Skip to main content

Changelog

Per-package release notes, managed with Changesets.

@rtorcato/api-amqp

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

0.2.1

Patch Changes

  • 7a51835: 1.0 surface hygiene (from the #88 API-freeze audit)

    • api-upload: rename uploader()uploadFile() so the action reads as a verb, consistent with validate/connect/createX across the packages. Breaking: update imports (import { uploadFile } from '@rtorcato/api-upload').
    • api-graceful-shutdown: rename createShutdownHandler()createShutdownController() so the factory matches its return type ShutdownController (mirrors createHealthRegistry → HealthRegistry). Breaking: update imports.
    • api-openapi: replace export * from './builder' with explicit named re-exports so the public surface is enumerated and can't silently widen/narrow. No symbols added or removed.
    • api-amqp: type connect(url, socketOptions?)'s second parameter against amqplib (Parameters<typeof amqp.connect>[1]) instead of unknown.

0.2.0

Minor Changes

  • d8e4a95: Add @rtorcato/api-amqp — typed amqplib publisher/consumer helpers for RabbitMQ. createPublisher asserts an exchange and JSON-encodes messages; createConsumer asserts a queue, sets prefetch, and acks on success / nacks on throw. amqplib is a peer dependency.

@rtorcato/api-auth

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-errors@1.0.0

0.1.1

Patch Changes

  • Updated dependencies [097cc1f]
    • @rtorcato/api-errors@0.3.0

0.1.0

Minor Changes

  • 1669391: First 0.1.0 release. These packages were sitting at 0.0.0 despite being test-covered, documented, and (for several) already on npm. Floor them at 0.1.0 so the version reflects real maturity. No API changes.

@rtorcato/api-auth-express

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-auth@1.0.0
    • @rtorcato/api-errors@1.0.0

0.1.1

Patch Changes

  • Updated dependencies [097cc1f]
    • @rtorcato/api-errors@0.3.0
    • @rtorcato/api-auth@0.1.1

0.1.0

Minor Changes

  • 1669391: First 0.1.0 release. These packages were sitting at 0.0.0 despite being test-covered, documented, and (for several) already on npm. Floor them at 0.1.0 so the version reflects real maturity. No API changes.

Patch Changes

  • Updated dependencies [1669391]
    • @rtorcato/api-auth@0.1.0

@rtorcato/api-auth-hono

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-auth@1.0.0
    • @rtorcato/api-errors@1.0.0

0.2.1

Patch Changes

  • Updated dependencies [097cc1f]
    • @rtorcato/api-errors@0.3.0
    • @rtorcato/api-auth@0.1.1

0.2.0

Minor Changes

  • ae1ca0d: Add @rtorcato/api-auth-hono — Hono middleware over @rtorcato/api-auth. Provides authMiddleware and optionalAuthMiddleware with Bearer-header and cookie token support, and an AuthVariables type for a typed c.get('user').

@rtorcato/api-config

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

0.2.0

Minor Changes

  • 7495730: Update the zod peer dependency range from ^3.23.0 to ^4.0.0. These packages are developed and tested against Zod 4 (which is what the workspace resolves); the old ^3.23.0 peer no longer matched reality. Consumers still on Zod 3 should upgrade to Zod 4.

0.1.0

Minor Changes

  • be7810d: Add four packages seeded from the api-starter reference app:

    • @rtorcato/api-logger — framework-agnostic pino logger factory.
    • @rtorcato/api-validation — zod request validation that throws BadRequestError, plus formatZodError.
    • @rtorcato/api-configloadEnv(schema) for dotenv + zod env validation (throws instead of process.exit).
    • @rtorcato/api-rate-limit — in-memory sliding-window limiter with bounded memory.

Patch Changes

  • fa3f320: Add repository, homepage, bugs, and keywords metadata to every package for npm discoverability.

@rtorcato/api-cors-express

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

0.1.0

Minor Changes

  • 1669391: First 0.1.0 release. These packages were sitting at 0.0.0 despite being test-covered, documented, and (for several) already on npm. Floor them at 0.1.0 so the version reflects real maturity. No API changes.

@rtorcato/api-errors

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

0.3.0

Minor Changes

  • 097cc1f: Unify the error response envelope across packages.

    • api-errors now exports toErrorResponse(err, { includeStack }) and the ErrorResponse type — the single source of truth for the { error, code, message, stack? } body. The Express and Hono error handlers, and api-response, now derive from it instead of hand-rolling the shape.
    • Fix: the rate-limit middleware (Express + Hono) previously responded 429 with a non-standard body { success: false, code: 'rate_limited', message }. It now returns the standard error envelope { error: 'TooManyRequestsError', code: 'too_many_requests', message }, so clients parse rate-limit errors like any other error. The code is now too_many_requests (was rate_limited).

0.2.0

Minor Changes

  • fa3f320: Add UnprocessableEntityError (422), TooManyRequestsError (429), and ServiceUnavailableError (503) classes.

Patch Changes

  • fa3f320: Add repository, homepage, bugs, and keywords metadata to every package for npm discoverability.

0.1.1

Patch Changes

  • 8c3e3e5: Expand README with install + usage examples. No code changes.

0.1.0

Minor Changes

  • a5c26a7: Initial release.

    • @rtorcato/api-errors: framework-agnostic HttpError base class plus BadRequestError, UnauthorizedError, ForbiddenError, NotFoundError, ConflictError, InternalServerError. Each carries status, code, and message.
    • @rtorcato/api-errors-express: Express middleware (errorHandler, notFoundHandler) that maps HttpError instances to a { error, code, message, stack? } JSON body. express is a peer dependency (^4 || ^5).
    • @rtorcato/api-errors-hono: Hono middleware (errorHandler, notFoundHandler) wiring into app.onError / app.notFound with the same response shape as the Express adapter. hono is a peer dependency (^4).

@rtorcato/api-errors-express

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-errors@1.0.0

0.2.1

Patch Changes

  • 097cc1f: Unify the error response envelope across packages.

    • api-errors now exports toErrorResponse(err, { includeStack }) and the ErrorResponse type — the single source of truth for the { error, code, message, stack? } body. The Express and Hono error handlers, and api-response, now derive from it instead of hand-rolling the shape.
    • Fix: the rate-limit middleware (Express + Hono) previously responded 429 with a non-standard body { success: false, code: 'rate_limited', message }. It now returns the standard error envelope { error: 'TooManyRequestsError', code: 'too_many_requests', message }, so clients parse rate-limit errors like any other error. The code is now too_many_requests (was rate_limited).
  • Updated dependencies [097cc1f]

    • @rtorcato/api-errors@0.3.0

0.2.0

Minor Changes

  • 9fd03c8: Add asyncHandler() — wraps an async Express route handler and forwards rejections to next(), so errorHandler handles them without per-route try/catch.

Patch Changes

  • fa3f320: Add repository, homepage, bugs, and keywords metadata to every package for npm discoverability.
  • Updated dependencies [fa3f320]
  • Updated dependencies [fa3f320]
    • @rtorcato/api-errors@0.2.0

0.1.1

Patch Changes

  • 8c3e3e5: Expand README with install + usage examples. No code changes.
  • Updated dependencies [8c3e3e5]
    • @rtorcato/api-errors@0.1.1

0.1.0

Minor Changes

  • a5c26a7: Initial release.

    • @rtorcato/api-errors: framework-agnostic HttpError base class plus BadRequestError, UnauthorizedError, ForbiddenError, NotFoundError, ConflictError, InternalServerError. Each carries status, code, and message.
    • @rtorcato/api-errors-express: Express middleware (errorHandler, notFoundHandler) that maps HttpError instances to a { error, code, message, stack? } JSON body. express is a peer dependency (^4 || ^5).
    • @rtorcato/api-errors-hono: Hono middleware (errorHandler, notFoundHandler) wiring into app.onError / app.notFound with the same response shape as the Express adapter. hono is a peer dependency (^4).

Patch Changes

  • Updated dependencies [a5c26a7]
    • @rtorcato/api-errors@0.1.0

@rtorcato/api-errors-hono

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-errors@1.0.0

0.1.3

Patch Changes

  • 097cc1f: Unify the error response envelope across packages.

    • api-errors now exports toErrorResponse(err, { includeStack }) and the ErrorResponse type — the single source of truth for the { error, code, message, stack? } body. The Express and Hono error handlers, and api-response, now derive from it instead of hand-rolling the shape.
    • Fix: the rate-limit middleware (Express + Hono) previously responded 429 with a non-standard body { success: false, code: 'rate_limited', message }. It now returns the standard error envelope { error: 'TooManyRequestsError', code: 'too_many_requests', message }, so clients parse rate-limit errors like any other error. The code is now too_many_requests (was rate_limited).
  • Updated dependencies [097cc1f]

    • @rtorcato/api-errors@0.3.0

0.1.2

Patch Changes

  • fa3f320: Add repository, homepage, bugs, and keywords metadata to every package for npm discoverability.
  • Updated dependencies [fa3f320]
  • Updated dependencies [fa3f320]
    • @rtorcato/api-errors@0.2.0

0.1.1

Patch Changes

  • 8c3e3e5: Expand README with install + usage examples. No code changes.
  • Updated dependencies [8c3e3e5]
    • @rtorcato/api-errors@0.1.1

0.1.0

Minor Changes

  • a5c26a7: Initial release.

    • @rtorcato/api-errors: framework-agnostic HttpError base class plus BadRequestError, UnauthorizedError, ForbiddenError, NotFoundError, ConflictError, InternalServerError. Each carries status, code, and message.
    • @rtorcato/api-errors-express: Express middleware (errorHandler, notFoundHandler) that maps HttpError instances to a { error, code, message, stack? } JSON body. express is a peer dependency (^4 || ^5).
    • @rtorcato/api-errors-hono: Hono middleware (errorHandler, notFoundHandler) wiring into app.onError / app.notFound with the same response shape as the Express adapter. hono is a peer dependency (^4).

Patch Changes

  • Updated dependencies [a5c26a7]
    • @rtorcato/api-errors@0.1.0

@rtorcato/api-express-utils

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

0.3.0

Minor Changes

  • 439d346: New package: Express utility helpers.

    • getIP(req)X-Forwarded-For-aware client IP extraction.
    • logRoutes(app, opts?) — return/print an app's registered routes at boot.

0.2.0

Minor Changes

  • 9c52aa4: New package: Express utility helpers.

    • getIP(req)X-Forwarded-For-aware client IP extraction.
    • logRoutes(app, opts?) — return/print an app's registered routes at boot.

@rtorcato/api-graceful-shutdown

1.0.1

Patch Changes

  • c767fc4: Republish so the README ships to npm. These four were published at 1.0.0 (PR #109) before their READMEs were added (PR #120), so npm still serves a README-less tarball. No code change — the README is already in the repo and included in the tarball; it just needs a version bump to publish.

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

0.2.0

Minor Changes

  • 7a51835: 1.0 surface hygiene (from the #88 API-freeze audit)

    • api-upload: rename uploader()uploadFile() so the action reads as a verb, consistent with validate/connect/createX across the packages. Breaking: update imports (import { uploadFile } from '@rtorcato/api-upload').
    • api-graceful-shutdown: rename createShutdownHandler()createShutdownController() so the factory matches its return type ShutdownController (mirrors createHealthRegistry → HealthRegistry). Breaking: update imports.
    • api-openapi: replace export * from './builder' with explicit named re-exports so the public surface is enumerated and can't silently widen/narrow. No symbols added or removed.
    • api-amqp: type connect(url, socketOptions?)'s second parameter against amqplib (Parameters<typeof amqp.connect>[1]) instead of unknown.

0.1.0

Minor Changes

  • f2332f7: Add @rtorcato/api-graceful-shutdown: SIGTERM/SIGINT drain for Node API servers. createShutdownHandler runs ordered cleanup hooks with a hard timeout and force-exit; closeHttpServer wraps a Node HTTP server's close() as a hook (works for Express and Hono via @hono/node-server).

@rtorcato/api-health

1.0.1

Patch Changes

  • c767fc4: Republish so the README ships to npm. These four were published at 1.0.0 (PR #109) before their READMEs were added (PR #120), so npm still serves a README-less tarball. No code change — the README is already in the repo and included in the tarball; it just needs a version bump to publish.

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

0.1.0

Minor Changes

  • c273623: Add health-check packages: a framework-agnostic readiness registry (createHealthRegistry) plus Express and Hono liveness/readiness probe handlers (livenessHandler, readinessHandler) for /healthz and /readyz endpoints.

@rtorcato/api-health-express

1.0.1

Patch Changes

  • c767fc4: Republish so the README ships to npm. These four were published at 1.0.0 (PR #109) before their READMEs were added (PR #120), so npm still serves a README-less tarball. No code change — the README is already in the repo and included in the tarball; it just needs a version bump to publish.
  • Updated dependencies [c767fc4]
    • @rtorcato/api-health@1.0.1

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-health@1.0.0

0.1.0

Minor Changes

  • c273623: Add health-check packages: a framework-agnostic readiness registry (createHealthRegistry) plus Express and Hono liveness/readiness probe handlers (livenessHandler, readinessHandler) for /healthz and /readyz endpoints.

Patch Changes

  • Updated dependencies [c273623]
    • @rtorcato/api-health@0.1.0

@rtorcato/api-health-hono

1.0.1

Patch Changes

  • c767fc4: Republish so the README ships to npm. These four were published at 1.0.0 (PR #109) before their READMEs were added (PR #120), so npm still serves a README-less tarball. No code change — the README is already in the repo and included in the tarball; it just needs a version bump to publish.
  • Updated dependencies [c767fc4]
    • @rtorcato/api-health@1.0.1

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-health@1.0.0

0.1.0

Minor Changes

  • c273623: Add health-check packages: a framework-agnostic readiness registry (createHealthRegistry) plus Express and Hono liveness/readiness probe handlers (livenessHandler, readinessHandler) for /healthz and /readyz endpoints.

Patch Changes

  • Updated dependencies [c273623]
    • @rtorcato/api-health@0.1.0

@rtorcato/api-http

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-errors@1.0.0

0.2.1

Patch Changes

  • Updated dependencies [097cc1f]
    • @rtorcato/api-errors@0.3.0

0.2.0

Minor Changes

  • d06c9cd: Add @rtorcato/api-http — a typed HTTP client over native fetch (Node 22+, no axios). createHttpClient({ baseURL, headers, timeoutMs, retries }) returns typed get/post/put/patch/delete; non-2xx and network failures are normalized to @rtorcato/api-errors HttpErrors.

@rtorcato/api-logger

1.1.0

Minor Changes

  • e80cdcc: Add prettyOptions to createLogger — forwards options to pino-pretty (e.g. colorize, singleLine, translateTime, ignore) when pretty is on, so consumers no longer have to bypass the factory to configure the dev transport.

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

0.1.0

Minor Changes

  • be7810d: Add four packages seeded from the api-starter reference app:

    • @rtorcato/api-logger — framework-agnostic pino logger factory.
    • @rtorcato/api-validation — zod request validation that throws BadRequestError, plus formatZodError.
    • @rtorcato/api-configloadEnv(schema) for dotenv + zod env validation (throws instead of process.exit).
    • @rtorcato/api-rate-limit — in-memory sliding-window limiter with bounded memory.

Patch Changes

  • fa3f320: Add repository, homepage, bugs, and keywords metadata to every package for npm discoverability.

@rtorcato/api-mcp

0.1.0

Minor Changes

  • 36d7b14: Add @rtorcato/api-mcp — two tiny result helpers for @modelcontextprotocol/sdk MCP tool handlers: asText(value) (JSON success content block) and mcpError(text) (isError content block). Both return the SDK's CallToolResult, so they drop straight into registerTool. The SDK is a peer dependency. Scope is deliberately minimal — the SDK already owns registration and transports; this only removes the result-shaping boilerplate every server rewrites. example-mcp now uses it.

@rtorcato/api-openapi

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

0.2.1

Patch Changes

  • 7a51835: 1.0 surface hygiene (from the #88 API-freeze audit)

    • api-upload: rename uploader()uploadFile() so the action reads as a verb, consistent with validate/connect/createX across the packages. Breaking: update imports (import { uploadFile } from '@rtorcato/api-upload').
    • api-graceful-shutdown: rename createShutdownHandler()createShutdownController() so the factory matches its return type ShutdownController (mirrors createHealthRegistry → HealthRegistry). Breaking: update imports.
    • api-openapi: replace export * from './builder' with explicit named re-exports so the public surface is enumerated and can't silently widen/narrow. No symbols added or removed.
    • api-amqp: type connect(url, socketOptions?)'s second parameter against amqplib (Parameters<typeof amqp.connect>[1]) instead of unknown.

0.2.0

Minor Changes

  • 8701d23: Add a schema-first OpenAPI 3.1 document builder. buildOpenApiDocument({ info, routes }) assembles a spec from route definitions whose params/query/headers/body/responses are Zod schemas — converted with Zod 4's native z.toJSONSchema (no new runtime dep), so the docs derive from the same schemas you validate with and can't drift. Also adds docsHtml({ specUrl, ui }), a URL-based Scalar/Swagger renderer that complements the existing spec-inlining generators.

0.1.0

Minor Changes

  • 1669391: First 0.1.0 release. These packages were sitting at 0.0.0 despite being test-covered, documented, and (for several) already on npm. Floor them at 0.1.0 so the version reflects real maturity. No API changes.

@rtorcato/api-openapi-express

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-openapi@1.0.0

0.2.1

Patch Changes

  • Updated dependencies [7a51835]
    • @rtorcato/api-openapi@0.2.1

0.2.0

Minor Changes

  • 13fd3ec: Add mountOpenAPI(app, { doc, ui, specPath, docsPath }) — wires the spec JSON and a docs UI (Scalar or Swagger) directly onto an Express app or router, with the UI fetching the spec by URL. Also add specFromJsDoc({ definition, apis }), which builds a spec from JSDoc-annotated files via swagger-jsdoc (a new optional peer dependency) for legacy projects. Existing serveApiDocs / serveSwaggerDocs are unchanged.

0.1.1

Patch Changes

  • Updated dependencies [8701d23]
    • @rtorcato/api-openapi@0.2.0

0.1.0

Minor Changes

  • 1669391: First 0.1.0 release. These packages were sitting at 0.0.0 despite being test-covered, documented, and (for several) already on npm. Floor them at 0.1.0 so the version reflects real maturity. No API changes.

Patch Changes

  • Updated dependencies [1669391]
    • @rtorcato/api-openapi@0.1.0

@rtorcato/api-openapi-hono

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

0.1.0

Minor Changes

  • 88cc0ee: Add @rtorcato/api-openapi-hono — a Hono adapter for schema-first OpenAPI docs. configureOpenAPI(app, { document }) wires @hono/zod-openapi's doc31() (OpenAPI 3.1 JSON generated from the route Zod schemas) and mounts the Scalar API reference UI, with configurable paths and Scalar overrides.

@rtorcato/api-rate-limit

2.0.0

Major Changes

  • 66af10c: Pluggable rate-limit store + async check (closes #199)

    @rtorcato/api-rate-limit no longer ships a silent in-memory default — an in-memory default is wrong across replicas, where each process keeps its own counts and the effective limit becomes N× the configured value.

    Breaking:

    • createRateLimiter({ requests, windowMs, store }) now requires a store. Pass memoryStore() (single-process/dev/tests) or redisStore() from the new @rtorcato/api-rate-limit-redis package (limits shared across instances).
    • check() and reset() are now async (Promise-returning) — a networked store can't be synchronous. await limiter.check(key).
    • The Express and Hono middlewares (rateLimitMiddleware) now require store in their options and await the check.

    New: @rtorcato/api-rate-limit-redis — a redisStore(ioredisClient, { prefix }) that counts via an atomic Lua sliding-window over a Redis sorted set, so limits hold across every instance. ioredis is a peer dependency.

    Migration:

    // before
    const limiter = createRateLimiter({ requests: 100, windowMs: 60_000 });
    const { allowed } = limiter.check(ip);

    // after — single process
    import { createRateLimiter, memoryStore } from "@rtorcato/api-rate-limit";
    const limiter = createRateLimiter({
    requests: 100,
    windowMs: 60_000,
    store: memoryStore(),
    });
    const { allowed } = await limiter.check(ip);

    // after — shared across instances
    import { redisStore } from "@rtorcato/api-rate-limit-redis";
    const limiter = createRateLimiter({
    requests: 100,
    windowMs: 60_000,
    store: redisStore(redis),
    });

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

0.1.0

Minor Changes

  • be7810d: Add four packages seeded from the api-starter reference app:

    • @rtorcato/api-logger — framework-agnostic pino logger factory.
    • @rtorcato/api-validation — zod request validation that throws BadRequestError, plus formatZodError.
    • @rtorcato/api-configloadEnv(schema) for dotenv + zod env validation (throws instead of process.exit).
    • @rtorcato/api-rate-limit — in-memory sliding-window limiter with bounded memory.

Patch Changes

  • fa3f320: Add repository, homepage, bugs, and keywords metadata to every package for npm discoverability.

@rtorcato/api-rate-limit-express

2.0.0

Major Changes

  • 66af10c: Pluggable rate-limit store + async check (closes #199)

    @rtorcato/api-rate-limit no longer ships a silent in-memory default — an in-memory default is wrong across replicas, where each process keeps its own counts and the effective limit becomes N× the configured value.

    Breaking:

    • createRateLimiter({ requests, windowMs, store }) now requires a store. Pass memoryStore() (single-process/dev/tests) or redisStore() from the new @rtorcato/api-rate-limit-redis package (limits shared across instances).
    • check() and reset() are now async (Promise-returning) — a networked store can't be synchronous. await limiter.check(key).
    • The Express and Hono middlewares (rateLimitMiddleware) now require store in their options and await the check.

    New: @rtorcato/api-rate-limit-redis — a redisStore(ioredisClient, { prefix }) that counts via an atomic Lua sliding-window over a Redis sorted set, so limits hold across every instance. ioredis is a peer dependency.

    Migration:

    // before
    const limiter = createRateLimiter({ requests: 100, windowMs: 60_000 });
    const { allowed } = limiter.check(ip);

    // after — single process
    import { createRateLimiter, memoryStore } from "@rtorcato/api-rate-limit";
    const limiter = createRateLimiter({
    requests: 100,
    windowMs: 60_000,
    store: memoryStore(),
    });
    const { allowed } = await limiter.check(ip);

    // after — shared across instances
    import { redisStore } from "@rtorcato/api-rate-limit-redis";
    const limiter = createRateLimiter({
    requests: 100,
    windowMs: 60_000,
    store: redisStore(redis),
    });

Patch Changes

  • Updated dependencies [66af10c]
    • @rtorcato/api-rate-limit@2.0.0

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-errors@1.0.0
    • @rtorcato/api-express-utils@1.0.0
    • @rtorcato/api-rate-limit@1.0.0

0.2.0

Minor Changes

  • 097cc1f: Unify the error response envelope across packages.

    • api-errors now exports toErrorResponse(err, { includeStack }) and the ErrorResponse type — the single source of truth for the { error, code, message, stack? } body. The Express and Hono error handlers, and api-response, now derive from it instead of hand-rolling the shape.
    • Fix: the rate-limit middleware (Express + Hono) previously responded 429 with a non-standard body { success: false, code: 'rate_limited', message }. It now returns the standard error envelope { error: 'TooManyRequestsError', code: 'too_many_requests', message }, so clients parse rate-limit errors like any other error. The code is now too_many_requests (was rate_limited).

Patch Changes

  • Updated dependencies [097cc1f]
    • @rtorcato/api-errors@0.3.0

0.1.0

Minor Changes

  • 1669391: First 0.1.0 release. These packages were sitting at 0.0.0 despite being test-covered, documented, and (for several) already on npm. Floor them at 0.1.0 so the version reflects real maturity. No API changes.

Patch Changes

  • Updated dependencies [439d346]
    • @rtorcato/api-express-utils@0.3.0

@rtorcato/api-rate-limit-hono

2.0.0

Major Changes

  • 66af10c: Pluggable rate-limit store + async check (closes #199)

    @rtorcato/api-rate-limit no longer ships a silent in-memory default — an in-memory default is wrong across replicas, where each process keeps its own counts and the effective limit becomes N× the configured value.

    Breaking:

    • createRateLimiter({ requests, windowMs, store }) now requires a store. Pass memoryStore() (single-process/dev/tests) or redisStore() from the new @rtorcato/api-rate-limit-redis package (limits shared across instances).
    • check() and reset() are now async (Promise-returning) — a networked store can't be synchronous. await limiter.check(key).
    • The Express and Hono middlewares (rateLimitMiddleware) now require store in their options and await the check.

    New: @rtorcato/api-rate-limit-redis — a redisStore(ioredisClient, { prefix }) that counts via an atomic Lua sliding-window over a Redis sorted set, so limits hold across every instance. ioredis is a peer dependency.

    Migration:

    // before
    const limiter = createRateLimiter({ requests: 100, windowMs: 60_000 });
    const { allowed } = limiter.check(ip);

    // after — single process
    import { createRateLimiter, memoryStore } from "@rtorcato/api-rate-limit";
    const limiter = createRateLimiter({
    requests: 100,
    windowMs: 60_000,
    store: memoryStore(),
    });
    const { allowed } = await limiter.check(ip);

    // after — shared across instances
    import { redisStore } from "@rtorcato/api-rate-limit-redis";
    const limiter = createRateLimiter({
    requests: 100,
    windowMs: 60_000,
    store: redisStore(redis),
    });

Patch Changes

  • Updated dependencies [66af10c]
    • @rtorcato/api-rate-limit@2.0.0

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-errors@1.0.0
    • @rtorcato/api-rate-limit@1.0.0

0.2.0

Minor Changes

  • 097cc1f: Unify the error response envelope across packages.

    • api-errors now exports toErrorResponse(err, { includeStack }) and the ErrorResponse type — the single source of truth for the { error, code, message, stack? } body. The Express and Hono error handlers, and api-response, now derive from it instead of hand-rolling the shape.
    • Fix: the rate-limit middleware (Express + Hono) previously responded 429 with a non-standard body { success: false, code: 'rate_limited', message }. It now returns the standard error envelope { error: 'TooManyRequestsError', code: 'too_many_requests', message }, so clients parse rate-limit errors like any other error. The code is now too_many_requests (was rate_limited).

Patch Changes

  • Updated dependencies [097cc1f]
    • @rtorcato/api-errors@0.3.0

0.1.0

Minor Changes

  • 1669391: First 0.1.0 release. These packages were sitting at 0.0.0 despite being test-covered, documented, and (for several) already on npm. Floor them at 0.1.0 so the version reflects real maturity. No API changes.

@rtorcato/api-rate-limit-redis

0.2.0

Minor Changes

  • 66af10c: Pluggable rate-limit store + async check (closes #199)

    @rtorcato/api-rate-limit no longer ships a silent in-memory default — an in-memory default is wrong across replicas, where each process keeps its own counts and the effective limit becomes N× the configured value.

    Breaking:

    • createRateLimiter({ requests, windowMs, store }) now requires a store. Pass memoryStore() (single-process/dev/tests) or redisStore() from the new @rtorcato/api-rate-limit-redis package (limits shared across instances).
    • check() and reset() are now async (Promise-returning) — a networked store can't be synchronous. await limiter.check(key).
    • The Express and Hono middlewares (rateLimitMiddleware) now require store in their options and await the check.

    New: @rtorcato/api-rate-limit-redis — a redisStore(ioredisClient, { prefix }) that counts via an atomic Lua sliding-window over a Redis sorted set, so limits hold across every instance. ioredis is a peer dependency.

    Migration:

    // before
    const limiter = createRateLimiter({ requests: 100, windowMs: 60_000 });
    const { allowed } = limiter.check(ip);

    // after — single process
    import { createRateLimiter, memoryStore } from "@rtorcato/api-rate-limit";
    const limiter = createRateLimiter({
    requests: 100,
    windowMs: 60_000,
    store: memoryStore(),
    });
    const { allowed } = await limiter.check(ip);

    // after — shared across instances
    import { redisStore } from "@rtorcato/api-rate-limit-redis";
    const limiter = createRateLimiter({
    requests: 100,
    windowMs: 60_000,
    store: redisStore(redis),
    });

Patch Changes

  • Updated dependencies [66af10c]
    • @rtorcato/api-rate-limit@2.0.0

@rtorcato/api-response

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-errors@1.0.0

0.1.1

Patch Changes

  • 097cc1f: Unify the error response envelope across packages.

    • api-errors now exports toErrorResponse(err, { includeStack }) and the ErrorResponse type — the single source of truth for the { error, code, message, stack? } body. The Express and Hono error handlers, and api-response, now derive from it instead of hand-rolling the shape.
    • Fix: the rate-limit middleware (Express + Hono) previously responded 429 with a non-standard body { success: false, code: 'rate_limited', message }. It now returns the standard error envelope { error: 'TooManyRequestsError', code: 'too_many_requests', message }, so clients parse rate-limit errors like any other error. The code is now too_many_requests (was rate_limited).
  • Updated dependencies [097cc1f]

    • @rtorcato/api-errors@0.3.0

0.1.0

Minor Changes

  • 7495730: Update the zod peer dependency range from ^3.23.0 to ^4.0.0. These packages are developed and tested against Zod 4 (which is what the workspace resolves); the old ^3.23.0 peer no longer matched reality. Consumers still on Zod 3 should upgrade to Zod 4.

0.0.1

Patch Changes

  • fa3f320: Add repository, homepage, bugs, and keywords metadata to every package for npm discoverability.

@rtorcato/api-security-express

0.1.0

Minor Changes

  • 6080f21: Add @rtorcato/api-security-express (closes #90): Express security-headers middleware — a thin helmet wrapper that applies helmet's full, sane default header suite (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, …) and forwards any helmet option through. Express-only, since Hono ships secureHeaders built in.

@rtorcato/api-testing

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-auth@1.0.0

0.1.1

Patch Changes

  • @rtorcato/api-auth@0.1.1

0.1.0

Minor Changes

  • 1669391: First 0.1.0 release. These packages were sitting at 0.0.0 despite being test-covered, documented, and (for several) already on npm. Floor them at 0.1.0 so the version reflects real maturity. No API changes.

Patch Changes

  • Updated dependencies [1669391]
    • @rtorcato/api-auth@0.1.0

@rtorcato/api-timeout

0.1.0

Minor Changes

  • b6ff9d0: Add per-request timeout packages (closes #66):

    • @rtorcato/api-timeout — framework-agnostic withTimeout(promise, ms) that races a promise against a deadline and rejects with a ServiceUnavailableError (503) from @rtorcato/api-errors.
    • @rtorcato/api-timeout-express — Express middleware; sends the standard 503 error envelope if the response isn't produced within the deadline.
    • @rtorcato/api-timeout-hono — Hono middleware; same behaviour, with non-timeout errors bubbling to onError.

@rtorcato/api-timeout-express

0.1.0

Minor Changes

  • b6ff9d0: Add per-request timeout packages (closes #66):

    • @rtorcato/api-timeout — framework-agnostic withTimeout(promise, ms) that races a promise against a deadline and rejects with a ServiceUnavailableError (503) from @rtorcato/api-errors.
    • @rtorcato/api-timeout-express — Express middleware; sends the standard 503 error envelope if the response isn't produced within the deadline.
    • @rtorcato/api-timeout-hono — Hono middleware; same behaviour, with non-timeout errors bubbling to onError.

Patch Changes

  • Updated dependencies [b6ff9d0]
    • @rtorcato/api-timeout@0.1.0

@rtorcato/api-timeout-hono

0.1.0

Minor Changes

  • b6ff9d0: Add per-request timeout packages (closes #66):

    • @rtorcato/api-timeout — framework-agnostic withTimeout(promise, ms) that races a promise against a deadline and rejects with a ServiceUnavailableError (503) from @rtorcato/api-errors.
    • @rtorcato/api-timeout-express — Express middleware; sends the standard 503 error envelope if the response isn't produced within the deadline.
    • @rtorcato/api-timeout-hono — Hono middleware; same behaviour, with non-timeout errors bubbling to onError.

Patch Changes

  • Updated dependencies [b6ff9d0]
    • @rtorcato/api-timeout@0.1.0

@rtorcato/api-ts-rest-express

1.1.0

Minor Changes

  • e80cdcc: Add withDefaultErrors and defaultErrorSchema for attaching the shared 400/404/500 error envelope (matching @rtorcato/api-errors-express) to a ts-rest route's responses, plus RestRequest / RestResponse inference-type aliases for typing handlers off a contract.

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-openapi-express@1.0.0

0.2.1

Patch Changes

  • @rtorcato/api-openapi-express@0.2.1

0.2.0

Minor Changes

  • bcc5759: Add @rtorcato/api-ts-rest-expressmountTsRest(app, { contract, router, openapi }) registers a ts-rest contract's routes on Express and (optionally) generates an OpenAPI 3.1 doc from the contract and serves it as Scalar docs via @rtorcato/api-openapi-express. Requires @ts-rest/* ≥ 3.53.0-rc.1 (first release supporting zod 4 + express 5). @ts-rest/*, express, and zod are peer dependencies.

@rtorcato/api-upload

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-errors@1.0.0

0.3.0

Minor Changes

  • 7a51835: 1.0 surface hygiene (from the #88 API-freeze audit)

    • api-upload: rename uploader()uploadFile() so the action reads as a verb, consistent with validate/connect/createX across the packages. Breaking: update imports (import { uploadFile } from '@rtorcato/api-upload').
    • api-graceful-shutdown: rename createShutdownHandler()createShutdownController() so the factory matches its return type ShutdownController (mirrors createHealthRegistry → HealthRegistry). Breaking: update imports.
    • api-openapi: replace export * from './builder' with explicit named re-exports so the public surface is enumerated and can't silently widen/narrow. No symbols added or removed.
    • api-amqp: type connect(url, socketOptions?)'s second parameter against amqplib (Parameters<typeof amqp.connect>[1]) instead of unknown.

0.2.1

Patch Changes

  • Updated dependencies [097cc1f]
    • @rtorcato/api-errors@0.3.0

0.2.0

Minor Changes

  • f87e0af: Add @rtorcato/api-uploaduploader(req, res, { s3, bucket, field, key, isPublic?, cacheControl?, maxSizeBytes? }) streams a single multipart file to S3 via multer-s3 and resolves with the stored object. Rejects with @rtorcato/api-errors HttpErrors (413 file_too_large, 400 no_file). @aws-sdk/client-s3, multer, multer-s3, and express are peer dependencies.

@rtorcato/api-upload-hono

0.1.0

Minor Changes

  • de1abc3: Add @rtorcato/api-upload-hono (closes #101): the Hono counterpart to @rtorcato/api-upload. uploadFile(c, options) parses the multipart body via c.req.parseBody() and writes the file straight to S3 with the AWS SDK — Hono has no multer/multer-s3 to wrap. Same surface as the Express package (UploadOptions/UploadedFile, public/private ACL, cache-control, deterministic keys) and the same typed errors from @rtorcato/api-errors (413 file_too_large, 400 no_file). @aws-sdk/client-s3 and hono are peer dependencies.

@rtorcato/api-validation

1.0.0

Major Changes

  • 352ee8e: First stable release — 1.0.0.

    The public API of every @rtorcato/api-* package is now frozen under semver following the 1.0 API-freeze audit (#88). No new code changes in this release: the error-envelope unification and the naming fixes (uploadFile, createShutdownController) already shipped across the preceding 0.x releases; this bump marks the surface as stable.

Patch Changes

  • Updated dependencies [352ee8e]
    • @rtorcato/api-errors@1.0.0

0.2.1

Patch Changes

  • Updated dependencies [097cc1f]
    • @rtorcato/api-errors@0.3.0

0.2.0

Minor Changes

  • 7495730: Update the zod peer dependency range from ^3.23.0 to ^4.0.0. These packages are developed and tested against Zod 4 (which is what the workspace resolves); the old ^3.23.0 peer no longer matched reality. Consumers still on Zod 3 should upgrade to Zod 4.

0.1.0

Minor Changes

  • be7810d: Add four packages seeded from the api-starter reference app:

    • @rtorcato/api-logger — framework-agnostic pino logger factory.
    • @rtorcato/api-validation — zod request validation that throws BadRequestError, plus formatZodError.
    • @rtorcato/api-configloadEnv(schema) for dotenv + zod env validation (throws instead of process.exit).
    • @rtorcato/api-rate-limit — in-memory sliding-window limiter with bounded memory.

Patch Changes

  • fa3f320: Add repository, homepage, bugs, and keywords metadata to every package for npm discoverability.
  • Updated dependencies [fa3f320]
  • Updated dependencies [fa3f320]
    • @rtorcato/api-errors@0.2.0

@rtorcato/api-webhooks

0.1.0

Minor Changes

  • 77f24b4: Add webhook packages (closes #62):

    • @rtorcato/api-webhooks — framework-agnostic sign and timing-safe verifySignature (HMAC, configurable algorithm + header prefix).
    • @rtorcato/api-webhooks-express — Express middleware that captures the raw body (before express.json() strips it), verifies the signature, and parses JSON onto req.body; 401 on bad signature, 400 on bad JSON.
    • @rtorcato/api-webhooks-hono — Hono middleware that verifies the signature over the raw body; 401 on bad signature. The handler can still read the buffered body via c.req.json().

@rtorcato/api-webhooks-express

0.1.0

Minor Changes

  • 77f24b4: Add webhook packages (closes #62):

    • @rtorcato/api-webhooks — framework-agnostic sign and timing-safe verifySignature (HMAC, configurable algorithm + header prefix).
    • @rtorcato/api-webhooks-express — Express middleware that captures the raw body (before express.json() strips it), verifies the signature, and parses JSON onto req.body; 401 on bad signature, 400 on bad JSON.
    • @rtorcato/api-webhooks-hono — Hono middleware that verifies the signature over the raw body; 401 on bad signature. The handler can still read the buffered body via c.req.json().

Patch Changes

  • Updated dependencies [77f24b4]
    • @rtorcato/api-webhooks@0.1.0

@rtorcato/api-webhooks-hono

0.1.0

Minor Changes

  • 77f24b4: Add webhook packages (closes #62):

    • @rtorcato/api-webhooks — framework-agnostic sign and timing-safe verifySignature (HMAC, configurable algorithm + header prefix).
    • @rtorcato/api-webhooks-express — Express middleware that captures the raw body (before express.json() strips it), verifies the signature, and parses JSON onto req.body; 401 on bad signature, 400 on bad JSON.
    • @rtorcato/api-webhooks-hono — Hono middleware that verifies the signature over the raw body; 401 on bad signature. The handler can still read the buffered body via c.req.json().

Patch Changes

  • Updated dependencies [77f24b4]
    • @rtorcato/api-webhooks@0.1.0