@kelpie/server 0.2.0 → 0.3.0

package/dist/modules/rate-limit/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/modules/rate-limit/middleware.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAGvD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAA;AAoBxF;;;;;GAKG;AACH,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IAC9D,iBAAiB;IACjB,gBAAgB;IAChB,yBAAyB;IACzB,iCAAiC;CAClC,CAAC,CAAA;AAEF,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;AAC9E,CAAC;AAED,wGAAwG;AACxG,SAAS,WAAW,CAAC,GAAS,EAAE,QAAgB;IAC9C,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAA;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAAuB;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;AACnF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,YAA6C,EAC7C,OAAgB,EAChB,MAA0F;IAE1F,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,CAAA;IAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAEtD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,YAAY,CAAC,EAAE,EAAE;QAC5D,EAAE,EAAE,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC5C,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,WAAW,EAAE,KAAK;KACnB,CAAC,CAAA;IAEF,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,4BAA4B,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACjH,CAAC;IAED,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAA;QACxD,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;QAElF,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAA;QACxD,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC9B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,YAA6C;IAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,EAAE,CAAA;YACZ,OAAM;QACR,CAAC;QAED,MAAM,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE;YACzC,KAAK,EAAE,OAAO;YACd,GAAG,EAAE,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC;YAC1C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK;SAClC,CAAC,CAAA;QACF,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mCAAmC,CACjD,YAA6C;IAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;QAE7B,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,EAAE,CAAA;YACZ,OAAM;QACR,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1E,MAAM,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE;gBACzC,KAAK,EAAE,MAAM;gBACb,GAAG,EAAE,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC;gBAC1C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI;aACjC,CAAC,CAAA;YACF,MAAM,IAAI,EAAE,CAAA;YACZ,OAAM;QACR,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAA;QAEnE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,EAAE,CAAA;YACZ,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAEvE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,EAAE,CAAA;YACZ,OAAM;QACR,CAAC;QAED,MAAM,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE;YACzC,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,KAAK,CAAC,QAAQ;YACnB,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG;SAChC,CAAC,CAAA;QACF,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAA;AACH,CAAC"}

package/dist/modules/rate-limit/repository.d.ts

@@ -0,0 +1,32 @@
+import type { Database } from '../../lib/database.ts';
+import type { Transaction } from '../../runtime/transaction.ts';
+import { rateLimitBuckets } from './schema.ts';
+/** Queries for `rate_limit_buckets`. The middleware decides; these read and write. */
+export type Queryable = Database | Transaction;
+export type RateLimitBucketRecord = typeof rateLimitBuckets.$inferSelect;
+/**
+ * Increments the counter for `(scope, key, windowStart)`, creating the row on
+ * the first request of a window.
+ *
+ * One atomic upsert. Postgres's own row lock under `ON CONFLICT` is what makes
+ * concurrent requests from the same caller count correctly with no read
+ * followed by a separate write to race against — the same shape
+ * `reserveIdempotencyKey` uses, and for the same reason: two statements can't
+ * be made atomic against each other, but one can.
+ */
+export declare function incrementRateLimitBucket(db: Queryable, params: {
+    readonly id: string;
+    readonly scope: string;
+    readonly key: string;
+    readonly windowStart: Date;
+}): Promise<number>;
+/**
+ * Sweeps buckets from windows that have fully elapsed.
+ *
+ * Enforced here rather than by a schedule, the same call `idempotency_keys`
+ * and `webhook_deliveries` make about their own growth: there is no scheduler
+ * in the service, so the middleware prunes on every increment
+ * (`middleware.ts`) and the table stays bounded by the traffic that grows it.
+ */
+export declare function pruneExpiredRateLimitBuckets(db: Queryable, before: Date): Promise<number>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/modules/rate-limit/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../src/modules/rate-limit/repository.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C,sFAAsF;AAEtF,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAA;AAE9C,MAAM,MAAM,qBAAqB,GAAG,OAAO,gBAAgB,CAAC,YAAY,CAAA;AAExE;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,SAAS,EACb,MAAM,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAA;CAAE,GACxG,OAAO,CAAC,MAAM,CAAC,CAqBjB;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAO/F"}

package/dist/modules/rate-limit/repository.js

@@ -0,0 +1,48 @@
+import { lt, sql } from 'drizzle-orm';
+import { rateLimitBuckets } from './schema.js';
+/**
+ * Increments the counter for `(scope, key, windowStart)`, creating the row on
+ * the first request of a window.
+ *
+ * One atomic upsert. Postgres's own row lock under `ON CONFLICT` is what makes
+ * concurrent requests from the same caller count correctly with no read
+ * followed by a separate write to race against — the same shape
+ * `reserveIdempotencyKey` uses, and for the same reason: two statements can't
+ * be made atomic against each other, but one can.
+ */
+export async function incrementRateLimitBucket(db, params) {
+    const [row] = await db
+        .insert(rateLimitBuckets)
+        .values({
+        id: params.id,
+        scope: params.scope,
+        key: params.key,
+        windowStart: params.windowStart,
+        count: 1,
+    })
+        .onConflictDoUpdate({
+        target: [rateLimitBuckets.scope, rateLimitBuckets.key, rateLimitBuckets.windowStart],
+        set: { count: sql `${rateLimitBuckets.count} + 1` },
+    })
+        .returning({ count: rateLimitBuckets.count });
+    if (row === undefined) {
+        throw new Error('rate limit bucket upsert returned no row');
+    }
+    return row.count;
+}
+/**
+ * Sweeps buckets from windows that have fully elapsed.
+ *
+ * Enforced here rather than by a schedule, the same call `idempotency_keys`
+ * and `webhook_deliveries` make about their own growth: there is no scheduler
+ * in the service, so the middleware prunes on every increment
+ * (`middleware.ts`) and the table stays bounded by the traffic that grows it.
+ */
+export async function pruneExpiredRateLimitBuckets(db, before) {
+    const deleted = await db
+        .delete(rateLimitBuckets)
+        .where(lt(rateLimitBuckets.windowStart, before))
+        .returning({ id: rateLimitBuckets.id });
+    return deleted.length;
+}
+//# sourceMappingURL=repository.js.map

package/dist/modules/rate-limit/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/modules/rate-limit/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAIrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAQ9C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAa,EACb,MAAyG;IAEzG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,gBAAgB,CAAC;SACxB,MAAM,CAAC;QACN,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,CAAC;KACT,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,CAAC,WAAW,CAAC;QACpF,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAA,GAAG,gBAAgB,CAAC,KAAK,MAAM,EAAE;KACnD,CAAC;SACD,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAA;IAE/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,GAAG,CAAC,KAAK,CAAA;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EAAa,EAAE,MAAY;IAC5E,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,gBAAgB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;SAC/C,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEzC,OAAO,OAAO,CAAC,MAAM,CAAA;AACvB,CAAC"}

package/dist/modules/rate-limit/schema.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Fixed-window counters backing the rate limiter (`app.ts`). Not
+ * workspace-owned, unlike every other core table: a public form submission or
+ * an unauthenticated auth attempt has no workspace to scope to, which is
+ * exactly the traffic this table exists to police. `scope` names the budget
+ * (`forms`, `auth`, `api`) and `key` is the caller within it — an IP address
+ * or an API key id.
+ *
+ * `(scope, key, window_start)` is unique rather than `(scope, key)` alone
+ * because the window boundary lives in the key: a new window is a new row, so
+ * incrementing is one atomic upsert (`repository.ts`) with no read before the
+ * write to race against. A row is left for `pruneExpiredRateLimitBuckets` to
+ * sweep once its window has elapsed rather than deleted eagerly, since nothing
+ * reads a bucket after that.
+ */
+export declare const rateLimitBuckets: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "rate_limit_buckets";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "rate_limit_buckets";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        scope: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scope";
+            tableName: "rate_limit_buckets";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        key: import("drizzle-orm/pg-core").PgColumn<{
+            name: "key";
+            tableName: "rate_limit_buckets";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        windowStart: import("drizzle-orm/pg-core").PgColumn<{
+            name: string;
+            tableName: "rate_limit_buckets";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        count: import("drizzle-orm/pg-core").PgColumn<{
+            name: "count";
+            tableName: "rate_limit_buckets";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "rate_limit_buckets";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/modules/rate-limit/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/modules/rate-limit/schema.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc5B,CAAA"}

package/dist/modules/rate-limit/schema.js

@@ -0,0 +1,29 @@
+import { index, integer, pgTable, text, unique } from 'drizzle-orm/pg-core';
+import { createdAt, moment, primaryId } from '../../lib/columns.js';
+/**
+ * Fixed-window counters backing the rate limiter (`app.ts`). Not
+ * workspace-owned, unlike every other core table: a public form submission or
+ * an unauthenticated auth attempt has no workspace to scope to, which is
+ * exactly the traffic this table exists to police. `scope` names the budget
+ * (`forms`, `auth`, `api`) and `key` is the caller within it — an IP address
+ * or an API key id.
+ *
+ * `(scope, key, window_start)` is unique rather than `(scope, key)` alone
+ * because the window boundary lives in the key: a new window is a new row, so
+ * incrementing is one atomic upsert (`repository.ts`) with no read before the
+ * write to race against. A row is left for `pruneExpiredRateLimitBuckets` to
+ * sweep once its window has elapsed rather than deleted eagerly, since nothing
+ * reads a bucket after that.
+ */
+export const rateLimitBuckets = pgTable('rate_limit_buckets', {
+    id: primaryId(),
+    scope: text('scope').notNull(),
+    key: text('key').notNull(),
+    windowStart: moment('window_start').notNull(),
+    count: integer('count').notNull().default(1),
+    createdAt: createdAt(),
+}, (table) => [
+    unique('rate_limit_buckets_scope_key_window_key').on(table.scope, table.key, table.windowStart),
+    index('rate_limit_buckets_window_start_idx').on(table.windowStart),
+]);
+//# sourceMappingURL=schema.js.map

package/dist/modules/rate-limit/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/modules/rate-limit/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAE3E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CACrC,oBAAoB,EACpB;IACE,EAAE,EAAE,SAAS,EAAE;IACf,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IAC1B,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC7C,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,SAAS,EAAE,SAAS,EAAE;CACvB,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,MAAM,CAAC,yCAAyC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC;IAC/F,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;CACnE,CACF,CAAA"}

package/dist/schema/index.d.ts

@@ -27,4 +27,5 @@ export * from '../modules/import-export/schema.ts';
 export * from '../modules/agent-tasks/schema.ts';
 export * from '../modules/webhooks/schema.ts';
 export * from '../modules/integrations/schema.ts';
+export * from '../modules/rate-limit/schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/schema/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schema/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,2BAA2B,CAAA;AACzC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,oCAAoC,CAAA;AAClD,cAAc,mCAAmC,CAAA;AACjD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,iCAAiC,CAAA;AAC/C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,oCAAoC,CAAA;AAClD,cAAc,kCAAkC,CAAA;AAChD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,mCAAmC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schema/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,2BAA2B,CAAA;AACzC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,oCAAoC,CAAA;AAClD,cAAc,mCAAmC,CAAA;AACjD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,iCAAiC,CAAA;AAC/C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,oCAAoC,CAAA;AAClD,cAAc,kCAAkC,CAAA;AAChD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,mCAAmC,CAAA;AACjD,cAAc,iCAAiC,CAAA"}

package/dist/schema/index.js

@@ -27,4 +27,5 @@ export * from '../modules/import-export/schema.js';
 export * from '../modules/agent-tasks/schema.js';
 export * from '../modules/webhooks/schema.js';
 export * from '../modules/integrations/schema.js';
+export * from '../modules/rate-limit/schema.js';
 //# sourceMappingURL=index.js.map

package/dist/schema/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schema/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,2BAA2B,CAAA;AACzC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,oCAAoC,CAAA;AAClD,cAAc,mCAAmC,CAAA;AACjD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,iCAAiC,CAAA;AAC/C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,oCAAoC,CAAA;AAClD,cAAc,kCAAkC,CAAA;AAChD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,mCAAmC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schema/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,2BAA2B,CAAA;AACzC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,oCAAoC,CAAA;AAClD,cAAc,mCAAmC,CAAA;AACjD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,iCAAiC,CAAA;AAC/C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,oCAAoC,CAAA;AAClD,cAAc,kCAAkC,CAAA;AAChD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,mCAAmC,CAAA;AACjD,cAAc,iCAAiC,CAAA"}

package/dist/testing/app.d.ts

@@ -3,6 +3,7 @@ import type { AppBindings } from '../app.ts';
 import type { Actor } from '../lib/actor.ts';
 import type { Environment } from '../lib/config.ts';
 import type { DatabaseProbe } from '../lib/database.ts';
+import type { RateLimitConfig } from '../lib/rateLimit.ts';
 import type { KelpieModule } from '../runtime/module.ts';
 import type { ModuleContributions } from '../runtime/registry.ts';
 import type { EntitlementRegistry } from '../runtime/entitlements.ts';
@@ -30,6 +31,10 @@ export interface TestAppOptions {
      * route behaves as it did before module toggling existed.
      */
     readonly resolveActor?: (context: Context) => Promise<Actor>;
+    /** Defaults to the same numbers `loadConfig` would, from an empty environment. */
+    readonly rateLimit?: RateLimitConfig;
+    /** Defaults to reading `X-Forwarded-For`, so a test can simulate distinct callers. */
+    readonly resolveClientIp?: (context: Context) => string;
 }
 export interface TestApp {
     readonly app: Hono<AppBindings>;

package/dist/testing/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/testing/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAGzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD;;;;GAIG;AAEH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;IAC1C,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;IACrD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAA;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAC3C,sFAAsF;IACtF,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACzD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAA;IAC3C,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAID,wBAAsB,aAAa,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CA0BlF"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/testing/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAGzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAGvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAejD;;;;GAIG;AAEH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;IAC1C,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;IACrD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAA;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAC3C,sFAAsF;IACtF,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACzD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,CAAA;IAC5D,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAA;IACpC,sFAAsF;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAA;CACxD;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAA;IAC3C,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAID,wBAAsB,aAAa,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CA4BlF"}

package/dist/testing/app.js

@@ -1,8 +1,20 @@
 import { createApp } from '../app.js';
 import { createLogger } from '../lib/logger.js';
+import { rateLimitConfigFrom, rateLimitConfigSchema } from '../lib/rateLimit.js';
 import { registerModules } from '../runtime/registry.js';
 import { TEST_ENVIRONMENT } from './environment.js';
 import { createTestServices } from './services.js';
+/** The same defaults `loadConfig` produces from an empty environment: one source of numbers for both. */
+const DEFAULT_TEST_RATE_LIMIT = rateLimitConfigFrom(rateLimitConfigSchema.parse({}));
+/**
+ * A caller's IP, for tests. Real entry points resolve this from the socket
+ * (`apps/kelpie/src/server.ts`); a test using `app.request()` has no socket, so
+ * it reads `X-Forwarded-For` when a test sets one to simulate distinct
+ * callers, falling back to a fixed address for everything else.
+ */
+function testClientIp(context) {
+    return context.req.header('X-Forwarded-For') ?? '203.0.113.1';
+}
 const reachableDatabase = () => Promise.resolve({ reachable: true });
 export async function createTestApp(options = {}) {
     const logLines = [];
@@ -25,6 +37,8 @@ export async function createTestApp(options = {}) {
         credentials: { db: services.db, now: services.now },
         generateRequestId: options.generateRequestId ?? (() => 'req-test'),
         createId: services.createId,
+        rateLimit: options.rateLimit ?? DEFAULT_TEST_RATE_LIMIT,
+        resolveClientIp: options.resolveClientIp ?? testClientIp,
     });
     return { app, contributions, logLines, services };
 }

package/dist/testing/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/testing/app.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAKrC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAI/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAqClD,MAAM,iBAAiB,GAAG,GAA2B,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;AAE5F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAO,GAAmB,EAAE;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAEnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,EAAE,CAAA;IACzD,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,gBAAgB;QACpD,MAAM;QACN,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,QAAQ;KACT,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,MAAM;QACN,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,iBAAiB;QACzD,aAAa;QACb,WAAW,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;QACnD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC;QAClE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAA;IAEF,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;AACnD,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/testing/app.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAKrC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAKhF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAGlD,yGAAyG;AACzG,MAAM,uBAAuB,GAAoB,mBAAmB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;AAErG;;;;;GAKG;AACH,SAAS,YAAY,CAAC,OAAgB;IACpC,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,aAAa,CAAA;AAC/D,CAAC;AAwCD,MAAM,iBAAiB,GAAG,GAA2B,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;AAE5F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAO,GAAmB,EAAE;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAEnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,EAAE,CAAA;IACzD,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,gBAAgB;QACpD,MAAM;QACN,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,QAAQ;KACT,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,MAAM;QACN,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,iBAAiB;QACzD,aAAa;QACb,WAAW,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;QACnD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC;QAClE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB;QACvD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,YAAY;KACzD,CAAC,CAAA;IAEF,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;AACnD,CAAC"}

package/dist/webBundle.d.ts

@@ -0,0 +1,37 @@
+import type { Hono } from 'hono';
+import type { AppBindings } from './app.ts';
+/**
+ * Serves a built web bundle from the same origin as the API.
+ *
+ * `createApp` answers data and nothing else. In development the Vite dev server
+ * builds the pages and proxies `/v1` through to the API, so one address serves
+ * both. That proxy is doing two jobs: rebuilding on edit, which is development
+ * only, and putting the pages and the API on one origin, which is permanent.
+ * Nothing did the second job in production, so a deployed assembly answered API
+ * calls and served no pages at all.
+ *
+ * An assembly opts in by calling this after `createApp`, which is where the
+ * three assemblies (`apps/kelpie`, a scaffolded project, and `kelpie-cloud`)
+ * would otherwise each grow their own copy of the fallback rule below.
+ */
+export interface WebBundleOptions {
+    /** Directory holding the built `index.html` and its assets. */
+    readonly directory: string;
+}
+/** The bundle directory does not hold a build. Thrown at boot, never per request. */
+export declare class WebBundleError extends Error {
+    constructor(message: string);
+}
+/**
+ * Mounts the bundle on an app built by `createApp`.
+ *
+ * Call it after `createApp` and before serving. Hono composes a request's
+ * handlers in registration order and stops at the first one that answers, so
+ * mounting last leaves every API route matching ahead of these two.
+ *
+ * @throws WebBundleError if the directory holds no `index.html`. A deployment
+ *   whose build did not run should stop at boot rather than serve an API with
+ *   invisible pages, which is the failure this function exists to remove.
+ */
+export declare function serveWebBundle(app: Hono<AppBindings>, options: WebBundleOptions): void;
+//# sourceMappingURL=webBundle.d.ts.map

package/dist/webBundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webBundle.d.ts","sourceRoot":"","sources":["../src/webBundle.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,IAAI,EAAqB,MAAM,MAAM,CAAA;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAG3C;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,qFAAqF;AACrF,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAuCD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAwBtF"}

package/dist/webBundle.js

@@ -0,0 +1,75 @@
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { serveStatic } from '@hono/node-server/serve-static';
+import { MCP_ROUTE_PREFIX } from './modules/mcp/index.js';
+/** The bundle directory does not hold a build. Thrown at boot, never per request. */
+export class WebBundleError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'WebBundleError';
+    }
+}
+/**
+ * The prefixes `createApp` answers on.
+ *
+ * `/v1/public` needs no entry of its own: it sits under `/v1`. `MCP_ROUTE_PREFIX`
+ * is imported rather than written out, so moving the endpoint moves this with it.
+ */
+const API_PREFIXES = ['/v1', MCP_ROUTE_PREFIX, '/healthz'];
+function isApiRequest(path) {
+    return API_PREFIXES.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}
+/**
+ * Restricts a handler to requests for the web app.
+ *
+ * The API exclusion is the point of the whole file. `app.notFound` renders
+ * `api.md`'s JSON 404, and it only fires when no route matched, so a bare
+ * catch-all registered after `createApp` would answer `GET /v1/typo` with the
+ * app shell and a 200. A client asking for data would get a web page and no
+ * indication it had misspelled anything.
+ *
+ * Methods are filtered for the same reason: `POST /v1/typo` is a wrong endpoint,
+ * not a page request, and only a `GET` or a `HEAD` can sensibly be answered with
+ * a document.
+ */
+function webRequestsOnly(handler) {
+    return async (context, next) => {
+        const isDocumentRequest = context.req.method === 'GET' || context.req.method === 'HEAD';
+        if (!isDocumentRequest || isApiRequest(context.req.path)) {
+            return next();
+        }
+        return handler(context, next);
+    };
+}
+/**
+ * Mounts the bundle on an app built by `createApp`.
+ *
+ * Call it after `createApp` and before serving. Hono composes a request's
+ * handlers in registration order and stops at the first one that answers, so
+ * mounting last leaves every API route matching ahead of these two.
+ *
+ * @throws WebBundleError if the directory holds no `index.html`. A deployment
+ *   whose build did not run should stop at boot rather than serve an API with
+ *   invisible pages, which is the failure this function exists to remove.
+ */
+export function serveWebBundle(app, options) {
+    const directory = resolve(options.directory);
+    const indexHtml = join(directory, 'index.html');
+    if (!existsSync(indexHtml)) {
+        throw new WebBundleError(`No index.html in ${directory}. Point WEB_BUNDLE_DIR at a built web bundle, or run the web build first.`);
+    }
+    // Two registrations rather than one: `serveStatic` calls `next()` when it
+    // finds no file, which is exactly the signal the fallback needs. A request
+    // for a real asset is answered by the first and never reaches the second.
+    app.use('*', webRequestsOnly(serveStatic({ root: directory })));
+    // The single-page fallback. The app decides what to draw from the address, so
+    // a deep link to `/people/per_01J…` has to return the same `index.html` even
+    // though no file sits at that path.
+    //
+    // A missing asset gets the shell too, which is what every static SPA server
+    // does by default. Narrowing this by `Accept` would turn a stale asset
+    // reference into a clean 404, and would also turn `curl /people/per_01J…`
+    // into one, so it is left alone.
+    app.use('*', webRequestsOnly(serveStatic({ path: indexHtml })));
+}
+//# sourceMappingURL=webBundle.js.map

package/dist/webBundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webBundle.js","sourceRoot":"","sources":["../src/webBundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAI5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAsBzD,qFAAqF;AACrF,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAC9B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,YAAY,GAAsB,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAA;AAE7E,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAA;AACxF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,eAAe,CAAC,OAA0B;IACjD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAA;QAEvF,IAAI,CAAC,iBAAiB,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC/B,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,GAAsB,EAAE,OAAyB;IAC9E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAE/C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,cAAc,CACtB,oBAAoB,SAAS,2EAA2E,CACzG,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAA;IAE/D,8EAA8E;IAC9E,6EAA6E;IAC7E,oCAAoC;IACpC,EAAE;IACF,4EAA4E;IAC5E,uEAAuE;IACvE,0EAA0E;IAC1E,iCAAiC;IACjC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC"}

package/migrations/0016_misty_mentor.sql

@@ -0,0 +1,11 @@
+CREATE TABLE "rate_limit_buckets" (
+	"id" text PRIMARY KEY NOT NULL,
+	"scope" text NOT NULL,
+	"key" text NOT NULL,
+	"window_start" timestamp with time zone NOT NULL,
+	"count" integer DEFAULT 1 NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "rate_limit_buckets_scope_key_window_key" UNIQUE("scope","key","window_start")
+);
+--> statement-breakpoint
+CREATE INDEX "rate_limit_buckets_window_start_idx" ON "rate_limit_buckets" USING btree ("window_start");