stratal 0.0.25 → 0.0.26

package/dist/rate-limiter/index.d.mts

@@ -1,4 +1,4 @@
-import { Dn as AsyncModuleOptions, Dr as ApplicationError, Fn as OnException, In as OnInitialize, Nn as ModuleContext, Y as Container, _n as Middleware, c as HttpException, d as ExceptionHandler, kn as DynamicModule, rt as RouterContext, vn as Next } from "../index-C_t8VVQD.mjs";
+import { $ as Container, Cn as Middleware, Fn as DynamicModule, Hn as OnInitialize, Ir as ApplicationError, Nn as AsyncModuleOptions, Vn as OnException, f as ExceptionHandler, l as HttpException, st as RouterContext, wn as Next, zn as ModuleContext } from "../index-uybm0bhQ.mjs";
 import { t as Macroable } from "../index-0ItCjaqw.mjs";
 import { t as StratalEnv } from "../env-ug22bJj7.mjs";
 import { t as Constructor } from "../types-CmV_9xBD.mjs";
@@ -91,50 +91,6 @@ declare class Limit {
   get customResponse(): RateLimitResponseHandler | undefined;
 }
 //#endregion
-//#region src/rate-limiter/stores/rate-limiter-store.interface.d.ts
-/**
- * Result of a single hit against the rate limiter (registry-internal).
- *
- * The store no longer participates in the increment — it's a typed KV.
- * `RateLimiterRegistry.handle()` produces this value as it runs the
- * get-modify-set sequence.
- */
-interface RateLimitHit {
-  /** Counter value AFTER the increment (1 on first hit). */
-  count: number;
-  /** Absolute reset timestamp in milliseconds since epoch. */
-  resetAt: number;
-}
-/**
- * Pluggable backend for rate-limit storage — a typed key-value store with TTL.
- *
- * The framework ships `KvRateLimiterStore` (Cloudflare KV) and
- * `InMemoryRateLimiterStore` (tests). Users can register a custom
- * implementation through `RateLimiterModule.forRoot({ store: { useClass: ... } })`.
- *
- * The increment logic lives in `RateLimiterRegistry`; the store only persists
- * arbitrary values keyed by string. Same shape consumed by the better-auth
- * bridge in `@stratal/framework/auth`, which stores its own `RateLimit`
- * records here under a separate key namespace.
- */
-interface IRateLimiterStore {
-  /**
-   * Read the value at `key`. Returns `null` when missing or expired.
-   * Implementations are responsible for honouring TTL (lazy or active).
-   */
-  get<T = unknown>(key: string): Promise<T | null>;
-  /**
-   * Write `value` at `key` with `ttlSeconds` TTL. Overwrites any existing
-   * value. The TTL resets on every write — callers compute the remaining
-   * window themselves and pass it explicitly.
-   */
-  set<T = unknown>(key: string, value: T, ttlSeconds: number): Promise<void>;
-  /**
-   * Remove `key`. No-op when missing.
-   */
-  delete(key: string): Promise<void>;
-}
-//#endregion
 //#region src/rate-limiter/rate-limiter-registry.d.ts
 /**
  * Resolver function registered via {@link RateLimiterRegistry.for}. Receives
@@ -162,9 +118,16 @@ type LimitResolver = (ctx: RouterContext) => Limit | Limit[] | Promise<Limit | L
  * `customRules` interop.
  */
 declare class RateLimiterRegistry extends Macroable {
-  private readonly store;
+  private readonly container;
   private readonly resolvers;
-  constructor(store: IRateLimiterStore);
+  constructor(container: Container);
+  /**
+   * Resolve the store per access instead of capturing it at construction.
+   * The registry is a singleton built during module init; lazy resolution
+   * keeps later `RATE_LIMITER_TOKENS.Store` overrides (e.g. the testing
+   * harness disabling limits) effective.
+   */
+  private get store();
   /**
    * Register a named limiter. Names must be unique; calling `for()` again
    * with the same name overwrites the previous resolver (matches Laravel
@@ -190,6 +153,50 @@ declare class RateLimiterRegistry extends Macroable {
   private makeHeaders;
 }
 //#endregion
+//#region src/rate-limiter/stores/rate-limiter-store.interface.d.ts
+/**
+ * Result of a single hit against the rate limiter (registry-internal).
+ *
+ * The store no longer participates in the increment — it's a typed KV.
+ * `RateLimiterRegistry.handle()` produces this value as it runs the
+ * get-modify-set sequence.
+ */
+interface RateLimitHit {
+  /** Counter value AFTER the increment (1 on first hit). */
+  count: number;
+  /** Absolute reset timestamp in milliseconds since epoch. */
+  resetAt: number;
+}
+/**
+ * Pluggable backend for rate-limit storage — a typed key-value store with TTL.
+ *
+ * The framework ships `KvRateLimiterStore` (Cloudflare KV) and
+ * `InMemoryRateLimiterStore` (tests). Users can register a custom
+ * implementation through `RateLimiterModule.forRoot({ store: { useClass: ... } })`.
+ *
+ * The increment logic lives in `RateLimiterRegistry`; the store only persists
+ * arbitrary values keyed by string. Same shape consumed by the better-auth
+ * bridge in `@stratal/framework/auth`, which stores its own `RateLimit`
+ * records here under a separate key namespace.
+ */
+interface IRateLimiterStore {
+  /**
+   * Read the value at `key`. Returns `null` when missing or expired.
+   * Implementations are responsible for honouring TTL (lazy or active).
+   */
+  get<T = unknown>(key: string): Promise<T | null>;
+  /**
+   * Write `value` at `key` with `ttlSeconds` TTL. Overwrites any existing
+   * value. The TTL resets on every write — callers compute the remaining
+   * window themselves and pass it explicitly.
+   */
+  set<T = unknown>(key: string, value: T, ttlSeconds: number): Promise<void>;
+  /**
+   * Remove `key`. No-op when missing.
+   */
+  delete(key: string): Promise<void>;
+}
+//#endregion
 //#region src/rate-limiter/stores/store-factory.d.ts
 /**
  * Configuration for `RateLimiterModule.forRoot()`. Picks the backing store.

package/dist/rate-limiter/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/rate-limiter/errors.ts","../../src/rate-limiter/limit.ts","../../src/rate-limiter/stores/rate-limiter-store.interface.ts","../../src/rate-limiter/rate-limiter-registry.ts","../../src/rate-limiter/stores/store-factory.ts","../../src/rate-limiter/rate-limiter.module.ts","../../src/rate-limiter/rate-limiter.tokens.ts","../../src/rate-limiter/throttle.middleware.ts","../../src/rate-limiter/decorators/rate-limit.decorator.ts","../../src/rate-limiter/stores/kv-store.ts","../../src/rate-limiter/stores/memory-store.ts"],"mappings":";;;;;;;;;;;;;AAYA;;;;cAAa,oBAAA,SAA6B,aAAa;EAAA,SAEnC,IAAA;IAAQ,UAAA;IAAoB,KAAA;IAAe,OAAA;EAAA;cAA3C,IAAA;IAAQ,UAAA;IAAoB,KAAA;IAAe,OAAA;EAAA;AAAA;AAAA,cAMlD,gBAAA,SAAyB,gBAAgB;;;;;;;UCdrC,gBAAA;EACf,aAAA;EACA,mBAAA;EACA,uBAAA;EACA,mBAAA;AAAA;;;;;;;KASU,wBAAA,IACV,GAAA,EAAK,aAAA,EACL,OAAA,EAAS,gBAAA,KACN,QAAA,GAAW,OAAA,CAAQ,QAAA;;;;;ADRwD;AAMhF;;;;AAAsD;;;;ACdtD;;;;cAmCa,KAAA;EAAA,SAKO,aAAA;EAAA,SACA,GAAA;EAAA,SACA,QAAA;EAAA,QANV,IAAA;EAAA,QACA,eAAA;EAAA,QAED,WAAA;EAAA,OAMA,SAAA,CAAU,GAAA,WAAc,KAAA;EAAA,OAIxB,UAAA,CAAW,OAAA,UAAiB,GAAA,WAAc,KAAA;EAAA,OAI1C,SAAA,CAAU,GAAA,WAAc,KAAA;EAAA,OAIxB,UAAA,CAAW,OAAA,UAAiB,GAAA,WAAc,KAAA;EAAA,OAI1C,OAAA,CAAQ,GAAA,WAAc,KAAA;EAAA,OAItB,MAAA,CAAO,GAAA,WAAc,KAAA;EAjDd;EAAA,OAsDP,IAAA,IAAQ,KAAA;EAtDM;EA2DrB,EAAA,CAAG,GAAA;EA7DH;;;;;EAuEA,QAAA,CAAS,OAAA,EAAS,wBAAA;EAAA,IAKd,GAAA;EAAA,IAIA,cAAA,IAAkB,wBAAA;AAAA;;;;;;;;;;UC7FP,YAAA;EFKiB;EEHhC,KAAA;EFGqD;EEDrD,OAAO;AAAA;;;;;;;;;;AFGuE;AAMhF;;UEMiB,iBAAA;EFNqC;AAAA;;;EEWpD,GAAA,cAAiB,GAAA,WAAc,OAAA,CAAQ,CAAA;EDzBxB;;;;;ECgCf,GAAA,cAAiB,GAAA,UAAa,KAAA,EAAO,CAAA,EAAG,UAAA,WAAqB,OAAA;ED7B7D;;;ECkCA,MAAA,CAAO,GAAA,WAAc,OAAA;AAAA;;;;;AF/BvB;;;KGGY,aAAA,IACV,GAAA,EAAK,aAAA,KACF,KAAA,GAAQ,KAAA,KAAU,OAAA,CAAQ,KAAA,GAAQ,KAAA;;;;;;;;;;;;AHHyC;AAMhF;;;;AAAsD;;;cG8BzC,mBAAA,SAA4B,SAAA;EAAA,iBAIe,KAAA;EAAA,iBAHrC,SAAA;cAGqC,KAAA,EAAO,iBAAA;EFhD9B;;;;;EE0D/B,GAAA,CAAI,IAAA,UAAc,QAAA,EAAU,aAAA;EAI5B,GAAA,CAAI,IAAA;EFjDM;;;;;;;;EE6DJ,MAAA,CAAO,IAAA,UAAc,GAAA,EAAK,aAAA,EAAe,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,QAAA;EF1D/C;;;;EAAA,QE4HP,GAAA;EAAA,QAgBN,OAAA;EAAA,QAKA,WAAA;AAAA;;;;;AH3JV;;;;;;;KIWY,wBAAA;EACN,KAAA;EAAa,OAAA,QAAe,UAAA;AAAA;EAC5B,KAAA;AAAA;EACA,KAAA;IAAS,QAAA,EAAU,WAAA,CAAY,iBAAA;EAAA;AAAA;AAAA,cAOxB,uBAAA;EAAA,iBAEyC,GAAA;EAAA,iBACE,KAAA;EAAA,iBACV,SAAA;EAAA,iBAEzB,OAAA;cAJiC,GAAA,EAAK,UAAA,EACH,KAAA,EAAO,YAAA,EACjB,SAAA,EAAW,SAAA,EAEpC,OAAA,GAAU,wBAAA;EAG7B,MAAA,IAAU,iBAAA;AAAA;;;;;;;AJ9BZ;;;;;;;;;;;;;;;AAEgF;AAMhF;;;;cK0Ba,iBAAA,YAA6B,YAAA,EAAc,WAAA;;;;AJxCxD;;SI8CS,OAAA,CAAQ,OAAA,EAAS,wBAAA,GAA2B,aAAA;EJ9CpB;;;;EAAA,OI2DxB,YAAA,CAAa,OAAA,EAAS,kBAAA,CAAmB,wBAAA,IAA4B,aAAA;EJvDzD;AAAA;AASrB;;;;;;EImEE,YAAA;IAAe;EAAA,GAAa,aAAA;EJhEd;;;;;;EI2Ed,WAAA,CAAY,OAAA,EAAS,gBAAA;AAAA;;;cCjGV,mBAAA;EAAA;;;;;;ANYb;;;;KMAY,gBAAA,WAA2B,mBAAA,eAAkC,mBAAmB;;;;;;;;ANA5F;;;;iBOSgB,wBAAA,CAAyB,IAAA,WAAe,WAAW,CAAC,UAAA;;;;;;;;;;APTpE;;;;;;;;;;;;;;;AAEgF;AAMhF;;;iBQWgB,SAAA,CAAU,IAAA,WAAe,cAAA,GAAiB,eAAe;ARXnB;;;;ACdtD;;;ADcsD,iBQ8BtC,aAAA,CAAc,MAAA,UAAgB,WAAoB;;;;;;;;ARtClE;;;;;;;cSGa,kBAAA,YAA8B,iBAAA;EAAA,iBACZ,KAAA;cAAA,KAAA,EAAO,YAAA;EAE9B,GAAA,IAAO,GAAA,WAAc,OAAA,CAAQ,CAAA;EAI7B,GAAA,IAAO,GAAA,UAAa,KAAA,EAAO,CAAA,EAAG,UAAA,WAAqB,OAAA;EAKnD,MAAA,CAAO,GAAA,WAAc,OAAA;AAAA;;;;;;;;;ATf7B;;;cUIa,wBAAA,YAAoC,iBAAA;EAAA,iBAC9B,OAAA;EAEjB,GAAA,IAAO,GAAA,WAAc,OAAA,CAAQ,CAAA;EAU7B,GAAA,IAAO,GAAA,UAAa,KAAA,EAAO,CAAA,EAAG,UAAA,WAAqB,OAAA;EAKnD,MAAA,CAAO,GAAA,WAAc,OAAA;AAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/rate-limiter/errors.ts","../../src/rate-limiter/limit.ts","../../src/rate-limiter/rate-limiter-registry.ts","../../src/rate-limiter/stores/rate-limiter-store.interface.ts","../../src/rate-limiter/stores/store-factory.ts","../../src/rate-limiter/rate-limiter.module.ts","../../src/rate-limiter/rate-limiter.tokens.ts","../../src/rate-limiter/throttle.middleware.ts","../../src/rate-limiter/decorators/rate-limit.decorator.ts","../../src/rate-limiter/stores/kv-store.ts","../../src/rate-limiter/stores/memory-store.ts"],"mappings":";;;;;;;;;;;;;AAYA;;;;cAAa,oBAAA,SAA6B,aAAa;EAAA,SAEnC,IAAA;IAAQ,UAAA;IAAoB,KAAA;IAAe,OAAA;EAAA;cAA3C,IAAA;IAAQ,UAAA;IAAoB,KAAA;IAAe,OAAA;EAAA;AAAA;AAAA,cAMlD,gBAAA,SAAyB,gBAAgB;;;;;;;UCdrC,gBAAA;EACf,aAAA;EACA,mBAAA;EACA,uBAAA;EACA,mBAAA;AAAA;;;;;;;KASU,wBAAA,IACV,GAAA,EAAK,aAAA,EACL,OAAA,EAAS,gBAAA,KACN,QAAA,GAAW,OAAA,CAAQ,QAAA;;;;;ADRwD;AAMhF;;;;AAAsD;;;;ACdtD;;;;cAmCa,KAAA;EAAA,SAKO,aAAA;EAAA,SACA,GAAA;EAAA,SACA,QAAA;EAAA,QANV,IAAA;EAAA,QACA,eAAA;EAAA,QAED,WAAA;EAAA,OAMA,SAAA,CAAU,GAAA,WAAc,KAAA;EAAA,OAIxB,UAAA,CAAW,OAAA,UAAiB,GAAA,WAAc,KAAA;EAAA,OAI1C,SAAA,CAAU,GAAA,WAAc,KAAA;EAAA,OAIxB,UAAA,CAAW,OAAA,UAAiB,GAAA,WAAc,KAAA;EAAA,OAI1C,OAAA,CAAQ,GAAA,WAAc,KAAA;EAAA,OAItB,MAAA,CAAO,GAAA,WAAc,KAAA;EAjDd;EAAA,OAsDP,IAAA,IAAQ,KAAA;EAtDM;EA2DrB,EAAA,CAAG,GAAA;EA7DH;;;;;EAuEA,QAAA,CAAS,OAAA,EAAS,wBAAA;EAAA,IAKd,GAAA;EAAA,IAIA,cAAA,IAAkB,wBAAA;AAAA;;;;;ADxFxB;;;KEGY,aAAA,IACV,GAAA,EAAK,aAAA,KACF,KAAA,GAAQ,KAAA,KAAU,OAAA,CAAQ,KAAA,GAAQ,KAAA;;;;;;;;;;;;AFHyC;AAMhF;;;;AAAsD;;;cE8BzC,mBAAA,SAA4B,SAAA;EAAA,iBAIS,SAAA;EAAA,iBAH/B,SAAA;cAG+B,SAAA,EAAW,SAAA;EDhD5B;;;;;;EAAA,YC2DnB,KAAA;ED9CF;;;;;ECuDV,GAAA,CAAI,IAAA,UAAc,QAAA,EAAU,aAAA;EAI5B,GAAA,CAAI,IAAA;EDxDU;;;;;;;;ECoER,MAAA,CAAO,IAAA,UAAc,GAAA,EAAK,aAAA,EAAe,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,QAAA;EDpE9C;;AAAQ;AAmBhC;EAnBwB,QCsIR,GAAA;EAAA,QAgBN,OAAA;EAAA,QAKA,WAAA;AAAA;;;;;;;;;;UC1KO,YAAA;EHKiB;EGHhC,KAAA;EHGqD;EGDrD,OAAO;AAAA;;;;;;;;;;AHGuE;AAMhF;;UGMiB,iBAAA;EHNqC;AAAA;;;EGWpD,GAAA,cAAiB,GAAA,WAAc,OAAA,CAAQ,CAAA;EFzBxB;;;;;EEgCf,GAAA,cAAiB,GAAA,UAAa,KAAA,EAAO,CAAA,EAAG,UAAA,WAAqB,OAAA;EF7B7D;;;EEkCA,MAAA,CAAO,GAAA,WAAc,OAAA;AAAA;;;;;AH/BvB;;;;;;;KIWY,wBAAA;EACN,KAAA;EAAa,OAAA,QAAe,UAAA;AAAA;EAC5B,KAAA;AAAA;EACA,KAAA;IAAS,QAAA,EAAU,WAAA,CAAY,iBAAA;EAAA;AAAA;AAAA,cAOxB,uBAAA;EAAA,iBAEyC,GAAA;EAAA,iBACE,KAAA;EAAA,iBACV,SAAA;EAAA,iBAEzB,OAAA;cAJiC,GAAA,EAAK,UAAA,EACH,KAAA,EAAO,YAAA,EACjB,SAAA,EAAW,SAAA,EAEpC,OAAA,GAAU,wBAAA;EAG7B,MAAA,IAAU,iBAAA;AAAA;;;;;;;AJ9BZ;;;;;;;;;;;;;;;AAEgF;AAMhF;;;;cK0Ba,iBAAA,YAA6B,YAAA,EAAc,WAAA;;;;AJxCxD;;SI8CS,OAAA,CAAQ,OAAA,EAAS,wBAAA,GAA2B,aAAA;EJ9CpB;;;;EAAA,OI2DxB,YAAA,CAAa,OAAA,EAAS,kBAAA,CAAmB,wBAAA,IAA4B,aAAA;EJvDzD;AAAA;AASrB;;;;;;EImEE,YAAA;IAAe;EAAA,GAAa,aAAA;EJhEd;;;;;;EI2Ed,WAAA,CAAY,OAAA,EAAS,gBAAA;AAAA;;;cCjGV,mBAAA;EAAA;;;;;;ANYb;;;;KMAY,gBAAA,WAA2B,mBAAA,eAAkC,mBAAmB;;;;;;;;ANA5F;;;;iBOSgB,wBAAA,CAAyB,IAAA,WAAe,WAAW,CAAC,UAAA;;;;;;;;;;APTpE;;;;;;;;;;;;;;;AAEgF;AAMhF;;;iBQWgB,SAAA,CAAU,IAAA,WAAe,cAAA,GAAiB,eAAe;ARXnB;;;;ACdtD;;;ADcsD,iBQ8BtC,aAAA,CAAc,MAAA,UAAgB,WAAoB;;;;;;;;ARtClE;;;;;;;cSGa,kBAAA,YAA8B,iBAAA;EAAA,iBACZ,KAAA;cAAA,KAAA,EAAO,YAAA;EAE9B,GAAA,IAAO,GAAA,WAAc,OAAA,CAAQ,CAAA;EAI7B,GAAA,IAAO,GAAA,UAAa,KAAA,EAAO,CAAA,EAAG,UAAA,WAAqB,OAAA;EAKnD,MAAA,CAAO,GAAA,WAAc,OAAA;AAAA;;;;;;;;;ATf7B;;;cUIa,wBAAA,YAAoC,iBAAA;EAAA,iBAC9B,OAAA;EAEjB,GAAA,IAAO,GAAA,WAAc,OAAA,CAAQ,CAAA;EAU7B,GAAA,IAAO,GAAA,UAAa,KAAA,EAAO,CAAA,EAAG,UAAA,WAAqB,OAAA;EAKnD,MAAA,CAAO,GAAA,WAAc,OAAA;AAAA"}

package/dist/rate-limiter/index.mjs

@@ -1,11 +1,11 @@
-import { d as inject, n as CONTAINER_TOKEN, r as DI_TOKENS, s as Singleton } from "../di-B0NXIdRF.mjs";
+import { l as Singleton, n as CONTAINER_TOKEN, p as inject, r as DI_TOKENS } from "../di-D7qmrAir.mjs";
 import { n as __decorateParam, t as __decorate } from "../decorate-CuAoSZvs.mjs";
 import { t as Macroable } from "../macroable-cvDTFZ_A.mjs";
 import { n as Module } from "../module.decorator-CYHY6pG5.mjs";
-import { c as RATE_LIMITER_TOKENS, l as RateLimiterError, s as createThrottleMiddleware, u as TooManyRequestsError } from "../module-registry-MfWmniZ7.mjs";
+import { c as RATE_LIMITER_TOKENS, l as RateLimiterError, s as createThrottleMiddleware, u as TooManyRequestsError } from "../module-registry-NxX5O0Qk.mjs";
 import "../module/index.mjs";
 import { CACHE_TOKENS, CacheModule } from "../cache/index.mjs";
-import { n as getRateLimits, t as RateLimit } from "../rate-limit.decorator-B35jBEVD.mjs";
+import { n as getRateLimits, t as RateLimit } from "../rate-limit.decorator-Djs4oYDB.mjs";
 //#region src/rate-limiter/limit.ts
 /**
 * A single rate limit window.
@@ -81,11 +81,20 @@ var Limit = class Limit {
 //#endregion
 //#region src/rate-limiter/rate-limiter-registry.ts
 let RateLimiterRegistry = class RateLimiterRegistry extends Macroable {
-	store;
+	container;
 	resolvers = /* @__PURE__ */ new Map();
-	constructor(store) {
+	constructor(container) {
 		super();
-		this.store = store;
+		this.container = container;
+	}
+	/**
+	* Resolve the store per access instead of capturing it at construction.
+	* The registry is a singleton built during module init; lazy resolution
+	* keeps later `RATE_LIMITER_TOKENS.Store` overrides (e.g. the testing
+	* harness disabling limits) effective.
+	*/
+	get store() {
+		return this.container.resolve(RATE_LIMITER_TOKENS.Store);
 	}
 	/**
 	* Register a named limiter. Names must be unique; calling `for()` again
@@ -182,7 +191,7 @@ let RateLimiterRegistry = class RateLimiterRegistry extends Macroable {
 		};
 	}
 };
-RateLimiterRegistry = __decorate([Singleton(), __decorateParam(0, inject(RATE_LIMITER_TOKENS.Store))], RateLimiterRegistry);
+RateLimiterRegistry = __decorate([Singleton(), __decorateParam(0, inject(DI_TOKENS.Container))], RateLimiterRegistry);
 //#endregion
 //#region src/rate-limiter/stores/kv-store.ts
 /**

package/dist/rate-limiter/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/rate-limiter/limit.ts","../../src/rate-limiter/rate-limiter-registry.ts","../../src/rate-limiter/stores/kv-store.ts","../../src/rate-limiter/stores/memory-store.ts","../../src/rate-limiter/stores/store-factory.ts","../../src/rate-limiter/rate-limiter.module.ts"],"sourcesContent":["import type { RouterContext } from '../router/router-context'\n\n/**\n * Standard rate-limit response headers passed to custom response handlers.\n * Keys are canonical HTTP header names; values are the stringified counts.\n */\nexport interface RateLimitHeaders {\n  'Retry-After': string\n  'X-RateLimit-Limit': string\n  'X-RateLimit-Remaining': string\n  'X-RateLimit-Reset': string\n}\n\n/**\n * Custom response handler invoked when a limit is exceeded and the user\n * supplied `.response()` on the {@link Limit}. Receives the request context\n * and the precomputed standard headers (which the handler can spread, drop,\n * or override).\n */\nexport type RateLimitResponseHandler = (\n  ctx: RouterContext,\n  headers: RateLimitHeaders,\n) => Response | Promise<Response>\n\n/**\n * A single rate limit window.\n *\n * Build via the static factories (`perSecond`, `perMinute`, `perMinutes`,\n * `perHour`, `perDay`, `none`). Chain `.by(key)` to scope per-actor and\n * `.response(handler)` to override the default 429 response.\n *\n * Returned (singly or as an array) by limiter resolvers registered via\n * `RateLimiterRegistry.for()`.\n *\n * @example\n * ```typescript\n * Limit.perMinute(60).by(ctx.header('cf-connecting-ip') ?? 'global')\n * Limit.perHour(100).by(userId)\n * Limit.none()                                // bypass\n * ```\n */\nexport class Limit {\n  private _key?: string\n  private _customResponse?: RateLimitResponseHandler\n\n  private constructor(\n    public readonly windowSeconds: number,\n    public readonly max: number,\n    public readonly disabled = false,\n  ) {}\n\n  static perSecond(max: number): Limit {\n    return new Limit(1, max)\n  }\n\n  static perSeconds(seconds: number, max: number): Limit {\n    return new Limit(seconds, max)\n  }\n\n  static perMinute(max: number): Limit {\n    return new Limit(60, max)\n  }\n\n  static perMinutes(minutes: number, max: number): Limit {\n    return new Limit(minutes * 60, max)\n  }\n\n  static perHour(max: number): Limit {\n    return new Limit(60 * 60, max)\n  }\n\n  static perDay(max: number): Limit {\n    return new Limit(24 * 60 * 60, max)\n  }\n\n  /** Bypass the limiter entirely for this request. */\n  static none(): Limit {\n    return new Limit(0, 0, true)\n  }\n\n  /** Scope this limit to a specific actor (user id, IP, tenant, etc.). */\n  by(key: string | number): this {\n    this._key = String(key)\n    return this\n  }\n\n  /**\n   * Override the default 429 response. The handler receives the standard\n   * `RateLimitHeaders` so it can spread them onto its own Response or omit\n   * them as it sees fit.\n   */\n  response(handler: RateLimitResponseHandler): this {\n    this._customResponse = handler\n    return this\n  }\n\n  get key(): string | undefined {\n    return this._key\n  }\n\n  get customResponse(): RateLimitResponseHandler | undefined {\n    return this._customResponse\n  }\n}\n","import { inject } from '../di'\nimport { Singleton } from '../di/decorators'\nimport { Macroable } from '../macroable'\nimport type { Next } from '../router/middleware.interface'\nimport type { RouterContext } from '../router/router-context'\nimport { RateLimiterError, TooManyRequestsError } from './errors'\nimport type { Limit, RateLimitHeaders } from './limit'\nimport { RATE_LIMITER_TOKENS } from './rate-limiter.tokens'\nimport type { IRateLimiterStore, RateLimitHit } from './stores/rate-limiter-store.interface'\n\n/**\n * Resolver function registered via {@link RateLimiterRegistry.for}. Receives\n * the request context and returns the limit (or limits) that apply to this\n * request. Return `Limit.none()` to bypass for the current request.\n */\nexport type LimitResolver = (\n  ctx: RouterContext,\n) => Limit | Limit[] | Promise<Limit | Limit[]>\n\ninterface StoredHit {\n  count: number\n  resetAt: number\n}\n\n/**\n * Central registry of named rate limiters and the request-time enforcement\n * pipeline. Resolved as a singleton; consumed by `ThrottleMiddleware`.\n *\n * Register limiters in a module's `onInitialize` hook:\n * ```typescript\n * @Module({})\n * export class RateLimitsModule implements OnInitialize {\n *   onInitialize({ container }: ModuleContext): void {\n *     const limiter = container.resolve<RateLimiterRegistry>(RATE_LIMITER_TOKENS.Registry)\n *     limiter.for('api', (ctx) => Limit.perMinute(60).by(ctx.header('cf-connecting-ip') ?? '*'))\n *   }\n * }\n * ```\n *\n * Extensible via `Macroable`: adapter packages (e.g. `@stratal/framework/auth`)\n * can attach extra registration methods such as `forPath()` for better-auth\n * `customRules` interop.\n */\n// IMPORTANT: do not pass a token to @Singleton — that would self-register\n// the class globally at module-load time, making the Registry resolvable\n// even when the user never imported RateLimiterModule. We rely on\n// RateLimiterModule providers being the only binding source, so\n// `{ isOptional: true }` in ThrottleMiddleware correctly returns undefined\n// when the module is missing.\n@Singleton()\nexport class RateLimiterRegistry extends Macroable {\n  private readonly resolvers = new Map<string, LimitResolver>()\n\n  constructor(\n    @inject(RATE_LIMITER_TOKENS.Store) private readonly store: IRateLimiterStore,\n  ) {\n    super()\n  }\n\n  /**\n   * Register a named limiter. Names must be unique; calling `for()` again\n   * with the same name overwrites the previous resolver (matches Laravel\n   * `RateLimiter::for` semantics — last definition wins).\n   */\n  for(name: string, resolver: LimitResolver): void {\n    this.resolvers.set(name, resolver)\n  }\n\n  has(name: string): boolean {\n    return this.resolvers.has(name)\n  }\n\n  /**\n   * Enforce the named limiter for the current request. Called by\n   * `ThrottleMiddleware` (the per-name class produced by\n   * `createThrottleMiddleware`). Resolves the limiter, increments the store\n   * for each non-bypassed limit, sets `X-RateLimit-*` headers on success, and\n   * either invokes the limit's custom `.response()` or throws\n   * {@link TooManyRequestsError} when a limit is exceeded.\n   */\n  async handle(name: string, ctx: RouterContext, next: Next): Promise<Response | void> {\n    const resolver = this.resolvers.get(name)\n    if (!resolver) {\n      throw new RateLimiterError(`Rate limiter \"${name}\" is not defined. Register it with limiter.for(\"${name}\", ...) in a module's onInitialize hook.`)\n    }\n\n    const resolved = await resolver(ctx)\n    const limits = Array.isArray(resolved) ? resolved : [resolved]\n    const active = limits.filter((l) => !l.disabled)\n\n    if (active.length === 0) {\n      return next()\n    }\n\n    let mostRestrictive: { limit: Limit; remaining: number; resetAt: number } | undefined\n    let exceeded: { limit: Limit; resetAt: number } | undefined\n\n    for (const limit of active) {\n      const key = this.makeKey(name, limit.windowSeconds, limit.key)\n      const hit = await this.hit(key, limit.windowSeconds)\n\n      if (hit.count > limit.max) {\n        if (!exceeded || hit.resetAt > exceeded.resetAt) {\n          exceeded = { limit, resetAt: hit.resetAt }\n        }\n        continue\n      }\n\n      const remaining = limit.max - hit.count\n      if (!mostRestrictive || remaining < mostRestrictive.remaining) {\n        mostRestrictive = { limit, remaining, resetAt: hit.resetAt }\n      }\n    }\n\n    if (exceeded) {\n      const headers = this.makeHeaders(exceeded.limit.max, 0, exceeded.resetAt)\n      if (exceeded.limit.customResponse) {\n        return exceeded.limit.customResponse(ctx, headers)\n      }\n      throw new TooManyRequestsError({\n        retryAfter: Number(headers['Retry-After']),\n        limit: exceeded.limit.max,\n        resetAt: exceeded.resetAt,\n      })\n    }\n\n    await next()\n\n    if (mostRestrictive) {\n      const headers = this.makeHeaders(\n        mostRestrictive.limit.max,\n        mostRestrictive.remaining,\n        mostRestrictive.resetAt,\n      )\n      // Hono populates ctx.c.res after next() — same pattern as logger.middleware.ts.\n      const downstream = ctx.c.res\n      downstream.headers.set('X-RateLimit-Limit', headers['X-RateLimit-Limit'])\n      downstream.headers.set('X-RateLimit-Remaining', headers['X-RateLimit-Remaining'])\n      downstream.headers.set('X-RateLimit-Reset', headers['X-RateLimit-Reset'])\n    }\n  }\n\n  /**\n   * Get-modify-set increment over the typed KV store. Not atomic across\n   * concurrent edge requests on KV — see `KvRateLimiterStore`'s caveat.\n   */\n  private async hit(key: string, windowSeconds: number): Promise<RateLimitHit> {\n    const now = Date.now()\n    const existing = await this.store.get<StoredHit>(key)\n\n    let next: StoredHit\n    if (!existing || existing.resetAt <= now) {\n      next = { count: 1, resetAt: now + windowSeconds * 1000 }\n    } else {\n      next = { count: existing.count + 1, resetAt: existing.resetAt }\n    }\n\n    const ttlSeconds = Math.max(1, Math.ceil((next.resetAt - now) / 1000))\n    await this.store.set(key, next, ttlSeconds)\n    return next\n  }\n\n  private makeKey(name: string, windowSeconds: number, by: string | undefined): string {\n    const actor = by ?? '*'\n    return `rl:${name}:${windowSeconds}:${actor}`\n  }\n\n  private makeHeaders(limit: number, remaining: number, resetAt: number): RateLimitHeaders {\n    const retryAfter = Math.max(1, Math.ceil((resetAt - Date.now()) / 1000))\n    return {\n      'Retry-After': String(retryAfter),\n      'X-RateLimit-Limit': String(limit),\n      'X-RateLimit-Remaining': String(Math.max(0, remaining)),\n      'X-RateLimit-Reset': String(Math.ceil(resetAt / 1000)),\n    }\n  }\n}\n","import type { CacheService } from '../../cache/services/cache.service'\nimport type { IRateLimiterStore } from './rate-limiter-store.interface'\n\n/**\n * Cloudflare KV-backed typed KV store.\n *\n * KV's minimum `expirationTtl` is 60 seconds; sub-60s windows are still\n * enforced by the registry's algorithm via the persisted `resetAt`, but\n * the key itself may live in KV longer than the logical window.\n *\n * KV has no native atomic increment, so concurrent writes from different\n * edge locations may undercount under high contention. That's an inherent\n * KV tradeoff — pick `{ useClass: MyDurableObjectStore }` for strict\n * accuracy across edges.\n */\nexport class KvRateLimiterStore implements IRateLimiterStore {\n  constructor(private readonly cache: CacheService) {}\n\n  async get<T>(key: string): Promise<T | null> {\n    return (await this.cache.get<T>(key, 'json')) ?? null\n  }\n\n  async set<T>(key: string, value: T, ttlSeconds: number): Promise<void> {\n    const ttl = Math.max(60, Math.ceil(ttlSeconds))\n    await this.cache.put(key, JSON.stringify(value), { expirationTtl: ttl })\n  }\n\n  async delete(key: string): Promise<void> {\n    await this.cache.delete(key)\n  }\n}\n","import type { IRateLimiterStore } from './rate-limiter-store.interface'\n\ninterface Entry {\n  value: unknown\n  expiresAt: number\n}\n\n/**\n * In-process Map-backed typed KV store.\n *\n * Suitable for tests and single-isolate scenarios. Not safe across\n * Cloudflare Worker isolates — entries reset whenever a fresh isolate\n * spins up. Use `KvRateLimiterStore` (or a custom Durable Object store)\n * for production. Expiry is lazy: stale entries are dropped on the next\n * `get`.\n */\nexport class InMemoryRateLimiterStore implements IRateLimiterStore {\n  private readonly entries = new Map<string, Entry>()\n\n  get<T>(key: string): Promise<T | null> {\n    const entry = this.entries.get(key)\n    if (!entry) return Promise.resolve(null)\n    if (entry.expiresAt <= Date.now()) {\n      this.entries.delete(key)\n      return Promise.resolve(null)\n    }\n    return Promise.resolve(entry.value as T)\n  }\n\n  set<T>(key: string, value: T, ttlSeconds: number): Promise<void> {\n    this.entries.set(key, { value, expiresAt: Date.now() + ttlSeconds * 1000 })\n    return Promise.resolve()\n  }\n\n  delete(key: string): Promise<void> {\n    this.entries.delete(key)\n    return Promise.resolve()\n  }\n}\n","import { inject } from '../../di'\nimport { CACHE_TOKENS } from '../../cache/cache.tokens'\nimport type { CacheService } from '../../cache/services/cache.service'\nimport { CONTAINER_TOKEN, type Container } from '../../di'\nimport { Singleton } from '../../di/decorators'\nimport { DI_TOKENS } from '../../di/tokens'\nimport type { StratalEnv } from '../../env'\nimport type { Constructor } from '../../types'\nimport { RateLimiterError } from '../errors'\nimport { RATE_LIMITER_TOKENS } from '../rate-limiter.tokens'\nimport { KvRateLimiterStore } from './kv-store'\nimport { InMemoryRateLimiterStore } from './memory-store'\nimport type { IRateLimiterStore } from './rate-limiter-store.interface'\n\n/**\n * Configuration for `RateLimiterModule.forRoot()`. Picks the backing store.\n *\n * - `'kv'`: Cloudflare KV. `binding` names the KVNamespace on `StratalEnv`.\n * - `'memory'`: in-process Map. Tests / single-isolate only.\n * - `{ useClass }`: any class implementing `IRateLimiterStore`. Resolved\n *   from the DI container (so the class can declare its own `@inject` deps,\n *   e.g. a Durable Object namespace from `StratalEnv`).\n */\nexport type RateLimiterModuleOptions =\n  | { store: 'kv'; binding: keyof StratalEnv }\n  | { store: 'memory' }\n  | { store: { useClass: Constructor<IRateLimiterStore> } }\n\n// IMPORTANT: see RateLimiterRegistry — no token on @Singleton so the\n// factory isn't globally bound at class-load time. Module providers are\n// the sole binding source, which keeps the \"module not imported\" detection\n// in ThrottleMiddleware working.\n@Singleton()\nexport class RateLimiterStoreFactory {\n  constructor(\n    @inject(DI_TOKENS.CloudflareEnv) private readonly env: StratalEnv,\n    @inject(CACHE_TOKENS.CacheService) private readonly cache: CacheService,\n    @inject(CONTAINER_TOKEN) private readonly container: Container,\n    @inject(RATE_LIMITER_TOKENS.Options, { isOptional: true })\n    private readonly options?: RateLimiterModuleOptions,\n  ) {}\n\n  create(): IRateLimiterStore {\n    if (!this.options) {\n      throw new RateLimiterError('RateLimiterModule is not configured. Call RateLimiterModule.forRoot({ store: ... }) to configure a backing store.')\n    }\n\n    const { store } = this.options\n\n    if (store === 'memory') {\n      return new InMemoryRateLimiterStore()\n    }\n\n    if (store === 'kv') {\n      const binding = this.env[this.options.binding] as KVNamespace | undefined\n      if (!binding) {\n        throw new RateLimiterError(`KV binding \"${String(this.options.binding)}\" is not available in the environment.`)\n      }\n      return new KvRateLimiterStore(this.cache.withBinding(binding))\n    }\n\n    return this.container.resolve<IRateLimiterStore>(store.useClass)\n  }\n}\n","import { CacheModule } from '../cache'\nimport type { ExceptionHandler } from '../errors/exception-handler'\nimport { Module } from '../module'\nimport type { AsyncModuleOptions, DynamicModule, ModuleContext, OnException, OnInitialize } from '../module/types'\nimport { TooManyRequestsError } from './errors'\nimport { RateLimiterRegistry } from './rate-limiter-registry'\nimport { RATE_LIMITER_TOKENS } from './rate-limiter.tokens'\nimport { RateLimiterStoreFactory, type RateLimiterModuleOptions } from './stores/store-factory'\nimport type { IRateLimiterStore } from './stores/rate-limiter-store.interface'\n\n/**\n * Rate limiter module — opt-in, NOT registered automatically by Application.\n *\n * Usage:\n * ```typescript\n * @Module({\n *   imports: [RateLimiterModule.forRoot({ store: 'kv', binding: 'RATE_LIMITS' })],\n * })\n * export class AppModule {}\n * ```\n *\n * Define limiters in any module's `onInitialize` hook by resolving\n * `RATE_LIMITER_TOKENS.Registry` from the container. Apply them with\n * `router.throttle('name')` or `@RateLimit('name')`.\n *\n * The module:\n *  - eagerly validates the store at app boot (`onInitialize` resolves the\n *    factory and calls `create()`); a missing `forRoot` surfaces\n *    `RateLimiterError` before any request is served.\n *  - registers a `respond()` callback on the `ExceptionHandler` (via\n *    `onException`) that injects `Retry-After` and `X-RateLimit-*` headers\n *    on every {@link TooManyRequestsError} response, regardless of whether\n *    the body was rendered as JSON, HTML, or via Inertia.\n */\n@Module({\n  imports: [CacheModule],\n  providers: [\n    { provide: RATE_LIMITER_TOKENS.Registry, useClass: RateLimiterRegistry },\n    { provide: RATE_LIMITER_TOKENS.StoreFactory, useClass: RateLimiterStoreFactory },\n    {\n      provide: RATE_LIMITER_TOKENS.Store,\n      useFactory: (factory: RateLimiterStoreFactory) => factory.create(),\n      inject: [RATE_LIMITER_TOKENS.StoreFactory],\n    },\n  ],\n})\nexport class RateLimiterModule implements OnInitialize, OnException {\n  /**\n   * Configure the rate limiter with a store choice.\n   *\n   * @param options - `{ store: 'kv', binding }` | `{ store: 'memory' }` | `{ store: { useClass } }`\n   */\n  static forRoot(options: RateLimiterModuleOptions): DynamicModule {\n    return {\n      module: RateLimiterModule,\n      providers: [\n        { provide: RATE_LIMITER_TOKENS.Options, useValue: options },\n      ],\n    }\n  }\n\n  /**\n   * Async configuration. Use when store options depend on other services\n   * (e.g. ConfigService).\n   */\n  static forRootAsync(options: AsyncModuleOptions<RateLimiterModuleOptions>): DynamicModule {\n    return {\n      module: RateLimiterModule,\n      providers: [\n        {\n          provide: RATE_LIMITER_TOKENS.Options,\n          useFactory: options.useFactory,\n          inject: options.inject,\n        },\n      ],\n    }\n  }\n\n  /**\n   * Eagerly resolve the store so a missing `forRoot()` fails at boot,\n   * not on the first throttled request. Also registers a per-app marker\n   * value so ThrottleMiddleware can distinguish \"module imported into this\n   * app\" from \"module class loaded somewhere in the process\" (the latter is\n   * indistinguishable at the DI layer because @Module's `registry()` call\n   * binds providers globally at decoration time).\n   */\n  onInitialize({ container }: ModuleContext): void {\n    container.resolve<IRateLimiterStore>(RATE_LIMITER_TOKENS.Store)\n    container.registerValue(RATE_LIMITER_TOKENS.ModuleMarker, { imported: true })\n  }\n\n  /**\n   * Inject `Retry-After` + `X-RateLimit-*` headers on every 429 response.\n   * The body itself is rendered by `ExceptionHandler.defaultRender` —\n   * content-negotiated, so HTML clients (browsers, Inertia) and JSON\n   * clients both get the right shape.\n   */\n  onException(handler: ExceptionHandler): void {\n    handler.dontReport([TooManyRequestsError])\n    handler.respond((response, error) => {\n      if (!(error instanceof TooManyRequestsError)) return response\n      response.headers.set('Retry-After', String(error.info.retryAfter))\n      response.headers.set('X-RateLimit-Limit', String(error.info.limit))\n      response.headers.set('X-RateLimit-Remaining', '0')\n      response.headers.set('X-RateLimit-Reset', String(Math.ceil(error.info.resetAt / 1000)))\n      return response\n    })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,IAAa,QAAb,MAAa,MAAM;CAKC;CACA;CACA;CANlB;CACA;CAEA,YACE,eACA,KACA,WAA2B,OAC3B;EAHgB,KAAA,gBAAA;EACA,KAAA,MAAA;EACA,KAAA,WAAA;CACf;CAEH,OAAO,UAAU,KAAoB;EACnC,OAAO,IAAI,MAAM,GAAG,GAAG;CACzB;CAEA,OAAO,WAAW,SAAiB,KAAoB;EACrD,OAAO,IAAI,MAAM,SAAS,GAAG;CAC/B;CAEA,OAAO,UAAU,KAAoB;EACnC,OAAO,IAAI,MAAM,IAAI,GAAG;CAC1B;CAEA,OAAO,WAAW,SAAiB,KAAoB;EACrD,OAAO,IAAI,MAAM,UAAU,IAAI,GAAG;CACpC;CAEA,OAAO,QAAQ,KAAoB;EACjC,OAAO,IAAI,MAAM,MAAS,GAAG;CAC/B;CAEA,OAAO,OAAO,KAAoB;EAChC,OAAO,IAAI,MAAM,OAAU,IAAI,GAAG;CACpC;;CAGA,OAAO,OAAc;EACnB,OAAO,IAAI,MAAM,GAAG,GAAG,IAAI;CAC7B;;CAGA,GAAG,KAA4B;EAC7B,KAAK,OAAO,OAAO,GAAG;EACtB,OAAO;CACT;;;;;;CAOA,SAAS,SAAyC;EAChD,KAAK,kBAAkB;EACvB,OAAO;CACT;CAEA,IAAI,MAA0B;EAC5B,OAAO,KAAK;CACd;CAEA,IAAI,iBAAuD;EACzD,OAAO,KAAK;CACd;AACF;;;ACrDO,IAAA,sBAAA,MAAM,4BAA4B,UAAU;CAIK;CAHtD,4BAA6B,IAAI,IAA2B;CAE5D,YACE,OACA;EACA,MAAM;EAF8C,KAAA,QAAA;CAGtD;;;;;;CAOA,IAAI,MAAc,UAA+B;EAC/C,KAAK,UAAU,IAAI,MAAM,QAAQ;CACnC;CAEA,IAAI,MAAuB;EACzB,OAAO,KAAK,UAAU,IAAI,IAAI;CAChC;;;;;;;;;CAUA,MAAM,OAAO,MAAc,KAAoB,MAAsC;EACnF,MAAM,WAAW,KAAK,UAAU,IAAI,IAAI;EACxC,IAAI,CAAC,UACH,MAAM,IAAI,iBAAiB,iBAAiB,KAAK,kDAAkD,KAAK,yCAAyC;EAGnJ,MAAM,WAAW,MAAM,SAAS,GAAG;EAEnC,MAAM,UADS,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ,GACvC,QAAQ,MAAM,CAAC,EAAE,QAAQ;EAE/C,IAAI,OAAO,WAAW,GACpB,OAAO,KAAK;EAGd,IAAI;EACJ,IAAI;EAEJ,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,MAAM,KAAK,QAAQ,MAAM,MAAM,eAAe,MAAM,GAAG;GAC7D,MAAM,MAAM,MAAM,KAAK,IAAI,KAAK,MAAM,aAAa;GAEnD,IAAI,IAAI,QAAQ,MAAM,KAAK;IACzB,IAAI,CAAC,YAAY,IAAI,UAAU,SAAS,SACtC,WAAW;KAAE;KAAO,SAAS,IAAI;IAAQ;IAE3C;GACF;GAEA,MAAM,YAAY,MAAM,MAAM,IAAI;GAClC,IAAI,CAAC,mBAAmB,YAAY,gBAAgB,WAClD,kBAAkB;IAAE;IAAO;IAAW,SAAS,IAAI;GAAQ;EAE/D;EAEA,IAAI,UAAU;GACZ,MAAM,UAAU,KAAK,YAAY,SAAS,MAAM,KAAK,GAAG,SAAS,OAAO;GACxE,IAAI,SAAS,MAAM,gBACjB,OAAO,SAAS,MAAM,eAAe,KAAK,OAAO;GAEnD,MAAM,IAAI,qBAAqB;IAC7B,YAAY,OAAO,QAAQ,cAAc;IACzC,OAAO,SAAS,MAAM;IACtB,SAAS,SAAS;GACpB,CAAC;EACH;EAEA,MAAM,KAAK;EAEX,IAAI,iBAAiB;GACnB,MAAM,UAAU,KAAK,YACnB,gBAAgB,MAAM,KACtB,gBAAgB,WAChB,gBAAgB,OAClB;GAEA,MAAM,aAAa,IAAI,EAAE;GACzB,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,oBAAoB;GACxE,WAAW,QAAQ,IAAI,yBAAyB,QAAQ,wBAAwB;GAChF,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,oBAAoB;EAC1E;CACF;;;;;CAMA,MAAc,IAAI,KAAa,eAA8C;EAC3E,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,WAAW,MAAM,KAAK,MAAM,IAAe,GAAG;EAEpD,IAAI;EACJ,IAAI,CAAC,YAAY,SAAS,WAAW,KACnC,OAAO;GAAE,OAAO;GAAG,SAAS,MAAM,gBAAgB;EAAK;OAEvD,OAAO;GAAE,OAAO,SAAS,QAAQ;GAAG,SAAS,SAAS;EAAQ;EAGhE,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,UAAU,OAAO,GAAI,CAAC;EACrE,MAAM,KAAK,MAAM,IAAI,KAAK,MAAM,UAAU;EAC1C,OAAO;CACT;CAEA,QAAgB,MAAc,eAAuB,IAAgC;EAEnF,OAAO,MAAM,KAAK,GAAG,cAAc,GADrB,MAAM;CAEtB;CAEA,YAAoB,OAAe,WAAmB,SAAmC;EACvF,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,KAAK,IAAI,KAAK,GAAI,CAAC;EACvE,OAAO;GACL,eAAe,OAAO,UAAU;GAChC,qBAAqB,OAAO,KAAK;GACjC,yBAAyB,OAAO,KAAK,IAAI,GAAG,SAAS,CAAC;GACtD,qBAAqB,OAAO,KAAK,KAAK,UAAU,GAAI,CAAC;EACvD;CACF;AACF;kCA/HC,UAAU,GAAA,gBAAA,GAKN,OAAO,oBAAoB,KAAK,CAAA,CAAA,GAAA,mBAAA;;;;;;;;;;;;;;;ACvCrC,IAAa,qBAAb,MAA6D;CAC9B;CAA7B,YAAY,OAAsC;EAArB,KAAA,QAAA;CAAsB;CAEnD,MAAM,IAAO,KAAgC;EAC3C,OAAQ,MAAM,KAAK,MAAM,IAAO,KAAK,MAAM,KAAM;CACnD;CAEA,MAAM,IAAO,KAAa,OAAU,YAAmC;EACrE,MAAM,MAAM,KAAK,IAAI,IAAI,KAAK,KAAK,UAAU,CAAC;EAC9C,MAAM,KAAK,MAAM,IAAI,KAAK,KAAK,UAAU,KAAK,GAAG,EAAE,eAAe,IAAI,CAAC;CACzE;CAEA,MAAM,OAAO,KAA4B;EACvC,MAAM,KAAK,MAAM,OAAO,GAAG;CAC7B;AACF;;;;;;;;;;;;ACdA,IAAa,2BAAb,MAAmE;CACjE,0BAA2B,IAAI,IAAmB;CAElD,IAAO,KAAgC;EACrC,MAAM,QAAQ,KAAK,QAAQ,IAAI,GAAG;EAClC,IAAI,CAAC,OAAO,OAAO,QAAQ,QAAQ,IAAI;EACvC,IAAI,MAAM,aAAa,KAAK,IAAI,GAAG;GACjC,KAAK,QAAQ,OAAO,GAAG;GACvB,OAAO,QAAQ,QAAQ,IAAI;EAC7B;EACA,OAAO,QAAQ,QAAQ,MAAM,KAAU;CACzC;CAEA,IAAO,KAAa,OAAU,YAAmC;EAC/D,KAAK,QAAQ,IAAI,KAAK;GAAE;GAAO,WAAW,KAAK,IAAI,IAAI,aAAa;EAAK,CAAC;EAC1E,OAAO,QAAQ,QAAQ;CACzB;CAEA,OAAO,KAA4B;EACjC,KAAK,QAAQ,OAAO,GAAG;EACvB,OAAO,QAAQ,QAAQ;CACzB;AACF;;;ACLO,IAAA,0BAAA,MAAM,wBAAwB;CAEiB;CACE;CACV;CAEzB;CALnB,YACE,KACA,OACA,WACA,SAEA;EALkD,KAAA,MAAA;EACE,KAAA,QAAA;EACV,KAAA,YAAA;EAEzB,KAAA,UAAA;CAChB;CAEH,SAA4B;EAC1B,IAAI,CAAC,KAAK,SACR,MAAM,IAAI,iBAAiB,mHAAmH;EAGhJ,MAAM,EAAE,UAAU,KAAK;EAEvB,IAAI,UAAU,UACZ,OAAO,IAAI,yBAAyB;EAGtC,IAAI,UAAU,MAAM;GAClB,MAAM,UAAU,KAAK,IAAI,KAAK,QAAQ;GACtC,IAAI,CAAC,SACH,MAAM,IAAI,iBAAiB,eAAe,OAAO,KAAK,QAAQ,OAAO,EAAE,uCAAuC;GAEhH,OAAO,IAAI,mBAAmB,KAAK,MAAM,YAAY,OAAO,CAAC;EAC/D;EAEA,OAAO,KAAK,UAAU,QAA2B,MAAM,QAAQ;CACjE;AACF;;CA/BC,UAAU;oBAGN,OAAO,UAAU,aAAa,CAAA;oBAC9B,OAAO,aAAa,YAAY,CAAA;oBAChC,OAAO,eAAe,CAAA;oBACtB,OAAO,oBAAoB,SAAS,EAAE,YAAY,KAAK,CAAC,CAAA;;;;;ACQtD,IAAA,oBAAA,qBAAA,MAAM,kBAAuD;;;;;;CAMlE,OAAO,QAAQ,SAAkD;EAC/D,OAAO;GACL,QAAA;GACA,WAAW,CACT;IAAE,SAAS,oBAAoB;IAAS,UAAU;GAAQ,CAC5D;EACF;CACF;;;;;CAMA,OAAO,aAAa,SAAsE;EACxF,OAAO;GACL,QAAA;GACA,WAAW,CACT;IACE,SAAS,oBAAoB;IAC7B,YAAY,QAAQ;IACpB,QAAQ,QAAQ;GAClB,CACF;EACF;CACF;;;;;;;;;CAUA,aAAa,EAAE,aAAkC;EAC/C,UAAU,QAA2B,oBAAoB,KAAK;EAC9D,UAAU,cAAc,oBAAoB,cAAc,EAAE,UAAU,KAAK,CAAC;CAC9E;;;;;;;CAQA,YAAY,SAAiC;EAC3C,QAAQ,WAAW,CAAC,oBAAoB,CAAC;EACzC,QAAQ,SAAS,UAAU,UAAU;GACnC,IAAI,EAAE,iBAAiB,uBAAuB,OAAO;GACrD,SAAS,QAAQ,IAAI,eAAe,OAAO,MAAM,KAAK,UAAU,CAAC;GACjE,SAAS,QAAQ,IAAI,qBAAqB,OAAO,MAAM,KAAK,KAAK,CAAC;GAClE,SAAS,QAAQ,IAAI,yBAAyB,GAAG;GACjD,SAAS,QAAQ,IAAI,qBAAqB,OAAO,KAAK,KAAK,MAAM,KAAK,UAAU,GAAI,CAAC,CAAC;GACtF,OAAO;EACT,CAAC;CACH;AACF;qDA1EC,OAAO;CACN,SAAS,CAAC,WAAW;CACrB,WAAW;EACT;GAAE,SAAS,oBAAoB;GAAU,UAAU;EAAoB;EACvE;GAAE,SAAS,oBAAoB;GAAc,UAAU;EAAwB;EAC/E;GACE,SAAS,oBAAoB;GAC7B,aAAa,YAAqC,QAAQ,OAAO;GACjE,QAAQ,CAAC,oBAAoB,YAAY;EAC3C;CACF;AACF,CAAC,CAAA,GAAA,iBAAA"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/rate-limiter/limit.ts","../../src/rate-limiter/rate-limiter-registry.ts","../../src/rate-limiter/stores/kv-store.ts","../../src/rate-limiter/stores/memory-store.ts","../../src/rate-limiter/stores/store-factory.ts","../../src/rate-limiter/rate-limiter.module.ts"],"sourcesContent":["import type { RouterContext } from '../router/router-context'\n\n/**\n * Standard rate-limit response headers passed to custom response handlers.\n * Keys are canonical HTTP header names; values are the stringified counts.\n */\nexport interface RateLimitHeaders {\n  'Retry-After': string\n  'X-RateLimit-Limit': string\n  'X-RateLimit-Remaining': string\n  'X-RateLimit-Reset': string\n}\n\n/**\n * Custom response handler invoked when a limit is exceeded and the user\n * supplied `.response()` on the {@link Limit}. Receives the request context\n * and the precomputed standard headers (which the handler can spread, drop,\n * or override).\n */\nexport type RateLimitResponseHandler = (\n  ctx: RouterContext,\n  headers: RateLimitHeaders,\n) => Response | Promise<Response>\n\n/**\n * A single rate limit window.\n *\n * Build via the static factories (`perSecond`, `perMinute`, `perMinutes`,\n * `perHour`, `perDay`, `none`). Chain `.by(key)` to scope per-actor and\n * `.response(handler)` to override the default 429 response.\n *\n * Returned (singly or as an array) by limiter resolvers registered via\n * `RateLimiterRegistry.for()`.\n *\n * @example\n * ```typescript\n * Limit.perMinute(60).by(ctx.header('cf-connecting-ip') ?? 'global')\n * Limit.perHour(100).by(userId)\n * Limit.none()                                // bypass\n * ```\n */\nexport class Limit {\n  private _key?: string\n  private _customResponse?: RateLimitResponseHandler\n\n  private constructor(\n    public readonly windowSeconds: number,\n    public readonly max: number,\n    public readonly disabled = false,\n  ) {}\n\n  static perSecond(max: number): Limit {\n    return new Limit(1, max)\n  }\n\n  static perSeconds(seconds: number, max: number): Limit {\n    return new Limit(seconds, max)\n  }\n\n  static perMinute(max: number): Limit {\n    return new Limit(60, max)\n  }\n\n  static perMinutes(minutes: number, max: number): Limit {\n    return new Limit(minutes * 60, max)\n  }\n\n  static perHour(max: number): Limit {\n    return new Limit(60 * 60, max)\n  }\n\n  static perDay(max: number): Limit {\n    return new Limit(24 * 60 * 60, max)\n  }\n\n  /** Bypass the limiter entirely for this request. */\n  static none(): Limit {\n    return new Limit(0, 0, true)\n  }\n\n  /** Scope this limit to a specific actor (user id, IP, tenant, etc.). */\n  by(key: string | number): this {\n    this._key = String(key)\n    return this\n  }\n\n  /**\n   * Override the default 429 response. The handler receives the standard\n   * `RateLimitHeaders` so it can spread them onto its own Response or omit\n   * them as it sees fit.\n   */\n  response(handler: RateLimitResponseHandler): this {\n    this._customResponse = handler\n    return this\n  }\n\n  get key(): string | undefined {\n    return this._key\n  }\n\n  get customResponse(): RateLimitResponseHandler | undefined {\n    return this._customResponse\n  }\n}\n","import { type Container, DI_TOKENS, inject } from '../di'\nimport { Singleton } from '../di/decorators'\nimport { Macroable } from '../macroable'\nimport type { Next } from '../router/middleware.interface'\nimport type { RouterContext } from '../router/router-context'\nimport { RateLimiterError, TooManyRequestsError } from './errors'\nimport type { Limit, RateLimitHeaders } from './limit'\nimport { RATE_LIMITER_TOKENS } from './rate-limiter.tokens'\nimport type { IRateLimiterStore, RateLimitHit } from './stores/rate-limiter-store.interface'\n\n/**\n * Resolver function registered via {@link RateLimiterRegistry.for}. Receives\n * the request context and returns the limit (or limits) that apply to this\n * request. Return `Limit.none()` to bypass for the current request.\n */\nexport type LimitResolver = (\n  ctx: RouterContext,\n) => Limit | Limit[] | Promise<Limit | Limit[]>\n\ninterface StoredHit {\n  count: number\n  resetAt: number\n}\n\n/**\n * Central registry of named rate limiters and the request-time enforcement\n * pipeline. Resolved as a singleton; consumed by `ThrottleMiddleware`.\n *\n * Register limiters in a module's `onInitialize` hook:\n * ```typescript\n * @Module({})\n * export class RateLimitsModule implements OnInitialize {\n *   onInitialize({ container }: ModuleContext): void {\n *     const limiter = container.resolve<RateLimiterRegistry>(RATE_LIMITER_TOKENS.Registry)\n *     limiter.for('api', (ctx) => Limit.perMinute(60).by(ctx.header('cf-connecting-ip') ?? '*'))\n *   }\n * }\n * ```\n *\n * Extensible via `Macroable`: adapter packages (e.g. `@stratal/framework/auth`)\n * can attach extra registration methods such as `forPath()` for better-auth\n * `customRules` interop.\n */\n// IMPORTANT: do not pass a token to @Singleton — that would self-register\n// the class globally at module-load time, making the Registry resolvable\n// even when the user never imported RateLimiterModule. We rely on\n// RateLimiterModule providers being the only binding source, so\n// `{ isOptional: true }` in ThrottleMiddleware correctly returns undefined\n// when the module is missing.\n@Singleton()\nexport class RateLimiterRegistry extends Macroable {\n  private readonly resolvers = new Map<string, LimitResolver>()\n\n  constructor(\n    @inject(DI_TOKENS.Container) private readonly container: Container,\n  ) {\n    super()\n  }\n\n  /**\n   * Resolve the store per access instead of capturing it at construction.\n   * The registry is a singleton built during module init; lazy resolution\n   * keeps later `RATE_LIMITER_TOKENS.Store` overrides (e.g. the testing\n   * harness disabling limits) effective.\n   */\n  private get store(): IRateLimiterStore {\n    return this.container.resolve<IRateLimiterStore>(RATE_LIMITER_TOKENS.Store)\n  }\n\n  /**\n   * Register a named limiter. Names must be unique; calling `for()` again\n   * with the same name overwrites the previous resolver (matches Laravel\n   * `RateLimiter::for` semantics — last definition wins).\n   */\n  for(name: string, resolver: LimitResolver): void {\n    this.resolvers.set(name, resolver)\n  }\n\n  has(name: string): boolean {\n    return this.resolvers.has(name)\n  }\n\n  /**\n   * Enforce the named limiter for the current request. Called by\n   * `ThrottleMiddleware` (the per-name class produced by\n   * `createThrottleMiddleware`). Resolves the limiter, increments the store\n   * for each non-bypassed limit, sets `X-RateLimit-*` headers on success, and\n   * either invokes the limit's custom `.response()` or throws\n   * {@link TooManyRequestsError} when a limit is exceeded.\n   */\n  async handle(name: string, ctx: RouterContext, next: Next): Promise<Response | void> {\n    const resolver = this.resolvers.get(name)\n    if (!resolver) {\n      throw new RateLimiterError(`Rate limiter \"${name}\" is not defined. Register it with limiter.for(\"${name}\", ...) in a module's onInitialize hook.`)\n    }\n\n    const resolved = await resolver(ctx)\n    const limits = Array.isArray(resolved) ? resolved : [resolved]\n    const active = limits.filter((l) => !l.disabled)\n\n    if (active.length === 0) {\n      return next()\n    }\n\n    let mostRestrictive: { limit: Limit; remaining: number; resetAt: number } | undefined\n    let exceeded: { limit: Limit; resetAt: number } | undefined\n\n    for (const limit of active) {\n      const key = this.makeKey(name, limit.windowSeconds, limit.key)\n      const hit = await this.hit(key, limit.windowSeconds)\n\n      if (hit.count > limit.max) {\n        if (!exceeded || hit.resetAt > exceeded.resetAt) {\n          exceeded = { limit, resetAt: hit.resetAt }\n        }\n        continue\n      }\n\n      const remaining = limit.max - hit.count\n      if (!mostRestrictive || remaining < mostRestrictive.remaining) {\n        mostRestrictive = { limit, remaining, resetAt: hit.resetAt }\n      }\n    }\n\n    if (exceeded) {\n      const headers = this.makeHeaders(exceeded.limit.max, 0, exceeded.resetAt)\n      if (exceeded.limit.customResponse) {\n        return exceeded.limit.customResponse(ctx, headers)\n      }\n      throw new TooManyRequestsError({\n        retryAfter: Number(headers['Retry-After']),\n        limit: exceeded.limit.max,\n        resetAt: exceeded.resetAt,\n      })\n    }\n\n    await next()\n\n    if (mostRestrictive) {\n      const headers = this.makeHeaders(\n        mostRestrictive.limit.max,\n        mostRestrictive.remaining,\n        mostRestrictive.resetAt,\n      )\n      // Hono populates ctx.c.res after next() — same pattern as logger.middleware.ts.\n      const downstream = ctx.c.res\n      downstream.headers.set('X-RateLimit-Limit', headers['X-RateLimit-Limit'])\n      downstream.headers.set('X-RateLimit-Remaining', headers['X-RateLimit-Remaining'])\n      downstream.headers.set('X-RateLimit-Reset', headers['X-RateLimit-Reset'])\n    }\n  }\n\n  /**\n   * Get-modify-set increment over the typed KV store. Not atomic across\n   * concurrent edge requests on KV — see `KvRateLimiterStore`'s caveat.\n   */\n  private async hit(key: string, windowSeconds: number): Promise<RateLimitHit> {\n    const now = Date.now()\n    const existing = await this.store.get<StoredHit>(key)\n\n    let next: StoredHit\n    if (!existing || existing.resetAt <= now) {\n      next = { count: 1, resetAt: now + windowSeconds * 1000 }\n    } else {\n      next = { count: existing.count + 1, resetAt: existing.resetAt }\n    }\n\n    const ttlSeconds = Math.max(1, Math.ceil((next.resetAt - now) / 1000))\n    await this.store.set(key, next, ttlSeconds)\n    return next\n  }\n\n  private makeKey(name: string, windowSeconds: number, by: string | undefined): string {\n    const actor = by ?? '*'\n    return `rl:${name}:${windowSeconds}:${actor}`\n  }\n\n  private makeHeaders(limit: number, remaining: number, resetAt: number): RateLimitHeaders {\n    const retryAfter = Math.max(1, Math.ceil((resetAt - Date.now()) / 1000))\n    return {\n      'Retry-After': String(retryAfter),\n      'X-RateLimit-Limit': String(limit),\n      'X-RateLimit-Remaining': String(Math.max(0, remaining)),\n      'X-RateLimit-Reset': String(Math.ceil(resetAt / 1000)),\n    }\n  }\n}\n","import type { CacheService } from '../../cache/services/cache.service'\nimport type { IRateLimiterStore } from './rate-limiter-store.interface'\n\n/**\n * Cloudflare KV-backed typed KV store.\n *\n * KV's minimum `expirationTtl` is 60 seconds; sub-60s windows are still\n * enforced by the registry's algorithm via the persisted `resetAt`, but\n * the key itself may live in KV longer than the logical window.\n *\n * KV has no native atomic increment, so concurrent writes from different\n * edge locations may undercount under high contention. That's an inherent\n * KV tradeoff — pick `{ useClass: MyDurableObjectStore }` for strict\n * accuracy across edges.\n */\nexport class KvRateLimiterStore implements IRateLimiterStore {\n  constructor(private readonly cache: CacheService) {}\n\n  async get<T>(key: string): Promise<T | null> {\n    return (await this.cache.get<T>(key, 'json')) ?? null\n  }\n\n  async set<T>(key: string, value: T, ttlSeconds: number): Promise<void> {\n    const ttl = Math.max(60, Math.ceil(ttlSeconds))\n    await this.cache.put(key, JSON.stringify(value), { expirationTtl: ttl })\n  }\n\n  async delete(key: string): Promise<void> {\n    await this.cache.delete(key)\n  }\n}\n","import type { IRateLimiterStore } from './rate-limiter-store.interface'\n\ninterface Entry {\n  value: unknown\n  expiresAt: number\n}\n\n/**\n * In-process Map-backed typed KV store.\n *\n * Suitable for tests and single-isolate scenarios. Not safe across\n * Cloudflare Worker isolates — entries reset whenever a fresh isolate\n * spins up. Use `KvRateLimiterStore` (or a custom Durable Object store)\n * for production. Expiry is lazy: stale entries are dropped on the next\n * `get`.\n */\nexport class InMemoryRateLimiterStore implements IRateLimiterStore {\n  private readonly entries = new Map<string, Entry>()\n\n  get<T>(key: string): Promise<T | null> {\n    const entry = this.entries.get(key)\n    if (!entry) return Promise.resolve(null)\n    if (entry.expiresAt <= Date.now()) {\n      this.entries.delete(key)\n      return Promise.resolve(null)\n    }\n    return Promise.resolve(entry.value as T)\n  }\n\n  set<T>(key: string, value: T, ttlSeconds: number): Promise<void> {\n    this.entries.set(key, { value, expiresAt: Date.now() + ttlSeconds * 1000 })\n    return Promise.resolve()\n  }\n\n  delete(key: string): Promise<void> {\n    this.entries.delete(key)\n    return Promise.resolve()\n  }\n}\n","import { inject } from '../../di'\nimport { CACHE_TOKENS } from '../../cache/cache.tokens'\nimport type { CacheService } from '../../cache/services/cache.service'\nimport { CONTAINER_TOKEN, type Container } from '../../di'\nimport { Singleton } from '../../di/decorators'\nimport { DI_TOKENS } from '../../di/tokens'\nimport type { StratalEnv } from '../../env'\nimport type { Constructor } from '../../types'\nimport { RateLimiterError } from '../errors'\nimport { RATE_LIMITER_TOKENS } from '../rate-limiter.tokens'\nimport { KvRateLimiterStore } from './kv-store'\nimport { InMemoryRateLimiterStore } from './memory-store'\nimport type { IRateLimiterStore } from './rate-limiter-store.interface'\n\n/**\n * Configuration for `RateLimiterModule.forRoot()`. Picks the backing store.\n *\n * - `'kv'`: Cloudflare KV. `binding` names the KVNamespace on `StratalEnv`.\n * - `'memory'`: in-process Map. Tests / single-isolate only.\n * - `{ useClass }`: any class implementing `IRateLimiterStore`. Resolved\n *   from the DI container (so the class can declare its own `@inject` deps,\n *   e.g. a Durable Object namespace from `StratalEnv`).\n */\nexport type RateLimiterModuleOptions =\n  | { store: 'kv'; binding: keyof StratalEnv }\n  | { store: 'memory' }\n  | { store: { useClass: Constructor<IRateLimiterStore> } }\n\n// IMPORTANT: see RateLimiterRegistry — no token on @Singleton so the\n// factory isn't globally bound at class-load time. Module providers are\n// the sole binding source, which keeps the \"module not imported\" detection\n// in ThrottleMiddleware working.\n@Singleton()\nexport class RateLimiterStoreFactory {\n  constructor(\n    @inject(DI_TOKENS.CloudflareEnv) private readonly env: StratalEnv,\n    @inject(CACHE_TOKENS.CacheService) private readonly cache: CacheService,\n    @inject(CONTAINER_TOKEN) private readonly container: Container,\n    @inject(RATE_LIMITER_TOKENS.Options, { isOptional: true })\n    private readonly options?: RateLimiterModuleOptions,\n  ) {}\n\n  create(): IRateLimiterStore {\n    if (!this.options) {\n      throw new RateLimiterError('RateLimiterModule is not configured. Call RateLimiterModule.forRoot({ store: ... }) to configure a backing store.')\n    }\n\n    const { store } = this.options\n\n    if (store === 'memory') {\n      return new InMemoryRateLimiterStore()\n    }\n\n    if (store === 'kv') {\n      const binding = this.env[this.options.binding] as KVNamespace | undefined\n      if (!binding) {\n        throw new RateLimiterError(`KV binding \"${String(this.options.binding)}\" is not available in the environment.`)\n      }\n      return new KvRateLimiterStore(this.cache.withBinding(binding))\n    }\n\n    return this.container.resolve<IRateLimiterStore>(store.useClass)\n  }\n}\n","import { CacheModule } from '../cache'\nimport type { ExceptionHandler } from '../errors/exception-handler'\nimport { Module } from '../module'\nimport type { AsyncModuleOptions, DynamicModule, ModuleContext, OnException, OnInitialize } from '../module/types'\nimport { TooManyRequestsError } from './errors'\nimport { RateLimiterRegistry } from './rate-limiter-registry'\nimport { RATE_LIMITER_TOKENS } from './rate-limiter.tokens'\nimport { RateLimiterStoreFactory, type RateLimiterModuleOptions } from './stores/store-factory'\nimport type { IRateLimiterStore } from './stores/rate-limiter-store.interface'\n\n/**\n * Rate limiter module — opt-in, NOT registered automatically by Application.\n *\n * Usage:\n * ```typescript\n * @Module({\n *   imports: [RateLimiterModule.forRoot({ store: 'kv', binding: 'RATE_LIMITS' })],\n * })\n * export class AppModule {}\n * ```\n *\n * Define limiters in any module's `onInitialize` hook by resolving\n * `RATE_LIMITER_TOKENS.Registry` from the container. Apply them with\n * `router.throttle('name')` or `@RateLimit('name')`.\n *\n * The module:\n *  - eagerly validates the store at app boot (`onInitialize` resolves the\n *    factory and calls `create()`); a missing `forRoot` surfaces\n *    `RateLimiterError` before any request is served.\n *  - registers a `respond()` callback on the `ExceptionHandler` (via\n *    `onException`) that injects `Retry-After` and `X-RateLimit-*` headers\n *    on every {@link TooManyRequestsError} response, regardless of whether\n *    the body was rendered as JSON, HTML, or via Inertia.\n */\n@Module({\n  imports: [CacheModule],\n  providers: [\n    { provide: RATE_LIMITER_TOKENS.Registry, useClass: RateLimiterRegistry },\n    { provide: RATE_LIMITER_TOKENS.StoreFactory, useClass: RateLimiterStoreFactory },\n    {\n      provide: RATE_LIMITER_TOKENS.Store,\n      useFactory: (factory: RateLimiterStoreFactory) => factory.create(),\n      inject: [RATE_LIMITER_TOKENS.StoreFactory],\n    },\n  ],\n})\nexport class RateLimiterModule implements OnInitialize, OnException {\n  /**\n   * Configure the rate limiter with a store choice.\n   *\n   * @param options - `{ store: 'kv', binding }` | `{ store: 'memory' }` | `{ store: { useClass } }`\n   */\n  static forRoot(options: RateLimiterModuleOptions): DynamicModule {\n    return {\n      module: RateLimiterModule,\n      providers: [\n        { provide: RATE_LIMITER_TOKENS.Options, useValue: options },\n      ],\n    }\n  }\n\n  /**\n   * Async configuration. Use when store options depend on other services\n   * (e.g. ConfigService).\n   */\n  static forRootAsync(options: AsyncModuleOptions<RateLimiterModuleOptions>): DynamicModule {\n    return {\n      module: RateLimiterModule,\n      providers: [\n        {\n          provide: RATE_LIMITER_TOKENS.Options,\n          useFactory: options.useFactory,\n          inject: options.inject,\n        },\n      ],\n    }\n  }\n\n  /**\n   * Eagerly resolve the store so a missing `forRoot()` fails at boot,\n   * not on the first throttled request. Also registers a per-app marker\n   * value so ThrottleMiddleware can distinguish \"module imported into this\n   * app\" from \"module class loaded somewhere in the process\" (the latter is\n   * indistinguishable at the DI layer because @Module's `registry()` call\n   * binds providers globally at decoration time).\n   */\n  onInitialize({ container }: ModuleContext): void {\n    container.resolve<IRateLimiterStore>(RATE_LIMITER_TOKENS.Store)\n    container.registerValue(RATE_LIMITER_TOKENS.ModuleMarker, { imported: true })\n  }\n\n  /**\n   * Inject `Retry-After` + `X-RateLimit-*` headers on every 429 response.\n   * The body itself is rendered by `ExceptionHandler.defaultRender` —\n   * content-negotiated, so HTML clients (browsers, Inertia) and JSON\n   * clients both get the right shape.\n   */\n  onException(handler: ExceptionHandler): void {\n    handler.dontReport([TooManyRequestsError])\n    handler.respond((response, error) => {\n      if (!(error instanceof TooManyRequestsError)) return response\n      response.headers.set('Retry-After', String(error.info.retryAfter))\n      response.headers.set('X-RateLimit-Limit', String(error.info.limit))\n      response.headers.set('X-RateLimit-Remaining', '0')\n      response.headers.set('X-RateLimit-Reset', String(Math.ceil(error.info.resetAt / 1000)))\n      return response\n    })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,IAAa,QAAb,MAAa,MAAM;CAKC;CACA;CACA;CANlB;CACA;CAEA,YACE,eACA,KACA,WAA2B,OAC3B;EAHgB,KAAA,gBAAA;EACA,KAAA,MAAA;EACA,KAAA,WAAA;CACf;CAEH,OAAO,UAAU,KAAoB;EACnC,OAAO,IAAI,MAAM,GAAG,GAAG;CACzB;CAEA,OAAO,WAAW,SAAiB,KAAoB;EACrD,OAAO,IAAI,MAAM,SAAS,GAAG;CAC/B;CAEA,OAAO,UAAU,KAAoB;EACnC,OAAO,IAAI,MAAM,IAAI,GAAG;CAC1B;CAEA,OAAO,WAAW,SAAiB,KAAoB;EACrD,OAAO,IAAI,MAAM,UAAU,IAAI,GAAG;CACpC;CAEA,OAAO,QAAQ,KAAoB;EACjC,OAAO,IAAI,MAAM,MAAS,GAAG;CAC/B;CAEA,OAAO,OAAO,KAAoB;EAChC,OAAO,IAAI,MAAM,OAAU,IAAI,GAAG;CACpC;;CAGA,OAAO,OAAc;EACnB,OAAO,IAAI,MAAM,GAAG,GAAG,IAAI;CAC7B;;CAGA,GAAG,KAA4B;EAC7B,KAAK,OAAO,OAAO,GAAG;EACtB,OAAO;CACT;;;;;;CAOA,SAAS,SAAyC;EAChD,KAAK,kBAAkB;EACvB,OAAO;CACT;CAEA,IAAI,MAA0B;EAC5B,OAAO,KAAK;CACd;CAEA,IAAI,iBAAuD;EACzD,OAAO,KAAK;CACd;AACF;;;ACrDO,IAAA,sBAAA,MAAM,4BAA4B,UAAU;CAID;CAHhD,4BAA6B,IAAI,IAA2B;CAE5D,YACE,WACA;EACA,MAAM;EAFwC,KAAA,YAAA;CAGhD;;;;;;;CAQA,IAAY,QAA2B;EACrC,OAAO,KAAK,UAAU,QAA2B,oBAAoB,KAAK;CAC5E;;;;;;CAOA,IAAI,MAAc,UAA+B;EAC/C,KAAK,UAAU,IAAI,MAAM,QAAQ;CACnC;CAEA,IAAI,MAAuB;EACzB,OAAO,KAAK,UAAU,IAAI,IAAI;CAChC;;;;;;;;;CAUA,MAAM,OAAO,MAAc,KAAoB,MAAsC;EACnF,MAAM,WAAW,KAAK,UAAU,IAAI,IAAI;EACxC,IAAI,CAAC,UACH,MAAM,IAAI,iBAAiB,iBAAiB,KAAK,kDAAkD,KAAK,yCAAyC;EAGnJ,MAAM,WAAW,MAAM,SAAS,GAAG;EAEnC,MAAM,UADS,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ,GACvC,QAAQ,MAAM,CAAC,EAAE,QAAQ;EAE/C,IAAI,OAAO,WAAW,GACpB,OAAO,KAAK;EAGd,IAAI;EACJ,IAAI;EAEJ,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,MAAM,KAAK,QAAQ,MAAM,MAAM,eAAe,MAAM,GAAG;GAC7D,MAAM,MAAM,MAAM,KAAK,IAAI,KAAK,MAAM,aAAa;GAEnD,IAAI,IAAI,QAAQ,MAAM,KAAK;IACzB,IAAI,CAAC,YAAY,IAAI,UAAU,SAAS,SACtC,WAAW;KAAE;KAAO,SAAS,IAAI;IAAQ;IAE3C;GACF;GAEA,MAAM,YAAY,MAAM,MAAM,IAAI;GAClC,IAAI,CAAC,mBAAmB,YAAY,gBAAgB,WAClD,kBAAkB;IAAE;IAAO;IAAW,SAAS,IAAI;GAAQ;EAE/D;EAEA,IAAI,UAAU;GACZ,MAAM,UAAU,KAAK,YAAY,SAAS,MAAM,KAAK,GAAG,SAAS,OAAO;GACxE,IAAI,SAAS,MAAM,gBACjB,OAAO,SAAS,MAAM,eAAe,KAAK,OAAO;GAEnD,MAAM,IAAI,qBAAqB;IAC7B,YAAY,OAAO,QAAQ,cAAc;IACzC,OAAO,SAAS,MAAM;IACtB,SAAS,SAAS;GACpB,CAAC;EACH;EAEA,MAAM,KAAK;EAEX,IAAI,iBAAiB;GACnB,MAAM,UAAU,KAAK,YACnB,gBAAgB,MAAM,KACtB,gBAAgB,WAChB,gBAAgB,OAClB;GAEA,MAAM,aAAa,IAAI,EAAE;GACzB,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,oBAAoB;GACxE,WAAW,QAAQ,IAAI,yBAAyB,QAAQ,wBAAwB;GAChF,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,oBAAoB;EAC1E;CACF;;;;;CAMA,MAAc,IAAI,KAAa,eAA8C;EAC3E,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,WAAW,MAAM,KAAK,MAAM,IAAe,GAAG;EAEpD,IAAI;EACJ,IAAI,CAAC,YAAY,SAAS,WAAW,KACnC,OAAO;GAAE,OAAO;GAAG,SAAS,MAAM,gBAAgB;EAAK;OAEvD,OAAO;GAAE,OAAO,SAAS,QAAQ;GAAG,SAAS,SAAS;EAAQ;EAGhE,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,UAAU,OAAO,GAAI,CAAC;EACrE,MAAM,KAAK,MAAM,IAAI,KAAK,MAAM,UAAU;EAC1C,OAAO;CACT;CAEA,QAAgB,MAAc,eAAuB,IAAgC;EAEnF,OAAO,MAAM,KAAK,GAAG,cAAc,GADrB,MAAM;CAEtB;CAEA,YAAoB,OAAe,WAAmB,SAAmC;EACvF,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,KAAK,IAAI,KAAK,GAAI,CAAC;EACvE,OAAO;GACL,eAAe,OAAO,UAAU;GAChC,qBAAqB,OAAO,KAAK;GACjC,yBAAyB,OAAO,KAAK,IAAI,GAAG,SAAS,CAAC;GACtD,qBAAqB,OAAO,KAAK,KAAK,UAAU,GAAI,CAAC;EACvD;CACF;AACF;kCAzIC,UAAU,GAAA,gBAAA,GAKN,OAAO,UAAU,SAAS,CAAA,CAAA,GAAA,mBAAA;;;;;;;;;;;;;;;ACvC/B,IAAa,qBAAb,MAA6D;CAC9B;CAA7B,YAAY,OAAsC;EAArB,KAAA,QAAA;CAAsB;CAEnD,MAAM,IAAO,KAAgC;EAC3C,OAAQ,MAAM,KAAK,MAAM,IAAO,KAAK,MAAM,KAAM;CACnD;CAEA,MAAM,IAAO,KAAa,OAAU,YAAmC;EACrE,MAAM,MAAM,KAAK,IAAI,IAAI,KAAK,KAAK,UAAU,CAAC;EAC9C,MAAM,KAAK,MAAM,IAAI,KAAK,KAAK,UAAU,KAAK,GAAG,EAAE,eAAe,IAAI,CAAC;CACzE;CAEA,MAAM,OAAO,KAA4B;EACvC,MAAM,KAAK,MAAM,OAAO,GAAG;CAC7B;AACF;;;;;;;;;;;;ACdA,IAAa,2BAAb,MAAmE;CACjE,0BAA2B,IAAI,IAAmB;CAElD,IAAO,KAAgC;EACrC,MAAM,QAAQ,KAAK,QAAQ,IAAI,GAAG;EAClC,IAAI,CAAC,OAAO,OAAO,QAAQ,QAAQ,IAAI;EACvC,IAAI,MAAM,aAAa,KAAK,IAAI,GAAG;GACjC,KAAK,QAAQ,OAAO,GAAG;GACvB,OAAO,QAAQ,QAAQ,IAAI;EAC7B;EACA,OAAO,QAAQ,QAAQ,MAAM,KAAU;CACzC;CAEA,IAAO,KAAa,OAAU,YAAmC;EAC/D,KAAK,QAAQ,IAAI,KAAK;GAAE;GAAO,WAAW,KAAK,IAAI,IAAI,aAAa;EAAK,CAAC;EAC1E,OAAO,QAAQ,QAAQ;CACzB;CAEA,OAAO,KAA4B;EACjC,KAAK,QAAQ,OAAO,GAAG;EACvB,OAAO,QAAQ,QAAQ;CACzB;AACF;;;ACLO,IAAA,0BAAA,MAAM,wBAAwB;CAEiB;CACE;CACV;CAEzB;CALnB,YACE,KACA,OACA,WACA,SAEA;EALkD,KAAA,MAAA;EACE,KAAA,QAAA;EACV,KAAA,YAAA;EAEzB,KAAA,UAAA;CAChB;CAEH,SAA4B;EAC1B,IAAI,CAAC,KAAK,SACR,MAAM,IAAI,iBAAiB,mHAAmH;EAGhJ,MAAM,EAAE,UAAU,KAAK;EAEvB,IAAI,UAAU,UACZ,OAAO,IAAI,yBAAyB;EAGtC,IAAI,UAAU,MAAM;GAClB,MAAM,UAAU,KAAK,IAAI,KAAK,QAAQ;GACtC,IAAI,CAAC,SACH,MAAM,IAAI,iBAAiB,eAAe,OAAO,KAAK,QAAQ,OAAO,EAAE,uCAAuC;GAEhH,OAAO,IAAI,mBAAmB,KAAK,MAAM,YAAY,OAAO,CAAC;EAC/D;EAEA,OAAO,KAAK,UAAU,QAA2B,MAAM,QAAQ;CACjE;AACF;;CA/BC,UAAU;oBAGN,OAAO,UAAU,aAAa,CAAA;oBAC9B,OAAO,aAAa,YAAY,CAAA;oBAChC,OAAO,eAAe,CAAA;oBACtB,OAAO,oBAAoB,SAAS,EAAE,YAAY,KAAK,CAAC,CAAA;;;;;ACQtD,IAAA,oBAAA,qBAAA,MAAM,kBAAuD;;;;;;CAMlE,OAAO,QAAQ,SAAkD;EAC/D,OAAO;GACL,QAAA;GACA,WAAW,CACT;IAAE,SAAS,oBAAoB;IAAS,UAAU;GAAQ,CAC5D;EACF;CACF;;;;;CAMA,OAAO,aAAa,SAAsE;EACxF,OAAO;GACL,QAAA;GACA,WAAW,CACT;IACE,SAAS,oBAAoB;IAC7B,YAAY,QAAQ;IACpB,QAAQ,QAAQ;GAClB,CACF;EACF;CACF;;;;;;;;;CAUA,aAAa,EAAE,aAAkC;EAC/C,UAAU,QAA2B,oBAAoB,KAAK;EAC9D,UAAU,cAAc,oBAAoB,cAAc,EAAE,UAAU,KAAK,CAAC;CAC9E;;;;;;;CAQA,YAAY,SAAiC;EAC3C,QAAQ,WAAW,CAAC,oBAAoB,CAAC;EACzC,QAAQ,SAAS,UAAU,UAAU;GACnC,IAAI,EAAE,iBAAiB,uBAAuB,OAAO;GACrD,SAAS,QAAQ,IAAI,eAAe,OAAO,MAAM,KAAK,UAAU,CAAC;GACjE,SAAS,QAAQ,IAAI,qBAAqB,OAAO,MAAM,KAAK,KAAK,CAAC;GAClE,SAAS,QAAQ,IAAI,yBAAyB,GAAG;GACjD,SAAS,QAAQ,IAAI,qBAAqB,OAAO,KAAK,KAAK,MAAM,KAAK,UAAU,GAAI,CAAC,CAAC;GACtF,OAAO;EACT,CAAC;CACH;AACF;qDA1EC,OAAO;CACN,SAAS,CAAC,WAAW;CACrB,WAAW;EACT;GAAE,SAAS,oBAAoB;GAAU,UAAU;EAAoB;EACvE;GAAE,SAAS,oBAAoB;GAAc,UAAU;EAAwB;EAC/E;GACE,SAAS,oBAAoB;GAC7B,aAAa,YAAqC,QAAQ,OAAO;GACjE,QAAQ,CAAC,oBAAoB,YAAY;EAC3C;CACF;AACF,CAAC,CAAA,GAAA,iBAAA"}

package/dist/{route-registration.service-HN8WgIis.mjs → route-registration.service-CDPQKpm4.mjs}

@@ -1,17 +1,17 @@
 import { t as __exportAll } from "./chunk-BBjsoOtd.mjs";
-import { d as inject, m as getMethodInjections, r as DI_TOKENS, s as Singleton, v as ROUTER_TOKENS } from "./di-B0NXIdRF.mjs";
+import { b as ROUTER_TOKENS, g as getMethodInjections, l as Singleton, p as inject, r as DI_TOKENS } from "./di-D7qmrAir.mjs";
 import { n as getMetadata, t as defineMetadata } from "./metadata-DzzprcID.mjs";
 import { n as __decorateParam, t as __decorate } from "./decorate-CuAoSZvs.mjs";
 import { LOGGER_TOKENS } from "./logger/index.mjs";
-import { d as abort, u as HttpException } from "./errors-EUtwVfNm.mjs";
-import { a as RouterContext, c as METHOD_STATUS_CODES, d as SECURITY_SCHEMES, l as ROUTER_CONTEXT_KEYS, o as DEFAULT_CONTENT_TYPE, s as HTTP_METHODS, u as ROUTE_METADATA_KEYS } from "./exception-context-Bd5Hk2c_.mjs";
-import { o as RouterError, s as createThrottleMiddleware } from "./module-registry-MfWmniZ7.mjs";
+import { d as HttpException, f as abort } from "./errors-C01O2T-n.mjs";
+import { a as RouterContext, c as METHOD_STATUS_CODES, d as SECURITY_SCHEMES, l as ROUTER_CONTEXT_KEYS, o as DEFAULT_CONTENT_TYPE, s as HTTP_METHODS, u as ROUTE_METADATA_KEYS } from "./exception-context-D-kvney-.mjs";
+import { o as RouterError, s as createThrottleMiddleware } from "./module-registry-NxX5O0Qk.mjs";
 import { i as zod_exports, r as z } from "./zod-eKqqhZ5_.mjs";
-import { n as getControllerOptions, r as getControllerRoute } from "./controller.decorator-DKeZ71aP.mjs";
-import "./http-method.decorator-xCuGoZPC.mjs";
+import { n as getControllerOptions, r as getControllerRoute } from "./controller.decorator-YSTPQntu.mjs";
+import "./http-method.decorator-BljM8BDj.mjs";
 import { i as getMethodGuards, r as getControllerGuards, t as GuardExecutionService } from "./guards-DALPXy3_.mjs";
-import { n as getRateLimits } from "./rate-limit.decorator-B35jBEVD.mjs";
-import { a as getWsOnCloseMethod, o as getWsOnErrorMethod, s as getWsOnMessageMethod, t as GatewayContext, u as isGateway } from "./gateway-context-I0tKgGfh.mjs";
+import { n as getRateLimits } from "./rate-limit.decorator-Djs4oYDB.mjs";
+import { a as getWsOnCloseMethod, o as getWsOnErrorMethod, s as getWsOnMessageMethod, t as GatewayContext, u as isGateway } from "./gateway-context-m7kEzRa2.mjs";
 import { o as toOpenAPIPath, r as generateConventionRouteName, s as toRoutingOpenAPIPath } from "./route-name-DGoBOfPg.mjs";
 //#region src/router/errors/route-not-found.error.ts
 var RouteNotFoundError = class extends HttpException {
@@ -915,4 +915,4 @@ RouteRegistrationService = __decorate([
 //#endregion
 export { ResponseValidationError as _, paginatedResponseSchema as a, uuidParamSchema as c, getRouteDecoratedMethods as d, getRouteMetadata as f, InvalidSignatureError as g, parseDomainPattern as h, errorResponseSchema as i, validationErrorResponseSchema as l, createDomainMiddleware as m, route_registration_service_exports as n, paginationQuerySchema as o, createMiddlewareChain as p, commonErrorSchemas as r, successMessageSchema as s, RouteRegistrationService as t, Route as u, SchemaValidationError as v, RouteNotFoundError as y };
 
-//# sourceMappingURL=route-registration.service-HN8WgIis.mjs.map
+//# sourceMappingURL=route-registration.service-CDPQKpm4.mjs.map