@substrat-run/vertical-host 0.137.0 → 0.139.0

package/dist/live.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../src/live.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE9E;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,qEAAqE;AACrE,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,2GAA2G;AAC3G,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAE1F,qGAAqG;AAErG,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IACnD,oFAAoF;IACpF,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC;IACxE;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAeD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,GAAG,EAE1C,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,EACtB,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,IAAI,CAsBN"}
+{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../src/live.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE9E;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,qEAAqE;AACrE,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,2GAA2G;AAC3G,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAE1F,qGAAqG;AAErG,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IACnD,oFAAoF;IACpF,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC;IACxE;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,SAAuC,GAAG,QAAQ,CAErG;AAED,gCAAgC;AAChC,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,SAA4D,GAAG,QAAQ,CAEtH;AAeD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,GAAG,EAE1C,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,EACtB,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,IAAI,CAYN"}

package/dist/live.js

@@ -8,6 +8,20 @@ import { isUpgradeRequest } from '@substrat-run/kernel';
 export { isUpgradeRequest };
 /** Where `mountLiveReads` mounts the route unless told otherwise. */
 export const LIVE_PATH = '/api/live';
+/**
+ * The two refusals a client reads as "no push here" (#1853): `426` for a request that is not
+ * a WebSocket handshake, and `501` for a host that cannot push, each with the
+ * `LIVE_MODE_HEADER` value the client keys its fallback on. Exported so a vertical's own
+ * live route — one that cannot use `mountLiveReads`'s same-origin gate, like a widget on
+ * somebody else's page — answers in the same words.
+ */
+export function refuseNotAnUpgrade(c, error = 'live reads are a WebSocket surface') {
+    return c.json({ error }, 426, { [LIVE_MODE_HEADER]: 'not-an-upgrade' });
+}
+/** See `refuseNotAnUpgrade`. */
+export function refuseLivePoll(c, error = 'live reads are not available on this host; poll instead') {
+    return c.json({ error }, 501, { [LIVE_MODE_HEADER]: 'poll' });
+}
 /**
  * Whether a handshake's `Origin` is the page this vertical serves.
  *
@@ -28,18 +42,14 @@ export function mountLiveReads(
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 app, options) {
     app.get(options.path ?? LIVE_PATH, async (c) => {
-        if (!isUpgradeRequest(c.req.raw)) {
-            return c.json({ error: 'live reads are a WebSocket surface' }, 426, {
-                [LIVE_MODE_HEADER]: 'not-an-upgrade',
-            });
-        }
+        if (!isUpgradeRequest(c.req.raw))
+            return refuseNotAnUpgrade(c);
         if (!sameOrigin(c.req.raw)) {
             return c.json({ error: 'live reads are only offered to this app’s own pages' }, 403);
         }
         const live = options.live(c);
-        if (!live) {
-            return c.json({ error: 'live reads are not available on this host; poll instead' }, 501, { [LIVE_MODE_HEADER]: 'poll' });
-        }
+        if (!live)
+            return refuseLivePoll(c);
         const who = await options.subscriber(c);
         if (!who)
             return c.json({ error: 'unauthorized' }, 401);

package/dist/live.js.map

@@ -1 +1 @@
-{"version":3,"file":"live.js","sourceRoot":"","sources":["../src/live.ts"],"names":[],"mappings":"AA6CA,OAAO,EAAE,gBAAgB,EAAoB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAwB,MAAM,sBAAsB,CAAC;AAE9E;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,qEAAqE;AACrE,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAmBrC;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;AAC5B,8DAA8D;AAC9D,GAAsB,EACtB,OAA4B;IAE5B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,EAAE,GAAG,EAAE;gBAClE,CAAC,gBAAgB,CAAC,EAAE,gBAAsC;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qDAAqD,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yDAAyD,EAAE,EACpE,GAAG,EACH,EAAE,CAAC,gBAAgB,CAAC,EAAE,MAA4B,EAAE,CACrD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"live.js","sourceRoot":"","sources":["../src/live.ts"],"names":[],"mappings":"AA6CA,OAAO,EAAE,gBAAgB,EAAoB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAwB,MAAM,sBAAsB,CAAC;AAE9E;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,qEAAqE;AACrE,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAmBrC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAU,EAAE,KAAK,GAAG,oCAAoC;IACzF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,gBAAsC,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,cAAc,CAAC,CAAU,EAAE,KAAK,GAAG,yDAAyD;IAC1G,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,MAA4B,EAAE,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;AAC5B,8DAA8D;AAC9D,GAAsB,EACtB,OAA4B;IAE5B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qDAAqD,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/rate-limit.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Request rate limiting for a host with no router in front (#130).
+ *
+ * On the hosted path the router counts every request before it reaches a vertical, and a
+ * vertical mounts nothing. A node host — self-host, a dev server, a container — has no
+ * router, so this is the same choke point moved onto its own Hono app: the keys, the
+ * headers and the 429 are `@substrat-run/contracts`' `rate-limit.ts`, so the two paths
+ * cannot disagree about what a refusal looks like.
+ *
+ * Opt-in, and never mounted on a Cloudflare vertical: an isolate's memory is not a counter,
+ * and the router already counted the request.
+ *
+ * ```ts
+ * app.use('*', rateLimit({ nodeOf: () => ({ tenantId, scopeId }), clientIp: (c) => … }));
+ * ```
+ */
+import type { Context, MiddlewareHandler } from 'hono';
+import { type RateLimitBucket, type RateLimiter, type RateLimitPolicy } from '@substrat-run/contracts';
+export interface RateLimitOptions {
+    /**
+     * The tenant and scope a request is for — the prefix of every key, which is what keeps one
+     * tenant from spending another's budget. A single-install host answers a constant.
+     */
+    nodeOf: (c: Context) => {
+        tenantId: string;
+        scopeId: string;
+    } | Promise<{
+        tenantId: string;
+        scopeId: string;
+    }>;
+    /**
+     * The client address, for the address budget and for a request with no credential. Only
+     * the host knows which proxy header it can trust, so nothing is read by default; absent,
+     * every anonymous caller shares one budget.
+     */
+    clientIp?: (c: Context) => string | null | undefined;
+    /** Budgets per bucket. Defaults to `DEFAULT_RATE_LIMITS`. */
+    limits?: Partial<Record<RateLimitBucket, RateLimitPolicy>>;
+    /**
+     * The counters. Defaults to one {@link memoryRateLimiter} per bucket — exact for this
+     * process, and only for it: several replicas want a shared counter here.
+     */
+    limiters?: Partial<Record<RateLimitBucket, RateLimiter>>;
+}
+/**
+ * Count each request against its budgets before any route runs. Refuses with a 429
+ * `application/problem+json` (`rate_limited`) and `Retry-After`; fails OPEN with a log line
+ * when a counter throws, for the reason the contracts module gives.
+ */
+export declare function rateLimit(options: RateLimitOptions): MiddlewareHandler;
+/** The keys a {@link memoryRateLimiter} holds at most, by default. */
+export declare const MEMORY_RATE_LIMITER_MAX_KEYS = 50000;
+/**
+ * A fixed-window counter in this process's memory — the `RateLimiter` {@link rateLimit}
+ * counts with by default.
+ *
+ * Exact for ONE process. Several replicas behind a balancer each count their own share, so
+ * the effective budget is the limit times the replica count; a deployment like that wants a
+ * shared counter behind the same interface.
+ *
+ * Bounded at `maxKeys` windows. Expired windows are swept at most once a period as keys are
+ * touched; a NEW key arriving at capacity first sweeps whatever has expired, and if the map is
+ * still full it evicts the oldest window. Eviction, not refusal, deliberately: refusing a
+ * newcomer because a crowd of other addresses filled the map would let that crowd deny
+ * service to everyone else, while forgetting the oldest count only hands that key a fresh
+ * budget — the limiter degrading toward open, the same direction it fails in everywhere else.
+ * A caller rotating credentials from one address cannot fill it: `evaluateRateLimits` counts
+ * the address first and never mints a credential key for a request the address refused.
+ */
+export declare function memoryRateLimiter(policy: RateLimitPolicy, { now, maxKeys }?: {
+    now?: () => number;
+    maxKeys?: number;
+}): RateLimiter & {
+    readonly size: number;
+};
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,EAKL,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/G;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACrD,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;IAC3D;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;CAC1D;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,iBAAiB,CAuBtE;AAED,sEAAsE;AACtE,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,eAAe,EACvB,EAAE,GAAc,EAAE,OAAsC,EAAE,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GACxG,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAkCzC"}

package/dist/rate-limit.js

@@ -0,0 +1,88 @@
+import { DEFAULT_RATE_LIMITS, evaluateRateLimits, RATE_LIMIT_BUCKETS, RATE_LIMIT_POLICY_HEADER, } from '@substrat-run/contracts';
+/**
+ * Count each request against its budgets before any route runs. Refuses with a 429
+ * `application/problem+json` (`rate_limited`) and `Retry-After`; fails OPEN with a log line
+ * when a counter throws, for the reason the contracts module gives.
+ */
+export function rateLimit(options) {
+    const policies = { ...DEFAULT_RATE_LIMITS, ...options.limits };
+    const limiters = Object.fromEntries(RATE_LIMIT_BUCKETS.map((bucket) => [bucket, options.limiters?.[bucket] ?? memoryRateLimiter(policies[bucket])]));
+    return async (c, next) => {
+        const at = await options.nodeOf(c);
+        const { refusal, policyHeader, unavailable } = await evaluateRateLimits({
+            subject: { ...at, headers: c.req.raw.headers, clientIp: options.clientIp?.(c), method: c.req.method },
+            policies,
+            limiters,
+            instance: c.req.path,
+        });
+        if (unavailable)
+            console.error(JSON.stringify({ host: 'rate-limit-unavailable', ...at, ...unavailable }));
+        if (refusal)
+            return c.body(JSON.stringify(refusal.body), refusal.status, refusal.headers);
+        await next();
+        // Rebuilt rather than set in place: a handler may answer with a response whose headers
+        // are immutable (one it fetched). An upgrade carries a socket a rebuild would drop.
+        if (c.res.status === 101 || !policyHeader)
+            return;
+        c.res = new Response(c.res.body, c.res);
+        c.res.headers.set(RATE_LIMIT_POLICY_HEADER, policyHeader);
+    };
+}
+/** The keys a {@link memoryRateLimiter} holds at most, by default. */
+export const MEMORY_RATE_LIMITER_MAX_KEYS = 50_000;
+/**
+ * A fixed-window counter in this process's memory — the `RateLimiter` {@link rateLimit}
+ * counts with by default.
+ *
+ * Exact for ONE process. Several replicas behind a balancer each count their own share, so
+ * the effective budget is the limit times the replica count; a deployment like that wants a
+ * shared counter behind the same interface.
+ *
+ * Bounded at `maxKeys` windows. Expired windows are swept at most once a period as keys are
+ * touched; a NEW key arriving at capacity first sweeps whatever has expired, and if the map is
+ * still full it evicts the oldest window. Eviction, not refusal, deliberately: refusing a
+ * newcomer because a crowd of other addresses filled the map would let that crowd deny
+ * service to everyone else, while forgetting the oldest count only hands that key a fresh
+ * budget — the limiter degrading toward open, the same direction it fails in everywhere else.
+ * A caller rotating credentials from one address cannot fill it: `evaluateRateLimits` counts
+ * the address first and never mints a credential key for a request the address refused.
+ */
+export function memoryRateLimiter(policy, { now = Date.now, maxKeys = MEMORY_RATE_LIMITER_MAX_KEYS } = {}) {
+    // Insertion order is window-start order: a key whose window resets is deleted and
+    // re-inserted, so the first entry is always the oldest window.
+    const windows = new Map();
+    const periodMs = policy.period * 1000;
+    let lastSweep = now();
+    const sweep = (t) => {
+        for (const [k, w] of windows) {
+            if (t - w.start < periodMs)
+                break;
+            windows.delete(k);
+        }
+        lastSweep = t;
+    };
+    return {
+        get size() {
+            return windows.size;
+        },
+        async limit({ key }) {
+            const t = now();
+            if (t - lastSweep >= periodMs)
+                sweep(t);
+            let w = windows.get(key);
+            if (!w || t - w.start >= periodMs) {
+                windows.delete(key);
+                if (windows.size >= maxKeys) {
+                    sweep(t);
+                    if (windows.size >= maxKeys)
+                        windows.delete(windows.keys().next().value);
+                }
+                w = { start: t, count: 0 };
+                windows.set(key, w);
+            }
+            w.count += 1;
+            return { success: w.count <= policy.limit };
+        },
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,GAIzB,MAAM,yBAAyB,CAAC;AAuBjC;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,OAAyB;IACjD,MAAM,QAAQ,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CACxE,CAAC;IAE1C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACtE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE;YACrG,QAAQ;YACR,QAAQ;YACR,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;SACrB,CAAC,CAAC;QACH,IAAI,WAAW;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1G,IAAI,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1F,MAAM,IAAI,EAAE,CAAC;QACb,uFAAuF;QACvF,oFAAoF;QACpF,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY;YAAE,OAAO;QAClD,CAAC,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAC;IAC5D,CAAC,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAuB,EACvB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,4BAA4B,EAAE,GAA6C,EAAE;IAEzG,kFAAkF;IAClF,+DAA+D;IAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4C,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;IACtC,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,CAAC,CAAS,EAAQ,EAAE;QAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,QAAQ;gBAAE,MAAM;YAClC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC,CAAC;IACF,OAAO;QACL,IAAI,IAAI;YACN,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE;YACjB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,SAAS,IAAI,QAAQ;gBAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAClC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpB,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;oBAC5B,KAAK,CAAC,CAAC,CAAC,CAAC;oBACT,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO;wBAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;gBAC5E,CAAC;gBACD,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtB,CAAC;YACD,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/vertical-host",
-  "version": "0.137.0",
+  "version": "0.139.0",
   "description": "The platform's /internal/* surface + error envelope, authored once — mount it in a vertical worker instead of re-copying the control-plane contract",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -26,18 +26,21 @@
     "dist"
   ],
   "dependencies": {
-    "ai": "7.0.114",
-    "hono": "^4.13.9",
+    "ai": "7.0.127",
+    "hono": "^4.13.12",
     "workers-ai-provider": "^4.0.0",
-    "@substrat-run/contracts": "^0.137.0",
-    "@substrat-run/model-providers": "^0.5.27",
-    "@substrat-run/kernel": "^0.137.0"
+    "@substrat-run/contracts": "^0.139.0",
+    "@substrat-run/model-providers": "^0.5.29",
+    "@substrat-run/kernel": "^0.139.0"
   },
   "devDependencies": {
+    "@types/better-sqlite3": "^9.6.0",
+    "better-sqlite3": "^13.0.3",
     "typescript": "^7.0.0",
     "vitest": "^3.2.7",
-    "@substrat-run/adapter-sqlite": "^0.137.0",
-    "@substrat-run/contract-tests": "^0.137.0"
+    "@substrat-run/adapter-sqlite": "^0.139.0",
+    "@substrat-run/contract-tests": "^0.139.0",
+    "@substrat-run/vertical-auth": "^0.20.0"
   },
   "publishConfig": {
     "access": "public"