@resq-systems/security 1.0.5 → 2.0.0

package/lib/controls/payload.mjs

@@ -0,0 +1,147 @@
+//#region src/controls/payload.ts
+/**
+* Defaults sized from real payloads rather than from what looks tidy.
+*
+* An earlier draft used 20/1000/200/10k/1M and rejected four of five ordinary bodies: a
+* 250-key dependency manifest, a 25-deep config tree, a 40 KB data-URI avatar and a
+* 2000-row page. These are backstops against a payload built to exhaust memory, not a
+* schema — a body that trips one of them is pathological rather than merely large.
+*/
+const DEFAULT_LIMITS = {
+	maxDepth: 100,
+	maxArrayLength: 1e4,
+	maxObjectKeys: 2e3,
+	maxStringLength: 1e6,
+	maxLength: 5e6
+};
+/**
+* Cap on the per-container counter stack.
+*
+* Without it, a payload nested 200 000 deep grows 200 000 entries of scanner state — the
+* same unbounded allocation this function exists to prevent, moved one layer down. Depth
+* is still counted past the cap; only per-container entry counts stop being tracked, and
+* a payload that deep has already exceeded `maxDepth` by a wide margin.
+*/
+const MAX_COUNTER_STACK = 512;
+/**
+* Measure a JSON payload's structure without parsing it.
+*
+* `JSON.parse` allocates the whole object graph before a caller can inspect anything, so
+* a body designed to exhaust memory has already succeeded by the time validation runs.
+* This is one linear pass over the *text*: it counts nesting, container sizes and string
+* lengths, and never builds a value.
+*
+* Reporting rather than enforcing, deliberately. It returns what it measured and which
+* bounds were exceeded; the caller decides. Schema validation remains the real control
+* for shape — this only bounds the cost of getting there.
+*
+* Malformed JSON is not diagnosed. The scanner is a bracket counter, so an invalid or
+* truncated payload yields whatever it measured before running out; use `JSON.parse` for
+* validity, once this has bounded the cost.
+*
+* @param text - The raw JSON text, before parsing.
+* @param limits - See {@link JsonPayloadLimits}.
+* @returns The measured {@link JsonPayloadReport}. Never throws.
+*
+* @example
+* ```ts
+* const report = checkJsonPayloadLimits(await request.text());
+* if (!report.withinLimits) {
+*   return new Response(`Payload rejected: ${report.exceeded.join(", ")}`, { status: 413 });
+* }
+* ```
+*/
+function checkJsonPayloadLimits(text, limits = {}) {
+	const { maxDepth, maxArrayLength, maxObjectKeys, maxStringLength, maxLength } = {
+		...DEFAULT_LIMITS,
+		...limits
+	};
+	if (typeof text !== "string") return {
+		depth: 0,
+		arrayLength: 0,
+		objectKeys: 0,
+		stringLength: 0,
+		length: 0,
+		withinLimits: true,
+		exceeded: []
+	};
+	let depth = 0;
+	let deepest = 0;
+	let arrayLength = 0;
+	let objectKeys = 0;
+	let stringLength = 0;
+	/** Entry counts for the containers currently open, innermost last. */
+	const counters = [];
+	let inString = false;
+	let escaped = false;
+	let stringStart = 0;
+	/** Whether the innermost container has seen content since the last comma. */
+	let sawContent = false;
+	for (let index = 0; index < text.length; index++) {
+		const char = text[index];
+		if (inString) {
+			if (escaped) escaped = false;
+			else if (char === "\\") escaped = true;
+			else if (char === "\"") {
+				inString = false;
+				const measured = index - stringStart;
+				if (measured > stringLength) stringLength = measured;
+			}
+			continue;
+		}
+		if (char === "\"") {
+			inString = true;
+			stringStart = index + 1;
+			sawContent = true;
+			continue;
+		}
+		if (char === "{" || char === "[") {
+			depth++;
+			if (depth > deepest) deepest = depth;
+			if (counters.length < MAX_COUNTER_STACK) counters.push({
+				isArray: char === "[",
+				count: 0
+			});
+			sawContent = false;
+			continue;
+		}
+		if (char === "}" || char === "]") {
+			const container = counters.pop();
+			if (container !== void 0) {
+				const entries = sawContent || container.count > 0 ? container.count + 1 : 0;
+				if (container.isArray) {
+					if (entries > arrayLength) arrayLength = entries;
+				} else if (entries > objectKeys) objectKeys = entries;
+			}
+			depth = Math.max(0, depth - 1);
+			sawContent = true;
+			continue;
+		}
+		if (char === ",") {
+			const container = counters[counters.length - 1];
+			if (container !== void 0) container.count++;
+			sawContent = false;
+			continue;
+		}
+		if (char !== void 0 && char !== ":" && char.trim().length > 0) sawContent = true;
+	}
+	const exceeded = [];
+	if (deepest > maxDepth) exceeded.push("depth");
+	if (arrayLength > maxArrayLength) exceeded.push("arrayLength");
+	if (objectKeys > maxObjectKeys) exceeded.push("objectKeys");
+	if (stringLength > maxStringLength) exceeded.push("stringLength");
+	if (text.length > maxLength) exceeded.push("length");
+	return {
+		depth: deepest,
+		arrayLength,
+		objectKeys,
+		stringLength,
+		length: text.length,
+		withinLimits: exceeded.length === 0,
+		exceeded
+	};
+}
+//#endregion
+export { checkJsonPayloadLimits };
+
+//# sourceMappingURL=payload.mjs.map

package/lib/controls/payload.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.mjs","names":[],"sources":["../../src/controls/payload.ts"],"sourcesContent":["/**\n * Copyright 2026 ResQ Systems, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * @fileoverview Structural bounds on a JSON payload, measured from the text before\n * anything parses it (OWASP API Security API4 — unrestricted resource consumption).\n *\n * @module @resq-systems/security/controls/payload\n */\n\n//#region Types\n\n/** Bounds for {@link checkJsonPayloadLimits}. */\nexport interface JsonPayloadLimits {\n\t/** Deepest container nesting. Defaults to 100. */\n\treadonly maxDepth?: number;\n\t/** Most entries in any single array. Defaults to 10 000. */\n\treadonly maxArrayLength?: number;\n\t/** Most keys in any single object. Defaults to 2 000. */\n\treadonly maxObjectKeys?: number;\n\t/** Longest single string value, in characters. Defaults to 1 000 000. */\n\treadonly maxStringLength?: number;\n\t/** Longest payload overall, in characters. Defaults to 5 000 000. */\n\treadonly maxLength?: number;\n}\n\n/** Result of {@link checkJsonPayloadLimits}. */\nexport interface JsonPayloadReport {\n\t/** Deepest container nesting reached. */\n\treadonly depth: number;\n\t/** Largest array seen, by entry count. */\n\treadonly arrayLength: number;\n\t/** Largest object seen, by key count. */\n\treadonly objectKeys: number;\n\t/** Longest string value seen. */\n\treadonly stringLength: number;\n\t/** Character length of the payload. */\n\treadonly length: number;\n\t/** `true` when every bound is satisfied. */\n\treadonly withinLimits: boolean;\n\t/** Names of the bounds exceeded; empty when `withinLimits`. */\n\treadonly exceeded: readonly string[];\n}\n\n//#endregion\n\n//#region Implementation\n\n/**\n * Defaults sized from real payloads rather than from what looks tidy.\n *\n * An earlier draft used 20/1000/200/10k/1M and rejected four of five ordinary bodies: a\n * 250-key dependency manifest, a 25-deep config tree, a 40 KB data-URI avatar and a\n * 2000-row page. These are backstops against a payload built to exhaust memory, not a\n * schema — a body that trips one of them is pathological rather than merely large.\n */\nconst DEFAULT_LIMITS = {\n\tmaxDepth: 100,\n\tmaxArrayLength: 10_000,\n\tmaxObjectKeys: 2_000,\n\tmaxStringLength: 1_000_000,\n\tmaxLength: 5_000_000,\n} as const satisfies Required<JsonPayloadLimits>;\n\n/**\n * Cap on the per-container counter stack.\n *\n * Without it, a payload nested 200 000 deep grows 200 000 entries of scanner state — the\n * same unbounded allocation this function exists to prevent, moved one layer down. Depth\n * is still counted past the cap; only per-container entry counts stop being tracked, and\n * a payload that deep has already exceeded `maxDepth` by a wide margin.\n */\nconst MAX_COUNTER_STACK = 512;\n\n/**\n * Measure a JSON payload's structure without parsing it.\n *\n * `JSON.parse` allocates the whole object graph before a caller can inspect anything, so\n * a body designed to exhaust memory has already succeeded by the time validation runs.\n * This is one linear pass over the *text*: it counts nesting, container sizes and string\n * lengths, and never builds a value.\n *\n * Reporting rather than enforcing, deliberately. It returns what it measured and which\n * bounds were exceeded; the caller decides. Schema validation remains the real control\n * for shape — this only bounds the cost of getting there.\n *\n * Malformed JSON is not diagnosed. The scanner is a bracket counter, so an invalid or\n * truncated payload yields whatever it measured before running out; use `JSON.parse` for\n * validity, once this has bounded the cost.\n *\n * @param text - The raw JSON text, before parsing.\n * @param limits - See {@link JsonPayloadLimits}.\n * @returns The measured {@link JsonPayloadReport}. Never throws.\n *\n * @example\n * ```ts\n * const report = checkJsonPayloadLimits(await request.text());\n * if (!report.withinLimits) {\n *   return new Response(`Payload rejected: ${report.exceeded.join(\", \")}`, { status: 413 });\n * }\n * ```\n */\nexport function checkJsonPayloadLimits(\n\ttext: string,\n\tlimits: JsonPayloadLimits = {},\n): JsonPayloadReport {\n\tconst { maxDepth, maxArrayLength, maxObjectKeys, maxStringLength, maxLength } = {\n\t\t...DEFAULT_LIMITS,\n\t\t...limits,\n\t};\n\n\tif (typeof text !== \"string\") {\n\t\treturn {\n\t\t\tdepth: 0,\n\t\t\tarrayLength: 0,\n\t\t\tobjectKeys: 0,\n\t\t\tstringLength: 0,\n\t\t\tlength: 0,\n\t\t\twithinLimits: true,\n\t\t\texceeded: [],\n\t\t};\n\t}\n\n\tlet depth = 0;\n\tlet deepest = 0;\n\tlet arrayLength = 0;\n\tlet objectKeys = 0;\n\tlet stringLength = 0;\n\n\t/** Entry counts for the containers currently open, innermost last. */\n\tconst counters: { isArray: boolean; count: number }[] = [];\n\tlet inString = false;\n\tlet escaped = false;\n\tlet stringStart = 0;\n\t/** Whether the innermost container has seen content since the last comma. */\n\tlet sawContent = false;\n\n\tfor (let index = 0; index < text.length; index++) {\n\t\tconst char = text[index];\n\n\t\tif (inString) {\n\t\t\tif (escaped) {\n\t\t\t\tescaped = false;\n\t\t\t} else if (char === \"\\\\\") {\n\t\t\t\tescaped = true;\n\t\t\t} else if (char === '\"') {\n\t\t\t\tinString = false;\n\t\t\t\tconst measured = index - stringStart;\n\t\t\t\tif (measured > stringLength) stringLength = measured;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === '\"') {\n\t\t\tinString = true;\n\t\t\tstringStart = index + 1;\n\t\t\tsawContent = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"{\" || char === \"[\") {\n\t\t\tdepth++;\n\t\t\tif (depth > deepest) deepest = depth;\n\t\t\tif (counters.length < MAX_COUNTER_STACK) {\n\t\t\t\tcounters.push({ isArray: char === \"[\", count: 0 });\n\t\t\t}\n\t\t\tsawContent = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"}\" || char === \"]\") {\n\t\t\tconst container = counters.pop();\n\t\t\tif (container !== undefined) {\n\t\t\t\t// A container holding any content has one more entry than it has commas.\n\t\t\t\tconst entries = sawContent || container.count > 0 ? container.count + 1 : 0;\n\t\t\t\tif (container.isArray) {\n\t\t\t\t\tif (entries > arrayLength) arrayLength = entries;\n\t\t\t\t} else if (entries > objectKeys) {\n\t\t\t\t\tobjectKeys = entries;\n\t\t\t\t}\n\t\t\t}\n\t\t\tdepth = Math.max(0, depth - 1);\n\t\t\tsawContent = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \",\") {\n\t\t\tconst container = counters[counters.length - 1];\n\t\t\tif (container !== undefined) container.count++;\n\t\t\tsawContent = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char !== undefined && char !== \":\" && char.trim().length > 0) sawContent = true;\n\t}\n\n\tconst exceeded: string[] = [];\n\tif (deepest > maxDepth) exceeded.push(\"depth\");\n\tif (arrayLength > maxArrayLength) exceeded.push(\"arrayLength\");\n\tif (objectKeys > maxObjectKeys) exceeded.push(\"objectKeys\");\n\tif (stringLength > maxStringLength) exceeded.push(\"stringLength\");\n\tif (text.length > maxLength) exceeded.push(\"length\");\n\n\treturn {\n\t\tdepth: deepest,\n\t\tarrayLength,\n\t\tobjectKeys,\n\t\tstringLength,\n\t\tlength: text.length,\n\t\twithinLimits: exceeded.length === 0,\n\t\texceeded,\n\t};\n}\n\n//#endregion\n"],"mappings":";;;;;;;;;AAqEA,MAAM,iBAAiB;CACtB,UAAU;CACV,gBAAgB;CAChB,eAAe;CACf,iBAAiB;CACjB,WAAW;AACZ;;;;;;;;;AAUA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8B1B,SAAgB,uBACf,MACA,SAA4B,CAAC,GACT;CACpB,MAAM,EAAE,UAAU,gBAAgB,eAAe,iBAAiB,cAAc;EAC/E,GAAG;EACH,GAAG;CACJ;CAEA,IAAI,OAAO,SAAS,UACnB,OAAO;EACN,OAAO;EACP,aAAa;EACb,YAAY;EACZ,cAAc;EACd,QAAQ;EACR,cAAc;EACd,UAAU,CAAC;CACZ;CAGD,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,IAAI,cAAc;CAClB,IAAI,aAAa;CACjB,IAAI,eAAe;;CAGnB,MAAM,WAAkD,CAAC;CACzD,IAAI,WAAW;CACf,IAAI,UAAU;CACd,IAAI,cAAc;;CAElB,IAAI,aAAa;CAEjB,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EACjD,MAAM,OAAO,KAAK;EAElB,IAAI,UAAU;GACb,IAAI,SACH,UAAU;QACJ,IAAI,SAAS,MACnB,UAAU;QACJ,IAAI,SAAS,MAAK;IACxB,WAAW;IACX,MAAM,WAAW,QAAQ;IACzB,IAAI,WAAW,cAAc,eAAe;GAC7C;GACA;EACD;EAEA,IAAI,SAAS,MAAK;GACjB,WAAW;GACX,cAAc,QAAQ;GACtB,aAAa;GACb;EACD;EAEA,IAAI,SAAS,OAAO,SAAS,KAAK;GACjC;GACA,IAAI,QAAQ,SAAS,UAAU;GAC/B,IAAI,SAAS,SAAS,mBACrB,SAAS,KAAK;IAAE,SAAS,SAAS;IAAK,OAAO;GAAE,CAAC;GAElD,aAAa;GACb;EACD;EAEA,IAAI,SAAS,OAAO,SAAS,KAAK;GACjC,MAAM,YAAY,SAAS,IAAI;GAC/B,IAAI,cAAc,KAAA,GAAW;IAE5B,MAAM,UAAU,cAAc,UAAU,QAAQ,IAAI,UAAU,QAAQ,IAAI;IAC1E,IAAI,UAAU,SACT;SAAA,UAAU,aAAa,cAAc;IAAA,OACnC,IAAI,UAAU,YACpB,aAAa;GAEf;GACA,QAAQ,KAAK,IAAI,GAAG,QAAQ,CAAC;GAC7B,aAAa;GACb;EACD;EAEA,IAAI,SAAS,KAAK;GACjB,MAAM,YAAY,SAAS,SAAS,SAAS;GAC7C,IAAI,cAAc,KAAA,GAAW,UAAU;GACvC,aAAa;GACb;EACD;EAEA,IAAI,SAAS,KAAA,KAAa,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAAG,aAAa;CAChF;CAEA,MAAM,WAAqB,CAAC;CAC5B,IAAI,UAAU,UAAU,SAAS,KAAK,OAAO;CAC7C,IAAI,cAAc,gBAAgB,SAAS,KAAK,aAAa;CAC7D,IAAI,aAAa,eAAe,SAAS,KAAK,YAAY;CAC1D,IAAI,eAAe,iBAAiB,SAAS,KAAK,cAAc;CAChE,IAAI,KAAK,SAAS,WAAW,SAAS,KAAK,QAAQ;CAEnD,OAAO;EACN,OAAO;EACP;EACA;EACA;EACA,QAAQ,KAAK;EACb,cAAc,SAAS,WAAW;EAClC;CACD;AACD"}

package/lib/controls/query.d.mts

@@ -0,0 +1,157 @@
+//#region src/controls/query.d.ts
+/**
+ * Copyright 2026 ResQ Systems, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Validate a JSONP callback name.
+ *
+ * A JSONP response body is `<callback>(<json>)`, so the callback name is *concatenated
+ * into executable JavaScript* — an allowlist is the only safe validation. Escaping is
+ * not an option: there is no encoding of `alert(1);//` that is both harmless and still
+ * callable.
+ *
+ * Prefer not shipping JSONP at all. It predates CORS, requires an endpoint that answers
+ * `<script src>` with credentials attached, and is the mechanism behind cross-site
+ * script inclusion.
+ *
+ * @param callback - The requested callback name.
+ * @returns `true` when the name is a plain identifier or dotted namespace path and is
+ *   not reserved.
+ *
+ * @example
+ * ```ts
+ * validateJsonpCallback("app.render");  // true
+ * validateJsonpCallback("alert(1);//"); // false
+ * validateJsonpCallback("window.eval"); // false — every segment is checked
+ * ```
+ */
+declare function validateJsonpCallback(callback: string): boolean;
+/** Limits applied by {@link analyzeQueryComplexity}. */
+interface QueryComplexityLimits {
+  /** Maximum nesting depth. Defaults to 10. */
+  readonly maxDepth?: number;
+  /** Maximum aliased fields. Defaults to 50. */
+  readonly maxAliases?: number;
+  /** Maximum selected fields overall. Defaults to 500. */
+  readonly maxFields?: number;
+  /** Maximum characters. Defaults to 20 000. */
+  readonly maxLength?: number;
+}
+/** Measured shape of a query. */
+interface QueryComplexity {
+  /** Deepest brace nesting reached. */
+  readonly depth: number;
+  /** Count of `alias: field` constructs. Approximate — see the function note. */
+  readonly aliases: number;
+  /** Approximate count of selected fields. */
+  readonly fields: number;
+  /** Character length. */
+  readonly length: number;
+  /** `true` when every limit is satisfied. */
+  readonly withinLimits: boolean;
+  /** Names of the limits exceeded; empty when `withinLimits`. */
+  readonly exceeded: readonly string[];
+}
+/**
+ * Measure a GraphQL-shaped query against structural limits.
+ *
+ * One linear pass counting brace depth, aliases, and field tokens. This is a *bound*,
+ * not a parser: it does not validate the document, resolve fragments, or account for
+ * list multipliers, so a production GraphQL server should still run a cost-analysis
+ * plugin. What it catches is the cheap denial-of-service shape — deeply nested
+ * recursive selections and mass aliasing — before the query reaches a resolver.
+ *
+ * String literals and `#` comments are skipped, so a brace inside `"{ }"` cannot
+ * inflate the depth. The alias count is approximate: argument colons inside parens are
+ * also preceded by a word and are counted too.
+ *
+ * @param query - The query document.
+ * @param limits - See {@link QueryComplexityLimits}.
+ * @returns The measured {@link QueryComplexity}. Never throws.
+ *
+ * @example
+ * ```ts
+ * const complexity = analyzeQueryComplexity(req.body.query, { maxDepth: 8 });
+ * if (!complexity.withinLimits) {
+ *   return new Response(`Query too complex: ${complexity.exceeded.join(", ")}`, {
+ *     status: 400,
+ *   });
+ * }
+ * ```
+ */
+declare function analyzeQueryComplexity(query: string, limits?: QueryComplexityLimits): QueryComplexity;
+/** Limits for {@link analyzeGraphQLRequest}. */
+interface GraphQLRequestLimits extends QueryComplexityLimits {
+  /**
+   * Top-level operations permitted across the whole request. Defaults to 10.
+   *
+   * The bound {@link analyzeQueryComplexity} cannot express, because it measures one
+   * document and a batch is many.
+   */
+  readonly maxOperations?: number;
+  /** Documents permitted in one batch. Defaults to 10. */
+  readonly maxDocuments?: number;
+}
+/** Result of {@link analyzeGraphQLRequest}. */
+interface GraphQLRequestAnalysis {
+  /** Documents found in the request. `1` for an ordinary single query. */
+  readonly documents: number;
+  /** Top-level operations summed across every document. */
+  readonly operations: number;
+  /** The highest per-document complexity in the batch. */
+  readonly worst: QueryComplexity;
+  /** `true` when every limit is satisfied. */
+  readonly withinLimits: boolean;
+  /** Names of the limits exceeded; empty when `withinLimits`. */
+  readonly exceeded: readonly string[];
+}
+/**
+ * Measure a whole GraphQL *request*, including batches.
+ *
+ * {@link analyzeQueryComplexity} measures one document, which leaves two ways past it,
+ * both measured against this package:
+ *
+ * - The documented call, `analyzeQueryComplexity(req.body.query, …)`, reads `undefined`
+ *   when a client posts an **array** batch — so a 250-operation request measured
+ *   `{ depth: 0, fields: 0, withinLimits: true }`. A total pass that does not even trip
+ *   the length bound.
+ * - Passing the raw body instead does not help: the scanner skips everything between
+ *   JSON quotes, so the same batch measured `fields: 0`.
+ *
+ * Alias batching *inside* one document is already bounded and needs nothing here — 300
+ * aliased selections report `exceeded: ["aliases", "fields"]`.
+ *
+ * Accepts a parsed body (`{ query }`, or an array of them) or the raw JSON text, and
+ * delegates per-document measurement to {@link analyzeQueryComplexity}, so existing
+ * callers and limits keep their meaning.
+ *
+ * Still a bound rather than a parser: run a cost-analysis plugin in the server too.
+ *
+ * @param body - The request body, parsed or raw.
+ * @param limits - Per-document limits, plus `maxOperations` and `maxDocuments`.
+ * @returns The measured {@link GraphQLRequestAnalysis}. Never throws.
+ *
+ * @example
+ * ```ts
+ * const analysis = analyzeGraphQLRequest(req.body);
+ * if (!analysis.withinLimits) {
+ *   return new Response("Request rejected: " + analysis.exceeded.join(", "), { status: 400 });
+ * }
+ * ```
+ */
+declare function analyzeGraphQLRequest(body: unknown, limits?: GraphQLRequestLimits): GraphQLRequestAnalysis;
+//#endregion
+export { GraphQLRequestAnalysis, GraphQLRequestLimits, QueryComplexity, QueryComplexityLimits, analyzeGraphQLRequest, analyzeQueryComplexity, validateJsonpCallback };
+//# sourceMappingURL=query.d.mts.map

package/lib/controls/query.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.mts","names":[],"sources":["../../src/controls/query.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6EgB,sBAAsB;;UAgBrB;;WAEP;;WAEA;;WAEA;;WAEA;;;UAIO;;WAEP;;WAEA;;WAEA;;WAEA;;WAEA;;WAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyCM,uBACf,eACA,SAAQ,wBACN;;UAoFc,6BAA6B;;;;;;;WAOpC;;WAEA;;;UAIO;;WAEP;;WAEA;;WAEA,OAAO;;WAEP;;WAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyKM,sBACf,eACA,SAAQ,uBACN"}