alepha 0.13.1 → 0.13.2

package/dist/server-rate-limit/index.d.ts

@@ -1,5 +1,5 @@
 import * as alepha1 from "alepha";
-import { Descriptor, KIND, Static } from "alepha";
+import { KIND, Primitive, Static } from "alepha";
 import { ServerRequest, ServerRouterProvider } from "alepha/server";
 import * as alepha_cache0 from "alepha/cache";
 import * as alepha_logger0 from "alepha/logger";
@@ -34,7 +34,7 @@ declare class ServerRateLimitProvider {
     RATE_LIMIT_WINDOW_MS: number;
     RATE_LIMIT_MAX_REQUESTS: number;
   };
-  protected readonly cache: alepha_cache0.CacheDescriptorFn<RateLimitData, any[]>;
+  protected readonly cache: alepha_cache0.CachePrimitiveFn<RateLimitData, any[]>;
   protected readonly globalOptions: Readonly<{
     windowMs?: number | undefined;
     max?: number | undefined;
@@ -44,18 +44,18 @@ declare class ServerRateLimitProvider {
   /**
    * Registered rate limit configurations with their path patterns
    */
-  readonly registeredConfigs: RateLimitDescriptorOptions[];
+  readonly registeredConfigs: RateLimitPrimitiveOptions[];
   /**
-   * Register a rate limit configuration (called by descriptors)
+   * Register a rate limit configuration (called by primitives)
    */
-  registerRateLimit(config: RateLimitDescriptorOptions): void;
-  protected readonly onStart: alepha1.HookDescriptor<"start">;
-  readonly onRequest: alepha1.HookDescriptor<"server:onRequest">;
-  readonly onActionRequest: alepha1.HookDescriptor<"action:onRequest">;
+  registerRateLimit(config: RateLimitPrimitiveOptions): void;
+  protected readonly onStart: alepha1.HookPrimitive<"start">;
+  readonly onRequest: alepha1.HookPrimitive<"server:onRequest">;
+  readonly onActionRequest: alepha1.HookPrimitive<"action:onRequest">;
   /**
    * Build complete rate limit options by merging with global defaults
    */
-  protected buildRateLimitOptions(config: RateLimitDescriptorOptions): RateLimitOptions;
+  protected buildRateLimitOptions(config: RateLimitPrimitiveOptions): RateLimitOptions;
   /**
    * Set rate limit headers on the response
    */
@@ -70,10 +70,10 @@ interface RateLimitData {
   hits: number[];
 }
 //#endregion
-//#region src/server-rate-limit/descriptors/$rateLimit.d.ts
+//#region src/server-rate-limit/primitives/$rateLimit.d.ts
 /**
  * Declares rate limiting for server routes or custom usage.
- * This descriptor provides methods to check rate limits and configure behavior
+ * This primitive provides methods to check rate limits and configure behavior
  * within the server request/response cycle.
  *
  * @example
@@ -98,33 +98,33 @@ interface RateLimitData {
  * ```
  */
 declare const $rateLimit: {
-  (options?: RateLimitDescriptorOptions): AbstractRateLimitDescriptor;
-  [KIND]: typeof RateLimitDescriptor;
+  (options?: RateLimitPrimitiveOptions): AbstractRateLimitPrimitive;
+  [KIND]: typeof RateLimitPrimitive;
 };
-interface RateLimitDescriptorOptions extends RateLimitOptions {
+interface RateLimitPrimitiveOptions extends RateLimitOptions {
   /** Name identifier for this rate limit (default: property key) */
   name?: string;
   /** Path patterns to match (supports wildcards like /api/*) */
   paths?: string[];
 }
-interface AbstractRateLimitDescriptor {
+interface AbstractRateLimitPrimitive {
   readonly name: string;
-  readonly options: RateLimitDescriptorOptions;
+  readonly options: RateLimitPrimitiveOptions;
   check(request: ServerRequest, options?: RateLimitOptions): Promise<RateLimitResult>;
 }
-declare class RateLimitDescriptor extends Descriptor<RateLimitDescriptorOptions> implements AbstractRateLimitDescriptor {
+declare class RateLimitPrimitive extends Primitive<RateLimitPrimitiveOptions> implements AbstractRateLimitPrimitive {
   protected readonly serverRateLimitProvider: ServerRateLimitProvider;
   get name(): string;
   protected onInit(): void;
   /**
-   * Checks rate limit for the given request using this descriptor's configuration.
+   * Checks rate limit for the given request using this primitive's configuration.
    */
   check(request: ServerRequest, options?: RateLimitOptions): Promise<RateLimitResult>;
 }
 //#endregion
 //#region src/server-rate-limit/index.d.ts
 declare module "alepha/server" {
-  interface ActionDescriptorOptions<TConfig> {
+  interface ActionPrimitiveOptions<TConfig> {
     /**
      * Rate limiting configuration for this action.
      * When specified, the action will be rate limited according to these settings.
@@ -155,8 +155,8 @@ interface RateLimitOptions {
  * Provides rate limiting capabilities for server routes and actions with configurable limits and windows.
  *
  * The server-rate-limit module enables per-route and per-action rate limiting using either:
- * - The `$rateLimit` descriptor with `paths` option for path-based rate limiting
- * - The `rateLimit` option in action descriptors for action-specific limiting
+ * - The `$rateLimit` primitive with `paths` option for path-based rate limiting
+ * - The `rateLimit` option in action primitives for action-specific limiting
  *
  * It offers sliding window rate limiting, custom key generation, and seamless integration with server routes.
  *
@@ -179,5 +179,5 @@ interface RateLimitOptions {
  */
 declare const AlephaServerRateLimit: alepha1.Service<alepha1.Module>;
 //#endregion
-export { $rateLimit, AbstractRateLimitDescriptor, AlephaServerRateLimit, RateLimitAtomOptions, RateLimitDescriptor, RateLimitDescriptorOptions, RateLimitOptions, RateLimitResult, ServerRateLimitProvider, rateLimitOptions };
+export { $rateLimit, AbstractRateLimitPrimitive, AlephaServerRateLimit, RateLimitAtomOptions, RateLimitOptions, RateLimitPrimitive, RateLimitPrimitiveOptions, RateLimitResult, ServerRateLimitProvider, rateLimitOptions };
 //# sourceMappingURL=index.d.ts.map

package/dist/server-rate-limit/index.js

@@ -1,4 +1,4 @@
-import { $atom, $env, $hook, $inject, $module, $use, Descriptor, KIND, createDescriptor, t } from "alepha";
+import { $atom, $env, $hook, $inject, $module, $use, KIND, Primitive, createPrimitive, t } from "alepha";
 import { AlephaServer, HttpError, ServerRouterProvider } from "alepha/server";
 import { $cache } from "alepha/cache";
 import { $logger } from "alepha/logger";
@@ -41,7 +41,7 @@ var ServerRateLimitProvider = class {
 	*/
 	registeredConfigs = [];
 	/**
-	* Register a rate limit configuration (called by descriptors)
+	* Register a rate limit configuration (called by primitives)
 	*/
 	registerRateLimit(config) {
 		this.registeredConfigs.push(config);
@@ -147,10 +147,10 @@ var ServerRateLimitProvider = class {
 };
 
 //#endregion
-//#region src/server-rate-limit/descriptors/$rateLimit.ts
+//#region src/server-rate-limit/primitives/$rateLimit.ts
 /**
 * Declares rate limiting for server routes or custom usage.
-* This descriptor provides methods to check rate limits and configure behavior
+* This primitive provides methods to check rate limits and configure behavior
 * within the server request/response cycle.
 *
 * @example
@@ -175,9 +175,9 @@ var ServerRateLimitProvider = class {
 * ```
 */
 const $rateLimit = (options = {}) => {
-	return createDescriptor(RateLimitDescriptor, options);
+	return createPrimitive(RateLimitPrimitive, options);
 };
-var RateLimitDescriptor = class extends Descriptor {
+var RateLimitPrimitive = class extends Primitive {
 	serverRateLimitProvider = $inject(ServerRateLimitProvider);
 	get name() {
 		return this.options.name ?? `${this.config.propertyKey}`;
@@ -186,7 +186,7 @@ var RateLimitDescriptor = class extends Descriptor {
 		this.serverRateLimitProvider.registerRateLimit(this.options);
 	}
 	/**
-	* Checks rate limit for the given request using this descriptor's configuration.
+	* Checks rate limit for the given request using this primitive's configuration.
 	*/
 	async check(request, options) {
 		const mergedOptions = {
@@ -196,7 +196,7 @@ var RateLimitDescriptor = class extends Descriptor {
 		return this.serverRateLimitProvider.checkLimit(request, mergedOptions);
 	}
 };
-$rateLimit[KIND] = RateLimitDescriptor;
+$rateLimit[KIND] = RateLimitPrimitive;
 
 //#endregion
 //#region src/server-rate-limit/index.ts
@@ -204,8 +204,8 @@ $rateLimit[KIND] = RateLimitDescriptor;
 * Provides rate limiting capabilities for server routes and actions with configurable limits and windows.
 *
 * The server-rate-limit module enables per-route and per-action rate limiting using either:
-* - The `$rateLimit` descriptor with `paths` option for path-based rate limiting
-* - The `rateLimit` option in action descriptors for action-specific limiting
+* - The `$rateLimit` primitive with `paths` option for path-based rate limiting
+* - The `rateLimit` option in action primitives for action-specific limiting
 *
 * It offers sliding window rate limiting, custom key generation, and seamless integration with server routes.
 *
@@ -228,10 +228,10 @@ $rateLimit[KIND] = RateLimitDescriptor;
 */
 const AlephaServerRateLimit = $module({
 	name: "alepha.server.rate-limit",
-	descriptors: [$rateLimit],
+	primitives: [$rateLimit],
 	services: [AlephaServer, ServerRateLimitProvider]
 });
 
 //#endregion
-export { $rateLimit, AlephaServerRateLimit, RateLimitDescriptor, ServerRateLimitProvider, rateLimitOptions };
+export { $rateLimit, AlephaServerRateLimit, RateLimitPrimitive, ServerRateLimitProvider, rateLimitOptions };
 //# sourceMappingURL=index.js.map

package/dist/server-rate-limit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["result: RateLimitResult"],"sources":["../../src/server-rate-limit/providers/ServerRateLimitProvider.ts","../../src/server-rate-limit/descriptors/$rateLimit.ts","../../src/server-rate-limit/index.ts"],"sourcesContent":["import { $atom, $env, $hook, $inject, $use, type Static, t } from \"alepha\";\nimport { $cache } from \"alepha/cache\";\nimport { $logger } from \"alepha/logger\";\nimport {\n  HttpError,\n  type ServerRequest,\n  ServerRouterProvider,\n} from \"alepha/server\";\nimport type { RateLimitDescriptorOptions } from \"../descriptors/$rateLimit.ts\";\nimport type { RateLimitOptions } from \"../index.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface RateLimitResult {\n  allowed: boolean;\n  limit: number;\n  remaining: number;\n  resetTime: number;\n  retryAfter?: number;\n}\n\n/**\n * Rate limit configuration atom (global defaults)\n */\nexport const rateLimitOptions = $atom({\n  name: \"alepha.server.rate-limit.options\",\n  schema: t.object({\n    windowMs: t.optional(\n      t.number({\n        description: \"Window duration in milliseconds\",\n      }),\n    ),\n    max: t.optional(\n      t.number({\n        description: \"Maximum number of requests per window\",\n      }),\n    ),\n    skipFailedRequests: t.optional(\n      t.boolean({\n        description: \"Skip rate limiting for failed requests\",\n      }),\n    ),\n    skipSuccessfulRequests: t.optional(\n      t.boolean({\n        description: \"Skip rate limiting for successful requests\",\n      }),\n    ),\n  }),\n  default: {},\n});\n\nexport type RateLimitAtomOptions = Static<typeof rateLimitOptions.schema>;\n\ndeclare module \"alepha\" {\n  interface State {\n    [rateLimitOptions.key]: RateLimitAtomOptions;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nconst envSchema = t.object({\n  RATE_LIMIT_WINDOW_MS: t.number({\n    default: 15 * 60 * 1000, // 15 minutes\n    description: \"Rate limit window in milliseconds\",\n  }),\n  RATE_LIMIT_MAX_REQUESTS: t.number({\n    default: 100,\n    description: \"Maximum requests per window\",\n  }),\n});\n\nexport class ServerRateLimitProvider {\n  protected readonly log = $logger();\n  protected readonly serverRouterProvider = $inject(ServerRouterProvider);\n  protected readonly env = $env(envSchema);\n\n  protected readonly cache = $cache<RateLimitData>({\n    name: \"server-rate-limit\",\n    ttl: [this.env.RATE_LIMIT_WINDOW_MS, \"milliseconds\"],\n  });\n\n  protected readonly globalOptions = $use(rateLimitOptions);\n\n  /**\n   * Registered rate limit configurations with their path patterns\n   */\n  public readonly registeredConfigs: RateLimitDescriptorOptions[] = [];\n\n  /**\n   * Register a rate limit configuration (called by descriptors)\n   */\n  public registerRateLimit(config: RateLimitDescriptorOptions): void {\n    this.registeredConfigs.push(config);\n  }\n\n  protected readonly onStart = $hook({\n    on: \"start\",\n    handler: async () => {\n      // Apply path-specific rate limit configs to routes\n      for (const config of this.registeredConfigs) {\n        if (config.paths) {\n          for (const pattern of config.paths) {\n            const matchedRoutes = this.serverRouterProvider.getRoutes(pattern);\n            for (const route of matchedRoutes) {\n              route.rateLimit = this.buildRateLimitOptions(config);\n            }\n          }\n        }\n      }\n\n      if (this.registeredConfigs.length > 0) {\n        this.log.info(\n          `Initialized with ${this.registeredConfigs.length} registered rate-limit configurations.`,\n        );\n      }\n    },\n  });\n\n  public readonly onRequest = $hook({\n    on: \"server:onRequest\",\n    handler: async ({ route, request }) => {\n      // Use route-specific rate limit if defined, otherwise use global options\n      const rateLimitConfig = route.rateLimit ?? this.globalOptions;\n\n      // Skip if no rate limiting configured\n      if (!rateLimitConfig.max && !rateLimitConfig.windowMs) {\n        return;\n      }\n\n      const result = await this.checkLimit(request, rateLimitConfig);\n      this.setRateLimitHeaders(request, result);\n\n      if (!result.allowed) {\n        throw new HttpError({\n          status: 429,\n          message: \"Too Many Requests\",\n        });\n      }\n    },\n  });\n\n  public readonly onActionRequest = $hook({\n    on: \"action:onRequest\",\n    handler: async ({ action, request }) => {\n      // Check if this action has rate limiting enabled\n      const rateLimit = action.options?.rateLimit;\n      if (!rateLimit) {\n        return; // No rate limiting for this action\n      }\n\n      const result = await this.checkLimit(request, rateLimit);\n\n      if (!result.allowed) {\n        // Actions are internal - don't set HTTP headers\n        // Only throw error to prevent action execution\n        throw new HttpError({\n          status: 429,\n          message: \"Too Many Requests\",\n        });\n      }\n\n      // Action allowed - no headers to set since actions are internal\n    },\n  });\n\n  /**\n   * Build complete rate limit options by merging with global defaults\n   */\n  protected buildRateLimitOptions(\n    config: RateLimitDescriptorOptions,\n  ): RateLimitOptions {\n    return {\n      max: config.max ?? this.globalOptions.max,\n      windowMs: config.windowMs ?? this.globalOptions.windowMs,\n      keyGenerator: config.keyGenerator,\n      skipFailedRequests:\n        config.skipFailedRequests ?? this.globalOptions.skipFailedRequests,\n      skipSuccessfulRequests:\n        config.skipSuccessfulRequests ??\n        this.globalOptions.skipSuccessfulRequests,\n    };\n  }\n\n  /**\n   * Set rate limit headers on the response\n   */\n  protected setRateLimitHeaders(\n    request: ServerRequest,\n    result: RateLimitResult,\n  ): void {\n    request.reply.setHeader(\"X-RateLimit-Limit\", result.limit.toString());\n    request.reply.setHeader(\n      \"X-RateLimit-Remaining\",\n      result.remaining.toString(),\n    );\n    request.reply.setHeader(\n      \"X-RateLimit-Reset\",\n      Math.ceil(result.resetTime / 1000).toString(),\n    );\n\n    if (!result.allowed && result.retryAfter) {\n      request.reply.setHeader(\"Retry-After\", result.retryAfter.toString());\n    }\n  }\n\n  public async checkLimit(\n    req: ServerRequest,\n    options: RateLimitOptions = {},\n  ): Promise<RateLimitResult> {\n    const windowMs = options.windowMs ?? this.env.RATE_LIMIT_WINDOW_MS;\n    const max = options.max ?? this.env.RATE_LIMIT_MAX_REQUESTS;\n    const key = this.generateKey(req);\n\n    const now = Date.now();\n    const windowStart = now - windowMs;\n\n    // Get current rate limit data\n    const currentData = (await this.cache.get(key)) || {\n      count: 0,\n      windowStart: now,\n      hits: [],\n    };\n\n    // Clean old hits outside the current window\n    const validHits = currentData.hits.filter(\n      (hit: number) => hit >= windowStart,\n    );\n\n    // Check if limit exceeded\n    const allowed = validHits.length < max;\n    const remaining = Math.max(0, max - validHits.length);\n    const resetTime = Math.max(...validHits, windowStart) + windowMs;\n\n    // If allowed, record this request\n    if (allowed) {\n      validHits.push(now);\n      await this.cache.set(key, {\n        count: validHits.length,\n        windowStart: Math.min(currentData.windowStart, windowStart),\n        hits: validHits,\n      });\n    }\n\n    const result: RateLimitResult = {\n      allowed,\n      limit: max,\n      remaining: allowed ? remaining - 1 : remaining,\n      resetTime,\n    };\n\n    if (!allowed) {\n      result.retryAfter = Math.ceil((resetTime - now) / 1000);\n    }\n\n    return result;\n  }\n\n  protected generateKey(req: ServerRequest): string {\n    // Default to IP-based rate limiting\n    const ip = this.getClientIP(req);\n    return `ip:${ip}`;\n  }\n\n  protected getClientIP(req: ServerRequest): string {\n    // Check x-forwarded-for header first (for proxies/load balancers)\n    const forwarded = req.headers?.[\"x-forwarded-for\"];\n    if (forwarded) {\n      // x-forwarded-for can contain multiple IPs, get the first one (original client)\n      const firstIp = forwarded.split(\",\")[0].trim();\n      if (firstIp) return firstIp;\n    }\n\n    return req.ip || \"unknown\";\n  }\n}\n\ninterface RateLimitData {\n  count: number;\n  windowStart: number;\n  hits: number[];\n}\n","import { $inject, createDescriptor, Descriptor, KIND } from \"alepha\";\nimport type { ServerRequest } from \"alepha/server\";\nimport type { RateLimitOptions } from \"../index.ts\";\nimport {\n  type RateLimitResult,\n  ServerRateLimitProvider,\n} from \"../providers/ServerRateLimitProvider.ts\";\n\n/**\n * Declares rate limiting for server routes or custom usage.\n * This descriptor provides methods to check rate limits and configure behavior\n * within the server request/response cycle.\n *\n * @example\n * ```ts\n * class ApiService {\n *   // Apply rate limiting to specific paths\n *   apiRateLimit = $rateLimit({\n *     paths: [\"/api/*\"],\n *     max: 100,\n *     windowMs: 15 * 60 * 1000, // 15 minutes\n *   });\n *\n *   // Or use check() method for manual rate limiting\n *   customAction = $action({\n *     handler: async (req) => {\n *       const result = await this.apiRateLimit.check(req);\n *       if (!result.allowed) throw new Error(\"Rate limited\");\n *       return \"ok\";\n *     },\n *   });\n * }\n * ```\n */\nexport const $rateLimit = (\n  options: RateLimitDescriptorOptions = {},\n): AbstractRateLimitDescriptor => {\n  return createDescriptor(RateLimitDescriptor, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface RateLimitDescriptorOptions extends RateLimitOptions {\n  /** Name identifier for this rate limit (default: property key) */\n  name?: string;\n  /** Path patterns to match (supports wildcards like /api/*) */\n  paths?: string[];\n}\n\nexport interface AbstractRateLimitDescriptor {\n  readonly name: string;\n  readonly options: RateLimitDescriptorOptions;\n  check(\n    request: ServerRequest,\n    options?: RateLimitOptions,\n  ): Promise<RateLimitResult>;\n}\n\nexport class RateLimitDescriptor\n  extends Descriptor<RateLimitDescriptorOptions>\n  implements AbstractRateLimitDescriptor\n{\n  protected readonly serverRateLimitProvider = $inject(ServerRateLimitProvider);\n\n  public get name(): string {\n    return this.options.name ?? `${this.config.propertyKey}`;\n  }\n\n  protected onInit() {\n    // Register this rate limit configuration with the provider\n    this.serverRateLimitProvider.registerRateLimit(this.options);\n  }\n\n  /**\n   * Checks rate limit for the given request using this descriptor's configuration.\n   */\n  public async check(\n    request: ServerRequest,\n    options?: RateLimitOptions,\n  ): Promise<RateLimitResult> {\n    const mergedOptions = { ...this.options, ...options };\n    return this.serverRateLimitProvider.checkLimit(request, mergedOptions);\n  }\n}\n\n$rateLimit[KIND] = RateLimitDescriptor;\n","import { $module } from \"alepha\";\nimport { AlephaServer } from \"alepha/server\";\nimport { $rateLimit } from \"./descriptors/$rateLimit.ts\";\nimport { ServerRateLimitProvider } from \"./providers/ServerRateLimitProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./descriptors/$rateLimit.ts\";\nexport * from \"./providers/ServerRateLimitProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\ndeclare module \"alepha/server\" {\n  interface ActionDescriptorOptions<TConfig> {\n    /**\n     * Rate limiting configuration for this action.\n     * When specified, the action will be rate limited according to these settings.\n     */\n    rateLimit?: RateLimitOptions;\n  }\n\n  interface ServerRoute {\n    /**\n     * Route-specific rate limit configuration.\n     * If set, overrides the global rate limit options for this route.\n     */\n    rateLimit?: RateLimitOptions;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface RateLimitOptions {\n  /** Maximum number of requests per window (default: 100) */\n  max?: number;\n  /** Window duration in milliseconds (default: 15 minutes) */\n  windowMs?: number;\n  /** Custom key generator function */\n  keyGenerator?: (req: any) => string;\n  /** Skip rate limiting for failed requests */\n  skipFailedRequests?: boolean;\n  /** Skip rate limiting for successful requests */\n  skipSuccessfulRequests?: boolean;\n}\n\n/**\n * Provides rate limiting capabilities for server routes and actions with configurable limits and windows.\n *\n * The server-rate-limit module enables per-route and per-action rate limiting using either:\n * - The `$rateLimit` descriptor with `paths` option for path-based rate limiting\n * - The `rateLimit` option in action descriptors for action-specific limiting\n *\n * It offers sliding window rate limiting, custom key generation, and seamless integration with server routes.\n *\n * @example\n * ```ts\n * import { $rateLimit, AlephaServerRateLimit } from \"alepha/server-rate-limit\";\n *\n * class ApiService {\n *   // Path-specific rate limiting\n *   apiRateLimit = $rateLimit({\n *     paths: [\"/api/*\"],\n *     max: 100,\n *     windowMs: 15 * 60 * 1000, // 15 minutes\n *   });\n * }\n * ```\n *\n * @see {@link $rateLimit}\n * @module alepha.server.rate-limit\n */\nexport const AlephaServerRateLimit = $module({\n  name: \"alepha.server.rate-limit\",\n  descriptors: [$rateLimit],\n  services: [AlephaServer, ServerRateLimitProvider],\n});\n"],"mappings":";;;;;;;;;AAwBA,MAAa,mBAAmB,MAAM;CACpC,MAAM;CACN,QAAQ,EAAE,OAAO;EACf,UAAU,EAAE,SACV,EAAE,OAAO,EACP,aAAa,mCACd,CAAC,CACH;EACD,KAAK,EAAE,SACL,EAAE,OAAO,EACP,aAAa,yCACd,CAAC,CACH;EACD,oBAAoB,EAAE,SACpB,EAAE,QAAQ,EACR,aAAa,0CACd,CAAC,CACH;EACD,wBAAwB,EAAE,SACxB,EAAE,QAAQ,EACR,aAAa,8CACd,CAAC,CACH;EACF,CAAC;CACF,SAAS,EAAE;CACZ,CAAC;AAYF,MAAM,YAAY,EAAE,OAAO;CACzB,sBAAsB,EAAE,OAAO;EAC7B,SAAS,MAAU;EACnB,aAAa;EACd,CAAC;CACF,yBAAyB,EAAE,OAAO;EAChC,SAAS;EACT,aAAa;EACd,CAAC;CACH,CAAC;AAEF,IAAa,0BAAb,MAAqC;CACnC,AAAmB,MAAM,SAAS;CAClC,AAAmB,uBAAuB,QAAQ,qBAAqB;CACvE,AAAmB,MAAM,KAAK,UAAU;CAExC,AAAmB,QAAQ,OAAsB;EAC/C,MAAM;EACN,KAAK,CAAC,KAAK,IAAI,sBAAsB,eAAe;EACrD,CAAC;CAEF,AAAmB,gBAAgB,KAAK,iBAAiB;;;;CAKzD,AAAgB,oBAAkD,EAAE;;;;CAKpE,AAAO,kBAAkB,QAA0C;AACjE,OAAK,kBAAkB,KAAK,OAAO;;CAGrC,AAAmB,UAAU,MAAM;EACjC,IAAI;EACJ,SAAS,YAAY;AAEnB,QAAK,MAAM,UAAU,KAAK,kBACxB,KAAI,OAAO,MACT,MAAK,MAAM,WAAW,OAAO,OAAO;IAClC,MAAM,gBAAgB,KAAK,qBAAqB,UAAU,QAAQ;AAClE,SAAK,MAAM,SAAS,cAClB,OAAM,YAAY,KAAK,sBAAsB,OAAO;;AAM5D,OAAI,KAAK,kBAAkB,SAAS,EAClC,MAAK,IAAI,KACP,oBAAoB,KAAK,kBAAkB,OAAO,wCACnD;;EAGN,CAAC;CAEF,AAAgB,YAAY,MAAM;EAChC,IAAI;EACJ,SAAS,OAAO,EAAE,OAAO,cAAc;GAErC,MAAM,kBAAkB,MAAM,aAAa,KAAK;AAGhD,OAAI,CAAC,gBAAgB,OAAO,CAAC,gBAAgB,SAC3C;GAGF,MAAM,SAAS,MAAM,KAAK,WAAW,SAAS,gBAAgB;AAC9D,QAAK,oBAAoB,SAAS,OAAO;AAEzC,OAAI,CAAC,OAAO,QACV,OAAM,IAAI,UAAU;IAClB,QAAQ;IACR,SAAS;IACV,CAAC;;EAGP,CAAC;CAEF,AAAgB,kBAAkB,MAAM;EACtC,IAAI;EACJ,SAAS,OAAO,EAAE,QAAQ,cAAc;GAEtC,MAAM,YAAY,OAAO,SAAS;AAClC,OAAI,CAAC,UACH;AAKF,OAAI,EAFW,MAAM,KAAK,WAAW,SAAS,UAAU,EAE5C,QAGV,OAAM,IAAI,UAAU;IAClB,QAAQ;IACR,SAAS;IACV,CAAC;;EAKP,CAAC;;;;CAKF,AAAU,sBACR,QACkB;AAClB,SAAO;GACL,KAAK,OAAO,OAAO,KAAK,cAAc;GACtC,UAAU,OAAO,YAAY,KAAK,cAAc;GAChD,cAAc,OAAO;GACrB,oBACE,OAAO,sBAAsB,KAAK,cAAc;GAClD,wBACE,OAAO,0BACP,KAAK,cAAc;GACtB;;;;;CAMH,AAAU,oBACR,SACA,QACM;AACN,UAAQ,MAAM,UAAU,qBAAqB,OAAO,MAAM,UAAU,CAAC;AACrE,UAAQ,MAAM,UACZ,yBACA,OAAO,UAAU,UAAU,CAC5B;AACD,UAAQ,MAAM,UACZ,qBACA,KAAK,KAAK,OAAO,YAAY,IAAK,CAAC,UAAU,CAC9C;AAED,MAAI,CAAC,OAAO,WAAW,OAAO,WAC5B,SAAQ,MAAM,UAAU,eAAe,OAAO,WAAW,UAAU,CAAC;;CAIxE,MAAa,WACX,KACA,UAA4B,EAAE,EACJ;EAC1B,MAAM,WAAW,QAAQ,YAAY,KAAK,IAAI;EAC9C,MAAM,MAAM,QAAQ,OAAO,KAAK,IAAI;EACpC,MAAM,MAAM,KAAK,YAAY,IAAI;EAEjC,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,cAAc,MAAM;EAG1B,MAAM,cAAe,MAAM,KAAK,MAAM,IAAI,IAAI,IAAK;GACjD,OAAO;GACP,aAAa;GACb,MAAM,EAAE;GACT;EAGD,MAAM,YAAY,YAAY,KAAK,QAChC,QAAgB,OAAO,YACzB;EAGD,MAAM,UAAU,UAAU,SAAS;EACnC,MAAM,YAAY,KAAK,IAAI,GAAG,MAAM,UAAU,OAAO;EACrD,MAAM,YAAY,KAAK,IAAI,GAAG,WAAW,YAAY,GAAG;AAGxD,MAAI,SAAS;AACX,aAAU,KAAK,IAAI;AACnB,SAAM,KAAK,MAAM,IAAI,KAAK;IACxB,OAAO,UAAU;IACjB,aAAa,KAAK,IAAI,YAAY,aAAa,YAAY;IAC3D,MAAM;IACP,CAAC;;EAGJ,MAAMA,SAA0B;GAC9B;GACA,OAAO;GACP,WAAW,UAAU,YAAY,IAAI;GACrC;GACD;AAED,MAAI,CAAC,QACH,QAAO,aAAa,KAAK,MAAM,YAAY,OAAO,IAAK;AAGzD,SAAO;;CAGT,AAAU,YAAY,KAA4B;AAGhD,SAAO,MADI,KAAK,YAAY,IAAI;;CAIlC,AAAU,YAAY,KAA4B;EAEhD,MAAM,YAAY,IAAI,UAAU;AAChC,MAAI,WAAW;GAEb,MAAM,UAAU,UAAU,MAAM,IAAI,CAAC,GAAG,MAAM;AAC9C,OAAI,QAAS,QAAO;;AAGtB,SAAO,IAAI,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/OrB,MAAa,cACX,UAAsC,EAAE,KACR;AAChC,QAAO,iBAAiB,qBAAqB,QAAQ;;AAqBvD,IAAa,sBAAb,cACU,WAEV;CACE,AAAmB,0BAA0B,QAAQ,wBAAwB;CAE7E,IAAW,OAAe;AACxB,SAAO,KAAK,QAAQ,QAAQ,GAAG,KAAK,OAAO;;CAG7C,AAAU,SAAS;AAEjB,OAAK,wBAAwB,kBAAkB,KAAK,QAAQ;;;;;CAM9D,MAAa,MACX,SACA,SAC0B;EAC1B,MAAM,gBAAgB;GAAE,GAAG,KAAK;GAAS,GAAG;GAAS;AACrD,SAAO,KAAK,wBAAwB,WAAW,SAAS,cAAc;;;AAI1E,WAAW,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACdnB,MAAa,wBAAwB,QAAQ;CAC3C,MAAM;CACN,aAAa,CAAC,WAAW;CACzB,UAAU,CAAC,cAAc,wBAAwB;CAClD,CAAC"}
+{"version":3,"file":"index.js","names":["result: RateLimitResult"],"sources":["../../src/server-rate-limit/providers/ServerRateLimitProvider.ts","../../src/server-rate-limit/primitives/$rateLimit.ts","../../src/server-rate-limit/index.ts"],"sourcesContent":["import { $atom, $env, $hook, $inject, $use, type Static, t } from \"alepha\";\nimport { $cache } from \"alepha/cache\";\nimport { $logger } from \"alepha/logger\";\nimport {\n  HttpError,\n  type ServerRequest,\n  ServerRouterProvider,\n} from \"alepha/server\";\nimport type { RateLimitOptions } from \"../index.ts\";\nimport type { RateLimitPrimitiveOptions } from \"../primitives/$rateLimit.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface RateLimitResult {\n  allowed: boolean;\n  limit: number;\n  remaining: number;\n  resetTime: number;\n  retryAfter?: number;\n}\n\n/**\n * Rate limit configuration atom (global defaults)\n */\nexport const rateLimitOptions = $atom({\n  name: \"alepha.server.rate-limit.options\",\n  schema: t.object({\n    windowMs: t.optional(\n      t.number({\n        description: \"Window duration in milliseconds\",\n      }),\n    ),\n    max: t.optional(\n      t.number({\n        description: \"Maximum number of requests per window\",\n      }),\n    ),\n    skipFailedRequests: t.optional(\n      t.boolean({\n        description: \"Skip rate limiting for failed requests\",\n      }),\n    ),\n    skipSuccessfulRequests: t.optional(\n      t.boolean({\n        description: \"Skip rate limiting for successful requests\",\n      }),\n    ),\n  }),\n  default: {},\n});\n\nexport type RateLimitAtomOptions = Static<typeof rateLimitOptions.schema>;\n\ndeclare module \"alepha\" {\n  interface State {\n    [rateLimitOptions.key]: RateLimitAtomOptions;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nconst envSchema = t.object({\n  RATE_LIMIT_WINDOW_MS: t.number({\n    default: 15 * 60 * 1000, // 15 minutes\n    description: \"Rate limit window in milliseconds\",\n  }),\n  RATE_LIMIT_MAX_REQUESTS: t.number({\n    default: 100,\n    description: \"Maximum requests per window\",\n  }),\n});\n\nexport class ServerRateLimitProvider {\n  protected readonly log = $logger();\n  protected readonly serverRouterProvider = $inject(ServerRouterProvider);\n  protected readonly env = $env(envSchema);\n\n  protected readonly cache = $cache<RateLimitData>({\n    name: \"server-rate-limit\",\n    ttl: [this.env.RATE_LIMIT_WINDOW_MS, \"milliseconds\"],\n  });\n\n  protected readonly globalOptions = $use(rateLimitOptions);\n\n  /**\n   * Registered rate limit configurations with their path patterns\n   */\n  public readonly registeredConfigs: RateLimitPrimitiveOptions[] = [];\n\n  /**\n   * Register a rate limit configuration (called by primitives)\n   */\n  public registerRateLimit(config: RateLimitPrimitiveOptions): void {\n    this.registeredConfigs.push(config);\n  }\n\n  protected readonly onStart = $hook({\n    on: \"start\",\n    handler: async () => {\n      // Apply path-specific rate limit configs to routes\n      for (const config of this.registeredConfigs) {\n        if (config.paths) {\n          for (const pattern of config.paths) {\n            const matchedRoutes = this.serverRouterProvider.getRoutes(pattern);\n            for (const route of matchedRoutes) {\n              route.rateLimit = this.buildRateLimitOptions(config);\n            }\n          }\n        }\n      }\n\n      if (this.registeredConfigs.length > 0) {\n        this.log.info(\n          `Initialized with ${this.registeredConfigs.length} registered rate-limit configurations.`,\n        );\n      }\n    },\n  });\n\n  public readonly onRequest = $hook({\n    on: \"server:onRequest\",\n    handler: async ({ route, request }) => {\n      // Use route-specific rate limit if defined, otherwise use global options\n      const rateLimitConfig = route.rateLimit ?? this.globalOptions;\n\n      // Skip if no rate limiting configured\n      if (!rateLimitConfig.max && !rateLimitConfig.windowMs) {\n        return;\n      }\n\n      const result = await this.checkLimit(request, rateLimitConfig);\n      this.setRateLimitHeaders(request, result);\n\n      if (!result.allowed) {\n        throw new HttpError({\n          status: 429,\n          message: \"Too Many Requests\",\n        });\n      }\n    },\n  });\n\n  public readonly onActionRequest = $hook({\n    on: \"action:onRequest\",\n    handler: async ({ action, request }) => {\n      // Check if this action has rate limiting enabled\n      const rateLimit = action.options?.rateLimit;\n      if (!rateLimit) {\n        return; // No rate limiting for this action\n      }\n\n      const result = await this.checkLimit(request, rateLimit);\n\n      if (!result.allowed) {\n        // Actions are internal - don't set HTTP headers\n        // Only throw error to prevent action execution\n        throw new HttpError({\n          status: 429,\n          message: \"Too Many Requests\",\n        });\n      }\n\n      // Action allowed - no headers to set since actions are internal\n    },\n  });\n\n  /**\n   * Build complete rate limit options by merging with global defaults\n   */\n  protected buildRateLimitOptions(\n    config: RateLimitPrimitiveOptions,\n  ): RateLimitOptions {\n    return {\n      max: config.max ?? this.globalOptions.max,\n      windowMs: config.windowMs ?? this.globalOptions.windowMs,\n      keyGenerator: config.keyGenerator,\n      skipFailedRequests:\n        config.skipFailedRequests ?? this.globalOptions.skipFailedRequests,\n      skipSuccessfulRequests:\n        config.skipSuccessfulRequests ??\n        this.globalOptions.skipSuccessfulRequests,\n    };\n  }\n\n  /**\n   * Set rate limit headers on the response\n   */\n  protected setRateLimitHeaders(\n    request: ServerRequest,\n    result: RateLimitResult,\n  ): void {\n    request.reply.setHeader(\"X-RateLimit-Limit\", result.limit.toString());\n    request.reply.setHeader(\n      \"X-RateLimit-Remaining\",\n      result.remaining.toString(),\n    );\n    request.reply.setHeader(\n      \"X-RateLimit-Reset\",\n      Math.ceil(result.resetTime / 1000).toString(),\n    );\n\n    if (!result.allowed && result.retryAfter) {\n      request.reply.setHeader(\"Retry-After\", result.retryAfter.toString());\n    }\n  }\n\n  public async checkLimit(\n    req: ServerRequest,\n    options: RateLimitOptions = {},\n  ): Promise<RateLimitResult> {\n    const windowMs = options.windowMs ?? this.env.RATE_LIMIT_WINDOW_MS;\n    const max = options.max ?? this.env.RATE_LIMIT_MAX_REQUESTS;\n    const key = this.generateKey(req);\n\n    const now = Date.now();\n    const windowStart = now - windowMs;\n\n    // Get current rate limit data\n    const currentData = (await this.cache.get(key)) || {\n      count: 0,\n      windowStart: now,\n      hits: [],\n    };\n\n    // Clean old hits outside the current window\n    const validHits = currentData.hits.filter(\n      (hit: number) => hit >= windowStart,\n    );\n\n    // Check if limit exceeded\n    const allowed = validHits.length < max;\n    const remaining = Math.max(0, max - validHits.length);\n    const resetTime = Math.max(...validHits, windowStart) + windowMs;\n\n    // If allowed, record this request\n    if (allowed) {\n      validHits.push(now);\n      await this.cache.set(key, {\n        count: validHits.length,\n        windowStart: Math.min(currentData.windowStart, windowStart),\n        hits: validHits,\n      });\n    }\n\n    const result: RateLimitResult = {\n      allowed,\n      limit: max,\n      remaining: allowed ? remaining - 1 : remaining,\n      resetTime,\n    };\n\n    if (!allowed) {\n      result.retryAfter = Math.ceil((resetTime - now) / 1000);\n    }\n\n    return result;\n  }\n\n  protected generateKey(req: ServerRequest): string {\n    // Default to IP-based rate limiting\n    const ip = this.getClientIP(req);\n    return `ip:${ip}`;\n  }\n\n  protected getClientIP(req: ServerRequest): string {\n    // Check x-forwarded-for header first (for proxies/load balancers)\n    const forwarded = req.headers?.[\"x-forwarded-for\"];\n    if (forwarded) {\n      // x-forwarded-for can contain multiple IPs, get the first one (original client)\n      const firstIp = forwarded.split(\",\")[0].trim();\n      if (firstIp) return firstIp;\n    }\n\n    return req.ip || \"unknown\";\n  }\n}\n\ninterface RateLimitData {\n  count: number;\n  windowStart: number;\n  hits: number[];\n}\n","import { $inject, createPrimitive, KIND, Primitive } from \"alepha\";\nimport type { ServerRequest } from \"alepha/server\";\nimport type { RateLimitOptions } from \"../index.ts\";\nimport {\n  type RateLimitResult,\n  ServerRateLimitProvider,\n} from \"../providers/ServerRateLimitProvider.ts\";\n\n/**\n * Declares rate limiting for server routes or custom usage.\n * This primitive provides methods to check rate limits and configure behavior\n * within the server request/response cycle.\n *\n * @example\n * ```ts\n * class ApiService {\n *   // Apply rate limiting to specific paths\n *   apiRateLimit = $rateLimit({\n *     paths: [\"/api/*\"],\n *     max: 100,\n *     windowMs: 15 * 60 * 1000, // 15 minutes\n *   });\n *\n *   // Or use check() method for manual rate limiting\n *   customAction = $action({\n *     handler: async (req) => {\n *       const result = await this.apiRateLimit.check(req);\n *       if (!result.allowed) throw new Error(\"Rate limited\");\n *       return \"ok\";\n *     },\n *   });\n * }\n * ```\n */\nexport const $rateLimit = (\n  options: RateLimitPrimitiveOptions = {},\n): AbstractRateLimitPrimitive => {\n  return createPrimitive(RateLimitPrimitive, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface RateLimitPrimitiveOptions extends RateLimitOptions {\n  /** Name identifier for this rate limit (default: property key) */\n  name?: string;\n  /** Path patterns to match (supports wildcards like /api/*) */\n  paths?: string[];\n}\n\nexport interface AbstractRateLimitPrimitive {\n  readonly name: string;\n  readonly options: RateLimitPrimitiveOptions;\n  check(\n    request: ServerRequest,\n    options?: RateLimitOptions,\n  ): Promise<RateLimitResult>;\n}\n\nexport class RateLimitPrimitive\n  extends Primitive<RateLimitPrimitiveOptions>\n  implements AbstractRateLimitPrimitive\n{\n  protected readonly serverRateLimitProvider = $inject(ServerRateLimitProvider);\n\n  public get name(): string {\n    return this.options.name ?? `${this.config.propertyKey}`;\n  }\n\n  protected onInit() {\n    // Register this rate limit configuration with the provider\n    this.serverRateLimitProvider.registerRateLimit(this.options);\n  }\n\n  /**\n   * Checks rate limit for the given request using this primitive's configuration.\n   */\n  public async check(\n    request: ServerRequest,\n    options?: RateLimitOptions,\n  ): Promise<RateLimitResult> {\n    const mergedOptions = { ...this.options, ...options };\n    return this.serverRateLimitProvider.checkLimit(request, mergedOptions);\n  }\n}\n\n$rateLimit[KIND] = RateLimitPrimitive;\n","import { $module } from \"alepha\";\nimport { AlephaServer } from \"alepha/server\";\nimport { $rateLimit } from \"./primitives/$rateLimit.ts\";\nimport { ServerRateLimitProvider } from \"./providers/ServerRateLimitProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./primitives/$rateLimit.ts\";\nexport * from \"./providers/ServerRateLimitProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\ndeclare module \"alepha/server\" {\n  interface ActionPrimitiveOptions<TConfig> {\n    /**\n     * Rate limiting configuration for this action.\n     * When specified, the action will be rate limited according to these settings.\n     */\n    rateLimit?: RateLimitOptions;\n  }\n\n  interface ServerRoute {\n    /**\n     * Route-specific rate limit configuration.\n     * If set, overrides the global rate limit options for this route.\n     */\n    rateLimit?: RateLimitOptions;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface RateLimitOptions {\n  /** Maximum number of requests per window (default: 100) */\n  max?: number;\n  /** Window duration in milliseconds (default: 15 minutes) */\n  windowMs?: number;\n  /** Custom key generator function */\n  keyGenerator?: (req: any) => string;\n  /** Skip rate limiting for failed requests */\n  skipFailedRequests?: boolean;\n  /** Skip rate limiting for successful requests */\n  skipSuccessfulRequests?: boolean;\n}\n\n/**\n * Provides rate limiting capabilities for server routes and actions with configurable limits and windows.\n *\n * The server-rate-limit module enables per-route and per-action rate limiting using either:\n * - The `$rateLimit` primitive with `paths` option for path-based rate limiting\n * - The `rateLimit` option in action primitives for action-specific limiting\n *\n * It offers sliding window rate limiting, custom key generation, and seamless integration with server routes.\n *\n * @example\n * ```ts\n * import { $rateLimit, AlephaServerRateLimit } from \"alepha/server-rate-limit\";\n *\n * class ApiService {\n *   // Path-specific rate limiting\n *   apiRateLimit = $rateLimit({\n *     paths: [\"/api/*\"],\n *     max: 100,\n *     windowMs: 15 * 60 * 1000, // 15 minutes\n *   });\n * }\n * ```\n *\n * @see {@link $rateLimit}\n * @module alepha.server.rate-limit\n */\nexport const AlephaServerRateLimit = $module({\n  name: \"alepha.server.rate-limit\",\n  primitives: [$rateLimit],\n  services: [AlephaServer, ServerRateLimitProvider],\n});\n"],"mappings":";;;;;;;;;AAwBA,MAAa,mBAAmB,MAAM;CACpC,MAAM;CACN,QAAQ,EAAE,OAAO;EACf,UAAU,EAAE,SACV,EAAE,OAAO,EACP,aAAa,mCACd,CAAC,CACH;EACD,KAAK,EAAE,SACL,EAAE,OAAO,EACP,aAAa,yCACd,CAAC,CACH;EACD,oBAAoB,EAAE,SACpB,EAAE,QAAQ,EACR,aAAa,0CACd,CAAC,CACH;EACD,wBAAwB,EAAE,SACxB,EAAE,QAAQ,EACR,aAAa,8CACd,CAAC,CACH;EACF,CAAC;CACF,SAAS,EAAE;CACZ,CAAC;AAYF,MAAM,YAAY,EAAE,OAAO;CACzB,sBAAsB,EAAE,OAAO;EAC7B,SAAS,MAAU;EACnB,aAAa;EACd,CAAC;CACF,yBAAyB,EAAE,OAAO;EAChC,SAAS;EACT,aAAa;EACd,CAAC;CACH,CAAC;AAEF,IAAa,0BAAb,MAAqC;CACnC,AAAmB,MAAM,SAAS;CAClC,AAAmB,uBAAuB,QAAQ,qBAAqB;CACvE,AAAmB,MAAM,KAAK,UAAU;CAExC,AAAmB,QAAQ,OAAsB;EAC/C,MAAM;EACN,KAAK,CAAC,KAAK,IAAI,sBAAsB,eAAe;EACrD,CAAC;CAEF,AAAmB,gBAAgB,KAAK,iBAAiB;;;;CAKzD,AAAgB,oBAAiD,EAAE;;;;CAKnE,AAAO,kBAAkB,QAAyC;AAChE,OAAK,kBAAkB,KAAK,OAAO;;CAGrC,AAAmB,UAAU,MAAM;EACjC,IAAI;EACJ,SAAS,YAAY;AAEnB,QAAK,MAAM,UAAU,KAAK,kBACxB,KAAI,OAAO,MACT,MAAK,MAAM,WAAW,OAAO,OAAO;IAClC,MAAM,gBAAgB,KAAK,qBAAqB,UAAU,QAAQ;AAClE,SAAK,MAAM,SAAS,cAClB,OAAM,YAAY,KAAK,sBAAsB,OAAO;;AAM5D,OAAI,KAAK,kBAAkB,SAAS,EAClC,MAAK,IAAI,KACP,oBAAoB,KAAK,kBAAkB,OAAO,wCACnD;;EAGN,CAAC;CAEF,AAAgB,YAAY,MAAM;EAChC,IAAI;EACJ,SAAS,OAAO,EAAE,OAAO,cAAc;GAErC,MAAM,kBAAkB,MAAM,aAAa,KAAK;AAGhD,OAAI,CAAC,gBAAgB,OAAO,CAAC,gBAAgB,SAC3C;GAGF,MAAM,SAAS,MAAM,KAAK,WAAW,SAAS,gBAAgB;AAC9D,QAAK,oBAAoB,SAAS,OAAO;AAEzC,OAAI,CAAC,OAAO,QACV,OAAM,IAAI,UAAU;IAClB,QAAQ;IACR,SAAS;IACV,CAAC;;EAGP,CAAC;CAEF,AAAgB,kBAAkB,MAAM;EACtC,IAAI;EACJ,SAAS,OAAO,EAAE,QAAQ,cAAc;GAEtC,MAAM,YAAY,OAAO,SAAS;AAClC,OAAI,CAAC,UACH;AAKF,OAAI,EAFW,MAAM,KAAK,WAAW,SAAS,UAAU,EAE5C,QAGV,OAAM,IAAI,UAAU;IAClB,QAAQ;IACR,SAAS;IACV,CAAC;;EAKP,CAAC;;;;CAKF,AAAU,sBACR,QACkB;AAClB,SAAO;GACL,KAAK,OAAO,OAAO,KAAK,cAAc;GACtC,UAAU,OAAO,YAAY,KAAK,cAAc;GAChD,cAAc,OAAO;GACrB,oBACE,OAAO,sBAAsB,KAAK,cAAc;GAClD,wBACE,OAAO,0BACP,KAAK,cAAc;GACtB;;;;;CAMH,AAAU,oBACR,SACA,QACM;AACN,UAAQ,MAAM,UAAU,qBAAqB,OAAO,MAAM,UAAU,CAAC;AACrE,UAAQ,MAAM,UACZ,yBACA,OAAO,UAAU,UAAU,CAC5B;AACD,UAAQ,MAAM,UACZ,qBACA,KAAK,KAAK,OAAO,YAAY,IAAK,CAAC,UAAU,CAC9C;AAED,MAAI,CAAC,OAAO,WAAW,OAAO,WAC5B,SAAQ,MAAM,UAAU,eAAe,OAAO,WAAW,UAAU,CAAC;;CAIxE,MAAa,WACX,KACA,UAA4B,EAAE,EACJ;EAC1B,MAAM,WAAW,QAAQ,YAAY,KAAK,IAAI;EAC9C,MAAM,MAAM,QAAQ,OAAO,KAAK,IAAI;EACpC,MAAM,MAAM,KAAK,YAAY,IAAI;EAEjC,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,cAAc,MAAM;EAG1B,MAAM,cAAe,MAAM,KAAK,MAAM,IAAI,IAAI,IAAK;GACjD,OAAO;GACP,aAAa;GACb,MAAM,EAAE;GACT;EAGD,MAAM,YAAY,YAAY,KAAK,QAChC,QAAgB,OAAO,YACzB;EAGD,MAAM,UAAU,UAAU,SAAS;EACnC,MAAM,YAAY,KAAK,IAAI,GAAG,MAAM,UAAU,OAAO;EACrD,MAAM,YAAY,KAAK,IAAI,GAAG,WAAW,YAAY,GAAG;AAGxD,MAAI,SAAS;AACX,aAAU,KAAK,IAAI;AACnB,SAAM,KAAK,MAAM,IAAI,KAAK;IACxB,OAAO,UAAU;IACjB,aAAa,KAAK,IAAI,YAAY,aAAa,YAAY;IAC3D,MAAM;IACP,CAAC;;EAGJ,MAAMA,SAA0B;GAC9B;GACA,OAAO;GACP,WAAW,UAAU,YAAY,IAAI;GACrC;GACD;AAED,MAAI,CAAC,QACH,QAAO,aAAa,KAAK,MAAM,YAAY,OAAO,IAAK;AAGzD,SAAO;;CAGT,AAAU,YAAY,KAA4B;AAGhD,SAAO,MADI,KAAK,YAAY,IAAI;;CAIlC,AAAU,YAAY,KAA4B;EAEhD,MAAM,YAAY,IAAI,UAAU;AAChC,MAAI,WAAW;GAEb,MAAM,UAAU,UAAU,MAAM,IAAI,CAAC,GAAG,MAAM;AAC9C,OAAI,QAAS,QAAO;;AAGtB,SAAO,IAAI,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/OrB,MAAa,cACX,UAAqC,EAAE,KACR;AAC/B,QAAO,gBAAgB,oBAAoB,QAAQ;;AAqBrD,IAAa,qBAAb,cACU,UAEV;CACE,AAAmB,0BAA0B,QAAQ,wBAAwB;CAE7E,IAAW,OAAe;AACxB,SAAO,KAAK,QAAQ,QAAQ,GAAG,KAAK,OAAO;;CAG7C,AAAU,SAAS;AAEjB,OAAK,wBAAwB,kBAAkB,KAAK,QAAQ;;;;;CAM9D,MAAa,MACX,SACA,SAC0B;EAC1B,MAAM,gBAAgB;GAAE,GAAG,KAAK;GAAS,GAAG;GAAS;AACrD,SAAO,KAAK,wBAAwB,WAAW,SAAS,cAAc;;;AAI1E,WAAW,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACdnB,MAAa,wBAAwB,QAAQ;CAC3C,MAAM;CACN,YAAY,CAAC,WAAW;CACxB,UAAU,CAAC,cAAc,wBAAwB;CAClD,CAAC"}

package/dist/server-security/index.d.ts

@@ -1,5 +1,5 @@
 import * as alepha5 from "alepha";
-import { Alepha, Descriptor, KIND } from "alepha";
+import { Alepha, KIND, Primitive } from "alepha";
 import { JwtProvider, Permission, SecurityProvider, UserAccount, UserAccountToken } from "alepha/security";
 import { FetchOptions, ServerRequest, ServerRouterProvider } from "alepha/server";
 import * as alepha_logger0 from "alepha/logger";
@@ -9,7 +9,7 @@ interface BasicAuthOptions {
   username: string;
   password: string;
 }
-interface BasicAuthDescriptorConfig extends BasicAuthOptions {
+interface BasicAuthPrimitiveConfig extends BasicAuthOptions {
   /** Name identifier for this basic auth (default: property key) */
   name?: string;
   /** Path patterns to match (supports wildcards like /devtools/*) */
@@ -21,22 +21,22 @@ declare class ServerBasicAuthProvider {
   protected readonly routerProvider: ServerRouterProvider;
   protected readonly realm = "Secure Area";
   /**
-   * Registered basic auth descriptors with their configurations
+   * Registered basic auth primitives with their configurations
    */
-  readonly registeredAuths: BasicAuthDescriptorConfig[];
+  readonly registeredAuths: BasicAuthPrimitiveConfig[];
   /**
-   * Register a basic auth configuration (called by descriptors)
+   * Register a basic auth configuration (called by primitives)
    */
-  registerAuth(config: BasicAuthDescriptorConfig): void;
-  readonly onStart: alepha5.HookDescriptor<"start">;
+  registerAuth(config: BasicAuthPrimitiveConfig): void;
+  readonly onStart: alepha5.HookPrimitive<"start">;
   /**
    * Hook into server:onRequest to check basic auth
    */
-  readonly onRequest: alepha5.HookDescriptor<"server:onRequest">;
+  readonly onRequest: alepha5.HookPrimitive<"server:onRequest">;
   /**
    * Hook into action:onRequest to check basic auth for actions
    */
-  readonly onActionRequest: alepha5.HookDescriptor<"action:onRequest">;
+  readonly onActionRequest: alepha5.HookPrimitive<"action:onRequest">;
   /**
    * Check basic authentication
    */
@@ -66,9 +66,9 @@ declare class ServerSecurityProvider {
   protected readonly securityProvider: SecurityProvider;
   protected readonly jwtProvider: JwtProvider;
   protected readonly alepha: Alepha;
-  protected readonly onConfigure: alepha5.HookDescriptor<"configure">;
-  protected readonly onActionRequest: alepha5.HookDescriptor<"action:onRequest">;
-  protected readonly onRequest: alepha5.HookDescriptor<"server:onRequest">;
+  protected readonly onConfigure: alepha5.HookPrimitive<"configure">;
+  protected readonly onActionRequest: alepha5.HookPrimitive<"action:onRequest">;
+  protected readonly onRequest: alepha5.HookPrimitive<"server:onRequest">;
   protected check(user: UserAccountToken, secure: ServerRouteSecure): void;
   /**
    * Get the user account token for a local action call.
@@ -85,33 +85,33 @@ declare class ServerSecurityProvider {
     user?: UserAccountToken | "system" | "context";
   }, permission?: Permission): UserAccountToken;
   protected createTestUser(): UserAccountToken;
-  protected readonly onClientRequest: alepha5.HookDescriptor<"client:onRequest">;
+  protected readonly onClientRequest: alepha5.HookPrimitive<"client:onRequest">;
 }
 type ServerRouteSecure = {
   realm?: string;
   basic?: BasicAuthOptions;
 };
 //#endregion
-//#region src/server-security/descriptors/$basicAuth.d.ts
+//#region src/server-security/primitives/$basicAuth.d.ts
 /**
  * Declares HTTP Basic Authentication for server routes.
- * This descriptor provides methods to protect routes with username/password authentication.
+ * This primitive provides methods to protect routes with username/password authentication.
  */
 declare const $basicAuth: {
-  (options: BasicAuthDescriptorConfig): AbstractBasicAuthDescriptor;
-  [KIND]: typeof BasicAuthDescriptor;
+  (options: BasicAuthPrimitiveConfig): AbstractBasicAuthPrimitive;
+  [KIND]: typeof BasicAuthPrimitive;
 };
-interface AbstractBasicAuthDescriptor {
+interface AbstractBasicAuthPrimitive {
   readonly name: string;
-  readonly options: BasicAuthDescriptorConfig;
+  readonly options: BasicAuthPrimitiveConfig;
   check(request: ServerRequest, options?: BasicAuthOptions): void;
 }
-declare class BasicAuthDescriptor extends Descriptor<BasicAuthDescriptorConfig> implements AbstractBasicAuthDescriptor {
+declare class BasicAuthPrimitive extends Primitive<BasicAuthPrimitiveConfig> implements AbstractBasicAuthPrimitive {
   protected readonly serverBasicAuthProvider: ServerBasicAuthProvider;
   get name(): string;
   protected onInit(): void;
   /**
-   * Checks basic auth for the given request using this descriptor's configuration.
+   * Checks basic auth for the given request using this primitive's configuration.
    */
   check(request: ServerRequest, options?: BasicAuthOptions): void;
 }
@@ -169,5 +169,5 @@ declare module "alepha/server" {
  */
 declare const AlephaServerSecurity: alepha5.Service<alepha5.Module>;
 //#endregion
-export { $basicAuth, AbstractBasicAuthDescriptor, AlephaServerSecurity, BasicAuthDescriptor, BasicAuthDescriptorConfig, BasicAuthOptions, ServerBasicAuthProvider, ServerRouteSecure, ServerSecurityProvider, isBasicAuth };
+export { $basicAuth, AbstractBasicAuthPrimitive, AlephaServerSecurity, BasicAuthOptions, BasicAuthPrimitive, BasicAuthPrimitiveConfig, ServerBasicAuthProvider, ServerRouteSecure, ServerSecurityProvider, isBasicAuth };
 //# sourceMappingURL=index.d.ts.map

package/dist/server-security/index.js

@@ -1,4 +1,4 @@
-import { $hook, $inject, $module, Alepha, Descriptor, KIND, createDescriptor } from "alepha";
+import { $hook, $inject, $module, Alepha, KIND, Primitive, createPrimitive } from "alepha";
 import { $permission, $realm, $role, AlephaSecurity, JwtProvider, SecurityProvider, userAccountInfoSchema } from "alepha/security";
 import { $action, AlephaServer, ForbiddenError, HttpError, ServerRouterProvider, UnauthorizedError } from "alepha/server";
 import { randomUUID, timingSafeEqual } from "node:crypto";
@@ -11,11 +11,11 @@ var ServerBasicAuthProvider = class {
 	routerProvider = $inject(ServerRouterProvider);
 	realm = "Secure Area";
 	/**
-	* Registered basic auth descriptors with their configurations
+	* Registered basic auth primitives with their configurations
 	*/
 	registeredAuths = [];
 	/**
-	* Register a basic auth configuration (called by descriptors)
+	* Register a basic auth configuration (called by primitives)
 	*/
 	registerAuth(config) {
 		this.registeredAuths.push(config);
@@ -113,15 +113,15 @@ const isBasicAuth = (value) => {
 };
 
 //#endregion
-//#region src/server-security/descriptors/$basicAuth.ts
+//#region src/server-security/primitives/$basicAuth.ts
 /**
 * Declares HTTP Basic Authentication for server routes.
-* This descriptor provides methods to protect routes with username/password authentication.
+* This primitive provides methods to protect routes with username/password authentication.
 */
 const $basicAuth = (options) => {
-	return createDescriptor(BasicAuthDescriptor, options);
+	return createPrimitive(BasicAuthPrimitive, options);
 };
-var BasicAuthDescriptor = class extends Descriptor {
+var BasicAuthPrimitive = class extends Primitive {
 	serverBasicAuthProvider = $inject(ServerBasicAuthProvider);
 	get name() {
 		return this.options.name ?? `${this.config.propertyKey}`;
@@ -130,7 +130,7 @@ var BasicAuthDescriptor = class extends Descriptor {
 		this.serverBasicAuthProvider.registerAuth(this.options);
 	}
 	/**
-	* Checks basic auth for the given request using this descriptor's configuration.
+	* Checks basic auth for the given request using this primitive's configuration.
 	*/
 	check(request, options) {
 		const mergedOptions = {
@@ -140,7 +140,7 @@ var BasicAuthDescriptor = class extends Descriptor {
 		this.serverBasicAuthProvider.checkAuth(request, mergedOptions);
 	}
 };
-$basicAuth[KIND] = BasicAuthDescriptor;
+$basicAuth[KIND] = BasicAuthPrimitive;
 
 //#endregion
 //#region src/server-security/providers/ServerSecurityProvider.ts
@@ -152,7 +152,7 @@ var ServerSecurityProvider = class {
 	onConfigure = $hook({
 		on: "configure",
 		handler: async () => {
-			for (const action of this.alepha.descriptors($action)) {
+			for (const action of this.alepha.primitives($action)) {
 				if (action.options.disabled || action.options.secure === false || this.securityProvider.getRealms().length === 0) continue;
 				if (typeof action.options.secure !== "object") this.securityProvider.createPermission({
 					name: action.name,
@@ -176,7 +176,7 @@ var ServerSecurityProvider = class {
 				request.user = this.createUserFromLocalFunctionContext(options, permission);
 				const route = action.route;
 				if (typeof route.secure === "object") this.check(request.user, route.secure);
-				this.alepha.state.set("alepha.server.request.user", this.alepha.codec.decode(userAccountInfoSchema, request.user));
+				this.alepha.store.set("alepha.server.request.user", this.alepha.codec.decode(userAccountInfoSchema, request.user));
 			} catch (error) {
 				if (action.options.secure || permission) throw error;
 				this.log.trace("Skipping security check for action");
@@ -200,7 +200,7 @@ var ServerSecurityProvider = class {
 			try {
 				request.user = await this.securityProvider.createUserFromToken(request.headers.authorization, { permission });
 				if (typeof route.secure === "object") this.check(request.user, route.secure);
-				this.alepha.state.set("alepha.server.request.user", this.alepha.codec.decode(userAccountInfoSchema, request.user));
+				this.alepha.store.set("alepha.server.request.user", this.alepha.codec.decode(userAccountInfoSchema, request.user));
 				this.log.trace("User set from request token", {
 					user: request.user,
 					permission
@@ -232,7 +232,7 @@ var ServerSecurityProvider = class {
 		const type = typeof options.user === "string" ? options.user : void 0;
 		let user;
 		const fromContext = this.alepha.context.get("request")?.user;
-		const fromSystem = this.alepha.state.get("alepha.server.security.system.user");
+		const fromSystem = this.alepha.store.get("alepha.server.security.system.user");
 		if (type === "system") user = fromSystem;
 		else if (type === "context") user = fromContext;
 		else user = fromOptions ?? fromContext ?? fromSystem;
@@ -292,7 +292,7 @@ var ServerSecurityProvider = class {
 */
 const AlephaServerSecurity = $module({
 	name: "alepha.server.security",
-	descriptors: [
+	primitives: [
 		$realm,
 		$role,
 		$permission,
@@ -307,5 +307,5 @@ const AlephaServerSecurity = $module({
 });
 
 //#endregion
-export { $basicAuth, AlephaServerSecurity, BasicAuthDescriptor, ServerBasicAuthProvider, ServerSecurityProvider, isBasicAuth };
+export { $basicAuth, AlephaServerSecurity, BasicAuthPrimitive, ServerBasicAuthProvider, ServerSecurityProvider, isBasicAuth };
 //# sourceMappingURL=index.js.map