@warlock.js/core 5.10.0 → 5.12.0

package/esm/http/createHttpApplication.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createHttpApplication.mjs","names":[],"sources":["../../../../../../../core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;AAQA,eAAsB,wBAAwB;CAC5C,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAU,OAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}
+{"version":3,"file":"createHttpApplication.mjs","names":[],"sources":["../../../../../../../core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { validateCspConfigAtBoot } from \"./csp\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  // Fail loudly, before the server ever binds a port, when `http.csp` is\n  // enabled with a malformed directive — never silently repair it and never\n  // wait for the first request to discover it.\n  validateCspConfigAtBoot();\n\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,wBAAwB;CAI5C,wBAAwB;CAExB,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAU,OAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}

package/esm/http/csp.d.mts

@@ -0,0 +1,139 @@
+import { Response } from "./response.mjs";
+import { Request } from "./request.mjs";
+
+//#region ../core/src/http/csp.d.ts
+/**
+ * App-facing `http.csp` configuration shape.
+ *
+ * Disabled by default: an app that never sets `http.csp` (or sets
+ * `enabled: false`) gets no `Content-Security-Policy` header at all — zero
+ * behaviour change for every existing app. Opting in only swaps `enabled` to
+ * `true`; `reportOnly` and `directives` are optional refinements on top.
+ *
+ * @example
+ * ```ts title="src/config/http.ts"
+ * const httpConfigurations: HttpConfigurations = {
+ *   csp: {
+ *     enabled: true,
+ *     directives: {
+ *       "img-src": ["'self'", "data:", "https://cdn.example.com"],
+ *     },
+ *   },
+ * };
+ * ```
+ */
+type CspConfig = {
+  /**
+   * Turn the header on. Everything else in this type is inert while this is
+   * `false`/unset.
+   */
+  enabled: boolean;
+  /**
+   * Emit `Content-Security-Policy-Report-Only` instead of the enforcing
+   * `Content-Security-Policy` header — the browser reports violations
+   * (via `report-to`/`report-uri`, if the app's directives configure one)
+   * without blocking anything. Use this to observe a policy safely before
+   * enforcing it.
+   *
+   * @default false
+   */
+  reportOnly?: boolean;
+  /**
+   * App-supplied directive values. A directive named here REPLACES the
+   * framework's default list for that directive entirely (the two lists are
+   * never merged element-wise) — declare the full value list you want.
+   *
+   * `script-src` is special-cased regardless of whether it is declared here:
+   * the current request's CSP nonce (`'nonce-<value>'`) is always appended to
+   * it, so the framework's own inline/module scripts keep working.
+   */
+  directives?: Record<string, string[]>;
+};
+/**
+ * The policy every `http.csp`-enabled app starts from. Deliberately
+ * conservative — same-origin by default, no plugins, no framing by other
+ * sites — and documented here rather than only in the skill, since this is
+ * the literal set an app's `directives` entry replaces one key at a time.
+ */
+declare const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>>;
+/**
+ * Thrown at boot when `http.csp.directives` contains a value the framework
+ * refuses to ship as-is, rather than silently dropping or rewriting it.
+ *
+ * Two shapes are rejected:
+ * - a value containing `;` — CSP directives are `;`-delimited, so a `;`
+ *   inside one value would prematurely close it and let the remainder be
+ *   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.
+ * - a value with an odd number of `'` characters — every CSP keyword
+ *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an
+ *   unbalanced count means a keyword was truncated or malformed.
+ */
+declare class InvalidCspDirectiveError extends Error {
+  readonly directive: string;
+  readonly value: string;
+  constructor(directive: string, value: string, reason: string);
+}
+/**
+ * Validate every directive value an app supplied, throwing
+ * {@link InvalidCspDirectiveError} on the first offender.
+ *
+ * Exported so boot code and tests can call it directly, independent of
+ * whether `http.csp` happens to be enabled.
+ */
+declare function validateCspDirectives(directives: Record<string, string[]> | undefined): void;
+/**
+ * Read the app's `http.csp` config, if any.
+ */
+declare function resolveCspConfig(): CspConfig | undefined;
+/**
+ * Fail the boot loudly when `http.csp` is enabled with invalid directives.
+ *
+ * Called once, from {@link createHttpApplication} before the server starts
+ * listening — never per-request. A per-request validation would let an app
+ * boot successfully and only discover the bad config on first traffic;
+ * checking once at boot surfaces it immediately, the same way a malformed
+ * `warlock.config.ts` would.
+ *
+ * @throws {InvalidCspDirectiveError} when a directive value is malformed.
+ */
+declare function validateCspConfigAtBoot(): void;
+/**
+ * Merge the app's directives over the framework defaults and fold in the
+ * request's nonce.
+ *
+ * Per-directive replacement, not element-wise merging: a directive the app
+ * names wins outright, everything else falls back to
+ * {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains
+ * `'nonce-<nonce>'` on top, whichever list it started from, so the
+ * framework's own inline payload script and hydration module script are
+ * never blocked by an app's own policy.
+ */
+declare function mergeCspDirectives(appDirectives: Record<string, string[]> | undefined, nonce: string): Record<string, string[]>;
+/**
+ * Serialize a merged directive map into a header value —
+ * `"default-src 'self'; script-src 'self' 'nonce-...'; ..."`.
+ */
+declare function serializeCspDirectives(directives: Record<string, string[]>): string;
+/**
+ * Build the full `Content-Security-Policy` (or `-Report-Only`) header value
+ * for one request, using that request's own nonce.
+ */
+declare function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string;
+/**
+ * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,
+ * `Content-Security-Policy-Report-Only`) header on the response, when the
+ * app opted in via `http.csp.enabled`.
+ *
+ * A no-op when `http.csp` is absent or `enabled` is falsy — the default,
+ * behaviour-preserving state for every app that hasn't opted in.
+ *
+ * Reads `request.nonce`, which lazily generates and caches the per-request
+ * nonce (`request.ts`) — calling this early in the request lifecycle (see
+ * `inject-request-context.ts`) means the SAME nonce this stamps into the
+ * header is the one still available later for the web layer's `<script>`
+ * tags to read off `request.nonce`.
+ */
+declare function applyCspHeader(request: Request, response: Response): void;
+//#endregion
+export { CspConfig, DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives };
+//# sourceMappingURL=csp.d.mts.map

package/esm/http/csp.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.d.mts","names":[],"sources":["../../../../../../../core/src/http/csp.ts"],"mappings":";;;;;;AAwBA;;;;;;;;;AAyBqB;AASrB;;;;AAAoD;AAsBpD;;;KAxDY,SAAA;EAwDkC;;;;EAnD5C,OAAA;EAsDkB;;;AACF;AAkBlB;;;;AAAsF;EA/DpF,UAAA;EA2F8B;;;AAAa;AAe7C;;;;AAAuC;EAhGrC,UAAA,GAAa,MAAM;AAAA;;;;;;;cASR,sBAAA,EAAwB,QAAQ,CAAC,MAAA;AA6GrC;AAqCT;;;;AAA2E;AAU3E;;;;;;AA/CS,cAvFI,wBAAA,SAAiC,KAAK;EAAA,SAE/B,SAAA;EAAA,SACA,KAAA;cADA,SAAA,UACA,KAAA,UAChB,MAAA;AAAA;;;;;;;;iBAkBY,qBAAA,CAAsB,UAAgD,EAApC,MAAM;;;;iBA4BxC,gBAAA,IAAoB,SAAS;;;;;;;;;;;;iBAe7B,uBAAA;;;;;;;;;;;;iBAmBA,kBAAA,CACd,aAAA,EAAe,MAAA,gCACf,KAAA,WACC,MAAM;;;;;iBAqCO,sBAAA,CAAuB,UAAoC,EAAxB,MAAM;;;;;iBAUzC,mBAAA,CAAoB,SAAA,EAAW,SAAS,EAAE,KAAA;;;;;;;;;;;;;;;iBAkB1C,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,QAAQ"}

package/esm/http/csp.mjs

@@ -0,0 +1,134 @@
+import config from "@mongez/config";
+
+//#region ../core/src/http/csp.ts
+/**
+* The policy every `http.csp`-enabled app starts from. Deliberately
+* conservative — same-origin by default, no plugins, no framing by other
+* sites — and documented here rather than only in the skill, since this is
+* the literal set an app's `directives` entry replaces one key at a time.
+*/
+const DEFAULT_CSP_DIRECTIVES = {
+	"default-src": ["'self'"],
+	"script-src": ["'self'"],
+	"style-src": ["'self'"],
+	"img-src": ["'self'", "data:"],
+	"object-src": ["'none'"],
+	"base-uri": ["'self'"],
+	"frame-ancestors": ["'self'"]
+};
+/**
+* Thrown at boot when `http.csp.directives` contains a value the framework
+* refuses to ship as-is, rather than silently dropping or rewriting it.
+*
+* Two shapes are rejected:
+* - a value containing `;` — CSP directives are `;`-delimited, so a `;`
+*   inside one value would prematurely close it and let the remainder be
+*   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.
+* - a value with an odd number of `'` characters — every CSP keyword
+*   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an
+*   unbalanced count means a keyword was truncated or malformed.
+*/
+var InvalidCspDirectiveError = class extends Error {
+	constructor(directive, value, reason) {
+		super(`Invalid "http.csp.directives" entry — directive "${directive}" has a value ${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; the framework will not silently repair it.`);
+		this.directive = directive;
+		this.value = value;
+		this.name = "InvalidCspDirectiveError";
+	}
+};
+/**
+* Validate every directive value an app supplied, throwing
+* {@link InvalidCspDirectiveError} on the first offender.
+*
+* Exported so boot code and tests can call it directly, independent of
+* whether `http.csp` happens to be enabled.
+*/
+function validateCspDirectives(directives) {
+	if (!directives) return;
+	for (const [directive, values] of Object.entries(directives)) for (const value of values) {
+		if (value.includes(";")) throw new InvalidCspDirectiveError(directive, value, "contains a ';' character, which would truncate the directive.");
+		if ((value.match(/'/g) ?? []).length % 2 !== 0) throw new InvalidCspDirectiveError(directive, value, "has an unbalanced number of ' characters.");
+	}
+}
+/**
+* Read the app's `http.csp` config, if any.
+*/
+function resolveCspConfig() {
+	return config.get("http.csp");
+}
+/**
+* Fail the boot loudly when `http.csp` is enabled with invalid directives.
+*
+* Called once, from {@link createHttpApplication} before the server starts
+* listening — never per-request. A per-request validation would let an app
+* boot successfully and only discover the bad config on first traffic;
+* checking once at boot surfaces it immediately, the same way a malformed
+* `warlock.config.ts` would.
+*
+* @throws {InvalidCspDirectiveError} when a directive value is malformed.
+*/
+function validateCspConfigAtBoot() {
+	const cspConfig = resolveCspConfig();
+	if (!cspConfig?.enabled) return;
+	validateCspDirectives(cspConfig.directives);
+}
+/**
+* Merge the app's directives over the framework defaults and fold in the
+* request's nonce.
+*
+* Per-directive replacement, not element-wise merging: a directive the app
+* names wins outright, everything else falls back to
+* {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains
+* `'nonce-<nonce>'` on top, whichever list it started from, so the
+* framework's own inline payload script and hydration module script are
+* never blocked by an app's own policy.
+*/
+function mergeCspDirectives(appDirectives, nonce) {
+	const merged = {};
+	for (const [directive, defaultValues] of Object.entries(DEFAULT_CSP_DIRECTIVES)) merged[directive] = appDirectives?.[directive] ? [...appDirectives[directive]] : [...defaultValues];
+	if (appDirectives) {
+		for (const [directive, values] of Object.entries(appDirectives)) if (!(directive in merged)) merged[directive] = [...values];
+	}
+	const scriptSrc = merged["script-src"] ?? [];
+	const nonceSource = `'nonce-${nonce}'`;
+	merged["script-src"] = scriptSrc.includes(nonceSource) ? scriptSrc : [...scriptSrc, nonceSource];
+	return merged;
+}
+/**
+* Serialize a merged directive map into a header value —
+* `"default-src 'self'; script-src 'self' 'nonce-...'; ..."`.
+*/
+function serializeCspDirectives(directives) {
+	return Object.entries(directives).map(([directive, values]) => `${directive} ${values.join(" ")}`).join("; ");
+}
+/**
+* Build the full `Content-Security-Policy` (or `-Report-Only`) header value
+* for one request, using that request's own nonce.
+*/
+function buildCspHeaderValue(cspConfig, nonce) {
+	return serializeCspDirectives(mergeCspDirectives(cspConfig.directives, nonce));
+}
+/**
+* Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,
+* `Content-Security-Policy-Report-Only`) header on the response, when the
+* app opted in via `http.csp.enabled`.
+*
+* A no-op when `http.csp` is absent or `enabled` is falsy — the default,
+* behaviour-preserving state for every app that hasn't opted in.
+*
+* Reads `request.nonce`, which lazily generates and caches the per-request
+* nonce (`request.ts`) — calling this early in the request lifecycle (see
+* `inject-request-context.ts`) means the SAME nonce this stamps into the
+* header is the one still available later for the web layer's `<script>`
+* tags to read off `request.nonce`.
+*/
+function applyCspHeader(request, response) {
+	const cspConfig = resolveCspConfig();
+	if (!cspConfig?.enabled) return;
+	const headerName = cspConfig.reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy";
+	response.header(headerName, buildCspHeaderValue(cspConfig, request.nonce));
+}
+
+//#endregion
+export { DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives };
+//# sourceMappingURL=csp.mjs.map

package/esm/http/csp.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.mjs","names":[],"sources":["../../../../../../../core/src/http/csp.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/**\n * App-facing `http.csp` configuration shape.\n *\n * Disabled by default: an app that never sets `http.csp` (or sets\n * `enabled: false`) gets no `Content-Security-Policy` header at all — zero\n * behaviour change for every existing app. Opting in only swaps `enabled` to\n * `true`; `reportOnly` and `directives` are optional refinements on top.\n *\n * @example\n * ```ts title=\"src/config/http.ts\"\n * const httpConfigurations: HttpConfigurations = {\n *   csp: {\n *     enabled: true,\n *     directives: {\n *       \"img-src\": [\"'self'\", \"data:\", \"https://cdn.example.com\"],\n *     },\n *   },\n * };\n * ```\n */\nexport type CspConfig = {\n  /**\n   * Turn the header on. Everything else in this type is inert while this is\n   * `false`/unset.\n   */\n  enabled: boolean;\n  /**\n   * Emit `Content-Security-Policy-Report-Only` instead of the enforcing\n   * `Content-Security-Policy` header — the browser reports violations\n   * (via `report-to`/`report-uri`, if the app's directives configure one)\n   * without blocking anything. Use this to observe a policy safely before\n   * enforcing it.\n   *\n   * @default false\n   */\n  reportOnly?: boolean;\n  /**\n   * App-supplied directive values. A directive named here REPLACES the\n   * framework's default list for that directive entirely (the two lists are\n   * never merged element-wise) — declare the full value list you want.\n   *\n   * `script-src` is special-cased regardless of whether it is declared here:\n   * the current request's CSP nonce (`'nonce-<value>'`) is always appended to\n   * it, so the framework's own inline/module scripts keep working.\n   */\n  directives?: Record<string, string[]>;\n};\n\n/**\n * The policy every `http.csp`-enabled app starts from. Deliberately\n * conservative — same-origin by default, no plugins, no framing by other\n * sites — and documented here rather than only in the skill, since this is\n * the literal set an app's `directives` entry replaces one key at a time.\n */\nexport const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>> = {\n  \"default-src\": [\"'self'\"],\n  \"script-src\": [\"'self'\"],\n  \"style-src\": [\"'self'\"],\n  \"img-src\": [\"'self'\", \"data:\"],\n  \"object-src\": [\"'none'\"],\n  \"base-uri\": [\"'self'\"],\n  \"frame-ancestors\": [\"'self'\"],\n};\n\n/**\n * Thrown at boot when `http.csp.directives` contains a value the framework\n * refuses to ship as-is, rather than silently dropping or rewriting it.\n *\n * Two shapes are rejected:\n * - a value containing `;` — CSP directives are `;`-delimited, so a `;`\n *   inside one value would prematurely close it and let the remainder be\n *   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.\n * - a value with an odd number of `'` characters — every CSP keyword\n *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an\n *   unbalanced count means a keyword was truncated or malformed.\n */\nexport class InvalidCspDirectiveError extends Error {\n  public constructor(\n    public readonly directive: string,\n    public readonly value: string,\n    reason: string,\n  ) {\n    super(\n      `Invalid \"http.csp.directives\" entry — directive \"${directive}\" has a value ` +\n        `${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; ` +\n        `the framework will not silently repair it.`,\n    );\n    this.name = \"InvalidCspDirectiveError\";\n  }\n}\n\n/**\n * Validate every directive value an app supplied, throwing\n * {@link InvalidCspDirectiveError} on the first offender.\n *\n * Exported so boot code and tests can call it directly, independent of\n * whether `http.csp` happens to be enabled.\n */\nexport function validateCspDirectives(directives: Record<string, string[]> | undefined): void {\n  if (!directives) return;\n\n  for (const [directive, values] of Object.entries(directives)) {\n    for (const value of values) {\n      if (value.includes(\";\")) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"contains a ';' character, which would truncate the directive.\",\n        );\n      }\n\n      const quoteCount = (value.match(/'/g) ?? []).length;\n      if (quoteCount % 2 !== 0) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"has an unbalanced number of ' characters.\",\n        );\n      }\n    }\n  }\n}\n\n/**\n * Read the app's `http.csp` config, if any.\n */\nexport function resolveCspConfig(): CspConfig | undefined {\n  return config.get(\"http.csp\");\n}\n\n/**\n * Fail the boot loudly when `http.csp` is enabled with invalid directives.\n *\n * Called once, from {@link createHttpApplication} before the server starts\n * listening — never per-request. A per-request validation would let an app\n * boot successfully and only discover the bad config on first traffic;\n * checking once at boot surfaces it immediately, the same way a malformed\n * `warlock.config.ts` would.\n *\n * @throws {InvalidCspDirectiveError} when a directive value is malformed.\n */\nexport function validateCspConfigAtBoot(): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  validateCspDirectives(cspConfig.directives);\n}\n\n/**\n * Merge the app's directives over the framework defaults and fold in the\n * request's nonce.\n *\n * Per-directive replacement, not element-wise merging: a directive the app\n * names wins outright, everything else falls back to\n * {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains\n * `'nonce-<nonce>'` on top, whichever list it started from, so the\n * framework's own inline payload script and hydration module script are\n * never blocked by an app's own policy.\n */\nexport function mergeCspDirectives(\n  appDirectives: Record<string, string[]> | undefined,\n  nonce: string,\n): Record<string, string[]> {\n  const merged: Record<string, string[]> = {};\n\n  for (const [directive, defaultValues] of Object.entries(DEFAULT_CSP_DIRECTIVES)) {\n    merged[directive] = appDirectives?.[directive]\n      ? [...appDirectives[directive]]\n      : [...defaultValues];\n  }\n\n  if (appDirectives) {\n    for (const [directive, values] of Object.entries(appDirectives)) {\n      if (!(directive in merged)) {\n        merged[directive] = [...values];\n      }\n    }\n  }\n\n  // `merged[\"script-src\"]` is always populated by the loop above —\n  // `DEFAULT_CSP_DIRECTIVES` (:59-67) declares a `script-src` entry, and every\n  // one of its keys is copied into `merged` unconditionally — but its type is\n  // `Record<string, string[]>`, so `noUncheckedIndexedAccess` still widens the\n  // read to `string[] | undefined`. Narrowed once, locally, rather than\n  // asserted away.\n  const scriptSrc = merged[\"script-src\"] ?? [];\n  const nonceSource = `'nonce-${nonce}'`;\n\n  merged[\"script-src\"] = scriptSrc.includes(nonceSource)\n    ? scriptSrc\n    : [...scriptSrc, nonceSource];\n\n  return merged;\n}\n\n/**\n * Serialize a merged directive map into a header value —\n * `\"default-src 'self'; script-src 'self' 'nonce-...'; ...\"`.\n */\nexport function serializeCspDirectives(directives: Record<string, string[]>): string {\n  return Object.entries(directives)\n    .map(([directive, values]) => `${directive} ${values.join(\" \")}`)\n    .join(\"; \");\n}\n\n/**\n * Build the full `Content-Security-Policy` (or `-Report-Only`) header value\n * for one request, using that request's own nonce.\n */\nexport function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string {\n  return serializeCspDirectives(mergeCspDirectives(cspConfig.directives, nonce));\n}\n\n/**\n * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,\n * `Content-Security-Policy-Report-Only`) header on the response, when the\n * app opted in via `http.csp.enabled`.\n *\n * A no-op when `http.csp` is absent or `enabled` is falsy — the default,\n * behaviour-preserving state for every app that hasn't opted in.\n *\n * Reads `request.nonce`, which lazily generates and caches the per-request\n * nonce (`request.ts`) — calling this early in the request lifecycle (see\n * `inject-request-context.ts`) means the SAME nonce this stamps into the\n * header is the one still available later for the web layer's `<script>`\n * tags to read off `request.nonce`.\n */\nexport function applyCspHeader(request: Request, response: Response): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  const headerName = cspConfig.reportOnly\n    ? \"Content-Security-Policy-Report-Only\"\n    : \"Content-Security-Policy\";\n\n  response.header(headerName, buildCspHeaderValue(cspConfig, request.nonce));\n}\n"],"mappings":";;;;;;;;;AA0DA,MAAa,yBAAsE;CACjF,eAAe,CAAC,QAAQ;CACxB,cAAc,CAAC,QAAQ;CACvB,aAAa,CAAC,QAAQ;CACtB,WAAW,CAAC,UAAU,OAAO;CAC7B,cAAc,CAAC,QAAQ;CACvB,YAAY,CAAC,QAAQ;CACrB,mBAAmB,CAAC,QAAQ;AAC9B;;;;;;;;;;;;;AAcA,IAAa,2BAAb,cAA8C,MAAM;CAClD,AAAO,YACL,AAAgB,WAChB,AAAgB,OAChB,QACA;EACA,MACE,oDAAoD,UAAU,gBACzD,KAAK,UAAU,KAAK,EAAE,QAAQ,OAAO,qFAE5C;EARgB;EACA;EAQhB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,sBAAsB,YAAwD;CAC5F,IAAI,CAAC,YAAY;CAEjB,KAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,UAAU,GACzD,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,GAAG,GACpB,MAAM,IAAI,yBACR,WACA,OACA,+DACF;EAIF,KADoB,MAAM,MAAM,IAAI,KAAK,CAAC,EAAC,CAAE,SAC5B,MAAM,GACrB,MAAM,IAAI,yBACR,WACA,OACA,2CACF;CAEJ;AAEJ;;;;AAKA,SAAgB,mBAA0C;CACxD,OAAO,OAAO,IAAI,UAAU;AAC9B;;;;;;;;;;;;AAaA,SAAgB,0BAAgC;CAC9C,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,sBAAsB,UAAU,UAAU;AAC5C;;;;;;;;;;;;AAaA,SAAgB,mBACd,eACA,OAC0B;CAC1B,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,WAAW,kBAAkB,OAAO,QAAQ,sBAAsB,GAC5E,OAAO,aAAa,gBAAgB,aAChC,CAAC,GAAG,cAAc,UAAU,IAC5B,CAAC,GAAG,aAAa;CAGvB,IAAI,eACF;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,aAAa,GAC5D,IAAI,EAAE,aAAa,SACjB,OAAO,aAAa,CAAC,GAAG,MAAM;CAElC;CASF,MAAM,YAAY,OAAO,iBAAiB,CAAC;CAC3C,MAAM,cAAc,UAAU,MAAM;CAEpC,OAAO,gBAAgB,UAAU,SAAS,WAAW,IACjD,YACA,CAAC,GAAG,WAAW,WAAW;CAE9B,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,YAA8C;CACnF,OAAO,OAAO,QAAQ,UAAU,CAAC,CAC9B,KAAK,CAAC,WAAW,YAAY,GAAG,UAAU,GAAG,OAAO,KAAK,GAAG,GAAG,CAAC,CAChE,KAAK,IAAI;AACd;;;;;AAMA,SAAgB,oBAAoB,WAAsB,OAAuB;CAC/E,OAAO,uBAAuB,mBAAmB,UAAU,YAAY,KAAK,CAAC;AAC/E;;;;;;;;;;;;;;;AAgBA,SAAgB,eAAe,SAAkB,UAA0B;CACzE,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,MAAM,aAAa,UAAU,aACzB,wCACA;CAEJ,SAAS,OAAO,YAAY,oBAAoB,WAAW,QAAQ,KAAK,CAAC;AAC3E"}

package/esm/http/errors/errors.d.mts

@@ -37,6 +37,22 @@ declare class NotAllowedError extends HttpError {
   payload?: any | undefined;
   constructor(message: string, payload?: any | undefined);
 }
+/**
+ * Thrown by `Request.prototype.user` in development to catch a call site
+ * still reading the removed `request.user` getter/setter after the 5.12.0
+ * move: the authenticated user now lives at `request.locals.user`, written
+ * by `@warlock.js/auth`'s middleware.
+ *
+ * Development-only diagnostic, not a runtime contract other code should
+ * catch — the getter itself is typed `never`, so a caller that still
+ * compiles against `request.user` only does so via `any`/an outdated type.
+ * Kept in core (not auth) because `request.user` is a core `Request`
+ * accessor and core cannot depend on `@warlock.js/auth` to react to it.
+ * Slated for removal one release after 5.12.0 — see the CHANGELOG.
+ */
+declare class RequestUserMovedError extends Error {
+  constructor();
+}
 //#endregion
-export { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError };
+export { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, RequestUserMovedError, ResourceNotFoundError, ServerError, UnAuthorizedError };
 //# sourceMappingURL=errors.d.mts.map

package/esm/http/errors/errors.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../../core/src/http/errors/errors.ts"],"mappings":";cAAa,SAAA,SAAkB,KAAK;EAEzB,MAAA;EACA,OAAA;EACA,OAAA;cAFA,MAAA,UACA,OAAA,UACA,OAAA;AAAA;AAAA,cAOE,qBAAA,SAA8B,SAAS;EAGzC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,iBAAA,SAA0B,SAAS;EAGrC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,cAAA,SAAuB,SAAS;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,WAAA,SAAoB,SAAS;EAG/B,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,aAAA,SAAsB,SAAS;EAGjC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,kBAAA,SAA2B,SAAS;EAGtC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA"}
+{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../../core/src/http/errors/errors.ts"],"mappings":";cAAa,SAAA,SAAkB,KAAK;EAEzB,MAAA;EACA,OAAA;EACA,OAAA;cAFA,MAAA,UACA,OAAA,UACA,OAAA;AAAA;AAAA,cAOE,qBAAA,SAA8B,SAAS;EAGzC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,iBAAA,SAA0B,SAAS;EAGrC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,cAAA,SAAuB,SAAS;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,WAAA,SAAoB,SAAS;EAG/B,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,aAAA,SAAsB,SAAS;EAGjC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,kBAAA,SAA2B,SAAS;EAGtC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;;;;;;;;;;AAlDa;AAOxB;;;cA+Da,qBAAA,SAA8B,KAAK;EAAL,WAAA;AAAA"}

package/esm/http/errors/errors.mjs

@@ -64,7 +64,26 @@ var NotAllowedError = class extends HttpError {
 		this.name = "NotAllowedError";
 	}
 };
+/**
+* Thrown by `Request.prototype.user` in development to catch a call site
+* still reading the removed `request.user` getter/setter after the 5.12.0
+* move: the authenticated user now lives at `request.locals.user`, written
+* by `@warlock.js/auth`'s middleware.
+*
+* Development-only diagnostic, not a runtime contract other code should
+* catch — the getter itself is typed `never`, so a caller that still
+* compiles against `request.user` only does so via `any`/an outdated type.
+* Kept in core (not auth) because `request.user` is a core `Request`
+* accessor and core cannot depend on `@warlock.js/auth` to react to it.
+* Slated for removal one release after 5.12.0 — see the CHANGELOG.
+*/
+var RequestUserMovedError = class extends Error {
+	constructor() {
+		super("request.user has been removed. The authenticated user now lives at request.locals.user, set by @warlock.js/auth's middleware.");
+		this.name = "RequestUserMovedError";
+	}
+};
 
 //#endregion
-export { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError };
+export { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, RequestUserMovedError, ResourceNotFoundError, ServerError, UnAuthorizedError };
 //# sourceMappingURL=errors.mjs.map

package/esm/http/errors/errors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../../../../../../../../core/src/http/errors/errors.ts"],"sourcesContent":["export class HttpError extends Error {\r\n  public constructor(\r\n    public status: number,\r\n    public message: string,\r\n    public payload?: any,\r\n  ) {\r\n    super(message);\r\n    this.name = \"HttpError\";\r\n  }\r\n}\r\n\r\nexport class ResourceNotFoundError extends HttpError {\r\n  public constructor(\r\n    message: string,\r\n    public payload?: any,\r\n  ) {\r\n    super(404, message, payload);\r\n    this.name = \"ResourceNotFoundError\";\r\n  }\r\n}\r\n\r\nexport class UnAuthorizedError extends HttpError {\r\n  public constructor(\r\n    message: string,\r\n    public payload?: any,\r\n  ) {\r\n    super(401, message, payload);\r\n    this.name = \"UnAuthorizedError\";\r\n  }\r\n}\r\n\r\nexport class ForbiddenError extends HttpError {\r\n  public constructor(\r\n    message: string,\r\n    public payload?: any,\r\n  ) {\r\n    super(403, message, payload);\r\n    this.name = \"ForbiddenError\";\r\n  }\r\n}\r\n\r\nexport class BadRequestError extends HttpError {\r\n  public constructor(\r\n    message: string,\r\n    public payload?: any,\r\n  ) {\r\n    super(400, message, payload);\r\n    this.name = \"BadRequestError\";\r\n  }\r\n}\r\n\r\nexport class ServerError extends HttpError {\r\n  public constructor(\r\n    message: string,\r\n    public payload?: any,\r\n  ) {\r\n    super(500, message, payload);\r\n    this.name = \"ServerError\";\r\n  }\r\n}\r\n\r\nexport class ConflictError extends HttpError {\r\n  public constructor(\r\n    message: string,\r\n    public payload?: any,\r\n  ) {\r\n    super(409, message, payload);\r\n    this.name = \"ConflictError\";\r\n  }\r\n}\r\n\r\nexport class NotAcceptableError extends HttpError {\r\n  public constructor(\r\n    message: string,\r\n    public payload?: any,\r\n  ) {\r\n    super(406, message, payload);\r\n    this.name = \"NotAcceptableError\";\r\n  }\r\n}\r\n\r\nexport class NotAllowedError extends HttpError {\r\n  public constructor(\r\n    message: string,\r\n    public payload?: any,\r\n  ) {\r\n    super(405, message, payload);\r\n    this.name = \"NotAllowedError\";\r\n  }\r\n}\r\n"],"mappings":";AAAA,IAAa,YAAb,cAA+B,MAAM;CACnC,AAAO,YACL,AAAO,QACP,AAAO,SACP,AAAO,SACP;EACA,MAAM,OAAO;EAJN;EACA;EACA;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,wBAAb,cAA2C,UAAU;CACnD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,UAAU;CAC5C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,cAAb,cAAiC,UAAU;CACzC,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,UAAU;CAC3C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../../../../../../core/src/http/errors/errors.ts"],"sourcesContent":["export class HttpError extends Error {\n  public constructor(\n    public status: number,\n    public message: string,\n    public payload?: any,\n  ) {\n    super(message);\n    this.name = \"HttpError\";\n  }\n}\n\nexport class ResourceNotFoundError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(404, message, payload);\n    this.name = \"ResourceNotFoundError\";\n  }\n}\n\nexport class UnAuthorizedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(401, message, payload);\n    this.name = \"UnAuthorizedError\";\n  }\n}\n\nexport class ForbiddenError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(403, message, payload);\n    this.name = \"ForbiddenError\";\n  }\n}\n\nexport class BadRequestError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(400, message, payload);\n    this.name = \"BadRequestError\";\n  }\n}\n\nexport class ServerError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(500, message, payload);\n    this.name = \"ServerError\";\n  }\n}\n\nexport class ConflictError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(409, message, payload);\n    this.name = \"ConflictError\";\n  }\n}\n\nexport class NotAcceptableError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(406, message, payload);\n    this.name = \"NotAcceptableError\";\n  }\n}\n\nexport class NotAllowedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(405, message, payload);\n    this.name = \"NotAllowedError\";\n  }\n}\n\n/**\n * Thrown by `Request.prototype.user` in development to catch a call site\n * still reading the removed `request.user` getter/setter after the 5.12.0\n * move: the authenticated user now lives at `request.locals.user`, written\n * by `@warlock.js/auth`'s middleware.\n *\n * Development-only diagnostic, not a runtime contract other code should\n * catch — the getter itself is typed `never`, so a caller that still\n * compiles against `request.user` only does so via `any`/an outdated type.\n * Kept in core (not auth) because `request.user` is a core `Request`\n * accessor and core cannot depend on `@warlock.js/auth` to react to it.\n * Slated for removal one release after 5.12.0 — see the CHANGELOG.\n */\nexport class RequestUserMovedError extends Error {\n  public constructor() {\n    super(\n      \"request.user has been removed. The authenticated user now lives at \" +\n        \"request.locals.user, set by @warlock.js/auth's middleware.\",\n    );\n    this.name = \"RequestUserMovedError\";\n  }\n}\n"],"mappings":";AAAA,IAAa,YAAb,cAA+B,MAAM;CACnC,AAAO,YACL,AAAO,QACP,AAAO,SACP,AAAO,SACP;EACA,MAAM,OAAO;EAJN;EACA;EACA;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,wBAAb,cAA2C,UAAU;CACnD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,UAAU;CAC5C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,cAAb,cAAiC,UAAU;CACzC,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,UAAU;CAC3C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;AAeA,IAAa,wBAAb,cAA2C,MAAM;CAC/C,AAAO,cAAc;EACnB,MACE,+HAEF;EACA,KAAK,OAAO;CACd;AACF"}

package/esm/http/index.d.mts

@@ -1,8 +1,11 @@
+import { PipeableReactStream, StreamReactResponseOptions, streamReactResponse } from "./stream-react-response.mjs";
+import { CookieOptions, Response, ResponseStatus, SendBufferOptions, SendFileOptions } from "./response.mjs";
 import { FileNamingStrategy, ImageTransformCallback, ImageTransformConfig, PrefixConfig, PrefixOptions, SaveAsOptions, SaveOptions, UploadedFileImageOptions, UploadsConfigurations } from "./uploads-types.mjs";
 import { FileValidationOptions, UploadedFile, UploadedFileJson } from "./uploaded-file.mjs";
 import { Request } from "./request.mjs";
-import { CookieOptions, Response, ResponseStatus, SendBufferOptions, SendFileOptions } from "./response.mjs";
-import { DecodedAccessToken, HttpConfigurations, PartialMiddleware, RequestEvent, RequestLocals, RequestUser, ResponseEvent, ResponseSSEController, ResponseStreamController, ReturnedResponse } from "./types.mjs";
+import { CspConfig, DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives } from "./csp.mjs";
+import { HttpTracingConfig, TracingContext, TracingHooks, TracingPhaseInfo, TracingRequestEndInfo } from "./tracing/tracing.type.mjs";
+import { DecodedAccessToken, HttpConfigurations, PartialMiddleware, RequestEvent, RequestLocals, ResponseEvent, ResponseSSEController, ResponseStreamController, ReturnedResponse } from "./types.mjs";
 import { defaultHttpConfigurations, httpConfig } from "./config.mjs";
 import { createHttpApplication, stopHttpApplication } from "./createHttpApplication.mjs";
 import { RequestLog } from "./database/RequestLog.mjs";
@@ -11,7 +14,7 @@ import { logResponse, wrapResponseInDataKey } from "./events.mjs";
 import { HealthCheck, HealthStatus, health } from "./health.mjs";
 import { RequestController } from "./request-controller.mjs";
 import { UPLOADS_DEFAULTS, uploadsConfig } from "./uploads-config.mjs";
-import { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./errors/errors.mjs";
+import { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, RequestUserMovedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./errors/errors.mjs";
 import { CacheMiddlewareOptions } from "./middleware/cache-response-middleware.mjs";
 import { ConcurrencyLimitOptions } from "./middleware/concurrency-limit.middleware.mjs";
 import { IdempotencyOptions } from "./middleware/idempotency.middleware.mjs";
@@ -28,5 +31,7 @@ import { registerHttpPlugins } from "./plugins.mjs";
 import { assertConfiguredHttpPortIsFree, preflightConfiguredHttpPort, remedyLines, shouldPreflightHttpPort } from "./boot-port-preflight.mjs";
 import { PortInUseError, assertPortIsAvailable, isPortAvailable } from "./port-preflight.mjs";
 import { HttpReadyReport, getHttpReadyReport, resetHttpReadyReport, setHttpReadyReport } from "./ready-report.mjs";
+import { deriveTraceId, parseTraceparentTraceId } from "./tracing/trace-id.mjs";
+import { TracingContextSource, buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled, resetTracingConfigForTests, resolveTracingConfig } from "./tracing/tracing-dispatcher.mjs";
 import { RequestContextStore, requestContext, useCurrentUser, useRequest, useRequestStore } from "./context/request-context.mjs";
 import { requestMemo } from "./context/request-memo.mjs";

package/esm/http/index.mjs

@@ -1,7 +1,12 @@
 import { requestContext, useCurrentUser, useRequest, useRequestStore } from "./context/request-context.mjs";
-import { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./errors/errors.mjs";
+import { DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives } from "./csp.mjs";
+import { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, RequestUserMovedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./errors/errors.mjs";
+import { deriveTraceId, parseTraceparentTraceId } from "./tracing/trace-id.mjs";
+import { buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled, resetTracingConfigForTests, resolveTracingConfig } from "./tracing/tracing-dispatcher.mjs";
+import "./tracing/index.mjs";
 import { createRequestStore, t } from "./middleware/inject-request-context.mjs";
 import { defaultHttpConfigurations, httpConfig } from "./config.mjs";
+import { streamReactResponse } from "./stream-react-response.mjs";
 import { Response, ResponseStatus } from "./response.mjs";
 import { UPLOADS_DEFAULTS, uploadsConfig } from "./uploads-config.mjs";
 import { UploadedFile } from "./uploaded-file.mjs";

package/esm/http/middleware/concurrency-limit.middleware.d.mts

@@ -11,7 +11,7 @@ type ConcurrencyLimitOptions = {
    * or per-tenant.
    *
    * @example
-   * keyGenerator: (request) => `${request.route.path}:${request.user?.id ?? request.ip}`,
+   * keyGenerator: (request) => `${request.route.path}:${request.locals.user?.id ?? request.ip}`,
    */
   keyGenerator?: (request: Request) => string;
   /**
@@ -42,7 +42,7 @@ type ConcurrencyLimitOptions = {
  * router.post("/ai/summarize", summarizeController, {
  *   middleware: [
  *     middleware.concurrencyLimit(10, {
- *       keyGenerator: (request) => `ai:${request.user?.id ?? request.ip}`,
+ *       keyGenerator: (request) => `ai:${request.locals.user?.id ?? request.ip}`,
  *     }),
  *   ],
  * });

package/esm/http/middleware/concurrency-limit.middleware.mjs

@@ -34,7 +34,7 @@ function release(key) {
 * router.post("/ai/summarize", summarizeController, {
 *   middleware: [
 *     middleware.concurrencyLimit(10, {
-*       keyGenerator: (request) => `ai:${request.user?.id ?? request.ip}`,
+*       keyGenerator: (request) => `ai:${request.locals.user?.id ?? request.ip}`,
 *     }),
 *   ],
 * });

package/esm/http/middleware/concurrency-limit.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"concurrency-limit.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/concurrency-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the concurrency limit middleware.\n */\nexport type ConcurrencyLimitOptions = {\n  /**\n   * Group key generator. Defaults to `request.route.path` — i.e. the cap\n   * applies across all callers of that route. Override to scope per-user\n   * or per-tenant.\n   *\n   * @example\n   * keyGenerator: (request) => `${request.route.path}:${request.user?.id ?? request.ip}`,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nconst counters = new Map<string, number>();\n\nfunction release(key: string) {\n  const after = (counters.get(key) || 1) - 1;\n\n  if (after <= 0) {\n    counters.delete(key);\n\n    return;\n  }\n\n  counters.set(key, after);\n}\n\n/**\n * Cap the number of in-flight requests against a route. Above the cap, new\n * requests get a fast 429 + `Retry-After: 1` — no queue, no timeout.\n *\n * Use for endpoints whose cost is unbounded per-request: report generation,\n * AI completions, image processing, expensive aggregations. Different from\n * `rateLimit()` — rate-limit caps requests-per-time, concurrency caps\n * in-flight requests at any instant.\n *\n * The counter is process-local. With `N` replicas the effective cap is\n * `N × max`. Document this in the route's behavior; if you need shared\n * concurrency across replicas, reach for a `@warlock.js/cache` lock instead.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/reports/generate\", reportController, {\n *   middleware: [middleware.concurrencyLimit(3)],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     middleware.concurrencyLimit(10, {\n *       keyGenerator: (request) => `ai:${request.user?.id ?? request.ip}`,\n *     }),\n *   ],\n * });\n */\nexport function concurrencyLimitMiddleware(\n  max: number,\n  options: ConcurrencyLimitOptions = {},\n): Middleware {\n  return ({ request, response }) => {\n    const key = options.keyGenerator?.(request) || request.route.path;\n    const current = counters.get(key) || 0;\n\n    if (current >= max) {\n      response.header(\"Retry-After\", 1);\n\n      return response.tooManyRequests({\n        error: options.errorMessage || t(\"http.concurrencyLimitReached\"),\n        errorCode: HttpErrorCodes.ConcurrencyLimitReached,\n        limit: max,\n      });\n    }\n\n    counters.set(key, current + 1);\n\n    let released = false;\n\n    const releaseOnce = () => {\n      if (released) {\n        return;\n      }\n\n      released = true;\n      release(key);\n    };\n\n    // `onSent` only fires from Response.send()/stream().end()/sse().end().\n    // Bare-reply paths (noContent, redirect, sendFile, download, sendBuffer,\n    // raw send) never trigger it, so the slot would leak and the route would\n    // permanently 429 after `max` such requests. Bind to the raw socket\n    // lifecycle as well so the slot frees regardless of response path —\n    // `releaseOnce` is idempotent, so double-firing is harmless.\n    response.onSent((_sentResponse: Response) => releaseOnce());\n    response.baseResponse.raw.once(\"finish\", releaseOnce);\n    response.baseResponse.raw.once(\"close\", releaseOnce);\n  };\n}\n"],"mappings":";;;;AAyBA,MAAM,2BAAW,IAAI,IAAoB;AAEzC,SAAS,QAAQ,KAAa;CAC5B,MAAM,SAAS,SAAS,IAAI,GAAG,KAAK,KAAK;CAEzC,IAAI,SAAS,GAAG;EACd,SAAS,OAAO,GAAG;EAEnB;CACF;CAEA,SAAS,IAAI,KAAK,KAAK;AACzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,2BACd,KACA,UAAmC,CAAC,GACxB;CACZ,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,QAAQ,eAAe,OAAO,KAAK,QAAQ,MAAM;EAC7D,MAAM,UAAU,SAAS,IAAI,GAAG,KAAK;EAErC,IAAI,WAAW,KAAK;GAClB,SAAS,OAAO,eAAe,CAAC;GAEhC,OAAO,SAAS,gBAAgB;IAC9B,OAAO,QAAQ,gBAAgB,EAAE,8BAA8B;IAC/D;IACA,OAAO;GACT,CAAC;EACH;EAEA,SAAS,IAAI,KAAK,UAAU,CAAC;EAE7B,IAAI,WAAW;EAEf,MAAM,oBAAoB;GACxB,IAAI,UACF;GAGF,WAAW;GACX,QAAQ,GAAG;EACb;EAQA,SAAS,QAAQ,kBAA4B,YAAY,CAAC;EAC1D,SAAS,aAAa,IAAI,KAAK,UAAU,WAAW;EACpD,SAAS,aAAa,IAAI,KAAK,SAAS,WAAW;CACrD;AACF"}
+{"version":3,"file":"concurrency-limit.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/concurrency-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the concurrency limit middleware.\n */\nexport type ConcurrencyLimitOptions = {\n  /**\n   * Group key generator. Defaults to `request.route.path` — i.e. the cap\n   * applies across all callers of that route. Override to scope per-user\n   * or per-tenant.\n   *\n   * @example\n   * keyGenerator: (request) => `${request.route.path}:${request.locals.user?.id ?? request.ip}`,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nconst counters = new Map<string, number>();\n\nfunction release(key: string) {\n  const after = (counters.get(key) || 1) - 1;\n\n  if (after <= 0) {\n    counters.delete(key);\n\n    return;\n  }\n\n  counters.set(key, after);\n}\n\n/**\n * Cap the number of in-flight requests against a route. Above the cap, new\n * requests get a fast 429 + `Retry-After: 1` — no queue, no timeout.\n *\n * Use for endpoints whose cost is unbounded per-request: report generation,\n * AI completions, image processing, expensive aggregations. Different from\n * `rateLimit()` — rate-limit caps requests-per-time, concurrency caps\n * in-flight requests at any instant.\n *\n * The counter is process-local. With `N` replicas the effective cap is\n * `N × max`. Document this in the route's behavior; if you need shared\n * concurrency across replicas, reach for a `@warlock.js/cache` lock instead.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/reports/generate\", reportController, {\n *   middleware: [middleware.concurrencyLimit(3)],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     middleware.concurrencyLimit(10, {\n *       keyGenerator: (request) => `ai:${request.locals.user?.id ?? request.ip}`,\n *     }),\n *   ],\n * });\n */\nexport function concurrencyLimitMiddleware(\n  max: number,\n  options: ConcurrencyLimitOptions = {},\n): Middleware {\n  return ({ request, response }) => {\n    const key = options.keyGenerator?.(request) || request.route.path;\n    const current = counters.get(key) || 0;\n\n    if (current >= max) {\n      response.header(\"Retry-After\", 1);\n\n      return response.tooManyRequests({\n        error: options.errorMessage || t(\"http.concurrencyLimitReached\"),\n        errorCode: HttpErrorCodes.ConcurrencyLimitReached,\n        limit: max,\n      });\n    }\n\n    counters.set(key, current + 1);\n\n    let released = false;\n\n    const releaseOnce = () => {\n      if (released) {\n        return;\n      }\n\n      released = true;\n      release(key);\n    };\n\n    // `onSent` only fires from Response.send()/stream().end()/sse().end().\n    // Bare-reply paths (noContent, redirect, sendFile, download, sendBuffer,\n    // raw send) never trigger it, so the slot would leak and the route would\n    // permanently 429 after `max` such requests. Bind to the raw socket\n    // lifecycle as well so the slot frees regardless of response path —\n    // `releaseOnce` is idempotent, so double-firing is harmless.\n    response.onSent((_sentResponse: Response) => releaseOnce());\n    response.baseResponse.raw.once(\"finish\", releaseOnce);\n    response.baseResponse.raw.once(\"close\", releaseOnce);\n  };\n}\n"],"mappings":";;;;AAyBA,MAAM,2BAAW,IAAI,IAAoB;AAEzC,SAAS,QAAQ,KAAa;CAC5B,MAAM,SAAS,SAAS,IAAI,GAAG,KAAK,KAAK;CAEzC,IAAI,SAAS,GAAG;EACd,SAAS,OAAO,GAAG;EAEnB;CACF;CAEA,SAAS,IAAI,KAAK,KAAK;AACzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,2BACd,KACA,UAAmC,CAAC,GACxB;CACZ,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,QAAQ,eAAe,OAAO,KAAK,QAAQ,MAAM;EAC7D,MAAM,UAAU,SAAS,IAAI,GAAG,KAAK;EAErC,IAAI,WAAW,KAAK;GAClB,SAAS,OAAO,eAAe,CAAC;GAEhC,OAAO,SAAS,gBAAgB;IAC9B,OAAO,QAAQ,gBAAgB,EAAE,8BAA8B;IAC/D;IACA,OAAO;GACT,CAAC;EACH;EAEA,SAAS,IAAI,KAAK,UAAU,CAAC;EAE7B,IAAI,WAAW;EAEf,MAAM,oBAAoB;GACxB,IAAI,UACF;GAGF,WAAW;GACX,QAAQ,GAAG;EACb;EAQA,SAAS,QAAQ,kBAA4B,YAAY,CAAC;EAC1D,SAAS,aAAa,IAAI,KAAK,UAAU,WAAW;EACpD,SAAS,aAAa,IAAI,KAAK,SAAS,WAAW;CACrD;AACF"}

package/esm/http/middleware/inject-request-context.d.mts

@@ -1,5 +1,5 @@
-import { Request } from "../request.mjs";
 import { Response } from "../response.mjs";
+import { Request } from "../request.mjs";
 import { ReturnedResponse } from "../types.mjs";
 
 //#region ../core/src/http/middleware/inject-request-context.d.ts

package/esm/http/middleware/inject-request-context.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;AA0CA;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;iBAiGK,CAAA,CAAE,OAAA,UAAiB,YAAkB"}
+{"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;AA4CA;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;iBAkHK,CAAA,CAAE,OAAA,UAAiB,YAAkB"}

package/esm/http/middleware/inject-request-context.mjs

@@ -1,7 +1,10 @@
 import { environment } from "../../utils/environment.mjs";
 import { requestContext } from "../context/request-context.mjs";
 import "../../utils/index.mjs";
+import { applyCspHeader } from "../csp.mjs";
 import { HttpError } from "../errors/errors.mjs";
+import { buildTracingContext, dispatchPhase, isTracingEnabled } from "../tracing/tracing-dispatcher.mjs";
+import "../tracing/index.mjs";
 import config from "@mongez/config";
 import { trans } from "@mongez/localization";
 import { DatabaseWriterValidationError } from "@warlock.js/cascade";
@@ -34,6 +37,7 @@ function stampRequestIdHeader(request, response) {
 */
 function createRequestStore(request, response) {
 	stampRequestIdHeader(request, response);
+	applyCspHeader(request, response);
 	const httpContextStore = contextManager.buildStores({
 		request,
 		response
@@ -45,10 +49,16 @@ function createRequestStore(request, response) {
 			request.trigger("executingAction", request.route);
 			const handler = request.getHandler();
 			request.log("Executing Handler", "info");
+			const tracingEnabled = isTracingEnabled();
+			const handlerStartedAt = tracingEnabled ? performance.now() : 0;
 			const output = await handler({
 				request,
 				response
 			});
+			if (tracingEnabled) dispatchPhase(buildTracingContext(request), {
+				name: "handler",
+				durationMs: performance.now() - handlerStartedAt
+			});
 			request.log("Handler Executed Successfully", "success");
 			request.trigger("executedAction", request.route);
 			return output;

package/esm/http/middleware/inject-request-context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\n * Request Context Middleware\n *\n * Creates a unified context for each request using the ContextManager.\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\n */\nimport { trans } from \"@mongez/localization\";\nimport { type GenericObject } from \"@mongez/reinforcements\";\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\nimport { contextManager } from \"@warlock.js/context\";\nimport config from \"@mongez/config\";\nimport { environment } from \"../../utils\";\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\nimport { HttpError } from \"../errors\";\nimport { type Request } from \"../request\";\nimport { type Response } from \"../response\";\nimport { type ReturnedResponse } from \"./../types\";\n\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\n\n/**\n * Echo `request.id` back as a response header so the FE / proxies / log\n * aggregators can correlate by the same value the server logs against.\n *\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\n * Skip when `http.requestId.enabled` is explicitly false.\n */\nfunction stampRequestIdHeader(request: Request, response: Response) {\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\n\n  if (requestIdConfig.enabled === false) return;\n\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\n\n  response.header(headerName, request.id);\n}\n\n/**\n * Create request store and execute middleware + handler\n *\n * Runs all registered contexts together using ContextManager.\n */\nexport function createRequestStore(\n  request: Request<any>,\n  response: Response,\n): Promise<ReturnedResponse> {\n  stampRequestIdHeader(request, response);\n\n  // Build all context stores using the immutable API\n  // Each context defines its own store initialization via buildStore()\n  const httpContextStore = contextManager.buildStores({ request, response });\n\n  // Run all contexts together!\n  return contextManager.runAll(httpContextStore, async () => {\n    try {\n      // Run middleware chain\n      const result = await request.runMiddleware();\n\n      if (result) {\n        return result as ReturnedResponse;\n      }\n\n      // Execute route handler\n      request.trigger(\"executingAction\", request.route);\n\n      const handler = request.getHandler();\n\n      request.log(\"Executing Handler\", \"info\");\n\n      const output = await handler({ request, response });\n\n      request.log(\"Handler Executed Successfully\", \"success\");\n\n      request.trigger(\"executedAction\", request.route);\n\n      return output as ReturnedResponse;\n    } catch (error) {\n      request.log(error, \"error\");\n      return handleRequestError(error, response);\n    }\n  });\n}\n\n/**\n * Handle request errors\n * @internal\n */\nfunction handleRequestError(error: unknown, response: Response): ReturnedResponse {\n  // Availability floor, not a cache-policy nit: `handleRequestError` is the\n  // single funnel every unhandled error in every Warlock app passes through\n  // (`createRequestStore`'s catch above), and none of the branches below set\n  // a `Cache-Control` header. Without this, an error response — a 500 as\n  // much as a 401/403/404 carrying per-request/-user state — can be stored\n  // by a shared cache or CDN and replayed to other requests/users long after\n  // the condition that caused it is gone: a cached 500 becomes an outage\n  // that outlives its cause; a cached 401/403 becomes a leak across users.\n  // Set once, here, before any branch runs — not per branch — because the\n  // branches below do not partition by status. `ResourceNotFoundError`,\n  // `UnAuthorizedError`, `ForbiddenError`, `BadRequestError` and `ServerError`\n  // all extend `HttpError`, so the `HttpError` branch answers for every one of\n  // them, and a raw `HttpError` can carry any caller-chosen status, 4xx or 5xx.\n  // Gating the floor on the eventual status would mean re-deriving that status\n  // per branch — one rule meeting one form while others reach the same output.\n  // Applying it once, unconditionally, is both simpler and safer.\n  response.header(\"Cache-Control\", \"private, no-store\");\n\n  if (error instanceof HttpError) {\n    const payload: GenericObject = {\n      error: error.message,\n    };\n    if (error.payload) {\n      payload.payload = error.payload;\n    }\n\n    if (environment() === \"development\") {\n      payload.stack = error.stack;\n    }\n\n    return response.setStatusCode(error.status).send(payload);\n  }\n\n  if (error instanceof DatabaseWriterValidationError) {\n    return response.badRequest({\n      errors: error.errors,\n    });\n  }\n\n  // Last resort: the error matched none of the known shapes above, so the\n  // client gets a deliberately opaque message. Without this line the error\n  // itself is discarded here — no stack, no message, nothing in any log — and\n  // an unrecognised failure becomes indistinguishable from a working server\n  // returning 500. Never swallow the only copy of an error (`65e476ee`).\n  console.error(\"[warlock] unhandled request error:\", error);\n\n  return response.serverError({\n    error: \"Internal server error.\",\n  });\n}\n\n/**\n * Translate a keyword (uses request context for locale)\n */\nexport function t(keyword: string, placeholders?: any) {\n  return (\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\n    trans(keyword, placeholders)\n  );\n}\n\n// `fromRequest` was removed in v5. It cached computed values as dynamic\n// properties on the Request instance, which only compiled because of the\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\n// per-request lifetime, single-flight, and it never touches the Request object.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAItC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAEF,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,OAAO,OAAO;GAC1B,OAAO,mBAAmB,OAAO,QAAQ;EAC3C;CACF,CAAC;AACH;;;;;AAMA,SAAS,mBAAmB,OAAgB,UAAsC;CAiBhF,SAAS,OAAO,iBAAiB,mBAAmB;CAEpD,IAAI,iBAAiB,WAAW;EAC9B,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,+BACnB,OAAO,SAAS,WAAW,EACzB,QAAQ,MAAM,OAChB,CAAC;CAQH,QAAQ,MAAM,sCAAsC,KAAK;CAEzD,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAoB;CACrD,OACEA,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}
+{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\n * Request Context Middleware\n *\n * Creates a unified context for each request using the ContextManager.\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\n */\nimport { trans } from \"@mongez/localization\";\nimport { type GenericObject } from \"@mongez/reinforcements\";\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\nimport { contextManager } from \"@warlock.js/context\";\nimport config from \"@mongez/config\";\nimport { environment } from \"../../utils\";\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\nimport { applyCspHeader } from \"../csp\";\nimport { HttpError } from \"../errors\";\nimport { type Request } from \"../request\";\nimport { type Response } from \"../response\";\nimport { buildTracingContext, dispatchPhase, isTracingEnabled } from \"../tracing\";\nimport { type ReturnedResponse } from \"./../types\";\n\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\n\n/**\n * Echo `request.id` back as a response header so the FE / proxies / log\n * aggregators can correlate by the same value the server logs against.\n *\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\n * Skip when `http.requestId.enabled` is explicitly false.\n */\nfunction stampRequestIdHeader(request: Request, response: Response) {\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\n\n  if (requestIdConfig.enabled === false) return;\n\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\n\n  response.header(headerName, request.id);\n}\n\n/**\n * Create request store and execute middleware + handler\n *\n * Runs all registered contexts together using ContextManager.\n */\nexport function createRequestStore(\n  request: Request<any>,\n  response: Response,\n): Promise<ReturnedResponse> {\n  stampRequestIdHeader(request, response);\n\n  // Stamped this early — before any middleware or handler runs — so the\n  // header carries the SAME nonce the web layer later reads off\n  // `request.nonce` for its `<script>` tags: `request.nonce` caches on first\n  // read, and this is deliberately the first read. A no-op when the app\n  // hasn't opted into `http.csp` (see `csp.ts`).\n  applyCspHeader(request, response);\n\n  // Build all context stores using the immutable API\n  // Each context defines its own store initialization via buildStore()\n  const httpContextStore = contextManager.buildStores({ request, response });\n\n  // Run all contexts together!\n  return contextManager.runAll(httpContextStore, async () => {\n    try {\n      // Run middleware chain\n      const result = await request.runMiddleware();\n\n      if (result) {\n        return result as ReturnedResponse;\n      }\n\n      // Execute route handler\n      request.trigger(\"executingAction\", request.route);\n\n      const handler = request.getHandler();\n\n      request.log(\"Executing Handler\", \"info\");\n\n      const tracingEnabled = isTracingEnabled();\n      const handlerStartedAt = tracingEnabled ? performance.now() : 0;\n\n      const output = await handler({ request, response });\n\n      if (tracingEnabled) {\n        dispatchPhase(buildTracingContext(request), {\n          name: \"handler\",\n          durationMs: performance.now() - handlerStartedAt,\n        });\n      }\n\n      request.log(\"Handler Executed Successfully\", \"success\");\n\n      request.trigger(\"executedAction\", request.route);\n\n      return output as ReturnedResponse;\n    } catch (error) {\n      request.log(error, \"error\");\n      return handleRequestError(error, response);\n    }\n  });\n}\n\n/**\n * Handle request errors\n * @internal\n */\nfunction handleRequestError(error: unknown, response: Response): ReturnedResponse {\n  // Availability floor, not a cache-policy nit: `handleRequestError` is the\n  // single funnel every unhandled error in every Warlock app passes through\n  // (`createRequestStore`'s catch above), and none of the branches below set\n  // a `Cache-Control` header. Without this, an error response — a 500 as\n  // much as a 401/403/404 carrying per-request/-user state — can be stored\n  // by a shared cache or CDN and replayed to other requests/users long after\n  // the condition that caused it is gone: a cached 500 becomes an outage\n  // that outlives its cause; a cached 401/403 becomes a leak across users.\n  // Set once, here, before any branch runs — not per branch — because the\n  // branches below do not partition by status. `ResourceNotFoundError`,\n  // `UnAuthorizedError`, `ForbiddenError`, `BadRequestError` and `ServerError`\n  // all extend `HttpError`, so the `HttpError` branch answers for every one of\n  // them, and a raw `HttpError` can carry any caller-chosen status, 4xx or 5xx.\n  // Gating the floor on the eventual status would mean re-deriving that status\n  // per branch — one rule meeting one form while others reach the same output.\n  // Applying it once, unconditionally, is both simpler and safer.\n  response.header(\"Cache-Control\", \"private, no-store\");\n\n  if (error instanceof HttpError) {\n    const payload: GenericObject = {\n      error: error.message,\n    };\n    if (error.payload) {\n      payload.payload = error.payload;\n    }\n\n    if (environment() === \"development\") {\n      payload.stack = error.stack;\n    }\n\n    return response.setStatusCode(error.status).send(payload);\n  }\n\n  if (error instanceof DatabaseWriterValidationError) {\n    return response.badRequest({\n      errors: error.errors,\n    });\n  }\n\n  // Last resort: the error matched none of the known shapes above, so the\n  // client gets a deliberately opaque message. Without this line the error\n  // itself is discarded here — no stack, no message, nothing in any log — and\n  // an unrecognised failure becomes indistinguishable from a working server\n  // returning 500. Never swallow the only copy of an error (`65e476ee`).\n  console.error(\"[warlock] unhandled request error:\", error);\n\n  return response.serverError({\n    error: \"Internal server error.\",\n  });\n}\n\n/**\n * Translate a keyword (uses request context for locale)\n */\nexport function t(keyword: string, placeholders?: any) {\n  return (\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\n    trans(keyword, placeholders)\n  );\n}\n\n// `fromRequest` was removed in v5. It cached computed values as dynamic\n// properties on the Request instance, which only compiled because of the\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\n// per-request lifetime, single-flight, and it never touches the Request object.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAOtC,eAAe,SAAS,QAAQ;CAIhC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAEF,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,iBAAiB,iBAAiB;GACxC,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,IAAI;GAE9D,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,IAAI,gBACF,cAAc,oBAAoB,OAAO,GAAG;IAC1C,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;GAClC,CAAC;GAGH,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,OAAO,OAAO;GAC1B,OAAO,mBAAmB,OAAO,QAAQ;EAC3C;CACF,CAAC;AACH;;;;;AAMA,SAAS,mBAAmB,OAAgB,UAAsC;CAiBhF,SAAS,OAAO,iBAAiB,mBAAmB;CAEpD,IAAI,iBAAiB,WAAW;EAC9B,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,+BACnB,OAAO,SAAS,WAAW,EACzB,QAAQ,MAAM,OAChB,CAAC;CAQH,QAAQ,MAAM,sCAAsC,KAAK;CAEzD,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAoB;CACrD,OACEA,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}

package/esm/http/middleware/rate-limit.middleware.d.mts

@@ -18,7 +18,7 @@ type RateLimitOptions = {
    * per-organization, per-tenant, etc.
    *
    * @example
-   * keyGenerator: (request) => request.user?.id ?? request.ip,
+   * keyGenerator: (request) => request.locals.user?.id ?? request.ip,
    */
   keyGenerator?: (request: Request) => string;
   /**