layercache 1.2.4 → 1.2.5

package/dist/index.js

@@ -5,7 +5,7 @@ import {
   MemoryLayer,
   TagIndex,
   createHonoCacheMiddleware
-} from "./chunk-KOYGHLVP.js";
+} from "./chunk-JC26W3KK.js";
 import {
   PatternMatcher,
   createStoredValueEnvelope,
@@ -136,6 +136,7 @@ var CacheNamespace = class _CacheNamespace {
    * ```
    */
   namespace(childPrefix) {
+    validateNamespaceKey(childPrefix);
     return new _CacheNamespace(this.cache, `${this.prefix}:${childPrefix}`);
   }
   qualify(key) {
@@ -265,6 +266,17 @@ function addMap(base, delta) {
   }
   return result;
 }
+function validateNamespaceKey(key) {
+  if (key.length === 0) {
+    throw new Error("Namespace prefix must not be empty.");
+  }
+  if (key.length > 256) {
+    throw new Error("Namespace prefix must be at most 256 characters.");
+  }
+  if (/[\u0000-\u001F\u007F]/.test(key)) {
+    throw new Error("Namespace prefix contains unsupported control characters.");
+  }
+}
 
 // src/internal/CacheKeyDiscovery.ts
 var CacheKeyDiscovery = class {
@@ -337,9 +349,7 @@ var CircuitBreakerManager = class {
     }
     const now = Date.now();
     if (state.openUntil <= now) {
-      state.openUntil = null;
-      state.failures = 0;
-      this.breakers.set(key, state);
+      this.breakers.delete(key);
       return;
     }
     const remainingMs = state.openUntil - now;
@@ -350,15 +360,15 @@ var CircuitBreakerManager = class {
     if (!options) {
       return;
     }
+    this.pruneIfNeeded();
     const failureThreshold = options.failureThreshold ?? 3;
     const cooldownMs = options.cooldownMs ?? 3e4;
-    const state = this.breakers.get(key) ?? { failures: 0, openUntil: null };
+    const state = this.breakers.get(key) ?? { failures: 0, openUntil: null, createdAt: Date.now() };
     state.failures += 1;
     if (state.failures >= failureThreshold) {
       state.openUntil = Date.now() + cooldownMs;
     }
     this.breakers.set(key, state);
-    this.pruneIfNeeded();
   }
   recordSuccess(key) {
     this.breakers.delete(key);
@@ -369,8 +379,7 @@ var CircuitBreakerManager = class {
       return false;
     }
     if (state.openUntil <= Date.now()) {
-      state.openUntil = null;
-      state.failures = 0;
+      this.breakers.delete(key);
       return false;
     }
     return true;
@@ -394,15 +403,20 @@ var CircuitBreakerManager = class {
     if (this.breakers.size <= this.maxEntries) {
       return;
     }
+    const now = Date.now();
     for (const [key, state] of this.breakers.entries()) {
       if (this.breakers.size <= this.maxEntries) {
-        break;
+        return;
       }
-      if (!state.openUntil || state.openUntil <= Date.now()) {
+      if (!state.openUntil || state.openUntil <= now) {
         this.breakers.delete(key);
       }
     }
-    for (const key of this.breakers.keys()) {
+    if (this.breakers.size <= this.maxEntries) {
+      return;
+    }
+    const sorted = [...this.breakers.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
+    for (const [key] of sorted) {
       if (this.breakers.size <= this.maxEntries) {
         break;
       }
@@ -412,6 +426,7 @@ var CircuitBreakerManager = class {
 };
 
 // src/internal/FetchRateLimiter.ts
+var MAX_BUCKETS = 1e4;
 var FetchRateLimiter = class {
   buckets = /* @__PURE__ */ new Map();
   queuesByBucket = /* @__PURE__ */ new Map();
@@ -577,10 +592,25 @@ var FetchRateLimiter = class {
     if (existing) {
       return existing;
     }
+    if (this.buckets.size >= MAX_BUCKETS) {
+      this.evictIdleBuckets();
+    }
     const bucket = { active: 0, startedAt: [] };
     this.buckets.set(bucketKey, bucket);
     return bucket;
   }
+  evictIdleBuckets() {
+    for (const [key, bucket] of this.buckets.entries()) {
+      if (this.buckets.size <= MAX_BUCKETS * 0.9) {
+        break;
+      }
+      if (bucket.active === 0 && bucket.startedAt.length === 0 && !this.queuesByBucket.has(key)) {
+        this.buckets.delete(key);
+        this.queuesByBucket.delete(key);
+        this.pendingBuckets.delete(key);
+      }
+    }
+  }
   cleanupBucket(bucketKey, bucket, intervalMs) {
     const queued = this.queuesByBucket.get(bucketKey)?.length ?? 0;
     if (queued === 0 && bucket.active === 0 && bucket.startedAt.length === 0) {
@@ -783,13 +813,12 @@ var TtlResolver = class {
       return;
     }
     const toRemove = Math.ceil(this.maxProfileEntries * 0.1);
-    let removed = 0;
-    for (const key of this.accessProfiles.keys()) {
-      if (removed >= toRemove) {
-        break;
+    const sorted = [...this.accessProfiles.entries()].sort((a, b) => a[1].lastAccessAt - b[1].lastAccessAt);
+    for (let i = 0; i < toRemove && i < sorted.length; i++) {
+      const entry = sorted[i];
+      if (entry) {
+        this.accessProfiles.delete(entry[0]);
       }
-      this.accessProfiles.delete(key);
-      removed += 1;
     }
   }
 };
@@ -872,6 +901,7 @@ var DEFAULT_SINGLE_FLIGHT_TIMEOUT_MS = 5e3;
 var DEFAULT_SINGLE_FLIGHT_POLL_MS = 50;
 var DEFAULT_BACKGROUND_REFRESH_TIMEOUT_MS = 3e4;
 var MAX_CACHE_KEY_LENGTH = 1024;
+var MAX_PATTERN_LENGTH = 1024;
 var DEFAULT_MAX_PROFILE_ENTRIES = 1e5;
 var DANGEROUS_OBJECT_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
 var DebugLogger = class {
@@ -1305,6 +1335,7 @@ var CacheStack = class extends EventEmitter {
     await this.publishInvalidation({ scope: "keys", keys, sourceId: this.instanceId, operation: "invalidate" });
   }
   async invalidateByPattern(pattern) {
+    this.validatePattern(pattern);
     await this.awaitStartup("invalidateByPattern");
     const keys = await this.keyDiscovery.collectKeysMatchingPattern(this.qualifyPattern(pattern));
     await this.deleteKeys(keys);
@@ -2198,6 +2229,17 @@ var CacheStack = class extends EventEmitter {
     }
     return key;
   }
+  validatePattern(pattern) {
+    if (pattern.length === 0) {
+      throw new Error("Pattern must not be empty.");
+    }
+    if (pattern.length > MAX_PATTERN_LENGTH) {
+      throw new Error(`Pattern length must be at most ${MAX_PATTERN_LENGTH} characters.`);
+    }
+    if (/[\u0000-\u001F\u007F]/.test(pattern)) {
+      throw new Error("Pattern contains unsupported control characters.");
+    }
+  }
   validateTtlPolicy(name, policy) {
     if (!policy || typeof policy === "function" || policy === "until-midnight" || policy === "next-hour") {
       return;
@@ -2362,7 +2404,18 @@ var CacheStack = class extends EventEmitter {
   }
 };
 function createInstanceId() {
-  return globalThis.crypto?.randomUUID?.() ?? `layercache-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  if (globalThis.crypto?.randomUUID) {
+    return globalThis.crypto.randomUUID();
+  }
+  const bytes = new Uint8Array(16);
+  if (globalThis.crypto?.getRandomValues) {
+    globalThis.crypto.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < bytes.length; i++) {
+      bytes[i] = Math.floor(Math.random() * 256);
+    }
+  }
+  return `layercache-${Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("")}`;
 }
 
 // src/invalidation/RedisInvalidationBus.ts
@@ -2404,7 +2457,7 @@ var RedisInvalidationBus = class {
   async dispatchToHandlers(payload) {
     let message;
     try {
-      const parsed = JSON.parse(payload);
+      const parsed = sanitizeJsonValue2(JSON.parse(payload));
       if (!this.isInvalidationMessage(parsed)) {
         throw new Error("Invalid invalidation payload shape.");
       }
@@ -2441,12 +2494,30 @@ var RedisInvalidationBus = class {
     console.error(`[layercache] ${message}`, error);
   }
 };
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function sanitizeJsonValue2(value) {
+  if (Array.isArray(value)) {
+    return value.map(sanitizeJsonValue2);
+  }
+  if (value && typeof value === "object") {
+    const result = /* @__PURE__ */ Object.create(null);
+    for (const key of Object.keys(value)) {
+      if (!DANGEROUS_KEYS.has(key)) {
+        result[key] = sanitizeJsonValue2(value[key]);
+      }
+    }
+    return result;
+  }
+  return value;
+}
 
 // src/http/createCacheStatsHandler.ts
 function createCacheStatsHandler(cache) {
   return async (_request, response) => {
     response.statusCode = 200;
     response.setHeader?.("content-type", "application/json; charset=utf-8");
+    response.setHeader?.("cache-control", "no-store");
+    response.setHeader?.("x-content-type-options", "nosniff");
     response.end(JSON.stringify(cache.getStats(), null, 2));
   };
 }
@@ -2532,7 +2603,7 @@ function normalizeUrl(url) {
   try {
     const parsed = new URL(url, "http://localhost");
     parsed.searchParams.sort();
-    return decodeURIComponent(parsed.pathname) + parsed.search;
+    return parsed.pathname + parsed.search;
   } catch {
     return url;
   }
@@ -2822,8 +2893,9 @@ var RedisLayer = class {
       }
     }
     try {
-      await this.client.del(this.withPrefix(key)).catch(() => void 0);
-    } catch {
+      await this.client.del(this.withPrefix(key));
+    } catch (deleteError) {
+      console.warn(`[layercache] RedisLayer: failed to delete corrupted key "${key}"`, deleteError);
     }
     return null;
   }
@@ -3223,7 +3295,7 @@ var MemcachedLayer = class {
 
 // src/serialization/MsgpackSerializer.ts
 import { decode, encode } from "@msgpack/msgpack";
-var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var DANGEROUS_KEYS2 = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
 var MsgpackSerializer = class {
   serialize(value) {
     return Buffer.from(encode(value));
@@ -3242,7 +3314,7 @@ function sanitizeMsgpackValue(value) {
   }
   const sanitized = {};
   for (const [key, entry] of Object.entries(value)) {
-    if (DANGEROUS_KEYS.has(key)) {
+    if (DANGEROUS_KEYS2.has(key)) {
       continue;
     }
     sanitized[key] = sanitizeMsgpackValue(entry);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "layercache",
-  "version": "1.2.4",
+  "version": "1.2.5",
   "description": "Hardened multi-layer caching for Node.js with memory, Redis, stampede prevention, and operational invalidation helpers.",
   "license": "MIT",
   "repository": {

package/packages/nestjs/dist/index.cjs

@@ -374,6 +374,7 @@ var CacheNamespace = class _CacheNamespace {
    * ```
    */
   namespace(childPrefix) {
+    validateNamespaceKey(childPrefix);
     return new _CacheNamespace(this.cache, `${this.prefix}:${childPrefix}`);
   }
   qualify(key) {
@@ -503,6 +504,17 @@ function addMap(base, delta) {
   }
   return result;
 }
+function validateNamespaceKey(key) {
+  if (key.length === 0) {
+    throw new Error("Namespace prefix must not be empty.");
+  }
+  if (key.length > 256) {
+    throw new Error("Namespace prefix must be at most 256 characters.");
+  }
+  if (/[\u0000-\u001F\u007F]/.test(key)) {
+    throw new Error("Namespace prefix contains unsupported control characters.");
+  }
+}
 
 // ../../src/invalidation/PatternMatcher.ts
 var PatternMatcher = class _PatternMatcher {
@@ -623,9 +635,7 @@ var CircuitBreakerManager = class {
     }
     const now = Date.now();
     if (state.openUntil <= now) {
-      state.openUntil = null;
-      state.failures = 0;
-      this.breakers.set(key, state);
+      this.breakers.delete(key);
       return;
     }
     const remainingMs = state.openUntil - now;
@@ -636,15 +646,15 @@ var CircuitBreakerManager = class {
     if (!options) {
       return;
     }
+    this.pruneIfNeeded();
     const failureThreshold = options.failureThreshold ?? 3;
     const cooldownMs = options.cooldownMs ?? 3e4;
-    const state = this.breakers.get(key) ?? { failures: 0, openUntil: null };
+    const state = this.breakers.get(key) ?? { failures: 0, openUntil: null, createdAt: Date.now() };
     state.failures += 1;
     if (state.failures >= failureThreshold) {
       state.openUntil = Date.now() + cooldownMs;
     }
     this.breakers.set(key, state);
-    this.pruneIfNeeded();
   }
   recordSuccess(key) {
     this.breakers.delete(key);
@@ -655,8 +665,7 @@ var CircuitBreakerManager = class {
       return false;
     }
     if (state.openUntil <= Date.now()) {
-      state.openUntil = null;
-      state.failures = 0;
+      this.breakers.delete(key);
       return false;
     }
     return true;
@@ -680,15 +689,20 @@ var CircuitBreakerManager = class {
     if (this.breakers.size <= this.maxEntries) {
       return;
     }
+    const now = Date.now();
     for (const [key, state] of this.breakers.entries()) {
       if (this.breakers.size <= this.maxEntries) {
-        break;
+        return;
       }
-      if (!state.openUntil || state.openUntil <= Date.now()) {
+      if (!state.openUntil || state.openUntil <= now) {
         this.breakers.delete(key);
       }
     }
-    for (const key of this.breakers.keys()) {
+    if (this.breakers.size <= this.maxEntries) {
+      return;
+    }
+    const sorted = [...this.breakers.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
+    for (const [key] of sorted) {
       if (this.breakers.size <= this.maxEntries) {
         break;
       }
@@ -698,6 +712,7 @@ var CircuitBreakerManager = class {
 };
 
 // ../../src/internal/FetchRateLimiter.ts
+var MAX_BUCKETS = 1e4;
 var FetchRateLimiter = class {
   buckets = /* @__PURE__ */ new Map();
   queuesByBucket = /* @__PURE__ */ new Map();
@@ -863,10 +878,25 @@ var FetchRateLimiter = class {
     if (existing) {
       return existing;
     }
+    if (this.buckets.size >= MAX_BUCKETS) {
+      this.evictIdleBuckets();
+    }
     const bucket = { active: 0, startedAt: [] };
     this.buckets.set(bucketKey, bucket);
     return bucket;
   }
+  evictIdleBuckets() {
+    for (const [key, bucket] of this.buckets.entries()) {
+      if (this.buckets.size <= MAX_BUCKETS * 0.9) {
+        break;
+      }
+      if (bucket.active === 0 && bucket.startedAt.length === 0 && !this.queuesByBucket.has(key)) {
+        this.buckets.delete(key);
+        this.queuesByBucket.delete(key);
+        this.pendingBuckets.delete(key);
+      }
+    }
+  }
   cleanupBucket(bucketKey, bucket, intervalMs) {
     const queued = this.queuesByBucket.get(bucketKey)?.length ?? 0;
     if (queued === 0 && bucket.active === 0 && bucket.startedAt.length === 0) {
@@ -1193,18 +1223,18 @@ var TtlResolver = class {
       return;
     }
     const toRemove = Math.ceil(this.maxProfileEntries * 0.1);
-    let removed = 0;
-    for (const key of this.accessProfiles.keys()) {
-      if (removed >= toRemove) {
-        break;
+    const sorted = [...this.accessProfiles.entries()].sort((a, b) => a[1].lastAccessAt - b[1].lastAccessAt);
+    for (let i = 0; i < toRemove && i < sorted.length; i++) {
+      const entry = sorted[i];
+      if (entry) {
+        this.accessProfiles.delete(entry[0]);
       }
-      this.accessProfiles.delete(key);
-      removed += 1;
     }
   }
 };
 
 // ../../src/invalidation/TagIndex.ts
+var MAX_PATTERN_RECURSION_DEPTH = 500;
 var TagIndex = class {
   tagToKeys = /* @__PURE__ */ new Map();
   keyToTags = /* @__PURE__ */ new Map();
@@ -1259,7 +1289,7 @@ var TagIndex = class {
   }
   async matchPattern(pattern) {
     const matches = /* @__PURE__ */ new Set();
-    this.collectPatternMatches(this.root, "", pattern, 0, matches, /* @__PURE__ */ new Set());
+    this.collectPatternMatches(this.root, "", pattern, 0, matches, /* @__PURE__ */ new Set(), 0);
     return [...matches];
   }
   async clear() {
@@ -1311,7 +1341,10 @@ var TagIndex = class {
       this.collectFromNode(child, `${prefix}${character}`, matches);
     }
   }
-  collectPatternMatches(node, prefix, pattern, patternIndex, matches, visited) {
+  collectPatternMatches(node, prefix, pattern, patternIndex, matches, visited, depth) {
+    if (depth > MAX_PATTERN_RECURSION_DEPTH) {
+      return;
+    }
     const stateKey = `${node.id}:${patternIndex}`;
     if (visited.has(stateKey)) {
       return;
@@ -1328,21 +1361,37 @@ var TagIndex = class {
       return;
     }
     if (patternChar === "*") {
-      this.collectPatternMatches(node, prefix, pattern, patternIndex + 1, matches, visited);
+      this.collectPatternMatches(node, prefix, pattern, patternIndex + 1, matches, visited, depth + 1);
       for (const [character, child2] of node.children) {
-        this.collectPatternMatches(child2, `${prefix}${character}`, pattern, patternIndex, matches, visited);
+        this.collectPatternMatches(child2, `${prefix}${character}`, pattern, patternIndex, matches, visited, depth + 1);
       }
       return;
     }
     if (patternChar === "?") {
       for (const [character, child2] of node.children) {
-        this.collectPatternMatches(child2, `${prefix}${character}`, pattern, patternIndex + 1, matches, visited);
+        this.collectPatternMatches(
+          child2,
+          `${prefix}${character}`,
+          pattern,
+          patternIndex + 1,
+          matches,
+          visited,
+          depth + 1
+        );
       }
       return;
     }
     const child = node.children.get(patternChar);
     if (child) {
-      this.collectPatternMatches(child, `${prefix}${patternChar}`, pattern, patternIndex + 1, matches, visited);
+      this.collectPatternMatches(
+        child,
+        `${prefix}${patternChar}`,
+        pattern,
+        patternIndex + 1,
+        matches,
+        visited,
+        depth + 1
+      );
     }
   }
   pruneKnownKeysIfNeeded() {
@@ -1484,6 +1533,7 @@ var DEFAULT_SINGLE_FLIGHT_TIMEOUT_MS = 5e3;
 var DEFAULT_SINGLE_FLIGHT_POLL_MS = 50;
 var DEFAULT_BACKGROUND_REFRESH_TIMEOUT_MS = 3e4;
 var MAX_CACHE_KEY_LENGTH = 1024;
+var MAX_PATTERN_LENGTH = 1024;
 var DEFAULT_MAX_PROFILE_ENTRIES = 1e5;
 var DANGEROUS_OBJECT_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
 var DebugLogger = class {
@@ -1917,6 +1967,7 @@ var CacheStack = class extends import_node_events.EventEmitter {
     await this.publishInvalidation({ scope: "keys", keys, sourceId: this.instanceId, operation: "invalidate" });
   }
   async invalidateByPattern(pattern) {
+    this.validatePattern(pattern);
     await this.awaitStartup("invalidateByPattern");
     const keys = await this.keyDiscovery.collectKeysMatchingPattern(this.qualifyPattern(pattern));
     await this.deleteKeys(keys);
@@ -2810,6 +2861,17 @@ var CacheStack = class extends import_node_events.EventEmitter {
     }
     return key;
   }
+  validatePattern(pattern) {
+    if (pattern.length === 0) {
+      throw new Error("Pattern must not be empty.");
+    }
+    if (pattern.length > MAX_PATTERN_LENGTH) {
+      throw new Error(`Pattern length must be at most ${MAX_PATTERN_LENGTH} characters.`);
+    }
+    if (/[\u0000-\u001F\u007F]/.test(pattern)) {
+      throw new Error("Pattern contains unsupported control characters.");
+    }
+  }
   validateTtlPolicy(name, policy) {
     if (!policy || typeof policy === "function" || policy === "until-midnight" || policy === "next-hour") {
       return;
@@ -2974,7 +3036,18 @@ var CacheStack = class extends import_node_events.EventEmitter {
   }
 };
 function createInstanceId() {
-  return globalThis.crypto?.randomUUID?.() ?? `layercache-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  if (globalThis.crypto?.randomUUID) {
+    return globalThis.crypto.randomUUID();
+  }
+  const bytes = new Uint8Array(16);
+  if (globalThis.crypto?.getRandomValues) {
+    globalThis.crypto.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < bytes.length; i++) {
+      bytes[i] = Math.floor(Math.random() * 256);
+    }
+  }
+  return `layercache-${Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("")}`;
 }
 
 // src/module.ts

package/packages/nestjs/dist/index.d.cts

@@ -555,6 +555,7 @@ declare class CacheStack extends EventEmitter {
     private validateRateLimitOptions;
     private validateNonNegativeNumber;
     private validateCacheKey;
+    private validatePattern;
     private validateTtlPolicy;
     private assertActive;
     private awaitStartup;

package/packages/nestjs/dist/index.d.ts

@@ -555,6 +555,7 @@ declare class CacheStack extends EventEmitter {
     private validateRateLimitOptions;
     private validateNonNegativeNumber;
     private validateCacheKey;
+    private validatePattern;
     private validateTtlPolicy;
     private assertActive;
     private awaitStartup;