layercache 1.0.2 → 1.1.0

package/benchmarks/latency.ts

@@ -1,5 +1,5 @@
-import Redis from 'ioredis-mock'
 import { performance } from 'node:perf_hooks'
+import Redis from 'ioredis-mock'
 import { CacheStack, MemoryLayer, RedisLayer } from '../src'
 
 async function main(): Promise<void> {

package/benchmarks/stampede.ts

@@ -3,10 +3,7 @@ import { CacheStack, MemoryLayer, RedisLayer } from '../src'
 
 async function main(): Promise<void> {
   const redis = new Redis()
-  const cache = new CacheStack([
-    new MemoryLayer({ ttl: 60 }),
-    new RedisLayer({ client: redis, ttl: 300 })
-  ])
+  const cache = new CacheStack([new MemoryLayer({ ttl: 60 }), new RedisLayer({ client: redis, ttl: 300 })])
 
   let executions = 0
 

package/dist/{chunk-IILH5XTS.js → chunk-QUB5VZFZ.js}

@@ -1,9 +1,38 @@
 // src/invalidation/PatternMatcher.ts
-var PatternMatcher = class {
+var PatternMatcher = class _PatternMatcher {
+  /**
+   * Tests whether a glob-style pattern matches a value.
+   * Supports `*` (any sequence of characters) and `?` (any single character).
+   * Uses a linear-time algorithm to avoid ReDoS vulnerabilities.
+   */
   static matches(pattern, value) {
-    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-    const regex = new RegExp(`^${escaped.replace(/\*/g, ".*").replace(/\?/g, ".")}$`);
-    return regex.test(value);
+    return _PatternMatcher.matchLinear(pattern, value);
+  }
+  /**
+   * Linear-time glob matching using dynamic programming.
+   * Avoids catastrophic backtracking that RegExp-based glob matching can cause.
+   */
+  static matchLinear(pattern, value) {
+    const m = pattern.length;
+    const n = value.length;
+    const dp = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(false));
+    dp[0][0] = true;
+    for (let i = 1; i <= m; i++) {
+      if (pattern[i - 1] === "*") {
+        dp[i][0] = dp[i - 1]?.[0];
+      }
+    }
+    for (let i = 1; i <= m; i++) {
+      for (let j = 1; j <= n; j++) {
+        const pc = pattern[i - 1];
+        if (pc === "*") {
+          dp[i][j] = dp[i - 1]?.[j] || dp[i]?.[j - 1];
+        } else if (pc === "?" || pc === value[j - 1]) {
+          dp[i][j] = dp[i - 1]?.[j - 1];
+        }
+      }
+    }
+    return dp[m]?.[n];
   }
 };
 

package/dist/cli.cjs

@@ -37,11 +37,40 @@ module.exports = __toCommonJS(cli_exports);
 var import_ioredis = __toESM(require("ioredis"), 1);
 
 // src/invalidation/PatternMatcher.ts
-var PatternMatcher = class {
+var PatternMatcher = class _PatternMatcher {
+  /**
+   * Tests whether a glob-style pattern matches a value.
+   * Supports `*` (any sequence of characters) and `?` (any single character).
+   * Uses a linear-time algorithm to avoid ReDoS vulnerabilities.
+   */
   static matches(pattern, value) {
-    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-    const regex = new RegExp(`^${escaped.replace(/\*/g, ".*").replace(/\?/g, ".")}$`);
-    return regex.test(value);
+    return _PatternMatcher.matchLinear(pattern, value);
+  }
+  /**
+   * Linear-time glob matching using dynamic programming.
+   * Avoids catastrophic backtracking that RegExp-based glob matching can cause.
+   */
+  static matchLinear(pattern, value) {
+    const m = pattern.length;
+    const n = value.length;
+    const dp = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(false));
+    dp[0][0] = true;
+    for (let i = 1; i <= m; i++) {
+      if (pattern[i - 1] === "*") {
+        dp[i][0] = dp[i - 1]?.[0];
+      }
+    }
+    for (let i = 1; i <= m; i++) {
+      for (let j = 1; j <= n; j++) {
+        const pc = pattern[i - 1];
+        if (pc === "*") {
+          dp[i][j] = dp[i - 1]?.[j] || dp[i]?.[j - 1];
+        } else if (pc === "?" || pc === value[j - 1]) {
+          dp[i][j] = dp[i - 1]?.[j - 1];
+        }
+      }
+    }
+    return dp[m]?.[n];
   }
 };
 
@@ -136,6 +165,7 @@ var RedisTagIndex = class {
 };
 
 // src/cli.ts
+var CONNECT_TIMEOUT_MS = 5e3;
 async function main(argv = process.argv.slice(2)) {
   const args = parseArgs(argv);
   if (!args.command || !args.redisUrl) {
@@ -143,8 +173,25 @@ async function main(argv = process.argv.slice(2)) {
     process.exitCode = 1;
     return;
   }
-  const redis = new import_ioredis.default(args.redisUrl);
+  const redisUrl = validateRedisUrl(args.redisUrl);
+  if (!redisUrl) {
+    process.stderr.write(
+      `Error: invalid Redis URL "${args.redisUrl}". Expected format: redis://[user:password@]host[:port][/db]
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const redis = new import_ioredis.default(redisUrl, {
+    connectTimeout: CONNECT_TIMEOUT_MS,
+    lazyConnect: true,
+    enableReadyCheck: false
+  });
   try {
+    await redis.connect().catch((error) => {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`Failed to connect to Redis at "${redisUrl}": ${message}`);
+    });
     if (args.command === "stats") {
       const keys = await scanKeys(redis, args.pattern ?? "*");
       process.stdout.write(`${JSON.stringify({ totalKeys: keys.length, pattern: args.pattern ?? "*" }, null, 2)}
@@ -153,8 +200,10 @@ async function main(argv = process.argv.slice(2)) {
     }
     if (args.command === "keys") {
       const keys = await scanKeys(redis, args.pattern ?? "*");
-      process.stdout.write(`${keys.join("\n")}
+      if (keys.length > 0) {
+        process.stdout.write(`${keys.join("\n")}
 `);
+      }
       return;
     }
     if (args.command === "invalidate") {
@@ -178,10 +227,29 @@ async function main(argv = process.argv.slice(2)) {
     }
     printUsage();
     process.exitCode = 1;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`Error: ${message}
+`);
+    process.exitCode = 1;
   } finally {
     redis.disconnect();
   }
 }
+function validateRedisUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "redis:" && parsed.protocol !== "rediss:") {
+      return null;
+    }
+    return url;
+  } catch {
+    if (/^[A-Za-z0-9._-]+(:\d+)?$/.test(url)) {
+      return url;
+    }
+    return null;
+  }
+}
 function parseArgs(argv) {
   const [command, ...rest] = argv;
   const parsed = { command };
@@ -216,7 +284,7 @@ async function scanKeys(redis, pattern) {
 }
 function printUsage() {
   process.stdout.write(
-    "Usage:\n  layercache stats --redis <url> [--pattern <glob>]\n  layercache keys --redis <url> [--pattern <glob>]\n  layercache invalidate --redis <url> [--pattern <glob> | --tag <tag>] [--tag-index-prefix <prefix>]\n"
+    "Usage:\n  layercache stats --redis <url> [--pattern <glob>]\n  layercache keys --redis <url> [--pattern <glob>]\n  layercache invalidate --redis <url> [--pattern <glob> | --tag <tag>] [--tag-index-prefix <prefix>]\n\nOptions:\n  --redis <url>               Redis connection URL (e.g. redis://localhost:6379)\n  --pattern <glob>            Glob pattern to filter keys (default: *)\n  --tag <tag>                 Invalidate by tag name\n  --tag-index-prefix <prefix> Redis key prefix for tag index (default: layercache:tag-index)\n"
   );
 }
 if (process.argv[1]?.includes("cli.")) {

package/dist/cli.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import {
   RedisTagIndex
-} from "./chunk-IILH5XTS.js";
+} from "./chunk-QUB5VZFZ.js";
 
 // src/cli.ts
 import Redis from "ioredis";
+var CONNECT_TIMEOUT_MS = 5e3;
 async function main(argv = process.argv.slice(2)) {
   const args = parseArgs(argv);
   if (!args.command || !args.redisUrl) {
@@ -12,8 +13,25 @@ async function main(argv = process.argv.slice(2)) {
     process.exitCode = 1;
     return;
   }
-  const redis = new Redis(args.redisUrl);
+  const redisUrl = validateRedisUrl(args.redisUrl);
+  if (!redisUrl) {
+    process.stderr.write(
+      `Error: invalid Redis URL "${args.redisUrl}". Expected format: redis://[user:password@]host[:port][/db]
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const redis = new Redis(redisUrl, {
+    connectTimeout: CONNECT_TIMEOUT_MS,
+    lazyConnect: true,
+    enableReadyCheck: false
+  });
   try {
+    await redis.connect().catch((error) => {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`Failed to connect to Redis at "${redisUrl}": ${message}`);
+    });
     if (args.command === "stats") {
       const keys = await scanKeys(redis, args.pattern ?? "*");
       process.stdout.write(`${JSON.stringify({ totalKeys: keys.length, pattern: args.pattern ?? "*" }, null, 2)}
@@ -22,8 +40,10 @@ async function main(argv = process.argv.slice(2)) {
     }
     if (args.command === "keys") {
       const keys = await scanKeys(redis, args.pattern ?? "*");
-      process.stdout.write(`${keys.join("\n")}
+      if (keys.length > 0) {
+        process.stdout.write(`${keys.join("\n")}
 `);
+      }
       return;
     }
     if (args.command === "invalidate") {
@@ -47,10 +67,29 @@ async function main(argv = process.argv.slice(2)) {
     }
     printUsage();
     process.exitCode = 1;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`Error: ${message}
+`);
+    process.exitCode = 1;
   } finally {
     redis.disconnect();
   }
 }
+function validateRedisUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "redis:" && parsed.protocol !== "rediss:") {
+      return null;
+    }
+    return url;
+  } catch {
+    if (/^[A-Za-z0-9._-]+(:\d+)?$/.test(url)) {
+      return url;
+    }
+    return null;
+  }
+}
 function parseArgs(argv) {
   const [command, ...rest] = argv;
   const parsed = { command };
@@ -85,7 +124,7 @@ async function scanKeys(redis, pattern) {
 }
 function printUsage() {
   process.stdout.write(
-    "Usage:\n  layercache stats --redis <url> [--pattern <glob>]\n  layercache keys --redis <url> [--pattern <glob>]\n  layercache invalidate --redis <url> [--pattern <glob> | --tag <tag>] [--tag-index-prefix <prefix>]\n"
+    "Usage:\n  layercache stats --redis <url> [--pattern <glob>]\n  layercache keys --redis <url> [--pattern <glob>]\n  layercache invalidate --redis <url> [--pattern <glob> | --tag <tag>] [--tag-index-prefix <prefix>]\n\nOptions:\n  --redis <url>               Redis connection URL (e.g. redis://localhost:6379)\n  --pattern <glob>            Glob pattern to filter keys (default: *)\n  --tag <tag>                 Invalidate by tag name\n  --tag-index-prefix <prefix> Redis key prefix for tag index (default: layercache:tag-index)\n"
   );
 }
 if (process.argv[1]?.includes("cli.")) {