@velajs/vela 1.8.7 → 1.9.0

package/dist/openapi/document.js

@@ -278,14 +278,32 @@ export function createOpenApiDocument(rootModule, options = {}) {
                 description: options.info.description
             } : {}
         },
+        // servers sits between info and paths (OpenAPI convention). Omitted when
+        // the caller passes none, mirroring the components/tags handling below.
+        ...options.servers?.length ? {
+            servers: options.servers
+        } : {},
         paths
     };
+    // components.schemas (generated from DTOs) and components.securitySchemes
+    // (caller-supplied) share the same `components` object — attach it when
+    // either is present so neither clobbers the other.
     const schemas = registry.build();
-    if (schemas) {
+    if (schemas || options.securitySchemes) {
         document.components = {
-            schemas
+            ...schemas ? {
+                schemas
+            } : {},
+            ...options.securitySchemes ? {
+                securitySchemes: options.securitySchemes
+            } : {}
         };
     }
+    // Document-level default security requirements (each operation may override).
+    // Omitted entirely when the caller passes none.
+    if (options.security?.length) {
+        document.security = options.security;
+    }
     // Only attach `tags` when non-empty. Emitting `tags: []` on a tag-less
     // spec is the exact symptom the consumer reported, so omit the key
     // entirely in that case (mirrors the `components` handling above).

package/dist/openapi/types.d.ts

@@ -46,6 +46,13 @@ export interface OpenApiResponse {
         schema: JsonSchema;
     }>;
 }
+/**
+ * A single security requirement: maps a securityScheme name to the scopes it
+ * requires (empty array for apiKey/http schemes). An operation- or document-
+ * level array is an OR of these objects. Kept as a plain record so callers can
+ * build them inline (`{ cookieAuth: [] }`).
+ */
+export type OpenApiSecurityRequirement = Record<string, string[]>;
 export interface OpenApiOperation {
     summary?: string;
     description?: string;
@@ -55,6 +62,35 @@ export interface OpenApiOperation {
     parameters?: OpenApiParameter[];
     requestBody?: OpenApiRequestBody;
     responses: Record<string, OpenApiResponse>;
+    /** Per-operation security requirements (overrides the document-level array). */
+    security?: OpenApiSecurityRequirement[];
+}
+/** An OpenAPI Server Object. Kept loose so callers can add `variables`. */
+export interface OpenApiServer {
+    url: string;
+    description?: string;
+    variables?: Record<string, {
+        enum?: string[];
+        default: string;
+        description?: string;
+    }>;
+    [key: string]: unknown;
+}
+/**
+ * An OpenAPI Security Scheme Object (apiKey / http / oauth2 / openIdConnect /
+ * mutualTLS). Index signature keeps it open so any valid scheme shape passes
+ * without fighting the types (mirrors JsonSchema above).
+ */
+export interface OpenApiSecurityScheme {
+    type: 'apiKey' | 'http' | 'oauth2' | 'openIdConnect' | 'mutualTLS';
+    description?: string;
+    name?: string;
+    in?: 'query' | 'header' | 'cookie';
+    scheme?: string;
+    bearerFormat?: string;
+    flows?: Record<string, unknown>;
+    openIdConnectUrl?: string;
+    [key: string]: unknown;
 }
 export type HttpVerb = 'get' | 'post' | 'put' | 'patch' | 'delete' | 'options' | 'head';
 export type OpenApiPathItem = {
@@ -63,10 +99,13 @@ export type OpenApiPathItem = {
 export interface OpenApiDocument {
     openapi: '3.1.0';
     info: OpenApiInfo;
+    servers?: OpenApiServer[];
     paths: Record<string, OpenApiPathItem>;
     components?: {
         schemas?: Record<string, JsonSchema>;
+        securitySchemes?: Record<string, OpenApiSecurityScheme>;
     };
+    security?: OpenApiSecurityRequirement[];
     tags?: Array<{
         name: string;
         description?: string;
@@ -101,6 +140,21 @@ export interface CreateOpenApiDocumentOptions {
         name: string;
         description?: string;
     }>;
+    /**
+     * Top-level `servers` array (base URLs the API is served from). Emitted
+     * verbatim between `info` and `paths` when non-empty; omitted otherwise.
+     */
+    servers?: OpenApiServer[];
+    /**
+     * Named security schemes, emitted under `components.securitySchemes` (merged
+     * with generated `components.schemas`). Reference them from `security`.
+     */
+    securitySchemes?: Record<string, OpenApiSecurityScheme>;
+    /**
+     * Document-level default security requirements (applies to every operation
+     * unless the operation overrides it). Emitted verbatim when non-empty.
+     */
+    security?: OpenApiSecurityRequirement[];
 }
 export type OpenApiUi = 'swagger' | 'scalar' | 'redoc';
 export interface MountOpenApiOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velajs/vela",
-  "version": "1.8.7",
+  "version": "1.9.0",
   "description": "NestJS-compatible framework for edge runtimes, powered by Hono",
   "type": "module",
   "main": "./dist/index.js",
@@ -29,16 +29,10 @@
     "LICENSE",
     "CHANGELOG.md"
   ],
-  "scripts": {
-    "build": "rm -rf dist && swc src -d dist --strip-leading-paths && tsc --emitDeclarationOnly",
-    "test": "vitest run",
-    "test:workers": "vitest run --config vitest.config.workers.ts",
-    "typecheck": "tsc --noEmit",
-    "prepare": "swc src -d dist --strip-leading-paths && tsc --emitDeclarationOnly",
-    "prepublishOnly": "pnpm run typecheck && pnpm test"
-  },
   "sideEffects": [
-    "./dist/index.js"
+    "./dist/index.js",
+    "./dist/metadata.js",
+    "./dist/schedule-node/index.js"
   ],
   "keywords": [
     "edge",
@@ -68,14 +62,6 @@
   "dependencies": {
     "hono": "^4.12.26"
   },
-  "packageManager": "pnpm@10.20.0",
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "@swc/core",
-      "esbuild",
-      "workerd"
-    ]
-  },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.16.18",
     "@swc/cli": "^0.8.1",
@@ -87,5 +73,11 @@
     "unplugin-swc": "^1.5.9",
     "vitest": "^4.1.9",
     "zod": "^4.4.3"
+  },
+  "scripts": {
+    "build": "rm -rf dist && swc src -d dist --strip-leading-paths && tsc --emitDeclarationOnly",
+    "test": "vitest run",
+    "test:workers": "vitest run --config vitest.config.workers.ts",
+    "typecheck": "tsc --noEmit"
   }
-}
+}