@tstdl/base 0.93.172 → 0.93.174

package/ai/genkit/tests/multi-region.test.js

@@ -6,7 +6,7 @@ import { CircuitBreakerProvider } from '../../../circuit-breaker/provider.js';
 import { Logger } from '../../../logger/logger.js';
 import { setupIntegrationTest } from '../../../testing/index.js';
 import { vertexAiMultiLocation } from '../multi-region.plugin.js';
-vi.mock('#/utils/array/index.js', async (importOriginal) => {
+vi.mock('../../../utils/array/index.js', async (importOriginal) => {
     const actual = await importOriginal();
     return {
         ...actual,

package/ai/genkit/tests/token-limit-fallback.test.js

@@ -7,7 +7,7 @@ import { Logger } from '../../../logger/logger.js';
 import { setupIntegrationTest } from '../../../testing/index.js';
 import { timeout } from '../../../utils/timing.js';
 import { vertexAiMultiLocation } from '../multi-region.plugin.js';
-vi.mock('#/utils/array/index.js', async (importOriginal) => {
+vi.mock('../../../utils/array/index.js', async (importOriginal) => {
     const actual = await importOriginal();
     return {
         ...actual,

package/api/server/middlewares/cors.middleware.js

@@ -1,53 +1,91 @@
 import { resolveApiEndpointDataProvider } from '../../../api/types.js';
-import { toArray } from '../../../utils/array/array.js';
-import { isDefined } from '../../../utils/type-guards.js';
+import { distinct, toArray } from '../../../utils/array/array.js';
+import { isDefined, isString } from '../../../utils/type-guards.js';
+const defaultAllowedHeaders = ['Content-Type', 'Authorization', 'Cache-Control', 'If-None-Match', 'Range'];
+const defaultExposedHeaders = ['ETag', 'Content-Disposition', 'Content-Range'];
+const headerSplitPattern = /,\s*/u;
 export function corsMiddleware(options = {}) {
     return async function corsMiddleware(context, next) {
-        try {
-            await next();
-        }
-        finally {
-            const { request, response } = context;
-            const requestMethod = request.headers.tryGetSingle('Access-Control-Request-Method') ?? request.method;
-            const isOptions = (request.method == 'OPTIONS');
-            const endpointDefinition = context.api.endpoints.get(requestMethod)?.definition;
-            const cors = { ...options.default, ...endpointDefinition?.cors };
-            if (isOptions) {
-                const allowMethods = (await resolveApiEndpointDataProvider(request, context, cors.accessControlAllowMethods)) ?? [...context.api.endpoints.keys()].join(', ');
-                response.headers.set('Access-Control-Allow-Methods', allowMethods);
-                if (isDefined(cors.accessControlAllowHeaders) && !request.headers.has('Access-Control-Allow-Headers')) {
-                    const value = await resolveApiEndpointDataProvider(request, context, cors.accessControlAllowHeaders);
-                    response.headers.set('Access-Control-Allow-Headers', value);
-                }
-                if (isDefined(cors.accessControlExposeHeaders) && !request.headers.has('Access-Control-Expose-Headers')) {
-                    const value = await resolveApiEndpointDataProvider(request, context, cors.accessControlExposeHeaders);
-                    response.headers.set('Access-Control-Expose-Headers', value);
-                }
-                if (isDefined(cors.accessControlMaxAge) && !request.headers.has('Access-Control-Max-Age')) {
-                    const value = await resolveApiEndpointDataProvider(request, context, cors.accessControlMaxAge);
-                    response.headers.set('Access-Control-Max-Age', value);
-                }
-            }
-            if (!request.headers.has('Access-Control-Allow-Credentials')) {
-                const allowCredentials = isDefined(cors.accessControlAllowCredentials)
-                    ? await resolveApiEndpointDataProvider(request, context, cors.accessControlAllowCredentials)
-                    : endpointDefinition?.credentials;
-                if (allowCredentials == true) {
-                    response.headers.set('Access-Control-Allow-Credentials', 'true');
-                }
-            }
+        const { request, response } = context;
+        const requestMethod = request.headers.tryGetSingle('Access-Control-Request-Method') ?? request.method;
+        const isOptions = (request.method == 'OPTIONS');
+        const endpointDefinition = context.api.endpoints.get(requestMethod)?.definition;
+        const cors = { ...options.default, ...endpointDefinition?.cors };
+        const origin = request.headers.tryGetSingle('Origin');
+        const allowCredentials = (await resolveApiEndpointDataProvider(request, context, cors.accessControlAllowCredentials)) ?? endpointDefinition?.credentials;
+        if (isDefined(origin)) {
+            let allowOriginValidationFailed = false;
             if (isDefined(cors.accessControlAllowOrigin) && !response.headers.has('Access-Control-Allow-Origin')) {
-                const value = await resolveApiEndpointDataProvider(request, context, cors.accessControlAllowOrigin);
-                response.headers.set('Access-Control-Allow-Origin', value);
+                const allowedOrigin = await resolveApiEndpointDataProvider(request, context, cors.accessControlAllowOrigin);
+                if (isDefined(allowedOrigin)) {
+                    const isWildcard = (allowedOrigin == '*');
+                    const isAllowed = isWildcard || (origin == allowedOrigin);
+                    if (isAllowed) {
+                        const value = (isWildcard && (allowCredentials == true)) ? origin : allowedOrigin;
+                        response.headers.set('Access-Control-Allow-Origin', value);
+                        if (value == origin) {
+                            response.headers.append('Vary', 'Origin');
+                        }
+                    }
+                    else {
+                        allowOriginValidationFailed = true;
+                    }
+                }
             }
             if (isDefined(cors.autoAccessControlAllowOrigin) && !response.headers.has('Access-Control-Allow-Origin')) {
-                const value = await resolveApiEndpointDataProvider(request, context, cors.autoAccessControlAllowOrigin);
-                const origin = request.headers.tryGetSingle('Origin');
-                const allowed = isDefined(value) && toArray(value).includes(origin);
+                const allowedOrigins = await resolveApiEndpointDataProvider(request, context, cors.autoAccessControlAllowOrigin);
+                const allowed = allowedOrigins?.includes(origin) ?? false;
                 if (allowed) {
                     response.headers.set('Access-Control-Allow-Origin', origin);
+                    response.headers.append('Vary', 'Origin');
+                }
+                else {
+                    allowOriginValidationFailed = true;
                 }
             }
+            if (isOptions && allowOriginValidationFailed && !response.headers.has('Access-Control-Allow-Origin')) {
+                response.statusCode = 403;
+                return;
+            }
+        }
+        if (isOptions) {
+            const customAllowMethods = await resolveApiEndpointDataProvider(request, context, cors.accessControlAllowMethods);
+            const allowMethods = customAllowMethods?.join(', ') ?? [...context.api.endpoints.keys()].join(', ');
+            response.headers.set('Access-Control-Allow-Methods', allowMethods);
+            const customAllowHeaders = await resolveApiEndpointDataProvider(request, context, cors.accessControlAllowHeaders);
+            const allowHeaders = distinct([
+                ...defaultAllowedHeaders,
+                ...(customAllowHeaders ?? []),
+                ...toArray(response.headers.tryGet('Access-Control-Allow-Headers') ?? []).filter(isString).flatMap((h) => h.split(headerSplitPattern)),
+            ]).filter((header) => (header.length > 0)).join(', ');
+            response.headers.set('Access-Control-Allow-Headers', allowHeaders);
+            if (isDefined(cors.accessControlMaxAge) && !response.headers.has('Access-Control-Max-Age')) {
+                const value = await resolveApiEndpointDataProvider(request, context, cors.accessControlMaxAge);
+                response.headers.set('Access-Control-Max-Age', value);
+            }
+            else if (!response.headers.has('Access-Control-Max-Age')) {
+                response.headers.set('Access-Control-Max-Age', '86400');
+            }
+            if (allowCredentials == true) {
+                response.headers.set('Access-Control-Allow-Credentials', 'true');
+            }
+            response.statusCode = 204;
+            return;
+        }
+        try {
+            await next();
+        }
+        finally {
+            const customExposeHeaders = await resolveApiEndpointDataProvider(request, context, cors.accessControlExposeHeaders);
+            const exposeHeaders = [...new Set([
+                    ...defaultExposedHeaders,
+                    ...(customExposeHeaders ?? []),
+                    ...toArray(response.headers.tryGet('Access-Control-Expose-Headers') ?? []).filter(isString).flatMap((h) => h.split(headerSplitPattern)),
+                ])].filter((header) => (header.length > 0)).join(', ');
+            response.headers.set('Access-Control-Expose-Headers', exposeHeaders);
+            if (allowCredentials == true) {
+                response.headers.setIfMissing('Access-Control-Allow-Credentials', 'true');
+            }
         }
     };
 }

package/api/types.d.ts

@@ -33,11 +33,11 @@ export type ApiEndpointDefinitionResult = SchemaTestable | typeof String | typeo
 export type ApiEndpointDataProvider<T> = T | ((request: HttpServerRequest, context: ApiGatewayMiddlewareContext) => T | Promise<T>);
 export type ApiEndpointDefinitionCors = {
     accessControlAllowCredentials?: ApiEndpointDataProvider<boolean | undefined>;
-    accessControlAllowHeaders?: ApiEndpointDataProvider<OneOrMany<string> | undefined>;
-    accessControlAllowMethods?: ApiEndpointDataProvider<OneOrMany<HttpMethod> | undefined>;
+    accessControlAllowHeaders?: ApiEndpointDataProvider<string[] | undefined>;
+    accessControlAllowMethods?: ApiEndpointDataProvider<HttpMethod[] | undefined>;
     accessControlAllowOrigin?: ApiEndpointDataProvider<string | undefined>;
-    autoAccessControlAllowOrigin?: ApiEndpointDataProvider<OneOrMany<string> | undefined>;
-    accessControlExposeHeaders?: ApiEndpointDataProvider<OneOrMany<string> | undefined>;
+    autoAccessControlAllowOrigin?: ApiEndpointDataProvider<string[] | undefined>;
+    accessControlExposeHeaders?: ApiEndpointDataProvider<string[] | undefined>;
     accessControlMaxAge?: ApiEndpointDataProvider<number | undefined>;
 };
 export type ApiEndpointDefinition = {

package/authentication/client/authentication.service.d.ts

@@ -26,7 +26,7 @@ export declare class AuthenticationClientService<AdditionalTokenPayload extends
     private readonly logger;
     private readonly disposeSignal;
     private readonly forceRefreshRequested;
-    private readonly forceRefreshRequested$;
+    private readonly forceRefreshSubject;
     private clockOffset;
     private initialized;
     private refreshLoopPromise;

package/authentication/client/authentication.service.js

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { Subject, filter, firstValueFrom, from, race, skip, takeUntil, timer } from 'rxjs';
+import { Subject, filter, firstValueFrom, from, race, takeUntil, timer } from 'rxjs';
 import { CancellationSignal } from '../../cancellation/token.js';
 import { BadRequestError } from '../../errors/bad-request.error.js';
 import { ForbiddenError } from '../../errors/forbidden.error.js';
@@ -72,7 +72,7 @@ let AuthenticationClientService = class AuthenticationClientService {
     logger = inject(Logger, 'AuthenticationService');
     disposeSignal = inject(CancellationSignal).fork();
     forceRefreshRequested = signal(false);
-    forceRefreshRequested$ = toObservable(this.forceRefreshRequested);
+    forceRefreshSubject = new Subject();
     clockOffset = 0;
     initialized = false;
     refreshLoopPromise;
@@ -267,6 +267,7 @@ let AuthenticationClientService = class AuthenticationClientService {
             this.setAdditionalData(data);
         }
         this.forceRefreshRequested.set(true);
+        this.forceRefreshSubject.next();
     }
     /**
      * Refresh the token.
@@ -404,7 +405,7 @@ let AuthenticationClientService = class AuthenticationClientService {
             timer(Math.max(10, delayMs)),
             from(this.disposeSignal),
             this.token$.pipe(filter((t) => t?.exp !== referenceExp)),
-            this.forceRefreshRequested$.pipe(filter(Boolean), skip(1)),
+            this.forceRefreshSubject,
         ]), { defaultValue: undefined });
         while (this.disposeSignal.isUnset) {
             const token = this.token();
@@ -428,9 +429,9 @@ let AuthenticationClientService = class AuthenticationClientService {
                         const currentNow = this.estimatedServerTimestampSeconds();
                         const currentBuffer = calculateRefreshBufferSeconds(currentToken);
                         const stillNeedsRefresh = this.forceRefreshRequested() || (currentNow >= currentToken.exp - currentBuffer);
-                        this.forceRefreshRequested.set(false);
                         if (stillNeedsRefresh) {
                             await this.refresh();
+                            this.forceRefreshRequested.set(false);
                         }
                     });
                     // If lock is held by another instance/tab, wait briefly for it to finish (passive sync)

package/document-management/tests/ai-config-integration.test.js

@@ -90,10 +90,10 @@ describe('DocumentManagementAiService Integration', () => {
         await runInInjectionContext(injector, async () => {
             await aiService.extractData(tenantId, document.id);
             const lastCall = mockGenerate.mock.calls[0][0];
-            const systemPrompt = lastCall.system;
-            const systemPromptText = systemPrompt.map((p) => p.text).join('\n');
-            expect(systemPromptText).toContain('Format the title of the document exactly as follows: INV-{{Date}}');
-            expect(systemPromptText).toContain('Focus on items.');
+            const userPrompt = lastCall.prompt;
+            const userPromptText = userPrompt.map((p) => p.text).join('\n');
+            expect(userPromptText).toContain('Format the title of the document exactly as follows: INV-{{Date}}');
+            expect(userPromptText).toContain('Focus on items.');
         });
     });
     test('classifyDocumentType should include granular instructions in prompt', async () => {

package/document-management/tests/document-validation-ai-overrides.test.js

@@ -6,6 +6,7 @@ import { object, string } from '../../schema/index.js';
 import { setupIntegrationTest } from '../../testing/index.js';
 import { isString } from '../../utils/type-guards.js';
 import { DocumentManagementConfiguration } from '../server/module.js';
+import { DocumentFileService } from '../server/services/document-file.service.js';
 import { DocumentManagementAiProviderService, DocumentManagementAncillaryService } from '../server/services/index.js';
 import { AiValidationExecutor } from '../server/validators/ai-validation-executor.js';
 import { TestDocumentManagementAncillaryService } from './helper.js';
@@ -41,6 +42,7 @@ describe('AiValidationExecutor Overrides', () => {
         injector.register(DocumentManagementAiProviderService, { useValue: mockAiProvider });
         injector.register(DocumentManagementAncillaryService, { useToken: TestDocumentManagementAncillaryService });
         injector.register(DocumentManagementConfiguration, { useValue: { fileObjectStorageModule: 'docs', fileUploadObjectStorageModule: 'uploads', filePreviewObjectStorageModule: 'previews' } });
+        injector.register(DocumentFileService, { useValue: { getContent: vi.fn().mockResolvedValue(new Uint8Array([1, 2, 3])) } });
     });
     afterAll(async () => {
         await injector?.dispose();
@@ -66,6 +68,7 @@ describe('AiValidationExecutor Overrides', () => {
             const context = {
                 execution: { tenantId },
                 definition: { identifier: 'test-validation' },
+                document: { id: 'test-doc', mimeType: 'application/pdf' },
             };
             await executor.publicExecute(context);
             const call = generateSpy.mock.calls[0][0];

package/examples/api/streaming.js

@@ -40,7 +40,7 @@ const streamingApiDefinition = defineApi({
             result: ServerSentEvents,
             cors: {
                 accessControlAllowOrigin: '*',
-                accessControlAllowMethods: 'GET',
+                accessControlAllowMethods: ['GET'],
             },
         },
     },

package/examples/document-management/main.js

@@ -132,8 +132,8 @@ function bootstrap() {
             prefix: null,
             cors: {
                 default: {
-                    autoAccessControlAllowOrigin: 'http://localhost:4200',
-                    accessControlAllowHeaders: 'Content-Type, Authorization',
+                    autoAccessControlAllowOrigin: ['http://localhost:4200'],
+                    accessControlAllowHeaders: ['Content-Type', 'Authorization'],
                 },
             },
         },

package/http/server/http-server-response.d.ts

@@ -23,9 +23,9 @@ export type HttpServerResponseOptions = {
 };
 export declare class HttpServerResponse {
     #private;
+    readonly headers: HttpHeaders;
     statusCode: number | undefined;
     statusMessage: string | undefined;
-    headers: HttpHeaders;
     get body(): HttpServerResponseBody | undefined;
     set body(value: HttpServerResponseBody | undefined);
     get bodyType(): HttpServerResponseBodyType;

package/http/server/http-server-response.js

@@ -5,9 +5,9 @@ import { HttpHeaders } from '../http-headers.js';
 export class HttpServerResponse {
     #body;
     #bodyType;
+    headers = new HttpHeaders();
     statusCode;
     statusMessage;
-    headers;
     get body() {
         return this.#body;
     }
@@ -35,10 +35,18 @@ export class HttpServerResponse {
         });
     }
     update(options) {
-        this.statusCode = options.statusCode;
-        this.statusMessage = options.statusMessage;
-        this.headers = new HttpHeaders(options.headers);
-        this.body = options.body;
+        if (isDefined(options.statusCode)) {
+            this.statusCode = options.statusCode;
+        }
+        if (isDefined(options.statusMessage)) {
+            this.statusMessage = options.statusMessage;
+        }
+        if (isDefined(options.headers)) {
+            this.headers.setMany(options.headers);
+        }
+        if (isDefined(options.body)) {
+            this.body = options.body;
+        }
         if (isDefined(options.cookies)) {
             for (const [name, cookie] of objectEntries(options.cookies)) {
                 this.headers.append('Set-Cookie', formatSetCookie(name, cookie.value, cookie));

package/logger/tests/pretty-print.test.js

@@ -1,11 +1,11 @@
 import { describe, expect, it, vi } from 'vitest';
 // Mock supports before importing PrettyPrintLogFormatter
-vi.mock('#/supports.js', () => ({
+vi.mock('../../supports.js', () => ({
     supportsColoredStdout: true,
     supportsColoredStderr: true,
 }));
-import { LogLevel } from '../level.js';
 import { PrettyPrintLogFormatter } from '../formatters/pretty-print.js';
+import { LogLevel } from '../level.js';
 describe('PrettyPrintLogFormatter', () => {
     const formatter = new PrettyPrintLogFormatter();
     it('should format a log entry with an error and no context', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tstdl/base",
-  "version": "0.93.172",
+  "version": "0.93.174",
   "author": "Patrick Hein",
   "publishConfig": {
     "access": "public"
@@ -203,7 +203,6 @@
     "typedoc-plugin-missing-exports": "4.1",
     "typescript": "5.9",
     "typescript-eslint": "8.57",
-    "vite-tsconfig-paths": "6.1",
     "vitest": "4.1"
   }
 }