@arkyn/server 3.0.10 → 3.0.12

package/dist/modules/services/apiService.js

@@ -12,8 +12,9 @@ var c = class c {
 	baseHeaders;
 	baseToken;
 	enableDebug;
+	timeoutMs;
 	constructor(e) {
-		this.baseUrl = e.baseUrl, this.baseHeaders = e.baseHeaders || void 0, this.baseToken = e.baseToken || void 0, this.enableDebug = e.enableDebug || !1;
+		this.baseUrl = e.baseUrl, this.baseHeaders = e.baseHeaders || void 0, this.baseToken = e.baseToken || void 0, this.enableDebug = e.enableDebug || !1, this.timeoutMs = e.timeoutMs;
 	}
 	static toPlainHeaders(e) {
 		return e instanceof Headers ? Object.fromEntries(e.entries()) : Object.fromEntries(new Headers(e).entries());
@@ -52,7 +53,8 @@ var c = class c {
 		let n = this.generateHeaders(t?.headers || {}, t?.token), i = await r({
 			url: this.baseUrl + e,
 			urlParams: t?.urlParams || {},
-			headers: n
+			headers: n,
+			timeoutMs: t?.timeoutMs ?? this.timeoutMs
 		});
 		return this.onDebug(e, "get", {
 			headers: n,
@@ -65,7 +67,8 @@ var c = class c {
 			url: this.baseUrl + e,
 			urlParams: t?.urlParams || {},
 			headers: n,
-			body: r
+			body: r,
+			timeoutMs: t?.timeoutMs ?? this.timeoutMs
 		});
 		return this.onDebug(e, "post", {
 			headers: n,
@@ -79,7 +82,8 @@ var c = class c {
 			url: this.baseUrl + e,
 			urlParams: t?.urlParams || {},
 			headers: n,
-			body: r
+			body: r,
+			timeoutMs: t?.timeoutMs ?? this.timeoutMs
 		});
 		return this.onDebug(e, "put", {
 			headers: n,
@@ -93,7 +97,8 @@ var c = class c {
 			url: this.baseUrl + e,
 			urlParams: t?.urlParams || {},
 			headers: n,
-			body: r
+			body: r,
+			timeoutMs: t?.timeoutMs ?? this.timeoutMs
 		});
 		return this.onDebug(e, "patch", {
 			headers: n,
@@ -107,7 +112,8 @@ var c = class c {
 			url: this.baseUrl + e,
 			urlParams: t?.urlParams || {},
 			headers: r,
-			body: i
+			body: i,
+			timeoutMs: t?.timeoutMs ?? this.timeoutMs
 		});
 		return this.onDebug(e, "delete", {
 			headers: r,

package/dist/modules/services/apiService.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiService.js","names":[],"sources":["../../../src/services/apiService.ts"],"sourcesContent":["import { parseSensitiveData } from \"@arkyn/shared\";\nimport { deleteRequest } from \"../http/api/_deleteRequest\";\nimport { getRequest } from \"../http/api/_getRequest\";\nimport { patchRequest } from \"../http/api/_patchRequest\";\nimport { postRequest } from \"../http/api/_postRequest\";\nimport { putRequest } from \"../http/api/_putRequest\";\nimport { flushDebugLogs } from \"../utilities/flushDebugLogs\";\nimport { SENSITIVE_DATA_KEYS } from \"../utilities/sensitiveDataKeys\";\n\ntype ApiServiceConstructorProps = {\n\t/** Base URL prepended to every request path (e.g. `\"https://api.example.com\"`). */\n\tbaseUrl: string;\n\t/** Default headers merged into every request. */\n\tbaseHeaders?: HeadersInit;\n\t/** Default Bearer token; can be overridden per request via `data.token`. */\n\tbaseToken?: string | null;\n\t/** When `true`, logs each request and response to the console in development. */\n\tenableDebug?: boolean;\n};\n\ntype ApiRequestDataWithoutBodyProps = {\n\theaders?: HeadersInit;\n\ttoken?: string;\n\turlParams?: Record<string, string>;\n};\n\ntype ApiRequestDataWithBodyProps = {\n\t// biome-ignore lint/suspicious/noExplicitAny: intentional\n\tbody?: any;\n\theaders?: HeadersInit;\n\ttoken?: string;\n\turlParams?: Record<string, string>;\n};\n\ntype DebugConfig = {\n\theaders?: HeadersInit;\n\t// biome-ignore lint/suspicious/noExplicitAny: intentional\n\tbody?: any;\n\tstatus: number;\n\tmessage: string;\n};\n\n/**\n * HTTP client for external API calls. Wraps fetch with base URL, default headers, optional auth token,\n * and per-request overrides for all standard HTTP methods.\n *\n * @example\n * ```typescript\n * const api = new ApiService({\n *   baseUrl: \"https://api.example.com\",\n *   baseToken: session.token,\n *   enableDebug: true,\n * });\n *\n * const { data } = await api.get(\"/users/me\");\n * const { data: created } = await api.post(\"/orders\", { body: { productId: 1 } });\n * ```\n */\nclass ApiService {\n\tprivate baseUrl: string;\n\tprivate baseHeaders?: HeadersInit;\n\tprivate baseToken?: string;\n\tprivate enableDebug?: boolean;\n\n\tconstructor(props: ApiServiceConstructorProps) {\n\t\tthis.baseUrl = props.baseUrl;\n\t\tthis.baseHeaders = props.baseHeaders || undefined;\n\t\tthis.baseToken = props.baseToken || undefined;\n\t\tthis.enableDebug = props.enableDebug || false;\n\t}\n\n\t/**\n\t * Converts a `HeadersInit` value into a plain object so it can be safely\n\t * JSON-serialized and redacted, regardless of whether it was provided as a\n\t * `Headers` instance, a plain object, or an array of tuples.\n\t */\n\tprivate static toPlainHeaders(headers: HeadersInit): Record<string, string> {\n\t\tif (headers instanceof Headers)\n\t\t\treturn Object.fromEntries(headers.entries());\n\t\treturn Object.fromEntries(new Headers(headers).entries());\n\t}\n\n\t/**\n\t * Serializes a value to JSON and masks sensitive fields (e.g. `Authorization`\n\t * headers, `password`/`token`/`secret` body fields) before it is written to the\n\t * debug output. See `SENSITIVE_DATA_KEYS`.\n\t */\n\tprivate static toRedactedJson(value: unknown): string {\n\t\treturn parseSensitiveData(JSON.stringify(value), [...SENSITIVE_DATA_KEYS]);\n\t}\n\n\tprivate onDebug(endpoint: string, method: string, data: DebugConfig) {\n\t\tif (this.enableDebug) {\n\t\t\tconst debugs: string[] = [];\n\n\t\t\tdebugs.push(`Base URL: ${this.baseUrl}`);\n\t\t\tdebugs.push(`Endpoint: ${endpoint}`);\n\t\t\tdebugs.push(`Status/Method: ${method} => ${data.status}`);\n\t\t\tdebugs.push(`Message: ${data.message}`);\n\n\t\t\tif (data.headers) {\n\t\t\t\tconst plainHeaders = ApiService.toPlainHeaders(data.headers);\n\t\t\t\tdebugs.push(`Headers: ${ApiService.toRedactedJson(plainHeaders)}`);\n\t\t\t}\n\t\t\tif (data.body)\n\t\t\t\tdebugs.push(`Body: ${ApiService.toRedactedJson(data.body)}`);\n\n\t\t\tflushDebugLogs({ debugs, name: \"ApiDebug\", scheme: \"yellow\" });\n\t\t}\n\t}\n\n\tprivate generateHeaders(\n\t\tinitHeaders: HeadersInit,\n\t\ttoken?: string,\n\t): HeadersInit {\n\t\tlet headers: HeadersInit = {};\n\t\tif (this.baseToken) headers = { Authorization: `Bearer ${this.baseToken}` };\n\t\tif (this.baseHeaders) headers = { ...headers, ...this.baseHeaders };\n\n\t\tif (initHeaders) headers = { ...headers, ...initHeaders };\n\t\tif (token) headers = { ...headers, Authorization: `Bearer ${token}` };\n\n\t\treturn headers;\n\t}\n\n\t/**\n\t * Sends a get request to the specified endpoint.\n\t * @param endpoint - The API endpoint to send the get request to.\n\t * @param data - The request data, including optional headers and token.\n\t * @returns The API response data.\n\t */\n\n\tasync get(endpoint: string, data?: ApiRequestDataWithoutBodyProps) {\n\t\tconst headers = this.generateHeaders(data?.headers || {}, data?.token);\n\n\t\tconst response = await getRequest({\n\t\t\turl: this.baseUrl + endpoint,\n\t\t\turlParams: data?.urlParams || {},\n\t\t\theaders,\n\t\t});\n\n\t\tthis.onDebug(endpoint, \"get\", {\n\t\t\theaders,\n\t\t\tmessage: response.message,\n\t\t\tstatus: response.status,\n\t\t});\n\n\t\treturn response;\n\t}\n\n\t/**\n\t * Sends a post request to the specified endpoint.\n\t * @param endpoint - The API endpoint to send the post request to.\n\t * @param data - The request data, including body, optional headers, and token.\n\t * @returns The API response data.\n\t */\n\n\tasync post(endpoint: string, data?: ApiRequestDataWithBodyProps) {\n\t\tconst headers = this.generateHeaders(data?.headers || {}, data?.token);\n\t\tconst body = data?.body;\n\n\t\tconst response = await postRequest({\n\t\t\turl: this.baseUrl + endpoint,\n\t\t\turlParams: data?.urlParams || {},\n\t\t\theaders,\n\t\t\tbody,\n\t\t});\n\n\t\tthis.onDebug(endpoint, \"post\", {\n\t\t\theaders,\n\t\t\tbody,\n\t\t\tmessage: response.message,\n\t\t\tstatus: response.status,\n\t\t});\n\n\t\treturn response;\n\t}\n\n\t/**\n\t * Sends a put request to the specified endpoint.\n\t * @param endpoint - The API endpoint to send the put request to.\n\t * @param data - The request data, including body, optional headers, and token.\n\t * @returns The API response data.\n\t */\n\n\tasync put(endpoint: string, data?: ApiRequestDataWithBodyProps) {\n\t\tconst headers = this.generateHeaders(data?.headers || {}, data?.token);\n\t\tconst body = data?.body;\n\n\t\tconst response = await putRequest({\n\t\t\turl: this.baseUrl + endpoint,\n\t\t\turlParams: data?.urlParams || {},\n\t\t\theaders,\n\t\t\tbody,\n\t\t});\n\n\t\tthis.onDebug(endpoint, \"put\", {\n\t\t\theaders,\n\t\t\tbody,\n\t\t\tmessage: response.message,\n\t\t\tstatus: response.status,\n\t\t});\n\n\t\treturn response;\n\t}\n\n\t/**\n\t * Sends a patch request to the specified endpoint.\n\t * @param endpoint - The API endpoint to send the patch request to.\n\t * @param data - The request data, including body, optional headers, and token.\n\t * @returns The API response data.\n\t */\n\n\tasync patch(endpoint: string, data?: ApiRequestDataWithBodyProps) {\n\t\tconst headers = this.generateHeaders(data?.headers || {}, data?.token);\n\t\tconst body = data?.body;\n\n\t\tconst response = await patchRequest({\n\t\t\turl: this.baseUrl + endpoint,\n\t\t\turlParams: data?.urlParams || {},\n\t\t\theaders,\n\t\t\tbody,\n\t\t});\n\n\t\tthis.onDebug(endpoint, \"patch\", {\n\t\t\theaders,\n\t\t\tbody,\n\t\t\tmessage: response.message,\n\t\t\tstatus: response.status,\n\t\t});\n\n\t\treturn response;\n\t}\n\n\t/**\n\t * Sends a delete request to the specified endpoint.\n\t * @param endpoint - The API endpoint to send the delete request to.\n\t * @param data - The request data, including body, optional headers, and token.\n\t * @returns The API response data.\n\t */\n\n\tasync delete(endpoint: string, data?: ApiRequestDataWithBodyProps) {\n\t\tconst headers = this.generateHeaders(data?.headers || {}, data?.token);\n\t\tconst body = data?.body;\n\n\t\tconst response = await deleteRequest({\n\t\t\turl: this.baseUrl + endpoint,\n\t\t\turlParams: data?.urlParams || {},\n\t\t\theaders,\n\t\t\tbody,\n\t\t});\n\n\t\tthis.onDebug(endpoint, \"delete\", {\n\t\t\theaders,\n\t\t\tbody,\n\t\t\tmessage: response.message,\n\t\t\tstatus: response.status,\n\t\t});\n\n\t\treturn response;\n\t}\n}\n\nexport { ApiService };\n"],"mappings":";;;;;;;;;AA0DA,IAAM,IAAN,MAAM,EAAW;CAChB;CACA;CACA;CACA;CAEA,YAAY,GAAmC;EAI9C,AAHA,KAAK,UAAU,EAAM,SACrB,KAAK,cAAc,EAAM,eAAe,KAAA,GACxC,KAAK,YAAY,EAAM,aAAa,KAAA,GACpC,KAAK,cAAc,EAAM,eAAe;CACzC;CAOA,OAAe,eAAe,GAA8C;EAG3E,OAFI,aAAmB,UACf,OAAO,YAAY,EAAQ,QAAQ,CAAC,IACrC,OAAO,YAAY,IAAI,QAAQ,CAAO,CAAC,CAAC,QAAQ,CAAC;CACzD;CAOA,OAAe,eAAe,GAAwB;EACrD,OAAO,EAAmB,KAAK,UAAU,CAAK,GAAG,CAAC,GAAG,CAAmB,CAAC;CAC1E;CAEA,QAAgB,GAAkB,GAAgB,GAAmB;EACpE,IAAI,KAAK,aAAa;GACrB,IAAM,IAAmB,CAAC;GAO1B,IALA,EAAO,KAAK,aAAa,KAAK,SAAS,GACvC,EAAO,KAAK,aAAa,GAAU,GACnC,EAAO,KAAK,kBAAkB,EAAO,MAAM,EAAK,QAAQ,GACxD,EAAO,KAAK,YAAY,EAAK,SAAS,GAElC,EAAK,SAAS;IACjB,IAAM,IAAe,EAAW,eAAe,EAAK,OAAO;IAC3D,EAAO,KAAK,YAAY,EAAW,eAAe,CAAY,GAAG;GAClE;GAIA,AAHI,EAAK,QACR,EAAO,KAAK,SAAS,EAAW,eAAe,EAAK,IAAI,GAAG,GAE5D,EAAe;IAAE;IAAQ,MAAM;IAAY,QAAQ;GAAS,CAAC;EAC9D;CACD;CAEA,gBACC,GACA,GACc;EACd,IAAI,IAAuB,CAAC;EAO5B,OANI,KAAK,cAAW,IAAU,EAAE,eAAe,UAAU,KAAK,YAAY,IACtE,KAAK,gBAAa,IAAU;GAAE,GAAG;GAAS,GAAG,KAAK;EAAY,IAE9D,MAAa,IAAU;GAAE,GAAG;GAAS,GAAG;EAAY,IACpD,MAAO,IAAU;GAAE,GAAG;GAAS,eAAe,UAAU;EAAQ,IAE7D;CACR;CASA,MAAM,IAAI,GAAkB,GAAuC;EAClE,IAAM,IAAU,KAAK,gBAAgB,GAAM,WAAW,CAAC,GAAG,GAAM,KAAK,GAE/D,IAAW,MAAM,EAAW;GACjC,KAAK,KAAK,UAAU;GACpB,WAAW,GAAM,aAAa,CAAC;GAC/B;EACD,CAAC;EAQD,OANA,KAAK,QAAQ,GAAU,OAAO;GAC7B;GACA,SAAS,EAAS;GAClB,QAAQ,EAAS;EAClB,CAAC,GAEM;CACR;CASA,MAAM,KAAK,GAAkB,GAAoC;EAChE,IAAM,IAAU,KAAK,gBAAgB,GAAM,WAAW,CAAC,GAAG,GAAM,KAAK,GAC/D,IAAO,GAAM,MAEb,IAAW,MAAM,EAAY;GAClC,KAAK,KAAK,UAAU;GACpB,WAAW,GAAM,aAAa,CAAC;GAC/B;GACA;EACD,CAAC;EASD,OAPA,KAAK,QAAQ,GAAU,QAAQ;GAC9B;GACA;GACA,SAAS,EAAS;GAClB,QAAQ,EAAS;EAClB,CAAC,GAEM;CACR;CASA,MAAM,IAAI,GAAkB,GAAoC;EAC/D,IAAM,IAAU,KAAK,gBAAgB,GAAM,WAAW,CAAC,GAAG,GAAM,KAAK,GAC/D,IAAO,GAAM,MAEb,IAAW,MAAM,EAAW;GACjC,KAAK,KAAK,UAAU;GACpB,WAAW,GAAM,aAAa,CAAC;GAC/B;GACA;EACD,CAAC;EASD,OAPA,KAAK,QAAQ,GAAU,OAAO;GAC7B;GACA;GACA,SAAS,EAAS;GAClB,QAAQ,EAAS;EAClB,CAAC,GAEM;CACR;CASA,MAAM,MAAM,GAAkB,GAAoC;EACjE,IAAM,IAAU,KAAK,gBAAgB,GAAM,WAAW,CAAC,GAAG,GAAM,KAAK,GAC/D,IAAO,GAAM,MAEb,IAAW,MAAM,EAAa;GACnC,KAAK,KAAK,UAAU;GACpB,WAAW,GAAM,aAAa,CAAC;GAC/B;GACA;EACD,CAAC;EASD,OAPA,KAAK,QAAQ,GAAU,SAAS;GAC/B;GACA;GACA,SAAS,EAAS;GAClB,QAAQ,EAAS;EAClB,CAAC,GAEM;CACR;CASA,MAAM,OAAO,GAAkB,GAAoC;EAClE,IAAM,IAAU,KAAK,gBAAgB,GAAM,WAAW,CAAC,GAAG,GAAM,KAAK,GAC/D,IAAO,GAAM,MAEb,IAAW,MAAM,EAAc;GACpC,KAAK,KAAK,UAAU;GACpB,WAAW,GAAM,aAAa,CAAC;GAC/B;GACA;EACD,CAAC;EASD,OAPA,KAAK,QAAQ,GAAU,UAAU;GAChC;GACA;GACA,SAAS,EAAS;GAClB,QAAQ,EAAS;EAClB,CAAC,GAEM;CACR;AACD"}
+{"version":3,"file":"apiService.js","names":[],"sources":["../../../src/services/apiService.ts"],"sourcesContent":["import { parseSensitiveData } from \"@arkyn/shared\";\nimport { deleteRequest } from \"../http/api/_deleteRequest\";\nimport { getRequest } from \"../http/api/_getRequest\";\nimport { patchRequest } from \"../http/api/_patchRequest\";\nimport { postRequest } from \"../http/api/_postRequest\";\nimport { putRequest } from \"../http/api/_putRequest\";\nimport { flushDebugLogs } from \"../utilities/flushDebugLogs\";\nimport { SENSITIVE_DATA_KEYS } from \"../utilities/sensitiveDataKeys\";\n\ntype ApiServiceConstructorProps = {\n\t/** Base URL prepended to every request path (e.g. `\"https://api.example.com\"`). */\n\tbaseUrl: string;\n\t/** Default headers merged into every request. */\n\tbaseHeaders?: HeadersInit;\n\t/** Default Bearer token; can be overridden per request via `data.token`. */\n\tbaseToken?: string | null;\n\t/** When `true`, logs each request and response to the console in development. */\n\tenableDebug?: boolean;\n\t/** Default request timeout in ms; can be overridden per request via `data.timeoutMs`. */\n\ttimeoutMs?: number;\n};\n\ntype ApiRequestDataWithoutBodyProps = {\n\theaders?: HeadersInit;\n\ttoken?: string;\n\turlParams?: Record<string, string>;\n\ttimeoutMs?: number;\n};\n\ntype ApiRequestDataWithBodyProps = {\n\t// biome-ignore lint/suspicious/noExplicitAny: intentional\n\tbody?: any;\n\theaders?: HeadersInit;\n\ttoken?: string;\n\turlParams?: Record<string, string>;\n\ttimeoutMs?: number;\n};\n\ntype DebugConfig = {\n\theaders?: HeadersInit;\n\t// biome-ignore lint/suspicious/noExplicitAny: intentional\n\tbody?: any;\n\tstatus: number;\n\tmessage: string;\n};\n\n/**\n * HTTP client for external API calls. Wraps fetch with base URL, default headers, optional auth token,\n * and per-request overrides for all standard HTTP methods.\n *\n * @example\n * ```typescript\n * const api = new ApiService({\n *   baseUrl: \"https://api.example.com\",\n *   baseToken: session.token,\n *   enableDebug: true,\n * });\n *\n * const { data } = await api.get(\"/users/me\");\n * const { data: created } = await api.post(\"/orders\", { body: { productId: 1 } });\n * ```\n */\nclass ApiService {\n\tprivate baseUrl: string;\n\tprivate baseHeaders?: HeadersInit;\n\tprivate baseToken?: string;\n\tprivate enableDebug?: boolean;\n\tprivate timeoutMs?: number;\n\n\tconstructor(props: ApiServiceConstructorProps) {\n\t\tthis.baseUrl = props.baseUrl;\n\t\tthis.baseHeaders = props.baseHeaders || undefined;\n\t\tthis.baseToken = props.baseToken || undefined;\n\t\tthis.enableDebug = props.enableDebug || false;\n\t\tthis.timeoutMs = props.timeoutMs;\n\t}\n\n\t/**\n\t * Converts a `HeadersInit` value into a plain object so it can be safely\n\t * JSON-serialized and redacted, regardless of whether it was provided as a\n\t * `Headers` instance, a plain object, or an array of tuples.\n\t */\n\tprivate static toPlainHeaders(headers: HeadersInit): Record<string, string> {\n\t\tif (headers instanceof Headers)\n\t\t\treturn Object.fromEntries(headers.entries());\n\t\treturn Object.fromEntries(new Headers(headers).entries());\n\t}\n\n\t/**\n\t * Serializes a value to JSON and masks sensitive fields (e.g. `Authorization`\n\t * headers, `password`/`token`/`secret` body fields) before it is written to the\n\t * debug output. See `SENSITIVE_DATA_KEYS`.\n\t */\n\tprivate static toRedactedJson(value: unknown): string {\n\t\treturn parseSensitiveData(JSON.stringify(value), [...SENSITIVE_DATA_KEYS]);\n\t}\n\n\tprivate onDebug(endpoint: string, method: string, data: DebugConfig) {\n\t\tif (this.enableDebug) {\n\t\t\tconst debugs: string[] = [];\n\n\t\t\tdebugs.push(`Base URL: ${this.baseUrl}`);\n\t\t\tdebugs.push(`Endpoint: ${endpoint}`);\n\t\t\tdebugs.push(`Status/Method: ${method} => ${data.status}`);\n\t\t\tdebugs.push(`Message: ${data.message}`);\n\n\t\t\tif (data.headers) {\n\t\t\t\tconst plainHeaders = ApiService.toPlainHeaders(data.headers);\n\t\t\t\tdebugs.push(`Headers: ${ApiService.toRedactedJson(plainHeaders)}`);\n\t\t\t}\n\t\t\tif (data.body)\n\t\t\t\tdebugs.push(`Body: ${ApiService.toRedactedJson(data.body)}`);\n\n\t\t\tflushDebugLogs({ debugs, name: \"ApiDebug\", scheme: \"yellow\" });\n\t\t}\n\t}\n\n\tprivate generateHeaders(\n\t\tinitHeaders: HeadersInit,\n\t\ttoken?: string,\n\t): HeadersInit {\n\t\tlet headers: HeadersInit = {};\n\t\tif (this.baseToken) headers = { Authorization: `Bearer ${this.baseToken}` };\n\t\tif (this.baseHeaders) headers = { ...headers, ...this.baseHeaders };\n\n\t\tif (initHeaders) headers = { ...headers, ...initHeaders };\n\t\tif (token) headers = { ...headers, Authorization: `Bearer ${token}` };\n\n\t\treturn headers;\n\t}\n\n\t/**\n\t * Sends a get request to the specified endpoint.\n\t * @param endpoint - The API endpoint to send the get request to.\n\t * @param data - The request data, including optional headers and token.\n\t * @returns The API response data.\n\t */\n\n\tasync get(endpoint: string, data?: ApiRequestDataWithoutBodyProps) {\n\t\tconst headers = this.generateHeaders(data?.headers || {}, data?.token);\n\n\t\tconst response = await getRequest({\n\t\t\turl: this.baseUrl + endpoint,\n\t\t\turlParams: data?.urlParams || {},\n\t\t\theaders,\n\t\t\ttimeoutMs: data?.timeoutMs ?? this.timeoutMs,\n\t\t});\n\n\t\tthis.onDebug(endpoint, \"get\", {\n\t\t\theaders,\n\t\t\tmessage: response.message,\n\t\t\tstatus: response.status,\n\t\t});\n\n\t\treturn response;\n\t}\n\n\t/**\n\t * Sends a post request to the specified endpoint.\n\t * @param endpoint - The API endpoint to send the post request to.\n\t * @param data - The request data, including body, optional headers, and token.\n\t * @returns The API response data.\n\t */\n\n\tasync post(endpoint: string, data?: ApiRequestDataWithBodyProps) {\n\t\tconst headers = this.generateHeaders(data?.headers || {}, data?.token);\n\t\tconst body = data?.body;\n\n\t\tconst response = await postRequest({\n\t\t\turl: this.baseUrl + endpoint,\n\t\t\turlParams: data?.urlParams || {},\n\t\t\theaders,\n\t\t\tbody,\n\t\t\ttimeoutMs: data?.timeoutMs ?? this.timeoutMs,\n\t\t});\n\n\t\tthis.onDebug(endpoint, \"post\", {\n\t\t\theaders,\n\t\t\tbody,\n\t\t\tmessage: response.message,\n\t\t\tstatus: response.status,\n\t\t});\n\n\t\treturn response;\n\t}\n\n\t/**\n\t * Sends a put request to the specified endpoint.\n\t * @param endpoint - The API endpoint to send the put request to.\n\t * @param data - The request data, including body, optional headers, and token.\n\t * @returns The API response data.\n\t */\n\n\tasync put(endpoint: string, data?: ApiRequestDataWithBodyProps) {\n\t\tconst headers = this.generateHeaders(data?.headers || {}, data?.token);\n\t\tconst body = data?.body;\n\n\t\tconst response = await putRequest({\n\t\t\turl: this.baseUrl + endpoint,\n\t\t\turlParams: data?.urlParams || {},\n\t\t\theaders,\n\t\t\tbody,\n\t\t\ttimeoutMs: data?.timeoutMs ?? this.timeoutMs,\n\t\t});\n\n\t\tthis.onDebug(endpoint, \"put\", {\n\t\t\theaders,\n\t\t\tbody,\n\t\t\tmessage: response.message,\n\t\t\tstatus: response.status,\n\t\t});\n\n\t\treturn response;\n\t}\n\n\t/**\n\t * Sends a patch request to the specified endpoint.\n\t * @param endpoint - The API endpoint to send the patch request to.\n\t * @param data - The request data, including body, optional headers, and token.\n\t * @returns The API response data.\n\t */\n\n\tasync patch(endpoint: string, data?: ApiRequestDataWithBodyProps) {\n\t\tconst headers = this.generateHeaders(data?.headers || {}, data?.token);\n\t\tconst body = data?.body;\n\n\t\tconst response = await patchRequest({\n\t\t\turl: this.baseUrl + endpoint,\n\t\t\turlParams: data?.urlParams || {},\n\t\t\theaders,\n\t\t\tbody,\n\t\t\ttimeoutMs: data?.timeoutMs ?? this.timeoutMs,\n\t\t});\n\n\t\tthis.onDebug(endpoint, \"patch\", {\n\t\t\theaders,\n\t\t\tbody,\n\t\t\tmessage: response.message,\n\t\t\tstatus: response.status,\n\t\t});\n\n\t\treturn response;\n\t}\n\n\t/**\n\t * Sends a delete request to the specified endpoint.\n\t * @param endpoint - The API endpoint to send the delete request to.\n\t * @param data - The request data, including body, optional headers, and token.\n\t * @returns The API response data.\n\t */\n\n\tasync delete(endpoint: string, data?: ApiRequestDataWithBodyProps) {\n\t\tconst headers = this.generateHeaders(data?.headers || {}, data?.token);\n\t\tconst body = data?.body;\n\n\t\tconst response = await deleteRequest({\n\t\t\turl: this.baseUrl + endpoint,\n\t\t\turlParams: data?.urlParams || {},\n\t\t\theaders,\n\t\t\tbody,\n\t\t\ttimeoutMs: data?.timeoutMs ?? this.timeoutMs,\n\t\t});\n\n\t\tthis.onDebug(endpoint, \"delete\", {\n\t\t\theaders,\n\t\t\tbody,\n\t\t\tmessage: response.message,\n\t\t\tstatus: response.status,\n\t\t});\n\n\t\treturn response;\n\t}\n}\n\nexport { ApiService };\n"],"mappings":";;;;;;;;;AA8DA,IAAM,IAAN,MAAM,EAAW;CAChB;CACA;CACA;CACA;CACA;CAEA,YAAY,GAAmC;EAK9C,AAJA,KAAK,UAAU,EAAM,SACrB,KAAK,cAAc,EAAM,eAAe,KAAA,GACxC,KAAK,YAAY,EAAM,aAAa,KAAA,GACpC,KAAK,cAAc,EAAM,eAAe,IACxC,KAAK,YAAY,EAAM;CACxB;CAOA,OAAe,eAAe,GAA8C;EAG3E,OAFI,aAAmB,UACf,OAAO,YAAY,EAAQ,QAAQ,CAAC,IACrC,OAAO,YAAY,IAAI,QAAQ,CAAO,CAAC,CAAC,QAAQ,CAAC;CACzD;CAOA,OAAe,eAAe,GAAwB;EACrD,OAAO,EAAmB,KAAK,UAAU,CAAK,GAAG,CAAC,GAAG,CAAmB,CAAC;CAC1E;CAEA,QAAgB,GAAkB,GAAgB,GAAmB;EACpE,IAAI,KAAK,aAAa;GACrB,IAAM,IAAmB,CAAC;GAO1B,IALA,EAAO,KAAK,aAAa,KAAK,SAAS,GACvC,EAAO,KAAK,aAAa,GAAU,GACnC,EAAO,KAAK,kBAAkB,EAAO,MAAM,EAAK,QAAQ,GACxD,EAAO,KAAK,YAAY,EAAK,SAAS,GAElC,EAAK,SAAS;IACjB,IAAM,IAAe,EAAW,eAAe,EAAK,OAAO;IAC3D,EAAO,KAAK,YAAY,EAAW,eAAe,CAAY,GAAG;GAClE;GAIA,AAHI,EAAK,QACR,EAAO,KAAK,SAAS,EAAW,eAAe,EAAK,IAAI,GAAG,GAE5D,EAAe;IAAE;IAAQ,MAAM;IAAY,QAAQ;GAAS,CAAC;EAC9D;CACD;CAEA,gBACC,GACA,GACc;EACd,IAAI,IAAuB,CAAC;EAO5B,OANI,KAAK,cAAW,IAAU,EAAE,eAAe,UAAU,KAAK,YAAY,IACtE,KAAK,gBAAa,IAAU;GAAE,GAAG;GAAS,GAAG,KAAK;EAAY,IAE9D,MAAa,IAAU;GAAE,GAAG;GAAS,GAAG;EAAY,IACpD,MAAO,IAAU;GAAE,GAAG;GAAS,eAAe,UAAU;EAAQ,IAE7D;CACR;CASA,MAAM,IAAI,GAAkB,GAAuC;EAClE,IAAM,IAAU,KAAK,gBAAgB,GAAM,WAAW,CAAC,GAAG,GAAM,KAAK,GAE/D,IAAW,MAAM,EAAW;GACjC,KAAK,KAAK,UAAU;GACpB,WAAW,GAAM,aAAa,CAAC;GAC/B;GACA,WAAW,GAAM,aAAa,KAAK;EACpC,CAAC;EAQD,OANA,KAAK,QAAQ,GAAU,OAAO;GAC7B;GACA,SAAS,EAAS;GAClB,QAAQ,EAAS;EAClB,CAAC,GAEM;CACR;CASA,MAAM,KAAK,GAAkB,GAAoC;EAChE,IAAM,IAAU,KAAK,gBAAgB,GAAM,WAAW,CAAC,GAAG,GAAM,KAAK,GAC/D,IAAO,GAAM,MAEb,IAAW,MAAM,EAAY;GAClC,KAAK,KAAK,UAAU;GACpB,WAAW,GAAM,aAAa,CAAC;GAC/B;GACA;GACA,WAAW,GAAM,aAAa,KAAK;EACpC,CAAC;EASD,OAPA,KAAK,QAAQ,GAAU,QAAQ;GAC9B;GACA;GACA,SAAS,EAAS;GAClB,QAAQ,EAAS;EAClB,CAAC,GAEM;CACR;CASA,MAAM,IAAI,GAAkB,GAAoC;EAC/D,IAAM,IAAU,KAAK,gBAAgB,GAAM,WAAW,CAAC,GAAG,GAAM,KAAK,GAC/D,IAAO,GAAM,MAEb,IAAW,MAAM,EAAW;GACjC,KAAK,KAAK,UAAU;GACpB,WAAW,GAAM,aAAa,CAAC;GAC/B;GACA;GACA,WAAW,GAAM,aAAa,KAAK;EACpC,CAAC;EASD,OAPA,KAAK,QAAQ,GAAU,OAAO;GAC7B;GACA;GACA,SAAS,EAAS;GAClB,QAAQ,EAAS;EAClB,CAAC,GAEM;CACR;CASA,MAAM,MAAM,GAAkB,GAAoC;EACjE,IAAM,IAAU,KAAK,gBAAgB,GAAM,WAAW,CAAC,GAAG,GAAM,KAAK,GAC/D,IAAO,GAAM,MAEb,IAAW,MAAM,EAAa;GACnC,KAAK,KAAK,UAAU;GACpB,WAAW,GAAM,aAAa,CAAC;GAC/B;GACA;GACA,WAAW,GAAM,aAAa,KAAK;EACpC,CAAC;EASD,OAPA,KAAK,QAAQ,GAAU,SAAS;GAC/B;GACA;GACA,SAAS,EAAS;GAClB,QAAQ,EAAS;EAClB,CAAC,GAEM;CACR;CASA,MAAM,OAAO,GAAkB,GAAoC;EAClE,IAAM,IAAU,KAAK,gBAAgB,GAAM,WAAW,CAAC,GAAG,GAAM,KAAK,GAC/D,IAAO,GAAM,MAEb,IAAW,MAAM,EAAc;GACpC,KAAK,KAAK,UAAU;GACpB,WAAW,GAAM,aAAa,CAAC;GAC/B;GACA;GACA,WAAW,GAAM,aAAa,KAAK;EACpC,CAAC;EASD,OAPA,KAAK,QAAQ,GAAU,UAAU;GAChC;GACA;GACA,SAAS,EAAS;GAClB,QAAQ,EAAS;EAClB,CAAC,GAEM;CACR;AACD"}

package/dist/modules/services/logService.js

@@ -6,25 +6,38 @@ var t = class t {
 		return e.protocol === "https:" ? !0 : e.hostname === "localhost" || e.hostname === "127.0.0.1";
 	}
 	static setConfig(n) {
-		if (t.config) return;
-		let { trafficSourceId: r, userToken: i, logBaseApiUrl: a } = n, o = null;
-		if (a) try {
-			let n = new URL(a);
-			t.isSecureEndpoint(n) ? o = `${a}/ingest-log` : e({
+		if (t.config) {
+			e({
+				name: "LogServiceError",
+				scheme: "yellow",
+				debugs: ["LogService.setConfig() was already called and is a singleton — this call was ignored. Call setConfig() once at application boot, never inside a request handler (a per-request value would only ever apply to the first request that reaches it)."]
+			});
+			return;
+		}
+		let { trafficSourceId: r, logBaseApiUrl: i } = n, a = n.serviceToken ?? n.userToken;
+		if (n.userToken !== void 0 && n.serviceToken === void 0 && e({
+			name: "LogServiceError",
+			scheme: "yellow",
+			debugs: ["LogService.setConfig({ userToken }) is deprecated — use \"serviceToken\" instead. It must be a static, application-level credential, not a per-user/session value."]
+		}), !a) throw Error("LogService.setConfig() requires a serviceToken (or the deprecated userToken alias).");
+		let o = null;
+		if (i) try {
+			let n = new URL(i);
+			t.isSecureEndpoint(n) ? o = `${i}/ingest-log` : e({
 				name: "LogServiceError",
 				scheme: "red",
-				debugs: [`Insecure logBaseApiUrl "${a}" rejected: use https://, or http:// only for localhost/127.0.0.1. Remote logging disabled.`]
+				debugs: [`Insecure logBaseApiUrl "${i}" rejected: use https://, or http:// only for localhost/127.0.0.1. Remote logging disabled.`]
 			});
 		} catch {
 			e({
 				name: "LogServiceError",
 				scheme: "red",
-				debugs: [`Invalid logBaseApiUrl "${a}". Remote logging disabled.`]
+				debugs: [`Invalid logBaseApiUrl "${i}". Remote logging disabled.`]
 			});
 		}
 		t.config = {
 			trafficSourceId: r,
-			userToken: i,
+			serviceToken: a,
 			apiUrl: o
 		};
 	}

package/dist/modules/services/logService.js.map

@@ -1 +1 @@
-{"version":3,"file":"logService.js","names":[],"sources":["../../../src/services/logService.ts"],"sourcesContent":["import { flushDebugLogs } from \"../utilities/flushDebugLogs\";\n\n/**\n * Static service for log endpoint configuration and access.\n *\n * Stores a singleton configuration containing the traffic source identifier,\n * user token, and log ingestion URL.\n */\nclass LogService {\n\tprivate static config?: {\n\t\ttrafficSourceId: string;\n\t\tuserToken: string;\n\t\tapiUrl: string | null;\n\t};\n\n\t/**\n\t * Checks whether a log ingestion URL is safe to send telemetry to: `https://`\n\t * is always accepted, and plain `http://` is only accepted for local development\n\t * (`localhost` / `127.0.0.1`). Every other `http://` destination is rejected so\n\t * request/response data is never transmitted in plaintext over the network.\n\t */\n\tprivate static isSecureEndpoint(url: URL): boolean {\n\t\tif (url.protocol === \"https:\") return true;\n\t\treturn url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\";\n\t}\n\n\t/**\n\t * Sets the log service configuration once. Subsequent calls are ignored.\n\t *\n\t * There is no hardcoded fallback endpoint: if `logBaseApiUrl` is omitted, invalid,\n\t * or points at an insecure (`http://`) non-local destination, remote log delivery\n\t * is disabled (`getConfig().apiUrl` is `null`) instead of silently sending data to\n\t * a default/insecure host — `logRequest` skips the network call in that case.\n\t *\n\t * @param config.trafficSourceId - Traffic source identifier.\n\t * @param config.userToken - User token for authentication.\n\t * @param config.logBaseApiUrl - Log ingestion base URL. Must be `https://`, or\n\t * `http://localhost`/`http://127.0.0.1` for local development.\n\t */\n\tstatic setConfig(config: {\n\t\ttrafficSourceId: string;\n\t\tuserToken: string;\n\t\tlogBaseApiUrl?: string;\n\t}): void {\n\t\tif (LogService.config) return;\n\n\t\tconst { trafficSourceId, userToken, logBaseApiUrl } = config;\n\t\tlet apiUrl: string | null = null;\n\n\t\tif (logBaseApiUrl) {\n\t\t\ttry {\n\t\t\t\tconst parsedUrl = new URL(logBaseApiUrl);\n\n\t\t\t\tif (LogService.isSecureEndpoint(parsedUrl)) {\n\t\t\t\t\tapiUrl = `${logBaseApiUrl}/ingest-log`;\n\t\t\t\t} else {\n\t\t\t\t\tflushDebugLogs({\n\t\t\t\t\t\tname: \"LogServiceError\",\n\t\t\t\t\t\tscheme: \"red\",\n\t\t\t\t\t\tdebugs: [\n\t\t\t\t\t\t\t`Insecure logBaseApiUrl \"${logBaseApiUrl}\" rejected: use https://, or http:// only for localhost/127.0.0.1. Remote logging disabled.`,\n\t\t\t\t\t\t],\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\tflushDebugLogs({\n\t\t\t\t\tname: \"LogServiceError\",\n\t\t\t\t\tscheme: \"red\",\n\t\t\t\t\tdebugs: [\n\t\t\t\t\t\t`Invalid logBaseApiUrl \"${logBaseApiUrl}\". Remote logging disabled.`,\n\t\t\t\t\t],\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\tLogService.config = { trafficSourceId, userToken, apiUrl };\n\t}\n\n\t/** Returns the stored configuration, or `undefined` if `setConfig` has not been called. */\n\tstatic getConfig():\n\t\t| { trafficSourceId: string; userToken: string; apiUrl: string | null }\n\t\t| undefined {\n\t\treturn LogService.config;\n\t}\n\n\t/**\n\t * Resets the stored configuration, allowing a new initialization.\n\t */\n\tstatic resetConfig() {\n\t\tLogService.config = undefined;\n\t}\n}\n\nexport { LogService };\n"],"mappings":";;AAQA,IAAM,IAAN,MAAM,EAAW;CAChB,OAAe;CAYf,OAAe,iBAAiB,GAAmB;EAElD,OADI,EAAI,aAAa,WAAiB,KAC/B,EAAI,aAAa,eAAe,EAAI,aAAa;CACzD;CAeA,OAAO,UAAU,GAIR;EACR,IAAI,EAAW,QAAQ;EAEvB,IAAM,EAAE,oBAAiB,cAAW,qBAAkB,GAClD,IAAwB;EAE5B,IAAI,GACH,IAAI;GACH,IAAM,IAAY,IAAI,IAAI,CAAa;GAEvC,AAAI,EAAW,iBAAiB,CAAS,IACxC,IAAS,GAAG,EAAc,eAE1B,EAAe;IACd,MAAM;IACN,QAAQ;IACR,QAAQ,CACP,2BAA2B,EAAc,4FAC1C;GACD,CAAC;EAEH,QAAQ;GACP,EAAe;IACd,MAAM;IACN,QAAQ;IACR,QAAQ,CACP,0BAA0B,EAAc,4BACzC;GACD,CAAC;EACF;EAGD,EAAW,SAAS;GAAE;GAAiB;GAAW;EAAO;CAC1D;CAGA,OAAO,YAEM;EACZ,OAAO,EAAW;CACnB;CAKA,OAAO,cAAc;EACpB,EAAW,SAAS,KAAA;CACrB;AACD"}
+{"version":3,"file":"logService.js","names":[],"sources":["../../../src/services/logService.ts"],"sourcesContent":["import { flushDebugLogs } from \"../utilities/flushDebugLogs\";\n\n/**\n * Static service for log endpoint configuration and access.\n *\n * Stores a singleton configuration containing the traffic source identifier,\n * service token, and log ingestion URL.\n *\n * `serviceToken` authenticates *this application* to the Arkyn log ingestion\n * API — it is a static, application-level credential (e.g. an env var),\n * the same for every request. It is **not** an end-user/session token:\n * because `setConfig` is a singleton that only applies on its first call\n * (see below), passing a per-request value (like `session.token`) here\n * would permanently leak whichever request happened to call `setConfig`\n * first to every other request's outbound telemetry for the lifetime of\n * the process. Call `setConfig` once, at application boot, outside of any\n * request handler.\n */\nclass LogService {\n\tprivate static config?: {\n\t\ttrafficSourceId: string;\n\t\tserviceToken: string;\n\t\tapiUrl: string | null;\n\t};\n\n\t/**\n\t * Checks whether a log ingestion URL is safe to send telemetry to: `https://`\n\t * is always accepted, and plain `http://` is only accepted for local development\n\t * (`localhost` / `127.0.0.1`). Every other `http://` destination is rejected so\n\t * request/response data is never transmitted in plaintext over the network.\n\t */\n\tprivate static isSecureEndpoint(url: URL): boolean {\n\t\tif (url.protocol === \"https:\") return true;\n\t\treturn url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\";\n\t}\n\n\t/**\n\t * Sets the log service configuration once. Subsequent calls are ignored\n\t * (a warning is logged in development/debug mode so accidental\n\t * per-request reconfiguration attempts — e.g. calling this from inside a\n\t * request handler — aren't silently swallowed during development).\n\t *\n\t * There is no hardcoded fallback endpoint: if `logBaseApiUrl` is omitted, invalid,\n\t * or points at an insecure (`http://`) non-local destination, remote log delivery\n\t * is disabled (`getConfig().apiUrl` is `null`) instead of silently sending data to\n\t * a default/insecure host — `logRequest` skips the network call in that case.\n\t *\n\t * @param config.trafficSourceId - Traffic source identifier.\n\t * @param config.serviceToken - Static, application-level credential used to\n\t * authenticate to the Arkyn log ingestion API. Must be the same value for every\n\t * request (e.g. sourced from an env var) — never an end-user/session token.\n\t * @param config.userToken - @deprecated Alias for `serviceToken`, kept for\n\t * backward compatibility. Using this name for a per-request/session value is\n\t * unsafe: `setConfig` is a singleton, so only the first call's value is kept.\n\t * @param config.logBaseApiUrl - Log ingestion base URL. Must be `https://`, or\n\t * `http://localhost`/`http://127.0.0.1` for local development.\n\t */\n\tstatic setConfig(config: {\n\t\ttrafficSourceId: string;\n\t\tserviceToken?: string;\n\t\t/** @deprecated Use `serviceToken` instead. */\n\t\tuserToken?: string;\n\t\tlogBaseApiUrl?: string;\n\t}): void {\n\t\tif (LogService.config) {\n\t\t\tflushDebugLogs({\n\t\t\t\tname: \"LogServiceError\",\n\t\t\t\tscheme: \"yellow\",\n\t\t\t\tdebugs: [\n\t\t\t\t\t\"LogService.setConfig() was already called and is a singleton — this call was ignored. \" +\n\t\t\t\t\t\t\"Call setConfig() once at application boot, never inside a request handler \" +\n\t\t\t\t\t\t\"(a per-request value would only ever apply to the first request that reaches it).\",\n\t\t\t\t],\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\n\t\tconst { trafficSourceId, logBaseApiUrl } = config;\n\t\tconst serviceToken = config.serviceToken ?? config.userToken;\n\n\t\tif (config.userToken !== undefined && config.serviceToken === undefined) {\n\t\t\tflushDebugLogs({\n\t\t\t\tname: \"LogServiceError\",\n\t\t\t\tscheme: \"yellow\",\n\t\t\t\tdebugs: [\n\t\t\t\t\t'LogService.setConfig({ userToken }) is deprecated — use \"serviceToken\" instead. ' +\n\t\t\t\t\t\t\"It must be a static, application-level credential, not a per-user/session value.\",\n\t\t\t\t],\n\t\t\t});\n\t\t}\n\n\t\tif (!serviceToken) {\n\t\t\tthrow new Error(\n\t\t\t\t\"LogService.setConfig() requires a serviceToken (or the deprecated userToken alias).\",\n\t\t\t);\n\t\t}\n\n\t\tlet apiUrl: string | null = null;\n\n\t\tif (logBaseApiUrl) {\n\t\t\ttry {\n\t\t\t\tconst parsedUrl = new URL(logBaseApiUrl);\n\n\t\t\t\tif (LogService.isSecureEndpoint(parsedUrl)) {\n\t\t\t\t\tapiUrl = `${logBaseApiUrl}/ingest-log`;\n\t\t\t\t} else {\n\t\t\t\t\tflushDebugLogs({\n\t\t\t\t\t\tname: \"LogServiceError\",\n\t\t\t\t\t\tscheme: \"red\",\n\t\t\t\t\t\tdebugs: [\n\t\t\t\t\t\t\t`Insecure logBaseApiUrl \"${logBaseApiUrl}\" rejected: use https://, or http:// only for localhost/127.0.0.1. Remote logging disabled.`,\n\t\t\t\t\t\t],\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\tflushDebugLogs({\n\t\t\t\t\tname: \"LogServiceError\",\n\t\t\t\t\tscheme: \"red\",\n\t\t\t\t\tdebugs: [\n\t\t\t\t\t\t`Invalid logBaseApiUrl \"${logBaseApiUrl}\". Remote logging disabled.`,\n\t\t\t\t\t],\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\tLogService.config = { trafficSourceId, serviceToken, apiUrl };\n\t}\n\n\t/** Returns the stored configuration, or `undefined` if `setConfig` has not been called. */\n\tstatic getConfig():\n\t\t| { trafficSourceId: string; serviceToken: string; apiUrl: string | null }\n\t\t| undefined {\n\t\treturn LogService.config;\n\t}\n\n\t/**\n\t * Resets the stored configuration, allowing a new initialization.\n\t */\n\tstatic resetConfig() {\n\t\tLogService.config = undefined;\n\t}\n}\n\nexport { LogService };\n"],"mappings":";;AAkBA,IAAM,IAAN,MAAM,EAAW;CAChB,OAAe;CAYf,OAAe,iBAAiB,GAAmB;EAElD,OADI,EAAI,aAAa,WAAiB,KAC/B,EAAI,aAAa,eAAe,EAAI,aAAa;CACzD;CAuBA,OAAO,UAAU,GAMR;EACR,IAAI,EAAW,QAAQ;GACtB,EAAe;IACd,MAAM;IACN,QAAQ;IACR,QAAQ,CACP,mPAGD;GACD,CAAC;GACD;EACD;EAEA,IAAM,EAAE,oBAAiB,qBAAkB,GACrC,IAAe,EAAO,gBAAgB,EAAO;EAanD,IAXI,EAAO,cAAc,KAAA,KAAa,EAAO,iBAAiB,KAAA,KAC7D,EAAe;GACd,MAAM;GACN,QAAQ;GACR,QAAQ,CACP,oKAED;EACD,CAAC,GAGE,CAAC,GACJ,MAAU,MACT,qFACD;EAGD,IAAI,IAAwB;EAE5B,IAAI,GACH,IAAI;GACH,IAAM,IAAY,IAAI,IAAI,CAAa;GAEvC,AAAI,EAAW,iBAAiB,CAAS,IACxC,IAAS,GAAG,EAAc,eAE1B,EAAe;IACd,MAAM;IACN,QAAQ;IACR,QAAQ,CACP,2BAA2B,EAAc,4FAC1C;GACD,CAAC;EAEH,QAAQ;GACP,EAAe;IACd,MAAM;IACN,QAAQ;IACR,QAAQ,CACP,0BAA0B,EAAc,4BACzC;GACD,CAAC;EACF;EAGD,EAAW,SAAS;GAAE;GAAiB;GAAc;EAAO;CAC7D;CAGA,OAAO,YAEM;EACZ,OAAO,EAAW;CACnB;CAKA,OAAO,cAAc;EACpB,EAAW,SAAS,KAAA;CACrB;AACD"}

package/dist/modules/utilities/withSecurityHeaders.js

@@ -0,0 +1,18 @@
+//#region src/utilities/withSecurityHeaders.ts
+var e = {
+	"X-Content-Type-Options": "nosniff",
+	"X-Frame-Options": "DENY",
+	"Referrer-Policy": "strict-origin-when-cross-origin"
+};
+function t(t, n) {
+	let r = {
+		...e,
+		...n
+	};
+	for (let [e, n] of Object.entries(r)) n === null ? t.headers.delete(e) : t.headers.set(e, n);
+	return t;
+}
+//#endregion
+export { t as withSecurityHeaders };
+
+//# sourceMappingURL=withSecurityHeaders.js.map

package/dist/modules/utilities/withSecurityHeaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"withSecurityHeaders.js","names":[],"sources":["../../../src/utilities/withSecurityHeaders.ts"],"sourcesContent":["const DEFAULT_SECURITY_HEADERS: Record<string, string> = {\n\t\"X-Content-Type-Options\": \"nosniff\",\n\t\"X-Frame-Options\": \"DENY\",\n\t\"Referrer-Policy\": \"strict-origin-when-cross-origin\",\n};\n\ntype SecurityHeaderOverrides = Record<string, string | null>;\n\n/**\n * Adds a small set of standard security headers to a `Response`, mutating and\n * returning the same instance (`Response.headers` is mutable for responses\n * constructed via `new Response()`/`Response.json()`, which is what every\n * `@arkyn/server` response class produces).\n *\n * Opt-in only — nothing in `@arkyn/server` calls this automatically, so it\n * never changes behavior for existing consumers unless they call it\n * themselves, e.g. `return withSecurityHeaders(new Success(...).toResponse())`.\n *\n * Defaults applied (each can be replaced or removed via `overrides` — see below):\n * - `X-Content-Type-Options: nosniff`\n * - `X-Frame-Options: DENY`\n * - `Referrer-Policy: strict-origin-when-cross-origin`\n *\n * `Content-Security-Policy` and `Strict-Transport-Security` are intentionally\n * **not** included by default: a wrong CSP can break an app's own scripts/styles,\n * and HSTS assumes HTTPS is already correctly configured — both are too\n * app-specific to guess safely. Pass them via `overrides` if you want them.\n *\n * @param response - The `Response` to add headers to.\n * @param overrides - Per-header customization: a string sets/replaces that\n * header (works for the defaults above or any other header, e.g. `Content-Security-Policy`);\n * `null` removes a default instead of applying it.\n * @returns The same `Response` instance, for chaining.\n *\n * @example\n * ```typescript\n * import { Success, withSecurityHeaders } from \"@arkyn/server\";\n *\n * export async function loader() {\n *   return withSecurityHeaders(new Success(\"OK\", { data }).toResponse());\n * }\n *\n * // Disable one default, add a CSP\n * withSecurityHeaders(response, {\n *   \"X-Frame-Options\": null,\n *   \"Content-Security-Policy\": \"default-src 'self'\",\n * });\n * ```\n */\nfunction withSecurityHeaders(\n\tresponse: Response,\n\toverrides?: SecurityHeaderOverrides,\n): Response {\n\tconst merged = { ...DEFAULT_SECURITY_HEADERS, ...overrides };\n\n\tfor (const [name, value] of Object.entries(merged)) {\n\t\tif (value === null) response.headers.delete(name);\n\t\telse response.headers.set(name, value);\n\t}\n\n\treturn response;\n}\n\nexport { withSecurityHeaders };\n"],"mappings":";AAAA,IAAM,IAAmD;CACxD,0BAA0B;CAC1B,mBAAmB;CACnB,mBAAmB;AACpB;AA6CA,SAAS,EACR,GACA,GACW;CACX,IAAM,IAAS;EAAE,GAAG;EAA0B,GAAG;CAAU;CAE3D,KAAK,IAAM,CAAC,GAAM,MAAU,OAAO,QAAQ,CAAM,GAChD,AAAI,MAAU,OAAM,EAAS,QAAQ,OAAO,CAAI,IAC3C,EAAS,QAAQ,IAAI,GAAM,CAAK;CAGtC,OAAO;AACR"}

package/dist/modules/validations/validateDate.js

@@ -3,21 +3,11 @@ import { ValidateDateService as e } from "@arkyn/shared";
 function t(t, n) {
 	let r = n?.inputFormat || "brazilianDate", i = n?.minYear || 1900, a = n?.maxYear || 3e3, o = new e();
 	o.validateInputFormat(r);
-	let s, c, l, u = t.split(/[-/]/).map(Number);
-	if (u.length !== 3) return !1;
+	let s = t.split(/[-/]/).map(Number);
+	if (s.length !== 3) return !1;
 	try {
-		switch (r) {
-			case "brazilianDate":
-				[s, c, l] = u, o.validateDateParts(l, c, s);
-				break;
-			case "isoDate":
-				[c, s, l] = u, o.validateDateParts(l, c, s);
-				break;
-			case "timestamp":
-				[l, c, s] = u, o.validateDateParts(l, c, s);
-				break;
-		}
-		return !(l < i || l > a);
+		let { year: e } = o.parseDateParts(s, r);
+		return !(e < i || e > a);
 	} catch {
 		return !1;
 	}

package/dist/modules/validations/validateDate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateDate.js","names":[],"sources":["../../../src/validations/validateDate.ts"],"sourcesContent":["import { ValidateDateService } from \"@arkyn/shared\";\n\n/**\n * Validates a date string against a format and optional year bounds.\n *\n * @param date - The date string to validate.\n * @param config.inputFormat - Parsing format: `\"brazilianDate\"` (DD/MM/YYYY, default), `\"isoDate\"` (MM-DD-YYYY), or `\"timestamp\"` (YYYY-MM-DD).\n * @param config.minYear - Minimum allowed year. Defaults to 1900.\n * @param config.maxYear - Maximum allowed year. Defaults to 3000.\n * @returns `true` if the date is valid according to the format and bounds, otherwise `false`.\n *\n * @example\n * ```typescript\n * validateDate(\"31/12/2023\"); // true\n * validateDate(\"2023-12-31\", { inputFormat: \"timestamp\", minYear: 2000, maxYear: 2100 }); // true\n * validateDate(\"29/02/2023\"); // false (not a leap year)\n * ```\n */\n\nfunction validateDate(\n\tdate: string,\n\tconfig?: {\n\t\tinputFormat?: \"brazilianDate\" | \"isoDate\" | \"timestamp\";\n\t\tminYear?: number;\n\t\tmaxYear?: number;\n\t},\n): boolean {\n\tconst inputFormat = config?.inputFormat || \"brazilianDate\";\n\tconst minYear = config?.minYear || 1900;\n\tconst maxYear = config?.maxYear || 3000;\n\n\tconst validateDateService = new ValidateDateService();\n\tvalidateDateService.validateInputFormat(inputFormat);\n\n\tlet day: number, month: number, year: number;\n\tconst dateParts = date.split(/[-/]/).map(Number);\n\n\tif (dateParts.length !== 3) return false;\n\n\ttry {\n\t\tswitch (inputFormat) {\n\t\t\tcase \"brazilianDate\":\n\t\t\t\t[day, month, year] = dateParts;\n\t\t\t\tvalidateDateService.validateDateParts(year, month, day);\n\t\t\t\tbreak;\n\t\t\tcase \"isoDate\":\n\t\t\t\t[month, day, year] = dateParts;\n\t\t\t\tvalidateDateService.validateDateParts(year, month, day);\n\t\t\t\tbreak;\n\t\t\tcase \"timestamp\":\n\t\t\t\t[year, month, day] = dateParts;\n\t\t\t\tvalidateDateService.validateDateParts(year, month, day);\n\t\t\t\tbreak;\n\t\t}\n\t\tif (year < minYear || year > maxYear) return false;\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport { validateDate };\n"],"mappings":";;AAmBA,SAAS,EACR,GACA,GAKU;CACV,IAAM,IAAc,GAAQ,eAAe,iBACrC,IAAU,GAAQ,WAAW,MAC7B,IAAU,GAAQ,WAAW,KAE7B,IAAsB,IAAI,EAAoB;CACpD,EAAoB,oBAAoB,CAAW;CAEnD,IAAI,GAAa,GAAe,GAC1B,IAAY,EAAK,MAAM,MAAM,CAAC,CAAC,IAAI,MAAM;CAE/C,IAAI,EAAU,WAAW,GAAG,OAAO;CAEnC,IAAI;EACH,QAAQ,GAAR;GACC,KAAK;IAEJ,AADA,CAAC,GAAK,GAAO,KAAQ,GACrB,EAAoB,kBAAkB,GAAM,GAAO,CAAG;IACtD;GACD,KAAK;IAEJ,AADA,CAAC,GAAO,GAAK,KAAQ,GACrB,EAAoB,kBAAkB,GAAM,GAAO,CAAG;IACtD;GACD,KAAK;IAEJ,AADA,CAAC,GAAM,GAAO,KAAO,GACrB,EAAoB,kBAAkB,GAAM,GAAO,CAAG;IACtD;EACF;EAEA,OADA,EAAI,IAAO,KAAW,IAAO;CAE9B,QAAQ;EACP,OAAO;CACR;AACD"}
+{"version":3,"file":"validateDate.js","names":[],"sources":["../../../src/validations/validateDate.ts"],"sourcesContent":["import { type DateInputFormat, ValidateDateService } from \"@arkyn/shared\";\n\n/**\n * Validates a date string against a format and optional year bounds.\n *\n * @param date - The date string to validate.\n * @param config.inputFormat - Parsing format: `\"brazilianDate\"` (DD/MM/YYYY, default), `\"usDate\"` (MM-DD-YYYY), `\"isoDate\"` (deprecated misnamed alias for `\"usDate\"` — not actually ISO 8601), or `\"timestamp\"` (YYYY-MM-DD, the actual ISO 8601 date format).\n * @param config.minYear - Minimum allowed year. Defaults to 1900.\n * @param config.maxYear - Maximum allowed year. Defaults to 3000.\n * @returns `true` if the date is valid according to the format and bounds, otherwise `false`.\n *\n * @example\n * ```typescript\n * validateDate(\"31/12/2023\"); // true\n * validateDate(\"2023-12-31\", { inputFormat: \"timestamp\", minYear: 2000, maxYear: 2100 }); // true\n * validateDate(\"29/02/2023\"); // false (not a leap year)\n * ```\n */\n\nfunction validateDate(\n\tdate: string,\n\tconfig?: {\n\t\tinputFormat?: DateInputFormat;\n\t\tminYear?: number;\n\t\tmaxYear?: number;\n\t},\n): boolean {\n\tconst inputFormat = config?.inputFormat || \"brazilianDate\";\n\tconst minYear = config?.minYear || 1900;\n\tconst maxYear = config?.maxYear || 3000;\n\n\tconst validateDateService = new ValidateDateService();\n\tvalidateDateService.validateInputFormat(inputFormat);\n\n\tconst dateParts = date.split(/[-/]/).map(Number);\n\n\tif (dateParts.length !== 3) return false;\n\n\ttry {\n\t\tconst { year } = validateDateService.parseDateParts(dateParts, inputFormat);\n\t\tif (year < minYear || year > maxYear) return false;\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport { validateDate };\n"],"mappings":";;AAmBA,SAAS,EACR,GACA,GAKU;CACV,IAAM,IAAc,GAAQ,eAAe,iBACrC,IAAU,GAAQ,WAAW,MAC7B,IAAU,GAAQ,WAAW,KAE7B,IAAsB,IAAI,EAAoB;CACpD,EAAoB,oBAAoB,CAAW;CAEnD,IAAM,IAAY,EAAK,MAAM,MAAM,CAAC,CAAC,IAAI,MAAM;CAE/C,IAAI,EAAU,WAAW,GAAG,OAAO;CAEnC,IAAI;EACH,IAAM,EAAE,YAAS,EAAoB,eAAe,GAAW,CAAW;EAE1E,OADA,EAAI,IAAO,KAAW,IAAO;CAE9B,QAAQ;EACP,OAAO;CACR;AACD"}

package/dist/services/apiService.d.ts

@@ -7,17 +7,21 @@ type ApiServiceConstructorProps = {
     baseToken?: string | null;
     /** When `true`, logs each request and response to the console in development. */
     enableDebug?: boolean;
+    /** Default request timeout in ms; can be overridden per request via `data.timeoutMs`. */
+    timeoutMs?: number;
 };
 type ApiRequestDataWithoutBodyProps = {
     headers?: HeadersInit;
     token?: string;
     urlParams?: Record<string, string>;
+    timeoutMs?: number;
 };
 type ApiRequestDataWithBodyProps = {
     body?: any;
     headers?: HeadersInit;
     token?: string;
     urlParams?: Record<string, string>;
+    timeoutMs?: number;
 };
 /**
  * HTTP client for external API calls. Wraps fetch with base URL, default headers, optional auth token,
@@ -40,6 +44,7 @@ declare class ApiService {
     private baseHeaders?;
     private baseToken?;
     private enableDebug?;
+    private timeoutMs?;
     constructor(props: ApiServiceConstructorProps);
     /**
      * Converts a `HeadersInit` value into a plain object so it can be safely

package/dist/services/apiService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiService.d.ts","sourceRoot":"","sources":["../../src/services/apiService.ts"],"names":[],"mappings":"AASA,KAAK,0BAA0B,GAAG;IACjC,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,KAAK,8BAA8B,GAAG;IACrC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC,CAAC;AAEF,KAAK,2BAA2B,GAAG;IAElC,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC,CAAC;AAUF;;;;;;;;;;;;;;;GAeG;AACH,cAAM,UAAU;IACf,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,WAAW,CAAC,CAAU;gBAElB,KAAK,EAAE,0BAA0B;IAO7C;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAM7B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAI7B,OAAO,CAAC,OAAO;IAoBf,OAAO,CAAC,eAAe;IAcvB;;;;;OAKG;IAEG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,8BAA8B;IAkBjE;;;;;OAKG;IAEG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,2BAA2B;IAqB/D;;;;;OAKG;IAEG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,2BAA2B;IAqB9D;;;;;OAKG;IAEG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,2BAA2B;IAqBhE;;;;;OAKG;IAEG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,2BAA2B;CAoBjE;AAED,OAAO,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"apiService.d.ts","sourceRoot":"","sources":["../../src/services/apiService.ts"],"names":[],"mappings":"AASA,KAAK,0BAA0B,GAAG;IACjC,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,8BAA8B,GAAG;IACrC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,2BAA2B,GAAG;IAElC,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAUF;;;;;;;;;;;;;;;GAeG;AACH,cAAM,UAAU;IACf,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,WAAW,CAAC,CAAU;IAC9B,OAAO,CAAC,SAAS,CAAC,CAAS;gBAEf,KAAK,EAAE,0BAA0B;IAQ7C;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAM7B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAI7B,OAAO,CAAC,OAAO;IAoBf,OAAO,CAAC,eAAe;IAcvB;;;;;OAKG;IAEG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,8BAA8B;IAmBjE;;;;;OAKG;IAEG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,2BAA2B;IAsB/D;;;;;OAKG;IAEG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,2BAA2B;IAsB9D;;;;;OAKG;IAEG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,2BAA2B;IAsBhE;;;;;OAKG;IAEG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,2BAA2B;CAqBjE;AAED,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/services/logService.d.ts

@@ -2,7 +2,17 @@
  * Static service for log endpoint configuration and access.
  *
  * Stores a singleton configuration containing the traffic source identifier,
- * user token, and log ingestion URL.
+ * service token, and log ingestion URL.
+ *
+ * `serviceToken` authenticates *this application* to the Arkyn log ingestion
+ * API — it is a static, application-level credential (e.g. an env var),
+ * the same for every request. It is **not** an end-user/session token:
+ * because `setConfig` is a singleton that only applies on its first call
+ * (see below), passing a per-request value (like `session.token`) here
+ * would permanently leak whichever request happened to call `setConfig`
+ * first to every other request's outbound telemetry for the lifetime of
+ * the process. Call `setConfig` once, at application boot, outside of any
+ * request handler.
  */
 declare class LogService {
     private static config?;
@@ -14,7 +24,10 @@ declare class LogService {
      */
     private static isSecureEndpoint;
     /**
-     * Sets the log service configuration once. Subsequent calls are ignored.
+     * Sets the log service configuration once. Subsequent calls are ignored
+     * (a warning is logged in development/debug mode so accidental
+     * per-request reconfiguration attempts — e.g. calling this from inside a
+     * request handler — aren't silently swallowed during development).
      *
      * There is no hardcoded fallback endpoint: if `logBaseApiUrl` is omitted, invalid,
      * or points at an insecure (`http://`) non-local destination, remote log delivery
@@ -22,19 +35,26 @@ declare class LogService {
      * a default/insecure host — `logRequest` skips the network call in that case.
      *
      * @param config.trafficSourceId - Traffic source identifier.
-     * @param config.userToken - User token for authentication.
+     * @param config.serviceToken - Static, application-level credential used to
+     * authenticate to the Arkyn log ingestion API. Must be the same value for every
+     * request (e.g. sourced from an env var) — never an end-user/session token.
+     * @param config.userToken - @deprecated Alias for `serviceToken`, kept for
+     * backward compatibility. Using this name for a per-request/session value is
+     * unsafe: `setConfig` is a singleton, so only the first call's value is kept.
      * @param config.logBaseApiUrl - Log ingestion base URL. Must be `https://`, or
      * `http://localhost`/`http://127.0.0.1` for local development.
      */
     static setConfig(config: {
         trafficSourceId: string;
-        userToken: string;
+        serviceToken?: string;
+        /** @deprecated Use `serviceToken` instead. */
+        userToken?: string;
         logBaseApiUrl?: string;
     }): void;
     /** Returns the stored configuration, or `undefined` if `setConfig` has not been called. */
     static getConfig(): {
         trafficSourceId: string;
-        userToken: string;
+        serviceToken: string;
         apiUrl: string | null;
     } | undefined;
     /**

package/dist/services/logService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logService.d.ts","sourceRoot":"","sources":["../../src/services/logService.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,cAAM,UAAU;IACf,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAIpB;IAEF;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAK/B;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE;QACxB,eAAe,EAAE,MAAM,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,IAAI;IAmCR,2FAA2F;IAC3F,MAAM,CAAC,SAAS,IACb;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACrE,SAAS;IAIZ;;OAEG;IACH,MAAM,CAAC,WAAW;CAGlB;AAED,OAAO,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"logService.d.ts","sourceRoot":"","sources":["../../src/services/logService.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,cAAM,UAAU;IACf,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAIpB;IAEF;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAK/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE;QACxB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,8CAA8C;QAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,IAAI;IAiER,2FAA2F;IAC3F,MAAM,CAAC,SAAS,IACb;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACxE,SAAS;IAIZ;;OAEG;IACH,MAAM,CAAC,WAAW;CAGlB;AAED,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/utilities/withSecurityHeaders.d.ts

@@ -0,0 +1,45 @@
+type SecurityHeaderOverrides = Record<string, string | null>;
+/**
+ * Adds a small set of standard security headers to a `Response`, mutating and
+ * returning the same instance (`Response.headers` is mutable for responses
+ * constructed via `new Response()`/`Response.json()`, which is what every
+ * `@arkyn/server` response class produces).
+ *
+ * Opt-in only — nothing in `@arkyn/server` calls this automatically, so it
+ * never changes behavior for existing consumers unless they call it
+ * themselves, e.g. `return withSecurityHeaders(new Success(...).toResponse())`.
+ *
+ * Defaults applied (each can be replaced or removed via `overrides` — see below):
+ * - `X-Content-Type-Options: nosniff`
+ * - `X-Frame-Options: DENY`
+ * - `Referrer-Policy: strict-origin-when-cross-origin`
+ *
+ * `Content-Security-Policy` and `Strict-Transport-Security` are intentionally
+ * **not** included by default: a wrong CSP can break an app's own scripts/styles,
+ * and HSTS assumes HTTPS is already correctly configured — both are too
+ * app-specific to guess safely. Pass them via `overrides` if you want them.
+ *
+ * @param response - The `Response` to add headers to.
+ * @param overrides - Per-header customization: a string sets/replaces that
+ * header (works for the defaults above or any other header, e.g. `Content-Security-Policy`);
+ * `null` removes a default instead of applying it.
+ * @returns The same `Response` instance, for chaining.
+ *
+ * @example
+ * ```typescript
+ * import { Success, withSecurityHeaders } from "@arkyn/server";
+ *
+ * export async function loader() {
+ *   return withSecurityHeaders(new Success("OK", { data }).toResponse());
+ * }
+ *
+ * // Disable one default, add a CSP
+ * withSecurityHeaders(response, {
+ *   "X-Frame-Options": null,
+ *   "Content-Security-Policy": "default-src 'self'",
+ * });
+ * ```
+ */
+declare function withSecurityHeaders(response: Response, overrides?: SecurityHeaderOverrides): Response;
+export { withSecurityHeaders };
+//# sourceMappingURL=withSecurityHeaders.d.ts.map

package/dist/utilities/withSecurityHeaders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withSecurityHeaders.d.ts","sourceRoot":"","sources":["../../src/utilities/withSecurityHeaders.ts"],"names":[],"mappings":"AAMA,KAAK,uBAAuB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,iBAAS,mBAAmB,CAC3B,QAAQ,EAAE,QAAQ,EAClB,SAAS,CAAC,EAAE,uBAAuB,GACjC,QAAQ,CASV;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/validations/validateDate.d.ts

@@ -1,8 +1,9 @@
+import { type DateInputFormat } from "@arkyn/shared";
 /**
  * Validates a date string against a format and optional year bounds.
  *
  * @param date - The date string to validate.
- * @param config.inputFormat - Parsing format: `"brazilianDate"` (DD/MM/YYYY, default), `"isoDate"` (MM-DD-YYYY), or `"timestamp"` (YYYY-MM-DD).
+ * @param config.inputFormat - Parsing format: `"brazilianDate"` (DD/MM/YYYY, default), `"usDate"` (MM-DD-YYYY), `"isoDate"` (deprecated misnamed alias for `"usDate"` — not actually ISO 8601), or `"timestamp"` (YYYY-MM-DD, the actual ISO 8601 date format).
  * @param config.minYear - Minimum allowed year. Defaults to 1900.
  * @param config.maxYear - Maximum allowed year. Defaults to 3000.
  * @returns `true` if the date is valid according to the format and bounds, otherwise `false`.
@@ -15,7 +16,7 @@
  * ```
  */
 declare function validateDate(date: string, config?: {
-    inputFormat?: "brazilianDate" | "isoDate" | "timestamp";
+    inputFormat?: DateInputFormat;
     minYear?: number;
     maxYear?: number;
 }): boolean;

package/dist/validations/validateDate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateDate.d.ts","sourceRoot":"","sources":["../../src/validations/validateDate.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH,iBAAS,YAAY,CACpB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE;IACR,WAAW,CAAC,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,GACC,OAAO,CAiCT;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"validateDate.d.ts","sourceRoot":"","sources":["../../src/validations/validateDate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAuB,MAAM,eAAe,CAAC;AAE1E;;;;;;;;;;;;;;;GAeG;AAEH,iBAAS,YAAY,CACpB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE;IACR,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,GACC,OAAO,CAmBT;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arkyn/server",
-  "version": "3.0.10",
+  "version": "3.0.12",
   "author": "Arkyn | Lucas Gonçalves",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -240,6 +240,11 @@
       "import": "./dist/modules/validations/validateRg.js",
       "types": "./dist/validations/validateRg.d.ts",
       "default": "./dist/modules/validations/validateRg.js"
+    },
+    "./withSecurityHeaders": {
+      "import": "./dist/modules/utilities/withSecurityHeaders.js",
+      "types": "./dist/utilities/withSecurityHeaders.d.ts",
+      "default": "./dist/modules/utilities/withSecurityHeaders.js"
     }
   },
   "typesVersions": {
@@ -342,6 +347,9 @@
       ],
       "validateRg": [
         "./dist/validations/validateRg.d.ts"
+      ],
+      "withSecurityHeaders": [
+        "./dist/utilities/withSecurityHeaders.d.ts"
       ]
     }
   }