@luckystack/core 0.7.6 → 0.8.1

package/dist/{pageRouteValidation-CWkPqPW3.d.ts → pageRouteValidation-bz2LFVQq.d.ts}

@@ -113,7 +113,7 @@ declare const defaultHttpStatusForResponse: ({ status, explicitHttpStatus, fallb
  * null in token mode or when no session exists. Callers should attach the
  * returned value as the `X-CSRF-Token` request header.
  */
-declare const getCsrfToken: () => Promise<string | null>;
+declare const getCsrfToken: (origin?: string) => Promise<string | null>;
 /** Drop the cached token. Call this on logout or when a 403 csrfMismatch is seen. */
 declare const clearCsrfToken: () => void;
 /**
@@ -139,6 +139,12 @@ declare const clearCsrfToken: () => void;
  */
 declare const httpFetch: typeof fetch;
 
+type HttpMethodLiteral = 'GET' | 'POST' | 'PUT' | 'DELETE';
+type ApiMethodMap = Record<string, Record<string, Record<string, HttpMethodLiteral>>>;
+declare const registerApiMethodMap: (map: ApiMethodMap) => void;
+declare const getRegisteredApiMethod: (pagePath: string, apiName: string, version: string) => HttpMethodLiteral | undefined;
+declare const isApiMethodMapRegistered: () => boolean;
+
 interface ServiceRouteParseSuccess {
     status: 'success';
     normalizedRouteName: string;
@@ -225,12 +231,6 @@ declare const getLogger: () => Logger;
 declare const isLoggerRegistered: () => boolean;
 declare const resetLoggerForTests: () => void;
 
-type HttpMethodLiteral = 'GET' | 'POST' | 'PUT' | 'DELETE';
-type ApiMethodMap = Record<string, Record<string, Record<string, HttpMethodLiteral>>>;
-declare const registerApiMethodMap: (map: ApiMethodMap) => void;
-declare const getRegisteredApiMethod: (pagePath: string, apiName: string, version: string) => HttpMethodLiteral | undefined;
-declare const isApiMethodMapRegistered: () => boolean;
-
 interface PageRouteRules {
     /**
      * Single-character prefix that marks a folder as **invisible-parent** for

package/dist/{projectConfig-DBLSQ3NY.js → projectConfig-PB5VK5AD.js}

@@ -4,7 +4,7 @@ import {
   getProjectName,
   isProjectConfigRegistered,
   registerProjectConfig
-} from "./chunk-LTCDQU5Z.js";
+} from "./chunk-RH65K3US.js";
 export {
   DEFAULT_PROJECT_CONFIG,
   getProjectConfig,
@@ -12,4 +12,4 @@ export {
   isProjectConfigRegistered,
   registerProjectConfig
 };
-//# sourceMappingURL=projectConfig-DBLSQ3NY.js.map
+//# sourceMappingURL=projectConfig-PB5VK5AD.js.map

package/dist/{sentrySetup-MF6JSVWA.js → sentrySetup-G7NGISBY.js}

@@ -4,8 +4,8 @@ import {
   initSharedSentry,
   setSentryUser,
   startSpan
-} from "./chunk-J3UOWYT4.js";
-import "./chunk-LTCDQU5Z.js";
+} from "./chunk-I4R7DMIX.js";
+import "./chunk-RH65K3US.js";
 export {
   captureException,
   captureMessage,
@@ -13,4 +13,4 @@ export {
   setSentryUser,
   startSpan
 };
-//# sourceMappingURL=sentrySetup-MF6JSVWA.js.map
+//# sourceMappingURL=sentrySetup-G7NGISBY.js.map

package/dist/{sessionTypes-Dzen_rPK.d.ts → sessionTypes-iyUMf_pf.d.ts}

@@ -518,6 +518,16 @@ interface SyncStreamThrottleConfig {
     /** Default `field` (payload key) for emitted chunks. */
     field: string;
 }
+interface TransportConfig {
+    /**
+     * Transport used for typed API/sync invocations. Socket.io remains connected
+     * in both modes for rooms, presence, reconnect state and realtime callbacks.
+     * `'socket'` is the backwards-compatible monolith default; `'routed-http'`
+     * sends invocations over same-origin HTTP/SSE so @luckystack/router can select
+     * the service owner.
+     */
+    invocation: 'socket' | 'routed-http';
+}
 interface ApiConfig {
     /**
      * Default response timeout (ms) for `apiRequest`. After this elapses with no
@@ -696,6 +706,7 @@ interface ProjectConfig {
     http: HttpConfig;
     auth: AuthConfig;
     socket: SocketConfig;
+    transport: TransportConfig;
     api: ApiConfig;
     sync: SyncConfig;
     validation: ValidationConfig;
@@ -809,4 +820,4 @@ interface AuthProps {
     }[];
 }
 
-export { type AppConfig as A, type BaseSessionLayout as B, type CorsConfig as C, type DeepPartial as D, type HealthHashConfig as H, type Jsonify as J, type LoggingConfig as L, type OfflineQueueConfig as O, type ProjectConfig as P, type RateLimitingConfig as R, type SessionConfig as S, type ValidationConfig as V, type AuthProps as a, type SessionLocation as b, type ApiConfig as c, type AuthConfig as d, type AuthRateLimitConfig as e, DEFAULT_PROJECT_CONFIG as f, getProjectConfig as g, type DevConfig as h, isProjectConfigRegistered as i, type HttpConfig as j, type HttpStreamConfig as k, type PasswordPolicyConfig as l, type PathsConfig as m, type ProjectConfigInput as n, type RateLimitIdentity as o, type RateLimitIdentityParams as p, type SecurityHeadersConfig as q, registerProjectConfig as r, type SocketConfig as s, type SyncConfig as t, type SyncFlushPressureConfig as u, type SyncStreamThrottleConfig as v, deepMerge as w, getProjectName as x, isPlainObject as y };
+export { type AppConfig as A, type BaseSessionLayout as B, type CorsConfig as C, type DeepPartial as D, type HealthHashConfig as H, type Jsonify as J, type LoggingConfig as L, type OfflineQueueConfig as O, type ProjectConfig as P, type RateLimitingConfig as R, type SessionConfig as S, type TransportConfig as T, type ValidationConfig as V, type AuthProps as a, type SessionLocation as b, type ApiConfig as c, type AuthConfig as d, type AuthRateLimitConfig as e, DEFAULT_PROJECT_CONFIG as f, getProjectConfig as g, type DevConfig as h, isProjectConfigRegistered as i, type HttpConfig as j, type HttpStreamConfig as k, type PasswordPolicyConfig as l, type PathsConfig as m, type ProjectConfigInput as n, type RateLimitIdentity as o, type RateLimitIdentityParams as p, type SecurityHeadersConfig as q, registerProjectConfig as r, type SocketConfig as s, type SyncConfig as t, type SyncFlushPressureConfig as u, type SyncStreamThrottleConfig as v, deepMerge as w, getProjectName as x, isPlainObject as y };

package/docs/app-bootstrap.md

@@ -291,9 +291,10 @@ Returns the registered reloader, or `null` when none was supplied (watcher no-op
 
 `BOOT_KEY_PREFIX` is exported as the single source of truth so `@luckystack/router`'s `bootHandshake.ts` cannot drift.
 
-### `resolveEnvKey(): string`
+### Runtime mode versus deploy environment
 
-Returns `process.env.LUCKYSTACK_ENV` ?? `process.env.NODE_ENV` ?? `'development'`.
+- `resolveRuntimeMode()` returns the validated `NODE_ENV` application mode (`development`, `production` or `test`). `isProductionRuntime()` and `isTestRuntime()` are convenience predicates. Security, route-map, cookie and dev-tool behavior uses this axis.
+- `resolveEnvKey()` returns `process.env.LUCKYSTACK_ENV` ?? `process.env.NODE_ENV` ?? `'development'`. This is only the deploy-topology identity used by boot UUIDs, health attestation, routing and observability labels. A production process may therefore use `LUCKYSTACK_ENV=staging` without enabling development behavior.
 
 ### `writeBootUuid(envKey?: string): Promise<string>`
 

package/docs/session-types.md

@@ -158,7 +158,7 @@ export const validateInputByType = async ({
 
 **Supported type forms (validateType):**
 - Primitives: `string`, `number`, `boolean`, `true`, `false`, `null`, `undefined`, `Date` (accepts ISO string or `Date` instance).
-- String/number literal types (single-quoted or double-quoted).
+- String literal types (single-quoted or double-quoted) and finite numeric literals, including negative, decimal, exponent, hexadecimal, binary, octal, and numeric-separator forms.
 - Unions (`A | B`) — succeeds on first matching branch.
 - Intersections (`A & B`) — requires all branches to succeed.
 - Arrays (`T[]`) — checks every element.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@luckystack/core",
-  "version": "0.7.6",
+  "version": "0.8.1",
   "private": false,
   "publishConfig": {
     "access": "public",