npm - @morojs/moro - Versions diffs - 1.8.14 → 1.8.16 - Mend

@morojs/moro 1.8.14 → 1.8.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (24) hide show

package/dist/core/http/http2-server.d.ts +1 -0
package/dist/core/http/http2-server.js +32 -10
package/dist/core/http/http2-server.js.map +1 -1
package/dist/core/http/moro-engine-server.d.ts +4 -0
package/dist/core/http/moro-engine-server.js +96 -47
package/dist/core/http/moro-engine-server.js.map +1 -1
package/dist/core/http/utils/compression.d.ts +34 -4
package/dist/core/http/utils/compression.js +146 -27
package/dist/core/http/utils/compression.js.map +1 -1
package/dist/core/http/uws-http-server.js +2 -2
package/dist/core/http/uws-http-server.js.map +1 -1
package/dist/core/middleware/built-in/compression/core.d.ts +4 -2
package/dist/core/middleware/built-in/compression/core.js +13 -3
package/dist/core/middleware/built-in/compression/core.js.map +1 -1
package/dist/core/middleware/built-in/static/core.d.ts +88 -0
package/dist/core/middleware/built-in/static/core.js +321 -15
package/dist/core/middleware/built-in/static/core.js.map +1 -1
package/dist/core/networking/adapters/engine-adapter.js +65 -10
package/dist/core/networking/adapters/engine-adapter.js.map +1 -1
package/dist/types/config.d.ts +7 -0
package/dist/types/config.js.map +1 -1
package/dist/types/core.d.ts +1 -0
package/dist/types/core.js.map +1 -1
package/package.json +2 -2

package/dist/types/config.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA,0DAA0D","sourcesContent":["// TypeScript-based Configuration Types for Moro Framework\n\n/*\n CORS origin function type for dynamic origin validation\n /\nexport type OriginFunction = (\n origin: string \| undefined,\n req: any\n) => string \| string[] \| boolean \| Promise<string \| string[] \| boolean>;\n\n/\n Deep partial type that makes all properties and nested properties optional\n * Used for user-provided configuration where only partial overrides are needed\n /\nexport type DeepPartial<T> = T extends object\n ? T extends Array<infer U>\n ? Array<DeepPartial<U>>\n : T extends (...args: any[]) => any\n ? T\n : { [P in keyof T]?: DeepPartial<T[P]> }\n : T;\n\n/* Unified SSL/TLS config (superset of both historical shapes). /\nexport interface SSLConfig {\n /* File-path shape (uWS-style; keyFile/certFile also accepted) /\n key_file_name?: string;\n cert_file_name?: string;\n ca_file_name?: string \| string[];\n keyFile?: string;\n certFile?: string;\n caFile?: string \| string[];\n /* Inline-PEM shape (node-style) /\n key?: string \| Buffer;\n cert?: string \| Buffer;\n ca?: string \| Buffer \| Array<string \| Buffer>;\n passphrase?: string;\n minVersion?: 'TLSv1.2' \| 'TLSv1.3';\n requestCert?: boolean;\n rejectUnauthorized?: boolean;\n /\n Reload the certificate when the key/cert files change on disk (file-path\n * shape only; `true` = 1000 ms debounce). Equivalent to calling\n * `app.reloadTLS()` after each change.\n /\n watch?: boolean \| { debounceMs?: number };\n}\n\n/* Per-phase receive timeouts. 0 = use the per-server default / disabled. /\nexport interface ServerTimeoutsConfig {\n /* Full-request receive budget (ms); does NOT reset on activity. /\n request?: number;\n /* Socket inactivity timeout (ms). /\n idle?: number;\n /* Node keep-alive socket timeout (ms). Default 5000. /\n keepAlive?: number;\n /* Node headers-received timeout (ms). Default 6000. /\n headers?: number;\n}\n\nexport interface MultipartLimitsConfig {\n maxParts?: number;\n maxPartHeaderBytes?: number \| string;\n maxFiles?: number;\n maxFileSize?: number \| string;\n}\n\n/* Fine-grained limits; every value is a documented default, not a hard cap. /\nexport interface ServerLimitsConfig {\n /* Max request head (request line + headers) size. Node maxHeaderSize / engine maxHeadSize. /\n maxHeaderSize?: number \| string;\n /* Max header count. Node maxHeadersCount / engine maxHeaders. /\n maxHeaders?: number;\n multipart?: MultipartLimitsConfig;\n /* Reassembled WebSocket message cap (engine wsMaxMessageSize). /\n wsMaxMessageSize?: number \| string;\n /* WebSocket send backpressure cap (engine wsBackpressureLimit). 0 = unlimited. /\n wsBackpressureLimit?: number \| string;\n /* Write-queue high-water mark (engine writeHighWaterMark). /\n writeHighWaterMark?: number \| string;\n /* Per-connection not-yet-parsed backlog cap (engine maxPendingBytes). /\n maxPendingBytes?: number \| string;\n}\n\nexport interface Http2SettingsConfig {\n maxConcurrentStreams?: number;\n initialWindowSize?: number;\n maxFrameSize?: number;\n maxHeaderListSize?: number;\n headerTableSize?: number;\n enablePush?: boolean;\n enableConnectProtocol?: boolean;\n maxHeaderSize?: number;\n}\n\nexport interface ServerConfig {\n port: number;\n host: string;\n maxConnections: number;\n /* @deprecated Use timeouts.request. Kept as an alias; still honored. /\n timeout: number;\n bodySizeLimit: string;\n maxUploadSize: string; // Maximum size for file uploads (multipart/form-data)\n /* Per-phase receive timeouts (finally applied to every runtime). /\n timeouts?: ServerTimeoutsConfig;\n /* Fine-grained size/count limits, passed through to whichever runtime serves. /\n limits?: ServerLimitsConfig;\n /* TCP listen backlog. /\n backlog?: number;\n /* HTTP/2: true, or an options object. Served natively by the engine when\n * it supports h2 (feature-detected), else by the Node http2 server. /\n http2?:\n boolean \| { allowHTTP1?: boolean; maxSessionMemory?: number; settings?: Http2SettingsConfig };\n requestTracking: {\n enabled: boolean;\n };\n requestLogging: {\n enabled: boolean;\n };\n errorBoundary: {\n enabled: boolean;\n };\n /\n HTTP engine selection. Default: 'moro'.\n * - 'moro' (default): Moro's own native engine (@morojs/engine), falling back\n * to the Node.js http server if it cannot load on this platform/Node ABI\n * - 'node': the Node.js http server (no native engine)\n * - 'uws': opt in to uWebSockets.js, falling back to Node.js if it cannot load\n * Any chosen engine that cannot load degrades to Node.js and logs why; the app\n * never fails to boot. Inspect what actually booted via app.engine.\n /\n engine?: 'moro' \| 'node' \| 'uws';\n /* @deprecated Use engine: 'uws' instead. Enable uWebSockets for both HTTP and WebSocket /\n useUWebSockets?: boolean;\n /* Unified SSL/TLS config; flows to whichever runtime serves. /\n ssl?: SSLConfig;\n}\n\nexport interface ServiceDiscoveryConfig {\n enabled: boolean;\n type: 'memory' \| 'consul' \| 'kubernetes';\n consulUrl: string;\n kubernetesNamespace: string;\n healthCheckInterval: number;\n retryAttempts: number;\n}\n\nexport interface DatabaseConfig {\n url?: string;\n redis?: {\n url: string;\n maxRetries: number;\n retryDelay: number;\n keyPrefix: string;\n };\n mysql?: {\n host: string;\n port: number;\n database?: string;\n username?: string;\n password?: string;\n connectionLimit: number;\n acquireTimeout: number;\n timeout: number;\n };\n postgresql?: {\n host: string;\n port: number;\n database?: string;\n user?: string;\n password?: string;\n connectionLimit: number;\n ssl?: boolean;\n };\n sqlite?: {\n filename: string;\n memory?: boolean;\n verbose?: boolean;\n };\n mongodb?: {\n url?: string;\n host?: string;\n port?: number;\n database?: string;\n username?: string;\n password?: string;\n };\n}\n\n// Validation error context passed to error handlers\nexport interface ValidationErrorContext {\n request: {\n method: string;\n path: string;\n url: string;\n headers: Record<string, any>;\n };\n route?: {\n path: string;\n method: string;\n };\n field: 'body' \| 'query' \| 'params' \| 'headers';\n}\n\n// Validation error detail structure\nexport interface ValidationErrorDetail {\n field: string;\n message: string;\n code?: string;\n value?: any;\n path?: (string \| number)[];\n}\n\n// Validation error response structure\nexport interface ValidationErrorResponse {\n status: number;\n body: any;\n headers?: Record<string, string>;\n}\n\n// Validation error handler function type\nexport type ValidationErrorHandler = (\n errors: ValidationErrorDetail[],\n context: ValidationErrorContext\n) => ValidationErrorResponse;\n\nexport interface ModuleDefaultsConfig {\n apiPrefix?: string; // Prefix for module routes, defaults to '/api/' - set to empty string '' to disable\n cache: {\n enabled: boolean;\n defaultTtl: number;\n maxSize: number;\n strategy: 'lru' \| 'lfu' \| 'fifo';\n };\n rateLimit: {\n enabled: boolean;\n defaultRequests: number;\n defaultWindow: number;\n skipSuccessfulRequests: boolean;\n skipFailedRequests: boolean;\n };\n validation: {\n enabled: boolean;\n stripUnknown: boolean;\n abortEarly: boolean;\n allowUnknown?: boolean;\n onError?: ValidationErrorHandler;\n };\n session?: {\n enabled: boolean;\n store: 'memory' \| 'redis' \| 'file';\n storeOptions?: {\n url?: string;\n host?: string;\n port?: number;\n password?: string;\n keyPrefix?: string;\n path?: string;\n max?: number;\n };\n secret?: string;\n name?: string;\n rolling?: boolean;\n resave?: boolean;\n saveUninitialized?: boolean;\n cookie?: {\n maxAge?: number;\n httpOnly?: boolean;\n secure?: boolean;\n sameSite?: 'strict' \| 'lax' \| 'none';\n domain?: string;\n path?: string;\n };\n proxy?: boolean;\n unset?: 'destroy' \| 'keep';\n };\n autoDiscovery: {\n enabled: boolean;\n paths: string[];\n patterns: string[];\n recursive: boolean;\n loadingStrategy: 'eager' \| 'lazy' \| 'conditional';\n watchForChanges: boolean;\n ignorePatterns: string[];\n loadOrder: 'alphabetical' \| 'dependency' \| 'custom';\n failOnError: boolean;\n maxDepth: number;\n };\n}\n\nexport interface LoggingConfig {\n level: 'debug' \| 'info' \| 'warn' \| 'error' \| 'fatal';\n format: 'pretty' \| 'json' \| 'compact';\n enableColors: boolean;\n enableTimestamp: boolean;\n enableContext: boolean;\n // Opt-in: appends a JSON metadata object (e.g. {\"framework\":\"moro\",...}) to pretty log lines.\n // Has no effect on 'json' format - structured output always includes metadata.\n enableMetadata: boolean;\n // Opt-in: collects and renders per-log performance data such as memory usage (e.g. \"(210MB)\").\n // Disabling skips the process.memoryUsage() call on every log line.\n enablePerformance: boolean;\n outputs: {\n console: boolean;\n file: {\n enabled: boolean;\n path: string;\n maxSize: string;\n maxFiles: number;\n };\n webhook: {\n enabled: boolean;\n url?: string;\n headers: Record<string, string>;\n };\n };\n}\n\nexport interface SecurityConfig {\n cors: {\n enabled: boolean;\n origin: string \| string[] \| boolean \| OriginFunction;\n methods: string[];\n allowedHeaders: string[];\n exposedHeaders?: string[];\n credentials: boolean;\n maxAge?: number;\n preflightContinue?: boolean;\n };\n helmet: {\n enabled: boolean;\n // Simplified options (backward compatible)\n contentSecurityPolicy?: boolean;\n hsts?: boolean;\n noSniff?: boolean;\n frameguard?: boolean;\n // Detailed options (for advanced configuration)\n xFrameOptions?: 'DENY' \| 'SAMEORIGIN';\n xContentTypeOptions?: boolean;\n xXssProtection?: boolean;\n referrerPolicy?: string;\n strictTransportSecurity?: { maxAge?: number; includeSubDomains?: boolean };\n xDownloadOptions?: boolean;\n xPermittedCrossDomainPolicies?: boolean;\n };\n csrf?: {\n enabled: boolean;\n secret?: string;\n tokenLength?: number;\n cookieName?: string;\n headerName?: string;\n ignoreMethods?: string[];\n sameSite?: boolean;\n };\n csp?: {\n enabled: boolean;\n directives?: {\n defaultSrc?: string[];\n scriptSrc?: string[];\n styleSrc?: string[];\n imgSrc?: string[];\n connectSrc?: string[];\n fontSrc?: string[];\n objectSrc?: string[];\n mediaSrc?: string[];\n frameSrc?: string[];\n childSrc?: string[];\n workerSrc?: string[];\n formAction?: string[];\n upgradeInsecureRequests?: boolean;\n blockAllMixedContent?: boolean;\n };\n reportOnly?: boolean;\n reportUri?: string;\n nonce?: boolean;\n };\n rateLimit: {\n global: {\n enabled: boolean;\n requests: number;\n window: number;\n };\n };\n}\n\nexport interface ExternalServicesConfig {\n stripe?: {\n secretKey?: string \| undefined;\n publishableKey?: string \| undefined;\n webhookSecret?: string \| undefined;\n apiVersion: string;\n };\n paypal?: {\n clientId?: string \| undefined;\n clientSecret?: string \| undefined;\n webhookId?: string \| undefined;\n environment: 'sandbox' \| 'production';\n };\n smtp?: {\n host?: string \| undefined;\n port: number;\n secure: boolean;\n username?: string \| undefined;\n password?: string \| undefined;\n };\n}\n\nexport interface PerformanceConfig {\n compression: {\n enabled: boolean;\n level: number;\n threshold: number;\n /* Encoding preference order (default ['br','gzip','deflate']). /\n encodings?: Array<'br' \| 'gzip' \| 'deflate'>;\n /\n Bodies at or below this size are compressed on the calling thread and\n * sent with a Content-Length; larger ones are compressed on the\n * threadpool and streamed. 0 sends every body through the pool.\n * Default 16384.\n */\n maxInlineBytes?: number;\n };\n circuitBreaker: {\n enabled: boolean;\n failureThreshold: number;\n resetTimeout: number;\n monitoringPeriod: number;\n };\n clustering: {\n enabled: boolean;\n workers: number \| 'auto';\n memoryPerWorkerGB?: number \| undefined;\n };\n}\n\nexport interface WebSocketConfig {\n enabled: boolean;\n adapter?: string \| 'socket.io' \| 'ws' \| 'uws';\n compression?: boolean;\n customIdGenerator?: () => string;\n options?: {\n cors?: {\n origin?: string \| string[];\n credentials?: boolean;\n };\n path?: string;\n maxPayloadLength?: number;\n idleTimeout?: number;\n ssl?: {\n key_file_name?: string;\n cert_file_name?: string;\n passphrase?: string;\n };\n };\n}\n\nexport interface JobsConfig {\n enabled?: boolean;\n maxConcurrentJobs?: number;\n gracefulShutdownTimeout?: number;\n leaderElection?: {\n enabled?: boolean;\n strategy?: 'file' \| 'redis' \| 'none';\n lockPath?: string;\n lockTimeout?: number;\n heartbeatInterval?: number;\n };\n executor?: {\n maxRetries?: number;\n retryDelay?: number;\n retryBackoff?: 'linear' \| 'exponential';\n retryBackoffMultiplier?: number;\n maxRetryDelay?: number;\n timeout?: number;\n enableCircuitBreaker?: boolean;\n circuitBreakerThreshold?: number;\n circuitBreakerResetTimeout?: number;\n enableMemoryMonitoring?: boolean;\n memoryThreshold?: number;\n };\n stateManager?: {\n persistPath?: string;\n historySize?: number;\n persistInterval?: number;\n enableAutoPersist?: boolean;\n enableRecovery?: boolean;\n };\n}\n\n// File-based routing configuration. When enabled, route files under the\n// configured directories are imported during startup (after module discovery)\n// so their `getApp().get(...)` registrations execute automatically.\nexport interface RoutingConfig {\n enabled: boolean;\n // Directories scanned via loadRoutes(). Defaults to ./src/routes in\n // development and ./dist/(src/)routes in production when omitted.\n paths?: string[];\n}\n\n// Main configuration interface\nexport interface AppConfig {\n server: ServerConfig;\n serviceDiscovery: ServiceDiscoveryConfig;\n database: DatabaseConfig;\n modules: ModuleDefaultsConfig;\n // Enable file-based auto routing (./src/routes). Defaults to true.\n routing: boolean \| RoutingConfig;\n logging: LoggingConfig;\n security: SecurityConfig;\n external: ExternalServicesConfig;\n performance: PerformanceConfig;\n websocket: WebSocketConfig;\n jobs?: JobsConfig;\n queue?: QueueConfig;\n}\n\n// Queue Configuration\nexport interface QueueConfig {\n adapter?: 'bull' \| 'rabbitmq' \| 'sqs' \| 'kafka' \| 'memory';\n connection?: {\n host?: string;\n port?: number;\n username?: string;\n password?: string;\n database?: number;\n brokers?: string[];\n groupId?: string;\n region?: string;\n queueUrl?: string;\n [key: string]: any;\n };\n concurrency?: number;\n retry?: {\n maxAttempts: number;\n backoff: 'fixed' \| 'exponential' \| 'linear';\n initialDelay: number;\n maxDelay?: number;\n };\n deadLetterQueue?: {\n enabled: boolean;\n maxRetries: number;\n queueName?: string;\n };\n defaultJobOptions?: {\n removeOnComplete?: boolean \| number;\n removeOnFail?: boolean \| number;\n attempts?: number;\n backoff?: {\n type: 'fixed' \| 'exponential' \| 'linear';\n delay: number;\n };\n };\n prefix?: string;\n limiter?: {\n max: number;\n duration: number;\n };\n}\n"]}
1	+ {"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA,0DAA0D","sourcesContent":["// TypeScript-based Configuration Types for Moro Framework\n\n/*\n CORS origin function type for dynamic origin validation\n /\nexport type OriginFunction = (\n origin: string \| undefined,\n req: any\n) => string \| string[] \| boolean \| Promise<string \| string[] \| boolean>;\n\n/\n Deep partial type that makes all properties and nested properties optional\n * Used for user-provided configuration where only partial overrides are needed\n /\nexport type DeepPartial<T> = T extends object\n ? T extends Array<infer U>\n ? Array<DeepPartial<U>>\n : T extends (...args: any[]) => any\n ? T\n : { [P in keyof T]?: DeepPartial<T[P]> }\n : T;\n\n/* Unified SSL/TLS config (superset of both historical shapes). /\nexport interface SSLConfig {\n /* File-path shape (uWS-style; keyFile/certFile also accepted) /\n key_file_name?: string;\n cert_file_name?: string;\n ca_file_name?: string \| string[];\n keyFile?: string;\n certFile?: string;\n caFile?: string \| string[];\n /* Inline-PEM shape (node-style) /\n key?: string \| Buffer;\n cert?: string \| Buffer;\n ca?: string \| Buffer \| Array<string \| Buffer>;\n passphrase?: string;\n minVersion?: 'TLSv1.2' \| 'TLSv1.3';\n requestCert?: boolean;\n rejectUnauthorized?: boolean;\n /\n Reload the certificate when the key/cert files change on disk (file-path\n * shape only; `true` = 1000 ms debounce). Equivalent to calling\n * `app.reloadTLS()` after each change.\n /\n watch?: boolean \| { debounceMs?: number };\n}\n\n/* Per-phase receive timeouts. 0 = use the per-server default / disabled. /\nexport interface ServerTimeoutsConfig {\n /* Full-request receive budget (ms); does NOT reset on activity. /\n request?: number;\n /* Socket inactivity timeout (ms). /\n idle?: number;\n /* Node keep-alive socket timeout (ms). Default 5000. /\n keepAlive?: number;\n /* Node headers-received timeout (ms). Default 6000. /\n headers?: number;\n}\n\nexport interface MultipartLimitsConfig {\n maxParts?: number;\n maxPartHeaderBytes?: number \| string;\n maxFiles?: number;\n maxFileSize?: number \| string;\n}\n\n/* Fine-grained limits; every value is a documented default, not a hard cap. /\nexport interface ServerLimitsConfig {\n /* Max request head (request line + headers) size. Node maxHeaderSize / engine maxHeadSize. /\n maxHeaderSize?: number \| string;\n /* Max header count. Node maxHeadersCount / engine maxHeaders. /\n maxHeaders?: number;\n multipart?: MultipartLimitsConfig;\n /* Reassembled WebSocket message cap (engine wsMaxMessageSize). /\n wsMaxMessageSize?: number \| string;\n /* WebSocket send backpressure cap (engine wsBackpressureLimit). 0 = unlimited. /\n wsBackpressureLimit?: number \| string;\n /* Write-queue high-water mark (engine writeHighWaterMark). /\n writeHighWaterMark?: number \| string;\n /* Per-connection not-yet-parsed backlog cap (engine maxPendingBytes). /\n maxPendingBytes?: number \| string;\n}\n\nexport interface Http2SettingsConfig {\n maxConcurrentStreams?: number;\n initialWindowSize?: number;\n maxFrameSize?: number;\n maxHeaderListSize?: number;\n headerTableSize?: number;\n /* Accepted for compatibility but never sent: RFC 9113 forbids a server from advertising ENABLE_PUSH=1 (clients drop the connection), and whether push is possible is the client's setting, read per stream. /\n enablePush?: boolean;\n enableConnectProtocol?: boolean;\n maxHeaderSize?: number;\n}\n\nexport interface ServerConfig {\n port: number;\n host: string;\n maxConnections: number;\n /* @deprecated Use timeouts.request. Kept as an alias; still honored. /\n timeout: number;\n bodySizeLimit: string;\n maxUploadSize: string; // Maximum size for file uploads (multipart/form-data)\n /* Per-phase receive timeouts (finally applied to every runtime). /\n timeouts?: ServerTimeoutsConfig;\n /* Fine-grained size/count limits, passed through to whichever runtime serves. /\n limits?: ServerLimitsConfig;\n /* TCP listen backlog. /\n backlog?: number;\n /* HTTP/2: true, or an options object. Served natively by the engine when\n * it supports h2 (feature-detected), else by the Node http2 server. /\n http2?:\n boolean \| { allowHTTP1?: boolean; maxSessionMemory?: number; settings?: Http2SettingsConfig };\n requestTracking: {\n enabled: boolean;\n };\n requestLogging: {\n enabled: boolean;\n };\n errorBoundary: {\n enabled: boolean;\n };\n /\n HTTP engine selection. Default: 'moro'.\n * - 'moro' (default): Moro's own native engine (@morojs/engine), falling back\n * to the Node.js http server if it cannot load on this platform/Node ABI\n * - 'node': the Node.js http server (no native engine)\n * - 'uws': opt in to uWebSockets.js, falling back to Node.js if it cannot load\n * Any chosen engine that cannot load degrades to Node.js and logs why; the app\n * never fails to boot. Inspect what actually booted via app.engine.\n /\n engine?: 'moro' \| 'node' \| 'uws';\n /* @deprecated Use engine: 'uws' instead. Enable uWebSockets for both HTTP and WebSocket /\n useUWebSockets?: boolean;\n /* Unified SSL/TLS config; flows to whichever runtime serves. /\n ssl?: SSLConfig;\n}\n\nexport interface ServiceDiscoveryConfig {\n enabled: boolean;\n type: 'memory' \| 'consul' \| 'kubernetes';\n consulUrl: string;\n kubernetesNamespace: string;\n healthCheckInterval: number;\n retryAttempts: number;\n}\n\nexport interface DatabaseConfig {\n url?: string;\n redis?: {\n url: string;\n maxRetries: number;\n retryDelay: number;\n keyPrefix: string;\n };\n mysql?: {\n host: string;\n port: number;\n database?: string;\n username?: string;\n password?: string;\n connectionLimit: number;\n acquireTimeout: number;\n timeout: number;\n };\n postgresql?: {\n host: string;\n port: number;\n database?: string;\n user?: string;\n password?: string;\n connectionLimit: number;\n ssl?: boolean;\n };\n sqlite?: {\n filename: string;\n memory?: boolean;\n verbose?: boolean;\n };\n mongodb?: {\n url?: string;\n host?: string;\n port?: number;\n database?: string;\n username?: string;\n password?: string;\n };\n}\n\n// Validation error context passed to error handlers\nexport interface ValidationErrorContext {\n request: {\n method: string;\n path: string;\n url: string;\n headers: Record<string, any>;\n };\n route?: {\n path: string;\n method: string;\n };\n field: 'body' \| 'query' \| 'params' \| 'headers';\n}\n\n// Validation error detail structure\nexport interface ValidationErrorDetail {\n field: string;\n message: string;\n code?: string;\n value?: any;\n path?: (string \| number)[];\n}\n\n// Validation error response structure\nexport interface ValidationErrorResponse {\n status: number;\n body: any;\n headers?: Record<string, string>;\n}\n\n// Validation error handler function type\nexport type ValidationErrorHandler = (\n errors: ValidationErrorDetail[],\n context: ValidationErrorContext\n) => ValidationErrorResponse;\n\nexport interface ModuleDefaultsConfig {\n apiPrefix?: string; // Prefix for module routes, defaults to '/api/' - set to empty string '' to disable\n cache: {\n enabled: boolean;\n defaultTtl: number;\n maxSize: number;\n strategy: 'lru' \| 'lfu' \| 'fifo';\n };\n rateLimit: {\n enabled: boolean;\n defaultRequests: number;\n defaultWindow: number;\n skipSuccessfulRequests: boolean;\n skipFailedRequests: boolean;\n };\n validation: {\n enabled: boolean;\n stripUnknown: boolean;\n abortEarly: boolean;\n allowUnknown?: boolean;\n onError?: ValidationErrorHandler;\n };\n session?: {\n enabled: boolean;\n store: 'memory' \| 'redis' \| 'file';\n storeOptions?: {\n url?: string;\n host?: string;\n port?: number;\n password?: string;\n keyPrefix?: string;\n path?: string;\n max?: number;\n };\n secret?: string;\n name?: string;\n rolling?: boolean;\n resave?: boolean;\n saveUninitialized?: boolean;\n cookie?: {\n maxAge?: number;\n httpOnly?: boolean;\n secure?: boolean;\n sameSite?: 'strict' \| 'lax' \| 'none';\n domain?: string;\n path?: string;\n };\n proxy?: boolean;\n unset?: 'destroy' \| 'keep';\n };\n autoDiscovery: {\n enabled: boolean;\n paths: string[];\n patterns: string[];\n recursive: boolean;\n loadingStrategy: 'eager' \| 'lazy' \| 'conditional';\n watchForChanges: boolean;\n ignorePatterns: string[];\n loadOrder: 'alphabetical' \| 'dependency' \| 'custom';\n failOnError: boolean;\n maxDepth: number;\n };\n}\n\nexport interface LoggingConfig {\n level: 'debug' \| 'info' \| 'warn' \| 'error' \| 'fatal';\n format: 'pretty' \| 'json' \| 'compact';\n enableColors: boolean;\n enableTimestamp: boolean;\n enableContext: boolean;\n // Opt-in: appends a JSON metadata object (e.g. {\"framework\":\"moro\",...}) to pretty log lines.\n // Has no effect on 'json' format - structured output always includes metadata.\n enableMetadata: boolean;\n // Opt-in: collects and renders per-log performance data such as memory usage (e.g. \"(210MB)\").\n // Disabling skips the process.memoryUsage() call on every log line.\n enablePerformance: boolean;\n outputs: {\n console: boolean;\n file: {\n enabled: boolean;\n path: string;\n maxSize: string;\n maxFiles: number;\n };\n webhook: {\n enabled: boolean;\n url?: string;\n headers: Record<string, string>;\n };\n };\n}\n\nexport interface SecurityConfig {\n cors: {\n enabled: boolean;\n origin: string \| string[] \| boolean \| OriginFunction;\n methods: string[];\n allowedHeaders: string[];\n exposedHeaders?: string[];\n credentials: boolean;\n maxAge?: number;\n preflightContinue?: boolean;\n };\n helmet: {\n enabled: boolean;\n // Simplified options (backward compatible)\n contentSecurityPolicy?: boolean;\n hsts?: boolean;\n noSniff?: boolean;\n frameguard?: boolean;\n // Detailed options (for advanced configuration)\n xFrameOptions?: 'DENY' \| 'SAMEORIGIN';\n xContentTypeOptions?: boolean;\n xXssProtection?: boolean;\n referrerPolicy?: string;\n strictTransportSecurity?: { maxAge?: number; includeSubDomains?: boolean };\n xDownloadOptions?: boolean;\n xPermittedCrossDomainPolicies?: boolean;\n };\n csrf?: {\n enabled: boolean;\n secret?: string;\n tokenLength?: number;\n cookieName?: string;\n headerName?: string;\n ignoreMethods?: string[];\n sameSite?: boolean;\n };\n csp?: {\n enabled: boolean;\n directives?: {\n defaultSrc?: string[];\n scriptSrc?: string[];\n styleSrc?: string[];\n imgSrc?: string[];\n connectSrc?: string[];\n fontSrc?: string[];\n objectSrc?: string[];\n mediaSrc?: string[];\n frameSrc?: string[];\n childSrc?: string[];\n workerSrc?: string[];\n formAction?: string[];\n upgradeInsecureRequests?: boolean;\n blockAllMixedContent?: boolean;\n };\n reportOnly?: boolean;\n reportUri?: string;\n nonce?: boolean;\n };\n rateLimit: {\n global: {\n enabled: boolean;\n requests: number;\n window: number;\n };\n };\n}\n\nexport interface ExternalServicesConfig {\n stripe?: {\n secretKey?: string \| undefined;\n publishableKey?: string \| undefined;\n webhookSecret?: string \| undefined;\n apiVersion: string;\n };\n paypal?: {\n clientId?: string \| undefined;\n clientSecret?: string \| undefined;\n webhookId?: string \| undefined;\n environment: 'sandbox' \| 'production';\n };\n smtp?: {\n host?: string \| undefined;\n port: number;\n secure: boolean;\n username?: string \| undefined;\n password?: string \| undefined;\n };\n}\n\nexport interface PerformanceConfig {\n compression: {\n enabled: boolean;\n level: number;\n threshold: number;\n /* Encoding preference order (default ['br','gzip','deflate']). /\n encodings?: Array<'br' \| 'gzip' \| 'deflate'>;\n /\n Bodies at or below this size are compressed on the calling thread and\n * sent with a Content-Length; larger ones are compressed on the\n * threadpool and streamed. 0 sends every body through the pool.\n * Default 16384.\n /\n maxInlineBytes?: number;\n /* zlib options for gzip/deflate; a `level` here wins over the shared level. /\n gzip?: import('zlib').ZlibOptions;\n /* brotli options; a quality under `params` wins over the one the shared level maps to. /\n brotli?: import('zlib').BrotliOptions;\n /* Keep one gzip encoder per setting and reset it between bodies (default true). */\n reuseEncoders?: boolean;\n };\n circuitBreaker: {\n enabled: boolean;\n failureThreshold: number;\n resetTimeout: number;\n monitoringPeriod: number;\n };\n clustering: {\n enabled: boolean;\n workers: number \| 'auto';\n memoryPerWorkerGB?: number \| undefined;\n };\n}\n\nexport interface WebSocketConfig {\n enabled: boolean;\n adapter?: string \| 'socket.io' \| 'ws' \| 'uws';\n compression?: boolean;\n customIdGenerator?: () => string;\n options?: {\n cors?: {\n origin?: string \| string[];\n credentials?: boolean;\n };\n path?: string;\n maxPayloadLength?: number;\n idleTimeout?: number;\n ssl?: {\n key_file_name?: string;\n cert_file_name?: string;\n passphrase?: string;\n };\n };\n}\n\nexport interface JobsConfig {\n enabled?: boolean;\n maxConcurrentJobs?: number;\n gracefulShutdownTimeout?: number;\n leaderElection?: {\n enabled?: boolean;\n strategy?: 'file' \| 'redis' \| 'none';\n lockPath?: string;\n lockTimeout?: number;\n heartbeatInterval?: number;\n };\n executor?: {\n maxRetries?: number;\n retryDelay?: number;\n retryBackoff?: 'linear' \| 'exponential';\n retryBackoffMultiplier?: number;\n maxRetryDelay?: number;\n timeout?: number;\n enableCircuitBreaker?: boolean;\n circuitBreakerThreshold?: number;\n circuitBreakerResetTimeout?: number;\n enableMemoryMonitoring?: boolean;\n memoryThreshold?: number;\n };\n stateManager?: {\n persistPath?: string;\n historySize?: number;\n persistInterval?: number;\n enableAutoPersist?: boolean;\n enableRecovery?: boolean;\n };\n}\n\n// File-based routing configuration. When enabled, route files under the\n// configured directories are imported during startup (after module discovery)\n// so their `getApp().get(...)` registrations execute automatically.\nexport interface RoutingConfig {\n enabled: boolean;\n // Directories scanned via loadRoutes(). Defaults to ./src/routes in\n // development and ./dist/(src/)routes in production when omitted.\n paths?: string[];\n}\n\n// Main configuration interface\nexport interface AppConfig {\n server: ServerConfig;\n serviceDiscovery: ServiceDiscoveryConfig;\n database: DatabaseConfig;\n modules: ModuleDefaultsConfig;\n // Enable file-based auto routing (./src/routes). Defaults to true.\n routing: boolean \| RoutingConfig;\n logging: LoggingConfig;\n security: SecurityConfig;\n external: ExternalServicesConfig;\n performance: PerformanceConfig;\n websocket: WebSocketConfig;\n jobs?: JobsConfig;\n queue?: QueueConfig;\n}\n\n// Queue Configuration\nexport interface QueueConfig {\n adapter?: 'bull' \| 'rabbitmq' \| 'sqs' \| 'kafka' \| 'memory';\n connection?: {\n host?: string;\n port?: number;\n username?: string;\n password?: string;\n database?: number;\n brokers?: string[];\n groupId?: string;\n region?: string;\n queueUrl?: string;\n [key: string]: any;\n };\n concurrency?: number;\n retry?: {\n maxAttempts: number;\n backoff: 'fixed' \| 'exponential' \| 'linear';\n initialDelay: number;\n maxDelay?: number;\n };\n deadLetterQueue?: {\n enabled: boolean;\n maxRetries: number;\n queueName?: string;\n };\n defaultJobOptions?: {\n removeOnComplete?: boolean \| number;\n removeOnFail?: boolean \| number;\n attempts?: number;\n backoff?: {\n type: 'fixed' \| 'exponential' \| 'linear';\n delay: number;\n };\n };\n prefix?: string;\n limiter?: {\n max: number;\n duration: number;\n };\n}\n"]}

package/dist/types/core.d.ts CHANGED Viewed

@@ -22,6 +22,7 @@ export interface MoroOptions {
         maxSessionMemory?: number;
         settings?: {
             headerTableSize?: number;
+            /** Accepted for compatibility but never sent: RFC 9113 forbids a server from advertising ENABLE_PUSH=1 (clients drop the connection), and whether push is possible is the client's setting, read per stream. */
             enablePush?: boolean;
             initialWindowSize?: number;
             maxFrameSize?: number;

package/dist/types/core.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/types/core.ts"],"names":[],"mappings":"","sourcesContent":["// Core Framework Types\nimport { RuntimeConfig } from './runtime.js';\nimport { LoggerOptions } from './logger.js';\nimport { AppConfig, ValidationErrorHandler } from './config.js';\n\nexport interface MoroOptions {\n autoDiscover?:\n \| boolean\n \| {\n enabled?: boolean;\n paths?: string[];\n patterns?: string[];\n recursive?: boolean;\n loadingStrategy?: 'eager' \| 'lazy' \| 'conditional';\n watchForChanges?: boolean;\n ignorePatterns?: string[];\n loadOrder?: 'alphabetical' \| 'dependency' \| 'custom';\n failOnError?: boolean;\n maxDepth?: number;\n };\n modulesPath?: string; // Deprecated: use autoDiscover.paths instead\n middleware?: any[];\n\n // Runtime configuration\n runtime?: RuntimeConfig;\n\n // HTTP/WebSocket options\n http2?:\n \| boolean\n \| {\n allowHTTP1?: boolean;\n maxSessionMemory?: number;\n settings?: {\n headerTableSize?: number;\n enablePush?: boolean;\n initialWindowSize?: number;\n maxFrameSize?: number;\n maxConcurrentStreams?: number;\n maxHeaderListSize?: number;\n maxHeaderSize?: number;\n enableConnectProtocol?: boolean;\n };\n };\n https?: {\n key: string \| Buffer;\n cert: string \| Buffer;\n ca?: string \| Buffer;\n };\n websocket?:\n \| {\n enabled?: boolean;\n adapter?: any;\n compression?: boolean;\n customIdGenerator?: () => string;\n options?: any;\n }\n \| false;\n\n // Simplified config options (these map to the full config)\n cors?: boolean \| object;\n compression?: boolean \| object;\n helmet?: boolean \| object;\n logger?: LoggerOptions \| boolean;\n\n // Worker threads configuration\n workers?: {\n enabled?: boolean;\n count?: number;\n maxQueueSize?: number;\n };\n\n // Validation configuration (top-level for convenience, maps to modules.validation)\n validation?: {\n enabled?: boolean;\n stripUnknown?: boolean;\n abortEarly?: boolean;\n allowUnknown?: boolean;\n onError?: ValidationErrorHandler;\n };\n\n // Direct config overrides (partial)\n server?: Partial<AppConfig['server']>;\n database?: Partial<AppConfig['database']>;\n modules?: Partial<AppConfig['modules']>;\n logging?: Partial<AppConfig['logging']>;\n security?: Partial<AppConfig['security']>;\n external?: Partial<AppConfig['external']>;\n performance?: Partial<AppConfig['performance']>;\n jobs?: Partial<AppConfig['jobs']>;\n}\n"]}
1	+ {"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/types/core.ts"],"names":[],"mappings":"","sourcesContent":["// Core Framework Types\nimport { RuntimeConfig } from './runtime.js';\nimport { LoggerOptions } from './logger.js';\nimport { AppConfig, ValidationErrorHandler } from './config.js';\n\nexport interface MoroOptions {\n autoDiscover?:\n \| boolean\n \| {\n enabled?: boolean;\n paths?: string[];\n patterns?: string[];\n recursive?: boolean;\n loadingStrategy?: 'eager' \| 'lazy' \| 'conditional';\n watchForChanges?: boolean;\n ignorePatterns?: string[];\n loadOrder?: 'alphabetical' \| 'dependency' \| 'custom';\n failOnError?: boolean;\n maxDepth?: number;\n };\n modulesPath?: string; // Deprecated: use autoDiscover.paths instead\n middleware?: any[];\n\n // Runtime configuration\n runtime?: RuntimeConfig;\n\n // HTTP/WebSocket options\n http2?:\n \| boolean\n \| {\n allowHTTP1?: boolean;\n maxSessionMemory?: number;\n settings?: {\n headerTableSize?: number;\n /** Accepted for compatibility but never sent: RFC 9113 forbids a server from advertising ENABLE_PUSH=1 (clients drop the connection), and whether push is possible is the client's setting, read per stream. */\n enablePush?: boolean;\n initialWindowSize?: number;\n maxFrameSize?: number;\n maxConcurrentStreams?: number;\n maxHeaderListSize?: number;\n maxHeaderSize?: number;\n enableConnectProtocol?: boolean;\n };\n };\n https?: {\n key: string \| Buffer;\n cert: string \| Buffer;\n ca?: string \| Buffer;\n };\n websocket?:\n \| {\n enabled?: boolean;\n adapter?: any;\n compression?: boolean;\n customIdGenerator?: () => string;\n options?: any;\n }\n \| false;\n\n // Simplified config options (these map to the full config)\n cors?: boolean \| object;\n compression?: boolean \| object;\n helmet?: boolean \| object;\n logger?: LoggerOptions \| boolean;\n\n // Worker threads configuration\n workers?: {\n enabled?: boolean;\n count?: number;\n maxQueueSize?: number;\n };\n\n // Validation configuration (top-level for convenience, maps to modules.validation)\n validation?: {\n enabled?: boolean;\n stripUnknown?: boolean;\n abortEarly?: boolean;\n allowUnknown?: boolean;\n onError?: ValidationErrorHandler;\n };\n\n // Direct config overrides (partial)\n server?: Partial<AppConfig['server']>;\n database?: Partial<AppConfig['database']>;\n modules?: Partial<AppConfig['modules']>;\n logging?: Partial<AppConfig['logging']>;\n security?: Partial<AppConfig['security']>;\n external?: Partial<AppConfig['external']>;\n performance?: Partial<AppConfig['performance']>;\n jobs?: Partial<AppConfig['jobs']>;\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@morojs/moro",
-  "version": "1.8.14",
+  "version": "1.8.16",
   "description": "High-performance Node.js framework with intelligent routing, automatic middleware ordering, enterprise authentication (Better Auth), type-safe validation, and functional architecture",
   "type": "module",
   "main": "dist/index.js",
@@ -137,7 +137,7 @@
     "ejs": ">=3.1.10",
     "graphql": ">=16.12.0",
     "graphql-jit": ">=0.8.7",
-    "handlebars": ">=4.7.8",
+    "handlebars": ">=4.7.10",
     "ioredis": ">=5.7.0",
     "joi": ">=17.0.0",
     "kafkajs": ">=2.2.4",