@warlock.js/core 5.1.0 → 5.2.0

package/esm/http/middleware/ip-filter.middleware.d.mts

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/ip-filter.middleware.d.ts
+//#region core/src/http/middleware/ip-filter.middleware.d.ts
 /**
  * Options for the IP filter middleware. Use at least one of `allow` / `deny`.
  *
@@ -28,7 +28,7 @@ type IpFilterOptions = {
  * Reads the client IP via `request.detectIp()`, which honors the forwarding
  * headers only when `http.trustProxy` is set — otherwise the socket peer
  * address is used, since both headers are client-settable. When opting in,
- * prefer a bounded `http.trustProxy` (hop count or CIDR list of your proxies)
+ * prefer a bounded `http.trustProxy` (a CIDR list of your proxies)
  * over `true`: with `true`, any client that can reach the process directly
  * picks its own IP and this allowlist is decorative.
  *

package/esm/http/middleware/ip-filter.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ip-filter.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/ip-filter.middleware.ts"],"mappings":";;;;;AAUA;;KAAY,eAAA;EAAe;;;;EAKzB,KAAA;EASY;AA+Bd;;;EAnCE,IAAA;EAmC0C;;;EA/B1C,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Bc,kBAAA,CAAmB,OAAA,EAAS,eAAA,GAAkB,UAAU"}
+{"version":3,"file":"ip-filter.middleware.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/ip-filter.middleware.ts"],"mappings":";;;;;AAUA;;KAAY,eAAA;EAAe;;;;EAKzB,KAAA;EASY;AA+Bd;;;EAnCE,IAAA;EAmC0C;;;EA/B1C,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Bc,kBAAA,CAAmB,OAAA,EAAS,eAAA,GAAkB,UAAU"}

package/esm/http/middleware/ip-filter.middleware.mjs

@@ -2,7 +2,7 @@ import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
 import { anyMatch } from "./utils/cidr-match.mjs";
 
-//#region ../core/src/http/middleware/ip-filter.middleware.ts
+//#region core/src/http/middleware/ip-filter.middleware.ts
 /**
 * Allow / deny requests by client IP. Fail-closed: if the IP can't be read,
 * the request is rejected with 403.
@@ -10,7 +10,7 @@ import { anyMatch } from "./utils/cidr-match.mjs";
 * Reads the client IP via `request.detectIp()`, which honors the forwarding
 * headers only when `http.trustProxy` is set — otherwise the socket peer
 * address is used, since both headers are client-settable. When opting in,
-* prefer a bounded `http.trustProxy` (hop count or CIDR list of your proxies)
+* prefer a bounded `http.trustProxy` (a CIDR list of your proxies)
 * over `true`: with `true`, any client that can reach the process directly
 * picks its own IP and this allowlist is decorative.
 *

package/esm/http/middleware/ip-filter.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ip-filter.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/ip-filter.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { anyMatch } from \"./utils/cidr-match\";\n\n/**\n * Options for the IP filter middleware. Use at least one of `allow` / `deny`.\n *\n * Precedence: `deny` wins. If a request matches both lists it is denied.\n */\nexport type IpFilterOptions = {\n  /**\n   * Allowlist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. When present,\n   * only IPs matching the list pass through.\n   */\n  allow?: string[];\n  /**\n   * Denylist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. Matched IPs\n   * are rejected regardless of the allowlist.\n   */\n  deny?: string[];\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\n/**\n * Allow / deny requests by client IP. Fail-closed: if the IP can't be read,\n * the request is rejected with 403.\n *\n * Reads the client IP via `request.detectIp()`, which honors the forwarding\n * headers only when `http.trustProxy` is set — otherwise the socket peer\n * address is used, since both headers are client-settable. When opting in,\n * prefer a bounded `http.trustProxy` (hop count or CIDR list of your proxies)\n * over `true`: with `true`, any client that can reach the process directly\n * picks its own IP and this allowlist is decorative.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.group(\n *   {\n *     prefix: \"/admin\",\n *     middleware: [middleware.ipFilter({ allow: [\"10.0.0.0/8\", \"203.0.113.42\"] })],\n *   },\n *   () => {\n *     router.get(\"/dashboard\", dashboardController);\n *   },\n * );\n *\n * router.post(\"/webhooks/provider\", webhookController, {\n *   middleware: [middleware.ipFilter({ allow: [\"198.51.100.0/24\"] })],\n * });\n */\nexport function ipFilterMiddleware(options: IpFilterOptions): Middleware {\n  return ({ request, response }) => {\n    const ip = request.detectIp();\n\n    if (!ip || typeof ip !== \"string\") {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.deny && anyMatch(ip, options.deny)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.allow && !anyMatch(ip, options.allow)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,mBAAmB,SAAsC;CACvE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,CAAC,MAAM,OAAO,OAAO,UACvB,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,QAAQ,SAAS,IAAI,QAAQ,IAAI,GAC3C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,SAAS,CAAC,SAAS,IAAI,QAAQ,KAAK,GAC9C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CAEL;AACF"}
+{"version":3,"file":"ip-filter.middleware.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/ip-filter.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { anyMatch } from \"./utils/cidr-match\";\n\n/**\n * Options for the IP filter middleware. Use at least one of `allow` / `deny`.\n *\n * Precedence: `deny` wins. If a request matches both lists it is denied.\n */\nexport type IpFilterOptions = {\n  /**\n   * Allowlist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. When present,\n   * only IPs matching the list pass through.\n   */\n  allow?: string[];\n  /**\n   * Denylist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. Matched IPs\n   * are rejected regardless of the allowlist.\n   */\n  deny?: string[];\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\n/**\n * Allow / deny requests by client IP. Fail-closed: if the IP can't be read,\n * the request is rejected with 403.\n *\n * Reads the client IP via `request.detectIp()`, which honors the forwarding\n * headers only when `http.trustProxy` is set — otherwise the socket peer\n * address is used, since both headers are client-settable. When opting in,\n * prefer a bounded `http.trustProxy` (a CIDR list of your proxies)\n * over `true`: with `true`, any client that can reach the process directly\n * picks its own IP and this allowlist is decorative.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.group(\n *   {\n *     prefix: \"/admin\",\n *     middleware: [middleware.ipFilter({ allow: [\"10.0.0.0/8\", \"203.0.113.42\"] })],\n *   },\n *   () => {\n *     router.get(\"/dashboard\", dashboardController);\n *   },\n * );\n *\n * router.post(\"/webhooks/provider\", webhookController, {\n *   middleware: [middleware.ipFilter({ allow: [\"198.51.100.0/24\"] })],\n * });\n */\nexport function ipFilterMiddleware(options: IpFilterOptions): Middleware {\n  return ({ request, response }) => {\n    const ip = request.detectIp();\n\n    if (!ip || typeof ip !== \"string\") {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.deny && anyMatch(ip, options.deny)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.allow && !anyMatch(ip, options.allow)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,mBAAmB,SAAsC;CACvE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,CAAC,MAAM,OAAO,OAAO,UACvB,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,QAAQ,SAAS,IAAI,QAAQ,IAAI,GAC3C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,SAAS,CAAC,SAAS,IAAI,QAAQ,KAAK,GAC9C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CAEL;AACF"}

package/esm/http/middleware/maintenance.middleware.d.mts

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/maintenance.middleware.d.ts
+//#region core/src/http/middleware/maintenance.middleware.d.ts
 /**
  * Options for the maintenance middleware.
  */

package/esm/http/middleware/maintenance.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/maintenance.middleware.ts"],"mappings":";;;;;KAQY,kBAAA;EAAkB;;;;;;;AAkBhB;EATZ,SAAA;EA0CmC;;;;EArCnC,UAAA;EAqCuE;;AAAU;EAjCjF,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;iBAiCc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}
+{"version":3,"file":"maintenance.middleware.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/maintenance.middleware.ts"],"mappings":";;;;;KAQY,kBAAA;EAAkB;;;;;;;AAkBhB;EATZ,SAAA;EA0CmC;;;;EArCnC,UAAA;EAqCuE;;AAAU;EAjCjF,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;iBAiCc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}

package/esm/http/middleware/maintenance.middleware.mjs

@@ -2,7 +2,7 @@ import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
 import config from "@mongez/config";
 
-//#region ../core/src/http/middleware/maintenance.middleware.ts
+//#region core/src/http/middleware/maintenance.middleware.ts
 function isAllowlisted(path, patterns) {
 	return patterns.some((pattern) => {
 		if (pattern.endsWith("*")) return path.startsWith(pattern.slice(0, -1));

package/esm/http/middleware/maintenance.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return ({ request, response }) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist =\n      options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    // `request.path` includes the query string, but allowlist entries are\n    // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n    // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n    const pathname = request.path.split(\"?\")[0];\n\n    if (isAllowlisted(pathname, allowlist)) return;\n\n    const retryAfter =\n      options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,EAAE,SAAS,eAAe;EAGhC,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YACJ,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAK3E,MAAM,WAAW,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC;EAEzC,IAAI,cAAc,UAAU,SAAS,GAAG;EAExC,MAAM,aACJ,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAEpE,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return ({ request, response }) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist =\n      options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    // `request.path` includes the query string, but allowlist entries are\n    // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n    // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n    const pathname = request.path.split(\"?\")[0];\n\n    if (isAllowlisted(pathname, allowlist)) return;\n\n    const retryAfter =\n      options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,EAAE,SAAS,eAAe;EAGhC,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YACJ,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAK3E,MAAM,WAAW,QAAQ,KAAK,MAAM,GAAG,EAAE;EAEzC,IAAI,cAAc,UAAU,SAAS,GAAG;EAExC,MAAM,aACJ,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAEpE,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}

package/esm/http/middleware/max-body-size.middleware.d.mts

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/max-body-size.middleware.d.ts
+//#region core/src/http/middleware/max-body-size.middleware.d.ts
 /**
  * Reject requests whose `Content-Length` exceeds the configured cap.
  *

package/esm/http/middleware/max-body-size.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"max-body-size.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/max-body-size.middleware.ts"],"mappings":";;;;;AAiCA;;;;AAAyE;;;;;;;;;;;;;;;;;;;;;iBAAzD,qBAAA,CAAsB,KAAA,oBAAyB,UAAU"}
+{"version":3,"file":"max-body-size.middleware.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/max-body-size.middleware.ts"],"mappings":";;;;;AAiCA;;;;AAAyE;;;;;;;;;;;;;;;;;;;;;iBAAzD,qBAAA,CAAsB,KAAA,oBAAyB,UAAU"}

package/esm/http/middleware/max-body-size.middleware.mjs

@@ -2,7 +2,7 @@ import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
 import { parseSize } from "./utils/parse-size.mjs";
 
-//#region ../core/src/http/middleware/max-body-size.middleware.ts
+//#region core/src/http/middleware/max-body-size.middleware.ts
 /**
 * Reject requests whose `Content-Length` exceeds the configured cap.
 *

package/esm/http/middleware/max-body-size.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"max-body-size.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/max-body-size.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { parseSize } from \"./utils/parse-size\";\n\n/**\n * Reject requests whose `Content-Length` exceeds the configured cap.\n *\n * ⚠️ **This runs AFTER the body has been parsed, not before it.** Framework\n * middleware executes inside the Fastify route handler, and `@fastify/multipart`\n * is registered with `attachFieldsToBody: true` — so by the time this sees the\n * request, the bytes are already resident. It inspects `Content-Length` and\n * answers 413; it does not and cannot prevent the read.\n *\n * **So this is not a resource-exhaustion control.** For that, lower\n * `http.bodyLimit`, or set `bodyLimit` in the route's own `serverOptions` —\n * Fastify enforces those while reading. This middleware is a per-route\n * convenience for returning a consistent 413, not a replacement for either.\n *\n * The same caveat applies to `concurrencyLimit`: it bounds how many requests\n * run at once, not how many bytes are resident.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/comments\", createCommentController, {\n *   middleware: [middleware.maxBodySize(\"8kb\")],\n * });\n *\n * router.post(\"/uploads\", uploadController, {\n *   middleware: [middleware.maxBodySize(\"10mb\")],\n * });\n */\nexport function maxBodySizeMiddleware(limit: string | number): Middleware {\n  const limitBytes = parseSize(limit);\n\n  return ({ request, response }) => {\n    const contentLengthHeader = request.header(\"content-length\");\n\n    if (!contentLengthHeader) return;\n\n    const contentLength = Number(contentLengthHeader);\n\n    if (!Number.isFinite(contentLength)) return;\n\n    if (contentLength <= limitBytes) return;\n\n    response.header(\"Connection\", \"close\");\n\n    return response.contentTooLarge({\n        error: t(\"http.bodyTooLarge\"),\n        errorCode: HttpErrorCodes.BodyTooLarge,\n        limit: limitBytes,\n        received: contentLength,\n      },\n    );\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,sBAAsB,OAAoC;CACxE,MAAM,aAAa,UAAU,KAAK;CAElC,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,sBAAsB,QAAQ,OAAO,gBAAgB;EAE3D,IAAI,CAAC,qBAAqB;EAE1B,MAAM,gBAAgB,OAAO,mBAAmB;EAEhD,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;EAErC,IAAI,iBAAiB,YAAY;EAEjC,SAAS,OAAO,cAAc,OAAO;EAErC,OAAO,SAAS,gBAAgB;GAC5B,OAAO,EAAE,mBAAmB;GAC5B;GACA,OAAO;GACP,UAAU;EACZ,CACF;CACF;AACF"}
+{"version":3,"file":"max-body-size.middleware.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/max-body-size.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { parseSize } from \"./utils/parse-size\";\n\n/**\n * Reject requests whose `Content-Length` exceeds the configured cap.\n *\n * ⚠️ **This runs AFTER the body has been parsed, not before it.** Framework\n * middleware executes inside the Fastify route handler, and `@fastify/multipart`\n * is registered with `attachFieldsToBody: true` — so by the time this sees the\n * request, the bytes are already resident. It inspects `Content-Length` and\n * answers 413; it does not and cannot prevent the read.\n *\n * **So this is not a resource-exhaustion control.** For that, lower\n * `http.bodyLimit`, or set `bodyLimit` in the route's own `serverOptions` —\n * Fastify enforces those while reading. This middleware is a per-route\n * convenience for returning a consistent 413, not a replacement for either.\n *\n * The same caveat applies to `concurrencyLimit`: it bounds how many requests\n * run at once, not how many bytes are resident.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/comments\", createCommentController, {\n *   middleware: [middleware.maxBodySize(\"8kb\")],\n * });\n *\n * router.post(\"/uploads\", uploadController, {\n *   middleware: [middleware.maxBodySize(\"10mb\")],\n * });\n */\nexport function maxBodySizeMiddleware(limit: string | number): Middleware {\n  const limitBytes = parseSize(limit);\n\n  return ({ request, response }) => {\n    const contentLengthHeader = request.header(\"content-length\");\n\n    if (!contentLengthHeader) return;\n\n    const contentLength = Number(contentLengthHeader);\n\n    if (!Number.isFinite(contentLength)) return;\n\n    if (contentLength <= limitBytes) return;\n\n    response.header(\"Connection\", \"close\");\n\n    return response.contentTooLarge({\n        error: t(\"http.bodyTooLarge\"),\n        errorCode: HttpErrorCodes.BodyTooLarge,\n        limit: limitBytes,\n        received: contentLength,\n      },\n    );\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,sBAAsB,OAAoC;CACxE,MAAM,aAAa,UAAU,KAAK;CAElC,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,sBAAsB,QAAQ,OAAO,gBAAgB;EAE3D,IAAI,CAAC,qBAAqB;EAE1B,MAAM,gBAAgB,OAAO,mBAAmB;EAEhD,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;EAErC,IAAI,iBAAiB,YAAY;EAEjC,SAAS,OAAO,cAAc,OAAO;EAErC,OAAO,SAAS,gBAAgB;GAC5B,OAAO,EAAE,mBAAmB;GAC5B;GACA,OAAO;GACP,UAAU;EACZ,CACF;CACF;AACF"}

package/esm/http/middleware/middleware-list.d.mts

@@ -6,7 +6,7 @@ import { maintenanceMiddleware } from "./maintenance.middleware.mjs";
 import { maxBodySizeMiddleware } from "./max-body-size.middleware.mjs";
 import { rateLimitMiddleware } from "./rate-limit.middleware.mjs";
 
-//#region ../core/src/http/middleware/middleware-list.d.ts
+//#region core/src/http/middleware/middleware-list.d.ts
 /**
  * Built-in HTTP middleware factories.
  *

package/esm/http/middleware/middleware-list.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware-list.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/middleware-list.ts"],"mappings":";;;;;;;;;;;AA+BA;;;;;;;;;;;;;;;;;;;;;cAAa,UAAA;EAAA"}
+{"version":3,"file":"middleware-list.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/middleware-list.ts"],"mappings":";;;;;;;;;;;AA+BA;;;;;;;;;;;;;;;;;;;;;cAAa,UAAA;EAAA"}

package/esm/http/middleware/middleware-list.mjs

@@ -6,7 +6,7 @@ import { maintenanceMiddleware } from "./maintenance.middleware.mjs";
 import { maxBodySizeMiddleware } from "./max-body-size.middleware.mjs";
 import { rateLimitMiddleware } from "./rate-limit.middleware.mjs";
 
-//#region ../core/src/http/middleware/middleware-list.ts
+//#region core/src/http/middleware/middleware-list.ts
 /**
 * Built-in HTTP middleware factories.
 *

package/esm/http/middleware/middleware-list.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware-list.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/middleware-list.ts"],"sourcesContent":["import { cacheMiddleware } from \"./cache-response-middleware\";\nimport { concurrencyLimitMiddleware } from \"./concurrency-limit.middleware\";\nimport { idempotencyMiddleware } from \"./idempotency.middleware\";\nimport { ipFilterMiddleware } from \"./ip-filter.middleware\";\nimport { maintenanceMiddleware } from \"./maintenance.middleware\";\nimport { maxBodySizeMiddleware } from \"./max-body-size.middleware\";\nimport { rateLimitMiddleware } from \"./rate-limit.middleware\";\n\n/**\n * Built-in HTTP middleware factories.\n *\n * Single canonical entry point for the framework's middleware suite. Each\n * property is a factory that returns a `Middleware` ready to drop into a\n * route's `middleware` array.\n *\n * Bare names (`rateLimitMiddleware`, etc.) are not exported from the package —\n * always reach for them via this namespace. The internal `*Middleware` suffix\n * naming exists for in-package code organization only.\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware, router } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.rateLimit({ max: 5, duration: 60_000 }),\n *     middleware.idempotency(),\n *   ],\n * });\n */\nexport const middleware = {\n  cache: cacheMiddleware,\n  concurrencyLimit: concurrencyLimitMiddleware,\n  idempotency: idempotencyMiddleware,\n  ipFilter: ipFilterMiddleware,\n  maintenance: maintenanceMiddleware,\n  maxBodySize: maxBodySizeMiddleware,\n  rateLimit: rateLimitMiddleware,\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAa,aAAa;CACxB,OAAO;CACP,kBAAkB;CAClB,aAAa;CACb,UAAU;CACV,aAAa;CACb,aAAa;CACb,WAAW;AACb"}
+{"version":3,"file":"middleware-list.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/middleware-list.ts"],"sourcesContent":["import { cacheMiddleware } from \"./cache-response-middleware\";\nimport { concurrencyLimitMiddleware } from \"./concurrency-limit.middleware\";\nimport { idempotencyMiddleware } from \"./idempotency.middleware\";\nimport { ipFilterMiddleware } from \"./ip-filter.middleware\";\nimport { maintenanceMiddleware } from \"./maintenance.middleware\";\nimport { maxBodySizeMiddleware } from \"./max-body-size.middleware\";\nimport { rateLimitMiddleware } from \"./rate-limit.middleware\";\n\n/**\n * Built-in HTTP middleware factories.\n *\n * Single canonical entry point for the framework's middleware suite. Each\n * property is a factory that returns a `Middleware` ready to drop into a\n * route's `middleware` array.\n *\n * Bare names (`rateLimitMiddleware`, etc.) are not exported from the package —\n * always reach for them via this namespace. The internal `*Middleware` suffix\n * naming exists for in-package code organization only.\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware, router } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.rateLimit({ max: 5, duration: 60_000 }),\n *     middleware.idempotency(),\n *   ],\n * });\n */\nexport const middleware = {\n  cache: cacheMiddleware,\n  concurrencyLimit: concurrencyLimitMiddleware,\n  idempotency: idempotencyMiddleware,\n  ipFilter: ipFilterMiddleware,\n  maintenance: maintenanceMiddleware,\n  maxBodySize: maxBodySizeMiddleware,\n  rateLimit: rateLimitMiddleware,\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAa,aAAa;CACxB,OAAO;CACP,kBAAkB;CAClB,aAAa;CACb,UAAU;CACV,aAAa;CACb,aAAa;CACb,WAAW;AACb"}

package/esm/http/middleware/rate-limit.middleware.d.mts

@@ -1,6 +1,6 @@
 import { Request } from "../request.mjs";
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/rate-limit.middleware.d.ts
+//#region core/src/http/middleware/rate-limit.middleware.d.ts
 /**
  * Options for the per-route rate limit middleware.
  */

package/esm/http/middleware/rate-limit.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/rate-limit.middleware.ts"],"mappings":";;;;;;KAQY,gBAAA;EAAgB;;;EAI1B,GAAA;EAIA;;;EAAA,QAAA;EAYA;;AAAY;AA6Cd;;;;EAjDE,YAAA,IAAgB,OAAA,EAAS,OAAO;EAiDE;;;EA7ClC,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;iBA6Cc,mBAAA,CAAoB,OAAA,EAAS,gBAAA,GAAmB,UAAU"}
+{"version":3,"file":"rate-limit.middleware.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/rate-limit.middleware.ts"],"mappings":";;;;;;KAQY,gBAAA;EAAgB;;;EAI1B,GAAA;EAIA;;;EAAA,QAAA;EAYA;;AAAY;AA6Cd;;;;EAjDE,YAAA,IAAgB,OAAA,EAAS,OAAO;EAiDE;;;EA7ClC,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;iBA6Cc,mBAAA,CAAoB,OAAA,EAAS,gBAAA,GAAmB,UAAU"}

package/esm/http/middleware/rate-limit.middleware.mjs

@@ -1,7 +1,7 @@
 import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
 
-//#region ../core/src/http/middleware/rate-limit.middleware.ts
+//#region core/src/http/middleware/rate-limit.middleware.ts
 const buckets = /* @__PURE__ */ new Map();
 /**
 * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys

package/esm/http/middleware/rate-limit.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/rate-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the per-route rate limit middleware.\n */\nexport type RateLimitOptions = {\n  /**\n   * Max requests allowed within the time window.\n   */\n  max: number;\n  /**\n   * Time window in milliseconds.\n   */\n  duration: number;\n  /**\n   * Group key generator. Defaults to the client IP. Override to scope per-user,\n   * per-organization, per-tenant, etc.\n   *\n   * @example\n   * keyGenerator: (request) => request.user?.id ?? request.ip,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\ntype Bucket = {\n  count: number;\n  resetAt: number;\n};\n\nconst buckets = new Map<string, Bucket>();\n\n/**\n * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys\n * (rare per-user keys, dynamic path parameters in `keyGenerator`, etc.).\n * Called opportunistically, at most once per minute, not on a timer — keeps\n * the module side-effect-free for testing.\n */\nlet lastPruneAt = 0;\n\nfunction pruneExpired(now: number) {\n  for (const [key, bucket] of buckets) {\n    if (bucket.resetAt <= now) {\n      buckets.delete(key);\n    }\n  }\n}\n\n/**\n * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s\n * global cap (configured via `http.rateLimit`) — both run, and either can\n * 429. Use this for endpoints that need a tighter cap than the global default:\n * login, OTP request, password reset, expensive search, AI completions.\n *\n * The counter lives in-process. With `N` replicas the effective cap is\n * `N × max`. For genuinely shared limits, configure `@fastify/rate-limit`'s\n * Redis store via `http.rateLimit` instead.\n *\n * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on\n * every response; adds `Retry-After` (seconds) on a 429.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],\n * });\n */\nexport function rateLimitMiddleware(options: RateLimitOptions): Middleware {\n  return ({ request, response }) => {\n    const now = Date.now();\n\n    if (now - lastPruneAt > 60_000) {\n      pruneExpired(now);\n      lastPruneAt = now;\n    }\n\n    const groupKey = options.keyGenerator?.(request) || request.detectIp() || \"unknown\";\n    const cacheKey = `${request.route.path}:${groupKey}`;\n\n    let bucket = buckets.get(cacheKey);\n\n    if (!bucket || bucket.resetAt <= now) {\n      bucket = { count: 0, resetAt: now + options.duration };\n      buckets.set(cacheKey, bucket);\n    }\n\n    bucket.count++;\n\n    const remaining = Math.max(0, options.max - bucket.count);\n    const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));\n\n    response.header(\"X-RateLimit-Limit\", options.max);\n    response.header(\"X-RateLimit-Remaining\", remaining);\n    response.header(\"X-RateLimit-Reset\", Math.ceil(bucket.resetAt / 1000));\n\n    if (bucket.count > options.max) {\n      response.header(\"Retry-After\", retryAfter);\n\n      return response.tooManyRequests({\n          error: options.errorMessage || t(\"http.rateLimitExceeded\"),\n          errorCode: HttpErrorCodes.RateLimitExceeded,\n        },\n      );\n    }\n  };\n}\n"],"mappings":";;;;AAoCA,MAAM,0BAAU,IAAI,IAAoB;;;;;;;AAQxC,IAAI,cAAc;AAElB,SAAS,aAAa,KAAa;CACjC,KAAK,MAAM,CAAC,KAAK,WAAW,SAC1B,IAAI,OAAO,WAAW,KACpB,QAAQ,OAAO,GAAG;AAGxB;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,oBAAoB,SAAuC;CACzE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI,MAAM,cAAc,KAAQ;GAC9B,aAAa,GAAG;GAChB,cAAc;EAChB;EAEA,MAAM,WAAW,QAAQ,eAAe,OAAO,KAAK,QAAQ,SAAS,KAAK;EAC1E,MAAM,WAAW,GAAG,QAAQ,MAAM,KAAK,GAAG;EAE1C,IAAI,SAAS,QAAQ,IAAI,QAAQ;EAEjC,IAAI,CAAC,UAAU,OAAO,WAAW,KAAK;GACpC,SAAS;IAAE,OAAO;IAAG,SAAS,MAAM,QAAQ;GAAS;GACrD,QAAQ,IAAI,UAAU,MAAM;EAC9B;EAEA,OAAO;EAEP,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,MAAM,OAAO,KAAK;EACxD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,OAAO,GAAI,CAAC;EAEvE,SAAS,OAAO,qBAAqB,QAAQ,GAAG;EAChD,SAAS,OAAO,yBAAyB,SAAS;EAClD,SAAS,OAAO,qBAAqB,KAAK,KAAK,OAAO,UAAU,GAAI,CAAC;EAErE,IAAI,OAAO,QAAQ,QAAQ,KAAK;GAC9B,SAAS,OAAO,eAAe,UAAU;GAEzC,OAAO,SAAS,gBAAgB;IAC5B,OAAO,QAAQ,gBAAgB,EAAE,wBAAwB;IACzD;GACF,CACF;EACF;CACF;AACF"}
+{"version":3,"file":"rate-limit.middleware.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/rate-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the per-route rate limit middleware.\n */\nexport type RateLimitOptions = {\n  /**\n   * Max requests allowed within the time window.\n   */\n  max: number;\n  /**\n   * Time window in milliseconds.\n   */\n  duration: number;\n  /**\n   * Group key generator. Defaults to the client IP. Override to scope per-user,\n   * per-organization, per-tenant, etc.\n   *\n   * @example\n   * keyGenerator: (request) => request.user?.id ?? request.ip,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\ntype Bucket = {\n  count: number;\n  resetAt: number;\n};\n\nconst buckets = new Map<string, Bucket>();\n\n/**\n * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys\n * (rare per-user keys, dynamic path parameters in `keyGenerator`, etc.).\n * Called opportunistically, at most once per minute, not on a timer — keeps\n * the module side-effect-free for testing.\n */\nlet lastPruneAt = 0;\n\nfunction pruneExpired(now: number) {\n  for (const [key, bucket] of buckets) {\n    if (bucket.resetAt <= now) {\n      buckets.delete(key);\n    }\n  }\n}\n\n/**\n * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s\n * global cap (configured via `http.rateLimit`) — both run, and either can\n * 429. Use this for endpoints that need a tighter cap than the global default:\n * login, OTP request, password reset, expensive search, AI completions.\n *\n * The counter lives in-process. With `N` replicas the effective cap is\n * `N × max`. For genuinely shared limits, configure `@fastify/rate-limit`'s\n * Redis store via `http.rateLimit` instead.\n *\n * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on\n * every response; adds `Retry-After` (seconds) on a 429.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],\n * });\n */\nexport function rateLimitMiddleware(options: RateLimitOptions): Middleware {\n  return ({ request, response }) => {\n    const now = Date.now();\n\n    if (now - lastPruneAt > 60_000) {\n      pruneExpired(now);\n      lastPruneAt = now;\n    }\n\n    const groupKey = options.keyGenerator?.(request) || request.detectIp() || \"unknown\";\n    const cacheKey = `${request.route.path}:${groupKey}`;\n\n    let bucket = buckets.get(cacheKey);\n\n    if (!bucket || bucket.resetAt <= now) {\n      bucket = { count: 0, resetAt: now + options.duration };\n      buckets.set(cacheKey, bucket);\n    }\n\n    bucket.count++;\n\n    const remaining = Math.max(0, options.max - bucket.count);\n    const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));\n\n    response.header(\"X-RateLimit-Limit\", options.max);\n    response.header(\"X-RateLimit-Remaining\", remaining);\n    response.header(\"X-RateLimit-Reset\", Math.ceil(bucket.resetAt / 1000));\n\n    if (bucket.count > options.max) {\n      response.header(\"Retry-After\", retryAfter);\n\n      return response.tooManyRequests({\n          error: options.errorMessage || t(\"http.rateLimitExceeded\"),\n          errorCode: HttpErrorCodes.RateLimitExceeded,\n        },\n      );\n    }\n  };\n}\n"],"mappings":";;;;AAoCA,MAAM,0BAAU,IAAI,IAAoB;;;;;;;AAQxC,IAAI,cAAc;AAElB,SAAS,aAAa,KAAa;CACjC,KAAK,MAAM,CAAC,KAAK,WAAW,SAC1B,IAAI,OAAO,WAAW,KACpB,QAAQ,OAAO,GAAG;AAGxB;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,oBAAoB,SAAuC;CACzE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI,MAAM,cAAc,KAAQ;GAC9B,aAAa,GAAG;GAChB,cAAc;EAChB;EAEA,MAAM,WAAW,QAAQ,eAAe,OAAO,KAAK,QAAQ,SAAS,KAAK;EAC1E,MAAM,WAAW,GAAG,QAAQ,MAAM,KAAK,GAAG;EAE1C,IAAI,SAAS,QAAQ,IAAI,QAAQ;EAEjC,IAAI,CAAC,UAAU,OAAO,WAAW,KAAK;GACpC,SAAS;IAAE,OAAO;IAAG,SAAS,MAAM,QAAQ;GAAS;GACrD,QAAQ,IAAI,UAAU,MAAM;EAC9B;EAEA,OAAO;EAEP,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,MAAM,OAAO,KAAK;EACxD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,OAAO,GAAI,CAAC;EAEvE,SAAS,OAAO,qBAAqB,QAAQ,GAAG;EAChD,SAAS,OAAO,yBAAyB,SAAS;EAClD,SAAS,OAAO,qBAAqB,KAAK,KAAK,OAAO,UAAU,GAAI,CAAC;EAErE,IAAI,OAAO,QAAQ,QAAQ,KAAK;GAC9B,SAAS,OAAO,eAAe,UAAU;GAEzC,OAAO,SAAS,gBAAgB;IAC5B,OAAO,QAAQ,gBAAgB,EAAE,wBAAwB;IACzD;GACF,CACF;EACF;CACF;AACF"}

package/esm/http/middleware/utils/cidr-match.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/http/middleware/utils/cidr-match.d.ts
+//#region core/src/http/middleware/utils/cidr-match.d.ts
 declare function ipMatches(ip: string, pattern: string): boolean;
 /**
  * Returns true if `ip` matches any pattern in the list.

package/esm/http/middleware/utils/cidr-match.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cidr-match.d.mts","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/cidr-match.ts"],"mappings":";iBAkCgB,SAAA,CAAU,EAAA,UAAY,OAAe;AAArD;;;;AAAqD;AA0CrD;AA1CA,iBA0CgB,QAAA,CAAS,EAAA,UAAY,QAAkB"}
+{"version":3,"file":"cidr-match.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/utils/cidr-match.ts"],"mappings":";iBAkCgB,SAAA,CAAU,EAAA,UAAY,OAAe;AAArD;;;;AAAqD;AA0CrD;AA1CA,iBA0CgB,QAAA,CAAS,EAAA,UAAY,QAAkB"}

package/esm/http/middleware/utils/cidr-match.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/middleware/utils/cidr-match.ts
+//#region core/src/http/middleware/utils/cidr-match.ts
 /**
 * Match an IPv4 address against an exact IP or a CIDR block.
 *

package/esm/http/middleware/utils/cidr-match.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cidr-match.mjs","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/cidr-match.ts"],"sourcesContent":["/**\n * Match an IPv4 address against an exact IP or a CIDR block.\n *\n * IPv6 patterns are matched as exact-string only — full IPv6 CIDR support is\n * out of scope; ACLs in production almost always use IPv4 ranges. Add IPv6 CIDR\n * later if a real use-case appears.\n *\n * @example\n * ipMatches(\"10.0.0.5\", \"10.0.0.0/8\");      // true\n * ipMatches(\"10.0.0.5\", \"10.0.0.5\");        // true\n * ipMatches(\"192.168.1.1\", \"10.0.0.0/8\");   // false\n */\nfunction ipv4ToInt(ip: string): number | null {\n  const parts = ip.split(\".\");\n\n  if (parts.length !== 4) {\n    return null;\n  }\n\n  let result = 0;\n\n  for (const part of parts) {\n    const num = Number(part);\n\n    if (!Number.isInteger(num) || num < 0 || num > 255) {\n      return null;\n    }\n\n    result = (result << 8) + num;\n  }\n\n  return result >>> 0;\n}\n\nexport function ipMatches(ip: string, pattern: string): boolean {\n  if (!ip || !pattern) {\n    return false;\n  }\n\n  if (pattern === ip) {\n    return true;\n  }\n\n  if (!pattern.includes(\"/\")) {\n    return false;\n  }\n\n  const [base, bitsRaw] = pattern.split(\"/\");\n  const bits = Number(bitsRaw);\n\n  if (!Number.isInteger(bits) || bits < 0 || bits > 32) {\n    return false;\n  }\n\n  const ipInt = ipv4ToInt(ip);\n  const baseInt = ipv4ToInt(base);\n\n  if (ipInt === null || baseInt === null) {\n    return false;\n  }\n\n  if (bits === 0) {\n    return true;\n  }\n\n  const mask = (~0 << (32 - bits)) >>> 0;\n\n  return (ipInt & mask) === (baseInt & mask);\n}\n\n/**\n * Returns true if `ip` matches any pattern in the list.\n *\n * @example\n * anyMatch(\"10.0.0.5\", [\"192.168.0.0/16\", \"10.0.0.0/8\"]); // true\n */\nexport function anyMatch(ip: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => ipMatches(ip, pattern));\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAS,UAAU,IAA2B;CAC5C,MAAM,QAAQ,GAAG,MAAM,GAAG;CAE1B,IAAI,MAAM,WAAW,GACnB,OAAO;CAGT,IAAI,SAAS;CAEb,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,OAAO,IAAI;EAEvB,IAAI,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,MAAM,KAC7C,OAAO;EAGT,UAAU,UAAU,KAAK;CAC3B;CAEA,OAAO,WAAW;AACpB;AAEA,SAAgB,UAAU,IAAY,SAA0B;CAC9D,IAAI,CAAC,MAAM,CAAC,SACV,OAAO;CAGT,IAAI,YAAY,IACd,OAAO;CAGT,IAAI,CAAC,QAAQ,SAAS,GAAG,GACvB,OAAO;CAGT,MAAM,CAAC,MAAM,WAAW,QAAQ,MAAM,GAAG;CACzC,MAAM,OAAO,OAAO,OAAO;CAE3B,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,IAChD,OAAO;CAGT,MAAM,QAAQ,UAAU,EAAE;CAC1B,MAAM,UAAU,UAAU,IAAI;CAE9B,IAAI,UAAU,QAAQ,YAAY,MAChC,OAAO;CAGT,IAAI,SAAS,GACX,OAAO;CAGT,MAAM,OAAQ,MAAO,KAAK,SAAW;CAErC,QAAQ,QAAQ,WAAW,UAAU;AACvC;;;;;;;AAQA,SAAgB,SAAS,IAAY,UAA6B;CAChE,OAAO,SAAS,MAAM,YAAY,UAAU,IAAI,OAAO,CAAC;AAC1D"}
+{"version":3,"file":"cidr-match.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/utils/cidr-match.ts"],"sourcesContent":["/**\n * Match an IPv4 address against an exact IP or a CIDR block.\n *\n * IPv6 patterns are matched as exact-string only — full IPv6 CIDR support is\n * out of scope; ACLs in production almost always use IPv4 ranges. Add IPv6 CIDR\n * later if a real use-case appears.\n *\n * @example\n * ipMatches(\"10.0.0.5\", \"10.0.0.0/8\");      // true\n * ipMatches(\"10.0.0.5\", \"10.0.0.5\");        // true\n * ipMatches(\"192.168.1.1\", \"10.0.0.0/8\");   // false\n */\nfunction ipv4ToInt(ip: string): number | null {\n  const parts = ip.split(\".\");\n\n  if (parts.length !== 4) {\n    return null;\n  }\n\n  let result = 0;\n\n  for (const part of parts) {\n    const num = Number(part);\n\n    if (!Number.isInteger(num) || num < 0 || num > 255) {\n      return null;\n    }\n\n    result = (result << 8) + num;\n  }\n\n  return result >>> 0;\n}\n\nexport function ipMatches(ip: string, pattern: string): boolean {\n  if (!ip || !pattern) {\n    return false;\n  }\n\n  if (pattern === ip) {\n    return true;\n  }\n\n  if (!pattern.includes(\"/\")) {\n    return false;\n  }\n\n  const [base, bitsRaw] = pattern.split(\"/\");\n  const bits = Number(bitsRaw);\n\n  if (!Number.isInteger(bits) || bits < 0 || bits > 32) {\n    return false;\n  }\n\n  const ipInt = ipv4ToInt(ip);\n  const baseInt = ipv4ToInt(base);\n\n  if (ipInt === null || baseInt === null) {\n    return false;\n  }\n\n  if (bits === 0) {\n    return true;\n  }\n\n  const mask = (~0 << (32 - bits)) >>> 0;\n\n  return (ipInt & mask) === (baseInt & mask);\n}\n\n/**\n * Returns true if `ip` matches any pattern in the list.\n *\n * @example\n * anyMatch(\"10.0.0.5\", [\"192.168.0.0/16\", \"10.0.0.0/8\"]); // true\n */\nexport function anyMatch(ip: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => ipMatches(ip, pattern));\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAS,UAAU,IAA2B;CAC5C,MAAM,QAAQ,GAAG,MAAM,GAAG;CAE1B,IAAI,MAAM,WAAW,GACnB,OAAO;CAGT,IAAI,SAAS;CAEb,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,OAAO,IAAI;EAEvB,IAAI,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,MAAM,KAC7C,OAAO;EAGT,UAAU,UAAU,KAAK;CAC3B;CAEA,OAAO,WAAW;AACpB;AAEA,SAAgB,UAAU,IAAY,SAA0B;CAC9D,IAAI,CAAC,MAAM,CAAC,SACV,OAAO;CAGT,IAAI,YAAY,IACd,OAAO;CAGT,IAAI,CAAC,QAAQ,SAAS,GAAG,GACvB,OAAO;CAGT,MAAM,CAAC,MAAM,WAAW,QAAQ,MAAM,GAAG;CACzC,MAAM,OAAO,OAAO,OAAO;CAE3B,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,IAChD,OAAO;CAGT,MAAM,QAAQ,UAAU,EAAE;CAC1B,MAAM,UAAU,UAAU,IAAI;CAE9B,IAAI,UAAU,QAAQ,YAAY,MAChC,OAAO;CAGT,IAAI,SAAS,GACX,OAAO;CAGT,MAAM,OAAQ,MAAO,KAAK,SAAW;CAErC,QAAQ,QAAQ,WAAW,UAAU;AACvC;;;;;;;AAQA,SAAgB,SAAS,IAAY,UAA6B;CAChE,OAAO,SAAS,MAAM,YAAY,UAAU,IAAI,OAAO,CAAC;AAC1D"}

package/esm/http/middleware/utils/idempotency-key.d.mts

@@ -1,6 +1,6 @@
 import { Request } from "../../request.mjs";
 
-//#region ../core/src/http/middleware/utils/idempotency-key.d.ts
+//#region core/src/http/middleware/utils/idempotency-key.d.ts
 declare function isValidIdempotencyKey(value: unknown): value is string;
 /**
  * Hash a request body to a stable hex digest.

package/esm/http/middleware/utils/idempotency-key.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency-key.d.mts","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/idempotency-key.ts"],"mappings":";;;iBAegB,qBAAA,CAAsB,KAAA,YAAiB,KAAK;;AAA5D;;;;AAA4D;AAmB5D;;;;iBAAgB,QAAA,CAAS,IAAa;AAAA,iBAyCtB,wBAAA,CAAyB,OAAA,EAAS,OAAO,EAAE,cAAA"}
+{"version":3,"file":"idempotency-key.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/utils/idempotency-key.ts"],"mappings":";;;iBAegB,qBAAA,CAAsB,KAAA,YAAiB,KAAK;;AAA5D;;;;AAA4D;AAmB5D;;;;iBAAgB,QAAA,CAAS,IAAa;AAAA,iBAyCtB,wBAAA,CAAyB,OAAA,EAAS,OAAO,EAAE,cAAA"}

package/esm/http/middleware/utils/idempotency-key.mjs

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 
-//#region ../core/src/http/middleware/utils/idempotency-key.ts
+//#region core/src/http/middleware/utils/idempotency-key.ts
 /**
 * Idempotency-key validation rules.
 *

package/esm/http/middleware/utils/idempotency-key.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency-key.mjs","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/idempotency-key.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { Request } from \"../../request\";\nimport type { RequestUser } from \"../../types\";\n\n/**\n * Idempotency-key validation rules.\n *\n * RFC draft-ietf-httpapi-idempotency-key suggests UUIDs or ULIDs but doesn't\n * mandate a format. We accept any printable ASCII string up to 255 chars —\n * tight enough to reject log-injection (no control characters / newlines),\n * loose enough to accept whatever ID scheme the client picks.\n */\nconst MAX_KEY_LENGTH = 255;\nconst PRINTABLE_ASCII = /^[\\x21-\\x7e]+$/;\n\nexport function isValidIdempotencyKey(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    value.length <= MAX_KEY_LENGTH &&\n    PRINTABLE_ASCII.test(value)\n  );\n}\n\n/**\n * Hash a request body to a stable hex digest.\n *\n * Used to detect \"same key, different body\" — that's a client bug, not a retry.\n * sha256 is overkill for collision resistance here, but it's the dependency-free\n * choice and avoids importing a faster hasher.\n *\n * @example\n * hashBody({ amount: 100, currency: \"USD\" }); // \"a1b2c3...\"\n */\nexport function hashBody(body: unknown): string {\n  const serialized = typeof body === \"string\" ? body : JSON.stringify(body ?? {});\n\n  return createHash(\"sha256\").update(serialized).digest(\"hex\");\n}\n\n/**\n * Build the cache key for an idempotency record.\n *\n * Scope is `userType:userId` when authenticated, falling back to the client IP\n * when anonymous. This prevents user A from replaying user B's key — even if\n * user B used a guessable value — while still letting the primitive work on\n * public endpoints.\n *\n * Idempotency middleware must run **after** `authMiddleware` so `request.user`\n * and `request.decodedAccessToken` are populated.\n *\n * @example\n * buildIdempotencyCacheKey(request, \"01J9XZQ-ABC\"); // \"idem:client:user_123:01J9XZQ-ABC\"\n */\n/**\n * Read `id` off `request.user` without assuming every app's `RequestUser`\n * augmentation declares it.\n *\n * `RequestUser` (`core/src/http/types.ts`) is empty by default — apps narrow\n * it to their own model shape. Adding `id` directly to `RequestUser` here\n * would force that exact field (and type) onto every app: TypeScript\n * interface merging requires all declarations of a shared member to have an\n * identical type, so an app augmenting `RequestUser` with, say, `id: string`\n * only would conflict with a core-declared `id?: string | number`. A local,\n * narrow read survives any augmentation shape (eed20184 step (b) —\n * `implementation/2026-08-20-A2-request-locals.md` §6.2) — no `as any`.\n */\nfunction readUserId(user: RequestUser | undefined): string | number | undefined {\n  if (!user || typeof user !== \"object\" || !(\"id\" in user)) return undefined;\n\n  const id = (user as { id?: unknown }).id;\n\n  return typeof id === \"string\" || typeof id === \"number\" ? id : undefined;\n}\n\nexport function buildIdempotencyCacheKey(request: Request, idempotencyKey: string): string {\n  const userType = request.decodedAccessToken?.userType || \"anonymous\";\n  const userId = readUserId(request.user) || request.detectIp() || \"unknown\";\n\n  return `idem:${userType}:${userId}:${idempotencyKey}`;\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,SAAgB,sBAAsB,OAAiC;CACrE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,kBAChB,gBAAgB,KAAK,KAAK;AAE9B;;;;;;;;;;;AAYA,SAAgB,SAAS,MAAuB;CAC9C,MAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC;CAE9E,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,WAAW,MAA4D;CAC9E,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OAAO,OAAO;CAEjE,MAAM,KAAM,KAA0B;CAEtC,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,WAAW,KAAK;AACjE;AAEA,SAAgB,yBAAyB,SAAkB,gBAAgC;CAIzF,OAAO,QAHU,QAAQ,oBAAoB,YAAY,YAGjC,GAFT,WAAW,QAAQ,IAAI,KAAK,QAAQ,SAAS,KAAK,UAE/B,GAAG;AACvC"}
+{"version":3,"file":"idempotency-key.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/utils/idempotency-key.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { Request } from \"../../request\";\nimport type { RequestUser } from \"../../types\";\n\n/**\n * Idempotency-key validation rules.\n *\n * RFC draft-ietf-httpapi-idempotency-key suggests UUIDs or ULIDs but doesn't\n * mandate a format. We accept any printable ASCII string up to 255 chars —\n * tight enough to reject log-injection (no control characters / newlines),\n * loose enough to accept whatever ID scheme the client picks.\n */\nconst MAX_KEY_LENGTH = 255;\nconst PRINTABLE_ASCII = /^[\\x21-\\x7e]+$/;\n\nexport function isValidIdempotencyKey(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    value.length <= MAX_KEY_LENGTH &&\n    PRINTABLE_ASCII.test(value)\n  );\n}\n\n/**\n * Hash a request body to a stable hex digest.\n *\n * Used to detect \"same key, different body\" — that's a client bug, not a retry.\n * sha256 is overkill for collision resistance here, but it's the dependency-free\n * choice and avoids importing a faster hasher.\n *\n * @example\n * hashBody({ amount: 100, currency: \"USD\" }); // \"a1b2c3...\"\n */\nexport function hashBody(body: unknown): string {\n  const serialized = typeof body === \"string\" ? body : JSON.stringify(body ?? {});\n\n  return createHash(\"sha256\").update(serialized).digest(\"hex\");\n}\n\n/**\n * Build the cache key for an idempotency record.\n *\n * Scope is `userType:userId` when authenticated, falling back to the client IP\n * when anonymous. This prevents user A from replaying user B's key — even if\n * user B used a guessable value — while still letting the primitive work on\n * public endpoints.\n *\n * Idempotency middleware must run **after** `authMiddleware` so `request.user`\n * and `request.decodedAccessToken` are populated.\n *\n * @example\n * buildIdempotencyCacheKey(request, \"01J9XZQ-ABC\"); // \"idem:client:user_123:01J9XZQ-ABC\"\n */\n/**\n * Read `id` off `request.user` without assuming every app's `RequestUser`\n * augmentation declares it.\n *\n * `RequestUser` (`core/src/http/types.ts`) is empty by default — apps narrow\n * it to their own model shape. Adding `id` directly to `RequestUser` here\n * would force that exact field (and type) onto every app: TypeScript\n * interface merging requires all declarations of a shared member to have an\n * identical type, so an app augmenting `RequestUser` with, say, `id: string`\n * only would conflict with a core-declared `id?: string | number`. A local,\n * narrow read survives any augmentation shape (eed20184 step (b) —\n * `implementation/2026-08-20-A2-request-locals.md` §6.2) — no `as any`.\n */\nfunction readUserId(user: RequestUser | undefined): string | number | undefined {\n  if (!user || typeof user !== \"object\" || !(\"id\" in user)) return undefined;\n\n  const id = (user as { id?: unknown }).id;\n\n  return typeof id === \"string\" || typeof id === \"number\" ? id : undefined;\n}\n\nexport function buildIdempotencyCacheKey(request: Request, idempotencyKey: string): string {\n  const userType = request.decodedAccessToken?.userType || \"anonymous\";\n  const userId = readUserId(request.user) || request.detectIp() || \"unknown\";\n\n  return `idem:${userType}:${userId}:${idempotencyKey}`;\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,SAAgB,sBAAsB,OAAiC;CACrE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,kBAChB,gBAAgB,KAAK,KAAK;AAE9B;;;;;;;;;;;AAYA,SAAgB,SAAS,MAAuB;CAC9C,MAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC;CAE9E,OAAO,WAAW,QAAQ,EAAE,OAAO,UAAU,EAAE,OAAO,KAAK;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,WAAW,MAA4D;CAC9E,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OAAO,OAAO;CAEjE,MAAM,KAAM,KAA0B;CAEtC,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,WAAW,KAAK;AACjE;AAEA,SAAgB,yBAAyB,SAAkB,gBAAgC;CAIzF,OAAO,QAHU,QAAQ,oBAAoB,YAAY,YAGjC,GAFT,WAAW,QAAQ,IAAI,KAAK,QAAQ,SAAS,KAAK,UAE/B,GAAG;AACvC"}

package/esm/http/middleware/utils/parse-size.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/http/middleware/utils/parse-size.d.ts
+//#region core/src/http/middleware/utils/parse-size.d.ts
 declare function parseSize(value: string | number): number;
 //#endregion
 export { parseSize };

package/esm/http/middleware/utils/parse-size.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-size.d.mts","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/parse-size.ts"],"mappings":";iBAkBgB,SAAA,CAAU,KAAsB"}
+{"version":3,"file":"parse-size.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/utils/parse-size.ts"],"mappings":";iBAkBgB,SAAA,CAAU,KAAsB"}

package/esm/http/middleware/utils/parse-size.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/middleware/utils/parse-size.ts
+//#region core/src/http/middleware/utils/parse-size.ts
 /**
 * Parse a human-readable size string into bytes.
 *

package/esm/http/middleware/utils/parse-size.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"parse-size.mjs","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/parse-size.ts"],"sourcesContent":["/**\n * Parse a human-readable size string into bytes.\n *\n * Accepts `\"2mb\"`, `\"500kb\"`, `\"1.5gb\"`, `\"1024\"`, `\"1024b\"`, etc. Case-insensitive.\n * Numeric input is returned untouched (already bytes).\n *\n * @example\n * parseSize(\"2mb\");     // 2_097_152\n * parseSize(\"500kb\");   // 512_000\n * parseSize(4096);      // 4096\n */\nconst UNITS: Record<string, number> = {\n  b: 1,\n  kb: 1024,\n  mb: 1024 * 1024,\n  gb: 1024 * 1024 * 1024,\n};\n\nexport function parseSize(value: string | number): number {\n  if (typeof value === \"number\") {\n    return value;\n  }\n\n  const match = /^(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb)?$/i.exec(value.trim());\n\n  if (!match) {\n    throw new Error(`Invalid size value: ${value}`);\n  }\n\n  const [, amount, rawUnit = \"b\"] = match;\n  const unit = rawUnit.toLowerCase();\n  const multiplier = UNITS[unit];\n\n  if (!multiplier) {\n    throw new Error(`Unknown size unit: ${unit}`);\n  }\n\n  return Math.floor(Number(amount) * multiplier);\n}\n"],"mappings":";;;;;;;;;;;;AAWA,MAAM,QAAgC;CACpC,GAAG;CACH,IAAI;CACJ,IAAI,OAAO;CACX,IAAI,OAAO,OAAO;AACpB;AAEA,SAAgB,UAAU,OAAgC;CACxD,IAAI,OAAO,UAAU,UACnB,OAAO;CAGT,MAAM,QAAQ,qCAAqC,KAAK,MAAM,KAAK,CAAC;CAEpE,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,uBAAuB,OAAO;CAGhD,MAAM,GAAG,QAAQ,UAAU,OAAO;CAClC,MAAM,OAAO,QAAQ,YAAY;CACjC,MAAM,aAAa,MAAM;CAEzB,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,sBAAsB,MAAM;CAG9C,OAAO,KAAK,MAAM,OAAO,MAAM,IAAI,UAAU;AAC/C"}
+{"version":3,"file":"parse-size.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/utils/parse-size.ts"],"sourcesContent":["/**\n * Parse a human-readable size string into bytes.\n *\n * Accepts `\"2mb\"`, `\"500kb\"`, `\"1.5gb\"`, `\"1024\"`, `\"1024b\"`, etc. Case-insensitive.\n * Numeric input is returned untouched (already bytes).\n *\n * @example\n * parseSize(\"2mb\");     // 2_097_152\n * parseSize(\"500kb\");   // 512_000\n * parseSize(4096);      // 4096\n */\nconst UNITS: Record<string, number> = {\n  b: 1,\n  kb: 1024,\n  mb: 1024 * 1024,\n  gb: 1024 * 1024 * 1024,\n};\n\nexport function parseSize(value: string | number): number {\n  if (typeof value === \"number\") {\n    return value;\n  }\n\n  const match = /^(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb)?$/i.exec(value.trim());\n\n  if (!match) {\n    throw new Error(`Invalid size value: ${value}`);\n  }\n\n  const [, amount, rawUnit = \"b\"] = match;\n  const unit = rawUnit.toLowerCase();\n  const multiplier = UNITS[unit];\n\n  if (!multiplier) {\n    throw new Error(`Unknown size unit: ${unit}`);\n  }\n\n  return Math.floor(Number(amount) * multiplier);\n}\n"],"mappings":";;;;;;;;;;;;AAWA,MAAM,QAAgC;CACpC,GAAG;CACH,IAAI;CACJ,IAAI,OAAO;CACX,IAAI,OAAO,OAAO;AACpB;AAEA,SAAgB,UAAU,OAAgC;CACxD,IAAI,OAAO,UAAU,UACnB,OAAO;CAGT,MAAM,QAAQ,qCAAqC,KAAK,MAAM,KAAK,CAAC;CAEpE,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,uBAAuB,OAAO;CAGhD,MAAM,GAAG,QAAQ,UAAU,OAAO;CAClC,MAAM,OAAO,QAAQ,YAAY;CACjC,MAAM,aAAa,MAAM;CAEzB,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,sBAAsB,MAAM;CAG9C,OAAO,KAAK,MAAM,OAAO,MAAM,IAAI,UAAU;AAC/C"}

package/esm/http/plugins.d.mts

@@ -1,6 +1,6 @@
 import { FastifyInstance } from "./server.mjs";
 
-//#region ../core/src/http/plugins.d.ts
+//#region core/src/http/plugins.d.ts
 declare function registerHttpPlugins(server: FastifyInstance): Promise<void>;
 //#endregion
 export { registerHttpPlugins };

package/esm/http/plugins.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.d.mts","names":[],"sources":["../../../../../../../core/src/http/plugins.ts"],"mappings":";;;iBAMsB,mBAAA,CAAoB,MAAA,EAAQ,eAAA,GAAe,OAAA"}
+{"version":3,"file":"plugins.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/plugins.ts"],"mappings":";;;iBAMsB,mBAAA,CAAoB,MAAA,EAAQ,eAAA,GAAe,OAAA"}

package/esm/http/plugins.mjs

@@ -4,7 +4,7 @@ import { buildCorsOptions } from "./build-cors-options.mjs";
 import config from "@mongez/config";
 import fastifyMultipart from "@fastify/multipart";
 
-//#region ../core/src/http/plugins.ts
+//#region core/src/http/plugins.ts
 async function registerHttpPlugins(server) {
 	server.register(import("@fastify/rate-limit"), {
 		max: config.get("http.rateLimit.max", 60),

package/esm/http/plugins.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.mjs","names":[],"sources":["../../../../../../../core/src/http/plugins.ts"],"sourcesContent":["import fastifyMultipart from \"@fastify/multipart\";\nimport config from \"@mongez/config\";\nimport { rootPath } from \"../utils\";\nimport { buildCorsOptions } from \"./build-cors-options\";\nimport type { FastifyInstance } from \"./server\";\n\nexport async function registerHttpPlugins(server: FastifyInstance) {\n  // 👇🏻 register rate-limit plugin\n  server.register(import(\"@fastify/rate-limit\"), {\n    // max requests per time window\n    max: config.get(\"http.rateLimit.max\", 60),\n    // maximum time that is will allow max requests\n    timeWindow: config.get(\"http.rateLimit.duration\", 60 * 1000),\n  });\n\n  // 👇🏻 register cors plugin\n  server.register(import(\"@fastify/cors\"), buildCorsOptions());\n\n  // 👇🏻 import multipart plugin\n  server.register(fastifyMultipart, {\n    attachFieldsToBody: true,\n    limits: {\n      // file size could be up to 10MB\n      fileSize: config.get(\"http.fileUploadLimit\", 10 * 1024 * 1024),\n    },\n  });\n\n  server.register(import(\"@fastify/static\"), {\n    root: config.get(\"storage.publicRoot\", rootPath(\"public\")),\n    prefix: config.get(\"storage.publicPrefix\", \"/public/\"),\n  });\n\n  // 👇🏻 register cookie plugin\n  server.register(import(\"@fastify/cookie\"), {\n    secret: config.get(\"http.cookies.secret\"), // Optional: allow signed cookies\n    parseOptions: config.get(\"http.cookies.options\", {}),\n  });\n}\n"],"mappings":";;;;;;;AAMA,eAAsB,oBAAoB,QAAyB;CAEjE,OAAO,SAAS,OAAO,wBAAwB;EAE7C,KAAK,OAAO,IAAI,sBAAsB,EAAE;EAExC,YAAY,OAAO,IAAI,2BAA2B,KAAK,GAAI;CAC7D,CAAC;CAGD,OAAO,SAAS,OAAO,kBAAkB,iBAAiB,CAAC;CAG3D,OAAO,SAAS,kBAAkB;EAChC,oBAAoB;EACpB,QAAQ,EAEN,UAAU,OAAO,IAAI,wBAAwB,KAAK,OAAO,IAAI,EAC/D;CACF,CAAC;CAED,OAAO,SAAS,OAAO,oBAAoB;EACzC,MAAM,OAAO,IAAI,sBAAsB,SAAS,QAAQ,CAAC;EACzD,QAAQ,OAAO,IAAI,wBAAwB,UAAU;CACvD,CAAC;CAGD,OAAO,SAAS,OAAO,oBAAoB;EACzC,QAAQ,OAAO,IAAI,qBAAqB;EACxC,cAAc,OAAO,IAAI,wBAAwB,CAAC,CAAC;CACrD,CAAC;AACH"}
+{"version":3,"file":"plugins.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/plugins.ts"],"sourcesContent":["import fastifyMultipart from \"@fastify/multipart\";\nimport config from \"@mongez/config\";\nimport { rootPath } from \"../utils\";\nimport { buildCorsOptions } from \"./build-cors-options\";\nimport type { FastifyInstance } from \"./server\";\n\nexport async function registerHttpPlugins(server: FastifyInstance) {\n  // 👇🏻 register rate-limit plugin\n  server.register(import(\"@fastify/rate-limit\"), {\n    // max requests per time window\n    max: config.get(\"http.rateLimit.max\", 60),\n    // maximum time that is will allow max requests\n    timeWindow: config.get(\"http.rateLimit.duration\", 60 * 1000),\n  });\n\n  // 👇🏻 register cors plugin\n  server.register(import(\"@fastify/cors\"), buildCorsOptions());\n\n  // 👇🏻 import multipart plugin\n  server.register(fastifyMultipart, {\n    attachFieldsToBody: true,\n    limits: {\n      // file size could be up to 10MB\n      fileSize: config.get(\"http.fileUploadLimit\", 10 * 1024 * 1024),\n    },\n  });\n\n  server.register(import(\"@fastify/static\"), {\n    root: config.get(\"storage.publicRoot\", rootPath(\"public\")),\n    prefix: config.get(\"storage.publicPrefix\", \"/public/\"),\n  });\n\n  // 👇🏻 register cookie plugin\n  server.register(import(\"@fastify/cookie\"), {\n    secret: config.get(\"http.cookies.secret\"), // Optional: allow signed cookies\n    parseOptions: config.get(\"http.cookies.options\", {}),\n  });\n}\n"],"mappings":";;;;;;;AAMA,eAAsB,oBAAoB,QAAyB;CAEjE,OAAO,SAAS,OAAO,wBAAwB;EAE7C,KAAK,OAAO,IAAI,sBAAsB,EAAE;EAExC,YAAY,OAAO,IAAI,2BAA2B,KAAK,GAAI;CAC7D,CAAC;CAGD,OAAO,SAAS,OAAO,kBAAkB,iBAAiB,CAAC;CAG3D,OAAO,SAAS,kBAAkB;EAChC,oBAAoB;EACpB,QAAQ,EAEN,UAAU,OAAO,IAAI,wBAAwB,KAAK,OAAO,IAAI,EAC/D;CACF,CAAC;CAED,OAAO,SAAS,OAAO,oBAAoB;EACzC,MAAM,OAAO,IAAI,sBAAsB,SAAS,QAAQ,CAAC;EACzD,QAAQ,OAAO,IAAI,wBAAwB,UAAU;CACvD,CAAC;CAGD,OAAO,SAAS,OAAO,oBAAoB;EACzC,QAAQ,OAAO,IAAI,qBAAqB;EACxC,cAAc,OAAO,IAAI,wBAAwB,CAAC,CAAC;CACrD,CAAC;AACH"}

package/esm/http/port-preflight.d.mts

@@ -1,14 +1,22 @@
-//#region ../core/src/http/port-preflight.d.ts
+//#region core/src/http/port-preflight.d.ts
 /**
  * Raised when a port the framework is about to bind is already taken.
  *
  * Carries the port and host so a caller can report them without parsing the
  * message, and its message is the developer-facing instruction — the whole
  * point of preflighting is that nobody has to decode a raw `EADDRINUSE`.
+ *
+ * The message leads with `EADDRINUSE` on purpose: it is the string a
+ * developer greps their terminal for, and the one every other Node tool
+ * already trained them to recognize as "something else is on this port".
+ * `code` mirrors it as a property so a caller can branch on it without
+ * parsing text, the same way `NodeJS.ErrnoException.code` works.
  */
 declare class PortInUseError extends Error {
   readonly port: number;
   readonly host: string;
+  /** Mirrors Node's own `ErrnoException.code` for this failure. */
+  readonly code = "EADDRINUSE";
   constructor(port: number, host: string);
 }
 /**

package/esm/http/port-preflight.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"port-preflight.d.mts","names":[],"sources":["../../../../../../../core/src/http/port-preflight.ts"],"mappings":";;AAcA;;;;;;cAAa,cAAA,SAAuB,KAAK;EAAA,SAErB,IAAA;EAAA,SACA,IAAA;cADA,IAAA,UACA,IAAA;AAAA;AAAY;AAiBhC;;;;;;AAjBgC,iBAiBhB,eAAA,CACd,IAAA,UACA,IAAA,YACC,OAAO;;AAAA;AAmCV;;;;;;;iBAAsB,qBAAA,CACpB,IAAA,UACA,IAAA,YACC,OAAO"}
+{"version":3,"file":"port-preflight.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/port-preflight.ts"],"mappings":";;AAoBA;;;;;;;;;;;;cAAa,cAAA,SAAuB,KAAK;EAAA,SAKrB,IAAA;EAAA,SACA,IAAA;;WAJF,IAAA;cAGE,IAAA,UACA,IAAA;AAAA;;;AAoBV;AAmCV;;;;iBAtCgB,eAAA,CACd,IAAA,UACA,IAAA,YACC,OAAO;;;;AAsCA;;;;;;iBAHY,qBAAA,CACpB,IAAA,UACA,IAAA,YACC,OAAO"}

package/esm/http/port-preflight.mjs

@@ -1,6 +1,6 @@
 import { createServer } from "node:net";
 
-//#region ../core/src/http/port-preflight.ts
+//#region core/src/http/port-preflight.ts
 /**
 * Host used when the caller has no configured bind host.
 */
@@ -11,12 +11,19 @@ const DEFAULT_PROBE_HOST = "localhost";
 * Carries the port and host so a caller can report them without parsing the
 * message, and its message is the developer-facing instruction — the whole
 * point of preflighting is that nobody has to decode a raw `EADDRINUSE`.
+*
+* The message leads with `EADDRINUSE` on purpose: it is the string a
+* developer greps their terminal for, and the one every other Node tool
+* already trained them to recognize as "something else is on this port".
+* `code` mirrors it as a property so a caller can branch on it without
+* parsing text, the same way `NodeJS.ErrnoException.code` works.
 */
 var PortInUseError = class extends Error {
 	constructor(port, host) {
-		super(`Port ${port} is already in use on ${host}. Stop the dev server (or whatever else is listening on port ${port}) and run again, or start on a free port — e.g. startHttpTestServer({ port: ${port + 1} }).`);
+		super(`EADDRINUSE: Port ${port} is already in use on ${host}. Stop the dev server (or whatever else is listening on port ${port}) and run again, or start on a free port — e.g. startHttpTestServer({ port: ${port + 1} }).`);
 		this.port = port;
 		this.host = host;
+		this.code = "EADDRINUSE";
 		this.name = "PortInUseError";
 	}
 };

package/esm/http/port-preflight.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"port-preflight.mjs","names":[],"sources":["../../../../../../../core/src/http/port-preflight.ts"],"sourcesContent":["import { createServer } from \"node:net\";\n\n/**\n * Host used when the caller has no configured bind host.\n */\nconst DEFAULT_PROBE_HOST = \"localhost\";\n\n/**\n * Raised when a port the framework is about to bind is already taken.\n *\n * Carries the port and host so a caller can report them without parsing the\n * message, and its message is the developer-facing instruction — the whole\n * point of preflighting is that nobody has to decode a raw `EADDRINUSE`.\n */\nexport class PortInUseError extends Error {\n  public constructor(\n    public readonly port: number,\n    public readonly host: string,\n  ) {\n    super(\n      `Port ${port} is already in use on ${host}. Stop the dev server (or whatever else is listening on port ${port}) and run again, or start on a free port — e.g. startHttpTestServer({ port: ${port + 1} }).`,\n    );\n\n    this.name = \"PortInUseError\";\n  }\n}\n\n/**\n * Probe a TCP port by attempting a bind and immediately releasing it.\n *\n * @returns `true` when the port is free, `false` when it is taken or the\n * process is not allowed to bind it. Any other bind failure is re-thrown —\n * an unreadable network error must not be reported as \"port in use\".\n */\nexport function isPortAvailable(\n  port: number,\n  host: string = DEFAULT_PROBE_HOST,\n): Promise<boolean> {\n  return new Promise((resolve, reject) => {\n    const probe = createServer();\n\n    probe.unref();\n\n    probe.once(\"error\", (error: NodeJS.ErrnoException) => {\n      if (error.code === \"EADDRINUSE\" || error.code === \"EACCES\") {\n        resolve(false);\n\n        return;\n      }\n\n      reject(error);\n    });\n\n    probe.once(\"listening\", () => {\n      probe.close(() => resolve(true));\n    });\n\n    // `exclusive` refuses a shared bind, which is what makes the probe honest:\n    // with load balancing enabled a second bind on a served port can succeed.\n    probe.listen({ port, host, exclusive: true });\n  });\n}\n\n/**\n * Assert a port is free before something binds it.\n *\n * Run this ahead of the actual `listen()` so a collision surfaces as an\n * instruction the developer can act on, instead of a raw `EADDRINUSE` thrown\n * from deep inside the HTTP stack.\n *\n * @throws {PortInUseError} when the port is taken.\n */\nexport async function assertPortIsAvailable(\n  port: number,\n  host: string = DEFAULT_PROBE_HOST,\n): Promise<void> {\n  const available = await isPortAvailable(port, host);\n\n  if (!available) {\n    throw new PortInUseError(port, host);\n  }\n}\n"],"mappings":";;;;;;AAKA,MAAM,qBAAqB;;;;;;;;AAS3B,IAAa,iBAAb,cAAoC,MAAM;CACxC,AAAO,YACL,AAAgB,MAChB,AAAgB,MAChB;EACA,MACE,QAAQ,KAAK,wBAAwB,KAAK,+DAA+D,KAAK,8EAA8E,OAAO,EAAE,KACvM;EALgB;EACA;EAMhB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,gBACd,MACA,OAAe,oBACG;CAClB,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,QAAQ,aAAa;EAE3B,MAAM,MAAM;EAEZ,MAAM,KAAK,UAAU,UAAiC;GACpD,IAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,UAAU;IAC1D,QAAQ,KAAK;IAEb;GACF;GAEA,OAAO,KAAK;EACd,CAAC;EAED,MAAM,KAAK,mBAAmB;GAC5B,MAAM,YAAY,QAAQ,IAAI,CAAC;EACjC,CAAC;EAID,MAAM,OAAO;GAAE;GAAM;GAAM,WAAW;EAAK,CAAC;CAC9C,CAAC;AACH;;;;;;;;;;AAWA,eAAsB,sBACpB,MACA,OAAe,oBACA;CAGf,IAAI,CAAC,MAFmB,gBAAgB,MAAM,IAAI,GAGhD,MAAM,IAAI,eAAe,MAAM,IAAI;AAEvC"}
+{"version":3,"file":"port-preflight.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/port-preflight.ts"],"sourcesContent":["import { createServer } from \"node:net\";\n\n/**\n * Host used when the caller has no configured bind host.\n */\nconst DEFAULT_PROBE_HOST = \"localhost\";\n\n/**\n * Raised when a port the framework is about to bind is already taken.\n *\n * Carries the port and host so a caller can report them without parsing the\n * message, and its message is the developer-facing instruction — the whole\n * point of preflighting is that nobody has to decode a raw `EADDRINUSE`.\n *\n * The message leads with `EADDRINUSE` on purpose: it is the string a\n * developer greps their terminal for, and the one every other Node tool\n * already trained them to recognize as \"something else is on this port\".\n * `code` mirrors it as a property so a caller can branch on it without\n * parsing text, the same way `NodeJS.ErrnoException.code` works.\n */\nexport class PortInUseError extends Error {\n  /** Mirrors Node's own `ErrnoException.code` for this failure. */\n  public readonly code = \"EADDRINUSE\";\n\n  public constructor(\n    public readonly port: number,\n    public readonly host: string,\n  ) {\n    super(\n      `EADDRINUSE: Port ${port} is already in use on ${host}. Stop the dev server (or whatever else is listening on port ${port}) and run again, or start on a free port — e.g. startHttpTestServer({ port: ${port + 1} }).`,\n    );\n\n    this.name = \"PortInUseError\";\n  }\n}\n\n/**\n * Probe a TCP port by attempting a bind and immediately releasing it.\n *\n * @returns `true` when the port is free, `false` when it is taken or the\n * process is not allowed to bind it. Any other bind failure is re-thrown —\n * an unreadable network error must not be reported as \"port in use\".\n */\nexport function isPortAvailable(\n  port: number,\n  host: string = DEFAULT_PROBE_HOST,\n): Promise<boolean> {\n  return new Promise((resolve, reject) => {\n    const probe = createServer();\n\n    probe.unref();\n\n    probe.once(\"error\", (error: NodeJS.ErrnoException) => {\n      if (error.code === \"EADDRINUSE\" || error.code === \"EACCES\") {\n        resolve(false);\n\n        return;\n      }\n\n      reject(error);\n    });\n\n    probe.once(\"listening\", () => {\n      probe.close(() => resolve(true));\n    });\n\n    // `exclusive` refuses a shared bind, which is what makes the probe honest:\n    // with load balancing enabled a second bind on a served port can succeed.\n    probe.listen({ port, host, exclusive: true });\n  });\n}\n\n/**\n * Assert a port is free before something binds it.\n *\n * Run this ahead of the actual `listen()` so a collision surfaces as an\n * instruction the developer can act on, instead of a raw `EADDRINUSE` thrown\n * from deep inside the HTTP stack.\n *\n * @throws {PortInUseError} when the port is taken.\n */\nexport async function assertPortIsAvailable(\n  port: number,\n  host: string = DEFAULT_PROBE_HOST,\n): Promise<void> {\n  const available = await isPortAvailable(port, host);\n\n  if (!available) {\n    throw new PortInUseError(port, host);\n  }\n}\n"],"mappings":";;;;;;AAKA,MAAM,qBAAqB;;;;;;;;;;;;;;AAe3B,IAAa,iBAAb,cAAoC,MAAM;CAIxC,AAAO,YACL,AAAgB,MAChB,AAAgB,MAChB;EACA,MACE,oBAAoB,KAAK,wBAAwB,KAAK,+DAA+D,KAAK,8EAA8E,OAAO,EAAE,KACnN;EALgB;EACA;cAJK;EAUrB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,gBACd,MACA,OAAe,oBACG;CAClB,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,QAAQ,aAAa;EAE3B,MAAM,MAAM;EAEZ,MAAM,KAAK,UAAU,UAAiC;GACpD,IAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,UAAU;IAC1D,QAAQ,KAAK;IAEb;GACF;GAEA,OAAO,KAAK;EACd,CAAC;EAED,MAAM,KAAK,mBAAmB;GAC5B,MAAM,YAAY,QAAQ,IAAI,CAAC;EACjC,CAAC;EAID,MAAM,OAAO;GAAE;GAAM;GAAM,WAAW;EAAK,CAAC;CAC9C,CAAC;AACH;;;;;;;;;;AAWA,eAAsB,sBACpB,MACA,OAAe,oBACA;CAGf,IAAI,CAAC,MAFmB,gBAAgB,MAAM,IAAI,GAGhD,MAAM,IAAI,eAAe,MAAM,IAAI;AAEvC"}

package/esm/http/ready-report.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/http/ready-report.d.ts
+//#region core/src/http/ready-report.d.ts
 /**
  * What the HTTP connector learned at the moment it finished binding.
  *

package/esm/http/ready-report.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ready-report.d.mts","names":[],"sources":["../../../../../../../core/src/http/ready-report.ts"],"mappings":";;AAiCA;;;;;;;;;;;AAYW;AAQX;;;;AAAwD;AASxD;;;;AAAqD;AAKrD;;;;AAAoC;;;;;KAlCxB,eAAA;2EAEV,YAAA;EAEA,GAAA;EAEA,YAAA;EAEA,IAAA;EAEA,UAAA;EAEA,SAAA;AAAA;;;;iBAQc,kBAAA,CAAmB,IAAqB,EAAf,eAAe;;;;;;iBASxC,kBAAA,IAAsB,eAAe;;iBAKrC,oBAAA"}
+{"version":3,"file":"ready-report.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/ready-report.ts"],"mappings":";;AAiCA;;;;;;;;;;;AAYW;AAQX;;;;AAAwD;AASxD;;;;AAAqD;AAKrD;;;;AAAoC;;;;;KAlCxB,eAAA;2EAEV,YAAA;EAEA,GAAA;EAEA,YAAA;EAEA,IAAA;EAEA,UAAA;EAEA,SAAA;AAAA;;;;iBAQc,kBAAA,CAAmB,IAAqB,EAAf,eAAe;;;;;;iBASxC,kBAAA,CAAA,GAAsB,eAAe;;iBAKrC,oBAAA,CAAA"}

package/esm/http/ready-report.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/ready-report.ts
+//#region core/src/http/ready-report.ts
 let report;
 /**
 * @internal Called by `HttpConnector.start()` right after a successful listen.

package/esm/http/ready-report.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ready-report.mjs","names":[],"sources":["../../../../../../../core/src/http/ready-report.ts"],"sourcesContent":["/**\n * What the HTTP connector learned at the moment it finished binding.\n *\n * ## Why this exists rather than another `log.*` call\n *\n * The facts a developer needs on a `warlock dev` boot — the URL, the port, the\n * mode, how many routes registered — are discovered by DIFFERENT components at\n * DIFFERENT times, and each one used to print the instant it knew. The result\n * was a ready \"screen\" assembled by whatever finished first:\n *\n *     ℹ info    [http] [routes] 14 route(s) registered\n *     ✓ success [http] [connection] Server ready at http://[::1]:2030\n *     …          Development Server is ready in 660ms\n *\n * Three lines, three formats, no single place stating where to point a browser.\n *\n * So the connector RECORDS instead of narrating, and one renderer prints one\n * block once boot has actually completed (`dev-server/ready-block.ts`). The\n * split matters: a component that prints cannot be composed, and a boot\n * sequence whose output order is its completion order cannot be read.\n *\n * ## What deliberately does NOT go through here\n *\n * Warnings. A status block is a summary of the healthy case, and folding a\n * warning into a summary is how a warning stops being read. Anything the\n * connector needs to WARN about is still logged the moment it is known, which\n * puts it above the block, where it survives being skimmed.\n *\n * Production is unchanged for the same reason it always was: `warlock start`\n * hands its stdout to a supervisor that greps for known lines, so the existing\n * per-fact log lines stay exactly as they are outside development.\n */\n\nexport type HttpReadyReport = {\n  /** Exactly what `listen()` returned — the bind, not its presentation. */\n  boundAddress?: string;\n  /** The address spelled for a human; safe to paste into a browser. */\n  url: string;\n  /** Whether the bind covers more than loopback. */\n  wildcardBind: boolean;\n  /** The port actually bound. */\n  port: number;\n  /** Routes on the app router at the moment the server started listening. */\n  routeCount: number;\n  /** `app.baseUrl`, when it is a deployment address rather than a local one. */\n  publicUrl?: string;\n};\n\nlet report: HttpReadyReport | undefined;\n\n/**\n * @internal Called by `HttpConnector.start()` right after a successful listen.\n */\nexport function setHttpReadyReport(next: HttpReadyReport): void {\n  report = next;\n}\n\n/**\n * The last recorded bind, or `undefined` for a process with no HTTP surface —\n * a queue worker still boots, and the ready block must render without an app\n * URL rather than invent one.\n */\nexport function getHttpReadyReport(): HttpReadyReport | undefined {\n  return report;\n}\n\n/** @internal Test seam — a module-level singleton needs a way back to empty. */\nexport function resetHttpReadyReport(): void {\n  report = undefined;\n}\n"],"mappings":";AAgDA,IAAI;;;;AAKJ,SAAgB,mBAAmB,MAA6B;CAC9D,SAAS;AACX;;;;;;AAOA,SAAgB,qBAAkD;CAChE,OAAO;AACT;;AAGA,SAAgB,uBAA6B;CAC3C,SAAS;AACX"}
+{"version":3,"file":"ready-report.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/ready-report.ts"],"sourcesContent":["/**\n * What the HTTP connector learned at the moment it finished binding.\n *\n * ## Why this exists rather than another `log.*` call\n *\n * The facts a developer needs on a `warlock dev` boot — the URL, the port, the\n * mode, how many routes registered — are discovered by DIFFERENT components at\n * DIFFERENT times, and each one used to print the instant it knew. The result\n * was a ready \"screen\" assembled by whatever finished first:\n *\n *     ℹ info    [http] [routes] 14 route(s) registered\n *     ✓ success [http] [connection] Server ready at http://[::1]:2030\n *     …          Development Server is ready in 660ms\n *\n * Three lines, three formats, no single place stating where to point a browser.\n *\n * So the connector RECORDS instead of narrating, and one renderer prints one\n * block once boot has actually completed (`dev-server/ready-block.ts`). The\n * split matters: a component that prints cannot be composed, and a boot\n * sequence whose output order is its completion order cannot be read.\n *\n * ## What deliberately does NOT go through here\n *\n * Warnings. A status block is a summary of the healthy case, and folding a\n * warning into a summary is how a warning stops being read. Anything the\n * connector needs to WARN about is still logged the moment it is known, which\n * puts it above the block, where it survives being skimmed.\n *\n * Production is unchanged for the same reason it always was: `warlock start`\n * hands its stdout to a supervisor that greps for known lines, so the existing\n * per-fact log lines stay exactly as they are outside development.\n */\n\nexport type HttpReadyReport = {\n  /** Exactly what `listen()` returned — the bind, not its presentation. */\n  boundAddress?: string;\n  /** The address spelled for a human; safe to paste into a browser. */\n  url: string;\n  /** Whether the bind covers more than loopback. */\n  wildcardBind: boolean;\n  /** The port actually bound. */\n  port: number;\n  /** Routes on the app router at the moment the server started listening. */\n  routeCount: number;\n  /** `app.baseUrl`, when it is a deployment address rather than a local one. */\n  publicUrl?: string;\n};\n\nlet report: HttpReadyReport | undefined;\n\n/**\n * @internal Called by `HttpConnector.start()` right after a successful listen.\n */\nexport function setHttpReadyReport(next: HttpReadyReport): void {\n  report = next;\n}\n\n/**\n * The last recorded bind, or `undefined` for a process with no HTTP surface —\n * a queue worker still boots, and the ready block must render without an app\n * URL rather than invent one.\n */\nexport function getHttpReadyReport(): HttpReadyReport | undefined {\n  return report;\n}\n\n/** @internal Test seam — a module-level singleton needs a way back to empty. */\nexport function resetHttpReadyReport(): void {\n  report = undefined;\n}\n"],"mappings":";AAgDA,IAAI;;;;AAKJ,SAAgB,mBAAmB,MAA6B;CAC9D,SAAS;AACX;;;;;;AAOA,SAAgB,qBAAkD;CAChE,OAAO;AACT;;AAGA,SAAgB,uBAA6B;CAC3C,SAAS;AACX"}

package/esm/http/request-controller.d.mts

@@ -3,7 +3,7 @@ import { Response } from "./response.mjs";
 import { ReturnedResponse } from "./types.mjs";
 import { RequestControllerContract } from "../router/types.mjs";
 
-//#region ../core/src/http/request-controller.d.ts
+//#region core/src/http/request-controller.d.ts
 declare abstract class RequestController implements RequestControllerContract {
   readonly request: Request;
   readonly response: Response;

package/esm/http/request-controller.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-controller.d.mts","names":[],"sources":["../../../../../../../core/src/http/request-controller.ts"],"mappings":";;;;;;uBAKsB,iBAAA,YAA6B,yBAAA;EAAA,SAE/B,OAAA,EAAS,OAAA;EAAA,SACT,QAAA,EAAU,QAAA;cADV,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA;EAAA,SAKZ,OAAA,IAAW,OAAA,CAAQ,gBAAA;AAAA"}
+{"version":3,"file":"request-controller.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/request-controller.ts"],"mappings":";;;;;;uBAKsB,iBAAA,YAA6B,yBAAA;EAAA,SAE/B,OAAA,EAAS,OAAA;EAAA,SACT,QAAA,EAAU,QAAA;cADV,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA;EAAA,SAKZ,OAAA,CAAA,GAAW,OAAA,CAAQ,gBAAA;AAAA"}

package/esm/http/request-controller.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/request-controller.ts
+//#region core/src/http/request-controller.ts
 var RequestController = class {
 	constructor(request, response) {
 		this.request = request;

package/esm/http/request-controller.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request-controller.mjs","names":[],"sources":["../../../../../../../core/src/http/request-controller.ts"],"sourcesContent":["import type { RequestControllerContract } from \"./../router/types\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\nimport type { ReturnedResponse } from \"./types\";\n\nexport abstract class RequestController implements RequestControllerContract {\n  public constructor(\n    public readonly request: Request,\n    public readonly response: Response,\n  ) {\n    //\n  }\n\n  public abstract execute(): Promise<ReturnedResponse>;\n}\n"],"mappings":";AAKA,IAAsB,oBAAtB,MAA6E;CAC3E,AAAO,YACL,AAAgB,SAChB,AAAgB,UAChB;EAFgB;EACA;CAGlB;AAGF"}
+{"version":3,"file":"request-controller.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/request-controller.ts"],"sourcesContent":["import type { RequestControllerContract } from \"./../router/types\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\nimport type { ReturnedResponse } from \"./types\";\n\nexport abstract class RequestController implements RequestControllerContract {\n  public constructor(\n    public readonly request: Request,\n    public readonly response: Response,\n  ) {\n    //\n  }\n\n  public abstract execute(): Promise<ReturnedResponse>;\n}\n"],"mappings":";AAKA,IAAsB,oBAAtB,MAA6E;CAC3E,AAAO,YACL,AAAgB,SAChB,AAAgB,UAChB;EAFgB;EACA;CAGlB;AAGF"}

package/esm/http/request.d.mts

@@ -8,7 +8,7 @@ import { LogLevel } from "@warlock.js/logger";
 import { FastifyRequest } from "fastify";
 import { IncomingHttpHeaders } from "node:http2";
 
-//#region ../core/src/http/request.d.ts
+//#region core/src/http/request.d.ts
 type StandardHeaders = { [K in keyof IncomingHttpHeaders as string extends K ? never : number extends K ? never : K]: IncomingHttpHeaders[K] };
 type HeaderKeys = keyof StandardHeaders;
 declare class Request<RequestValidation = any> {
@@ -96,6 +96,18 @@ declare class Request<RequestValidation = any> {
    * a prior one.
    */
   locals: RequestLocals;
+  /**
+   * Forget the authenticated user for this request.
+   *
+   * The `user` documentation above already names this as "the one place core
+   * writes it directly", and `@warlock.js/auth`'s middleware already calls it when
+   * a token is forged, malformed, expired, or of the wrong type. It was designed,
+   * documented and called — just never written, so `auth` could not typecheck.
+   *
+   * Clearing rather than leaving a stale value matters: a request that failed
+   * authentication must not carry the identity of whoever this object last held.
+   */
+  clearCurrentUser(): void;
   /**
    * Backing field for the lazily-generated CSP nonce. Left `undefined` until
    * the first `request.nonce` read; see the `nonce` getter below.
@@ -529,10 +541,10 @@ declare class Request<RequestValidation = any> {
    *
    * `X-Real-IP` is NOT part of that resolution — Fastify never looks at it,
    * and unlike `X-Forwarded-For` it carries no chain, so there is nothing to
-   * validate a hop count or proxy allowlist against. It is therefore honoured
+   * validate a proxy allowlist against. It is therefore honoured
    * only under `trustProxy: true` ("everything upstream is mine"), where it is
    * no weaker than the trust already granted. Under a bounded `trustProxy`
-   * (hop count / CIDR list) it is ignored: a trusted-but-passthrough edge that
+   * (CIDR / IP list) it is ignored: a trusted-but-passthrough edge that
    * forwards the client's own `X-Real-IP` verbatim would otherwise hand any
    * client a way around the bound.
    *