alepha 0.15.0 → 0.15.1

package/dist/core/index.browser.js

@@ -259,6 +259,7 @@ const $module = (options) => {
 	const $ = class extends Module {
 		options = options;
 		register(alepha) {
+			if (options.atoms) for (const atom of options.atoms) alepha.store.register(atom);
 			if (typeof options.register === "function") {
 				options.register(alepha);
 				return;
@@ -395,6 +396,64 @@ var JsonSchemaCodec = class extends SchemaCodec {
 	}
 };
 
+//#endregion
+//#region ../../src/core/primitives/$hook.ts
+/**
+* Registers a new hook.
+*
+* ```ts
+* import { $hook } from "alepha";
+*
+* class MyProvider {
+*   onStart = $hook({
+*     name: "start", // or "configure", "ready", "stop", ...
+*     handler: async (app) => {
+*       // await db.connect(); ...
+*     }
+*   });
+* }
+* ```
+*
+* Hooks are used to run async functions from all registered providers/services.
+*
+* You can't register a hook after the App has started.
+*
+* It's used under the hood by the `configure`, `start`, and `stop` methods.
+* Some modules also use hooks to run their own logic. (e.g. `alepha/server`).
+*
+* You can create your own hooks by using module augmentation:
+*
+* ```ts
+* declare module "alepha" {
+*
+*   interface Hooks {
+*     "my:custom:hook": {
+*       arg1: string;
+*     }
+*   }
+* }
+*
+* await alepha.events.emit("my:custom:hook", { arg1: "value" });
+* ```
+*
+*/
+const $hook = (options) => createPrimitive(HookPrimitive, options);
+var HookPrimitive = class extends Primitive {
+	called = 0;
+	onInit() {
+		const handler = this.options.handler;
+		this.alepha.events.on(this.options.on, {
+			caller: this.config.service,
+			priority: this.options.priority,
+			callback: (args) => {
+				this.called += 1;
+				return handler(args);
+			}
+		});
+	}
+};
+$hook[KIND] = HookPrimitive;
+
 //#endregion
 //#region ../../src/core/helpers/FileLike.ts
 const isTypeFile = (value) => {
@@ -831,22 +890,49 @@ const t = new TypeProvider();
 
 //#endregion
 //#region ../../src/core/providers/KeylessJsonSchemaCodec.ts
+const UNSAFE_KEYS = new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
 /**
 * KeylessJsonSchemaCodec provides schema-driven JSON encoding without keys.
 *
 * It uses the schema to determine field order, allowing the encoded output
 * to be a simple JSON array instead of an object with keys.
-*
-* Performance characteristics:
-* - Encode: 0.94-1.53x vs JSON.stringify (faster for complex objects)
-* - Decode: 1.76-2.00x vs JSON.parse
-* - Size: 50-56% smaller than JSON
 */
 var KeylessJsonSchemaCodec = class extends SchemaCodec {
 	cache = /* @__PURE__ */ new Map();
-	encoder = new TextEncoder();
-	decoder = new TextDecoder();
+	textEncoder = new TextEncoder();
+	textDecoder = new TextDecoder();
 	varCounter = 0;
+	useFunctionCompilation = true;
+	maxArrayLength = 1e4;
+	maxStringLength = 1e6;
+	maxDepth = 50;
+	/**
+	* Configure codec options.
+	*/
+	configure(options) {
+		if (options.useFunctionCompilation !== void 0) {
+			this.useFunctionCompilation = options.useFunctionCompilation;
+			this.cache.clear();
+		}
+		if (options.maxArrayLength !== void 0) this.maxArrayLength = options.maxArrayLength;
+		if (options.maxStringLength !== void 0) this.maxStringLength = options.maxStringLength;
+		if (options.maxDepth !== void 0) this.maxDepth = options.maxDepth;
+		return this;
+	}
+	/**
+	* Hook to auto-detect safe mode on configure.
+	* Disables function compilation in browser by default.
+	*/
+	onConfigure = $hook({
+		on: "configure",
+		handler: () => {
+			this.useFunctionCompilation = this.canUseFunction();
+		}
+	});
 	/**
 	* Encode value to a keyless JSON string.
 	*/
@@ -857,14 +943,14 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 	* Encode value to binary (UTF-8 encoded keyless JSON).
 	*/
 	encodeToBinary(schema, value) {
-		return this.encoder.encode(this.encodeToString(schema, value));
+		return this.textEncoder.encode(this.encodeToString(schema, value));
 	}
 	/**
 	* Decode keyless JSON string or binary to value.
 	*/
 	decode(schema, value) {
 		if (value instanceof Uint8Array) {
-			const text = this.decoder.decode(value);
+			const text = this.textDecoder.decode(value);
 			return this.getCodec(schema).decode(text);
 		}
 		if (typeof value === "string") return this.getCodec(schema).decode(value);
@@ -872,13 +958,54 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 		return value;
 	}
 	/**
+	* Test if `new Function()` is available (not blocked by CSP).
+	*/
+	canUseFunction() {
+		try {
+			return new Function("return true")() === true;
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* Validate schema keys for prototype pollution.
+	* Uses a visited set to avoid infinite recursion on recursive schemas.
+	*/
+	validateSchemaKeys(schema, depth = 0, visited = /* @__PURE__ */ new Set()) {
+		if (visited.has(schema)) return;
+		visited.add(schema);
+		if (depth > this.maxDepth) throw new AlephaError(`Schema depth exceeds maximum allowed (${this.maxDepth})`);
+		if (t.schema.isObject(schema)) {
+			const props = schema.properties;
+			for (const key of Object.keys(props)) {
+				if (UNSAFE_KEYS.has(key)) throw new AlephaError(`Unsafe schema key "${key}" detected. This key is blocked to prevent prototype pollution.`);
+				this.validateSchemaKeys(props[key], depth + 1, visited);
+			}
+		} else if (t.schema.isArray(schema)) {
+			const arrSchema = schema;
+			this.validateSchemaKeys(arrSchema.items, depth + 1, visited);
+		} else if (t.schema.isUnion(schema) || t.schema.isOptional(schema)) this.validateSchemaKeys(this.unwrap(schema), depth, visited);
+	}
+	/**
+	* Validate array length.
+	*/
+	validateArrayLength(arr) {
+		if (arr.length > this.maxArrayLength) throw new AlephaError(`Array length (${arr.length}) exceeds maximum allowed (${this.maxArrayLength})`);
+	}
+	/**
+	* Validate string length.
+	*/
+	validateStringLength(str) {
+		if (str.length > this.maxStringLength) throw new AlephaError(`String length (${str.length}) exceeds maximum allowed (${this.maxStringLength})`);
+	}
+	/**
 	* Get a compiled codec for the given schema.
 	* Codecs are cached for reuse.
 	*/
 	getCodec(schema) {
 		let c = this.cache.get(schema);
 		if (!c) {
-			c = this.compile(schema);
+			c = this.useFunctionCompilation ? this.compileWithFunction(schema) : this.compileInterpreted(schema);
 			this.cache.set(schema, c);
 		}
 		return c;
@@ -886,7 +1013,11 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 	nextVar() {
 		return `_${this.varCounter++}`;
 	}
-	compile(schema) {
+	/**
+	* Compile codec using `new Function()` for maximum performance.
+	* Only used when CSP allows and useFunctionCompilation is true.
+	*/
+	compileWithFunction(schema) {
 		this.varCounter = 0;
 		const encBody = this.genEnc(schema, "v");
 		this.varCounter = 0;
@@ -896,6 +1027,122 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 			decode: new Function("s", `const a=JSON.parse(s);let i=0;${decBody.code}return ${decBody.result};`)
 		};
 	}
+	/**
+	* Compile codec using interpreter-based approach.
+	* Safer (no eval/Function) but slower. Used in browser by default.
+	*/
+	compileInterpreted(schema) {
+		const self = this;
+		return {
+			encode(value) {
+				return JSON.stringify(self.interpretEncode(schema, value));
+			},
+			decode(str) {
+				const ctx = {
+					arr: JSON.parse(str),
+					i: 0
+				};
+				return self.interpretDecode(schema, ctx);
+			}
+		};
+	}
+	interpretEncode(schema, value) {
+		if (t.schema.isString(schema) || t.schema.isNumber(schema) || t.schema.isInteger(schema) || t.schema.isBoolean(schema) || this.isEnum(schema)) return value;
+		if (t.schema.isBigInt(schema)) return `${value}n`;
+		if (t.schema.isArray(schema)) {
+			const arrSchema = schema;
+			if (!Array.isArray(value)) return value;
+			if (t.schema.isString(arrSchema.items) || t.schema.isNumber(arrSchema.items) || t.schema.isInteger(arrSchema.items) || t.schema.isBoolean(arrSchema.items)) return value;
+			return value.map((e) => this.interpretEncode(arrSchema.items, e));
+		}
+		if (t.schema.isObject(schema)) {
+			const objSchema = schema;
+			const props = objSchema.properties;
+			const keys = Object.keys(props);
+			const req = new Set(objSchema.required || []);
+			const result = [];
+			for (const k of keys) {
+				const ps = props[k];
+				const isOpt = !req.has(k) || t.schema.isOptional(ps);
+				const isNullable = this.isNullable(ps);
+				const inner = this.unwrap(ps);
+				const v = value[k];
+				if (isOpt) result.push(v !== void 0 ? this.interpretEncode(inner, v) : null);
+				else if (isNullable) result.push(v !== null ? this.interpretEncode(inner, v) : null);
+				else result.push(this.interpretEncode(inner, v));
+			}
+			return result;
+		}
+		if (t.schema.isOptional(schema) || t.schema.isUnion(schema)) {
+			const inner = this.unwrap(schema);
+			if (this.isNullable(schema)) return value !== null ? this.interpretEncode(inner, value) : null;
+			return value !== void 0 ? this.interpretEncode(inner, value) : null;
+		}
+		return value;
+	}
+	interpretDecode(schema, ctx) {
+		if (t.schema.isString(schema) || t.schema.isNumber(schema) || t.schema.isInteger(schema) || t.schema.isBoolean(schema) || this.isEnum(schema)) return ctx.arr[ctx.i++];
+		if (t.schema.isBigInt(schema)) return BigInt(ctx.arr[ctx.i++].slice(0, -1));
+		if (t.schema.isArray(schema)) {
+			const arrSchema = schema;
+			const arr = ctx.arr[ctx.i++];
+			if (!Array.isArray(arr)) return arr;
+			if (t.schema.isObject(arrSchema.items)) return arr.map((e) => this.interpretDecodeFromValue(arrSchema.items, e));
+			return arr;
+		}
+		if (t.schema.isObject(schema)) {
+			const objSchema = schema;
+			const props = objSchema.properties;
+			const keys = Object.keys(props);
+			const req = new Set(objSchema.required || []);
+			const result = {};
+			for (const k of keys) {
+				const ps = props[k];
+				const isOpt = !req.has(k) || t.schema.isOptional(ps);
+				const isNullable = this.isNullable(ps);
+				const inner = this.unwrap(ps);
+				const val = ctx.arr[ctx.i++];
+				if (isOpt) {
+					if (val !== null) result[k] = this.interpretDecodeFromValue(inner, val);
+				} else if (isNullable) result[k] = val === null ? null : this.interpretDecodeFromValue(inner, val);
+				else result[k] = this.interpretDecodeFromValue(inner, val);
+			}
+			return result;
+		}
+		if (t.schema.isOptional(schema) || t.schema.isUnion(schema)) {
+			const inner = this.unwrap(schema);
+			const val = ctx.arr[ctx.i++];
+			if (val === null) return this.isNullable(schema) ? null : void 0;
+			if (t.schema.isObject(inner) || t.schema.isArray(inner)) return this.interpretDecodeFromValue(inner, val);
+			return val;
+		}
+		return ctx.arr[ctx.i++];
+	}
+	interpretDecodeFromValue(schema, value) {
+		if (t.schema.isString(schema) || t.schema.isNumber(schema) || t.schema.isInteger(schema) || t.schema.isBoolean(schema) || this.isEnum(schema)) return value;
+		if (t.schema.isBigInt(schema)) return BigInt(value.slice(0, -1));
+		if (t.schema.isArray(schema)) {
+			if (!Array.isArray(value)) return value;
+			const arrSchema = schema;
+			if (t.schema.isObject(arrSchema.items)) return value.map((e) => this.interpretDecodeFromValue(arrSchema.items, e));
+			return value;
+		}
+		if (t.schema.isObject(schema)) {
+			const props = schema.properties;
+			const keys = Object.keys(props);
+			const result = {};
+			for (let idx = 0; idx < keys.length; idx++) {
+				const k = keys[idx];
+				const inner = this.unwrap(props[k]);
+				const v = value[idx];
+				if (t.schema.isObject(inner)) result[k] = this.interpretDecodeFromValue(inner, v);
+				else if (t.schema.isBigInt(inner)) result[k] = BigInt(v.slice(0, -1));
+				else result[k] = v;
+			}
+			return result;
+		}
+		return value;
+	}
 	genEnc(schema, ve) {
 		if (t.schema.isString(schema) || t.schema.isNumber(schema) || t.schema.isInteger(schema) || t.schema.isBoolean(schema) || this.isEnum(schema)) return ve;
 		if (t.schema.isBigInt(schema)) return `${ve}+'n'`;
@@ -1087,64 +1334,6 @@ var TypeBoxError = class extends AlephaError {
 	}
 };
 
-//#endregion
-//#region ../../src/core/primitives/$hook.ts
-/**
-* Registers a new hook.
-*
-* ```ts
-* import { $hook } from "alepha";
-*
-* class MyProvider {
-*   onStart = $hook({
-*     name: "start", // or "configure", "ready", "stop", ...
-*     handler: async (app) => {
-*       // await db.connect(); ...
-*     }
-*   });
-* }
-* ```
-*
-* Hooks are used to run async functions from all registered providers/services.
-*
-* You can't register a hook after the App has started.
-*
-* It's used under the hood by the `configure`, `start`, and `stop` methods.
-* Some modules also use hooks to run their own logic. (e.g. `alepha/server`).
-*
-* You can create your own hooks by using module augmentation:
-*
-* ```ts
-* declare module "alepha" {
-*
-*   interface Hooks {
-*     "my:custom:hook": {
-*       arg1: string;
-*     }
-*   }
-* }
-*
-* await alepha.events.emit("my:custom:hook", { arg1: "value" });
-* ```
-*
-*/
-const $hook = (options) => createPrimitive(HookPrimitive, options);
-var HookPrimitive = class extends Primitive {
-	called = 0;
-	onInit() {
-		const handler = this.options.handler;
-		this.alepha.events.on(this.options.on, {
-			caller: this.config.service,
-			priority: this.options.priority,
-			callback: (args) => {
-				this.called += 1;
-				return handler(args);
-			}
-		});
-	}
-};
-$hook[KIND] = HookPrimitive;
-
 //#endregion
 //#region ../../src/core/providers/SchemaValidator.ts
 var SchemaValidator = class {
@@ -1724,13 +1913,10 @@ var Alepha = class Alepha {
 	* If you are not interested about these helpers, you can use the constructor directly.
 	*/
 	static create(state = {}) {
-		if (typeof process === "object" && typeof process.env === "object") {
-			state.env = {
-				...state.env,
-				...process.env
-			};
-			for (const key in state.env) if (state.env[key] === "") delete state.env[key];
-		}
+		if (typeof process === "object" && typeof process.env === "object") state.env = {
+			...state.env,
+			...process.env
+		};
 		const alepha = new Alepha(state);
 		if (alepha.isTest()) {
 			const g = globalThis;
@@ -2088,7 +2274,10 @@ var Alepha = class Alepha {
 				if (!match.parents.includes(parent) && parent !== service) match.parents.push(parent);
 				return match.instance;
 			}
-			if (this.started) throw new ContainerLockedError(`Container is locked. No more services can be added. ${parent?.name} -> ${service.name}`);
+			if (this.started) {
+				const mod = service[MODULE]?.name;
+				throw new ContainerLockedError(`Container is locked. No more services can be added. Attempted to inject '${service.name}' from '${parent?.name}'. ${mod ? `Maybe register module '${mod}' in Alepha.` : ""}`);
+			}
 		}
 		const module = service[MODULE];
 		if (module && typeof module === "function") this.with(module);
@@ -2104,10 +2293,10 @@ var Alepha = class Alepha {
 		if (!transient) registry.set(service, definition);
 		if (instance instanceof Module) {
 			this.modules.push(instance);
-			const parent$1 = __alephaRef.parent;
+			const parent = __alephaRef.parent;
 			__alephaRef.parent = instance.constructor;
 			instance.register(this);
-			__alephaRef.parent = parent$1;
+			__alephaRef.parent = parent;
 		}
 		return instance;
 	}