@hyperfrontend/immutable-api-utils 0.0.1

package/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+This file was generated using [@jscutlery/semver](https://github.com/jscutlery/semver).
+
+## 0.0.1 (2026-02-15)

package/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Andrew Redican
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,192 @@
+# @hyperfrontend/immutable-api-utils
+
+<p align="center">
+  <a href="https://github.com/AndrewRedican/hyperfrontend/actions/workflows/ci-lib-immutable-api-utils.yml">
+    <img src="https://img.shields.io/github/actions/workflow/status/AndrewRedican/hyperfrontend/ci-lib-immutable-api-utils.yml?style=flat-square&logo=github&label=build" alt="Build">
+  </a>
+  <a href="https://codecov.io/gh/AndrewRedican/hyperfrontend/flags?flags%5B0%5D=immutable-api-utils">
+    <img src="https://codecov.io/gh/AndrewRedican/hyperfrontend/graph/badge.svg?flag=immutable-api-utils" alt="Coverage">
+  </a>
+  <a href="https://www.npmjs.com/package/@hyperfrontend/immutable-api-utils">
+    <img src="https://img.shields.io/npm/v/@hyperfrontend/immutable-api-utils?style=flat-square" alt="npm version">
+  </a>
+</p>
+<p align="center">
+  <!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
+  <a href="#contributors">
+    <img src="https://img.shields.io/github/all-contributors/AndrewRedican/hyperfrontend?color=ee8449&style=flat-square" alt="All Contributors">
+  </a>
+  <!-- ALL-CONTRIBUTORS-BADGE:END -->
+  <a href="https://github.com/AndrewRedican/hyperfrontend/blob/main/LICENSE.md">
+    <img src="https://img.shields.io/badge/license-MIT-blue?style=flat-square" alt="License">
+  </a>
+  <a href="https://www.npmjs.com/package/@hyperfrontend/immutable-api-utils">
+    <img src="https://img.shields.io/npm/dm/@hyperfrontend/immutable-api-utils?style=flat-square" alt="npm downloads">
+  </a>
+  <a href="https://github.com/AndrewRedican/hyperfrontend">
+    <img src="https://img.shields.io/github/stars/AndrewRedican/hyperfrontend?style=flat-square" alt="GitHub stars">
+  </a>
+  <a href="https://bundlephobia.com/package/@hyperfrontend/immutable-api-utils">
+    <img src="https://img.shields.io/bundlephobia/minzip/@hyperfrontend/immutable-api-utils?style=flat-square" alt="Bundle Size">
+  </a>
+  <img src="https://img.shields.io/badge/node-%3E%3D18.0.0-brightgreen?style=flat-square&logo=node.js" alt="Node Version">
+  <img src="https://img.shields.io/badge/tree%20shakeable-%E2%9C%93-success?style=flat-square" alt="Tree Shakeable">
+</p>
+
+Decorators and utilities for creating immutable, tamper-proof object APIs.
+
+## What is @hyperfrontend/immutable-api-utils?
+
+@hyperfrontend/immutable-api-utils provides low-level utilities for locking object properties and methods to prevent modification. Using JavaScript's property descriptors (`Object.defineProperty`), it creates truly immutable APIs where neither values nor method bindings can be altered after definition.
+
+The library offers three approaches: a TypeScript decorator (`@locked()`) for class methods, a functional API (`lockedProps()`) for bulk property locking, and descriptor builders (`lockedPropertyDescriptors()`) for granular control. All utilities enforce non-writable, non-configurable descriptors while maintaining correct `this` binding through per-instance caching.
+
+### Key Features
+
+- **`@locked()` decorator** for TypeScript classes—prevents method overwriting and ensures correct `this` binding
+- **Bulk property locking** via `lockedProps()` for multiple properties in one call
+- **Property descriptor creation** with `lockedPropertyDescriptors()` for custom locking patterns
+- **Per-instance binding cache** to avoid repeated `.bind()` calls
+- **Zero runtime dependencies** - pure JavaScript property descriptor manipulation
+
+### Architecture Highlights
+
+The `@locked()` decorator uses Symbol-based caching to store bound methods per instance, avoiding the performance cost of repeated `.bind()` calls. Properties are marked `configurable: false` to prevent deletion or descriptor modification, and `writable: false` to block reassignment.
+
+## Why Use @hyperfrontend/immutable-api-utils?
+
+### Prevents Accidental API Tampering in Shared Contexts
+
+When exposing objects to third-party code, plugin systems, or sandboxed environments, you need guarantees that critical methods won't be overwritten. `@locked()` makes methods truly immutable—attempting reassignment throws a TypeError. This protects public APIs from accidental or malicious modification.
+
+### Eliminates `this` Binding Bugs Without Arrow Functions
+
+Arrow functions in class fields break inheritance and bloat bundle sizes due to per-instance function creation. The `@locked()` decorator provides correct `this` binding (like arrow functions) while using efficient prototype methods. Methods are bound once per instance and cached with Symbol keys.
+
+### Simplifies Immutable Object Construction
+
+Building frozen objects with `Object.freeze()` is shallow and doesn't prevent descriptor modification. `lockedProps()` provides deep immutability for specific properties while allowing controlled mutability elsewhere—ideal for partially frozen configs or API surfaces.
+
+### TypeScript-First with Runtime Enforcement
+
+Unlike TypeScript `readonly` (compile-time only), these utilities enforce immutability at runtime. This catches bugs in JavaScript-land, during deserialization, or when interfacing with dynamically typed code. Type safety and runtime safety in one decorator.
+
+## Installation
+
+```bash
+npm install @hyperfrontend/immutable-api-utils
+```
+
+## Quick Start
+
+```typescript
+import { locked, lockedProps, lockedPropertyDescriptors } from '@hyperfrontend/immutable-api-utils'
+
+// Decorator usage: lock methods in classes
+class Counter {
+  private count = 0
+
+  @locked()
+  increment() {
+    this.count++
+    return this.count
+  }
+
+  @locked()
+  getValue() {
+    return this.count
+  }
+}
+
+const counter = new Counter()
+counter.increment() // Works: 1
+counter.increment = () => 0 // Throws: Cannot overwrite locked method
+
+// Ensure correct `this` binding even when method is extracted
+const { increment } = counter
+increment() // Still works correctly, `this` remains bound
+
+// Functional API: lock multiple properties
+const config = {}
+lockedProps(config, [
+  ['apiKey', 'secret-key-12345'],
+  ['timeout', 5000],
+  ['retries', 3],
+])
+
+config.apiKey = 'hacked' // Silent fail in non-strict mode, throws in strict mode
+Object.defineProperty(config, 'apiKey', { writable: true }) // Throws: cannot redefine
+
+// Low-level descriptor creation
+const obj = {}
+Object.defineProperty(obj, 'version', lockedPropertyDescriptors('1.0.0', true))
+// Property is non-writable, non-configurable, but enumerable
+```
+
+## API Overview
+
+### Decorator
+
+- **`@locked()`** - TypeScript decorator that makes class methods immutable with correct `this` binding
+
+### Functions
+
+- **`lockedProps(object, pairs)`** - Lock multiple properties on an object with key-value pairs
+- **`lockedPropertyDescriptors(value, enumerable?)`** - Create a locked property descriptor for manual use with `Object.defineProperty`
+
+## Use Cases
+
+- **Plugin APIs**: Prevent plugins from modifying core library methods
+- **Sandboxed execution**: Expose safe APIs to untrusted code
+- **Configuration objects**: Lock critical config values after initialization
+- **Public library interfaces**: Protect exported classes from mutation
+- **Event emitters**: Prevent handler list manipulation
+- **Prototype pollution defense**: Make critical prototypes tamper-proof
+
+## Compatibility
+
+| Platform                      | Support |
+| ----------------------------- | :-----: |
+| Browser                       |   ✅    |
+| Node.js                       |   ✅    |
+| Web Workers                   |   ✅    |
+| Deno, Bun, Cloudflare Workers |   ✅    |
+
+### Output Formats
+
+| Format | File                       | Tree-Shakeable |
+| ------ | -------------------------- | :------------: |
+| ESM    | `index.esm.js`             |       ✅       |
+| CJS    | `index.cjs.js`             |       ❌       |
+| IIFE   | `bundle/index.iife.min.js` |       ❌       |
+| UMD    | `bundle/index.umd.min.js`  |       ❌       |
+
+**Bundle size:** < 1 KB (minified, self-contained)
+
+### CDN Usage
+
+```html
+<!-- unpkg -->
+<script src="https://unpkg.com/@hyperfrontend/immutable-api-utils"></script>
+
+<!-- jsDelivr -->
+<script src="https://cdn.jsdelivr.net/npm/@hyperfrontend/immutable-api-utils"></script>
+
+<script>
+  const { immutableApi, freezeClass, sealClass } = HyperfrontendImmutableApiUtils
+</script>
+```
+
+**Global variable:** `HyperfrontendImmutableApiUtils`
+
+### Dependencies
+
+None — zero external dependencies.
+
+## Part of hyperfrontend
+
+This library is part of the [hyperfrontend](https://github.com/AndrewRedican/hyperfrontend) monorepo. [Full documentation](https://hyperfrontend.dev).
+
+## License
+
+MIT

package/SECURITY.md

@@ -0,0 +1,82 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+We take the security of hyperfrontend seriously. If you discover a security vulnerability, please help us protect our users by following responsible disclosure practices.
+
+### How to Report
+
+**Please DO NOT report security vulnerabilities through public GitHub issues.**
+
+Instead, please report security vulnerabilities directly via email to:
+
+**<andrew.redican.mejia@gmail.com>**
+
+### What to Include
+
+To help us understand and resolve the issue quickly, please include the following information in your report:
+
+- **Description**: A clear description of the vulnerability
+- **Impact**: The potential impact and severity of the issue
+- **Reproduction Steps**: Detailed steps to reproduce the vulnerability
+- **Environment**: The version of hyperfrontend affected, browser/Node.js version, operating system, etc.
+- **Proof of Concept**: If possible, include a minimal code example or proof of concept
+- **Suggested Fix**: If you have ideas on how to fix the issue (optional)
+
+### Response Timeline
+
+- **Acknowledgment**: We will acknowledge receipt of your vulnerability report within 2 business days
+- **Initial Assessment**: We will provide an initial assessment within 5 business days
+- **Patch Development**: We aim to develop and test a patch within 10 days of acknowledgment
+- **Public Disclosure**: Please allow at least **10 days** from the initial report before making the vulnerability publicly known
+
+This grace period gives us time to:
+
+- Verify and reproduce the issue
+- Develop and test a fix
+- Release a patched version
+- Notify users to update their dependencies
+
+### Coordinated Disclosure
+
+We believe in coordinated disclosure and appreciate your cooperation in:
+
+- Not exploiting the vulnerability beyond what is necessary to demonstrate it
+- Not accessing, modifying, or deleting data that doesn't belong to you
+- Allowing us reasonable time to address the issue before public disclosure
+- Making a good faith effort to avoid privacy violations, data destruction, and service interruption
+
+### Recognition
+
+Once the vulnerability is patched and publicly disclosed, we will acknowledge your responsible disclosure in:
+
+- Our release notes
+- Our security advisories (if applicable)
+- This SECURITY.md file (with your permission)
+
+Thank you for helping keep hyperfrontend and its users safe!
+
+## Security Best Practices
+
+When using hyperfrontend in your applications:
+
+1. **Keep Dependencies Updated**: Regularly update to the latest version to receive security patches
+2. **Content Security Policy**: Implement appropriate CSP headers when embedding features
+3. **Input Validation**: Validate and sanitize all data passed between features
+4. **Origin Verification**: Always verify the origin of messages in cross-frame communication
+5. **Authentication**: Implement proper authentication and authorization for sensitive features
+6. **HTTPS**: Always serve hyperfrontend features over HTTPS in production
+
+## Security Updates
+
+Security updates will be released as patch versions and documented in the [CHANGELOG](https://github.com/AndrewRedican/hyperfrontend/releases) and GitHub Security Advisories.
+
+## Supported Versions
+
+We currently provide security updates for:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.0.x   | :white_check_mark: |
+
+As the project matures, we will update this table to reflect our long-term support policy.

package/bundle/index.iife.js

@@ -0,0 +1,65 @@
+var HyperfrontendImmutableApiUtils = (function (exports) {
+    'use strict';
+
+    /**
+     * Creates a decorator that locks a method to prevent overwriting and ensure correct `this` binding.
+     *
+     * @locked
+     * Ensures a classic prototype method cannot be overwritten and is
+     * always called with the correct `this` instance without needing arrow functions.
+     *
+     * - The method of the prototype is non-configurable and non-enumerable.
+     * - Any attempt to assign to the method throws an error.
+     * - It does not support class fields / arrow functions.
+     *
+     * @returns A method decorator that locks the method
+     */
+    const locked = () => {
+        return function lockMethod(target, key, descriptor) {
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type
+            const original = descriptor.value;
+            const BOUND = Symbol(`[[locked.bound:${String(key)}]]`);
+            return {
+                configurable: false,
+                enumerable: false,
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                get() {
+                    // cache a bound function per instance
+                    if (!Object.prototype.hasOwnProperty.call(this, BOUND)) {
+                        Object.defineProperty(this, BOUND, {
+                            value: original.bind(this),
+                            writable: false,
+                            configurable: false,
+                            enumerable: false,
+                        });
+                    }
+                    return this[BOUND];
+                },
+                set() {
+                    throw new TypeError(`Cannot overwrite locked method ${String(key)}`);
+                },
+            };
+        };
+    };
+
+    const lockedPropertyDescriptors = (value, enumerable = false) => ({
+        value,
+        writable: false,
+        configurable: false,
+        enumerable,
+    });
+
+    const lockedProps = (object, propertyValuePairs) => {
+        const propertyMap = {};
+        propertyValuePairs.forEach(([key, value]) => (propertyMap[key] = lockedPropertyDescriptors(value)));
+        Object.defineProperties(object, propertyMap);
+    };
+
+    exports.locked = locked;
+    exports.lockedPropertyDescriptors = lockedPropertyDescriptors;
+    exports.lockedProps = lockedProps;
+
+    return exports;
+
+})({});
+//# sourceMappingURL=index.iife.js.map

package/bundle/index.iife.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.iife.js","sources":["../../../../../../../../../../libs/utils/immutable-api/src/locked.ts","../../../../../../../../../../libs/utils/immutable-api/src/locked-prop-descriptors.ts","../../../../../../../../../../libs/utils/immutable-api/src/locked-props.ts"],"sourcesContent":[null,null,null],"names":[],"mappings":";;;IAQA;;;;;;;;;;;;IAYG;AACI,UAAM,MAAM,GAAG,MAAmB;IACvC,IAAA,OAAO,SAAS,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAA;;IAEhD,QAAA,MAAM,QAAQ,GAAa,UAAU,CAAC,KAAK;YAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAA,eAAA,EAAkB,MAAM,CAAC,GAAG,CAAC,CAAA,EAAA,CAAI,CAAC;YACvD,OAA2B;IACzB,YAAA,YAAY,EAAE,KAAK;IACnB,YAAA,UAAU,EAAE,KAAK;;gBAEjB,GAAG,GAAA;;IAED,gBAAA,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;IACtD,oBAAA,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE;IACjC,wBAAA,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;IAC1B,wBAAA,QAAQ,EAAE,KAAK;IACf,wBAAA,YAAY,EAAE,KAAK;IACnB,wBAAA,UAAU,EAAE,KAAK;IAClB,qBAAA,CAAC;oBACJ;IACA,gBAAA,OAAO,IAAI,CAAC,KAAK,CAAC;gBACpB,CAAC;gBACD,GAAG,GAAA;oBACD,MAAM,IAAI,SAAS,CAAC,CAAA,+BAAA,EAAkC,MAAM,CAAC,GAAG,CAAC,CAAA,CAAE,CAAC;gBACtE,CAAC;aACF;IACH,IAAA,CAAC;IACH;;AC7CO,UAAM,yBAAyB,GAAiC,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,MAAM;QACrG,KAAK;IACL,IAAA,QAAQ,EAAE,KAAK;IACf,IAAA,YAAY,EAAE,KAAK;QACnB,UAAU;IACX,CAAA;;UCCY,WAAW,GAAiB,CAAC,MAAM,EAAE,kBAAkB,KAAI;QACtE,MAAM,WAAW,GAA0B,EAAE;QAC7C,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;IACnG,IAAA,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC;IAC9C;;;;;;;;;;;;"}

package/bundle/index.iife.min.js

@@ -0,0 +1,2 @@
+var HyperfrontendImmutableApiUtils=function(e){"use strict";const r=(e,r=!1)=>({value:e,writable:!1,configurable:!1,enumerable:r});return e.locked=()=>function(e,r,t){const o=t.value,n=Symbol(`[[locked.bound:${String(r)}]]`);return{configurable:!1,enumerable:!1,get(){return Object.prototype.hasOwnProperty.call(this,n)||Object.defineProperty(this,n,{value:o.bind(this),writable:!1,configurable:!1,enumerable:!1}),this[n]},set(){throw new TypeError(`Cannot overwrite locked method ${String(r)}`)}}},e.lockedPropertyDescriptors=r,e.lockedProps=(e,t)=>{const o={};t.forEach(([e,t])=>o[e]=r(t)),Object.defineProperties(e,o)},e}({});
+//# sourceMappingURL=index.iife.min.js.map

package/bundle/index.iife.min.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.iife.min.js","sources":["../../../../../../../../../../libs/utils/immutable-api/src/locked.ts","../../../../../../../../../../libs/utils/immutable-api/src/locked-prop-descriptors.ts","../../../../../../../../../../libs/utils/immutable-api/src/locked-props.ts"],"sourcesContent":[null,null,null],"names":["lockedPropertyDescriptors","value","enumerable","writable","configurable","target","key","descriptor","original","BOUND","Symbol","String","get","Object","prototype","hasOwnProperty","call","this","defineProperty","bind","set","TypeError","object","propertyValuePairs","propertyMap","forEach","defineProperties"],"mappings":"4DAqBO,MCnBMA,EAA0D,CAACC,EAAOC,GAAa,KAAK,CAC/FD,QACAE,UAAU,EACVC,cAAc,EACdF,+BDeoB,IACb,SAAoBG,EAAQC,EAAKC,GAEtC,MAAMC,EAAqBD,EAAWN,MAChCQ,EAAQC,OAAO,kBAAkBC,OAAOL,QAC9C,MAA2B,CACzBF,cAAc,EACdF,YAAY,EAEZ,GAAAU,GAUE,OARKC,OAAOC,UAAUC,eAAeC,KAAKC,KAAMR,IAC9CI,OAAOK,eAAeD,KAAMR,EAAO,CACjCR,MAAOO,EAASW,KAAKF,MACrBd,UAAU,EACVC,cAAc,EACdF,YAAY,IAGTe,KAAKR,EACd,EACA,GAAAW,GACE,MAAM,IAAIC,UAAU,kCAAkCV,OAAOL,KAC/D,EAEJ,8CEtCuC,CAACgB,EAAQC,KAChD,MAAMC,EAAqC,CAAA,EAC3CD,EAAmBE,QAAQ,EAAEnB,EAAKL,KAAYuB,EAAYlB,GAAON,EAA0BC,IAC3FY,OAAOa,iBAAiBJ,EAAQE"}

package/bundle/index.umd.js

@@ -0,0 +1,66 @@
+(function (global, factory) {
+    typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
+    typeof define === 'function' && define.amd ? define(['exports'], factory) :
+    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.HyperfrontendImmutableApiUtils = {}));
+})(this, (function (exports) { 'use strict';
+
+    /**
+     * Creates a decorator that locks a method to prevent overwriting and ensure correct `this` binding.
+     *
+     * @locked
+     * Ensures a classic prototype method cannot be overwritten and is
+     * always called with the correct `this` instance without needing arrow functions.
+     *
+     * - The method of the prototype is non-configurable and non-enumerable.
+     * - Any attempt to assign to the method throws an error.
+     * - It does not support class fields / arrow functions.
+     *
+     * @returns A method decorator that locks the method
+     */
+    const locked = () => {
+        return function lockMethod(target, key, descriptor) {
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type
+            const original = descriptor.value;
+            const BOUND = Symbol(`[[locked.bound:${String(key)}]]`);
+            return {
+                configurable: false,
+                enumerable: false,
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                get() {
+                    // cache a bound function per instance
+                    if (!Object.prototype.hasOwnProperty.call(this, BOUND)) {
+                        Object.defineProperty(this, BOUND, {
+                            value: original.bind(this),
+                            writable: false,
+                            configurable: false,
+                            enumerable: false,
+                        });
+                    }
+                    return this[BOUND];
+                },
+                set() {
+                    throw new TypeError(`Cannot overwrite locked method ${String(key)}`);
+                },
+            };
+        };
+    };
+
+    const lockedPropertyDescriptors = (value, enumerable = false) => ({
+        value,
+        writable: false,
+        configurable: false,
+        enumerable,
+    });
+
+    const lockedProps = (object, propertyValuePairs) => {
+        const propertyMap = {};
+        propertyValuePairs.forEach(([key, value]) => (propertyMap[key] = lockedPropertyDescriptors(value)));
+        Object.defineProperties(object, propertyMap);
+    };
+
+    exports.locked = locked;
+    exports.lockedPropertyDescriptors = lockedPropertyDescriptors;
+    exports.lockedProps = lockedProps;
+
+}));
+//# sourceMappingURL=index.umd.js.map

package/bundle/index.umd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.umd.js","sources":["../../../../../../../../../../libs/utils/immutable-api/src/locked.ts","../../../../../../../../../../libs/utils/immutable-api/src/locked-prop-descriptors.ts","../../../../../../../../../../libs/utils/immutable-api/src/locked-props.ts"],"sourcesContent":[null,null,null],"names":[],"mappings":";;;;;;IAQA;;;;;;;;;;;;IAYG;AACI,UAAM,MAAM,GAAG,MAAmB;IACvC,IAAA,OAAO,SAAS,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAA;;IAEhD,QAAA,MAAM,QAAQ,GAAa,UAAU,CAAC,KAAK;YAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAA,eAAA,EAAkB,MAAM,CAAC,GAAG,CAAC,CAAA,EAAA,CAAI,CAAC;YACvD,OAA2B;IACzB,YAAA,YAAY,EAAE,KAAK;IACnB,YAAA,UAAU,EAAE,KAAK;;gBAEjB,GAAG,GAAA;;IAED,gBAAA,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;IACtD,oBAAA,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE;IACjC,wBAAA,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;IAC1B,wBAAA,QAAQ,EAAE,KAAK;IACf,wBAAA,YAAY,EAAE,KAAK;IACnB,wBAAA,UAAU,EAAE,KAAK;IAClB,qBAAA,CAAC;oBACJ;IACA,gBAAA,OAAO,IAAI,CAAC,KAAK,CAAC;gBACpB,CAAC;gBACD,GAAG,GAAA;oBACD,MAAM,IAAI,SAAS,CAAC,CAAA,+BAAA,EAAkC,MAAM,CAAC,GAAG,CAAC,CAAA,CAAE,CAAC;gBACtE,CAAC;aACF;IACH,IAAA,CAAC;IACH;;AC7CO,UAAM,yBAAyB,GAAiC,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,MAAM;QACrG,KAAK;IACL,IAAA,QAAQ,EAAE,KAAK;IACf,IAAA,YAAY,EAAE,KAAK;QACnB,UAAU;IACX,CAAA;;UCCY,WAAW,GAAiB,CAAC,MAAM,EAAE,kBAAkB,KAAI;QACtE,MAAM,WAAW,GAA0B,EAAE;QAC7C,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;IACnG,IAAA,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC;IAC9C;;;;;;;;;;"}

package/bundle/index.umd.min.js

@@ -0,0 +1,2 @@
+!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).HyperfrontendImmutableApiUtils={})}(this,function(e){"use strict";const t=(e,t=!1)=>({value:e,writable:!1,configurable:!1,enumerable:t});e.locked=()=>function(e,t,o){const r=o.value,n=Symbol(`[[locked.bound:${String(t)}]]`);return{configurable:!1,enumerable:!1,get(){return Object.prototype.hasOwnProperty.call(this,n)||Object.defineProperty(this,n,{value:r.bind(this),writable:!1,configurable:!1,enumerable:!1}),this[n]},set(){throw new TypeError(`Cannot overwrite locked method ${String(t)}`)}}},e.lockedPropertyDescriptors=t,e.lockedProps=(e,o)=>{const r={};o.forEach(([e,o])=>r[e]=t(o)),Object.defineProperties(e,r)}});
+//# sourceMappingURL=index.umd.min.js.map

package/bundle/index.umd.min.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.umd.min.js","sources":["../../../../../../../../../../libs/utils/immutable-api/src/locked.ts","../../../../../../../../../../libs/utils/immutable-api/src/locked-prop-descriptors.ts","../../../../../../../../../../libs/utils/immutable-api/src/locked-props.ts"],"sourcesContent":[null,null,null],"names":["lockedPropertyDescriptors","value","enumerable","writable","configurable","target","key","descriptor","original","BOUND","Symbol","String","get","Object","prototype","hasOwnProperty","call","this","defineProperty","bind","set","TypeError","object","propertyValuePairs","propertyMap","forEach","defineProperties"],"mappings":"qQAqBO,MCnBMA,EAA0D,CAACC,EAAOC,GAAa,KAAK,CAC/FD,QACAE,UAAU,EACVC,cAAc,EACdF,wBDeoB,IACb,SAAoBG,EAAQC,EAAKC,GAEtC,MAAMC,EAAqBD,EAAWN,MAChCQ,EAAQC,OAAO,kBAAkBC,OAAOL,QAC9C,MAA2B,CACzBF,cAAc,EACdF,YAAY,EAEZ,GAAAU,GAUE,OARKC,OAAOC,UAAUC,eAAeC,KAAKC,KAAMR,IAC9CI,OAAOK,eAAeD,KAAMR,EAAO,CACjCR,MAAOO,EAASW,KAAKF,MACrBd,UAAU,EACVC,cAAc,EACdF,YAAY,IAGTe,KAAKR,EACd,EACA,GAAAW,GACE,MAAM,IAAIC,UAAU,kCAAkCV,OAAOL,KAC/D,EAEJ,8CEtCuC,CAACgB,EAAQC,KAChD,MAAMC,EAAqC,CAAA,EAC3CD,EAAmBE,QAAQ,EAAEnB,EAAKL,KAAYuB,EAAYlB,GAAON,EAA0BC,IAC3FY,OAAOa,iBAAiBJ,EAAQE"}

package/index.cjs.js

@@ -0,0 +1,60 @@
+'use strict';
+
+/**
+ * Creates a decorator that locks a method to prevent overwriting and ensure correct `this` binding.
+ *
+ * @locked
+ * Ensures a classic prototype method cannot be overwritten and is
+ * always called with the correct `this` instance without needing arrow functions.
+ *
+ * - The method of the prototype is non-configurable and non-enumerable.
+ * - Any attempt to assign to the method throws an error.
+ * - It does not support class fields / arrow functions.
+ *
+ * @returns A method decorator that locks the method
+ */
+const locked = () => {
+    return function lockMethod(target, key, descriptor) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type
+        const original = descriptor.value;
+        const BOUND = Symbol(`[[locked.bound:${String(key)}]]`);
+        return {
+            configurable: false,
+            enumerable: false,
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            get() {
+                // cache a bound function per instance
+                if (!Object.prototype.hasOwnProperty.call(this, BOUND)) {
+                    Object.defineProperty(this, BOUND, {
+                        value: original.bind(this),
+                        writable: false,
+                        configurable: false,
+                        enumerable: false,
+                    });
+                }
+                return this[BOUND];
+            },
+            set() {
+                throw new TypeError(`Cannot overwrite locked method ${String(key)}`);
+            },
+        };
+    };
+};
+
+const lockedPropertyDescriptors = (value, enumerable = false) => ({
+    value,
+    writable: false,
+    configurable: false,
+    enumerable,
+});
+
+const lockedProps = (object, propertyValuePairs) => {
+    const propertyMap = {};
+    propertyValuePairs.forEach(([key, value]) => (propertyMap[key] = lockedPropertyDescriptors(value)));
+    Object.defineProperties(object, propertyMap);
+};
+
+exports.locked = locked;
+exports.lockedPropertyDescriptors = lockedPropertyDescriptors;
+exports.lockedProps = lockedProps;
+//# sourceMappingURL=index.cjs.js.map

package/index.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs.js","sources":["../../../../libs/utils/immutable-api/src/locked.ts","../../../../libs/utils/immutable-api/src/locked-prop-descriptors.ts","../../../../libs/utils/immutable-api/src/locked-props.ts"],"sourcesContent":[null,null,null],"names":[],"mappings":";;AAQA;;;;;;;;;;;;AAYG;AACI,MAAM,MAAM,GAAG,MAAmB;AACvC,IAAA,OAAO,SAAS,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAA;;AAEhD,QAAA,MAAM,QAAQ,GAAa,UAAU,CAAC,KAAK;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAA,eAAA,EAAkB,MAAM,CAAC,GAAG,CAAC,CAAA,EAAA,CAAI,CAAC;QACvD,OAA2B;AACzB,YAAA,YAAY,EAAE,KAAK;AACnB,YAAA,UAAU,EAAE,KAAK;;YAEjB,GAAG,GAAA;;AAED,gBAAA,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;AACtD,oBAAA,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE;AACjC,wBAAA,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;AAC1B,wBAAA,QAAQ,EAAE,KAAK;AACf,wBAAA,YAAY,EAAE,KAAK;AACnB,wBAAA,UAAU,EAAE,KAAK;AAClB,qBAAA,CAAC;gBACJ;AACA,gBAAA,OAAO,IAAI,CAAC,KAAK,CAAC;YACpB,CAAC;YACD,GAAG,GAAA;gBACD,MAAM,IAAI,SAAS,CAAC,CAAA,+BAAA,EAAkC,MAAM,CAAC,GAAG,CAAC,CAAA,CAAE,CAAC;YACtE,CAAC;SACF;AACH,IAAA,CAAC;AACH;;AC7CO,MAAM,yBAAyB,GAAiC,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,MAAM;IACrG,KAAK;AACL,IAAA,QAAQ,EAAE,KAAK;AACf,IAAA,YAAY,EAAE,KAAK;IACnB,UAAU;AACX,CAAA;;MCCY,WAAW,GAAiB,CAAC,MAAM,EAAE,kBAAkB,KAAI;IACtE,MAAM,WAAW,GAA0B,EAAE;IAC7C,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;AACnG,IAAA,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC;AAC9C;;;;;;"}

package/index.d.ts

@@ -0,0 +1,4 @@
+export * from './locked';
+export * from './locked-prop-descriptors';
+export * from './locked-props';
+//# sourceMappingURL=index.d.ts.map

package/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../libs/utils/immutable-api/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAA;AACxB,cAAc,2BAA2B,CAAA;AACzC,cAAc,gBAAgB,CAAA"}

package/index.esm.js

@@ -0,0 +1,56 @@
+/**
+ * Creates a decorator that locks a method to prevent overwriting and ensure correct `this` binding.
+ *
+ * @locked
+ * Ensures a classic prototype method cannot be overwritten and is
+ * always called with the correct `this` instance without needing arrow functions.
+ *
+ * - The method of the prototype is non-configurable and non-enumerable.
+ * - Any attempt to assign to the method throws an error.
+ * - It does not support class fields / arrow functions.
+ *
+ * @returns A method decorator that locks the method
+ */
+const locked = () => {
+    return function lockMethod(target, key, descriptor) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type
+        const original = descriptor.value;
+        const BOUND = Symbol(`[[locked.bound:${String(key)}]]`);
+        return {
+            configurable: false,
+            enumerable: false,
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            get() {
+                // cache a bound function per instance
+                if (!Object.prototype.hasOwnProperty.call(this, BOUND)) {
+                    Object.defineProperty(this, BOUND, {
+                        value: original.bind(this),
+                        writable: false,
+                        configurable: false,
+                        enumerable: false,
+                    });
+                }
+                return this[BOUND];
+            },
+            set() {
+                throw new TypeError(`Cannot overwrite locked method ${String(key)}`);
+            },
+        };
+    };
+};
+
+const lockedPropertyDescriptors = (value, enumerable = false) => ({
+    value,
+    writable: false,
+    configurable: false,
+    enumerable,
+});
+
+const lockedProps = (object, propertyValuePairs) => {
+    const propertyMap = {};
+    propertyValuePairs.forEach(([key, value]) => (propertyMap[key] = lockedPropertyDescriptors(value)));
+    Object.defineProperties(object, propertyMap);
+};
+
+export { locked, lockedPropertyDescriptors, lockedProps };
+//# sourceMappingURL=index.esm.js.map

package/index.esm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.esm.js","sources":["../../../../libs/utils/immutable-api/src/locked.ts","../../../../libs/utils/immutable-api/src/locked-prop-descriptors.ts","../../../../libs/utils/immutable-api/src/locked-props.ts"],"sourcesContent":[null,null,null],"names":[],"mappings":"AAQA;;;;;;;;;;;;AAYG;AACI,MAAM,MAAM,GAAG,MAAmB;AACvC,IAAA,OAAO,SAAS,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAA;;AAEhD,QAAA,MAAM,QAAQ,GAAa,UAAU,CAAC,KAAK;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAA,eAAA,EAAkB,MAAM,CAAC,GAAG,CAAC,CAAA,EAAA,CAAI,CAAC;QACvD,OAA2B;AACzB,YAAA,YAAY,EAAE,KAAK;AACnB,YAAA,UAAU,EAAE,KAAK;;YAEjB,GAAG,GAAA;;AAED,gBAAA,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;AACtD,oBAAA,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE;AACjC,wBAAA,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;AAC1B,wBAAA,QAAQ,EAAE,KAAK;AACf,wBAAA,YAAY,EAAE,KAAK;AACnB,wBAAA,UAAU,EAAE,KAAK;AAClB,qBAAA,CAAC;gBACJ;AACA,gBAAA,OAAO,IAAI,CAAC,KAAK,CAAC;YACpB,CAAC;YACD,GAAG,GAAA;gBACD,MAAM,IAAI,SAAS,CAAC,CAAA,+BAAA,EAAkC,MAAM,CAAC,GAAG,CAAC,CAAA,CAAE,CAAC;YACtE,CAAC;SACF;AACH,IAAA,CAAC;AACH;;AC7CO,MAAM,yBAAyB,GAAiC,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,MAAM;IACrG,KAAK;AACL,IAAA,QAAQ,EAAE,KAAK;AACf,IAAA,YAAY,EAAE,KAAK;IACnB,UAAU;AACX,CAAA;;MCCY,WAAW,GAAiB,CAAC,MAAM,EAAE,kBAAkB,KAAI;IACtE,MAAM,WAAW,GAA0B,EAAE;IAC7C,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;AACnG,IAAA,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC;AAC9C;;;;"}

package/locked-prop-descriptors.d.ts

@@ -0,0 +1,3 @@
+export type LockedPropDescriptorsCreator = (value: unknown, enumerable?: boolean) => PropertyDescriptor;
+export declare const lockedPropertyDescriptors: LockedPropDescriptorsCreator;
+//# sourceMappingURL=locked-prop-descriptors.d.ts.map

package/locked-prop-descriptors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locked-prop-descriptors.d.ts","sourceRoot":"","sources":["../../../../libs/utils/immutable-api/src/locked-prop-descriptors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,4BAA4B,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,OAAO,KAAK,kBAAkB,CAAA;AAEvG,eAAO,MAAM,yBAAyB,EAAE,4BAKtC,CAAA"}

package/locked-props.d.ts

@@ -0,0 +1,3 @@
+export type PropertyLock = (object: object, propertyValuePairs: [string, any][]) => void;
+export declare const lockedProps: PropertyLock;
+//# sourceMappingURL=locked-props.d.ts.map

package/locked-props.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locked-props.d.ts","sourceRoot":"","sources":["../../../../libs/utils/immutable-api/src/locked-props.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,YAAY,GAAG,CACzB,MAAM,EAAE,MAAM,EAEd,kBAAkB,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAChC,IAAI,CAAA;AAET,eAAO,MAAM,WAAW,EAAE,YAIzB,CAAA"}

package/locked.d.ts

@@ -0,0 +1,16 @@
+export type LockedMethod = (target: object, propertyKey: string | symbol, descriptor: TypedPropertyDescriptor<any>) => any;
+/**
+ * Creates a decorator that locks a method to prevent overwriting and ensure correct `this` binding.
+ *
+ * @locked
+ * Ensures a classic prototype method cannot be overwritten and is
+ * always called with the correct `this` instance without needing arrow functions.
+ *
+ * - The method of the prototype is non-configurable and non-enumerable.
+ * - Any attempt to assign to the method throws an error.
+ * - It does not support class fields / arrow functions.
+ *
+ * @returns A method decorator that locks the method
+ */
+export declare const locked: () => LockedMethod;
+//# sourceMappingURL=locked.d.ts.map

package/locked.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locked.d.ts","sourceRoot":"","sources":["../../../../libs/utils/immutable-api/src/locked.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,MAAM,EAE5B,UAAU,EAAE,uBAAuB,CAAC,GAAG,CAAC,KAErC,GAAG,CAAA;AAER;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,MAAM,QAAO,YA0BzB,CAAA"}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@hyperfrontend/immutable-api-utils",
+  "version": "0.0.1",
+  "description": "Decorators and utilities for creating immutable, tamper-proof object APIs.",
+  "license": "MIT",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18.0.0",
+    "npm": ">=8.0.0"
+  },
+  "keywords": [
+    "immutable",
+    "decorator",
+    "property-descriptor",
+    "locked",
+    "frozen",
+    "non-writable",
+    "non-configurable",
+    "this-binding",
+    "typescript",
+    "api-protection",
+    "zero-dependencies",
+    "functional",
+    "tamper-proof"
+  ],
+  "main": "./index.cjs.js",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AndrewRedican/hyperfrontend.git"
+  },
+  "bugs": {
+    "url": "https://github.com/AndrewRedican/hyperfrontend/issues"
+  },
+  "homepage": "https://github.com/AndrewRedican/hyperfrontend#readme",
+  "author": {
+    "name": "andrew.redican.mejia@gmail.com",
+    "url": "https://hyperfrontend.dev"
+  },
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./index.d.ts",
+      "import": "./index.esm.js",
+      "require": "./index.cjs.js"
+    },
+    "./bundle": {
+      "import": "./bundle/index.iife.min.js",
+      "require": "./bundle/index.iife.min.js"
+    }
+  },
+  "module": "./index.esm.js",
+  "types": "./index.d.ts",
+  "unpkg": "./bundle/index.umd.min.js",
+  "jsdelivr": "./bundle/index.umd.min.js"
+}