@karbonjs/api 0.2.4 → 0.2.5

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 export { createClientApi } from './client/client.js';
 export type { ClientApiConfig } from './client/client.js';
 export { createServerApi } from './server/server.js';
+export { createProxy, type ProxyConfig } from './server/proxy.js';
+export { createRateLimiter, type RateLimitRule, type RateLimitRules, type RateLimitResult, type RateLimiter } from './server/rate-limiter.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAA"}

package/dist/index.js

@@ -1,3 +1,5 @@
 export { createClientApi } from './client/client.js';
 export { createServerApi } from './server/server.js';
+export { createProxy } from './server/proxy.js';
+export { createRateLimiter } from './server/rate-limiter.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGpD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGpD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAoB,MAAM,mBAAmB,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAmF,MAAM,0BAA0B,CAAA"}

package/dist/server/index.d.ts

@@ -0,0 +1,4 @@
+export { createServerApi } from './server.js';
+export { createProxy, type ProxyConfig } from './proxy.js';
+export { createRateLimiter, type RateLimitRule, type RateLimitRules, type RateLimitResult, type RateLimiter } from './rate-limiter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/server/index.js

@@ -0,0 +1,4 @@
+export { createServerApi } from './server.js';
+export { createProxy } from './proxy.js';
+export { createRateLimiter } from './rate-limiter.js';
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAmF,MAAM,mBAAmB,CAAA"}

package/dist/server/proxy.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Configurable API proxy for SvelteKit catch-all routes.
+ *
+ * Generates GET/POST/PUT/PATCH/DELETE handlers that proxy
+ * requests to a backend server with security built-in:
+ * - Path sanitization (blocks `../`, `//`)
+ * - Blocked path prefixes (e.g. `internal`)
+ * - CSRF protection (Origin vs Host check)
+ * - Rate limiting (sliding window, per IP)
+ * - Body size limit
+ * - Request/response streaming (no memory buffering)
+ * - Cookie & auth header forwarding
+ * - X-Forwarded-For client IP forwarding
+ *
+ * @example
+ * ```ts
+ * // src/routes/api/[...path]/+server.ts
+ * import { createProxy } from '@karbonjs/api'
+ *
+ * export const { GET, POST, PUT, PATCH, DELETE } = createProxy({
+ *   backend: 'http://localhost:8080',
+ *   prefix: '/api',
+ *   blockedPrefixes: ['internal'],
+ *   csrf: true,
+ *   rateLimit: {
+ *     'auth/login': { max: 20, windowSec: 60 },
+ *     '*': { max: 200, windowSec: 60 },
+ *   },
+ * })
+ * ```
+ */
+import { type RateLimitRules } from './rate-limiter.js';
+export interface ProxyConfig {
+    /** Backend URL (e.g. `http://localhost:8080`) */
+    backend: string;
+    /** URL prefix to prepend to proxied path (default: `/api`) */
+    prefix?: string;
+    /** Max request body size in bytes (default: 10 MB) */
+    maxBodySize?: number;
+    /** Path prefixes to block — returns 404 (default: `['internal']`) */
+    blockedPrefixes?: string[];
+    /** Enable CSRF check on mutating requests (default: `true`) */
+    csrf?: boolean;
+    /** Rate limit rules per route pattern. Use `'*'` for default. Set `false` to disable. */
+    rateLimit?: RateLimitRules | false;
+}
+/** Minimal SvelteKit RequestEvent shape — keeps karbonjs framework-agnostic */
+interface RequestEvent {
+    request: Request;
+    params: Record<string, string>;
+    url: URL;
+    getClientAddress: () => string;
+}
+type Handler = (event: RequestEvent) => Promise<Response>;
+/**
+ * Create a proxy handler set for SvelteKit `+server.ts` catch-all routes.
+ */
+export declare function createProxy(config: ProxyConfig): {
+    GET: Handler;
+    POST: Handler;
+    PUT: Handler;
+    PATCH: Handler;
+    DELETE: Handler;
+};
+export {};
+//# sourceMappingURL=proxy.d.ts.map

package/dist/server/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/server/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAqB,KAAK,cAAc,EAAoB,MAAM,mBAAmB,CAAA;AAE5F,MAAM,WAAW,WAAW;IAC1B,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAA;IACf,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,+DAA+D;IAC/D,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,yFAAyF;IACzF,SAAS,CAAC,EAAE,cAAc,GAAG,KAAK,CAAA;CACnC;AAED,+EAA+E;AAC/E,UAAU,YAAY;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,GAAG,EAAE,GAAG,CAAA;IACR,gBAAgB,EAAE,MAAM,MAAM,CAAA;CAC/B;AAED,KAAK,OAAO,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AASzD;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW;;;;;;EAiJ9C"}

package/dist/server/proxy.js

@@ -0,0 +1,170 @@
+/**
+ * Configurable API proxy for SvelteKit catch-all routes.
+ *
+ * Generates GET/POST/PUT/PATCH/DELETE handlers that proxy
+ * requests to a backend server with security built-in:
+ * - Path sanitization (blocks `../`, `//`)
+ * - Blocked path prefixes (e.g. `internal`)
+ * - CSRF protection (Origin vs Host check)
+ * - Rate limiting (sliding window, per IP)
+ * - Body size limit
+ * - Request/response streaming (no memory buffering)
+ * - Cookie & auth header forwarding
+ * - X-Forwarded-For client IP forwarding
+ *
+ * @example
+ * ```ts
+ * // src/routes/api/[...path]/+server.ts
+ * import { createProxy } from '@karbonjs/api'
+ *
+ * export const { GET, POST, PUT, PATCH, DELETE } = createProxy({
+ *   backend: 'http://localhost:8080',
+ *   prefix: '/api',
+ *   blockedPrefixes: ['internal'],
+ *   csrf: true,
+ *   rateLimit: {
+ *     'auth/login': { max: 20, windowSec: 60 },
+ *     '*': { max: 200, windowSec: 60 },
+ *   },
+ * })
+ * ```
+ */
+import { createRateLimiter } from './rate-limiter.js';
+function jsonResponse(status, message, extra) {
+    return new Response(JSON.stringify({ success: false, message }), {
+        status,
+        headers: { 'content-type': 'application/json', ...extra },
+    });
+}
+/**
+ * Create a proxy handler set for SvelteKit `+server.ts` catch-all routes.
+ */
+export function createProxy(config) {
+    const { backend, prefix = '/api', maxBodySize = 10 * 1024 * 1024, blockedPrefixes = ['internal'], csrf = true, rateLimit: rateLimitConfig, } = config;
+    // Validate backend URL
+    try {
+        const url = new URL(backend);
+        if (!['http:', 'https:'].includes(url.protocol)) {
+            throw new Error('Backend URL must use http or https');
+        }
+    }
+    catch {
+        throw new Error(`Invalid backend URL: ${backend}`);
+    }
+    // Init rate limiter (unless disabled)
+    let limiter = null;
+    if (rateLimitConfig !== false) {
+        limiter = createRateLimiter(rateLimitConfig ?? undefined);
+    }
+    const handler = async (event) => {
+        const { request, params, url } = event;
+        const rawPath = params.path ?? '';
+        // 1. Sanitize path
+        if (rawPath.includes('..') || rawPath.includes('//')) {
+            return jsonResponse(400, 'Invalid path');
+        }
+        // 2. Block forbidden prefixes
+        const firstSegment = rawPath.split('/')[0];
+        if (blockedPrefixes.includes(firstSegment)) {
+            return jsonResponse(404, 'Not found');
+        }
+        const path = `${prefix}/${rawPath}${url.search}`;
+        // 3. Client IP
+        let clientIp = '127.0.0.1';
+        try {
+            clientIp = event.getClientAddress();
+        }
+        catch { /* dev mode */ }
+        // 4. Rate limiting
+        if (limiter) {
+            const rl = limiter.check(clientIp, path);
+            if (!rl.allowed) {
+                return jsonResponse(429, 'Too many requests', {
+                    'retry-after': String(rl.retryAfterSec ?? 60),
+                    'x-ratelimit-limit': String(rl.limit),
+                    'x-ratelimit-remaining': '0',
+                });
+            }
+        }
+        // 5. CSRF — mutating requests must come from same origin
+        if (csrf && request.method !== 'GET' && request.method !== 'HEAD') {
+            const origin = request.headers.get('origin');
+            const host = request.headers.get('host');
+            if (origin && host) {
+                try {
+                    const originHost = new URL(origin).host;
+                    if (originHost !== host) {
+                        return jsonResponse(403, 'Forbidden');
+                    }
+                }
+                catch {
+                    return jsonResponse(403, 'Forbidden');
+                }
+            }
+        }
+        // 6. Build headers
+        const headers = new Headers();
+        headers.set('content-type', request.headers.get('content-type') || 'application/json');
+        const auth = request.headers.get('authorization');
+        if (auth)
+            headers.set('authorization', auth);
+        const cookies = request.headers.get('cookie');
+        if (cookies)
+            headers.set('cookie', cookies);
+        headers.set('x-forwarded-for', clientIp);
+        // 7. Stream body with size check
+        let body = null;
+        if (request.method !== 'GET' && request.method !== 'HEAD' && request.body) {
+            const contentLength = request.headers.get('content-length');
+            if (contentLength && parseInt(contentLength) > maxBodySize) {
+                return jsonResponse(413, 'Request too large');
+            }
+            body = request.body;
+        }
+        // 8. Proxy to backend
+        let apiRes;
+        try {
+            apiRes = await fetch(`${backend}${path}`, {
+                method: request.method,
+                headers,
+                body,
+                // @ts-expect-error — duplex required for streaming body in Node
+                duplex: body ? 'half' : undefined,
+            });
+        }
+        catch {
+            return jsonResponse(502, 'Backend unreachable');
+        }
+        // 9. Build response — stream back
+        const responseHeaders = new Headers();
+        responseHeaders.set('content-type', apiRes.headers.get('content-type') || 'application/json');
+        // Rate limit info
+        if (limiter) {
+            const rl = limiter.check(clientIp, path);
+            responseHeaders.set('x-ratelimit-limit', String(rl.limit));
+            responseHeaders.set('x-ratelimit-remaining', String(rl.remaining));
+        }
+        // Forward Set-Cookie
+        const setCookies = apiRes.headers.getSetCookie?.() ?? [];
+        for (const cookie of setCookies) {
+            responseHeaders.append('set-cookie', cookie);
+        }
+        if (setCookies.length === 0) {
+            const raw = apiRes.headers.get('set-cookie');
+            if (raw)
+                responseHeaders.set('set-cookie', raw);
+        }
+        return new Response(apiRes.body, {
+            status: apiRes.status,
+            headers: responseHeaders,
+        });
+    };
+    return {
+        GET: handler,
+        POST: handler,
+        PUT: handler,
+        PATCH: handler,
+        DELETE: handler,
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/server/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/server/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,iBAAiB,EAAyC,MAAM,mBAAmB,CAAA;AA2B5F,SAAS,YAAY,CAAC,MAAc,EAAE,OAAe,EAAE,KAA8B;IACnF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;QAC/D,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,KAAK,EAAE;KAC1D,CAAC,CAAA;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,MAAM,EACJ,OAAO,EACP,MAAM,GAAG,MAAM,EACf,WAAW,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAC9B,eAAe,GAAG,CAAC,UAAU,CAAC,EAC9B,IAAI,GAAG,IAAI,EACX,SAAS,EAAE,eAAe,GAC3B,GAAG,MAAM,CAAA;IAEV,uBAAuB;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;QAC5B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAA;IACpD,CAAC;IAED,sCAAsC;IACtC,IAAI,OAAO,GAAuB,IAAI,CAAA;IACtC,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC9B,OAAO,GAAG,iBAAiB,CAAC,eAAe,IAAI,SAAS,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,OAAO,GAAY,KAAK,EAAE,KAAK,EAAE,EAAE;QACvC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAA;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAA;QAEjC,mBAAmB;QACnB,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,OAAO,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QAC1C,CAAC;QAED,8BAA8B;QAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1C,IAAI,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,OAAO,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;QAEhD,eAAe;QACf,IAAI,QAAQ,GAAG,WAAW,CAAA;QAC1B,IAAI,CAAC;YAAC,QAAQ,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAEpE,mBAAmB;QACnB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;gBAChB,OAAO,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE;oBAC5C,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC;oBAC7C,mBAAmB,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC;oBACrC,uBAAuB,EAAE,GAAG;iBAC7B,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACxC,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;oBACvC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;wBACxB,OAAO,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;oBACvC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;QAC7B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,CAAA;QAEtF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QACjD,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;QAE5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC7C,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAE3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAA;QAExC,iCAAiC;QACjC,IAAI,IAAI,GAAsC,IAAI,CAAA;QAClD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1E,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;YAC3D,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,GAAG,WAAW,EAAE,CAAC;gBAC3D,OAAO,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;YAC/C,CAAC;YACD,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACrB,CAAC;QAED,sBAAsB;QACtB,IAAI,MAAgB,CAAA;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;gBACxC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO;gBACP,IAAI;gBACJ,gEAAgE;gBAChE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;aAClC,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAA;QACjD,CAAC;QAED,kCAAkC;QAClC,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAA;QACrC,eAAe,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,CAAA;QAE7F,kBAAkB;QAClB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YACxC,eAAe,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1D,eAAe,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QACpE,CAAC;QAED,qBAAqB;QACrB,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAA;QACxD,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,eAAe,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;QAC9C,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YAC5C,IAAI,GAAG;gBAAE,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;QACjD,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,eAAe;SACzB,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,OAAO;QACL,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,OAAO;KAChB,CAAA;AACH,CAAC"}

package/dist/server/rate-limiter.d.ts

@@ -0,0 +1,43 @@
+/**
+ * In-memory sliding window rate limiter.
+ *
+ * Tracks request timestamps per IP + route pattern.
+ * Auto-purges expired entries every 5 minutes.
+ *
+ * @example
+ * ```ts
+ * const limiter = createRateLimiter({
+ *   'auth/login': { max: 20, windowSec: 60 },
+ *   '*': { max: 200, windowSec: 60 },
+ * })
+ *
+ * const result = limiter.check('192.168.1.1', '/api/auth/login')
+ * if (!result.allowed) // return 429
+ * ```
+ */
+export interface RateLimitRule {
+    max: number;
+    windowSec: number;
+}
+export type RateLimitRules = Record<string, RateLimitRule>;
+export interface RateLimitResult {
+    allowed: boolean;
+    remaining: number;
+    limit: number;
+    retryAfterSec?: number;
+}
+export interface RateLimiter {
+    /** Check if request is allowed. Records the timestamp if allowed. */
+    check(ip: string, path: string): RateLimitResult;
+    /** Reset all entries (useful for testing) */
+    reset(): void;
+    /** Stop the cleanup interval */
+    destroy(): void;
+}
+/**
+ * Create a rate limiter with custom rules.
+ * Rules are matched by path prefix (after stripping `/api/`).
+ * Use `'*'` as the fallback rule.
+ */
+export declare function createRateLimiter(rules?: RateLimitRules): RateLimiter;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/server/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../src/server/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAE1D,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAUD,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,CAAA;IAChD,6CAA6C;IAC7C,KAAK,IAAI,IAAI,CAAA;IACb,gCAAgC;IAChC,OAAO,IAAI,IAAI,CAAA;CAChB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,cAA8B,GAAG,WAAW,CAqEpF"}

package/dist/server/rate-limiter.js

@@ -0,0 +1,90 @@
+/**
+ * In-memory sliding window rate limiter.
+ *
+ * Tracks request timestamps per IP + route pattern.
+ * Auto-purges expired entries every 5 minutes.
+ *
+ * @example
+ * ```ts
+ * const limiter = createRateLimiter({
+ *   'auth/login': { max: 20, windowSec: 60 },
+ *   '*': { max: 200, windowSec: 60 },
+ * })
+ *
+ * const result = limiter.check('192.168.1.1', '/api/auth/login')
+ * if (!result.allowed) // return 429
+ * ```
+ */
+const DEFAULT_RULES = {
+    '*': { max: 200, windowSec: 60 },
+};
+/**
+ * Create a rate limiter with custom rules.
+ * Rules are matched by path prefix (after stripping `/api/`).
+ * Use `'*'` as the fallback rule.
+ */
+export function createRateLimiter(rules = DEFAULT_RULES) {
+    const mergedRules = { ...DEFAULT_RULES, ...rules };
+    const store = new Map();
+    // Cleanup expired entries every 5 min
+    const cleanupTimer = setInterval(() => {
+        const now = Date.now();
+        for (const [ip, routes] of store) {
+            for (const [route, entry] of routes) {
+                const rule = getRule(route);
+                entry.timestamps = entry.timestamps.filter(t => now - t < rule.windowSec * 1000);
+                if (entry.timestamps.length === 0)
+                    routes.delete(route);
+            }
+            if (routes.size === 0)
+                store.delete(ip);
+        }
+    }, 5 * 60 * 1000);
+    // Don't block process exit
+    if (cleanupTimer && typeof cleanupTimer === 'object' && 'unref' in cleanupTimer) {
+        cleanupTimer.unref();
+    }
+    function matchRoute(path) {
+        const route = path.replace(/^\/api\//, '');
+        for (const pattern of Object.keys(mergedRules)) {
+            if (pattern === '*')
+                continue;
+            if (route.startsWith(pattern))
+                return pattern;
+        }
+        return '*';
+    }
+    function getRule(routeKey) {
+        return mergedRules[routeKey] ?? mergedRules['*'] ?? DEFAULT_RULES['*'];
+    }
+    function check(ip, path) {
+        const routeKey = matchRoute(path);
+        const rule = getRule(routeKey);
+        const now = Date.now();
+        const windowMs = rule.windowSec * 1000;
+        if (!store.has(ip))
+            store.set(ip, new Map());
+        const ipMap = store.get(ip);
+        if (!ipMap.has(routeKey))
+            ipMap.set(routeKey, { timestamps: [] });
+        const entry = ipMap.get(routeKey);
+        // Sliding window
+        entry.timestamps = entry.timestamps.filter(t => now - t < windowMs);
+        if (entry.timestamps.length >= rule.max) {
+            const oldest = entry.timestamps[0];
+            const retryAfterSec = Math.ceil((oldest + windowMs - now) / 1000);
+            return { allowed: false, remaining: 0, limit: rule.max, retryAfterSec };
+        }
+        entry.timestamps.push(now);
+        return { allowed: true, remaining: rule.max - entry.timestamps.length, limit: rule.max };
+    }
+    function reset() {
+        store.clear();
+    }
+    function destroy() {
+        clearInterval(cleanupTimer);
+        store.clear();
+    }
+    return { check, reset, destroy };
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/server/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/server/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAoBH,MAAM,aAAa,GAAmB;IACpC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE;CACjC,CAAA;AAWD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAwB,aAAa;IACrE,MAAM,WAAW,GAAmB,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,EAAE,CAAA;IAClE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuC,CAAA;IAE5D,sCAAsC;IACtC,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;gBAC3B,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;gBAChF,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACzD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACzC,CAAC;IACH,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEjB,2BAA2B;IAC3B,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;QAC/E,YAAiD,CAAC,KAAK,EAAE,CAAA;IAC5D,CAAC;IAED,SAAS,UAAU,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QAC1C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,IAAI,OAAO,KAAK,GAAG;gBAAE,SAAQ;YAC7B,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAA;QAC/C,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,SAAS,OAAO,CAAC,QAAgB;QAC/B,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAA;IACxE,CAAC;IAED,SAAS,KAAK,CAAC,EAAU,EAAE,IAAY;QACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;QAEtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAE,CAAA;QAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;QACjE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAA;QAElC,iBAAiB;QACjB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAA;QAEnE,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;YAClC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;YACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,CAAA;QACzE,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAA;IAC1F,CAAC;IAED,SAAS,KAAK;QACZ,KAAK,CAAC,KAAK,EAAE,CAAA;IACf,CAAC;IAED,SAAS,OAAO;QACd,aAAa,CAAC,YAAY,CAAC,CAAA;QAC3B,KAAK,CAAC,KAAK,EAAE,CAAA;IACf,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAClC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@karbonjs/api",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Type-safe API client for Karbon backends with SSR and client support",
   "type": "module",
   "main": "dist/index.js",
@@ -9,13 +9,17 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "import": "./dist/server/index.js"
     }
   },
   "files": [
     "dist"
   ],
   "dependencies": {
-    "@karbonjs/types": "0.2.4"
+    "@karbonjs/types": "0.2.5"
   },
   "publishConfig": {
     "access": "public"