feat(api): publish the validation, http-protect and net references — Wave 5

Closes the Hardening & validation group, the fourth Tier 2 section on /api/ and the
last unblocked wave. All three packages were doc-blocked and released first, so the
generator had real prose to copy: 101 new pages, every one of them yielding a
summary.

  validation@1.1.0     7 pages   1 root +  6 symbols +  0 members
  http-protect@3.0.1  39 pages   1 root +  6 symbols + 32 members
  net@3.0.2           55 pages   1 root + 34 symbols + 20 members

sitemap-api.xml 274 -> 323, which is exactly the 3 roots plus 46 symbols; the 52
member pages carry sitemap: false and stay index, follow per the W0-12 decision. All
14 packages now report 100% summary coverage. 18 nav files / 525 entries / 0
duplicates — +3 files and +46 entries, matching the new symbol pages one for one.
Three more Pages Functions, 14 in total.

Every figure above was pre-measured against a local build before each release, so
generation confirmed rather than discovered — the practice Wave 4 recommended, now
used for a whole wave. The one number that moved was validation's page count, 6 to
7, because exporting Ctor gave it a page.

net is the first package here that could never be generated at all. The Buffer
failure was recorded as fixed by Wave 0's `types: ['node']`; it was not, and the
claim survived five waves because it had been verified against core and rpc, neither
of which references Buffer. The real fix was four imports in net itself.

http-protect is the first package to ship through the collision-suffix stripper: its
exported Response collides with the global Response from @types/node, so
api-extractor named it Response_2 and, without 197898c, six pages would have shipped
under a name the package does not export. Verified on the built page — title,
breadcrumb and sidebar all read Response, and the sentence that used to lose its
words to an unresolvable {@link} is intact.

Blurbs rewritten for net and http-protect, which api-packages.js asks for when a
wave ships: "Fast binary network address checker" and "HTTP DDoS protection
middleware" both described the packages more narrowly than what the references now
document. validation's was already accurate and is unchanged.

Also refreshes src/org/api/index.md's dateModified, stale because the collapsible
groups landed in 49f4c90 after pageDates.json was last generated. Worth
distinguishing from the §8 gap: this instance is the fixable kind, since the page
file itself changed. The structural one still stands — this wave also added a whole
group to that page through api-packages.js, which no regeneration can date.

All four checks pass; 1,598 pages crawled with 0 broken links.

Author: Mikhus

functions/api/http-protect/[[path]].js

@@ -0,0 +1,7 @@
+// GENERATED by scripts/build-api-docs.js — do not edit by hand.
+// Cloudflare Pages Function — /api/http-protect/*
+// Resolves retired @imqueue/http-protect version URLs onto the kept version trees.
+// See lib/api-redirects.js for the policy and why this is not in _redirects.
+import { handleApiRequest } from "../../../lib/api-handler.js";
+
+export const onRequest = handleApiRequest;

functions/api/net/[[path]].js

@@ -0,0 +1,7 @@
+// GENERATED by scripts/build-api-docs.js — do not edit by hand.
+// Cloudflare Pages Function — /api/net/*
+// Resolves retired @imqueue/net version URLs onto the kept version trees.
+// See lib/api-redirects.js for the policy and why this is not in _redirects.
+import { handleApiRequest } from "../../../lib/api-handler.js";
+
+export const onRequest = handleApiRequest;

functions/api/validation/[[path]].js

@@ -0,0 +1,7 @@
+// GENERATED by scripts/build-api-docs.js — do not edit by hand.
+// Cloudflare Pages Function — /api/validation/*
+// Resolves retired @imqueue/validation version URLs onto the kept version trees.
+// See lib/api-redirects.js for the policy and why this is not in _redirects.
+import { handleApiRequest } from "../../../lib/api-handler.js";
+
+export const onRequest = handleApiRequest;

lib/api-renames.js

@@ -9,6 +9,7 @@
 // Keys and values are <pkg>/<version-segment>/<page-basename>, i.e. the /api/
 // path with no leading or trailing slash.
 export const RENAMED_API_PAGES = new Map([
+    ["http-protect/latest/http-protect.response_2", "http-protect/latest/http-protect.response"], // Interface
     ["pg-cache/latest/pg-cache.classdecorator_2", "pg-cache/latest/pg-cache.classdecorator"], // TypeAlias
     ["pg-cache/latest/pg-cache.methoddecorator_2", "pg-cache/latest/pg-cache.methoddecorator"], // TypeAlias
 ]);

lib/api-versions.js

@@ -14,5 +14,8 @@ export const API_VERSIONS = {
   "dd-trace": { "latest": "3.1.0", "archives": [] },
   "graphql-dependency": { "latest": "3.1.0", "archives": [] },
   "type-graphql-dependency": { "latest": "3.0.3", "archives": [] },
+  "net": { "latest": "3.0.2", "archives": [] },
+  "http-protect": { "latest": "3.0.1", "archives": [] },
+  "validation": { "latest": "1.1.0", "archives": [] },
   "job": { "latest": "3.0.3", "archives": [] }
 };

scripts/lib/api-packages.js

@@ -225,21 +225,23 @@ const PACKAGES = [
     tier: 2,
     group: 'Hardening & validation',
     tags: [],
-    blurb: 'Fast binary network address checker with IPv4 and IPv6 support.',
+    blurb: 'CIDR membership testing for IPv4 and IPv6 — sorted binary ranges '
+      + 'searched in O(log n) rather than one comparison per network.',
     cliId: 'net',
     latestOnly: true,
-    status: 'planned',
+    status: 'shipped',
     wave: 5,
   },
   {
     name: 'http-protect',
     tier: 2,
     group: 'Hardening & validation',
     tags: [],
-    blurb: 'HTTP DDoS protection middleware.',
+    blurb: 'Per-IP rate limiting and banning for express-like servers, backed by '
+      + 'Redis so every process sees one view of a client.',
     cliId: 'http-protect',
     latestOnly: true,
-    status: 'planned',
+    status: 'shipped',
     wave: 5,
   },
   {
@@ -250,7 +252,7 @@ const PACKAGES = [
     blurb: 'Zod-backed field- and method-level validation via native (TC39) decorators.',
     cliId: null,
     latestOnly: true,
-    status: 'planned',
+    status: 'shipped',
     wave: 5,
   },
 

src/_data/apiVersions.json

@@ -45,6 +45,18 @@
     "latest": "3.0.3",
     "archives": []
   },
+  "net": {
+    "latest": "3.0.2",
+    "archives": []
+  },
+  "http-protect": {
+    "latest": "3.0.1",
+    "archives": []
+  },
+  "validation": {
+    "latest": "1.1.0",
+    "archives": []
+  },
   "job": {
     "latest": "3.0.3",
     "archives": []

src/_data/pageDates.json

@@ -29,7 +29,7 @@
   },
   "src/org/api/index.md": {
     "published": "2026-07-19T22:58:50+02:00",
-    "modified": "2026-07-31T21:35:26+02:00"
+    "modified": "2026-08-01T09:07:05+02:00"
   },
   "src/org/blog/authors.html": {
     "published": "2026-07-22T04:09:43+02:00",

src/org/api/http-protect/latest/http-protect.httpprotect._constructor_.md

@@ -0,0 +1,76 @@
+---
+title: "HttpProtect.(constructor) · @imqueue/http-protect"
+description: "Resolves every threshold, parses the exempt networks and connects to Redis."
+apiCrumbs: [{"name":"API reference","url":"/api/"},{"name":"@imqueue/http-protect","url":"/api/http-protect/latest/"},{"name":"HttpProtect","url":"/api/http-protect/latest/http-protect.httpprotect/"},{"name":"(constructor)","url":"/api/http-protect/latest/http-protect.httpprotect._constructor_/"}]
+sitemap: false
+---
+
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+# HttpProtect.(constructor)
+
+Resolves every threshold, parses the exempt networks and connects to Redis.
+
+**Signature:**
+
+```typescript
+constructor(options?: HttpProtectOptions | undefined);
+```
+
+## Parameters
+
+<table><thead><tr><th>
+
+Parameter
+
+
+</th><th>
+
+Type
+
+
+</th><th>
+
+Description
+
+
+</th></tr></thead>
+<tbody><tr><td>
+
+options
+
+
+</td><td>
+
+[HttpProtectOptions](/api/http-protect/latest/http-protect.httpprotectoptions/) \| undefined
+
+
+</td><td>
+
+_(Optional)_ configuration; every field is optional, and omitting the object entirely gives default thresholds against `localhost:6379`
+
+
+</td></tr>
+</tbody></table>
+
+## Exceptions
+
+TypeError if any [HttpProtectOptions.safeNetworks](/api/http-protect/latest/http-protect.httpprotectoptions.safenetworks/) entry is not valid CIDR — including a bare address with no prefix length.
+
+## Remarks
+
+Connects immediately unless [HttpProtectOptions.redis](/api/http-protect/latest/http-protect.httpprotectoptions.redis/) is supplied, so this is not a cheap object to build in a process that has no Redis.
+
+## Example
+
+
+```typescript
+const protect = new HttpProtect({
+    redis: existingClient,
+    ttl: 60,
+    maxRequests: 600,
+    banLimit: 10000,
+    safeNetworks: ['10.0.0.0/8', '203.0.113.7/32'],
+});
+```
+

src/org/api/http-protect/latest/http-protect.httpprotect.banlimit.md

@@ -0,0 +1,18 @@
+---
+title: "HttpProtect.banLimit property · @imqueue/http-protect"
+description: "The resolved ban threshold, from HttpProtectOptions.banLimit, HTTP_PROTECT_BAN_LIMIT, or 1000."
+apiCrumbs: [{"name":"API reference","url":"/api/"},{"name":"@imqueue/http-protect","url":"/api/http-protect/latest/"},{"name":"HttpProtect","url":"/api/http-protect/latest/http-protect.httpprotect/"},{"name":"banLimit","url":"/api/http-protect/latest/http-protect.httpprotect.banlimit/"}]
+sitemap: false
+---
+
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+# HttpProtect.banLimit property
+
+The resolved ban threshold, from [HttpProtectOptions.banLimit](/api/http-protect/latest/http-protect.httpprotectoptions.banlimit/)<!-- -->, `HTTP_PROTECT_BAN_LIMIT`<!-- -->, or 1000.
+
+**Signature:**
+
+```typescript
+readonly banLimit: number;
+```