@luckystack/core 0.10.2 → 0.11.0

package/dist/configUtils.d.ts

@@ -0,0 +1,16 @@
+export type DeepPartial<T> = {
+    [K in keyof T]?: T[K] extends object | undefined ? DeepPartial<NonNullable<T[K]>> : T[K];
+};
+/**
+ * True when `value` is a plain object literal (prototype is `Object.prototype`
+ * or `null`). Arrays, class instances, Maps, Dates, and `null` are rejected so
+ * they are treated as opaque replacement values during a merge.
+ */
+export declare const isPlainObject: (value: unknown) => value is Record<string, unknown>;
+/**
+ * Deep-merge a deep-partial `override` over a fully-populated `base`,
+ * returning a new object. See the module header for the exact behaviour
+ * contract. Arrays and non-plain-object values are replaced wholesale; nested
+ * plain objects merge recursively; `undefined` override values are ignored.
+ */
+export declare const deepMerge: <T>(base: T, override: DeepPartial<T> | undefined) => T;

package/dist/consoleLog.d.ts

@@ -0,0 +1 @@
+export declare const initConsolelog: () => void;

package/dist/cookies.d.ts

@@ -0,0 +1,28 @@
+export declare const getCookieValue: (cookieHeader: string | undefined, cookieName: string) => string | null;
+export declare const hasCookie: (cookieHeader: string | undefined, cookieName: string) => boolean;
+/** Attributes a cookie-builder must honour, after applying any name prefix. */
+export interface CookiePrefixConstraints {
+    /** Effective cookie name (prefix prepended when applicable). */
+    name: string;
+    /** Whether `Secure` must be set (forced true by either prefix). */
+    secure: boolean;
+    /** Whether `Path=/` is forced (true under `__Host-`). */
+    forcePathRoot: boolean;
+    /** Whether a `Domain` attribute is FORBIDDEN (true under `__Host-`). */
+    forbidDomain: boolean;
+}
+/**
+ * Compute the attribute constraints a `__Host-` / `__Secure-` cookie-name prefix
+ * imposes (CORE-10/39), so the server's session + CSRF cookie builders apply the
+ * browser-enforced rules consistently:
+ *
+ *   - `'__Host-'`   → name prefixed, `Secure` forced, `Path=/` forced, `Domain` forbidden.
+ *   - `'__Secure-'` → name prefixed, `Secure` forced.
+ *   - `undefined`   → name unchanged, no forced attributes (today's behavior).
+ *
+ * Pure + deterministic — the builder still owns serialization; this only
+ * resolves the constraints so server and any other cookie-site can't drift.
+ * `secureOverride` lets the caller force `Secure` independent of a prefix
+ * (mirrors `http.sessionCookieSecure`).
+ */
+export declare const applyCookiePrefixConstraints: (baseName: string, prefix: '__Host-' | '__Secure-' | undefined, secureOverride?: boolean) => CookiePrefixConstraints;

package/dist/createRegistry.d.ts

@@ -0,0 +1,39 @@
+type RequireTransform<TInput, TStored> = [TInput] extends [TStored] ? {
+    transform?: (input: TInput, current: TStored) => TStored;
+} : {
+    transform: (input: TInput, current: TStored) => TStored;
+};
+interface RegistryOptionsBase<TStored> {
+    /**
+     * Called once per `register` with the freshly-stored value — used for the
+     * rate-limiter's `[RateLimiter] active strategy → …` debug line. Runs after
+     * the slot is updated so a logger registry can log through itself.
+     */
+    onRegister?: (stored: TStored) => void;
+    /**
+     * Resolve the value `get` returns when nothing has been registered yet.
+     * Defaults to returning `defaultValue`. `servicesConfig` throws here.
+     */
+    resolveDefault?: () => TStored;
+}
+export type RegistryOptions<TInput, TStored> = RegistryOptionsBase<TStored> & RequireTransform<TInput, TStored>;
+export interface Registry<TInput, TStored> {
+    /** Store a value (after the optional `transform`) and mark the slot registered. */
+    register: (input: TInput) => TStored;
+    /** Read the active value at call time (registered value, else the default). */
+    get: () => TStored;
+    /** True once `register` has been called at least once. */
+    isRegistered: () => boolean;
+    /** Restore the unregistered state (test-only). */
+    reset: () => void;
+}
+/**
+ * Create a single-slot registry. `defaultValue` is returned by `get` until
+ * `register` is called (unless `resolveDefault` overrides that). When
+ * `TInput` differs from `TStored`, the `transform` option is mandatory (the
+ * `RequireTransform` constraint enforces it); when they match it is optional
+ * and defaults to identity. The second positional argument is likewise
+ * optional only in the identity case.
+ */
+export declare function createRegistry<TStored, TInput = TStored>(defaultValue: TStored, ...optionsArg: [TInput] extends [TStored] ? [options?: RegistryOptions<TInput, TStored>] : [options: RegistryOptions<TInput, TStored>]): Registry<TInput, TStored>;
+export {};

package/dist/csrf.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Fetch (or return the cached) CSRF token for the active session. Returns
+ * null in token mode or when no session exists. Callers should attach the
+ * returned value as the `X-CSRF-Token` request header.
+ */
+export declare const getCsrfToken: (origin?: string) => Promise<string | null>;
+/** Drop the cached token. Call this on logout or when a 403 csrfMismatch is seen. */
+export declare const clearCsrfToken: () => void;
+/**
+ * Drop-in replacement for `fetch` that automatically attaches the framework's
+ * `X-CSRF-Token` and `X-Request-Id` headers to state-changing requests in
+ * cookie mode. Use this for any project-side HTTP call that hits a
+ * LuckyStack `/api/*`, `/sync/*`, or `/auth/api/*` endpoint.
+ *
+ * Behavior:
+ *   - GET / OPTIONS / HEAD: passes through without CSRF (read-only).
+ *   - Token mode: passes through without CSRF (immune by design).
+ *   - Cookie mode + state-changing method: lazily fetches `/auth/csrf` once,
+ *     caches, attaches as `x-csrf-token`. On a 403 `auth.csrfMismatch`
+ *     response, clears the cache and retries once.
+ *   - `credentials: 'include'` is forced unless the caller overrode it.
+ *
+ * @example
+ *   import { httpFetch } from '@luckystack/core/client';
+ *   const res = await httpFetch('/api/system/myRoute/v1', {
+ *     method: 'POST',
+ *     body: JSON.stringify({ ... }),
+ *   });
+ */
+export declare const httpFetch: typeof fetch;

package/dist/csrfConfig.d.ts

@@ -0,0 +1,32 @@
+export interface CsrfCookieOptions {
+    sameSite?: 'strict' | 'lax' | 'none';
+    secure?: boolean;
+    /**
+     * Whether the login-absent double-submit cookie is HttpOnly. The client gets
+     * the matching header value from the same-origin `GET /auth/csrf` JSON body,
+     * so either value works; `false` remains the compatibility default.
+     */
+    httpOnly?: boolean;
+    path?: string;
+    maxAgeMs?: number;
+}
+export interface CsrfConfig {
+    /** Cookie name used to deliver the CSRF token to the browser. */
+    cookieName: string;
+    /** Request-header name the client attaches on state-changing requests. */
+    headerName: string;
+    /** Length in bytes of the random token minted by the session layer. */
+    tokenLength: number;
+    cookieOptions: CsrfCookieOptions;
+}
+export declare const DEFAULT_CSRF_CONFIG: CsrfConfig;
+/**
+ * Override one or more CSRF settings. Merges shallowly with the current
+ * config; `cookieOptions` is deep-merged so a partial override of (say)
+ * `sameSite` does not clobber `path` / `maxAgeMs`. Last-write-wins.
+ */
+export declare const registerCsrfConfig: (input: Partial<CsrfConfig>) => void;
+/** Read the active config at call time (never at module load). */
+export declare const getCsrfConfig: () => CsrfConfig;
+/** Test-only — restore defaults between scenarios. */
+export declare const resetCsrfConfigForTests: () => void;

package/dist/db.d.ts

@@ -0,0 +1,12 @@
+import './env.js';
+import type { PrismaClient } from '@prisma/client';
+declare global {
+    var __luckystackPrisma: PrismaClient | undefined;
+}
+/**
+ * Is a generated `@prisma/client` present in this install? Used by the
+ * default resolver's error path and by `/readyz` to decide whether a missing
+ * DB ping means "broken" or "this project has no Prisma by design".
+ */
+export declare const isPrismaClientResolvable: () => boolean;
+export declare const prisma: PrismaClient;

package/dist/dbHealthCheck.d.ts

@@ -0,0 +1,6 @@
+export type DbHealthResult = boolean | 'skipped';
+export type DbHealthCheck = () => Promise<DbHealthResult> | DbHealthResult;
+export declare const registerDbHealthCheck: (check: DbHealthCheck) => void;
+export declare const getDbHealthCheck: () => DbHealthCheck | null;
+export declare const isDbHealthCheckRegistered: () => boolean;
+export declare const resetDbHealthCheckForTests: () => void;

package/dist/{config-CwW3KY9r.d.ts → deployConfigRegistry.d.ts}

@@ -1,21 +1,15 @@
-import './sessionTypes-DanjuPaE.js';
-
-declare const registerPortOverride: (port: number | null) => void;
-declare const getPortOverride: () => number | undefined;
-declare const resetPortOverrideForTests: () => void;
-
-interface DeployResourceShape {
+export interface DeployResourceShape {
     type: 'redis' | 'mongo';
     urlEnvKey: string;
     synchronizedEnvKeys?: string[];
 }
-interface DeployEnvironmentShape {
+export interface DeployEnvironmentShape {
     redis: string;
     mongo: string;
     fallback?: string;
     bindings: Record<string, string>;
 }
-interface DeployRoutingShape {
+export interface DeployRoutingShape {
     onMissingService?: 'hard-error' | 'proxy-fallback';
     missingServiceErrorCode?: string;
     enableUnhealthyFallback?: boolean;
@@ -95,46 +89,17 @@ interface DeployRoutingShape {
      */
     wsMaxBytesPerConnection?: number | false;
 }
-interface DeployDevelopmentShape {
+export interface DeployDevelopmentShape {
     enableFallbackRouting?: boolean;
     healthPollMs?: number;
     switchNewTrafficToLocalWhenHealthy?: boolean;
 }
-interface DeployConfigShape {
+export interface DeployConfigShape {
     resources: Record<string, DeployResourceShape>;
     environments?: Record<string, DeployEnvironmentShape>;
     routing?: DeployRoutingShape;
     development?: DeployDevelopmentShape;
 }
-declare const registerDeployConfig: (config: DeployConfigShape) => DeployConfigShape;
-declare const getDeployConfig: () => DeployConfigShape;
-declare const isDeployConfigRegistered: () => boolean;
-
-interface ServiceDefinition {
-    /** 'root' -> reserved for the system service. Otherwise a folder name under srcDir. */
-    source: 'root' | string;
-}
-interface PresetDefinition {
-    description?: string;
-    /** Services that are bundled together into one backend artifact. */
-    services: string[];
-}
-interface ServicesConfigShape {
-    services: Record<string, ServiceDefinition>;
-    presets: Record<string, PresetDefinition>;
-    /**
-     * Pure-data ownership manifest for HTTP routes outside `/api/*` and `/sync/*`.
-     * Keys are absolute path prefixes; values are service keys. The router uses
-     * longest-prefix matching, so `/webhooks/admin` may override `/webhooks`.
-     */
-    customRoutes?: Record<string, string>;
-}
-declare const registerServicesConfig: (config: ServicesConfigShape) => ServicesConfigShape;
-declare const getServicesConfig: () => ServicesConfigShape;
-declare const isServicesConfigRegistered: () => boolean;
-
-type SecretsResolvedListener = (changedKeys: readonly string[] | undefined) => void;
-declare const registerSecretsResolvedListener: (listener: SecretsResolvedListener) => (() => void);
-declare const notifySecretsResolved: (changedKeys?: readonly string[]) => void;
-
-export { type DeployConfigShape as D, type PresetDefinition as P, type SecretsResolvedListener as S, type DeployDevelopmentShape as a, type DeployEnvironmentShape as b, type DeployResourceShape as c, type DeployRoutingShape as d, type ServiceDefinition as e, type ServicesConfigShape as f, getDeployConfig as g, getPortOverride as h, getServicesConfig as i, isDeployConfigRegistered as j, isServicesConfigRegistered as k, registerPortOverride as l, registerSecretsResolvedListener as m, notifySecretsResolved as n, registerServicesConfig as o, resetPortOverrideForTests as p, registerDeployConfig as r };
+export declare const registerDeployConfig: (config: DeployConfigShape) => DeployConfigShape;
+export declare const getDeployConfig: () => DeployConfigShape;
+export declare const isDeployConfigRegistered: () => boolean;

package/dist/emailRegistry.d.ts

@@ -0,0 +1,139 @@
+/**
+ * A single email attachment (email F2). Adapters (Resend, SMTP/Nodemailer, SES)
+ * thread these into their provider payload. `content` is the raw bytes
+ * (`Buffer`/`Uint8Array`) or a base64 string; provide a `path`/`href` instead
+ * for adapters that fetch externally. Shapes are intentionally permissive so a
+ * single attachment object works across providers — each adapter maps the
+ * fields it supports.
+ */
+export interface EmailAttachment {
+    /** File name shown to the recipient (e.g. `invoice.pdf`). */
+    filename: string;
+    /** Inline bytes or base64 string. Mutually exclusive with `path`/`href`. */
+    content?: Buffer | Uint8Array | string;
+    /**
+     * Local file path the adapter reads (when it supports path-based sends).
+     *
+     * @security Trusted-input field — do NOT derive from client-supplied data
+     * without validation. Framework-level path-traversal or safe-directory checks
+     * are NOT applied automatically; callers must reject paths that escape the
+     * intended directory (e.g. containing `..` or absolute paths outside a known
+     * root) before passing them here.
+     */
+    path?: string;
+    /**
+     * Remote URL the adapter fetches (when it supports href-based sends).
+     *
+     * @security Trusted-input field — do NOT derive from client-supplied data
+     * without validation. Only `https:` and `http:` URLs are safe for
+     * framework-internal use; arbitrary schemes (e.g. `file:`, `data:`) may be
+     * forwarded to nodemailer/Resend without restriction. Validate against an
+     * allowlist before passing here.
+     */
+    href?: string;
+    /** MIME type (e.g. `application/pdf`). Adapter may infer from `filename` if omitted. */
+    contentType?: string;
+    /** `Content-ID` for inline/embedded images referenced by `cid:` in the HTML. */
+    cid?: string;
+}
+export interface EmailMessage {
+    to: string | string[];
+    subject: string;
+    html: string;
+    text?: string;
+    from?: string;
+    replyTo?: string;
+    cc?: string | string[];
+    bcc?: string | string[];
+    /**
+     * File attachments (email F2). Owned by core (not `@luckystack/email`) so the
+     * type is the single source of truth across the framework and every adapter;
+     * adapters thread these into their provider's attachment payload. Optional —
+     * a message without attachments behaves exactly as before.
+     */
+    attachments?: EmailAttachment[];
+    /**
+     * Custom message headers (email F2) — e.g. `X-Entity-Ref-ID`,
+     * `List-Unsubscribe`, idempotency keys. Adapters merge these over the headers
+     * they set themselves (adapter-reserved headers win to avoid breaking
+     * delivery). Optional.
+     *
+     * @security CR and LF characters in header keys or values enable SMTP header
+     * injection. `sendEmail` strips `\r` and `\n` from every key and value before
+     * passing them to the adapter (EMAIL-O7). Do NOT derive keys or values from
+     * unsanitized client input.
+     */
+    headers?: Record<string, string>;
+}
+export type EmailDeliveryOutcome = 'not-sent' | 'unknown';
+export type EmailResult = {
+    ok: true;
+    id: string;
+} | {
+    ok: false;
+    reason: string;
+    cause?: unknown;
+    /**
+     * `unknown` means the caller stopped waiting after dispatch began; retry
+     * only with the same idempotency key. Omitted on legacy/provider failures
+     * whose delivery semantics are adapter-specific.
+     */
+    deliveryOutcome?: EmailDeliveryOutcome;
+};
+export interface EmailSendContext {
+    /** Cooperative cancellation. Custom adapters should abort provider I/O when supported. */
+    signal: AbortSignal;
+    /** Stable caller-provided key reused across retries of the same logical email. */
+    idempotencyKey?: string;
+}
+export interface EmailSender {
+    /** Adapter identifier for logs + diagnostics ("console", "resend", "smtp", etc.). */
+    name: string;
+    /**
+     * The optional context preserves source compatibility with pre-0.7 adapters.
+     * New adapters should honor `signal` and provider-native idempotency where available.
+     */
+    send: (message: EmailMessage, context?: EmailSendContext) => Promise<EmailResult>;
+}
+/**
+ * Registry keyed by adapter-slot name. Reserved slots used by the
+ * framework:
+ *
+ *  - `'default'` — fallback when no specific slot matches.
+ *  - `'transactional'` — login password-reset, account-confirmation,
+ *    invoice-receipt, security-critical emails.
+ *  - `'marketing'` — newsletters, announcements; consumers MAY route
+ *    bulk sends here.
+ *  - `'diagnostics'` — diagnostic-test endpoints (e.g. playground).
+ *
+ * Custom slot names ('billing', 'support', etc.) are allowed; consumers
+ * resolve them explicitly via `sendEmail({ adapter: 'billing', ... })`.
+ */
+export type EmailSenderRegistry = Partial<Record<string, EmailSender>>;
+/**
+ * Register a single global email sender. Kept for backwards compatibility.
+ * For new code, prefer `registerEmailSenders({ ... })` which lets the
+ * framework route transactional vs. marketing through different adapters.
+ */
+export declare const registerEmailSender: (sender: EmailSender) => void;
+/**
+ * Register multiple named email senders. Replaces the entire registry
+ * (last-write-wins). Use this when your app routes different message
+ * types through different adapters — e.g. Resend for marketing and SMTP
+ * for transactional. The framework picks adapter slots by convention
+ * (see `EmailSenderRegistry`); consumer code can pick explicitly via
+ * `sendEmail({ adapter: 'foo', ... })`.
+ */
+export declare const registerEmailSenders: (senders: EmailSenderRegistry) => void;
+/** Read the legacy single sender (or the `default` slot of the registry). */
+export declare const getEmailSender: () => EmailSender | null;
+/**
+ * Read a specific named sender. Falls back to the legacy single sender
+ * when the requested slot is absent. Returns null when neither exists.
+ * Pass the convention-based slots (`'transactional'`, `'marketing'`,
+ * `'diagnostics'`, `'default'`) or any custom slot you registered.
+ */
+export declare const getEmailSenderByName: (name: string) => EmailSender | null;
+/** Read every registered slot name. */
+export declare const listEmailSenderNames: () => string[];
+export declare const isEmailSenderRegistered: () => boolean;

package/dist/env.d.ts

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+declare const EnvSchema: z.ZodObject<{
+    NODE_ENV: z.ZodDefault<z.ZodEnum<{
+        development: "development";
+        production: "production";
+        test: "test";
+    }>>;
+    SERVER_IP: z.ZodDefault<z.ZodString>;
+    SECURE: z.ZodDefault<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>;
+    REDIS_HOST: z.ZodDefault<z.ZodString>;
+    REDIS_PORT: z.ZodDefault<z.ZodString>;
+    PROJECT_NAME: z.ZodDefault<z.ZodString>;
+}, z.core.$loose>;
+export type RuntimeEnv = z.infer<typeof EnvSchema>;
+export declare const DEFAULT_ENV_FILES: string[];
+export declare const getEnvFiles: () => string[];
+export declare const loadEnvFiles: () => void;
+export declare const bootstrapEnv: () => RuntimeEnv;
+export declare const env: {
+    [x: string]: unknown;
+    NODE_ENV: "development" | "production" | "test";
+    SERVER_IP: string;
+    SECURE: "false" | "true";
+    REDIS_HOST: string;
+    REDIS_PORT: string;
+    PROJECT_NAME: string;
+};
+export declare const isProduction: boolean;
+export declare const getEnv: () => RuntimeEnv;
+/** Application runtime mode. Keep separate from `resolveEnvKey()`, which is a
+ * deploy-topology identity and may be `staging`, `dockerSplit`, etc. */
+export declare const resolveRuntimeMode: () => RuntimeEnv['NODE_ENV'];
+export declare const isProductionRuntime: () => boolean;
+export declare const isTestRuntime: () => boolean;
+export {};

package/dist/errorFormatterRegistry.d.ts

@@ -0,0 +1,54 @@
+export interface ErrorFormatterContext {
+    /** Resolved route name (`api/billing/getInvoice/v1`, `sync/...`). */
+    routeName: string;
+    /** Transport that triggered the error. */
+    transport: 'socket' | 'http';
+    /** Session id when available. */
+    userId?: string | null;
+}
+/** The normalized error envelope handed to every formatter. */
+export interface FormatterErrorEnvelope {
+    status: 'error';
+    errorCode?: string;
+    message?: string;
+    httpStatus?: number;
+    [key: string]: unknown;
+}
+export type ErrorFormatter = (error: FormatterErrorEnvelope, ctx: ErrorFormatterContext) => Record<string, unknown>;
+/**
+ * Minimal structural contract every formatter-eligible envelope satisfies:
+ * a discriminant `status` plus an open string-index so formatters can read /
+ * add arbitrary fields. Generic helpers below constrain to this so transport
+ * handlers no longer need `as unknown as` double-casts at the formatter
+ * boundary — see `applyErrorFormatter` / `buildFormattedError`.
+ */
+export interface FormatterEnvelope {
+    status?: string;
+    [key: string]: unknown;
+}
+/**
+ * Register a global error-response formatter. Receives the normalized
+ * error envelope + context; return a (possibly extended) object that the
+ * framework will emit. Pass `null` to unregister.
+ *
+ * For per-endpoint overrides, export `errorFormatter` from your
+ * `_api/foo_v1.ts` file directly — the api/sync handler imports + invokes
+ * it through `applyErrorFormatter`.
+ */
+export declare const registerErrorFormatter: (formatter: ErrorFormatter | null) => void;
+/** Read the active global formatter (or null). */
+export declare const getErrorFormatter: () => ErrorFormatter | null;
+/**
+ * Apply per-route → global → identity formatter chain to a normalized
+ * error envelope. Returns the envelope unchanged when `status !== 'error'`
+ * so it's safe to wrap every emit call. Errors thrown inside a formatter
+ * are caught and logged; the un-formatted envelope is returned in that
+ * case to keep the error path crash-resistant.
+ */
+export declare const applyErrorFormatter: <T extends FormatterEnvelope>(input: {
+    response: T;
+    routeName: string;
+    transport: 'socket' | 'http';
+    userId?: string | null;
+    perRouteFormatter?: ErrorFormatter | undefined | null;
+}) => T;

package/dist/errorTrackerIdentity.d.ts

@@ -0,0 +1,14 @@
+export interface ErrorTrackerUser {
+    id?: string;
+    email?: string;
+    username?: string;
+    [key: string]: unknown;
+}
+/** Open an isolated request identity scope before the first async boundary. */
+export declare const runWithErrorTrackerIdentityScope: <T>(fn: () => T) => T;
+/** Open an isolated scope with a user that is already known. */
+export declare const runWithErrorTrackerIdentity: <T>(user: ErrorTrackerUser | null, fn: () => T) => T;
+/** Set the user inside the active request scope; no-op outside a scope. */
+export declare const setCurrentErrorTrackerIdentity: (user: ErrorTrackerUser | null) => void;
+/** Read the current request identity, or null outside a scope. */
+export declare const getCurrentErrorTrackerIdentity: () => ErrorTrackerUser | null;

package/dist/errorTrackerRegistry.d.ts

@@ -0,0 +1,85 @@
+import type { ErrorTrackerUser } from './errorTrackerIdentity.js';
+export type { ErrorTrackerUser } from './errorTrackerIdentity.js';
+export type ErrorTrackerContext = Record<string, unknown>;
+export declare const sanitizeErrorString: (value: string) => string;
+export declare const sanitizeErrorStrings: (error: unknown) => {
+    message: string;
+    stack: string | undefined;
+} | null;
+export interface ErrorTrackerEvent {
+    /** When false, the adapter must not forward this event (beforeSend opt-out). */
+    forwarded: boolean;
+    kind: 'exception' | 'message';
+    payload: Record<string, unknown>;
+}
+export type SpanResult<T> = T;
+export interface ErrorTracker {
+    /** Human-readable identifier (logs, diagnostics). */
+    name: string;
+    captureException: (error: unknown, context?: ErrorTrackerContext) => void;
+    captureMessage: (message: string, level: 'info' | 'warning' | 'error' | 'fatal', context?: ErrorTrackerContext) => void;
+    setUser: (user: ErrorTrackerUser | null) => void;
+    setContext?: (key: string, context: ErrorTrackerContext | null) => void;
+    startSpan?: <T>(name: string, op: string, fn: () => T) => T;
+    /**
+     * Optional handle-style span (#62): open a span NOW and close it later via the
+     * returned handle's `finish()`. Unlike {@link startSpan} (which wraps a single
+     * synchronous `fn`), this fits an open-at-preExecute / close-at-postExecute
+     * request lifecycle that spans awaits. When present, the registry-level
+     * {@link startSpanHandle} delegates to the FIRST registered adapter that
+     * implements it so the request span reaches an adapter-only backend
+     * (Datadog/PostHog/custom), not just the legacy Sentry SDK path.
+     */
+    startSpanHandle?: (name: string, op: string) => {
+        finish: () => void;
+    };
+    recordMetric?: (name: string, value: number, tags?: Record<string, string>) => void;
+    beforeSend?: (event: ErrorTrackerEvent) => ErrorTrackerEvent | null;
+    /**
+     * Optional flush lifecycle hook (error-tracking ET batch). Called by
+     * {@link flushErrorTrackers} on graceful shutdown so a buffered adapter
+     * (PostHog batch, Sentry transport) can drain in-flight events before exit.
+     * Returns a promise that resolves when the adapter has flushed.
+     */
+    flush?: () => Promise<void>;
+}
+export type PreCaptureFilter = (event: ErrorTrackerEvent) => boolean;
+export declare const registerPreCaptureFilter: (filter: PreCaptureFilter | null) => void;
+export declare const registerErrorTracker: (tracker: ErrorTracker) => void;
+export declare const registerErrorTrackers: (trackers: ErrorTracker[]) => void;
+/**
+ * APPEND primitive (ET-05): add a tracker WITHOUT clobbering already-registered
+ * ones. Fixes the async-PostHog-vs-consumer-overlay race where the loser of
+ * `registerErrorTracker`'s replace silently vanished. De-duplicates by `name`
+ * (re-appending the same adapter name replaces that one entry in place) so a
+ * lazy adapter that registers a proxy then the real client doesn't double-fire.
+ */
+export declare const appendErrorTracker: (tracker: ErrorTracker) => void;
+export declare const getActiveErrorTrackers: () => ErrorTracker[];
+/**
+ * Flush lifecycle (error-tracking ET batch): drain every adapter that exposes a
+ * `flush()` before shutdown. Per-adapter failures are swallowed + logged so one
+ * stuck adapter can't block graceful shutdown. Safe to call when no adapter has
+ * `flush`.
+ */
+export declare const flushErrorTrackers: () => Promise<void>;
+export declare const captureExceptionAcrossTrackers: (error: unknown, context?: ErrorTrackerContext) => void;
+export declare const captureMessageAcrossTrackers: (message: string, level: 'info' | 'warning' | 'error' | 'fatal', context?: ErrorTrackerContext) => void;
+export declare const setErrorTrackerUser: (user: ErrorTrackerUser | null) => void;
+export declare const recordMetricAcrossTrackers: (name: string, value: number, tags?: Record<string, string>) => void;
+export declare const startSpanAcrossTrackers: <T>(name: string, op: string, fn: () => T) => T;
+/**
+ * Handle-style span (error-tracking ET batch): for callers that can't wrap the
+ * measured work in a single synchronous `fn` (streaming, cross-await spans).
+ * Returns a handle whose `finish()` resolves the span's duration. The default
+ * implementation is a lightweight wall-clock timer (works with any backend);
+ * an adapter can supply a richer span via the existing `startSpan` callback
+ * form when it needs native instrumentation. `finish()` is idempotent.
+ */
+export interface SpanHandle {
+    /** Stop the span; safe to call more than once (subsequent calls are no-ops). */
+    finish: () => void;
+    /** Milliseconds elapsed at the moment `finish()` first ran (0 before). */
+    readonly durationMs: number;
+}
+export declare const startSpanHandle: (name: string, op: string) => SpanHandle;

package/dist/escapeHtml.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Escape `&`, `<`, `>`, `"`, `'` for safe interpolation into HTML text nodes
+ * and quoted attribute values. Does NOT protect against CSS/JS/URL-context
+ * injection — use a dedicated sanitizer for those contexts.
+ */
+export declare const escapeHtml: (str: string) => string;

package/dist/eslint/index.d.ts

@@ -1,10 +1,7 @@
-import { Rule, Linter } from 'eslint';
-
-type EslintRule = Rule.RuleModule;
-
-declare const hasPackage: (name: string) => boolean;
-
+import type { Linter } from 'eslint';
+import type { EslintRule } from './internal/ruleTypes.js';
 declare const allRules: Record<string, EslintRule>;
 declare const luckystackConfig: Linter.Config[];
-
-export { luckystackConfig as default, hasPackage, allRules as rules };
+export default luckystackConfig;
+export { allRules as rules };
+export { hasPackage } from './internal/hasPackage.js';

package/dist/eslint/internal/hasPackage.d.ts

@@ -0,0 +1 @@
+export declare const hasPackage: (name: string) => boolean;

package/dist/eslint/internal/ruleTypes.d.ts

@@ -0,0 +1,4 @@
+import type { Rule } from 'eslint';
+export type EslintRule = Rule.RuleModule;
+export type RuleContext = Rule.RuleContext;
+export type RuleListener = Rule.RuleListener;

package/dist/eslint/rules/no-arbitrary-tailwind-color.d.ts

@@ -0,0 +1,3 @@
+import type { EslintRule } from '../internal/ruleTypes.js';
+declare const rule: EslintRule;
+export default rule;

package/dist/eslint/rules/no-direct-prisma-import-in-components.d.ts

@@ -0,0 +1,3 @@
+import type { EslintRule } from '../internal/ruleTypes.js';
+declare const rule: EslintRule;
+export default rule;

package/dist/eslint/rules/no-local-socket-enumeration.d.ts

@@ -0,0 +1,3 @@
+import type { EslintRule } from '../internal/ruleTypes.js';
+declare const rule: EslintRule;
+export default rule;

package/dist/eslint/rules/no-raw-fetch-in-src.d.ts

@@ -0,0 +1,3 @@
+import type { EslintRule } from '../internal/ruleTypes.js';
+declare const rule: EslintRule;
+export default rule;

package/dist/eslint/rules/no-raw-try-catch.d.ts

@@ -0,0 +1,3 @@
+import type { EslintRule } from '../internal/ruleTypes.js';
+declare const rule: EslintRule;
+export default rule;

package/dist/eslint/rules/no-unsafe-api-wrappers.d.ts

@@ -0,0 +1,3 @@
+import type { EslintRule } from '../internal/ruleTypes.js';
+declare const rule: EslintRule;
+export default rule;