@moxon/api 6.0.0-pre

package/.prettierignore

@@ -0,0 +1,5 @@
+.github/
+dist/
+node_modules/
+package-lock.json
+package.json

package/LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2024, Sylvain L.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/README.md

@@ -0,0 +1,277 @@
+# @moxon/api
+
+## About
+
+`@moxon/api` bundles 40+ self-contained utilities: encryption, matrix math, SVG charts, CSV, JWT, TOTP, barcodes, fake data generation, text processing, validation and more. Install it and import — no configuration, no setup step, types included.
+
+It works two ways:
+
+- **As a library** — import any module directly into your code.
+- **As a server** — a single import boots an Express app that exposes every module over HTTP.
+
+The HTTP surface is versioned from `v4` to `v6`, and every version stays mounted side by side, so a new release never changes the behaviour of the one you already target. The full endpoint reference lives on [docs.sylvain.sh](https://docs.sylvain.sh).
+
+## Migrating from `@20syldev/api`
+
+`@moxon/api` is the new name of `@20syldev/api`. This release is the code of `@20syldev/api@6.0.0` under its new name: same exports, same `/v6` HTTP API. Nothing else changed.
+
+```bash
+npm uninstall @20syldev/api
+npm install @moxon/api
+```
+
+Then replace the package name in your imports. The subpaths are the same.
+
+```diff
+- import { evaluate } from '@20syldev/api/v6';
++ import { evaluate } from '@moxon/api/v6';
+```
+
+## Requirements
+
+**Node.js >= 22.12.0.** The package ships as ESM, but that does not lock out CommonJS: Node has been able to `require()` an ESM module since 22.12, which is why that is the floor. The library entry works from both module systems.
+
+```js
+import { evaluate } from '@moxon/api'; // ESM
+const { evaluate } = require('@moxon/api'); // CommonJS
+```
+
+The server entry loads its plugins asynchronously, so it must be imported rather than required:
+
+```js
+await import('@moxon/api/server'); // from CommonJS
+```
+
+## Installation
+
+```console
+$ npm install @moxon/api
+```
+
+## Quick start
+
+The root import always resolves to the latest version. Use a subpath (`/v4` to `/v6`) to pin a specific one.
+
+```js
+// Latest version, equivalent to '@moxon/api/v6'
+import { color, evaluate, username } from '@moxon/api';
+
+// Or a specific version
+import { color as colorV4 } from '@moxon/api/v4';
+
+// Evaluate a math expression
+const expr = evaluate('sin(pi / 2) + sqrt(4)', 5);
+console.log(expr.result); // 3
+console.log(expr.expression); // 'sin(pi / 2) + sqrt(4)'
+
+// Generate a random color, converted to every common notation
+const c = color();
+console.log(c.hex, c.rgb, c.hsl, c.hsv, c.hwb, c.cmyk);
+
+// Generate a random username
+const user = username();
+console.log(user.username);
+```
+
+## What's inside
+
+| Domain             | Exports                                                                               |
+| ------------------ | ------------------------------------------------------------------------------------- |
+| **Crypto**         | `asymmetric` `symmetric` `hash` `jwt` `otp` `token` `password` `captcha`              |
+| **Math & data**    | **`matrix`** **`algorithms`** `evaluate` `statistics` `convert` `csv`                 |
+| **Text**           | **`text`** **`encode`** **`validate`** `caseConvert` `levenshtein` `regex` `parseUrl` |
+| **Graphics**       | **`chart`** `barcode` `qrcode` `avatar` `placeholder` `color` `palette`               |
+| **Fake data**      | `personal` `address` `credit` `username` `dice` `domain` `agent`                      |
+| **Network & time** | `ip` `geo` `time` `cron` `hyperplanning`                                              |
+| **Stateful**       | `chat` `tic_tac_toe`                                                                  |
+
+The six names in **bold** are namespaces — they group related functions, called as `namespace.method()`:
+
+| Namespace        | Functions                                                                                                                |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| **`algorithms`** | `factorial` `fibonacci` `gcd` `isprime` `primefactors` `primelist` `roman` `anagram` `palindrome` `reverse` `bubblesort` |
+| **`chart`**      | `bar` `line` `pie` `donut`                                                                                               |
+| **`encode`**     | `base64encode` `base64decode` `urlencode` `urldecode` `binary` `unbinary` `morse` `unmorse` `caesar` `rot13`             |
+| **`matrix`**     | `add` `subtract` `multiply` `scalar` `transpose` `determinant` `inverse` `identity`                                      |
+| **`text`**       | `lorem` `slug` `stats` `number`                                                                                          |
+| **`validate`**   | `email` `iban` `luhn`                                                                                                    |
+
+Everything else is a plain function, called directly.
+
+Two names differ from their HTTP endpoint, because `case` is a reserved word and `url` is a global identifier:
+
+| Endpoint | Import        |
+| -------- | ------------- |
+| `/case`  | `caseConvert` |
+| `/url`   | `parseUrl`    |
+
+> _`personal` generates **fake** profiles (names, emails, jobs, addresses) for seeding and testing — it holds no real data._
+
+## Examples
+
+```js
+import {
+    asymmetric,
+    caseConvert,
+    chart,
+    csv,
+    evaluate,
+    jwt,
+    matrix,
+    otp,
+    parseUrl,
+    symmetric,
+    validate,
+} from '@moxon/api/v5';
+
+// RSA key generation, encryption and decryption
+const { publicKey, privateKey } = asymmetric('keygen', {});
+const { result: encrypted } = asymmetric('encrypt', { text: 'secret message', publicKey });
+const { result: decrypted } = asymmetric('decrypt', { text: encrypted, privateKey });
+console.log(decrypted); // 'secret message'
+
+// AES-256-GCM symmetric encryption, key derived with scrypt
+const { result: blob } = symmetric('encrypt', 'secret message', 'a-strong-key');
+const { result: plain } = symmetric('decrypt', blob, 'a-strong-key');
+console.log(plain); // 'secret message'
+
+// TOTP secret, code generation and verification
+const { secret, uri } = otp('secret', { label: 'alice', issuer: 'MyApp' });
+const { code } = otp('generate', { secret });
+const { valid } = otp('verify', { secret, code });
+console.log(valid); // true
+
+// Decode a JWT without verifying its signature (inspection only)
+const { header, payload } = jwt('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.qfhpVR4l');
+console.log(header.alg, payload.sub); // 'HS256' '1234567890'
+
+// Evaluate a math expression, with a precision
+const { result } = evaluate('log2(8) * (3 + pi)', 4);
+console.log(result); // 18.4248
+
+// Matrix product
+const { result: product } = matrix.multiply(
+    [
+        [1, 2],
+        [3, 4],
+    ],
+    [
+        [5, 6],
+        [7, 8],
+    ],
+);
+console.log(product); // [[19, 22], [43, 50]]
+
+// Render an SVG chart in memory
+const { body: svg } = chart.bar(
+    { labels: ['Jan', 'Feb', 'Mar'], datasets: [{ label: 'Sales', values: [120, 85, 200] }] },
+    { width: 600, height: 300 },
+);
+// body holds a ready-to-serve SVG string
+
+// Parse CSV into rows, or format rows back into CSV
+const { rows } = csv('parse', { csv: 'name,age\nAlice,30\nBob,25' });
+console.log(rows); // [{ name: 'Alice', age: '30' }, { name: 'Bob', age: '25' }]
+
+// Convert between case styles
+console.log(caseConvert('hello world', 'pascal').result); // 'HelloWorld'
+
+// Split a URL into its components
+const parsed = parseUrl('https://example.com/a/b?tag=x&tag=y#top');
+console.log(parsed.host, parsed.port, parsed.params, parsed.fragment);
+
+// Validate an email, an IBAN or a card number
+console.log(validate.email('alice@example.com').valid); // true
+```
+
+## Running the server
+
+From the installed package, one import mounts every version:
+
+```js
+import '@moxon/api/server';
+```
+
+From a clone of the repository:
+
+```console
+$ npm run build && npm start
+```
+
+```console
+> @moxon/api@6.0.0-pre build
+> tsc
+
+> @moxon/api@6.0.0-pre start
+> node dist/app.js
+
+API is running on
+    - http://127.0.0.1:3000
+    - http://localhost:3000
+```
+
+For development with automatic reloading:
+
+```console
+$ npm run dev
+```
+
+Endpoints follow the `/:version/:endpoint` pattern — `GET /v5/color`, `GET /v5/evaluate?expr=2%2B2`, `POST /v5/matrix`. `GET /` lists the available versions, and `GET /:version` lists that version's endpoints with their parameters.
+
+### Configuration
+
+Every setting is optional and read from the environment; a `.env` file at the project root is loaded automatically. The server runs with none of them set.
+
+| Variable           | Default | Purpose                                                                                                                                                |
+| ------------------ | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `PORT`             | `3000`  | Port the server listens on                                                                                                                             |
+| `DOCS_URL`         | —       | Documentation base URL reported by `/`, `/:version` and `/:version/infos`                                                                              |
+| `REPO_URL`         | —       | Source repository reported by `/:version/infos`                                                                                                        |
+| `INSTANCE_CREATED` | —       | Launch date reported by `/:version/infos`                                                                                                              |
+| `LOGS_TOKEN`       | —       | Value required in the `X-Logs-Token` header to read `/logs`; the route answers 404 while unset                                                         |
+| `CHALLENGE_SECRET` | random  | Key signing the captcha and proof-of-work tokens; a random one is generated at startup while unset                                                     |
+| `TRUSTED_PROXIES`  | one hop | CIDR blocks separated by spaces or commas, or the `loopback` / `linklocal` / `uniquelocal` shorthands, for deployments behind a CDN or platform router |
+| `GLOBAL_LIMIT`     | `50000` | Requests per hour accepted across the whole instance                                                                                                   |
+| `DEFAULT_LIMIT`    | `2000`  | Per-client requests per hour                                                                                                                           |
+| `DEFAULT_BURST`    | `50`    | Per-client requests per 10-second window                                                                                                               |
+
+The three metadata variables are omitted from responses when unset, so an instance never advertises somebody else's documentation or repository.
+
+Higher quotas can be granted per client: `ADVANCED_`, `PRO_` and `BUSINESS_` variants of `_LIMIT` and `_BURST` define the tiers, and the matching `*_TOKEN_LIST` variables hold the space-separated bearer tokens that map to them. A client's tier and quota are reported by `GET /auth`.
+
+> _Rate-limit counters live in process memory, so each instance of a multi-instance deployment counts separately._
+
+> _Captcha and proof-of-work tokens are signed with `CHALLENGE_SECRET`. While it is unset each process invents its own key, so tokens stop verifying after a restart and are rejected by sibling instances — set it explicitly for any deployment running more than one process, with a full-entropy value such as `openssl rand -hex 32`._
+
+## Versioning
+
+| Version | What it changes                                                                                                                                                          |
+| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `v4`    | The first fully typed version, and the one that introduced the PATCH and DELETE routes                                                                                   |
+| `v5`    | Adds `base`, `case`, `csv`, `diff`, `evaluate`, `pow`, `read`, `semver`, `url`, `uuid`, asymmetric and symmetric crypto, charts, JWT, matrices and OTP                   |
+| `v6`    | The captcha answers with a signed token by default, `levenshtein` moves to POST, chat and tic-tac-toe carry their identifiers in the body, `hyperplanning` is deprecated |
+
+Every version is fully typed. The package root always tracks the latest one.
+
+> _`v1`, `v2` and `v3` were removed in `6.0.0`, along with the untyped JavaScript they shared. Install `@20syldev/api@5.9.0` if you still need them._
+
+> _`hyperplanning` is deprecated: it still works on every version, but `v6` no longer lists it among its endpoints, and it will be removed entirely in `7.0.0`._
+
+## Scripts
+
+| Command          | Description                                             |
+| ---------------- | ------------------------------------------------------- |
+| `npm run dev`    | Development server with automatic reloading (tsx watch) |
+| `npm run build`  | Compile TypeScript to `dist/`                           |
+| `npm start`      | Start the production server (`node dist/app.js`)        |
+| `npm test`       | Run unit and integration tests                          |
+| `npm run format` | Format with Prettier and auto-fix with ESLint           |
+| `npm run check`  | TypeScript and ESLint verification                      |
+
+## Hosted instance
+
+A public instance runs at [api.sylvain.sh](https://api.sylvain.sh), with the complete endpoint reference, request examples and usage guides on [docs.sylvain.sh](https://docs.sylvain.sh).
+
+## License
+
+BSD 3-Clause. See [LICENSE](LICENSE).

package/dist/app.d.ts

@@ -0,0 +1,2 @@
+declare const app: import("express-serve-static-core").Express;
+export default app;

package/dist/app.js

@@ -0,0 +1,55 @@
+import express from 'express';
+import { env } from './config/env.js';
+import { setupCors } from './middleware/cors.js';
+import { errorHandler } from './middleware/error.js';
+import { jsonResponseMiddleware } from './middleware/json.js';
+import { loggerMiddleware } from './middleware/logger.js';
+import { rateLimitMiddleware } from './middleware/ratelimit.js';
+import { endpointCheckMiddleware, versionCheckMiddleware } from './middleware/version.js';
+import deleteRoutes from './routes/delete.js';
+import getRoutes from './routes/get.js';
+import indexRoutes from './routes/index.js';
+import patchRoutes from './routes/patch.js';
+import postRoutes from './routes/post.js';
+import { error } from './utils/response.js';
+const app = express();
+// Setup CORS, body parsing, static files
+setupCors(app);
+// Custom JSON response
+app.use(jsonResponseMiddleware);
+// Rate limiting
+app.use(rateLimitMiddleware);
+// Request logging
+app.use(loggerMiddleware);
+// Root routes (before version check)
+app.use(indexRoutes);
+// Version & endpoint validation
+app.use('/:version', versionCheckMiddleware);
+app.use('/:version/:endpoint', endpointCheckMiddleware);
+// Load plugins if available
+const entry = './plugins/index.js';
+try {
+    const { default: plugins } = (await import(entry));
+    for (const plugin of plugins)
+        app.use(plugin);
+}
+catch {
+    // No plugins bundled in this build
+}
+// Versioned routes
+app.use(getRoutes);
+app.use(postRoutes);
+app.use(patchRoutes);
+app.use(deleteRoutes);
+// JSON 404 fallback
+app.use((req, res) => {
+    error(res, 404, `Endpoint '${req.path}' does not exist.`);
+});
+// Error handling (after routes)
+app.use(errorHandler);
+// Start server
+if (process.env.NODE_ENV !== 'test') {
+    app.listen(env.PORT, () => console.log(`API is running on\n    - http://127.0.0.1:${env.PORT}\n    - http://localhost:${env.PORT}`));
+}
+export default app;
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAqD,MAAM,SAAS,CAAC;AAE5E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAE5C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;AAEtB,yCAAyC;AACzC,SAAS,CAAC,GAAG,CAAC,CAAC;AAEf,uBAAuB;AACvB,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAEhC,gBAAgB;AAChB,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAE7B,kBAAkB;AAClB,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAE1B,qCAAqC;AACrC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAErB,gCAAgC;AAChC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;AAC7C,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;AAExD,4BAA4B;AAC5B,MAAM,KAAK,GAAG,oBAAoB,CAAC;AACnC,IAAI,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAA0B,CAAC;IAC5E,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAAC,MAAM,CAAC;IACL,mCAAmC;AACvC,CAAC;AAED,mBAAmB;AACnB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACnB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACpB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACrB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAEtB,oBAAoB;AACpB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACpC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,GAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEH,gCAAgC;AAChC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAEtB,eAAe;AACf,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;IAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CACtB,OAAO,CAAC,GAAG,CAAC,6CAA6C,GAAG,CAAC,IAAI,4BAA4B,GAAG,CAAC,IAAI,EAAE,CAAC,CAC3G,CAAC;AACN,CAAC;AAED,eAAe,GAAG,CAAC"}

package/dist/config/env.d.ts

@@ -0,0 +1,22 @@
+export declare function envList(key: string): string[] | null;
+export declare const env: {
+    PORT: number;
+    TRUSTED_PROXIES: string[] | null;
+    DOCS_URL: string;
+    REPO_URL: string;
+    INSTANCE_CREATED: string;
+    LOGS_TOKEN: string;
+    CHALLENGE_SECRET: string;
+    DEFAULT_LIMIT: number;
+    ADVANCED_LIMIT: number;
+    PRO_LIMIT: number;
+    BUSINESS_LIMIT: number;
+    GLOBAL_LIMIT: number;
+    DEFAULT_BURST: number;
+    ADVANCED_BURST: number;
+    PRO_BURST: number;
+    BUSINESS_BURST: number;
+    BUSINESS_TOKEN_LIST: string[];
+    PRO_TOKEN_LIST: string[];
+    ADVANCED_TOKEN_LIST: string[];
+};

package/dist/config/env.js

@@ -0,0 +1,36 @@
+import dotenv from 'dotenv';
+import { DEFAULT_PORT } from '../constants.js';
+dotenv.config();
+export function envList(key) {
+    const v = process.env[key];
+    if (!v || v === 'undefined')
+        return null;
+    const items = v.split(/[\s,]+/).filter(Boolean);
+    return items.length ? items : null;
+}
+function envNumber(key, fallback) {
+    const v = parseInt(process.env[key] ?? '', 10);
+    return isNaN(v) ? fallback : v;
+}
+export const env = {
+    PORT: envNumber('PORT', DEFAULT_PORT),
+    TRUSTED_PROXIES: envList('TRUSTED_PROXIES'),
+    DOCS_URL: (process.env.DOCS_URL ?? '').replace(/\/+$/, ''),
+    REPO_URL: process.env.REPO_URL ?? '',
+    INSTANCE_CREATED: process.env.INSTANCE_CREATED ?? '',
+    LOGS_TOKEN: process.env.LOGS_TOKEN ?? '',
+    CHALLENGE_SECRET: process.env.CHALLENGE_SECRET ?? '',
+    DEFAULT_LIMIT: envNumber('DEFAULT_LIMIT', 2000),
+    ADVANCED_LIMIT: envNumber('ADVANCED_LIMIT', 3500),
+    PRO_LIMIT: envNumber('PRO_LIMIT', 6000),
+    BUSINESS_LIMIT: envNumber('BUSINESS_LIMIT', 10000),
+    GLOBAL_LIMIT: envNumber('GLOBAL_LIMIT', 50000),
+    DEFAULT_BURST: envNumber('DEFAULT_BURST', 50),
+    ADVANCED_BURST: envNumber('ADVANCED_BURST', 80),
+    PRO_BURST: envNumber('PRO_BURST', 120),
+    BUSINESS_BURST: envNumber('BUSINESS_BURST', 200),
+    BUSINESS_TOKEN_LIST: envList('BUSINESS_TOKEN_LIST') ?? [],
+    PRO_TOKEN_LIST: envList('PRO_TOKEN_LIST') ?? [],
+    ADVANCED_TOKEN_LIST: envList('ADVANCED_TOKEN_LIST') ?? [],
+};
+//# sourceMappingURL=env.js.map

package/dist/config/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,MAAM,UAAU,OAAO,CAAC,GAAW;IAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,QAAgB;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG;IACf,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC;IACrC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC;IAE3C,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE;IACpC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;IAEpD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE;IACxC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;IAEpD,aAAa,EAAE,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/C,cAAc,EAAE,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC;IACvC,cAAc,EAAE,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC;IAClD,YAAY,EAAE,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC;IAE9C,aAAa,EAAE,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC;IAC7C,cAAc,EAAE,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC;IAC/C,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC;IACtC,cAAc,EAAE,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC;IAEhD,mBAAmB,EAAE,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE;IACzD,cAAc,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE;IAC/C,mBAAmB,EAAE,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE;CAC5D,CAAC"}

package/dist/config/plans.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Rate limit plans configuration.
+ *
+ * hourly  — max requests per hour (matches pricing page)
+ * burst   — max requests per 10-second window
+ * tokens  — list of bearer tokens for this tier
+ *
+ * To adjust limits, edit the values below or override via .env:
+ *   DEFAULT_LIMIT, ADVANCED_LIMIT, PRO_LIMIT, BUSINESS_LIMIT
+ *   DEFAULT_BURST, ADVANCED_BURST, PRO_BURST, BUSINESS_BURST
+ */
+export interface Plan {
+    hourly: number;
+    burst: number;
+    tokens: string[];
+}
+export declare const plans: Record<string, Plan>;
+export declare const globalLimit: number;
+/**
+ * Returns the plan matching a bearer token, or 'default'.
+ * Returns null if the token is provided but invalid.
+ */
+export declare function getPlan(token: string): {
+    name: string;
+    plan: Plan;
+} | null;

package/dist/config/plans.js

@@ -0,0 +1,44 @@
+import { env } from './env.js';
+export const plans = {
+    business: {
+        hourly: env.BUSINESS_LIMIT,
+        burst: env.BUSINESS_BURST,
+        tokens: env.BUSINESS_TOKEN_LIST,
+    },
+    pro: {
+        hourly: env.PRO_LIMIT,
+        burst: env.PRO_BURST,
+        tokens: env.PRO_TOKEN_LIST,
+    },
+    advanced: {
+        hourly: env.ADVANCED_LIMIT,
+        burst: env.ADVANCED_BURST,
+        tokens: env.ADVANCED_TOKEN_LIST,
+    },
+    default: {
+        hourly: env.DEFAULT_LIMIT,
+        burst: env.DEFAULT_BURST,
+        tokens: [],
+    },
+};
+export const globalLimit = env.GLOBAL_LIMIT; // 50 000/h
+/**
+ * Returns the plan matching a bearer token, or 'default'.
+ * Returns null if the token is provided but invalid.
+ */
+export function getPlan(token) {
+    if (!token)
+        return { name: 'default', plan: plans.default };
+    if (token === 'undefined')
+        return null;
+    for (const [name, plan] of Object.entries(plans)) {
+        if (name === 'default')
+            continue;
+        if (plan.tokens.includes('undefined'))
+            continue;
+        if (plan.tokens.includes(token))
+            return { name, plan };
+    }
+    return null;
+}
+//# sourceMappingURL=plans.js.map

package/dist/config/plans.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plans.js","sourceRoot":"","sources":["../../src/config/plans.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAoB/B,MAAM,CAAC,MAAM,KAAK,GAAyB;IACvC,QAAQ,EAAE;QACN,MAAM,EAAE,GAAG,CAAC,cAAc;QAC1B,KAAK,EAAE,GAAG,CAAC,cAAc;QACzB,MAAM,EAAE,GAAG,CAAC,mBAAmB;KAClC;IACD,GAAG,EAAE;QACD,MAAM,EAAE,GAAG,CAAC,SAAS;QACrB,KAAK,EAAE,GAAG,CAAC,SAAS;QACpB,MAAM,EAAE,GAAG,CAAC,cAAc;KAC7B;IACD,QAAQ,EAAE;QACN,MAAM,EAAE,GAAG,CAAC,cAAc;QAC1B,KAAK,EAAE,GAAG,CAAC,cAAc;QACzB,MAAM,EAAE,GAAG,CAAC,mBAAmB;KAClC;IACD,OAAO,EAAE;QACL,MAAM,EAAE,GAAG,CAAC,aAAa;QACzB,KAAK,EAAE,GAAG,CAAC,aAAa;QACxB,MAAM,EAAE,EAAE;KACb;CACJ,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,WAAW;AAExD;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,KAAa;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAQ,EAAE,CAAC;IAC7D,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAEvC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,SAAS;QAChD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/config/versions.d.ts

@@ -0,0 +1,18 @@
+import * as apiv4 from '../modules/v4.js';
+import * as apiv5 from '../modules/v5.js';
+import * as apiv6 from '../modules/v6.js';
+export interface Endpoint {
+    name: string;
+    path?: string;
+    children?: Record<string, string>;
+}
+export interface VersionConfig {
+    endpoints: {
+        get: Endpoint[];
+        post: Endpoint[];
+        patch?: Endpoint[];
+        delete?: Endpoint[];
+    };
+    modules: typeof apiv4 | typeof apiv5 | typeof apiv6;
+}
+export declare const versions: Record<string, VersionConfig>;