@warlock.js/core 4.9.2 → 4.10.0

package/esm/http/createHttpApplication.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createHttpApplication.mjs","names":[],"sources":["../../../../../../../core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;AAQA,eAAsB,wBAAwB;CAC5C,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAU,OAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}
+{"version":3,"file":"createHttpApplication.mjs","names":["config"],"sources":["../../../../../../../core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;AAQA,eAAsB,wBAAwB;CAC5C,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAUA,WAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}

package/esm/http/middleware/idempotency.middleware.mjs

@@ -1,7 +1,7 @@
 import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
 import { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from "./utils/idempotency-key.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { log } from "@warlock.js/logger";
 import { cache } from "@warlock.js/cache";
 
@@ -44,10 +44,10 @@ const DEFAULT_METHODS = [
 */
 function idempotencyMiddleware(options = {}) {
 	return async (request, response) => {
-		const headerName = options.headerName || config.get("http.idempotency.headerName", "Idempotency-Key");
-		const methods = options.methods || config.get("http.idempotency.methods", DEFAULT_METHODS);
-		const ttl = options.ttl || config.get("http.idempotency.ttl", 86400);
-		const driverName = options.driver || config.get("http.idempotency.driver");
+		const headerName = options.headerName || baseConfig.get("http.idempotency.headerName", "Idempotency-Key");
+		const methods = options.methods || baseConfig.get("http.idempotency.methods", DEFAULT_METHODS);
+		const ttl = options.ttl || baseConfig.get("http.idempotency.ttl", 86400);
+		const driverName = options.driver || baseConfig.get("http.idempotency.driver");
 		if (!methods.includes(request.method.toUpperCase())) return;
 		const idempotencyKey = request.header(headerName.toLowerCase());
 		if (!idempotencyKey) return;

package/esm/http/middleware/idempotency.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/idempotency.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\nimport {\n  buildIdempotencyCacheKey,\n  hashBody,\n  isValidIdempotencyKey,\n} from \"./utils/idempotency-key\";\n\n/**\n * Options for the idempotency middleware.\n */\nexport type IdempotencyOptions = {\n  /**\n   * Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).\n   */\n  ttl?: number;\n  /**\n   * Header name carrying the client's key. Falls back to\n   * `http.idempotency.headerName`, then `\"Idempotency-Key\"`.\n   */\n  headerName?: string;\n  /**\n   * HTTP methods eligible for idempotency. Falls back to\n   * `http.idempotency.methods`, then `[\"POST\",\"PUT\",\"PATCH\",\"DELETE\"]`.\n   * Safe methods (GET/HEAD) are skipped regardless.\n   */\n  methods?: string[];\n  /**\n   * Cache driver name. Falls back to `http.idempotency.driver`, then the\n   * default driver of the cache manager.\n   */\n  driver?: string;\n};\n\ntype CachedResponse = {\n  status: number;\n  body: unknown;\n  bodyHash: string;\n  contentType?: string;\n};\n\nconst DEFAULT_METHODS = [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"];\n\n/**\n * Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,\n * same body, within TTL → cached replay; same key, different body → 422\n * `IdempotencyKeyConflict`.\n *\n * **Must run after `authMiddleware`** — the cache key is scoped per-user\n * (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.\n * Anonymous requests fall back to IP scope.\n *\n * The replay sets `Idempotent-Replay: true` on the response for easy\n * client-side / observability detection.\n *\n * Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through\n * even with the header set (RFC: safe methods are already idempotent).\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [authMiddleware(\"client\"), middleware.idempotency()],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries\n *   ],\n * });\n */\nexport function idempotencyMiddleware(options: IdempotencyOptions = {}): Middleware {\n  return async (request, response) => {\n    const headerName =\n      options.headerName ||\n      config.get(\"http.idempotency.headerName\", \"Idempotency-Key\");\n    const methods =\n      options.methods || config.get(\"http.idempotency.methods\", DEFAULT_METHODS);\n    const ttl = options.ttl || config.get(\"http.idempotency.ttl\", 86400);\n    const driverName = options.driver || config.get(\"http.idempotency.driver\");\n\n    if (!methods.includes(request.method.toUpperCase())) return;\n\n    const idempotencyKey = request.header(headerName.toLowerCase());\n\n    if (!idempotencyKey) return;\n\n    if (!isValidIdempotencyKey(idempotencyKey)) {\n      return response.badRequest({\n        error: t(\"http.idempotencyKeyInvalid\"),\n        errorCode: HttpErrorCodes.IdempotencyKeyInvalid,\n      });\n    }\n\n    const cacheDriver = driverName ? await cache.use(driverName) : cache;\n    const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);\n    const bodyHash = hashBody(request.body);\n\n    const cached = (await cacheDriver.get(cacheKey)) as CachedResponse | null;\n\n    if (cached) {\n      if (cached.bodyHash !== bodyHash) {\n        return response.unprocessableEntity({\n          error: t(\"http.idempotencyKeyConflict\"),\n          errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n        });\n      }\n\n      response.header(\"Idempotent-Replay\", \"true\");\n\n      return response.replay({\n        status: cached.status,\n        body: cached.body,\n        contentType: cached.contentType,\n      });\n    }\n\n    response.onSent((sentResponse: Response) => {\n      // Don't cache server errors — clients should be able to retry past a 5xx.\n      // 4xx are deterministic outcomes of the request, so caching is fine.\n      if (sentResponse.statusCode >= 500) return;\n\n      const sentContentType = sentResponse.contentType;\n\n      // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n      // write (e.g. Redis down) would surface as an unhandledRejection.\n      cacheDriver\n        .set(\n          cacheKey,\n          {\n            status: sentResponse.statusCode,\n            body: sentResponse.parsedBody,\n            bodyHash,\n            contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n          },\n          ttl,\n        )\n        .catch((error: unknown) => {\n          log.error(\"idempotency-middleware\", \"set\", error);\n        });\n    });\n  };\n}\n"],"mappings":";;;;;;;;AA8CA,MAAM,kBAAkB;CAAC;CAAQ;CAAO;CAAS;AAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCzD,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,OAAO,OAAO,SAAS,aAAa;EAClC,MAAM,aACJ,QAAQ,cACR,OAAO,IAAI,+BAA+B,iBAAiB;EAC7D,MAAM,UACJ,QAAQ,WAAW,OAAO,IAAI,4BAA4B,eAAe;EAC3E,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAI,wBAAwB,KAAK;EACnE,MAAM,aAAa,QAAQ,UAAU,OAAO,IAAI,yBAAyB;EAEzE,IAAI,CAAC,QAAQ,SAAS,QAAQ,OAAO,YAAY,CAAC,GAAG;EAErD,MAAM,iBAAiB,QAAQ,OAAO,WAAW,YAAY,CAAC;EAE9D,IAAI,CAAC,gBAAgB;EAErB,IAAI,CAAC,sBAAsB,cAAc,GACvC,OAAO,SAAS,WAAW;GACzB,OAAO,EAAE,4BAA4B;GACrC;EACF,CAAC;EAGH,MAAM,cAAc,aAAa,MAAM,MAAM,IAAI,UAAU,IAAI;EAC/D,MAAM,WAAW,yBAAyB,SAAS,cAAc;EACjE,MAAM,WAAW,SAAS,QAAQ,IAAI;EAEtC,MAAM,SAAU,MAAM,YAAY,IAAI,QAAQ;EAE9C,IAAI,QAAQ;GACV,IAAI,OAAO,aAAa,UACtB,OAAO,SAAS,oBAAoB;IAClC,OAAO,EAAE,6BAA6B;IACtC;GACF,CAAC;GAGH,SAAS,OAAO,qBAAqB,MAAM;GAE3C,OAAO,SAAS,OAAO;IACrB,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,aAAa,OAAO;GACtB,CAAC;EACH;EAEA,SAAS,QAAQ,iBAA2B;GAG1C,IAAI,aAAa,cAAc,KAAK;GAEpC,MAAM,kBAAkB,aAAa;GAIrC,YACG,IACC,UACA;IACE,QAAQ,aAAa;IACrB,MAAM,aAAa;IACnB;IACA,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE,GACA,GACF,CAAC,CACA,OAAO,UAAmB;IACzB,IAAI,MAAM,0BAA0B,OAAO,KAAK;GAClD,CAAC;EACL,CAAC;CACH;AACF"}
+{"version":3,"file":"idempotency.middleware.mjs","names":["config"],"sources":["../../../../../../../../core/src/http/middleware/idempotency.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\nimport {\n  buildIdempotencyCacheKey,\n  hashBody,\n  isValidIdempotencyKey,\n} from \"./utils/idempotency-key\";\n\n/**\n * Options for the idempotency middleware.\n */\nexport type IdempotencyOptions = {\n  /**\n   * Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).\n   */\n  ttl?: number;\n  /**\n   * Header name carrying the client's key. Falls back to\n   * `http.idempotency.headerName`, then `\"Idempotency-Key\"`.\n   */\n  headerName?: string;\n  /**\n   * HTTP methods eligible for idempotency. Falls back to\n   * `http.idempotency.methods`, then `[\"POST\",\"PUT\",\"PATCH\",\"DELETE\"]`.\n   * Safe methods (GET/HEAD) are skipped regardless.\n   */\n  methods?: string[];\n  /**\n   * Cache driver name. Falls back to `http.idempotency.driver`, then the\n   * default driver of the cache manager.\n   */\n  driver?: string;\n};\n\ntype CachedResponse = {\n  status: number;\n  body: unknown;\n  bodyHash: string;\n  contentType?: string;\n};\n\nconst DEFAULT_METHODS = [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"];\n\n/**\n * Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,\n * same body, within TTL → cached replay; same key, different body → 422\n * `IdempotencyKeyConflict`.\n *\n * **Must run after `authMiddleware`** — the cache key is scoped per-user\n * (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.\n * Anonymous requests fall back to IP scope.\n *\n * The replay sets `Idempotent-Replay: true` on the response for easy\n * client-side / observability detection.\n *\n * Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through\n * even with the header set (RFC: safe methods are already idempotent).\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [authMiddleware(\"client\"), middleware.idempotency()],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries\n *   ],\n * });\n */\nexport function idempotencyMiddleware(options: IdempotencyOptions = {}): Middleware {\n  return async (request, response) => {\n    const headerName =\n      options.headerName ||\n      config.get(\"http.idempotency.headerName\", \"Idempotency-Key\");\n    const methods =\n      options.methods || config.get(\"http.idempotency.methods\", DEFAULT_METHODS);\n    const ttl = options.ttl || config.get(\"http.idempotency.ttl\", 86400);\n    const driverName = options.driver || config.get(\"http.idempotency.driver\");\n\n    if (!methods.includes(request.method.toUpperCase())) return;\n\n    const idempotencyKey = request.header(headerName.toLowerCase());\n\n    if (!idempotencyKey) return;\n\n    if (!isValidIdempotencyKey(idempotencyKey)) {\n      return response.badRequest({\n        error: t(\"http.idempotencyKeyInvalid\"),\n        errorCode: HttpErrorCodes.IdempotencyKeyInvalid,\n      });\n    }\n\n    const cacheDriver = driverName ? await cache.use(driverName) : cache;\n    const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);\n    const bodyHash = hashBody(request.body);\n\n    const cached = (await cacheDriver.get(cacheKey)) as CachedResponse | null;\n\n    if (cached) {\n      if (cached.bodyHash !== bodyHash) {\n        return response.unprocessableEntity({\n          error: t(\"http.idempotencyKeyConflict\"),\n          errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n        });\n      }\n\n      response.header(\"Idempotent-Replay\", \"true\");\n\n      return response.replay({\n        status: cached.status,\n        body: cached.body,\n        contentType: cached.contentType,\n      });\n    }\n\n    response.onSent((sentResponse: Response) => {\n      // Don't cache server errors — clients should be able to retry past a 5xx.\n      // 4xx are deterministic outcomes of the request, so caching is fine.\n      if (sentResponse.statusCode >= 500) return;\n\n      const sentContentType = sentResponse.contentType;\n\n      // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n      // write (e.g. Redis down) would surface as an unhandledRejection.\n      cacheDriver\n        .set(\n          cacheKey,\n          {\n            status: sentResponse.statusCode,\n            body: sentResponse.parsedBody,\n            bodyHash,\n            contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n          },\n          ttl,\n        )\n        .catch((error: unknown) => {\n          log.error(\"idempotency-middleware\", \"set\", error);\n        });\n    });\n  };\n}\n"],"mappings":";;;;;;;;AA8CA,MAAM,kBAAkB;CAAC;CAAQ;CAAO;CAAS;AAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCzD,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,OAAO,OAAO,SAAS,aAAa;EAClC,MAAM,aACJ,QAAQ,cACRA,WAAO,IAAI,+BAA+B,iBAAiB;EAC7D,MAAM,UACJ,QAAQ,WAAWA,WAAO,IAAI,4BAA4B,eAAe;EAC3E,MAAM,MAAM,QAAQ,OAAOA,WAAO,IAAI,wBAAwB,KAAK;EACnE,MAAM,aAAa,QAAQ,UAAUA,WAAO,IAAI,yBAAyB;EAEzE,IAAI,CAAC,QAAQ,SAAS,QAAQ,OAAO,YAAY,CAAC,GAAG;EAErD,MAAM,iBAAiB,QAAQ,OAAO,WAAW,YAAY,CAAC;EAE9D,IAAI,CAAC,gBAAgB;EAErB,IAAI,CAAC,sBAAsB,cAAc,GACvC,OAAO,SAAS,WAAW;GACzB,OAAO,EAAE,4BAA4B;GACrC;EACF,CAAC;EAGH,MAAM,cAAc,aAAa,MAAM,MAAM,IAAI,UAAU,IAAI;EAC/D,MAAM,WAAW,yBAAyB,SAAS,cAAc;EACjE,MAAM,WAAW,SAAS,QAAQ,IAAI;EAEtC,MAAM,SAAU,MAAM,YAAY,IAAI,QAAQ;EAE9C,IAAI,QAAQ;GACV,IAAI,OAAO,aAAa,UACtB,OAAO,SAAS,oBAAoB;IAClC,OAAO,EAAE,6BAA6B;IACtC;GACF,CAAC;GAGH,SAAS,OAAO,qBAAqB,MAAM;GAE3C,OAAO,SAAS,OAAO;IACrB,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,aAAa,OAAO;GACtB,CAAC;EACH;EAEA,SAAS,QAAQ,iBAA2B;GAG1C,IAAI,aAAa,cAAc,KAAK;GAEpC,MAAM,kBAAkB,aAAa;GAIrC,YACG,IACC,UACA;IACE,QAAQ,aAAa;IACrB,MAAM,aAAa;IACnB;IACA,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE,GACA,GACF,CAAC,CACA,OAAO,UAAmB;IACzB,IAAI,MAAM,0BAA0B,OAAO,KAAK;GAClD,CAAC;EACL,CAAC;CACH;AACF"}

package/esm/http/middleware/inject-request-context.mjs

@@ -2,7 +2,7 @@ import { environment } from "../../utils/environment.mjs";
 import { requestContext, useRequestStore } from "../context/request-context.mjs";
 import "../../utils/index.mjs";
 import { BadRequestError, ForbiddenError, HttpError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "../errors/errors.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { trans } from "@mongez/localization";
 import { DatabaseWriterValidationError } from "@warlock.js/cascade";
 import { contextManager } from "@warlock.js/context";
@@ -22,7 +22,7 @@ import { contextManager } from "@warlock.js/context";
 * Skip when `http.requestId.enabled` is explicitly false.
 */
 function stampRequestIdHeader(request, response) {
-	const requestIdConfig = config.get("http.requestId", {});
+	const requestIdConfig = baseConfig.get("http.requestId", {});
 	if (requestIdConfig.enabled === false) return;
 	const headerName = requestIdConfig.header || "X-Request-Id";
 	response.header(headerName, request.id);

package/esm/http/middleware/inject-request-context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\r\n * Request Context Middleware\r\n *\r\n * Creates a unified context for each request using the ContextManager.\r\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\r\n */\r\nimport { trans } from \"@mongez/localization\";\r\nimport { GenericObject } from \"@mongez/reinforcements\";\r\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\r\nimport { contextManager } from \"@warlock.js/context\";\r\nimport config from \"@mongez/config\";\r\nimport { environment } from \"../../utils\";\r\nimport {\r\n  requestContext as requestContextInstance,\r\n  useRequestStore,\r\n} from \"../context/request-context\";\r\nimport {\r\n  BadRequestError,\r\n  ForbiddenError,\r\n  HttpError,\r\n  ResourceNotFoundError,\r\n  ServerError,\r\n  UnAuthorizedError,\r\n} from \"../errors\";\r\nimport { type Request } from \"../request\";\r\nimport { type Response } from \"../response\";\r\nimport { type ReturnedResponse } from \"./../types\";\r\n\r\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\r\n\r\n/**\r\n * Echo `request.id` back as a response header so the FE / proxies / log\r\n * aggregators can correlate by the same value the server logs against.\r\n *\r\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\r\n * Skip when `http.requestId.enabled` is explicitly false.\r\n */\r\nfunction stampRequestIdHeader(request: Request, response: Response) {\r\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\r\n\r\n  if (requestIdConfig.enabled === false) return;\r\n\r\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\r\n\r\n  response.header(headerName, request.id);\r\n}\r\n\r\n/**\r\n * Create request store and execute middleware + handler\r\n *\r\n * Runs all registered contexts together using ContextManager.\r\n */\r\nexport function createRequestStore(\r\n  request: Request<any>,\r\n  response: Response,\r\n): Promise<ReturnedResponse> {\r\n  stampRequestIdHeader(request, response);\r\n\r\n  // Build all context stores using the immutable API\r\n  // Each context defines its own store initialization via buildStore()\r\n  const httpContextStore = contextManager.buildStores({ request, response });\r\n\r\n  // Run all contexts together!\r\n  return contextManager.runAll(httpContextStore, async () => {\r\n    try {\r\n      // Run middleware chain\r\n      const result = await request.runMiddleware();\r\n\r\n      if (result) {\r\n        return result as ReturnedResponse;\r\n      }\r\n\r\n      // Execute route handler\r\n      request.trigger(\"executingAction\", request.route);\r\n\r\n      const handler = request.getHandler();\r\n\r\n      request.log(\"Executing Handler\", \"info\");\r\n\r\n      const output = await handler(request, response);\r\n\r\n      request.log(\"Handler Executed Successfully\", \"success\");\r\n\r\n      request.trigger(\"executedAction\", request.route);\r\n\r\n      return output as ReturnedResponse;\r\n    } catch (error: any) {\r\n      request.log(`${error.constructor.name}: Request failed: ${error.message}`, \"error\");\r\n      return handleRequestError(error, response);\r\n    }\r\n  });\r\n}\r\n\r\n/**\r\n * Handle request errors\r\n * @internal\r\n */\r\nfunction handleRequestError(error: any, response: Response): ReturnedResponse {\r\n  if (error instanceof HttpError) {\r\n    const payload: GenericObject = {\r\n      error: error.message,\r\n    };\r\n    if (error.payload) {\r\n      payload.payload = error.payload;\r\n    }\r\n\r\n    if (environment() === \"development\") {\r\n      payload.stack = error.stack;\r\n    }\r\n\r\n    return response.setStatusCode(error.status).send(payload);\r\n  }\r\n\r\n  if (error instanceof ResourceNotFoundError) {\r\n    return response.notFound({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof UnAuthorizedError) {\r\n    return response.unauthorized({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ForbiddenError) {\r\n    return response.forbidden({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof BadRequestError) {\r\n    return response.badRequest({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof DatabaseWriterValidationError) {\r\n    return response.badRequest({\r\n      errors: error.errors,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ServerError) {\r\n    return response.serverError({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  console.log(error);\r\n\r\n  return response.badRequest({\r\n    error: error.message,\r\n    ...error.payload,\r\n  });\r\n}\r\n\r\n/**\r\n * Translate a keyword (uses request context for locale)\r\n */\r\nexport function t(keyword: string, placeholders?: any) {\r\n  return (\r\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\r\n    trans(keyword, placeholders)\r\n  );\r\n}\r\n\r\n/**\r\n * Get or compute a value from the request cache\r\n *\r\n * If the value exists in request, return it.\r\n * Otherwise, execute callback, store result in request, and return it.\r\n */\r\nexport async function fromRequest<T>(\r\n  key: string,\r\n  callback: (request?: Request) => Promise<T>,\r\n): Promise<T> {\r\n  const { request } = useRequestStore();\r\n\r\n  if (!request) return await callback();\r\n\r\n  if (request[key]) return request[key];\r\n\r\n  request[key] = await callback(request);\r\n\r\n  return request[key];\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAqCA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAItC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAEF,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,SAAS,MAAM,QAAQ,SAAS,QAAQ;GAE9C,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAY;GACnB,QAAQ,IAAI,GAAG,MAAM,YAAY,KAAK,oBAAoB,MAAM,WAAW,OAAO;GAClF,OAAO,mBAAmB,OAAO,QAAQ;EAC3C;CACF,CAAC;AACH;;;;;AAMA,SAAS,mBAAmB,OAAY,UAAsC;CAC5E,IAAI,iBAAiB,WAAW;EAC9B,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,uBACnB,OAAO,SAAS,SAAS;EACvB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,mBACnB,OAAO,SAAS,aAAa;EAC3B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,gBACnB,OAAO,SAAS,UAAU;EACxB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,iBACnB,OAAO,SAAS,WAAW;EACzB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,+BACnB,OAAO,SAAS,WAAW,EACzB,QAAQ,MAAM,OAChB,CAAC;CAGH,IAAI,iBAAiB,aACnB,OAAO,SAAS,YAAY;EAC1B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,QAAQ,IAAI,KAAK;CAEjB,OAAO,SAAS,WAAW;EACzB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAoB;CACrD,OACEA,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B;;;;;;;AAQA,eAAsB,YACpB,KACA,UACY;CACZ,MAAM,EAAE,YAAY,gBAAgB;CAEpC,IAAI,CAAC,SAAS,OAAO,MAAM,SAAS;CAEpC,IAAI,QAAQ,MAAM,OAAO,QAAQ;CAEjC,QAAQ,OAAO,MAAM,SAAS,OAAO;CAErC,OAAO,QAAQ;AACjB"}
+{"version":3,"file":"inject-request-context.mjs","names":["config","requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\r\n * Request Context Middleware\r\n *\r\n * Creates a unified context for each request using the ContextManager.\r\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\r\n */\r\nimport { trans } from \"@mongez/localization\";\r\nimport { GenericObject } from \"@mongez/reinforcements\";\r\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\r\nimport { contextManager } from \"@warlock.js/context\";\r\nimport config from \"@mongez/config\";\r\nimport { environment } from \"../../utils\";\r\nimport {\r\n  requestContext as requestContextInstance,\r\n  useRequestStore,\r\n} from \"../context/request-context\";\r\nimport {\r\n  BadRequestError,\r\n  ForbiddenError,\r\n  HttpError,\r\n  ResourceNotFoundError,\r\n  ServerError,\r\n  UnAuthorizedError,\r\n} from \"../errors\";\r\nimport { type Request } from \"../request\";\r\nimport { type Response } from \"../response\";\r\nimport { type ReturnedResponse } from \"./../types\";\r\n\r\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\r\n\r\n/**\r\n * Echo `request.id` back as a response header so the FE / proxies / log\r\n * aggregators can correlate by the same value the server logs against.\r\n *\r\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\r\n * Skip when `http.requestId.enabled` is explicitly false.\r\n */\r\nfunction stampRequestIdHeader(request: Request, response: Response) {\r\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\r\n\r\n  if (requestIdConfig.enabled === false) return;\r\n\r\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\r\n\r\n  response.header(headerName, request.id);\r\n}\r\n\r\n/**\r\n * Create request store and execute middleware + handler\r\n *\r\n * Runs all registered contexts together using ContextManager.\r\n */\r\nexport function createRequestStore(\r\n  request: Request<any>,\r\n  response: Response,\r\n): Promise<ReturnedResponse> {\r\n  stampRequestIdHeader(request, response);\r\n\r\n  // Build all context stores using the immutable API\r\n  // Each context defines its own store initialization via buildStore()\r\n  const httpContextStore = contextManager.buildStores({ request, response });\r\n\r\n  // Run all contexts together!\r\n  return contextManager.runAll(httpContextStore, async () => {\r\n    try {\r\n      // Run middleware chain\r\n      const result = await request.runMiddleware();\r\n\r\n      if (result) {\r\n        return result as ReturnedResponse;\r\n      }\r\n\r\n      // Execute route handler\r\n      request.trigger(\"executingAction\", request.route);\r\n\r\n      const handler = request.getHandler();\r\n\r\n      request.log(\"Executing Handler\", \"info\");\r\n\r\n      const output = await handler(request, response);\r\n\r\n      request.log(\"Handler Executed Successfully\", \"success\");\r\n\r\n      request.trigger(\"executedAction\", request.route);\r\n\r\n      return output as ReturnedResponse;\r\n    } catch (error: any) {\r\n      request.log(`${error.constructor.name}: Request failed: ${error.message}`, \"error\");\r\n      return handleRequestError(error, response);\r\n    }\r\n  });\r\n}\r\n\r\n/**\r\n * Handle request errors\r\n * @internal\r\n */\r\nfunction handleRequestError(error: any, response: Response): ReturnedResponse {\r\n  if (error instanceof HttpError) {\r\n    const payload: GenericObject = {\r\n      error: error.message,\r\n    };\r\n    if (error.payload) {\r\n      payload.payload = error.payload;\r\n    }\r\n\r\n    if (environment() === \"development\") {\r\n      payload.stack = error.stack;\r\n    }\r\n\r\n    return response.setStatusCode(error.status).send(payload);\r\n  }\r\n\r\n  if (error instanceof ResourceNotFoundError) {\r\n    return response.notFound({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof UnAuthorizedError) {\r\n    return response.unauthorized({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ForbiddenError) {\r\n    return response.forbidden({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof BadRequestError) {\r\n    return response.badRequest({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof DatabaseWriterValidationError) {\r\n    return response.badRequest({\r\n      errors: error.errors,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ServerError) {\r\n    return response.serverError({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  console.log(error);\r\n\r\n  return response.badRequest({\r\n    error: error.message,\r\n    ...error.payload,\r\n  });\r\n}\r\n\r\n/**\r\n * Translate a keyword (uses request context for locale)\r\n */\r\nexport function t(keyword: string, placeholders?: any) {\r\n  return (\r\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\r\n    trans(keyword, placeholders)\r\n  );\r\n}\r\n\r\n/**\r\n * Get or compute a value from the request cache\r\n *\r\n * If the value exists in request, return it.\r\n * Otherwise, execute callback, store result in request, and return it.\r\n */\r\nexport async function fromRequest<T>(\r\n  key: string,\r\n  callback: (request?: Request) => Promise<T>,\r\n): Promise<T> {\r\n  const { request } = useRequestStore();\r\n\r\n  if (!request) return await callback();\r\n\r\n  if (request[key]) return request[key];\r\n\r\n  request[key] = await callback(request);\r\n\r\n  return request[key];\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAqCA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkBA,WAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAItC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAEF,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,SAAS,MAAM,QAAQ,SAAS,QAAQ;GAE9C,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAY;GACnB,QAAQ,IAAI,GAAG,MAAM,YAAY,KAAK,oBAAoB,MAAM,WAAW,OAAO;GAClF,OAAO,mBAAmB,OAAO,QAAQ;EAC3C;CACF,CAAC;AACH;;;;;AAMA,SAAS,mBAAmB,OAAY,UAAsC;CAC5E,IAAI,iBAAiB,WAAW;EAC9B,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,uBACnB,OAAO,SAAS,SAAS;EACvB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,mBACnB,OAAO,SAAS,aAAa;EAC3B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,gBACnB,OAAO,SAAS,UAAU;EACxB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,iBACnB,OAAO,SAAS,WAAW;EACzB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,+BACnB,OAAO,SAAS,WAAW,EACzB,QAAQ,MAAM,OAChB,CAAC;CAGH,IAAI,iBAAiB,aACnB,OAAO,SAAS,YAAY;EAC1B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,QAAQ,IAAI,KAAK;CAEjB,OAAO,SAAS,WAAW;EACzB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAoB;CACrD,OACEC,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B;;;;;;;AAQA,eAAsB,YACpB,KACA,UACY;CACZ,MAAM,EAAE,YAAY,gBAAgB;CAEpC,IAAI,CAAC,SAAS,OAAO,MAAM,SAAS;CAEpC,IAAI,QAAQ,MAAM,OAAO,QAAQ;CAEjC,QAAQ,OAAO,MAAM,SAAS,OAAO;CAErC,OAAO,QAAQ;AACjB"}

package/esm/http/middleware/maintenance.middleware.mjs

@@ -1,6 +1,6 @@
 import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 
 //#region ../core/src/http/middleware/maintenance.middleware.ts
 function isAllowlisted(path, patterns) {
@@ -31,11 +31,11 @@ function isAllowlisted(path, patterns) {
 */
 function maintenanceMiddleware(options = {}) {
 	return (request, response) => {
-		if (!config.get("http.maintenance.enabled", false)) return;
-		const allowlist = options.allowlist || config.get("http.maintenance.allowlist", ["/health"]);
+		if (!baseConfig.get("http.maintenance.enabled", false)) return;
+		const allowlist = options.allowlist || baseConfig.get("http.maintenance.allowlist", ["/health"]);
 		const pathname = request.path.split("?")[0];
 		if (isAllowlisted(pathname, allowlist)) return;
-		const retryAfter = options.retryAfter || config.get("http.maintenance.retryAfter", 60);
+		const retryAfter = options.retryAfter || baseConfig.get("http.maintenance.retryAfter", 60);
 		response.header("Retry-After", retryAfter);
 		return response.serviceUnavailable({
 			error: options.errorMessage || t("http.maintenance"),

package/esm/http/middleware/maintenance.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return (request, response) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist =\n      options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    // `request.path` includes the query string, but allowlist entries are\n    // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n    // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n    const pathname = request.path.split(\"?\")[0];\n\n    if (isAllowlisted(pathname, allowlist)) return;\n\n    const retryAfter =\n      options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,SAAS,aAAa;EAG5B,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YACJ,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAK3E,MAAM,WAAW,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC;EAEzC,IAAI,cAAc,UAAU,SAAS,GAAG;EAExC,MAAM,aACJ,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAEpE,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"maintenance.middleware.mjs","names":["config"],"sources":["../../../../../../../../core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return (request, response) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist =\n      options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    // `request.path` includes the query string, but allowlist entries are\n    // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n    // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n    const pathname = request.path.split(\"?\")[0];\n\n    if (isAllowlisted(pathname, allowlist)) return;\n\n    const retryAfter =\n      options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,SAAS,aAAa;EAG5B,IAAI,CAFYA,WAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YACJ,QAAQ,aAAaA,WAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAK3E,MAAM,WAAW,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC;EAEzC,IAAI,cAAc,UAAU,SAAS,GAAG;EAExC,MAAM,aACJ,QAAQ,cAAcA,WAAO,IAAI,+BAA+B,EAAE;EAEpE,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}

package/esm/http/plugins.mjs

@@ -1,6 +1,6 @@
 import { rootPath } from "../utils/paths.mjs";
 import "../utils/index.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import fastifyMultipart from "@fastify/multipart";
 
 //#region ../core/src/http/plugins.ts
@@ -10,25 +10,25 @@ const defaultCorsOptions = {
 };
 async function registerHttpPlugins(server) {
 	server.register(import("@fastify/rate-limit"), {
-		max: config.get("http.rateLimit.max", 60),
-		timeWindow: config.get("http.rateLimit.duration", 60 * 1e3)
+		max: baseConfig.get("http.rateLimit.max", 60),
+		timeWindow: baseConfig.get("http.rateLimit.duration", 60 * 1e3)
 	});
 	const corsOptions = {
-		...config.get("http.cors", {}),
+		...baseConfig.get("http.cors", {}),
 		...defaultCorsOptions
 	};
 	server.register(import("@fastify/cors"), corsOptions);
 	server.register(fastifyMultipart, {
 		attachFieldsToBody: true,
-		limits: { fileSize: config.get("http.fileUploadLimit", 10 * 1024 * 1024) }
+		limits: { fileSize: baseConfig.get("http.fileUploadLimit", 10 * 1024 * 1024) }
 	});
 	server.register(import("@fastify/static"), {
-		root: config.get("storage.publicRoot", rootPath("public")),
-		prefix: config.get("storage.publicPrefix", "/public/")
+		root: baseConfig.get("storage.publicRoot", rootPath("public")),
+		prefix: baseConfig.get("storage.publicPrefix", "/public/")
 	});
 	server.register(import("@fastify/cookie"), {
-		secret: config.get("http.cookies.secret"),
-		parseOptions: config.get("http.cookies.options", {})
+		secret: baseConfig.get("http.cookies.secret"),
+		parseOptions: baseConfig.get("http.cookies.options", {})
 	});
 }
 

package/esm/http/plugins.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.mjs","names":[],"sources":["../../../../../../../core/src/http/plugins.ts"],"sourcesContent":["import type { FastifyCorsOptions } from \"@fastify/cors\";\nimport fastifyMultipart from \"@fastify/multipart\";\nimport config from \"@mongez/config\";\nimport { rootPath } from \"../utils\";\nimport type { FastifyInstance } from \"./server\";\n\nconst defaultCorsOptions: FastifyCorsOptions = {\n  origin: \"*\",\n  methods: \"*\",\n};\n\nexport async function registerHttpPlugins(server: FastifyInstance) {\n  // 👇🏻 register rate-limit plugin\n  server.register(import(\"@fastify/rate-limit\"), {\n    // max requests per time window\n    max: config.get(\"http.rateLimit.max\", 60),\n    // maximum time that is will allow max requests\n    timeWindow: config.get(\"http.rateLimit.duration\", 60 * 1000),\n  });\n\n  // 👇🏻 register cors plugin\n  const corsOptions: FastifyCorsOptions | undefined = {\n    ...config.get(\"http.cors\", {}),\n    ...defaultCorsOptions,\n  };\n\n  server.register(import(\"@fastify/cors\"), corsOptions);\n\n  // 👇🏻 import multipart plugin\n  server.register(fastifyMultipart, {\n    attachFieldsToBody: true,\n    limits: {\n      // file size could be up to 10MB\n      fileSize: config.get(\"http.fileUploadLimit\", 10 * 1024 * 1024),\n    },\n  });\n\n  server.register(import(\"@fastify/static\"), {\n    root: config.get(\"storage.publicRoot\", rootPath(\"public\")),\n    prefix: config.get(\"storage.publicPrefix\", \"/public/\"),\n  });\n\n  // 👇🏻 register cookie plugin\n  server.register(import(\"@fastify/cookie\"), {\n    secret: config.get(\"http.cookies.secret\"), // Optional: allow signed cookies\n    parseOptions: config.get(\"http.cookies.options\", {}),\n  });\n}\n"],"mappings":";;;;;;AAMA,MAAM,qBAAyC;CAC7C,QAAQ;CACR,SAAS;AACX;AAEA,eAAsB,oBAAoB,QAAyB;CAEjE,OAAO,SAAS,OAAO,wBAAwB;EAE7C,KAAK,OAAO,IAAI,sBAAsB,EAAE;EAExC,YAAY,OAAO,IAAI,2BAA2B,KAAK,GAAI;CAC7D,CAAC;CAGD,MAAM,cAA8C;EAClD,GAAG,OAAO,IAAI,aAAa,CAAC,CAAC;EAC7B,GAAG;CACL;CAEA,OAAO,SAAS,OAAO,kBAAkB,WAAW;CAGpD,OAAO,SAAS,kBAAkB;EAChC,oBAAoB;EACpB,QAAQ,EAEN,UAAU,OAAO,IAAI,wBAAwB,KAAK,OAAO,IAAI,EAC/D;CACF,CAAC;CAED,OAAO,SAAS,OAAO,oBAAoB;EACzC,MAAM,OAAO,IAAI,sBAAsB,SAAS,QAAQ,CAAC;EACzD,QAAQ,OAAO,IAAI,wBAAwB,UAAU;CACvD,CAAC;CAGD,OAAO,SAAS,OAAO,oBAAoB;EACzC,QAAQ,OAAO,IAAI,qBAAqB;EACxC,cAAc,OAAO,IAAI,wBAAwB,CAAC,CAAC;CACrD,CAAC;AACH"}
+{"version":3,"file":"plugins.mjs","names":["config"],"sources":["../../../../../../../core/src/http/plugins.ts"],"sourcesContent":["import type { FastifyCorsOptions } from \"@fastify/cors\";\nimport fastifyMultipart from \"@fastify/multipart\";\nimport config from \"@mongez/config\";\nimport { rootPath } from \"../utils\";\nimport type { FastifyInstance } from \"./server\";\n\nconst defaultCorsOptions: FastifyCorsOptions = {\n  origin: \"*\",\n  methods: \"*\",\n};\n\nexport async function registerHttpPlugins(server: FastifyInstance) {\n  // 👇🏻 register rate-limit plugin\n  server.register(import(\"@fastify/rate-limit\"), {\n    // max requests per time window\n    max: config.get(\"http.rateLimit.max\", 60),\n    // maximum time that is will allow max requests\n    timeWindow: config.get(\"http.rateLimit.duration\", 60 * 1000),\n  });\n\n  // 👇🏻 register cors plugin\n  const corsOptions: FastifyCorsOptions | undefined = {\n    ...config.get(\"http.cors\", {}),\n    ...defaultCorsOptions,\n  };\n\n  server.register(import(\"@fastify/cors\"), corsOptions);\n\n  // 👇🏻 import multipart plugin\n  server.register(fastifyMultipart, {\n    attachFieldsToBody: true,\n    limits: {\n      // file size could be up to 10MB\n      fileSize: config.get(\"http.fileUploadLimit\", 10 * 1024 * 1024),\n    },\n  });\n\n  server.register(import(\"@fastify/static\"), {\n    root: config.get(\"storage.publicRoot\", rootPath(\"public\")),\n    prefix: config.get(\"storage.publicPrefix\", \"/public/\"),\n  });\n\n  // 👇🏻 register cookie plugin\n  server.register(import(\"@fastify/cookie\"), {\n    secret: config.get(\"http.cookies.secret\"), // Optional: allow signed cookies\n    parseOptions: config.get(\"http.cookies.options\", {}),\n  });\n}\n"],"mappings":";;;;;;AAMA,MAAM,qBAAyC;CAC7C,QAAQ;CACR,SAAS;AACX;AAEA,eAAsB,oBAAoB,QAAyB;CAEjE,OAAO,SAAS,OAAO,wBAAwB;EAE7C,KAAKA,WAAO,IAAI,sBAAsB,EAAE;EAExC,YAAYA,WAAO,IAAI,2BAA2B,KAAK,GAAI;CAC7D,CAAC;CAGD,MAAM,cAA8C;EAClD,GAAGA,WAAO,IAAI,aAAa,CAAC,CAAC;EAC7B,GAAG;CACL;CAEA,OAAO,SAAS,OAAO,kBAAkB,WAAW;CAGpD,OAAO,SAAS,kBAAkB;EAChC,oBAAoB;EACpB,QAAQ,EAEN,UAAUA,WAAO,IAAI,wBAAwB,KAAK,OAAO,IAAI,EAC/D;CACF,CAAC;CAED,OAAO,SAAS,OAAO,oBAAoB;EACzC,MAAMA,WAAO,IAAI,sBAAsB,SAAS,QAAQ,CAAC;EACzD,QAAQA,WAAO,IAAI,wBAAwB,UAAU;CACvD,CAAC;CAGD,OAAO,SAAS,OAAO,oBAAoB;EACzC,QAAQA,WAAO,IAAI,qBAAqB;EACxC,cAAcA,WAAO,IAAI,wBAAwB,CAAC,CAAC;CACrD,CAAC;AACH"}

package/esm/http/response.d.mts

@@ -324,13 +324,28 @@ declare class Response {
    * cleanly with `request.cookie(name)`. Pass `{ raw: true }` to skip the
    * JSON wrapping for plain-string cookies (session tokens, opaque IDs).
    *
+   * **Secure by default.** `httpOnly: true`, `sameSite: "lax"`, and — outside
+   * development — `secure: true` are applied unless you override them. These
+   * are the flags whose absence never fails a test and is fatal in production:
+   * without `httpOnly` any injected script can read the cookie, without
+   * `secure` it travels in cleartext, without `sameSite` it rides along on
+   * cross-site requests. Opting out is explicit, per call or via
+   * `http.cookies.options`.
+   *
+   * Precedence, lowest to highest: framework defaults → `http.cookies.options`
+   * → the per-call `options` argument.
+   *
    * @example
    * // JSON-wrapped (default) — round-trips with request.cookie()
-   * response.cookie("prefs", { theme: "dark" }, { maxAge: 3600, httpOnly: true });
+   * response.cookie("prefs", { theme: "dark" }, { maxAge: 3600 });
    *
    * @example
    * // Raw string — no JSON quoting; useful for tokens / opaque IDs
-   * response.cookie("session", "abc.def.ghi", { raw: true, httpOnly: true });
+   * response.cookie("session", "abc.def.ghi", { raw: true });
+   *
+   * @example
+   * // Deliberately readable by client-side JS
+   * response.cookie("theme", "dark", { httpOnly: false });
    */
   cookie(name: string, value: CookieValue, options?: CookieOptions): this;
   /**

package/esm/http/response.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"response.d.mts","names":[],"sources":["../../../../../../../core/src/http/response.ts"],"mappings":";;;;;;;;;;;;KAqBK,WAAA,+BAA0C,MAAA,gBAAsB,KAAK;;;;AAFoB;;;;AAEpB;AAc1E;;;;KAAY,aAAA,GAAgB,sBAAsB;EAStC;;;;;EAHV,GAAG;AAAA;AAAA,aAGO,cAAA;EACV,EAAA;EACA,OAAA;EACA,QAAA;EACA,iBAAA;EACA,KAAA;EACA,SAAA;EACA,YAAA;EACA,kBAAA;EACA,kBAAA;EACA,UAAA;EACA,WAAA;EACA,YAAA;EACA,SAAA;EACA,SAAA;EACA,kBAAA;EACA,QAAA;EACA,iBAAA;EACA,qBAAA;EACA,mBAAA;AAAA;;;;KAMU,eAAA;EACV,SAAA;EACA,SAAA;EACA,MAAA;EACA,QAAA;AAAA;;;;KAMU,iBAAA,GAAoB,eAAe;EAC7C,WAAA;EACA,IAAA;AAAA;AAAA,cAGW,QAAA;EAAQ;;;EAAA,UAIT,KAAA,EAAQ,KAAA;EAiCD;;;;;;;;;;;;;;;;EAfV,YAAA,EAAe,YAAA;EAsauB;;;EAAA,UAjanC,iBAAA;EAwamE;;;EAAA,UAnanE,WAAA;EAibmC;;;EA5atC,OAAA,EAAU,OAAA;EA0vBA;;;EAAA,UArvBP,MAAA,EAAM,GAAA;EA6yB2B;;;;;EAtyBpC,UAAA;EAy0B4B;;;EAAA,IAp0BxB,GAAA,wBAAG,cAAA,qBAAA,eAAA;EAy1BX;;;EAAA,IAl1BQ,IAAA;EAi2BqB;;;EAAA,IA11BrB,IAAA,CAAK,IAAA;EAw2B4B;;;EAj2BrC,SAAA,CAAU,QAAA;EAu3ByC;;;EA92BnD,MAAA,CAAO,QAAA;EA63BsB;;;EAp3B7B,WAAA,CAAY,QAAA,EAAU,YAAA;EA28B2D;;;EA57BjF,KAAA;EAkhC+D;;;EAzgC/D,QAAA,CAAS,KAAA,EAAO,KAAA;EAokCc;;;EAAA,IA3jC1B,WAAA;EAkkCoC;;;EA3jCxC,cAAA,CAAe,WAAA;EA0nCsB;;;EAAA,IAjnCjC,UAAA;EA1ID;;;EAAA,IAiJC,IAAA;EA1HD;;;EAAA,IAiIC,IAAA;EAlHD;;;EAAA,OAyHI,EAAA,CACZ,KAAA,EAAO,aAAA,EACP,QAAA,GAAW,QAAA,EAAU,QAAA,YACpB,iBAAA;EAhHW;;;EAAA,iBAuHS,OAAA,CAAQ,KAAA,EAAO,aAAA,KAAkB,IAAA,UAAW,OAAA;EAzGnD;;;EAAA,UAsHA,SAAA,IAAS,OAAA;EAtGX;;;EA6GD,KAAA,CAAM,KAAA,QAAa,OAAA;EArFzB;;;EA4HA,GAAA,CAAI,OAAA,UAAiB,KAAA,GAAO,QAAA;EA1GxB;;;EAAA,IA4HA,MAAA;EArGA;;;;;;EA+GE,IAAA,CAAK,IAAA,QAAY,UAAA,WAAqB,aAAA,aAAuB,OAAA,CAAQ,QAAA;EA/FhF;;;;;;;;;;;;;;;;;;;EA+PK,MAAA,CAAO,MAAA;IACZ,MAAA;IACA,IAAA;IACA,WAAA;IACA,OAAA,GAAU,MAAA;EAAA,IACR,OAAA,CAAQ,QAAA;EAHV;;;EAsBK,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAxB/B;;;EA+BP,MAAA,CAAO,OAAA,EAAS,KAAA,CAAM,YAAA,GAAe,KAAA,CAAM,aAAA,EAAe,MAAA,YAAY,OAAA,CAAA,QAAA;EAPjE;;;EAcL,GAAA,CAAI,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAPrC;;;EAcA,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAdK;;;;;;;;;;;;;;;;;;;EAqC3C,MAAA,CAAO,WAAA,YAA6B,wBAAA;EAqQpC;;;;;;;;;;;;;;;;;;;;;;;;EAtIA,GAAA,IAAO,qBAAA;EA6N2C;;;EAvFlD,aAAA,CAAc,UAAA;EA0GsB;;;EAjGpC,QAAA,CAAS,GAAA,UAAa,UAAA;EA2GC;;;EAlGvB,iBAAA,CAAkB,GAAA;EAyGG;;;EAhGrB,eAAA;EA0GJ;;;EAnGI,YAAA,CAAa,GAAA;EA2Ge;;;EAlG5B,SAAA,CAAU,GAAA;EA4Gd;;;EArGI,UAAA,IAAU,MAAA,+BAAA,UAAA;EAgHd;;;EAzGI,OAAA,CAAQ,OAAA,EAAS,MAAA;EAiHG;;;EAxGpB,MAAA,CAAO,GAAA,UAAa,KAAA;EA+GK;;;;;;;;;;;;;;;EA1FzB,MAAA,CAAO,IAAA,UAAc,KAAA,EAAO,WAAA,EAAa,OAAA,GAAS,aAAA;EA+GzC;;;;;;EA5FT,WAAA,CAAY,IAAA,UAAc,OAAA,GAAU,sBAAA;EA2G3B;;;EAjGT,SAAA,CAAU,GAAA,UAAa,KAAA;EAwGP;;;EAjGhB,WAAA,CAAY,IAAA,QAAS,OAAA,CAAA,QAAA;EAyGD;;;EAlGpB,SAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EA6IK;;;EArID,kBAAA,CAAmB,IAAA,QAAS,OAAA,CAAA,QAAA;EA8KsC;;;EAvKlE,YAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EA0PI;;;EAlPA,QAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EA+O+B;;;EAvO3B,UAAA,CAAW,IAAA,QAAS,OAAA,CAAA,QAAA;EAuO2C;;;EAhO/D,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;EAgOsC;;;EAzN/D,aAAA,CAAc,IAAA,QAAS,OAAA,CAAA,QAAA;EA6OH;;;EAtOpB,OAAA,CAAQ,IAAA,SAA6B,OAAA,CAAA,QAAA;EA6QrC;;;EAtQA,SAAA,IAAS,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,sBAAA,eAAA,sBAAA,cAAA,qBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;EAsQsD;;;;EA9P/D,QAAA,CAAS,IAAA,SAA0D,OAAA,CAAA,QAAA;EAqQ3B;;;EA9PxC,QAAA,CAAS,IAAA,SAA0C,OAAA,CAAA,QAAA;EAqQd;;;EA9PrC,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;EA8SN;;;;EAtSnB,mBAAA,CAAoB,IAAA,QAAS,OAAA,CAAA,QAAA;EA8SQ;;AAAA;;;;;;;;;;;;;UA3RpC,kBAAA;EAAA,QA2BA,oBAAA;;;;EAyCK,QAAA,CAAS,QAAA,WAAmB,WAAA,EAAa,OAAA,YAAmB,eAAA,GAAe,OAAA,CAAA,QAAA;;;;;EAsFjF,UAAA,CAAW,MAAA,EAAQ,MAAA,EAAQ,OAAA,YAAmB,iBAAA,GAAiB,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,sBAAA,eAAA,sBAAA,cAAA,qBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;;;;;EAkBzD,SAAA,CACX,KAAA;EACA,OAAA,aAAoB,IAAA,CAAK,iBAAA;IAAsC,WAAA;EAAA,KAAuB,OAAA;;;;;;EAuCjF,cAAA,CAAe,IAAA,WAAe,WAAA,EAAa,SAAA,YAAoB,OAAA,CAAA,QAAA;;;;EAO/D,QAAA,CAAS,IAAA,UAAc,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAOlC,YAAA,CAAa,QAAA,UAAkB,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAgDtD,kBAAA,CAAmB,QAAA;;;;EAQnB,YAAA,CAAa,MAAA,EAAQ,gBAAA,GAAgB,OAAA,CAAA,QAAA;AAAA"}
+{"version":3,"file":"response.d.mts","names":[],"sources":["../../../../../../../core/src/http/response.ts"],"mappings":";;;;;;;;;;;;KAsBK,WAAA,+BAA0C,MAAA,gBAAsB,KAAK;;;;AAFoB;;;;AAEpB;AAc1E;;;;KAAY,aAAA,GAAgB,sBAAsB;EAStC;;;;;EAHV,GAAG;AAAA;AAAA,aAGO,cAAA;EACV,EAAA;EACA,OAAA;EACA,QAAA;EACA,iBAAA;EACA,KAAA;EACA,SAAA;EACA,YAAA;EACA,kBAAA;EACA,kBAAA;EACA,UAAA;EACA,WAAA;EACA,YAAA;EACA,SAAA;EACA,SAAA;EACA,kBAAA;EACA,QAAA;EACA,iBAAA;EACA,qBAAA;EACA,mBAAA;AAAA;;;;KAMU,eAAA;EACV,SAAA;EACA,SAAA;EACA,MAAA;EACA,QAAA;AAAA;;;;KAMU,iBAAA,GAAoB,eAAe;EAC7C,WAAA;EACA,IAAA;AAAA;AAAA,cAqBW,QAAA;EAAQ;;;EAAA,UAIT,KAAA,EAAQ,KAAA;EAiCD;;;;;;;;;;;;;;;;EAfV,YAAA,EAAe,YAAA;EAsauB;;;EAAA,UAjanC,iBAAA;EAwamE;;;EAAA,UAnanE,WAAA;EAibmC;;;EA5atC,OAAA,EAAU,OAAA;EA0vBA;;;EAAA,UArvBP,MAAA,EAAM,GAAA;EA6zB2B;;;;;EAtzBpC,UAAA;EAy1B4B;;;EAAA,IAp1BxB,GAAA,wBAAG,cAAA,qBAAA,eAAA;EAy2BX;;;EAAA,IAl2BQ,IAAA;EAi3BqB;;;EAAA,IA12BrB,IAAA,CAAK,IAAA;EAw3B4B;;;EAj3BrC,SAAA,CAAU,QAAA;EAu4ByC;;;EA93BnD,MAAA,CAAO,QAAA;EA64BsB;;;EAp4B7B,WAAA,CAAY,QAAA,EAAU,YAAA;EA29B2D;;;EA58BjF,KAAA;EAkiC+D;;;EAzhC/D,QAAA,CAAS,KAAA,EAAO,KAAA;EAolCc;;;EAAA,IA3kC1B,WAAA;EAklCoC;;;EA3kCxC,cAAA,CAAe,WAAA;EA0oCsB;;;EAAA,IAjoCjC,UAAA;EA1ID;;;EAAA,IAiJC,IAAA;EA1HD;;;EAAA,IAiIC,IAAA;EAlHD;;;EAAA,OAyHI,EAAA,CACZ,KAAA,EAAO,aAAA,EACP,QAAA,GAAW,QAAA,EAAU,QAAA,YACpB,iBAAA;EAhHW;;;EAAA,iBAuHS,OAAA,CAAQ,KAAA,EAAO,aAAA,KAAkB,IAAA,UAAW,OAAA;EAzGnD;;;EAAA,UAsHA,SAAA,IAAS,OAAA;EAtGX;;;EA6GD,KAAA,CAAM,KAAA,QAAa,OAAA;EArFzB;;;EA4HA,GAAA,CAAI,OAAA,UAAiB,KAAA,GAAO,QAAA;EA1GxB;;;EAAA,IA4HA,MAAA;EArGA;;;;;;EA+GE,IAAA,CAAK,IAAA,QAAY,UAAA,WAAqB,aAAA,aAAuB,OAAA,CAAQ,QAAA;EA/FhF;;;;;;;;;;;;;;;;;;;EA+PK,MAAA,CAAO,MAAA;IACZ,MAAA;IACA,IAAA;IACA,WAAA;IACA,OAAA,GAAU,MAAA;EAAA,IACR,OAAA,CAAQ,QAAA;EAHV;;;EAsBK,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAxB/B;;;EA+BP,MAAA,CAAO,OAAA,EAAS,KAAA,CAAM,YAAA,GAAe,KAAA,CAAM,aAAA,EAAe,MAAA,YAAY,OAAA,CAAA,QAAA;EAPjE;;;EAcL,GAAA,CAAI,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAPrC;;;EAcA,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAdK;;;;;;;;;;;;;;;;;;;EAqC3C,MAAA,CAAO,WAAA,YAA6B,wBAAA;EAqQpC;;;;;;;;;;;;;;;;;;;;;;;;EAtIA,GAAA,IAAO,qBAAA;EA4O2C;;;EAtGlD,aAAA,CAAc,UAAA;EA0HsB;;;EAjHpC,QAAA,CAAS,GAAA,UAAa,UAAA;EA2HC;;;EAlHvB,iBAAA,CAAkB,GAAA;EAyHG;;;EAhHrB,eAAA;EA0HJ;;;EAnHI,YAAA,CAAa,GAAA;EA2He;;;EAlH5B,SAAA,CAAU,GAAA;EA4Hd;;;EArHI,UAAA,IAAU,MAAA,+BAAA,UAAA;EAgId;;;EAzHI,OAAA,CAAQ,OAAA,EAAS,MAAA;EAiIG;;;EAxHpB,MAAA,CAAO,GAAA,UAAa,KAAA;EA+HK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA3FzB,MAAA,CAAO,IAAA,UAAc,KAAA,EAAO,WAAA,EAAa,OAAA,GAAS,aAAA;EA8I9B;;;;;;EA1HpB,WAAA,CAAY,IAAA,UAAc,OAAA,GAAU,sBAAA;EAiNrB;;;EAvMf,SAAA,CAAU,GAAA,UAAa,KAAA;EAuM0D;;;EAhMjF,WAAA,CAAY,IAAA,QAAS,OAAA,CAAA,QAAA;EAsRyB;;;EA/Q9C,SAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EA4QmE;;;EApQ/D,kBAAA,CAAmB,IAAA,QAAS,OAAA,CAAA,QAAA;EAoQmC;;;EA7P/D,YAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EA8QmB;;;EAtQf,QAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EAmQqF;;;EA3PjF,UAAA,CAAW,IAAA,QAAS,OAAA,CAAA,QAAA;EAkSuB;;;EA3R3C,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;EAkShB;;;EA3RT,aAAA,CAAc,IAAA,QAAS,OAAA,CAAA,QAAA;EAkSjB;;;EA3RN,OAAA,CAAQ,IAAA,SAA6B,OAAA,CAAA,QAAA;EA2RiB;;;EApRtD,SAAA,IAAS,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,sBAAA,eAAA,sBAAA,cAAA,qBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;EA4UY;;;;EApUrB,QAAA,CAAS,IAAA,SAA0D,OAAA,CAAA,QAAA;EAoU9B;;;EA7TrC,QAAA,CAAS,IAAA,SAA0C,OAAA,CAAA,QAAA;;;;EAOnD,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;;EAQzB,mBAAA,CAAoB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;;;;;;;;;;;;;UAmB5B,kBAAA;EAAA,QA2BA,oBAAA;;;;EAyCK,QAAA,CAAS,QAAA,WAAmB,WAAA,EAAa,OAAA,YAAmB,eAAA,GAAe,OAAA,CAAA,QAAA;;;;;EAsFjF,UAAA,CAAW,MAAA,EAAQ,MAAA,EAAQ,OAAA,YAAmB,iBAAA,GAAiB,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,sBAAA,eAAA,sBAAA,cAAA,qBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;;;;;EAkBzD,SAAA,CACX,KAAA;EACA,OAAA,aAAoB,IAAA,CAAK,iBAAA;IAAsC,WAAA;EAAA,KAAuB,OAAA;;;;;;EAuCjF,cAAA,CAAe,IAAA,WAAe,WAAA,EAAa,SAAA,YAAoB,OAAA,CAAA,QAAA;;;;EAO/D,QAAA,CAAS,IAAA,UAAc,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAOlC,YAAA,CAAa,QAAA,UAAkB,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAgDtD,kBAAA,CAAmB,QAAA;;;;EAQnB,YAAA,CAAa,MAAA,EAAQ,gBAAA,GAAgB,OAAA,CAAA,QAAA;AAAA"}

package/esm/http/response.mjs

@@ -1,7 +1,8 @@
+import { Application } from "../application/application.mjs";
 import { StorageFile } from "../storage/storage-file.mjs";
 import "../storage/index.mjs";
 import { renderReact } from "../react/index.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { log } from "@warlock.js/logger";
 import path from "path";
 import { isIterable, isPlainObject, isScalar } from "@mongez/supportive-is";
@@ -33,6 +34,23 @@ let ResponseStatus = /* @__PURE__ */ function(ResponseStatus) {
 	ResponseStatus[ResponseStatus["SERVICE_UNAVAILABLE"] = 503] = "SERVICE_UNAVAILABLE";
 	return ResponseStatus;
 }({});
+/**
+* The cookie flags every response cookie gets unless something overrides them.
+*
+* Computed per call rather than hoisted to a constant because `secure` depends
+* on the environment, which is not known at module-evaluation time.
+*
+* `secure` is relaxed in development only: a `Secure` cookie is dropped by the
+* browser over plain http, which would silently break every local login. It
+* stays on everywhere else, including test and staging.
+*/
+function secureCookieDefaults() {
+	return {
+		httpOnly: true,
+		sameSite: "lax",
+		secure: !Application.isDevelopment
+	};
+}
 var Response = class Response {
 	constructor() {
 		this.currentStatusCode = 200;
@@ -175,7 +193,7 @@ var Response = class Response {
 	* Make a log message
 	*/
 	log(message, level = "info") {
-		if (!config.get("http.log")) return;
+		if (!baseConfig.get("http.log")) return;
 		log.log({
 			module: "response",
 			action: this.route.method + " " + this.route.path.replace("/*", "") + `:${this.request.id}`,
@@ -551,19 +569,35 @@ var Response = class Response {
 	* cleanly with `request.cookie(name)`. Pass `{ raw: true }` to skip the
 	* JSON wrapping for plain-string cookies (session tokens, opaque IDs).
 	*
+	* **Secure by default.** `httpOnly: true`, `sameSite: "lax"`, and — outside
+	* development — `secure: true` are applied unless you override them. These
+	* are the flags whose absence never fails a test and is fatal in production:
+	* without `httpOnly` any injected script can read the cookie, without
+	* `secure` it travels in cleartext, without `sameSite` it rides along on
+	* cross-site requests. Opting out is explicit, per call or via
+	* `http.cookies.options`.
+	*
+	* Precedence, lowest to highest: framework defaults → `http.cookies.options`
+	* → the per-call `options` argument.
+	*
 	* @example
 	* // JSON-wrapped (default) — round-trips with request.cookie()
-	* response.cookie("prefs", { theme: "dark" }, { maxAge: 3600, httpOnly: true });
+	* response.cookie("prefs", { theme: "dark" }, { maxAge: 3600 });
 	*
 	* @example
 	* // Raw string — no JSON quoting; useful for tokens / opaque IDs
-	* response.cookie("session", "abc.def.ghi", { raw: true, httpOnly: true });
+	* response.cookie("session", "abc.def.ghi", { raw: true });
+	*
+	* @example
+	* // Deliberately readable by client-side JS
+	* response.cookie("theme", "dark", { httpOnly: false });
 	*/
 	cookie(name, value, options = {}) {
 		const { raw, ...cookieOptions } = options;
-		const defaultOptions = config.get("http.cookies.options", {});
+		const defaultOptions = baseConfig.get("http.cookies.options", {});
 		const serializedValue = raw ? String(value) : JSON.stringify(value);
 		this.baseResponse.setCookie(name, serializedValue, {
+			...secureCookieDefaults(),
 			...defaultOptions,
 			...cookieOptions
 		});
@@ -576,7 +610,7 @@ var Response = class Response {
 	* response.clearCookie('token', { path: '/' });
 	*/
 	clearCookie(name, options) {
-		const defaultOptions = config.get("http.cookies.options", {});
+		const defaultOptions = baseConfig.get("http.cookies.options", {});
 		this.baseResponse.clearCookie(name, {
 			...defaultOptions,
 			...options
@@ -849,7 +883,7 @@ var Response = class Response {
 	* Mark the response as failed
 	*/
 	failedSchema(result) {
-		const { errors, inputKey, inputError, status } = config.get("validation.response", {
+		const { errors, inputKey, inputError, status } = baseConfig.get("validation.response", {
 			errors: "errors",
 			inputKey: "input",
 			inputError: "error",