toilscript 0.1.10 → 0.1.11

package/dist/web.js

@@ -1,8 +1,8 @@
-var ASSEMBLYSCRIPT_VERSION = "0.1.10";
+var ASSEMBLYSCRIPT_VERSION = "0.1.11";
   var ASSEMBLYSCRIPT_IMPORTMAP = {
   "imports": {
-    "toilscript": "https://cdn.jsdelivr.net/npm/toilscript@0.1.10/dist/toilscript.js",
-    "toilscript/cli": "https://cdn.jsdelivr.net/npm/toilscript@0.1.10/dist/cli.js",
+    "toilscript": "https://cdn.jsdelivr.net/npm/toilscript@0.1.11/dist/toilscript.js",
+    "toilscript/cli": "https://cdn.jsdelivr.net/npm/toilscript@0.1.11/dist/cli.js",
     "binaryen": "https://cdn.jsdelivr.net/npm/binaryen@129.0.0-nightly.20260428/index.js",
     "long": "https://cdn.jsdelivr.net/npm/long@5.3.2/index.js"
   }

package/package.json

@@ -8,7 +8,7 @@
     "toilscript",
     "wasm"
   ],
-  "version": "0.1.10",
+  "version": "0.1.11",
   "author": "Daniel Wirtz <dcode+assemblyscript@dcode.io>",
   "license": "Apache-2.0",
   "homepage": "https://github.com/dacely-cloud/toilscript",

package/std/assembly/json.ts

@@ -320,9 +320,18 @@ export class JSON {
 }
 
 /** Recursive-descent parser producing a `JSON` value tree. Internal. */
+/**
+ * Maximum array/object nesting depth. Recursive descent costs stack per level, so an
+ * unbounded depth lets a small hostile input (e.g. `[[[[...`) overflow the stack and trap
+ * the instance. 512 is far beyond any real-world JSON yet far below the overflow point, so
+ * over-nested input fails as a normal parse error instead of crashing.
+ */
+const JSON_MAX_DEPTH: i32 = 512;
+
 class Parser {
     private src: string;
     private pos: i32 = 0;
+    private depth: i32 = 0;
     err: string = "";
 
     constructor(src: string) {
@@ -468,11 +477,13 @@ class Parser {
     }
 
     private parseArray(): JSON {
+        if (++this.depth > JSON_MAX_DEPTH) return this.fail("maximum nesting depth exceeded");
         this.pos++; // [
         const j = JSON.arr();
         this.skipWs();
         if (!this.atEnd() && this.peek() == 0x5d) {
             this.pos++;
+            this.depth--;
             return j;
         }
         while (true) {
@@ -484,15 +495,18 @@ class Parser {
             if (c == 0x5d) break; // ]
             if (c != 0x2c) return this.fail("expected ',' or ']'"); // ,
         }
+        this.depth--;
         return j;
     }
 
     private parseObject(): JSON {
+        if (++this.depth > JSON_MAX_DEPTH) return this.fail("maximum nesting depth exceeded");
         this.pos++; // {
         const j = JSON.obj();
         this.skipWs();
         if (!this.atEnd() && this.peek() == 0x7d) {
             this.pos++;
+            this.depth--;
             return j;
         }
         while (true) {
@@ -510,6 +524,7 @@ class Parser {
             if (c == 0x7d) break; // }
             if (c != 0x2c) return this.fail("expected ',' or '}'"); // ,
         }
+        this.depth--;
         return j;
     }
 }

package/std/assembly/rest.ts

@@ -0,0 +1,25 @@
+// Globals for the `@rest` / `@route` HTTP layer (no import). Top-level std exports are
+// globalized like the other natives.
+
+/**
+ * HTTP method for `@route({ method: Methods.GET, ... })`. Values mirror the server runtime
+ * `Method` enum so `req.method == Methods.GET` compiles to a plain integer comparison.
+ */
+export enum Methods {
+  GET = 0,
+  POST = 1,
+  PUT = 2,
+  DELETE = 3,
+  PATCH = 4,
+  HEAD = 5,
+  OPTIONS = 6
+}
+
+/**
+ * Body/response codec for `@route({ stream: DataStream.JSON, ... })`: `JSON` uses the `@data`
+ * class's `toJSON`/`fromJSON`, `Binary` uses its `encode`/`decode`.
+ */
+export enum DataStream {
+  JSON = 0,
+  Binary = 1
+}

package/std/assembly/toilscript.d.ts

@@ -38,6 +38,35 @@ declare function remote<T>(target: Object, propertyKey: string | symbol, descrip
  */
 declare function service(target: Function): void;
 
+// --- HTTP layer (@rest / @route), handled natively by the compiler; typed here for editors ---
+
+/** HTTP method for `@route({ method: Methods.GET, ... })`. */
+declare enum Methods { GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS }
+
+/** Body/response codec for `@route({ stream: DataStream.JSON, ... })`. */
+declare enum DataStream { JSON, Binary }
+
+interface RestOptions { stream?: DataStream }
+interface RouteOptions { method: Methods; path: string; stream?: DataStream }
+/** A legacy method decorator (the return of a `@route`/`@get`/... factory). */
+type ToilRouteDecorator = <T>(target: Object, propertyKey: string | symbol, descriptor: TypedPropertyDescriptor<T>) => void;
+
+/** Marks a class as an HTTP controller mounted at `prefix` (default `/`). */
+declare function rest(target: Function): void;
+declare function rest(prefix?: string): (target: Function) => void;
+declare function rest(options: RestOptions): (target: Function) => void;
+
+/** Declares an HTTP route on a `@rest` method (`@route({ method, path, stream })`). */
+declare function route(options: RouteOptions): ToilRouteDecorator;
+/** HTTP verb shortcuts for `@route` (`@del` for DELETE, since `delete` is a reserved word). */
+declare function get(path: string): ToilRouteDecorator;
+declare function post(path: string): ToilRouteDecorator;
+declare function put(path: string): ToilRouteDecorator;
+declare function del(path: string): ToilRouteDecorator;
+declare function patch(path: string): ToilRouteDecorator;
+declare function head(path: string): ToilRouteDecorator;
+declare function options(path: string): ToilRouteDecorator;
+
 // Big integers, native globals implemented in std/assembly/bignum. The
 // arithmetic/bitwise/comparison operators
 // (+ - * / % & | ^ << >> == != < > <= >=) are operator overloads resolved by