@velajs/vela 1.19.0 → 1.19.1

package/dist/http/route.manager.js

@@ -1,481 +0,0 @@
-import { Hono } from "hono";
-import { contextStorage } from "hono/context-storage";
-import { HttpMethod } from "../constants.js";
-import { HttpException } from "../errors/http-exception.js";
-import { getMetadata } from "../metadata.js";
-import { joinPaths } from "../registry/paths.js";
-import { ArgumentResolver } from "./argument-resolver.js";
-import { getRouteContributors } from "./route-contributor.js";
-import { buildMiddlewareExecutionContext } from "./execution-context.js";
-import { HandlerExecutor } from "./handler-executor.js";
-import { instantiate, instantiateMany } from "./instantiate.js";
-import { REQUEST_CONTEXT, createRequestContext } from "./request-context.js";
-import { mapResponse } from "./response-mapper.js";
-import { ComponentManager } from "../pipeline/component.manager.js";
-import { shouldFilterCatch } from "../pipeline/decorators.js";
-import { MetadataRegistry } from "../registry/metadata.registry.js";
-const defaultGetClientIp = (c)=>c.req.raw.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? c.req.raw.headers.get('x-real-ip') ?? null;
-// Mirror a response body stream, invoking `onDone` exactly once when it is fully
-// read, errors, or is cancelled. Lets request-scoped resources be disposed only
-// after the body has drained — never mid-stream.
-function disposeStreamWhenDone(body, onDone) {
-    const reader = body.getReader();
-    let finished = false;
-    const finish = ()=>{
-        if (!finished) {
-            finished = true;
-            onDone();
-        }
-    };
-    return new ReadableStream({
-        async pull (controller) {
-            try {
-                const { done, value } = await reader.read();
-                if (done) {
-                    controller.close();
-                    finish();
-                    return;
-                }
-                controller.enqueue(value);
-            } catch (error) {
-                controller.error(error);
-                finish();
-            }
-        },
-        cancel (reason) {
-            finish();
-            return reader.cancel(reason);
-        }
-    });
-}
-export class RouteManager {
-    container;
-    static METHOD_REGISTRAR = new Map([
-        [
-            HttpMethod.GET,
-            (app, p, h)=>app.get(p, h)
-        ],
-        [
-            HttpMethod.POST,
-            (app, p, h)=>app.post(p, h)
-        ],
-        [
-            HttpMethod.PUT,
-            (app, p, h)=>app.put(p, h)
-        ],
-        [
-            HttpMethod.PATCH,
-            (app, p, h)=>app.patch(p, h)
-        ],
-        [
-            HttpMethod.DELETE,
-            (app, p, h)=>app.delete(p, h)
-        ],
-        [
-            HttpMethod.OPTIONS,
-            (app, p, h)=>app.options(p, h)
-        ],
-        [
-            HttpMethod.HEAD,
-            (app, p, h)=>app.get(p, (c, next)=>c.req.method === 'HEAD' ? h(c) : next())
-        ],
-        [
-            HttpMethod.ALL,
-            (app, p, h)=>app.all(p, h)
-        ]
-    ]);
-    controllers = [];
-    globalMiddleware = [];
-    globalPipes = [];
-    globalGuards = [];
-    globalInterceptors = [];
-    globalFilters = [];
-    globalPrefix = '';
-    consumerMiddlewareDefinitions = [];
-    routeDescriptions = [];
-    handlerExecutor;
-    ambientContainer;
-    constructor(container, options = {}){
-        this.container = container;
-        this.ambientContainer = options.ambientContainer ?? false;
-        const argumentResolver = new ArgumentResolver(options.getClientIp ?? defaultGetClientIp);
-        this.handlerExecutor = new HandlerExecutor(argumentResolver, ()=>({
-                guards: this.globalGuards,
-                pipes: this.globalPipes,
-                interceptors: this.globalInterceptors,
-                filters: this.globalFilters
-            }), (c)=>this.getRequestContainer(c));
-    }
-    /**
-   * The global-tier components (`APP_*` provider tokens + imperative
-   * `app.useGlobalX()` instances). Exposed so non-HTTP transports (the
-   * WebSocket dispatcher) can apply the same app-wide guards/pipes/interceptors/
-   * filters as HTTP routes, read live so late registrations propagate.
-   */ getGlobalComponents() {
-        return {
-            guards: this.globalGuards,
-            pipes: this.globalPipes,
-            interceptors: this.globalInterceptors,
-            filters: this.globalFilters
-        };
-    }
-    registerConsumerMiddleware(definitions) {
-        this.consumerMiddlewareDefinitions.push(...definitions);
-        return this;
-    }
-    setGlobalPrefix(prefix) {
-        this.globalPrefix = prefix && !prefix.startsWith('/') ? `/${prefix}` : prefix;
-        return this;
-    }
-    useGlobalMiddleware(...middleware) {
-        this.globalMiddleware.push(...middleware);
-        return this;
-    }
-    useGlobalMiddlewareTokens(...middlewareTokens) {
-        this.globalMiddleware.push(...middlewareTokens);
-        return this;
-    }
-    useGlobalPipes(...pipes) {
-        this.globalPipes.push(...pipes);
-        return this;
-    }
-    useGlobalPipeTokens(...pipeTokens) {
-        this.globalPipes.push(...pipeTokens);
-        return this;
-    }
-    useGlobalGuards(...guards) {
-        this.globalGuards.push(...guards);
-        return this;
-    }
-    useGlobalGuardTokens(...guardTokens) {
-        this.globalGuards.push(...guardTokens);
-        return this;
-    }
-    useGlobalInterceptors(...interceptors) {
-        this.globalInterceptors.push(...interceptors);
-        return this;
-    }
-    useGlobalInterceptorTokens(...interceptorTokens) {
-        this.globalInterceptors.push(...interceptorTokens);
-        return this;
-    }
-    useGlobalFilters(...filters) {
-        this.globalFilters.push(...filters);
-        return this;
-    }
-    useGlobalFilterTokens(...filterTokens) {
-        this.globalFilters.push(...filterTokens);
-        return this;
-    }
-    getMiddlewarePriority(entry) {
-        if (entry == null) return 0;
-        if (typeof entry === 'function') {
-            const p = entry.priority;
-            if (typeof p === 'number') return p;
-        }
-        if (typeof entry === 'object') {
-            const inst = entry;
-            if (typeof inst.priority === 'number') return inst.priority;
-            if (typeof inst.constructor?.priority === 'number') return inst.constructor.priority;
-        }
-        // A token owned exclusively by unmaterialized lazy modules must not be
-        // instantiate-probed here — the probe at route build would defeat the
-        // module's deferral (i18n's APP_MIDDLEWARE). Default priority instead;
-        // the middleware still materializes on its first request.
-        if (this.container.isLazyPending(entry)) return 0;
-        try {
-            const resolved = instantiate(entry, this.container);
-            if (resolved && typeof resolved === 'object') {
-                const p = resolved.priority;
-                if (typeof p === 'number') return p;
-                const cp = resolved.constructor?.priority;
-                if (typeof cp === 'number') return cp;
-            }
-        } catch  {
-        // Unresolvable at build time (e.g. request-scoped) — default 0
-        }
-        return 0;
-    }
-    getRequestContainer(c) {
-        const existing = c.get('container');
-        if (existing) {
-            return existing;
-        }
-        const child = this.container.createChild();
-        child.setRequestInstance(REQUEST_CONTEXT, createRequestContext(c));
-        c.set('container', child);
-        return child;
-    }
-    // Wraps an attached middleware so a thrown error flows through the
-    // exception-filter chain instead of bypassing it on the way to Hono's
-    // outer error handler. Mirrors the catch tail in HandlerExecutor — global
-    // filters are the only scope reachable here, since per-handler filters
-    // require a controller call frame that the middleware boundary lacks.
-    // Non-throwing middleware paths (returning a Response, calling `next()`,
-    // resolving a promise) are byte-identical to before — the wrapper only
-    // intercepts thrown / rejected values.
-    wrapMiddlewareWithFilters(handler) {
-        return async (c, next)=>{
-            try {
-                return await handler(c, next);
-            } catch (error) {
-                const response = await this.mapMiddlewareError(c, error);
-                // Force-replace any handler-set response. A middleware that throws
-                // *after* `await next()` has the handler's body already attached
-                // to `c.res`; without overwriting it, Hono would emit the
-                // pre-throw success response and the filter's render would be
-                // dropped.
-                c.res = response;
-                return response;
-            }
-        };
-    }
-    async mapMiddlewareError(c, error) {
-        const requestContainer = this.getRequestContainer(c);
-        const filters = instantiateMany(this.globalFilters, requestContainer);
-        const host = buildMiddlewareExecutionContext(c);
-        for (const filter of filters){
-            if (shouldFilterCatch(filter, error)) {
-                try {
-                    const filtered = await filter.catch(error, host);
-                    return mapResponse(c, filtered);
-                } catch  {
-                    break;
-                }
-            }
-        }
-        if (error instanceof HttpException) {
-            const response = error.getResponse();
-            const status = error.getStatus();
-            return c.json(response, status);
-        }
-        // Non-HttpException with no catching filter: re-throw so Hono's
-        // outer error handler produces the same default-500 response it
-        // produced before this wrapping was introduced.
-        throw error;
-    }
-    registerController(controller) {
-        const prefix = MetadataRegistry.getControllerPath(controller);
-        const options = MetadataRegistry.getControllerOptions(controller);
-        const routes = MetadataRegistry.getRoutes(controller);
-        // The ModuleLoader registers controllers in their owning module's bucket;
-        // fall back to a `__root__` registration only for controllers that arrive
-        // here outside the module-loading flow (test harnesses, custom adapters).
-        if (!this.container.has(controller)) {
-            this.container.register(controller);
-        }
-        this.controllers.push({
-            controller,
-            metadata: {
-                prefix,
-                version: options.version
-            },
-            routes: routes
-        });
-        return this;
-    }
-    /** The explicit controller routes recorded by the last `build()`. */ getRouteDescriptions() {
-        return [
-            ...this.routeDescriptions
-        ];
-    }
-    /** The global prefix in effect (set at bootstrap; '' when none). */ getGlobalPrefix() {
-        return this.globalPrefix;
-    }
-    async build() {
-        const app = new Hono();
-        this.routeDescriptions = [];
-        // Outermost: dispose the per-request child container once the request is
-        // fully done. Fast-paths out when the child has no request-scoped
-        // disposables (the common case → zero overhead / no behavior change).
-        // Streaming-safe: when a response body is present, disposal is deferred
-        // until the body is fully read (or errors/cancels), never mid-stream.
-        app.use('*', async (c, next)=>{
-            let threw = false;
-            try {
-                await next();
-            } catch (error) {
-                threw = true;
-                throw error;
-            } finally{
-                const child = c.get('container');
-                if (child?.hasDisposables()) {
-                    const body = threw ? null : c.res?.body ?? null;
-                    if (body) {
-                        // Defer disposal to when the runtime finishes reading the body.
-                        c.res = new Response(disposeStreamWhenDone(body, ()=>void child.dispose()), {
-                            status: c.res.status,
-                            statusText: c.res.statusText,
-                            headers: c.res.headers
-                        });
-                    } else {
-                        // No body (or error path) — nothing streaming, dispose now.
-                        await child.dispose();
-                    }
-                }
-            }
-        });
-        // Opt-in ambient container: contextStorage() must be an early middleware so
-        // getContext() is available to everything downstream.
-        if (this.ambientContainer) {
-            app.use('*', contextStorage());
-        }
-        // Sort global middleware by priority (lower runs first) with insertion
-        // index as tiebreaker so equal priorities preserve registration order.
-        const sortedGlobal = this.globalMiddleware.map((entry, index)=>({
-                entry,
-                index,
-                priority: this.getMiddlewarePriority(entry)
-            })).sort((a, b)=>a.priority - b.priority || a.index - b.index);
-        for (const { entry } of sortedGlobal){
-            app.use('*', this.wrapMiddlewareWithFilters((c, next)=>{
-                const requestContainer = this.getRequestContainer(c);
-                const resolved = instantiate(entry, requestContainer);
-                return resolved.use(c, next);
-            }));
-        }
-        const sortedConsumer = this.consumerMiddlewareDefinitions.map((def, index)=>({
-                def,
-                index,
-                priority: def.priority ?? 0
-            })).sort((a, b)=>a.priority - b.priority || a.index - b.index);
-        for (const { def } of sortedConsumer){
-            const matchRoute = this.compileRouteMatcher(def.routes);
-            const matchExclude = this.compileRouteMatcher(def.excludes);
-            app.use('*', this.wrapMiddlewareWithFilters((c, next)=>{
-                const path = c.req.path;
-                const method = c.req.method;
-                if (!matchRoute(path, method) || matchExclude(path, method)) return next();
-                const requestContainer = this.getRequestContainer(c);
-                const runChain = (index)=>{
-                    if (index >= def.middleware.length) return next();
-                    const instance = instantiate(def.middleware[index], requestContainer);
-                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                    return instance.use(c, ()=>runChain(index + 1)).then(()=>{});
-                };
-                return runChain(0);
-            }));
-        }
-        // First pass: register all custom routes (must come before CRUD /:id routes).
-        for (const { controller, metadata, routes } of this.controllers){
-            if (routes.length > 0) {
-                const allParamMetadata = MetadataRegistry.getParameters(controller);
-                for (const route of routes){
-                    const effectiveVersion = route.version ?? metadata.version;
-                    const versionedPaths = this.buildVersionedPaths(this.globalPrefix, metadata.prefix, route.path, effectiveVersion);
-                    // Parallel to versionedPaths: buildVersionedPaths maps versions to
-                    // paths 1:1 in order, so index i of both arrays belongs together.
-                    const versionsForPaths = effectiveVersion === undefined ? [
-                        undefined
-                    ] : Array.isArray(effectiveVersion) ? effectiveVersion : [
-                        effectiveVersion
-                    ];
-                    // Scoped (controller/handler) middleware only — global middleware is
-                    // applied once by this manager's own global pass, never re-read here.
-                    const middlewareItems = ComponentManager.getScopedComponents('middleware', controller, route.handlerName);
-                    const handler = this.handlerExecutor.create(route, controller, allParamMetadata);
-                    for (const [pathIndex, fullPath] of versionedPaths.entries()){
-                        for (const middlewareItem of middlewareItems){
-                            app.use(fullPath, this.wrapMiddlewareWithFilters((c, next)=>{
-                                const requestContainer = this.getRequestContainer(c);
-                                const resolved = instantiate(middlewareItem, requestContainer);
-                                return resolved.use(c, next);
-                            }));
-                        }
-                        this.registerRoute(app, route.method, fullPath, handler);
-                        this.routeDescriptions.push({
-                            method: String(route.method),
-                            path: fullPath || '/',
-                            controller: controller.name,
-                            handler: String(route.handlerName),
-                            version: versionsForPaths[pathIndex],
-                            ...route.name !== undefined ? {
-                                name: route.name
-                            } : {}
-                        });
-                    }
-                }
-            }
-        }
-        // Second pass: route contributors (generated routes registered last, so a
-        // contributor's `/:id` catch-alls never shadow explicit routes). Each
-        // contributor claims controllers by class-level metadata; `@velajs/crud`
-        // registers one as an import side effect. The registry contract (instead
-        // of dynamic `import()`) exists because esbuild leaves
-        // `await import(variable)` as a runtime import Cloudflare Workers cannot
-        // resolve.
-        const contributors = getRouteContributors();
-        for (const { controller, metadata, routes } of this.controllers){
-            for (const contributor of contributors){
-                const meta = getMetadata(contributor.claimsMetaKey, controller);
-                if (meta === undefined) continue;
-                await contributor.buildRoutes(app, {
-                    controller,
-                    controllerPrefix: metadata.prefix,
-                    meta,
-                    globalPrefix: this.globalPrefix,
-                    globalGuards: instantiateMany(this.globalGuards, this.container),
-                    container: this.container,
-                    joinPaths
-                });
-            }
-            // DX warning for stale setups: @Crud() metadata but nothing produced a
-            // route — native @velajs/crud (>=1.18) stamps real routes at decoration
-            // time, and legacy bridges register a claiming contributor.
-            if (getMetadata('vela:crud', controller) !== undefined && routes.length === 0 && !contributors.some((c)=>c.claimsMetaKey === 'vela:crud')) {
-                console.warn(`[vela] ${controller.name} carries @Crud() metadata but produced no routes — ` + "install and import '@velajs/crud' (>=1.18), or remove the decorator.");
-            }
-        }
-        return app;
-    }
-    registerRoute(app, method, path, handler) {
-        const normalizedPath = path || '/';
-        const registrar = RouteManager.METHOD_REGISTRAR.get(method);
-        if (registrar) {
-            registrar(app, normalizedPath, handler);
-        } else {
-            app.on(method, normalizedPath, handler);
-        }
-    }
-    buildVersionedPaths(globalPrefix, controllerPrefix, routePath, version) {
-        if (version === undefined) {
-            return [
-                joinPaths(globalPrefix, joinPaths(controllerPrefix, routePath))
-            ];
-        }
-        const versions = Array.isArray(version) ? version : [
-            version
-        ];
-        return versions.map((v)=>{
-            const versionSegment = `/v${v}`;
-            return joinPaths(globalPrefix, joinPaths(versionSegment, joinPaths(controllerPrefix, routePath)));
-        });
-    }
-    compilePathMatcher(routePath) {
-        if (routePath === '*') return ()=>true;
-        const norm = routePath.startsWith('/') ? routePath : `/${routePath}`;
-        if (norm.endsWith('*')) {
-            const prefix = norm.slice(0, -1);
-            return (p)=>p.startsWith(prefix);
-        }
-        return (p)=>p === norm || p.startsWith(`${norm}/`);
-    }
-    compileRouteMatcher(routes) {
-        const matchers = routes.map((route)=>{
-            const matchPath = this.compilePathMatcher(route.path);
-            return (path, method)=>{
-                if (!matchPath(path)) return false;
-                if (route.method && route.method !== HttpMethod.ALL) return method === route.method;
-                return true;
-            };
-        });
-        if (matchers.length === 0) return ()=>false;
-        if (matchers.length === 1) return matchers[0];
-        return (path, method)=>matchers.some((m)=>m(path, method));
-    }
-    getControllers() {
-        return [
-            ...this.controllers
-        ];
-    }
-}

package/dist/http/types.d.ts

@@ -1,37 +0,0 @@
-import type { HttpMethod } from '../constants';
-import type { Type } from '../container/types';
-import type { PipeType } from '../registry/types';
-export interface RouteMetadata {
-    method: HttpMethod;
-    path: string;
-    handlerName: string | symbol;
-    version?: number | number[];
-    /** Route name for URL generation / OpenAPI operationId (`@Get(path, { name })`). */
-    name?: string;
-}
-export interface ControllerOptions {
-    path?: string;
-    version?: number | number[];
-}
-export interface ControllerMetadata {
-    prefix: string;
-    version?: number | number[];
-}
-export interface ParamMetadata {
-    index: number;
-    type: string;
-    name?: string;
-    pipes?: PipeType[];
-    factory?: (data: unknown, ctx: import('hono').Context) => unknown;
-    /**
-     * Explicit param type for programmatic routes. Methods synthesized at
-     * runtime (e.g. `@Crud()` verb handlers) have no `design:paramtypes`, so
-     * ValidationPipe and the OpenAPI walk read this instead when present.
-     */
-    metatype?: unknown;
-}
-export interface ControllerRegistration {
-    controller: Type;
-    metadata: ControllerMetadata;
-    routes: RouteMetadata[];
-}

package/dist/http/types.js

@@ -1 +0,0 @@
-export { };

package/dist/http/url/index.d.ts

@@ -1,4 +0,0 @@
-export { UrlGeneratorService } from './url-generator.service';
-export type { UrlForOptions, SignedUrlGenerateOptions } from './url-generator.service';
-export { SignedUrlGuard, SignedUrl } from './signed-url.guard';
-export { URL_SIGNING_SECRET } from './signing-secret';

package/dist/http/url/index.js

@@ -1,3 +0,0 @@
-export { UrlGeneratorService } from "./url-generator.service.js";
-export { SignedUrlGuard, SignedUrl } from "./signed-url.guard.js";
-export { URL_SIGNING_SECRET } from "./signing-secret.js";

package/dist/http/url/signed-url.guard.d.ts

@@ -1,27 +0,0 @@
-import { applyDecorators } from '../decorators';
-import type { CanActivate, ExecutionContext } from '../../pipeline/types';
-/**
- * Verifies the HMAC signature (and `expires`) of the incoming request URL,
- * using the same secret source as {@link UrlGeneratorService.signedUrl}: the
- * {@link URL_SIGNING_SECRET} token, else `CONFIG_ENV`. Throws
- * `ForbiddenException` (403) when the signature is missing, tampered, or
- * expired. Registered app-wide by `bootstrap`; apply it per-route with
- * {@link SignedUrl}.
- */
-export declare class SignedUrlGuard implements CanActivate {
-    private readonly secretToken?;
-    private readonly env;
-    constructor(secretToken?: string | undefined, env?: Record<string, unknown>);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-}
-/**
- * Guards a route with {@link SignedUrlGuard} — the request must carry a valid,
- * unexpired HMAC signature (produced by `UrlGeneratorService.signedUrl`).
- *
- * ```ts
- * @Get('download', { name: 'file.download' })
- * @SignedUrl()
- * download() { ... }
- * ```
- */
-export declare function SignedUrl(): ReturnType<typeof applyDecorators>;

package/dist/http/url/signed-url.guard.js

@@ -1,62 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { Injectable, Inject, Optional } from "../../container/decorators.js";
-import { CONFIG_ENV } from "../../config/config.tokens.js";
-import { verifySignedUrl } from "../../crypto/signed-url.js";
-import { ForbiddenException } from "../../errors/http-exception.js";
-import { applyDecorators } from "../decorators.js";
-import { UseGuards } from "../../pipeline/decorators.js";
-import { URL_SIGNING_SECRET, resolveSigningSecret } from "./signing-secret.js";
-export class SignedUrlGuard {
-    secretToken;
-    env;
-    constructor(secretToken, env = {}){
-        this.secretToken = secretToken;
-        this.env = env;
-    }
-    async canActivate(context) {
-        const request = context.switchToHttp().getRequest();
-        const secret = resolveSigningSecret(undefined, this.secretToken, this.env);
-        const valid = await verifySignedUrl(request.url, secret);
-        if (!valid) {
-            throw new ForbiddenException('Invalid or expired signed URL');
-        }
-        return true;
-    }
-}
-SignedUrlGuard = _ts_decorate([
-    Injectable(),
-    _ts_param(0, Optional()),
-    _ts_param(0, Inject(URL_SIGNING_SECRET)),
-    _ts_param(1, Optional()),
-    _ts_param(1, Inject(CONFIG_ENV)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        typeof Record === "undefined" ? Object : Record
-    ])
-], SignedUrlGuard);
-/**
- * Guards a route with {@link SignedUrlGuard} — the request must carry a valid,
- * unexpired HMAC signature (produced by `UrlGeneratorService.signedUrl`).
- *
- * ```ts
- * @Get('download', { name: 'file.download' })
- * @SignedUrl()
- * download() { ... }
- * ```
- */ export function SignedUrl() {
-    return applyDecorators(UseGuards(SignedUrlGuard));
-}

package/dist/http/url/signing-secret.d.ts

@@ -1,20 +0,0 @@
-import { InjectionToken } from '../../container/types';
-/**
- * Optional DI token holding the HMAC secret used to sign / verify URLs. Provide
- * it globally (e.g. from a platform adapter or a `@Global` module) so both
- * {@link UrlGeneratorService} and the signed-URL guard can read it:
- *
- * ```ts
- * { provide: URL_SIGNING_SECRET, useValue: env.URL_SIGNING_SECRET }
- * ```
- */
-export declare const URL_SIGNING_SECRET: InjectionToken<string>;
-/** Key read from `CONFIG_ENV` when no explicit secret / token is available. */
-export declare const URL_SIGNING_SECRET_ENV_KEY = "URL_SIGNING_SECRET";
-/**
- * Resolve the signing secret from, in order: an explicit argument, the
- * {@link URL_SIGNING_SECRET} token, then `CONFIG_ENV[URL_SIGNING_SECRET]`.
- * Throws a descriptive error when none is available — signing must never fall
- * back to an empty/implicit key.
- */
-export declare function resolveSigningSecret(explicit: string | undefined, token: string | undefined, env: Record<string, unknown> | undefined): string;

package/dist/http/url/signing-secret.js

@@ -1,24 +0,0 @@
-import { InjectionToken } from "../../container/types.js";
-/**
- * Optional DI token holding the HMAC secret used to sign / verify URLs. Provide
- * it globally (e.g. from a platform adapter or a `@Global` module) so both
- * {@link UrlGeneratorService} and the signed-URL guard can read it:
- *
- * ```ts
- * { provide: URL_SIGNING_SECRET, useValue: env.URL_SIGNING_SECRET }
- * ```
- */ export const URL_SIGNING_SECRET = new InjectionToken('URL_SIGNING_SECRET');
-/** Key read from `CONFIG_ENV` when no explicit secret / token is available. */ export const URL_SIGNING_SECRET_ENV_KEY = 'URL_SIGNING_SECRET';
-/**
- * Resolve the signing secret from, in order: an explicit argument, the
- * {@link URL_SIGNING_SECRET} token, then `CONFIG_ENV[URL_SIGNING_SECRET]`.
- * Throws a descriptive error when none is available — signing must never fall
- * back to an empty/implicit key.
- */ export function resolveSigningSecret(explicit, token, env) {
-    const fromEnv = env?.[URL_SIGNING_SECRET_ENV_KEY];
-    const secret = explicit ?? token ?? (typeof fromEnv === 'string' ? fromEnv : undefined);
-    if (!secret) {
-        throw new Error('No URL signing secret is available. Pass one explicitly, register a ' + '`URL_SIGNING_SECRET` provider, or set `URL_SIGNING_SECRET` in `CONFIG_ENV`.');
-    }
-    return secret;
-}