@vitrine-kit/core 0.2.2 → 0.3.1

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { S as SlotRegistry, c as createSlotRegistry, g as getSlotMounts, r as registerSlot, s as slotRegistry } from './registry-CfORxf9H.js';
 import { Backend, SiteConfig, CatalogSource, CommerceBackend, Cart, Order, Money, CurrencyCode, OrderStatus } from '@vitrine-kit/contracts';
 
-declare const CORE_VERSION: "0.2.2";
+declare const CORE_VERSION: "0.3.1";
 
 interface AdapterFactory {
     backend: Backend;
@@ -143,4 +143,19 @@ interface BuildOrderOptions {
 /** Snapshots the cart into an order (after payment). Totals come from the cart — not recomputed. */
 declare function buildOrderFromCart(cart: Cart, opts: BuildOrderOptions): Order;
 
-export { type AdapterFactory, type AdapterRegistry, type BuildOrderOptions, CORE_VERSION, type CreateCheckoutArgs, type NewLineInput, type NormalizedPaymentEvent, type OrderCreationGuard, type OrderPipelineContext, type OrderStage, type PaymentProvider, type PaymentProviderName, type PaymentRegistry, type PaymentWebhookHandlers, type PaymentWebhookRequest, type PaymentWebhookResult, adapters, addCartLine, buildOrderFromCart, cartItemCount, computeLineTotal, createAdapterRegistry, createPaymentRegistry, emptyCart, handlePaymentWebhook, payments, recalcCart, removeCartLine, runPipeline, setCartLineQty, shouldCreateOrder };
+interface RateLimitOptions {
+    /** Max requests allowed within the window. */
+    limit: number;
+    /** Window size in milliseconds. */
+    windowMs: number;
+}
+interface RateLimitResult {
+    allowed: boolean;
+    /** Milliseconds until the caller may retry — present only when !allowed. */
+    retryAfterMs?: number;
+}
+declare function checkRateLimit(key: string, { limit, windowMs }: RateLimitOptions): RateLimitResult;
+/** Best-effort client IP from standard proxy headers (Web Fetch API `Headers`). */
+declare function clientIpFromHeaders(headers: Headers): string;
+
+export { type AdapterFactory, type AdapterRegistry, type BuildOrderOptions, CORE_VERSION, type CreateCheckoutArgs, type NewLineInput, type NormalizedPaymentEvent, type OrderCreationGuard, type OrderPipelineContext, type OrderStage, type PaymentProvider, type PaymentProviderName, type PaymentRegistry, type PaymentWebhookHandlers, type PaymentWebhookRequest, type PaymentWebhookResult, type RateLimitOptions, type RateLimitResult, adapters, addCartLine, buildOrderFromCart, cartItemCount, checkRateLimit, clientIpFromHeaders, computeLineTotal, createAdapterRegistry, createPaymentRegistry, emptyCart, handlePaymentWebhook, payments, recalcCart, removeCartLine, runPipeline, setCartLineQty, shouldCreateOrder };

package/dist/index.js

@@ -6,7 +6,7 @@ import {
 } from "./chunk-BQVNYHVU.js";
 
 // src/version.generated.ts
-var CORE_VERSION = "0.2.2";
+var CORE_VERSION = "0.3.1";
 
 // src/adapter/resolver.ts
 function createAdapterRegistry() {
@@ -186,12 +186,35 @@ function buildOrderFromCart(cart, opts) {
     createdAt: opts.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
   };
 }
+
+// src/security/rate-limit.ts
+var buckets = /* @__PURE__ */ new Map();
+function checkRateLimit(key, { limit, windowMs }) {
+  const now = Date.now();
+  const bucket = buckets.get(key);
+  if (!bucket || bucket.resetAt <= now) {
+    buckets.set(key, { count: 1, resetAt: now + windowMs });
+    return { allowed: true };
+  }
+  if (bucket.count >= limit) {
+    return { allowed: false, retryAfterMs: bucket.resetAt - now };
+  }
+  bucket.count += 1;
+  return { allowed: true };
+}
+function clientIpFromHeaders(headers) {
+  const forwarded = headers.get("x-forwarded-for");
+  const first = forwarded?.split(",")[0]?.trim();
+  return first || headers.get("x-real-ip") || "unknown";
+}
 export {
   CORE_VERSION,
   adapters,
   addCartLine,
   buildOrderFromCart,
   cartItemCount,
+  checkRateLimit,
+  clientIpFromHeaders,
   computeLineTotal,
   createAdapterRegistry,
   createPaymentRegistry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vitrine-kit/core",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "description": "Vitrine core — slot/adapter runtime, order pipeline, provider-neutral payment webhook dispatch. Critical logic (a bug = an incident for everyone).",
   "license": "MIT",
   "type": "module",
@@ -33,7 +33,7 @@
     "directory": "packages/core"
   },
   "dependencies": {
-    "@vitrine-kit/contracts": "1.2.1"
+    "@vitrine-kit/contracts": "1.2.2"
   },
   "peerDependencies": {
     "react": ">=18.0.0"