@velajs/vela 1.18.0 → 1.19.1

package/dist/container/decorators.d.ts

@@ -1,17 +0,0 @@
-import { Scope } from '../constants';
-import type { InjectableOptions, InjectMetadata, Token } from './types';
-import { ForwardRef } from './types';
-export declare function Injectable(options?: InjectableOptions): ClassDecorator;
-export declare function Optional(): ParameterDecorator;
-export declare function Inject(token: Token | ForwardRef): ParameterDecorator;
-export declare function isInjectable(target: object): boolean;
-export declare function getScope(target: object): Scope;
-/**
- * Read through Reflect so dist/src coexistence in tests routes through the
- * single polyfill-installed registry — SWC writes `design:paramtypes` via
- * Reflect, so reads must too. The runtime contract is that each entry is a
- * constructor reference (a `Token`); we surface that contract directly so
- * callers don't need to re-cast.
- */
-export declare function getConstructorDependencies(target: object): Array<Token | undefined>;
-export declare function getInjectMetadata(target: object): InjectMetadata[];

package/dist/container/decorators.js

@@ -1,57 +0,0 @@
-import { Scope } from "../constants.js";
-import { MetadataRegistry } from "../registry/metadata.registry.js";
-export function Injectable(options = {}) {
-    return (target)=>{
-        const { scope = Scope.SINGLETON } = options;
-        MetadataRegistry.markInjectable(target);
-        MetadataRegistry.setScope(target, scope);
-    };
-}
-export function Optional() {
-    return (target, _propertyKey, parameterIndex)=>{
-        const existing = getInjectMetadata(target);
-        const entry = existing.find((m)=>m.index === parameterIndex);
-        if (entry) {
-            entry.optional = true;
-        } else {
-            existing.push({
-                index: parameterIndex,
-                optional: true
-            });
-        }
-        MetadataRegistry.setInjectTokens(target, existing);
-    };
-}
-export function Inject(token) {
-    return (target, _propertyKey, parameterIndex)=>{
-        const existing = getInjectMetadata(target);
-        const entry = existing.find((m)=>m.index === parameterIndex);
-        if (entry) {
-            entry.token = token;
-        } else {
-            existing.push({
-                index: parameterIndex,
-                token
-            });
-        }
-        MetadataRegistry.setInjectTokens(target, existing);
-    };
-}
-export function isInjectable(target) {
-    return MetadataRegistry.hasInjectable(target);
-}
-export function getScope(target) {
-    return MetadataRegistry.getScope(target) ?? Scope.SINGLETON;
-}
-/**
- * Read through Reflect so dist/src coexistence in tests routes through the
- * single polyfill-installed registry — SWC writes `design:paramtypes` via
- * Reflect, so reads must too. The runtime contract is that each entry is a
- * constructor reference (a `Token`); we surface that contract directly so
- * callers don't need to re-cast.
- */ export function getConstructorDependencies(target) {
-    return Reflect.getMetadata('design:paramtypes', target) ?? [];
-}
-export function getInjectMetadata(target) {
-    return MetadataRegistry.getInjectTokens(target) ?? [];
-}

package/dist/container/disposable.d.ts

@@ -1,5 +0,0 @@
-export interface Disposable {
-    dispose?(): void | Promise<void>;
-}
-export declare function isDisposable(value: unknown): boolean;
-export declare function disposeInstance(value: unknown): Promise<void>;

package/dist/container/disposable.js

@@ -1,33 +0,0 @@
-// Edge-safe disposal contract. Precedence:
-//   Symbol.asyncDispose > Symbol.dispose > .dispose()
-// Symbol.asyncDispose/Symbol.dispose are resolved at runtime (they are not in
-// the ES2022 lib the project targets), so nothing here depends on the
-// esnext.disposable typings.
-const ASYNC_DISPOSE = Symbol.asyncDispose;
-const SYNC_DISPOSE = Symbol.dispose;
-function asRecord(value) {
-    if (value === null) return undefined;
-    return typeof value === 'object' || typeof value === 'function' ? value : undefined;
-}
-export function isDisposable(value) {
-    const obj = asRecord(value);
-    if (!obj) return false;
-    if (ASYNC_DISPOSE && typeof obj[ASYNC_DISPOSE] === 'function') return true;
-    if (SYNC_DISPOSE && typeof obj[SYNC_DISPOSE] === 'function') return true;
-    return typeof obj.dispose === 'function';
-}
-export async function disposeInstance(value) {
-    const obj = asRecord(value);
-    if (!obj) return;
-    if (ASYNC_DISPOSE && typeof obj[ASYNC_DISPOSE] === 'function') {
-        await obj[ASYNC_DISPOSE].call(obj);
-        return;
-    }
-    if (SYNC_DISPOSE && typeof obj[SYNC_DISPOSE] === 'function') {
-        obj[SYNC_DISPOSE].call(obj);
-        return;
-    }
-    if (typeof obj.dispose === 'function') {
-        await obj.dispose.call(obj);
-    }
-}

package/dist/container/index.d.ts

@@ -1,6 +0,0 @@
-export { Container } from './container';
-export { Injectable, Inject, Optional, isInjectable, getScope } from './decorators';
-export { InjectionToken, ForwardRef, forwardRef, ModuleVisibilityError, MultipleProvidersFoundError, ROOT_MODULE_ID, describeToken, } from './types';
-export { ModuleRef } from './module-ref';
-export { mixin } from './mixin';
-export type { Type, Token, InferToken, InferTokens, InjectableOptions, InjectMetadata, ProviderOptions, ProviderRegistration, InjectionTokenOptions, ModuleScope, ModuleDescription, ContainerOptions, Diagnostics, } from './types';

package/dist/container/index.js

@@ -1,5 +0,0 @@
-export { Container } from "./container.js";
-export { Injectable, Inject, Optional, isInjectable, getScope } from "./decorators.js";
-export { InjectionToken, ForwardRef, forwardRef, ModuleVisibilityError, MultipleProvidersFoundError, ROOT_MODULE_ID, describeToken } from "./types.js";
-export { ModuleRef } from "./module-ref.js";
-export { mixin } from "./mixin.js";

package/dist/container/mixin.d.ts

@@ -1,24 +0,0 @@
-import type { Type } from './types';
-/**
- * Creates a reusable injectable mixin class from a base class.
- * Applies @Injectable() so the returned class can be registered as a provider.
- *
- * @example
- * ```ts
- * function RoleGuardMixin(role: string) {
- *   class MixedRoleGuard implements CanActivate {
- *     canActivate(ctx: ExecutionContext) {
- *       return ctx.getRequest().headers.get('x-role') === role;
- *     }
- *   }
- *   return mixin(MixedRoleGuard);
- * }
- *
- * const AdminGuard = RoleGuardMixin('admin');
- *
- * @UseGuards(AdminGuard)
- * @Get('/admin')
- * adminOnly() { ... }
- * ```
- */
-export declare function mixin<T>(mixinClass: Type<T>): Type<T>;

package/dist/container/mixin.js

@@ -1,26 +0,0 @@
-import { Injectable } from "./decorators.js";
-/**
- * Creates a reusable injectable mixin class from a base class.
- * Applies @Injectable() so the returned class can be registered as a provider.
- *
- * @example
- * ```ts
- * function RoleGuardMixin(role: string) {
- *   class MixedRoleGuard implements CanActivate {
- *     canActivate(ctx: ExecutionContext) {
- *       return ctx.getRequest().headers.get('x-role') === role;
- *     }
- *   }
- *   return mixin(MixedRoleGuard);
- * }
- *
- * const AdminGuard = RoleGuardMixin('admin');
- *
- * @UseGuards(AdminGuard)
- * @Get('/admin')
- * adminOnly() { ... }
- * ```
- */ export function mixin(mixinClass) {
-    Injectable()(mixinClass);
-    return mixinClass;
-}

package/dist/container/module-ref.d.ts

@@ -1,21 +0,0 @@
-import type { Token, Type } from './types';
-import type { Container } from './container';
-export declare class ModuleRef {
-    private readonly container;
-    constructor(container: Container);
-    /**
-     * Retrieve a provider instance from the DI container.
-     * Returns the existing singleton (or cached value) for the token.
-     */
-    get<T>(token: Token<T>): T;
-    /**
-     * Resolve a provider, creating a new instance for TRANSIENT-scoped providers.
-     * For SINGLETON-scoped providers this is equivalent to get().
-     */
-    resolve<T>(token: Token<T>): T;
-    /**
-     * Instantiate a class outside of the DI container's singleton cache.
-     * Dependencies are resolved from the container. Each call returns a new instance.
-     */
-    create<T>(type: Type<T>): T;
-}

package/dist/container/module-ref.js

@@ -1,48 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-import { Scope } from "../constants.js";
-import { Injectable } from "./decorators.js";
-export class ModuleRef {
-    container;
-    constructor(container){
-        this.container = container;
-    }
-    /**
-   * Retrieve a provider instance from the DI container.
-   * Returns the existing singleton (or cached value) for the token.
-   */ get(token) {
-        return this.container.resolve(token);
-    }
-    /**
-   * Resolve a provider, creating a new instance for TRANSIENT-scoped providers.
-   * For SINGLETON-scoped providers this is equivalent to get().
-   */ resolve(token) {
-        return this.container.resolve(token);
-    }
-    /**
-   * Instantiate a class outside of the DI container's singleton cache.
-   * Dependencies are resolved from the container. Each call returns a new instance.
-   */ create(type) {
-        const sandbox = this.container.createDetached();
-        sandbox.register({
-            provide: type,
-            useClass: type,
-            scope: Scope.TRANSIENT
-        });
-        return sandbox.resolve(type);
-    }
-}
-ModuleRef = _ts_decorate([
-    Injectable(),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof Container === "undefined" ? Object : Container
-    ])
-], ModuleRef);

package/dist/container/types.d.ts

@@ -1,154 +0,0 @@
-import type { Scope } from '../constants';
-export type Type<T = any> = new (...args: any[]) => T;
-export type Constructor<T = unknown> = abstract new (...args: any[]) => T;
-export interface InjectionTokenOptions<T> {
-    factory?: () => T;
-}
-export declare class InjectionToken<T = unknown> {
-    private readonly description;
-    readonly options?: InjectionTokenOptions<T> | undefined;
-    constructor(description: string, options?: InjectionTokenOptions<T> | undefined);
-    toString(): string;
-}
-export declare class ForwardRef<T = unknown> {
-    readonly factory: () => Token<T>;
-    constructor(factory: () => Token<T>);
-}
-export declare function forwardRef<T>(factory: () => Token<T>): ForwardRef<T>;
-export type Token<T = any> = Type<T> | InjectionToken<T> | string | symbol;
-/**
- * Maps a single DI `Token<T>` to its resolved value type at the type level:
- * - `InjectionToken<T>`           → `T`
- * - `Type<T>` / `Constructor<T>`  → `T` (the instance type)
- * - `ForwardRef<T>`               → `T`
- * - `string` / `symbol`           → `unknown` (runtime-only tokens carry no
- *                                   static type info; the consumer asserts).
- *
- * Used by `AsyncModuleOptions` to give `useFactory` parameters their real
- * types based on the literal `inject` tuple — without `as const` at the call
- * site (relies on the `const` type parameter on the consuming generic).
- */
-export type InferToken<T> = T extends InjectionToken<infer U> ? U : T extends ForwardRef<infer U> ? U : T extends abstract new (...args: any[]) => infer U ? U : unknown;
-/**
- * Map every position of a `Token[]` tuple to its resolved value type.
- * Pairs with `const Inject extends readonly Token<unknown>[]` generics to
- * give `useFactory(...deps)` parameter types inferred from the literal
- * `inject` array.
- */
-export type InferTokens<T extends readonly unknown[]> = {
-    [K in keyof T]: InferToken<T[K]>;
-};
-export interface InjectableOptions {
-    scope?: Scope;
-}
-export interface InjectMetadata {
-    index: number;
-    token?: Token | ForwardRef;
-    optional?: boolean;
-}
-export interface ProviderOptions<T = unknown> {
-    provide?: Token<T>;
-    scope?: Scope;
-    useValue?: T;
-    useFactory?: (...args: any[]) => T | Promise<T>;
-    useClass?: Type<T>;
-    inject?: readonly Token[];
-    useExisting?: Token<T>;
-}
-export interface ProviderRegistration<T = unknown> {
-    provide: Token<T>;
-    /** The declared scope (from `@Injectable`/`@Controller`/provider options). */
-    scope: Scope;
-    /**
-     * Scope after request-scope bubbling: `REQUEST` if this provider (transitively)
-     * depends on a request-scoped provider, else the declared scope. Computed once
-     * at bootstrap (`Container.computeEffectiveScopes`); falls back to `scope`
-     * until then. Governs caching + eager instantiation.
-     */
-    effectiveScope?: Scope;
-    /**
-     * Module that owns this registration. Used by `resolveClass` to determine
-     * the POV from which the class's dependencies resolve. Sandbox/bootstrap
-     * registrations land in the `"__root__"` bucket.
-     */
-    declaringModuleId: string;
-    instance?: T;
-    useValue?: T;
-    useFactory?: (...args: any[]) => T | Promise<T>;
-    useClass?: Type<T>;
-    inject?: readonly Token[];
-    useExisting?: Token<T>;
-}
-export interface ModuleScope {
-    moduleId: string;
-    localProviders: Set<Token>;
-    importedModules: Set<string>;
-    exportedTokens: Set<Token>;
-    isGlobal: boolean;
-    /** Module instance opted into deferred (first-use) materialization. */
-    lazy?: boolean;
-}
-/**
- * The container's seam into lazy-module materialization (implemented by
- * `LazyModuleManager`). The container only ever *claims* a pending module at
- * a resolution trigger and *drains* completed claims when the resolution
- * stack has fully unwound — construction and hook replay live behind this
- * interface so the container stays module-system-agnostic.
- */
-export interface LazyResolutionHook {
-    /** Is this module instance still deferred (untriggered)? */
-    isPending(moduleId: string): boolean;
-    /** Mark a pending module as triggered; idempotent. */
-    claim(moduleId: string): void;
-    /** Any claimed-but-unmaterialized groups? (cheap fast-path check) */
-    hasClaimed(): boolean;
-    /**
-     * A drain loop is currently running. The container must NOT start (or
-     * await) another drain from inside it — the running loop picks pending
-     * claims up; awaiting would self-deadlock on the async path.
-     */
-    isDraining(): boolean;
-    /** Complete claimed groups synchronously; throws if async work surfaces. */
-    drainSync(): void;
-    /** Complete claimed groups, awaiting async construction and hooks. */
-    drainAsync(): Promise<void>;
-}
-export type Diagnostics = 'silent' | 'log' | 'throw';
-export interface ContainerOptions {
-    diagnostics?: Diagnostics;
-}
-/**
- * Human-readable token label — class name, `InjectionToken(desc)`, symbol
- * string, or String() fallback. Public so introspection tooling (module
- * graphs, entrypoint listings) renders tokens the same way vela's own errors
- * do.
- */
-export declare function describeToken(token: Token): string;
-/**
- * One module instance in the loaded graph, serializable (strings only) —
- * what `Container.getModuleDescriptions()` returns for introspection tooling
- * (`vela module graph`). Reads registration state only; never constructs.
- */
-export interface ModuleDescription {
-    moduleId: string;
-    /** moduleIds this instance imports. */
-    imports: string[];
-    isGlobal: boolean;
-    lazy: boolean;
-    /** Token labels registered in this instance's bucket (registration order). */
-    providers: string[];
-    /** Token labels this instance exports. */
-    exports: string[];
-}
-export declare class ModuleVisibilityError extends Error {
-    readonly moduleId: string;
-    readonly token: Token;
-    constructor(moduleId: string, token: Token);
-}
-export declare class MultipleProvidersFoundError extends Error {
-    readonly moduleId: string;
-    readonly token: Token;
-    readonly candidates: string[];
-    constructor(moduleId: string, token: Token, candidates: string[]);
-}
-export declare const ROOT_MODULE_ID = "__root__";

package/dist/container/types.js

@@ -1,49 +0,0 @@
-export class InjectionToken {
-    description;
-    options;
-    constructor(description, options){
-        this.description = description;
-        this.options = options;
-    }
-    toString() {
-        return `InjectionToken(${this.description})`;
-    }
-}
-export class ForwardRef {
-    factory;
-    constructor(factory){
-        this.factory = factory;
-    }
-}
-export function forwardRef(factory) {
-    return new ForwardRef(factory);
-}
-/**
- * Human-readable token label — class name, `InjectionToken(desc)`, symbol
- * string, or String() fallback. Public so introspection tooling (module
- * graphs, entrypoint listings) renders tokens the same way vela's own errors
- * do.
- */ export function describeToken(token) {
-    if (token instanceof InjectionToken) return token.toString();
-    if (typeof token === 'function') return token.name;
-    if (typeof token === 'symbol') return token.toString();
-    return String(token);
-}
-export class ModuleVisibilityError extends Error {
-    moduleId;
-    token;
-    constructor(moduleId, token){
-        super(`Module '${moduleId}' cannot resolve '${describeToken(token)}': ` + `not declared in providers, not imported from another module's exports, not @Global. ` + `Either add to imports/exports or mark as @Global.`), this.moduleId = moduleId, this.token = token;
-        this.name = 'ModuleVisibilityError';
-    }
-}
-export class MultipleProvidersFoundError extends Error {
-    moduleId;
-    token;
-    candidates;
-    constructor(moduleId, token, candidates){
-        super(`Multiple providers found for '${describeToken(token)}' in module '${moduleId}':\n` + candidates.map((c)=>`  - ${c}`).join('\n') + `\nResolve ambiguity by importing only one instance, or by using a per-instance ` + `accessor exposed by the module (e.g., Module.tokenFor(key)).`), this.moduleId = moduleId, this.token = token, this.candidates = candidates;
-        this.name = 'MultipleProvidersFoundError';
-    }
-}
-export const ROOT_MODULE_ID = '__root__';

package/dist/cors/cors.module.d.ts

@@ -1,7 +0,0 @@
-import type { CorsOptions } from './cors.types';
-declare const ConfigurableModuleClass: import("..").ConfigurableModuleClassType<CorsOptions, "forRoot", "create", {
-    isGlobal?: boolean;
-}>;
-export declare class CorsModule extends ConfigurableModuleClass {
-}
-export {};

package/dist/cors/cors.module.js

@@ -1,37 +0,0 @@
-import { cors } from "hono/cors";
-import { defineModule } from "../module/define-module.js";
-import { APP_MIDDLEWARE } from "../pipeline/tokens.js";
-import { CORS_OPTIONS } from "./cors.tokens.js";
-function buildCorsMiddleware(options) {
-    const corsMiddleware = cors({
-        origin: options.origin ?? '*',
-        allowMethods: options.allowMethods,
-        allowHeaders: options.allowHeaders,
-        exposeHeaders: options.exposeHeaders,
-        credentials: options.credentials,
-        maxAge: options.maxAge
-    });
-    return {
-        use: (c, next)=>corsMiddleware(c, next)
-    };
-}
-const { ConfigurableModuleClass } = defineModule({
-    name: 'Cors',
-    optionsToken: CORS_OPTIONS,
-    setup: ({ OPTIONS })=>({
-            providers: [
-                {
-                    provide: APP_MIDDLEWARE,
-                    useFactory: (options)=>buildCorsMiddleware(options),
-                    inject: [
-                        OPTIONS
-                    ]
-                }
-            ],
-            exports: [
-                OPTIONS
-            ]
-        })
-});
-export class CorsModule extends ConfigurableModuleClass {
-}

package/dist/cors/cors.tokens.d.ts

@@ -1,3 +0,0 @@
-import { InjectionToken } from '../container/types';
-import type { CorsOptions } from './cors.types';
-export declare const CORS_OPTIONS: InjectionToken<CorsOptions>;

package/dist/cors/cors.tokens.js

@@ -1,2 +0,0 @@
-import { InjectionToken } from "../container/types.js";
-export const CORS_OPTIONS = new InjectionToken('CORS_OPTIONS');

package/dist/cors/cors.types.d.ts

@@ -1,8 +0,0 @@
-export interface CorsOptions {
-    origin?: string | string[] | ((origin: string) => string | undefined | null);
-    allowMethods?: string[];
-    allowHeaders?: string[];
-    exposeHeaders?: string[];
-    credentials?: boolean;
-    maxAge?: number;
-}

package/dist/cors/cors.types.js

@@ -1 +0,0 @@
-export { };

package/dist/cors/index.d.ts

@@ -1,3 +0,0 @@
-export { CorsModule } from './cors.module';
-export { CORS_OPTIONS } from './cors.tokens';
-export type { CorsOptions } from './cors.types';

package/dist/cors/index.js

@@ -1,2 +0,0 @@
-export { CorsModule } from "./cors.module.js";
-export { CORS_OPTIONS } from "./cors.tokens.js";

package/dist/crypto/signed-url.d.ts

@@ -1,12 +0,0 @@
-export interface SignedUrlOptions {
-    /** Time-to-live in seconds; a matching `expires` param is added + enforced. */
-    expiresIn?: number;
-}
-/**
- * Sign a URL (or path) with HMAC-SHA256, appending `signature` (and `expires`).
- * The signature covers `pathname + search` (minus the signature param). Returns
- * the full URL for absolute inputs, or `pathname?search` for relative ones.
- */
-export declare function signUrl(url: string, secret: string, options?: SignedUrlOptions): Promise<string>;
-/** Verify a signed URL (timing-safe) and enforce `expires`. */
-export declare function verifySignedUrl(url: string, secret: string): Promise<boolean>;

package/dist/crypto/signed-url.js

@@ -1,60 +0,0 @@
-// Signed-URL utilities using HMAC-SHA256 via the Web Crypto API (edge-safe;
-// no node:crypto). Verification uses crypto.subtle.verify for timing-safety.
-// Pattern: https://developers.cloudflare.com/workers/examples/signing-requests/
-//
-// This is the canonical home for the util. `@velajs/vela/storage` re-exports it
-// (see src/storage/index.ts) so the storage subpath API is unchanged, while
-// core (the URL generator + signed-URL guard) imports it here directly — core
-// never reaches into a published subpath.
-async function importKey(secret) {
-    return crypto.subtle.importKey('raw', new TextEncoder().encode(secret), {
-        name: 'HMAC',
-        hash: 'SHA-256'
-    }, false, [
-        'sign',
-        'verify'
-    ]);
-}
-function toBase64Url(buffer) {
-    const bytes = new Uint8Array(buffer);
-    let binary = '';
-    for (const byte of bytes)binary += String.fromCharCode(byte);
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-}
-function fromBase64Url(value) {
-    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
-    const binary = atob(base64);
-    const bytes = new Uint8Array(new ArrayBuffer(binary.length));
-    for(let i = 0; i < binary.length; i++)bytes[i] = binary.charCodeAt(i);
-    return bytes;
-}
-/**
- * Sign a URL (or path) with HMAC-SHA256, appending `signature` (and `expires`).
- * The signature covers `pathname + search` (minus the signature param). Returns
- * the full URL for absolute inputs, or `pathname?search` for relative ones.
- */ export async function signUrl(url, secret, options) {
-    const parsed = new URL(url, 'https://placeholder.local');
-    const key = await importKey(secret);
-    if (options?.expiresIn) {
-        const expires = Math.floor(Date.now() / 1000) + options.expiresIn;
-        parsed.searchParams.set('expires', String(expires));
-    }
-    const dataToSign = `${parsed.pathname}?${parsed.searchParams.toString()}`;
-    const signatureBuffer = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(dataToSign));
-    parsed.searchParams.set('signature', toBase64Url(signatureBuffer));
-    return url.startsWith('http') ? parsed.toString() : `${parsed.pathname}?${parsed.searchParams.toString()}`;
-}
-/** Verify a signed URL (timing-safe) and enforce `expires`. */ export async function verifySignedUrl(url, secret) {
-    const parsed = new URL(url, 'https://placeholder.local');
-    const signature = parsed.searchParams.get('signature');
-    if (!signature) return false;
-    const expires = parsed.searchParams.get('expires');
-    if (expires) {
-        const expiryTime = parseInt(expires, 10);
-        if (Number.isNaN(expiryTime) || Math.floor(Date.now() / 1000) > expiryTime) return false;
-    }
-    parsed.searchParams.delete('signature');
-    const dataToVerify = `${parsed.pathname}?${parsed.searchParams.toString()}`;
-    const key = await importKey(secret);
-    return crypto.subtle.verify('HMAC', key, fromBase64Url(signature), new TextEncoder().encode(dataToVerify));
-}

package/dist/discovery/discoverable.decorator.d.ts

@@ -1,38 +0,0 @@
-/**
- * A decorator whose annotated classes/methods are findable through
- * `DiscoveryService` by the decorator itself (no string key at the call site).
- */
-export interface DiscoverableDecorator<T> {
-    (value: T): ClassDecorator & MethodDecorator;
-    /** The metadata key backing this decorator — stable across HMR re-evals. */
-    KEY: string;
-}
-export interface CreateDiscoverableDecoratorOptions {
-    /**
-     * Append to a class-level list instead of overwriting a single slot —
-     * for stackable method decorators (`@Cron`-style: each application pushes
-     * `{ methodName, ...value }` onto the class's list, which
-     * `DiscoveryService.methodsWithMeta` flattens back to per-method entries).
-     */
-    append?: boolean;
-}
-/**
- * Mint a discoverable decorator for a module's extension surface:
- *
- * ```ts
- * export interface QueueConsumerMeta { queue: string }
- * export const QueueConsumer = createDiscoverableDecorator<QueueConsumerMeta>('vela:queue:consumer');
- *
- * @QueueConsumer({ queue: 'emails' })
- * @Injectable()
- * class EmailConsumer { ... }
- *
- * // At bootstrap, anywhere:
- * discovery.providersWithMeta(QueueConsumer)  // typed { meta: QueueConsumerMeta }
- * ```
- *
- * Unlike `Reflector.createDecorator`, the key is required and caller-chosen:
- * a random key would mint a fresh identity on every HMR re-eval and orphan
- * previously-decorated classes. Namespace it (`'<pkg>:<area>:<thing>'`).
- */
-export declare function createDiscoverableDecorator<T>(key: string, options?: CreateDiscoverableDecoratorOptions): DiscoverableDecorator<T>;