Changelog
Per-package release notes, managed with Changesets.
@rtorcato/api-amqp
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
0.2.1
Patch Changes
-
7a51835: 1.0 surface hygiene (from the #88 API-freeze audit)
- api-upload: rename
uploader()→uploadFile()so the action reads as a verb, consistent withvalidate/connect/createXacross the packages. Breaking: update imports (import { uploadFile } from '@rtorcato/api-upload'). - api-graceful-shutdown: rename
createShutdownHandler()→createShutdownController()so the factory matches its return typeShutdownController(mirrorscreateHealthRegistry → HealthRegistry). Breaking: update imports. - api-openapi: replace
export * from './builder'with explicit named re-exports so the public surface is enumerated and can't silently widen/narrow. No symbols added or removed. - api-amqp: type
connect(url, socketOptions?)'s second parameter against amqplib (Parameters<typeof amqp.connect>[1]) instead ofunknown.
- api-upload: rename
0.2.0
Minor Changes
- d8e4a95: Add
@rtorcato/api-amqp— typed amqplib publisher/consumer helpers for RabbitMQ.createPublisherasserts an exchange and JSON-encodes messages;createConsumerasserts a queue, sets prefetch, and acks on success / nacks on throw.amqplibis a peer dependency.
@rtorcato/api-auth
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-errors@1.0.0
0.1.1
Patch Changes
- Updated dependencies [097cc1f]
- @rtorcato/api-errors@0.3.0
0.1.0
Minor Changes
- 1669391: First
0.1.0release. These packages were sitting at0.0.0despite being test-covered, documented, and (for several) already on npm. Floor them at0.1.0so the version reflects real maturity. No API changes.
@rtorcato/api-auth-express
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-auth@1.0.0
- @rtorcato/api-errors@1.0.0
0.1.1
Patch Changes
- Updated dependencies [097cc1f]
- @rtorcato/api-errors@0.3.0
- @rtorcato/api-auth@0.1.1
0.1.0
Minor Changes
- 1669391: First
0.1.0release. These packages were sitting at0.0.0despite being test-covered, documented, and (for several) already on npm. Floor them at0.1.0so the version reflects real maturity. No API changes.
Patch Changes
- Updated dependencies [1669391]
- @rtorcato/api-auth@0.1.0
@rtorcato/api-auth-hono
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-auth@1.0.0
- @rtorcato/api-errors@1.0.0
0.2.1
Patch Changes
- Updated dependencies [097cc1f]
- @rtorcato/api-errors@0.3.0
- @rtorcato/api-auth@0.1.1
0.2.0
Minor Changes
- ae1ca0d: Add
@rtorcato/api-auth-hono— Hono middleware over@rtorcato/api-auth. ProvidesauthMiddlewareandoptionalAuthMiddlewarewith Bearer-header and cookie token support, and anAuthVariablestype for a typedc.get('user').
@rtorcato/api-config
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
0.2.0
Minor Changes
- 7495730: Update the
zodpeer dependency range from^3.23.0to^4.0.0. These packages are developed and tested against Zod 4 (which is what the workspace resolves); the old^3.23.0peer no longer matched reality. Consumers still on Zod 3 should upgrade to Zod 4.
0.1.0
Minor Changes
-
be7810d: Add four packages seeded from the api-starter reference app:
@rtorcato/api-logger— framework-agnostic pino logger factory.@rtorcato/api-validation— zod request validation that throwsBadRequestError, plusformatZodError.@rtorcato/api-config—loadEnv(schema)for dotenv + zod env validation (throws instead ofprocess.exit).@rtorcato/api-rate-limit— in-memory sliding-window limiter with bounded memory.
Patch Changes
- fa3f320: Add
repository,homepage,bugs, andkeywordsmetadata to every package for npm discoverability.
@rtorcato/api-cors-express
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
0.1.0
Minor Changes
- 1669391: First
0.1.0release. These packages were sitting at0.0.0despite being test-covered, documented, and (for several) already on npm. Floor them at0.1.0so the version reflects real maturity. No API changes.
@rtorcato/api-errors
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
0.3.0
Minor Changes
-
097cc1f: Unify the error response envelope across packages.
api-errorsnow exportstoErrorResponse(err, { includeStack })and theErrorResponsetype — the single source of truth for the{ error, code, message, stack? }body. The Express and Hono error handlers, andapi-response, now derive from it instead of hand-rolling the shape.- Fix: the rate-limit middleware (Express + Hono) previously responded
429with a non-standard body{ success: false, code: 'rate_limited', message }. It now returns the standard error envelope{ error: 'TooManyRequestsError', code: 'too_many_requests', message }, so clients parse rate-limit errors like any other error. Thecodeis nowtoo_many_requests(wasrate_limited).
0.2.0
Minor Changes
- fa3f320: Add
UnprocessableEntityError(422),TooManyRequestsError(429), andServiceUnavailableError(503) classes.
Patch Changes
- fa3f320: Add
repository,homepage,bugs, andkeywordsmetadata to every package for npm discoverability.
0.1.1
Patch Changes
- 8c3e3e5: Expand README with install + usage examples. No code changes.
0.1.0
Minor Changes
-
a5c26a7: Initial release.
@rtorcato/api-errors: framework-agnosticHttpErrorbase class plusBadRequestError,UnauthorizedError,ForbiddenError,NotFoundError,ConflictError,InternalServerError. Each carriesstatus,code, andmessage.@rtorcato/api-errors-express: Express middleware (errorHandler,notFoundHandler) that mapsHttpErrorinstances to a{ error, code, message, stack? }JSON body.expressis a peer dependency (^4 || ^5).@rtorcato/api-errors-hono: Hono middleware (errorHandler,notFoundHandler) wiring intoapp.onError/app.notFoundwith the same response shape as the Express adapter.honois a peer dependency (^4).
@rtorcato/api-errors-express
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-errors@1.0.0
0.2.1
Patch Changes
-
097cc1f: Unify the error response envelope across packages.
api-errorsnow exportstoErrorResponse(err, { includeStack })and theErrorResponsetype — the single source of truth for the{ error, code, message, stack? }body. The Express and Hono error handlers, andapi-response, now derive from it instead of hand-rolling the shape.- Fix: the rate-limit middleware (Express + Hono) previously responded
429with a non-standard body{ success: false, code: 'rate_limited', message }. It now returns the standard error envelope{ error: 'TooManyRequestsError', code: 'too_many_requests', message }, so clients parse rate-limit errors like any other error. Thecodeis nowtoo_many_requests(wasrate_limited).
-
Updated dependencies [097cc1f]
- @rtorcato/api-errors@0.3.0
0.2.0
Minor Changes
- 9fd03c8: Add
asyncHandler()— wraps an async Express route handler and forwards rejections tonext(), soerrorHandlerhandles them without per-route try/catch.
Patch Changes
- fa3f320: Add
repository,homepage,bugs, andkeywordsmetadata to every package for npm discoverability. - Updated dependencies [fa3f320]
- Updated dependencies [fa3f320]
- @rtorcato/api-errors@0.2.0
0.1.1
Patch Changes
- 8c3e3e5: Expand README with install + usage examples. No code changes.
- Updated dependencies [8c3e3e5]
- @rtorcato/api-errors@0.1.1
0.1.0
Minor Changes
-
a5c26a7: Initial release.
@rtorcato/api-errors: framework-agnosticHttpErrorbase class plusBadRequestError,UnauthorizedError,ForbiddenError,NotFoundError,ConflictError,InternalServerError. Each carriesstatus,code, andmessage.@rtorcato/api-errors-express: Express middleware (errorHandler,notFoundHandler) that mapsHttpErrorinstances to a{ error, code, message, stack? }JSON body.expressis a peer dependency (^4 || ^5).@rtorcato/api-errors-hono: Hono middleware (errorHandler,notFoundHandler) wiring intoapp.onError/app.notFoundwith the same response shape as the Express adapter.honois a peer dependency (^4).
Patch Changes
- Updated dependencies [a5c26a7]
- @rtorcato/api-errors@0.1.0
@rtorcato/api-errors-hono
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-errors@1.0.0
0.1.3
Patch Changes
-
097cc1f: Unify the error response envelope across packages.
api-errorsnow exportstoErrorResponse(err, { includeStack })and theErrorResponsetype — the single source of truth for the{ error, code, message, stack? }body. The Express and Hono error handlers, andapi-response, now derive from it instead of hand-rolling the shape.- Fix: the rate-limit middleware (Express + Hono) previously responded
429with a non-standard body{ success: false, code: 'rate_limited', message }. It now returns the standard error envelope{ error: 'TooManyRequestsError', code: 'too_many_requests', message }, so clients parse rate-limit errors like any other error. Thecodeis nowtoo_many_requests(wasrate_limited).
-
Updated dependencies [097cc1f]
- @rtorcato/api-errors@0.3.0
0.1.2
Patch Changes
- fa3f320: Add
repository,homepage,bugs, andkeywordsmetadata to every package for npm discoverability. - Updated dependencies [fa3f320]
- Updated dependencies [fa3f320]
- @rtorcato/api-errors@0.2.0
0.1.1
Patch Changes
- 8c3e3e5: Expand README with install + usage examples. No code changes.
- Updated dependencies [8c3e3e5]
- @rtorcato/api-errors@0.1.1
0.1.0
Minor Changes
-
a5c26a7: Initial release.
@rtorcato/api-errors: framework-agnosticHttpErrorbase class plusBadRequestError,UnauthorizedError,ForbiddenError,NotFoundError,ConflictError,InternalServerError. Each carriesstatus,code, andmessage.@rtorcato/api-errors-express: Express middleware (errorHandler,notFoundHandler) that mapsHttpErrorinstances to a{ error, code, message, stack? }JSON body.expressis a peer dependency (^4 || ^5).@rtorcato/api-errors-hono: Hono middleware (errorHandler,notFoundHandler) wiring intoapp.onError/app.notFoundwith the same response shape as the Express adapter.honois a peer dependency (^4).
Patch Changes
- Updated dependencies [a5c26a7]
- @rtorcato/api-errors@0.1.0
@rtorcato/api-express-utils
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
0.3.0
Minor Changes
-
439d346: New package: Express utility helpers.
getIP(req)—X-Forwarded-For-aware client IP extraction.logRoutes(app, opts?)— return/print an app's registered routes at boot.
0.2.0
Minor Changes
-
9c52aa4: New package: Express utility helpers.
getIP(req)—X-Forwarded-For-aware client IP extraction.logRoutes(app, opts?)— return/print an app's registered routes at boot.
@rtorcato/api-graceful-shutdown
1.0.1
Patch Changes
- c767fc4: Republish so the README ships to npm. These four were published at 1.0.0 (PR #109) before their READMEs were added (PR #120), so npm still serves a README-less tarball. No code change — the README is already in the repo and included in the tarball; it just needs a version bump to publish.
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
0.2.0
Minor Changes
-
7a51835: 1.0 surface hygiene (from the #88 API-freeze audit)
- api-upload: rename
uploader()→uploadFile()so the action reads as a verb, consistent withvalidate/connect/createXacross the packages. Breaking: update imports (import { uploadFile } from '@rtorcato/api-upload'). - api-graceful-shutdown: rename
createShutdownHandler()→createShutdownController()so the factory matches its return typeShutdownController(mirrorscreateHealthRegistry → HealthRegistry). Breaking: update imports. - api-openapi: replace
export * from './builder'with explicit named re-exports so the public surface is enumerated and can't silently widen/narrow. No symbols added or removed. - api-amqp: type
connect(url, socketOptions?)'s second parameter against amqplib (Parameters<typeof amqp.connect>[1]) instead ofunknown.
- api-upload: rename
0.1.0
Minor Changes
- f2332f7: Add
@rtorcato/api-graceful-shutdown: SIGTERM/SIGINT drain for Node API servers.createShutdownHandlerruns ordered cleanup hooks with a hard timeout and force-exit;closeHttpServerwraps a Node HTTP server'sclose()as a hook (works for Express and Hono via@hono/node-server).
@rtorcato/api-health
1.0.1
Patch Changes
- c767fc4: Republish so the README ships to npm. These four were published at 1.0.0 (PR #109) before their READMEs were added (PR #120), so npm still serves a README-less tarball. No code change — the README is already in the repo and included in the tarball; it just needs a version bump to publish.
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
0.1.0
Minor Changes
- c273623: Add health-check packages: a framework-agnostic readiness registry (
createHealthRegistry) plus Express and Hono liveness/readiness probe handlers (livenessHandler,readinessHandler) for/healthzand/readyzendpoints.
@rtorcato/api-health-express
1.0.1
Patch Changes
- c767fc4: Republish so the README ships to npm. These four were published at 1.0.0 (PR #109) before their READMEs were added (PR #120), so npm still serves a README-less tarball. No code change — the README is already in the repo and included in the tarball; it just needs a version bump to publish.
- Updated dependencies [c767fc4]
- @rtorcato/api-health@1.0.1
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-health@1.0.0
0.1.0
Minor Changes
- c273623: Add health-check packages: a framework-agnostic readiness registry (
createHealthRegistry) plus Express and Hono liveness/readiness probe handlers (livenessHandler,readinessHandler) for/healthzand/readyzendpoints.
Patch Changes
- Updated dependencies [c273623]
- @rtorcato/api-health@0.1.0
@rtorcato/api-health-hono
1.0.1
Patch Changes
- c767fc4: Republish so the README ships to npm. These four were published at 1.0.0 (PR #109) before their READMEs were added (PR #120), so npm still serves a README-less tarball. No code change — the README is already in the repo and included in the tarball; it just needs a version bump to publish.
- Updated dependencies [c767fc4]
- @rtorcato/api-health@1.0.1
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-health@1.0.0
0.1.0
Minor Changes
- c273623: Add health-check packages: a framework-agnostic readiness registry (
createHealthRegistry) plus Express and Hono liveness/readiness probe handlers (livenessHandler,readinessHandler) for/healthzand/readyzendpoints.
Patch Changes
- Updated dependencies [c273623]
- @rtorcato/api-health@0.1.0
@rtorcato/api-http
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-errors@1.0.0
0.2.1
Patch Changes
- Updated dependencies [097cc1f]
- @rtorcato/api-errors@0.3.0
0.2.0
Minor Changes
- d06c9cd: Add
@rtorcato/api-http— a typed HTTP client over nativefetch(Node 22+, no axios).createHttpClient({ baseURL, headers, timeoutMs, retries })returns typedget/post/put/patch/delete; non-2xx and network failures are normalized to@rtorcato/api-errorsHttpErrors.
@rtorcato/api-logger
1.1.0
Minor Changes
- e80cdcc: Add
prettyOptionstocreateLogger— forwards options topino-pretty(e.g.colorize,singleLine,translateTime,ignore) whenprettyis on, so consumers no longer have to bypass the factory to configure the dev transport.
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
0.1.0
Minor Changes
-
be7810d: Add four packages seeded from the api-starter reference app:
@rtorcato/api-logger— framework-agnostic pino logger factory.@rtorcato/api-validation— zod request validation that throwsBadRequestError, plusformatZodError.@rtorcato/api-config—loadEnv(schema)for dotenv + zod env validation (throws instead ofprocess.exit).@rtorcato/api-rate-limit— in-memory sliding-window limiter with bounded memory.
Patch Changes
- fa3f320: Add
repository,homepage,bugs, andkeywordsmetadata to every package for npm discoverability.
@rtorcato/api-mcp
0.1.0
Minor Changes
- 36d7b14: Add
@rtorcato/api-mcp— two tiny result helpers for@modelcontextprotocol/sdkMCP tool handlers:asText(value)(JSON success content block) andmcpError(text)(isErrorcontent block). Both return the SDK'sCallToolResult, so they drop straight intoregisterTool. The SDK is a peer dependency. Scope is deliberately minimal — the SDK already owns registration and transports; this only removes the result-shaping boilerplate every server rewrites.example-mcpnow uses it.
@rtorcato/api-openapi
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
0.2.1
Patch Changes
-
7a51835: 1.0 surface hygiene (from the #88 API-freeze audit)
- api-upload: rename
uploader()→uploadFile()so the action reads as a verb, consistent withvalidate/connect/createXacross the packages. Breaking: update imports (import { uploadFile } from '@rtorcato/api-upload'). - api-graceful-shutdown: rename
createShutdownHandler()→createShutdownController()so the factory matches its return typeShutdownController(mirrorscreateHealthRegistry → HealthRegistry). Breaking: update imports. - api-openapi: replace
export * from './builder'with explicit named re-exports so the public surface is enumerated and can't silently widen/narrow. No symbols added or removed. - api-amqp: type
connect(url, socketOptions?)'s second parameter against amqplib (Parameters<typeof amqp.connect>[1]) instead ofunknown.
- api-upload: rename
0.2.0
Minor Changes
- 8701d23: Add a schema-first OpenAPI 3.1 document builder.
buildOpenApiDocument({ info, routes })assembles a spec from route definitions whose params/query/headers/body/responses are Zod schemas — converted with Zod 4's nativez.toJSONSchema(no new runtime dep), so the docs derive from the same schemas you validate with and can't drift. Also addsdocsHtml({ specUrl, ui }), a URL-based Scalar/Swagger renderer that complements the existing spec-inlining generators.
0.1.0
Minor Changes
- 1669391: First
0.1.0release. These packages were sitting at0.0.0despite being test-covered, documented, and (for several) already on npm. Floor them at0.1.0so the version reflects real maturity. No API changes.
@rtorcato/api-openapi-express
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-openapi@1.0.0
0.2.1
Patch Changes
- Updated dependencies [7a51835]
- @rtorcato/api-openapi@0.2.1
0.2.0
Minor Changes
- 13fd3ec: Add
mountOpenAPI(app, { doc, ui, specPath, docsPath })— wires the spec JSON and a docs UI (Scalar or Swagger) directly onto an Express app or router, with the UI fetching the spec by URL. Also addspecFromJsDoc({ definition, apis }), which builds a spec from JSDoc-annotated files viaswagger-jsdoc(a new optional peer dependency) for legacy projects. ExistingserveApiDocs/serveSwaggerDocsare unchanged.
0.1.1
Patch Changes
- Updated dependencies [8701d23]
- @rtorcato/api-openapi@0.2.0
0.1.0
Minor Changes
- 1669391: First
0.1.0release. These packages were sitting at0.0.0despite being test-covered, documented, and (for several) already on npm. Floor them at0.1.0so the version reflects real maturity. No API changes.
Patch Changes
- Updated dependencies [1669391]
- @rtorcato/api-openapi@0.1.0
@rtorcato/api-openapi-hono
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
0.1.0
Minor Changes
- 88cc0ee: Add
@rtorcato/api-openapi-hono— a Hono adapter for schema-first OpenAPI docs.configureOpenAPI(app, { document })wires@hono/zod-openapi'sdoc31()(OpenAPI 3.1 JSON generated from the route Zod schemas) and mounts the Scalar API reference UI, with configurable paths and Scalar overrides.
@rtorcato/api-rate-limit
2.0.0
Major Changes
-
66af10c: Pluggable rate-limit store + async
check(closes #199)@rtorcato/api-rate-limitno longer ships a silent in-memory default — an in-memory default is wrong across replicas, where each process keeps its own counts and the effective limit becomes N× the configured value.Breaking:
createRateLimiter({ requests, windowMs, store })now requires astore. PassmemoryStore()(single-process/dev/tests) orredisStore()from the new@rtorcato/api-rate-limit-redispackage (limits shared across instances).check()andreset()are now async (Promise-returning) — a networked store can't be synchronous.await limiter.check(key).- The Express and Hono middlewares (
rateLimitMiddleware) now requirestorein their options andawaitthe check.
New:
@rtorcato/api-rate-limit-redis— aredisStore(ioredisClient, { prefix })that counts via an atomic Lua sliding-window over a Redis sorted set, so limits hold across every instance.ioredisis a peer dependency.Migration:
// beforeconst limiter = createRateLimiter({ requests: 100, windowMs: 60_000 });const { allowed } = limiter.check(ip);// after — single processimport { createRateLimiter, memoryStore } from "@rtorcato/api-rate-limit";const limiter = createRateLimiter({requests: 100,windowMs: 60_000,store: memoryStore(),});const { allowed } = await limiter.check(ip);// after — shared across instancesimport { redisStore } from "@rtorcato/api-rate-limit-redis";const limiter = createRateLimiter({requests: 100,windowMs: 60_000,store: redisStore(redis),});
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
0.1.0
Minor Changes
-
be7810d: Add four packages seeded from the api-starter reference app:
@rtorcato/api-logger— framework-agnostic pino logger factory.@rtorcato/api-validation— zod request validation that throwsBadRequestError, plusformatZodError.@rtorcato/api-config—loadEnv(schema)for dotenv + zod env validation (throws instead ofprocess.exit).@rtorcato/api-rate-limit— in-memory sliding-window limiter with bounded memory.
Patch Changes
- fa3f320: Add
repository,homepage,bugs, andkeywordsmetadata to every package for npm discoverability.
@rtorcato/api-rate-limit-express
2.0.0
Major Changes
-
66af10c: Pluggable rate-limit store + async
check(closes #199)@rtorcato/api-rate-limitno longer ships a silent in-memory default — an in-memory default is wrong across replicas, where each process keeps its own counts and the effective limit becomes N× the configured value.Breaking:
createRateLimiter({ requests, windowMs, store })now requires astore. PassmemoryStore()(single-process/dev/tests) orredisStore()from the new@rtorcato/api-rate-limit-redispackage (limits shared across instances).check()andreset()are now async (Promise-returning) — a networked store can't be synchronous.await limiter.check(key).- The Express and Hono middlewares (
rateLimitMiddleware) now requirestorein their options andawaitthe check.
New:
@rtorcato/api-rate-limit-redis— aredisStore(ioredisClient, { prefix })that counts via an atomic Lua sliding-window over a Redis sorted set, so limits hold across every instance.ioredisis a peer dependency.Migration:
// beforeconst limiter = createRateLimiter({ requests: 100, windowMs: 60_000 });const { allowed } = limiter.check(ip);// after — single processimport { createRateLimiter, memoryStore } from "@rtorcato/api-rate-limit";const limiter = createRateLimiter({requests: 100,windowMs: 60_000,store: memoryStore(),});const { allowed } = await limiter.check(ip);// after — shared across instancesimport { redisStore } from "@rtorcato/api-rate-limit-redis";const limiter = createRateLimiter({requests: 100,windowMs: 60_000,store: redisStore(redis),});
Patch Changes
- Updated dependencies [66af10c]
- @rtorcato/api-rate-limit@2.0.0
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-errors@1.0.0
- @rtorcato/api-express-utils@1.0.0
- @rtorcato/api-rate-limit@1.0.0
0.2.0
Minor Changes
-
097cc1f: Unify the error response envelope across packages.
api-errorsnow exportstoErrorResponse(err, { includeStack })and theErrorResponsetype — the single source of truth for the{ error, code, message, stack? }body. The Express and Hono error handlers, andapi-response, now derive from it instead of hand-rolling the shape.- Fix: the rate-limit middleware (Express + Hono) previously responded
429with a non-standard body{ success: false, code: 'rate_limited', message }. It now returns the standard error envelope{ error: 'TooManyRequestsError', code: 'too_many_requests', message }, so clients parse rate-limit errors like any other error. Thecodeis nowtoo_many_requests(wasrate_limited).
Patch Changes
- Updated dependencies [097cc1f]
- @rtorcato/api-errors@0.3.0
0.1.0
Minor Changes
- 1669391: First
0.1.0release. These packages were sitting at0.0.0despite being test-covered, documented, and (for several) already on npm. Floor them at0.1.0so the version reflects real maturity. No API changes.
Patch Changes
- Updated dependencies [439d346]
- @rtorcato/api-express-utils@0.3.0
@rtorcato/api-rate-limit-hono
2.0.0
Major Changes
-
66af10c: Pluggable rate-limit store + async
check(closes #199)@rtorcato/api-rate-limitno longer ships a silent in-memory default — an in-memory default is wrong across replicas, where each process keeps its own counts and the effective limit becomes N× the configured value.Breaking:
createRateLimiter({ requests, windowMs, store })now requires astore. PassmemoryStore()(single-process/dev/tests) orredisStore()from the new@rtorcato/api-rate-limit-redispackage (limits shared across instances).check()andreset()are now async (Promise-returning) — a networked store can't be synchronous.await limiter.check(key).- The Express and Hono middlewares (
rateLimitMiddleware) now requirestorein their options andawaitthe check.
New:
@rtorcato/api-rate-limit-redis— aredisStore(ioredisClient, { prefix })that counts via an atomic Lua sliding-window over a Redis sorted set, so limits hold across every instance.ioredisis a peer dependency.Migration:
// beforeconst limiter = createRateLimiter({ requests: 100, windowMs: 60_000 });const { allowed } = limiter.check(ip);// after — single processimport { createRateLimiter, memoryStore } from "@rtorcato/api-rate-limit";const limiter = createRateLimiter({requests: 100,windowMs: 60_000,store: memoryStore(),});const { allowed } = await limiter.check(ip);// after — shared across instancesimport { redisStore } from "@rtorcato/api-rate-limit-redis";const limiter = createRateLimiter({requests: 100,windowMs: 60_000,store: redisStore(redis),});
Patch Changes
- Updated dependencies [66af10c]
- @rtorcato/api-rate-limit@2.0.0
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-errors@1.0.0
- @rtorcato/api-rate-limit@1.0.0
0.2.0
Minor Changes
-
097cc1f: Unify the error response envelope across packages.
api-errorsnow exportstoErrorResponse(err, { includeStack })and theErrorResponsetype — the single source of truth for the{ error, code, message, stack? }body. The Express and Hono error handlers, andapi-response, now derive from it instead of hand-rolling the shape.- Fix: the rate-limit middleware (Express + Hono) previously responded
429with a non-standard body{ success: false, code: 'rate_limited', message }. It now returns the standard error envelope{ error: 'TooManyRequestsError', code: 'too_many_requests', message }, so clients parse rate-limit errors like any other error. Thecodeis nowtoo_many_requests(wasrate_limited).
Patch Changes
- Updated dependencies [097cc1f]
- @rtorcato/api-errors@0.3.0
0.1.0
Minor Changes
- 1669391: First
0.1.0release. These packages were sitting at0.0.0despite being test-covered, documented, and (for several) already on npm. Floor them at0.1.0so the version reflects real maturity. No API changes.
@rtorcato/api-rate-limit-redis
0.2.0
Minor Changes
-
66af10c: Pluggable rate-limit store + async
check(closes #199)@rtorcato/api-rate-limitno longer ships a silent in-memory default — an in-memory default is wrong across replicas, where each process keeps its own counts and the effective limit becomes N× the configured value.Breaking:
createRateLimiter({ requests, windowMs, store })now requires astore. PassmemoryStore()(single-process/dev/tests) orredisStore()from the new@rtorcato/api-rate-limit-redispackage (limits shared across instances).check()andreset()are now async (Promise-returning) — a networked store can't be synchronous.await limiter.check(key).- The Express and Hono middlewares (
rateLimitMiddleware) now requirestorein their options andawaitthe check.
New:
@rtorcato/api-rate-limit-redis— aredisStore(ioredisClient, { prefix })that counts via an atomic Lua sliding-window over a Redis sorted set, so limits hold across every instance.ioredisis a peer dependency.Migration:
// beforeconst limiter = createRateLimiter({ requests: 100, windowMs: 60_000 });const { allowed } = limiter.check(ip);// after — single processimport { createRateLimiter, memoryStore } from "@rtorcato/api-rate-limit";const limiter = createRateLimiter({requests: 100,windowMs: 60_000,store: memoryStore(),});const { allowed } = await limiter.check(ip);// after — shared across instancesimport { redisStore } from "@rtorcato/api-rate-limit-redis";const limiter = createRateLimiter({requests: 100,windowMs: 60_000,store: redisStore(redis),});
Patch Changes
- Updated dependencies [66af10c]
- @rtorcato/api-rate-limit@2.0.0
@rtorcato/api-response
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-errors@1.0.0
0.1.1
Patch Changes
-
097cc1f: Unify the error response envelope across packages.
api-errorsnow exportstoErrorResponse(err, { includeStack })and theErrorResponsetype — the single source of truth for the{ error, code, message, stack? }body. The Express and Hono error handlers, andapi-response, now derive from it instead of hand-rolling the shape.- Fix: the rate-limit middleware (Express + Hono) previously responded
429with a non-standard body{ success: false, code: 'rate_limited', message }. It now returns the standard error envelope{ error: 'TooManyRequestsError', code: 'too_many_requests', message }, so clients parse rate-limit errors like any other error. Thecodeis nowtoo_many_requests(wasrate_limited).
-
Updated dependencies [097cc1f]
- @rtorcato/api-errors@0.3.0
0.1.0
Minor Changes
- 7495730: Update the
zodpeer dependency range from^3.23.0to^4.0.0. These packages are developed and tested against Zod 4 (which is what the workspace resolves); the old^3.23.0peer no longer matched reality. Consumers still on Zod 3 should upgrade to Zod 4.
0.0.1
Patch Changes
- fa3f320: Add
repository,homepage,bugs, andkeywordsmetadata to every package for npm discoverability.
@rtorcato/api-security-express
0.1.0
Minor Changes
- 6080f21: Add
@rtorcato/api-security-express(closes #90): Express security-headers middleware — a thin helmet wrapper that applies helmet's full, sane default header suite (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, …) and forwards any helmet option through. Express-only, since Hono shipssecureHeadersbuilt in.
@rtorcato/api-testing
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-auth@1.0.0
0.1.1
Patch Changes
- @rtorcato/api-auth@0.1.1
0.1.0
Minor Changes
- 1669391: First
0.1.0release. These packages were sitting at0.0.0despite being test-covered, documented, and (for several) already on npm. Floor them at0.1.0so the version reflects real maturity. No API changes.
Patch Changes
- Updated dependencies [1669391]
- @rtorcato/api-auth@0.1.0
@rtorcato/api-timeout
0.1.0
Minor Changes
-
b6ff9d0: Add per-request timeout packages (closes #66):
@rtorcato/api-timeout— framework-agnosticwithTimeout(promise, ms)that races a promise against a deadline and rejects with aServiceUnavailableError(503) from@rtorcato/api-errors.@rtorcato/api-timeout-express— Express middleware; sends the standard 503 error envelope if the response isn't produced within the deadline.@rtorcato/api-timeout-hono— Hono middleware; same behaviour, with non-timeout errors bubbling toonError.
@rtorcato/api-timeout-express
0.1.0
Minor Changes
-
b6ff9d0: Add per-request timeout packages (closes #66):
@rtorcato/api-timeout— framework-agnosticwithTimeout(promise, ms)that races a promise against a deadline and rejects with aServiceUnavailableError(503) from@rtorcato/api-errors.@rtorcato/api-timeout-express— Express middleware; sends the standard 503 error envelope if the response isn't produced within the deadline.@rtorcato/api-timeout-hono— Hono middleware; same behaviour, with non-timeout errors bubbling toonError.
Patch Changes
- Updated dependencies [b6ff9d0]
- @rtorcato/api-timeout@0.1.0
@rtorcato/api-timeout-hono
0.1.0
Minor Changes
-
b6ff9d0: Add per-request timeout packages (closes #66):
@rtorcato/api-timeout— framework-agnosticwithTimeout(promise, ms)that races a promise against a deadline and rejects with aServiceUnavailableError(503) from@rtorcato/api-errors.@rtorcato/api-timeout-express— Express middleware; sends the standard 503 error envelope if the response isn't produced within the deadline.@rtorcato/api-timeout-hono— Hono middleware; same behaviour, with non-timeout errors bubbling toonError.
Patch Changes
- Updated dependencies [b6ff9d0]
- @rtorcato/api-timeout@0.1.0
@rtorcato/api-ts-rest-express
1.1.0
Minor Changes
- e80cdcc: Add
withDefaultErrorsanddefaultErrorSchemafor attaching the shared400/404/500error envelope (matching@rtorcato/api-errors-express) to a ts-rest route'sresponses, plusRestRequest/RestResponseinference-type aliases for typing handlers off a contract.
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-openapi-express@1.0.0
0.2.1
Patch Changes
- @rtorcato/api-openapi-express@0.2.1
0.2.0
Minor Changes
- bcc5759: Add
@rtorcato/api-ts-rest-express—mountTsRest(app, { contract, router, openapi })registers a ts-rest contract's routes on Express and (optionally) generates an OpenAPI 3.1 doc from the contract and serves it as Scalar docs via@rtorcato/api-openapi-express. Requires@ts-rest/*≥ 3.53.0-rc.1 (first release supporting zod 4 + express 5).@ts-rest/*,express, andzodare peer dependencies.
@rtorcato/api-upload
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-errors@1.0.0
0.3.0
Minor Changes
-
7a51835: 1.0 surface hygiene (from the #88 API-freeze audit)
- api-upload: rename
uploader()→uploadFile()so the action reads as a verb, consistent withvalidate/connect/createXacross the packages. Breaking: update imports (import { uploadFile } from '@rtorcato/api-upload'). - api-graceful-shutdown: rename
createShutdownHandler()→createShutdownController()so the factory matches its return typeShutdownController(mirrorscreateHealthRegistry → HealthRegistry). Breaking: update imports. - api-openapi: replace
export * from './builder'with explicit named re-exports so the public surface is enumerated and can't silently widen/narrow. No symbols added or removed. - api-amqp: type
connect(url, socketOptions?)'s second parameter against amqplib (Parameters<typeof amqp.connect>[1]) instead ofunknown.
- api-upload: rename
0.2.1
Patch Changes
- Updated dependencies [097cc1f]
- @rtorcato/api-errors@0.3.0
0.2.0
Minor Changes
- f87e0af: Add
@rtorcato/api-upload—uploader(req, res, { s3, bucket, field, key, isPublic?, cacheControl?, maxSizeBytes? })streams a single multipart file to S3 via multer-s3 and resolves with the stored object. Rejects with@rtorcato/api-errorsHttpErrors (413 file_too_large,400 no_file).@aws-sdk/client-s3,multer,multer-s3, andexpressare peer dependencies.
@rtorcato/api-upload-hono
0.1.0
Minor Changes
- de1abc3: Add
@rtorcato/api-upload-hono(closes #101): the Hono counterpart to@rtorcato/api-upload.uploadFile(c, options)parses the multipart body viac.req.parseBody()and writes the file straight to S3 with the AWS SDK — Hono has no multer/multer-s3 to wrap. Same surface as the Express package (UploadOptions/UploadedFile, public/private ACL, cache-control, deterministic keys) and the same typed errors from@rtorcato/api-errors(413 file_too_large,400 no_file).@aws-sdk/client-s3andhonoare peer dependencies.
@rtorcato/api-validation
1.0.0
Major Changes
-
352ee8e: First stable release — 1.0.0.
The public API of every
@rtorcato/api-*package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile,createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.
Patch Changes
- Updated dependencies [352ee8e]
- @rtorcato/api-errors@1.0.0
0.2.1
Patch Changes
- Updated dependencies [097cc1f]
- @rtorcato/api-errors@0.3.0
0.2.0
Minor Changes
- 7495730: Update the
zodpeer dependency range from^3.23.0to^4.0.0. These packages are developed and tested against Zod 4 (which is what the workspace resolves); the old^3.23.0peer no longer matched reality. Consumers still on Zod 3 should upgrade to Zod 4.
0.1.0
Minor Changes
-
be7810d: Add four packages seeded from the api-starter reference app:
@rtorcato/api-logger— framework-agnostic pino logger factory.@rtorcato/api-validation— zod request validation that throwsBadRequestError, plusformatZodError.@rtorcato/api-config—loadEnv(schema)for dotenv + zod env validation (throws instead ofprocess.exit).@rtorcato/api-rate-limit— in-memory sliding-window limiter with bounded memory.
Patch Changes
- fa3f320: Add
repository,homepage,bugs, andkeywordsmetadata to every package for npm discoverability. - Updated dependencies [fa3f320]
- Updated dependencies [fa3f320]
- @rtorcato/api-errors@0.2.0
@rtorcato/api-webhooks
0.1.0
Minor Changes
-
77f24b4: Add webhook packages (closes #62):
@rtorcato/api-webhooks— framework-agnosticsignand timing-safeverifySignature(HMAC, configurable algorithm + header prefix).@rtorcato/api-webhooks-express— Express middleware that captures the raw body (beforeexpress.json()strips it), verifies the signature, and parses JSON ontoreq.body; 401 on bad signature, 400 on bad JSON.@rtorcato/api-webhooks-hono— Hono middleware that verifies the signature over the raw body; 401 on bad signature. The handler can still read the buffered body viac.req.json().
@rtorcato/api-webhooks-express
0.1.0
Minor Changes
-
77f24b4: Add webhook packages (closes #62):
@rtorcato/api-webhooks— framework-agnosticsignand timing-safeverifySignature(HMAC, configurable algorithm + header prefix).@rtorcato/api-webhooks-express— Express middleware that captures the raw body (beforeexpress.json()strips it), verifies the signature, and parses JSON ontoreq.body; 401 on bad signature, 400 on bad JSON.@rtorcato/api-webhooks-hono— Hono middleware that verifies the signature over the raw body; 401 on bad signature. The handler can still read the buffered body viac.req.json().
Patch Changes
- Updated dependencies [77f24b4]
- @rtorcato/api-webhooks@0.1.0
@rtorcato/api-webhooks-hono
0.1.0
Minor Changes
-
77f24b4: Add webhook packages (closes #62):
@rtorcato/api-webhooks— framework-agnosticsignand timing-safeverifySignature(HMAC, configurable algorithm + header prefix).@rtorcato/api-webhooks-express— Express middleware that captures the raw body (beforeexpress.json()strips it), verifies the signature, and parses JSON ontoreq.body; 401 on bad signature, 400 on bad JSON.@rtorcato/api-webhooks-hono— Hono middleware that verifies the signature over the raw body; 401 on bad signature. The handler can still read the buffered body viac.req.json().
Patch Changes
- Updated dependencies [77f24b4]
- @rtorcato/api-webhooks@0.1.0