alepha 0.15.0 → 0.15.2

package/dist/core/index.browser.js

@@ -259,6 +259,7 @@ const $module = (options) => {
 	const $ = class extends Module {
 		options = options;
 		register(alepha) {
+			if (options.atoms) for (const atom of options.atoms) alepha.store.register(atom);
 			if (typeof options.register === "function") {
 				options.register(alepha);
 				return;
@@ -357,12 +358,8 @@ var InjectPrimitive = class extends Primitive {};
 * Used across the codebase via dependency injection.
 */
 var Json = class {
-	stringify(value, replacer, space) {
-		return JSON.stringify(value, replacer, space);
-	}
-	parse(text, reviver) {
-		return JSON.parse(text, reviver);
-	}
+	stringify = JSON.stringify;
+	parse = JSON.parse;
 };
 
 //#endregion
@@ -395,6 +392,64 @@ var JsonSchemaCodec = class extends SchemaCodec {
 	}
 };
 
+//#endregion
+//#region ../../src/core/primitives/$hook.ts
+/**
+* Registers a new hook.
+*
+* ```ts
+* import { $hook } from "alepha";
+*
+* class MyProvider {
+*   onStart = $hook({
+*     name: "start", // or "configure", "ready", "stop", ...
+*     handler: async (app) => {
+*       // await db.connect(); ...
+*     }
+*   });
+* }
+* ```
+*
+* Hooks are used to run async functions from all registered providers/services.
+*
+* You can't register a hook after the App has started.
+*
+* It's used under the hood by the `configure`, `start`, and `stop` methods.
+* Some modules also use hooks to run their own logic. (e.g. `alepha/server`).
+*
+* You can create your own hooks by using module augmentation:
+*
+* ```ts
+* declare module "alepha" {
+*
+*   interface Hooks {
+*     "my:custom:hook": {
+*       arg1: string;
+*     }
+*   }
+* }
+*
+* await alepha.events.emit("my:custom:hook", { arg1: "value" });
+* ```
+*
+*/
+const $hook = (options) => createPrimitive(HookPrimitive, options);
+var HookPrimitive = class extends Primitive {
+	called = 0;
+	onInit() {
+		const handler = this.options.handler;
+		this.alepha.events.on(this.options.on, {
+			caller: this.config.service,
+			priority: this.options.priority,
+			callback: (args) => {
+				this.called += 1;
+				return handler(args);
+			}
+		});
+	}
+};
+$hook[KIND] = HookPrimitive;
+
 //#endregion
 //#region ../../src/core/helpers/FileLike.ts
 const isTypeFile = (value) => {
@@ -831,22 +886,49 @@ const t = new TypeProvider();
 
 //#endregion
 //#region ../../src/core/providers/KeylessJsonSchemaCodec.ts
+const UNSAFE_KEYS = new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
 /**
 * KeylessJsonSchemaCodec provides schema-driven JSON encoding without keys.
 *
 * It uses the schema to determine field order, allowing the encoded output
 * to be a simple JSON array instead of an object with keys.
-*
-* Performance characteristics:
-* - Encode: 0.94-1.53x vs JSON.stringify (faster for complex objects)
-* - Decode: 1.76-2.00x vs JSON.parse
-* - Size: 50-56% smaller than JSON
 */
 var KeylessJsonSchemaCodec = class extends SchemaCodec {
 	cache = /* @__PURE__ */ new Map();
-	encoder = new TextEncoder();
-	decoder = new TextDecoder();
+	textEncoder = new TextEncoder();
+	textDecoder = new TextDecoder();
 	varCounter = 0;
+	useFunctionCompilation = true;
+	maxArrayLength = 1e4;
+	maxStringLength = 1e6;
+	maxDepth = 50;
+	/**
+	* Configure codec options.
+	*/
+	configure(options) {
+		if (options.useFunctionCompilation !== void 0) {
+			this.useFunctionCompilation = options.useFunctionCompilation;
+			this.cache.clear();
+		}
+		if (options.maxArrayLength !== void 0) this.maxArrayLength = options.maxArrayLength;
+		if (options.maxStringLength !== void 0) this.maxStringLength = options.maxStringLength;
+		if (options.maxDepth !== void 0) this.maxDepth = options.maxDepth;
+		return this;
+	}
+	/**
+	* Hook to auto-detect safe mode on configure.
+	* Disables function compilation in browser by default.
+	*/
+	onConfigure = $hook({
+		on: "configure",
+		handler: () => {
+			this.useFunctionCompilation = this.canUseFunction();
+		}
+	});
 	/**
 	* Encode value to a keyless JSON string.
 	*/
@@ -857,14 +939,14 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 	* Encode value to binary (UTF-8 encoded keyless JSON).
 	*/
 	encodeToBinary(schema, value) {
-		return this.encoder.encode(this.encodeToString(schema, value));
+		return this.textEncoder.encode(this.encodeToString(schema, value));
 	}
 	/**
 	* Decode keyless JSON string or binary to value.
 	*/
 	decode(schema, value) {
 		if (value instanceof Uint8Array) {
-			const text = this.decoder.decode(value);
+			const text = this.textDecoder.decode(value);
 			return this.getCodec(schema).decode(text);
 		}
 		if (typeof value === "string") return this.getCodec(schema).decode(value);
@@ -872,13 +954,54 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 		return value;
 	}
 	/**
+	* Test if `new Function()` is available (not blocked by CSP).
+	*/
+	canUseFunction() {
+		try {
+			return new Function("return true")() === true;
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* Validate schema keys for prototype pollution.
+	* Uses a visited set to avoid infinite recursion on recursive schemas.
+	*/
+	validateSchemaKeys(schema, depth = 0, visited = /* @__PURE__ */ new Set()) {
+		if (visited.has(schema)) return;
+		visited.add(schema);
+		if (depth > this.maxDepth) throw new AlephaError(`Schema depth exceeds maximum allowed (${this.maxDepth})`);
+		if (t.schema.isObject(schema)) {
+			const props = schema.properties;
+			for (const key of Object.keys(props)) {
+				if (UNSAFE_KEYS.has(key)) throw new AlephaError(`Unsafe schema key "${key}" detected. This key is blocked to prevent prototype pollution.`);
+				this.validateSchemaKeys(props[key], depth + 1, visited);
+			}
+		} else if (t.schema.isArray(schema)) {
+			const arrSchema = schema;
+			this.validateSchemaKeys(arrSchema.items, depth + 1, visited);
+		} else if (t.schema.isUnion(schema) || t.schema.isOptional(schema)) this.validateSchemaKeys(this.unwrap(schema), depth, visited);
+	}
+	/**
+	* Validate array length.
+	*/
+	validateArrayLength(arr) {
+		if (arr.length > this.maxArrayLength) throw new AlephaError(`Array length (${arr.length}) exceeds maximum allowed (${this.maxArrayLength})`);
+	}
+	/**
+	* Validate string length.
+	*/
+	validateStringLength(str) {
+		if (str.length > this.maxStringLength) throw new AlephaError(`String length (${str.length}) exceeds maximum allowed (${this.maxStringLength})`);
+	}
+	/**
 	* Get a compiled codec for the given schema.
 	* Codecs are cached for reuse.
 	*/
 	getCodec(schema) {
 		let c = this.cache.get(schema);
 		if (!c) {
-			c = this.compile(schema);
+			c = this.useFunctionCompilation ? this.compileWithFunction(schema) : this.compileInterpreted(schema);
 			this.cache.set(schema, c);
 		}
 		return c;
@@ -886,7 +1009,11 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 	nextVar() {
 		return `_${this.varCounter++}`;
 	}
-	compile(schema) {
+	/**
+	* Compile codec using `new Function()` for maximum performance.
+	* Only used when CSP allows and useFunctionCompilation is true.
+	*/
+	compileWithFunction(schema) {
 		this.varCounter = 0;
 		const encBody = this.genEnc(schema, "v");
 		this.varCounter = 0;
@@ -896,6 +1023,122 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 			decode: new Function("s", `const a=JSON.parse(s);let i=0;${decBody.code}return ${decBody.result};`)
 		};
 	}
+	/**
+	* Compile codec using interpreter-based approach.
+	* Safer (no eval/Function) but slower. Used in browser by default.
+	*/
+	compileInterpreted(schema) {
+		const self = this;
+		return {
+			encode(value) {
+				return JSON.stringify(self.interpretEncode(schema, value));
+			},
+			decode(str) {
+				const ctx = {
+					arr: JSON.parse(str),
+					i: 0
+				};
+				return self.interpretDecode(schema, ctx);
+			}
+		};
+	}
+	interpretEncode(schema, value) {
+		if (t.schema.isString(schema) || t.schema.isNumber(schema) || t.schema.isInteger(schema) || t.schema.isBoolean(schema) || this.isEnum(schema)) return value;
+		if (t.schema.isBigInt(schema)) return `${value}n`;
+		if (t.schema.isArray(schema)) {
+			const arrSchema = schema;
+			if (!Array.isArray(value)) return value;
+			if (t.schema.isString(arrSchema.items) || t.schema.isNumber(arrSchema.items) || t.schema.isInteger(arrSchema.items) || t.schema.isBoolean(arrSchema.items)) return value;
+			return value.map((e) => this.interpretEncode(arrSchema.items, e));
+		}
+		if (t.schema.isObject(schema)) {
+			const objSchema = schema;
+			const props = objSchema.properties;
+			const keys = Object.keys(props);
+			const req = new Set(objSchema.required || []);
+			const result = [];
+			for (const k of keys) {
+				const ps = props[k];
+				const isOpt = !req.has(k) || t.schema.isOptional(ps);
+				const isNullable = this.isNullable(ps);
+				const inner = this.unwrap(ps);
+				const v = value[k];
+				if (isOpt) result.push(v !== void 0 ? this.interpretEncode(inner, v) : null);
+				else if (isNullable) result.push(v !== null ? this.interpretEncode(inner, v) : null);
+				else result.push(this.interpretEncode(inner, v));
+			}
+			return result;
+		}
+		if (t.schema.isOptional(schema) || t.schema.isUnion(schema)) {
+			const inner = this.unwrap(schema);
+			if (this.isNullable(schema)) return value !== null ? this.interpretEncode(inner, value) : null;
+			return value !== void 0 ? this.interpretEncode(inner, value) : null;
+		}
+		return value;
+	}
+	interpretDecode(schema, ctx) {
+		if (t.schema.isString(schema) || t.schema.isNumber(schema) || t.schema.isInteger(schema) || t.schema.isBoolean(schema) || this.isEnum(schema)) return ctx.arr[ctx.i++];
+		if (t.schema.isBigInt(schema)) return BigInt(ctx.arr[ctx.i++].slice(0, -1));
+		if (t.schema.isArray(schema)) {
+			const arrSchema = schema;
+			const arr = ctx.arr[ctx.i++];
+			if (!Array.isArray(arr)) return arr;
+			if (t.schema.isObject(arrSchema.items)) return arr.map((e) => this.interpretDecodeFromValue(arrSchema.items, e));
+			return arr;
+		}
+		if (t.schema.isObject(schema)) {
+			const objSchema = schema;
+			const props = objSchema.properties;
+			const keys = Object.keys(props);
+			const req = new Set(objSchema.required || []);
+			const result = {};
+			for (const k of keys) {
+				const ps = props[k];
+				const isOpt = !req.has(k) || t.schema.isOptional(ps);
+				const isNullable = this.isNullable(ps);
+				const inner = this.unwrap(ps);
+				const val = ctx.arr[ctx.i++];
+				if (isOpt) {
+					if (val !== null) result[k] = this.interpretDecodeFromValue(inner, val);
+				} else if (isNullable) result[k] = val === null ? null : this.interpretDecodeFromValue(inner, val);
+				else result[k] = this.interpretDecodeFromValue(inner, val);
+			}
+			return result;
+		}
+		if (t.schema.isOptional(schema) || t.schema.isUnion(schema)) {
+			const inner = this.unwrap(schema);
+			const val = ctx.arr[ctx.i++];
+			if (val === null) return this.isNullable(schema) ? null : void 0;
+			if (t.schema.isObject(inner) || t.schema.isArray(inner)) return this.interpretDecodeFromValue(inner, val);
+			return val;
+		}
+		return ctx.arr[ctx.i++];
+	}
+	interpretDecodeFromValue(schema, value) {
+		if (t.schema.isString(schema) || t.schema.isNumber(schema) || t.schema.isInteger(schema) || t.schema.isBoolean(schema) || this.isEnum(schema)) return value;
+		if (t.schema.isBigInt(schema)) return BigInt(value.slice(0, -1));
+		if (t.schema.isArray(schema)) {
+			if (!Array.isArray(value)) return value;
+			const arrSchema = schema;
+			if (t.schema.isObject(arrSchema.items)) return value.map((e) => this.interpretDecodeFromValue(arrSchema.items, e));
+			return value;
+		}
+		if (t.schema.isObject(schema)) {
+			const props = schema.properties;
+			const keys = Object.keys(props);
+			const result = {};
+			for (let idx = 0; idx < keys.length; idx++) {
+				const k = keys[idx];
+				const inner = this.unwrap(props[k]);
+				const v = value[idx];
+				if (t.schema.isObject(inner)) result[k] = this.interpretDecodeFromValue(inner, v);
+				else if (t.schema.isBigInt(inner)) result[k] = BigInt(v.slice(0, -1));
+				else result[k] = v;
+			}
+			return result;
+		}
+		return value;
+	}
 	genEnc(schema, ve) {
 		if (t.schema.isString(schema) || t.schema.isNumber(schema) || t.schema.isInteger(schema) || t.schema.isBoolean(schema) || this.isEnum(schema)) return ve;
 		if (t.schema.isBigInt(schema)) return `${ve}+'n'`;
@@ -1087,64 +1330,6 @@ var TypeBoxError = class extends AlephaError {
 	}
 };
 
-//#endregion
-//#region ../../src/core/primitives/$hook.ts
-/**
-* Registers a new hook.
-*
-* ```ts
-* import { $hook } from "alepha";
-*
-* class MyProvider {
-*   onStart = $hook({
-*     name: "start", // or "configure", "ready", "stop", ...
-*     handler: async (app) => {
-*       // await db.connect(); ...
-*     }
-*   });
-* }
-* ```
-*
-* Hooks are used to run async functions from all registered providers/services.
-*
-* You can't register a hook after the App has started.
-*
-* It's used under the hood by the `configure`, `start`, and `stop` methods.
-* Some modules also use hooks to run their own logic. (e.g. `alepha/server`).
-*
-* You can create your own hooks by using module augmentation:
-*
-* ```ts
-* declare module "alepha" {
-*
-*   interface Hooks {
-*     "my:custom:hook": {
-*       arg1: string;
-*     }
-*   }
-* }
-*
-* await alepha.events.emit("my:custom:hook", { arg1: "value" });
-* ```
-*
-*/
-const $hook = (options) => createPrimitive(HookPrimitive, options);
-var HookPrimitive = class extends Primitive {
-	called = 0;
-	onInit() {
-		const handler = this.options.handler;
-		this.alepha.events.on(this.options.on, {
-			caller: this.config.service,
-			priority: this.options.priority,
-			callback: (args) => {
-				this.called += 1;
-				return handler(args);
-			}
-		});
-	}
-};
-$hook[KIND] = HookPrimitive;
-
 //#endregion
 //#region ../../src/core/providers/SchemaValidator.ts
 var SchemaValidator = class {
@@ -1400,7 +1585,7 @@ var EventManager = class {
 	async emit(func, payload, options = {}) {
 		const events = this.events[func];
 		if (!events || events.length === 0) return;
-		if (events.length === 1 && !options.log && !options.reverse) {
+		if (events.length === 1 && !options.log) {
 			const hook = events[0];
 			try {
 				const result = hook.callback(payload);
@@ -1419,9 +1604,7 @@ var EventManager = class {
 			ctx.now = performance.now();
 			this.log?.trace(`${String(func)} ...`);
 		}
-		let eventList = events;
-		if (options.reverse) eventList = events.toReversed();
-		for (const hook of eventList) {
+		for (const hook of events) {
 			const name = hook.caller?.name ?? "unknown";
 			if (options.log) {
 				ctx.now2 = performance.now();
@@ -1724,13 +1907,10 @@ var Alepha = class Alepha {
 	* If you are not interested about these helpers, you can use the constructor directly.
 	*/
 	static create(state = {}) {
-		if (typeof process === "object" && typeof process.env === "object") {
-			state.env = {
-				...state.env,
-				...process.env
-			};
-			for (const key in state.env) if (state.env[key] === "") delete state.env[key];
-		}
+		if (typeof process === "object" && typeof process.env === "object") state.env = {
+			...state.env,
+			...process.env
+		};
 		const alepha = new Alepha(state);
 		if (alepha.isTest()) {
 			const g = globalThis;
@@ -1985,10 +2165,7 @@ var Alepha = class Alepha {
 	async stop() {
 		if (!this.started) return;
 		this.log?.info("Stopping App...");
-		await this.events.emit("stop", this, {
-			reverse: true,
-			log: true
-		});
+		await this.events.emit("stop", this, { log: true });
 		this.log?.info("App is now off");
 		this.started = false;
 		this.ready = false;
@@ -2088,7 +2265,10 @@ var Alepha = class Alepha {
 				if (!match.parents.includes(parent) && parent !== service) match.parents.push(parent);
 				return match.instance;
 			}
-			if (this.started) throw new ContainerLockedError(`Container is locked. No more services can be added. ${parent?.name} -> ${service.name}`);
+			if (this.started) {
+				const mod = service[MODULE]?.name;
+				throw new ContainerLockedError(`Container is locked. No more services can be added. Attempted to inject '${service.name}' from '${parent?.name}'. ${mod ? `Module '${mod}' is not registered ?` : ""}`);
+			}
 		}
 		const module = service[MODULE];
 		if (module && typeof module === "function") this.with(module);
@@ -2104,10 +2284,10 @@ var Alepha = class Alepha {
 		if (!transient) registry.set(service, definition);
 		if (instance instanceof Module) {
 			this.modules.push(instance);
-			const parent$1 = __alephaRef.parent;
+			const parent = __alephaRef.parent;
 			__alephaRef.parent = instance.constructor;
 			instance.register(this);
-			__alephaRef.parent = parent$1;
+			__alephaRef.parent = parent;
 		}
 		return instance;
 	}
@@ -2319,11 +2499,13 @@ function createPagination(entities, limit = 10, offset = 0, sort) {
 * - Nested objects with required/optional properties
 * - Arrays with item schemas
 * - Common validation options: minLength, maxLength, minimum, maximum, pattern
+* - anyOf/oneOf/allOf with nullable patterns (e.g., `anyOf: [type, null]` → `t.nullable(type)`)
+* - Alepha ~options (trim, lowercase) pass-through
 *
 * **Not supported:**
-* - oneOf, anyOf, allOf, not (composition schemas)
 * - $ref (references)
 * - additionalProperties, patternProperties
+* - Complex composition schemas (multiple non-null types in anyOf/oneOf/allOf)
 *
 * @param schema - JSON Schema object to convert
 * @returns TypeBox TSchema
@@ -2350,7 +2532,6 @@ function createPagination(entities, limit = 10, offset = 0, sort) {
 * ```
 */
 function jsonSchemaToTypeBox(schema) {
-	if (schema["~kind"]) return schema;
 	if (schema.const !== void 0) return t.const(schema.const);
 	if (schema.enum && Array.isArray(schema.enum)) {
 		if (schema.enum.every((v) => typeof v === "string")) return t.enum(schema.enum, filterUndefined({
@@ -2360,6 +2541,33 @@ function jsonSchemaToTypeBox(schema) {
 		}));
 		return t.union(schema.enum.map((v) => t.const(v)));
 	}
+	if (schema.anyOf && Array.isArray(schema.anyOf)) {
+		const nullSchema = schema.anyOf.find((s) => s.type === "null");
+		const nonNullSchemas = schema.anyOf.filter((s) => s.type !== "null");
+		if (nullSchema && nonNullSchemas.length === 1) {
+			const converted = jsonSchemaToTypeBox(nonNullSchemas[0]);
+			return t.nullable(converted);
+		}
+		return t.union(schema.anyOf.map((s) => jsonSchemaToTypeBox(s)));
+	}
+	if (schema.allOf && Array.isArray(schema.allOf)) {
+		const nullSchema = schema.allOf.find((s) => s.type === "null");
+		const nonNullSchemas = schema.allOf.filter((s) => s.type !== "null");
+		if (nullSchema && nonNullSchemas.length === 1) {
+			const converted = jsonSchemaToTypeBox(nonNullSchemas[0]);
+			return t.nullable(converted);
+		}
+		if (nonNullSchemas.length > 0) return jsonSchemaToTypeBox(nonNullSchemas[0]);
+	}
+	if (schema.oneOf && Array.isArray(schema.oneOf)) {
+		const nullSchema = schema.oneOf.find((s) => s.type === "null");
+		const nonNullSchemas = schema.oneOf.filter((s) => s.type !== "null");
+		if (nullSchema && nonNullSchemas.length === 1) {
+			const converted = jsonSchemaToTypeBox(nonNullSchemas[0]);
+			return t.nullable(converted);
+		}
+		return t.union(schema.oneOf.map((s) => jsonSchemaToTypeBox(s)));
+	}
 	switch (Array.isArray(schema.type) ? schema.type[0] : schema.type) {
 		case "string": return convertString(schema);
 		case "number": return convertNumber(schema);
@@ -2383,7 +2591,7 @@ function filterUndefined(obj) {
 * Convert JSON Schema string type to TypeBox.
 */
 function convertString(schema) {
-	const options = filterUndefined({
+	const baseOptions = filterUndefined({
 		title: schema.title,
 		description: schema.description,
 		default: schema.default,
@@ -2391,6 +2599,10 @@ function convertString(schema) {
 		maxLength: schema.maxLength,
 		pattern: schema.pattern
 	});
+	const options = schema["~options"] ? {
+		...baseOptions,
+		"~options": schema["~options"]
+	} : baseOptions;
 	switch (schema.format) {
 		case "email": return t.email(options);
 		case "uuid": return t.uuid(options);
@@ -2648,5 +2860,5 @@ const run = (entry, opts) => {
 };
 
 //#endregion
-export { $atom, $context, $env, $hook, $inject, $module, $use, Alepha, AlephaError, AlsProvider, AppNotStartedError, Atom, CircularDependencyError, CodecManager, ContainerLockedError, EventManager, Format, HookPrimitive, InjectPrimitive, JsonSchemaCodec, KIND, KeylessJsonSchemaCodec, Module, OPTIONS, Primitive, SchemaCodec, StateManager, TooLateSubstitutionError, Type, TypeBoxError, TypeGuard, TypeProvider, Value, createPagination, createPrimitive, isClass, isFileLike, isTypeFile, isUUID, jsonSchemaToTypeBox, pageMetadataSchema, pageQuerySchema, pageSchema, run, t };
+export { $atom, $context, $env, $hook, $inject, $module, $use, Alepha, AlephaError, AlsProvider, AppNotStartedError, Atom, CircularDependencyError, CodecManager, ContainerLockedError, EventManager, Format, HookPrimitive, InjectPrimitive, Json, JsonSchemaCodec, KIND, KeylessJsonSchemaCodec, Module, OPTIONS, Primitive, SchemaCodec, StateManager, TooLateSubstitutionError, Type, TypeBoxError, TypeGuard, TypeProvider, Value, createPagination, createPrimitive, isClass, isFileLike, isTypeFile, isUUID, jsonSchemaToTypeBox, pageMetadataSchema, pageQuerySchema, pageSchema, run, t };
 //# sourceMappingURL=index.browser.js.map