@getstrata/core 0.5.100 → 0.7.3

package/dist/entries/database/repositoryQuery.js

@@ -1,10 +1,11 @@
 // @bun
 // ../../src/core/database/query.ts
+import { currentSqlDialect } from "@getstrata/core/database/dialect";
 function quoteIdentifier(identifier) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
-    throw new Error(`Invalid SQL identifier: ${identifier}`);
-  }
-  return `"${identifier}"`;
+  return currentSqlDialect().quoteIdentifier(identifier);
+}
+function returningSuffix(columns) {
+  return currentSqlDialect().returningClause(columns);
 }
 function qualifyColumn(tableName, column) {
   return `${quoteIdentifier(tableName)}.${quoteIdentifier(column)}`;
@@ -34,7 +35,7 @@ function isQueryOperator(value) {
 }
 function pushParam(values, value) {
   values.push(value);
-  return `$${values.length}`;
+  return currentSqlDialect().placeholder(values.length);
 }
 function buildInClause(column, values, params) {
   if (values.length === 0) {
@@ -74,9 +75,12 @@ function buildOperatorClauses(column, operator, params) {
     clauses.push(`${column} <= ${pushParam(params, operator.lte)}`);
   }
   if (operator.ilike !== undefined) {
-    clauses.push(`${column} ILIKE ${pushParam(params, operator.ilike)}`);
+    clauses.push(`${column} ${currentSqlDialect().ilikeOperator()} ${pushParam(params, operator.ilike)}`);
   }
   if (operator.tsMatch !== undefined) {
+    if (currentSqlDialect().driver !== "pgsql") {
+      throw new Error("Full-text search (tsMatch) is only available on PostgreSQL.");
+    }
     clauses.push(`${column} @@ plainto_tsquery('english', ${pushParam(params, operator.tsMatch)})`);
   }
   return clauses;
@@ -275,7 +279,7 @@ function buildSelectList(table, select, params = []) {
       return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
     }
     if (item.kind === "literalText") {
-      return `${pushParam(params, item.value)}::text AS ${quoteIdentifier(item.as)}`;
+      return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
     }
     const column = qualifyColumn(item.table, item.column);
     const placeholder = pushParam(params, item.query);
@@ -367,7 +371,7 @@ function buildInsertQuery(table, values) {
   const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
   const returningColumns = buildReturningColumns(table);
   return {
-    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders}) RETURNING ${returningColumns}`,
+    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders})${returningSuffix(returningColumns)}`,
     params
   };
 }
@@ -386,7 +390,7 @@ function buildUpdateQuery(table, id, changes) {
   appendSoftDeleteScope(table, {}, scopeClauses);
   const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
   return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix} RETURNING ${returningColumns}`,
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
     params
   };
 }
@@ -399,9 +403,12 @@ function buildSoftDeleteByIdQuery(table, id, deletedAt) {
   const scopeClauses = [];
   appendSoftDeleteScope(table, {}, scopeClauses);
   const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  const params = [];
+  const deletedAtPlaceholder = pushParam(params, deletedAt);
+  const idPlaceholder = pushParam(params, id);
   return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2${scopeSuffix} RETURNING ${returningColumns}`,
-    params: [deletedAt, id]
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = ${deletedAtPlaceholder} WHERE ${quoteIdentifier(table.primaryKey)} = ${idPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
+    params
   };
 }
 function buildRestoreByIdQuery(table, id) {
@@ -410,15 +417,21 @@ function buildRestoreByIdQuery(table, id) {
     throw new Error(`Table ${table.name} does not support soft deletes.`);
   }
   const returningColumns = buildReturningColumns(table);
+  const params = [];
+  const deletedAtPlaceholder = pushParam(params, null);
+  const idPlaceholder = pushParam(params, id);
   return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2 AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL RETURNING ${returningColumns}`,
-    params: [null, id]
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = ${deletedAtPlaceholder} WHERE ${quoteIdentifier(table.primaryKey)} = ${idPlaceholder} AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL${returningSuffix(returningColumns)}`,
+    params
   };
 }
 function buildDeleteByIdQuery(table, id) {
+  const params = [];
+  const idPlaceholder = pushParam(params, id);
+  const returning = returningSuffix(`${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`);
   return {
-    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = $1 RETURNING ${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`,
-    params: [id]
+    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = ${idPlaceholder}${returning}`,
+    params
   };
 }
 
@@ -441,6 +454,13 @@ function belongsTo(definition) {
     ...definition
   };
 }
+function hasManyThrough(definition) {
+  return {
+    type: "hasManyThrough",
+    throughParentKey: "__through_parent_id",
+    ...definition
+  };
+}
 function belongsToMany(definition) {
   return {
     type: "belongsToMany",
@@ -462,6 +482,19 @@ function relationMatchKey(value) {
   }
   return String(value);
 }
+var relationLookupCache = new WeakMap;
+function indexedRelationLookup(map) {
+  const cached = relationLookupCache.get(map);
+  if (cached) {
+    return cached;
+  }
+  const indexed = new Map;
+  for (const [existing, value] of map) {
+    indexed.set(relationMatchKey(existing), value);
+  }
+  relationLookupCache.set(map, indexed);
+  return indexed;
+}
 function getByRelationKey(map, key) {
   if (map.has(key)) {
     return map.get(key);
@@ -470,12 +503,7 @@ function getByRelationKey(map, key) {
   if (want === "") {
     return;
   }
-  for (const [existing, value] of map) {
-    if (relationMatchKey(existing) === want) {
-      return value;
-    }
-  }
-  return;
+  return indexedRelationLookup(map).get(want);
 }
 function indexHasManyRelation(parents, children, relation) {
   const groups = new Map;
@@ -614,6 +642,26 @@ function indexMorphOneRelation(parents, children, relation) {
   }
   return result;
 }
+function indexHasManyThroughRelation(parents, children, relation) {
+  const throughKey = relation.throughParentKey ?? "__through_parent_id";
+  const grouped = new Map;
+  for (const child of children) {
+    const key = relationMatchKey(child[throughKey]);
+    if (key === "") {
+      continue;
+    }
+    const existing = grouped.get(key) ?? [];
+    const { [throughKey]: _through, ...far } = child;
+    existing.push(far);
+    grouped.set(key, existing);
+  }
+  const result = new Map;
+  for (const parent of parents) {
+    const key = relationMatchKey(parent[relation.localKey]);
+    result.set(parent[relation.localKey], grouped.get(key) ?? []);
+  }
+  return result;
+}
 function indexMorphToRelation(children, parentsByType, relation) {
   const result = new Map;
   for (const child of children) {
@@ -797,6 +845,24 @@ class RepositoryQuery {
     });
     return this;
   }
+  withHasManyThrough(as, relation, farRepository, options = {}) {
+    this.eagerLoads.push({
+      kind: "hasManyThrough",
+      as,
+      relation,
+      repository: farRepository,
+      options
+    });
+    return this;
+  }
+  withTrashed() {
+    this.queryOptions = { ...this.queryOptions, withTrashed: true };
+    return this;
+  }
+  onlyTrashed() {
+    this.queryOptions = { ...this.queryOptions, onlyTrashed: true };
+    return this;
+  }
   async get() {
     const rows = await this.repository.findAll(this.buildOptions());
     return await this.attach(rows);
@@ -850,64 +916,67 @@ class RepositoryQuery {
     return this;
   }
   async attach(rows) {
-    if (rows.length === 0 || this.eagerLoads.length === 0) {
-      return rows.map((row) => ({ ...row }));
-    }
-    let result = rows.map((row) => ({ ...row }));
-    for (const load of this.eagerLoads) {
-      if (load.kind === "hasMany") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: getByRelationKey(grouped2, row[relation2.localKey]) ?? []
-        }));
-        continue;
+    const result = rows.map((row) => ({ ...row }));
+    if (result.length === 0 || this.eagerLoads.length === 0) {
+      return result;
+    }
+    await Promise.all(this.eagerLoads.map((load) => this.hydrateEagerLoad(rows, result, load)));
+    return result;
+  }
+  async hydrateEagerLoad(rows, result, load) {
+    if (load.kind === "hasMany") {
+      const relation2 = load.relation;
+      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation2, load.options);
+      for (const row of result) {
+        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
       }
-      if (load.kind === "morphMany") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: getByRelationKey(grouped2, row[relation2.localKey]) ?? []
-        }));
-        continue;
+      return;
+    }
+    if (load.kind === "morphMany") {
+      const relation2 = load.relation;
+      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation2, load.options);
+      for (const row of result) {
+        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
       }
-      if (load.kind === "morphOne") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: getByRelationKey(grouped2, row[relation2.localKey])
-        }));
-        continue;
+      return;
+    }
+    if (load.kind === "morphOne") {
+      const relation2 = load.relation;
+      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation2, load.options);
+      for (const row of result) {
+        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]);
       }
-      if (load.kind === "belongsToMany") {
-        const relation2 = load.relation;
-        const grouped2 = await this.repository.loadBelongsToManyForParents(rows, relation2, load.repository, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: getByRelationKey(grouped2, row[relation2.parentKey]) ?? []
-        }));
-        continue;
+      return;
+    }
+    if (load.kind === "hasManyThrough") {
+      const relation2 = load.relation;
+      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyThroughForParents(rows, relation2, load.options);
+      for (const row of result) {
+        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
       }
-      if (load.kind === "morphTo") {
-        const relation2 = load.relation;
-        const grouped2 = await this.repository.loadMorphToForChildren(rows, relation2, load.morphRepositories ?? new Map, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: getByRelationKey(grouped2, row[relation2.morphIdKey])
-        }));
-        continue;
+      return;
+    }
+    if (load.kind === "belongsToMany") {
+      const relation2 = load.relation;
+      const grouped2 = await this.repository.loadBelongsToManyForParents(rows, relation2, load.repository, load.options);
+      for (const row of result) {
+        row[load.as] = getByRelationKey(grouped2, row[relation2.parentKey]) ?? [];
       }
-      const relation = load.relation;
-      const grouped = await this.repository.loadBelongsToForParents(rows, relation, load.repository, load.options);
-      result = result.map((row) => ({
-        ...row,
-        [load.as]: getByRelationKey(grouped, row[relation.foreignKey])
-      }));
+      return;
+    }
+    if (load.kind === "morphTo") {
+      const relation2 = load.relation;
+      const grouped2 = await this.repository.loadMorphToForChildren(rows, relation2, load.morphRepositories ?? new Map, load.options);
+      for (const row of result) {
+        row[load.as] = getByRelationKey(grouped2, row[relation2.morphIdKey]);
+      }
+      return;
+    }
+    const relation = load.relation;
+    const grouped = await this.repository.loadBelongsToForParents(rows, relation, load.repository, load.options);
+    for (const row of result) {
+      row[load.as] = getByRelationKey(grouped, row[relation.foreignKey]);
     }
-    return result;
   }
 }
 export {

package/dist/entries/database/schema.js

@@ -267,11 +267,12 @@ class UnsupportedSchemaFeatureError extends Error {
   }
 }
 // ../../src/core/database/query.ts
+import { currentSqlDialect } from "@getstrata/core/database/dialect";
 function quoteIdentifier(identifier) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
-    throw new Error(`Invalid SQL identifier: ${identifier}`);
-  }
-  return `"${identifier}"`;
+  return currentSqlDialect().quoteIdentifier(identifier);
+}
+function returningSuffix(columns) {
+  return currentSqlDialect().returningClause(columns);
 }
 function qualifyColumn(tableName, column) {
   return `${quoteIdentifier(tableName)}.${quoteIdentifier(column)}`;
@@ -301,7 +302,7 @@ function isQueryOperator(value) {
 }
 function pushParam(values, value) {
   values.push(value);
-  return `$${values.length}`;
+  return currentSqlDialect().placeholder(values.length);
 }
 function buildInClause(column, values, params) {
   if (values.length === 0) {
@@ -341,9 +342,12 @@ function buildOperatorClauses(column, operator, params) {
     clauses.push(`${column} <= ${pushParam(params, operator.lte)}`);
   }
   if (operator.ilike !== undefined) {
-    clauses.push(`${column} ILIKE ${pushParam(params, operator.ilike)}`);
+    clauses.push(`${column} ${currentSqlDialect().ilikeOperator()} ${pushParam(params, operator.ilike)}`);
   }
   if (operator.tsMatch !== undefined) {
+    if (currentSqlDialect().driver !== "pgsql") {
+      throw new Error("Full-text search (tsMatch) is only available on PostgreSQL.");
+    }
     clauses.push(`${column} @@ plainto_tsquery('english', ${pushParam(params, operator.tsMatch)})`);
   }
   return clauses;
@@ -542,7 +546,7 @@ function buildSelectList(table, select, params = []) {
       return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
     }
     if (item.kind === "literalText") {
-      return `${pushParam(params, item.value)}::text AS ${quoteIdentifier(item.as)}`;
+      return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
     }
     const column = qualifyColumn(item.table, item.column);
     const placeholder = pushParam(params, item.query);
@@ -634,7 +638,7 @@ function buildInsertQuery(table, values) {
   const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
   const returningColumns = buildReturningColumns(table);
   return {
-    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders}) RETURNING ${returningColumns}`,
+    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders})${returningSuffix(returningColumns)}`,
     params
   };
 }
@@ -653,7 +657,7 @@ function buildUpdateQuery(table, id, changes) {
   appendSoftDeleteScope(table, {}, scopeClauses);
   const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
   return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix} RETURNING ${returningColumns}`,
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
     params
   };
 }
@@ -666,9 +670,12 @@ function buildSoftDeleteByIdQuery(table, id, deletedAt) {
   const scopeClauses = [];
   appendSoftDeleteScope(table, {}, scopeClauses);
   const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  const params = [];
+  const deletedAtPlaceholder = pushParam(params, deletedAt);
+  const idPlaceholder = pushParam(params, id);
   return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2${scopeSuffix} RETURNING ${returningColumns}`,
-    params: [deletedAt, id]
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = ${deletedAtPlaceholder} WHERE ${quoteIdentifier(table.primaryKey)} = ${idPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
+    params
   };
 }
 function buildRestoreByIdQuery(table, id) {
@@ -677,15 +684,21 @@ function buildRestoreByIdQuery(table, id) {
     throw new Error(`Table ${table.name} does not support soft deletes.`);
   }
   const returningColumns = buildReturningColumns(table);
+  const params = [];
+  const deletedAtPlaceholder = pushParam(params, null);
+  const idPlaceholder = pushParam(params, id);
   return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2 AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL RETURNING ${returningColumns}`,
-    params: [null, id]
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = ${deletedAtPlaceholder} WHERE ${quoteIdentifier(table.primaryKey)} = ${idPlaceholder} AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL${returningSuffix(returningColumns)}`,
+    params
   };
 }
 function buildDeleteByIdQuery(table, id) {
+  const params = [];
+  const idPlaceholder = pushParam(params, id);
+  const returning = returningSuffix(`${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`);
   return {
-    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = $1 RETURNING ${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`,
-    params: [id]
+    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = ${idPlaceholder}${returning}`,
+    params
   };
 }
 

package/dist/entries/database/sqliteConnection.js

@@ -0,0 +1,34 @@
+// @bun
+// ../../src/core/database/sqliteConnection.ts
+import { Database } from "bun:sqlite";
+function isRowReturning(sql) {
+  const upper = sql.replace(/\s+/g, " ").trim().toUpperCase();
+  if (upper.includes(" RETURNING ")) {
+    return true;
+  }
+  return upper.startsWith("SELECT") || upper.startsWith("WITH") || upper.startsWith("PRAGMA") || upper.startsWith("EXPLAIN");
+}
+function createSqliteConnection(filename) {
+  if (!filename.trim()) {
+    throw new Error("SQLite path is not configured. Pass a filename or :memory:.");
+  }
+  const db = new Database(filename, { create: true });
+  db.exec("PRAGMA foreign_keys = ON");
+  return {
+    async unsafe(query, params = []) {
+      const statement = db.query(query);
+      const args = [...params];
+      if (isRowReturning(query)) {
+        return statement.all(...args);
+      }
+      statement.run(...args);
+      return [];
+    },
+    close() {
+      db.close();
+    }
+  };
+}
+export {
+  createSqliteConnection
+};

package/dist/entries/facades.js

@@ -226,7 +226,7 @@ class LogMailDriver {
       to: message.to,
       subject: message.subject,
       body: message.body,
-      ...message.html ? { html: message.html } : {}
+      ...message.html ? { htmlBytes: Buffer.byteLength(message.html, "utf8") } : {}
     }));
   }
 }

package/dist/entries/http/contentNegotiation.js

@@ -7,6 +7,10 @@ function requestPrefersJson(request) {
   if (request.headers.get("HX-Request") === "true") {
     return false;
   }
+  const pathname = new URL(request.url).pathname;
+  if (pathname.startsWith("/api/")) {
+    return true;
+  }
   const accept = request.headers.get("accept")?.toLowerCase() ?? "";
   if (accept.includes("text/html")) {
     return false;
@@ -18,8 +22,7 @@ function requestPrefersJson(request) {
   if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
     return false;
   }
-  const pathname = new URL(request.url).pathname;
-  return pathname.startsWith("/api/");
+  return false;
 }
 export {
   requestPrefersJson

package/dist/entries/http/csrfMiddleware.js

@@ -195,6 +195,48 @@ function resolveCsrfTokenForRequest(request) {
   return resolveCsrfToken(request).token;
 }
 
+// ../../src/core/http/statelessAuth.ts
+function authorizationScheme(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  const scheme = header.split(/\s+/, 1)[0];
+  return scheme ? scheme.toLowerCase() : "";
+}
+function requestUsesHeaderCredentials(request) {
+  const scheme = authorizationScheme(request);
+  return scheme === "bearer" || scheme === "basic";
+}
+function readBearerToken(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  if (!header.toLowerCase().startsWith("bearer ")) {
+    return null;
+  }
+  const token = header.slice("Bearer ".length).trim();
+  return token.length > 0 ? token : null;
+}
+function readBasicCredentials(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  if (!header.toLowerCase().startsWith("basic ")) {
+    return null;
+  }
+  const encoded = header.slice("Basic ".length).trim();
+  if (!encoded) {
+    return null;
+  }
+  try {
+    const decoded = Buffer.from(encoded, "base64").toString("utf8");
+    const separator = decoded.indexOf(":");
+    if (separator < 0) {
+      return null;
+    }
+    return {
+      username: decoded.slice(0, separator),
+      password: decoded.slice(separator + 1)
+    };
+  } catch {
+    return null;
+  }
+}
+
 // ../../src/core/http/csrfMiddleware.ts
 var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 function appendSetCookie(response, cookie) {
@@ -208,6 +250,9 @@ function appendSetCookie(response, cookie) {
 }
 function createCsrfMiddleware() {
   return async (request, next) => {
+    if (requestUsesHeaderCredentials(request)) {
+      return await next();
+    }
     const method = request.method.toUpperCase();
     if (!MUTATING_METHODS.has(method)) {
       const csrf = resolveCsrfToken(request);