@warlock.js/core 4.0.174 → 4.1.3

package/esm/http/middleware/maintenance.middleware.d.mts

@@ -0,0 +1,49 @@
+import { Middleware } from "../../router/types.mjs";
+//#region ../../@warlock.js/core/src/http/middleware/maintenance.middleware.d.ts
+/**
+ * Options for the maintenance middleware.
+ */
+type MaintenanceOptions = {
+  /**
+   * Path prefixes (ending in `*`) or exact paths to bypass even when
+   * maintenance is on. Falls back to `http.maintenance.allowlist`, then
+   * `["/health"]`.
+   *
+   * @example
+   * allowlist: ["/health", "/admin/*", "/webhooks/stripe"]
+   */
+  allowlist?: string[];
+  /**
+   * Seconds advertised in the `Retry-After` header. Falls back to
+   * `http.maintenance.retryAfter`, then `60`.
+   */
+  retryAfter?: number;
+  /**
+   * Override the default error message.
+   */
+  errorMessage?: string;
+};
+/**
+ * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`
+ * is true, except for paths matching the allowlist.
+ *
+ * Designed for app-wide registration via `http.middleware.all`. Toggled via
+ * config — flipping the flag requires a restart (no runtime hot-flip yet).
+ * Allowlist defaults to `["/health"]` so health checks still pass during
+ * planned downtime.
+ *
+ * @example
+ * // src/config/http.ts
+ * import { middleware } from "@warlock.js/core";
+ *
+ * export default {
+ *   maintenance: { enabled: env("MAINTENANCE_MODE") === "true" },
+ *   middleware: {
+ *     all: [middleware.maintenance({ allowlist: ["/health", "/admin/*"] })],
+ *   },
+ * };
+ */
+declare function maintenanceMiddleware(options?: MaintenanceOptions): Middleware;
+//#endregion
+export { MaintenanceOptions, maintenanceMiddleware };
+//# sourceMappingURL=maintenance.middleware.d.mts.map

package/esm/http/middleware/maintenance.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.middleware.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/maintenance.middleware.ts"],"mappings":";;;;;KAQY,kBAAA;EAAkB;;;;;;;AAkBhB;EATZ,SAAA;EA0CmC;;;;EArCnC,UAAA;EAqCuE;;AAAU;EAjCjF,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;iBAiCc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}

package/esm/http/middleware/maintenance.middleware.mjs

@@ -0,0 +1,48 @@
+import { t } from "./inject-request-context.mjs";
+import { HttpErrorCodes } from "../error-codes.mjs";
+import config from "@mongez/config";
+
+//#region ../../@warlock.js/core/src/http/middleware/maintenance.middleware.ts
+function isAllowlisted(path, patterns) {
+	return patterns.some((pattern) => {
+		if (pattern.endsWith("*")) return path.startsWith(pattern.slice(0, -1));
+		return path === pattern;
+	});
+}
+/**
+* Return 503 + `Retry-After` for every request when `http.maintenance.enabled`
+* is true, except for paths matching the allowlist.
+*
+* Designed for app-wide registration via `http.middleware.all`. Toggled via
+* config — flipping the flag requires a restart (no runtime hot-flip yet).
+* Allowlist defaults to `["/health"]` so health checks still pass during
+* planned downtime.
+*
+* @example
+* // src/config/http.ts
+* import { middleware } from "@warlock.js/core";
+*
+* export default {
+*   maintenance: { enabled: env("MAINTENANCE_MODE") === "true" },
+*   middleware: {
+*     all: [middleware.maintenance({ allowlist: ["/health", "/admin/*"] })],
+*   },
+* };
+*/
+function maintenanceMiddleware(options = {}) {
+	return (request, response) => {
+		if (!config.get("http.maintenance.enabled", false)) return;
+		const allowlist = options.allowlist || config.get("http.maintenance.allowlist", ["/health"]);
+		if (isAllowlisted(request.path, allowlist)) return;
+		const retryAfter = options.retryAfter || config.get("http.maintenance.retryAfter", 60);
+		response.header("Retry-After", retryAfter);
+		return response.serviceUnavailable({
+			error: options.errorMessage || t("http.maintenance"),
+			errorCode: "EC106"
+		});
+	};
+}
+
+//#endregion
+export { maintenanceMiddleware };
+//# sourceMappingURL=maintenance.middleware.mjs.map

package/esm/http/middleware/maintenance.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return (request, response) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist =\n      options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    if (isAllowlisted(request.path, allowlist)) return;\n\n    const retryAfter =\n      options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,SAAS,aAAa;EAG5B,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YACJ,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAE3E,IAAI,cAAc,QAAQ,MAAM,SAAS,GAAG;EAE5C,MAAM,aACJ,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAEpE,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}

package/esm/http/middleware/max-body-size.middleware.d.mts

@@ -0,0 +1,26 @@
+import { Middleware } from "../../router/types.mjs";
+//#region ../../@warlock.js/core/src/http/middleware/max-body-size.middleware.d.ts
+/**
+ * Reject requests whose `Content-Length` exceeds the configured cap.
+ *
+ * Runs before body parsing — the rejection lands as a 413 with the request
+ * body still on the wire (the server reads it to completion regardless; this
+ * just short-circuits the application stack). For genuine pre-read protection
+ * you also want `http.bodyLimit` lowered at the Fastify level — middleware
+ * is a per-route layer on top, not a replacement.
+ *
+ * @example
+ * import { middleware } from "@warlock.js/core";
+ *
+ * router.post("/comments", createCommentController, {
+ *   middleware: [middleware.maxBodySize("8kb")],
+ * });
+ *
+ * router.post("/uploads", uploadController, {
+ *   middleware: [middleware.maxBodySize("10mb")],
+ * });
+ */
+declare function maxBodySizeMiddleware(limit: string | number): Middleware;
+//#endregion
+export { maxBodySizeMiddleware };
+//# sourceMappingURL=max-body-size.middleware.d.mts.map

package/esm/http/middleware/max-body-size.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"max-body-size.middleware.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/max-body-size.middleware.ts"],"mappings":";;;;;AAyBA;;;;AAAyE;;;;;;;;;;;;;iBAAzD,qBAAA,CAAsB,KAAA,oBAAyB,UAAU"}

package/esm/http/middleware/max-body-size.middleware.mjs

@@ -0,0 +1,46 @@
+import { t } from "./inject-request-context.mjs";
+import { HttpErrorCodes } from "../error-codes.mjs";
+import { parseSize } from "./utils/parse-size.mjs";
+
+//#region ../../@warlock.js/core/src/http/middleware/max-body-size.middleware.ts
+/**
+* Reject requests whose `Content-Length` exceeds the configured cap.
+*
+* Runs before body parsing — the rejection lands as a 413 with the request
+* body still on the wire (the server reads it to completion regardless; this
+* just short-circuits the application stack). For genuine pre-read protection
+* you also want `http.bodyLimit` lowered at the Fastify level — middleware
+* is a per-route layer on top, not a replacement.
+*
+* @example
+* import { middleware } from "@warlock.js/core";
+*
+* router.post("/comments", createCommentController, {
+*   middleware: [middleware.maxBodySize("8kb")],
+* });
+*
+* router.post("/uploads", uploadController, {
+*   middleware: [middleware.maxBodySize("10mb")],
+* });
+*/
+function maxBodySizeMiddleware(limit) {
+	const limitBytes = parseSize(limit);
+	return (request, response) => {
+		const contentLengthHeader = request.header("content-length");
+		if (!contentLengthHeader) return;
+		const contentLength = Number(contentLengthHeader);
+		if (!Number.isFinite(contentLength)) return;
+		if (contentLength <= limitBytes) return;
+		response.header("Connection", "close");
+		return response.contentTooLarge({
+			error: t("http.bodyTooLarge"),
+			errorCode: "EC104",
+			limit: limitBytes,
+			received: contentLength
+		});
+	};
+}
+
+//#endregion
+export { maxBodySizeMiddleware };
+//# sourceMappingURL=max-body-size.middleware.mjs.map

package/esm/http/middleware/max-body-size.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"max-body-size.middleware.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/max-body-size.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { parseSize } from \"./utils/parse-size\";\n\n/**\n * Reject requests whose `Content-Length` exceeds the configured cap.\n *\n * Runs before body parsing — the rejection lands as a 413 with the request\n * body still on the wire (the server reads it to completion regardless; this\n * just short-circuits the application stack). For genuine pre-read protection\n * you also want `http.bodyLimit` lowered at the Fastify level — middleware\n * is a per-route layer on top, not a replacement.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/comments\", createCommentController, {\n *   middleware: [middleware.maxBodySize(\"8kb\")],\n * });\n *\n * router.post(\"/uploads\", uploadController, {\n *   middleware: [middleware.maxBodySize(\"10mb\")],\n * });\n */\nexport function maxBodySizeMiddleware(limit: string | number): Middleware {\n  const limitBytes = parseSize(limit);\n\n  return (request, response) => {\n    const contentLengthHeader = request.header(\"content-length\");\n\n    if (!contentLengthHeader) return;\n\n    const contentLength = Number(contentLengthHeader);\n\n    if (!Number.isFinite(contentLength)) return;\n\n    if (contentLength <= limitBytes) return;\n\n    response.header(\"Connection\", \"close\");\n\n    return response.contentTooLarge({\n        error: t(\"http.bodyTooLarge\"),\n        errorCode: HttpErrorCodes.BodyTooLarge,\n        limit: limitBytes,\n        received: contentLength,\n      },\n    );\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,sBAAsB,OAAoC;CACxE,MAAM,aAAa,UAAU,KAAK;CAElC,QAAQ,SAAS,aAAa;EAC5B,MAAM,sBAAsB,QAAQ,OAAO,gBAAgB;EAE3D,IAAI,CAAC,qBAAqB;EAE1B,MAAM,gBAAgB,OAAO,mBAAmB;EAEhD,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;EAErC,IAAI,iBAAiB,YAAY;EAEjC,SAAS,OAAO,cAAc,OAAO;EAErC,OAAO,SAAS,gBAAgB;GAC5B,OAAO,EAAE,mBAAmB;GAC5B;GACA,OAAO;GACP,UAAU;EACZ,CACF;CACF;AACF"}

package/esm/http/middleware/middleware-list.d.mts

@@ -0,0 +1,44 @@
+import { cacheMiddleware } from "./cache-response-middleware.mjs";
+import { concurrencyLimitMiddleware } from "./concurrency-limit.middleware.mjs";
+import { idempotencyMiddleware } from "./idempotency.middleware.mjs";
+import { ipFilterMiddleware } from "./ip-filter.middleware.mjs";
+import { maintenanceMiddleware } from "./maintenance.middleware.mjs";
+import { maxBodySizeMiddleware } from "./max-body-size.middleware.mjs";
+import { rateLimitMiddleware } from "./rate-limit.middleware.mjs";
+
+//#region ../../@warlock.js/core/src/http/middleware/middleware-list.d.ts
+/**
+ * Built-in HTTP middleware factories.
+ *
+ * Single canonical entry point for the framework's middleware suite. Each
+ * property is a factory that returns a `Middleware` ready to drop into a
+ * route's `middleware` array.
+ *
+ * Bare names (`rateLimitMiddleware`, etc.) are not exported from the package —
+ * always reach for them via this namespace. The internal `*Middleware` suffix
+ * naming exists for in-package code organization only.
+ *
+ * @example
+ * import { authMiddleware } from "@warlock.js/auth";
+ * import { middleware, router } from "@warlock.js/core";
+ *
+ * router.post("/orders", createOrderController, {
+ *   middleware: [
+ *     authMiddleware("client"),
+ *     middleware.rateLimit({ max: 5, duration: 60_000 }),
+ *     middleware.idempotency(),
+ *   ],
+ * });
+ */
+declare const middleware: {
+  readonly cache: typeof cacheMiddleware;
+  readonly concurrencyLimit: typeof concurrencyLimitMiddleware;
+  readonly idempotency: typeof idempotencyMiddleware;
+  readonly ipFilter: typeof ipFilterMiddleware;
+  readonly maintenance: typeof maintenanceMiddleware;
+  readonly maxBodySize: typeof maxBodySizeMiddleware;
+  readonly rateLimit: typeof rateLimitMiddleware;
+};
+//#endregion
+export { middleware };
+//# sourceMappingURL=middleware-list.d.mts.map

package/esm/http/middleware/middleware-list.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware-list.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/middleware-list.ts"],"mappings":";;;;;;;;;;;AA+BA;;;;;;;;;;;;;;;;;;;;;cAAa,UAAA;EAAA"}

package/esm/http/middleware/middleware-list.mjs

@@ -0,0 +1,45 @@
+import { cacheMiddleware } from "./cache-response-middleware.mjs";
+import { concurrencyLimitMiddleware } from "./concurrency-limit.middleware.mjs";
+import { idempotencyMiddleware } from "./idempotency.middleware.mjs";
+import { ipFilterMiddleware } from "./ip-filter.middleware.mjs";
+import { maintenanceMiddleware } from "./maintenance.middleware.mjs";
+import { maxBodySizeMiddleware } from "./max-body-size.middleware.mjs";
+import { rateLimitMiddleware } from "./rate-limit.middleware.mjs";
+
+//#region ../../@warlock.js/core/src/http/middleware/middleware-list.ts
+/**
+* Built-in HTTP middleware factories.
+*
+* Single canonical entry point for the framework's middleware suite. Each
+* property is a factory that returns a `Middleware` ready to drop into a
+* route's `middleware` array.
+*
+* Bare names (`rateLimitMiddleware`, etc.) are not exported from the package —
+* always reach for them via this namespace. The internal `*Middleware` suffix
+* naming exists for in-package code organization only.
+*
+* @example
+* import { authMiddleware } from "@warlock.js/auth";
+* import { middleware, router } from "@warlock.js/core";
+*
+* router.post("/orders", createOrderController, {
+*   middleware: [
+*     authMiddleware("client"),
+*     middleware.rateLimit({ max: 5, duration: 60_000 }),
+*     middleware.idempotency(),
+*   ],
+* });
+*/
+const middleware = {
+	cache: cacheMiddleware,
+	concurrencyLimit: concurrencyLimitMiddleware,
+	idempotency: idempotencyMiddleware,
+	ipFilter: ipFilterMiddleware,
+	maintenance: maintenanceMiddleware,
+	maxBodySize: maxBodySizeMiddleware,
+	rateLimit: rateLimitMiddleware
+};
+
+//#endregion
+export { middleware };
+//# sourceMappingURL=middleware-list.mjs.map

package/esm/http/middleware/middleware-list.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware-list.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/middleware-list.ts"],"sourcesContent":["import { cacheMiddleware } from \"./cache-response-middleware\";\nimport { concurrencyLimitMiddleware } from \"./concurrency-limit.middleware\";\nimport { idempotencyMiddleware } from \"./idempotency.middleware\";\nimport { ipFilterMiddleware } from \"./ip-filter.middleware\";\nimport { maintenanceMiddleware } from \"./maintenance.middleware\";\nimport { maxBodySizeMiddleware } from \"./max-body-size.middleware\";\nimport { rateLimitMiddleware } from \"./rate-limit.middleware\";\n\n/**\n * Built-in HTTP middleware factories.\n *\n * Single canonical entry point for the framework's middleware suite. Each\n * property is a factory that returns a `Middleware` ready to drop into a\n * route's `middleware` array.\n *\n * Bare names (`rateLimitMiddleware`, etc.) are not exported from the package —\n * always reach for them via this namespace. The internal `*Middleware` suffix\n * naming exists for in-package code organization only.\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware, router } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.rateLimit({ max: 5, duration: 60_000 }),\n *     middleware.idempotency(),\n *   ],\n * });\n */\nexport const middleware = {\n  cache: cacheMiddleware,\n  concurrencyLimit: concurrencyLimitMiddleware,\n  idempotency: idempotencyMiddleware,\n  ipFilter: ipFilterMiddleware,\n  maintenance: maintenanceMiddleware,\n  maxBodySize: maxBodySizeMiddleware,\n  rateLimit: rateLimitMiddleware,\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAa,aAAa;CACxB,OAAO;CACP,kBAAkB;CAClB,aAAa;CACb,UAAU;CACV,aAAa;CACb,aAAa;CACb,WAAW;AACb"}

package/esm/http/middleware/rate-limit.middleware.d.mts

@@ -0,0 +1,51 @@
+import { Request } from "../request.mjs";
+import { Middleware } from "../../router/types.mjs";
+//#region ../../@warlock.js/core/src/http/middleware/rate-limit.middleware.d.ts
+/**
+ * Options for the per-route rate limit middleware.
+ */
+type RateLimitOptions = {
+  /**
+   * Max requests allowed within the time window.
+   */
+  max: number;
+  /**
+   * Time window in milliseconds.
+   */
+  duration: number;
+  /**
+   * Group key generator. Defaults to the client IP. Override to scope per-user,
+   * per-organization, per-tenant, etc.
+   *
+   * @example
+   * keyGenerator: (request) => request.user?.id ?? request.ip,
+   */
+  keyGenerator?: (request: Request) => string;
+  /**
+   * Override the default error message.
+   */
+  errorMessage?: string;
+};
+/**
+ * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s
+ * global cap (configured via `http.rateLimit`) — both run, and either can
+ * 429. Use this for endpoints that need a tighter cap than the global default:
+ * login, OTP request, password reset, expensive search, AI completions.
+ *
+ * The counter lives in-process. With `N` replicas the effective cap is
+ * `N × max`. For genuinely shared limits, configure `@fastify/rate-limit`'s
+ * Redis store via `http.rateLimit` instead.
+ *
+ * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on
+ * every response; adds `Retry-After` (seconds) on a 429.
+ *
+ * @example
+ * import { middleware } from "@warlock.js/core";
+ * router.post("/auth/login", loginController, {
+ *   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],
+ * });
+ */
+declare function rateLimitMiddleware(options: RateLimitOptions): Middleware;
+//#endregion
+export { RateLimitOptions, rateLimitMiddleware };
+//# sourceMappingURL=rate-limit.middleware.d.mts.map

package/esm/http/middleware/rate-limit.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.middleware.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/rate-limit.middleware.ts"],"mappings":";;;;;;KAQY,gBAAA;EAAgB;;;EAI1B,GAAA;EAIA;;;EAAA,QAAA;EAYA;;AAAY;AA6Cd;;;;EAjDE,YAAA,IAAgB,OAAA,EAAS,OAAO;EAiDE;;;EA7ClC,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;iBA6Cc,mBAAA,CAAoB,OAAA,EAAS,gBAAA,GAAmB,UAAU"}

package/esm/http/middleware/rate-limit.middleware.mjs

@@ -0,0 +1,70 @@
+import { t } from "./inject-request-context.mjs";
+import { HttpErrorCodes } from "../error-codes.mjs";
+
+//#region ../../@warlock.js/core/src/http/middleware/rate-limit.middleware.ts
+const buckets = /* @__PURE__ */ new Map();
+/**
+* Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys
+* (rare per-user keys, dynamic path parameters in `keyGenerator`, etc.).
+* Called opportunistically, at most once per minute, not on a timer — keeps
+* the module side-effect-free for testing.
+*/
+let lastPruneAt = 0;
+function pruneExpired(now) {
+	for (const [key, bucket] of buckets) if (bucket.resetAt <= now) buckets.delete(key);
+}
+/**
+* Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s
+* global cap (configured via `http.rateLimit`) — both run, and either can
+* 429. Use this for endpoints that need a tighter cap than the global default:
+* login, OTP request, password reset, expensive search, AI completions.
+*
+* The counter lives in-process. With `N` replicas the effective cap is
+* `N × max`. For genuinely shared limits, configure `@fastify/rate-limit`'s
+* Redis store via `http.rateLimit` instead.
+*
+* Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on
+* every response; adds `Retry-After` (seconds) on a 429.
+*
+* @example
+* import { middleware } from "@warlock.js/core";
+* router.post("/auth/login", loginController, {
+*   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],
+* });
+*/
+function rateLimitMiddleware(options) {
+	return (request, response) => {
+		const now = Date.now();
+		if (now - lastPruneAt > 6e4) {
+			pruneExpired(now);
+			lastPruneAt = now;
+		}
+		const groupKey = options.keyGenerator?.(request) || request.detectIp() || "unknown";
+		const cacheKey = `${request.route.path}:${groupKey}`;
+		let bucket = buckets.get(cacheKey);
+		if (!bucket || bucket.resetAt <= now) {
+			bucket = {
+				count: 0,
+				resetAt: now + options.duration
+			};
+			buckets.set(cacheKey, bucket);
+		}
+		bucket.count++;
+		const remaining = Math.max(0, options.max - bucket.count);
+		const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1e3));
+		response.header("X-RateLimit-Limit", options.max);
+		response.header("X-RateLimit-Remaining", remaining);
+		response.header("X-RateLimit-Reset", Math.ceil(bucket.resetAt / 1e3));
+		if (bucket.count > options.max) {
+			response.header("Retry-After", retryAfter);
+			return response.tooManyRequests({
+				error: options.errorMessage || t("http.rateLimitExceeded"),
+				errorCode: "EC102"
+			});
+		}
+	};
+}
+
+//#endregion
+export { rateLimitMiddleware };
+//# sourceMappingURL=rate-limit.middleware.mjs.map

package/esm/http/middleware/rate-limit.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.middleware.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/middleware/rate-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the per-route rate limit middleware.\n */\nexport type RateLimitOptions = {\n  /**\n   * Max requests allowed within the time window.\n   */\n  max: number;\n  /**\n   * Time window in milliseconds.\n   */\n  duration: number;\n  /**\n   * Group key generator. Defaults to the client IP. Override to scope per-user,\n   * per-organization, per-tenant, etc.\n   *\n   * @example\n   * keyGenerator: (request) => request.user?.id ?? request.ip,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\ntype Bucket = {\n  count: number;\n  resetAt: number;\n};\n\nconst buckets = new Map<string, Bucket>();\n\n/**\n * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys\n * (rare per-user keys, dynamic path parameters in `keyGenerator`, etc.).\n * Called opportunistically, at most once per minute, not on a timer — keeps\n * the module side-effect-free for testing.\n */\nlet lastPruneAt = 0;\n\nfunction pruneExpired(now: number) {\n  for (const [key, bucket] of buckets) {\n    if (bucket.resetAt <= now) {\n      buckets.delete(key);\n    }\n  }\n}\n\n/**\n * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s\n * global cap (configured via `http.rateLimit`) — both run, and either can\n * 429. Use this for endpoints that need a tighter cap than the global default:\n * login, OTP request, password reset, expensive search, AI completions.\n *\n * The counter lives in-process. With `N` replicas the effective cap is\n * `N × max`. For genuinely shared limits, configure `@fastify/rate-limit`'s\n * Redis store via `http.rateLimit` instead.\n *\n * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on\n * every response; adds `Retry-After` (seconds) on a 429.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],\n * });\n */\nexport function rateLimitMiddleware(options: RateLimitOptions): Middleware {\n  return (request, response) => {\n    const now = Date.now();\n\n    if (now - lastPruneAt > 60_000) {\n      pruneExpired(now);\n      lastPruneAt = now;\n    }\n\n    const groupKey = options.keyGenerator?.(request) || request.detectIp() || \"unknown\";\n    const cacheKey = `${request.route.path}:${groupKey}`;\n\n    let bucket = buckets.get(cacheKey);\n\n    if (!bucket || bucket.resetAt <= now) {\n      bucket = { count: 0, resetAt: now + options.duration };\n      buckets.set(cacheKey, bucket);\n    }\n\n    bucket.count++;\n\n    const remaining = Math.max(0, options.max - bucket.count);\n    const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));\n\n    response.header(\"X-RateLimit-Limit\", options.max);\n    response.header(\"X-RateLimit-Remaining\", remaining);\n    response.header(\"X-RateLimit-Reset\", Math.ceil(bucket.resetAt / 1000));\n\n    if (bucket.count > options.max) {\n      response.header(\"Retry-After\", retryAfter);\n\n      return response.tooManyRequests({\n          error: options.errorMessage || t(\"http.rateLimitExceeded\"),\n          errorCode: HttpErrorCodes.RateLimitExceeded,\n        },\n      );\n    }\n  };\n}\n"],"mappings":";;;;AAoCA,MAAM,0BAAU,IAAI,IAAoB;;;;;;;AAQxC,IAAI,cAAc;AAElB,SAAS,aAAa,KAAa;CACjC,KAAK,MAAM,CAAC,KAAK,WAAW,SAC1B,IAAI,OAAO,WAAW,KACpB,QAAQ,OAAO,GAAG;AAGxB;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,oBAAoB,SAAuC;CACzE,QAAQ,SAAS,aAAa;EAC5B,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI,MAAM,cAAc,KAAQ;GAC9B,aAAa,GAAG;GAChB,cAAc;EAChB;EAEA,MAAM,WAAW,QAAQ,eAAe,OAAO,KAAK,QAAQ,SAAS,KAAK;EAC1E,MAAM,WAAW,GAAG,QAAQ,MAAM,KAAK,GAAG;EAE1C,IAAI,SAAS,QAAQ,IAAI,QAAQ;EAEjC,IAAI,CAAC,UAAU,OAAO,WAAW,KAAK;GACpC,SAAS;IAAE,OAAO;IAAG,SAAS,MAAM,QAAQ;GAAS;GACrD,QAAQ,IAAI,UAAU,MAAM;EAC9B;EAEA,OAAO;EAEP,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,MAAM,OAAO,KAAK;EACxD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,OAAO,GAAI,CAAC;EAEvE,SAAS,OAAO,qBAAqB,QAAQ,GAAG;EAChD,SAAS,OAAO,yBAAyB,SAAS;EAClD,SAAS,OAAO,qBAAqB,KAAK,KAAK,OAAO,UAAU,GAAI,CAAC;EAErE,IAAI,OAAO,QAAQ,QAAQ,KAAK;GAC9B,SAAS,OAAO,eAAe,UAAU;GAEzC,OAAO,SAAS,gBAAgB;IAC5B,OAAO,QAAQ,gBAAgB,EAAE,wBAAwB;IACzD;GACF,CACF;EACF;CACF;AACF"}

package/esm/http/middleware/utils/cidr-match.d.mts

@@ -0,0 +1,12 @@
+//#region ../../@warlock.js/core/src/http/middleware/utils/cidr-match.d.ts
+declare function ipMatches(ip: string, pattern: string): boolean;
+/**
+ * Returns true if `ip` matches any pattern in the list.
+ *
+ * @example
+ * anyMatch("10.0.0.5", ["192.168.0.0/16", "10.0.0.0/8"]); // true
+ */
+declare function anyMatch(ip: string, patterns: string[]): boolean;
+//#endregion
+export { anyMatch, ipMatches };
+//# sourceMappingURL=cidr-match.d.mts.map

package/esm/http/middleware/utils/cidr-match.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cidr-match.d.mts","names":[],"sources":["../../../../../../../../@warlock.js/core/src/http/middleware/utils/cidr-match.ts"],"mappings":";iBAkCgB,SAAA,CAAU,EAAA,UAAY,OAAe;AAArD;;;;AAAqD;AA0CrD;AA1CA,iBA0CgB,QAAA,CAAS,EAAA,UAAY,QAAkB"}

package/esm/http/middleware/utils/cidr-match.mjs

@@ -0,0 +1,51 @@
+//#region ../../@warlock.js/core/src/http/middleware/utils/cidr-match.ts
+/**
+* Match an IPv4 address against an exact IP or a CIDR block.
+*
+* IPv6 patterns are matched as exact-string only — full IPv6 CIDR support is
+* out of scope; ACLs in production almost always use IPv4 ranges. Add IPv6 CIDR
+* later if a real use-case appears.
+*
+* @example
+* ipMatches("10.0.0.5", "10.0.0.0/8");      // true
+* ipMatches("10.0.0.5", "10.0.0.5");        // true
+* ipMatches("192.168.1.1", "10.0.0.0/8");   // false
+*/
+function ipv4ToInt(ip) {
+	const parts = ip.split(".");
+	if (parts.length !== 4) return null;
+	let result = 0;
+	for (const part of parts) {
+		const num = Number(part);
+		if (!Number.isInteger(num) || num < 0 || num > 255) return null;
+		result = (result << 8) + num;
+	}
+	return result >>> 0;
+}
+function ipMatches(ip, pattern) {
+	if (!ip || !pattern) return false;
+	if (pattern === ip) return true;
+	if (!pattern.includes("/")) return false;
+	const [base, bitsRaw] = pattern.split("/");
+	const bits = Number(bitsRaw);
+	if (!Number.isInteger(bits) || bits < 0 || bits > 32) return false;
+	const ipInt = ipv4ToInt(ip);
+	const baseInt = ipv4ToInt(base);
+	if (ipInt === null || baseInt === null) return false;
+	if (bits === 0) return true;
+	const mask = -1 << 32 - bits >>> 0;
+	return (ipInt & mask) === (baseInt & mask);
+}
+/**
+* Returns true if `ip` matches any pattern in the list.
+*
+* @example
+* anyMatch("10.0.0.5", ["192.168.0.0/16", "10.0.0.0/8"]); // true
+*/
+function anyMatch(ip, patterns) {
+	return patterns.some((pattern) => ipMatches(ip, pattern));
+}
+
+//#endregion
+export { anyMatch, ipMatches };
+//# sourceMappingURL=cidr-match.mjs.map

package/esm/http/middleware/utils/cidr-match.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cidr-match.mjs","names":[],"sources":["../../../../../../../../@warlock.js/core/src/http/middleware/utils/cidr-match.ts"],"sourcesContent":["/**\n * Match an IPv4 address against an exact IP or a CIDR block.\n *\n * IPv6 patterns are matched as exact-string only — full IPv6 CIDR support is\n * out of scope; ACLs in production almost always use IPv4 ranges. Add IPv6 CIDR\n * later if a real use-case appears.\n *\n * @example\n * ipMatches(\"10.0.0.5\", \"10.0.0.0/8\");      // true\n * ipMatches(\"10.0.0.5\", \"10.0.0.5\");        // true\n * ipMatches(\"192.168.1.1\", \"10.0.0.0/8\");   // false\n */\nfunction ipv4ToInt(ip: string): number | null {\n  const parts = ip.split(\".\");\n\n  if (parts.length !== 4) {\n    return null;\n  }\n\n  let result = 0;\n\n  for (const part of parts) {\n    const num = Number(part);\n\n    if (!Number.isInteger(num) || num < 0 || num > 255) {\n      return null;\n    }\n\n    result = (result << 8) + num;\n  }\n\n  return result >>> 0;\n}\n\nexport function ipMatches(ip: string, pattern: string): boolean {\n  if (!ip || !pattern) {\n    return false;\n  }\n\n  if (pattern === ip) {\n    return true;\n  }\n\n  if (!pattern.includes(\"/\")) {\n    return false;\n  }\n\n  const [base, bitsRaw] = pattern.split(\"/\");\n  const bits = Number(bitsRaw);\n\n  if (!Number.isInteger(bits) || bits < 0 || bits > 32) {\n    return false;\n  }\n\n  const ipInt = ipv4ToInt(ip);\n  const baseInt = ipv4ToInt(base);\n\n  if (ipInt === null || baseInt === null) {\n    return false;\n  }\n\n  if (bits === 0) {\n    return true;\n  }\n\n  const mask = (~0 << (32 - bits)) >>> 0;\n\n  return (ipInt & mask) === (baseInt & mask);\n}\n\n/**\n * Returns true if `ip` matches any pattern in the list.\n *\n * @example\n * anyMatch(\"10.0.0.5\", [\"192.168.0.0/16\", \"10.0.0.0/8\"]); // true\n */\nexport function anyMatch(ip: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => ipMatches(ip, pattern));\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAS,UAAU,IAA2B;CAC5C,MAAM,QAAQ,GAAG,MAAM,GAAG;CAE1B,IAAI,MAAM,WAAW,GACnB,OAAO;CAGT,IAAI,SAAS;CAEb,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,OAAO,IAAI;EAEvB,IAAI,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,MAAM,KAC7C,OAAO;EAGT,UAAU,UAAU,KAAK;CAC3B;CAEA,OAAO,WAAW;AACpB;AAEA,SAAgB,UAAU,IAAY,SAA0B;CAC9D,IAAI,CAAC,MAAM,CAAC,SACV,OAAO;CAGT,IAAI,YAAY,IACd,OAAO;CAGT,IAAI,CAAC,QAAQ,SAAS,GAAG,GACvB,OAAO;CAGT,MAAM,CAAC,MAAM,WAAW,QAAQ,MAAM,GAAG;CACzC,MAAM,OAAO,OAAO,OAAO;CAE3B,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,IAChD,OAAO;CAGT,MAAM,QAAQ,UAAU,EAAE;CAC1B,MAAM,UAAU,UAAU,IAAI;CAE9B,IAAI,UAAU,QAAQ,YAAY,MAChC,OAAO;CAGT,IAAI,SAAS,GACX,OAAO;CAGT,MAAM,OAAQ,MAAO,KAAK,SAAW;CAErC,QAAQ,QAAQ,WAAW,UAAU;AACvC;;;;;;;AAQA,SAAgB,SAAS,IAAY,UAA6B;CAChE,OAAO,SAAS,MAAM,YAAY,UAAU,IAAI,OAAO,CAAC;AAC1D"}

package/esm/http/middleware/utils/idempotency-key.d.mts

@@ -0,0 +1,33 @@
+import { Request } from "../../request.mjs";
+
+//#region ../../@warlock.js/core/src/http/middleware/utils/idempotency-key.d.ts
+declare function isValidIdempotencyKey(value: unknown): value is string;
+/**
+ * Hash a request body to a stable hex digest.
+ *
+ * Used to detect "same key, different body" — that's a client bug, not a retry.
+ * sha256 is overkill for collision resistance here, but it's the dependency-free
+ * choice and avoids importing a faster hasher.
+ *
+ * @example
+ * hashBody({ amount: 100, currency: "USD" }); // "a1b2c3..."
+ */
+declare function hashBody(body: unknown): string;
+/**
+ * Build the cache key for an idempotency record.
+ *
+ * Scope is `userType:userId` when authenticated, falling back to the client IP
+ * when anonymous. This prevents user A from replaying user B's key — even if
+ * user B used a guessable value — while still letting the primitive work on
+ * public endpoints.
+ *
+ * Idempotency middleware must run **after** `authMiddleware` so `request.user`
+ * and `request.decodedAccessToken` are populated.
+ *
+ * @example
+ * buildIdempotencyCacheKey(request, "01J9XZQ-ABC"); // "idem:client:user_123:01J9XZQ-ABC"
+ */
+declare function buildIdempotencyCacheKey(request: Request, idempotencyKey: string): string;
+//#endregion
+export { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey };
+//# sourceMappingURL=idempotency-key.d.mts.map

package/esm/http/middleware/utils/idempotency-key.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency-key.d.mts","names":[],"sources":["../../../../../../../../@warlock.js/core/src/http/middleware/utils/idempotency-key.ts"],"mappings":";;;iBAcgB,qBAAA,CAAsB,KAAA,YAAiB,KAAK;;AAA5D;;;;AAA4D;AAmB5D;;;;iBAAgB,QAAA,CAAS,IAAa;AAoBtC;;;;;;;;AAAiF;;;;;;AAAjF,iBAAgB,wBAAA,CAAyB,OAAA,EAAS,OAAO,EAAE,cAAA"}

package/esm/http/middleware/utils/idempotency-key.mjs

@@ -0,0 +1,51 @@
+import { createHash } from "node:crypto";
+
+//#region ../../@warlock.js/core/src/http/middleware/utils/idempotency-key.ts
+/**
+* Idempotency-key validation rules.
+*
+* RFC draft-ietf-httpapi-idempotency-key suggests UUIDs or ULIDs but doesn't
+* mandate a format. We accept any printable ASCII string up to 255 chars —
+* tight enough to reject log-injection (no control characters / newlines),
+* loose enough to accept whatever ID scheme the client picks.
+*/
+const MAX_KEY_LENGTH = 255;
+const PRINTABLE_ASCII = /^[\x21-\x7e]+$/;
+function isValidIdempotencyKey(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= MAX_KEY_LENGTH && PRINTABLE_ASCII.test(value);
+}
+/**
+* Hash a request body to a stable hex digest.
+*
+* Used to detect "same key, different body" — that's a client bug, not a retry.
+* sha256 is overkill for collision resistance here, but it's the dependency-free
+* choice and avoids importing a faster hasher.
+*
+* @example
+* hashBody({ amount: 100, currency: "USD" }); // "a1b2c3..."
+*/
+function hashBody(body) {
+	const serialized = typeof body === "string" ? body : JSON.stringify(body ?? {});
+	return createHash("sha256").update(serialized).digest("hex");
+}
+/**
+* Build the cache key for an idempotency record.
+*
+* Scope is `userType:userId` when authenticated, falling back to the client IP
+* when anonymous. This prevents user A from replaying user B's key — even if
+* user B used a guessable value — while still letting the primitive work on
+* public endpoints.
+*
+* Idempotency middleware must run **after** `authMiddleware` so `request.user`
+* and `request.decodedAccessToken` are populated.
+*
+* @example
+* buildIdempotencyCacheKey(request, "01J9XZQ-ABC"); // "idem:client:user_123:01J9XZQ-ABC"
+*/
+function buildIdempotencyCacheKey(request, idempotencyKey) {
+	return `idem:${request.decodedAccessToken?.userType || "anonymous"}:${request.user?.id || request.detectIp() || "unknown"}:${idempotencyKey}`;
+}
+
+//#endregion
+export { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey };
+//# sourceMappingURL=idempotency-key.mjs.map

package/esm/http/middleware/utils/idempotency-key.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency-key.mjs","names":[],"sources":["../../../../../../../../@warlock.js/core/src/http/middleware/utils/idempotency-key.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { Request } from \"../../request\";\n\n/**\n * Idempotency-key validation rules.\n *\n * RFC draft-ietf-httpapi-idempotency-key suggests UUIDs or ULIDs but doesn't\n * mandate a format. We accept any printable ASCII string up to 255 chars —\n * tight enough to reject log-injection (no control characters / newlines),\n * loose enough to accept whatever ID scheme the client picks.\n */\nconst MAX_KEY_LENGTH = 255;\nconst PRINTABLE_ASCII = /^[\\x21-\\x7e]+$/;\n\nexport function isValidIdempotencyKey(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    value.length <= MAX_KEY_LENGTH &&\n    PRINTABLE_ASCII.test(value)\n  );\n}\n\n/**\n * Hash a request body to a stable hex digest.\n *\n * Used to detect \"same key, different body\" — that's a client bug, not a retry.\n * sha256 is overkill for collision resistance here, but it's the dependency-free\n * choice and avoids importing a faster hasher.\n *\n * @example\n * hashBody({ amount: 100, currency: \"USD\" }); // \"a1b2c3...\"\n */\nexport function hashBody(body: unknown): string {\n  const serialized = typeof body === \"string\" ? body : JSON.stringify(body ?? {});\n\n  return createHash(\"sha256\").update(serialized).digest(\"hex\");\n}\n\n/**\n * Build the cache key for an idempotency record.\n *\n * Scope is `userType:userId` when authenticated, falling back to the client IP\n * when anonymous. This prevents user A from replaying user B's key — even if\n * user B used a guessable value — while still letting the primitive work on\n * public endpoints.\n *\n * Idempotency middleware must run **after** `authMiddleware` so `request.user`\n * and `request.decodedAccessToken` are populated.\n *\n * @example\n * buildIdempotencyCacheKey(request, \"01J9XZQ-ABC\"); // \"idem:client:user_123:01J9XZQ-ABC\"\n */\nexport function buildIdempotencyCacheKey(request: Request, idempotencyKey: string): string {\n  const userType = request.decodedAccessToken?.userType || \"anonymous\";\n  const userId = request.user?.id || request.detectIp() || \"unknown\";\n\n  return `idem:${userType}:${userId}:${idempotencyKey}`;\n}\n"],"mappings":";;;;;;;;;;;AAWA,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,SAAgB,sBAAsB,OAAiC;CACrE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,kBAChB,gBAAgB,KAAK,KAAK;AAE9B;;;;;;;;;;;AAYA,SAAgB,SAAS,MAAuB;CAC9C,MAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC;CAE9E,OAAO,WAAW,QAAQ,EAAE,OAAO,UAAU,EAAE,OAAO,KAAK;AAC7D;;;;;;;;;;;;;;;AAgBA,SAAgB,yBAAyB,SAAkB,gBAAgC;CAIzF,OAAO,QAHU,QAAQ,oBAAoB,YAAY,YAGjC,GAFT,QAAQ,MAAM,MAAM,QAAQ,SAAS,KAAK,UAEvB,GAAG;AACvC"}

package/esm/http/middleware/utils/index.d.mts

@@ -0,0 +1,3 @@
+import { anyMatch, ipMatches } from "./cidr-match.mjs";
+import { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from "./idempotency-key.mjs";
+import { parseSize } from "./parse-size.mjs";

package/esm/http/middleware/utils/parse-size.d.mts

@@ -0,0 +1,5 @@
+//#region ../../@warlock.js/core/src/http/middleware/utils/parse-size.d.ts
+declare function parseSize(value: string | number): number;
+//#endregion
+export { parseSize };
+//# sourceMappingURL=parse-size.d.mts.map

package/esm/http/middleware/utils/parse-size.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-size.d.mts","names":[],"sources":["../../../../../../../../@warlock.js/core/src/http/middleware/utils/parse-size.ts"],"mappings":";iBAkBgB,SAAA,CAAU,KAAsB"}