@futdevpro/nts-dynamo 1.15.154 → 1.15.156

package/build/_modules/rate-limit/rate-limit.middleware.js

@@ -1,379 +1,379 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DyNTS_RateLimit_Middleware = void 0;
-const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
-const global_settings_const_1 = require("../../_collections/global-settings.const");
-const singleton_service_base_1 = require("../../_services/base/singleton.service-base");
-const rate_limit_store_kind_type_enum_1 = require("./_enums/rate-limit-store-kind.type-enum");
-const rate_limit_in_memory_store_1 = require("./rate-limit-in-memory.store");
-const DEFAULT_LIMIT = 100;
-const DEFAULT_WINDOW_MS = 60_000;
-const DEFAULT_RESPONSE_HEADERS = true;
-const MAX_LIMIT = 1_000_000;
-const MAX_WINDOW_MS = 7 * 24 * 60 * 60 * 1_000;
-const MAX_BUCKET_PART_LENGTH = 240;
-const SERVICE_NAME = 'DyNTS_RateLimit_Middleware';
-/** Atomic HTTP rate-limit boundary with an explicit shared-store production gate. */
-class DyNTS_RateLimit_Middleware extends singleton_service_base_1.DyNTS_SingletonServiceBase {
-    defaultLimit = DEFAULT_LIMIT;
-    defaultWindowMs = DEFAULT_WINDOW_MS;
-    isResponseHeadersEnabled = DEFAULT_RESPONSE_HEADERS;
-    isSharedStoreRequired = false;
-    isKeyExtractorExplicit = false;
-    isEndpointGrouperExplicit = false;
-    keyExtractor = (req) => req.ip ?? 'unknown';
-    endpointGrouper = (req) => req.path;
-    costExtractor = (req) => {
-        void req;
-        return 1;
-    };
-    clock = () => Date.now();
-    store = new rate_limit_in_memory_store_1.DyNTS_RateLimit_InMemoryStore();
-    keyPolicies = new Map();
-    endpointPolicies = new Map();
-    /** Returns the process-wide rate-limit middleware. */
-    static getInstance() {
-        return DyNTS_RateLimit_Middleware.getSingletonInstance();
-    }
-    /** Applies a validated configuration atomically; invalid settings do not partially mutate the service. */
-    configure(config) {
-        const snapshot = this.buildConfigSnapshot(config);
-        this.defaultLimit = snapshot.defaultLimit;
-        this.defaultWindowMs = snapshot.defaultWindowMs;
-        this.isResponseHeadersEnabled = snapshot.isResponseHeadersEnabled;
-        this.isSharedStoreRequired = snapshot.isSharedStoreRequired;
-        this.keyExtractor = snapshot.keyExtractor;
-        this.endpointGrouper = snapshot.endpointGrouper;
-        this.costExtractor = snapshot.costExtractor;
-        this.clock = snapshot.clock;
-        this.store = snapshot.store;
-        this.isKeyExtractorExplicit = snapshot.isKeyExtractorExplicit;
-        this.isEndpointGrouperExplicit = snapshot.isEndpointGrouperExplicit;
-        this.keyPolicies = snapshot.keyPolicies;
-        this.endpointPolicies = snapshot.endpointPolicies;
-    }
-    /** Returns content-free configuration diagnostics. */
-    getConfig() {
-        return {
-            defaultLimit: this.defaultLimit,
-            defaultWindowMs: this.defaultWindowMs,
-            responseHeaders: this.isResponseHeadersEnabled,
-            activeKeyPolicies: this.keyPolicies.size,
-            activeEndpointPolicies: this.endpointPolicies.size,
-            trackedStorageKeys: this.store instanceof rate_limit_in_memory_store_1.DyNTS_RateLimit_InMemoryStore
-                ? this.store.getTrackedBucketCount()
-                : 0,
-            storeKind: this.store.storeKind,
-            requireSharedStore: this.isSharedStoreRequired,
-        };
-    }
-    /** Sets one validated subject policy. */
-    setPolicyForKey(key, policy) {
-        this.assertBucketPart(key);
-        this.assertPolicy(policy);
-        this.keyPolicies.set(key, { ...policy });
-    }
-    /** Removes one subject policy. */
-    clearPolicyForKey(key) {
-        this.keyPolicies.delete(key);
-    }
-    /** Sets one validated endpoint-group policy. */
-    setPolicyForEndpoint(endpoint, policy) {
-        this.assertBucketPart(endpoint);
-        this.assertPolicy(policy);
-        this.endpointPolicies.set(endpoint, { ...policy });
-    }
-    /** Removes one endpoint-group policy. */
-    clearPolicyForEndpoint(endpoint) {
-        this.endpointPolicies.delete(endpoint);
-    }
-    /** Atomically consumes one request permit or raises a stable content-free error. */
-    check = async (req, res) => {
-        const subject = this.extractBucketPart(this.keyExtractor, req);
-        const endpoint = this.extractBucketPart(this.endpointGrouper, req);
-        const cost = this.extractCost(req);
-        const policy = this.keyPolicies.get(subject)
-            ?? this.endpointPolicies.get(endpoint)
-            ?? { limit: this.defaultLimit, windowMs: this.defaultWindowMs };
-        this.assertPolicy(policy);
-        this.assertCost(cost, policy);
-        const now = this.getNow();
-        let result;
-        try {
-            result = await this.store.consume({
-                bucketKey: this.buildBucketKey(subject, endpoint),
-                policy: policy,
-                cost: cost,
-                now: now,
-            });
-        }
-        catch {
-            this.throwRateLimitError({
-                status: 503,
-                subcode: 'STORE_UNAVAILABLE',
-                message: 'The configured rate-limit store could not commit a permit decision.',
-                userMessage: 'Request protection is temporarily unavailable. Please try again later.',
-            });
-        }
-        this.assertStoreResult(result, policy, now);
-        this.setResponseHeaders(res, {
-            policy: policy,
-            result: result,
-            now: now,
-        });
-        if (!result.allowed) {
-            const retryAfterSeconds = this.getRetryAfterSeconds(result.resetAt, now);
-            this.throwRateLimitError({
-                status: 429,
-                subcode: 'LIMIT',
-                message: 'The rate-limit policy rejected a request.',
-                userMessage: `Too many requests. Retry after ${retryAfterSeconds} seconds.`,
-            });
-        }
-    };
-    /** Performs explicit opportunistic cleanup only for the local test/development store. */
-    runGc() {
-        if (this.store instanceof rate_limit_in_memory_store_1.DyNTS_RateLimit_InMemoryStore) {
-            this.store.cleanup(this.clock());
-        }
-    }
-    /** Backward-compatible no-op: this implementation never starts a timer. */
-    stopGcTimer() { }
-    /** Resets all state to deterministic local defaults for tests. */
-    _resetForTesting() {
-        this.defaultLimit = DEFAULT_LIMIT;
-        this.defaultWindowMs = DEFAULT_WINDOW_MS;
-        this.isResponseHeadersEnabled = DEFAULT_RESPONSE_HEADERS;
-        this.isSharedStoreRequired = false;
-        this.isKeyExtractorExplicit = false;
-        this.isEndpointGrouperExplicit = false;
-        this.keyExtractor = (req) => req.ip ?? 'unknown';
-        this.endpointGrouper = (req) => req.path;
-        this.costExtractor = (req) => {
-            void req;
-            return 1;
-        };
-        this.clock = () => Date.now();
-        this.store = new rate_limit_in_memory_store_1.DyNTS_RateLimit_InMemoryStore();
-        this.keyPolicies.clear();
-        this.endpointPolicies.clear();
-    }
-    buildConfigSnapshot(config) {
-        const defaultLimit = config.defaultLimit ?? this.defaultLimit;
-        const defaultWindowMs = config.defaultWindowMs ?? this.defaultWindowMs;
-        const store = config.store ?? this.store;
-        const isSharedStoreRequired = config.requireSharedStore ?? this.isSharedStoreRequired;
-        const isKeyExtractorExplicit = config.keyExtractor !== undefined || this.isKeyExtractorExplicit;
-        const isEndpointGrouperExplicit = config.endpointGrouper !== undefined
-            || this.isEndpointGrouperExplicit;
-        const keyPolicies = new Map(this.keyPolicies);
-        const endpointPolicies = new Map(this.endpointPolicies);
-        this.assertPolicy({ limit: defaultLimit, windowMs: defaultWindowMs });
-        this.assertConfigurationFunctions(config);
-        this.assertStore(store);
-        this.addInitialPolicies(keyPolicies, config.initialKeyPolicies);
-        this.addInitialPolicies(endpointPolicies, config.initialEndpointPolicies);
-        if (isSharedStoreRequired
-            && (store.storeKind !== rate_limit_store_kind_type_enum_1.DyNTS_RateLimitStoreKind_Type.shared
-                || !isKeyExtractorExplicit
-                || !isEndpointGrouperExplicit)) {
-            this.throwRateLimitError({
-                status: 500,
-                subcode: 'SHARED_STORE_REQUIRED',
-                message: 'Production rate limiting requires a shared store and explicit opaque bucket extractors.',
-                userMessage: 'Request protection is not configured.',
-            });
-        }
-        return {
-            defaultLimit: defaultLimit,
-            defaultWindowMs: defaultWindowMs,
-            isResponseHeadersEnabled: config.responseHeaders ?? this.isResponseHeadersEnabled,
-            isSharedStoreRequired: isSharedStoreRequired,
-            keyExtractor: config.keyExtractor ?? this.keyExtractor,
-            endpointGrouper: config.endpointGrouper ?? this.endpointGrouper,
-            costExtractor: config.costExtractor ?? this.costExtractor,
-            clock: config.clock ?? this.clock,
-            store: store,
-            isKeyExtractorExplicit: isKeyExtractorExplicit,
-            isEndpointGrouperExplicit: isEndpointGrouperExplicit,
-            keyPolicies: keyPolicies,
-            endpointPolicies: endpointPolicies,
-        };
-    }
-    addInitialPolicies(target, policies) {
-        if (!policies) {
-            return;
-        }
-        for (const entry of Object.entries(policies)) {
-            const key = entry[0];
-            const policy = entry[1];
-            this.assertBucketPart(key);
-            this.assertPolicy(policy);
-            target.set(key, { ...policy });
-        }
-    }
-    assertPolicy(policy) {
-        if (!Number.isSafeInteger(policy.limit)
-            || policy.limit <= 0
-            || policy.limit > MAX_LIMIT
-            || !Number.isSafeInteger(policy.windowMs)
-            || policy.windowMs <= 0
-            || policy.windowMs > MAX_WINDOW_MS) {
-            this.throwRateLimitError({
-                status: 500,
-                subcode: 'POLICY_INVALID',
-                message: 'A rate-limit policy is outside the supported safety bounds.',
-                userMessage: 'Request protection is not configured.',
-            });
-        }
-    }
-    assertCost(cost, policy) {
-        if (!Number.isSafeInteger(cost) || cost <= 0 || cost > policy.limit) {
-            this.throwRateLimitError({
-                status: 500,
-                subcode: 'COST_INVALID',
-                message: 'A rate-limit request cost is outside the active policy.',
-                userMessage: 'Request protection is not configured.',
-            });
-        }
-    }
-    assertConfigurationFunctions(config) {
-        const hasInvalidFunction = (config.keyExtractor !== undefined && typeof config.keyExtractor !== 'function') || (config.endpointGrouper !== undefined && typeof config.endpointGrouper !== 'function') || (config.costExtractor !== undefined && typeof config.costExtractor !== 'function') || (config.clock !== undefined && typeof config.clock !== 'function');
-        if (hasInvalidFunction) {
-            this.throwRateLimitError({
-                status: 500,
-                subcode: 'CONFIG_INVALID',
-                message: 'A rate-limit configuration callback is invalid.',
-                userMessage: 'Request protection is not configured.',
-            });
-        }
-    }
-    assertStore(store) {
-        const hasKnownKind = store?.storeKind === rate_limit_store_kind_type_enum_1.DyNTS_RateLimitStoreKind_Type.inMemory
-            || store?.storeKind === rate_limit_store_kind_type_enum_1.DyNTS_RateLimitStoreKind_Type.shared;
-        if (!hasKnownKind || typeof store.consume !== 'function') {
-            this.throwRateLimitError({
-                status: 500,
-                subcode: 'STORE_INVALID',
-                message: 'The configured rate-limit store does not satisfy the Bedrock contract.',
-                userMessage: 'Request protection is not configured.',
-            });
-        }
-    }
-    extractBucketPart(extractor, req) {
-        let value;
-        try {
-            value = extractor(req);
-        }
-        catch {
-            value = undefined;
-        }
-        if (typeof value !== 'string') {
-            this.throwBucketKeyInvalid();
-        }
-        const normalized = value.trim();
-        this.assertBucketPart(normalized);
-        return normalized;
-    }
-    extractCost(req) {
-        try {
-            return this.costExtractor(req);
-        }
-        catch {
-            this.throwRateLimitError({
-                status: 500,
-                subcode: 'COST_INVALID',
-                message: 'The rate-limit request cost could not be derived.',
-                userMessage: 'Request protection is not configured.',
-            });
-        }
-    }
-    buildBucketKey(subject, endpoint) {
-        return `${subject.length}:${subject}${endpoint.length}:${endpoint}`;
-    }
-    getNow() {
-        let now;
-        try {
-            now = this.clock();
-        }
-        catch {
-            now = undefined;
-        }
-        if (!Number.isSafeInteger(now) || typeof now !== 'number' || now < 0) {
-            this.throwRateLimitError({
-                status: 503,
-                subcode: 'CLOCK_INVALID',
-                message: 'The rate-limit clock returned an invalid timestamp.',
-                userMessage: 'Request protection is temporarily unavailable. Please try again later.',
-            });
-        }
-        return now;
-    }
-    assertBucketPart(value) {
-        if (!value || value.length > MAX_BUCKET_PART_LENGTH) {
-            this.throwBucketKeyInvalid();
-        }
-    }
-    throwBucketKeyInvalid() {
-        this.throwRateLimitError({
-            status: 500,
-            subcode: 'BUCKET_KEY_INVALID',
-            message: 'A rate-limit bucket component is missing, invalid or too large.',
-            userMessage: 'Request protection is not configured.',
-        });
-    }
-    assertStoreResult(result, policy, now) {
-        const isValid = typeof result === 'object'
-            && result !== null
-            && 'allowed' in result
-            && 'remaining' in result
-            && 'resetAt' in result
-            && typeof result.allowed === 'boolean'
-            && typeof result.remaining === 'number'
-            && Number.isSafeInteger(result.remaining)
-            && result.remaining >= 0
-            && result.remaining <= policy.limit
-            && typeof result.resetAt === 'number'
-            && Number.isSafeInteger(result.resetAt)
-            && result.resetAt >= now;
-        if (!isValid) {
-            this.throwRateLimitError({
-                status: 503,
-                subcode: 'STORE_RESULT_INVALID',
-                message: 'The rate-limit store returned an invalid permit decision.',
-                userMessage: 'Request protection is temporarily unavailable. Please try again later.',
-            });
-        }
-    }
-    setResponseHeaders(res, context) {
-        if (!this.isResponseHeadersEnabled) {
-            return;
-        }
-        const resetSeconds = Math.ceil(context.result.resetAt / 1_000).toString();
-        res.setHeader('X-RateLimit-Limit', context.policy.limit.toString());
-        res.setHeader('X-RateLimit-Remaining', context.result.remaining.toString());
-        res.setHeader('X-RateLimit-Reset', resetSeconds);
-        res.setHeader('RateLimit-Limit', context.policy.limit.toString());
-        res.setHeader('RateLimit-Remaining', context.result.remaining.toString());
-        res.setHeader('RateLimit-Reset', Math.max(0, Math.ceil((context.result.resetAt - context.now) / 1_000)).toString());
-        if (!context.result.allowed) {
-            res.setHeader('Retry-After', this.getRetryAfterSeconds(context.result.resetAt, context.now).toString());
-        }
-    }
-    getRetryAfterSeconds(resetAt, now) {
-        return Math.max(1, Math.ceil((resetAt - now) / 1_000));
-    }
-    throwRateLimitError(context) {
-        const systemShortCode = global_settings_const_1.DyNTS_global_settings.systemShortCodeName ?? 'DyNTS';
-        throw new fsm_dynamo_1.DyFM_Error({
-            status: context.status,
-            errorCode: `${systemShortCode}|DyNTS-RL-${context.subcode}`,
-            addECToUserMsg: true,
-            message: context.message,
-            userMessage: context.userMessage,
-            issuerService: SERVICE_NAME,
-        });
-    }
-}
-exports.DyNTS_RateLimit_Middleware = DyNTS_RateLimit_Middleware;
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_RateLimit_Middleware = void 0;
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const global_settings_const_1 = require("../../_collections/global-settings.const");
+const singleton_service_base_1 = require("../../_services/base/singleton.service-base");
+const rate_limit_store_kind_type_enum_1 = require("./_enums/rate-limit-store-kind.type-enum");
+const rate_limit_in_memory_store_1 = require("./rate-limit-in-memory.store");
+const DEFAULT_LIMIT = 100;
+const DEFAULT_WINDOW_MS = 60_000;
+const DEFAULT_RESPONSE_HEADERS = true;
+const MAX_LIMIT = 1_000_000;
+const MAX_WINDOW_MS = 7 * 24 * 60 * 60 * 1_000;
+const MAX_BUCKET_PART_LENGTH = 240;
+const SERVICE_NAME = 'DyNTS_RateLimit_Middleware';
+/** Atomic HTTP rate-limit boundary with an explicit shared-store production gate. */
+class DyNTS_RateLimit_Middleware extends singleton_service_base_1.DyNTS_SingletonServiceBase {
+    defaultLimit = DEFAULT_LIMIT;
+    defaultWindowMs = DEFAULT_WINDOW_MS;
+    isResponseHeadersEnabled = DEFAULT_RESPONSE_HEADERS;
+    isSharedStoreRequired = false;
+    isKeyExtractorExplicit = false;
+    isEndpointGrouperExplicit = false;
+    keyExtractor = (req) => req.ip ?? 'unknown';
+    endpointGrouper = (req) => req.path;
+    costExtractor = (req) => {
+        void req;
+        return 1;
+    };
+    clock = () => Date.now();
+    store = new rate_limit_in_memory_store_1.DyNTS_RateLimit_InMemoryStore();
+    keyPolicies = new Map();
+    endpointPolicies = new Map();
+    /** Returns the process-wide rate-limit middleware. */
+    static getInstance() {
+        return DyNTS_RateLimit_Middleware.getSingletonInstance();
+    }
+    /** Applies a validated configuration atomically; invalid settings do not partially mutate the service. */
+    configure(config) {
+        const snapshot = this.buildConfigSnapshot(config);
+        this.defaultLimit = snapshot.defaultLimit;
+        this.defaultWindowMs = snapshot.defaultWindowMs;
+        this.isResponseHeadersEnabled = snapshot.isResponseHeadersEnabled;
+        this.isSharedStoreRequired = snapshot.isSharedStoreRequired;
+        this.keyExtractor = snapshot.keyExtractor;
+        this.endpointGrouper = snapshot.endpointGrouper;
+        this.costExtractor = snapshot.costExtractor;
+        this.clock = snapshot.clock;
+        this.store = snapshot.store;
+        this.isKeyExtractorExplicit = snapshot.isKeyExtractorExplicit;
+        this.isEndpointGrouperExplicit = snapshot.isEndpointGrouperExplicit;
+        this.keyPolicies = snapshot.keyPolicies;
+        this.endpointPolicies = snapshot.endpointPolicies;
+    }
+    /** Returns content-free configuration diagnostics. */
+    getConfig() {
+        return {
+            defaultLimit: this.defaultLimit,
+            defaultWindowMs: this.defaultWindowMs,
+            responseHeaders: this.isResponseHeadersEnabled,
+            activeKeyPolicies: this.keyPolicies.size,
+            activeEndpointPolicies: this.endpointPolicies.size,
+            trackedStorageKeys: this.store instanceof rate_limit_in_memory_store_1.DyNTS_RateLimit_InMemoryStore
+                ? this.store.getTrackedBucketCount()
+                : 0,
+            storeKind: this.store.storeKind,
+            requireSharedStore: this.isSharedStoreRequired,
+        };
+    }
+    /** Sets one validated subject policy. */
+    setPolicyForKey(key, policy) {
+        this.assertBucketPart(key);
+        this.assertPolicy(policy);
+        this.keyPolicies.set(key, { ...policy });
+    }
+    /** Removes one subject policy. */
+    clearPolicyForKey(key) {
+        this.keyPolicies.delete(key);
+    }
+    /** Sets one validated endpoint-group policy. */
+    setPolicyForEndpoint(endpoint, policy) {
+        this.assertBucketPart(endpoint);
+        this.assertPolicy(policy);
+        this.endpointPolicies.set(endpoint, { ...policy });
+    }
+    /** Removes one endpoint-group policy. */
+    clearPolicyForEndpoint(endpoint) {
+        this.endpointPolicies.delete(endpoint);
+    }
+    /** Atomically consumes one request permit or raises a stable content-free error. */
+    check = async (req, res) => {
+        const subject = this.extractBucketPart(this.keyExtractor, req);
+        const endpoint = this.extractBucketPart(this.endpointGrouper, req);
+        const cost = this.extractCost(req);
+        const policy = this.keyPolicies.get(subject)
+            ?? this.endpointPolicies.get(endpoint)
+            ?? { limit: this.defaultLimit, windowMs: this.defaultWindowMs };
+        this.assertPolicy(policy);
+        this.assertCost(cost, policy);
+        const now = this.getNow();
+        let result;
+        try {
+            result = await this.store.consume({
+                bucketKey: this.buildBucketKey(subject, endpoint),
+                policy: policy,
+                cost: cost,
+                now: now,
+            });
+        }
+        catch {
+            this.throwRateLimitError({
+                status: 503,
+                subcode: 'STORE_UNAVAILABLE',
+                message: 'The configured rate-limit store could not commit a permit decision.',
+                userMessage: 'Request protection is temporarily unavailable. Please try again later.',
+            });
+        }
+        this.assertStoreResult(result, policy, now);
+        this.setResponseHeaders(res, {
+            policy: policy,
+            result: result,
+            now: now,
+        });
+        if (!result.allowed) {
+            const retryAfterSeconds = this.getRetryAfterSeconds(result.resetAt, now);
+            this.throwRateLimitError({
+                status: 429,
+                subcode: 'LIMIT',
+                message: 'The rate-limit policy rejected a request.',
+                userMessage: `Too many requests. Retry after ${retryAfterSeconds} seconds.`,
+            });
+        }
+    };
+    /** Performs explicit opportunistic cleanup only for the local test/development store. */
+    runGc() {
+        if (this.store instanceof rate_limit_in_memory_store_1.DyNTS_RateLimit_InMemoryStore) {
+            this.store.cleanup(this.clock());
+        }
+    }
+    /** Backward-compatible no-op: this implementation never starts a timer. */
+    stopGcTimer() { }
+    /** Resets all state to deterministic local defaults for tests. */
+    _resetForTesting() {
+        this.defaultLimit = DEFAULT_LIMIT;
+        this.defaultWindowMs = DEFAULT_WINDOW_MS;
+        this.isResponseHeadersEnabled = DEFAULT_RESPONSE_HEADERS;
+        this.isSharedStoreRequired = false;
+        this.isKeyExtractorExplicit = false;
+        this.isEndpointGrouperExplicit = false;
+        this.keyExtractor = (req) => req.ip ?? 'unknown';
+        this.endpointGrouper = (req) => req.path;
+        this.costExtractor = (req) => {
+            void req;
+            return 1;
+        };
+        this.clock = () => Date.now();
+        this.store = new rate_limit_in_memory_store_1.DyNTS_RateLimit_InMemoryStore();
+        this.keyPolicies.clear();
+        this.endpointPolicies.clear();
+    }
+    buildConfigSnapshot(config) {
+        const defaultLimit = config.defaultLimit ?? this.defaultLimit;
+        const defaultWindowMs = config.defaultWindowMs ?? this.defaultWindowMs;
+        const store = config.store ?? this.store;
+        const isSharedStoreRequired = config.requireSharedStore ?? this.isSharedStoreRequired;
+        const isKeyExtractorExplicit = config.keyExtractor !== undefined || this.isKeyExtractorExplicit;
+        const isEndpointGrouperExplicit = config.endpointGrouper !== undefined
+            || this.isEndpointGrouperExplicit;
+        const keyPolicies = new Map(this.keyPolicies);
+        const endpointPolicies = new Map(this.endpointPolicies);
+        this.assertPolicy({ limit: defaultLimit, windowMs: defaultWindowMs });
+        this.assertConfigurationFunctions(config);
+        this.assertStore(store);
+        this.addInitialPolicies(keyPolicies, config.initialKeyPolicies);
+        this.addInitialPolicies(endpointPolicies, config.initialEndpointPolicies);
+        if (isSharedStoreRequired
+            && (store.storeKind !== rate_limit_store_kind_type_enum_1.DyNTS_RateLimitStoreKind_Type.shared
+                || !isKeyExtractorExplicit
+                || !isEndpointGrouperExplicit)) {
+            this.throwRateLimitError({
+                status: 500,
+                subcode: 'SHARED_STORE_REQUIRED',
+                message: 'Production rate limiting requires a shared store and explicit opaque bucket extractors.',
+                userMessage: 'Request protection is not configured.',
+            });
+        }
+        return {
+            defaultLimit: defaultLimit,
+            defaultWindowMs: defaultWindowMs,
+            isResponseHeadersEnabled: config.responseHeaders ?? this.isResponseHeadersEnabled,
+            isSharedStoreRequired: isSharedStoreRequired,
+            keyExtractor: config.keyExtractor ?? this.keyExtractor,
+            endpointGrouper: config.endpointGrouper ?? this.endpointGrouper,
+            costExtractor: config.costExtractor ?? this.costExtractor,
+            clock: config.clock ?? this.clock,
+            store: store,
+            isKeyExtractorExplicit: isKeyExtractorExplicit,
+            isEndpointGrouperExplicit: isEndpointGrouperExplicit,
+            keyPolicies: keyPolicies,
+            endpointPolicies: endpointPolicies,
+        };
+    }
+    addInitialPolicies(target, policies) {
+        if (!policies) {
+            return;
+        }
+        for (const entry of Object.entries(policies)) {
+            const key = entry[0];
+            const policy = entry[1];
+            this.assertBucketPart(key);
+            this.assertPolicy(policy);
+            target.set(key, { ...policy });
+        }
+    }
+    assertPolicy(policy) {
+        if (!Number.isSafeInteger(policy.limit)
+            || policy.limit <= 0
+            || policy.limit > MAX_LIMIT
+            || !Number.isSafeInteger(policy.windowMs)
+            || policy.windowMs <= 0
+            || policy.windowMs > MAX_WINDOW_MS) {
+            this.throwRateLimitError({
+                status: 500,
+                subcode: 'POLICY_INVALID',
+                message: 'A rate-limit policy is outside the supported safety bounds.',
+                userMessage: 'Request protection is not configured.',
+            });
+        }
+    }
+    assertCost(cost, policy) {
+        if (!Number.isSafeInteger(cost) || cost <= 0 || cost > policy.limit) {
+            this.throwRateLimitError({
+                status: 500,
+                subcode: 'COST_INVALID',
+                message: 'A rate-limit request cost is outside the active policy.',
+                userMessage: 'Request protection is not configured.',
+            });
+        }
+    }
+    assertConfigurationFunctions(config) {
+        const hasInvalidFunction = (config.keyExtractor !== undefined && typeof config.keyExtractor !== 'function') || (config.endpointGrouper !== undefined && typeof config.endpointGrouper !== 'function') || (config.costExtractor !== undefined && typeof config.costExtractor !== 'function') || (config.clock !== undefined && typeof config.clock !== 'function');
+        if (hasInvalidFunction) {
+            this.throwRateLimitError({
+                status: 500,
+                subcode: 'CONFIG_INVALID',
+                message: 'A rate-limit configuration callback is invalid.',
+                userMessage: 'Request protection is not configured.',
+            });
+        }
+    }
+    assertStore(store) {
+        const hasKnownKind = store?.storeKind === rate_limit_store_kind_type_enum_1.DyNTS_RateLimitStoreKind_Type.inMemory
+            || store?.storeKind === rate_limit_store_kind_type_enum_1.DyNTS_RateLimitStoreKind_Type.shared;
+        if (!hasKnownKind || typeof store.consume !== 'function') {
+            this.throwRateLimitError({
+                status: 500,
+                subcode: 'STORE_INVALID',
+                message: 'The configured rate-limit store does not satisfy the Bedrock contract.',
+                userMessage: 'Request protection is not configured.',
+            });
+        }
+    }
+    extractBucketPart(extractor, req) {
+        let value;
+        try {
+            value = extractor(req);
+        }
+        catch {
+            value = undefined;
+        }
+        if (typeof value !== 'string') {
+            this.throwBucketKeyInvalid();
+        }
+        const normalized = value.trim();
+        this.assertBucketPart(normalized);
+        return normalized;
+    }
+    extractCost(req) {
+        try {
+            return this.costExtractor(req);
+        }
+        catch {
+            this.throwRateLimitError({
+                status: 500,
+                subcode: 'COST_INVALID',
+                message: 'The rate-limit request cost could not be derived.',
+                userMessage: 'Request protection is not configured.',
+            });
+        }
+    }
+    buildBucketKey(subject, endpoint) {
+        return `${subject.length}:${subject}${endpoint.length}:${endpoint}`;
+    }
+    getNow() {
+        let now;
+        try {
+            now = this.clock();
+        }
+        catch {
+            now = undefined;
+        }
+        if (!Number.isSafeInteger(now) || typeof now !== 'number' || now < 0) {
+            this.throwRateLimitError({
+                status: 503,
+                subcode: 'CLOCK_INVALID',
+                message: 'The rate-limit clock returned an invalid timestamp.',
+                userMessage: 'Request protection is temporarily unavailable. Please try again later.',
+            });
+        }
+        return now;
+    }
+    assertBucketPart(value) {
+        if (!value || value.length > MAX_BUCKET_PART_LENGTH) {
+            this.throwBucketKeyInvalid();
+        }
+    }
+    throwBucketKeyInvalid() {
+        this.throwRateLimitError({
+            status: 500,
+            subcode: 'BUCKET_KEY_INVALID',
+            message: 'A rate-limit bucket component is missing, invalid or too large.',
+            userMessage: 'Request protection is not configured.',
+        });
+    }
+    assertStoreResult(result, policy, now) {
+        const isValid = typeof result === 'object'
+            && result !== null
+            && 'allowed' in result
+            && 'remaining' in result
+            && 'resetAt' in result
+            && typeof result.allowed === 'boolean'
+            && typeof result.remaining === 'number'
+            && Number.isSafeInteger(result.remaining)
+            && result.remaining >= 0
+            && result.remaining <= policy.limit
+            && typeof result.resetAt === 'number'
+            && Number.isSafeInteger(result.resetAt)
+            && result.resetAt >= now;
+        if (!isValid) {
+            this.throwRateLimitError({
+                status: 503,
+                subcode: 'STORE_RESULT_INVALID',
+                message: 'The rate-limit store returned an invalid permit decision.',
+                userMessage: 'Request protection is temporarily unavailable. Please try again later.',
+            });
+        }
+    }
+    setResponseHeaders(res, context) {
+        if (!this.isResponseHeadersEnabled) {
+            return;
+        }
+        const resetSeconds = Math.ceil(context.result.resetAt / 1_000).toString();
+        res.setHeader('X-RateLimit-Limit', context.policy.limit.toString());
+        res.setHeader('X-RateLimit-Remaining', context.result.remaining.toString());
+        res.setHeader('X-RateLimit-Reset', resetSeconds);
+        res.setHeader('RateLimit-Limit', context.policy.limit.toString());
+        res.setHeader('RateLimit-Remaining', context.result.remaining.toString());
+        res.setHeader('RateLimit-Reset', Math.max(0, Math.ceil((context.result.resetAt - context.now) / 1_000)).toString());
+        if (!context.result.allowed) {
+            res.setHeader('Retry-After', this.getRetryAfterSeconds(context.result.resetAt, context.now).toString());
+        }
+    }
+    getRetryAfterSeconds(resetAt, now) {
+        return Math.max(1, Math.ceil((resetAt - now) / 1_000));
+    }
+    throwRateLimitError(context) {
+        const systemShortCode = global_settings_const_1.DyNTS_global_settings.systemShortCodeName ?? 'DyNTS';
+        throw new fsm_dynamo_1.DyFM_Error({
+            status: context.status,
+            errorCode: `${systemShortCode}|DyNTS-RL-${context.subcode}`,
+            addECToUserMsg: true,
+            message: context.message,
+            userMessage: context.userMessage,
+            issuerService: SERVICE_NAME,
+        });
+    }
+}
+exports.DyNTS_RateLimit_Middleware = DyNTS_RateLimit_Middleware;
 //# sourceMappingURL=rate-limit.middleware.js.map