
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
dicc-compiler
Advanced tools
Dependency Injection Container Compiler
This is a project to end all current TypeScript DI implementations. I mean it. All of them. With extreme prejudice.
Why? Because they are all based on decorators. (Well, there is one exception, but that one doesn't - and cannot, properly - support async services, hence this project.) Don't get me wrong - decorators are awesome! I love decorators. I've built a pretty big library based entirely on decorators.
But - and I cannot stress this enough - decorator-based dependency injection breaks one of the most sacred dependency injection principles: your code should almost NEVER know or care that dependency injection even exists, and it most certainly shouldn't know anything about the specifics of the DI implementation - in other words, your code should not depend on your preferred dependency injection solution. Because if it does, then it's not portable, you can't just easily extract parts of it into a shared library, you cannot test it independently of the DI framework, you're simply locked in, you're alone in the dark, you're locked in and there are drums in the deep and they are coming and you cannot get out and you don't have Gandalf and
</rant>
<zen>
DICC can't do the pointy hat trick, but it does offer an alternative solution to dependency injection. Using a simple YAML config file, you specify one or more resource files, which are regular TypeScript files inside your project. From these resource files you export some classes, interfaces, and possibly some constant expressions, and then you point the DICC CLI to your config file and DICC will produce a compiled file, which exports a fully typed and autowired dependency injection container.
The only place in your code you will ever import { anything } from 'dicc'
will be inside the resource file (or files).
@Decorators) which
allow some modifications to service definitions without needing to alter the
definitions themselvesreflect-metadata, no junk in your source
code, minimal runtime footprintDICC is split into two packages, because the compiler depends on TypeScript and ts-morph, which are probably both something you want to be able to prune from your production node modules. The runtime package is tiny and doesn't have any other dependencies.
# Compile-time dependency:
npm i --save-dev dicc-compiler
# Runtime dependency:
npm i --save dicc
The DICC compiler actually uses DICC itself, so you can look at its source code to see a simple real-world example of service definitions and the resulting compiled container, as well as of how the container is used.
If you find a bug, please feel free to file an issue, even if you can't provide a pull request with a fix! Nobody will be shamed here for not having the time to invest into fixing other people's code. I set this boat out to sea, so it's my responsibility to keep it floating.
That said, I do welcome pull requests as well - whether they be bug fixes or new features. There's no formal code style, if I have an issue with your indentation or something, I'll just fix it.
FAQs
Compile-time dependency injection
We found that dicc-compiler demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.