@zarex/client 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kodjogbe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,51 @@
-# Temporary Holding Version
+# @zarex/client
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Client HTTP bas niveau du SDK Zarex, avec disjoncteur (circuit breaker) intégré pour échouer vite plutôt que de faire attendre vos visiteurs quand Zarex est lent ou injoignable.
+
+> **Vous n'avez normalement pas besoin d'installer ce paquet directement.** Il est utilisé par [`@zarex/core`](https://www.npmjs.com/package/@zarex/core) et, par transitivité, par tous les adaptateurs de framework (`@zarex/express`, `@zarex/fastify`, `@zarex/next`, `@zarex/sveltekit`, `@zarex/bun`). Installez-le directement seulement si vous construisez votre propre intégration, en dehors de `@zarex/core`.
+
+## Qu'est-ce que Zarex ?
+
+Zarex est une plateforme de sécurité applicative : un service qui protège une application web contre les bots, les abus de trafic, les injections et les fuites de données sensibles.
+
+## Utilisation
+
+```ts
+import { createClient, parseDecision } from "@zarex/client";
+
+const client = createClient({ key: process.env.ZAREX_KEY! });
+const response = await client.decide(request);
+const decision = parseDecision(response);
+```
+
+### `ClientOptions`
+
+| Option | Type | Description |
+|---|---|---|
+| `key` | `string` | Clé API du projet. |
+| `timeoutMs` | `number` | Délai maximal avant d'abandonner l'appel (défaut 500 ms). |
+| `breaker` | `BreakerOptions \| false` | Configuration du disjoncteur, ou `false` pour le désactiver. |
+| `baseUrl` | `string` | Inutile en usage normal. À ne définir que pour les tests ou un environnement local. |
+
+### Le disjoncteur (`CircuitBreaker`)
+
+Après un nombre configurable d'échecs consécutifs, le disjoncteur s'ouvre : les appels suivants échouent immédiatement (sans round-trip réseau) pendant une période de pause, puis une requête de sonde est tentée pour voir si le service est de nouveau disponible. Ce comportement évite qu'un ralentissement ne se répercute sur chaque requête de votre application par un délai d'attente répété.
+
+```ts
+import { CircuitBreaker } from "@zarex/client";
+
+const breaker = new CircuitBreaker({ failureThreshold: 5, cooldownMs: 10_000 });
+```
+
+### Erreurs
+
+| Classe | Quand |
+|---|---|
+| `ZarexConfigError` | Configuration invalide (clé manquante, option hors bornes…) — levée à la construction, jamais pendant le traitement d'une requête. |
+| `ZarexClientError` | Erreur réseau ou réponse inattendue lors d'un appel — voir `error.code` (`ClientErrorCode`). |
+
+Dans tous les adaptateurs de haut niveau, ces erreurs sont systématiquement interceptées : elles ne remontent jamais jusqu'à votre application (fail-open — si Zarex est injoignable, lent ou répond de façon inattendue, la requête du visiteur passe toujours).
+
+## Licence
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,336 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  CircuitBreaker: () => CircuitBreaker,
+  SDK_VERSION: () => SDK_VERSION,
+  ZarexClientError: () => ZarexClientError,
+  ZarexConfigError: () => ZarexConfigError,
+  createClient: () => createClient,
+  parseDecision: () => parseDecision,
+  resolveBaseUrl: () => resolveBaseUrl,
+  validateKey: () => validateKey
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/breaker.ts
+var CircuitBreaker = class {
+  state = "closed";
+  failures = 0;
+  openedAt = 0;
+  probing = false;
+  threshold;
+  cooldown;
+  now;
+  constructor(opts = {}) {
+    this.threshold = opts.failureThreshold ?? 5;
+    this.cooldown = opts.cooldownMs ?? 1e4;
+    this.now = opts.now ?? Date.now;
+  }
+  /** true = l'appel est autorisé. Quand le circuit est semi-ouvert, un seul appel à la fois passe. */
+  allow() {
+    if (this.state === "closed") return true;
+    if (this.state === "open") {
+      if (this.now() - this.openedAt < this.cooldown) return false;
+      this.state = "half-open";
+      this.probing = false;
+    }
+    if (this.probing) return false;
+    this.probing = true;
+    return true;
+  }
+  success() {
+    this.failures = 0;
+    this.probing = false;
+    this.state = "closed";
+  }
+  /** À appeler pour une panne d'infrastructure (délai, réseau, 5xx), pas pour une erreur de configuration. */
+  failure() {
+    this.probing = false;
+    if (this.state === "half-open") {
+      this.trip();
+      return;
+    }
+    this.failures++;
+    if (this.failures >= this.threshold) this.trip();
+  }
+  /** Un appel autorisé qui se termine sans verdict sur la santé du moteur (ex. 401) : libère l'essai. */
+  neutral() {
+    this.probing = false;
+    if (this.state === "half-open") this.state = "closed";
+  }
+  trip() {
+    this.state = "open";
+    this.openedAt = this.now();
+  }
+  get isOpen() {
+    return this.state !== "closed";
+  }
+};
+
+// src/errors.ts
+var ZarexClientError = class extends Error {
+  code;
+  status;
+  /** Code d'erreur renvoyé par le moteur (ex. « too_large »), si présent. */
+  engineCode;
+  constructor(code, message, opts = {}) {
+    super(message);
+    this.name = "ZarexClientError";
+    this.code = code;
+    if (opts.status !== void 0) this.status = opts.status;
+    if (opts.engineCode !== void 0) this.engineCode = opts.engineCode;
+  }
+};
+var ZarexConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ZarexConfigError";
+  }
+};
+
+// src/client.ts
+var SDK_VERSION = "0.1.0";
+var MAX_RESPONSE_BYTES = 256 * 1024;
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+var DEFAULT_BASE_URL = "https://engine.zarex.dev";
+function readEnv(name) {
+  try {
+    return typeof process !== "undefined" ? process.env?.[name] : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function validateKey(key) {
+  if (typeof key !== "string" || key.length < 16 || key.length > 256 || !/^[A-Za-z0-9_-]+$/.test(key)) {
+    throw new ZarexConfigError(
+      "Zarex: `key` is missing or malformed (expected the project API key, e.g. from process.env.ZAREX_KEY)."
+    );
+  }
+  return key;
+}
+function resolveBaseUrl(baseUrl, allowInsecureHttp = false) {
+  const raw = baseUrl ?? readEnv("ZAREX_URL") ?? DEFAULT_BASE_URL;
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw new ZarexConfigError("Zarex: `baseUrl` is not a valid URL.");
+  }
+  if (u.protocol !== "https:" && u.protocol !== "http:") {
+    throw new ZarexConfigError("Zarex: `baseUrl` must use https:// (or http:// for localhost).");
+  }
+  if (u.username || u.password) {
+    throw new ZarexConfigError("Zarex: `baseUrl` must not contain credentials.");
+  }
+  if (u.protocol === "http:" && !LOCAL_HOSTS.has(u.hostname) && !allowInsecureHttp) {
+    throw new ZarexConfigError(
+      "Zarex: refusing to send the API key over plain http:// to a remote host. Use https:// (or set allowInsecureHttp: true at your own risk)."
+    );
+  }
+  u.search = "";
+  u.hash = "";
+  return u.toString().replace(/\/+$/, "");
+}
+function createClient(opts) {
+  const key = validateKey(opts.key);
+  const base = resolveBaseUrl(opts.baseUrl, opts.allowInsecureHttp);
+  const timeoutMs = opts.timeoutMs ?? 500;
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 10 || timeoutMs > 3e4) {
+    throw new ZarexConfigError("Zarex: `timeoutMs` must be between 10 and 30000.");
+  }
+  const doFetch = opts.fetch ?? (typeof fetch === "function" ? fetch : void 0);
+  if (!doFetch) {
+    throw new ZarexConfigError("Zarex: no global fetch available; pass `fetch` in the options (Node >= 18 has one).");
+  }
+  const breaker = opts.breaker === false ? null : new CircuitBreaker(opts.breaker ?? {});
+  const url = `${base}/v1/decide`;
+  const version = opts.sdkVersion ?? SDK_VERSION;
+  async function decide(request) {
+    if (breaker && !breaker.allow()) {
+      throw new ZarexClientError("circuit_open", "Zarex engine temporarily skipped after repeated failures");
+    }
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    let outcome = "neutral";
+    try {
+      let res;
+      try {
+        res = await doFetch(url, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            accept: "application/json",
+            authorization: `Bearer ${key}`,
+            "user-agent": `zarex-js/${version}`
+          },
+          body: JSON.stringify(request),
+          signal: ctrl.signal,
+          // Ne JAMAIS suivre une redirection : elle renverrait la clé API ailleurs.
+          // "manual" plutôt que "error" : Cloudflare Workers ne connaît pas "error". La réponse 3xx est refusée plus bas.
+          redirect: "manual"
+        });
+      } catch (err) {
+        outcome = "infra";
+        if (ctrl.signal.aborted) throw new ZarexClientError("timeout", `Zarex engine did not answer within ${timeoutMs} ms`);
+        throw new ZarexClientError("network", `Zarex engine unreachable (${errKind(err)})`);
+      }
+      if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400) {
+        outcome = "infra";
+        void res.body?.cancel().catch(() => void 0);
+        throw new ZarexClientError("network", "Zarex engine unreachable (unexpected redirect)");
+      }
+      const text = await readCapped(res, MAX_RESPONSE_BYTES, ctrl.signal).catch(() => {
+        outcome = "infra";
+        if (ctrl.signal.aborted) throw new ZarexClientError("timeout", `Zarex engine did not answer within ${timeoutMs} ms`);
+        throw new ZarexClientError("bad_response", "Zarex engine response could not be read");
+      });
+      if (res.status !== 200) {
+        const engineCode = extractEngineCode(text);
+        const code = statusToCode(res.status);
+        outcome = code === "server_error" ? "infra" : "neutral";
+        throw new ZarexClientError(code, `Zarex engine answered HTTP ${res.status}${engineCode ? ` (${engineCode})` : ""}`, {
+          status: res.status,
+          ...engineCode ? { engineCode } : {}
+        });
+      }
+      let parsed;
+      try {
+        parsed = parseDecision(text);
+      } catch (err) {
+        outcome = "infra";
+        throw err;
+      }
+      outcome = "ok";
+      return parsed;
+    } finally {
+      clearTimeout(timer);
+      if (breaker) {
+        if (outcome === "ok") breaker.success();
+        else if (outcome === "infra") breaker.failure();
+        else breaker.neutral();
+      }
+    }
+  }
+  return { decide };
+}
+function errKind(err) {
+  const msg = err instanceof Error ? `${err.name} ${err.message} ${err.cause?.code ?? ""}` : "";
+  if (/redirect/i.test(msg)) return "unexpected redirect";
+  if (/ECONNREFUSED|refused/i.test(msg)) return "connection refused";
+  if (/ENOTFOUND|EAI_AGAIN|getaddrinfo/i.test(msg)) return "DNS lookup failed";
+  if (/certificate|TLS|SSL|CERT/i.test(msg)) return "TLS error";
+  return "network error";
+}
+function statusToCode(status) {
+  if (status === 401) return "unauthorized";
+  if (status === 403) return "forbidden";
+  if (status === 429) return "quota_exceeded";
+  if (status >= 500) return "server_error";
+  return "invalid_request";
+}
+function extractEngineCode(text) {
+  try {
+    const code = JSON.parse(text)?.error?.code;
+    return typeof code === "string" && /^[a-z_]{1,40}$/.test(code) ? code : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readCapped(res, max, signal) {
+  const declared = Number(res.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > max) throw new Error("too large");
+  if (!res.body) return await res.text();
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    if (signal.aborted) {
+      await reader.cancel().catch(() => void 0);
+      throw new Error("aborted");
+    }
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > max) {
+      await reader.cancel().catch(() => void 0);
+      throw new Error("too large");
+    }
+    chunks.push(value);
+  }
+  const all = new Uint8Array(total);
+  let off = 0;
+  for (const c of chunks) {
+    all.set(c, off);
+    off += c.byteLength;
+  }
+  return new TextDecoder().decode(all);
+}
+var VERDICTS = /* @__PURE__ */ new Set(["ALLOW", "DENY", "ERROR"]);
+function parseDecision(text) {
+  let v;
+  try {
+    v = JSON.parse(text);
+  } catch {
+    throw new ZarexClientError("bad_response", "Zarex engine returned invalid JSON");
+  }
+  const o = v;
+  if (!o || typeof o !== "object" || typeof o.verdict !== "string" || !VERDICTS.has(o.verdict) || !Array.isArray(o.results)) {
+    throw new ZarexClientError("bad_response", "Zarex engine returned an unexpected response");
+  }
+  const results = [];
+  for (const r of o.results) {
+    const x = r;
+    if (!x || typeof x !== "object" || typeof x.rule_type !== "string" || typeof x.verdict !== "string" || !VERDICTS.has(x.verdict)) {
+      throw new ZarexClientError("bad_response", "Zarex engine returned an unexpected rule result");
+    }
+    results.push({
+      rule_type: x.rule_type,
+      verdict: x.verdict,
+      is_dry_run: x.is_dry_run === true,
+      ...x.reason && typeof x.reason === "object" ? { reason: x.reason } : {}
+    });
+  }
+  const warnings = Array.isArray(o.warnings) ? o.warnings.filter((w) => typeof w === "string" && /^[a-z_]{1,40}$/.test(w)).slice(0, 10) : void 0;
+  const rawIp = o.ip;
+  const ipInfo = rawIp && typeof rawIp === "object" && typeof rawIp.country === "string" && /^[A-Z]{2}$/.test(rawIp.country) && typeof rawIp.asn === "string" && /^AS\d{1,10}$/.test(rawIp.asn) ? { country: rawIp.country, asn: rawIp.asn } : void 0;
+  return {
+    decision_id: typeof o.decision_id === "string" ? o.decision_id.slice(0, 64) : "",
+    verdict: o.verdict,
+    results,
+    ...typeof o.ttl_ms === "number" ? { ttl_ms: o.ttl_ms } : {},
+    ...warnings && warnings.length ? { warnings } : {},
+    ...ipInfo ? { ip: ipInfo } : {},
+    ...typeof o.ruleset_version === "string" && /^[A-Za-z0-9._+-]{1,64}$/.test(o.ruleset_version) ? { ruleset_version: o.ruleset_version } : {}
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CircuitBreaker,
+  SDK_VERSION,
+  ZarexClientError,
+  ZarexConfigError,
+  createClient,
+  parseDecision,
+  resolveBaseUrl,
+  validateKey
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/breaker.ts","../src/errors.ts","../src/client.ts"],"sourcesContent":["export { createClient, resolveBaseUrl, validateKey, parseDecision, SDK_VERSION } from \"./client.js\";\r\nexport type { ClientOptions, ZarexClient } from \"./client.js\";\r\nexport { CircuitBreaker } from \"./breaker.js\";\r\nexport type { BreakerOptions } from \"./breaker.js\";\r\nexport { ZarexClientError, ZarexConfigError } from \"./errors.js\";\r\nexport type { ClientErrorCode } from \"./errors.js\";\r\nexport type * from \"./types.js\";","/**\r\n * Disjoncteur côté SDK.\r\n *\r\n * Pourquoi : si le moteur est en panne ou très lent, CHAQUE requête du client\r\n * attendrait le délai maximal (ex. 500 ms) avant de laisser passer. Le site du\r\n * client serait ralenti par NOTRE panne. Après quelques échecs d'affilée, on\r\n * cesse d'appeler le moteur pendant un moment (« circuit ouvert ») : les\r\n * requêtes passent immédiatement. Puis UNE requête d'essai vérifie s'il est revenu.\r\n */\r\nexport interface BreakerOptions {\r\n  /** Échecs consécutifs avant ouverture. Défaut 5. */\r\n  failureThreshold?: number;\r\n  /** Durée pendant laquelle on n'appelle plus le moteur. Défaut 10 000 ms. */\r\n  cooldownMs?: number;\r\n  /** Horloge (tests). */\r\n  now?: () => number;\r\n}\r\n\r\ntype State = \"closed\" | \"open\" | \"half-open\";\r\n\r\nexport class CircuitBreaker {\r\n  private state: State = \"closed\";\r\n  private failures = 0;\r\n  private openedAt = 0;\r\n  private probing = false;\r\n  private readonly threshold: number;\r\n  private readonly cooldown: number;\r\n  private readonly now: () => number;\r\n\r\n  constructor(opts: BreakerOptions = {}) {\r\n    this.threshold = opts.failureThreshold ?? 5;\r\n    this.cooldown = opts.cooldownMs ?? 10_000;\r\n    this.now = opts.now ?? Date.now;\r\n  }\r\n\r\n  /** true = l'appel est autorisé. Quand le circuit est semi-ouvert, un seul appel à la fois passe. */\r\n  allow(): boolean {\r\n    if (this.state === \"closed\") return true;\r\n    if (this.state === \"open\") {\r\n      if (this.now() - this.openedAt < this.cooldown) return false;\r\n      this.state = \"half-open\";\r\n      this.probing = false;\r\n    }\r\n    // half-open : un seul essai en vol\r\n    if (this.probing) return false;\r\n    this.probing = true;\r\n    return true;\r\n  }\r\n\r\n  success(): void {\r\n    this.failures = 0;\r\n    this.probing = false;\r\n    this.state = \"closed\";\r\n  }\r\n\r\n  /** À appeler pour une panne d'infrastructure (délai, réseau, 5xx), pas pour une erreur de configuration. */\r\n  failure(): void {\r\n    this.probing = false;\r\n    if (this.state === \"half-open\") {\r\n      this.trip();\r\n      return;\r\n    }\r\n    this.failures++;\r\n    if (this.failures >= this.threshold) this.trip();\r\n  }\r\n \r\n  /** Un appel autorisé qui se termine sans verdict sur la santé du moteur (ex. 401) : libère l'essai. */\r\n  neutral(): void {\r\n    this.probing = false;\r\n    if (this.state === \"half-open\") this.state = \"closed\";\r\n  }\r\n \r\n  private trip(): void {\r\n    this.state = \"open\";\r\n    this.openedAt = this.now();\r\n  }\r\n \r\n  get isOpen(): boolean {\r\n    return this.state !== \"closed\";\r\n  }\r\n}","/**\r\n * Codes d'erreur du client. Le SDK ne lève JAMAIS ces erreurs jusqu'à\r\n * l'application du client : `protect()` les attrape et laisse passer la requête\r\n * (fail-open). Elles servent aux journaux et à `decision.error`.\r\n */\r\nexport type ClientErrorCode =\r\n  | \"timeout\" // le moteur n'a pas répondu à temps\r\n  | \"network\" // connexion impossible / coupée\r\n  | \"circuit_open\" // trop d'échecs récents : appel évité pour protéger l'application\r\n  | \"unauthorized\" // 401 : clé API absente, invalide ou révoquée\r\n  | \"forbidden\" // 403\r\n  | \"quota_exceeded\" // 429 : quota mensuel du plan atteint\r\n  | \"invalid_request\" // 400/413/415 : bug du SDK ou règle invalide\r\n  | \"server_error\" // 5xx\r\n  | \"bad_response\"; // réponse 200 mais illisible / inattendue\r\n \r\nexport class ZarexClientError extends Error {\r\n  readonly code: ClientErrorCode;\r\n  readonly status?: number;\r\n  /** Code d'erreur renvoyé par le moteur (ex. « too_large »), si présent. */\r\n  readonly engineCode?: string;\r\n \r\n  constructor(code: ClientErrorCode, message: string, opts: { status?: number; engineCode?: string } = {}) {\r\n    super(message);\r\n    this.name = \"ZarexClientError\";\r\n    this.code = code;\r\n    if (opts.status !== undefined) this.status = opts.status;\r\n    if (opts.engineCode !== undefined) this.engineCode = opts.engineCode;\r\n  }\r\n}\r\n \r\n/** Erreur de configuration : levée immédiatement à la création, jamais pendant une requête. */\r\nexport class ZarexConfigError extends Error {\r\n  constructor(message: string) {\r\n    super(message);\r\n    this.name = \"ZarexConfigError\";\r\n  }\r\n}","import { CircuitBreaker, type BreakerOptions } from \"./breaker.js\";\r\nimport { ZarexClientError, ZarexConfigError } from \"./errors.js\";\r\nimport type { DecideRequest, DecideResponse, Verdict } from \"./types.js\";\r\n\r\nexport interface ClientOptions {\r\n  /** Clé API du projet (zarex_live_… / zarex_test_…). Jamais journalisée. */\r\n  key: string;\r\n  /** Adresse du service Zarex. Inutile en usage normal (défaut : le service de production) — à ne définir que pour les tests ou un environnement local. Variable ZAREX_URL acceptée aussi. */\r\n  baseUrl?: string;\r\n  /** Délai maximal d'un appel, en ms. Défaut 500. */\r\n  timeoutMs?: number;\r\n  /** Autoriser http:// vers un hôte distant (déconseillé : la clé circulerait en clair). */\r\n  allowInsecureHttp?: boolean;\r\n  /** Disjoncteur. `false` pour le désactiver. */\r\n  breaker?: BreakerOptions | false;\r\n  /** Implémentation de fetch (tests, runtimes particuliers). */\r\n  fetch?: typeof fetch;\r\n  /** Version annoncée au moteur. */\r\n  sdkVersion?: string;\r\n}\r\n\r\nexport interface ZarexClient {\r\n  decide(request: DecideRequest): Promise<DecideResponse>;\r\n}\r\n\r\nexport const SDK_VERSION = \"0.1.0\";\r\nconst MAX_RESPONSE_BYTES = 256 * 1024;\r\nconst LOCAL_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\", \"::1\"]);\r\n/**\r\n * Adresse du service Zarex en production — un seul service partagé par tous\r\n * les clients, différenciés par leur clé API (comme Stripe/Twilio : jamais\r\n * besoin de configurer où se trouve l'API). `baseUrl`/`ZAREX_URL` restent\r\n * disponibles pour la remplacer (tests, environnement local), mais plus\r\n * personne n'a besoin de le faire pour un usage normal.\r\n */\r\nexport const DEFAULT_BASE_URL = \"https://engine.zarex.dev\";\r\n\r\nfunction readEnv(name: string): string | undefined {\r\n  try {\r\n    return typeof process !== \"undefined\" ? process.env?.[name] : undefined;\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\n/** Valide la clé sans jamais la recopier dans un message d'erreur. */\r\nexport function validateKey(key: unknown): string {\r\n  if (typeof key !== \"string\" || key.length < 16 || key.length > 256 || !/^[A-Za-z0-9_-]+$/.test(key)) {\r\n    throw new ZarexConfigError(\r\n      \"Zarex: `key` is missing or malformed (expected the project API key, e.g. from process.env.ZAREX_KEY).\"\r\n    );\r\n  }\r\n  return key;\r\n}\r\n\r\nexport function resolveBaseUrl(baseUrl: string | undefined, allowInsecureHttp = false): string {\r\n  const raw = baseUrl ?? readEnv(\"ZAREX_URL\") ?? DEFAULT_BASE_URL;\r\n  let u: URL;\r\n  try {\r\n    u = new URL(raw);\r\n  } catch {\r\n    throw new ZarexConfigError(\"Zarex: `baseUrl` is not a valid URL.\");\r\n  }\r\n  if (u.protocol !== \"https:\" && u.protocol !== \"http:\") {\r\n    throw new ZarexConfigError(\"Zarex: `baseUrl` must use https:// (or http:// for localhost).\");\r\n  }\r\n  if (u.username || u.password) {\r\n    throw new ZarexConfigError(\"Zarex: `baseUrl` must not contain credentials.\");\r\n  }\r\n  if (u.protocol === \"http:\" && !LOCAL_HOSTS.has(u.hostname) && !allowInsecureHttp) {\r\n    throw new ZarexConfigError(\r\n      \"Zarex: refusing to send the API key over plain http:// to a remote host. Use https:// (or set allowInsecureHttp: true at your own risk).\"\r\n    );\r\n  }\r\n  u.search = \"\";\r\n  u.hash = \"\";\r\n  return u.toString().replace(/\\/+$/, \"\");\r\n}\r\n\r\nexport function createClient(opts: ClientOptions): ZarexClient {\r\n  const key = validateKey(opts.key);\r\n  const base = resolveBaseUrl(opts.baseUrl, opts.allowInsecureHttp);\r\n  const timeoutMs = opts.timeoutMs ?? 500;\r\n  if (!Number.isFinite(timeoutMs) || timeoutMs < 10 || timeoutMs > 30_000) {\r\n    throw new ZarexConfigError(\"Zarex: `timeoutMs` must be between 10 and 30000.\");\r\n  }\r\n  const doFetch = opts.fetch ?? (typeof fetch === \"function\" ? fetch : undefined);\r\n  if (!doFetch) {\r\n    throw new ZarexConfigError(\"Zarex: no global fetch available; pass `fetch` in the options (Node >= 18 has one).\");\r\n  }\r\n  const breaker = opts.breaker === false ? null : new CircuitBreaker(opts.breaker ?? {});\r\n  const url = `${base}/v1/decide`;\r\n  const version = opts.sdkVersion ?? SDK_VERSION;\r\n\r\n  async function decide(request: DecideRequest): Promise<DecideResponse> {\r\n    if (breaker && !breaker.allow()) {\r\n      throw new ZarexClientError(\"circuit_open\", \"Zarex engine temporarily skipped after repeated failures\");\r\n    }\r\n\r\n    const ctrl = new AbortController();\r\n    const timer = setTimeout(() => ctrl.abort(), timeoutMs);\r\n    let outcome: \"ok\" | \"infra\" | \"neutral\" = \"neutral\";\r\n    try {\r\n      let res: Response;\r\n      try {\r\n        res = await doFetch!(url, {\r\n          method: \"POST\",\r\n          headers: {\r\n            \"content-type\": \"application/json\",\r\n            accept: \"application/json\",\r\n            authorization: `Bearer ${key}`,\r\n            \"user-agent\": `zarex-js/${version}`,\r\n          },\r\n          body: JSON.stringify(request),\r\n          signal: ctrl.signal,\r\n          // Ne JAMAIS suivre une redirection : elle renverrait la clé API ailleurs.\r\n          // \"manual\" plutôt que \"error\" : Cloudflare Workers ne connaît pas \"error\". La réponse 3xx est refusée plus bas.\r\n          redirect: \"manual\",\r\n        });\r\n      } catch (err) {\r\n        outcome = \"infra\";\r\n        if (ctrl.signal.aborted) throw new ZarexClientError(\"timeout\", `Zarex engine did not answer within ${timeoutMs} ms`);\r\n        // Le message natif peut contenir l'URL : on n'en garde que la nature.\r\n        throw new ZarexClientError(\"network\", `Zarex engine unreachable (${errKind(err)})`);\r\n      }\r\n\r\n      if (res.type === \"opaqueredirect\" || (res.status >= 300 && res.status < 400)) {\r\n        outcome = \"infra\";\r\n        void res.body?.cancel().catch(() => undefined);\r\n        throw new ZarexClientError(\"network\", \"Zarex engine unreachable (unexpected redirect)\");\r\n      }\r\n\r\n      const text = await readCapped(res, MAX_RESPONSE_BYTES, ctrl.signal).catch(() => {\r\n        outcome = \"infra\";\r\n        if (ctrl.signal.aborted) throw new ZarexClientError(\"timeout\", `Zarex engine did not answer within ${timeoutMs} ms`);\r\n        throw new ZarexClientError(\"bad_response\", \"Zarex engine response could not be read\");\r\n      });\r\n\r\n      if (res.status !== 200) {\r\n        const engineCode = extractEngineCode(text);\r\n        const code = statusToCode(res.status);\r\n        outcome = code === \"server_error\" ? \"infra\" : \"neutral\";\r\n        throw new ZarexClientError(code, `Zarex engine answered HTTP ${res.status}${engineCode ? ` (${engineCode})` : \"\"}`, {\r\n          status: res.status,\r\n          ...(engineCode ? { engineCode } : {}),\r\n        });\r\n      }\r\n\r\n      // Un 200 avec un corps JSON illisible/inattendu est la MÊME défaillance (« bad_response ») que celle\r\n      // de readCapped juste au-dessus, et doit compter de la même façon pour le disjoncteur (« infra ») —\r\n      // sans ce catch, `outcome` restait à \"neutral\" (sa valeur par défaut, jamais réécrite si parseDecision\r\n      // lève), donc un moteur qui renvoie du JSON corrompu en 200 n'ouvrait jamais le disjoncteur (trouvé\r\n      // lors de l'audit du 04/11/2026, voir AUDIT_SECURITE_COMPLET.md).\r\n      let parsed: DecideResponse;\r\n      try {\r\n        parsed = parseDecision(text);\r\n      } catch (err) {\r\n        outcome = \"infra\";\r\n        throw err;\r\n      }\r\n      outcome = \"ok\";\r\n      return parsed;\r\n    } finally {\r\n      clearTimeout(timer);\r\n      if (breaker) {\r\n        if (outcome === \"ok\") breaker.success();\r\n        else if (outcome === \"infra\") breaker.failure();\r\n        else breaker.neutral();\r\n      }\r\n    }\r\n  }\r\n\r\n  return { decide };\r\n}\r\n\r\nfunction errKind(err: unknown): string {\r\n  const msg = err instanceof Error ? `${err.name} ${err.message} ${(err as { cause?: { code?: string } }).cause?.code ?? \"\"}` : \"\";\r\n  if (/redirect/i.test(msg)) return \"unexpected redirect\";\r\n  if (/ECONNREFUSED|refused/i.test(msg)) return \"connection refused\";\r\n  if (/ENOTFOUND|EAI_AGAIN|getaddrinfo/i.test(msg)) return \"DNS lookup failed\";\r\n  if (/certificate|TLS|SSL|CERT/i.test(msg)) return \"TLS error\";\r\n  return \"network error\";\r\n}\r\n\r\nfunction statusToCode(status: number): ZarexClientError[\"code\"] {\r\n  if (status === 401) return \"unauthorized\";\r\n  if (status === 403) return \"forbidden\";\r\n  if (status === 429) return \"quota_exceeded\";\r\n  if (status >= 500) return \"server_error\";\r\n  return \"invalid_request\";\r\n}\r\n\r\nfunction extractEngineCode(text: string): string | undefined {\r\n  try {\r\n    const code = (JSON.parse(text) as { error?: { code?: unknown } })?.error?.code;\r\n    return typeof code === \"string\" && /^[a-z_]{1,40}$/.test(code) ? code : undefined;\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\n/** Lit au plus `max` octets : une réponse démesurée ne doit pas saturer la mémoire du client. */\r\nasync function readCapped(res: Response, max: number, signal: AbortSignal): Promise<string> {\r\n  const declared = Number(res.headers.get(\"content-length\"));\r\n  if (Number.isFinite(declared) && declared > max) throw new Error(\"too large\");\r\n  if (!res.body) return await res.text();\r\n  const reader = res.body.getReader();\r\n  const chunks: Uint8Array[] = [];\r\n  let total = 0;\r\n  for (;;) {\r\n    if (signal.aborted) {\r\n      await reader.cancel().catch(() => undefined);\r\n      throw new Error(\"aborted\");\r\n    }\r\n    const { done, value } = await reader.read();\r\n    if (done) break;\r\n    total += value.byteLength;\r\n    if (total > max) {\r\n      await reader.cancel().catch(() => undefined);\r\n      throw new Error(\"too large\");\r\n    }\r\n    chunks.push(value);\r\n  }\r\n  const all = new Uint8Array(total);\r\n  let off = 0;\r\n  for (const c of chunks) {\r\n    all.set(c, off);\r\n    off += c.byteLength;\r\n  }\r\n  return new TextDecoder().decode(all);\r\n}\r\n\r\nconst VERDICTS: ReadonlySet<string> = new Set<Verdict>([\"ALLOW\", \"DENY\", \"ERROR\"]);\r\n\r\n/** Validation stricte de la réponse : ce qu'on ne comprend pas n'est jamais interprété comme un verdict. */\r\nexport function parseDecision(text: string): DecideResponse {\r\n  let v: unknown;\r\n  try {\r\n    v = JSON.parse(text);\r\n  } catch {\r\n    throw new ZarexClientError(\"bad_response\", \"Zarex engine returned invalid JSON\");\r\n  }\r\n  const o = v as Record<string, unknown> | null;\r\n  if (!o || typeof o !== \"object\" || typeof o.verdict !== \"string\" || !VERDICTS.has(o.verdict) || !Array.isArray(o.results)) {\r\n    throw new ZarexClientError(\"bad_response\", \"Zarex engine returned an unexpected response\");\r\n  }\r\n  const results = [];\r\n  for (const r of o.results as unknown[]) {\r\n    const x = r as Record<string, unknown> | null;\r\n    if (!x || typeof x !== \"object\" || typeof x.rule_type !== \"string\" || typeof x.verdict !== \"string\" || !VERDICTS.has(x.verdict)) {\r\n      throw new ZarexClientError(\"bad_response\", \"Zarex engine returned an unexpected rule result\");\r\n    }\r\n    results.push({\r\n      rule_type: x.rule_type,\r\n      verdict: x.verdict as Verdict,\r\n      is_dry_run: x.is_dry_run === true,\r\n      ...(x.reason && typeof x.reason === \"object\" ? { reason: x.reason as Record<string, unknown> } : {}),\r\n    });\r\n  }\r\n  const warnings = Array.isArray(o.warnings)\r\n    ? (o.warnings as unknown[]).filter((w): w is string => typeof w === \"string\" && /^[a-z_]{1,40}$/.test(w)).slice(0, 10)\r\n    : undefined;\r\n  const rawIp = o.ip as Record<string, unknown> | null | undefined;\r\n  const ipInfo =\r\n    rawIp && typeof rawIp === \"object\" && typeof rawIp.country === \"string\" && /^[A-Z]{2}$/.test(rawIp.country) && typeof rawIp.asn === \"string\" && /^AS\\d{1,10}$/.test(rawIp.asn)\r\n      ? { country: rawIp.country, asn: rawIp.asn }\r\n      : undefined;\r\n  return {\r\n    decision_id: typeof o.decision_id === \"string\" ? o.decision_id.slice(0, 64) : \"\",\r\n    verdict: o.verdict as Verdict,\r\n    results,\r\n    ...(typeof o.ttl_ms === \"number\" ? { ttl_ms: o.ttl_ms } : {}),\r\n    ...(warnings && warnings.length ? { warnings } : {}),\r\n    ...(ipInfo ? { ip: ipInfo } : {}),\r\n    ...(typeof o.ruleset_version === \"string\" && /^[A-Za-z0-9._+-]{1,64}$/.test(o.ruleset_version) ? { ruleset_version: o.ruleset_version } : {}),\r\n  };\r\n}"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACoBO,IAAM,iBAAN,MAAqB;AAAA,EAClB,QAAe;AAAA,EACf,WAAW;AAAA,EACX,WAAW;AAAA,EACX,UAAU;AAAA,EACD;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,OAAuB,CAAC,GAAG;AACrC,SAAK,YAAY,KAAK,oBAAoB;AAC1C,SAAK,WAAW,KAAK,cAAc;AACnC,SAAK,MAAM,KAAK,OAAO,KAAK;AAAA,EAC9B;AAAA;AAAA,EAGA,QAAiB;AACf,QAAI,KAAK,UAAU,SAAU,QAAO;AACpC,QAAI,KAAK,UAAU,QAAQ;AACzB,UAAI,KAAK,IAAI,IAAI,KAAK,WAAW,KAAK,SAAU,QAAO;AACvD,WAAK,QAAQ;AACb,WAAK,UAAU;AAAA,IACjB;AAEA,QAAI,KAAK,QAAS,QAAO;AACzB,SAAK,UAAU;AACf,WAAO;AAAA,EACT;AAAA,EAEA,UAAgB;AACd,SAAK,WAAW;AAChB,SAAK,UAAU;AACf,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA,EAGA,UAAgB;AACd,SAAK,UAAU;AACf,QAAI,KAAK,UAAU,aAAa;AAC9B,WAAK,KAAK;AACV;AAAA,IACF;AACA,SAAK;AACL,QAAI,KAAK,YAAY,KAAK,UAAW,MAAK,KAAK;AAAA,EACjD;AAAA;AAAA,EAGA,UAAgB;AACd,SAAK,UAAU;AACf,QAAI,KAAK,UAAU,YAAa,MAAK,QAAQ;AAAA,EAC/C;AAAA,EAEQ,OAAa;AACnB,SAAK,QAAQ;AACb,SAAK,WAAW,KAAK,IAAI;AAAA,EAC3B;AAAA,EAEA,IAAI,SAAkB;AACpB,WAAO,KAAK,UAAU;AAAA,EACxB;AACF;;;AChEO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACjC;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,MAAuB,SAAiB,OAAiD,CAAC,GAAG;AACvG,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,QAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAClD,QAAI,KAAK,eAAe,OAAW,MAAK,aAAa,KAAK;AAAA,EAC5D;AACF;AAGO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACZO,IAAM,cAAc;AAC3B,IAAM,qBAAqB,MAAM;AACjC,IAAM,cAAc,oBAAI,IAAI,CAAC,aAAa,aAAa,SAAS,KAAK,CAAC;AAQ/D,IAAM,mBAAmB;AAEhC,SAAS,QAAQ,MAAkC;AACjD,MAAI;AACF,WAAO,OAAO,YAAY,cAAc,QAAQ,MAAM,IAAI,IAAI;AAAA,EAChE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,YAAY,KAAsB;AAChD,MAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,OAAO,CAAC,mBAAmB,KAAK,GAAG,GAAG;AACnG,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,eAAe,SAA6B,oBAAoB,OAAe;AAC7F,QAAM,MAAM,WAAW,QAAQ,WAAW,KAAK;AAC/C,MAAI;AACJ,MAAI;AACF,QAAI,IAAI,IAAI,GAAG;AAAA,EACjB,QAAQ;AACN,UAAM,IAAI,iBAAiB,sCAAsC;AAAA,EACnE;AACA,MAAI,EAAE,aAAa,YAAY,EAAE,aAAa,SAAS;AACrD,UAAM,IAAI,iBAAiB,gEAAgE;AAAA,EAC7F;AACA,MAAI,EAAE,YAAY,EAAE,UAAU;AAC5B,UAAM,IAAI,iBAAiB,gDAAgD;AAAA,EAC7E;AACA,MAAI,EAAE,aAAa,WAAW,CAAC,YAAY,IAAI,EAAE,QAAQ,KAAK,CAAC,mBAAmB;AAChF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,IAAE,SAAS;AACX,IAAE,OAAO;AACT,SAAO,EAAE,SAAS,EAAE,QAAQ,QAAQ,EAAE;AACxC;AAEO,SAAS,aAAa,MAAkC;AAC7D,QAAM,MAAM,YAAY,KAAK,GAAG;AAChC,QAAM,OAAO,eAAe,KAAK,SAAS,KAAK,iBAAiB;AAChE,QAAM,YAAY,KAAK,aAAa;AACpC,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,YAAY,MAAM,YAAY,KAAQ;AACvE,UAAM,IAAI,iBAAiB,kDAAkD;AAAA,EAC/E;AACA,QAAM,UAAU,KAAK,UAAU,OAAO,UAAU,aAAa,QAAQ;AACrE,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,iBAAiB,qFAAqF;AAAA,EAClH;AACA,QAAM,UAAU,KAAK,YAAY,QAAQ,OAAO,IAAI,eAAe,KAAK,WAAW,CAAC,CAAC;AACrF,QAAM,MAAM,GAAG,IAAI;AACnB,QAAM,UAAU,KAAK,cAAc;AAEnC,iBAAe,OAAO,SAAiD;AACrE,QAAI,WAAW,CAAC,QAAQ,MAAM,GAAG;AAC/B,YAAM,IAAI,iBAAiB,gBAAgB,0DAA0D;AAAA,IACvG;AAEA,UAAM,OAAO,IAAI,gBAAgB;AACjC,UAAM,QAAQ,WAAW,MAAM,KAAK,MAAM,GAAG,SAAS;AACtD,QAAI,UAAsC;AAC1C,QAAI;AACF,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,QAAS,KAAK;AAAA,UACxB,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,QAAQ;AAAA,YACR,eAAe,UAAU,GAAG;AAAA,YAC5B,cAAc,YAAY,OAAO;AAAA,UACnC;AAAA,UACA,MAAM,KAAK,UAAU,OAAO;AAAA,UAC5B,QAAQ,KAAK;AAAA;AAAA;AAAA,UAGb,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,kBAAU;AACV,YAAI,KAAK,OAAO,QAAS,OAAM,IAAI,iBAAiB,WAAW,sCAAsC,SAAS,KAAK;AAEnH,cAAM,IAAI,iBAAiB,WAAW,6BAA6B,QAAQ,GAAG,CAAC,GAAG;AAAA,MACpF;AAEA,UAAI,IAAI,SAAS,oBAAqB,IAAI,UAAU,OAAO,IAAI,SAAS,KAAM;AAC5E,kBAAU;AACV,aAAK,IAAI,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAC7C,cAAM,IAAI,iBAAiB,WAAW,gDAAgD;AAAA,MACxF;AAEA,YAAM,OAAO,MAAM,WAAW,KAAK,oBAAoB,KAAK,MAAM,EAAE,MAAM,MAAM;AAC9E,kBAAU;AACV,YAAI,KAAK,OAAO,QAAS,OAAM,IAAI,iBAAiB,WAAW,sCAAsC,SAAS,KAAK;AACnH,cAAM,IAAI,iBAAiB,gBAAgB,yCAAyC;AAAA,MACtF,CAAC;AAED,UAAI,IAAI,WAAW,KAAK;AACtB,cAAM,aAAa,kBAAkB,IAAI;AACzC,cAAM,OAAO,aAAa,IAAI,MAAM;AACpC,kBAAU,SAAS,iBAAiB,UAAU;AAC9C,cAAM,IAAI,iBAAiB,MAAM,8BAA8B,IAAI,MAAM,GAAG,aAAa,KAAK,UAAU,MAAM,EAAE,IAAI;AAAA,UAClH,QAAQ,IAAI;AAAA,UACZ,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACrC,CAAC;AAAA,MACH;AAOA,UAAI;AACJ,UAAI;AACF,iBAAS,cAAc,IAAI;AAAA,MAC7B,SAAS,KAAK;AACZ,kBAAU;AACV,cAAM;AAAA,MACR;AACA,gBAAU;AACV,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAClB,UAAI,SAAS;AACX,YAAI,YAAY,KAAM,SAAQ,QAAQ;AAAA,iBAC7B,YAAY,QAAS,SAAQ,QAAQ;AAAA,YACzC,SAAQ,QAAQ;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO;AAClB;AAEA,SAAS,QAAQ,KAAsB;AACrC,QAAM,MAAM,eAAe,QAAQ,GAAG,IAAI,IAAI,IAAI,IAAI,OAAO,IAAK,IAAsC,OAAO,QAAQ,EAAE,KAAK;AAC9H,MAAI,YAAY,KAAK,GAAG,EAAG,QAAO;AAClC,MAAI,wBAAwB,KAAK,GAAG,EAAG,QAAO;AAC9C,MAAI,mCAAmC,KAAK,GAAG,EAAG,QAAO;AACzD,MAAI,4BAA4B,KAAK,GAAG,EAAG,QAAO;AAClD,SAAO;AACT;AAEA,SAAS,aAAa,QAA0C;AAC9D,MAAI,WAAW,IAAK,QAAO;AAC3B,MAAI,WAAW,IAAK,QAAO;AAC3B,MAAI,WAAW,IAAK,QAAO;AAC3B,MAAI,UAAU,IAAK,QAAO;AAC1B,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAkC;AAC3D,MAAI;AACF,UAAM,OAAQ,KAAK,MAAM,IAAI,GAAsC,OAAO;AAC1E,WAAO,OAAO,SAAS,YAAY,iBAAiB,KAAK,IAAI,IAAI,OAAO;AAAA,EAC1E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAe,WAAW,KAAe,KAAa,QAAsC;AAC1F,QAAM,WAAW,OAAO,IAAI,QAAQ,IAAI,gBAAgB,CAAC;AACzD,MAAI,OAAO,SAAS,QAAQ,KAAK,WAAW,IAAK,OAAM,IAAI,MAAM,WAAW;AAC5E,MAAI,CAAC,IAAI,KAAM,QAAO,MAAM,IAAI,KAAK;AACrC,QAAM,SAAS,IAAI,KAAK,UAAU;AAClC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,aAAS;AACP,QAAI,OAAO,SAAS;AAClB,YAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,YAAM,IAAI,MAAM,SAAS;AAAA,IAC3B;AACA,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,aAAS,MAAM;AACf,QAAI,QAAQ,KAAK;AACf,YAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,YAAM,IAAI,MAAM,WAAW;AAAA,IAC7B;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,MAAM;AACV,aAAW,KAAK,QAAQ;AACtB,QAAI,IAAI,GAAG,GAAG;AACd,WAAO,EAAE;AAAA,EACX;AACA,SAAO,IAAI,YAAY,EAAE,OAAO,GAAG;AACrC;AAEA,IAAM,WAAgC,oBAAI,IAAa,CAAC,SAAS,QAAQ,OAAO,CAAC;AAG1E,SAAS,cAAc,MAA8B;AAC1D,MAAI;AACJ,MAAI;AACF,QAAI,KAAK,MAAM,IAAI;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI,iBAAiB,gBAAgB,oCAAoC;AAAA,EACjF;AACA,QAAM,IAAI;AACV,MAAI,CAAC,KAAK,OAAO,MAAM,YAAY,OAAO,EAAE,YAAY,YAAY,CAAC,SAAS,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,QAAQ,EAAE,OAAO,GAAG;AACzH,UAAM,IAAI,iBAAiB,gBAAgB,8CAA8C;AAAA,EAC3F;AACA,QAAM,UAAU,CAAC;AACjB,aAAW,KAAK,EAAE,SAAsB;AACtC,UAAM,IAAI;AACV,QAAI,CAAC,KAAK,OAAO,MAAM,YAAY,OAAO,EAAE,cAAc,YAAY,OAAO,EAAE,YAAY,YAAY,CAAC,SAAS,IAAI,EAAE,OAAO,GAAG;AAC/H,YAAM,IAAI,iBAAiB,gBAAgB,iDAAiD;AAAA,IAC9F;AACA,YAAQ,KAAK;AAAA,MACX,WAAW,EAAE;AAAA,MACb,SAAS,EAAE;AAAA,MACX,YAAY,EAAE,eAAe;AAAA,MAC7B,GAAI,EAAE,UAAU,OAAO,EAAE,WAAW,WAAW,EAAE,QAAQ,EAAE,OAAkC,IAAI,CAAC;AAAA,IACpG,CAAC;AAAA,EACH;AACA,QAAM,WAAW,MAAM,QAAQ,EAAE,QAAQ,IACpC,EAAE,SAAuB,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,iBAAiB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,EAAE,IACnH;AACJ,QAAM,QAAQ,EAAE;AAChB,QAAM,SACJ,SAAS,OAAO,UAAU,YAAY,OAAO,MAAM,YAAY,YAAY,aAAa,KAAK,MAAM,OAAO,KAAK,OAAO,MAAM,QAAQ,YAAY,eAAe,KAAK,MAAM,GAAG,IACzK,EAAE,SAAS,MAAM,SAAS,KAAK,MAAM,IAAI,IACzC;AACN,SAAO;AAAA,IACL,aAAa,OAAO,EAAE,gBAAgB,WAAW,EAAE,YAAY,MAAM,GAAG,EAAE,IAAI;AAAA,IAC9E,SAAS,EAAE;AAAA,IACX;AAAA,IACA,GAAI,OAAO,EAAE,WAAW,WAAW,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3D,GAAI,YAAY,SAAS,SAAS,EAAE,SAAS,IAAI,CAAC;AAAA,IAClD,GAAI,SAAS,EAAE,IAAI,OAAO,IAAI,CAAC;AAAA,IAC/B,GAAI,OAAO,EAAE,oBAAoB,YAAY,0BAA0B,KAAK,EAAE,eAAe,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,IAAI,CAAC;AAAA,EAC7I;AACF;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,230 @@
+/**
+ * Disjoncteur côté SDK.
+ *
+ * Pourquoi : si le moteur est en panne ou très lent, CHAQUE requête du client
+ * attendrait le délai maximal (ex. 500 ms) avant de laisser passer. Le site du
+ * client serait ralenti par NOTRE panne. Après quelques échecs d'affilée, on
+ * cesse d'appeler le moteur pendant un moment (« circuit ouvert ») : les
+ * requêtes passent immédiatement. Puis UNE requête d'essai vérifie s'il est revenu.
+ */
+interface BreakerOptions {
+    /** Échecs consécutifs avant ouverture. Défaut 5. */
+    failureThreshold?: number;
+    /** Durée pendant laquelle on n'appelle plus le moteur. Défaut 10 000 ms. */
+    cooldownMs?: number;
+    /** Horloge (tests). */
+    now?: () => number;
+}
+declare class CircuitBreaker {
+    private state;
+    private failures;
+    private openedAt;
+    private probing;
+    private readonly threshold;
+    private readonly cooldown;
+    private readonly now;
+    constructor(opts?: BreakerOptions);
+    /** true = l'appel est autorisé. Quand le circuit est semi-ouvert, un seul appel à la fois passe. */
+    allow(): boolean;
+    success(): void;
+    /** À appeler pour une panne d'infrastructure (délai, réseau, 5xx), pas pour une erreur de configuration. */
+    failure(): void;
+    /** Un appel autorisé qui se termine sans verdict sur la santé du moteur (ex. 401) : libère l'essai. */
+    neutral(): void;
+    private trip;
+    get isOpen(): boolean;
+}
+
+/** Contrat JSON de POST /v1/decide (voir proto/zarex.v1.proto, la référence). */
+type Mode = "LIVE" | "DRY_RUN" | "OFF";
+type Verdict = "ALLOW" | "DENY" | "ERROR";
+type Algorithm = "FIXED_WINDOW" | "SLIDING_WINDOW";
+/**
+ * Que faire d'une entrée plus grande que ce que Zarex inspecte (chemin, en-têtes, corps, texte) :
+ * "deny" = la refuser · "inspect" = analyser le début et la fin et le signaler · "allow" = laisser passer (signalé).
+ */
+type Oversize = "deny" | "inspect" | "allow";
+interface RateLimitRuleDTO {
+    mode: Mode;
+    max: number;
+    window: string;
+    algorithm: Algorithm;
+    characteristics: string[];
+}
+interface ShieldRuleDTO {
+    mode: Mode;
+    oversize?: Oversize;
+    threshold?: number;
+}
+interface BotDetectionRuleDTO {
+    mode: Mode;
+    allow: string[];
+    deny: string[];
+}
+interface TokenBucketRuleDTO {
+    mode: Mode;
+    capacity: number;
+    refill_rate: number;
+    interval: string;
+    characteristics: string[];
+}
+interface FilterExpressionDTO {
+    field: string;
+    operator: "EQ" | "NE" | "CONTAINS" | "STARTS_WITH" | "IN" | "NOT_IN" | "REGEX" | "LIKE" | "LEN_EQ" | "LEN_GT" | "LEN_LT";
+    value?: string;
+    values?: string[];
+    action: "DENY" | "ALLOW";
+    not?: boolean;
+}
+interface RequestFilterRuleDTO {
+    mode: Mode;
+    oversize?: Oversize;
+    expressions: FilterExpressionDTO[];
+    logic: "AND" | "OR";
+    default?: "ALLOW" | "DENY";
+}
+interface SensitiveInfoRuleDTO {
+    mode: Mode;
+    oversize?: Oversize;
+    deny?: string[];
+    inspect?: ("body" | "text_content")[];
+}
+interface EmailValidationRuleDTO {
+    mode: Mode;
+    deny?: string[];
+    allow_domains?: string[];
+    deny_domains?: string[];
+}
+interface PhoneValidationRuleDTO {
+    mode: Mode;
+    deny?: string[];
+    operators?: string[];
+    country_code?: string;
+    countries?: string[];
+}
+interface PromptInjectionRuleDTO {
+    mode: Mode;
+    oversize?: Oversize;
+    inspect?: ("body" | "text_content")[];
+    confidence_threshold?: number;
+}
+type RuleDTO = {
+    rate_limit: RateLimitRuleDTO;
+} | {
+    shield: ShieldRuleDTO;
+} | {
+    bot_detection: BotDetectionRuleDTO;
+} | {
+    token_bucket: TokenBucketRuleDTO;
+} | {
+    request_filter: RequestFilterRuleDTO;
+} | {
+    sensitive_info: SensitiveInfoRuleDTO;
+} | {
+    email_validation: EmailValidationRuleDTO;
+} | {
+    phone_validation: PhoneValidationRuleDTO;
+} | {
+    prompt_injection: PromptInjectionRuleDTO;
+};
+interface RequestContextDTO {
+    ip: string;
+    method: string;
+    path: string;
+    host: string;
+    body?: string;
+    body_truncated?: boolean;
+    headers: Record<string, string>;
+    characteristics?: {
+        key: string;
+        value: string;
+    }[];
+    tokens_requested?: number;
+    email?: string;
+    phone?: string;
+    text_content?: string;
+    text_truncated?: boolean;
+    /** Le SDK a coupé le chemin (plus de 8 Ko) : début + fin envoyés. */
+    path_truncated?: boolean;
+    /** Le SDK a coupé ou écarté des en-têtes. */
+    headers_truncated?: boolean;
+}
+interface DecideRequest {
+    site_key: string;
+    sdk_version: string;
+    sdk_lang: string;
+    entry_point: "REQUEST" | "GUARD";
+    context: RequestContextDTO;
+    rules: RuleDTO[];
+    ip_source?: string;
+}
+interface ResultDTO {
+    rule_type: string;
+    verdict: Verdict;
+    is_dry_run: boolean;
+    reason?: Record<string, unknown>;
+}
+interface DecideResponse {
+    decision_id: string;
+    verdict: Verdict;
+    results: ResultDTO[];
+    ttl_ms?: number;
+    warnings?: string[];
+    /** Version des règles du moteur qui ont décidé (ex. "11.3.0+shield-2.0"). Absente d'un ancien moteur. */
+    ruleset_version?: string;
+    /** Pays et réseau de l'IP du visiteur (étape 12). Absent si le moteur n'a pas de base d'adresses. */
+    ip?: {
+        country: string;
+        asn: string;
+    };
+}
+
+interface ClientOptions {
+    /** Clé API du projet (zarex_live_… / zarex_test_…). Jamais journalisée. */
+    key: string;
+    /** Adresse du service Zarex. Inutile en usage normal (défaut : le service de production) — à ne définir que pour les tests ou un environnement local. Variable ZAREX_URL acceptée aussi. */
+    baseUrl?: string;
+    /** Délai maximal d'un appel, en ms. Défaut 500. */
+    timeoutMs?: number;
+    /** Autoriser http:// vers un hôte distant (déconseillé : la clé circulerait en clair). */
+    allowInsecureHttp?: boolean;
+    /** Disjoncteur. `false` pour le désactiver. */
+    breaker?: BreakerOptions | false;
+    /** Implémentation de fetch (tests, runtimes particuliers). */
+    fetch?: typeof fetch;
+    /** Version annoncée au moteur. */
+    sdkVersion?: string;
+}
+interface ZarexClient {
+    decide(request: DecideRequest): Promise<DecideResponse>;
+}
+declare const SDK_VERSION = "0.1.0";
+/** Valide la clé sans jamais la recopier dans un message d'erreur. */
+declare function validateKey(key: unknown): string;
+declare function resolveBaseUrl(baseUrl: string | undefined, allowInsecureHttp?: boolean): string;
+declare function createClient(opts: ClientOptions): ZarexClient;
+/** Validation stricte de la réponse : ce qu'on ne comprend pas n'est jamais interprété comme un verdict. */
+declare function parseDecision(text: string): DecideResponse;
+
+/**
+ * Codes d'erreur du client. Le SDK ne lève JAMAIS ces erreurs jusqu'à
+ * l'application du client : `protect()` les attrape et laisse passer la requête
+ * (fail-open). Elles servent aux journaux et à `decision.error`.
+ */
+type ClientErrorCode = "timeout" | "network" | "circuit_open" | "unauthorized" | "forbidden" | "quota_exceeded" | "invalid_request" | "server_error" | "bad_response";
+declare class ZarexClientError extends Error {
+    readonly code: ClientErrorCode;
+    readonly status?: number;
+    /** Code d'erreur renvoyé par le moteur (ex. « too_large »), si présent. */
+    readonly engineCode?: string;
+    constructor(code: ClientErrorCode, message: string, opts?: {
+        status?: number;
+        engineCode?: string;
+    });
+}
+/** Erreur de configuration : levée immédiatement à la création, jamais pendant une requête. */
+declare class ZarexConfigError extends Error {
+    constructor(message: string);
+}
+
+export { type Algorithm, type BotDetectionRuleDTO, type BreakerOptions, CircuitBreaker, type ClientErrorCode, type ClientOptions, type DecideRequest, type DecideResponse, type EmailValidationRuleDTO, type FilterExpressionDTO, type Mode, type Oversize, type PhoneValidationRuleDTO, type PromptInjectionRuleDTO, type RateLimitRuleDTO, type RequestContextDTO, type RequestFilterRuleDTO, type ResultDTO, type RuleDTO, SDK_VERSION, type SensitiveInfoRuleDTO, type ShieldRuleDTO, type TokenBucketRuleDTO, type Verdict, type ZarexClient, ZarexClientError, ZarexConfigError, createClient, parseDecision, resolveBaseUrl, validateKey };

package/dist/index.d.ts

@@ -0,0 +1,230 @@
+/**
+ * Disjoncteur côté SDK.
+ *
+ * Pourquoi : si le moteur est en panne ou très lent, CHAQUE requête du client
+ * attendrait le délai maximal (ex. 500 ms) avant de laisser passer. Le site du
+ * client serait ralenti par NOTRE panne. Après quelques échecs d'affilée, on
+ * cesse d'appeler le moteur pendant un moment (« circuit ouvert ») : les
+ * requêtes passent immédiatement. Puis UNE requête d'essai vérifie s'il est revenu.
+ */
+interface BreakerOptions {
+    /** Échecs consécutifs avant ouverture. Défaut 5. */
+    failureThreshold?: number;
+    /** Durée pendant laquelle on n'appelle plus le moteur. Défaut 10 000 ms. */
+    cooldownMs?: number;
+    /** Horloge (tests). */
+    now?: () => number;
+}
+declare class CircuitBreaker {
+    private state;
+    private failures;
+    private openedAt;
+    private probing;
+    private readonly threshold;
+    private readonly cooldown;
+    private readonly now;
+    constructor(opts?: BreakerOptions);
+    /** true = l'appel est autorisé. Quand le circuit est semi-ouvert, un seul appel à la fois passe. */
+    allow(): boolean;
+    success(): void;
+    /** À appeler pour une panne d'infrastructure (délai, réseau, 5xx), pas pour une erreur de configuration. */
+    failure(): void;
+    /** Un appel autorisé qui se termine sans verdict sur la santé du moteur (ex. 401) : libère l'essai. */
+    neutral(): void;
+    private trip;
+    get isOpen(): boolean;
+}
+
+/** Contrat JSON de POST /v1/decide (voir proto/zarex.v1.proto, la référence). */
+type Mode = "LIVE" | "DRY_RUN" | "OFF";
+type Verdict = "ALLOW" | "DENY" | "ERROR";
+type Algorithm = "FIXED_WINDOW" | "SLIDING_WINDOW";
+/**
+ * Que faire d'une entrée plus grande que ce que Zarex inspecte (chemin, en-têtes, corps, texte) :
+ * "deny" = la refuser · "inspect" = analyser le début et la fin et le signaler · "allow" = laisser passer (signalé).
+ */
+type Oversize = "deny" | "inspect" | "allow";
+interface RateLimitRuleDTO {
+    mode: Mode;
+    max: number;
+    window: string;
+    algorithm: Algorithm;
+    characteristics: string[];
+}
+interface ShieldRuleDTO {
+    mode: Mode;
+    oversize?: Oversize;
+    threshold?: number;
+}
+interface BotDetectionRuleDTO {
+    mode: Mode;
+    allow: string[];
+    deny: string[];
+}
+interface TokenBucketRuleDTO {
+    mode: Mode;
+    capacity: number;
+    refill_rate: number;
+    interval: string;
+    characteristics: string[];
+}
+interface FilterExpressionDTO {
+    field: string;
+    operator: "EQ" | "NE" | "CONTAINS" | "STARTS_WITH" | "IN" | "NOT_IN" | "REGEX" | "LIKE" | "LEN_EQ" | "LEN_GT" | "LEN_LT";
+    value?: string;
+    values?: string[];
+    action: "DENY" | "ALLOW";
+    not?: boolean;
+}
+interface RequestFilterRuleDTO {
+    mode: Mode;
+    oversize?: Oversize;
+    expressions: FilterExpressionDTO[];
+    logic: "AND" | "OR";
+    default?: "ALLOW" | "DENY";
+}
+interface SensitiveInfoRuleDTO {
+    mode: Mode;
+    oversize?: Oversize;
+    deny?: string[];
+    inspect?: ("body" | "text_content")[];
+}
+interface EmailValidationRuleDTO {
+    mode: Mode;
+    deny?: string[];
+    allow_domains?: string[];
+    deny_domains?: string[];
+}
+interface PhoneValidationRuleDTO {
+    mode: Mode;
+    deny?: string[];
+    operators?: string[];
+    country_code?: string;
+    countries?: string[];
+}
+interface PromptInjectionRuleDTO {
+    mode: Mode;
+    oversize?: Oversize;
+    inspect?: ("body" | "text_content")[];
+    confidence_threshold?: number;
+}
+type RuleDTO = {
+    rate_limit: RateLimitRuleDTO;
+} | {
+    shield: ShieldRuleDTO;
+} | {
+    bot_detection: BotDetectionRuleDTO;
+} | {
+    token_bucket: TokenBucketRuleDTO;
+} | {
+    request_filter: RequestFilterRuleDTO;
+} | {
+    sensitive_info: SensitiveInfoRuleDTO;
+} | {
+    email_validation: EmailValidationRuleDTO;
+} | {
+    phone_validation: PhoneValidationRuleDTO;
+} | {
+    prompt_injection: PromptInjectionRuleDTO;
+};
+interface RequestContextDTO {
+    ip: string;
+    method: string;
+    path: string;
+    host: string;
+    body?: string;
+    body_truncated?: boolean;
+    headers: Record<string, string>;
+    characteristics?: {
+        key: string;
+        value: string;
+    }[];
+    tokens_requested?: number;
+    email?: string;
+    phone?: string;
+    text_content?: string;
+    text_truncated?: boolean;
+    /** Le SDK a coupé le chemin (plus de 8 Ko) : début + fin envoyés. */
+    path_truncated?: boolean;
+    /** Le SDK a coupé ou écarté des en-têtes. */
+    headers_truncated?: boolean;
+}
+interface DecideRequest {
+    site_key: string;
+    sdk_version: string;
+    sdk_lang: string;
+    entry_point: "REQUEST" | "GUARD";
+    context: RequestContextDTO;
+    rules: RuleDTO[];
+    ip_source?: string;
+}
+interface ResultDTO {
+    rule_type: string;
+    verdict: Verdict;
+    is_dry_run: boolean;
+    reason?: Record<string, unknown>;
+}
+interface DecideResponse {
+    decision_id: string;
+    verdict: Verdict;
+    results: ResultDTO[];
+    ttl_ms?: number;
+    warnings?: string[];
+    /** Version des règles du moteur qui ont décidé (ex. "11.3.0+shield-2.0"). Absente d'un ancien moteur. */
+    ruleset_version?: string;
+    /** Pays et réseau de l'IP du visiteur (étape 12). Absent si le moteur n'a pas de base d'adresses. */
+    ip?: {
+        country: string;
+        asn: string;
+    };
+}
+
+interface ClientOptions {
+    /** Clé API du projet (zarex_live_… / zarex_test_…). Jamais journalisée. */
+    key: string;
+    /** Adresse du service Zarex. Inutile en usage normal (défaut : le service de production) — à ne définir que pour les tests ou un environnement local. Variable ZAREX_URL acceptée aussi. */
+    baseUrl?: string;
+    /** Délai maximal d'un appel, en ms. Défaut 500. */
+    timeoutMs?: number;
+    /** Autoriser http:// vers un hôte distant (déconseillé : la clé circulerait en clair). */
+    allowInsecureHttp?: boolean;
+    /** Disjoncteur. `false` pour le désactiver. */
+    breaker?: BreakerOptions | false;
+    /** Implémentation de fetch (tests, runtimes particuliers). */
+    fetch?: typeof fetch;
+    /** Version annoncée au moteur. */
+    sdkVersion?: string;
+}
+interface ZarexClient {
+    decide(request: DecideRequest): Promise<DecideResponse>;
+}
+declare const SDK_VERSION = "0.1.0";
+/** Valide la clé sans jamais la recopier dans un message d'erreur. */
+declare function validateKey(key: unknown): string;
+declare function resolveBaseUrl(baseUrl: string | undefined, allowInsecureHttp?: boolean): string;
+declare function createClient(opts: ClientOptions): ZarexClient;
+/** Validation stricte de la réponse : ce qu'on ne comprend pas n'est jamais interprété comme un verdict. */
+declare function parseDecision(text: string): DecideResponse;
+
+/**
+ * Codes d'erreur du client. Le SDK ne lève JAMAIS ces erreurs jusqu'à
+ * l'application du client : `protect()` les attrape et laisse passer la requête
+ * (fail-open). Elles servent aux journaux et à `decision.error`.
+ */
+type ClientErrorCode = "timeout" | "network" | "circuit_open" | "unauthorized" | "forbidden" | "quota_exceeded" | "invalid_request" | "server_error" | "bad_response";
+declare class ZarexClientError extends Error {
+    readonly code: ClientErrorCode;
+    readonly status?: number;
+    /** Code d'erreur renvoyé par le moteur (ex. « too_large »), si présent. */
+    readonly engineCode?: string;
+    constructor(code: ClientErrorCode, message: string, opts?: {
+        status?: number;
+        engineCode?: string;
+    });
+}
+/** Erreur de configuration : levée immédiatement à la création, jamais pendant une requête. */
+declare class ZarexConfigError extends Error {
+    constructor(message: string);
+}
+
+export { type Algorithm, type BotDetectionRuleDTO, type BreakerOptions, CircuitBreaker, type ClientErrorCode, type ClientOptions, type DecideRequest, type DecideResponse, type EmailValidationRuleDTO, type FilterExpressionDTO, type Mode, type Oversize, type PhoneValidationRuleDTO, type PromptInjectionRuleDTO, type RateLimitRuleDTO, type RequestContextDTO, type RequestFilterRuleDTO, type ResultDTO, type RuleDTO, SDK_VERSION, type SensitiveInfoRuleDTO, type ShieldRuleDTO, type TokenBucketRuleDTO, type Verdict, type ZarexClient, ZarexClientError, ZarexConfigError, createClient, parseDecision, resolveBaseUrl, validateKey };

package/dist/index.js

@@ -0,0 +1,302 @@
+// src/breaker.ts
+var CircuitBreaker = class {
+  state = "closed";
+  failures = 0;
+  openedAt = 0;
+  probing = false;
+  threshold;
+  cooldown;
+  now;
+  constructor(opts = {}) {
+    this.threshold = opts.failureThreshold ?? 5;
+    this.cooldown = opts.cooldownMs ?? 1e4;
+    this.now = opts.now ?? Date.now;
+  }
+  /** true = l'appel est autorisé. Quand le circuit est semi-ouvert, un seul appel à la fois passe. */
+  allow() {
+    if (this.state === "closed") return true;
+    if (this.state === "open") {
+      if (this.now() - this.openedAt < this.cooldown) return false;
+      this.state = "half-open";
+      this.probing = false;
+    }
+    if (this.probing) return false;
+    this.probing = true;
+    return true;
+  }
+  success() {
+    this.failures = 0;
+    this.probing = false;
+    this.state = "closed";
+  }
+  /** À appeler pour une panne d'infrastructure (délai, réseau, 5xx), pas pour une erreur de configuration. */
+  failure() {
+    this.probing = false;
+    if (this.state === "half-open") {
+      this.trip();
+      return;
+    }
+    this.failures++;
+    if (this.failures >= this.threshold) this.trip();
+  }
+  /** Un appel autorisé qui se termine sans verdict sur la santé du moteur (ex. 401) : libère l'essai. */
+  neutral() {
+    this.probing = false;
+    if (this.state === "half-open") this.state = "closed";
+  }
+  trip() {
+    this.state = "open";
+    this.openedAt = this.now();
+  }
+  get isOpen() {
+    return this.state !== "closed";
+  }
+};
+
+// src/errors.ts
+var ZarexClientError = class extends Error {
+  code;
+  status;
+  /** Code d'erreur renvoyé par le moteur (ex. « too_large »), si présent. */
+  engineCode;
+  constructor(code, message, opts = {}) {
+    super(message);
+    this.name = "ZarexClientError";
+    this.code = code;
+    if (opts.status !== void 0) this.status = opts.status;
+    if (opts.engineCode !== void 0) this.engineCode = opts.engineCode;
+  }
+};
+var ZarexConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ZarexConfigError";
+  }
+};
+
+// src/client.ts
+var SDK_VERSION = "0.1.0";
+var MAX_RESPONSE_BYTES = 256 * 1024;
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+var DEFAULT_BASE_URL = "https://engine.zarex.dev";
+function readEnv(name) {
+  try {
+    return typeof process !== "undefined" ? process.env?.[name] : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function validateKey(key) {
+  if (typeof key !== "string" || key.length < 16 || key.length > 256 || !/^[A-Za-z0-9_-]+$/.test(key)) {
+    throw new ZarexConfigError(
+      "Zarex: `key` is missing or malformed (expected the project API key, e.g. from process.env.ZAREX_KEY)."
+    );
+  }
+  return key;
+}
+function resolveBaseUrl(baseUrl, allowInsecureHttp = false) {
+  const raw = baseUrl ?? readEnv("ZAREX_URL") ?? DEFAULT_BASE_URL;
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw new ZarexConfigError("Zarex: `baseUrl` is not a valid URL.");
+  }
+  if (u.protocol !== "https:" && u.protocol !== "http:") {
+    throw new ZarexConfigError("Zarex: `baseUrl` must use https:// (or http:// for localhost).");
+  }
+  if (u.username || u.password) {
+    throw new ZarexConfigError("Zarex: `baseUrl` must not contain credentials.");
+  }
+  if (u.protocol === "http:" && !LOCAL_HOSTS.has(u.hostname) && !allowInsecureHttp) {
+    throw new ZarexConfigError(
+      "Zarex: refusing to send the API key over plain http:// to a remote host. Use https:// (or set allowInsecureHttp: true at your own risk)."
+    );
+  }
+  u.search = "";
+  u.hash = "";
+  return u.toString().replace(/\/+$/, "");
+}
+function createClient(opts) {
+  const key = validateKey(opts.key);
+  const base = resolveBaseUrl(opts.baseUrl, opts.allowInsecureHttp);
+  const timeoutMs = opts.timeoutMs ?? 500;
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 10 || timeoutMs > 3e4) {
+    throw new ZarexConfigError("Zarex: `timeoutMs` must be between 10 and 30000.");
+  }
+  const doFetch = opts.fetch ?? (typeof fetch === "function" ? fetch : void 0);
+  if (!doFetch) {
+    throw new ZarexConfigError("Zarex: no global fetch available; pass `fetch` in the options (Node >= 18 has one).");
+  }
+  const breaker = opts.breaker === false ? null : new CircuitBreaker(opts.breaker ?? {});
+  const url = `${base}/v1/decide`;
+  const version = opts.sdkVersion ?? SDK_VERSION;
+  async function decide(request) {
+    if (breaker && !breaker.allow()) {
+      throw new ZarexClientError("circuit_open", "Zarex engine temporarily skipped after repeated failures");
+    }
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    let outcome = "neutral";
+    try {
+      let res;
+      try {
+        res = await doFetch(url, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            accept: "application/json",
+            authorization: `Bearer ${key}`,
+            "user-agent": `zarex-js/${version}`
+          },
+          body: JSON.stringify(request),
+          signal: ctrl.signal,
+          // Ne JAMAIS suivre une redirection : elle renverrait la clé API ailleurs.
+          // "manual" plutôt que "error" : Cloudflare Workers ne connaît pas "error". La réponse 3xx est refusée plus bas.
+          redirect: "manual"
+        });
+      } catch (err) {
+        outcome = "infra";
+        if (ctrl.signal.aborted) throw new ZarexClientError("timeout", `Zarex engine did not answer within ${timeoutMs} ms`);
+        throw new ZarexClientError("network", `Zarex engine unreachable (${errKind(err)})`);
+      }
+      if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400) {
+        outcome = "infra";
+        void res.body?.cancel().catch(() => void 0);
+        throw new ZarexClientError("network", "Zarex engine unreachable (unexpected redirect)");
+      }
+      const text = await readCapped(res, MAX_RESPONSE_BYTES, ctrl.signal).catch(() => {
+        outcome = "infra";
+        if (ctrl.signal.aborted) throw new ZarexClientError("timeout", `Zarex engine did not answer within ${timeoutMs} ms`);
+        throw new ZarexClientError("bad_response", "Zarex engine response could not be read");
+      });
+      if (res.status !== 200) {
+        const engineCode = extractEngineCode(text);
+        const code = statusToCode(res.status);
+        outcome = code === "server_error" ? "infra" : "neutral";
+        throw new ZarexClientError(code, `Zarex engine answered HTTP ${res.status}${engineCode ? ` (${engineCode})` : ""}`, {
+          status: res.status,
+          ...engineCode ? { engineCode } : {}
+        });
+      }
+      let parsed;
+      try {
+        parsed = parseDecision(text);
+      } catch (err) {
+        outcome = "infra";
+        throw err;
+      }
+      outcome = "ok";
+      return parsed;
+    } finally {
+      clearTimeout(timer);
+      if (breaker) {
+        if (outcome === "ok") breaker.success();
+        else if (outcome === "infra") breaker.failure();
+        else breaker.neutral();
+      }
+    }
+  }
+  return { decide };
+}
+function errKind(err) {
+  const msg = err instanceof Error ? `${err.name} ${err.message} ${err.cause?.code ?? ""}` : "";
+  if (/redirect/i.test(msg)) return "unexpected redirect";
+  if (/ECONNREFUSED|refused/i.test(msg)) return "connection refused";
+  if (/ENOTFOUND|EAI_AGAIN|getaddrinfo/i.test(msg)) return "DNS lookup failed";
+  if (/certificate|TLS|SSL|CERT/i.test(msg)) return "TLS error";
+  return "network error";
+}
+function statusToCode(status) {
+  if (status === 401) return "unauthorized";
+  if (status === 403) return "forbidden";
+  if (status === 429) return "quota_exceeded";
+  if (status >= 500) return "server_error";
+  return "invalid_request";
+}
+function extractEngineCode(text) {
+  try {
+    const code = JSON.parse(text)?.error?.code;
+    return typeof code === "string" && /^[a-z_]{1,40}$/.test(code) ? code : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readCapped(res, max, signal) {
+  const declared = Number(res.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > max) throw new Error("too large");
+  if (!res.body) return await res.text();
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    if (signal.aborted) {
+      await reader.cancel().catch(() => void 0);
+      throw new Error("aborted");
+    }
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > max) {
+      await reader.cancel().catch(() => void 0);
+      throw new Error("too large");
+    }
+    chunks.push(value);
+  }
+  const all = new Uint8Array(total);
+  let off = 0;
+  for (const c of chunks) {
+    all.set(c, off);
+    off += c.byteLength;
+  }
+  return new TextDecoder().decode(all);
+}
+var VERDICTS = /* @__PURE__ */ new Set(["ALLOW", "DENY", "ERROR"]);
+function parseDecision(text) {
+  let v;
+  try {
+    v = JSON.parse(text);
+  } catch {
+    throw new ZarexClientError("bad_response", "Zarex engine returned invalid JSON");
+  }
+  const o = v;
+  if (!o || typeof o !== "object" || typeof o.verdict !== "string" || !VERDICTS.has(o.verdict) || !Array.isArray(o.results)) {
+    throw new ZarexClientError("bad_response", "Zarex engine returned an unexpected response");
+  }
+  const results = [];
+  for (const r of o.results) {
+    const x = r;
+    if (!x || typeof x !== "object" || typeof x.rule_type !== "string" || typeof x.verdict !== "string" || !VERDICTS.has(x.verdict)) {
+      throw new ZarexClientError("bad_response", "Zarex engine returned an unexpected rule result");
+    }
+    results.push({
+      rule_type: x.rule_type,
+      verdict: x.verdict,
+      is_dry_run: x.is_dry_run === true,
+      ...x.reason && typeof x.reason === "object" ? { reason: x.reason } : {}
+    });
+  }
+  const warnings = Array.isArray(o.warnings) ? o.warnings.filter((w) => typeof w === "string" && /^[a-z_]{1,40}$/.test(w)).slice(0, 10) : void 0;
+  const rawIp = o.ip;
+  const ipInfo = rawIp && typeof rawIp === "object" && typeof rawIp.country === "string" && /^[A-Z]{2}$/.test(rawIp.country) && typeof rawIp.asn === "string" && /^AS\d{1,10}$/.test(rawIp.asn) ? { country: rawIp.country, asn: rawIp.asn } : void 0;
+  return {
+    decision_id: typeof o.decision_id === "string" ? o.decision_id.slice(0, 64) : "",
+    verdict: o.verdict,
+    results,
+    ...typeof o.ttl_ms === "number" ? { ttl_ms: o.ttl_ms } : {},
+    ...warnings && warnings.length ? { warnings } : {},
+    ...ipInfo ? { ip: ipInfo } : {},
+    ...typeof o.ruleset_version === "string" && /^[A-Za-z0-9._+-]{1,64}$/.test(o.ruleset_version) ? { ruleset_version: o.ruleset_version } : {}
+  };
+}
+export {
+  CircuitBreaker,
+  SDK_VERSION,
+  ZarexClientError,
+  ZarexConfigError,
+  createClient,
+  parseDecision,
+  resolveBaseUrl,
+  validateKey
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/breaker.ts","../src/errors.ts","../src/client.ts"],"sourcesContent":["/**\r\n * Disjoncteur côté SDK.\r\n *\r\n * Pourquoi : si le moteur est en panne ou très lent, CHAQUE requête du client\r\n * attendrait le délai maximal (ex. 500 ms) avant de laisser passer. Le site du\r\n * client serait ralenti par NOTRE panne. Après quelques échecs d'affilée, on\r\n * cesse d'appeler le moteur pendant un moment (« circuit ouvert ») : les\r\n * requêtes passent immédiatement. Puis UNE requête d'essai vérifie s'il est revenu.\r\n */\r\nexport interface BreakerOptions {\r\n  /** Échecs consécutifs avant ouverture. Défaut 5. */\r\n  failureThreshold?: number;\r\n  /** Durée pendant laquelle on n'appelle plus le moteur. Défaut 10 000 ms. */\r\n  cooldownMs?: number;\r\n  /** Horloge (tests). */\r\n  now?: () => number;\r\n}\r\n\r\ntype State = \"closed\" | \"open\" | \"half-open\";\r\n\r\nexport class CircuitBreaker {\r\n  private state: State = \"closed\";\r\n  private failures = 0;\r\n  private openedAt = 0;\r\n  private probing = false;\r\n  private readonly threshold: number;\r\n  private readonly cooldown: number;\r\n  private readonly now: () => number;\r\n\r\n  constructor(opts: BreakerOptions = {}) {\r\n    this.threshold = opts.failureThreshold ?? 5;\r\n    this.cooldown = opts.cooldownMs ?? 10_000;\r\n    this.now = opts.now ?? Date.now;\r\n  }\r\n\r\n  /** true = l'appel est autorisé. Quand le circuit est semi-ouvert, un seul appel à la fois passe. */\r\n  allow(): boolean {\r\n    if (this.state === \"closed\") return true;\r\n    if (this.state === \"open\") {\r\n      if (this.now() - this.openedAt < this.cooldown) return false;\r\n      this.state = \"half-open\";\r\n      this.probing = false;\r\n    }\r\n    // half-open : un seul essai en vol\r\n    if (this.probing) return false;\r\n    this.probing = true;\r\n    return true;\r\n  }\r\n\r\n  success(): void {\r\n    this.failures = 0;\r\n    this.probing = false;\r\n    this.state = \"closed\";\r\n  }\r\n\r\n  /** À appeler pour une panne d'infrastructure (délai, réseau, 5xx), pas pour une erreur de configuration. */\r\n  failure(): void {\r\n    this.probing = false;\r\n    if (this.state === \"half-open\") {\r\n      this.trip();\r\n      return;\r\n    }\r\n    this.failures++;\r\n    if (this.failures >= this.threshold) this.trip();\r\n  }\r\n \r\n  /** Un appel autorisé qui se termine sans verdict sur la santé du moteur (ex. 401) : libère l'essai. */\r\n  neutral(): void {\r\n    this.probing = false;\r\n    if (this.state === \"half-open\") this.state = \"closed\";\r\n  }\r\n \r\n  private trip(): void {\r\n    this.state = \"open\";\r\n    this.openedAt = this.now();\r\n  }\r\n \r\n  get isOpen(): boolean {\r\n    return this.state !== \"closed\";\r\n  }\r\n}","/**\r\n * Codes d'erreur du client. Le SDK ne lève JAMAIS ces erreurs jusqu'à\r\n * l'application du client : `protect()` les attrape et laisse passer la requête\r\n * (fail-open). Elles servent aux journaux et à `decision.error`.\r\n */\r\nexport type ClientErrorCode =\r\n  | \"timeout\" // le moteur n'a pas répondu à temps\r\n  | \"network\" // connexion impossible / coupée\r\n  | \"circuit_open\" // trop d'échecs récents : appel évité pour protéger l'application\r\n  | \"unauthorized\" // 401 : clé API absente, invalide ou révoquée\r\n  | \"forbidden\" // 403\r\n  | \"quota_exceeded\" // 429 : quota mensuel du plan atteint\r\n  | \"invalid_request\" // 400/413/415 : bug du SDK ou règle invalide\r\n  | \"server_error\" // 5xx\r\n  | \"bad_response\"; // réponse 200 mais illisible / inattendue\r\n \r\nexport class ZarexClientError extends Error {\r\n  readonly code: ClientErrorCode;\r\n  readonly status?: number;\r\n  /** Code d'erreur renvoyé par le moteur (ex. « too_large »), si présent. */\r\n  readonly engineCode?: string;\r\n \r\n  constructor(code: ClientErrorCode, message: string, opts: { status?: number; engineCode?: string } = {}) {\r\n    super(message);\r\n    this.name = \"ZarexClientError\";\r\n    this.code = code;\r\n    if (opts.status !== undefined) this.status = opts.status;\r\n    if (opts.engineCode !== undefined) this.engineCode = opts.engineCode;\r\n  }\r\n}\r\n \r\n/** Erreur de configuration : levée immédiatement à la création, jamais pendant une requête. */\r\nexport class ZarexConfigError extends Error {\r\n  constructor(message: string) {\r\n    super(message);\r\n    this.name = \"ZarexConfigError\";\r\n  }\r\n}","import { CircuitBreaker, type BreakerOptions } from \"./breaker.js\";\r\nimport { ZarexClientError, ZarexConfigError } from \"./errors.js\";\r\nimport type { DecideRequest, DecideResponse, Verdict } from \"./types.js\";\r\n\r\nexport interface ClientOptions {\r\n  /** Clé API du projet (zarex_live_… / zarex_test_…). Jamais journalisée. */\r\n  key: string;\r\n  /** Adresse du service Zarex. Inutile en usage normal (défaut : le service de production) — à ne définir que pour les tests ou un environnement local. Variable ZAREX_URL acceptée aussi. */\r\n  baseUrl?: string;\r\n  /** Délai maximal d'un appel, en ms. Défaut 500. */\r\n  timeoutMs?: number;\r\n  /** Autoriser http:// vers un hôte distant (déconseillé : la clé circulerait en clair). */\r\n  allowInsecureHttp?: boolean;\r\n  /** Disjoncteur. `false` pour le désactiver. */\r\n  breaker?: BreakerOptions | false;\r\n  /** Implémentation de fetch (tests, runtimes particuliers). */\r\n  fetch?: typeof fetch;\r\n  /** Version annoncée au moteur. */\r\n  sdkVersion?: string;\r\n}\r\n\r\nexport interface ZarexClient {\r\n  decide(request: DecideRequest): Promise<DecideResponse>;\r\n}\r\n\r\nexport const SDK_VERSION = \"0.1.0\";\r\nconst MAX_RESPONSE_BYTES = 256 * 1024;\r\nconst LOCAL_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\", \"::1\"]);\r\n/**\r\n * Adresse du service Zarex en production — un seul service partagé par tous\r\n * les clients, différenciés par leur clé API (comme Stripe/Twilio : jamais\r\n * besoin de configurer où se trouve l'API). `baseUrl`/`ZAREX_URL` restent\r\n * disponibles pour la remplacer (tests, environnement local), mais plus\r\n * personne n'a besoin de le faire pour un usage normal.\r\n */\r\nexport const DEFAULT_BASE_URL = \"https://engine.zarex.dev\";\r\n\r\nfunction readEnv(name: string): string | undefined {\r\n  try {\r\n    return typeof process !== \"undefined\" ? process.env?.[name] : undefined;\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\n/** Valide la clé sans jamais la recopier dans un message d'erreur. */\r\nexport function validateKey(key: unknown): string {\r\n  if (typeof key !== \"string\" || key.length < 16 || key.length > 256 || !/^[A-Za-z0-9_-]+$/.test(key)) {\r\n    throw new ZarexConfigError(\r\n      \"Zarex: `key` is missing or malformed (expected the project API key, e.g. from process.env.ZAREX_KEY).\"\r\n    );\r\n  }\r\n  return key;\r\n}\r\n\r\nexport function resolveBaseUrl(baseUrl: string | undefined, allowInsecureHttp = false): string {\r\n  const raw = baseUrl ?? readEnv(\"ZAREX_URL\") ?? DEFAULT_BASE_URL;\r\n  let u: URL;\r\n  try {\r\n    u = new URL(raw);\r\n  } catch {\r\n    throw new ZarexConfigError(\"Zarex: `baseUrl` is not a valid URL.\");\r\n  }\r\n  if (u.protocol !== \"https:\" && u.protocol !== \"http:\") {\r\n    throw new ZarexConfigError(\"Zarex: `baseUrl` must use https:// (or http:// for localhost).\");\r\n  }\r\n  if (u.username || u.password) {\r\n    throw new ZarexConfigError(\"Zarex: `baseUrl` must not contain credentials.\");\r\n  }\r\n  if (u.protocol === \"http:\" && !LOCAL_HOSTS.has(u.hostname) && !allowInsecureHttp) {\r\n    throw new ZarexConfigError(\r\n      \"Zarex: refusing to send the API key over plain http:// to a remote host. Use https:// (or set allowInsecureHttp: true at your own risk).\"\r\n    );\r\n  }\r\n  u.search = \"\";\r\n  u.hash = \"\";\r\n  return u.toString().replace(/\\/+$/, \"\");\r\n}\r\n\r\nexport function createClient(opts: ClientOptions): ZarexClient {\r\n  const key = validateKey(opts.key);\r\n  const base = resolveBaseUrl(opts.baseUrl, opts.allowInsecureHttp);\r\n  const timeoutMs = opts.timeoutMs ?? 500;\r\n  if (!Number.isFinite(timeoutMs) || timeoutMs < 10 || timeoutMs > 30_000) {\r\n    throw new ZarexConfigError(\"Zarex: `timeoutMs` must be between 10 and 30000.\");\r\n  }\r\n  const doFetch = opts.fetch ?? (typeof fetch === \"function\" ? fetch : undefined);\r\n  if (!doFetch) {\r\n    throw new ZarexConfigError(\"Zarex: no global fetch available; pass `fetch` in the options (Node >= 18 has one).\");\r\n  }\r\n  const breaker = opts.breaker === false ? null : new CircuitBreaker(opts.breaker ?? {});\r\n  const url = `${base}/v1/decide`;\r\n  const version = opts.sdkVersion ?? SDK_VERSION;\r\n\r\n  async function decide(request: DecideRequest): Promise<DecideResponse> {\r\n    if (breaker && !breaker.allow()) {\r\n      throw new ZarexClientError(\"circuit_open\", \"Zarex engine temporarily skipped after repeated failures\");\r\n    }\r\n\r\n    const ctrl = new AbortController();\r\n    const timer = setTimeout(() => ctrl.abort(), timeoutMs);\r\n    let outcome: \"ok\" | \"infra\" | \"neutral\" = \"neutral\";\r\n    try {\r\n      let res: Response;\r\n      try {\r\n        res = await doFetch!(url, {\r\n          method: \"POST\",\r\n          headers: {\r\n            \"content-type\": \"application/json\",\r\n            accept: \"application/json\",\r\n            authorization: `Bearer ${key}`,\r\n            \"user-agent\": `zarex-js/${version}`,\r\n          },\r\n          body: JSON.stringify(request),\r\n          signal: ctrl.signal,\r\n          // Ne JAMAIS suivre une redirection : elle renverrait la clé API ailleurs.\r\n          // \"manual\" plutôt que \"error\" : Cloudflare Workers ne connaît pas \"error\". La réponse 3xx est refusée plus bas.\r\n          redirect: \"manual\",\r\n        });\r\n      } catch (err) {\r\n        outcome = \"infra\";\r\n        if (ctrl.signal.aborted) throw new ZarexClientError(\"timeout\", `Zarex engine did not answer within ${timeoutMs} ms`);\r\n        // Le message natif peut contenir l'URL : on n'en garde que la nature.\r\n        throw new ZarexClientError(\"network\", `Zarex engine unreachable (${errKind(err)})`);\r\n      }\r\n\r\n      if (res.type === \"opaqueredirect\" || (res.status >= 300 && res.status < 400)) {\r\n        outcome = \"infra\";\r\n        void res.body?.cancel().catch(() => undefined);\r\n        throw new ZarexClientError(\"network\", \"Zarex engine unreachable (unexpected redirect)\");\r\n      }\r\n\r\n      const text = await readCapped(res, MAX_RESPONSE_BYTES, ctrl.signal).catch(() => {\r\n        outcome = \"infra\";\r\n        if (ctrl.signal.aborted) throw new ZarexClientError(\"timeout\", `Zarex engine did not answer within ${timeoutMs} ms`);\r\n        throw new ZarexClientError(\"bad_response\", \"Zarex engine response could not be read\");\r\n      });\r\n\r\n      if (res.status !== 200) {\r\n        const engineCode = extractEngineCode(text);\r\n        const code = statusToCode(res.status);\r\n        outcome = code === \"server_error\" ? \"infra\" : \"neutral\";\r\n        throw new ZarexClientError(code, `Zarex engine answered HTTP ${res.status}${engineCode ? ` (${engineCode})` : \"\"}`, {\r\n          status: res.status,\r\n          ...(engineCode ? { engineCode } : {}),\r\n        });\r\n      }\r\n\r\n      // Un 200 avec un corps JSON illisible/inattendu est la MÊME défaillance (« bad_response ») que celle\r\n      // de readCapped juste au-dessus, et doit compter de la même façon pour le disjoncteur (« infra ») —\r\n      // sans ce catch, `outcome` restait à \"neutral\" (sa valeur par défaut, jamais réécrite si parseDecision\r\n      // lève), donc un moteur qui renvoie du JSON corrompu en 200 n'ouvrait jamais le disjoncteur (trouvé\r\n      // lors de l'audit du 04/11/2026, voir AUDIT_SECURITE_COMPLET.md).\r\n      let parsed: DecideResponse;\r\n      try {\r\n        parsed = parseDecision(text);\r\n      } catch (err) {\r\n        outcome = \"infra\";\r\n        throw err;\r\n      }\r\n      outcome = \"ok\";\r\n      return parsed;\r\n    } finally {\r\n      clearTimeout(timer);\r\n      if (breaker) {\r\n        if (outcome === \"ok\") breaker.success();\r\n        else if (outcome === \"infra\") breaker.failure();\r\n        else breaker.neutral();\r\n      }\r\n    }\r\n  }\r\n\r\n  return { decide };\r\n}\r\n\r\nfunction errKind(err: unknown): string {\r\n  const msg = err instanceof Error ? `${err.name} ${err.message} ${(err as { cause?: { code?: string } }).cause?.code ?? \"\"}` : \"\";\r\n  if (/redirect/i.test(msg)) return \"unexpected redirect\";\r\n  if (/ECONNREFUSED|refused/i.test(msg)) return \"connection refused\";\r\n  if (/ENOTFOUND|EAI_AGAIN|getaddrinfo/i.test(msg)) return \"DNS lookup failed\";\r\n  if (/certificate|TLS|SSL|CERT/i.test(msg)) return \"TLS error\";\r\n  return \"network error\";\r\n}\r\n\r\nfunction statusToCode(status: number): ZarexClientError[\"code\"] {\r\n  if (status === 401) return \"unauthorized\";\r\n  if (status === 403) return \"forbidden\";\r\n  if (status === 429) return \"quota_exceeded\";\r\n  if (status >= 500) return \"server_error\";\r\n  return \"invalid_request\";\r\n}\r\n\r\nfunction extractEngineCode(text: string): string | undefined {\r\n  try {\r\n    const code = (JSON.parse(text) as { error?: { code?: unknown } })?.error?.code;\r\n    return typeof code === \"string\" && /^[a-z_]{1,40}$/.test(code) ? code : undefined;\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\n/** Lit au plus `max` octets : une réponse démesurée ne doit pas saturer la mémoire du client. */\r\nasync function readCapped(res: Response, max: number, signal: AbortSignal): Promise<string> {\r\n  const declared = Number(res.headers.get(\"content-length\"));\r\n  if (Number.isFinite(declared) && declared > max) throw new Error(\"too large\");\r\n  if (!res.body) return await res.text();\r\n  const reader = res.body.getReader();\r\n  const chunks: Uint8Array[] = [];\r\n  let total = 0;\r\n  for (;;) {\r\n    if (signal.aborted) {\r\n      await reader.cancel().catch(() => undefined);\r\n      throw new Error(\"aborted\");\r\n    }\r\n    const { done, value } = await reader.read();\r\n    if (done) break;\r\n    total += value.byteLength;\r\n    if (total > max) {\r\n      await reader.cancel().catch(() => undefined);\r\n      throw new Error(\"too large\");\r\n    }\r\n    chunks.push(value);\r\n  }\r\n  const all = new Uint8Array(total);\r\n  let off = 0;\r\n  for (const c of chunks) {\r\n    all.set(c, off);\r\n    off += c.byteLength;\r\n  }\r\n  return new TextDecoder().decode(all);\r\n}\r\n\r\nconst VERDICTS: ReadonlySet<string> = new Set<Verdict>([\"ALLOW\", \"DENY\", \"ERROR\"]);\r\n\r\n/** Validation stricte de la réponse : ce qu'on ne comprend pas n'est jamais interprété comme un verdict. */\r\nexport function parseDecision(text: string): DecideResponse {\r\n  let v: unknown;\r\n  try {\r\n    v = JSON.parse(text);\r\n  } catch {\r\n    throw new ZarexClientError(\"bad_response\", \"Zarex engine returned invalid JSON\");\r\n  }\r\n  const o = v as Record<string, unknown> | null;\r\n  if (!o || typeof o !== \"object\" || typeof o.verdict !== \"string\" || !VERDICTS.has(o.verdict) || !Array.isArray(o.results)) {\r\n    throw new ZarexClientError(\"bad_response\", \"Zarex engine returned an unexpected response\");\r\n  }\r\n  const results = [];\r\n  for (const r of o.results as unknown[]) {\r\n    const x = r as Record<string, unknown> | null;\r\n    if (!x || typeof x !== \"object\" || typeof x.rule_type !== \"string\" || typeof x.verdict !== \"string\" || !VERDICTS.has(x.verdict)) {\r\n      throw new ZarexClientError(\"bad_response\", \"Zarex engine returned an unexpected rule result\");\r\n    }\r\n    results.push({\r\n      rule_type: x.rule_type,\r\n      verdict: x.verdict as Verdict,\r\n      is_dry_run: x.is_dry_run === true,\r\n      ...(x.reason && typeof x.reason === \"object\" ? { reason: x.reason as Record<string, unknown> } : {}),\r\n    });\r\n  }\r\n  const warnings = Array.isArray(o.warnings)\r\n    ? (o.warnings as unknown[]).filter((w): w is string => typeof w === \"string\" && /^[a-z_]{1,40}$/.test(w)).slice(0, 10)\r\n    : undefined;\r\n  const rawIp = o.ip as Record<string, unknown> | null | undefined;\r\n  const ipInfo =\r\n    rawIp && typeof rawIp === \"object\" && typeof rawIp.country === \"string\" && /^[A-Z]{2}$/.test(rawIp.country) && typeof rawIp.asn === \"string\" && /^AS\\d{1,10}$/.test(rawIp.asn)\r\n      ? { country: rawIp.country, asn: rawIp.asn }\r\n      : undefined;\r\n  return {\r\n    decision_id: typeof o.decision_id === \"string\" ? o.decision_id.slice(0, 64) : \"\",\r\n    verdict: o.verdict as Verdict,\r\n    results,\r\n    ...(typeof o.ttl_ms === \"number\" ? { ttl_ms: o.ttl_ms } : {}),\r\n    ...(warnings && warnings.length ? { warnings } : {}),\r\n    ...(ipInfo ? { ip: ipInfo } : {}),\r\n    ...(typeof o.ruleset_version === \"string\" && /^[A-Za-z0-9._+-]{1,64}$/.test(o.ruleset_version) ? { ruleset_version: o.ruleset_version } : {}),\r\n  };\r\n}"],"mappings":";AAoBO,IAAM,iBAAN,MAAqB;AAAA,EAClB,QAAe;AAAA,EACf,WAAW;AAAA,EACX,WAAW;AAAA,EACX,UAAU;AAAA,EACD;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,OAAuB,CAAC,GAAG;AACrC,SAAK,YAAY,KAAK,oBAAoB;AAC1C,SAAK,WAAW,KAAK,cAAc;AACnC,SAAK,MAAM,KAAK,OAAO,KAAK;AAAA,EAC9B;AAAA;AAAA,EAGA,QAAiB;AACf,QAAI,KAAK,UAAU,SAAU,QAAO;AACpC,QAAI,KAAK,UAAU,QAAQ;AACzB,UAAI,KAAK,IAAI,IAAI,KAAK,WAAW,KAAK,SAAU,QAAO;AACvD,WAAK,QAAQ;AACb,WAAK,UAAU;AAAA,IACjB;AAEA,QAAI,KAAK,QAAS,QAAO;AACzB,SAAK,UAAU;AACf,WAAO;AAAA,EACT;AAAA,EAEA,UAAgB;AACd,SAAK,WAAW;AAChB,SAAK,UAAU;AACf,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA,EAGA,UAAgB;AACd,SAAK,UAAU;AACf,QAAI,KAAK,UAAU,aAAa;AAC9B,WAAK,KAAK;AACV;AAAA,IACF;AACA,SAAK;AACL,QAAI,KAAK,YAAY,KAAK,UAAW,MAAK,KAAK;AAAA,EACjD;AAAA;AAAA,EAGA,UAAgB;AACd,SAAK,UAAU;AACf,QAAI,KAAK,UAAU,YAAa,MAAK,QAAQ;AAAA,EAC/C;AAAA,EAEQ,OAAa;AACnB,SAAK,QAAQ;AACb,SAAK,WAAW,KAAK,IAAI;AAAA,EAC3B;AAAA,EAEA,IAAI,SAAkB;AACpB,WAAO,KAAK,UAAU;AAAA,EACxB;AACF;;;AChEO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACjC;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,MAAuB,SAAiB,OAAiD,CAAC,GAAG;AACvG,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,QAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAClD,QAAI,KAAK,eAAe,OAAW,MAAK,aAAa,KAAK;AAAA,EAC5D;AACF;AAGO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACZO,IAAM,cAAc;AAC3B,IAAM,qBAAqB,MAAM;AACjC,IAAM,cAAc,oBAAI,IAAI,CAAC,aAAa,aAAa,SAAS,KAAK,CAAC;AAQ/D,IAAM,mBAAmB;AAEhC,SAAS,QAAQ,MAAkC;AACjD,MAAI;AACF,WAAO,OAAO,YAAY,cAAc,QAAQ,MAAM,IAAI,IAAI;AAAA,EAChE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,YAAY,KAAsB;AAChD,MAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,OAAO,CAAC,mBAAmB,KAAK,GAAG,GAAG;AACnG,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,eAAe,SAA6B,oBAAoB,OAAe;AAC7F,QAAM,MAAM,WAAW,QAAQ,WAAW,KAAK;AAC/C,MAAI;AACJ,MAAI;AACF,QAAI,IAAI,IAAI,GAAG;AAAA,EACjB,QAAQ;AACN,UAAM,IAAI,iBAAiB,sCAAsC;AAAA,EACnE;AACA,MAAI,EAAE,aAAa,YAAY,EAAE,aAAa,SAAS;AACrD,UAAM,IAAI,iBAAiB,gEAAgE;AAAA,EAC7F;AACA,MAAI,EAAE,YAAY,EAAE,UAAU;AAC5B,UAAM,IAAI,iBAAiB,gDAAgD;AAAA,EAC7E;AACA,MAAI,EAAE,aAAa,WAAW,CAAC,YAAY,IAAI,EAAE,QAAQ,KAAK,CAAC,mBAAmB;AAChF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,IAAE,SAAS;AACX,IAAE,OAAO;AACT,SAAO,EAAE,SAAS,EAAE,QAAQ,QAAQ,EAAE;AACxC;AAEO,SAAS,aAAa,MAAkC;AAC7D,QAAM,MAAM,YAAY,KAAK,GAAG;AAChC,QAAM,OAAO,eAAe,KAAK,SAAS,KAAK,iBAAiB;AAChE,QAAM,YAAY,KAAK,aAAa;AACpC,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,YAAY,MAAM,YAAY,KAAQ;AACvE,UAAM,IAAI,iBAAiB,kDAAkD;AAAA,EAC/E;AACA,QAAM,UAAU,KAAK,UAAU,OAAO,UAAU,aAAa,QAAQ;AACrE,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,iBAAiB,qFAAqF;AAAA,EAClH;AACA,QAAM,UAAU,KAAK,YAAY,QAAQ,OAAO,IAAI,eAAe,KAAK,WAAW,CAAC,CAAC;AACrF,QAAM,MAAM,GAAG,IAAI;AACnB,QAAM,UAAU,KAAK,cAAc;AAEnC,iBAAe,OAAO,SAAiD;AACrE,QAAI,WAAW,CAAC,QAAQ,MAAM,GAAG;AAC/B,YAAM,IAAI,iBAAiB,gBAAgB,0DAA0D;AAAA,IACvG;AAEA,UAAM,OAAO,IAAI,gBAAgB;AACjC,UAAM,QAAQ,WAAW,MAAM,KAAK,MAAM,GAAG,SAAS;AACtD,QAAI,UAAsC;AAC1C,QAAI;AACF,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,QAAS,KAAK;AAAA,UACxB,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,QAAQ;AAAA,YACR,eAAe,UAAU,GAAG;AAAA,YAC5B,cAAc,YAAY,OAAO;AAAA,UACnC;AAAA,UACA,MAAM,KAAK,UAAU,OAAO;AAAA,UAC5B,QAAQ,KAAK;AAAA;AAAA;AAAA,UAGb,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,kBAAU;AACV,YAAI,KAAK,OAAO,QAAS,OAAM,IAAI,iBAAiB,WAAW,sCAAsC,SAAS,KAAK;AAEnH,cAAM,IAAI,iBAAiB,WAAW,6BAA6B,QAAQ,GAAG,CAAC,GAAG;AAAA,MACpF;AAEA,UAAI,IAAI,SAAS,oBAAqB,IAAI,UAAU,OAAO,IAAI,SAAS,KAAM;AAC5E,kBAAU;AACV,aAAK,IAAI,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAC7C,cAAM,IAAI,iBAAiB,WAAW,gDAAgD;AAAA,MACxF;AAEA,YAAM,OAAO,MAAM,WAAW,KAAK,oBAAoB,KAAK,MAAM,EAAE,MAAM,MAAM;AAC9E,kBAAU;AACV,YAAI,KAAK,OAAO,QAAS,OAAM,IAAI,iBAAiB,WAAW,sCAAsC,SAAS,KAAK;AACnH,cAAM,IAAI,iBAAiB,gBAAgB,yCAAyC;AAAA,MACtF,CAAC;AAED,UAAI,IAAI,WAAW,KAAK;AACtB,cAAM,aAAa,kBAAkB,IAAI;AACzC,cAAM,OAAO,aAAa,IAAI,MAAM;AACpC,kBAAU,SAAS,iBAAiB,UAAU;AAC9C,cAAM,IAAI,iBAAiB,MAAM,8BAA8B,IAAI,MAAM,GAAG,aAAa,KAAK,UAAU,MAAM,EAAE,IAAI;AAAA,UAClH,QAAQ,IAAI;AAAA,UACZ,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACrC,CAAC;AAAA,MACH;AAOA,UAAI;AACJ,UAAI;AACF,iBAAS,cAAc,IAAI;AAAA,MAC7B,SAAS,KAAK;AACZ,kBAAU;AACV,cAAM;AAAA,MACR;AACA,gBAAU;AACV,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAClB,UAAI,SAAS;AACX,YAAI,YAAY,KAAM,SAAQ,QAAQ;AAAA,iBAC7B,YAAY,QAAS,SAAQ,QAAQ;AAAA,YACzC,SAAQ,QAAQ;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO;AAClB;AAEA,SAAS,QAAQ,KAAsB;AACrC,QAAM,MAAM,eAAe,QAAQ,GAAG,IAAI,IAAI,IAAI,IAAI,OAAO,IAAK,IAAsC,OAAO,QAAQ,EAAE,KAAK;AAC9H,MAAI,YAAY,KAAK,GAAG,EAAG,QAAO;AAClC,MAAI,wBAAwB,KAAK,GAAG,EAAG,QAAO;AAC9C,MAAI,mCAAmC,KAAK,GAAG,EAAG,QAAO;AACzD,MAAI,4BAA4B,KAAK,GAAG,EAAG,QAAO;AAClD,SAAO;AACT;AAEA,SAAS,aAAa,QAA0C;AAC9D,MAAI,WAAW,IAAK,QAAO;AAC3B,MAAI,WAAW,IAAK,QAAO;AAC3B,MAAI,WAAW,IAAK,QAAO;AAC3B,MAAI,UAAU,IAAK,QAAO;AAC1B,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAkC;AAC3D,MAAI;AACF,UAAM,OAAQ,KAAK,MAAM,IAAI,GAAsC,OAAO;AAC1E,WAAO,OAAO,SAAS,YAAY,iBAAiB,KAAK,IAAI,IAAI,OAAO;AAAA,EAC1E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAe,WAAW,KAAe,KAAa,QAAsC;AAC1F,QAAM,WAAW,OAAO,IAAI,QAAQ,IAAI,gBAAgB,CAAC;AACzD,MAAI,OAAO,SAAS,QAAQ,KAAK,WAAW,IAAK,OAAM,IAAI,MAAM,WAAW;AAC5E,MAAI,CAAC,IAAI,KAAM,QAAO,MAAM,IAAI,KAAK;AACrC,QAAM,SAAS,IAAI,KAAK,UAAU;AAClC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,aAAS;AACP,QAAI,OAAO,SAAS;AAClB,YAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,YAAM,IAAI,MAAM,SAAS;AAAA,IAC3B;AACA,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,aAAS,MAAM;AACf,QAAI,QAAQ,KAAK;AACf,YAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,YAAM,IAAI,MAAM,WAAW;AAAA,IAC7B;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,MAAM;AACV,aAAW,KAAK,QAAQ;AACtB,QAAI,IAAI,GAAG,GAAG;AACd,WAAO,EAAE;AAAA,EACX;AACA,SAAO,IAAI,YAAY,EAAE,OAAO,GAAG;AACrC;AAEA,IAAM,WAAgC,oBAAI,IAAa,CAAC,SAAS,QAAQ,OAAO,CAAC;AAG1E,SAAS,cAAc,MAA8B;AAC1D,MAAI;AACJ,MAAI;AACF,QAAI,KAAK,MAAM,IAAI;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI,iBAAiB,gBAAgB,oCAAoC;AAAA,EACjF;AACA,QAAM,IAAI;AACV,MAAI,CAAC,KAAK,OAAO,MAAM,YAAY,OAAO,EAAE,YAAY,YAAY,CAAC,SAAS,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,QAAQ,EAAE,OAAO,GAAG;AACzH,UAAM,IAAI,iBAAiB,gBAAgB,8CAA8C;AAAA,EAC3F;AACA,QAAM,UAAU,CAAC;AACjB,aAAW,KAAK,EAAE,SAAsB;AACtC,UAAM,IAAI;AACV,QAAI,CAAC,KAAK,OAAO,MAAM,YAAY,OAAO,EAAE,cAAc,YAAY,OAAO,EAAE,YAAY,YAAY,CAAC,SAAS,IAAI,EAAE,OAAO,GAAG;AAC/H,YAAM,IAAI,iBAAiB,gBAAgB,iDAAiD;AAAA,IAC9F;AACA,YAAQ,KAAK;AAAA,MACX,WAAW,EAAE;AAAA,MACb,SAAS,EAAE;AAAA,MACX,YAAY,EAAE,eAAe;AAAA,MAC7B,GAAI,EAAE,UAAU,OAAO,EAAE,WAAW,WAAW,EAAE,QAAQ,EAAE,OAAkC,IAAI,CAAC;AAAA,IACpG,CAAC;AAAA,EACH;AACA,QAAM,WAAW,MAAM,QAAQ,EAAE,QAAQ,IACpC,EAAE,SAAuB,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,iBAAiB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,EAAE,IACnH;AACJ,QAAM,QAAQ,EAAE;AAChB,QAAM,SACJ,SAAS,OAAO,UAAU,YAAY,OAAO,MAAM,YAAY,YAAY,aAAa,KAAK,MAAM,OAAO,KAAK,OAAO,MAAM,QAAQ,YAAY,eAAe,KAAK,MAAM,GAAG,IACzK,EAAE,SAAS,MAAM,SAAS,KAAK,MAAM,IAAI,IACzC;AACN,SAAO;AAAA,IACL,aAAa,OAAO,EAAE,gBAAgB,WAAW,EAAE,YAAY,MAAM,GAAG,EAAE,IAAI;AAAA,IAC9E,SAAS,EAAE;AAAA,IACX;AAAA,IACA,GAAI,OAAO,EAAE,WAAW,WAAW,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3D,GAAI,YAAY,SAAS,SAAS,EAAE,SAAS,IAAI,CAAC;AAAA,IAClD,GAAI,SAAS,EAAE,IAAI,OAAO,IAAI,CAAC;AAAA,IAC/B,GAAI,OAAO,EAAE,oBAAoB,YAAY,0BAA0B,KAAK,EAAE,eAAe,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,IAAI,CAAC;AAAA,EAC7I;AACF;","names":[]}

package/package.json

@@ -1,6 +1,32 @@
 {
   "name": "@zarex/client",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "description": "Zarex — client HTTP du Decision Engine (fetch, délai, disjoncteur, fail-open)",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup"
+  }
 }