@proteinjs/user-server 1.22.0 → 1.22.2

package/dist/src/throttle/RequestDigests.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequestDigests = void 0;
+var crypto_1 = require("crypto");
+/**
+ * The two keyed digests the throttled doors key their windows on and write on their log lines,
+ * in place of what they stand for:
+ * - `account(email)` — the ACCOUNT DIGEST: a keyed hash of the trimmed, lowercased address.
+ *   One address gives one digest however it was typed, on every replica and across restarts, so
+ *   an operator can say "one account" across lines without the address.
+ * - `coarseIp(address)` — the COARSE IP HASH: a keyed hash of the client address at the grain
+ *   one device holds (an IPv4 address; an IPv6 /64, inside which a device rotates freely), so
+ *   an operator can say "one device" and a throttle cannot be dodged by rotating inside a /64.
+ *
+ * Keyed with HMAC-SHA256 under a key DERIVED from the session secret — the one secret every
+ * replica already shares, the same keying the invite-request door's IP hash uses; derived per
+ * purpose, never used raw, so neither digest weakens the session's own use of it, and the two
+ * digests never collide in meaning. Truncated to 64 bits: enough to tell accounts and devices
+ * apart, useless to anyone without the key — never the address, never a plain hash a list of
+ * addresses could reverse.
+ *
+ * The key is the deployment's `SESSION_SECRET` unless the constructor is given one (the tests).
+ * Without either the digests refuse to run: a server with no `SESSION_SECRET` has no sessions
+ * either (the session middleware refuses to start), so nothing ever runs unkeyed — never a plain
+ * hash a list of addresses could reverse, never a per-process key that quietly stops matching
+ * across replicas.
+ */
+var RequestDigests = /** @class */ (function () {
+    function RequestDigests(options) {
+        this.options = options;
+    }
+    /** The account digest of an address, however it was typed. */
+    RequestDigests.prototype.account = function (email) {
+        return this.digest('account-digest', email.trim().toLowerCase());
+    };
+    /** The coarse IP hash of a client address (see `ClientAddress`). */
+    RequestDigests.prototype.coarseIp = function (address) {
+        return this.digest('coarse-ip', this.coarsen(address.trim().toLowerCase()));
+    };
+    RequestDigests.prototype.digest = function (purpose, value) {
+        return (0, crypto_1.createHmac)('sha256', "".concat(purpose, ":").concat(this.secret()))
+            .update(value)
+            .digest('hex')
+            .slice(0, RequestDigests.DIGEST_HEX_LENGTH);
+    };
+    RequestDigests.prototype.secret = function () {
+        var _a, _b;
+        var configured = (_b = (_a = this.options) === null || _a === void 0 ? void 0 : _a.secret) !== null && _b !== void 0 ? _b : process.env.SESSION_SECRET;
+        if (!configured) {
+            throw new Error('SESSION_SECRET is not set: the account digest and the coarse IP hash need the key every replica shares');
+        }
+        return configured;
+    };
+    /** An IPv4 address as itself (an IPv4-mapped IPv6 address as its IPv4); an IPv6 address as its /64. */
+    RequestDigests.prototype.coarsen = function (address) {
+        var mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(address);
+        if (mapped) {
+            return mapped[1];
+        }
+        if (!address.includes(':')) {
+            return address;
+        }
+        var groups = this.ipv6Groups(address.split('%')[0]);
+        return groups ? "".concat(groups.slice(0, 4).join(':'), "::/64") : address;
+    };
+    /** The first four groups (the /64) of an IPv6 address, each without leading zeros; undefined when it does not parse. */
+    RequestDigests.prototype.ipv6Groups = function (address) {
+        var halves = address.split('::');
+        if (halves.length > 2) {
+            return undefined;
+        }
+        var parts = function (half) { return (half ? half.split(':') : []); };
+        var head = parts(halves[0]);
+        var tail = parts(halves[1]);
+        // A trailing dotted IPv4 part stands for two groups.
+        var groupsIn = function (list) { return list.reduce(function (count, part) { return count + (part.includes('.') ? 2 : 1); }, 0); };
+        var missing = 8 - groupsIn(head) - groupsIn(tail);
+        if (missing < 0 || (halves.length === 1 && missing !== 0)) {
+            return undefined;
+        }
+        var zeros = [];
+        for (var i = 0; i < missing; i++) {
+            zeros.push('0');
+        }
+        var groups = head.concat(zeros, tail).slice(0, 4);
+        if (groups.some(function (group) { return !/^[0-9a-f]{1,4}$/.test(group); })) {
+            return undefined;
+        }
+        return groups.map(function (group) { return parseInt(group, 16).toString(16); });
+    };
+    /** Hex characters kept from the HMAC: 64 bits. */
+    RequestDigests.DIGEST_HEX_LENGTH = 16;
+    return RequestDigests;
+}());
+exports.RequestDigests = RequestDigests;
+//# sourceMappingURL=RequestDigests.js.map

package/dist/src/throttle/RequestDigests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestDigests.js","sourceRoot":"","sources":["../../../src/throttle/RequestDigests.ts"],"names":[],"mappings":";;;AAAA,iCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH;IAIE,wBAA6B,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;IAAG,CAAC;IAE9D,8DAA8D;IAC9D,gCAAO,GAAP,UAAQ,KAAa;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,oEAAoE;IACpE,iCAAQ,GAAR,UAAS,OAAe;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEO,+BAAM,GAAd,UAAe,OAAe,EAAE,KAAa;QAC3C,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,UAAG,OAAO,cAAI,IAAI,CAAC,MAAM,EAAE,CAAE,CAAC;aACvD,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAChD,CAAC;IAEO,+BAAM,GAAd;;QACE,IAAM,UAAU,GAAG,MAAA,MAAA,IAAI,CAAC,OAAO,0CAAE,MAAM,mCAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACtE,IAAI,CAAC,UAAU,EAAE;YACf,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;SACH;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,uGAAuG;IAC/F,gCAAO,GAAf,UAAgB,OAAe;QAC7B,IAAM,MAAM,GAAG,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,MAAM,EAAE;YACV,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;SAClB;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;YAC1B,OAAO,OAAO,CAAC;SAChB;QACD,IAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC,CAAC,CAAC,UAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACnE,CAAC;IAED,wHAAwH;IAChH,mCAAU,GAAlB,UAAmB,OAAe;QAChC,IAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;YACrB,OAAO,SAAS,CAAC;SAClB;QACD,IAAM,KAAK,GAAG,UAAC,IAAwB,IAAK,OAAA,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAA7B,CAA6B,CAAC;QAC1E,IAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,qDAAqD;QACrD,IAAM,QAAQ,GAAG,UAAC,IAAc,IAAK,OAAA,IAAI,CAAC,MAAM,CAAC,UAAC,KAAK,EAAE,IAAI,IAAK,OAAA,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAApC,CAAoC,EAAE,CAAC,CAAC,EAArE,CAAqE,CAAC;QAC3G,IAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE;YACzD,OAAO,SAAS,CAAC;SAClB;QACD,IAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE;YAChC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SACjB;QACD,IAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAC,KAAK,IAAK,OAAA,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAA9B,CAA8B,CAAC,EAAE;YAC1D,OAAO,SAAS,CAAC;SAClB;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAhC,CAAgC,CAAC,CAAC;IACjE,CAAC;IArED,kDAAkD;IAC1B,gCAAiB,GAAG,EAAE,CAAC;IAqEjD,qBAAC;CAAA,AAvED,IAuEC;AAvEY,wCAAc"}

package/dist/src/throttle/SignInThrottle.d.ts

@@ -0,0 +1,67 @@
+/** Which window refused a try: the client's (its coarse IP hash) or the account's (its digest). */
+export type ThrottleWindow = 'client' | 'account';
+/**
+ * The sign-in door's two windows (`POST /user/login`), keyed by digests (`RequestDigests`),
+ * never by an address:
+ * - per CLIENT: every try that is not a success counts — wrong passwords, blank ones too, the
+ *   client made them — so one device cannot sweep many accounts; a successful sign-in never
+ *   counts (it is forgiven the moment it succeeds), so the people behind one shared address
+ *   signing in do not spend the window on each other;
+ * - per ACCOUNT: every try that carries a password counts (a blank submission judges no
+ *   password, so it never counts), so guesses spread over many devices still stop; a success
+ *   clears the account's count. A try is counted as it ARRIVES, before it is judged: tries in
+ *   flight at the same moment cannot all pass the window together.
+ *
+ * A throttled try is told `ANSWER` whichever window refused it and whether or not the address
+ * has an account, in the same time a refused password takes (the door runs the same password
+ * check and discards its verdict).
+ *
+ * The windows are in process memory (`SlidingWindow`): per replica. A deployment of three
+ * replicas behind a load balancer (up to ten under load) keeps three sets of windows, so its
+ * effective ceiling is ~3× the numbers below (up to ~10×). Friction, not the wall — a shared
+ * store is a separate step.
+ */
+export declare class SignInThrottle {
+    /** What a throttled try is told — in plain words, the same for every address, known or not. */
+    static readonly ANSWER = "Too many attempts. Try again in a few minutes.";
+    /**
+     * Per client: 50 tries that are not successes in 10 minutes (the founder's number, 2026-09-23).
+     * Successes never count, so an office or a school behind one address signing in at nine o'clock
+     * never spends this window on itself — only its mistypes do, and fifty wrong or blank tries in
+     * ten minutes is beyond any human population behind one address; a guessing script from one
+     * device is held to ~300 tries an hour per replica.
+     */
+    private static readonly CLIENT_LIMIT;
+    private static readonly CLIENT_WINDOW_MS;
+    /**
+     * Per account: 10 tries in 15 minutes (a success clears them, so only wrong ones ever add up).
+     * Someone who has forgotten a password tries a handful and asks for a reset link; ten wrong in
+     * a quarter of an hour is guessing, and counting per account holds however many devices the
+     * guesses come from. "A few minutes" in the answer is honest: the oldest try leaves the window
+     * within 15.
+     */
+    private static readonly ACCOUNT_LIMIT;
+    private static readonly ACCOUNT_WINDOW_MS;
+    private readonly clients;
+    private readonly accounts;
+    constructor(options?: {
+        now?: () => number;
+    });
+    /**
+     * Count this try against the client and against the account, and answer which window refuses
+     * it, if any. `account` is the digest of the address tried, given only when a password came
+     * with it (a blank submission judges no password, so it never counts toward an account). The
+     * count is taken here, before the try is judged, so tries in flight at once cannot all pass
+     * the window; a success clears it (`recordSuccess`).
+     */
+    admit(client: string, account?: string): ThrottleWindow | undefined;
+    /**
+     * The account proved itself: its window opens again. When it was a sign-in try from `client`
+     * (rather than a reset link redeemed), that try is forgiven — a success never counts against
+     * the device.
+     */
+    recordSuccess(account: string, client?: string): void;
+}
+/** The process-wide windows the sign-in door shares — they must span requests. */
+export declare const signInThrottle: SignInThrottle;
+//# sourceMappingURL=SignInThrottle.d.ts.map

package/dist/src/throttle/SignInThrottle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInThrottle.d.ts","sourceRoot":"","sources":["../../../src/throttle/SignInThrottle.ts"],"names":[],"mappings":"AAEA,mGAAmG;AACnG,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,cAAc;IACzB,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,MAAM,oDAAoD;IAE1E;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAM;IAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;IAE1D;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAM;IAC3C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAkB;IAE3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;gBAE7B,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE;IAa5C;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAUnE;;;;OAIG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;CAMtD;AAED,kFAAkF;AAClF,eAAO,MAAM,cAAc,gBAAuB,CAAC"}

package/dist/src/throttle/SignInThrottle.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signInThrottle = exports.SignInThrottle = void 0;
+var SlidingWindow_1 = require("./SlidingWindow");
+/**
+ * The sign-in door's two windows (`POST /user/login`), keyed by digests (`RequestDigests`),
+ * never by an address:
+ * - per CLIENT: every try that is not a success counts — wrong passwords, blank ones too, the
+ *   client made them — so one device cannot sweep many accounts; a successful sign-in never
+ *   counts (it is forgiven the moment it succeeds), so the people behind one shared address
+ *   signing in do not spend the window on each other;
+ * - per ACCOUNT: every try that carries a password counts (a blank submission judges no
+ *   password, so it never counts), so guesses spread over many devices still stop; a success
+ *   clears the account's count. A try is counted as it ARRIVES, before it is judged: tries in
+ *   flight at the same moment cannot all pass the window together.
+ *
+ * A throttled try is told `ANSWER` whichever window refused it and whether or not the address
+ * has an account, in the same time a refused password takes (the door runs the same password
+ * check and discards its verdict).
+ *
+ * The windows are in process memory (`SlidingWindow`): per replica. A deployment of three
+ * replicas behind a load balancer (up to ten under load) keeps three sets of windows, so its
+ * effective ceiling is ~3× the numbers below (up to ~10×). Friction, not the wall — a shared
+ * store is a separate step.
+ */
+var SignInThrottle = /** @class */ (function () {
+    function SignInThrottle(options) {
+        this.clients = new SlidingWindow_1.SlidingWindow({
+            windowMs: SignInThrottle.CLIENT_WINDOW_MS,
+            limit: SignInThrottle.CLIENT_LIMIT,
+            now: options === null || options === void 0 ? void 0 : options.now,
+        });
+        this.accounts = new SlidingWindow_1.SlidingWindow({
+            windowMs: SignInThrottle.ACCOUNT_WINDOW_MS,
+            limit: SignInThrottle.ACCOUNT_LIMIT,
+            now: options === null || options === void 0 ? void 0 : options.now,
+        });
+    }
+    /**
+     * Count this try against the client and against the account, and answer which window refuses
+     * it, if any. `account` is the digest of the address tried, given only when a password came
+     * with it (a blank submission judges no password, so it never counts toward an account). The
+     * count is taken here, before the try is judged, so tries in flight at once cannot all pass
+     * the window; a success clears it (`recordSuccess`).
+     */
+    SignInThrottle.prototype.admit = function (client, account) {
+        if (this.clients.hit(client)) {
+            return 'client';
+        }
+        if (account !== undefined && this.accounts.hit(account)) {
+            return 'account';
+        }
+        return undefined;
+    };
+    /**
+     * The account proved itself: its window opens again. When it was a sign-in try from `client`
+     * (rather than a reset link redeemed), that try is forgiven — a success never counts against
+     * the device.
+     */
+    SignInThrottle.prototype.recordSuccess = function (account, client) {
+        this.accounts.clear(account);
+        if (client !== undefined) {
+            this.clients.forgive(client);
+        }
+    };
+    /** What a throttled try is told — in plain words, the same for every address, known or not. */
+    SignInThrottle.ANSWER = 'Too many attempts. Try again in a few minutes.';
+    /**
+     * Per client: 50 tries that are not successes in 10 minutes (the founder's number, 2026-09-23).
+     * Successes never count, so an office or a school behind one address signing in at nine o'clock
+     * never spends this window on itself — only its mistypes do, and fifty wrong or blank tries in
+     * ten minutes is beyond any human population behind one address; a guessing script from one
+     * device is held to ~300 tries an hour per replica.
+     */
+    SignInThrottle.CLIENT_LIMIT = 50;
+    SignInThrottle.CLIENT_WINDOW_MS = 10 * 60 * 1000;
+    /**
+     * Per account: 10 tries in 15 minutes (a success clears them, so only wrong ones ever add up).
+     * Someone who has forgotten a password tries a handful and asks for a reset link; ten wrong in
+     * a quarter of an hour is guessing, and counting per account holds however many devices the
+     * guesses come from. "A few minutes" in the answer is honest: the oldest try leaves the window
+     * within 15.
+     */
+    SignInThrottle.ACCOUNT_LIMIT = 10;
+    SignInThrottle.ACCOUNT_WINDOW_MS = 15 * 60 * 1000;
+    return SignInThrottle;
+}());
+exports.SignInThrottle = SignInThrottle;
+/** The process-wide windows the sign-in door shares — they must span requests. */
+exports.signInThrottle = new SignInThrottle();
+//# sourceMappingURL=SignInThrottle.js.map

package/dist/src/throttle/SignInThrottle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInThrottle.js","sourceRoot":"","sources":["../../../src/throttle/SignInThrottle.ts"],"names":[],"mappings":";;;AAAA,iDAAgD;AAKhD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;IA2BE,wBAAY,OAAgC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,6BAAa,CAAC;YAC/B,QAAQ,EAAE,cAAc,CAAC,gBAAgB;YACzC,KAAK,EAAE,cAAc,CAAC,YAAY;YAClC,GAAG,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,6BAAa,CAAC;YAChC,QAAQ,EAAE,cAAc,CAAC,iBAAiB;YAC1C,KAAK,EAAE,cAAc,CAAC,aAAa;YACnC,GAAG,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,8BAAK,GAAL,UAAM,MAAc,EAAE,OAAgB;QACpC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YAC5B,OAAO,QAAQ,CAAC;SACjB;QACD,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YACvD,OAAO,SAAS,CAAC;SAClB;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,sCAAa,GAAb,UAAc,OAAe,EAAE,MAAe;QAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SAC9B;IACH,CAAC;IAlED,+FAA+F;IAC/E,qBAAM,GAAG,gDAAgD,CAAC;IAE1E;;;;;;OAMG;IACqB,2BAAY,GAAG,EAAE,CAAC;IAClB,+BAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE1D;;;;;;OAMG;IACqB,4BAAa,GAAG,EAAE,CAAC;IACnB,gCAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IA8C7D,qBAAC;CAAA,AApED,IAoEC;AApEY,wCAAc;AAsE3B,kFAAkF;AACrE,QAAA,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC"}

package/dist/src/throttle/SlidingWindow.d.ts

@@ -0,0 +1,51 @@
+/**
+ * A per-key sliding window: how many attempts a key made in the last `windowMs`, against a
+ * `limit`. The one window every throttled door shares — the sign-in and password-reset doors in
+ * this package, and any consumer door throttling per client (lifted from the invite-request
+ * door's per-IP throttle, which it replaces).
+ *
+ * Held in process memory only, which is what makes it cheap and what bounds it:
+ * - PER PROCESS. Each replica keeps its own windows, so behind a load balancer spreading a
+ *   client over N replicas the effective ceiling is ~N× the limit; a restart forgets them.
+ *   A throttle built on this is friction, not the wall. A shared store is a separate step.
+ * - BOUNDED. At most `maxKeys` keys are tracked; at the bound the oldest-touched key is
+ *   forgotten first, so a flood of fresh keys degrades the friction before it grows memory.
+ *
+ * Keys are whatever the caller passes — callers pass digests (see `RequestDigests`), never raw
+ * addresses, so nothing identifying is held here either.
+ */
+export declare class SlidingWindow {
+    private static readonly DEFAULT_MAX_KEYS;
+    private readonly windowMs;
+    private readonly limit;
+    private readonly maxKeys;
+    private readonly now;
+    /** key → the counted attempt times inside the window (pruned on touch), in touch order. */
+    private readonly attempts;
+    constructor(options: {
+        windowMs: number;
+        limit: number;
+        maxKeys?: number;
+        now?: () => number;
+    });
+    /**
+     * Record an attempt for `key` and answer whether it was over the window — `true` means refuse.
+     * A refused attempt is not counted, so a key drains one window after its last counted attempt.
+     */
+    hit(key: string): boolean;
+    /** Whether `key` has used up its window, without counting anything. */
+    isOver(key: string): boolean;
+    /** Count an attempt for `key` without answering (for doors that judge the attempt first). */
+    record(key: string): void;
+    /** Forget `key`'s attempts. */
+    clear(key: string): void;
+    /**
+     * Uncount `key`'s latest attempt (for doors that count a try as it arrives and learn afterwards
+     * that it should never have counted — a sign-in that succeeded).
+     */
+    forgive(key: string): void;
+    private inWindow;
+    /** Store `key`'s attempts as the most recently touched, evicting the oldest-touched key at the bound. */
+    private touch;
+}
+//# sourceMappingURL=SlidingWindow.d.ts.map

package/dist/src/throttle/SlidingWindow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlidingWindow.d.ts","sourceRoot":"","sources":["../../../src/throttle/SlidingWindow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAElD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;gBAE5C,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE;IAO9F;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IASzB,uEAAuE;IACvE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI5B,6FAA6F;IAC7F,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMzB,+BAA+B;IAC/B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIxB;;;OAGG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM1B,OAAO,CAAC,QAAQ;IAKhB,yGAAyG;IACzG,OAAO,CAAC,KAAK;CAUd"}

package/dist/src/throttle/SlidingWindow.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SlidingWindow = void 0;
+/**
+ * A per-key sliding window: how many attempts a key made in the last `windowMs`, against a
+ * `limit`. The one window every throttled door shares — the sign-in and password-reset doors in
+ * this package, and any consumer door throttling per client (lifted from the invite-request
+ * door's per-IP throttle, which it replaces).
+ *
+ * Held in process memory only, which is what makes it cheap and what bounds it:
+ * - PER PROCESS. Each replica keeps its own windows, so behind a load balancer spreading a
+ *   client over N replicas the effective ceiling is ~N× the limit; a restart forgets them.
+ *   A throttle built on this is friction, not the wall. A shared store is a separate step.
+ * - BOUNDED. At most `maxKeys` keys are tracked; at the bound the oldest-touched key is
+ *   forgotten first, so a flood of fresh keys degrades the friction before it grows memory.
+ *
+ * Keys are whatever the caller passes — callers pass digests (see `RequestDigests`), never raw
+ * addresses, so nothing identifying is held here either.
+ */
+var SlidingWindow = /** @class */ (function () {
+    function SlidingWindow(options) {
+        var _a, _b;
+        /** key → the counted attempt times inside the window (pruned on touch), in touch order. */
+        this.attempts = new Map();
+        this.windowMs = options.windowMs;
+        this.limit = options.limit;
+        this.maxKeys = (_a = options.maxKeys) !== null && _a !== void 0 ? _a : SlidingWindow.DEFAULT_MAX_KEYS;
+        this.now = (_b = options.now) !== null && _b !== void 0 ? _b : Date.now;
+    }
+    /**
+     * Record an attempt for `key` and answer whether it was over the window — `true` means refuse.
+     * A refused attempt is not counted, so a key drains one window after its last counted attempt.
+     */
+    SlidingWindow.prototype.hit = function (key) {
+        if (this.isOver(key)) {
+            this.touch(key, this.inWindow(key));
+            return true;
+        }
+        this.record(key);
+        return false;
+    };
+    /** Whether `key` has used up its window, without counting anything. */
+    SlidingWindow.prototype.isOver = function (key) {
+        return this.inWindow(key).length >= this.limit;
+    };
+    /** Count an attempt for `key` without answering (for doors that judge the attempt first). */
+    SlidingWindow.prototype.record = function (key) {
+        var attempts = this.inWindow(key);
+        attempts.push(this.now());
+        this.touch(key, attempts);
+    };
+    /** Forget `key`'s attempts. */
+    SlidingWindow.prototype.clear = function (key) {
+        this.attempts.delete(key);
+    };
+    /**
+     * Uncount `key`'s latest attempt (for doors that count a try as it arrives and learn afterwards
+     * that it should never have counted — a sign-in that succeeded).
+     */
+    SlidingWindow.prototype.forgive = function (key) {
+        var attempts = this.inWindow(key);
+        attempts.pop();
+        this.touch(key, attempts);
+    };
+    SlidingWindow.prototype.inWindow = function (key) {
+        var _a;
+        var cutoff = this.now() - this.windowMs;
+        return ((_a = this.attempts.get(key)) !== null && _a !== void 0 ? _a : []).filter(function (time) { return time > cutoff; });
+    };
+    /** Store `key`'s attempts as the most recently touched, evicting the oldest-touched key at the bound. */
+    SlidingWindow.prototype.touch = function (key, attempts) {
+        if (!this.attempts.has(key) && this.attempts.size >= this.maxKeys) {
+            var oldest = this.attempts.keys().next().value;
+            if (oldest !== undefined) {
+                this.attempts.delete(oldest);
+            }
+        }
+        this.attempts.delete(key);
+        this.attempts.set(key, attempts);
+    };
+    SlidingWindow.DEFAULT_MAX_KEYS = 10000;
+    return SlidingWindow;
+}());
+exports.SlidingWindow = SlidingWindow;
+//# sourceMappingURL=SlidingWindow.js.map

package/dist/src/throttle/SlidingWindow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlidingWindow.js","sourceRoot":"","sources":["../../../src/throttle/SlidingWindow.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;GAeG;AACH;IAUE,uBAAY,OAAkF;;QAH9F,2FAA2F;QAC1E,aAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;QAGtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,aAAa,CAAC,gBAAgB,CAAC;QACjE,IAAI,CAAC,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,2BAAG,GAAH,UAAI,GAAW;QACb,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACpB,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;SACb;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uEAAuE;IACvE,8BAAM,GAAN,UAAO,GAAW;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC;IACjD,CAAC;IAED,6FAA6F;IAC7F,8BAAM,GAAN,UAAO,GAAW;QAChB,IAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,+BAA+B;IAC/B,6BAAK,GAAL,UAAM,GAAW;QACf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,+BAAO,GAAP,UAAQ,GAAW;QACjB,IAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAEO,gCAAQ,GAAhB,UAAiB,GAAW;;QAC1B,IAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1C,OAAO,CAAC,MAAA,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,UAAC,IAAI,IAAK,OAAA,IAAI,GAAG,MAAM,EAAb,CAAa,CAAC,CAAC;IACxE,CAAC;IAED,yGAAyG;IACjG,6BAAK,GAAb,UAAc,GAAW,EAAE,QAAkB;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE;YACjE,IAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,MAAM,KAAK,SAAS,EAAE;gBACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;aAC9B;SACF;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAvEuB,8BAAgB,GAAG,KAAM,AAAT,CAAU;IAwEpD,oBAAC;CAAA,AAzED,IAyEC;AAzEY,sCAAa"}

package/dist/test/ClientAddress.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ClientAddress.test.d.ts.map

package/dist/test/ClientAddress.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientAddress.test.d.ts","sourceRoot":"","sources":["../../test/ClientAddress.test.ts"],"names":[],"mappings":""}

package/dist/test/ClientAddress.test.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+var ClientAddress_1 = require("../src/throttle/ClientAddress");
+/**
+ * Which address a throttle keys on. Behind Google's external Application Load Balancer the
+ * header ends `<client-ip>,<load-balancer-ip>` — the balancer appends both, and anything before
+ * them is whatever the client itself sent. So the client is the SECOND entry from the right:
+ * never the last (the balancer's own address, the same for every visitor — a throttle keyed on
+ * it is one bucket for the whole world) and never the first (client-supplied, rotatable at will).
+ */
+describe('ClientAddress', function () {
+    var behindTheBalancer = function (forwardedFor, socketAddress) {
+        var _a, _b;
+        if (socketAddress === void 0) { socketAddress = '35.191.0.10'; }
+        return ({
+            app: { get: function (setting) { return (setting === 'trust proxy' ? 1 : undefined); } },
+            headers: forwardedFor === undefined ? {} : { 'x-forwarded-for': forwardedFor },
+            socket: { remoteAddress: socketAddress },
+            // What express's own `request.ip` resolves to under `trust proxy 1`: the header's last entry.
+            ip: (_b = (_a = forwardedFor === null || forwardedFor === void 0 ? void 0 : forwardedFor.split(',').pop()) === null || _a === void 0 ? void 0 : _a.trim()) !== null && _b !== void 0 ? _b : socketAddress,
+        });
+    };
+    it("reads the client the balancer appended, not the balancer's own address", function () {
+        var request = behindTheBalancer('198.51.100.23, 34.120.1.1');
+        expect(new ClientAddress_1.ClientAddress().of(request)).toBe('198.51.100.23');
+        expect(request.ip).toBe('34.120.1.1');
+    });
+    it('ignores whatever the client put in the header itself', function () {
+        var spoofed = behindTheBalancer('203.0.113.99, 10.0.0.1, 198.51.100.23, 34.120.1.1');
+        expect(new ClientAddress_1.ClientAddress().of(spoofed)).toBe('198.51.100.23');
+    });
+    it('reads IPv6 clients the same way', function () {
+        expect(new ClientAddress_1.ClientAddress().of(behindTheBalancer('2001:db8:1:2:3:4:5:6,34.120.1.1'))).toBe('2001:db8:1:2:3:4:5:6');
+    });
+    it('a request that did not come through the balancer (no appended pair) keys on its own connection', function () {
+        expect(new ClientAddress_1.ClientAddress().of(behindTheBalancer(undefined, '10.8.0.7'))).toBe('10.8.0.7');
+        expect(new ClientAddress_1.ClientAddress().of(behindTheBalancer('10.8.0.9', '10.8.0.7'))).toBe('10.8.0.7');
+    });
+    it('with no proxy trusted (development) the connection is the client, and a forwarded header is ignored', function () {
+        var direct = {
+            app: { get: function () { return false; } },
+            headers: { 'x-forwarded-for': '203.0.113.99, 198.51.100.23' },
+            socket: { remoteAddress: '::1' },
+        };
+        expect(new ClientAddress_1.ClientAddress().of(direct)).toBe('::1');
+    });
+    it('a request with no connection details at all reads as the empty address', function () {
+        expect(new ClientAddress_1.ClientAddress().of({})).toBe('');
+    });
+});
+//# sourceMappingURL=ClientAddress.test.js.map

package/dist/test/ClientAddress.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientAddress.test.js","sourceRoot":"","sources":["../../test/ClientAddress.test.ts"],"names":[],"mappings":";;AAAA,+DAA8D;AAE9D;;;;;;GAMG;AACH,QAAQ,CAAC,eAAe,EAAE;IACxB,IAAM,iBAAiB,GAAG,UAAC,YAAgC,EAAE,aAA6B;;QAA7B,8BAAA,EAAA,6BAA6B;QAAK,OAAA,CAAC;YAC9F,GAAG,EAAE,EAAE,GAAG,EAAE,UAAC,OAAe,IAAK,OAAA,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAA3C,CAA2C,EAAE;YAC9E,OAAO,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,YAAY,EAAE;YAC9E,MAAM,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;YACxC,8FAA8F;YAC9F,EAAE,EAAE,MAAA,MAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,0CAAE,IAAI,EAAE,mCAAI,aAAa;SAC5D,CAAC,CAAA;KAAA,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE;QAC3E,IAAM,OAAO,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;QAE/D,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE;QACzD,IAAM,OAAO,GAAG,iBAAiB,CAAC,mDAAmD,CAAC,CAAC;QAEvF,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE;QACpC,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACpH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gGAAgG,EAAE;QACnG,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1F,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qGAAqG,EAAE;QACxG,IAAM,MAAM,GAAG;YACb,GAAG,EAAE,EAAE,GAAG,EAAE,cAAM,OAAA,KAAK,EAAL,CAAK,EAAE;YACzB,OAAO,EAAE,EAAE,iBAAiB,EAAE,6BAA6B,EAAE;YAC7D,MAAM,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE;SACjC,CAAC;QAEF,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE;QAC3E,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/DbTraffic.d.ts

@@ -0,0 +1,29 @@
+import { DbDriver } from '@proteinjs/db';
+/**
+ * What reached the database while a run executed — the outcome a "refused before any lookup"
+ * claim rests on. A response code cannot prove it: a value that is wrongly let through still
+ * matches no row and still answers 400, so the proof is that nothing was built and nothing ran.
+ * - `lookups`: the filter of every read built through the package's `Db` — every `query`, which
+ *   is also what a `get` is (the first row of one);
+ * - `writes`: how many writes were built through it (`insert`, `update`, `delete`);
+ * - `statements`: how many statements the driver ran, whoever built them.
+ */
+export declare class DbTraffic {
+    readonly lookups: unknown[];
+    readonly writes: number;
+    readonly statements: number;
+    private constructor();
+    /** The traffic of a run that never touched the database: `expect(traffic).toEqual(DbTraffic.NONE)`. */
+    static readonly NONE: {
+        lookups: never[];
+        writes: number;
+        statements: number;
+    };
+    /** Runs `run` and answers what it resolved to beside the database traffic it caused. */
+    static during<T>(driver: DbDriver, run: () => Promise<T>): Promise<{
+        result: T;
+        traffic: DbTraffic;
+    }>;
+    private static callCount;
+}
+//# sourceMappingURL=DbTraffic.d.ts.map

package/dist/test/DbTraffic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DbTraffic.d.ts","sourceRoot":"","sources":["../../test/DbTraffic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAM,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE7C;;;;;;;;GAQG;AACH,qBAAa,SAAS;IAElB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM;IAH7B,OAAO;IAMP,uGAAuG;IACvG,MAAM,CAAC,QAAQ,CAAC,IAAI;;;;MAA6C;IAEjE,wFAAwF;WAC3E,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,SAAS,CAAA;KAAE,CAAC;IAiB3G,OAAO,CAAC,MAAM,CAAC,SAAS;CAGzB"}

package/dist/test/DbTraffic.js

@@ -0,0 +1,106 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbTraffic = void 0;
+var db_1 = require("@proteinjs/db");
+/**
+ * What reached the database while a run executed — the outcome a "refused before any lookup"
+ * claim rests on. A response code cannot prove it: a value that is wrongly let through still
+ * matches no row and still answers 400, so the proof is that nothing was built and nothing ran.
+ * - `lookups`: the filter of every read built through the package's `Db` — every `query`, which
+ *   is also what a `get` is (the first row of one);
+ * - `writes`: how many writes were built through it (`insert`, `update`, `delete`);
+ * - `statements`: how many statements the driver ran, whoever built them.
+ */
+var DbTraffic = /** @class */ (function () {
+    function DbTraffic(lookups, writes, statements) {
+        this.lookups = lookups;
+        this.writes = writes;
+        this.statements = statements;
+    }
+    /** Runs `run` and answers what it resolved to beside the database traffic it caused. */
+    DbTraffic.during = function (driver, run) {
+        return __awaiter(this, void 0, void 0, function () {
+            var reads, writes, statements, result, lookups;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        reads = jest.spyOn(db_1.Db.prototype, 'query');
+                        writes = [
+                            jest.spyOn(db_1.Db.prototype, 'insert'),
+                            jest.spyOn(db_1.Db.prototype, 'update'),
+                            jest.spyOn(db_1.Db.prototype, 'delete'),
+                        ];
+                        statements = [jest.spyOn(driver, 'runQuery'), jest.spyOn(driver, 'runDml')];
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, , 3, 4]);
+                        return [4 /*yield*/, run()];
+                    case 2:
+                        result = _a.sent();
+                        lookups = reads.mock.calls.map(function (_a) {
+                            var _table = _a[0], filter = _a[1];
+                            return filter;
+                        });
+                        return [2 /*return*/, { result: result, traffic: new DbTraffic(lookups, DbTraffic.callCount(writes), DbTraffic.callCount(statements)) }];
+                    case 3:
+                        __spreadArray(__spreadArray([reads], writes, true), statements, true).forEach(function (spy) { return spy.mockRestore(); });
+                        return [7 /*endfinally*/];
+                    case 4: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    DbTraffic.callCount = function (spies) {
+        return spies.reduce(function (count, spy) { return count + spy.mock.calls.length; }, 0);
+    };
+    /** The traffic of a run that never touched the database: `expect(traffic).toEqual(DbTraffic.NONE)`. */
+    DbTraffic.NONE = { lookups: [], writes: 0, statements: 0 };
+    return DbTraffic;
+}());
+exports.DbTraffic = DbTraffic;
+//# sourceMappingURL=DbTraffic.js.map

package/dist/test/DbTraffic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DbTraffic.js","sourceRoot":"","sources":["../../test/DbTraffic.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA6C;AAE7C;;;;;;;;GAQG;AACH;IACE,mBACW,OAAkB,EAClB,MAAc,EACd,UAAkB;QAFlB,YAAO,GAAP,OAAO,CAAW;QAClB,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAQ;IAC1B,CAAC;IAKJ,wFAAwF;IAC3E,gBAAM,GAAnB,UAAuB,MAAgB,EAAE,GAAqB;;;;;;wBACtD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;wBAC1C,MAAM,GAAG;4BACb,IAAI,CAAC,KAAK,CAAC,OAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;4BAClC,IAAI,CAAC,KAAK,CAAC,OAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;4BAClC,IAAI,CAAC,KAAK,CAAC,OAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;yBACnC,CAAC;wBACI,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;;;;wBAEjE,qBAAM,GAAG,EAAE,EAAA;;wBAApB,MAAM,GAAG,SAAW;wBACpB,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAC,EAAgB;gCAAf,MAAM,QAAA,EAAE,MAAM,QAAA;4BAAM,OAAA,MAAM;wBAAN,CAAM,CAAC,CAAC;wBACnE,sBAAO,EAAE,MAAM,QAAA,EAAE,OAAO,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,EAAC;;wBAEjH,6BAAC,KAAK,GAAK,MAAM,SAAK,UAAU,QAAE,OAAO,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,WAAW,EAAE,EAAjB,CAAiB,CAAC,CAAC;;;;;;KAEzE;IAEc,mBAAS,GAAxB,UAAyB,KAAuC;QAC9D,OAAO,KAAK,CAAC,MAAM,CAAC,UAAC,KAAK,EAAE,GAAG,IAAK,OAAA,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAA7B,CAA6B,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAvBD,uGAAuG;IACvF,cAAI,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAuBnE,gBAAC;CAAA,AA/BD,IA+BC;AA/BY,8BAAS"}