
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@glidemq/hapi
Advanced tools
Hapi v21 plugin that turns glide-mq queues into a REST API with real-time SSE - one registration, 24 endpoints. Works as a general-purpose job queue API and as an AI orchestration layer with built-in usage tracking, budget monitoring, and streaming endpoints.
createTestApp builds an in-memory Hapi server for server.inject() assertionsnpm install @glidemq/hapi glide-mq @hapi/hapi joi
Requires glide-mq >= 0.14.0 and Hapi 21+.
import Hapi from "@hapi/hapi";
import { glideMQPlugin } from "@glidemq/hapi";
const server = Hapi.server({ port: 3000 });
await server.register({
plugin: glideMQPlugin,
options: {
connection: { addresses: [{ host: "localhost", port: 6379 }] },
queues: {
emails: {
processor: async (job) => {
await sendEmail(job.data.to, job.data.subject);
return { sent: true };
},
},
},
routes: true, // mounts REST + SSE endpoints
},
});
await server.start();
// POST /emails/jobs to enqueue, GET /emails/events for SSE
glideMQPlugin creates a registry on server.glidemq and optionally mounts routes. The onPostStop hook handles graceful shutdown.
glide-mq 0.14+ provides AI orchestration primitives - token/cost tracking, real-time streaming, human-in-the-loop suspend/signal, model failover chains, budget caps, dual-axis rate limiting, and vector search. This plugin exposes them as REST/SSE endpoints:
| Method | Path | Description |
|---|---|---|
GET | /{name}/flows/{id}/usage | Aggregated token/cost usage for a flow |
GET | /{name}/flows/{id}/budget | Budget status and remaining limits for a flow |
GET | /{name}/jobs/{id}/stream | SSE stream of a job's output chunks |
Job serialization includes AI fields when present: usage, signals, budgetKey, fallbackIndex, tpmTokens. SSE events include usage, suspended, and budget-exceeded event types.
All AI features are also accessible programmatically via the server.glidemq registry. See the glide-mq docs for details.
interface GlideMQPluginOptions {
connection?: ConnectionOptions; // Required unless testing: true
queues?: Record<string, QueueConfig>;
producers?: Record<string, ProducerConfig>;
prefix?: string; // Valkey key prefix (default: "glide")
testing?: boolean; // In-memory mode, no Valkey needed
routes?: boolean | GlideMQRoutesOptions; // Mount REST + SSE endpoints
}
Route access control via GlideMQRoutesOptions:
await server.register({
plugin: glideMQPlugin,
options: {
connection: { addresses: [{ host: "localhost", port: 6379 }] },
queues: { emails: { processor: async (job) => ({ sent: true }) } },
routes: {
queues: ["emails"], // restrict to specific queues
producers: ["emails"], // restrict to specific producers
},
},
});
import { createTestApp } from "@glidemq/hapi/testing";
const { server } = await createTestApp({
emails: { processor: async (job) => ({ sent: true }) },
});
const res = await server.inject({
method: "POST",
url: "/emails/jobs",
payload: { name: "welcome", data: { to: "user@test.com" } },
});
// res.statusCode === 201
await server.stop();
addAndWait (POST /{name}/jobs/wait) is not available in testing mode.FAQs
Hapi plugin for glide-mq - queue management REST API and SSE events
We found that @glidemq/hapi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.