alepha 0.18.2 → 0.18.3

package/dist/core/index.workerd.js

@@ -922,11 +922,6 @@ const t = new TypeProvider();
 
 //#endregion
 //#region ../../src/core/providers/KeylessJsonSchemaCodec.ts
-const UNSAFE_KEYS = new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
 /**
 * KeylessJsonSchemaCodec provides schema-driven JSON encoding without keys.
 *
@@ -939,9 +934,6 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 	textDecoder = new TextDecoder();
 	varCounter = 0;
 	useFunctionCompilation = true;
-	maxArrayLength = 1e4;
-	maxStringLength = 1e6;
-	maxDepth = 50;
 	/**
 	* Configure codec options.
 	*/
@@ -950,9 +942,6 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 			this.useFunctionCompilation = options.useFunctionCompilation;
 			this.cache.clear();
 		}
-		if (options.maxArrayLength !== void 0) this.maxArrayLength = options.maxArrayLength;
-		if (options.maxStringLength !== void 0) this.maxStringLength = options.maxStringLength;
-		if (options.maxDepth !== void 0) this.maxDepth = options.maxDepth;
 		return this;
 	}
 	/**
@@ -1000,37 +989,6 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 		}
 	}
 	/**
-	* Validate schema keys for prototype pollution.
-	* Uses a visited set to avoid infinite recursion on recursive schemas.
-	*/
-	validateSchemaKeys(schema, depth = 0, visited = /* @__PURE__ */ new Set()) {
-		if (visited.has(schema)) return;
-		visited.add(schema);
-		if (depth > this.maxDepth) throw new AlephaError(`Schema depth exceeds maximum allowed (${this.maxDepth})`);
-		if (t.schema.isObject(schema)) {
-			const props = schema.properties;
-			for (const key of Object.keys(props)) {
-				if (UNSAFE_KEYS.has(key)) throw new AlephaError(`Unsafe schema key "${key}" detected. This key is blocked to prevent prototype pollution.`);
-				this.validateSchemaKeys(props[key], depth + 1, visited);
-			}
-		} else if (t.schema.isArray(schema)) {
-			const arrSchema = schema;
-			this.validateSchemaKeys(arrSchema.items, depth + 1, visited);
-		} else if (t.schema.isUnion(schema) || t.schema.isOptional(schema)) this.validateSchemaKeys(this.unwrap(schema), depth, visited);
-	}
-	/**
-	* Validate array length.
-	*/
-	validateArrayLength(arr) {
-		if (arr.length > this.maxArrayLength) throw new AlephaError(`Array length (${arr.length}) exceeds maximum allowed (${this.maxArrayLength})`);
-	}
-	/**
-	* Validate string length.
-	*/
-	validateStringLength(str) {
-		if (str.length > this.maxStringLength) throw new AlephaError(`String length (${str.length}) exceeds maximum allowed (${this.maxStringLength})`);
-	}
-	/**
 	* Get a compiled codec for the given schema.
 	* Codecs are cached for reuse.
 	*/
@@ -1171,9 +1129,10 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 		if (t.schema.isObject(schema)) {
 			const parts = [];
 			for (const { key, isOpt, isNullable, inner } of this.getObjectFields(schema)) {
-				const innerEnc = this.genEnc(inner, `${ve}.${key}`);
-				if (isOpt) parts.push(`${ve}.${key}!==undefined?${innerEnc}:null`);
-				else if (isNullable) parts.push(`${ve}.${key}!==null?${innerEnc}:null`);
+				const access = `${ve}[${JSON.stringify(key)}]`;
+				const innerEnc = this.genEnc(inner, access);
+				if (isOpt) parts.push(`${access}!==undefined?${innerEnc}:null`);
+				else if (isNullable) parts.push(`${access}!==null?${innerEnc}:null`);
 				else parts.push(innerEnc);
 			}
 			return `[${parts.join(",")}]`;
@@ -1211,25 +1170,28 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 			const fields = this.getObjectFields(schema);
 			if (fields.every(({ isOpt, isNullable, inner }) => !isOpt && !isNullable && !t.schema.isObject(inner) && !t.schema.isArray(inner))) return {
 				code: "",
-				result: `{${fields.map(({ key }) => `${key}:a[i++]`).join(",")}}`
+				result: `{${fields.map(({ key }) => `${JSON.stringify(key)}:a[i++]`).join(",")}}`
 			};
 			let code = `const ${v}={};`;
-			for (const { key, isOpt, isNullable, inner } of fields) if (isOpt) {
-				const nested = this.genDecFromValue(inner, "t");
-				code += `{const t=a[i++];if(t!==null){${v}.${key}=${nested};}}`;
-			} else if (isNullable) {
-				const nested = this.genDecFromValue(inner, "t");
-				code += `{const t=a[i++];if(t===null){${v}.${key}=null;}else{${v}.${key}=${nested};}}`;
-			} else if (t.schema.isObject(inner)) {
-				const nested = this.genDecFromValue(inner, "a[i++]");
-				code += `${v}.${key}=${nested};`;
-			} else if (t.schema.isArray(inner)) {
-				const arrSchema = inner;
-				if (t.schema.isObject(arrSchema.items)) {
-					const itemTransform = this.genDecFromValue(arrSchema.items, "e");
-					code += `${v}.${key}=a[i++].map(e=>${itemTransform});`;
-				} else code += `${v}.${key}=a[i++];`;
-			} else code += `${v}.${key}=a[i++];`;
+			for (const { key, isOpt, isNullable, inner } of fields) {
+				const sk = JSON.stringify(key);
+				if (isOpt) {
+					const nested = this.genDecFromValue(inner, "t");
+					code += `{const t=a[i++];if(t!==null){${v}[${sk}]=${nested};}}`;
+				} else if (isNullable) {
+					const nested = this.genDecFromValue(inner, "t");
+					code += `{const t=a[i++];if(t===null){${v}[${sk}]=null;}else{${v}[${sk}]=${nested};}}`;
+				} else if (t.schema.isObject(inner)) {
+					const nested = this.genDecFromValue(inner, "a[i++]");
+					code += `${v}[${sk}]=${nested};`;
+				} else if (t.schema.isArray(inner)) {
+					const arrSchema = inner;
+					if (t.schema.isObject(arrSchema.items)) {
+						const itemTransform = this.genDecFromValue(arrSchema.items, "e");
+						code += `${v}[${sk}]=a[i++].map(e=>${itemTransform});`;
+					} else code += `${v}[${sk}]=a[i++];`;
+				} else code += `${v}[${sk}]=a[i++];`;
+			}
 			return {
 				code,
 				result: v
@@ -1259,9 +1221,10 @@ var KeylessJsonSchemaCodec = class extends SchemaCodec {
 			return `((${v}=${expr})=>({${keys.map((k, idx) => {
 				const inner = this.unwrap(props[k]);
 				const innerExpr = `${v}[${idx}]`;
-				if (t.schema.isObject(inner)) return `${k}:${this.genDecFromValue(inner, innerExpr)}`;
-				if (t.schema.isBigInt(inner)) return `${k}:BigInt(${innerExpr}.slice(0,-1))`;
-				return `${k}:${innerExpr}`;
+				const sk = JSON.stringify(k);
+				if (t.schema.isObject(inner)) return `${sk}:${this.genDecFromValue(inner, innerExpr)}`;
+				if (t.schema.isBigInt(inner)) return `${sk}:BigInt(${innerExpr}.slice(0,-1))`;
+				return `${sk}:${innerExpr}`;
 			}).join(",")}}))()`;
 		}
 		return expr;
@@ -1371,6 +1334,7 @@ var SchemaValidator = class {
 	beforeParse(schema, value, options) {
 		if (!schema) return value;
 		if (value === null && !this.isSchemaNullable(schema) && options.nullToUndefined) return;
+		if (!schema.type && schema.anyOf) schema = schema.anyOf.find((s) => s.type !== "null" && s.type !== "undefined") || schema;
 		if (Array.isArray(value)) return value.map((it) => this.beforeParse(schema.items, it, options));
 		if (typeof value === "string" && schema.type === "string") {
 			let str = value;
@@ -2063,9 +2027,21 @@ var Alepha = class Alepha {
 	*/
 	ready = false;
 	/**
-	* A promise that resolves when the App has started.
+	* In-flight startup promise returned by boot().
+	*
+	* Concurrent callers of start() share this same promise. Cleared on
+	* success, failure, or stale-detection.
 	*/
-	starting;
+	startPromise;
+	/**
+	* Timestamp (performance.now) when the current boot() began.
+	*
+	* In serverless environments (e.g. Cloudflare Workers), the runtime can
+	* kill an invocation mid-startup without running cleanup. The global
+	* Alepha instance persists, leaving startPromise as a never-settling
+	* promise. We detect this by comparing elapsed time against STARTUP_TIMEOUT.
+	*/
+	startedAt = 0;
 	/**
 	* During the instantiation process, we keep a list of pending instantiations.
 	* > It allows us to detect circular dependencies.
@@ -2232,6 +2208,16 @@ var Alepha = class Alepha {
 		return this.env.NODE_ENV === "production";
 	}
 	/**
+	* Max time (ms) a boot() is allowed to run before being considered stale.
+	*
+	* In serverless runtimes (Cloudflare Workers, etc.) an invocation can be
+	* killed mid-startup. The global Alepha instance survives, but
+	* `startPromise` becomes a zombie that never settles.
+	* Any new invocation that sees an older-than-STARTUP_TIMEOUT promise
+	* discards it and boots fresh.
+	*/
+	static STARTUP_TIMEOUT = 3e4;
+	/**
 	* Starts the App.
 	*
 	* - Lock any further changes to the container.
@@ -2239,6 +2225,10 @@ var Alepha = class Alepha {
 	* - Run "start" hook for all services. Providers will connect/listen/...
 	* - Run "ready" hook for all services. This is the point where the App is ready to serve requests.
 	*
+	* Concurrent callers share the same boot promise. If a previous boot was
+	* abandoned (serverless invocation killed), the stale promise is detected
+	* and a fresh boot is triggered.
+	*
 	* @return A promise that resolves when the App has started.
 	*/
 	async start() {
@@ -2246,14 +2236,31 @@ var Alepha = class Alepha {
 			this.log?.debug("App is already started, skipping...");
 			return this;
 		}
-		if (this.starting) {
-			this.log?.warn("App is already starting, waiting for it to finish...");
-			return this.starting.promise;
+		if (this.startPromise) {
+			const elapsed = performance.now() - this.startedAt;
+			if (elapsed > Alepha.STARTUP_TIMEOUT) {
+				this.log?.warn(`Previous start attempt is stale (${Math.round(elapsed)}ms ago), resetting...`);
+				this.resetStartup();
+			} else {
+				this.log?.warn("App is already starting, waiting for it to finish...");
+				return this.startPromise;
+			}
 		}
-		this.starting = Promise.withResolvers();
+		this.startedAt = performance.now();
+		this.startPromise = this.boot();
+		return this.startPromise;
+	}
+	/**
+	* Perform the actual startup sequence.
+	*
+	* Separated from start() so that start() remains a thin state-machine
+	* and boot() owns the real work. The promise returned here is stored as
+	* `startPromise` and shared with concurrent callers.
+	*/
+	async boot() {
+		const now = performance.now();
+		this.log?.info("Starting App...");
 		try {
-			const now = performance.now();
-			this.log?.info("Starting App...");
 			for (const [key] of this.substitutions.entries()) this.inject(key);
 			const target = this.store.get("alepha.target");
 			if (target) {
@@ -2275,15 +2282,26 @@ var Alepha = class Alepha {
 			await this.events.emit("ready", this, { log: true });
 			this.log?.info(`App is now ready [${Math.round(performance.now() - now)}ms]`);
 			this.ready = true;
+			return this;
 		} catch (error) {
-			this.starting.reject(error);
-			const promise = this.starting.promise;
-			this.starting = void 0;
-			return promise;
+			this.resetStartup();
+			throw error;
 		}
-		this.starting.resolve(this);
-		this.starting = void 0;
-		return this;
+	}
+	/**
+	* Reset startup state so that a fresh boot() can be attempted.
+	*
+	* Called when:
+	* - boot() fails (error during configure/start/ready hooks)
+	* - a stale startPromise is detected (serverless invocation was killed)
+	*/
+	resetStartup() {
+		this.startPromise = void 0;
+		this.startedAt = 0;
+		this.locked = false;
+		this.configured = false;
+		this.started = false;
+		this.ready = false;
 	}
 	/**
 	* Stops the App.
@@ -2304,6 +2322,8 @@ var Alepha = class Alepha {
 		this.log?.info("App is now off");
 		this.started = false;
 		this.ready = false;
+		this.startPromise = void 0;
+		this.startedAt = 0;
 	}
 	/**
 	* Destroys the App and clears all internal state.
@@ -2458,7 +2478,18 @@ var Alepha = class Alepha {
 	parseEnv(schema) {
 		if (this.cacheEnv.has(schema)) return this.cacheEnv.get(schema);
 		const config = this.codec.validate(schema, this.env);
-		for (const key in config) if (typeof config[key] === "string") for (const env in config) config[key] = config[key].replaceAll(`$${env}`, String(config[env] ?? ""));
+		let changed = true;
+		for (let pass = 0; changed && pass < 10; pass++) {
+			changed = false;
+			for (const key in config) {
+				if (typeof config[key] !== "string") continue;
+				for (const env in config) {
+					const before = config[key];
+					config[key] = before.replaceAll(`$${env}`, String(config[env] ?? ""));
+					if (config[key] !== before) changed = true;
+				}
+			}
+		}
 		this.cacheEnv.set(schema, config);
 		return config;
 	}
@@ -2923,13 +2954,20 @@ const $memoize = (options) => {
 			return async (...args) => {
 				const key = keyFn(...args);
 				if (store.has(key)) return store.get(key);
-				const result = await next(...args);
-				if (store.size >= maxSize) {
-					const firstKey = store.keys().next().value;
-					if (firstKey !== void 0) store.delete(firstKey);
+				const promise = next(...args);
+				store.set(key, promise);
+				try {
+					const result = await promise;
+					store.set(key, result);
+					if (store.size > maxSize) {
+						const firstKey = store.keys().next().value;
+						if (firstKey !== void 0) store.delete(firstKey);
+					}
+					return result;
+				} catch (error) {
+					store.delete(key);
+					throw error;
 				}
-				store.set(key, result);
-				return result;
 			};
 		}
 	});