hazo_core 2.2.0 → 2.4.0

package/README.md

@@ -70,8 +70,8 @@ import { loadConfig, defineConfig, createLogger, createDebug,
 
 ```ts
 import { withRetry, isUuid, parseListLimit, parseListOffset,
-  createDebouncedSaver } from 'hazo_core';
-// all five are env-agnostic and also available from 'hazo_core/client'
+  createDebouncedSaver, rateLimit, withRateLimit, getClientIp } from 'hazo_core';
+// all are env-agnostic and also available from 'hazo_core/client'
 ```
 
 ### Browser-safe subset

package/dist/http/rate_limit.d.ts

@@ -0,0 +1,49 @@
+/** Options for {@link rateLimit}. */
+export interface RateLimitOptions {
+    /** Bucket identifier (e.g. IP address or user ID). */
+    key: string;
+    /** Namespace / feature name (prevents cross-feature key collisions). */
+    scope: string;
+    /** Maximum requests allowed within the window. */
+    limit: number;
+    /** Window duration in milliseconds. */
+    window_ms: number;
+}
+export type RateLimitResult = {
+    ok: true;
+} | {
+    ok: false;
+    retry_after_seconds: number;
+};
+/**
+ * Fixed-window token-bucket check. Increments the bucket for `scope:key` and
+ * reports whether the caller is still under `limit` within `window_ms`.
+ *
+ * @example rateLimit({ key: '1.2.3.4', scope: 'login', limit: 5, window_ms: 60_000 })
+ */
+export declare function rateLimit(opts: RateLimitOptions): RateLimitResult;
+/** Clear all buckets. Used in tests only. */
+export declare function _clearBuckets(): void;
+type RateLimitRouteHandler = (req: Request, ...args: unknown[]) => Promise<Response> | Response;
+/**
+ * Wraps an HTTP route handler with rate limiting. Returns 429 with
+ * `Retry-After`/`X-RateLimit-Limit` headers when the limit is exceeded.
+ *
+ * Keys by client IP (`getClientIp`) by default; pass `getKey` to key by
+ * something else (e.g. a session/user id).
+ *
+ * Does NOT import from 'next' — uses the standard Request/Response types.
+ *
+ * @example
+ * export const POST = withRateLimit(myHandler, { scope: 'login', limit: 5, window_ms: 15 * 60 * 1000 });
+ */
+export declare function withRateLimit(handler: RateLimitRouteHandler, opts: Omit<RateLimitOptions, 'key'> & {
+    getKey?: (req: Request) => string;
+}): RateLimitRouteHandler;
+/**
+ * Best-effort client IP from standard proxy headers.
+ * Checks `x-forwarded-for` (first entry), then `x-real-ip`; falls back to `'unknown'`.
+ */
+export declare function getClientIp(req: Request): string;
+export {};
+//# sourceMappingURL=rate_limit.d.ts.map

package/dist/http/rate_limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate_limit.d.ts","sourceRoot":"","sources":["../../src/http/rate_limit.ts"],"names":[],"mappings":"AAeA,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC;AAS/C;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,eAAe,CAsBjE;AAED,6CAA6C;AAC7C,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAMD,KAAK,qBAAqB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAEhG;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;CAAE,GAC1E,qBAAqB,CAsBvB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAIhD"}

package/dist/http/rate_limit.js

@@ -0,0 +1,84 @@
+// file_description: In-memory token-bucket rate limiter plus a framework-agnostic
+// HTTP route-handler wrapper.
+//
+// `rateLimit`/`_clearBuckets` are a simple per-process Map-backed fixed-window
+// counter — single-process only; swap for a Postgres/Redis-backed store before
+// running multiple instances behind a load balancer.
+//
+// `withRateLimit`/`getClientIp` wrap a route handler using the standard
+// Request/Response types (not 'next/server'), so the same code works as-is in
+// a Next.js App Router route handler — NextRequest extends Request and a
+// returned plain Response is a valid handler return value — mirroring
+// `withRequestIdRouteHandler` in `request_id_middleware.ts`.
+//
+// Promoted from taxclientdocs' lib/rate-limit/{token-bucket,middleware}.ts.
+const _buckets = new Map();
+/**
+ * Fixed-window token-bucket check. Increments the bucket for `scope:key` and
+ * reports whether the caller is still under `limit` within `window_ms`.
+ *
+ * @example rateLimit({ key: '1.2.3.4', scope: 'login', limit: 5, window_ms: 60_000 })
+ */
+export function rateLimit(opts) {
+    const { key, scope, limit, window_ms } = opts;
+    const bucketKey = `${scope}:${key}`;
+    const now = Date.now();
+    const existing = _buckets.get(bucketKey);
+    if (!existing || now - existing.window_start >= window_ms) {
+        // New window
+        _buckets.set(bucketKey, { count: 1, window_start: now });
+        return { ok: true };
+    }
+    if (existing.count < limit) {
+        existing.count += 1;
+        return { ok: true };
+    }
+    // Limit exceeded
+    const elapsed = now - existing.window_start;
+    const retry_after_seconds = Math.ceil((window_ms - elapsed) / 1000);
+    return { ok: false, retry_after_seconds };
+}
+/** Clear all buckets. Used in tests only. */
+export function _clearBuckets() {
+    _buckets.clear();
+}
+/**
+ * Wraps an HTTP route handler with rate limiting. Returns 429 with
+ * `Retry-After`/`X-RateLimit-Limit` headers when the limit is exceeded.
+ *
+ * Keys by client IP (`getClientIp`) by default; pass `getKey` to key by
+ * something else (e.g. a session/user id).
+ *
+ * Does NOT import from 'next' — uses the standard Request/Response types.
+ *
+ * @example
+ * export const POST = withRateLimit(myHandler, { scope: 'login', limit: 5, window_ms: 15 * 60 * 1000 });
+ */
+export function withRateLimit(handler, opts) {
+    const getKey = opts.getKey ?? getClientIp;
+    return async (req, ...args) => {
+        const key = getKey(req);
+        const result = rateLimit({ ...opts, key });
+        if (!result.ok) {
+            return Response.json({ error: 'Too many requests. Please try again later.' }, {
+                status: 429,
+                headers: {
+                    'Retry-After': String(result.retry_after_seconds),
+                    'X-RateLimit-Limit': String(opts.limit),
+                },
+            });
+        }
+        return handler(req, ...args);
+    };
+}
+/**
+ * Best-effort client IP from standard proxy headers.
+ * Checks `x-forwarded-for` (first entry), then `x-real-ip`; falls back to `'unknown'`.
+ */
+export function getClientIp(req) {
+    const xff = req.headers.get('x-forwarded-for');
+    if (xff)
+        return xff.split(',')[0].trim();
+    return req.headers.get('x-real-ip') ?? 'unknown';
+}
+//# sourceMappingURL=rate_limit.js.map

package/dist/http/rate_limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate_limit.js","sourceRoot":"","sources":["../../src/http/rate_limit.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,8BAA8B;AAC9B,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,qDAAqD;AACrD,EAAE;AACF,wEAAwE;AACxE,8EAA8E;AAC9E,yEAAyE;AACzE,sEAAsE;AACtE,6DAA6D;AAC7D,EAAE;AACF,4EAA4E;AAuB5E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAAsB;IAC9C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC9C,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEzC,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,QAAQ,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC;QAC1D,aAAa;QACb,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;QAC3B,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,iBAAiB;IACjB,MAAM,OAAO,GAAG,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC5C,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;AAC5C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,aAAa;IAC3B,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA8B,EAC9B,IAA2E;IAE3E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAE1C,OAAO,KAAK,EAAE,GAAY,EAAE,GAAG,IAAe,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAE3C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,4CAA4C,EAAE,EACvD;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC;oBACjD,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;iBACxC;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;AACnD,CAAC"}

package/dist/i18n/client.d.ts

@@ -0,0 +1,8 @@
+/**
+ * hazo_core/i18n/client — browser-safe re-export.
+ *
+ * Safe because `./index.ts` has zero Node.js-only imports (only
+ * `optional_import`, already used from hazo_core's own `index.client.ts`).
+ */
+export * from './index.js';
+//# sourceMappingURL=client.d.ts.map

package/dist/i18n/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/i18n/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,YAAY,CAAC"}

package/dist/i18n/client.js

@@ -0,0 +1,8 @@
+/**
+ * hazo_core/i18n/client — browser-safe re-export.
+ *
+ * Safe because `./index.ts` has zero Node.js-only imports (only
+ * `optional_import`, already used from hazo_core's own `index.client.ts`).
+ */
+export * from './index.js';
+//# sourceMappingURL=client.js.map

package/dist/i18n/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/i18n/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,YAAY,CAAC"}

package/dist/i18n/index.d.ts

@@ -0,0 +1,104 @@
+/**
+ * hazo_core/i18n — canonical i18n bridge for hazo_* packages' own baked-in
+ * strings.
+ *
+ * 17+ packages each maintain a ~120-line local copy of this pattern (see
+ * hazo_auth/src/lib/create_package_t.ts, the reference this module is
+ * modeled on). This is the canonical version so those local copies can
+ * eventually be deleted.
+ *
+ * `hazo_i18n` — the companion package that provides a FULL i18n runtime
+ * (ICU, request-scoped locales, DB-authored catalogs, LLM translation
+ * pipeline) — does NOT exist as a dependency or peer dependency of
+ * hazo_core. It is probed lazily and optionally, exactly like the
+ * `hazo_debug` probe in `../debug/index.ts`. This keeps the workspace's
+ * peer-dep graph acyclic (a guarded import is not a peer) and guarantees
+ * that `createPackageT`'s `t()` NEVER blocks on, awaits, or becomes
+ * "aware" of hazo_i18n at read time — it always reads the bundled flat
+ * fallback catalog directly. The optional hazo_i18n probe exists purely as
+ * a fire-and-forget SIDE EFFECT: if hazo_i18n happens to be installed in
+ * the consuming app, we register this package's catalog into hazo_i18n's
+ * cross-package registry so the strings show up in its admin panel / LLM
+ * translation pipeline / compiled artifacts. That registration can never
+ * change what `t()`, `t.has()`, or `t.raw()` return.
+ *
+ * hazo_i18n has no synchronous "get current locale" function anywhere in
+ * its public API — only async, request-scoped `getLocale()`/
+ * `getTranslations()` gated behind a runtime object that may not exist.
+ * That's a deliberate design decision on hazo_i18n's side (a long-lived
+ * process serves many concurrent requests in different locales, so there
+ * is nothing safe to peek at synchronously) — not a gap for this module to
+ * work around. See `resolvePackageLocale` below.
+ */
+export type TFunc = ((key: string, vars?: Record<string, string | number>) => string) & {
+    /** True iff `fallbackCatalog[key]` is a string. */
+    has(key: string): boolean;
+    /** Raw (non-interpolated) template for `key`, or `undefined` if absent. */
+    raw(key: string): string | undefined;
+};
+/**
+ * Minimal shape we rely on from `hazo_i18n` when it is present. This is a
+ * defensive, best-effort probe — hazo_core never imports hazo_i18n's types
+ * statically, and treats its module shape as unknown, checked at runtime.
+ */
+interface HazoI18nModuleShape {
+    registerCatalog?: (pkg: string, catalogs: Record<string, Record<string, unknown>>, owner?: string) => void;
+}
+/**
+ * Creates a namespaced translator for a hazo_* package's own baked-in
+ * strings.
+ *
+ * `t()` does a direct flat lookup on `fallbackCatalog` (catalogs are flat
+ * objects with literal-dotted string keys, e.g. `{ "login.submit": "Sign
+ * in" }` — NOT nested trees), then `{{var}}` interpolation. A missing key
+ * returns the bare key unchanged; a placeholder whose variable is missing
+ * from `vars` is left literal in the output.
+ *
+ * Side effect: on every call, kicks off (or reuses) the shared, once-per-
+ * process `optional_import('hazo_i18n')` probe. When it resolves and the
+ * module exposes `registerCatalog`, this package's fallback catalog is
+ * registered under `{ en: fallbackCatalog }` for cross-package visibility
+ * (hazo_i18n's admin panel / LLM export / compiled artifacts). This is
+ * pure side effect — idempotent on hazo_i18n's side (same-owner
+ * re-registrations merge without warning) — and never affects what `t()`/
+ * `t.has()`/`t.raw()` return; those always read `fallbackCatalog` directly.
+ *
+ * @param namespace - Package namespace, e.g. `"hazo_ui"`. Used only when
+ *   registering into hazo_i18n's cross-package registry.
+ * @param fallbackCatalog - Flat `{ key: "English text" }` map bundled with
+ *   the package.
+ */
+export declare function createPackageT(namespace: string, fallbackCatalog: Record<string, string>): TFunc;
+/**
+ * Registers additional locale catalogs into hazo_i18n's cross-package
+ * registry, for packages that ship non-English locale files beyond their
+ * own `createPackageT` default catalog.
+ *
+ * Uses the same shared, once-per-process hazo_i18n probe as
+ * `createPackageT`. If hazo_i18n isn't installed or hasn't resolved yet,
+ * this is a documented no-op — there is nothing else to register into, and
+ * throwing would defeat the point of an optional peer.
+ */
+export declare function registerCatalog(pkg: string, catalogs: Record<string, Record<string, string>>, owner?: string): void;
+/**
+ * Always returns `defaultLocale` unchanged.
+ *
+ * hazo_i18n has no synchronous locale getter by design — a long-lived
+ * process serves many concurrent requests in different locales, so there
+ * is nothing safe to peek at synchronously (see hazo_i18n's
+ * `src/lib/package_t.ts` header for the fuller rationale). This function
+ * exists as a stable extension point for the day hazo_i18n (or another
+ * provider) exposes one, not because it does anything today.
+ */
+export declare function resolvePackageLocale(defaultLocale: string): string;
+/**
+ * Test-only escape hatch: lets tests simulate hazo_i18n being installed
+ * without actually installing it. Also marks the shared probe as
+ * "resolved" so `createPackageT`/`registerCatalog` don't kick off (or wait
+ * on) a real dynamic import during tests. Not exported from the package's
+ * public entry points (`src/index.ts` / `src/index.client.ts`) — import
+ * directly from `hazo_core/i18n`'s source in tests only.
+ */
+export declare function __setHazoI18nModuleForTests(mod: HazoI18nModuleShape | null): void;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/i18n/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/i18n/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAQH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC,GAAG;IACtF,mDAAmD;IACnD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACtC,CAAC;AAEF;;;;GAIG;AACH,UAAU,mBAAmB;IAC3B,eAAe,CAAC,EAAE,CAChB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACjD,KAAK,CAAC,EAAE,MAAM,KACX,IAAI,CAAC;CACX;AAmED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,KAAK,CAuBP;AAMD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAChD,KAAK,CAAC,EAAE,MAAM,GACb,IAAI,CAaN;AAMD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAElE;AAMD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAGjF"}

package/dist/i18n/index.js

@@ -0,0 +1,196 @@
+/**
+ * hazo_core/i18n — canonical i18n bridge for hazo_* packages' own baked-in
+ * strings.
+ *
+ * 17+ packages each maintain a ~120-line local copy of this pattern (see
+ * hazo_auth/src/lib/create_package_t.ts, the reference this module is
+ * modeled on). This is the canonical version so those local copies can
+ * eventually be deleted.
+ *
+ * `hazo_i18n` — the companion package that provides a FULL i18n runtime
+ * (ICU, request-scoped locales, DB-authored catalogs, LLM translation
+ * pipeline) — does NOT exist as a dependency or peer dependency of
+ * hazo_core. It is probed lazily and optionally, exactly like the
+ * `hazo_debug` probe in `../debug/index.ts`. This keeps the workspace's
+ * peer-dep graph acyclic (a guarded import is not a peer) and guarantees
+ * that `createPackageT`'s `t()` NEVER blocks on, awaits, or becomes
+ * "aware" of hazo_i18n at read time — it always reads the bundled flat
+ * fallback catalog directly. The optional hazo_i18n probe exists purely as
+ * a fire-and-forget SIDE EFFECT: if hazo_i18n happens to be installed in
+ * the consuming app, we register this package's catalog into hazo_i18n's
+ * cross-package registry so the strings show up in its admin panel / LLM
+ * translation pipeline / compiled artifacts. That registration can never
+ * change what `t()`, `t.has()`, or `t.raw()` return.
+ *
+ * hazo_i18n has no synchronous "get current locale" function anywhere in
+ * its public API — only async, request-scoped `getLocale()`/
+ * `getTranslations()` gated behind a runtime object that may not exist.
+ * That's a deliberate design decision on hazo_i18n's side (a long-lived
+ * process serves many concurrent requests in different locales, so there
+ * is nothing safe to peek at synchronously) — not a gap for this module to
+ * work around. See `resolvePackageLocale` below.
+ */
+// ---------------------------------------------------------------------------
+// Shared, process-wide probe for the optional hazo_i18n peer
+// ---------------------------------------------------------------------------
+let hazoI18nModule = null;
+// Fire-and-forget: populates hazoI18nModule as soon as the microtask queue
+// runs. Using dynamic import() with bundler-ignore hints so Turbopack/
+// webpack/Vite never try to statically resolve this optional peer dep and
+// emit "Module not found" errors/warnings.
+//
+// The specifier MUST be a variable, not a string literal. Vite's
+// import-analysis (which Vitest also runs through) only honours
+// `@vite-ignore` when it can't statically determine the specifier —
+// es-module-lexer resolves a literal `import('hazo_i18n')` to a concrete
+// specifier regardless of any ignore comment, so Vite still tries to
+// resolve it and hard-fails the whole module graph when the package isn't
+// installed, bypassing this try/catch entirely. Routing the name through
+// `hazoI18nPkg` makes the specifier unanalyzable, which is what actually
+// makes Vite skip resolution (the `@vite-ignore` here only suppresses its
+// "cannot analyze" warning). Mirrors `../debug/index.ts`'s `hazoDebugPkg`
+// probe exactly.
+//
+// This probe runs ONCE per process — every `createPackageT()` call shares
+// this same cached promise/module reference, it is not re-triggered per
+// call.
+const hazoI18nPkg = 'hazo_i18n';
+let hazoI18nProbe = null;
+function ensureHazoI18nProbe() {
+    if (!hazoI18nProbe) {
+        hazoI18nProbe = (async () => {
+            try {
+                hazoI18nModule = (await import(
+                /* turbopackIgnore: true */ /* webpackIgnore: true */ /* @vite-ignore */ hazoI18nPkg));
+            }
+            catch {
+                // hazo_i18n not installed — nothing to register into.
+                hazoI18nModule = null;
+            }
+        })();
+    }
+    return hazoI18nProbe;
+}
+// ---------------------------------------------------------------------------
+// Interpolation
+// ---------------------------------------------------------------------------
+/**
+ * Simple `{{var}}` mustache-style interpolation — intentionally not ICU.
+ * Unknown placeholders are left as-is rather than dropped, so a missing var
+ * is obvious in the rendered string instead of silently disappearing.
+ */
+function interpolate(template, vars) {
+    if (!vars)
+        return template;
+    return template.replace(/\{\{\s*(\w+)\s*\}\}/g, (whole, name) => Object.prototype.hasOwnProperty.call(vars, name) ? String(vars[name]) : whole);
+}
+// ---------------------------------------------------------------------------
+// createPackageT
+// ---------------------------------------------------------------------------
+/**
+ * Creates a namespaced translator for a hazo_* package's own baked-in
+ * strings.
+ *
+ * `t()` does a direct flat lookup on `fallbackCatalog` (catalogs are flat
+ * objects with literal-dotted string keys, e.g. `{ "login.submit": "Sign
+ * in" }` — NOT nested trees), then `{{var}}` interpolation. A missing key
+ * returns the bare key unchanged; a placeholder whose variable is missing
+ * from `vars` is left literal in the output.
+ *
+ * Side effect: on every call, kicks off (or reuses) the shared, once-per-
+ * process `optional_import('hazo_i18n')` probe. When it resolves and the
+ * module exposes `registerCatalog`, this package's fallback catalog is
+ * registered under `{ en: fallbackCatalog }` for cross-package visibility
+ * (hazo_i18n's admin panel / LLM export / compiled artifacts). This is
+ * pure side effect — idempotent on hazo_i18n's side (same-owner
+ * re-registrations merge without warning) — and never affects what `t()`/
+ * `t.has()`/`t.raw()` return; those always read `fallbackCatalog` directly.
+ *
+ * @param namespace - Package namespace, e.g. `"hazo_ui"`. Used only when
+ *   registering into hazo_i18n's cross-package registry.
+ * @param fallbackCatalog - Flat `{ key: "English text" }` map bundled with
+ *   the package.
+ */
+export function createPackageT(namespace, fallbackCatalog) {
+    void ensureHazoI18nProbe().then(() => {
+        const mod = hazoI18nModule;
+        if (mod && typeof mod.registerCatalog === 'function') {
+            try {
+                mod.registerCatalog(namespace, { en: fallbackCatalog });
+            }
+            catch {
+                // hazo_i18n present but errored on registration — never let this
+                // affect the fallback-catalog read path.
+            }
+        }
+    });
+    const t = ((key, vars) => {
+        const template = fallbackCatalog[key];
+        if (template === undefined)
+            return key;
+        return interpolate(template, vars);
+    });
+    t.has = (key) => typeof fallbackCatalog[key] === 'string';
+    t.raw = (key) => fallbackCatalog[key];
+    return t;
+}
+// ---------------------------------------------------------------------------
+// registerCatalog (standalone)
+// ---------------------------------------------------------------------------
+/**
+ * Registers additional locale catalogs into hazo_i18n's cross-package
+ * registry, for packages that ship non-English locale files beyond their
+ * own `createPackageT` default catalog.
+ *
+ * Uses the same shared, once-per-process hazo_i18n probe as
+ * `createPackageT`. If hazo_i18n isn't installed or hasn't resolved yet,
+ * this is a documented no-op — there is nothing else to register into, and
+ * throwing would defeat the point of an optional peer.
+ */
+export function registerCatalog(pkg, catalogs, owner) {
+    void ensureHazoI18nProbe().then(() => {
+        const mod = hazoI18nModule;
+        if (mod && typeof mod.registerCatalog === 'function') {
+            try {
+                mod.registerCatalog(pkg, catalogs, owner);
+            }
+            catch {
+                // hazo_i18n present but errored on registration — swallow, same as
+                // createPackageT's side-effect registration.
+            }
+        }
+        // else: hazo_i18n absent/unresolved — no-op by design.
+    });
+}
+// ---------------------------------------------------------------------------
+// resolvePackageLocale
+// ---------------------------------------------------------------------------
+/**
+ * Always returns `defaultLocale` unchanged.
+ *
+ * hazo_i18n has no synchronous locale getter by design — a long-lived
+ * process serves many concurrent requests in different locales, so there
+ * is nothing safe to peek at synchronously (see hazo_i18n's
+ * `src/lib/package_t.ts` header for the fuller rationale). This function
+ * exists as a stable extension point for the day hazo_i18n (or another
+ * provider) exposes one, not because it does anything today.
+ */
+export function resolvePackageLocale(defaultLocale) {
+    return defaultLocale;
+}
+// ---------------------------------------------------------------------------
+// Test-only escape hatch
+// ---------------------------------------------------------------------------
+/**
+ * Test-only escape hatch: lets tests simulate hazo_i18n being installed
+ * without actually installing it. Also marks the shared probe as
+ * "resolved" so `createPackageT`/`registerCatalog` don't kick off (or wait
+ * on) a real dynamic import during tests. Not exported from the package's
+ * public entry points (`src/index.ts` / `src/index.client.ts`) — import
+ * directly from `hazo_core/i18n`'s source in tests only.
+ */
+export function __setHazoI18nModuleForTests(mod) {
+    hazoI18nModule = mod;
+    hazoI18nProbe = Promise.resolve();
+}
+//# sourceMappingURL=index.js.map

package/dist/i18n/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/i18n/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AA4BH,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,IAAI,cAAc,GAA+B,IAAI,CAAC;AAEtD,2EAA2E;AAC3E,uEAAuE;AACvE,0EAA0E;AAC1E,2CAA2C;AAC3C,EAAE;AACF,iEAAiE;AACjE,gEAAgE;AAChE,oEAAoE;AACpE,yEAAyE;AACzE,qEAAqE;AACrE,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,iBAAiB;AACjB,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,QAAQ;AACR,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,IAAI,aAAa,GAAyB,IAAI,CAAC;AAE/C,SAAS,mBAAmB;IAC1B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,cAAc,GAAG,CAAC,MAAM,MAAM;gBAC5B,2BAA2B,CAAC,yBAAyB,CAAC,kBAAkB,CAAC,WAAW,CACrF,CAAwB,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;gBACtD,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAsC;IAC3E,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3B,OAAO,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CACtE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAC9E,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,eAAuC;IAEvC,KAAK,mBAAmB,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACnC,MAAM,GAAG,GAAG,cAAc,CAAC;QAC3B,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,GAAG,CAAC,eAAe,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,yCAAyC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,CAAC,GAAW,EAAE,IAAsC,EAAU,EAAE;QACzE,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;QACvC,OAAO,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CAAU,CAAC;IAEZ,CAAC,CAAC,GAAG,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;IAC3E,CAAC,CAAC,GAAG,GAAG,CAAC,GAAW,EAAsB,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAElE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,QAAgD,EAChD,KAAc;IAEd,KAAK,mBAAmB,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACnC,MAAM,GAAG,GAAG,cAAc,CAAC;QAC3B,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,GAAG,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,6CAA6C;YAC/C,CAAC;QACH,CAAC;QACD,uDAAuD;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,aAAqB;IACxD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAA+B;IACzE,cAAc,GAAG,GAAG,CAAC;IACrB,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;AACpC,CAAC"}

package/dist/index.client.d.ts

@@ -17,6 +17,8 @@ export type { DateFormat, RetryOptions, DebouncedSaveContext, CreateDebouncedSav
 export { fetchWithRequestId } from './http/fetch_with_request_id.client.js';
 export { get_origin_url, create_redirect_url } from './http/get_origin_url.js';
 export { parseListLimit, parseListOffset } from './http/list_params.js';
+export { rateLimit, _clearBuckets, withRateLimit, getClientIp } from './http/rate_limit.js';
+export type { RateLimitOptions, RateLimitResult } from './http/rate_limit.js';
 export { createLogger } from './logger/index.client.js';
 export type { HazoCoreLogger } from './logger/index.js';
 //# sourceMappingURL=index.client.d.ts.map

package/dist/index.client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.client.d.ts","sourceRoot":"","sources":["../src/index.client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG3F,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,gBAAgB,EAChB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,SAAS,EACT,MAAM,EACN,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAIxE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.client.d.ts","sourceRoot":"","sources":["../src/index.client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG3F,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,gBAAgB,EAChB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,SAAS,EACT,MAAM,EACN,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5F,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAI9E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.client.js

@@ -20,6 +20,7 @@ export { generateRequestId, generateId, optional_import, safeJsonParse, sleep, f
 export { fetchWithRequestId } from './http/fetch_with_request_id.client.js';
 export { get_origin_url, create_redirect_url } from './http/get_origin_url.js';
 export { parseListLimit, parseListOffset } from './http/list_params.js';
+export { rateLimit, _clearBuckets, withRateLimit, getClientIp } from './http/rate_limit.js';
 // Logger — client-side stub emits to the browser console (server version
 // requires node:module + process.stderr, neither available in browsers/edge)
 export { createLogger } from './logger/index.client.js';

package/dist/index.client.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.client.js","sourceRoot":"","sources":["../src/index.client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,2BAA2B;AAC3B,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE3F,sDAAsD;AACtD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEvE,4DAA4D;AAC5D,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAe3B,yDAAyD;AACzD,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,gBAAgB,EAChB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAG7B,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,SAAS,EACT,MAAM,EACN,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAgB1B,iEAAiE;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExE,yEAAyE;AACzE,6EAA6E;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.client.js","sourceRoot":"","sources":["../src/index.client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,2BAA2B;AAC3B,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE3F,sDAAsD;AACtD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEvE,4DAA4D;AAC5D,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAe3B,yDAAyD;AACzD,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,gBAAgB,EAChB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAG7B,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,SAAS,EACT,MAAM,EACN,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAgB1B,iEAAiE;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAG5F,yEAAyE;AACzE,6EAA6E;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/index.d.ts

@@ -22,4 +22,6 @@ export { createRequestIdMiddleware, withRequestIdRouteHandler, } from './http/re
 export { fetchWithRequestId } from './http/fetch_with_request_id.js';
 export { get_origin_url, create_redirect_url } from './http/get_origin_url.js';
 export { parseListLimit, parseListOffset } from './http/list_params.js';
+export { rateLimit, _clearBuckets, withRateLimit, getClientIp } from './http/rate_limit.js';
+export type { RateLimitOptions, RateLimitResult } from './http/rate_limit.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG3F,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG9G,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,SAAS,EACT,MAAM,EACN,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,WAAW,EACX,UAAU,EACV,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACjH,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,OAAO,EACL,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG3F,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG9G,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,SAAS,EACT,MAAM,EACN,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,WAAW,EACX,UAAU,EACV,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACjH,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,OAAO,EACL,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5F,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -25,4 +25,5 @@ export { createRequestIdMiddleware, withRequestIdRouteHandler, } from './http/re
 export { fetchWithRequestId } from './http/fetch_with_request_id.js';
 export { get_origin_url, create_redirect_url } from './http/get_origin_url.js';
 export { parseListLimit, parseListOffset } from './http/list_params.js';
+export { rateLimit, _clearBuckets, withRateLimit, getClientIp } from './http/rate_limit.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY;AACZ,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE3F,qBAAqB;AACrB,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE9G,YAAY;AACZ,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,SAAS,EACT,MAAM,EACN,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAgB1B,SAAS;AACT,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAe3B,uCAAuC;AACvC,OAAO,EACL,WAAW,EACX,UAAU,EACV,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAG5B,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGjH,SAAS;AACT,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,QAAQ;AACR,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO;AACP,OAAO,EACL,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY;AACZ,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE3F,qBAAqB;AACrB,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE9G,YAAY;AACZ,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,SAAS,EACT,MAAM,EACN,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAgB1B,SAAS;AACT,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAe3B,uCAAuC;AACvC,OAAO,EACL,WAAW,EACX,UAAU,EACV,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAG5B,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGjH,SAAS;AACT,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,QAAQ;AACR,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO;AACP,OAAO,EACL,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_core",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "Foundation package for all hazo_* packages — errors, correlation ID, config, logger, debug, singletons, utils",
   "type": "module",
   "main": "dist/index.js",
@@ -22,6 +22,14 @@
     "./context": {
       "types": "./dist/context/index.d.ts",
       "import": "./dist/context/index.js"
+    },
+    "./i18n": {
+      "types": "./dist/i18n/index.d.ts",
+      "import": "./dist/i18n/index.js"
+    },
+    "./i18n/client": {
+      "types": "./dist/i18n/client.d.ts",
+      "import": "./dist/i18n/client.js"
     }
   },
   "files": [