silgi 0.43.28 → 0.50.0

package/dist/compile.mjs

@@ -0,0 +1,332 @@
+import { validateSchema } from "./core/schema.mjs";
+import { SilgiError } from "./core/error.mjs";
+import { isProcedureDef } from "./core/router-utils.mjs";
+import { addRoute, createRouter, findRoute } from "rou3";
+//#region src/compile.ts
+/**
+* Pipeline Compiler — guard unrolling, context pooling, rou3 routing.
+*
+* 1. UNROLLED GUARDS — 0-4 guard specialization (no loop, V8 inlines)
+* 2. ZERO-ALLOC CONTEXT — Object.create(null) + pool reuse
+* 3. ROU3 ROUTER — unjs radix tree (same as h3/nitro)
+*/
+/** Internal symbol for pipeline raw input — prevents collision with user context keys */
+const RAW_INPUT = Symbol.for("silgi.rawInput");
+function isThenable(value) {
+	return value !== null && typeof value === "object" && typeof value.then === "function";
+}
+function createFail(errors) {
+	return (code, data) => {
+		const def = errors[code];
+		throw new SilgiError(code, {
+			status: typeof def === "number" ? def : def?.status ?? 500,
+			message: typeof def === "object" && def !== null && "message" in def ? def.message : void 0,
+			data,
+			defined: true
+		});
+	};
+}
+function noopFail(code, data) {
+	throw new SilgiError(code, {
+		data,
+		defined: false
+	});
+}
+const UNSAFE_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+/** Pre-frozen empty params — avoids per-request {} allocation */
+const EMPTY_PARAMS = /* @__PURE__ */ Object.freeze(Object.create(null));
+/** Sanitize a value to prevent prototype pollution from nested __proto__ keys */
+function sanitizeValue(value) {
+	if (typeof value !== "object" || value === null) return value;
+	if (Array.isArray(value)) {
+		for (let i = 0; i < value.length; i++) value[i] = sanitizeValue(value[i]);
+		return value;
+	}
+	const proto = Object.getPrototypeOf(value);
+	if (proto !== Object.prototype && proto !== null) return value;
+	const obj = value;
+	if (Object.prototype.hasOwnProperty.call(obj, "__proto__")) {
+		const clean = Object.create(null);
+		const keys = Object.keys(obj);
+		for (let i = 0; i < keys.length; i++) {
+			const k = keys[i];
+			if (!UNSAFE_KEYS.has(k)) clean[k] = sanitizeValue(obj[k]);
+		}
+		return clean;
+	}
+	const keys = Object.keys(obj);
+	for (let i = 0; i < keys.length; i++) {
+		const k = keys[i];
+		obj[k] = sanitizeValue(obj[k]);
+	}
+	return value;
+}
+/** Apply a single guard result to context — direct property set */
+function applyGuardResult(ctx, result) {
+	if (result === null || result === void 0 || typeof result !== "object") return;
+	const keys = Object.keys(result);
+	for (let i = 0; i < keys.length; i++) {
+		const k = keys[i];
+		if (UNSAFE_KEYS.has(k)) continue;
+		ctx[k] = sanitizeValue(result[k]);
+	}
+}
+/** Apply a single guard (sync fast-path, async fallback) */
+async function applyGuard(ctx, guard) {
+	const result = guard.fn(ctx);
+	applyGuardResult(ctx, isThenable(result) ? await result : result);
+}
+function runGuards0() {}
+function runGuards1(ctx, g0) {
+	const r0 = g0.fn(ctx);
+	if (isThenable(r0)) return r0.then((v) => applyGuardResult(ctx, v));
+	applyGuardResult(ctx, r0);
+}
+function runGuards2(ctx, g0, g1) {
+	const r0 = g0.fn(ctx);
+	if (isThenable(r0)) return r0.then((v) => {
+		applyGuardResult(ctx, v);
+		return applyGuard(ctx, g1);
+	});
+	applyGuardResult(ctx, r0);
+	const r1 = g1.fn(ctx);
+	if (isThenable(r1)) return r1.then((v) => applyGuardResult(ctx, v));
+	applyGuardResult(ctx, r1);
+}
+function runGuards3(ctx, g0, g1, g2) {
+	const r0 = g0.fn(ctx);
+	if (isThenable(r0)) return r0.then(async (v) => {
+		applyGuardResult(ctx, v);
+		await applyGuard(ctx, g1);
+		await applyGuard(ctx, g2);
+	});
+	applyGuardResult(ctx, r0);
+	const r1 = g1.fn(ctx);
+	if (isThenable(r1)) return r1.then(async (v) => {
+		applyGuardResult(ctx, v);
+		await applyGuard(ctx, g2);
+	});
+	applyGuardResult(ctx, r1);
+	const r2 = g2.fn(ctx);
+	if (isThenable(r2)) return r2.then((v) => applyGuardResult(ctx, v));
+	applyGuardResult(ctx, r2);
+}
+function runGuards4(ctx, g0, g1, g2, g3) {
+	const r0 = g0.fn(ctx);
+	if (isThenable(r0)) return r0.then(async (v) => {
+		applyGuardResult(ctx, v);
+		await applyGuard(ctx, g1);
+		await applyGuard(ctx, g2);
+		await applyGuard(ctx, g3);
+	});
+	applyGuardResult(ctx, r0);
+	const r1 = g1.fn(ctx);
+	if (isThenable(r1)) return r1.then(async (v) => {
+		applyGuardResult(ctx, v);
+		await applyGuard(ctx, g2);
+		await applyGuard(ctx, g3);
+	});
+	applyGuardResult(ctx, r1);
+	const r2 = g2.fn(ctx);
+	if (isThenable(r2)) return r2.then(async (v) => {
+		applyGuardResult(ctx, v);
+		await applyGuard(ctx, g3);
+	});
+	applyGuardResult(ctx, r2);
+	const r3 = g3.fn(ctx);
+	if (isThenable(r3)) return r3.then((v) => applyGuardResult(ctx, v));
+	applyGuardResult(ctx, r3);
+}
+/** Fallback for 5+ guards — loop */
+async function runGuardsN(ctx, guards) {
+	for (const guard of guards) {
+		const result = guard.fn(ctx);
+		applyGuardResult(ctx, isThenable(result) ? await result : result);
+	}
+}
+/**
+* Select the optimal guard runner based on count.
+* Returns a function that applies all guards to a context.
+*/
+function selectGuardRunner(guards) {
+	switch (guards.length) {
+		case 0: return runGuards0;
+		case 1: {
+			const g0 = guards[0];
+			return (ctx) => runGuards1(ctx, g0);
+		}
+		case 2: {
+			const [g0, g1] = guards;
+			return (ctx) => runGuards2(ctx, g0, g1);
+		}
+		case 3: {
+			const [g0, g1, g2] = guards;
+			return (ctx) => runGuards3(ctx, g0, g1, g2);
+		}
+		case 4: {
+			const [g0, g1, g2, g3] = guards;
+			return (ctx) => runGuards4(ctx, g0, g1, g2, g3);
+		}
+		default: return (ctx) => runGuardsN(ctx, guards);
+	}
+}
+/** Call resolve, then validate output (sync-first, async fallback) */
+function _resolveWithOutput(resolveFn, input, ctx, failFn, signal, outputSchema) {
+	const output = resolveFn({
+		input,
+		ctx,
+		fail: failFn,
+		signal,
+		params: ctx.params ?? EMPTY_PARAMS
+	});
+	if (!outputSchema) return output;
+	if (isThenable(output)) return output.then((o) => validateSchema(outputSchema, o));
+	return validateSchema(outputSchema, output);
+}
+/** Validate input, resolve, validate output — sync-first with rejected Promise fallback.
+*  All sync throws (validation errors, fail() calls, resolver errors) are converted
+*  to rejected Promises for consistent error handling in .then().catch() chains. */
+function _validateAndResolve(inputSchema, outputSchema, resolveFn, rawInput, ctx, failFn, signal) {
+	try {
+		const input = inputSchema ? validateSchema(inputSchema, rawInput ?? {}) : rawInput;
+		if (isThenable(input)) return input.then((resolvedInput) => _resolveWithOutput(resolveFn, resolvedInput, ctx, failFn, signal, outputSchema));
+		return _resolveWithOutput(resolveFn, input, ctx, failFn, signal, outputSchema);
+	} catch (e) {
+		return Promise.reject(e);
+	}
+}
+/**
+* Compile a procedure into the fastest possible handler.
+*
+* Optimizations applied:
+* - Guard count specialization (unrolled for 0-4)
+* - Separate fast path for no-wrap case (zero closures per request)
+* - Pre-computed fail function (singleton per procedure)
+* - Sync fast path when all guards are sync
+*/
+function compileProcedure(procedure) {
+	const middlewares = procedure.use ?? [];
+	const guards = [];
+	const wraps = [];
+	for (const mw of middlewares) if (mw.kind === "guard") guards.push(mw);
+	else wraps.push(mw);
+	const inputSchema = procedure.input;
+	const outputSchema = procedure.output;
+	const resolveFn = procedure.resolve;
+	let mergedErrors = procedure.errors;
+	for (const guard of guards) if (guard.errors) mergedErrors = mergedErrors ? {
+		...mergedErrors,
+		...guard.errors
+	} : guard.errors;
+	const failFn = mergedErrors ? createFail(mergedErrors) : noopFail;
+	const runGuards = selectGuardRunner(guards);
+	if (wraps.length === 0 && !inputSchema && !outputSchema) return (ctx, rawInput, signal) => {
+		try {
+			const guardResult = runGuards(ctx);
+			if (guardResult && isThenable(guardResult)) return guardResult.then(() => resolveFn({
+				input: rawInput,
+				ctx,
+				fail: failFn,
+				signal,
+				params: ctx.params ?? EMPTY_PARAMS
+			}));
+			return resolveFn({
+				input: rawInput,
+				ctx,
+				fail: failFn,
+				signal,
+				params: ctx.params ?? EMPTY_PARAMS
+			});
+		} catch (e) {
+			return Promise.reject(e);
+		}
+	};
+	if (wraps.length === 0) return (ctx, rawInput, signal) => {
+		try {
+			const guardResult = runGuards(ctx);
+			if (guardResult && isThenable(guardResult)) return guardResult.then(() => _validateAndResolve(inputSchema, outputSchema, resolveFn, rawInput, ctx, failFn, signal));
+			return _validateAndResolve(inputSchema, outputSchema, resolveFn, rawInput, ctx, failFn, signal);
+		} catch (e) {
+			return Promise.reject(e);
+		}
+	};
+	return async (ctx, rawInput, signal) => {
+		const guardResult = runGuards(ctx);
+		if (guardResult && isThenable(guardResult)) await guardResult;
+		let input;
+		if (inputSchema) {
+			const validated = validateSchema(inputSchema, rawInput ?? {});
+			input = isThenable(validated) ? await validated : validated;
+		} else input = rawInput;
+		ctx[RAW_INPUT] = input;
+		let execute = () => {
+			const resolvedInput = ctx[RAW_INPUT] ?? input;
+			return Promise.resolve(resolveFn({
+				input: resolvedInput,
+				ctx,
+				fail: failFn,
+				signal,
+				params: ctx.params ?? EMPTY_PARAMS
+			}));
+		};
+		for (let i = wraps.length - 1; i >= 0; i--) {
+			const wrapFn = wraps[i].fn;
+			const next = execute;
+			execute = () => wrapFn(ctx, next);
+		}
+		const output = await execute();
+		if (!outputSchema) return output;
+		const validated = validateSchema(outputSchema, output);
+		return isThenable(validated) ? await validated : validated;
+	};
+}
+/**
+* Compile a router tree into a rou3 radix router.
+*
+* Powered by rou3 (unjs) — battle-tested, fast, minimal.
+*/
+function compileRouter(def) {
+	const router = createRouter();
+	function walk(node, path) {
+		if (isProcedureDef(node)) {
+			const proc = node;
+			const route = proc.route;
+			const routePath = route?.path || "/" + path.join("/");
+			const method = route?.method?.toUpperCase() || "POST";
+			let cacheControl;
+			if (route?.cache != null) cacheControl = typeof route.cache === "number" ? `public, max-age=${route.cache}` : route.cache;
+			const compiled = {
+				handler: compileProcedure(proc),
+				cacheControl,
+				ws: route?.ws ?? void 0,
+				passthrough: routePath.includes("**") || void 0,
+				method
+			};
+			addRoute(router, method, routePath, compiled);
+			addRoute(router, "", routePath, compiled);
+			return;
+		}
+		if (typeof node === "object" && node !== null) for (const [k, v] of Object.entries(node)) walk(v, [...path, k]);
+	}
+	walk(def, []);
+	return (method, path) => findRoute(router, method, path);
+}
+/** Pool of pre-allocated null-prototype context objects — eliminates per-request GC pressure. */
+const CTX_POOL = [];
+const CTX_POOL_MAX = 128;
+/** Acquire a context object from the pool (or create one). */
+function createContext() {
+	return CTX_POOL.length > 0 ? CTX_POOL.pop() : Object.create(null);
+}
+/** Return a context object to the pool after request completes. */
+function releaseContext(ctx) {
+	for (const key of Object.keys(ctx)) delete ctx[key];
+	for (const sym of Object.getOwnPropertySymbols(ctx)) delete ctx[sym];
+	if (CTX_POOL.length < CTX_POOL_MAX) CTX_POOL.push(ctx);
+}
+//#endregion
+export { RAW_INPUT, compileProcedure, compileRouter, createContext, releaseContext };

package/dist/core/codec.mjs

@@ -0,0 +1,67 @@
+import { ValidationError } from "./schema.mjs";
+import { SilgiError, toSilgiError } from "./error.mjs";
+import { stringifyJSON } from "./utils.mjs";
+//#region src/core/codec.ts
+/**
+* Response encoding — JSON, MessagePack, devalue.
+*
+* Lazy-loads binary codecs on first non-JSON request.
+*/
+let _msgpack;
+let _devalue;
+/** Detect response format from Accept header */
+function detectResponseFormat(request) {
+	const accept = request.headers.get("accept");
+	if (!accept) return "json";
+	if (accept.includes("msgpack")) return "msgpack";
+	if (accept.includes("x-devalue")) return "devalue";
+	return "json";
+}
+/** Encode data into a Response with the given format */
+async function encodeResponse(data, status, format, extraHeaders) {
+	switch (format) {
+		case "msgpack":
+			_msgpack ??= await import("../codec/msgpack.mjs");
+			return new Response(_msgpack.encode(data), {
+				status,
+				headers: {
+					"content-type": _msgpack.MSGPACK_CONTENT_TYPE,
+					...extraHeaders
+				}
+			});
+		case "devalue":
+			_devalue ??= await import("../codec/devalue.mjs");
+			return new Response(_devalue.encode(data), {
+				status,
+				headers: {
+					"content-type": _devalue.DEVALUE_CONTENT_TYPE,
+					...extraHeaders
+				}
+			});
+		default: return new Response(stringifyJSON(data), {
+			status,
+			headers: {
+				"content-type": "application/json",
+				...extraHeaders
+			}
+		});
+	}
+}
+/** Build error Response from any thrown error */
+function makeErrorResponse(error, format) {
+	if (error instanceof ValidationError) return encodeResponse({
+		code: "BAD_REQUEST",
+		status: 400,
+		message: error.message,
+		data: { issues: error.issues }
+	}, 400, format);
+	if (error instanceof SyntaxError) return encodeResponse({
+		code: "BAD_REQUEST",
+		status: 400,
+		message: "Invalid JSON body"
+	}, 400, format);
+	const e = error instanceof SilgiError ? error : toSilgiError(error);
+	return encodeResponse(e.toJSON(), e.status, format);
+}
+//#endregion
+export { detectResponseFormat, encodeResponse, makeErrorResponse };

package/dist/core/context-bridge.mjs

@@ -0,0 +1,11 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/core/context-bridge.ts
+const ctxStorage = new AsyncLocalStorage();
+function runWithCtx(ctx, fn) {
+	return ctxStorage.run(ctx, fn);
+}
+function getCtx() {
+	return ctxStorage.getStore();
+}
+//#endregion
+export { getCtx, runWithCtx };

package/dist/core/dispatch.mjs

@@ -0,0 +1,62 @@
+import { ValidationError } from "./schema.mjs";
+import { SilgiError, toSilgiError } from "./error.mjs";
+//#region src/core/dispatch.ts
+/**
+* Shared dispatch utilities for adapters.
+*
+* Centralizes: context building, method enforcement, input parsing, error serialization.
+* Every non-Fetch adapter (express, nestjs, bun, lambda, message-port) uses these
+* instead of reimplementing the same logic.
+*/
+/**
+* Copy properties from source into target context via direct property set.
+* V8 monomorphic access — no Object.assign, no spread.
+*/
+function applyContext(target, source) {
+	const keys = Object.keys(source);
+	for (let i = 0; i < keys.length; i++) target[keys[i]] = source[keys[i]];
+}
+/**
+* Build a null-prototype context object from a base context and route params.
+* Uses direct property assignment (no Object.assign) for V8 monomorphic access.
+*/
+function buildContext(baseCtx, params) {
+	const ctx = Object.create(null);
+	if (baseCtx) applyContext(ctx, baseCtx);
+	if (params) ctx.params = params;
+	return ctx;
+}
+/** Check if an HTTP method is allowed for a compiled route. */
+function isMethodAllowed(reqMethod, routeMethod) {
+	if (routeMethod === "*") return true;
+	if (reqMethod === routeMethod) return true;
+	if (reqMethod === "OPTIONS") return true;
+	if (reqMethod === "GET" && routeMethod === "POST") return true;
+	return false;
+}
+/** Convert any thrown error to a serializable error body + status. */
+function serializeError(error) {
+	if (error instanceof ValidationError) return {
+		code: "BAD_REQUEST",
+		status: 400,
+		message: error.message,
+		data: { issues: error.issues }
+	};
+	return (error instanceof SilgiError ? error : toSilgiError(error)).toJSON();
+}
+/** Max allowed size for GET ?data= parameter (bytes). Prevents JSON bomb via URL. */
+const MAX_QUERY_DATA_LENGTH = 8192;
+/**
+* Parse a JSON string from a query parameter.
+* Throws SilgiError(BAD_REQUEST) on invalid JSON or oversized input.
+*/
+function parseQueryData(dataValue) {
+	if (dataValue.length > MAX_QUERY_DATA_LENGTH) throw new SilgiError("BAD_REQUEST", { message: "Query data parameter too large" });
+	try {
+		return JSON.parse(dataValue);
+	} catch {
+		throw new SilgiError("BAD_REQUEST", { message: "Invalid JSON in data parameter" });
+	}
+}
+//#endregion
+export { applyContext, buildContext, isMethodAllowed, parseQueryData, serializeError };

package/dist/core/error.d.mts

@@ -1,65 +1,104 @@
 //#region src/core/error.d.ts
 /**
-* Silgi Runtime Error
-* @class
-* @extends Error
-* @property {number} statusCode - An integer indicating the HTTP response status code.
-* @property {string} statusMessage - A string representing the HTTP status message.
-* @property {boolean} fatal - Indicates if the error is a fatal error.
-* @property {boolean} unhandled - Indicates if the error was unhandled and auto-captured.
-* @property {DataT} data - An extra data that will be included in the response.
-*                         This can be used to pass additional information about the error.
-*/
-declare class SilgiError<DataT = unknown> extends Error {
-  static __silgi_error__: boolean;
-  statusCode: number;
-  fatal: boolean;
-  unhandled: boolean;
-  statusMessage?: string;
-  data?: DataT;
+ * SilgiError — unified RPC error with cross-realm instanceof.
+ */
+declare const COMMON_ERRORS: Readonly<{
+  readonly BAD_REQUEST: {
+    readonly status: 400;
+    readonly message: "Bad Request";
+  };
+  readonly UNAUTHORIZED: {
+    readonly status: 401;
+    readonly message: "Unauthorized";
+  };
+  readonly FORBIDDEN: {
+    readonly status: 403;
+    readonly message: "Forbidden";
+  };
+  readonly NOT_FOUND: {
+    readonly status: 404;
+    readonly message: "Not Found";
+  };
+  readonly METHOD_NOT_ALLOWED: {
+    readonly status: 405;
+    readonly message: "Method Not Allowed";
+  };
+  readonly NOT_ACCEPTABLE: {
+    readonly status: 406;
+    readonly message: "Not Acceptable";
+  };
+  readonly CONFLICT: {
+    readonly status: 409;
+    readonly message: "Conflict";
+  };
+  readonly GONE: {
+    readonly status: 410;
+    readonly message: "Gone";
+  };
+  readonly UNPROCESSABLE_CONTENT: {
+    readonly status: 422;
+    readonly message: "Unprocessable Content";
+  };
+  readonly PRECONDITION_REQUIRED: {
+    readonly status: 428;
+    readonly message: "Precondition Required";
+  };
+  readonly TOO_MANY_REQUESTS: {
+    readonly status: 429;
+    readonly message: "Too Many Requests";
+  };
+  readonly CLIENT_CLOSED_REQUEST: {
+    readonly status: 499;
+    readonly message: "Client Closed Request";
+  };
+  readonly INTERNAL_SERVER_ERROR: {
+    readonly status: 500;
+    readonly message: "Internal Server Error";
+  };
+  readonly NOT_IMPLEMENTED: {
+    readonly status: 501;
+    readonly message: "Not Implemented";
+  };
+  readonly BAD_GATEWAY: {
+    readonly status: 502;
+    readonly message: "Bad Gateway";
+  };
+  readonly SERVICE_UNAVAILABLE: {
+    readonly status: 503;
+    readonly message: "Service Unavailable";
+  };
+  readonly GATEWAY_TIMEOUT: {
+    readonly status: 504;
+    readonly message: "Gateway Timeout";
+  };
+}>;
+type SilgiErrorCode = keyof typeof COMMON_ERRORS | (string & {});
+interface SilgiErrorOptions<TData = unknown> {
+  status?: number;
+  message?: string;
+  data?: TData;
   cause?: unknown;
-  constructor(message: string, opts?: {
-    cause?: unknown;
-  });
-  toJSON(): Pick<SilgiError<DataT>, "message" | "statusCode" | "statusMessage" | "data">;
+  defined?: boolean;
 }
-/**
-* Creates a new `Error` that can be used to handle both internal and runtime errors.
-*
-* @param input {string | (Partial<SilgiError> & { status?: number; statusText?: string })} - The error message or an object containing error properties.
-* If a string is provided, it will be used as the error `message`.
-*
-* @example
-* // String error where `statusCode` defaults to `500`
-* throw createError("An error occurred");
-* // Object error
-* throw createError({
-*   statusCode: 400,
-*   statusMessage: "Bad Request",
-*   message: "Invalid input",
-*   data: { field: "email" }
-* });
-*
-*
-* @return {SilgiError} - An instance of SilgiError.
-*
-* @remarks
-* - Typically, `message` contains a brief, human-readable description of the error, while `statusMessage` is specific to HTTP responses and describes
-* the status text related to the response status code.
-* - In a client-server context, using a short `statusMessage` is recommended because it can be accessed on the client side. Otherwise, a `message`
-* passed to `createError` on the server will not propagate to the client.
-* - Consider avoiding putting dynamic user input in the `message` to prevent potential security issues.
-*/
-declare function createError<DataT = unknown>(input: string | (Partial<SilgiError<DataT>> & {
-  status?: number;
-  statusText?: string;
-})): SilgiError<DataT>;
-/**
-* Checks if the given input is an instance of SilgiError.
-*
-* @param input {*} - The input to check.
-* @return {boolean} - Returns true if the input is an instance of SilgiError, false otherwise.
-*/
-declare function isError<DataT = unknown>(input: any): input is SilgiError<DataT>;
+interface SilgiErrorJSON<TCode extends string = string, TData = unknown> {
+  defined: boolean;
+  code: TCode;
+  status: number;
+  message: string;
+  data: TData;
+}
+declare class SilgiError<TCode extends string = string, TData = unknown> extends Error {
+  readonly code: TCode;
+  readonly status: number;
+  readonly data: TData;
+  readonly defined: boolean;
+  constructor(code: TCode, options?: SilgiErrorOptions<TData>);
+  toJSON(): SilgiErrorJSON<TCode, TData>;
+  static [Symbol.hasInstance](instance: unknown): boolean;
+}
+declare function isDefinedError<TError>(error: TError): error is TError & SilgiError & {
+  defined: true;
+};
+declare function toSilgiError(error: unknown): SilgiError;
 //#endregion
-export { SilgiError as SilgiError$1, createError as createError$1, isError as isError$1 };
+export { SilgiError, SilgiErrorCode, SilgiErrorJSON, SilgiErrorOptions, isDefinedError, toSilgiError };