ysk-omni 1.0.0

package/dist/interfaces/version-info.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-info.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/version-info.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,sEAAsE;IACtE,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB"}

package/dist/interfaces/version-info.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=version-info.interface.js.map

package/dist/interfaces/version-info.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-info.interface.js","sourceRoot":"","sources":["../../src/interfaces/version-info.interface.ts"],"names":[],"mappings":""}

package/dist/interfaces/version-status.type.d.ts

@@ -0,0 +1,3 @@
+/** How local package version compares to registry / channel */
+export type VersionStatus = 'update_available' | 'up_to_date' | 'ahead' | 'unknown';
+//# sourceMappingURL=version-status.type.d.ts.map

package/dist/interfaces/version-status.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-status.type.d.ts","sourceRoot":"","sources":["../../src/interfaces/version-status.type.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GACrB,kBAAkB,GAClB,YAAY,GACZ,OAAO,GACP,SAAS,CAAC"}

package/dist/interfaces/version-status.type.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=version-status.type.js.map

package/dist/interfaces/version-status.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-status.type.js","sourceRoot":"","sources":["../../src/interfaces/version-status.type.ts"],"names":[],"mappings":""}

package/dist/middlewares/auth.middleware.d.ts

@@ -0,0 +1,13 @@
+export declare const requireApiKey: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
+export declare const requireAdmin: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
+/**
+ * Admin panel / admin API auth:
+ * - Bearer gog_sess_* → OTP session (preferred for SPA)
+ * - Bearer omni_live_* → admin API key (automation / CLI)
+ */
+export declare const requireAdminAuth: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
+/**
+ * Attach apiKey when Bearer present; otherwise continue unauthenticated.
+ */
+export declare const optionalApiKey: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
+//# sourceMappingURL=auth.middleware.d.ts.map

package/dist/middlewares/auth.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.middleware.d.ts","sourceRoot":"","sources":["../../src/middlewares/auth.middleware.ts"],"names":[],"mappings":"AAuCA,eAAO,MAAM,aAAa,8IAgCxB,CAAC;AAEH,eAAO,MAAM,YAAY,8IAUvB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,8IAiD3B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,cAAc,8IAmBzB,CAAC"}

package/dist/middlewares/auth.middleware.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.optionalApiKey = exports.requireAdminAuth = exports.requireAdmin = exports.requireApiKey = void 0;
+const constants_1 = require("../config/constants");
+const exception_factory_1 = require("../exceptions/exception.factory");
+const rate_limit_middleware_1 = require("./rate-limit.middleware");
+const api_key_service_1 = require("../services/api-key.service");
+const admin_auth_service_1 = require("../services/admin-auth.service");
+const async_handler_1 = require("../utils/async-handler");
+const ip_match_1 = require("../utils/ip-match");
+const client_ip_1 = require("../utils/client-ip");
+const role_normalize_1 = require("../utils/role-normalize");
+function extractBearer(req) {
+    const header = req.header('authorization');
+    if (!header)
+        return null;
+    const [scheme, token] = header.split(/\s+/);
+    if (!scheme || !token)
+        return null;
+    if (scheme.toLowerCase() !== 'bearer')
+        return null;
+    return token.trim();
+}
+/** OpenAI Bearer or Anthropic x-api-key (same omni_live_ keys). */
+function extractApiKeyToken(req) {
+    const bearer = extractBearer(req);
+    if (bearer)
+        return bearer;
+    const xApiKey = req.header('x-api-key') || req.header('X-Api-Key');
+    if (xApiKey?.trim())
+        return xApiKey.trim();
+    return null;
+}
+function clientIp(req) {
+    return (0, client_ip_1.requestIp)(req);
+}
+exports.requireApiKey = (0, async_handler_1.asyncHandler)(async (req, _res, next) => {
+    const token = extractApiKeyToken(req);
+    if (!token) {
+        (0, rate_limit_middleware_1.recordFailedAuth)(req);
+        throw exception_factory_1.ExceptionFactory.unauthorized('Missing API key. Use Authorization: Bearer <api_key> or x-api-key: <api_key>');
+    }
+    // Session tokens are admin-panel only — not valid for /v1 public API
+    if ((0, admin_auth_service_1.isSessionToken)(token)) {
+        (0, rate_limit_middleware_1.recordFailedAuth)(req);
+        throw exception_factory_1.ExceptionFactory.unauthorized('Use an API key for this endpoint');
+    }
+    try {
+        req.apiKey = await api_key_service_1.apiKeyService.authenticate(token);
+        (0, rate_limit_middleware_1.clearFailedAuth)(req);
+    }
+    catch (err) {
+        (0, rate_limit_middleware_1.recordFailedAuth)(req);
+        throw err;
+    }
+    const wl = req.apiKey.ipWhitelist;
+    if (Array.isArray(wl) && wl.length > 0) {
+        const ip = clientIp(req);
+        if (!(0, ip_match_1.ipAllowed)(ip, wl)) {
+            throw exception_factory_1.ExceptionFactory.forbidden(`API key not allowed from IP ${ip} (whitelist enforced). Clear whitelist or add this IP.`);
+        }
+    }
+    next();
+});
+exports.requireAdmin = (0, async_handler_1.asyncHandler)(async (req, _res, next) => {
+    if (!req.apiKey) {
+        throw exception_factory_1.ExceptionFactory.unauthorized();
+    }
+    if ((0, role_normalize_1.normalizeApiKeyRole)(req.apiKey.role) !== constants_1.ROLES.ADMIN) {
+        throw exception_factory_1.ExceptionFactory.forbidden(`Admin role required (this key has role "${req.apiKey.role}"). Create an admin key: ysk-omni key create`);
+    }
+    next();
+});
+/**
+ * Admin panel / admin API auth:
+ * - Bearer gog_sess_* → OTP session (preferred for SPA)
+ * - Bearer omni_live_* → admin API key (automation / CLI)
+ */
+exports.requireAdminAuth = (0, async_handler_1.asyncHandler)(async (req, _res, next) => {
+    const token = extractBearer(req);
+    if (!token) {
+        (0, rate_limit_middleware_1.recordFailedAuth)(req);
+        throw exception_factory_1.ExceptionFactory.unauthorized('Missing Authorization. Log in with a one-time code (ysk-omni admin otp) or use an admin API key.');
+    }
+    if ((0, admin_auth_service_1.isSessionToken)(token)) {
+        try {
+            const actor = await admin_auth_service_1.adminAuthService.resolveSessionToken(token);
+            if (!actor) {
+                (0, rate_limit_middleware_1.recordFailedAuth)(req);
+                throw exception_factory_1.ExceptionFactory.unauthorized('Session expired or invalid. Run: ysk-omni admin otp');
+            }
+            req.apiKey = actor;
+            (0, rate_limit_middleware_1.clearFailedAuth)(req);
+            next();
+            return;
+        }
+        catch (err) {
+            (0, rate_limit_middleware_1.recordFailedAuth)(req);
+            throw err;
+        }
+    }
+    try {
+        req.apiKey = await api_key_service_1.apiKeyService.authenticate(token);
+        (0, rate_limit_middleware_1.clearFailedAuth)(req);
+    }
+    catch (err) {
+        (0, rate_limit_middleware_1.recordFailedAuth)(req);
+        throw err;
+    }
+    if ((0, role_normalize_1.normalizeApiKeyRole)(req.apiKey.role) !== constants_1.ROLES.ADMIN) {
+        throw exception_factory_1.ExceptionFactory.forbidden('Admin role required');
+    }
+    const wl = req.apiKey.ipWhitelist;
+    if (Array.isArray(wl) && wl.length > 0) {
+        const ip = clientIp(req);
+        if (!(0, ip_match_1.ipAllowed)(ip, wl)) {
+            throw exception_factory_1.ExceptionFactory.forbidden(`API key not allowed from IP ${ip} (whitelist enforced).`);
+        }
+    }
+    next();
+});
+/**
+ * Attach apiKey when Bearer present; otherwise continue unauthenticated.
+ */
+exports.optionalApiKey = (0, async_handler_1.asyncHandler)(async (req, _res, next) => {
+    const token = extractBearer(req);
+    if (!token) {
+        next();
+        return;
+    }
+    if ((0, admin_auth_service_1.isSessionToken)(token)) {
+        const actor = await admin_auth_service_1.adminAuthService.resolveSessionToken(token);
+        if (actor)
+            req.apiKey = actor;
+        next();
+        return;
+    }
+    try {
+        req.apiKey = await api_key_service_1.apiKeyService.authenticate(token);
+        (0, rate_limit_middleware_1.clearFailedAuth)(req);
+    }
+    catch {
+        /* optional */
+    }
+    next();
+});
+//# sourceMappingURL=auth.middleware.js.map

package/dist/middlewares/auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.middleware.js","sourceRoot":"","sources":["../../src/middlewares/auth.middleware.ts"],"names":[],"mappings":";;;AACA,mDAA4C;AAC5C,uEAAmE;AACnE,mEAGiC;AACjC,iEAA4D;AAC5D,uEAGwC;AACxC,0DAAsD;AACtD,gDAA8C;AAC9C,kDAA+C;AAC/C,4DAA8D;AAE9D,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,mEAAmE;AACnE,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,IAAI,OAAO,EAAE,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,IAAA,qBAAS,EAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAEY,QAAA,aAAa,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAClE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAA,wCAAgB,EAAC,GAAG,CAAC,CAAC;QACtB,MAAM,oCAAgB,CAAC,YAAY,CACjC,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,IAAI,IAAA,mCAAc,EAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAA,wCAAgB,EAAC,GAAG,CAAC,CAAC;QACtB,MAAM,oCAAgB,CAAC,YAAY,CAAC,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,MAAM,+BAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACrD,IAAA,uCAAe,EAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAA,wCAAgB,EAAC,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAA,oBAAS,EAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;YACvB,MAAM,oCAAgB,CAAC,SAAS,CAC9B,+BAA+B,EAAE,wDAAwD,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC,CAAC,CAAC;AAEU,QAAA,YAAY,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACjE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,oCAAgB,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,IAAA,oCAAmB,EAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,iBAAK,CAAC,KAAK,EAAE,CAAC;QACzD,MAAM,oCAAgB,CAAC,SAAS,CAC9B,2CAA2C,GAAG,CAAC,MAAM,CAAC,IAAI,8CAA8C,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACU,QAAA,gBAAgB,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAA,wCAAgB,EAAC,GAAG,CAAC,CAAC;QACtB,MAAM,oCAAgB,CAAC,YAAY,CACjC,kGAAkG,CACnG,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,mCAAc,EAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,qCAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAA,wCAAgB,EAAC,GAAG,CAAC,CAAC;gBACtB,MAAM,oCAAgB,CAAC,YAAY,CAAC,qDAAqD,CAAC,CAAC;YAC7F,CAAC;YACD,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC;YACnB,IAAA,uCAAe,EAAC,GAAG,CAAC,CAAC;YACrB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAA,wCAAgB,EAAC,GAAG,CAAC,CAAC;YACtB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,MAAM,+BAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACrD,IAAA,uCAAe,EAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAA,wCAAgB,EAAC,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,IAAA,oCAAmB,EAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,iBAAK,CAAC,KAAK,EAAE,CAAC;QACzD,MAAM,oCAAgB,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAA,oBAAS,EAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;YACvB,MAAM,oCAAgB,CAAC,SAAS,CAC9B,+BAA+B,EAAE,wBAAwB,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC,CAAC,CAAC;AAEH;;GAEG;AACU,QAAA,cAAc,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACnE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,IAAA,mCAAc,EAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,qCAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,KAAK;YAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC;QAC9B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,MAAM,+BAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACrD,IAAA,uCAAe,EAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC,CAAC"}

package/dist/middlewares/client-ip.middleware.d.ts

@@ -0,0 +1,11 @@
+import type { NextFunction, Request, Response } from 'express';
+/**
+ * Resolve real client IP (nginx / Cloudflare aware) onto req.clientIp.
+ * Must run after Express trust-proxy is configured.
+ */
+export declare function clientIpMiddleware(req: Request, _res: Response, next: NextFunction): void;
+/** Apply current proxy hops to an Express app (also on policy rebuild). */
+export declare function applyExpressTrustProxy(app: {
+    set: (k: string, v: unknown) => void;
+}): void;
+//# sourceMappingURL=client-ip.middleware.d.ts.map

package/dist/middlewares/client-ip.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-ip.middleware.d.ts","sourceRoot":"","sources":["../../src/middlewares/client-ip.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAO/D;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,YAAY,GACjB,IAAI,CAGN;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE;IAC1C,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,GAAG,IAAI,CAGP"}

package/dist/middlewares/client-ip.middleware.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clientIpMiddleware = clientIpMiddleware;
+exports.applyExpressTrustProxy = applyExpressTrustProxy;
+const client_ip_1 = require("../utils/client-ip");
+/**
+ * Resolve real client IP (nginx / Cloudflare aware) onto req.clientIp.
+ * Must run after Express trust-proxy is configured.
+ */
+function clientIpMiddleware(req, _res, next) {
+    req.clientIp = (0, client_ip_1.getClientIp)(req);
+    next();
+}
+/** Apply current proxy hops to an Express app (also on policy rebuild). */
+function applyExpressTrustProxy(app) {
+    const { trustHops } = (0, client_ip_1.getProxyIpConfig)();
+    app.set('trust proxy', (0, client_ip_1.expressTrustProxySetting)(trustHops));
+}
+//# sourceMappingURL=client-ip.middleware.js.map

package/dist/middlewares/client-ip.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-ip.middleware.js","sourceRoot":"","sources":["../../src/middlewares/client-ip.middleware.ts"],"names":[],"mappings":";;AAWA,gDAOC;AAGD,wDAKC;AAzBD,kDAI4B;AAE5B;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,GAAY,EACZ,IAAc,EACd,IAAkB;IAElB,GAAG,CAAC,QAAQ,GAAG,IAAA,uBAAW,EAAC,GAAG,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC;AACT,CAAC;AAED,2EAA2E;AAC3E,SAAgB,sBAAsB,CAAC,GAEtC;IACC,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,4BAAgB,GAAE,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAA,oCAAwB,EAAC,SAAS,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/middlewares/concurrency.middleware.d.ts

@@ -0,0 +1,6 @@
+import type { NextFunction, Request, Response } from 'express';
+/**
+ * Soft check before entering chat handler. Hard acquire still happens in ChatService.
+ */
+export declare function concurrencyGuard(_req: Request, _res: Response, next: NextFunction): void;
+//# sourceMappingURL=concurrency.middleware.d.ts.map

package/dist/middlewares/concurrency.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.middleware.d.ts","sourceRoot":"","sources":["../../src/middlewares/concurrency.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAI/D;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAMxF"}

package/dist/middlewares/concurrency.middleware.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.concurrencyGuard = concurrencyGuard;
+const exception_factory_1 = require("../exceptions/exception.factory");
+const engine_slot_service_1 = require("../services/engine-slot.service");
+/**
+ * Soft check before entering chat handler. Hard acquire still happens in ChatService.
+ */
+function concurrencyGuard(_req, _res, next) {
+    if (engine_slot_service_1.engineSlotService.activeCount >= engine_slot_service_1.engineSlotService.maxConcurrent) {
+        next(exception_factory_1.ExceptionFactory.concurrencyLimit());
+        return;
+    }
+    next();
+}
+//# sourceMappingURL=concurrency.middleware.js.map

package/dist/middlewares/concurrency.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.middleware.js","sourceRoot":"","sources":["../../src/middlewares/concurrency.middleware.ts"],"names":[],"mappings":";;AAOA,4CAMC;AAZD,uEAAmE;AACnE,yEAAoE;AAEpE;;GAEG;AACH,SAAgB,gBAAgB,CAAC,IAAa,EAAE,IAAc,EAAE,IAAkB;IAChF,IAAI,uCAAiB,CAAC,WAAW,IAAI,uCAAiB,CAAC,aAAa,EAAE,CAAC;QACrE,IAAI,CAAC,oCAAgB,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/middlewares/connection-tracker.middleware.d.ts

@@ -0,0 +1,33 @@
+import type { NextFunction, Request, Response } from 'express';
+import type { TrackedConnection } from '../interfaces/tracked-connection.interface';
+export declare function connectionTrackerMiddleware(req: Request, res: Response, next: NextFunction): void;
+export declare function getConnectionsSnapshot(): {
+    active: {
+        id: string;
+        ip: string;
+        method: string;
+        path: string;
+        userAgent: string;
+        startedAt: number;
+        finishedAt?: number;
+        durationMs?: number;
+        statusCode?: number;
+        apiKeyId?: string;
+        apiKeyPrefix?: string;
+        apiKeyName?: string;
+        state: "active" | "finished";
+    }[];
+    recent: TrackedConnection[];
+    counts: {
+        active: number;
+        recent: number;
+        rateLimitedHits: number;
+        blockedHits: number;
+    };
+};
+export declare function recordBlockedHit(): void;
+export declare function getAbuseCounters(): {
+    rateLimitedHits: number;
+    blockedHits: number;
+};
+//# sourceMappingURL=connection-tracker.middleware.d.ts.map

package/dist/middlewares/connection-tracker.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-tracker.middleware.d.ts","sourceRoot":"","sources":["../../src/middlewares/connection-tracker.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAepF,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,IAAI,CAmEN;AAED,wBAAgB,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;EAYrC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED,wBAAgB,gBAAgB;;;EAE/B"}

package/dist/middlewares/connection-tracker.middleware.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.connectionTrackerMiddleware = connectionTrackerMiddleware;
+exports.getConnectionsSnapshot = getConnectionsSnapshot;
+exports.recordBlockedHit = recordBlockedHit;
+exports.getAbuseCounters = getAbuseCounters;
+const node_crypto_1 = require("node:crypto");
+const client_ip_1 = require("../utils/client-ip");
+const abuse_guard_service_1 = require("../services/abuse-guard.service");
+const exception_factory_1 = require("../exceptions/exception.factory");
+const MAX_RECENT = 200;
+const active = new Map();
+const recent = [];
+let blockedHits = 0;
+let rateLimitedHits = 0;
+function clientIp(req) {
+    return req.clientIp || (0, client_ip_1.getClientIp)(req);
+}
+function connectionTrackerMiddleware(req, res, next) {
+    // Skip static admin assets noise
+    const url = req.originalUrl || req.url || '';
+    if (url.startsWith('/admin/') &&
+        !url.startsWith('/admin/api') &&
+        (url.includes('.') || url === '/admin/' || url === '/admin')) {
+        next();
+        return;
+    }
+    if (url === '/health' || url === '/ready') {
+        next();
+        return;
+    }
+    const pathOnly = url.split('?')[0] || '/';
+    const ip = clientIp(req);
+    const { overConcurrent } = abuse_guard_service_1.abuseGuardService.onRequestStart(ip, pathOnly);
+    if (overConcurrent) {
+        // End tracking immediately (do not pass 429 — that would double-count rate-abuse)
+        abuse_guard_service_1.abuseGuardService.onRequestEnd(ip, pathOnly);
+        next(exception_factory_1.ExceptionFactory.rateLimited('Too many concurrent connections from this IP'));
+        return;
+    }
+    const id = (0, node_crypto_1.randomUUID)();
+    const entry = {
+        id,
+        ip,
+        method: req.method,
+        path: pathOnly,
+        userAgent: String(req.headers['user-agent'] || '').slice(0, 200),
+        startedAt: Date.now(),
+        state: 'active',
+    };
+    active.set(id, entry);
+    let finished = false;
+    const finish = () => {
+        if (finished)
+            return;
+        finished = true;
+        if (!active.has(id))
+            return;
+        active.delete(id);
+        entry.finishedAt = Date.now();
+        entry.durationMs = entry.finishedAt - entry.startedAt;
+        entry.statusCode = res.statusCode;
+        entry.state = 'finished';
+        if (req.apiKey) {
+            entry.apiKeyId = req.apiKey.id;
+            entry.apiKeyPrefix = req.apiKey.keyPrefix;
+            entry.apiKeyName = req.apiKey.name;
+        }
+        if (res.statusCode === 429)
+            rateLimitedHits += 1;
+        abuse_guard_service_1.abuseGuardService.onRequestEnd(ip, pathOnly, res.statusCode);
+        recent.unshift({ ...entry });
+        if (recent.length > MAX_RECENT)
+            recent.length = MAX_RECENT;
+    };
+    res.on('finish', finish);
+    res.on('close', finish);
+    next();
+}
+function getConnectionsSnapshot() {
+    const activeList = Array.from(active.values()).map((e) => ({ ...e }));
+    return {
+        active: activeList,
+        recent: recent.slice(0, 100),
+        counts: {
+            active: activeList.length,
+            recent: recent.length,
+            rateLimitedHits,
+            blockedHits,
+        },
+    };
+}
+function recordBlockedHit() {
+    blockedHits += 1;
+}
+function getAbuseCounters() {
+    return { rateLimitedHits, blockedHits };
+}
+//# sourceMappingURL=connection-tracker.middleware.js.map

package/dist/middlewares/connection-tracker.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-tracker.middleware.js","sourceRoot":"","sources":["../../src/middlewares/connection-tracker.middleware.ts"],"names":[],"mappings":";;AAiBA,kEAuEC;AAED,wDAYC;AAED,4CAEC;AAED,4CAEC;AA7GD,6CAAyC;AAEzC,kDAAiD;AACjD,yEAAoE;AACpE,uEAAmE;AAEnE,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;AACpD,MAAM,MAAM,GAAwB,EAAE,CAAC;AACvC,IAAI,WAAW,GAAG,CAAC,CAAC;AACpB,IAAI,eAAe,GAAG,CAAC,CAAC;AAExB,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,GAAG,CAAC,QAAQ,IAAI,IAAA,uBAAW,EAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,SAAgB,2BAA2B,CACzC,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,iCAAiC;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IAC7C,IACE,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QACzB,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;QAC7B,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,QAAQ,CAAC,EAC5D,CAAC;QACD,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1C,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAEzB,MAAM,EAAE,cAAc,EAAE,GAAG,uCAAiB,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1E,IAAI,cAAc,EAAE,CAAC;QACnB,kFAAkF;QAClF,uCAAiB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,CACF,oCAAgB,CAAC,WAAW,CAC1B,8CAA8C,CAC/C,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;IACxB,MAAM,KAAK,GAAsB;QAC/B,EAAE;QACF,EAAE;QACF,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAChE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,KAAK,EAAE,QAAQ;KAChB,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAEtB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QAC5B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACtD,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QAClC,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC;QACzB,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;YAC1C,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACrC,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;YAAE,eAAe,IAAI,CAAC,CAAC;QACjD,uCAAiB,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU;YAAE,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;IAC7D,CAAC,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAgB,sBAAsB;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC5B,MAAM,EAAE;YACN,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,eAAe;YACf,WAAW;SACZ;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB;IAC9B,WAAW,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,SAAgB,gBAAgB;IAC9B,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC"}

package/dist/middlewares/error.middleware.d.ts

@@ -0,0 +1,4 @@
+import type { NextFunction, Request, Response } from 'express';
+export declare function notFoundHandler(req: Request, _res: Response, next: NextFunction): void;
+export declare function errorMiddleware(err: unknown, req: Request, res: Response, _next: NextFunction): void;
+//# sourceMappingURL=error.middleware.d.ts.map

package/dist/middlewares/error.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.middleware.d.ts","sourceRoot":"","sources":["../../src/middlewares/error.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAY/D,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAEtF;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,YAAY,GAClB,IAAI,CAuCN"}

package/dist/middlewares/error.middleware.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.notFoundHandler = notFoundHandler;
+exports.errorMiddleware = errorMiddleware;
+const http_exception_1 = require("../exceptions/http.exception");
+const exception_factory_1 = require("../exceptions/exception.factory");
+const logger_1 = require("../utils/logger");
+function requestPath(req) {
+    return req.originalUrl || req.url || req.path || '';
+}
+function notFoundHandler(req, _res, next) {
+    next(exception_factory_1.ExceptionFactory.notFound(`Route ${req.method} ${req.path}`));
+}
+function errorMiddleware(err, req, res, _next) {
+    const path = requestPath(req);
+    // CORS errors from cors package
+    if (err instanceof Error && err.message.startsWith('CORS origin not allowed')) {
+        const httpErr = exception_factory_1.ExceptionFactory.forbidden(err.message);
+        res.status(httpErr.statusCode).json((0, http_exception_1.toProtocolErrorBody)(httpErr, path));
+        return;
+    }
+    if (err instanceof http_exception_1.HttpException) {
+        if (err.statusCode >= 500) {
+            logger_1.logger.error({ err, requestId: req.requestId, path: req.path }, err.message);
+        }
+        else {
+            logger_1.logger.warn({ code: err.code, requestId: req.requestId, path: req.path }, err.message);
+        }
+        if (res.headersSent) {
+            return;
+        }
+        res.status(err.statusCode).json((0, http_exception_1.toProtocolErrorBody)(err, path));
+        return;
+    }
+    logger_1.logger.error({ err, requestId: req.requestId, path: req.path }, 'Unhandled error');
+    if (res.headersSent) {
+        return;
+    }
+    const httpErr = exception_factory_1.ExceptionFactory.internal();
+    res.status(httpErr.statusCode).json((0, http_exception_1.toProtocolErrorBody)(httpErr, path));
+}
+//# sourceMappingURL=error.middleware.js.map

package/dist/middlewares/error.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.middleware.js","sourceRoot":"","sources":["../../src/middlewares/error.middleware.ts"],"names":[],"mappings":";;AAYA,0CAEC;AAED,0CA4CC;AA3DD,iEAGsC;AACtC,uEAAmE;AACnE,4CAAyC;AAEzC,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,SAAgB,eAAe,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IAC9E,IAAI,CAAC,oCAAgB,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAgB,eAAe,CAC7B,GAAY,EACZ,GAAY,EACZ,GAAa,EACb,KAAmB;IAEnB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAE9B,gCAAgC;IAChC,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC9E,MAAM,OAAO,GAAG,oCAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAA,oCAAmB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,IAAI,GAAG,YAAY,8BAAa,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC1B,eAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EACjD,GAAG,CAAC,OAAO,CACZ,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,eAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAC5D,GAAG,CAAC,OAAO,CACZ,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAA,oCAAmB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IAED,eAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAEnF,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,oCAAgB,CAAC,QAAQ,EAAE,CAAC;IAC5C,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAA,oCAAmB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/middlewares/index.d.ts

@@ -0,0 +1,11 @@
+/** Cross-cutting HTTP middlewares. */
+export { requireApiKey, requireAdmin, requireAdminAuth, optionalApiKey } from './auth.middleware';
+export { validate } from './validate.middleware';
+export { errorMiddleware, notFoundHandler } from './error.middleware';
+export { requestIdMiddleware } from './request-id.middleware';
+export { globalRateLimiter, chatRateLimiter, chatBurstLimiter, ipBlockMiddleware, rebuildRateLimiters, } from './rate-limit.middleware';
+export { clientIpMiddleware, applyExpressTrustProxy, } from './client-ip.middleware';
+export { connectionTrackerMiddleware, getConnectionsSnapshot, getAbuseCounters, recordBlockedHit, } from './connection-tracker.middleware';
+export { uploadSingle } from './upload.middleware';
+export { concurrencyGuard } from './concurrency.middleware';
+//# sourceMappingURL=index.d.ts.map

package/dist/middlewares/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middlewares/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAClG,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/middlewares/index.js

@@ -0,0 +1,35 @@
+"use strict";
+/** Cross-cutting HTTP middlewares. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.concurrencyGuard = exports.uploadSingle = exports.recordBlockedHit = exports.getAbuseCounters = exports.getConnectionsSnapshot = exports.connectionTrackerMiddleware = exports.applyExpressTrustProxy = exports.clientIpMiddleware = exports.rebuildRateLimiters = exports.ipBlockMiddleware = exports.chatBurstLimiter = exports.chatRateLimiter = exports.globalRateLimiter = exports.requestIdMiddleware = exports.notFoundHandler = exports.errorMiddleware = exports.validate = exports.optionalApiKey = exports.requireAdminAuth = exports.requireAdmin = exports.requireApiKey = void 0;
+var auth_middleware_1 = require("./auth.middleware");
+Object.defineProperty(exports, "requireApiKey", { enumerable: true, get: function () { return auth_middleware_1.requireApiKey; } });
+Object.defineProperty(exports, "requireAdmin", { enumerable: true, get: function () { return auth_middleware_1.requireAdmin; } });
+Object.defineProperty(exports, "requireAdminAuth", { enumerable: true, get: function () { return auth_middleware_1.requireAdminAuth; } });
+Object.defineProperty(exports, "optionalApiKey", { enumerable: true, get: function () { return auth_middleware_1.optionalApiKey; } });
+var validate_middleware_1 = require("./validate.middleware");
+Object.defineProperty(exports, "validate", { enumerable: true, get: function () { return validate_middleware_1.validate; } });
+var error_middleware_1 = require("./error.middleware");
+Object.defineProperty(exports, "errorMiddleware", { enumerable: true, get: function () { return error_middleware_1.errorMiddleware; } });
+Object.defineProperty(exports, "notFoundHandler", { enumerable: true, get: function () { return error_middleware_1.notFoundHandler; } });
+var request_id_middleware_1 = require("./request-id.middleware");
+Object.defineProperty(exports, "requestIdMiddleware", { enumerable: true, get: function () { return request_id_middleware_1.requestIdMiddleware; } });
+var rate_limit_middleware_1 = require("./rate-limit.middleware");
+Object.defineProperty(exports, "globalRateLimiter", { enumerable: true, get: function () { return rate_limit_middleware_1.globalRateLimiter; } });
+Object.defineProperty(exports, "chatRateLimiter", { enumerable: true, get: function () { return rate_limit_middleware_1.chatRateLimiter; } });
+Object.defineProperty(exports, "chatBurstLimiter", { enumerable: true, get: function () { return rate_limit_middleware_1.chatBurstLimiter; } });
+Object.defineProperty(exports, "ipBlockMiddleware", { enumerable: true, get: function () { return rate_limit_middleware_1.ipBlockMiddleware; } });
+Object.defineProperty(exports, "rebuildRateLimiters", { enumerable: true, get: function () { return rate_limit_middleware_1.rebuildRateLimiters; } });
+var client_ip_middleware_1 = require("./client-ip.middleware");
+Object.defineProperty(exports, "clientIpMiddleware", { enumerable: true, get: function () { return client_ip_middleware_1.clientIpMiddleware; } });
+Object.defineProperty(exports, "applyExpressTrustProxy", { enumerable: true, get: function () { return client_ip_middleware_1.applyExpressTrustProxy; } });
+var connection_tracker_middleware_1 = require("./connection-tracker.middleware");
+Object.defineProperty(exports, "connectionTrackerMiddleware", { enumerable: true, get: function () { return connection_tracker_middleware_1.connectionTrackerMiddleware; } });
+Object.defineProperty(exports, "getConnectionsSnapshot", { enumerable: true, get: function () { return connection_tracker_middleware_1.getConnectionsSnapshot; } });
+Object.defineProperty(exports, "getAbuseCounters", { enumerable: true, get: function () { return connection_tracker_middleware_1.getAbuseCounters; } });
+Object.defineProperty(exports, "recordBlockedHit", { enumerable: true, get: function () { return connection_tracker_middleware_1.recordBlockedHit; } });
+var upload_middleware_1 = require("./upload.middleware");
+Object.defineProperty(exports, "uploadSingle", { enumerable: true, get: function () { return upload_middleware_1.uploadSingle; } });
+var concurrency_middleware_1 = require("./concurrency.middleware");
+Object.defineProperty(exports, "concurrencyGuard", { enumerable: true, get: function () { return concurrency_middleware_1.concurrencyGuard; } });
+//# sourceMappingURL=index.js.map

package/dist/middlewares/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middlewares/index.ts"],"names":[],"mappings":";AAAA,sCAAsC;;;AAEtC,qDAAkG;AAAzF,gHAAA,aAAa,OAAA;AAAE,+GAAA,YAAY,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AAAE,iHAAA,cAAc,OAAA;AACtE,6DAAiD;AAAxC,+GAAA,QAAQ,OAAA;AACjB,uDAAsE;AAA7D,mHAAA,eAAe,OAAA;AAAE,mHAAA,eAAe,OAAA;AACzC,iEAA8D;AAArD,4HAAA,mBAAmB,OAAA;AAC5B,iEAMiC;AAL/B,0HAAA,iBAAiB,OAAA;AACjB,wHAAA,eAAe,OAAA;AACf,yHAAA,gBAAgB,OAAA;AAChB,0HAAA,iBAAiB,OAAA;AACjB,4HAAA,mBAAmB,OAAA;AAErB,+DAGgC;AAF9B,0HAAA,kBAAkB,OAAA;AAClB,8HAAA,sBAAsB,OAAA;AAExB,iFAKyC;AAJvC,4IAAA,2BAA2B,OAAA;AAC3B,uIAAA,sBAAsB,OAAA;AACtB,iIAAA,gBAAgB,OAAA;AAChB,iIAAA,gBAAgB,OAAA;AAElB,yDAAmD;AAA1C,iHAAA,YAAY,OAAA;AACrB,mEAA4D;AAAnD,0HAAA,gBAAgB,OAAA"}

package/dist/middlewares/rate-limit.middleware.d.ts

@@ -0,0 +1,11 @@
+import type { NextFunction, Request, Response } from 'express';
+export declare function recordFailedAuth(req: Request): void;
+export declare function clearFailedAuth(req: Request): void;
+export declare function ipBlockMiddleware(req: Request, _res: Response, next: NextFunction): void;
+export declare function rebuildRateLimiters(): void;
+/** Wrappers so app.use / routes always hit the latest limiter instances. */
+export declare function globalRateLimiter(req: Request, res: Response, next: NextFunction): void;
+export declare function chatRateLimiter(req: Request, res: Response, next: NextFunction): void;
+export declare function chatBurstLimiter(req: Request, res: Response, next: NextFunction): void;
+export declare function adminApiLimiter(req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=rate-limit.middleware.d.ts.map

package/dist/middlewares/rate-limit.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.middleware.d.ts","sourceRoot":"","sources":["../../src/middlewares/rate-limit.middleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAW/D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAEnD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAElD;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,YAAY,GACjB,IAAI,CAiBN;AAmFD,wBAAgB,mBAAmB,IAAI,IAAI,CAK1C;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,IAAI,CAWN;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,IAAI,CAEN;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,IAAI,CAEN;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,IAAI,CAEN"}