stratal 0.0.21 → 0.0.23

package/dist/rate-limiter/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/rate-limiter/limit.ts","../../src/rate-limiter/rate-limiter-registry.ts","../../src/rate-limiter/stores/kv-store.ts","../../src/rate-limiter/stores/memory-store.ts","../../src/rate-limiter/stores/store-factory.ts","../../src/rate-limiter/rate-limiter.module.ts"],"sourcesContent":["import type { RouterContext } from '../router/router-context'\n\n/**\n * Standard rate-limit response headers passed to custom response handlers.\n * Keys are canonical HTTP header names; values are the stringified counts.\n */\nexport interface RateLimitHeaders {\n  'Retry-After': string\n  'X-RateLimit-Limit': string\n  'X-RateLimit-Remaining': string\n  'X-RateLimit-Reset': string\n}\n\n/**\n * Custom response handler invoked when a limit is exceeded and the user\n * supplied `.response()` on the {@link Limit}. Receives the request context\n * and the precomputed standard headers (which the handler can spread, drop,\n * or override).\n */\nexport type RateLimitResponseHandler = (\n  ctx: RouterContext,\n  headers: RateLimitHeaders,\n) => Response | Promise<Response>\n\n/**\n * A single rate limit window.\n *\n * Build via the static factories (`perSecond`, `perMinute`, `perMinutes`,\n * `perHour`, `perDay`, `none`). Chain `.by(key)` to scope per-actor and\n * `.response(handler)` to override the default 429 response.\n *\n * Returned (singly or as an array) by limiter resolvers registered via\n * `RateLimiterRegistry.for()`.\n *\n * @example\n * ```typescript\n * Limit.perMinute(60).by(ctx.header('cf-connecting-ip') ?? 'global')\n * Limit.perHour(100).by(userId)\n * Limit.none()                                // bypass\n * ```\n */\nexport class Limit {\n  private _key?: string\n  private _customResponse?: RateLimitResponseHandler\n\n  private constructor(\n    public readonly windowSeconds: number,\n    public readonly max: number,\n    public readonly disabled = false,\n  ) {}\n\n  static perSecond(max: number): Limit {\n    return new Limit(1, max)\n  }\n\n  static perSeconds(seconds: number, max: number): Limit {\n    return new Limit(seconds, max)\n  }\n\n  static perMinute(max: number): Limit {\n    return new Limit(60, max)\n  }\n\n  static perMinutes(minutes: number, max: number): Limit {\n    return new Limit(minutes * 60, max)\n  }\n\n  static perHour(max: number): Limit {\n    return new Limit(60 * 60, max)\n  }\n\n  static perDay(max: number): Limit {\n    return new Limit(24 * 60 * 60, max)\n  }\n\n  /** Bypass the limiter entirely for this request. */\n  static none(): Limit {\n    return new Limit(0, 0, true)\n  }\n\n  /** Scope this limit to a specific actor (user id, IP, tenant, etc.). */\n  by(key: string | number): this {\n    this._key = String(key)\n    return this\n  }\n\n  /**\n   * Override the default 429 response. The handler receives the standard\n   * `RateLimitHeaders` so it can spread them onto its own Response or omit\n   * them as it sees fit.\n   */\n  response(handler: RateLimitResponseHandler): this {\n    this._customResponse = handler\n    return this\n  }\n\n  get key(): string | undefined {\n    return this._key\n  }\n\n  get customResponse(): RateLimitResponseHandler | undefined {\n    return this._customResponse\n  }\n}\n","import { inject } from 'tsyringe'\nimport { Transient } from '../di/decorators'\nimport { Macroable } from '../macroable'\nimport type { Next } from '../router/middleware.interface'\nimport type { RouterContext } from '../router/router-context'\nimport { RateLimiterNotDefinedError, TooManyRequestsError } from './errors'\nimport type { Limit, RateLimitHeaders } from './limit'\nimport { RATE_LIMITER_TOKENS } from './rate-limiter.tokens'\nimport type { IRateLimiterStore, RateLimitHit } from './stores/rate-limiter-store.interface'\n\n/**\n * Resolver function registered via {@link RateLimiterRegistry.for}. Receives\n * the request context and returns the limit (or limits) that apply to this\n * request. Return `Limit.none()` to bypass for the current request.\n */\nexport type LimitResolver = (\n  ctx: RouterContext,\n) => Limit | Limit[] | Promise<Limit | Limit[]>\n\ninterface StoredHit {\n  count: number\n  resetAt: number\n}\n\n/**\n * Central registry of named rate limiters and the request-time enforcement\n * pipeline. Resolved as a singleton; consumed by `ThrottleMiddleware`.\n *\n * Register limiters in a module's `onInitialize` hook:\n * ```typescript\n * @Module({})\n * export class RateLimitsModule implements OnInitialize {\n *   onInitialize({ container }: ModuleContext): void {\n *     const limiter = container.resolve<RateLimiterRegistry>(RATE_LIMITER_TOKENS.Registry)\n *     limiter.for('api', (ctx) => Limit.perMinute(60).by(ctx.header('cf-connecting-ip') ?? '*'))\n *   }\n * }\n * ```\n *\n * Extensible via `Macroable`: adapter packages (e.g. `@stratal/framework/auth`)\n * can attach extra registration methods such as `forPath()` for better-auth\n * `customRules` interop.\n */\n// IMPORTANT: do not pass a token to @Transient — that would self-register\n// the class globally at module-load time, making the Registry resolvable\n// even when the user never imported RateLimiterModule. We rely on\n// RateLimiterModule providers being the only binding source, so\n// `{ isOptional: true }` in ThrottleMiddleware correctly returns undefined\n// when the module is missing.\n@Transient()\nexport class RateLimiterRegistry extends Macroable {\n  private readonly resolvers = new Map<string, LimitResolver>()\n\n  constructor(\n    @inject(RATE_LIMITER_TOKENS.Store) private readonly store: IRateLimiterStore,\n  ) {\n    super()\n  }\n\n  /**\n   * Register a named limiter. Names must be unique; calling `for()` again\n   * with the same name overwrites the previous resolver (matches Laravel\n   * `RateLimiter::for` semantics — last definition wins).\n   */\n  for(name: string, resolver: LimitResolver): void {\n    this.resolvers.set(name, resolver)\n  }\n\n  has(name: string): boolean {\n    return this.resolvers.has(name)\n  }\n\n  /**\n   * Enforce the named limiter for the current request. Called by\n   * `ThrottleMiddleware` (the per-name class produced by\n   * `createThrottleMiddleware`). Resolves the limiter, increments the store\n   * for each non-bypassed limit, sets `X-RateLimit-*` headers on success, and\n   * either invokes the limit's custom `.response()` or throws\n   * {@link TooManyRequestsError} when a limit is exceeded.\n   */\n  async handle(name: string, ctx: RouterContext, next: Next): Promise<Response | void> {\n    const resolver = this.resolvers.get(name)\n    if (!resolver) {\n      throw new RateLimiterNotDefinedError(name)\n    }\n\n    const resolved = await resolver(ctx)\n    const limits = Array.isArray(resolved) ? resolved : [resolved]\n    const active = limits.filter((l) => !l.disabled)\n\n    if (active.length === 0) {\n      return next()\n    }\n\n    let mostRestrictive: { limit: Limit; remaining: number; resetAt: number } | undefined\n    let exceeded: { limit: Limit; resetAt: number } | undefined\n\n    for (const limit of active) {\n      const key = this.makeKey(name, limit.windowSeconds, limit.key)\n      const hit = await this.hit(key, limit.windowSeconds)\n\n      if (hit.count > limit.max) {\n        if (!exceeded || hit.resetAt > exceeded.resetAt) {\n          exceeded = { limit, resetAt: hit.resetAt }\n        }\n        continue\n      }\n\n      const remaining = limit.max - hit.count\n      if (!mostRestrictive || remaining < mostRestrictive.remaining) {\n        mostRestrictive = { limit, remaining, resetAt: hit.resetAt }\n      }\n    }\n\n    if (exceeded) {\n      const headers = this.makeHeaders(exceeded.limit.max, 0, exceeded.resetAt)\n      if (exceeded.limit.customResponse) {\n        return exceeded.limit.customResponse(ctx, headers)\n      }\n      throw new TooManyRequestsError({\n        retryAfter: Number(headers['Retry-After']),\n        limit: exceeded.limit.max,\n        resetAt: exceeded.resetAt,\n      })\n    }\n\n    await next()\n\n    if (mostRestrictive) {\n      const headers = this.makeHeaders(\n        mostRestrictive.limit.max,\n        mostRestrictive.remaining,\n        mostRestrictive.resetAt,\n      )\n      // Hono populates ctx.c.res after next() — same pattern as logger.middleware.ts.\n      const downstream = ctx.c.res\n      downstream.headers.set('X-RateLimit-Limit', headers['X-RateLimit-Limit'])\n      downstream.headers.set('X-RateLimit-Remaining', headers['X-RateLimit-Remaining'])\n      downstream.headers.set('X-RateLimit-Reset', headers['X-RateLimit-Reset'])\n    }\n  }\n\n  /**\n   * Get-modify-set increment over the typed KV store. Not atomic across\n   * concurrent edge requests on KV — see `KvRateLimiterStore`'s caveat.\n   */\n  private async hit(key: string, windowSeconds: number): Promise<RateLimitHit> {\n    const now = Date.now()\n    const existing = await this.store.get<StoredHit>(key)\n\n    let next: StoredHit\n    if (!existing || existing.resetAt <= now) {\n      next = { count: 1, resetAt: now + windowSeconds * 1000 }\n    } else {\n      next = { count: existing.count + 1, resetAt: existing.resetAt }\n    }\n\n    const ttlSeconds = Math.max(1, Math.ceil((next.resetAt - now) / 1000))\n    await this.store.set(key, next, ttlSeconds)\n    return next\n  }\n\n  private makeKey(name: string, windowSeconds: number, by: string | undefined): string {\n    const actor = by ?? '*'\n    return `rl:${name}:${windowSeconds}:${actor}`\n  }\n\n  private makeHeaders(limit: number, remaining: number, resetAt: number): RateLimitHeaders {\n    const retryAfter = Math.max(1, Math.ceil((resetAt - Date.now()) / 1000))\n    return {\n      'Retry-After': String(retryAfter),\n      'X-RateLimit-Limit': String(limit),\n      'X-RateLimit-Remaining': String(Math.max(0, remaining)),\n      'X-RateLimit-Reset': String(Math.ceil(resetAt / 1000)),\n    }\n  }\n}\n","import type { CacheService } from '../../cache/services/cache.service'\nimport type { IRateLimiterStore } from './rate-limiter-store.interface'\n\n/**\n * Cloudflare KV-backed typed KV store.\n *\n * KV's minimum `expirationTtl` is 60 seconds; sub-60s windows are still\n * enforced by the registry's algorithm via the persisted `resetAt`, but\n * the key itself may live in KV longer than the logical window.\n *\n * KV has no native atomic increment, so concurrent writes from different\n * edge locations may undercount under high contention. That's an inherent\n * KV tradeoff — pick `{ useClass: MyDurableObjectStore }` for strict\n * accuracy across edges.\n */\nexport class KvRateLimiterStore implements IRateLimiterStore {\n  constructor(private readonly cache: CacheService) {}\n\n  async get<T>(key: string): Promise<T | null> {\n    return (await this.cache.get<T>(key, 'json')) ?? null\n  }\n\n  async set<T>(key: string, value: T, ttlSeconds: number): Promise<void> {\n    const ttl = Math.max(60, Math.ceil(ttlSeconds))\n    await this.cache.put(key, JSON.stringify(value), { expirationTtl: ttl })\n  }\n\n  async delete(key: string): Promise<void> {\n    await this.cache.delete(key)\n  }\n}\n","import type { IRateLimiterStore } from './rate-limiter-store.interface'\n\ninterface Entry {\n  value: unknown\n  expiresAt: number\n}\n\n/**\n * In-process Map-backed typed KV store.\n *\n * Suitable for tests and single-isolate scenarios. Not safe across\n * Cloudflare Worker isolates — entries reset whenever a fresh isolate\n * spins up. Use `KvRateLimiterStore` (or a custom Durable Object store)\n * for production. Expiry is lazy: stale entries are dropped on the next\n * `get`.\n */\nexport class InMemoryRateLimiterStore implements IRateLimiterStore {\n  private readonly entries = new Map<string, Entry>()\n\n  get<T>(key: string): Promise<T | null> {\n    const entry = this.entries.get(key)\n    if (!entry) return Promise.resolve(null)\n    if (entry.expiresAt <= Date.now()) {\n      this.entries.delete(key)\n      return Promise.resolve(null)\n    }\n    return Promise.resolve(entry.value as T)\n  }\n\n  set<T>(key: string, value: T, ttlSeconds: number): Promise<void> {\n    this.entries.set(key, { value, expiresAt: Date.now() + ttlSeconds * 1000 })\n    return Promise.resolve()\n  }\n\n  delete(key: string): Promise<void> {\n    this.entries.delete(key)\n    return Promise.resolve()\n  }\n}\n","import { inject } from 'tsyringe'\nimport { CACHE_TOKENS } from '../../cache/cache.tokens'\nimport type { CacheService } from '../../cache/services/cache.service'\nimport { CONTAINER_TOKEN, type Container } from '../../di'\nimport { Transient } from '../../di/decorators'\nimport { DI_TOKENS } from '../../di/tokens'\nimport type { StratalEnv } from '../../env'\nimport type { Constructor } from '../../types'\nimport { RateLimiterNotConfiguredError } from '../errors'\nimport { RATE_LIMITER_TOKENS } from '../rate-limiter.tokens'\nimport { KvRateLimiterStore } from './kv-store'\nimport { InMemoryRateLimiterStore } from './memory-store'\nimport type { IRateLimiterStore } from './rate-limiter-store.interface'\n\n/**\n * Configuration for `RateLimiterModule.forRoot()`. Picks the backing store.\n *\n * - `'kv'`: Cloudflare KV. `binding` names the KVNamespace on `StratalEnv`.\n * - `'memory'`: in-process Map. Tests / single-isolate only.\n * - `{ useClass }`: any class implementing `IRateLimiterStore`. Resolved\n *   from the DI container (so the class can declare its own `@inject` deps,\n *   e.g. a Durable Object namespace from `StratalEnv`).\n */\nexport type RateLimiterModuleOptions =\n  | { store: 'kv'; binding: keyof StratalEnv }\n  | { store: 'memory' }\n  | { store: { useClass: Constructor<IRateLimiterStore> } }\n\n// IMPORTANT: see RateLimiterRegistry — no token on @Transient so the\n// factory isn't globally bound at class-load time. Module providers are\n// the sole binding source, which keeps the \"module not imported\" detection\n// in ThrottleMiddleware working.\n@Transient()\nexport class RateLimiterStoreFactory {\n  constructor(\n    @inject(DI_TOKENS.CloudflareEnv) private readonly env: StratalEnv,\n    @inject(CACHE_TOKENS.CacheService) private readonly cache: CacheService,\n    @inject(CONTAINER_TOKEN) private readonly container: Container,\n    @inject(RATE_LIMITER_TOKENS.Options, { isOptional: true })\n    private readonly options?: RateLimiterModuleOptions,\n  ) {}\n\n  create(): IRateLimiterStore {\n    if (!this.options) {\n      throw new RateLimiterNotConfiguredError()\n    }\n\n    const { store } = this.options\n\n    if (store === 'memory') {\n      return new InMemoryRateLimiterStore()\n    }\n\n    if (store === 'kv') {\n      const binding = this.env[this.options.binding] as KVNamespace | undefined\n      if (!binding) {\n        throw new RateLimiterNotConfiguredError()\n      }\n      return new KvRateLimiterStore(this.cache.withBinding(binding))\n    }\n\n    return this.container.resolve<IRateLimiterStore>(store.useClass)\n  }\n}\n","import { Scope } from '../di/types'\nimport type { ExceptionHandler } from '../errors/exception-handler'\nimport { Module } from '../module'\nimport type { AsyncModuleOptions, DynamicModule, ModuleContext, OnException, OnInitialize } from '../module/types'\nimport { TooManyRequestsError } from './errors'\nimport { RateLimiterRegistry } from './rate-limiter-registry'\nimport { RATE_LIMITER_TOKENS } from './rate-limiter.tokens'\nimport { RateLimiterStoreFactory, type RateLimiterModuleOptions } from './stores/store-factory'\nimport type { IRateLimiterStore } from './stores/rate-limiter-store.interface'\n\n/**\n * Rate limiter module — opt-in, NOT registered automatically by Application.\n *\n * Usage:\n * ```typescript\n * @Module({\n *   imports: [RateLimiterModule.forRoot({ store: 'kv', binding: 'RATE_LIMITS' })],\n * })\n * export class AppModule {}\n * ```\n *\n * Define limiters in any module's `onInitialize` hook by resolving\n * `RATE_LIMITER_TOKENS.Registry` from the container. Apply them with\n * `router.throttle('name')` or `@RateLimit('name')`.\n *\n * The module:\n *  - eagerly validates the store at app boot (`onInitialize` resolves the\n *    factory and calls `create()`); a missing `forRoot` surfaces\n *    `RateLimiterNotConfiguredError` before any request is served.\n *  - registers a `respond()` callback on the `ExceptionHandler` (via\n *    `onException`) that injects `Retry-After` and `X-RateLimit-*` headers\n *    on every {@link TooManyRequestsError} response, regardless of whether\n *    the body was rendered as JSON, HTML, or via Inertia.\n */\n@Module({\n  providers: [\n    { provide: RATE_LIMITER_TOKENS.Registry, useClass: RateLimiterRegistry, scope: Scope.Singleton },\n    { provide: RATE_LIMITER_TOKENS.StoreFactory, useClass: RateLimiterStoreFactory, scope: Scope.Singleton },\n    {\n      provide: RATE_LIMITER_TOKENS.Store,\n      useFactory: (factory: RateLimiterStoreFactory) => factory.create(),\n      inject: [RATE_LIMITER_TOKENS.StoreFactory],\n      scope: Scope.Singleton,\n    },\n  ],\n})\nexport class RateLimiterModule implements OnInitialize, OnException {\n  /**\n   * Configure the rate limiter with a store choice.\n   *\n   * @param options - `{ store: 'kv', binding }` | `{ store: 'memory' }` | `{ store: { useClass } }`\n   */\n  static forRoot(options: RateLimiterModuleOptions): DynamicModule {\n    return {\n      module: RateLimiterModule,\n      providers: [\n        { provide: RATE_LIMITER_TOKENS.Options, useValue: options },\n      ],\n    }\n  }\n\n  /**\n   * Async configuration. Use when store options depend on other services\n   * (e.g. ConfigService).\n   */\n  static forRootAsync(options: AsyncModuleOptions<RateLimiterModuleOptions>): DynamicModule {\n    return {\n      module: RateLimiterModule,\n      providers: [\n        {\n          provide: RATE_LIMITER_TOKENS.Options,\n          useFactory: options.useFactory,\n          inject: options.inject,\n        },\n      ],\n    }\n  }\n\n  /**\n   * Eagerly resolve the store so a missing `forRoot()` fails at boot,\n   * not on the first throttled request. Also registers a per-app marker\n   * value so ThrottleMiddleware can distinguish \"module imported into this\n   * app\" from \"module class loaded somewhere in the process\" (the latter is\n   * indistinguishable at the DI layer because @Module's `registry()` call\n   * binds providers globally at decoration time).\n   */\n  onInitialize({ container }: ModuleContext): void {\n    container.resolve<IRateLimiterStore>(RATE_LIMITER_TOKENS.Store)\n    container.registerValue(RATE_LIMITER_TOKENS.ModuleMarker, { imported: true })\n  }\n\n  /**\n   * Inject `Retry-After` + `X-RateLimit-*` headers on every 429 response.\n   * The body itself is rendered by `ExceptionHandler.defaultRender` —\n   * content-negotiated, so HTML clients (browsers, Inertia) and JSON\n   * clients both get the right shape.\n   */\n  onException(handler: ExceptionHandler): void {\n    handler.dontReport([TooManyRequestsError])\n    handler.respond((response, error) => {\n      if (!(error instanceof TooManyRequestsError)) return response\n      response.headers.set('Retry-After', String(error.info.retryAfter))\n      response.headers.set('X-RateLimit-Limit', String(error.info.limit))\n      response.headers.set('X-RateLimit-Remaining', '0')\n      response.headers.set('X-RateLimit-Reset', String(Math.ceil(error.info.resetAt / 1000)))\n      return response\n    })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,IAAa,QAAb,MAAa,MAAM;CAKC;CACA;CACA;CANlB;CACA;CAEA,YACE,eACA,KACA,WAA2B,OAC3B;EAHgB,KAAA,gBAAA;EACA,KAAA,MAAA;EACA,KAAA,WAAA;;CAGlB,OAAO,UAAU,KAAoB;EACnC,OAAO,IAAI,MAAM,GAAG,IAAI;;CAG1B,OAAO,WAAW,SAAiB,KAAoB;EACrD,OAAO,IAAI,MAAM,SAAS,IAAI;;CAGhC,OAAO,UAAU,KAAoB;EACnC,OAAO,IAAI,MAAM,IAAI,IAAI;;CAG3B,OAAO,WAAW,SAAiB,KAAoB;EACrD,OAAO,IAAI,MAAM,UAAU,IAAI,IAAI;;CAGrC,OAAO,QAAQ,KAAoB;EACjC,OAAO,IAAI,MAAM,MAAS,IAAI;;CAGhC,OAAO,OAAO,KAAoB;EAChC,OAAO,IAAI,MAAM,OAAU,IAAI,IAAI;;;CAIrC,OAAO,OAAc;EACnB,OAAO,IAAI,MAAM,GAAG,GAAG,KAAK;;;CAI9B,GAAG,KAA4B;EAC7B,KAAK,OAAO,OAAO,IAAI;EACvB,OAAO;;;;;;;CAQT,SAAS,SAAyC;EAChD,KAAK,kBAAkB;EACvB,OAAO;;CAGT,IAAI,MAA0B;EAC5B,OAAO,KAAK;;CAGd,IAAI,iBAAuD;EACzD,OAAO,KAAK;;;;;ACnDT,IAAA,sBAAA,MAAM,4BAA4B,UAAU;CAIK;CAHtD,4BAA6B,IAAI,KAA4B;CAE7D,YACE,OACA;EACA,OAAO;EAF6C,KAAA,QAAA;;;;;;;CAUtD,IAAI,MAAc,UAA+B;EAC/C,KAAK,UAAU,IAAI,MAAM,SAAS;;CAGpC,IAAI,MAAuB;EACzB,OAAO,KAAK,UAAU,IAAI,KAAK;;;;;;;;;;CAWjC,MAAM,OAAO,MAAc,KAAoB,MAAsC;EACnF,MAAM,WAAW,KAAK,UAAU,IAAI,KAAK;EACzC,IAAI,CAAC,UACH,MAAM,IAAI,2BAA2B,KAAK;EAG5C,MAAM,WAAW,MAAM,SAAS,IAAI;EAEpC,MAAM,UADS,MAAM,QAAQ,SAAS,GAAG,WAAW,CAAC,SAAS,EACxC,QAAQ,MAAM,CAAC,EAAE,SAAS;EAEhD,IAAI,OAAO,WAAW,GACpB,OAAO,MAAM;EAGf,IAAI;EACJ,IAAI;EAEJ,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,MAAM,KAAK,QAAQ,MAAM,MAAM,eAAe,MAAM,IAAI;GAC9D,MAAM,MAAM,MAAM,KAAK,IAAI,KAAK,MAAM,cAAc;GAEpD,IAAI,IAAI,QAAQ,MAAM,KAAK;IACzB,IAAI,CAAC,YAAY,IAAI,UAAU,SAAS,SACtC,WAAW;KAAE;KAAO,SAAS,IAAI;KAAS;IAE5C;;GAGF,MAAM,YAAY,MAAM,MAAM,IAAI;GAClC,IAAI,CAAC,mBAAmB,YAAY,gBAAgB,WAClD,kBAAkB;IAAE;IAAO;IAAW,SAAS,IAAI;IAAS;;EAIhE,IAAI,UAAU;GACZ,MAAM,UAAU,KAAK,YAAY,SAAS,MAAM,KAAK,GAAG,SAAS,QAAQ;GACzE,IAAI,SAAS,MAAM,gBACjB,OAAO,SAAS,MAAM,eAAe,KAAK,QAAQ;GAEpD,MAAM,IAAI,qBAAqB;IAC7B,YAAY,OAAO,QAAQ,eAAe;IAC1C,OAAO,SAAS,MAAM;IACtB,SAAS,SAAS;IACnB,CAAC;;EAGJ,MAAM,MAAM;EAEZ,IAAI,iBAAiB;GACnB,MAAM,UAAU,KAAK,YACnB,gBAAgB,MAAM,KACtB,gBAAgB,WAChB,gBAAgB,QACjB;GAED,MAAM,aAAa,IAAI,EAAE;GACzB,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,qBAAqB;GACzE,WAAW,QAAQ,IAAI,yBAAyB,QAAQ,yBAAyB;GACjF,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,qBAAqB;;;;;;;CAQ7E,MAAc,IAAI,KAAa,eAA8C;EAC3E,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,WAAW,MAAM,KAAK,MAAM,IAAe,IAAI;EAErD,IAAI;EACJ,IAAI,CAAC,YAAY,SAAS,WAAW,KACnC,OAAO;GAAE,OAAO;GAAG,SAAS,MAAM,gBAAgB;GAAM;OAExD,OAAO;GAAE,OAAO,SAAS,QAAQ;GAAG,SAAS,SAAS;GAAS;EAGjE,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,UAAU,OAAO,IAAK,CAAC;EACtE,MAAM,KAAK,MAAM,IAAI,KAAK,MAAM,WAAW;EAC3C,OAAO;;CAGT,QAAgB,MAAc,eAAuB,IAAgC;EAEnF,OAAO,MAAM,KAAK,GAAG,cAAc,GADrB,MAAM;;CAItB,YAAoB,OAAe,WAAmB,SAAmC;EACvF,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,KAAK,KAAK,IAAI,IAAK,CAAC;EACxE,OAAO;GACL,eAAe,OAAO,WAAW;GACjC,qBAAqB,OAAO,MAAM;GAClC,yBAAyB,OAAO,KAAK,IAAI,GAAG,UAAU,CAAC;GACvD,qBAAqB,OAAO,KAAK,KAAK,UAAU,IAAK,CAAC;GACvD;;;;CA7HJ,WAAW;oBAKP,OAAO,oBAAoB,MAAM,CAAA;;;;;;;;;;;;;;;;;ACvCtC,IAAa,qBAAb,MAA6D;CAC9B;CAA7B,YAAY,OAAsC;EAArB,KAAA,QAAA;;CAE7B,MAAM,IAAO,KAAgC;EAC3C,OAAQ,MAAM,KAAK,MAAM,IAAO,KAAK,OAAO,IAAK;;CAGnD,MAAM,IAAO,KAAa,OAAU,YAAmC;EACrE,MAAM,MAAM,KAAK,IAAI,IAAI,KAAK,KAAK,WAAW,CAAC;EAC/C,MAAM,KAAK,MAAM,IAAI,KAAK,KAAK,UAAU,MAAM,EAAE,EAAE,eAAe,KAAK,CAAC;;CAG1E,MAAM,OAAO,KAA4B;EACvC,MAAM,KAAK,MAAM,OAAO,IAAI;;;;;;;;;;;;;;ACZhC,IAAa,2BAAb,MAAmE;CACjE,0BAA2B,IAAI,KAAoB;CAEnD,IAAO,KAAgC;EACrC,MAAM,QAAQ,KAAK,QAAQ,IAAI,IAAI;EACnC,IAAI,CAAC,OAAO,OAAO,QAAQ,QAAQ,KAAK;EACxC,IAAI,MAAM,aAAa,KAAK,KAAK,EAAE;GACjC,KAAK,QAAQ,OAAO,IAAI;GACxB,OAAO,QAAQ,QAAQ,KAAK;;EAE9B,OAAO,QAAQ,QAAQ,MAAM,MAAW;;CAG1C,IAAO,KAAa,OAAU,YAAmC;EAC/D,KAAK,QAAQ,IAAI,KAAK;GAAE;GAAO,WAAW,KAAK,KAAK,GAAG,aAAa;GAAM,CAAC;EAC3E,OAAO,QAAQ,SAAS;;CAG1B,OAAO,KAA4B;EACjC,KAAK,QAAQ,OAAO,IAAI;EACxB,OAAO,QAAQ,SAAS;;;;;ACHrB,IAAA,0BAAA,MAAM,wBAAwB;CAEiB;CACE;CACV;CAEzB;CALnB,YACE,KACA,OACA,WACA,SAEA;EALkD,KAAA,MAAA;EACE,KAAA,QAAA;EACV,KAAA,YAAA;EAEzB,KAAA,UAAA;;CAGnB,SAA4B;EAC1B,IAAI,CAAC,KAAK,SACR,MAAM,IAAI,+BAA+B;EAG3C,MAAM,EAAE,UAAU,KAAK;EAEvB,IAAI,UAAU,UACZ,OAAO,IAAI,0BAA0B;EAGvC,IAAI,UAAU,MAAM;GAClB,MAAM,UAAU,KAAK,IAAI,KAAK,QAAQ;GACtC,IAAI,CAAC,SACH,MAAM,IAAI,+BAA+B;GAE3C,OAAO,IAAI,mBAAmB,KAAK,MAAM,YAAY,QAAQ,CAAC;;EAGhE,OAAO,KAAK,UAAU,QAA2B,MAAM,SAAS;;;;CA7BnE,WAAW;oBAGP,OAAO,UAAU,cAAc,CAAA;oBAC/B,OAAO,aAAa,aAAa,CAAA;oBACjC,OAAO,gBAAgB,CAAA;oBACvB,OAAO,oBAAoB,SAAS,EAAE,YAAY,MAAM,CAAC,CAAA;;;;;;;;;;;ACQvD,IAAA,oBAAA,qBAAA,MAAM,kBAAuD;;;;;;CAMlE,OAAO,QAAQ,SAAkD;EAC/D,OAAO;GACL,QAAA;GACA,WAAW,CACT;IAAE,SAAS,oBAAoB;IAAS,UAAU;IAAS,CAC5D;GACF;;;;;;CAOH,OAAO,aAAa,SAAsE;EACxF,OAAO;GACL,QAAA;GACA,WAAW,CACT;IACE,SAAS,oBAAoB;IAC7B,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IACjB,CACF;GACF;;;;;;;;;;CAWH,aAAa,EAAE,aAAkC;EAC/C,UAAU,QAA2B,oBAAoB,MAAM;EAC/D,UAAU,cAAc,oBAAoB,cAAc,EAAE,UAAU,MAAM,CAAC;;;;;;;;CAS/E,YAAY,SAAiC;EAC3C,QAAQ,WAAW,CAAC,qBAAqB,CAAC;EAC1C,QAAQ,SAAS,UAAU,UAAU;GACnC,IAAI,EAAE,iBAAiB,uBAAuB,OAAO;GACrD,SAAS,QAAQ,IAAI,eAAe,OAAO,MAAM,KAAK,WAAW,CAAC;GAClE,SAAS,QAAQ,IAAI,qBAAqB,OAAO,MAAM,KAAK,MAAM,CAAC;GACnE,SAAS,QAAQ,IAAI,yBAAyB,IAAI;GAClD,SAAS,QAAQ,IAAI,qBAAqB,OAAO,KAAK,KAAK,MAAM,KAAK,UAAU,IAAK,CAAC,CAAC;GACvF,OAAO;IACP;;;qDAxEL,OAAO,EACN,WAAW;CACT;EAAE,SAAS,oBAAoB;EAAU,UAAU;EAAqB,OAAO,MAAM;EAAW;CAChG;EAAE,SAAS,oBAAoB;EAAc,UAAU;EAAyB,OAAO,MAAM;EAAW;CACxG;EACE,SAAS,oBAAoB;EAC7B,aAAa,YAAqC,QAAQ,QAAQ;EAClE,QAAQ,CAAC,oBAAoB,aAAa;EAC1C,OAAO,MAAM;EACd;CACF,EACF,CAAC,CAAA,EAAA,kBAAA"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/rate-limiter/limit.ts","../../src/rate-limiter/rate-limiter-registry.ts","../../src/rate-limiter/stores/kv-store.ts","../../src/rate-limiter/stores/memory-store.ts","../../src/rate-limiter/stores/store-factory.ts","../../src/rate-limiter/rate-limiter.module.ts"],"sourcesContent":["import type { RouterContext } from '../router/router-context'\n\n/**\n * Standard rate-limit response headers passed to custom response handlers.\n * Keys are canonical HTTP header names; values are the stringified counts.\n */\nexport interface RateLimitHeaders {\n  'Retry-After': string\n  'X-RateLimit-Limit': string\n  'X-RateLimit-Remaining': string\n  'X-RateLimit-Reset': string\n}\n\n/**\n * Custom response handler invoked when a limit is exceeded and the user\n * supplied `.response()` on the {@link Limit}. Receives the request context\n * and the precomputed standard headers (which the handler can spread, drop,\n * or override).\n */\nexport type RateLimitResponseHandler = (\n  ctx: RouterContext,\n  headers: RateLimitHeaders,\n) => Response | Promise<Response>\n\n/**\n * A single rate limit window.\n *\n * Build via the static factories (`perSecond`, `perMinute`, `perMinutes`,\n * `perHour`, `perDay`, `none`). Chain `.by(key)` to scope per-actor and\n * `.response(handler)` to override the default 429 response.\n *\n * Returned (singly or as an array) by limiter resolvers registered via\n * `RateLimiterRegistry.for()`.\n *\n * @example\n * ```typescript\n * Limit.perMinute(60).by(ctx.header('cf-connecting-ip') ?? 'global')\n * Limit.perHour(100).by(userId)\n * Limit.none()                                // bypass\n * ```\n */\nexport class Limit {\n  private _key?: string\n  private _customResponse?: RateLimitResponseHandler\n\n  private constructor(\n    public readonly windowSeconds: number,\n    public readonly max: number,\n    public readonly disabled = false,\n  ) {}\n\n  static perSecond(max: number): Limit {\n    return new Limit(1, max)\n  }\n\n  static perSeconds(seconds: number, max: number): Limit {\n    return new Limit(seconds, max)\n  }\n\n  static perMinute(max: number): Limit {\n    return new Limit(60, max)\n  }\n\n  static perMinutes(minutes: number, max: number): Limit {\n    return new Limit(minutes * 60, max)\n  }\n\n  static perHour(max: number): Limit {\n    return new Limit(60 * 60, max)\n  }\n\n  static perDay(max: number): Limit {\n    return new Limit(24 * 60 * 60, max)\n  }\n\n  /** Bypass the limiter entirely for this request. */\n  static none(): Limit {\n    return new Limit(0, 0, true)\n  }\n\n  /** Scope this limit to a specific actor (user id, IP, tenant, etc.). */\n  by(key: string | number): this {\n    this._key = String(key)\n    return this\n  }\n\n  /**\n   * Override the default 429 response. The handler receives the standard\n   * `RateLimitHeaders` so it can spread them onto its own Response or omit\n   * them as it sees fit.\n   */\n  response(handler: RateLimitResponseHandler): this {\n    this._customResponse = handler\n    return this\n  }\n\n  get key(): string | undefined {\n    return this._key\n  }\n\n  get customResponse(): RateLimitResponseHandler | undefined {\n    return this._customResponse\n  }\n}\n","import { inject } from '../di'\nimport { Singleton } from '../di/decorators'\nimport { Macroable } from '../macroable'\nimport type { Next } from '../router/middleware.interface'\nimport type { RouterContext } from '../router/router-context'\nimport { RateLimiterError, TooManyRequestsError } from './errors'\nimport type { Limit, RateLimitHeaders } from './limit'\nimport { RATE_LIMITER_TOKENS } from './rate-limiter.tokens'\nimport type { IRateLimiterStore, RateLimitHit } from './stores/rate-limiter-store.interface'\n\n/**\n * Resolver function registered via {@link RateLimiterRegistry.for}. Receives\n * the request context and returns the limit (or limits) that apply to this\n * request. Return `Limit.none()` to bypass for the current request.\n */\nexport type LimitResolver = (\n  ctx: RouterContext,\n) => Limit | Limit[] | Promise<Limit | Limit[]>\n\ninterface StoredHit {\n  count: number\n  resetAt: number\n}\n\n/**\n * Central registry of named rate limiters and the request-time enforcement\n * pipeline. Resolved as a singleton; consumed by `ThrottleMiddleware`.\n *\n * Register limiters in a module's `onInitialize` hook:\n * ```typescript\n * @Module({})\n * export class RateLimitsModule implements OnInitialize {\n *   onInitialize({ container }: ModuleContext): void {\n *     const limiter = container.resolve<RateLimiterRegistry>(RATE_LIMITER_TOKENS.Registry)\n *     limiter.for('api', (ctx) => Limit.perMinute(60).by(ctx.header('cf-connecting-ip') ?? '*'))\n *   }\n * }\n * ```\n *\n * Extensible via `Macroable`: adapter packages (e.g. `@stratal/framework/auth`)\n * can attach extra registration methods such as `forPath()` for better-auth\n * `customRules` interop.\n */\n// IMPORTANT: do not pass a token to @Singleton — that would self-register\n// the class globally at module-load time, making the Registry resolvable\n// even when the user never imported RateLimiterModule. We rely on\n// RateLimiterModule providers being the only binding source, so\n// `{ isOptional: true }` in ThrottleMiddleware correctly returns undefined\n// when the module is missing.\n@Singleton()\nexport class RateLimiterRegistry extends Macroable {\n  private readonly resolvers = new Map<string, LimitResolver>()\n\n  constructor(\n    @inject(RATE_LIMITER_TOKENS.Store) private readonly store: IRateLimiterStore,\n  ) {\n    super()\n  }\n\n  /**\n   * Register a named limiter. Names must be unique; calling `for()` again\n   * with the same name overwrites the previous resolver (matches Laravel\n   * `RateLimiter::for` semantics — last definition wins).\n   */\n  for(name: string, resolver: LimitResolver): void {\n    this.resolvers.set(name, resolver)\n  }\n\n  has(name: string): boolean {\n    return this.resolvers.has(name)\n  }\n\n  /**\n   * Enforce the named limiter for the current request. Called by\n   * `ThrottleMiddleware` (the per-name class produced by\n   * `createThrottleMiddleware`). Resolves the limiter, increments the store\n   * for each non-bypassed limit, sets `X-RateLimit-*` headers on success, and\n   * either invokes the limit's custom `.response()` or throws\n   * {@link TooManyRequestsError} when a limit is exceeded.\n   */\n  async handle(name: string, ctx: RouterContext, next: Next): Promise<Response | void> {\n    const resolver = this.resolvers.get(name)\n    if (!resolver) {\n      throw new RateLimiterError(`Rate limiter \"${name}\" is not defined. Register it with limiter.for(\"${name}\", ...) in a module's onInitialize hook.`)\n    }\n\n    const resolved = await resolver(ctx)\n    const limits = Array.isArray(resolved) ? resolved : [resolved]\n    const active = limits.filter((l) => !l.disabled)\n\n    if (active.length === 0) {\n      return next()\n    }\n\n    let mostRestrictive: { limit: Limit; remaining: number; resetAt: number } | undefined\n    let exceeded: { limit: Limit; resetAt: number } | undefined\n\n    for (const limit of active) {\n      const key = this.makeKey(name, limit.windowSeconds, limit.key)\n      const hit = await this.hit(key, limit.windowSeconds)\n\n      if (hit.count > limit.max) {\n        if (!exceeded || hit.resetAt > exceeded.resetAt) {\n          exceeded = { limit, resetAt: hit.resetAt }\n        }\n        continue\n      }\n\n      const remaining = limit.max - hit.count\n      if (!mostRestrictive || remaining < mostRestrictive.remaining) {\n        mostRestrictive = { limit, remaining, resetAt: hit.resetAt }\n      }\n    }\n\n    if (exceeded) {\n      const headers = this.makeHeaders(exceeded.limit.max, 0, exceeded.resetAt)\n      if (exceeded.limit.customResponse) {\n        return exceeded.limit.customResponse(ctx, headers)\n      }\n      throw new TooManyRequestsError({\n        retryAfter: Number(headers['Retry-After']),\n        limit: exceeded.limit.max,\n        resetAt: exceeded.resetAt,\n      })\n    }\n\n    await next()\n\n    if (mostRestrictive) {\n      const headers = this.makeHeaders(\n        mostRestrictive.limit.max,\n        mostRestrictive.remaining,\n        mostRestrictive.resetAt,\n      )\n      // Hono populates ctx.c.res after next() — same pattern as logger.middleware.ts.\n      const downstream = ctx.c.res\n      downstream.headers.set('X-RateLimit-Limit', headers['X-RateLimit-Limit'])\n      downstream.headers.set('X-RateLimit-Remaining', headers['X-RateLimit-Remaining'])\n      downstream.headers.set('X-RateLimit-Reset', headers['X-RateLimit-Reset'])\n    }\n  }\n\n  /**\n   * Get-modify-set increment over the typed KV store. Not atomic across\n   * concurrent edge requests on KV — see `KvRateLimiterStore`'s caveat.\n   */\n  private async hit(key: string, windowSeconds: number): Promise<RateLimitHit> {\n    const now = Date.now()\n    const existing = await this.store.get<StoredHit>(key)\n\n    let next: StoredHit\n    if (!existing || existing.resetAt <= now) {\n      next = { count: 1, resetAt: now + windowSeconds * 1000 }\n    } else {\n      next = { count: existing.count + 1, resetAt: existing.resetAt }\n    }\n\n    const ttlSeconds = Math.max(1, Math.ceil((next.resetAt - now) / 1000))\n    await this.store.set(key, next, ttlSeconds)\n    return next\n  }\n\n  private makeKey(name: string, windowSeconds: number, by: string | undefined): string {\n    const actor = by ?? '*'\n    return `rl:${name}:${windowSeconds}:${actor}`\n  }\n\n  private makeHeaders(limit: number, remaining: number, resetAt: number): RateLimitHeaders {\n    const retryAfter = Math.max(1, Math.ceil((resetAt - Date.now()) / 1000))\n    return {\n      'Retry-After': String(retryAfter),\n      'X-RateLimit-Limit': String(limit),\n      'X-RateLimit-Remaining': String(Math.max(0, remaining)),\n      'X-RateLimit-Reset': String(Math.ceil(resetAt / 1000)),\n    }\n  }\n}\n","import type { CacheService } from '../../cache/services/cache.service'\nimport type { IRateLimiterStore } from './rate-limiter-store.interface'\n\n/**\n * Cloudflare KV-backed typed KV store.\n *\n * KV's minimum `expirationTtl` is 60 seconds; sub-60s windows are still\n * enforced by the registry's algorithm via the persisted `resetAt`, but\n * the key itself may live in KV longer than the logical window.\n *\n * KV has no native atomic increment, so concurrent writes from different\n * edge locations may undercount under high contention. That's an inherent\n * KV tradeoff — pick `{ useClass: MyDurableObjectStore }` for strict\n * accuracy across edges.\n */\nexport class KvRateLimiterStore implements IRateLimiterStore {\n  constructor(private readonly cache: CacheService) {}\n\n  async get<T>(key: string): Promise<T | null> {\n    return (await this.cache.get<T>(key, 'json')) ?? null\n  }\n\n  async set<T>(key: string, value: T, ttlSeconds: number): Promise<void> {\n    const ttl = Math.max(60, Math.ceil(ttlSeconds))\n    await this.cache.put(key, JSON.stringify(value), { expirationTtl: ttl })\n  }\n\n  async delete(key: string): Promise<void> {\n    await this.cache.delete(key)\n  }\n}\n","import type { IRateLimiterStore } from './rate-limiter-store.interface'\n\ninterface Entry {\n  value: unknown\n  expiresAt: number\n}\n\n/**\n * In-process Map-backed typed KV store.\n *\n * Suitable for tests and single-isolate scenarios. Not safe across\n * Cloudflare Worker isolates — entries reset whenever a fresh isolate\n * spins up. Use `KvRateLimiterStore` (or a custom Durable Object store)\n * for production. Expiry is lazy: stale entries are dropped on the next\n * `get`.\n */\nexport class InMemoryRateLimiterStore implements IRateLimiterStore {\n  private readonly entries = new Map<string, Entry>()\n\n  get<T>(key: string): Promise<T | null> {\n    const entry = this.entries.get(key)\n    if (!entry) return Promise.resolve(null)\n    if (entry.expiresAt <= Date.now()) {\n      this.entries.delete(key)\n      return Promise.resolve(null)\n    }\n    return Promise.resolve(entry.value as T)\n  }\n\n  set<T>(key: string, value: T, ttlSeconds: number): Promise<void> {\n    this.entries.set(key, { value, expiresAt: Date.now() + ttlSeconds * 1000 })\n    return Promise.resolve()\n  }\n\n  delete(key: string): Promise<void> {\n    this.entries.delete(key)\n    return Promise.resolve()\n  }\n}\n","import { inject } from '../../di'\nimport { CACHE_TOKENS } from '../../cache/cache.tokens'\nimport type { CacheService } from '../../cache/services/cache.service'\nimport { CONTAINER_TOKEN, type Container } from '../../di'\nimport { Singleton } from '../../di/decorators'\nimport { DI_TOKENS } from '../../di/tokens'\nimport type { StratalEnv } from '../../env'\nimport type { Constructor } from '../../types'\nimport { RateLimiterError } from '../errors'\nimport { RATE_LIMITER_TOKENS } from '../rate-limiter.tokens'\nimport { KvRateLimiterStore } from './kv-store'\nimport { InMemoryRateLimiterStore } from './memory-store'\nimport type { IRateLimiterStore } from './rate-limiter-store.interface'\n\n/**\n * Configuration for `RateLimiterModule.forRoot()`. Picks the backing store.\n *\n * - `'kv'`: Cloudflare KV. `binding` names the KVNamespace on `StratalEnv`.\n * - `'memory'`: in-process Map. Tests / single-isolate only.\n * - `{ useClass }`: any class implementing `IRateLimiterStore`. Resolved\n *   from the DI container (so the class can declare its own `@inject` deps,\n *   e.g. a Durable Object namespace from `StratalEnv`).\n */\nexport type RateLimiterModuleOptions =\n  | { store: 'kv'; binding: keyof StratalEnv }\n  | { store: 'memory' }\n  | { store: { useClass: Constructor<IRateLimiterStore> } }\n\n// IMPORTANT: see RateLimiterRegistry — no token on @Singleton so the\n// factory isn't globally bound at class-load time. Module providers are\n// the sole binding source, which keeps the \"module not imported\" detection\n// in ThrottleMiddleware working.\n@Singleton()\nexport class RateLimiterStoreFactory {\n  constructor(\n    @inject(DI_TOKENS.CloudflareEnv) private readonly env: StratalEnv,\n    @inject(CACHE_TOKENS.CacheService) private readonly cache: CacheService,\n    @inject(CONTAINER_TOKEN) private readonly container: Container,\n    @inject(RATE_LIMITER_TOKENS.Options, { isOptional: true })\n    private readonly options?: RateLimiterModuleOptions,\n  ) {}\n\n  create(): IRateLimiterStore {\n    if (!this.options) {\n      throw new RateLimiterError('RateLimiterModule is not configured. Call RateLimiterModule.forRoot({ store: ... }) to configure a backing store.')\n    }\n\n    const { store } = this.options\n\n    if (store === 'memory') {\n      return new InMemoryRateLimiterStore()\n    }\n\n    if (store === 'kv') {\n      const binding = this.env[this.options.binding] as KVNamespace | undefined\n      if (!binding) {\n        throw new RateLimiterError(`KV binding \"${String(this.options.binding)}\" is not available in the environment.`)\n      }\n      return new KvRateLimiterStore(this.cache.withBinding(binding))\n    }\n\n    return this.container.resolve<IRateLimiterStore>(store.useClass)\n  }\n}\n","import { CacheModule } from '../cache'\nimport type { ExceptionHandler } from '../errors/exception-handler'\nimport { Module } from '../module'\nimport type { AsyncModuleOptions, DynamicModule, ModuleContext, OnException, OnInitialize } from '../module/types'\nimport { TooManyRequestsError } from './errors'\nimport { RateLimiterRegistry } from './rate-limiter-registry'\nimport { RATE_LIMITER_TOKENS } from './rate-limiter.tokens'\nimport { RateLimiterStoreFactory, type RateLimiterModuleOptions } from './stores/store-factory'\nimport type { IRateLimiterStore } from './stores/rate-limiter-store.interface'\n\n/**\n * Rate limiter module — opt-in, NOT registered automatically by Application.\n *\n * Usage:\n * ```typescript\n * @Module({\n *   imports: [RateLimiterModule.forRoot({ store: 'kv', binding: 'RATE_LIMITS' })],\n * })\n * export class AppModule {}\n * ```\n *\n * Define limiters in any module's `onInitialize` hook by resolving\n * `RATE_LIMITER_TOKENS.Registry` from the container. Apply them with\n * `router.throttle('name')` or `@RateLimit('name')`.\n *\n * The module:\n *  - eagerly validates the store at app boot (`onInitialize` resolves the\n *    factory and calls `create()`); a missing `forRoot` surfaces\n *    `RateLimiterError` before any request is served.\n *  - registers a `respond()` callback on the `ExceptionHandler` (via\n *    `onException`) that injects `Retry-After` and `X-RateLimit-*` headers\n *    on every {@link TooManyRequestsError} response, regardless of whether\n *    the body was rendered as JSON, HTML, or via Inertia.\n */\n@Module({\n  imports: [CacheModule],\n  providers: [\n    { provide: RATE_LIMITER_TOKENS.Registry, useClass: RateLimiterRegistry },\n    { provide: RATE_LIMITER_TOKENS.StoreFactory, useClass: RateLimiterStoreFactory },\n    {\n      provide: RATE_LIMITER_TOKENS.Store,\n      useFactory: (factory: RateLimiterStoreFactory) => factory.create(),\n      inject: [RATE_LIMITER_TOKENS.StoreFactory],\n    },\n  ],\n})\nexport class RateLimiterModule implements OnInitialize, OnException {\n  /**\n   * Configure the rate limiter with a store choice.\n   *\n   * @param options - `{ store: 'kv', binding }` | `{ store: 'memory' }` | `{ store: { useClass } }`\n   */\n  static forRoot(options: RateLimiterModuleOptions): DynamicModule {\n    return {\n      module: RateLimiterModule,\n      providers: [\n        { provide: RATE_LIMITER_TOKENS.Options, useValue: options },\n      ],\n    }\n  }\n\n  /**\n   * Async configuration. Use when store options depend on other services\n   * (e.g. ConfigService).\n   */\n  static forRootAsync(options: AsyncModuleOptions<RateLimiterModuleOptions>): DynamicModule {\n    return {\n      module: RateLimiterModule,\n      providers: [\n        {\n          provide: RATE_LIMITER_TOKENS.Options,\n          useFactory: options.useFactory,\n          inject: options.inject,\n        },\n      ],\n    }\n  }\n\n  /**\n   * Eagerly resolve the store so a missing `forRoot()` fails at boot,\n   * not on the first throttled request. Also registers a per-app marker\n   * value so ThrottleMiddleware can distinguish \"module imported into this\n   * app\" from \"module class loaded somewhere in the process\" (the latter is\n   * indistinguishable at the DI layer because @Module's `registry()` call\n   * binds providers globally at decoration time).\n   */\n  onInitialize({ container }: ModuleContext): void {\n    container.resolve<IRateLimiterStore>(RATE_LIMITER_TOKENS.Store)\n    container.registerValue(RATE_LIMITER_TOKENS.ModuleMarker, { imported: true })\n  }\n\n  /**\n   * Inject `Retry-After` + `X-RateLimit-*` headers on every 429 response.\n   * The body itself is rendered by `ExceptionHandler.defaultRender` —\n   * content-negotiated, so HTML clients (browsers, Inertia) and JSON\n   * clients both get the right shape.\n   */\n  onException(handler: ExceptionHandler): void {\n    handler.dontReport([TooManyRequestsError])\n    handler.respond((response, error) => {\n      if (!(error instanceof TooManyRequestsError)) return response\n      response.headers.set('Retry-After', String(error.info.retryAfter))\n      response.headers.set('X-RateLimit-Limit', String(error.info.limit))\n      response.headers.set('X-RateLimit-Remaining', '0')\n      response.headers.set('X-RateLimit-Reset', String(Math.ceil(error.info.resetAt / 1000)))\n      return response\n    })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,IAAa,QAAb,MAAa,MAAM;CAKC;CACA;CACA;CANlB;CACA;CAEA,YACE,eACA,KACA,WAA2B,OAC3B;EAHgB,KAAA,gBAAA;EACA,KAAA,MAAA;EACA,KAAA,WAAA;CACf;CAEH,OAAO,UAAU,KAAoB;EACnC,OAAO,IAAI,MAAM,GAAG,GAAG;CACzB;CAEA,OAAO,WAAW,SAAiB,KAAoB;EACrD,OAAO,IAAI,MAAM,SAAS,GAAG;CAC/B;CAEA,OAAO,UAAU,KAAoB;EACnC,OAAO,IAAI,MAAM,IAAI,GAAG;CAC1B;CAEA,OAAO,WAAW,SAAiB,KAAoB;EACrD,OAAO,IAAI,MAAM,UAAU,IAAI,GAAG;CACpC;CAEA,OAAO,QAAQ,KAAoB;EACjC,OAAO,IAAI,MAAM,MAAS,GAAG;CAC/B;CAEA,OAAO,OAAO,KAAoB;EAChC,OAAO,IAAI,MAAM,OAAU,IAAI,GAAG;CACpC;;CAGA,OAAO,OAAc;EACnB,OAAO,IAAI,MAAM,GAAG,GAAG,IAAI;CAC7B;;CAGA,GAAG,KAA4B;EAC7B,KAAK,OAAO,OAAO,GAAG;EACtB,OAAO;CACT;;;;;;CAOA,SAAS,SAAyC;EAChD,KAAK,kBAAkB;EACvB,OAAO;CACT;CAEA,IAAI,MAA0B;EAC5B,OAAO,KAAK;CACd;CAEA,IAAI,iBAAuD;EACzD,OAAO,KAAK;CACd;AACF;;;ACrDO,IAAA,sBAAA,MAAM,4BAA4B,UAAU;CAIK;CAHtD,4BAA6B,IAAI,IAA2B;CAE5D,YACE,OACA;EACA,MAAM;EAF8C,KAAA,QAAA;CAGtD;;;;;;CAOA,IAAI,MAAc,UAA+B;EAC/C,KAAK,UAAU,IAAI,MAAM,QAAQ;CACnC;CAEA,IAAI,MAAuB;EACzB,OAAO,KAAK,UAAU,IAAI,IAAI;CAChC;;;;;;;;;CAUA,MAAM,OAAO,MAAc,KAAoB,MAAsC;EACnF,MAAM,WAAW,KAAK,UAAU,IAAI,IAAI;EACxC,IAAI,CAAC,UACH,MAAM,IAAI,iBAAiB,iBAAiB,KAAK,kDAAkD,KAAK,yCAAyC;EAGnJ,MAAM,WAAW,MAAM,SAAS,GAAG;EAEnC,MAAM,UADS,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ,GACvC,QAAQ,MAAM,CAAC,EAAE,QAAQ;EAE/C,IAAI,OAAO,WAAW,GACpB,OAAO,KAAK;EAGd,IAAI;EACJ,IAAI;EAEJ,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,MAAM,KAAK,QAAQ,MAAM,MAAM,eAAe,MAAM,GAAG;GAC7D,MAAM,MAAM,MAAM,KAAK,IAAI,KAAK,MAAM,aAAa;GAEnD,IAAI,IAAI,QAAQ,MAAM,KAAK;IACzB,IAAI,CAAC,YAAY,IAAI,UAAU,SAAS,SACtC,WAAW;KAAE;KAAO,SAAS,IAAI;IAAQ;IAE3C;GACF;GAEA,MAAM,YAAY,MAAM,MAAM,IAAI;GAClC,IAAI,CAAC,mBAAmB,YAAY,gBAAgB,WAClD,kBAAkB;IAAE;IAAO;IAAW,SAAS,IAAI;GAAQ;EAE/D;EAEA,IAAI,UAAU;GACZ,MAAM,UAAU,KAAK,YAAY,SAAS,MAAM,KAAK,GAAG,SAAS,OAAO;GACxE,IAAI,SAAS,MAAM,gBACjB,OAAO,SAAS,MAAM,eAAe,KAAK,OAAO;GAEnD,MAAM,IAAI,qBAAqB;IAC7B,YAAY,OAAO,QAAQ,cAAc;IACzC,OAAO,SAAS,MAAM;IACtB,SAAS,SAAS;GACpB,CAAC;EACH;EAEA,MAAM,KAAK;EAEX,IAAI,iBAAiB;GACnB,MAAM,UAAU,KAAK,YACnB,gBAAgB,MAAM,KACtB,gBAAgB,WAChB,gBAAgB,OAClB;GAEA,MAAM,aAAa,IAAI,EAAE;GACzB,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,oBAAoB;GACxE,WAAW,QAAQ,IAAI,yBAAyB,QAAQ,wBAAwB;GAChF,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,oBAAoB;EAC1E;CACF;;;;;CAMA,MAAc,IAAI,KAAa,eAA8C;EAC3E,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,WAAW,MAAM,KAAK,MAAM,IAAe,GAAG;EAEpD,IAAI;EACJ,IAAI,CAAC,YAAY,SAAS,WAAW,KACnC,OAAO;GAAE,OAAO;GAAG,SAAS,MAAM,gBAAgB;EAAK;OAEvD,OAAO;GAAE,OAAO,SAAS,QAAQ;GAAG,SAAS,SAAS;EAAQ;EAGhE,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,UAAU,OAAO,GAAI,CAAC;EACrE,MAAM,KAAK,MAAM,IAAI,KAAK,MAAM,UAAU;EAC1C,OAAO;CACT;CAEA,QAAgB,MAAc,eAAuB,IAAgC;EAEnF,OAAO,MAAM,KAAK,GAAG,cAAc,GADrB,MAAM;CAEtB;CAEA,YAAoB,OAAe,WAAmB,SAAmC;EACvF,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,KAAK,IAAI,KAAK,GAAI,CAAC;EACvE,OAAO;GACL,eAAe,OAAO,UAAU;GAChC,qBAAqB,OAAO,KAAK;GACjC,yBAAyB,OAAO,KAAK,IAAI,GAAG,SAAS,CAAC;GACtD,qBAAqB,OAAO,KAAK,KAAK,UAAU,GAAI,CAAC;EACvD;CACF;AACF;kCA/HC,UAAU,GAAA,gBAAA,GAKN,OAAO,oBAAoB,KAAK,CAAA,CAAA,GAAA,mBAAA;;;;;;;;;;;;;;;ACvCrC,IAAa,qBAAb,MAA6D;CAC9B;CAA7B,YAAY,OAAsC;EAArB,KAAA,QAAA;CAAsB;CAEnD,MAAM,IAAO,KAAgC;EAC3C,OAAQ,MAAM,KAAK,MAAM,IAAO,KAAK,MAAM,KAAM;CACnD;CAEA,MAAM,IAAO,KAAa,OAAU,YAAmC;EACrE,MAAM,MAAM,KAAK,IAAI,IAAI,KAAK,KAAK,UAAU,CAAC;EAC9C,MAAM,KAAK,MAAM,IAAI,KAAK,KAAK,UAAU,KAAK,GAAG,EAAE,eAAe,IAAI,CAAC;CACzE;CAEA,MAAM,OAAO,KAA4B;EACvC,MAAM,KAAK,MAAM,OAAO,GAAG;CAC7B;AACF;;;;;;;;;;;;ACdA,IAAa,2BAAb,MAAmE;CACjE,0BAA2B,IAAI,IAAmB;CAElD,IAAO,KAAgC;EACrC,MAAM,QAAQ,KAAK,QAAQ,IAAI,GAAG;EAClC,IAAI,CAAC,OAAO,OAAO,QAAQ,QAAQ,IAAI;EACvC,IAAI,MAAM,aAAa,KAAK,IAAI,GAAG;GACjC,KAAK,QAAQ,OAAO,GAAG;GACvB,OAAO,QAAQ,QAAQ,IAAI;EAC7B;EACA,OAAO,QAAQ,QAAQ,MAAM,KAAU;CACzC;CAEA,IAAO,KAAa,OAAU,YAAmC;EAC/D,KAAK,QAAQ,IAAI,KAAK;GAAE;GAAO,WAAW,KAAK,IAAI,IAAI,aAAa;EAAK,CAAC;EAC1E,OAAO,QAAQ,QAAQ;CACzB;CAEA,OAAO,KAA4B;EACjC,KAAK,QAAQ,OAAO,GAAG;EACvB,OAAO,QAAQ,QAAQ;CACzB;AACF;;;ACLO,IAAA,0BAAA,MAAM,wBAAwB;CAEiB;CACE;CACV;CAEzB;CALnB,YACE,KACA,OACA,WACA,SAEA;EALkD,KAAA,MAAA;EACE,KAAA,QAAA;EACV,KAAA,YAAA;EAEzB,KAAA,UAAA;CAChB;CAEH,SAA4B;EAC1B,IAAI,CAAC,KAAK,SACR,MAAM,IAAI,iBAAiB,mHAAmH;EAGhJ,MAAM,EAAE,UAAU,KAAK;EAEvB,IAAI,UAAU,UACZ,OAAO,IAAI,yBAAyB;EAGtC,IAAI,UAAU,MAAM;GAClB,MAAM,UAAU,KAAK,IAAI,KAAK,QAAQ;GACtC,IAAI,CAAC,SACH,MAAM,IAAI,iBAAiB,eAAe,OAAO,KAAK,QAAQ,OAAO,EAAE,uCAAuC;GAEhH,OAAO,IAAI,mBAAmB,KAAK,MAAM,YAAY,OAAO,CAAC;EAC/D;EAEA,OAAO,KAAK,UAAU,QAA2B,MAAM,QAAQ;CACjE;AACF;;CA/BC,UAAU;oBAGN,OAAO,UAAU,aAAa,CAAA;oBAC9B,OAAO,aAAa,YAAY,CAAA;oBAChC,OAAO,eAAe,CAAA;oBACtB,OAAO,oBAAoB,SAAS,EAAE,YAAY,KAAK,CAAC,CAAA;;;;;ACQtD,IAAA,oBAAA,qBAAA,MAAM,kBAAuD;;;;;;CAMlE,OAAO,QAAQ,SAAkD;EAC/D,OAAO;GACL,QAAA;GACA,WAAW,CACT;IAAE,SAAS,oBAAoB;IAAS,UAAU;GAAQ,CAC5D;EACF;CACF;;;;;CAMA,OAAO,aAAa,SAAsE;EACxF,OAAO;GACL,QAAA;GACA,WAAW,CACT;IACE,SAAS,oBAAoB;IAC7B,YAAY,QAAQ;IACpB,QAAQ,QAAQ;GAClB,CACF;EACF;CACF;;;;;;;;;CAUA,aAAa,EAAE,aAAkC;EAC/C,UAAU,QAA2B,oBAAoB,KAAK;EAC9D,UAAU,cAAc,oBAAoB,cAAc,EAAE,UAAU,KAAK,CAAC;CAC9E;;;;;;;CAQA,YAAY,SAAiC;EAC3C,QAAQ,WAAW,CAAC,oBAAoB,CAAC;EACzC,QAAQ,SAAS,UAAU,UAAU;GACnC,IAAI,EAAE,iBAAiB,uBAAuB,OAAO;GACrD,SAAS,QAAQ,IAAI,eAAe,OAAO,MAAM,KAAK,UAAU,CAAC;GACjE,SAAS,QAAQ,IAAI,qBAAqB,OAAO,MAAM,KAAK,KAAK,CAAC;GAClE,SAAS,QAAQ,IAAI,yBAAyB,GAAG;GACjD,SAAS,QAAQ,IAAI,qBAAqB,OAAO,KAAK,KAAK,MAAM,KAAK,UAAU,GAAI,CAAC,CAAC;GACtF,OAAO;EACT,CAAC;CACH;AACF;qDA1EC,OAAO;CACN,SAAS,CAAC,WAAW;CACrB,WAAW;EACT;GAAE,SAAS,oBAAoB;GAAU,UAAU;EAAoB;EACvE;GAAE,SAAS,oBAAoB;GAAc,UAAU;EAAwB;EAC/E;GACE,SAAS,oBAAoB;GAC7B,aAAa,YAAqC,QAAQ,OAAO;GACjE,QAAQ,CAAC,oBAAoB,YAAY;EAC3C;CACF;AACF,CAAC,CAAA,GAAA,iBAAA"}

package/dist/route-name-DGoBOfPg.mjs

@@ -0,0 +1,171 @@
+//#region src/router/utils/path.ts
+/**
+* Path normalization and route ordering utilities.
+*
+* Users always write Hono-style `:param` paths (`:companyId`, `:id`).
+* OpenAPI requires `{param}` style — conversion happens only at registration time.
+*/
+/**
+* Convert Hono-style `:param` path segments to OpenAPI-style `{param}`.
+* Strips regex constraints (e.g., `:locale{sw}` → `{locale}`).
+*
+* @example
+* toOpenAPIPath('/users/:id')                    // '/users/{id}'
+* toOpenAPIPath('/:companyId/users/:userId')     // '/{companyId}/users/{userId}'
+* toOpenAPIPath('/users/:id/posts')              // '/users/{id}/posts'
+* toOpenAPIPath('/:locale{en|fr}/users')         // '/{locale}/users'
+*/
+function toOpenAPIPath(path) {
+	return path.replace(/:([a-zA-Z_][a-zA-Z0-9_]*)(\{[^}]*\})?/g, "{$1}");
+}
+/**
+* Convert Hono-style `:param` path segments to OpenAPI-style `{param}`,
+* preserving regex constraints.
+*
+* Used for Hono route registration via `app.openapi()`. The non-greedy
+* regex in `@hono/zod-openapi` (`\/{(.+?)}/g`) converts `{param}` back
+* to `:param` while leaving the constraint suffix intact.
+*
+* @example
+* toRoutingOpenAPIPath('/:locale{sw}/users/:id')  // '/{locale}{sw}/users/{id}'
+* toRoutingOpenAPIPath('/users/:id')               // '/users/{id}'
+*/
+function toRoutingOpenAPIPath(path) {
+	return path.replace(/:([a-zA-Z_][a-zA-Z0-9_]*)(\{[^}]*\})?/g, (_, name, constraint) => constraint ? `{${name}}${constraint}` : `{${name}}`);
+}
+/**
+* Compute a packed specificity key for route ordering.
+* Encodes both score and segment count into a single number to avoid object allocation.
+*
+* Lower score = higher priority (registered first in Hono).
+* Scoring: static = 0, `:param{constraint}` = 5, `:param` = 10, wildcard `{.+}` / `{.*}` = 100.
+*
+* Packed as: score * 10000 - segmentCount (negative segment count so more segments = lower key = higher priority)
+*
+* Locale variants score against the path with the leading `/:locale{…}` segment
+* stripped — the variant's score therefore matches its primary, but its larger
+* segment count makes it sort just before the primary. Without this, a primary
+* catch-all (e.g. `/:slug{.+}`) gobbles locale-prefixed URLs because Hono picks
+* whichever matching route was registered first.
+*/
+function getPathSpecificityKey(route) {
+	const segmentCount = countSegments(route.path);
+	const scoringPath = route.isLocaleVariant ? route.path.replace(/^\/:locale\{[^}]*\}/, "") || "/" : route.path;
+	let score = 0;
+	let i = 0;
+	while (i < scoringPath.length) {
+		if (scoringPath.charCodeAt(i) === 47) {
+			i++;
+			continue;
+		}
+		let end = scoringPath.indexOf("/", i);
+		if (end === -1) end = scoringPath.length;
+		const segment = scoringPath.substring(i, end);
+		if (segment.includes("{.+}") || segment.includes("{.*}")) score += 100;
+		else if (segment.charCodeAt(0) === 58) score += segment.includes("{") ? 5 : 10;
+		i = end;
+	}
+	return score * 1e4 - segmentCount;
+}
+function countSegments(path) {
+	let count = 0;
+	let i = 0;
+	while (i < path.length) {
+		if (path.charCodeAt(i) === 47) {
+			i++;
+			continue;
+		}
+		let end = path.indexOf("/", i);
+		if (end === -1) end = path.length;
+		count++;
+		i = end;
+	}
+	return count;
+}
+/**
+* Compute a specificity score for route ordering.
+* Lower score = higher priority (registered first in Hono).
+*
+* Scoring: static = 0, `:param{constraint}` = 5, `:param` = 10, wildcard `{.+}` / `{.*}` = 100.
+*/
+function getPathSpecificityScore(path) {
+	const segments = path.split("/").filter(Boolean);
+	let score = 0;
+	for (const segment of segments) if (segment.includes("{.+}") || segment.includes("{.*}")) score += 100;
+	else if (segment.startsWith(":") && segment.includes("{")) score += 5;
+	else if (segment.startsWith(":")) score += 10;
+	return score;
+}
+/**
+* Sort routes by specificity so Hono registers them in the correct order.
+*
+* 1. Static paths before parameterized before wildcards
+* 2. More segments = more specific (tie-breaker)
+* 3. Locale-prefixed variants before their primary (so a locale-prefixed
+*    request matches the variant first; a primary catch-all would otherwise
+*    swallow the locale prefix into its param)
+*/
+function sortRoutesBySpecificity(routes) {
+	const keys = /* @__PURE__ */ new Map();
+	for (const route of routes) keys.set(route, getPathSpecificityKey(route));
+	const copy = routes.slice();
+	copy.sort((a, b) => keys.get(a) - keys.get(b));
+	return copy;
+}
+//#endregion
+//#region src/router/utils/route-name.ts
+/**
+* Route naming utilities.
+*
+* Extracts parameter names from paths and domains,
+* and generates convention-based route names.
+*/
+/**
+* Extract parameter names from a Hono-style path.
+*
+* @example
+* extractParamNames('/users/:id')                     // ['id']
+* extractParamNames('/:companyId/users/:userId')      // ['companyId', 'userId']
+* extractParamNames('/users')                         // []
+*/
+function extractParamNames(path) {
+	if (!path.includes(":")) return [];
+	return [...path.matchAll(/:([a-zA-Z_][a-zA-Z0-9_]*)/g)].map((m) => m[1]);
+}
+/**
+* Extract parameter names from a domain pattern.
+*
+* @example
+* extractDomainParamNames('{tenant}.example.com')           // ['tenant']
+* extractDomainParamNames('{region}.{tenant}.example.com')  // ['region', 'tenant']
+* extractDomainParamNames('example.com')                    // []
+*/
+function extractDomainParamNames(domain) {
+	if (!domain.includes("{")) return [];
+	return [...domain.matchAll(/\{([a-zA-Z_][a-zA-Z0-9_]*)\}/g)].map((m) => m[1]);
+}
+/**
+* Auto-generate a route name for convention-based `@Route` methods.
+*
+* Strips common prefixes (`/api/`, `/v{N}/`) and parameter segments,
+* then joins remaining static segments with dots and appends the method name.
+*
+* @example
+* generateConventionRouteName('/users', 'index')                         // 'users.index'
+* generateConventionRouteName('/users', 'show')                          // 'users.show'
+* generateConventionRouteName('/api/v1/users', 'create')                 // 'users.create'
+* generateConventionRouteName('/api/v1/users/:userId/notes', 'index')    // 'users.notes.index'
+* generateConventionRouteName('/:companyId/users', 'index')              // 'users.index'
+* generateConventionRouteName('/users/:userId/notes/:noteId/tags', 'index') // 'users.notes.tags.index'
+*/
+function generateConventionRouteName(basePath, methodName) {
+	const parts = basePath.split("/");
+	const segments = [];
+	for (const s of parts) if (s && s !== "api" && !s.startsWith(":") && !/^v\d+$/.test(s)) segments.push(s);
+	if (segments.length === 0) return methodName;
+	return `${segments.join(".")}.${methodName}`;
+}
+//#endregion
+export { sortRoutesBySpecificity as a, getPathSpecificityScore as i, extractParamNames as n, toOpenAPIPath as o, generateConventionRouteName as r, toRoutingOpenAPIPath as s, extractDomainParamNames as t };
+
+//# sourceMappingURL=route-name-DGoBOfPg.mjs.map

package/dist/route-name-DGoBOfPg.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-name-DGoBOfPg.mjs","names":[],"sources":["../src/router/utils/path.ts","../src/router/utils/route-name.ts"],"sourcesContent":["/**\n * Path normalization and route ordering utilities.\n *\n * Users always write Hono-style `:param` paths (`:companyId`, `:id`).\n * OpenAPI requires `{param}` style — conversion happens only at registration time.\n */\n\n/**\n * Convert Hono-style `:param` path segments to OpenAPI-style `{param}`.\n * Strips regex constraints (e.g., `:locale{sw}` → `{locale}`).\n *\n * @example\n * toOpenAPIPath('/users/:id')                    // '/users/{id}'\n * toOpenAPIPath('/:companyId/users/:userId')     // '/{companyId}/users/{userId}'\n * toOpenAPIPath('/users/:id/posts')              // '/users/{id}/posts'\n * toOpenAPIPath('/:locale{en|fr}/users')         // '/{locale}/users'\n */\nexport function toOpenAPIPath(path: string): string {\n  return path.replace(/:([a-zA-Z_][a-zA-Z0-9_]*)(\\{[^}]*\\})?/g, '{$1}')\n}\n\n/**\n * Convert Hono-style `:param` path segments to OpenAPI-style `{param}`,\n * preserving regex constraints.\n *\n * Used for Hono route registration via `app.openapi()`. The non-greedy\n * regex in `@hono/zod-openapi` (`\\/{(.+?)}/g`) converts `{param}` back\n * to `:param` while leaving the constraint suffix intact.\n *\n * @example\n * toRoutingOpenAPIPath('/:locale{sw}/users/:id')  // '/{locale}{sw}/users/{id}'\n * toRoutingOpenAPIPath('/users/:id')               // '/users/{id}'\n */\nexport function toRoutingOpenAPIPath(path: string): string {\n  return path.replace(\n    /:([a-zA-Z_][a-zA-Z0-9_]*)(\\{[^}]*\\})?/g,\n    (_, name: string, constraint?: string) => constraint ? `{${name}}${constraint}` : `{${name}}`,\n  )\n}\n\n/**\n * Compute a packed specificity key for route ordering.\n * Encodes both score and segment count into a single number to avoid object allocation.\n *\n * Lower score = higher priority (registered first in Hono).\n * Scoring: static = 0, `:param{constraint}` = 5, `:param` = 10, wildcard `{.+}` / `{.*}` = 100.\n *\n * Packed as: score * 10000 - segmentCount (negative segment count so more segments = lower key = higher priority)\n *\n * Locale variants score against the path with the leading `/:locale{…}` segment\n * stripped — the variant's score therefore matches its primary, but its larger\n * segment count makes it sort just before the primary. Without this, a primary\n * catch-all (e.g. `/:slug{.+}`) gobbles locale-prefixed URLs because Hono picks\n * whichever matching route was registered first.\n */\nfunction getPathSpecificityKey(route: { path: string; isLocaleVariant?: boolean }): number {\n  const segmentCount = countSegments(route.path)\n  const scoringPath = route.isLocaleVariant\n    ? (route.path.replace(/^\\/:locale\\{[^}]*\\}/, '') || '/')\n    : route.path\n\n  let score = 0\n  let i = 0\n  while (i < scoringPath.length) {\n    if (scoringPath.charCodeAt(i) === 47 /* '/' */) { i++; continue }\n\n    let end = scoringPath.indexOf('/', i)\n    if (end === -1) end = scoringPath.length\n\n    const segment = scoringPath.substring(i, end)\n\n    if (segment.includes('{.+}') || segment.includes('{.*}')) {\n      score += 100\n    } else if (segment.charCodeAt(0) === 58 /* ':' */) {\n      score += segment.includes('{') ? 5 : 10\n    }\n\n    i = end\n  }\n\n  return score * 10000 - segmentCount\n}\n\nfunction countSegments(path: string): number {\n  let count = 0\n  let i = 0\n  while (i < path.length) {\n    if (path.charCodeAt(i) === 47 /* '/' */) { i++; continue }\n    let end = path.indexOf('/', i)\n    if (end === -1) end = path.length\n    count++\n    i = end\n  }\n  return count\n}\n\n/**\n * Compute a specificity score for route ordering.\n * Lower score = higher priority (registered first in Hono).\n *\n * Scoring: static = 0, `:param{constraint}` = 5, `:param` = 10, wildcard `{.+}` / `{.*}` = 100.\n */\nexport function getPathSpecificityScore(path: string): number {\n  const segments = path.split('/').filter(Boolean)\n  let score = 0\n  for (const segment of segments) {\n    if (segment.includes('{.+}') || segment.includes('{.*}')) {\n      score += 100\n    } else if (segment.startsWith(':') && segment.includes('{')) {\n      score += 5\n    } else if (segment.startsWith(':')) {\n      score += 10\n    }\n  }\n  return score\n}\n\n/**\n * Sort routes by specificity so Hono registers them in the correct order.\n *\n * 1. Static paths before parameterized before wildcards\n * 2. More segments = more specific (tie-breaker)\n * 3. Locale-prefixed variants before their primary (so a locale-prefixed\n *    request matches the variant first; a primary catch-all would otherwise\n *    swallow the locale prefix into its param)\n */\nexport function sortRoutesBySpecificity<T extends { path: string; isLocaleVariant?: boolean }>(routes: T[]): T[] {\n  // Pre-compute packed specificity keys (avoids object allocation per route)\n  const keys = new Map<T, number>()\n  for (const route of routes) {\n    keys.set(route, getPathSpecificityKey(route))\n  }\n\n  const copy = routes.slice()\n  copy.sort((a, b) => keys.get(a)! - keys.get(b)!)\n  return copy\n}\n","/**\n * Route naming utilities.\n *\n * Extracts parameter names from paths and domains,\n * and generates convention-based route names.\n */\n\n/**\n * Extract parameter names from a Hono-style path.\n *\n * @example\n * extractParamNames('/users/:id')                     // ['id']\n * extractParamNames('/:companyId/users/:userId')      // ['companyId', 'userId']\n * extractParamNames('/users')                         // []\n */\nexport function extractParamNames(path: string): string[] {\n  if (!path.includes(':')) return []\n  const matches = path.matchAll(/:([a-zA-Z_][a-zA-Z0-9_]*)/g)\n  return [...matches].map(m => m[1])\n}\n\n/**\n * Extract parameter names from a domain pattern.\n *\n * @example\n * extractDomainParamNames('{tenant}.example.com')           // ['tenant']\n * extractDomainParamNames('{region}.{tenant}.example.com')  // ['region', 'tenant']\n * extractDomainParamNames('example.com')                    // []\n */\nexport function extractDomainParamNames(domain: string): string[] {\n  if (!domain.includes('{')) return []\n  const matches = domain.matchAll(/\\{([a-zA-Z_][a-zA-Z0-9_]*)\\}/g)\n  return [...matches].map(m => m[1])\n}\n\n/**\n * Auto-generate a route name for convention-based `@Route` methods.\n *\n * Strips common prefixes (`/api/`, `/v{N}/`) and parameter segments,\n * then joins remaining static segments with dots and appends the method name.\n *\n * @example\n * generateConventionRouteName('/users', 'index')                         // 'users.index'\n * generateConventionRouteName('/users', 'show')                          // 'users.show'\n * generateConventionRouteName('/api/v1/users', 'create')                 // 'users.create'\n * generateConventionRouteName('/api/v1/users/:userId/notes', 'index')    // 'users.notes.index'\n * generateConventionRouteName('/:companyId/users', 'index')              // 'users.index'\n * generateConventionRouteName('/users/:userId/notes/:noteId/tags', 'index') // 'users.notes.tags.index'\n */\nexport function generateConventionRouteName(basePath: string, methodName: string): string {\n  // Single-pass: split and filter in one loop (avoids 4 intermediate arrays)\n  const parts = basePath.split('/')\n  const segments: string[] = []\n  for (const s of parts) {\n    if (s && s !== 'api' && !s.startsWith(':') && !/^v\\d+$/.test(s)) {\n      segments.push(s)\n    }\n  }\n\n  if (segments.length === 0) {\n    return methodName\n  }\n\n  return `${segments.join('.')}.${methodName}`\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,SAAgB,cAAc,MAAsB;CAClD,OAAO,KAAK,QAAQ,0CAA0C,MAAM;AACtE;;;;;;;;;;;;;AAcA,SAAgB,qBAAqB,MAAsB;CACzD,OAAO,KAAK,QACV,2CACC,GAAG,MAAc,eAAwB,aAAa,IAAI,KAAK,GAAG,eAAe,IAAI,KAAK,EAC7F;AACF;;;;;;;;;;;;;;;;AAiBA,SAAS,sBAAsB,OAA4D;CACzF,MAAM,eAAe,cAAc,MAAM,IAAI;CAC7C,MAAM,cAAc,MAAM,kBACrB,MAAM,KAAK,QAAQ,uBAAuB,EAAE,KAAK,MAClD,MAAM;CAEV,IAAI,QAAQ;CACZ,IAAI,IAAI;CACR,OAAO,IAAI,YAAY,QAAQ;EAC7B,IAAI,YAAY,WAAW,CAAC,MAAM,IAAc;GAAE;GAAK;EAAS;EAEhE,IAAI,MAAM,YAAY,QAAQ,KAAK,CAAC;EACpC,IAAI,QAAQ,IAAI,MAAM,YAAY;EAElC,MAAM,UAAU,YAAY,UAAU,GAAG,GAAG;EAE5C,IAAI,QAAQ,SAAS,MAAM,KAAK,QAAQ,SAAS,MAAM,GACrD,SAAS;OACJ,IAAI,QAAQ,WAAW,CAAC,MAAM,IACnC,SAAS,QAAQ,SAAS,GAAG,IAAI,IAAI;EAGvC,IAAI;CACN;CAEA,OAAO,QAAQ,MAAQ;AACzB;AAEA,SAAS,cAAc,MAAsB;CAC3C,IAAI,QAAQ;CACZ,IAAI,IAAI;CACR,OAAO,IAAI,KAAK,QAAQ;EACtB,IAAI,KAAK,WAAW,CAAC,MAAM,IAAc;GAAE;GAAK;EAAS;EACzD,IAAI,MAAM,KAAK,QAAQ,KAAK,CAAC;EAC7B,IAAI,QAAQ,IAAI,MAAM,KAAK;EAC3B;EACA,IAAI;CACN;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,wBAAwB,MAAsB;CAC5D,MAAM,WAAW,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;CAC/C,IAAI,QAAQ;CACZ,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,SAAS,MAAM,KAAK,QAAQ,SAAS,MAAM,GACrD,SAAS;MACJ,IAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GACxD,SAAS;MACJ,IAAI,QAAQ,WAAW,GAAG,GAC/B,SAAS;CAGb,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,wBAA+E,QAAkB;CAE/G,MAAM,uBAAO,IAAI,IAAe;CAChC,KAAK,MAAM,SAAS,QAClB,KAAK,IAAI,OAAO,sBAAsB,KAAK,CAAC;CAG9C,MAAM,OAAO,OAAO,MAAM;CAC1B,KAAK,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC,IAAK,KAAK,IAAI,CAAC,CAAE;CAC/C,OAAO;AACT;;;;;;;;;;;;;;;;;ACzHA,SAAgB,kBAAkB,MAAwB;CACxD,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,OAAO,CAAC;CAEjC,OAAO,CAAC,GADQ,KAAK,SAAS,4BACb,CAAC,EAAE,KAAI,MAAK,EAAE,EAAE;AACnC;;;;;;;;;AAUA,SAAgB,wBAAwB,QAA0B;CAChE,IAAI,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO,CAAC;CAEnC,OAAO,CAAC,GADQ,OAAO,SAAS,+BACf,CAAC,EAAE,KAAI,MAAK,EAAE,EAAE;AACnC;;;;;;;;;;;;;;;AAgBA,SAAgB,4BAA4B,UAAkB,YAA4B;CAExF,MAAM,QAAQ,SAAS,MAAM,GAAG;CAChC,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,KAAK,OACd,IAAI,KAAK,MAAM,SAAS,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC,SAAS,KAAK,CAAC,GAC5D,SAAS,KAAK,CAAC;CAInB,IAAI,SAAS,WAAW,GACtB,OAAO;CAGT,OAAO,GAAG,SAAS,KAAK,GAAG,EAAE,GAAG;AAClC"}