@futdevpro/nts-dynamo 1.15.145 → 1.15.151

package/build/_collections/npm-token-check.util.js

@@ -0,0 +1,302 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PUBLISH_RIGHT_ERROR_CODES = exports.DyNTS_NpmTokenShape = exports.DyNTS_NpmTokenState = void 0;
+exports.classifyNpmTokenShape = classifyNpmTokenShape;
+exports.classifyNpmTokenProbe = classifyNpmTokenProbe;
+exports.describeNpmTokenState = describeNpmTokenState;
+exports.extractTokenFromNpmrc = extractTokenFromNpmrc;
+exports.resolveNpmToken = resolveNpmToken;
+exports.checkNpmToken = checkNpmToken;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const os = tslib_1.__importStar(require("os"));
+const path = tslib_1.__importStar(require("path"));
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+/**
+ * FR-320 — NPM-TOKEN ALLAPOT-OSZTALYOZO (bedrock).
+ *
+ * MIERT KELLETT (2026-08-20..22, valos incidens): a flotta npm-tokenje lejart, majd egy olyan
+ * pot-token kerult be, aminek NEM volt 2FA-bypass joga. A kovetkezmeny NAPOKIG tartott es
+ * MINDENHOL `E404`-kent jelentkezett — privat csomagnal ugyanis az npm a jogosulatlan kerest
+ * 404-gyel utasitja el, NEM 401-gyel. Emiatt a "nincs ilyen csomag", a "lejart kulcs" es a
+ * "rossz jogu kulcs" MEGKULONBOZTETHETETLEN volt, es a diagnozis tobb kort vitt el.
+ *
+ * A KULCS-DISZKRIMINATOR: a `/-/whoami` vegpont NEM csomag-fuggo, ezert nem esik bele a privat-404
+ * elrejtesbe:
+ *   - token NELKUL / ROSSZ tokennel -> **401**
+ *   - ERVENYES tokennel             -> **200** + a felhasznalonev
+ * Innen a csomag-szintu proba mar ertelmezheto: ha a whoami OK, de a scope-olt csomag 404, akkor a
+ * token EL, csak nincs joga hozza.
+ *
+ * ⚠️ AMIT EZ NEM TUD MEGALLAPITANI (szandekosan kimondva, hogy ne igerjunk tobbet a valosagnal):
+ *   - a **2FA-bypass** hianya CSAK publikalaskor derul ki (`EOTP` hibakod) — read-only probaval nem;
+ *   - a **lejart** es a **visszavont** token kivulrol egyforman 401;
+ *   - a token **elettartama** nem kerdezheto le.
+ * Ezert a `publishErrorCode` opcionalis bemenet: ha egy publish mar elbukott, az `EOTP` alapjan
+ * ERRE is tudunk hatarozott allapotot mondani.
+ *
+ * A TOKEN ERTEKE SOSEM KERUL A KIMENETBE — sem logba, sem eredmenybe.
+ */
+/** Az npm-token megallapithato allapotai. */
+var DyNTS_NpmTokenState;
+(function (DyNTS_NpmTokenState) {
+    /** Nincs beallitva token (se env, se .npmrc). */
+    DyNTS_NpmTokenState["missing"] = "missing";
+    /** Van ertek, de nem npm-token alaku — jellemzoen elgepeles / rossz valtozo. */
+    DyNTS_NpmTokenState["malformed"] = "malformed";
+    /** A registry elutasitja (401): lejart, visszavont vagy egyszeruen rossz. */
+    DyNTS_NpmTokenState["invalid"] = "invalid";
+    /** A token EL (whoami OK), de a vizsgalt scope-hoz/csomaghoz NINCS joga. */
+    DyNTS_NpmTokenState["noScopeAccess"] = "no-scope-access";
+    /** A token el es olvas, de publikalasra nincs joga (2FA-bypass hianya — `EOTP`). */
+    DyNTS_NpmTokenState["missingPublishRight"] = "missing-publish-right";
+    /** Minden vizsgalt kepesseg rendben. */
+    DyNTS_NpmTokenState["ok"] = "ok";
+    /** A proba maga nem futott le (halozat/timeout) — NEM azonos azzal, hogy a token rossz. */
+    DyNTS_NpmTokenState["unknown"] = "unknown";
+})(DyNTS_NpmTokenState || (exports.DyNTS_NpmTokenState = DyNTS_NpmTokenState = {}));
+/** A helyi (halozat NELKULI) alak-ellenorzes eredmenye. */
+var DyNTS_NpmTokenShape;
+(function (DyNTS_NpmTokenShape) {
+    DyNTS_NpmTokenShape["missing"] = "missing";
+    DyNTS_NpmTokenShape["malformed"] = "malformed";
+    DyNTS_NpmTokenShape["plausible"] = "plausible";
+})(DyNTS_NpmTokenShape || (exports.DyNTS_NpmTokenShape = DyNTS_NpmTokenShape = {}));
+/**
+ * PURE — a token ALAKJANAK ellenorzese, halozat nelkul.
+ *
+ * MIERT KULON LEPES: a "nincs beallitva" es a "rosszul beallitva" eseteket halozat nelkul, azonnal
+ * es egyertelmuen el lehet donteni — ezek a leggyakoribb operatori hibak (ures env-var, idezojelek
+ * bennragadtak, a `//registry…/:_authToken=` PREFIX is bemasolodott).
+ *
+ * Az npm mai token-alakjai `npm_`-mel kezdodnek (classic automation + granular). A regi, prefix
+ * nelkuli UUID-alaku tokenek MEG ervenyesek lehetnek, ezert azokat is `plausible`-nek vesszuk —
+ * inkabb engedunk at egy kesobb 401-et kapo tokent, mint hogy egy jot elutasitsunk.
+ */
+function classifyNpmTokenShape(rawToken) {
+    const token = (rawToken ?? '').trim();
+    if (!token) {
+        return DyNTS_NpmTokenShape.missing;
+    }
+    // Gyakori elgepeles: a teljes .npmrc-sor kerult be a token helyere.
+    if (token.includes('_authToken') || token.includes('registry.npmjs.org')) {
+        return DyNTS_NpmTokenShape.malformed;
+    }
+    // Bennragadt idezojelek / whitespace a valtozo erteken belul.
+    if (/["'\s]/.test(token)) {
+        return DyNTS_NpmTokenShape.malformed;
+    }
+    // Nyilvanvaloan tul rovid ertek (pl. "x", "changeme").
+    if (token.length < 24) {
+        return DyNTS_NpmTokenShape.malformed;
+    }
+    return DyNTS_NpmTokenShape.plausible;
+}
+/**
+ * Publish-oldali npm-hibakodok, amik ELO token mellett JOGOSULTSAG-hianyt jelentenek.
+ *
+ * A lista SZANDEKOSAN tartalmazza az `E404`-et: az npm a `PUT` (publish) kerest is 404-gyel
+ * utasitja el, ha a tokennek nincs irasi joga a csomagra. Elo token mellett ez SOSEM jelentheti,
+ * hogy a csomag hianyzik — hiszen olvasni tudtuk.
+ */
+exports.PUBLISH_RIGHT_ERROR_CODES = ['EOTP', 'E403', 'E404'];
+/**
+ * PURE — a halozati valaszokbol allapot.
+ *
+ * A sorrend SZANDEKOS: a `whoami` az egyetlen csomag-fuggetlen jel, ezert az dont eloszor. Csak
+ * utana ertelmezheto a csomag-szintu 404 — kulonben ugyanaz a 404 jelentene "nincs ilyen csomag"-ot
+ * es "rossz kulcs"-ot is, ami epp a 2026-08-i incidens diagnozisat huzta el.
+ */
+function classifyNpmTokenProbe(input) {
+    // A proba el sem jutott a registryig -> NEM allitunk semmit a tokenrol.
+    if (input.whoamiStatus === null) {
+        return DyNTS_NpmTokenState.unknown;
+    }
+    // 401 = a registry elutasitja a hitelesitest (hianyzo/lejart/visszavont/rossz token).
+    if (input.whoamiStatus === 401) {
+        return DyNTS_NpmTokenState.invalid;
+    }
+    // Barmi mas, ami nem 200: nem tudunk hatarozott allapotot mondani (5xx, rate-limit, proxy).
+    if (input.whoamiStatus !== 200) {
+        return DyNTS_NpmTokenState.unknown;
+    }
+    // Innentol a token IGAZOLTAN el (whoami 200). Ezert BARMILYEN publish-oldali elutasitas
+    // JOGOSULTSAG-hiany, NEM hianyzo csomag:
+    //   EOTP  -> 2FA-bypass hianya,
+    //   E403  -> explicit tiltas,
+    //   E404  -> az npm a PUT-ra is 404-gyel valaszol, ha a tokennek NINCS IRASI joga a csomagra
+    //            (ugyanaz a letezes-elrejtes, mint olvasasnal).
+    // MERVE (2026-08-22): `npm error 404 Not Found - PUT .../@futdevpro%2fnts-dynamo` — mikozben
+    // UGYANAZ a token olvasni tudta a csomagot. Enelkul a megkulonboztetes nelkul ez "nincs ilyen
+    // csomag"-nak latszik, es epp ez vitte felre a diagnozist napokig.
+    if (exports.PUBLISH_RIGHT_ERROR_CODES.includes((input.publishErrorCode ?? '').toUpperCase())) {
+        return DyNTS_NpmTokenState.missingPublishRight;
+    }
+    // Elo token + a scope-olt csomag 404/403 -> a token nem lat ra a csomagra (jogosultsag).
+    if (input.scopedPackageStatus === 404 || input.scopedPackageStatus === 403) {
+        return DyNTS_NpmTokenState.noScopeAccess;
+    }
+    // A csomag-probat nem mertuk, vagy sikeres volt.
+    if (input.scopedPackageStatus === undefined || input.scopedPackageStatus === 200) {
+        return DyNTS_NpmTokenState.ok;
+    }
+    return DyNTS_NpmTokenState.unknown;
+}
+/**
+ * PURE — ember-olvashato magyarazat + a KOVETKEZO LEPES. A puszta allapot-cimke keves: az operator
+ * azt akarja tudni, mit tegyen.
+ */
+function describeNpmTokenState(state) {
+    switch (state) {
+        case DyNTS_NpmTokenState.missing:
+            return 'Nincs beallitva npm-token. Teendo: allitsd be a Keystore/CI kornyezetben (NEM .npmrc-fajlban).';
+        case DyNTS_NpmTokenState.malformed:
+            return 'A token erteke nem npm-token alaku (idezojel, whitespace, vagy a teljes .npmrc-sor kerult be). '
+                + 'Teendo: csak a NYERS token-erteket add meg.';
+        case DyNTS_NpmTokenState.invalid:
+            return 'A registry ELUTASITJA a tokent (401): lejart, visszavont vagy rossz. Teendo: uj token. '
+                + 'FIGYELEM: privat csomagnal ez a hiba a HIVOKNAL 404-kent jelenik meg, nem 401-kent.';
+        case DyNTS_NpmTokenState.noScopeAccess:
+            return 'A token EL, de a vizsgalt scope-hoz/csomaghoz nincs joga (a whoami rendben, a csomag 404/403). '
+                + 'Teendo: a token jogosultsagi koret bovitsd a scope-ra.';
+        case DyNTS_NpmTokenState.missingPublishRight:
+            return 'A token EL es OLVAS, de PUBLIKALNI nem tud (`EOTP` / `E403` / publish-oldali `E404`): '
+                + 'hianyzik az iras/2FA-bypass jog. FIGYELEM: a PUT-ra kapott 404 NEM hianyzo csomagot jelent, '
+                + 'hanem jogosultsag-hianyt. Teendo: automation/granular token IRASI joggal a scope-ra.';
+        case DyNTS_NpmTokenState.ok:
+            return 'A token ervenyes, es a vizsgalt csomagot is eleri.';
+        default:
+            return 'A proba nem jutott el a registryig (halozat/timeout/proxy) — ez NEM bizonyitja, hogy a token rossz.';
+    }
+}
+/**
+ * PURE — token kinyerese egy `.npmrc` TARTALMABOL.
+ *
+ * MIERT KELL: az elso valtozat CSAK a `process.env.NPM_TOKEN`-t nezte, es ezert a sajat
+ * workstationomon `missing`-et adott — HOLOTT az npm ott tokeletesen mukodott, mert a token a
+ * `~/.npmrc`-ben all. Ez HAMIS NEGATIV, es epp a legfontosabb helyeken (runner-kontener, hosztok)
+ * sulna el, ahol a token szinten FAJLBAN van.
+ *
+ * A `.npmrc`-t csak OLVASSUK — letrehozni tilos (flotta-szintu hard rule).
+ */
+function extractTokenFromNpmrc(content, registry = DEFAULT_REGISTRY) {
+    const host = registry.replace(/^https?:/, '').replace(/\/+$/, '');
+    for (const rawLine of content.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#') || line.startsWith(';')) {
+            continue;
+        }
+        // Alak: `//registry.npmjs.org/:_authToken=<ertek>` (a host elotti `//` a kulcs resze).
+        const match = line.match(/^(\/\/[^:]+):_authToken=(.+)$/);
+        if (!match) {
+            continue;
+        }
+        // A `.npmrc` a hostot ZARO PERJELLEL irja (`//registry.npmjs.org/`), a normalizalt
+        // `host` viszont nelkule all — ezert MINDKET oldalt normalizalni kell. Az elso
+        // valtozatom csak az egyiket tette, es ezert SOSEM illeszkedett (a specek fogtak meg).
+        const lineHost = match[1].replace(/\/+$/, '');
+        if (lineHost !== host) {
+            continue;
+        }
+        const value = match[2].trim().replace(/^["']|["']$/g, '');
+        if (value) {
+            return value;
+        }
+    }
+    return null;
+}
+/**
+ * A token feloldasa a szokasos helyekrol, PRIORITAS szerint:
+ *   1. explicit parameter, 2. `NPM_TOKEN` env, 3. a felhasznaloi `~/.npmrc`.
+ * Sose dob; ha egyik sincs, ures stringet ad.
+ */
+function resolveNpmToken(explicit, registry) {
+    const fromExplicit = (explicit ?? '').trim();
+    if (fromExplicit) {
+        return fromExplicit;
+    }
+    const fromEnv = (process.env.NPM_TOKEN ?? '').trim();
+    if (fromEnv) {
+        return fromEnv;
+    }
+    try {
+        const npmrcPath = path.join(os.homedir(), '.npmrc');
+        if (fs.existsSync(npmrcPath)) {
+            return extractTokenFromNpmrc(fs.readFileSync(npmrcPath, 'utf-8'), registry) ?? '';
+        }
+    }
+    catch {
+        // A fajl-olvasas hibaja NEM buktathatja az ellenorzest.
+    }
+    return '';
+}
+const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
+const DEFAULT_TIMEOUT_MS = 10000;
+/** Egy statusz-lekeres, timeout-tal. `null`, ha el sem jutottunk a szerverig. */
+async function fetchStatus(url, token, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => { controller.abort(); }, timeoutMs);
+    try {
+        const response = await fetch(url, {
+            headers: token ? { authorization: `Bearer ${token}` } : {},
+            signal: controller.signal,
+        });
+        return response.status;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * A tenyleges ellenorzes. SOSE dob — a hibat allapotkent adja vissza (a token-ellenorzes nem
+ * buktathat meg semmit, amibe beepitjuk).
+ */
+async function checkNpmToken(options = {}) {
+    const registry = (options.registry ?? DEFAULT_REGISTRY).replace(/\/+$/, '');
+    const token = resolveNpmToken(options.token, registry);
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const shape = classifyNpmTokenShape(token);
+    if (shape !== DyNTS_NpmTokenShape.plausible) {
+        const localState = shape === DyNTS_NpmTokenShape.missing
+            ? DyNTS_NpmTokenState.missing
+            : DyNTS_NpmTokenState.malformed;
+        return {
+            state: localState,
+            username: null,
+            detail: describeNpmTokenState(localState),
+            probe: { whoamiStatus: null },
+        };
+    }
+    const whoamiStatus = await fetchStatus(`${registry}/-/whoami`, token, timeoutMs);
+    let username = null;
+    if (whoamiStatus === 200) {
+        try {
+            const response = await fetch(`${registry}/-/whoami`, {
+                headers: { authorization: `Bearer ${token}` },
+            });
+            const body = await response.json();
+            username = typeof body.username === 'string' ? body.username : null;
+        }
+        catch {
+            username = null;
+        }
+    }
+    let scopedPackageStatus;
+    if (options.scopedPackage && whoamiStatus === 200) {
+        const encoded = options.scopedPackage.replace('/', '%2f');
+        const status = await fetchStatus(`${registry}/${encoded}`, token, timeoutMs);
+        scopedPackageStatus = status === null ? undefined : status;
+    }
+    const probe = {
+        whoamiStatus: whoamiStatus,
+        scopedPackageStatus: scopedPackageStatus,
+        publishErrorCode: options.publishErrorCode,
+    };
+    const state = classifyNpmTokenProbe(probe);
+    fsm_dynamo_1.DyFM_Log.info(`[npm-token-check] allapot=${state}${username ? ` user=${username}` : ''} (a token erteke NEM naplozodik)`);
+    return { state: state, username: username, detail: describeNpmTokenState(state), probe: probe };
+}
+//# sourceMappingURL=npm-token-check.util.js.map

package/build/_collections/npm-token-check.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-token-check.util.js","sourceRoot":"","sources":["../../src/_collections/npm-token-check.util.ts"],"names":[],"mappings":";;;AAoEA,sDAcC;AA4BD,sDAgCC;AAMD,sDAsBC;AAwCD,sDAiBC;AAOD,0CAcC;AA0BD,sCAoDC;;AAtUD,+CAAyB;AACzB,+CAAyB;AACzB,mDAA6B;AAE7B,sDAAiD;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,6CAA6C;AAC7C,IAAY,mBAeX;AAfD,WAAY,mBAAmB;IAC7B,iDAAiD;IACjD,0CAAmB,CAAA;IACnB,gFAAgF;IAChF,8CAAuB,CAAA;IACvB,6EAA6E;IAC7E,0CAAmB,CAAA;IACnB,4EAA4E;IAC5E,wDAAiC,CAAA;IACjC,oFAAoF;IACpF,oEAA6C,CAAA;IAC7C,wCAAwC;IACxC,gCAAS,CAAA;IACT,2FAA2F;IAC3F,0CAAmB,CAAA;AACrB,CAAC,EAfW,mBAAmB,mCAAnB,mBAAmB,QAe9B;AAED,2DAA2D;AAC3D,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,8CAAuB,CAAA;IACvB,8CAAuB,CAAA;AACzB,CAAC,EAJW,mBAAmB,mCAAnB,mBAAmB,QAI9B;AAED;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CAAC,QAAmC;IACvE,MAAM,KAAK,GAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,OAAO,mBAAmB,CAAC,OAAO,CAAC;IAAC,CAAC;IAEnD,oEAAoE;IACpE,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACzE,OAAO,mBAAmB,CAAC,SAAS,CAAC;IACvC,CAAC;IACD,8DAA8D;IAC9D,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,OAAO,mBAAmB,CAAC,SAAS,CAAC;IAAC,CAAC;IACnE,uDAAuD;IACvD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAAC,OAAO,mBAAmB,CAAC,SAAS,CAAC;IAAC,CAAC;IAEhE,OAAO,mBAAmB,CAAC,SAAS,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACU,QAAA,yBAAyB,GAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAY5E;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,KAAgC;IACpE,wEAAwE;IACxE,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAAC,OAAO,mBAAmB,CAAC,OAAO,CAAC;IAAC,CAAC;IAExE,sFAAsF;IACtF,IAAI,KAAK,CAAC,YAAY,KAAK,GAAG,EAAE,CAAC;QAAC,OAAO,mBAAmB,CAAC,OAAO,CAAC;IAAC,CAAC;IAEvE,4FAA4F;IAC5F,IAAI,KAAK,CAAC,YAAY,KAAK,GAAG,EAAE,CAAC;QAAC,OAAO,mBAAmB,CAAC,OAAO,CAAC;IAAC,CAAC;IAEvE,wFAAwF;IACxF,yCAAyC;IACzC,gCAAgC;IAChC,8BAA8B;IAC9B,6FAA6F;IAC7F,4DAA4D;IAC5D,6FAA6F;IAC7F,8FAA8F;IAC9F,mEAAmE;IACnE,IAAI,iCAAyB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACrF,OAAO,mBAAmB,CAAC,mBAAmB,CAAC;IACjD,CAAC;IAED,yFAAyF;IACzF,IAAI,KAAK,CAAC,mBAAmB,KAAK,GAAG,IAAI,KAAK,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QAC3E,OAAO,mBAAmB,CAAC,aAAa,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,KAAK,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QACjF,OAAO,mBAAmB,CAAC,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,mBAAmB,CAAC,OAAO,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,KAA0B;IAC9D,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,mBAAmB,CAAC,OAAO;YAC9B,OAAO,gGAAgG,CAAC;QAC1G,KAAK,mBAAmB,CAAC,SAAS;YAChC,OAAO,iGAAiG;kBACpG,6CAA6C,CAAC;QACpD,KAAK,mBAAmB,CAAC,OAAO;YAC9B,OAAO,yFAAyF;kBAC5F,qFAAqF,CAAC;QAC5F,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,iGAAiG;kBACpG,wDAAwD,CAAC;QAC/D,KAAK,mBAAmB,CAAC,mBAAmB;YAC1C,OAAO,wFAAwF;kBAC3F,8FAA8F;kBAC9F,sFAAsF,CAAC;QAC7F,KAAK,mBAAmB,CAAC,EAAE;YACzB,OAAO,oDAAoD,CAAC;QAC9D;YACE,OAAO,qGAAqG,CAAC;IACjH,CAAC;AACH,CAAC;AA8BD;;;;;;;;;GASG;AACH,SAAgB,qBAAqB,CAAC,OAAe,EAAE,WAAmB,gBAAgB;IACxF,MAAM,IAAI,GAAW,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAW,OAAO,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACxE,uFAAuF;QACvF,MAAM,KAAK,GAA4B,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnF,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACzB,mFAAmF;QACnF,+EAA+E;QAC/E,uFAAuF;QACvF,MAAM,QAAQ,GAAW,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACpC,MAAM,KAAK,GAAW,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,KAAK,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,QAA4B,EAAE,QAAgB;IAC5E,MAAM,YAAY,GAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,YAAY,EAAE,CAAC;QAAC,OAAO,YAAY,CAAC;IAAC,CAAC;IAC1C,MAAM,OAAO,GAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,OAAO,EAAE,CAAC;QAAC,OAAO,OAAO,CAAC;IAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,SAAS,GAAW,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,qBAAqB,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,gBAAgB,GAAW,4BAA4B,CAAC;AAC9D,MAAM,kBAAkB,GAAW,KAAK,CAAC;AAEzC,iFAAiF;AACjF,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,KAAoB,EAAE,SAAiB;IAC7E,MAAM,UAAU,GAAoB,IAAI,eAAe,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAmB,UAAU,CAAC,GAAS,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACzF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAa,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1C,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;YAC1D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,aAAa,CACjC,UAAuC,EAAE;IAEzC,MAAM,QAAQ,GAAW,CAAC,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,KAAK,GAAW,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAW,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAElE,MAAM,KAAK,GAAwB,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,KAAK,KAAK,mBAAmB,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAwB,KAAK,KAAK,mBAAmB,CAAC,OAAO;YAC3E,CAAC,CAAC,mBAAmB,CAAC,OAAO;YAC7B,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC;QAClC,OAAO;YACL,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,qBAAqB,CAAC,UAAU,CAAC;YACzC,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC9B,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAkB,MAAM,WAAW,CAAC,GAAG,QAAQ,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAEhG,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAa,MAAM,KAAK,CAAC,GAAG,QAAQ,WAAW,EAAE;gBAC7D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC,CAAC;YACH,MAAM,IAAI,GAA0B,MAAM,QAAQ,CAAC,IAAI,EAA2B,CAAC;YACnF,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,mBAAuC,CAAC;IAC5C,IAAI,OAAO,CAAC,aAAa,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;QAClD,MAAM,OAAO,GAAW,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,MAAM,GAAkB,MAAM,WAAW,CAAC,GAAG,QAAQ,IAAI,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5F,mBAAmB,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAA8B;QACvC,YAAY,EAAE,YAAY;QAC1B,mBAAmB,EAAE,mBAAmB;QACxC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC;IACF,MAAM,KAAK,GAAwB,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAEhE,qBAAQ,CAAC,IAAI,CAAC,6BAA6B,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC;IAE1H,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAClG,CAAC"}

package/build/_modules/rate-limit/_enums/rate-limit-store-kind.type-enum.d.ts

@@ -0,0 +1,6 @@
+/** Persistence scope advertised by a rate-limit store implementation. */
+export declare enum DyNTS_RateLimitStoreKind_Type {
+    inMemory = "in-memory",
+    shared = "shared"
+}
+//# sourceMappingURL=rate-limit-store-kind.type-enum.d.ts.map

package/build/_modules/rate-limit/_enums/rate-limit-store-kind.type-enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-store-kind.type-enum.d.ts","sourceRoot":"","sources":["../../../../src/_modules/rate-limit/_enums/rate-limit-store-kind.type-enum.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,oBAAY,6BAA6B;IACvC,QAAQ,cAAc;IACtB,MAAM,WAAW;CAClB"}

package/build/_modules/rate-limit/_enums/rate-limit-store-kind.type-enum.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_RateLimitStoreKind_Type = void 0;
+/** Persistence scope advertised by a rate-limit store implementation. */
+var DyNTS_RateLimitStoreKind_Type;
+(function (DyNTS_RateLimitStoreKind_Type) {
+    DyNTS_RateLimitStoreKind_Type["inMemory"] = "in-memory";
+    DyNTS_RateLimitStoreKind_Type["shared"] = "shared";
+})(DyNTS_RateLimitStoreKind_Type || (exports.DyNTS_RateLimitStoreKind_Type = DyNTS_RateLimitStoreKind_Type = {}));
+//# sourceMappingURL=rate-limit-store-kind.type-enum.js.map

package/build/_modules/rate-limit/_enums/rate-limit-store-kind.type-enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-store-kind.type-enum.js","sourceRoot":"","sources":["../../../../src/_modules/rate-limit/_enums/rate-limit-store-kind.type-enum.ts"],"names":[],"mappings":";;;AAAA,yEAAyE;AACzE,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,uDAAsB,CAAA;IACtB,kDAAiB,CAAA;AACnB,CAAC,EAHW,6BAA6B,6CAA7B,6BAA6B,QAGxC"}

package/build/_modules/rate-limit/_models/rate-limit-config.interface.d.ts

@@ -1,5 +1,6 @@
 import { Request } from 'express';
 import { DyNTS_RateLimit_Policy } from './rate-limit-policy.interface';
+import { DyNTS_RateLimit_Store_Interface } from './rate-limit-store.interface';
 /**
  * Config a `DyNTS_RateLimit_Middleware.configure(...)`-hoz.
  *
@@ -21,22 +22,30 @@ export interface DyNTS_RateLimit_Config {
      * Rate-limit subject-extractor. Visszater a karakterlanccal, ami azonositja
      * a rate-limit alanyat (pl. IP-cim, API-kulcs ID, account ID).
      *
-     * Default: a `req.headers['x-forwarded-for']` (csak az elso IP, ha lista)
-     * vagy ha hianyzik akkor `req.ip` vagy `'unknown'`. Ez webszerver elotti
-     * proxy/CDN-mentes setup-ra megfelelo; ha az nd-space mar identifikalja az
-     * API-kulcsot a `req`-ben, a host adhat sajat extractort ami a key-ID-t
-     * adja vissza.
+     * Default: az Express altal mar megbizhatonak minositett `req.ip`, vagy ha
+     * hianyzik akkor `'unknown'`. A middleware szandekosan nem olvassa kozvetlenul
+     * az ugyfel altal hamisithato `x-forwarded-for` headert. Production uzemben a
+     * shared-store gate explicit, opaque extractort kovetel.
      */
     keyExtractor?: (req: Request) => string;
     /**
      * Endpoint-csoportosito. Visszater a karakterlanccal, ami azonositja az
-     * adott endpoint-csoportot. A storage-key `${subject}|${endpoint}` lesz.
+     * adott endpoint-csoportot. A storage-key egyertelmuen hossz-prefixelt
+     * subject + endpoint kompozicio lesz.
      *
      * Default: `req.path` — minden uri-path kulon vodorbe kerul. Csoportositas
      * mas szempontok szerint (pl. "datasets" csoport = `/api/datasets/*`)
      * a hostnal felulirhato.
      */
     endpointGrouper?: (req: Request) => string;
+    /** Optional permit cost per request. Default: one. */
+    costExtractor?: (req: Request) => number;
+    /** Atomic store. The default in-memory implementation is for tests and single-instance development only. */
+    store?: DyNTS_RateLimit_Store_Interface;
+    /** Fail configuration unless a shared store plus explicit opaque key/group extractors are supplied. */
+    requireSharedStore?: boolean;
+    /** Deterministic clock seam. Production callers normally omit it. */
+    clock?: () => number;
     /**
      * Beallitja-e a `X-RateLimit-Limit`, `X-RateLimit-Remaining`,
      * `X-RateLimit-Reset` (es a 429-re `Retry-After`) response header-eket.

package/build/_modules/rate-limit/_models/rate-limit-config.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit-config.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/rate-limit/_models/rate-limit-config.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAExC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAE3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAE5D;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CAClE"}
+{"version":3,"file":"rate-limit-config.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/rate-limit/_models/rate-limit-config.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAExC;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAE3C,sDAAsD;IACtD,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAEzC,4GAA4G;IAC5G,KAAK,CAAC,EAAE,+BAA+B,CAAC;IAExC,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAE5D;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CAClE"}

package/build/_modules/rate-limit/_models/rate-limit-consume-request.interface.d.ts

@@ -0,0 +1,9 @@
+import { DyNTS_RateLimit_Policy } from './rate-limit-policy.interface';
+/** Atomic permit request passed to a rate-limit store. */
+export interface DyNTS_RateLimit_ConsumeRequest_Interface {
+    bucketKey: string;
+    policy: DyNTS_RateLimit_Policy;
+    cost: number;
+    now: number;
+}
+//# sourceMappingURL=rate-limit-consume-request.interface.d.ts.map

package/build/_modules/rate-limit/_models/rate-limit-consume-request.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-consume-request.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/rate-limit/_models/rate-limit-consume-request.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,0DAA0D;AAC1D,MAAM,WAAW,wCAAwC;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb"}

package/build/_modules/rate-limit/_models/rate-limit-consume-request.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=rate-limit-consume-request.interface.js.map

package/build/_modules/rate-limit/_models/rate-limit-consume-request.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-consume-request.interface.js","sourceRoot":"","sources":["../../../../src/_modules/rate-limit/_models/rate-limit-consume-request.interface.ts"],"names":[],"mappings":""}

package/build/_modules/rate-limit/_models/rate-limit-consume-result.interface.d.ts

@@ -0,0 +1,7 @@
+/** Content-free result of one atomically committed permit request. */
+export interface DyNTS_RateLimit_ConsumeResult_Interface {
+    allowed: boolean;
+    remaining: number;
+    resetAt: number;
+}
+//# sourceMappingURL=rate-limit-consume-result.interface.d.ts.map

package/build/_modules/rate-limit/_models/rate-limit-consume-result.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-consume-result.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/rate-limit/_models/rate-limit-consume-result.interface.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,MAAM,WAAW,uCAAuC;IACtD,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB"}

package/build/_modules/rate-limit/_models/rate-limit-consume-result.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=rate-limit-consume-result.interface.js.map

package/build/_modules/rate-limit/_models/rate-limit-consume-result.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-consume-result.interface.js","sourceRoot":"","sources":["../../../../src/_modules/rate-limit/_models/rate-limit-consume-result.interface.ts"],"names":[],"mappings":""}

package/build/_modules/rate-limit/_models/rate-limit-store.interface.d.ts

@@ -0,0 +1,9 @@
+import { DyNTS_RateLimitStoreKind_Type } from '../_enums/rate-limit-store-kind.type-enum';
+import { DyNTS_RateLimit_ConsumeRequest_Interface } from './rate-limit-consume-request.interface';
+import { DyNTS_RateLimit_ConsumeResult_Interface } from './rate-limit-consume-result.interface';
+/** Atomic persistence seam. Production hosts can require `shared` scope at configuration time. */
+export interface DyNTS_RateLimit_Store_Interface {
+    readonly storeKind: DyNTS_RateLimitStoreKind_Type;
+    consume(request: DyNTS_RateLimit_ConsumeRequest_Interface): Promise<DyNTS_RateLimit_ConsumeResult_Interface>;
+}
+//# sourceMappingURL=rate-limit-store.interface.d.ts.map

package/build/_modules/rate-limit/_models/rate-limit-store.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-store.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/rate-limit/_models/rate-limit-store.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAEhG,kGAAkG;AAClG,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,wCAAwC,GAAG,OAAO,CAAC,uCAAuC,CAAC,CAAC;CAC9G"}

package/build/_modules/rate-limit/_models/rate-limit-store.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=rate-limit-store.interface.js.map

package/build/_modules/rate-limit/_models/rate-limit-store.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-store.interface.js","sourceRoot":"","sources":["../../../../src/_modules/rate-limit/_models/rate-limit-store.interface.ts"],"names":[],"mappings":""}

package/build/_modules/rate-limit/index.d.ts

@@ -1,4 +1,9 @@
 export { DyNTS_RateLimit_Middleware } from './rate-limit.middleware';
+export { DyNTS_RateLimit_InMemoryStore } from './rate-limit-in-memory.store';
 export { DyNTS_RateLimit_Config } from './_models/rate-limit-config.interface';
+export { DyNTS_RateLimit_ConsumeRequest_Interface } from './_models/rate-limit-consume-request.interface';
+export { DyNTS_RateLimit_ConsumeResult_Interface } from './_models/rate-limit-consume-result.interface';
 export { DyNTS_RateLimit_Policy } from './_models/rate-limit-policy.interface';
+export { DyNTS_RateLimit_Store_Interface } from './_models/rate-limit-store.interface';
+export { DyNTS_RateLimitStoreKind_Type } from './_enums/rate-limit-store-kind.type-enum';
 //# sourceMappingURL=index.d.ts.map

package/build/_modules/rate-limit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/_modules/rate-limit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/_modules/rate-limit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC"}

package/build/_modules/rate-limit/index.js

@@ -1,6 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DyNTS_RateLimit_Middleware = void 0;
+exports.DyNTS_RateLimitStoreKind_Type = exports.DyNTS_RateLimit_InMemoryStore = exports.DyNTS_RateLimit_Middleware = void 0;
 var rate_limit_middleware_1 = require("./rate-limit.middleware");
 Object.defineProperty(exports, "DyNTS_RateLimit_Middleware", { enumerable: true, get: function () { return rate_limit_middleware_1.DyNTS_RateLimit_Middleware; } });
+var rate_limit_in_memory_store_1 = require("./rate-limit-in-memory.store");
+Object.defineProperty(exports, "DyNTS_RateLimit_InMemoryStore", { enumerable: true, get: function () { return rate_limit_in_memory_store_1.DyNTS_RateLimit_InMemoryStore; } });
+var rate_limit_store_kind_type_enum_1 = require("./_enums/rate-limit-store-kind.type-enum");
+Object.defineProperty(exports, "DyNTS_RateLimitStoreKind_Type", { enumerable: true, get: function () { return rate_limit_store_kind_type_enum_1.DyNTS_RateLimitStoreKind_Type; } });
 //# sourceMappingURL=index.js.map

package/build/_modules/rate-limit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/_modules/rate-limit/index.ts"],"names":[],"mappings":";;;AAAA,iEAAqE;AAA5D,mIAAA,0BAA0B,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/_modules/rate-limit/index.ts"],"names":[],"mappings":";;;AAAA,iEAAqE;AAA5D,mIAAA,0BAA0B,OAAA;AACnC,2EAA6E;AAApE,2IAAA,6BAA6B,OAAA;AAMtC,4FAAyF;AAAhF,gJAAA,6BAA6B,OAAA"}

package/build/_modules/rate-limit/rate-limit-in-memory.store.d.ts

@@ -0,0 +1,19 @@
+import { DyNTS_RateLimitStoreKind_Type } from './_enums/rate-limit-store-kind.type-enum';
+import { DyNTS_RateLimit_ConsumeRequest_Interface } from './_models/rate-limit-consume-request.interface';
+import { DyNTS_RateLimit_ConsumeResult_Interface } from './_models/rate-limit-consume-result.interface';
+import { DyNTS_RateLimit_Store_Interface } from './_models/rate-limit-store.interface';
+/** Deterministic single-process store for tests and explicitly single-instance development. */
+export declare class DyNTS_RateLimit_InMemoryStore implements DyNTS_RateLimit_Store_Interface {
+    readonly storeKind: DyNTS_RateLimitStoreKind_Type;
+    private readonly records;
+    /** Consumes permit units with exact sliding-window semantics and no background cleanup task. */
+    consume(request: DyNTS_RateLimit_ConsumeRequest_Interface): Promise<DyNTS_RateLimit_ConsumeResult_Interface>;
+    /** Opportunistically removes expired local records when explicitly invoked by the host. */
+    cleanup(now: number): void;
+    /** Clears all local state for deterministic tests. */
+    reset(): void;
+    /** Returns only the aggregate local bucket count for diagnostics. */
+    getTrackedBucketCount(): number;
+    private assertRequest;
+}
+//# sourceMappingURL=rate-limit-in-memory.store.d.ts.map

package/build/_modules/rate-limit/rate-limit-in-memory.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-in-memory.store.d.ts","sourceRoot":"","sources":["../../../src/_modules/rate-limit/rate-limit-in-memory.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAOvF,+FAA+F;AAC/F,qBAAa,6BAA8B,YAAW,+BAA+B;IACnF,SAAgB,SAAS,EAAE,6BAA6B,CAA0C;IAClG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoE;IAE5F,gGAAgG;IACnF,OAAO,CAClB,OAAO,EAAE,wCAAwC,GAChD,OAAO,CAAC,uCAAuC,CAAC;IA4BnD,2FAA2F;IACpF,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAgBjC,sDAAsD;IAC/C,KAAK,IAAI,IAAI;IAIpB,qEAAqE;IAC9D,qBAAqB,IAAI,MAAM;IAItC,OAAO,CAAC,aAAa;CAiBtB"}

package/build/_modules/rate-limit/rate-limit-in-memory.store.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_RateLimit_InMemoryStore = void 0;
+const rate_limit_store_kind_type_enum_1 = require("./_enums/rate-limit-store-kind.type-enum");
+/** Deterministic single-process store for tests and explicitly single-instance development. */
+class DyNTS_RateLimit_InMemoryStore {
+    storeKind = rate_limit_store_kind_type_enum_1.DyNTS_RateLimitStoreKind_Type.inMemory;
+    records = new Map();
+    /** Consumes permit units with exact sliding-window semantics and no background cleanup task. */
+    async consume(request) {
+        this.assertRequest(request);
+        const windowStart = request.now - request.policy.windowMs;
+        const existing = this.records.get(request.bucketKey);
+        const recent = (existing?.timestamps ?? []).filter((timestamp) => timestamp > windowStart);
+        const allowed = recent.length + request.cost <= request.policy.limit;
+        if (allowed) {
+            for (let index = 0; index < request.cost; index += 1) {
+                recent.push(request.now);
+            }
+        }
+        this.records.set(request.bucketKey, {
+            timestamps: recent,
+            windowMs: request.policy.windowMs,
+        });
+        return {
+            allowed: allowed,
+            remaining: Math.max(0, request.policy.limit - recent.length),
+            resetAt: (recent[0] ?? request.now) + request.policy.windowMs,
+        };
+    }
+    /** Opportunistically removes expired local records when explicitly invoked by the host. */
+    cleanup(now) {
+        for (const entry of this.records.entries()) {
+            const key = entry[0];
+            const record = entry[1];
+            const recent = record.timestamps.filter((timestamp) => timestamp > now - record.windowMs);
+            if (!recent.length) {
+                this.records.delete(key);
+            }
+            else {
+                this.records.set(key, { ...record, timestamps: recent });
+            }
+        }
+    }
+    /** Clears all local state for deterministic tests. */
+    reset() {
+        this.records.clear();
+    }
+    /** Returns only the aggregate local bucket count for diagnostics. */
+    getTrackedBucketCount() {
+        return this.records.size;
+    }
+    assertRequest(request) {
+        const isValid = Boolean(request.bucketKey.trim())
+            && request.bucketKey.length <= 512
+            && Number.isSafeInteger(request.now)
+            && request.now >= 0
+            && Number.isSafeInteger(request.cost)
+            && request.cost > 0
+            && Number.isSafeInteger(request.policy.limit)
+            && request.policy.limit > 0
+            && Number.isSafeInteger(request.policy.windowMs)
+            && request.policy.windowMs > 0
+            && request.cost <= request.policy.limit;
+        if (!isValid) {
+            throw new Error('DYNTS_RATE_LIMIT_STORE_REQUEST_INVALID');
+        }
+    }
+}
+exports.DyNTS_RateLimit_InMemoryStore = DyNTS_RateLimit_InMemoryStore;
+//# sourceMappingURL=rate-limit-in-memory.store.js.map

package/build/_modules/rate-limit/rate-limit-in-memory.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-in-memory.store.js","sourceRoot":"","sources":["../../../src/_modules/rate-limit/rate-limit-in-memory.store.ts"],"names":[],"mappings":";;;AAAA,8FAAyF;AAUzF,+FAA+F;AAC/F,MAAa,6BAA6B;IACxB,SAAS,GAAkC,+DAA6B,CAAC,QAAQ,CAAC;IACjF,OAAO,GAA0D,IAAI,GAAG,EAAE,CAAC;IAE5F,gGAAgG;IACzF,KAAK,CAAC,OAAO,CAClB,OAAiD;QAEjD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAE5B,MAAM,WAAW,GAAW,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QAClE,MAAM,QAAQ,GAAyD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3G,MAAM,MAAM,GAAa,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAC1D,CAAC,SAAiB,EAAW,EAAE,CAAC,SAAS,GAAG,WAAW,CACxD,CAAC;QACF,MAAM,OAAO,GAAY,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAE9E,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,IAAI,KAAK,GAAW,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE;YAClC,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;SAClC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5D,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ;SAC9D,CAAC;IACJ,CAAC;IAED,2FAA2F;IACpF,OAAO,CAAC,GAAW;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAW,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,MAAM,GAA6C,KAAK,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,MAAM,GAAa,MAAM,CAAC,UAAU,CAAC,MAAM,CAC/C,CAAC,SAAiB,EAAW,EAAE,CAAC,SAAS,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,CAClE,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,sDAAsD;IAC/C,KAAK;QACV,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,qEAAqE;IAC9D,qBAAqB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAEO,aAAa,CAAC,OAAiD;QACrE,MAAM,OAAO,GAAY,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;eACrD,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,GAAG;eAC/B,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;eACjC,OAAO,CAAC,GAAG,IAAI,CAAC;eAChB,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC;eAClC,OAAO,CAAC,IAAI,GAAG,CAAC;eAChB,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;eAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC;eACxB,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;eAC7C,OAAO,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC;eAC3B,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAE1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;CACF;AA/ED,sEA+EC"}