graphql-safe-guards 1.1.1 → 1.1.2

package/CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [Unreleased]
+
+## [1.1.2] – 2026-01-22
+
 ## [1.1.0] – 2026-01-22
 
 ### Added
@@ -19,12 +23,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
-- Improved README clarity around introspection and validation behavior.
+- `ignoreIntrospection` option to exclude GraphQL introspection queries
+  from depth and complexity validation.
 
 ### Fixed
 
-- Prevented GraphQL introspection queries from being blocked by strict
-  depth or complexity limits when `ignoreIntrospection` is enabled.
+- Ensured GraphQL introspection queries are excluded from depth and
+  complexity validation when `ignoreIntrospection` is enabled.
 
 ---
 

package/README.md

@@ -42,8 +42,8 @@ const server = new ApolloServer({
 
 ```ts
 createSafeGuards({
-  depth?: number;       // default: 5
-  complexity?: number;  // default: 100
+  depth?: number;       // default: 3 (strict preset)
+  complexity?: number;  // default: 50 (strict preset)
 
   /**
    * If true, GraphQL introspection queries are ignored
@@ -74,6 +74,22 @@ const server = new ApolloServer({
 });
 ```
 
+## Presets (Recommended)
+
+graphql-safe-guards includes opinionated, production-ready presets for common use cases.
+
+```ts
+createSafeGuards({ preset: "strict" });
+createSafeGuards({ preset: "balanced" });
+createSafeGuards({ preset: "relaxed" });
+```
+
+| Preset   | Depth | Complexity | Use case                    |
+| -------- | ----- | ---------- | --------------------------- |
+| strict   | 3     | 50         | Public APIs, read-only APIs |
+| balanced | 4     | 100        | Private frontends           |
+| relaxed  | 6     | 200        | Admin / internal tools      |
+
 ---
 
 ## What It Does
@@ -112,6 +128,14 @@ Most GraphQL servers need **both**, but wiring them together is repetitive.
 `graphql-safe-guards` provides a **single, predictable entry point**
 for GraphQL query safety.
 
+### Environment-based setup
+
+```ts
+createSafeGuards({
+  preset: process.env.NODE_ENV === "production" ? "strict" : "balanced",
+});
+```
+
 ---
 
 ## 🗺️ Roadmap
@@ -122,7 +146,7 @@ for GraphQL query safety.
 - ✅ Presets support (`strict`, `balanced`, `relaxed`)
 - ✅ Backward-compatible API
 - ✅ Integration tests with `graphql-js`
-- 🔜 Preset for private APIs (privateApi)
+- 🔜 Additional presets based on community feedback
 
 > Roadmap items may change based on feedback and real-world usage.
 

package/dist/index.js

@@ -6,24 +6,19 @@ const graphql_complexity_validation_1 = require("graphql-complexity-validation")
 const presets_1 = require("./presets");
 const wrapIgnoreIntrospection_1 = require("./utils/wrapIgnoreIntrospection");
 function createSafeGuards(options = {}) {
-    var _a, _b, _c, _d, _e;
+    var _a, _b, _c;
     const presetConfig = options.preset
         ? presets_1.SAFE_GUARD_PRESETS[options.preset]
-        : undefined;
-    const depth = (_b = (_a = options.depth) !== null && _a !== void 0 ? _a : presetConfig === null || presetConfig === void 0 ? void 0 : presetConfig.depth) !== null && _b !== void 0 ? _b : 5;
-    const complexity = (_d = (_c = options.complexity) !== null && _c !== void 0 ? _c : presetConfig === null || presetConfig === void 0 ? void 0 : presetConfig.complexity) !== null && _d !== void 0 ? _d : 100;
-    const ignoreIntrospection = (_e = options.ignoreIntrospection) !== null && _e !== void 0 ? _e : false;
-    const rules = [
+        : presets_1.SAFE_GUARD_PRESETS.strict;
+    const depth = (_a = options.depth) !== null && _a !== void 0 ? _a : presetConfig.depth;
+    const complexity = (_b = options.complexity) !== null && _b !== void 0 ? _b : presetConfig.complexity;
+    const ignoreIntrospection = (_c = options.ignoreIntrospection) !== null && _c !== void 0 ? _c : presetConfig.ignoreIntrospection;
+    let rules = [
         (0, graphql_safe_depth_1.createDepthLimitRule)({ maxDepth: depth }),
         (0, graphql_complexity_validation_1.createComplexityLimitRule)({ maxComplexity: complexity }),
     ];
-    if (!ignoreIntrospection) {
-        return rules;
+    if (ignoreIntrospection) {
+        rules = rules.map((rule) => (0, wrapIgnoreIntrospection_1.wrapIgnoreIntrospection)(rule));
     }
-    return rules.map((rule) => (0, wrapIgnoreIntrospection_1.wrapIgnoreIntrospection)(rule));
-    // el original
-    // return [
-    //   createDepthLimitRule({ maxDepth: depth }),
-    //   createComplexityLimitRule({ maxComplexity: complexity }),
-    // ];
+    return rules;
 }

package/dist/presets.d.ts

@@ -2,13 +2,16 @@ export declare const SAFE_GUARD_PRESETS: {
     readonly strict: {
         readonly depth: 3;
         readonly complexity: 50;
+        readonly ignoreIntrospection: false;
     };
     readonly balanced: {
         readonly depth: 5;
         readonly complexity: 100;
+        readonly ignoreIntrospection: true;
     };
     readonly relaxed: {
         readonly depth: 8;
         readonly complexity: 200;
+        readonly ignoreIntrospection: true;
     };
 };

package/dist/presets.js

@@ -5,13 +5,16 @@ exports.SAFE_GUARD_PRESETS = {
     strict: {
         depth: 3,
         complexity: 50,
+        ignoreIntrospection: false,
     },
     balanced: {
         depth: 5,
         complexity: 100,
+        ignoreIntrospection: true,
     },
     relaxed: {
         depth: 8,
         complexity: 200,
+        ignoreIntrospection: true,
     },
 };

package/dist/utils/wrapIgnoreIntrospection.js

@@ -1,20 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.wrapIgnoreIntrospection = wrapIgnoreIntrospection;
+const INTROSPECTION_FIELDS = new Set(["__schema", "__type"]);
 function wrapIgnoreIntrospection(rule) {
     return (context) => {
         const visitor = rule(context);
         return {
             Field(node) {
-                // Detecta introspection (__schema, __type)
-                if (node.name.value.startsWith("__")) {
-                    return false;
+                // Ignora introspection sin romper traversal
+                if (INTROSPECTION_FIELDS.has(node.name.value)) {
+                    return null;
                 }
-                // Delegamos al visitor original si existe
+                // Delegate safely if Field visitor exists
                 const fieldVisitor = visitor === null || visitor === void 0 ? void 0 : visitor.Field;
                 if (typeof fieldVisitor === "function") {
                     return fieldVisitor(node);
                 }
+                return undefined;
             },
         };
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphql-safe-guards",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Opinionated GraphQL security guards (depth + complexity) in one import",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",