@moxon/api 6.0.0-pre → 6.2.0

package/README.md

@@ -9,11 +9,11 @@ It works two ways:
 - **As a library** — import any module directly into your code.
 - **As a server** — a single import boots an Express app that exposes every module over HTTP.
 
-The HTTP surface is versioned from `v4` to `v6`, and every version stays mounted side by side, so a new release never changes the behaviour of the one you already target. The full endpoint reference lives on [docs.sylvain.sh](https://docs.sylvain.sh).
+The HTTP surface is versioned from `v4` to `v6`, and every version stays mounted side by side, so a new release never changes the behaviour of the one you already target. The full endpoint reference lives on [moxon.dev](https://moxon.dev).
 
 ## Migrating from `@20syldev/api`
 
-`@moxon/api` is the new name of `@20syldev/api`. This release is the code of `@20syldev/api@6.0.0` under its new name: same exports, same `/v6` HTTP API. Nothing else changed.
+`@moxon/api` is the new name of `@20syldev/api`, which no longer receives updates. `6.0.0-pre` carries the code of `@20syldev/api@6.0.0` under the new name, and every release since ships only as `@moxon/api`. The exports and the `/v6` HTTP API are unchanged, so migrating only takes a rename.
 
 ```bash
 npm uninstall @20syldev/api
@@ -75,15 +75,15 @@ console.log(user.username);
 
 ## What's inside
 
-| Domain             | Exports                                                                               |
-| ------------------ | ------------------------------------------------------------------------------------- |
-| **Crypto**         | `asymmetric` `symmetric` `hash` `jwt` `otp` `token` `password` `captcha`              |
-| **Math & data**    | **`matrix`** **`algorithms`** `evaluate` `statistics` `convert` `csv`                 |
-| **Text**           | **`text`** **`encode`** **`validate`** `caseConvert` `levenshtein` `regex` `parseUrl` |
-| **Graphics**       | **`chart`** `barcode` `qrcode` `avatar` `placeholder` `color` `palette`               |
-| **Fake data**      | `personal` `address` `credit` `username` `dice` `domain` `agent`                      |
-| **Network & time** | `ip` `geo` `time` `cron` `hyperplanning`                                              |
-| **Stateful**       | `chat` `tic_tac_toe`                                                                  |
+| Domain             | Exports                                                                                    |
+| ------------------ | ------------------------------------------------------------------------------------------ |
+| **Crypto**         | `asymmetric` `asymmetricAsync` `symmetric` `hash` `jwt` `otp` `token` `password` `captcha` |
+| **Math & data**    | **`matrix`** **`algorithms`** `evaluate` `statistics` `convert` `csv`                      |
+| **Text**           | **`text`** **`encode`** **`validate`** `caseConvert` `levenshtein` `regex` `parseUrl`      |
+| **Graphics**       | **`chart`** `barcode` `qrcode` `avatar` `placeholder` `color` `palette`                    |
+| **Fake data**      | `personal` `address` `credit` `username` `dice` `domain` `agent`                           |
+| **Network & time** | `ip` `geo` `time` `cron` `hyperplanning`                                                   |
+| **Stateful**       | `chat` `tic_tac_toe`                                                                       |
 
 The six names in **bold** are namespaces — they group related functions, called as `namespace.method()`:
 
@@ -112,6 +112,7 @@ Two names differ from their HTTP endpoint, because `case` is a reserved word and
 ```js
 import {
     asymmetric,
+    asymmetricAsync,
     caseConvert,
     chart,
     csv,
@@ -130,6 +131,10 @@ const { result: encrypted } = asymmetric('encrypt', { text: 'secret message', pu
 const { result: decrypted } = asymmetric('decrypt', { text: encrypted, privateKey });
 console.log(decrypted); // 'secret message'
 
+// Same result, but the key pair is generated off the main thread
+const keys = await asymmetricAsync('keygen', { modulusLength: 4096 });
+console.log(keys.modulusLength); // 4096
+
 // AES-256-GCM symmetric encryption, key derived with scrypt
 const { result: blob } = symmetric('encrypt', 'secret message', 'a-strong-key');
 const { result: plain } = symmetric('decrypt', blob, 'a-strong-key');
@@ -184,6 +189,21 @@ console.log(parsed.host, parsed.port, parsed.params, parsed.fragment);
 console.log(validate.email('alice@example.com').valid); // true
 ```
 
+## Endpoint manifest
+
+`@moxon/api/manifest` describes the HTTP endpoints as data — method, path, category, parameters and a request example — for tools that document or call the API. Each entry is typed as `ManifestEntry`.
+
+```js
+import { manifest } from '@moxon/api/manifest';
+
+const hash = manifest.find((entry) => entry.name === 'hash');
+console.log(hash.method, hash.path); // 'post' '/hash'
+console.log(Object.keys(hash.params)); // ['text', 'method', 'encoding']
+console.log(hash.example); // { text: 'hello', method: 'sha256' }
+```
+
+> _The manifest is experimental: it only lists the endpoints already declared as contracts (`hash` for now), and its shape may still change in a minor release._
+
 ## Running the server
 
 From the installed package, one import mounts every version:
@@ -199,10 +219,13 @@ $ npm run build && npm start
 ```
 
 ```console
-> @moxon/api@6.0.0-pre build
-> tsc
+> @moxon/api@6.2.0 build
+> npm run clean && tsc
 
-> @moxon/api@6.0.0-pre start
+> @moxon/api@6.2.0 clean
+> node -e "require('node:fs').rmSync('dist', { recursive: true, force: true })"
+
+> @moxon/api@6.2.0 start
 > node dist/app.js
 
 API is running on
@@ -216,7 +239,7 @@ For development with automatic reloading:
 $ npm run dev
 ```
 
-Endpoints follow the `/:version/:endpoint` pattern — `GET /v5/color`, `GET /v5/evaluate?expr=2%2B2`, `POST /v5/matrix`. `GET /` lists the available versions, and `GET /:version` lists that version's endpoints with their parameters.
+Endpoints follow the `/:version/:endpoint` pattern — `GET /v5/color`, `GET /v5/evaluate?expr=2%2B2`, `POST /v5/matrix`. `GET /` lists the available versions, and `GET /:version` lists that version's endpoints with their paths.
 
 ### Configuration
 
@@ -230,7 +253,7 @@ Every setting is optional and read from the environment; a `.env` file at the pr
 | `INSTANCE_CREATED` | —       | Launch date reported by `/:version/infos`                                                                                                              |
 | `LOGS_TOKEN`       | —       | Value required in the `X-Logs-Token` header to read `/logs`; the route answers 404 while unset                                                         |
 | `CHALLENGE_SECRET` | random  | Key signing the captcha and proof-of-work tokens; a random one is generated at startup while unset                                                     |
-| `TRUSTED_PROXIES`  | one hop | CIDR blocks separated by spaces or commas, or the `loopback` / `linklocal` / `uniquelocal` shorthands, for deployments behind a CDN or platform router |
+| `TRUSTED_PROXIES`  | one hop | CIDR blocks or `loopback` / `linklocal` / `uniquelocal`, space or comma separated; unset, exactly one reverse proxy is assumed and a warning is logged |
 | `GLOBAL_LIMIT`     | `50000` | Requests per hour accepted across the whole instance                                                                                                   |
 | `DEFAULT_LIMIT`    | `2000`  | Per-client requests per hour                                                                                                                           |
 | `DEFAULT_BURST`    | `50`    | Per-client requests per 10-second window                                                                                                               |
@@ -239,7 +262,9 @@ The three metadata variables are omitted from responses when unset, so an instan
 
 Higher quotas can be granted per client: `ADVANCED_`, `PRO_` and `BUSINESS_` variants of `_LIMIT` and `_BURST` define the tiers, and the matching `*_TOKEN_LIST` variables hold the space-separated bearer tokens that map to them. A client's tier and quota are reported by `GET /auth`.
 
-> _Rate-limit counters live in process memory, so each instance of a multi-instance deployment counts separately._
+> _Rate-limit counters live in process memory, so each instance of a multi-instance deployment counts separately. Clients are counted by address: an IPv4-mapped IPv6 address counts as its IPv4 form and any other IPv6 address as its `/64` block, while all the `/64` blocks of one `/48` network share four times the per-client hourly quota. A forwarded address that is not an IP address counts as the connecting peer. Only requests the per-client limits let through use the `GLOBAL_LIMIT` budget._
+
+> _The one-hop default reads the client address from the last `X-Forwarded-For` entry, which is right behind a single reverse proxy such as nginx or Caddy. Exposed directly, callers can forge that header and pick their own address; behind several hops, every caller is counted as the nearest proxy. Set `TRUSTED_PROXIES` to match the actual chain._
 
 > _Captcha and proof-of-work tokens are signed with `CHALLENGE_SECRET`. While it is unset each process invents its own key, so tokens stop verifying after a restart and are rejected by sibling instances — set it explicitly for any deployment running more than one process, with a full-entropy value such as `openssl rand -hex 32`._
 
@@ -268,9 +293,9 @@ Every version is fully typed. The package root always tracks the latest one.
 | `npm run format` | Format with Prettier and auto-fix with ESLint           |
 | `npm run check`  | TypeScript and ESLint verification                      |
 
-## Hosted instance
+## Documentation
 
-A public instance runs at [api.sylvain.sh](https://api.sylvain.sh), with the complete endpoint reference, request examples and usage guides on [docs.sylvain.sh](https://docs.sylvain.sh).
+The complete endpoint reference, request examples and usage guides live on [moxon.dev](https://moxon.dev).
 
 ## License
 

package/dist/app.js

@@ -1,6 +1,8 @@
 import express from 'express';
 import { env } from './config/env.js';
-import { setupCors } from './middleware/cors.js';
+import { endpoints } from './endpoints/index.js';
+import { build } from './endpoints/router.js';
+import { setupCors, setupParsers } from './middleware/cors.js';
 import { errorHandler } from './middleware/error.js';
 import { jsonResponseMiddleware } from './middleware/json.js';
 import { loggerMiddleware } from './middleware/logger.js';
@@ -13,12 +15,14 @@ import patchRoutes from './routes/patch.js';
 import postRoutes from './routes/post.js';
 import { error } from './utils/response.js';
 const app = express();
-// Setup CORS, body parsing, static files
+// Security headers, CORS, static files
 setupCors(app);
 // Custom JSON response
 app.use(jsonResponseMiddleware);
-// Rate limiting
+// Rate limiting, ahead of body parsing so malformed bodies are counted too
 app.use(rateLimitMiddleware);
+// Body parsing
+setupParsers(app);
 // Request logging
 app.use(loggerMiddleware);
 // Root routes (before version check)
@@ -36,7 +40,8 @@ try {
 catch {
     // No plugins bundled in this build
 }
-// Versioned routes
+// Versioned routes, declared endpoints first
+app.use(build(endpoints));
 app.use(getRoutes);
 app.use(postRoutes);
 app.use(patchRoutes);

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAqD,MAAM,SAAS,CAAC;AAE5E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAE5C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;AAEtB,yCAAyC;AACzC,SAAS,CAAC,GAAG,CAAC,CAAC;AAEf,uBAAuB;AACvB,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAEhC,gBAAgB;AAChB,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAE7B,kBAAkB;AAClB,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAE1B,qCAAqC;AACrC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAErB,gCAAgC;AAChC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;AAC7C,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;AAExD,4BAA4B;AAC5B,MAAM,KAAK,GAAG,oBAAoB,CAAC;AACnC,IAAI,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAA0B,CAAC;IAC5E,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAAC,MAAM,CAAC;IACL,mCAAmC;AACvC,CAAC;AAED,mBAAmB;AACnB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACnB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACpB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACrB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAEtB,oBAAoB;AACpB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACpC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,GAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEH,gCAAgC;AAChC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAEtB,eAAe;AACf,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;IAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CACtB,OAAO,CAAC,GAAG,CAAC,6CAA6C,GAAG,CAAC,IAAI,4BAA4B,GAAG,CAAC,IAAI,EAAE,CAAC,CAC3G,CAAC;AACN,CAAC;AAED,eAAe,GAAG,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAqD,MAAM,SAAS,CAAC;AAE5E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAE5C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;AAEtB,uCAAuC;AACvC,SAAS,CAAC,GAAG,CAAC,CAAC;AAEf,uBAAuB;AACvB,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAEhC,2EAA2E;AAC3E,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAE7B,eAAe;AACf,YAAY,CAAC,GAAG,CAAC,CAAC;AAElB,kBAAkB;AAClB,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAE1B,qCAAqC;AACrC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAErB,gCAAgC;AAChC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;AAC7C,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;AAExD,4BAA4B;AAC5B,MAAM,KAAK,GAAG,oBAAoB,CAAC;AACnC,IAAI,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAA0B,CAAC;IAC5E,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAAC,MAAM,CAAC;IACL,mCAAmC;AACvC,CAAC;AAED,6CAA6C;AAC7C,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1B,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACnB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACpB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACrB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAEtB,oBAAoB;AACpB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACpC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,GAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEH,gCAAgC;AAChC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAEtB,eAAe;AACf,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;IAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CACtB,OAAO,CAAC,GAAG,CAAC,6CAA6C,GAAG,CAAC,IAAI,4BAA4B,GAAG,CAAC,IAAI,EAAE,CAAC,CAC3G,CAAC;AACN,CAAC;AAED,eAAe,GAAG,CAAC"}

package/dist/constants.d.ts

@@ -1,22 +1,33 @@
 export declare const APP_VERSION: string;
 export declare const DEFAULT_PORT = 3000;
 export declare const START_TIME: number;
+export declare const CHALLENGE_MAX_ATTEMPTS = 5;
 export declare const CHALLENGE_TTL = 300000;
 export declare const GAME_CLEANUP_TTL = 600000;
 export declare const MAX_LOG_ENTRIES = 1000;
+export declare const RATE_LIMIT_IPV6_NETWORK = 48;
+export declare const RATE_LIMIT_IPV6_PREFIX = 64;
+export declare const RATE_LIMIT_NETWORK_FACTOR = 4;
 export declare const RATE_LIMIT_WINDOW = 10000;
 export declare const RATE_LIMIT_MAX = 50;
 export declare const SESSION_TTL = 3600000;
 export declare const STATUS_MESSAGES: Record<number, string>;
 export declare const EARTH_RADIUS_KM = 6371;
 export declare const MAX_ADDRESS_COUNT = 10;
+export declare const MAX_BARCODE_DATA_LENGTH = 128;
 export declare const MAX_BASE_VALUE_LENGTH = 100;
+export declare const MAX_CAPTCHA_TEXT_LENGTH = 32;
 export declare const MAX_CHART_DATASETS = 5;
 export declare const MAX_CHART_LABELS = 20;
+export declare const MAX_CHAT_MESSAGES = 200;
 export declare const MAX_CSV_LENGTH = 50000;
 export declare const MAX_CSV_ROWS = 1000;
 export declare const MAX_CREDIT_COUNT = 10;
+export declare const MAX_CONCURRENT_KEYGENS = 2;
 export declare const MAX_COUNTDOWN_YEARS = 100;
+export declare const MAX_CRON_DURATION = 250;
+export declare const MAX_CRON_DURATION_V4 = 1000;
+export declare const MAX_CRON_GAP: number;
 export declare const MAX_CRON_ITERATIONS: number;
 export declare const MAX_CRON_RESULTS = 20;
 export declare const MAX_DIFF_LENGTH = 10000;
@@ -25,6 +36,10 @@ export declare const MAX_EXPR_DEPTH = 100;
 export declare const MAX_EXPR_LENGTH = 500;
 export declare const MAX_FACTORIAL = 170;
 export declare const MAX_GCD_VALUE = 100000;
+export declare const ICS_FETCH_TIMEOUT = 10000;
+export declare const MAX_ICS_BYTES: number;
+export declare const MAX_ICS_EVENTS = 5000;
+export declare const MAX_ID_LENGTH = 256;
 export declare const MAX_JWT_LENGTH = 8192;
 export declare const MAX_LEVENSHTEIN_LENGTH = 1000;
 export declare const MIN_PASSWORD_LENGTH = 8;
@@ -34,15 +49,22 @@ export declare const MAX_MATRIX_SIZE = 20;
 export declare const MAX_PATTERN_LENGTH = 200;
 export declare const MAX_POW_DIFFICULTY = 6;
 export declare const MAX_PRIME_LIST = 10000;
+export declare const MAX_PRIVATE_CHATS = 1000;
 export declare const POW_DEFAULT_DIFFICULTY = 4;
+export declare const MAX_QRCODE_ICON_PIXELS = 16000000;
 export declare const MAX_QRCODE_LOGO_BYTES: number;
+export declare const QRCODE_ICON_TIMEOUT = 5000;
 export declare const MAX_READ_LENGTH = 50000;
 export declare const MAX_REGEX_MATCHES = 100;
+export declare const REGEX_TIMEOUT = 25;
+export declare const MAX_REMOTE_REDIRECTS = 10;
 export declare const MAX_RSA_MODULUS = 4096;
 export declare const MAX_SEMVER_LENGTH = 256;
 export declare const MAX_STRING_LENGTH = 1000;
+export declare const MAX_TIMESTAMP_LENGTH = 128;
 export declare const MIN_TOKEN_LENGTH = 12;
 export declare const MAX_TOKEN_LENGTH = 4096;
 export declare const MAX_URL_LENGTH = 2048;
+export declare const MAX_USERNAME_LENGTH = 100;
 export declare const MAX_UUID_COUNT = 50;
 export declare const ROMAN_VALUES: [number, string][];

package/dist/constants.js

@@ -4,9 +4,13 @@ export const APP_VERSION = pkg.version;
 export const DEFAULT_PORT = 3000;
 export const START_TIME = Date.now();
 // Server
+export const CHALLENGE_MAX_ATTEMPTS = 5;
 export const CHALLENGE_TTL = 300_000;
 export const GAME_CLEANUP_TTL = 600_000;
 export const MAX_LOG_ENTRIES = 1000;
+export const RATE_LIMIT_IPV6_NETWORK = 48;
+export const RATE_LIMIT_IPV6_PREFIX = 64;
+export const RATE_LIMIT_NETWORK_FACTOR = 4;
 export const RATE_LIMIT_WINDOW = 10_000;
 export const RATE_LIMIT_MAX = 50;
 export const SESSION_TTL = 3_600_000;
@@ -22,13 +26,20 @@ export const STATUS_MESSAGES = {
 // Modules
 export const EARTH_RADIUS_KM = 6371;
 export const MAX_ADDRESS_COUNT = 10;
+export const MAX_BARCODE_DATA_LENGTH = 128;
 export const MAX_BASE_VALUE_LENGTH = 100;
+export const MAX_CAPTCHA_TEXT_LENGTH = 32;
 export const MAX_CHART_DATASETS = 5;
 export const MAX_CHART_LABELS = 20;
+export const MAX_CHAT_MESSAGES = 200;
 export const MAX_CSV_LENGTH = 50_000;
 export const MAX_CSV_ROWS = 1000;
 export const MAX_CREDIT_COUNT = 10;
+export const MAX_CONCURRENT_KEYGENS = 2;
 export const MAX_COUNTDOWN_YEARS = 100;
+export const MAX_CRON_DURATION = 250;
+export const MAX_CRON_DURATION_V4 = 1000;
+export const MAX_CRON_GAP = 401 * 366 * 86_400_000;
 export const MAX_CRON_ITERATIONS = 365 * 24 * 60;
 export const MAX_CRON_RESULTS = 20;
 export const MAX_DIFF_LENGTH = 10_000;
@@ -37,6 +48,10 @@ export const MAX_EXPR_DEPTH = 100;
 export const MAX_EXPR_LENGTH = 500;
 export const MAX_FACTORIAL = 170;
 export const MAX_GCD_VALUE = 100_000;
+export const ICS_FETCH_TIMEOUT = 10_000;
+export const MAX_ICS_BYTES = 1024 * 1024;
+export const MAX_ICS_EVENTS = 5000;
+export const MAX_ID_LENGTH = 256;
 export const MAX_JWT_LENGTH = 8192;
 export const MAX_LEVENSHTEIN_LENGTH = 1000;
 export const MIN_PASSWORD_LENGTH = 8;
@@ -46,16 +61,23 @@ export const MAX_MATRIX_SIZE = 20;
 export const MAX_PATTERN_LENGTH = 200;
 export const MAX_POW_DIFFICULTY = 6;
 export const MAX_PRIME_LIST = 10_000;
+export const MAX_PRIVATE_CHATS = 1000;
 export const POW_DEFAULT_DIFFICULTY = 4;
+export const MAX_QRCODE_ICON_PIXELS = 16_000_000;
 export const MAX_QRCODE_LOGO_BYTES = 2 * 1024 * 1024;
+export const QRCODE_ICON_TIMEOUT = 5000;
 export const MAX_READ_LENGTH = 50_000;
 export const MAX_REGEX_MATCHES = 100;
+export const REGEX_TIMEOUT = 25;
+export const MAX_REMOTE_REDIRECTS = 10;
 export const MAX_RSA_MODULUS = 4096;
 export const MAX_SEMVER_LENGTH = 256;
 export const MAX_STRING_LENGTH = 1000;
+export const MAX_TIMESTAMP_LENGTH = 128;
 export const MIN_TOKEN_LENGTH = 12;
 export const MAX_TOKEN_LENGTH = 4096;
 export const MAX_URL_LENGTH = 2048;
+export const MAX_USERNAME_LENGTH = 100;
 export const MAX_UUID_COUNT = 50;
 export const ROMAN_VALUES = [
     [1000, 'M'],

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAExD,MAAM;AACN,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAErC,SAAS;AACT,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AAErC,MAAM,CAAC,MAAM,eAAe,GAA2B;IACnD,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,uBAAuB;CAC/B,CAAC;AAEF,UAAU;AACV,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AACnC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAuB;IAC5C,CAAC,IAAI,EAAE,GAAG,CAAC;IACX,CAAC,GAAG,EAAE,IAAI,CAAC;IACX,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,GAAG,EAAE,IAAI,CAAC;IACX,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,EAAE,EAAE,IAAI,CAAC;IACV,CAAC,EAAE,EAAE,GAAG,CAAC;IACT,CAAC,EAAE,EAAE,IAAI,CAAC;IACV,CAAC,EAAE,EAAE,GAAG,CAAC;IACT,CAAC,CAAC,EAAE,IAAI,CAAC;IACT,CAAC,CAAC,EAAE,GAAG,CAAC;IACR,CAAC,CAAC,EAAE,IAAI,CAAC;IACT,CAAC,CAAC,EAAE,GAAG,CAAC;CACX,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAExD,MAAM;AACN,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAErC,SAAS;AACT,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACxC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAC3C,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AAErC,MAAM,CAAC,MAAM,eAAe,GAA2B;IACnD,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,uBAAuB;CAC/B,CAAC;AAEF,UAAU;AACV,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AACzC,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,GAAG,UAAU,CAAC;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AACnC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AACnC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AACtC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACxC,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACrD,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AACtC,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACxC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AACnC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAuB;IAC5C,CAAC,IAAI,EAAE,GAAG,CAAC;IACX,CAAC,GAAG,EAAE,IAAI,CAAC;IACX,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,GAAG,EAAE,IAAI,CAAC;IACX,CAAC,GAAG,EAAE,GAAG,CAAC;IACV,CAAC,EAAE,EAAE,IAAI,CAAC;IACV,CAAC,EAAE,EAAE,GAAG,CAAC;IACT,CAAC,EAAE,EAAE,IAAI,CAAC;IACV,CAAC,EAAE,EAAE,GAAG,CAAC;IACT,CAAC,CAAC,EAAE,IAAI,CAAC;IACT,CAAC,CAAC,EAAE,GAAG,CAAC;IACR,CAAC,CAAC,EAAE,IAAI,CAAC;IACT,CAAC,CAAC,EAAE,GAAG,CAAC;CACX,CAAC"}

package/dist/endpoints/define.d.ts

@@ -0,0 +1,30 @@
+import type { Request } from 'express';
+export type Category = 'security' | 'text' | 'images' | 'compute' | 'fakeData' | 'network' | 'realtime';
+export interface Param {
+    required?: boolean;
+    missing?: string;
+    options?: readonly string[];
+    default?: string;
+}
+export type Values<P extends string> = Record<P, string | undefined>;
+export interface Endpoint<P extends string = string> {
+    name: string;
+    method: 'get' | 'post';
+    path: string;
+    category: Category;
+    since?: number;
+    params: Record<P, Param>;
+    example: Partial<Record<P, string>>;
+    run(values: Values<P>, req: Request): unknown;
+}
+/**
+ * Declares an endpoint contract and infers its parameter names, so `run` receives typed values.
+ * The HTTP router and the documentation manifest are both built from it, so the two cannot drift apart.
+ *
+ * @param endpoint - Contract of the route: `since` is the first API version serving it (all of them when
+ * omitted), `params` are read from the query string on GET and from the JSON body on POST, `example` is the
+ * input the documentation runs to show a real output, and an error thrown by `run` becomes a 400 carrying its
+ * message
+ * @returns The same contract, typed with its parameter names
+ */
+export declare function define<P extends string>(endpoint: Endpoint<P>): Endpoint<P>;

package/dist/endpoints/define.js

@@ -0,0 +1,14 @@
+/**
+ * Declares an endpoint contract and infers its parameter names, so `run` receives typed values.
+ * The HTTP router and the documentation manifest are both built from it, so the two cannot drift apart.
+ *
+ * @param endpoint - Contract of the route: `since` is the first API version serving it (all of them when
+ * omitted), `params` are read from the query string on GET and from the JSON body on POST, `example` is the
+ * input the documentation runs to show a real output, and an error thrown by `run` becomes a 400 carrying its
+ * message
+ * @returns The same contract, typed with its parameter names
+ */
+export function define(endpoint) {
+    return endpoint;
+}
+//# sourceMappingURL=define.js.map

package/dist/endpoints/define.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define.js","sourceRoot":"","sources":["../../src/endpoints/define.ts"],"names":[],"mappings":"AAwBA;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CAAmB,QAAqB;IAC1D,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/dist/endpoints/hash.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("./define.js").Endpoint<"text" | "method" | "encoding">;
+export default _default;

package/dist/endpoints/hash.js

@@ -0,0 +1,16 @@
+import hash from '../modules/v4/hash.js';
+import { define } from './define.js';
+export default define({
+    name: 'hash',
+    method: 'post',
+    path: '/hash',
+    category: 'security',
+    params: {
+        text: { required: true, missing: 'Please provide a text (?text={text})' },
+        method: { required: true, missing: 'Please provide a valid hash algorithm (&method={algorithm})' },
+        encoding: { options: ['hex', 'base64'], default: 'hex' },
+    },
+    example: { text: 'hello', method: 'sha256' },
+    run: ({ text, method, encoding }) => hash(text, method, encoding),
+});
+//# sourceMappingURL=hash.js.map

package/dist/endpoints/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/endpoints/hash.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,uBAAuB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,eAAe,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,OAAO;IACb,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE;QACJ,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,sCAAsC,EAAE;QACzE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,6DAA6D,EAAE;QAClG,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;KAC3D;IACD,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC5C,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAK,EAAE,MAAO,EAAE,QAAQ,CAAC;CACtE,CAAC,CAAC"}

package/dist/endpoints/index.d.ts

@@ -0,0 +1,2 @@
+import type { Endpoint } from './define.js';
+export declare const endpoints: Endpoint[];

package/dist/endpoints/index.js

@@ -0,0 +1,4 @@
+import hash from './hash.js';
+// Endpoints declared as contracts; the others are still hand-written in routes/ and move here one by one
+export const endpoints = [hash];
+//# sourceMappingURL=index.js.map

package/dist/endpoints/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/endpoints/index.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,yGAAyG;AACzG,MAAM,CAAC,MAAM,SAAS,GAAe,CAAC,IAAI,CAAC,CAAC"}

package/dist/endpoints/router.d.ts

@@ -0,0 +1,10 @@
+import { Router } from 'express';
+import type { Endpoint } from './define.js';
+/**
+ * Builds the HTTP routes of the declared endpoints, with the required parameter check and the shared error format.
+ * A POST-only endpoint also answers GET with a 405, and a version older than its `since` answers 404.
+ *
+ * @param endpoints - Contracts to serve, each mounted under `/:version`
+ * @returns Router to mount before the hand-written routes, so a declared endpoint takes precedence
+ */
+export declare function build(endpoints: Endpoint[]): Router;

package/dist/endpoints/router.js

@@ -0,0 +1,50 @@
+import { Router } from 'express';
+import { since } from '../utils/helpers.js';
+import { error } from '../utils/response.js';
+/**
+ * Builds the HTTP routes of the declared endpoints, with the required parameter check and the shared error format.
+ * A POST-only endpoint also answers GET with a 405, and a version older than its `since` answers 404.
+ *
+ * @param endpoints - Contracts to serve, each mounted under `/:version`
+ * @returns Router to mount before the hand-written routes, so a declared endpoint takes precedence
+ */
+export function build(endpoints) {
+    const router = Router();
+    for (const endpoint of endpoints) {
+        const path = `/:version${endpoint.path}`;
+        const served = (req) => !endpoint.since || since(req.version, endpoint.since);
+        router[endpoint.method](path, async (req, res) => {
+            if (!served(req)) {
+                error(res, 404, `Endpoint not available in ${req.version}.`);
+                return;
+            }
+            const source = ((endpoint.method === 'get' ? req.query : req.body) ?? {});
+            const values = {};
+            for (const [name, param] of Object.entries(endpoint.params)) {
+                const value = source[name];
+                if (param.required && !value) {
+                    error(res, 400, param.missing ?? `Please provide a ${name}`);
+                    return;
+                }
+                values[name] = value;
+            }
+            try {
+                res.jsonResponse(await endpoint.run(values, req));
+            }
+            catch (err) {
+                error(res, 400, err.message);
+            }
+        });
+        if (endpoint.method === 'post') {
+            router.get(path, (req, res) => {
+                if (!served(req)) {
+                    error(res, 404, `Endpoint not available in ${req.version}.`);
+                    return;
+                }
+                error(res, 405, 'This endpoint only supports POST requests.');
+            });
+        }
+    }
+    return router;
+}
+//# sourceMappingURL=router.js.map

package/dist/endpoints/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/endpoints/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,MAAM,EAAE,MAAM,SAAS,CAAC;AAE9D,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAG7C;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,SAAqB;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,YAAY,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEvF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;YAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACf,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,6BAA6B,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;gBAC7D,OAAO;YACX,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAA2B,CAAC;YACpG,MAAM,MAAM,GAAuC,EAAE,CAAC;YAEtD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC3B,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,oBAAoB,IAAI,EAAE,CAAC,CAAC;oBAC7D,OAAO;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACzB,CAAC;YAED,IAAI,CAAC;gBACD,GAAG,CAAC,YAAY,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,KAAK,CAAC,GAAG,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YAC5C,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;gBAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBACf,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,6BAA6B,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;oBAC7D,OAAO;gBACX,CAAC;gBACD,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,4CAA4C,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,11 @@
+import type { Category, Param } from './endpoints/define.js';
+export interface ManifestEntry {
+    name: string;
+    method: 'get' | 'post';
+    path: string;
+    category: Category;
+    since?: number;
+    params: Record<string, Param>;
+    example: Record<string, string>;
+}
+export declare const manifest: ManifestEntry[];

package/dist/manifest.js

@@ -0,0 +1,12 @@
+import { endpoints } from './endpoints/index.js';
+// Declared endpoints without their run function, for the documentation sidebar, parameter lists and playground
+export const manifest = endpoints.map(({ name, method, path, category, since, params, example }) => ({
+    name,
+    method,
+    path,
+    category,
+    ...(since ? { since } : {}),
+    params,
+    example: example,
+}));
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAYjD,+GAA+G;AAC/G,MAAM,CAAC,MAAM,QAAQ,GAAoB,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAClH,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,QAAQ;IACR,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3B,MAAM;IACN,OAAO,EAAE,OAAiC;CAC7C,CAAC,CAAC,CAAC"}

package/dist/middleware/cors.d.ts

@@ -1,2 +1,17 @@
 import { type Express } from 'express';
+/**
+ * Applies the proxy setting, the security headers, CORS and the robots.txt route.
+ *
+ * The security headers come first so that every response carries them,
+ * preflights and errors included. Body parsing is mounted separately by
+ * setupParsers, after the rate limiter.
+ *
+ * @param app - Express application to configure
+ */
 export declare function setupCors(app: Express): void;
+/**
+ * Mounts the URL-encoded and JSON body parsers, both capped at 10 KB.
+ *
+ * @param app - Express application to configure
+ */
+export declare function setupParsers(app: Express): void;

package/dist/middleware/cors.js

@@ -5,8 +5,25 @@ import { fileURLToPath } from 'url';
 import { env } from '../config/env.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
+/**
+ * Applies the proxy setting, the security headers, CORS and the robots.txt route.
+ *
+ * The security headers come first so that every response carries them,
+ * preflights and errors included. Body parsing is mounted separately by
+ * setupParsers, after the rate limiter.
+ *
+ * @param app - Express application to configure
+ */
 export function setupCors(app) {
     app.set('trust proxy', env.TRUSTED_PROXIES ?? 1);
+    if (!env.TRUSTED_PROXIES && process.env.NODE_ENV !== 'test') {
+        console.warn('TRUSTED_PROXIES is unset: client addresses are read assuming exactly one reverse proxy in front of the API.');
+    }
+    app.use((_req, res, next) => {
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('X-Frame-Options', 'DENY');
+        next();
+    });
     app.use(cors({
         methods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],
         exposedHeaders: [
@@ -18,14 +35,15 @@ export function setupCors(app) {
             'Retry-After',
         ],
     }));
+    app.use('/robots.txt', express.static(join(__dirname, '..', '..', 'robots.txt')));
+}
+/**
+ * Mounts the URL-encoded and JSON body parsers, both capped at 10 KB.
+ *
+ * @param app - Express application to configure
+ */
+export function setupParsers(app) {
     app.use(express.urlencoded({ extended: true, limit: '10kb' }));
     app.use(express.json({ limit: '10kb' }));
-    app.use((_req, res, next) => {
-        res.setHeader('X-Content-Type-Options', 'nosniff');
-        res.setHeader('X-Frame-Options', 'DENY');
-        next();
-    });
-    app.use('/favicon.ico', express.static(join(__dirname, '..', '..', 'src', 'favicon.ico')));
-    app.use('/robots.txt', express.static(join(__dirname, '..', '..', 'robots.txt')));
 }
 //# sourceMappingURL=cors.js.map

package/dist/middleware/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAyB,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,MAAM,UAAU,SAAS,CAAC,GAAY;IAClC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;IAEjD,GAAG,CAAC,GAAG,CACH,IAAI,CAAC;QACD,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;QACtD,cAAc,EAAE;YACZ,gBAAgB;YAChB,iBAAiB;YACjB,mBAAmB;YACnB,uBAAuB;YACvB,mBAAmB;YACnB,aAAa;SAChB;KACJ,CAAC,CACL,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC3F,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAyB,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,GAAY;IAClC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CACR,6GAA6G,CAChH,CAAC;IACN,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACH,IAAI,CAAC;QACD,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;QACtD,cAAc,EAAE;YACZ,gBAAgB;YAChB,iBAAiB;YACjB,mBAAmB;YACnB,uBAAuB;YACvB,mBAAmB;YACnB,aAAa;SAChB;KACJ,CAAC,CACL,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACrC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC"}