@vsaas/loopback 12.1.1 → 12.2.0

package/dist/lib/rate-limit/stores/persisted-model.cjs

@@ -0,0 +1,353 @@
+const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
+const require_errors = require("../errors.cjs");
+const require_subject = require("../subject.cjs");
+const require_config = require("../config.cjs");
+const require_common = require("../algorithms/common.cjs");
+const require_index = require("../algorithms/index.cjs");
+//#region src/lib/rate-limit/stores/persisted-model.ts
+var persisted_model_exports = /* @__PURE__ */ require_runtime.__exportAll({ PersistedModelRateLimitStore: () => PersistedModelRateLimitStore });
+function resultCount(result) {
+	return typeof result === "number" ? result : Number(result?.count || 0);
+}
+function dateMs(value) {
+	if (value == null) return null;
+	const result = value instanceof Date ? value.getTime() : new Date(value).getTime();
+	if (!Number.isFinite(result)) throw require_errors.rateLimitUnavailableError(/* @__PURE__ */ new Error("Invalid persisted rate limit timestamp"));
+	return result;
+}
+function nonNegativeSafeInteger(value, name, fallback = 0) {
+	const result = value == null ? fallback : Number(value);
+	if (!Number.isSafeInteger(result) || result < 0) throw require_errors.rateLimitUnavailableError(/* @__PURE__ */ new Error(`Invalid persisted rate limit ${name}`));
+	return result;
+}
+function isExpired(record, nowMs) {
+	const expiresAtMs = dateMs(record.expiresAt);
+	if (expiresAtMs == null) throw require_errors.rateLimitUnavailableError(/* @__PURE__ */ new Error("Persisted rate limit expiry is missing"));
+	return expiresAtMs <= nowMs;
+}
+function stateFromRecord(record, nowMs) {
+	if (isExpired(record, nowMs)) return require_common.emptyRateLimitState();
+	return {
+		failureCount: nonNegativeSafeInteger(record.failureCount, "failureCount"),
+		attemptCount: nonNegativeSafeInteger(record.attemptCount, "attemptCount"),
+		lockoutLevel: nonNegativeSafeInteger(record.lockoutLevel, "lockoutLevel"),
+		windowStartedAtMs: dateMs(record.windowStartedAt),
+		lastAttemptAtMs: dateMs(record.lastAttemptAt),
+		lastFailureAtMs: dateMs(record.lastFailureAt),
+		blockedUntilMs: dateMs(record.blockedUntil)
+	};
+}
+function stateToRecord(state) {
+	return {
+		failureCount: state.failureCount,
+		attemptCount: state.attemptCount,
+		lockoutLevel: state.lockoutLevel,
+		windowStartedAt: state.windowStartedAtMs == null ? null : new Date(state.windowStartedAtMs),
+		lastAttemptAt: state.lastAttemptAtMs == null ? null : new Date(state.lastAttemptAtMs),
+		lastFailureAt: state.lastFailureAtMs == null ? null : new Date(state.lastFailureAtMs),
+		blockedUntil: state.blockedUntilMs == null ? null : new Date(state.blockedUntilMs)
+	};
+}
+function isDuplicateKey(error) {
+	return error && (error.code === 11e3 || error.code === 11001 || error.code === "E11000" || error.statusCode === 409 || error.status === 409);
+}
+function validateDecision(value, fingerprint) {
+	if (!value || value.resultVersion !== 1 || value.policyFingerprint !== fingerprint || typeof value.allowed !== "boolean" || !Number.isSafeInteger(value.revision) || value.blockedUntilMs !== null && !Number.isSafeInteger(value.blockedUntilMs)) throw require_errors.rateLimitUnavailableError(/* @__PURE__ */ new Error("Invalid persisted operation result"));
+	return value;
+}
+var crypto, PersistedModelRateLimitStore;
+var init_persisted_model = require_runtime.__esmMin((() => {
+	require_index.init_algorithms();
+	require_common.init_common();
+	require_subject.init_subject();
+	require_errors.init_errors();
+	require_config.init_config();
+	crypto = require("crypto");
+	PersistedModelRateLimitStore = class {
+		model;
+		clock;
+		maxRetries;
+		allowMemory;
+		constructor(options) {
+			this.model = options.model;
+			this.clock = options.clock || Date.now;
+			this.maxRetries = options.maxRetries || 20;
+			this.allowMemory = options.allowMemory === true;
+		}
+		async initialize() {
+			if (!this.model || !this.model.dataSource) throw require_errors.rateLimitConfigurationError("Persisted rate limit model is not connected");
+			const connectorName = this.model.dataSource.connector && (this.model.dataSource.connector.name || this.model.dataSource.connector.constructor?.name);
+			if (!this.allowMemory && String(connectorName).toLowerCase().includes("memory")) throw require_errors.rateLimitConfigurationError("Memory connector is not a supported deployed rate limit store");
+			await this.healthCheck();
+			await this.verifyCompareAndSetCapability();
+		}
+		async healthCheck() {
+			try {
+				await this.model.count({ id: { neq: "__rate_limit_health__" } });
+			} catch (error) {
+				throw require_errors.rateLimitUnavailableError(error);
+			}
+		}
+		async verifyCompareAndSetCapability() {
+			const id = `__rate_limit_capability_probe__${crypto.randomBytes(12).toString("hex")}`;
+			const now = new Date(this.clock());
+			const probe = {
+				id,
+				namespace: "__probe__",
+				scope: "__probe__",
+				subjectType: "__probe__",
+				bucket: "__probe__",
+				subjectKeyId: "__probe__",
+				formatVersion: 1,
+				policyFingerprint: "0".repeat(64),
+				failureCount: 0,
+				attemptCount: 0,
+				lockoutLevel: 0,
+				revision: 0,
+				createdAt: now,
+				updatedAt: now,
+				expiresAt: new Date(now.getTime() + 6e4)
+			};
+			let created = false;
+			try {
+				created = true;
+				await this.model.create(probe);
+				const roundTripped = await this.model.findById(id);
+				if (!roundTripped || String(roundTripped.id) !== id) throw new Error("Connector does not preserve deterministic string IDs");
+				try {
+					await this.model.create(probe);
+					throw new Error("Connector does not enforce unique rate-limit state IDs");
+				} catch (error) {
+					if (!isDuplicateKey(error)) throw new Error(`Connector duplicate-key errors are not recognized: ${error?.message || error}`);
+				}
+				const [first, second] = await Promise.all([this.model.updateAll({
+					id,
+					revision: 0
+				}, { revision: 1 }), this.model.updateAll({
+					id,
+					revision: 0
+				}, { revision: 2 })]);
+				const updated = resultCount(first) + resultCount(second);
+				const stale = await this.model.updateAll({
+					id,
+					revision: 0
+				}, { revision: 2 });
+				const winner = await this.model.findById(id);
+				if (updated !== 1 || resultCount(stale) !== 0 || !winner || ![1, 2].includes(Number(winner.revision))) throw new Error("Connector does not provide concurrent conditional update semantics");
+			} catch (error) {
+				throw require_errors.rateLimitConfigurationError(`Persisted rate limit connector failed its compare-and-set capability check: ${error?.message || error}`);
+			} finally {
+				if (created) try {
+					await this.model.destroyAll({ id });
+				} catch (error) {
+					throw require_errors.rateLimitConfigurationError(`Persisted rate limit capability probe cleanup failed: ${error?.message || error}`);
+				}
+			}
+		}
+		async inspect(input) {
+			const nowMs = this.clock();
+			const record = await this.findRecord(input.subject);
+			if (!record) return this.decision(input.policy.policyFingerprint, true, 0, null);
+			this.validateRecord(record, input.policy.policyFingerprint);
+			if (isExpired(record, nowMs)) return this.decision(input.policy.policyFingerprint, true, 0, null);
+			const transition = require_index.inspectState(stateFromRecord(record, nowMs), input.policy, nowMs);
+			return this.decision(input.policy.policyFingerprint, transition.allowed, Number(record.revision), transition.blockedUntilMs);
+		}
+		async consume(input) {
+			for (let attempt = 0; attempt < this.maxRetries; attempt++) {
+				const nowMs = this.clock();
+				const record = await this.findRecord(input.subject);
+				if (!record) {
+					const transition = require_index.consumeState(require_common.emptyRateLimitState(), input.policy, input.cost, nowMs);
+					const decision = this.decision(input.policy.policyFingerprint, transition.allowed, 1, transition.blockedUntilMs);
+					try {
+						await this.model.create({
+							id: require_subject.rateLimitStateId(input.subject),
+							namespace: input.subject.namespace,
+							scope: input.subject.scope,
+							subjectType: input.subject.subjectType,
+							bucket: input.subject.bucket,
+							subjectKeyId: input.subject.subjectKeyId,
+							formatVersion: 1,
+							policyFingerprint: input.policy.policyFingerprint,
+							...stateToRecord(transition.state),
+							revision: 1,
+							lastOperationId: input.operationId,
+							lastOperationResultJson: require_config.canonicalJson(decision),
+							createdAt: new Date(nowMs),
+							updatedAt: new Date(nowMs),
+							expiresAt: new Date(nowMs + input.policy.stateTtlMs)
+						});
+						return decision;
+					} catch (error) {
+						if (isDuplicateKey(error)) continue;
+						return this.recoverAmbiguous(input.subject, input.operationId, input.policy.policyFingerprint, error);
+					}
+				}
+				this.validateRecord(record, input.policy.policyFingerprint);
+				const deduplicated = this.readDeduplicated(record, input.operationId, input.policy.policyFingerprint);
+				if (deduplicated) return deduplicated;
+				const transition = require_index.consumeState(stateFromRecord(record, nowMs), input.policy, input.cost, nowMs);
+				const revision = Number(record.revision) + 1;
+				const decision = this.decision(input.policy.policyFingerprint, transition.allowed, revision, transition.blockedUntilMs);
+				try {
+					const result = await this.model.updateAll({
+						id: record.id,
+						formatVersion: 1,
+						policyFingerprint: input.policy.policyFingerprint,
+						revision: Number(record.revision)
+					}, {
+						...stateToRecord(transition.state),
+						revision,
+						lastOperationId: input.operationId,
+						lastOperationResultJson: require_config.canonicalJson(decision),
+						updatedAt: new Date(nowMs),
+						expiresAt: new Date(nowMs + input.policy.stateTtlMs)
+					});
+					if (result && result.count === 1) return decision;
+				} catch (error) {
+					return this.recoverAmbiguous(input.subject, input.operationId, input.policy.policyFingerprint, error);
+				}
+			}
+			throw require_errors.rateLimitUnavailableError(/* @__PURE__ */ new Error("Rate limit CAS retries exhausted"));
+		}
+		async reset(input) {
+			for (let attempt = 0; attempt < this.maxRetries; attempt++) {
+				const nowMs = this.clock();
+				const record = await this.findRecord(input.subject);
+				if (!record) {
+					const result = {
+						...this.decision(input.policy.policyFingerprint, true, 1, null),
+						outcome: "reset"
+					};
+					try {
+						await this.model.create({
+							id: require_subject.rateLimitStateId(input.subject),
+							namespace: input.subject.namespace,
+							scope: input.subject.scope,
+							subjectType: input.subject.subjectType,
+							bucket: input.subject.bucket,
+							subjectKeyId: input.subject.subjectKeyId,
+							formatVersion: 1,
+							policyFingerprint: input.policy.policyFingerprint,
+							...stateToRecord(require_common.emptyRateLimitState()),
+							revision: 1,
+							lastOperationId: input.operationId,
+							lastOperationResultJson: require_config.canonicalJson(result),
+							createdAt: new Date(nowMs),
+							updatedAt: new Date(nowMs),
+							expiresAt: new Date(nowMs + input.policy.stateTtlMs)
+						});
+						return result;
+					} catch (error) {
+						if (isDuplicateKey(error)) continue;
+						return await this.recoverAmbiguous(input.subject, input.operationId, input.policy.policyFingerprint, error);
+					}
+				}
+				this.validateRecord(record, input.policy.policyFingerprint);
+				const deduplicated = this.readDeduplicated(record, input.operationId, input.policy.policyFingerprint);
+				if (deduplicated) return deduplicated;
+				if (Number(record.revision) !== input.expectedRevision) {
+					const current = require_index.inspectState(stateFromRecord(record, nowMs), input.policy, nowMs);
+					return {
+						...this.decision(input.policy.policyFingerprint, current.allowed, Number(record.revision), current.blockedUntilMs),
+						outcome: "preserved-newer-state"
+					};
+				}
+				const revision = Number(record.revision) + 1;
+				const result = {
+					...this.decision(input.policy.policyFingerprint, true, revision, null),
+					outcome: "reset"
+				};
+				try {
+					const updated = await this.model.updateAll({
+						id: record.id,
+						formatVersion: 1,
+						policyFingerprint: input.policy.policyFingerprint,
+						revision: Number(record.revision)
+					}, {
+						...stateToRecord(require_common.emptyRateLimitState()),
+						revision,
+						lastOperationId: input.operationId,
+						lastOperationResultJson: require_config.canonicalJson(result),
+						updatedAt: new Date(nowMs),
+						expiresAt: new Date(nowMs + input.policy.stateTtlMs)
+					});
+					if (updated && updated.count === 1) return result;
+				} catch (error) {
+					return await this.recoverAmbiguous(input.subject, input.operationId, input.policy.policyFingerprint, error);
+				}
+			}
+			throw require_errors.rateLimitUnavailableError(/* @__PURE__ */ new Error("Rate limit reset CAS retries exhausted"));
+		}
+		async delete(input) {
+			const ids = input.subjects.map(require_subject.rateLimitStateId);
+			if (!ids.length) return;
+			try {
+				await this.model.destroyAll({ id: { inq: ids } });
+			} catch (error) {
+				throw require_errors.rateLimitUnavailableError(error);
+			}
+		}
+		async findRecord(subject) {
+			try {
+				return await this.model.findById(require_subject.rateLimitStateId(subject));
+			} catch (error) {
+				throw require_errors.rateLimitUnavailableError(error);
+			}
+		}
+		validateRecord(record, fingerprint) {
+			const revision = Number(record.revision);
+			if (Number(record.formatVersion) !== 1 || record.policyFingerprint !== fingerprint || !Number.isSafeInteger(revision) || revision < 1) throw require_errors.rateLimitUnavailableError(/* @__PURE__ */ new Error("Rate limit state format or policy mismatch"));
+			nonNegativeSafeInteger(record.failureCount, "failureCount");
+			nonNegativeSafeInteger(record.attemptCount, "attemptCount");
+			nonNegativeSafeInteger(record.lockoutLevel, "lockoutLevel");
+			dateMs(record.windowStartedAt);
+			dateMs(record.lastAttemptAt);
+			dateMs(record.lastFailureAt);
+			dateMs(record.blockedUntil);
+			isExpired(record, this.clock());
+		}
+		readDeduplicated(record, operationId, fingerprint) {
+			if (record.lastOperationId !== operationId) return null;
+			try {
+				return validateDecision(JSON.parse(record.lastOperationResultJson), fingerprint);
+			} catch (error) {
+				if (error instanceof require_errors.RateLimitError) throw error;
+				throw require_errors.rateLimitUnavailableError(error);
+			}
+		}
+		async recoverAmbiguous(subject, operationId, fingerprint, cause) {
+			const current = await this.findRecord(subject);
+			if (current) {
+				const result = this.readDeduplicated(current, operationId, fingerprint);
+				if (result) return result;
+			}
+			throw new require_errors.RateLimitError("RATE_LIMIT_OPERATION_AMBIGUOUS", "Rate limit operation outcome is ambiguous", 503, { cause });
+		}
+		decision(fingerprint, allowed, revision, blockedUntilMs) {
+			return {
+				resultVersion: 1,
+				policyFingerprint: fingerprint,
+				allowed,
+				revision,
+				blockedUntilMs
+			};
+		}
+	};
+}));
+//#endregion
+init_persisted_model();
+exports.PersistedModelRateLimitStore = PersistedModelRateLimitStore;
+Object.defineProperty(exports, "init_persisted_model", {
+	enumerable: true,
+	get: function() {
+		return init_persisted_model;
+	}
+});
+Object.defineProperty(exports, "persisted_model_exports", {
+	enumerable: true,
+	get: function() {
+		return persisted_model_exports;
+	}
+});

package/dist/lib/rate-limit/subject.cjs

@@ -0,0 +1,127 @@
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_errors = require("./errors.cjs");
+//#region src/lib/rate-limit/subject.ts
+var subject_exports = /* @__PURE__ */ require_runtime.__exportAll({
+	encodeLengthPrefixed: () => encodeLengthPrefixed,
+	hashRateLimitSubject: () => hashRateLimitSubject,
+	normalizeKeyring: () => normalizeKeyring,
+	rateLimitStateId: () => rateLimitStateId,
+	timingSafeEqualText: () => timingSafeEqualText,
+	validateSafeIdentifier: () => validateSafeIdentifier,
+	withBucket: () => withBucket
+});
+function encodeLengthPrefixed(values) {
+	const encoded = values.map((value) => Buffer.isBuffer(value) ? Buffer.from(value) : Buffer.from(value, "utf8"));
+	const total = encoded.reduce((size, value) => size + 4 + value.length, 0);
+	const output = Buffer.allocUnsafe(total);
+	let offset = 0;
+	for (const value of encoded) {
+		output.writeUInt32BE(value.length, offset);
+		offset += 4;
+		value.copy(output, offset);
+		offset += value.length;
+	}
+	return output;
+}
+function validateSafeIdentifier(value, name) {
+	if (typeof value !== "string" || !SAFE_IDENTIFIER.test(value)) throw require_errors.rateLimitConfigurationError(`${name} has an invalid format`);
+}
+function normalizeKeyring(input, name) {
+	if (!input || typeof input !== "object") throw require_errors.rateLimitConfigurationError(`${name} is required`);
+	validateSafeIdentifier(input.currentKeyId, `${name}.currentKeyId`);
+	const keys = {};
+	for (const keyId of Object.keys(input.keys || {})) {
+		validateSafeIdentifier(keyId, `${name}.keys key`);
+		const raw = input.keys[keyId];
+		const key = Buffer.isBuffer(raw) ? Buffer.from(raw) : Buffer.from(String(raw), "base64");
+		if (key.length < 32) throw require_errors.rateLimitConfigurationError(`${name}.keys.${keyId} must contain at least 32 bytes`);
+		keys[keyId] = key;
+	}
+	if (!keys[input.currentKeyId]) throw require_errors.rateLimitConfigurationError(`${name}.currentKeyId does not exist in keys`);
+	return Object.freeze({
+		currentKeyId: input.currentKeyId,
+		keys: Object.freeze(keys)
+	});
+}
+function hashRateLimitSubject(subject, keyring, keyId = keyring.currentKeyId) {
+	validateSafeIdentifier(subject.namespace, "subject.namespace");
+	validateSafeIdentifier(subject.scope, "subject.scope");
+	validateSafeIdentifier(subject.subjectType, "subject.subjectType");
+	if (typeof subject.canonicalValue !== "string" && !Buffer.isBuffer(subject.canonicalValue)) throw require_errors.rateLimitConfigurationError("subject.canonicalValue must be a string or Buffer");
+	const canonicalLength = Buffer.isBuffer(subject.canonicalValue) ? subject.canonicalValue.length : Buffer.byteLength(String(subject.canonicalValue), "utf8");
+	if (canonicalLength < 1 || canonicalLength > 4096) throw require_errors.rateLimitConfigurationError("subject.canonicalValue has an invalid length");
+	const key = keyring.keys[keyId];
+	if (!key) throw require_errors.rateLimitConfigurationError(`Unknown subject key ID ${keyId}`);
+	const material = encodeLengthPrefixed([
+		"rate-limit-subject:v1",
+		subject.namespace,
+		subject.scope,
+		subject.subjectType,
+		subject.canonicalValue
+	]);
+	const subjectHash = crypto.createHmac("sha256", key).update(material).digest("base64url");
+	material.fill(0);
+	return {
+		namespace: subject.namespace,
+		scope: subject.scope,
+		subjectType: subject.subjectType,
+		subjectHash,
+		subjectKeyId: keyId
+	};
+}
+function withBucket(subject, bucket, policyId, policyVersion) {
+	validateSafeIdentifier(bucket, "bucket");
+	validateSafeIdentifier(policyId, "policyId");
+	validateSafeIdentifier(policyVersion, "policyVersion");
+	return {
+		...subject,
+		bucket,
+		policyId,
+		policyVersion
+	};
+}
+function rateLimitStateId(subject) {
+	return crypto.createHash("sha256").update(encodeLengthPrefixed([
+		"rate-limit-state:v1",
+		subject.namespace,
+		subject.scope,
+		subject.subjectType,
+		subject.subjectKeyId,
+		subject.subjectHash,
+		subject.bucket,
+		subject.policyId,
+		subject.policyVersion
+	])).digest("base64url");
+}
+function timingSafeEqualText(left, right) {
+	const a = Buffer.from(left);
+	const b = Buffer.from(right);
+	return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+var crypto, SAFE_IDENTIFIER;
+var init_subject = require_runtime.__esmMin((() => {
+	require_errors.init_errors();
+	crypto = require("crypto");
+	SAFE_IDENTIFIER = /^[A-Za-z0-9._-]{1,128}$/;
+}));
+//#endregion
+init_subject();
+exports.encodeLengthPrefixed = encodeLengthPrefixed;
+exports.hashRateLimitSubject = hashRateLimitSubject;
+Object.defineProperty(exports, "init_subject", {
+	enumerable: true,
+	get: function() {
+		return init_subject;
+	}
+});
+exports.normalizeKeyring = normalizeKeyring;
+exports.rateLimitStateId = rateLimitStateId;
+Object.defineProperty(exports, "subject_exports", {
+	enumerable: true,
+	get: function() {
+		return subject_exports;
+	}
+});
+exports.timingSafeEqualText = timingSafeEqualText;
+exports.validateSafeIdentifier = validateSafeIdentifier;
+exports.withBucket = withBucket;

package/dist/lib/rate-limit/types.cjs

@@ -0,0 +1 @@
+require("../../_virtual/_rolldown/runtime.cjs");

package/dist/lib/rate-limit/types.d.cts

@@ -0,0 +1,167 @@
+//#region src/lib/rate-limit/types.d.ts
+type MaybePromise<T> = T | Promise<T>;
+type RateLimitAlgorithmName = 'fixed-window' | 'failure-lockout';
+type RateLimitStoreErrorMode = 'deny' | 'allow';
+type RateLimitPhase = 'early' | 'resolved' | 'domain';
+interface RateLimitSubjectMaterial {
+  namespace: string;
+  scope: string;
+  subjectType: string;
+  canonicalValue: string | Buffer;
+}
+interface HashedRateLimitSubject {
+  namespace: string;
+  scope: string;
+  subjectType: string;
+  subjectHash: string;
+  subjectKeyId: string;
+}
+interface RateLimitBucketSubject extends HashedRateLimitSubject {
+  policyId: string;
+  policyVersion: string;
+  bucket: string;
+}
+interface RateLimitSubjectKeyring {
+  currentKeyId: string;
+  keys: Record<string, Buffer>;
+}
+interface BaseRateLimitPolicy {
+  policyId: string;
+  policyVersion: string;
+  algorithm: RateLimitAlgorithmName;
+  stateTtlMs: number;
+  policyFingerprint: string;
+}
+interface FixedWindowRateLimitPolicy extends BaseRateLimitPolicy {
+  algorithm: 'fixed-window';
+  maxAttempts: number;
+  observationWindowMs: number;
+  blockDurationMs: number;
+}
+interface FailureLockoutRateLimitPolicy extends BaseRateLimitPolicy {
+  algorithm: 'failure-lockout';
+  maxFailedAttempts: number;
+  observationWindowMs: number;
+  blockDurationMs: number;
+  strategy: 'fixed' | 'exponential';
+  multiplier: number;
+  maxBlockDurationMs: number;
+  backoffResetAfterMs: number;
+}
+type NormalizedRateLimitPolicy = FixedWindowRateLimitPolicy | FailureLockoutRateLimitPolicy;
+interface ResolvedRateLimitRule {
+  ruleId: string;
+  store: string;
+  subjectKeyring: string;
+  subject: RateLimitSubjectMaterial;
+  bucket: string;
+  policy: NormalizedRateLimitPolicy;
+  cost: number;
+  onStoreError: RateLimitStoreErrorMode;
+  phase: RateLimitPhase;
+  order: number;
+  shortCircuitOnDeny: boolean;
+}
+interface RateLimitDecision {
+  resultVersion: 1;
+  policyFingerprint: string;
+  allowed: boolean;
+  revision: number;
+  blockedUntilMs: number | null;
+}
+interface RateLimitResetResult extends RateLimitDecision {
+  outcome: 'reset' | 'not-found' | 'preserved-newer-state';
+}
+interface RateLimitInspection {
+  subject: RateLimitBucketSubject;
+  policy: NormalizedRateLimitPolicy;
+}
+interface RateLimitConsumption extends RateLimitInspection {
+  cost: number;
+  operationId: string;
+}
+interface RateLimitReset extends RateLimitInspection {
+  expectedRevision: number;
+  operationId: string;
+}
+interface RateLimitDelete {
+  subjects: ReadonlyArray<RateLimitBucketSubject>;
+}
+interface RateLimitStore {
+  initialize(): Promise<void>;
+  healthCheck(): Promise<void>;
+  inspect(input: RateLimitInspection): Promise<RateLimitDecision>;
+  consume(input: RateLimitConsumption): Promise<RateLimitDecision>;
+  reset(input: RateLimitReset): Promise<RateLimitResetResult>;
+  delete(input: RateLimitDelete): Promise<void>;
+}
+interface RateLimitRuleDecision {
+  ruleId: string;
+  decision: RateLimitDecision;
+}
+interface AggregatedRateLimitDecision {
+  allowed: boolean;
+  blockedUntilMs: number | null;
+  decisions: ReadonlyArray<RateLimitRuleDecision>;
+}
+interface RateLimitStateData {
+  failureCount: number;
+  attemptCount: number;
+  lockoutLevel: number;
+  windowStartedAtMs: number | null;
+  lastAttemptAtMs: number | null;
+  lastFailureAtMs: number | null;
+  blockedUntilMs: number | null;
+}
+interface RateLimitTransition {
+  state: RateLimitStateData;
+  allowed: boolean;
+  blockedUntilMs: number | null;
+}
+interface DynamicFixedWindowLimit {
+  limit: number;
+  windowMs: number;
+  blockDurationMs?: number;
+  stateTtlMs?: number;
+  revision: string;
+}
+interface RegisteredFixedWindowRule<TContext = unknown> {
+  id: string;
+  algorithm: 'fixed-window';
+  store: string;
+  subjectKeyring: string;
+  bucket: string;
+  phase?: RateLimitPhase;
+  order?: number;
+  shortCircuitOnDeny?: boolean;
+  onStoreError: RateLimitStoreErrorMode;
+  subject(context: Readonly<TContext>): MaybePromise<RateLimitSubjectMaterial>;
+  limit: DynamicFixedWindowLimit | ((context: Readonly<TContext>) => MaybePromise<DynamicFixedWindowLimit | null>);
+  cost?: number | ((context: Readonly<TContext>) => MaybePromise<number>);
+}
+interface RegisteredRateLimitDecision {
+  ruleId: string;
+  applied: boolean;
+  allowed: boolean;
+  blockedUntilMs: number | null;
+  revision: number;
+}
+interface RateLimitBatchEntry<TContext = unknown> {
+  entryId: string;
+  context: TContext;
+}
+interface RateLimitBatchDecision extends RegisteredRateLimitDecision {
+  entryId: string;
+}
+interface RateLimitRemoteContext {
+  app: any;
+  model: any;
+  methodName: string;
+  args: Readonly<Record<string, unknown>>;
+  request?: any;
+  accessToken?: any;
+  source?: string | null;
+}
+type RemoteRateLimitResolver = (context: RateLimitRemoteContext) => MaybePromise<ResolvedRateLimitRule | ReadonlyArray<ResolvedRateLimitRule> | null | undefined>;
+//#endregion
+export { AggregatedRateLimitDecision, BaseRateLimitPolicy, DynamicFixedWindowLimit, FailureLockoutRateLimitPolicy, FixedWindowRateLimitPolicy, HashedRateLimitSubject, MaybePromise, NormalizedRateLimitPolicy, RateLimitAlgorithmName, RateLimitBatchDecision, RateLimitBatchEntry, RateLimitBucketSubject, RateLimitConsumption, RateLimitDecision, RateLimitDelete, RateLimitInspection, RateLimitPhase, RateLimitRemoteContext, RateLimitReset, RateLimitResetResult, RateLimitRuleDecision, RateLimitStateData, RateLimitStore, RateLimitStoreErrorMode, RateLimitSubjectKeyring, RateLimitSubjectMaterial, RateLimitTransition, RegisteredFixedWindowRule, RegisteredRateLimitDecision, RemoteRateLimitResolver, ResolvedRateLimitRule };

package/dist/lib/registry.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/lib/runtime.d.cts

@@ -0,0 +1,10 @@
+//#region src/lib/runtime.d.ts
+/**
+ * True if running in a server environment; false otherwise.
+ * @header loopback.isServer
+ */
+declare const runtime: {
+  isBrowser: boolean;
+  isServer: boolean;
+};
+export = runtime;

package/dist/lib/server-app.d.cts

@@ -0,0 +1,3 @@
+//#region src/lib/server-app.d.ts
+declare function loopbackExpress(): any;
+export = loopbackExpress;