hazo_secure 0.5.0 → 1.0.1

package/README.md

@@ -5,9 +5,10 @@ Security & compliance primitives for Node.js / Next.js apps. Four independent su
 | Subpath | Purpose |
 |---|---|
 | `hazo_secure/fetch` | SSRF-safe `safeFetch()` — domain allowlist, private-CIDR blocker, redirect controls |
-| `hazo_secure/ratelimit` | Sliding-window + token-bucket limiter with pluggable store (in-memory default, Redis adapter) |
+| `hazo_secure/ratelimit` | Sliding-window + token-bucket limiter with pluggable store (in-memory default, hazo_connect adapter) |
 | `hazo_secure/crypto` | AES-256-GCM field-level encryption with key versioning and AAD support |
 | `hazo_secure/gdpr` | Exporter / anonymiser registry + lifecycle orchestrator. Uses `hazo_jobs` for async export, `hazo_files` for ZIP delivery |
+| `hazo_secure/csrf` | Double-submit CSRF protection for Next.js routes — token generation, cookie header, constant-time verification |
 
 ## Install
 
@@ -15,7 +16,7 @@ Security & compliance primitives for Node.js / Next.js apps. Four independent su
 npm install hazo_secure
 ```
 
-`hazo_logs` is a required peer dep. `hazo_jobs` and `hazo_files` are optional peers — only needed if you use `hazo_secure/gdpr`.
+`hazo_logs` is a required peer dep. `hazo_connect`, `hazo_jobs`, and `hazo_files` are optional peers — `hazo_connect` is needed for `ConnectRateLimitStore`; `hazo_jobs` and `hazo_files` are only needed for `hazo_secure/gdpr`.
 
 ## Quick start
 
@@ -72,6 +73,90 @@ gdpr.registerExporter({
 });
 ```
 
+## New in 1.0.0
+
+### `hazo_secure/ratelimit` — ConnectRateLimitStore (token bucket)
+
+```ts
+import { ConnectRateLimitStore } from "hazo_secure/ratelimit";
+
+const store = new ConnectRateLimitStore({ getHazoConnect: () => db });
+const limiter = createRateLimiter({ store, windowMs: 60_000, max: 30 });
+```
+
+Stores token-bucket state in `hazo_rl_buckets` (see `migrations/001_hazo_rl_buckets.sql`). Run the migration before use. Requires `hazo_connect` peer.
+
+### `hazo_secure/fetch` — undici dispatcher + `validateConnectIp`
+
+```ts
+import { safeFetch, createSecureDispatcher, validateConnectIp } from "hazo_secure/fetch";
+
+// Use standalone to close the DNS-rebinding gap at socket creation time
+const dispatcher = createSecureDispatcher();
+const res = await safeFetch(url, { policy, deps: { fetchImpl: (u, i) => fetch(u, { ...i, dispatcher }) } });
+
+// Or validate resolved IPs yourself
+validateConnectIp("169.254.169.254"); // throws — blocked CIDR
+```
+
+Node.js only — undici is a Node dep. Edge runtime gets pre-flight checks only.
+
+### `hazo_secure/crypto` — HttpKeyProvider
+
+```ts
+import { HttpKeyProvider } from "hazo_secure/crypto";
+
+const provider = new HttpKeyProvider({
+  endpoint: "https://kms.internal/keys",
+  headers: { Authorization: `Bearer ${token}` },
+  ttlMs: 30_000,           // in-process cache TTL (default: 30 s)
+});
+provider.clearCache();     // force next fetch to re-fetch from endpoint
+```
+
+Cloud-agnostic — works with any HTTPS key endpoint that returns `{ keyId, key: "<base64>" }`. Caches keys in-process to avoid latency on every encrypt/decrypt call.
+
+### `hazo_secure/gdpr` — registry enhancements
+
+```ts
+import { createGdprRegistry, GdprRegistryError } from "hazo_secure/gdpr";
+
+const gdpr = createGdprRegistry({ auditIntent: logAuditEntry });
+
+// Validate registry completeness
+const issues = await gdpr.validateRegistry({ requiredDomains: ["persons", "payments"] });
+
+// Export user data (streams records from all registered exporters)
+for await (const file of gdpr.exportUser({ userId })) {
+  console.log(file.filename, file.content);
+}
+
+// Dry-run export without side effects
+const files = await gdpr.dryRunExport({ userId });
+
+// Anonymise user across all registered domains
+await gdpr.anonymiseUser({ userId });
+```
+
+`GdprRegistryError` is a typed error class — catch and `instanceof`-check it.
+
+---
+
+## Runtime Compatibility
+
+| Subpath | Edge runtime | Node.js (server) | Notes |
+|---|---|---|---|
+| `hazo_secure` | ✅ | ✅ | Types only, no runtime weight |
+| `hazo_secure/csrf` | ✅ | ✅ | Web Crypto API only |
+| `hazo_secure/ratelimit` | ✅ (MemoryRateLimitStore) | ✅ | ConnectRateLimitStore is Node-only (hazo_connect) |
+| `hazo_secure/fetch` | ⚠️ pre-flight only | ✅ full protection | Edge: host/IP checks only; Node: + undici connect-time validation |
+| `hazo_secure/crypto` | ❌ | ✅ | Uses `node:crypto` |
+| `hazo_secure/gdpr` | ❌ | ✅ | Async iterables + optional hazo_connect |
+
+**Node.js ≥ 18 required** for all Node-only subpaths.
+
+---
+
 ## Design
 
 Each subpath is independent — no cross-imports between `/fetch`, `/ratelimit`, `/crypto`, `/gdpr`. The `gdpr` module *consumes* the others when a project wires them together, but the package itself doesn't entangle them.

package/dist/crypto/index.d.ts

@@ -1,3 +1,34 @@
+interface HttpKeyProviderOptions {
+    /**
+     * Base HTTPS endpoint for key material.
+     * - current(): GET {endpoint}/current → { keyId: string; key: string }
+     * - byId(id):  GET {endpoint}/{id}    → { keyId: string; key: string }
+     *
+     * `key` must be base64url-encoded 32-byte AES-256 key material.
+     */
+    endpoint: string;
+    /**
+     * Fetch implementation. Inject safeFetch from hazo_secure/fetch for SSRF
+     * protection on external KMS endpoints. Defaults to globalThis.fetch.
+     */
+    fetch?: typeof globalThis.fetch;
+    /** Bearer token added as Authorization header on every request. */
+    token?: string;
+    /** Additional headers added to every request. */
+    headers?: Record<string, string>;
+}
+declare class HttpKeyProvider implements KeyProvider {
+    #private;
+    constructor(opts: HttpKeyProviderOptions);
+    current(): Promise<{
+        keyId: string;
+        key: Uint8Array;
+    }>;
+    byId(keyId: string): Promise<Uint8Array>;
+    /** Clear in-process key cache. Call after rotating keys. */
+    clearCache(): void;
+}
+
 /**
  * Source of symmetric keys for `encryptField` / `decryptField`. The current
  * key is used for encryption; `byId` resolves any key (current or rotated-out)
@@ -104,4 +135,4 @@ declare class StaticKeyProvider implements KeyProvider {
  *  Convention: `<table>:<entityId>:<field>` — collision-free across tables. */
 declare function aadFor(table: string, entityId: string, field: string): string;
 
-export { CryptoError, type EncryptedField, EnvKeyProvider, type KeyProvider, StaticKeyProvider, aadFor, decryptField, encryptField };
+export { CryptoError, type EncryptedField, EnvKeyProvider, HttpKeyProvider, type HttpKeyProviderOptions, type KeyProvider, StaticKeyProvider, aadFor, decryptField, encryptField };

package/dist/crypto/index.js

@@ -1,5 +1,84 @@
 // src/crypto/index.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+
+// src/crypto/provider-http.ts
+var KEY_LEN = 32;
+var HttpKeyProvider = class {
+  #endpoint;
+  #fetch;
+  #token;
+  #headers;
+  /** Cache for key material, keyed by keyId. */
+  #cache = /* @__PURE__ */ new Map();
+  /** Cached result of the most recent successful /current fetch. */
+  #currentCache = null;
+  constructor(opts) {
+    this.#endpoint = opts.endpoint.replace(/\/$/, "");
+    this.#fetch = opts.fetch ?? globalThis.fetch;
+    this.#token = opts.token;
+    this.#headers = opts.headers ?? {};
+  }
+  async current() {
+    if (this.#currentCache) return this.#currentCache;
+    const data = await this.#fetchSegment("current");
+    const key = this.#parseAndCacheKey(data);
+    this.#currentCache = { keyId: data.keyId, key };
+    return this.#currentCache;
+  }
+  async byId(keyId) {
+    const cached = this.#cache.get(keyId);
+    if (cached) return cached;
+    const data = await this.#fetchSegment(keyId);
+    return this.#parseAndCacheKey(data);
+  }
+  /** Clear in-process key cache. Call after rotating keys. */
+  clearCache() {
+    this.#cache.clear();
+    this.#currentCache = null;
+  }
+  #parseAndCacheKey(data) {
+    const buf = Buffer.from(data.key, "base64url");
+    if (buf.byteLength !== KEY_LEN) {
+      throw new CryptoError(
+        `HttpKeyProvider: key ${data.keyId} is ${buf.byteLength} bytes; AES-256-GCM needs ${KEY_LEN}`,
+        "invalid_key"
+      );
+    }
+    const key = new Uint8Array(buf);
+    this.#cache.set(data.keyId, key);
+    return key;
+  }
+  async #fetchSegment(segment) {
+    const url = `${this.#endpoint}/${segment}`;
+    const headers = { ...this.#headers };
+    if (this.#token) headers["Authorization"] = `Bearer ${this.#token}`;
+    let res;
+    try {
+      res = await this.#fetch(url, { headers });
+    } catch (err) {
+      throw new CryptoError(
+        `HttpKeyProvider: fetch failed for ${url}: ${err instanceof Error ? err.message : String(err)}`,
+        "key_not_found"
+      );
+    }
+    if (!res.ok) {
+      throw new CryptoError(
+        `HttpKeyProvider: endpoint returned ${res.status} for ${url}`,
+        "key_not_found"
+      );
+    }
+    try {
+      return await res.json();
+    } catch {
+      throw new CryptoError(
+        `HttpKeyProvider: invalid JSON response from ${url}`,
+        "key_not_found"
+      );
+    }
+  }
+};
+
+// src/crypto/index.ts
 var CryptoError = class extends Error {
   constructor(message, code) {
     super(message);
@@ -11,7 +90,7 @@ var CryptoError = class extends Error {
 var ALG = "aes-256-gcm";
 var IV_LEN = 12;
 var TAG_LEN = 16;
-var KEY_LEN = 32;
+var KEY_LEN2 = 32;
 function toB64(buf) {
   return Buffer.from(buf).toString("base64");
 }
@@ -20,9 +99,9 @@ function fromB64(s) {
 }
 async function encryptField(plaintext, opts) {
   const { keyId, key } = await opts.keys.current();
-  if (key.byteLength !== KEY_LEN) {
+  if (key.byteLength !== KEY_LEN2) {
     throw new CryptoError(
-      `Key for ${keyId} is ${key.byteLength} bytes; AES-256-GCM needs ${KEY_LEN}.`,
+      `Key for ${keyId} is ${key.byteLength} bytes; AES-256-GCM needs ${KEY_LEN2}.`,
       "invalid_key"
     );
   }
@@ -99,9 +178,9 @@ var EnvKeyProvider = class {
       throw new CryptoError(`Missing ${varName} env var`, "key_not_found");
     }
     const buf = Buffer.from(raw, "base64");
-    if (buf.byteLength !== KEY_LEN) {
+    if (buf.byteLength !== KEY_LEN2) {
       throw new CryptoError(
-        `${varName} decodes to ${buf.byteLength} bytes; AES-256-GCM needs ${KEY_LEN}`,
+        `${varName} decodes to ${buf.byteLength} bytes; AES-256-GCM needs ${KEY_LEN2}`,
         "invalid_key"
       );
     }
@@ -140,6 +219,7 @@ function aadFor(table, entityId, field) {
 export {
   CryptoError,
   EnvKeyProvider,
+  HttpKeyProvider,
   StaticKeyProvider,
   aadFor,
   decryptField,

package/dist/fetch/index.d.ts

@@ -1,3 +1,19 @@
+import { Agent } from 'undici';
+
+/**
+ * Validates a resolved IP at connect time. Throws if private/reserved.
+ * Exported so it can be unit-tested directly.
+ */
+declare function validateConnectIp(ip: string): void;
+/**
+ * Creates an undici Agent whose DNS lookup validates the resolved IP before
+ * the TCP socket is opened. This prevents DNS rebinding: even if the DNS
+ * record flips after the pre-flight check, the IP is re-validated here.
+ *
+ * Node 18+ ships undici as a built-in; we pin an explicit dep for stability.
+ */
+declare function createSecureDispatcher(): Agent;
+
 interface SafeFetchPolicy {
     allowedHosts?: readonly string[];
     allowedHostPatterns?: readonly RegExp[];
@@ -21,4 +37,4 @@ declare class SafeFetchError extends Error {
 }
 declare function safeFetch(input: string | URL, options: SafeFetchOptions): Promise<Response>;
 
-export { type SafeFetchDeps, SafeFetchError, type SafeFetchErrorCode, type SafeFetchOptions, type SafeFetchPolicy, safeFetch };
+export { type SafeFetchDeps, SafeFetchError, type SafeFetchErrorCode, type SafeFetchOptions, type SafeFetchPolicy, createSecureDispatcher, safeFetch, validateConnectIp };

package/dist/fetch/index.js

@@ -1,5 +1,6 @@
 // src/fetch/index.ts
-import { lookup } from "dns/promises";
+import { lookup as lookup2 } from "dns/promises";
+import { fetch as undiciFetch } from "undici";
 
 // src/fetch/cidr.ts
 import { isIP } from "net";
@@ -70,7 +71,38 @@ function isPrivateIp(ip) {
   return false;
 }
 
+// src/fetch/dispatcher.ts
+import { Agent } from "undici";
+import * as dns from "dns";
+function validateConnectIp(ip) {
+  if (isPrivateIp(ip)) {
+    const err = new Error(
+      `SSRF: resolved IP ${ip} is a private/reserved address \u2014 blocked at connect time`
+    );
+    err.code = "SSRF_PRIVATE_IP";
+    throw err;
+  }
+}
+function createSecureDispatcher() {
+  return new Agent({
+    connect: {
+      lookup(hostname, _options, callback) {
+        dns.lookup(hostname, (err, address, family) => {
+          if (err) return callback(err, "", 4);
+          try {
+            validateConnectIp(address);
+          } catch (ssrfErr) {
+            return callback(ssrfErr, "", 4);
+          }
+          callback(null, address, family);
+        });
+      }
+    }
+  });
+}
+
 // src/fetch/index.ts
+var secureDispatcher = createSecureDispatcher();
 var SafeFetchError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -83,7 +115,7 @@ var DEFAULT_TIMEOUT_MS = 1e4;
 var DEFAULT_MAX_REDIRECTS = 3;
 var DEFAULT_PROTOCOLS = ["https:", "http:"];
 async function defaultDnsLookup(host) {
-  const records = await lookup(host, { all: true, verbatim: true });
+  const records = await lookup2(host, { all: true, verbatim: true });
   return records.map((r) => r.address);
 }
 function hostAllowed(host, policy) {
@@ -129,7 +161,8 @@ async function validateUrl(url, policy, deps) {
 }
 async function safeFetch(input, options) {
   const { policy, deps = {}, ...init } = options;
-  const fetchImpl = deps.fetchImpl ?? fetch;
+  const fetchImpl = deps.fetchImpl ?? // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  ((url, init2) => undiciFetch(url, { ...init2, dispatcher: secureDispatcher }));
   const maxRedirects = policy.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
   const timeoutMs = policy.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   let currentUrl;
@@ -185,5 +218,7 @@ async function safeFetch(input, options) {
 }
 export {
   SafeFetchError,
-  safeFetch
+  createSecureDispatcher,
+  safeFetch,
+  validateConnectIp
 };

package/dist/gdpr/index.d.ts

@@ -13,12 +13,50 @@ interface DomainAnonymiser {
     domain: string;
     anonymise(ctx: ExporterContext): Promise<void>;
 }
+type UserExportResult = Array<{
+    domain: string;
+    files: Array<{
+        filename: string;
+        content: Uint8Array | string;
+    }>;
+}>;
+type DryRunExportResult = Array<{
+    domain: string;
+    files: string[];
+}>;
+interface ValidateRegistryOptions {
+    /** Domain names that MUST each have both an exporter and an anonymiser registered. */
+    requiredDomains: string[];
+}
+/** Matches hazo_audit's auditIntent after partial application with an adapter. */
+type AuditIntentFn = (name: string, callback: () => Promise<void>, opts?: {
+    subject_kind?: string;
+    subject_id?: string;
+    metadata?: Record<string, unknown>;
+}) => Promise<void>;
+interface GdprRegistryOptions {
+    /**
+     * Optional audit trail. Pass hazo_audit's auditIntent partially applied:
+     *   createGdprRegistry({
+     *     auditIntent: (name, cb, opts) => auditIntent(adapter, name, cb, opts),
+     *   })
+     */
+    auditIntent?: AuditIntentFn;
+}
+declare class GdprRegistryError extends Error {
+    readonly code: 'incomplete_registry';
+    constructor(message: string, code: 'incomplete_registry');
+}
 interface GdprRegistry {
     registerExporter(exporter: DomainExporter): void;
     registerAnonymiser(anonymiser: DomainAnonymiser): void;
     listExporters(): readonly DomainExporter[];
     listAnonymisers(): readonly DomainAnonymiser[];
+    exportUser(ctx: ExporterContext): Promise<UserExportResult>;
+    anonymiseUser(ctx: ExporterContext): Promise<void>;
+    validateRegistry(opts: ValidateRegistryOptions): void;
+    dryRunExport(ctx: ExporterContext): Promise<DryRunExportResult>;
 }
-declare function createGdprRegistry(): GdprRegistry;
+declare function createGdprRegistry(opts?: GdprRegistryOptions): GdprRegistry;
 
-export { type DomainAnonymiser, type DomainExporter, type ExporterContext, type GdprRegistry, createGdprRegistry };
+export { type AuditIntentFn, type DomainAnonymiser, type DomainExporter, type DryRunExportResult, type ExporterContext, type GdprRegistry, GdprRegistryError, type GdprRegistryOptions, type UserExportResult, type ValidateRegistryOptions, createGdprRegistry };

package/dist/gdpr/index.js

@@ -1,22 +1,102 @@
 // src/gdpr/index.ts
-function createGdprRegistry() {
+var GdprRegistryError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "GdprRegistryError";
+  }
+  code;
+};
+function createGdprRegistry(opts = {}) {
   const exporters = [];
   const anonymisers = [];
+  const { auditIntent } = opts;
+  async function exportUser(ctx) {
+    const run = async () => {
+      const result = [];
+      for (const exporter of exporters) {
+        const files = [];
+        for await (const item of exporter.export(ctx)) {
+          files.push(item);
+        }
+        result.push({ domain: exporter.domain, files });
+      }
+      return result;
+    };
+    if (auditIntent) {
+      let result;
+      await auditIntent(
+        "gdpr.export",
+        async () => {
+          result = await run();
+        },
+        { subject_kind: "user", subject_id: ctx.userId }
+      );
+      return result;
+    }
+    return run();
+  }
+  async function anonymiseUser(ctx) {
+    const run = async () => {
+      for (const anonymiser of anonymisers) {
+        await anonymiser.anonymise(ctx);
+      }
+    };
+    if (auditIntent) {
+      await auditIntent(
+        "gdpr.anonymise",
+        run,
+        { subject_kind: "user", subject_id: ctx.userId, metadata: { domainCount: anonymisers.length } }
+      );
+    } else {
+      await run();
+    }
+  }
+  function validateRegistry(options) {
+    const exporterDomains = new Set(exporters.map((e) => e.domain));
+    const anonymiserDomains = new Set(anonymisers.map((a) => a.domain));
+    const gaps = [];
+    for (const domain of options.requiredDomains) {
+      const missing = [];
+      if (!exporterDomains.has(domain)) missing.push("exporter");
+      if (!anonymiserDomains.has(domain)) missing.push("anonymiser");
+      if (missing.length > 0) gaps.push(`  ${domain}: missing ${missing.join(", ")}`);
+    }
+    if (gaps.length > 0) {
+      throw new GdprRegistryError(
+        `GDPR registry incomplete:
+${gaps.join("\n")}`,
+        "incomplete_registry"
+      );
+    }
+  }
+  async function dryRunExport(ctx) {
+    const result = [];
+    for (const exporter of exporters) {
+      const files = [];
+      for await (const item of exporter.export(ctx)) {
+        files.push(item.filename);
+      }
+      result.push({ domain: exporter.domain, files });
+    }
+    return result;
+  }
   return {
-    registerExporter(e) {
+    registerExporter: (e) => {
       exporters.push(e);
     },
-    registerAnonymiser(a) {
+    registerAnonymiser: (a) => {
       anonymisers.push(a);
     },
-    listExporters() {
-      return exporters;
-    },
-    listAnonymisers() {
-      return anonymisers;
-    }
+    listExporters: () => exporters,
+    listAnonymisers: () => anonymisers,
+    exportUser,
+    anonymiseUser,
+    validateRegistry,
+    dryRunExport
   };
 }
 export {
+  GdprRegistryError,
   createGdprRegistry
 };

package/dist/ratelimit/index.d.ts

@@ -8,7 +8,7 @@ declare class MemoryRateLimitStore implements RateLimitStore {
     private sweepTimer;
     constructor(opts?: MemoryStoreOptions);
     get(key: string): Promise<RateLimitState | null>;
-    increment(key: string, windowMs: number): Promise<RateLimitState>;
+    increment(key: string, windowMs: number, _max?: number): Promise<RateLimitState>;
     reset(key: string): Promise<void>;
     size(): number;
     sweep(): void;
@@ -16,6 +16,50 @@ declare class MemoryRateLimitStore implements RateLimitStore {
 }
 declare function getDefaultMemoryStore(): MemoryRateLimitStore;
 
+type BucketRow = {
+    id: string;
+    tokens: number;
+    last_refill_at: string;
+    max_tokens: number;
+    refill_rate_per_ms: number;
+};
+type SvcLike = {
+    findOneBy(criteria: Record<string, unknown>): Promise<BucketRow | null>;
+    insert(data: Partial<BucketRow> | Partial<BucketRow>[]): Promise<BucketRow[]>;
+    updateById(id: unknown, patch: Partial<BucketRow>): Promise<BucketRow[]>;
+    deleteById(id: unknown): Promise<void>;
+};
+interface ConnectRateLimitStoreOptions {
+    /**
+     * Factory that resolves to a hazo_connect HazoConnectAdapter. Used in production.
+     * Call createCrudService from hazo_connect/server before passing.
+     */
+    getAdapter?: () => unknown | Promise<unknown>;
+    /** For testing: inject a CrudService stub directly. */
+    _svc?: () => SvcLike | Promise<SvcLike>;
+    /** Injectable clock. Defaults to Date.now. */
+    now?: () => number;
+}
+/**
+ * Rate-limit store backed by hazo_connect (PostgreSQL or SQLite).
+ * Uses a token bucket algorithm — no boundary burst, continuous token refill.
+ *
+ * Requires the hazo_rl_buckets table from migrations/001_hazo_rl_buckets.sql.
+ *
+ * Token bucket → RateLimitState mapping:
+ *   count = max - tokensAfterConsumption
+ *   count <= max  → allowed (tokensAfter >= 0)
+ *   count >  max  → denied  (tokensAfter < 0)
+ */
+declare class ConnectRateLimitStore implements RateLimitStore {
+    #private;
+    constructor(opts: ConnectRateLimitStoreOptions);
+    private svc;
+    get(key: string): Promise<RateLimitState | null>;
+    increment(key: string, windowMs: number, max?: number): Promise<RateLimitState>;
+    reset(key: string): Promise<void>;
+}
+
 interface RateLimitState {
     count: number;
     resetAt: number;
@@ -28,7 +72,8 @@ interface RateLimitDecision {
 }
 interface RateLimitStore {
     get(key: string): Promise<RateLimitState | null>;
-    increment(key: string, windowMs: number): Promise<RateLimitState>;
+    /** max is optional for backward compat; ConnectRateLimitStore requires it. */
+    increment(key: string, windowMs: number, max?: number): Promise<RateLimitState>;
     reset(key: string): Promise<void>;
 }
 interface RateLimiterOptions {
@@ -51,4 +96,4 @@ interface WithRateLimitOptions extends RateLimiterOptions {
 type AnyRouteHandler = (...args: any[]) => Promise<Response>;
 declare function withRateLimit<H extends AnyRouteHandler>(handler: H, opts: WithRateLimitOptions): H;
 
-export { MemoryRateLimitStore, type RateLimitDecision, type RateLimitState, type RateLimitStore, type RateLimiter, type RateLimiterOptions, type WithRateLimitOptions, checkRateLimit, createRateLimiter, defaultKeyResolver, getDefaultMemoryStore, withRateLimit };
+export { ConnectRateLimitStore, type ConnectRateLimitStoreOptions, MemoryRateLimitStore, type RateLimitDecision, type RateLimitState, type RateLimitStore, type RateLimiter, type RateLimiterOptions, type WithRateLimitOptions, checkRateLimit, createRateLimiter, defaultKeyResolver, getDefaultMemoryStore, withRateLimit };

package/dist/ratelimit/index.js

@@ -21,7 +21,7 @@ var MemoryRateLimitStore = class {
     }
     return { ...e.state };
   }
-  async increment(key, windowMs) {
+  async increment(key, windowMs, _max) {
     const t = this.now();
     const existing = this.map.get(key);
     if (!existing || existing.expiresAt <= t) {
@@ -57,6 +57,85 @@ function getDefaultMemoryStore() {
   return defaultStore;
 }
 
+// src/ratelimit/store-connect.ts
+var ConnectRateLimitStore = class {
+  #getSvc;
+  #now;
+  constructor(opts) {
+    if (opts._svc) {
+      this.#getSvc = opts._svc;
+    } else if (opts.getAdapter) {
+      const getAdapter = opts.getAdapter;
+      this.#getSvc = async () => {
+        const { createCrudService } = await import("hazo_connect/server");
+        const adapter = await getAdapter();
+        return createCrudService(adapter, "hazo_rl_buckets", {
+          autoId: { enabled: false, column: "id" }
+        });
+      };
+    } else {
+      throw new Error("ConnectRateLimitStore: provide getAdapter or _svc");
+    }
+    this.#now = opts.now ?? Date.now;
+  }
+  async svc() {
+    return this.#getSvc();
+  }
+  async get(key) {
+    const svc = await this.svc();
+    const row = await svc.findOneBy({ id: key });
+    if (!row) return null;
+    const now = this.#now();
+    const elapsedMs = now - new Date(row.last_refill_at).getTime();
+    const tokens = Math.min(row.max_tokens, row.tokens + elapsedMs * row.refill_rate_per_ms);
+    const storedTokens = Math.max(0, tokens);
+    const resetAt = now + Math.ceil(Math.max(0, 1 - storedTokens) / row.refill_rate_per_ms);
+    return { count: Math.max(0, row.max_tokens - tokens), resetAt };
+  }
+  async increment(key, windowMs, max) {
+    if (max === void 0) {
+      throw new Error(
+        "ConnectRateLimitStore requires max in increment(). Ensure createRateLimiter / checkRateLimit receives { max }."
+      );
+    }
+    const svc = await this.svc();
+    const now = this.#now();
+    const refillRatePerMs = max / windowMs;
+    const row = await svc.findOneBy({ id: key });
+    let tokensAfter;
+    if (!row) {
+      tokensAfter = max - 1;
+      await svc.insert({
+        id: key,
+        tokens: Math.max(0, tokensAfter),
+        last_refill_at: new Date(now).toISOString(),
+        max_tokens: max,
+        refill_rate_per_ms: refillRatePerMs
+      });
+    } else {
+      const elapsedMs = now - new Date(row.last_refill_at).getTime();
+      const refilledTokens = Math.min(max, row.tokens + elapsedMs * refillRatePerMs);
+      tokensAfter = refilledTokens - 1;
+      await svc.updateById(key, {
+        tokens: Math.max(0, tokensAfter),
+        last_refill_at: new Date(now).toISOString(),
+        max_tokens: max,
+        refill_rate_per_ms: refillRatePerMs
+      });
+    }
+    const count = max - tokensAfter;
+    const storedTokens = Math.max(0, tokensAfter);
+    const refillNeeded = Math.max(0, 1 - storedTokens);
+    const resetAt = now + Math.ceil(refillNeeded / refillRatePerMs);
+    return { count, resetAt };
+  }
+  async reset(key) {
+    const svc = await this.svc();
+    const row = await svc.findOneBy({ id: key });
+    if (row) await svc.deleteById(key);
+  }
+};
+
 // src/ratelimit/index.ts
 function defaultKeyResolver(req) {
   const headers = req.headers;
@@ -73,7 +152,7 @@ function createRateLimiter(opts) {
   const keyResolver = opts.keyResolver ?? defaultKeyResolver;
   const now = opts.now ?? Date.now;
   async function checkKey(key) {
-    const state = await store.increment(key, opts.windowMs);
+    const state = await store.increment(key, opts.windowMs, opts.max);
     const allowed = state.count <= opts.max;
     const remaining = Math.max(0, opts.max - state.count);
     const retryAfterSeconds = Math.max(0, Math.ceil((state.resetAt - now()) / 1e3));
@@ -113,6 +192,7 @@ function withRateLimit(handler, opts) {
   return fn;
 }
 export {
+  ConnectRateLimitStore,
   MemoryRateLimitStore,
   checkRateLimit,
   createRateLimiter,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_secure",
-  "version": "0.5.0",
+  "version": "1.0.1",
   "description": "Security & compliance primitives — SSRF-safe fetch, rate limiting, field-level encryption, GDPR orchestration. Four subpath modules, pick the ones you need.",
   "type": "module",
   "main": "./dist/index.js",
@@ -54,14 +54,25 @@
     "install:test-app": "cd test-app && npm install",
     "prepublishOnly": "npm run build"
   },
+  "dependencies": {
+    "undici": "^7.3.0"
+  },
   "peerDependencies": {
     "hazo_logs": "^1.1.0",
+    "hazo_connect": "^2.6.0",
     "hazo_jobs": "^0.7.0",
     "hazo_files": "^1.4.7"
   },
   "peerDependenciesMeta": {
-    "hazo_jobs": { "optional": true },
-    "hazo_files": { "optional": true }
+    "hazo_connect": {
+      "optional": true
+    },
+    "hazo_jobs": {
+      "optional": true
+    },
+    "hazo_files": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@types/jest": "^29.0.0",