@warlock.js/core 5.10.0 → 5.12.0

package/esm/http/middleware/rate-limit.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/rate-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the per-route rate limit middleware.\n */\nexport type RateLimitOptions = {\n  /**\n   * Max requests allowed within the time window.\n   */\n  max: number;\n  /**\n   * Time window in milliseconds.\n   */\n  duration: number;\n  /**\n   * Group key generator. Defaults to the client IP. Override to scope per-user,\n   * per-organization, per-tenant, etc.\n   *\n   * @example\n   * keyGenerator: (request) => request.user?.id ?? request.ip,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\ntype Bucket = {\n  count: number;\n  resetAt: number;\n};\n\nconst buckets = new Map<string, Bucket>();\n\n/**\n * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys\n * (rare per-user keys, dynamic path parameters in `keyGenerator`, etc.).\n * Called opportunistically, at most once per minute, not on a timer — keeps\n * the module side-effect-free for testing.\n */\nlet lastPruneAt = 0;\n\nfunction pruneExpired(now: number) {\n  for (const [key, bucket] of buckets) {\n    if (bucket.resetAt <= now) {\n      buckets.delete(key);\n    }\n  }\n}\n\n/**\n * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s\n * global cap (configured via `http.rateLimit`) — both run, and either can\n * 429. Use this for endpoints that need a tighter cap than the global default:\n * login, OTP request, password reset, expensive search, AI completions.\n *\n * The counter lives in-process. With `N` replicas the effective cap is\n * `N × max`. For genuinely shared limits, configure `@fastify/rate-limit`'s\n * Redis store via `http.rateLimit` instead.\n *\n * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on\n * every response; adds `Retry-After` (seconds) on a 429.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],\n * });\n */\nexport function rateLimitMiddleware(options: RateLimitOptions): Middleware {\n  return ({ request, response }) => {\n    const now = Date.now();\n\n    if (now - lastPruneAt > 60_000) {\n      pruneExpired(now);\n      lastPruneAt = now;\n    }\n\n    const groupKey = options.keyGenerator?.(request) || request.detectIp() || \"unknown\";\n    const cacheKey = `${request.route.path}:${groupKey}`;\n\n    let bucket = buckets.get(cacheKey);\n\n    if (!bucket || bucket.resetAt <= now) {\n      bucket = { count: 0, resetAt: now + options.duration };\n      buckets.set(cacheKey, bucket);\n    }\n\n    bucket.count++;\n\n    const remaining = Math.max(0, options.max - bucket.count);\n    const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));\n\n    response.header(\"X-RateLimit-Limit\", options.max);\n    response.header(\"X-RateLimit-Remaining\", remaining);\n    response.header(\"X-RateLimit-Reset\", Math.ceil(bucket.resetAt / 1000));\n\n    if (bucket.count > options.max) {\n      response.header(\"Retry-After\", retryAfter);\n\n      return response.tooManyRequests({\n        error: options.errorMessage || t(\"http.rateLimitExceeded\"),\n        errorCode: HttpErrorCodes.RateLimitExceeded,\n      });\n    }\n  };\n}\n"],"mappings":";;;;AAoCA,MAAM,0BAAU,IAAI,IAAoB;;;;;;;AAQxC,IAAI,cAAc;AAElB,SAAS,aAAa,KAAa;CACjC,KAAK,MAAM,CAAC,KAAK,WAAW,SAC1B,IAAI,OAAO,WAAW,KACpB,QAAQ,OAAO,GAAG;AAGxB;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,oBAAoB,SAAuC;CACzE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI,MAAM,cAAc,KAAQ;GAC9B,aAAa,GAAG;GAChB,cAAc;EAChB;EAEA,MAAM,WAAW,QAAQ,eAAe,OAAO,KAAK,QAAQ,SAAS,KAAK;EAC1E,MAAM,WAAW,GAAG,QAAQ,MAAM,KAAK,GAAG;EAE1C,IAAI,SAAS,QAAQ,IAAI,QAAQ;EAEjC,IAAI,CAAC,UAAU,OAAO,WAAW,KAAK;GACpC,SAAS;IAAE,OAAO;IAAG,SAAS,MAAM,QAAQ;GAAS;GACrD,QAAQ,IAAI,UAAU,MAAM;EAC9B;EAEA,OAAO;EAEP,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,MAAM,OAAO,KAAK;EACxD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,OAAO,GAAI,CAAC;EAEvE,SAAS,OAAO,qBAAqB,QAAQ,GAAG;EAChD,SAAS,OAAO,yBAAyB,SAAS;EAClD,SAAS,OAAO,qBAAqB,KAAK,KAAK,OAAO,UAAU,GAAI,CAAC;EAErE,IAAI,OAAO,QAAQ,QAAQ,KAAK;GAC9B,SAAS,OAAO,eAAe,UAAU;GAEzC,OAAO,SAAS,gBAAgB;IAC9B,OAAO,QAAQ,gBAAgB,EAAE,wBAAwB;IACzD;GACF,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"rate-limit.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/rate-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the per-route rate limit middleware.\n */\nexport type RateLimitOptions = {\n  /**\n   * Max requests allowed within the time window.\n   */\n  max: number;\n  /**\n   * Time window in milliseconds.\n   */\n  duration: number;\n  /**\n   * Group key generator. Defaults to the client IP. Override to scope per-user,\n   * per-organization, per-tenant, etc.\n   *\n   * @example\n   * keyGenerator: (request) => request.locals.user?.id ?? request.ip,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\ntype Bucket = {\n  count: number;\n  resetAt: number;\n};\n\nconst buckets = new Map<string, Bucket>();\n\n/**\n * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys\n * (rare per-user keys, dynamic path parameters in `keyGenerator`, etc.).\n * Called opportunistically, at most once per minute, not on a timer — keeps\n * the module side-effect-free for testing.\n */\nlet lastPruneAt = 0;\n\nfunction pruneExpired(now: number) {\n  for (const [key, bucket] of buckets) {\n    if (bucket.resetAt <= now) {\n      buckets.delete(key);\n    }\n  }\n}\n\n/**\n * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s\n * global cap (configured via `http.rateLimit`) — both run, and either can\n * 429. Use this for endpoints that need a tighter cap than the global default:\n * login, OTP request, password reset, expensive search, AI completions.\n *\n * The counter lives in-process. With `N` replicas the effective cap is\n * `N × max`. For genuinely shared limits, configure `@fastify/rate-limit`'s\n * Redis store via `http.rateLimit` instead.\n *\n * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on\n * every response; adds `Retry-After` (seconds) on a 429.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],\n * });\n */\nexport function rateLimitMiddleware(options: RateLimitOptions): Middleware {\n  return ({ request, response }) => {\n    const now = Date.now();\n\n    if (now - lastPruneAt > 60_000) {\n      pruneExpired(now);\n      lastPruneAt = now;\n    }\n\n    const groupKey = options.keyGenerator?.(request) || request.detectIp() || \"unknown\";\n    const cacheKey = `${request.route.path}:${groupKey}`;\n\n    let bucket = buckets.get(cacheKey);\n\n    if (!bucket || bucket.resetAt <= now) {\n      bucket = { count: 0, resetAt: now + options.duration };\n      buckets.set(cacheKey, bucket);\n    }\n\n    bucket.count++;\n\n    const remaining = Math.max(0, options.max - bucket.count);\n    const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));\n\n    response.header(\"X-RateLimit-Limit\", options.max);\n    response.header(\"X-RateLimit-Remaining\", remaining);\n    response.header(\"X-RateLimit-Reset\", Math.ceil(bucket.resetAt / 1000));\n\n    if (bucket.count > options.max) {\n      response.header(\"Retry-After\", retryAfter);\n\n      return response.tooManyRequests({\n        error: options.errorMessage || t(\"http.rateLimitExceeded\"),\n        errorCode: HttpErrorCodes.RateLimitExceeded,\n      });\n    }\n  };\n}\n"],"mappings":";;;;AAoCA,MAAM,0BAAU,IAAI,IAAoB;;;;;;;AAQxC,IAAI,cAAc;AAElB,SAAS,aAAa,KAAa;CACjC,KAAK,MAAM,CAAC,KAAK,WAAW,SAC1B,IAAI,OAAO,WAAW,KACpB,QAAQ,OAAO,GAAG;AAGxB;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,oBAAoB,SAAuC;CACzE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI,MAAM,cAAc,KAAQ;GAC9B,aAAa,GAAG;GAChB,cAAc;EAChB;EAEA,MAAM,WAAW,QAAQ,eAAe,OAAO,KAAK,QAAQ,SAAS,KAAK;EAC1E,MAAM,WAAW,GAAG,QAAQ,MAAM,KAAK,GAAG;EAE1C,IAAI,SAAS,QAAQ,IAAI,QAAQ;EAEjC,IAAI,CAAC,UAAU,OAAO,WAAW,KAAK;GACpC,SAAS;IAAE,OAAO;IAAG,SAAS,MAAM,QAAQ;GAAS;GACrD,QAAQ,IAAI,UAAU,MAAM;EAC9B;EAEA,OAAO;EAEP,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,MAAM,OAAO,KAAK;EACxD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,OAAO,GAAI,CAAC;EAEvE,SAAS,OAAO,qBAAqB,QAAQ,GAAG;EAChD,SAAS,OAAO,yBAAyB,SAAS;EAClD,SAAS,OAAO,qBAAqB,KAAK,KAAK,OAAO,UAAU,GAAI,CAAC;EAErE,IAAI,OAAO,QAAQ,QAAQ,KAAK;GAC9B,SAAS,OAAO,eAAe,UAAU;GAEzC,OAAO,SAAS,gBAAgB;IAC9B,OAAO,QAAQ,gBAAgB,EAAE,wBAAwB;IACzD;GACF,CAAC;EACH;CACF;AACF"}

package/esm/http/middleware/utils/idempotency-key.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency-key.d.mts","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/idempotency-key.ts"],"mappings":";;;iBAegB,qBAAA,CAAsB,KAAA,YAAiB,KAAK;;AAA5D;;;;AAA4D;AAmB5D;;;;iBAAgB,QAAA,CAAS,IAAa;AAAA,iBAyCtB,wBAAA,CAAyB,OAAA,EAAS,OAAO,EAAE,cAAA"}
+{"version":3,"file":"idempotency-key.d.mts","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/idempotency-key.ts"],"mappings":";;;iBAcgB,qBAAA,CAAsB,KAAA,YAAiB,KAAK;;AAA5D;;;;AAA4D;AAmB5D;;;;iBAAgB,QAAA,CAAS,IAAa;AAAA,iBAuCtB,wBAAA,CAAyB,OAAA,EAAS,OAAO,EAAE,cAAA"}

package/esm/http/middleware/utils/idempotency-key.mjs

@@ -36,24 +36,22 @@ function hashBody(body) {
 * user B used a guessable value — while still letting the primitive work on
 * public endpoints.
 *
-* Idempotency middleware must run **after** `authMiddleware` so `request.user`
-* and `request.decodedAccessToken` are populated.
+* Idempotency middleware must run **after** `authMiddleware` so
+* `request.locals.user` (written by `@warlock.js/auth`) and
+* `request.decodedAccessToken` are populated.
 *
 * @example
 * buildIdempotencyCacheKey(request, "01J9XZQ-ABC"); // "idem:client:user_123:01J9XZQ-ABC"
 */
 /**
-* Read `id` off `request.user` without assuming every app's `RequestUser`
-* augmentation declares it.
+* Read `id` off `request.locals.user` without assuming any app's
+* `RequestUser` augmentation (declared by `@warlock.js/auth`, which core
+* cannot import) declares it, and without assuming `@warlock.js/auth` is
+* even installed — hence the untyped `unknown` read here rather than a
+* typed `RequestLocals["user"]` access.
 *
-* `RequestUser` (`core/src/http/types.ts`) is empty by default — apps narrow
-* it to their own model shape. Adding `id` directly to `RequestUser` here
-* would force that exact field (and type) onto every app: TypeScript
-* interface merging requires all declarations of a shared member to have an
-* identical type, so an app augmenting `RequestUser` with, say, `id: string`
-* only would conflict with a core-declared `id?: string | number`. A local,
-* narrow read survives any augmentation shape (eed20184 step (b) —
-* `implementation/2026-08-20-A2-request-locals.md` §6.2) — no `as any`.
+* A local, narrow runtime read survives any augmentation shape — no
+* `as any`.
 */
 function readUserId(user) {
 	if (!user || typeof user !== "object" || !("id" in user)) return void 0;
@@ -61,7 +59,9 @@ function readUserId(user) {
 	return typeof id === "string" || typeof id === "number" ? id : void 0;
 }
 function buildIdempotencyCacheKey(request, idempotencyKey) {
-	return `idem:${request.decodedAccessToken?.userType || "anonymous"}:${readUserId(request.user) || request.detectIp() || "unknown"}:${idempotencyKey}`;
+	const userType = request.decodedAccessToken?.userType || "anonymous";
+	const locals = request.locals;
+	return `idem:${userType}:${readUserId(locals.user) || request.detectIp() || "unknown"}:${idempotencyKey}`;
 }
 
 //#endregion

package/esm/http/middleware/utils/idempotency-key.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency-key.mjs","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/idempotency-key.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { Request } from \"../../request\";\nimport type { RequestUser } from \"../../types\";\n\n/**\n * Idempotency-key validation rules.\n *\n * RFC draft-ietf-httpapi-idempotency-key suggests UUIDs or ULIDs but doesn't\n * mandate a format. We accept any printable ASCII string up to 255 chars —\n * tight enough to reject log-injection (no control characters / newlines),\n * loose enough to accept whatever ID scheme the client picks.\n */\nconst MAX_KEY_LENGTH = 255;\nconst PRINTABLE_ASCII = /^[\\x21-\\x7e]+$/;\n\nexport function isValidIdempotencyKey(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    value.length <= MAX_KEY_LENGTH &&\n    PRINTABLE_ASCII.test(value)\n  );\n}\n\n/**\n * Hash a request body to a stable hex digest.\n *\n * Used to detect \"same key, different body\" — that's a client bug, not a retry.\n * sha256 is overkill for collision resistance here, but it's the dependency-free\n * choice and avoids importing a faster hasher.\n *\n * @example\n * hashBody({ amount: 100, currency: \"USD\" }); // \"a1b2c3...\"\n */\nexport function hashBody(body: unknown): string {\n  const serialized = typeof body === \"string\" ? body : JSON.stringify(body ?? {});\n\n  return createHash(\"sha256\").update(serialized).digest(\"hex\");\n}\n\n/**\n * Build the cache key for an idempotency record.\n *\n * Scope is `userType:userId` when authenticated, falling back to the client IP\n * when anonymous. This prevents user A from replaying user B's key — even if\n * user B used a guessable value — while still letting the primitive work on\n * public endpoints.\n *\n * Idempotency middleware must run **after** `authMiddleware` so `request.user`\n * and `request.decodedAccessToken` are populated.\n *\n * @example\n * buildIdempotencyCacheKey(request, \"01J9XZQ-ABC\"); // \"idem:client:user_123:01J9XZQ-ABC\"\n */\n/**\n * Read `id` off `request.user` without assuming every app's `RequestUser`\n * augmentation declares it.\n *\n * `RequestUser` (`core/src/http/types.ts`) is empty by default — apps narrow\n * it to their own model shape. Adding `id` directly to `RequestUser` here\n * would force that exact field (and type) onto every app: TypeScript\n * interface merging requires all declarations of a shared member to have an\n * identical type, so an app augmenting `RequestUser` with, say, `id: string`\n * only would conflict with a core-declared `id?: string | number`. A local,\n * narrow read survives any augmentation shape (eed20184 step (b) —\n * `implementation/2026-08-20-A2-request-locals.md` §6.2) — no `as any`.\n */\nfunction readUserId(user: RequestUser | undefined): string | number | undefined {\n  if (!user || typeof user !== \"object\" || !(\"id\" in user)) return undefined;\n\n  const id = (user as { id?: unknown }).id;\n\n  return typeof id === \"string\" || typeof id === \"number\" ? id : undefined;\n}\n\nexport function buildIdempotencyCacheKey(request: Request, idempotencyKey: string): string {\n  const userType = request.decodedAccessToken?.userType || \"anonymous\";\n  const userId = readUserId(request.user) || request.detectIp() || \"unknown\";\n\n  return `idem:${userType}:${userId}:${idempotencyKey}`;\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,SAAgB,sBAAsB,OAAiC;CACrE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,kBAChB,gBAAgB,KAAK,KAAK;AAE9B;;;;;;;;;;;AAYA,SAAgB,SAAS,MAAuB;CAC9C,MAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC;CAE9E,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,WAAW,MAA4D;CAC9E,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OAAO,OAAO;CAEjE,MAAM,KAAM,KAA0B;CAEtC,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,WAAW,KAAK;AACjE;AAEA,SAAgB,yBAAyB,SAAkB,gBAAgC;CAIzF,OAAO,QAHU,QAAQ,oBAAoB,YAAY,YAGjC,GAFT,WAAW,QAAQ,IAAI,KAAK,QAAQ,SAAS,KAAK,UAE/B,GAAG;AACvC"}
+{"version":3,"file":"idempotency-key.mjs","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/idempotency-key.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { Request } from \"../../request\";\n\n/**\n * Idempotency-key validation rules.\n *\n * RFC draft-ietf-httpapi-idempotency-key suggests UUIDs or ULIDs but doesn't\n * mandate a format. We accept any printable ASCII string up to 255 chars —\n * tight enough to reject log-injection (no control characters / newlines),\n * loose enough to accept whatever ID scheme the client picks.\n */\nconst MAX_KEY_LENGTH = 255;\nconst PRINTABLE_ASCII = /^[\\x21-\\x7e]+$/;\n\nexport function isValidIdempotencyKey(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    value.length <= MAX_KEY_LENGTH &&\n    PRINTABLE_ASCII.test(value)\n  );\n}\n\n/**\n * Hash a request body to a stable hex digest.\n *\n * Used to detect \"same key, different body\" — that's a client bug, not a retry.\n * sha256 is overkill for collision resistance here, but it's the dependency-free\n * choice and avoids importing a faster hasher.\n *\n * @example\n * hashBody({ amount: 100, currency: \"USD\" }); // \"a1b2c3...\"\n */\nexport function hashBody(body: unknown): string {\n  const serialized = typeof body === \"string\" ? body : JSON.stringify(body ?? {});\n\n  return createHash(\"sha256\").update(serialized).digest(\"hex\");\n}\n\n/**\n * Build the cache key for an idempotency record.\n *\n * Scope is `userType:userId` when authenticated, falling back to the client IP\n * when anonymous. This prevents user A from replaying user B's key — even if\n * user B used a guessable value — while still letting the primitive work on\n * public endpoints.\n *\n * Idempotency middleware must run **after** `authMiddleware` so\n * `request.locals.user` (written by `@warlock.js/auth`) and\n * `request.decodedAccessToken` are populated.\n *\n * @example\n * buildIdempotencyCacheKey(request, \"01J9XZQ-ABC\"); // \"idem:client:user_123:01J9XZQ-ABC\"\n */\n/**\n * Read `id` off `request.locals.user` without assuming any app's\n * `RequestUser` augmentation (declared by `@warlock.js/auth`, which core\n * cannot import) declares it, and without assuming `@warlock.js/auth` is\n * even installed — hence the untyped `unknown` read here rather than a\n * typed `RequestLocals[\"user\"]` access.\n *\n * A local, narrow runtime read survives any augmentation shape — no\n * `as any`.\n */\nfunction readUserId(user: unknown): string | number | undefined {\n  if (!user || typeof user !== \"object\" || !(\"id\" in user)) return undefined;\n\n  const id = (user as { id?: unknown }).id;\n\n  return typeof id === \"string\" || typeof id === \"number\" ? id : undefined;\n}\n\nexport function buildIdempotencyCacheKey(request: Request, idempotencyKey: string): string {\n  const userType = request.decodedAccessToken?.userType || \"anonymous\";\n  const locals = request.locals as Record<string, unknown>;\n  const userId = readUserId(locals.user) || request.detectIp() || \"unknown\";\n\n  return `idem:${userType}:${userId}:${idempotencyKey}`;\n}\n"],"mappings":";;;;;;;;;;;AAWA,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,SAAgB,sBAAsB,OAAiC;CACrE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,kBAChB,gBAAgB,KAAK,KAAK;AAE9B;;;;;;;;;;;AAYA,SAAgB,SAAS,MAAuB;CAC9C,MAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC;CAE9E,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAS,WAAW,MAA4C;CAC9D,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OAAO,OAAO;CAEjE,MAAM,KAAM,KAA0B;CAEtC,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,WAAW,KAAK;AACjE;AAEA,SAAgB,yBAAyB,SAAkB,gBAAgC;CACzF,MAAM,WAAW,QAAQ,oBAAoB,YAAY;CACzD,MAAM,SAAS,QAAQ;CAGvB,OAAO,QAAQ,SAAS,GAFT,WAAW,OAAO,IAAI,KAAK,QAAQ,SAAS,KAAK,UAE9B,GAAG;AACvC"}

package/esm/http/request-controller.d.mts

@@ -1,5 +1,5 @@
-import { Request } from "./request.mjs";
 import { Response } from "./response.mjs";
+import { Request } from "./request.mjs";
 import { ReturnedResponse } from "./types.mjs";
 import { RequestControllerContract } from "../router/types.mjs";
 

package/esm/http/request.d.mts

@@ -1,6 +1,6 @@
-import { UploadedFile } from "./uploaded-file.mjs";
 import { Response } from "./response.mjs";
-import { DecodedAccessToken, RequestEvent, RequestLocals, RequestUser } from "./types.mjs";
+import { UploadedFile } from "./uploaded-file.mjs";
+import { DecodedAccessToken, RequestEvent, RequestLocals } from "./types.mjs";
 import { Middleware, RequestHandler, Route } from "../router/types.mjs";
 import { BaseValidator } from "@warlock.js/seal";
 import { trans } from "@mongez/localization";
@@ -18,7 +18,8 @@ declare class Request<RequestValidation = any> {
    *
    * **Prefer framework methods first**: `request.input()`, `request.header()`,
    * `request.body`, `request.query`, `request.params`, `request.file()`,
-   * `request.user`, `request.detectIp()`, etc. They handle locale, parsing,
+   * `request.locals.user` (set by `@warlock.js/auth`), `request.detectIp()`,
+   * etc. They handle locale, parsing,
    * trust-proxy, and validation pipeline integration correctly.
    *
    * **Reach for `baseRequest` only** when the framework genuinely lacks a
@@ -54,38 +55,23 @@ declare class Request<RequestValidation = any> {
   get decodedAccessToken(): DecodedAccessToken | undefined;
   set decodedAccessToken(value: DecodedAccessToken | undefined);
   /**
-   * Backing field for `user` — see the accessor below.
-   */
-  private _user?;
-  /**
-   * The authenticated user attached to this request, if any.
-   *
-   * `RequestUser` is empty by default, so ANY shape is assignable here at the
-   * declaration site — the app or auth package declares its real fields via
-   * module augmentation:
+   * REMOVED in 5.12.0 — the authenticated user now lives at
+   * `request.locals.user`, a key `@warlock.js/auth` declares via module
+   * augmentation on `RequestLocals` and writes from its middleware after a
+   * successful token resolution. `RequestUser` moved out of core to
+   * `@warlock.js/auth` alongside it.
    *
-   * ```typescript
-   * declare module "@warlock.js/core" {
-   *   interface RequestUser {
-   *     id: string | number;
-   *   }
-   * }
-   * ```
+   * This getter is a development-time diagnostic only, kept for one release
+   * so a call site that still reads `request.user` fails loudly at runtime
+   * instead of silently reading `undefined`. It is typed `never` so it
+   * cannot reintroduce an auth-shaped type into core, and it throws
+   * unconditionally outside production so the failure is impossible to miss
+   * in local dev — see `RequestUserMovedError`.
    *
-   * Replaces the v4 `GuardedRequest` convention
-   * (`create-warlock/.../guarded.request.ts` — `Request<T> & { user: User }`,
-   * an intersection type hand-declared per app) with a property core itself
-   * declares and types. `clearCurrentUser()` below is the one place core
-   * writes it directly; auth middleware writes it after a successful token
-   * resolution.
-   *
-   * A prototype accessor, not a plain field: the setter also marks the
-   * request `authDerived` (see below), so `clearCurrentUser()`'s
-   * `this.user = undefined` still counts as touching auth state rather than
-   * un-marking it.
+   * There is no setter: nothing in core or downstream packages should ever
+   * assign to `request.user` again.
    */
-  get user(): RequestUser | undefined;
-  set user(value: RequestUser | undefined);
+  get user(): never;
   /**
    * Private, server-only, per-request data bag.
    *
@@ -115,18 +101,6 @@ declare class Request<RequestValidation = any> {
    * a prior one.
    */
   locals: RequestLocals;
-  /**
-   * Forget the authenticated user for this request.
-   *
-   * The `user` documentation above already names this as "the one place core
-   * writes it directly", and `@warlock.js/auth`'s middleware already calls it when
-   * a token is forged, malformed, expired, or of the wrong type. It was designed,
-   * documented and called — just never written, so `auth` could not typecheck.
-   *
-   * Clearing rather than leaving a stale value matters: a request that failed
-   * authentication must not carry the identity of whoever this object last held.
-   */
-  clearCurrentUser(): void;
   /**
    * Backing field for the lazily-generated CSP nonce. Left `undefined` until
    * the first `request.nonce` read; see the `nonce` getter below.
@@ -180,6 +154,12 @@ declare class Request<RequestValidation = any> {
    * Request id
    */
   id: string;
+  /**
+   * Trace id. The inbound `traceparent` header's trace id
+   * when valid, otherwise `id`. Resolved once in `setRequest`, alongside
+   * `id` itself — see `resolveTraceId`.
+   */
+  traceId: string;
   /**
    * Start Time
    */
@@ -202,6 +182,14 @@ declare class Request<RequestValidation = any> {
    * default is used regardless of any incoming header.
    */
   protected resolveRequestId(): void;
+  /**
+   * Derive `traceId`: the inbound
+   * `traceparent` header's trace id when it is a valid W3C traceparent,
+   * otherwise `id`. Always runs — unlike request-id inheritance this has no
+   * `enabled: false` escape hatch, since `traceId` is only ever read when
+   * tracing hooks are enabled (see `./tracing`).
+   */
+  protected resolveTraceId(): void;
   /**
    * Validate a candidate request-id value. Accepts non-empty printable ASCII
    * up to 128 characters — tight enough to reject newline / control-character

package/esm/http/request.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.mts","names":[],"sources":["../../../../../../../core/src/http/request.ts"],"mappings":";;;;;;;;;;;KAoBK,eAAA,iBAIU,mBAAA,mBAAsC,CAAA,0BAA2B,CAAA,WAAY,CAAA,GACvF,mBAAA,CAAoB,CAAA;AAAA,KAGpB,UAAA,SAAmB,eAAe;AAAA,cAE1B,OAAA;;;;;;;;;;;;;;;;EAgBJ,WAAA,EAAc,cAAA;EArBG;AAAA;AAAA;EA0BjB,QAAA,EAAW,QAAA;;;AAvBmB;EA4B9B,KAAA,EAAQ,KAAA;EA1BG;;;EAAA,UA+BR,OAAA;EALK;;;EAAA,QAUP,mBAAA;EAsDe;;;;;;;EAAA,IA7CZ,kBAAA,IAAsB,kBAAA;EAAA,IAItB,kBAAA,CAAmB,KAAA,EAAO,kBAAA;EA0UH;;;EAAA,QAlU1B,KAAA;EA0UgB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAA,IA7Sb,IAAA,IAAQ,WAAA;EAAA,IAIR,IAAA,CAAK,KAAA,EAAO,WAAA;EA1EhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2GA,MAAA,EAAQ,aAAA;EAmER;;;;;;;;;;;EAtDA,gBAAA;EAyHG;;;;EAAA,UAjHA,MAAA;EAqJO;;;;;;;;;;;;;;;;;;;;;;EAAA,IA7HN,KAAA;EA2NH;;;EAAA,OAhNM,OAAA,EAAS,OAAA;EAyNZ;;;;EAnNJ,KAAA,EAAO,UAAA,QAAkB,KAAA;EAuOzB;;;EAlOA,CAAA,EAAG,UAAA,QAAkB,KAAA;EAuPjB;;;EAAA,UAxOD,OAAA;EA4RC;;;EAAA,UAvRD,aAAA,GAAgB,iBAAA;EAyThB;;;EApTH,EAAA;EAoTkD;;;EA/SlD,SAAA;EA6eG;;;EAxeH,OAAA;EA8fS;;;EAzfT,UAAA,CAAW,OAAA,EAAS,cAAA;EAqgBgB;;;;;;;;;EAAA,UA1ejC,gBAAA;EAygBC;;;;;EAAA,iBAjfM,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EA2gBzB;;;EA/fnB,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EAkiB/C;;;;;;;;EAAA,UAthBG,WAAA,CAAY,SAAA;EA0iBf;;;;EAAA,UAthBG,aAAA;EAiiBU;;;EAAA,IAphBT,MAAA;EAwiBsB;;;EAAA,IA/hBtB,MAAA,CAAO,UAAA;EA2lBX;;;EAplBA,aAAA,CAAc,UAAA;EA2lBR;;;;;EAhlBN,aAAA,CAAc,wBAAA;EA8lBV;;;EAAA,IAvlBA,QAAA;EAumBJ;;;EAhmBM,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA,4BAAA,gBAAA;EA2mB1D;;;EApmBT,MAAA,gCAAsC,UAAA,EAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EAknB0B;;;EAAA,IA1mBjB,OAAA,IAAW,MAAA;EAsoBI;;;EA/nBnB,MAAA,CAAO,IAAA,UAAc,YAAA;EAgpBjB;;;EAnoBJ,SAAA,CAAU,IAAA;EAmpBN;;;EAAA,IA5oBA,MAAA;EA4pBJ;;;EAAA,IArpBI,QAAA;EA4sBJ;;;EAAA,IArsBI,MAAA;EAutBJ;;;EAAA,IAhtBI,YAAA;EAutBc;;;EAAA,IA1sBd,kBAAA;EA0uBA;;;;;EAAA,IAztBA,WAAA;EAyuBe;;;EAAA,IA1tBf,aAAA;EAkvBA;;;EAAA,IA3uBA,MAAA;EAk0BA;;;EAcuB;;;;;;;EAAA,UAl0BxB,gBAAA,CAAiB,GAAA;;;;;;;;;;YAajB,aAAA,CAAc,KAAA,OAAY,UAAA,WAAqB,KAAA,GAAQ,KAAA;EAAA,UAMvD,YAAA;;;;YAeA,SAAA,CAAU,IAAA;;;;YAyKV,UAAA,CAAW,IAAA;;;;EAsBd,QAAA,CAAS,KAAA,EAAO,KAAA;;;;EAYhB,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;;;;EAOpC,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA,iCAAa,iBAAA;;;;EAOzC,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;;;;MAiBrB,IAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;;;;;;EAYE,aAAA,IAAa,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;EA2BnB,UAAA,IAAU,cAAA,CAAA,OAAA;;;;;EAQV,SAAA,UAAmB,iBAAA,EAAmB,MAAA,UAAgB,MAAA,sBAA4B,MAAA;;;;EAalF,eAAA,IAAmB,MAAA,aAAmB,iBAAA;;;;EAOtC,gBAAA,CAAiB,IAAA,EAAM,iBAAA;;;;;;;;EAWjB,OAAA,IAAO,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YAoBJ,iBAAA,IAAiB,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YA8CvB,kBAAA,IAAsB,UAAA;;;;EAczB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,IAAS,IAAA;;;;MASL,IAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MASlB,KAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA;;;;EAOA,eAAA;;;;EAUA,iBAAA;;;;EAmBA,KAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCJ,QAAA;;;;MAoCI,MAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;MAOA,SAAA;;;;MAOA,OAAA,gBAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}
+{"version":3,"file":"request.d.mts","names":[],"sources":["../../../../../../../core/src/http/request.ts"],"mappings":";;;;;;;;;;;KAuBK,eAAA,iBAIU,mBAAA,mBAAsC,CAAA,0BAA2B,CAAA,WAAY,CAAA,GACvF,mBAAA,CAAoB,CAAA;AAAA,KAGpB,UAAA,SAAmB,eAAe;AAAA,cAE1B,OAAA;;;;;;;;;;;;;;;;;EAiBJ,WAAA,EAAc,cAAA;EAtBG;AAAA;;EA2BjB,QAAA,EAAW,QAAA;EAxBmB;AAAA;AAEvC;EA2BS,KAAA,EAAQ,KAAA;EA3BG;;;EAAA,UAgCR,OAAA;EAcuB;;;EAAA,QATzB,mBAAA;EAsHwB;;;;;;;EAAA,IA7GrB,kBAAA,IAAsB,kBAAA;EAAA,IAItB,kBAAA,CAAmB,KAAA,EAAO,kBAAA;EA0U7B;;;;;;;;;;;;;;;;;EAAA,IApTG,IAAA;EAmyBS;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA/vBb,MAAA,EAAQ,aAAA;EA8BJ;;;;EAAA,UAxBD,MAAA;EAyCsB;;;;;;;;;;;;;;;;;;;;;;EAAA,IAjBrB,KAAA;EAgKD;;;EAAA,OArJI,OAAA,EAAS,OAAA;EA+LZ;;;;EAzLJ,KAAA,EAAO,UAAA,QAAkB,KAAA;EA2MX;;;EAtMd,CAAA,EAAG,UAAA,QAAkB,KAAA;EAoNN;;;EAAA,UArMZ,OAAA;EA4MH;;;EAAA,UAvMG,aAAA,GAAgB,iBAAA;EAwMF;;;EAnMjB,EAAA;EA4Me;;;;;EArMf,OAAA;EAgOI;;;EA3NJ,SAAA;EA6PI;;;EAxPJ,OAAA;EA6SG;;;EAxSH,UAAA,CAAW,OAAA,EAAS,cAAA;EAqTS;;;;;;;;;EAAA,UAxR1B,gBAAA;EA4eM;;;;;;;EAAA,UAldN,cAAA;EAqeyB;;;;;EAAA,iBAzdlB,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EAifxC;;;EAreJ,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EA+f5B;;;;;;;;EAAA,UAnfhB,WAAA,CAAY,SAAA;EAkiBuC;;;;EAAA,UA9gBnD,aAAA;EA2hBmC;;;EAAA,IA9gBlC,MAAA;EAgiBE;;;EAAA,IAvhBF,MAAA,CAAO,UAAA;EA2iBF;;;EApiBT,aAAA,CAAc,UAAA;EAgmBX;;;;;EArlBH,aAAA,CAAc,wBAAA;EA0mBR;;;EAAA,IAnmBF,QAAA;EA0mBa;;;EAnmBX,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA,4BAAA,gBAAA;EAinB/D;;;EA1mBJ,MAAA,gCAAsC,UAAA,EAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EAinB6B;;;EAAA,IAzmBpB,OAAA,IAAW,MAAA;EAooBf;;;EA7nBA,MAAA,CAAO,IAAA,UAAc,YAAA;EAypBrB;;;EA5oBA,SAAA,CAAU,IAAA;EAspBJ;;;EAAA,IA/oBF,MAAA;EA6pBK;;;EAAA,IAtpBL,QAAA;EAsqBK;;;EAAA,IA/pBL,MAAA;EAyrBJ;;;EAAA,IAlrBI,YAAA;EA+tBJ;;;EAAA,IAltBI,kBAAA;EAouBJ;;;;;EAAA,IAntBI,WAAA;EAmvBA;;;EAAA,IApuBA,aAAA;EAovBJ;;;EAAA,IA7uBI,MAAA;EAsvBG;;;EAoDP;;;;;;;EAAA,UA5xBG,gBAAA,CAAiB,GAAA;EAm2BpB;;;;;AAAwC;;;;EAAxC,UAt1BG,aAAA,CAAc,KAAA,OAAY,UAAA,WAAqB,KAAA,GAAQ,KAAA;EAAA,UAMvD,YAAA;;;;YAeA,SAAA,CAAU,IAAA;;;;YAyKV,UAAA,CAAW,IAAA;;;;EAsBd,QAAA,CAAS,KAAA,EAAO,KAAA;;;;EAYhB,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;;;;EAOpC,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA,iCAAa,iBAAA;;;;EAOzC,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;;;;MAiBrB,IAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;;;;;;EAYE,aAAA,IAAa,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;EAuCnB,UAAA,IAAU,cAAA,CAAA,OAAA;;;;;EAQV,SAAA,UAAmB,iBAAA,EAAmB,MAAA,UAAgB,MAAA,sBAA4B,MAAA;;;;EAalF,eAAA,IAAmB,MAAA,aAAmB,iBAAA;;;;EAOtC,gBAAA,CAAiB,IAAA,EAAM,iBAAA;;;;;;;;EAWjB,OAAA,IAAO,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YAoBJ,iBAAA,IAAiB,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YA4DvB,kBAAA,IAAsB,UAAA;;;;EAczB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,IAAS,IAAA;;;;MASL,IAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MASlB,KAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA;;;;EAOA,eAAA;;;;EAUA,iBAAA;;;;EAmBA,KAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCJ,QAAA;;;;MAoCI,MAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;MAOA,SAAA;;;;MAOA,OAAA,gBAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}

package/esm/http/request.mjs

@@ -1,6 +1,11 @@
 import { config } from "../config/config-getter.mjs";
 import { LOCALE_COOKIE_NAME, resolveLocaleConfiguration } from "../config/locale-configuration.mjs";
+import { RequestUserMovedError } from "./errors/errors.mjs";
+import { deriveTraceId } from "./tracing/trace-id.mjs";
+import { buildTracingContext, dispatchPhase, isTracingEnabled } from "./tracing/tracing-dispatcher.mjs";
+import "./tracing/index.mjs";
 import { createRequestStore } from "./middleware/inject-request-context.mjs";
+import { Application } from "../application/application.mjs";
 import { validateAll } from "../validation/validateAll.mjs";
 import { Response } from "./response.mjs";
 import { UploadedFile } from "./uploaded-file.mjs";
@@ -22,6 +27,7 @@ var Request = class Request {
 		this.t = trans;
 		this._locale = "";
 		this.id = Random.string(32);
+		this.traceId = "";
 		this.startTime = Date.now();
 	}
 	/**
@@ -39,52 +45,24 @@ var Request = class Request {
 		this.locals.authDerived = true;
 	}
 	/**
-	* The authenticated user attached to this request, if any.
+	* REMOVED in 5.12.0 — the authenticated user now lives at
+	* `request.locals.user`, a key `@warlock.js/auth` declares via module
+	* augmentation on `RequestLocals` and writes from its middleware after a
+	* successful token resolution. `RequestUser` moved out of core to
+	* `@warlock.js/auth` alongside it.
 	*
-	* `RequestUser` is empty by default, so ANY shape is assignable here at the
-	* declaration site — the app or auth package declares its real fields via
-	* module augmentation:
+	* This getter is a development-time diagnostic only, kept for one release
+	* so a call site that still reads `request.user` fails loudly at runtime
+	* instead of silently reading `undefined`. It is typed `never` so it
+	* cannot reintroduce an auth-shaped type into core, and it throws
+	* unconditionally outside production so the failure is impossible to miss
+	* in local dev — see `RequestUserMovedError`.
 	*
-	* ```typescript
-	* declare module "@warlock.js/core" {
-	*   interface RequestUser {
-	*     id: string | number;
-	*   }
-	* }
-	* ```
-	*
-	* Replaces the v4 `GuardedRequest` convention
-	* (`create-warlock/.../guarded.request.ts` — `Request<T> & { user: User }`,
-	* an intersection type hand-declared per app) with a property core itself
-	* declares and types. `clearCurrentUser()` below is the one place core
-	* writes it directly; auth middleware writes it after a successful token
-	* resolution.
-	*
-	* A prototype accessor, not a plain field: the setter also marks the
-	* request `authDerived` (see below), so `clearCurrentUser()`'s
-	* `this.user = undefined` still counts as touching auth state rather than
-	* un-marking it.
+	* There is no setter: nothing in core or downstream packages should ever
+	* assign to `request.user` again.
 	*/
 	get user() {
-		return this._user;
-	}
-	set user(value) {
-		this._user = value;
-		this.locals.authDerived = true;
-	}
-	/**
-	* Forget the authenticated user for this request.
-	*
-	* The `user` documentation above already names this as "the one place core
-	* writes it directly", and `@warlock.js/auth`'s middleware already calls it when
-	* a token is forged, malformed, expired, or of the wrong type. It was designed,
-	* documented and called — just never written, so `auth` could not typecheck.
-	*
-	* Clearing rather than leaving a stale value matters: a request that failed
-	* authentication must not carry the identity of whoever this object last held.
-	*/
-	clearCurrentUser() {
-		this.user = void 0;
+		if (Application.isDevelopment) throw new RequestUserMovedError();
 	}
 	/**
 	* Per-request Content-Security-Policy nonce — a fresh, unguessable value
@@ -118,6 +96,7 @@ var Request = class Request {
 	setRequest(request) {
 		this.baseRequest = request;
 		this.resolveRequestId();
+		this.resolveTraceId();
 		this.parsePayload();
 		this.trans = this.t = (keyword, placeholders) => transFrom(this.getLocaleCode(), keyword, placeholders);
 		return this;
@@ -143,6 +122,18 @@ var Request = class Request {
 		if (typeof requestIdConfig.generator === "function") this.id = requestIdConfig.generator();
 	}
 	/**
+	* Derive `traceId`: the inbound
+	* `traceparent` header's trace id when it is a valid W3C traceparent,
+	* otherwise `id`. Always runs — unlike request-id inheritance this has no
+	* `enabled: false` escape hatch, since `traceId` is only ever read when
+	* tracing hooks are enabled (see `./tracing`).
+	*/
+	resolveTraceId() {
+		const header = this.baseRequest.headers.traceparent;
+		const traceparent = Array.isArray(header) ? header[0] : header;
+		this.traceId = deriveTraceId(traceparent, this.id);
+	}
+	/**
 	* Validate a candidate request-id value. Accepts non-empty printable ASCII
 	* up to 128 characters — tight enough to reject newline / control-character
 	* log-injection, loose enough to accept UUIDs, ULIDs, snowflakes, etc.
@@ -483,7 +474,14 @@ var Request = class Request {
 		}
 		const handler = this.route.handler;
 		if (!handler.validation) return;
-		return await validateAll(handler.validation, this, this.response);
+		const tracingEnabled = isTracingEnabled();
+		const validationStartedAt = tracingEnabled ? performance.now() : 0;
+		const validationOutput = await validateAll(handler.validation, this, this.response);
+		if (tracingEnabled) dispatchPhase(buildTracingContext(this), {
+			name: "validation",
+			durationMs: performance.now() - validationStartedAt
+		});
+		return validationOutput;
 	}
 	/**
 	* Return the request handler attached to the current route.
@@ -540,12 +538,22 @@ var Request = class Request {
 		if (middlewares.length === 0) return;
 		this.log("About to execute request middlewares");
 		this.trigger("executingMiddleware", middlewares, this.route);
-		for (const middleware of middlewares) {
+		const tracingEnabled = isTracingEnabled();
+		for (const [index, middleware] of middlewares.entries()) {
 			this.log("Executing middleware " + colors.yellowBright(middleware.name));
+			const middlewareStartedAt = tracingEnabled ? performance.now() : 0;
 			const output = await middleware({
 				request: this,
 				response: this.response
 			});
+			if (tracingEnabled) dispatchPhase(buildTracingContext(this), {
+				name: "middleware",
+				durationMs: performance.now() - middlewareStartedAt,
+				attrs: {
+					name: middleware.name,
+					index
+				}
+			});
 			this.log("Executed middleware " + colors.yellowBright(middleware.name), "success");
 			if (output !== void 0) {
 				this.log(colors.yellow("request intercepted by middleware ") + colors.cyanBright(middleware.name), "warn");