@warlock.js/core 5.10.0 → 5.12.0

package/esm/http/tracing/tracing-dispatcher.mjs

@@ -0,0 +1,94 @@
+import config from "@mongez/config";
+import { log } from "@warlock.js/logger";
+
+//#region ../core/src/http/tracing/tracing-dispatcher.ts
+/**
+* Tracing hook dispatch.
+*
+* `http.tracing` is resolved once — lazily, on first read, then cached for
+* the life of the process — never per request. Every call site gates on
+* `isTracingEnabled()` BEFORE doing anything else (building a context
+* object, calling `performance.now()`), so a disabled app pays exactly one
+* boolean check per call site and never allocates the attrs/context payload.
+*/
+let resolved;
+/**
+* Resolve `http.tracing` once per process and cache it. Safe to call from
+* every hot-path call site — after the first call this is a plain field
+* read, no config lookup.
+*/
+function resolveTracingConfig() {
+	if (resolved) return resolved;
+	const tracing = config.get("http.tracing", {}) ?? {};
+	resolved = {
+		enabled: tracing.enabled === true,
+		hooks: tracing.hooks ?? []
+	};
+	return resolved;
+}
+/** The single boolean check every instrumented call site guards on. */
+function isTracingEnabled() {
+	return resolveTracingConfig().enabled;
+}
+/** Test-only: forces the next `resolveTracingConfig()` call to re-read config. */
+function resetTracingConfigForTests() {
+	resolved = void 0;
+	reportedHooks = /* @__PURE__ */ new WeakMap();
+}
+/** Build the per-request context handed to every hook call. */
+function buildTracingContext(request) {
+	return {
+		traceId: request.traceId,
+		requestId: request.id,
+		method: request.method,
+		route: request.route?.path,
+		path: request.path
+	};
+}
+/**
+* Tracks which (hook, verb) pairs have already been reported, so a hook that
+* throws on every request is reported to the error sink exactly once per
+* process rather than flooding it.
+*/
+let reportedHooks = /* @__PURE__ */ new WeakMap();
+function reportHookErrorOnce(hook, verb, error) {
+	let reportedVerbs = reportedHooks.get(hook);
+	if (!reportedVerbs) {
+		reportedVerbs = /* @__PURE__ */ new Set();
+		reportedHooks.set(hook, reportedVerbs);
+	}
+	if (reportedVerbs.has(verb)) return;
+	reportedVerbs.add(verb);
+	log.error("http", "tracing-hook", error, { hook: verb });
+}
+function safeInvoke(hook, verb, invoke) {
+	const fn = hook[verb];
+	if (!fn) return;
+	try {
+		invoke(fn);
+	} catch (error) {
+		reportHookErrorOnce(hook, verb, error);
+	}
+}
+/** Dispatch `onRequestStart` to every configured hook. No-op when disabled. */
+function dispatchRequestStart(ctx) {
+	const { enabled, hooks } = resolveTracingConfig();
+	if (!enabled) return;
+	for (const hook of hooks) safeInvoke(hook, "onRequestStart", (fn) => fn(ctx));
+}
+/** Dispatch `onRequestEnd` to every configured hook. No-op when disabled. */
+function dispatchRequestEnd(ctx, result) {
+	const { enabled, hooks } = resolveTracingConfig();
+	if (!enabled) return;
+	for (const hook of hooks) safeInvoke(hook, "onRequestEnd", (fn) => fn(ctx, result));
+}
+/** Dispatch `onPhase` to every configured hook. No-op when disabled. */
+function dispatchPhase(ctx, phase) {
+	const { enabled, hooks } = resolveTracingConfig();
+	if (!enabled) return;
+	for (const hook of hooks) safeInvoke(hook, "onPhase", (fn) => fn(ctx, phase));
+}
+
+//#endregion
+export { buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled, resetTracingConfigForTests, resolveTracingConfig };
+//# sourceMappingURL=tracing-dispatcher.mjs.map

package/esm/http/tracing/tracing-dispatcher.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing-dispatcher.mjs","names":[],"sources":["../../../../../../../../core/src/http/tracing/tracing-dispatcher.ts"],"sourcesContent":["/**\n * Tracing hook dispatch.\n *\n * `http.tracing` is resolved once — lazily, on first read, then cached for\n * the life of the process — never per request. Every call site gates on\n * `isTracingEnabled()` BEFORE doing anything else (building a context\n * object, calling `performance.now()`), so a disabled app pays exactly one\n * boolean check per call site and never allocates the attrs/context payload.\n */\nimport config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport type {\n  HttpTracingConfig,\n  TracingContext,\n  TracingHooks,\n  TracingPhaseInfo,\n  TracingRequestEndInfo,\n} from \"./tracing.type\";\n\ntype ResolvedTracing = {\n  enabled: boolean;\n  hooks: TracingHooks[];\n};\n\nlet resolved: ResolvedTracing | undefined;\n\n/**\n * Minimal request shape `buildTracingContext` needs. Kept structural (not a\n * `Request` import) so this module never creates an import cycle with\n * `../request`, which itself calls into this module.\n */\nexport type TracingContextSource = {\n  traceId: string;\n  id: string;\n  method: string;\n  path: string;\n  route?: { path: string };\n};\n\n/**\n * Resolve `http.tracing` once per process and cache it. Safe to call from\n * every hot-path call site — after the first call this is a plain field\n * read, no config lookup.\n */\nexport function resolveTracingConfig(): ResolvedTracing {\n  if (resolved) return resolved;\n\n  const tracing = config.get(\"http.tracing\", {} as HttpTracingConfig) ?? {};\n\n  resolved = {\n    enabled: tracing.enabled === true,\n    hooks: tracing.hooks ?? [],\n  };\n\n  return resolved;\n}\n\n/** The single boolean check every instrumented call site guards on. */\nexport function isTracingEnabled(): boolean {\n  return resolveTracingConfig().enabled;\n}\n\n/** Test-only: forces the next `resolveTracingConfig()` call to re-read config. */\nexport function resetTracingConfigForTests(): void {\n  resolved = undefined;\n  reportedHooks = new WeakMap();\n}\n\n/** Build the per-request context handed to every hook call. */\nexport function buildTracingContext(request: TracingContextSource): TracingContext {\n  return {\n    traceId: request.traceId,\n    requestId: request.id,\n    method: request.method,\n    route: request.route?.path,\n    path: request.path,\n  };\n}\n\n/**\n * Tracks which (hook, verb) pairs have already been reported, so a hook that\n * throws on every request is reported to the error sink exactly once per\n * process rather than flooding it.\n */\nlet reportedHooks = new WeakMap<TracingHooks, Set<string>>();\n\nfunction reportHookErrorOnce(hook: TracingHooks, verb: string, error: unknown): void {\n  let reportedVerbs = reportedHooks.get(hook);\n\n  if (!reportedVerbs) {\n    reportedVerbs = new Set();\n    reportedHooks.set(hook, reportedVerbs);\n  }\n\n  if (reportedVerbs.has(verb)) return;\n\n  reportedVerbs.add(verb);\n\n  // Never swallow the only copy of an error — but a throwing hook must never\n  // break the request it was only meant to observe, so this is reported, not\n  // re-thrown.\n  log.error(\"http\", \"tracing-hook\", error, { hook: verb });\n}\n\nfunction safeInvoke<Verb extends keyof TracingHooks>(\n  hook: TracingHooks,\n  verb: Verb,\n  invoke: (fn: NonNullable<TracingHooks[Verb]>) => void,\n): void {\n  const fn = hook[verb];\n\n  if (!fn) return;\n\n  try {\n    invoke(fn as NonNullable<TracingHooks[Verb]>);\n  } catch (error) {\n    reportHookErrorOnce(hook, verb, error);\n  }\n}\n\n/** Dispatch `onRequestStart` to every configured hook. No-op when disabled. */\nexport function dispatchRequestStart(ctx: TracingContext): void {\n  const { enabled, hooks } = resolveTracingConfig();\n\n  if (!enabled) return;\n\n  for (const hook of hooks) {\n    safeInvoke(hook, \"onRequestStart\", (fn) => fn(ctx));\n  }\n}\n\n/** Dispatch `onRequestEnd` to every configured hook. No-op when disabled. */\nexport function dispatchRequestEnd(ctx: TracingContext, result: TracingRequestEndInfo): void {\n  const { enabled, hooks } = resolveTracingConfig();\n\n  if (!enabled) return;\n\n  for (const hook of hooks) {\n    safeInvoke(hook, \"onRequestEnd\", (fn) => fn(ctx, result));\n  }\n}\n\n/** Dispatch `onPhase` to every configured hook. No-op when disabled. */\nexport function dispatchPhase(ctx: TracingContext, phase: TracingPhaseInfo): void {\n  const { enabled, hooks } = resolveTracingConfig();\n\n  if (!enabled) return;\n\n  for (const hook of hooks) {\n    safeInvoke(hook, \"onPhase\", (fn) => fn(ctx, phase));\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAwBA,IAAI;;;;;;AAoBJ,SAAgB,uBAAwC;CACtD,IAAI,UAAU,OAAO;CAErB,MAAM,UAAU,OAAO,IAAI,gBAAgB,CAAC,CAAsB,KAAK,CAAC;CAExE,WAAW;EACT,SAAS,QAAQ,YAAY;EAC7B,OAAO,QAAQ,SAAS,CAAC;CAC3B;CAEA,OAAO;AACT;;AAGA,SAAgB,mBAA4B;CAC1C,OAAO,qBAAqB,CAAC,CAAC;AAChC;;AAGA,SAAgB,6BAAmC;CACjD,WAAW;CACX,gCAAgB,IAAI,QAAQ;AAC9B;;AAGA,SAAgB,oBAAoB,SAA+C;CACjF,OAAO;EACL,SAAS,QAAQ;EACjB,WAAW,QAAQ;EACnB,QAAQ,QAAQ;EAChB,OAAO,QAAQ,OAAO;EACtB,MAAM,QAAQ;CAChB;AACF;;;;;;AAOA,IAAI,gCAAgB,IAAI,QAAmC;AAE3D,SAAS,oBAAoB,MAAoB,MAAc,OAAsB;CACnF,IAAI,gBAAgB,cAAc,IAAI,IAAI;CAE1C,IAAI,CAAC,eAAe;EAClB,gCAAgB,IAAI,IAAI;EACxB,cAAc,IAAI,MAAM,aAAa;CACvC;CAEA,IAAI,cAAc,IAAI,IAAI,GAAG;CAE7B,cAAc,IAAI,IAAI;CAKtB,IAAI,MAAM,QAAQ,gBAAgB,OAAO,EAAE,MAAM,KAAK,CAAC;AACzD;AAEA,SAAS,WACP,MACA,MACA,QACM;CACN,MAAM,KAAK,KAAK;CAEhB,IAAI,CAAC,IAAI;CAET,IAAI;EACF,OAAO,EAAqC;CAC9C,SAAS,OAAO;EACd,oBAAoB,MAAM,MAAM,KAAK;CACvC;AACF;;AAGA,SAAgB,qBAAqB,KAA2B;CAC9D,MAAM,EAAE,SAAS,UAAU,qBAAqB;CAEhD,IAAI,CAAC,SAAS;CAEd,KAAK,MAAM,QAAQ,OACjB,WAAW,MAAM,mBAAmB,OAAO,GAAG,GAAG,CAAC;AAEtD;;AAGA,SAAgB,mBAAmB,KAAqB,QAAqC;CAC3F,MAAM,EAAE,SAAS,UAAU,qBAAqB;CAEhD,IAAI,CAAC,SAAS;CAEd,KAAK,MAAM,QAAQ,OACjB,WAAW,MAAM,iBAAiB,OAAO,GAAG,KAAK,MAAM,CAAC;AAE5D;;AAGA,SAAgB,cAAc,KAAqB,OAA+B;CAChF,MAAM,EAAE,SAAS,UAAU,qBAAqB;CAEhD,IAAI,CAAC,SAAS;CAEd,KAAK,MAAM,QAAQ,OACjB,WAAW,MAAM,YAAY,OAAO,GAAG,KAAK,KAAK,CAAC;AAEtD"}

package/esm/http/tracing/tracing.type.d.mts

@@ -0,0 +1,66 @@
+//#region ../core/src/http/tracing/tracing.type.d.ts
+/**
+ * Vendor-neutral request-tracing hook surface.
+ *
+ * `core` exposes this four-verb shape and stays framework-agnostic — no
+ * `@opentelemetry/api` dependency here, ever. Introducing a hard OTel
+ * dependency in `core` would push it onto every consumer of the framework,
+ * including apps that use a different tracer or none. An OTel (or any other
+ * vendor) bridge is a separate, optional package that subscribes to these
+ * hooks instead.
+ */
+/**
+ * Per-request identity threaded through every hook call. `route` is the
+ * matched pattern (e.g. `/users/:id`), not the resolved path, so hooks can
+ * group by endpoint rather than by every distinct id a client happened to
+ * request; it is `undefined` until routing has matched (there is no path
+ * where a hook fires before that).
+ */
+type TracingContext = {
+  /**
+   * A valid inbound W3C `traceparent` trace id when present, otherwise
+   * `request.id`. See `resolveTraceId` in `./trace-id.ts`.
+   */
+  traceId: string; /** `request.id` — the framework's own per-request correlation id. */
+  requestId: string;
+  method: string;
+  route?: string;
+  path: string;
+};
+/** Payload passed to `onPhase` for a single named phase of the request. */
+type TracingPhaseInfo = {
+  name: string;
+  durationMs: number;
+  attrs?: Record<string, unknown>;
+};
+/** Payload passed to `onRequestEnd` once the request has settled. */
+type TracingRequestEndInfo = {
+  status?: number;
+  durationMs: number;
+  error?: unknown;
+};
+/**
+ * A single tracing observer. Every verb is optional — a hook that only cares
+ * about phase spans need not implement `onRequestStart`/`onRequestEnd`.
+ *
+ * A throwing hook never breaks the request: the dispatcher catches it and
+ * reports it once per hook per process to the error sink, then continues.
+ */
+type TracingHooks = {
+  onRequestStart?(ctx: TracingContext): void;
+  onRequestEnd?(ctx: TracingContext, result: TracingRequestEndInfo): void;
+  onPhase?(ctx: TracingContext, phase: TracingPhaseInfo): void;
+};
+/**
+ * `http.tracing` configuration. OFF by default — resolved once at boot (see
+ * `resolveTracingConfig` in `./tracing-dispatcher.ts`), so a disabled app
+ * pays a single cached boolean read per call site, never a per-request
+ * config lookup.
+ */
+type HttpTracingConfig = {
+  /** @default false */enabled?: boolean;
+  hooks?: TracingHooks[];
+};
+//#endregion
+export { HttpTracingConfig, TracingContext, TracingHooks, TracingPhaseInfo, TracingRequestEndInfo };
+//# sourceMappingURL=tracing.type.d.mts.map

package/esm/http/tracing/tracing.type.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.type.d.mts","names":[],"sources":["../../../../../../../../core/src/http/tracing/tracing.type.ts"],"mappings":";;AAkBA;;;;;;;;;;AAUM;AAIN;;;;;KAdY,cAAA;EAiBV;;;AAAc;EAZd,OAAA,UAgB+B;EAd/B,SAAA;EACA,MAAA;EACA,KAAA;EACA,IAAA;AAAA;;KAIU,gBAAA;EACV,IAAA;EACA,UAAA;EACA,KAAA,GAAQ,MAAM;AAAA;;KAIJ,qBAAA;EACV,MAAA;EACA,UAAA;EACA,KAAA;AAAA;;;;;;;;KAUU,YAAA;EACV,cAAA,EAAgB,GAAA,EAAK,cAAA;EACrB,YAAA,EAAc,GAAA,EAAK,cAAA,EAAgB,MAAA,EAAQ,qBAAA;EAC3C,OAAA,EAAS,GAAA,EAAK,cAAA,EAAgB,KAAA,EAAO,gBAAA;AAAA;;;AAAgB;AASvD;;;KAAY,iBAAA;EAEV,qBAAA,OAAA;EACA,KAAA,GAAQ,YAAY;AAAA"}

package/esm/http/types.d.mts

@@ -1,4 +1,6 @@
 import { Response } from "./response.mjs";
+import { CspConfig } from "./csp.mjs";
+import { HttpTracingConfig } from "./tracing/tracing.type.mjs";
 import { Middleware } from "../router/types.mjs";
 import { CookieSerializeOptions } from "@fastify/cookie";
 import { FastifyCorsOptions } from "@fastify/cors";
@@ -31,32 +33,20 @@ type RequestEvent = "executingMiddleware" | "executedMiddleware" | "executingAct
  */
 interface RequestLocals {
   /**
-   * Whether this request has, at any point, been assigned a `user` or a
-   * `decodedAccessToken` — set by their accessors in `request.ts`, never by
+   * Whether this request has, at any point, been assigned a
+   * `decodedAccessToken` — set by its accessor in `request.ts`, never by
    * anything else, and never cleared once set. Absent (not `false`) on a
    * request that never touched auth state; a later stage reads this to
    * decide cache headers, but that stage is not this one.
+   *
+   * `@warlock.js/auth` writes the authenticated user to `locals.user` (a key
+   * it augments onto this interface — see `RequestUser` in that package) but
+   * does not set `authDerived` when doing so; only `decodedAccessToken`
+   * marks this flag. Core intentionally does not restore a user-triggered
+   * cache mark here (see the 5.12.0 CHANGELOG for the design ruling).
    */
   authDerived?: boolean;
 }
-/**
- * The authenticated user attached to the current request — `request.user`.
- *
- * Empty by default so any shape is assignable at the declaration site;
- * apps/packages narrow it via module augmentation instead of the v4
- * `GuardedRequest` intersection type (`Request<T> & { user: User }`,
- * hand-declared per app):
- *
- * @example
- * ```typescript
- * declare module "@warlock.js/core" {
- *   interface RequestUser {
- *     id: string | number;
- *   }
- * }
- * ```
- */
-interface RequestUser {}
 /**
  * Decoded access-token claims attached to the current request —
  * `request.decodedAccessToken`.
@@ -246,6 +236,16 @@ interface HttpConfigurations {
      */
     options?: CookieSerializeOptions;
   };
+  /**
+   * Opt-in `Content-Security-Policy` header, built per-request from a
+   * documented default policy merged with these directives, plus the
+   * framework's own per-request CSP nonce on `script-src`.
+   *
+   * Disabled by default — no header, no behaviour change — until `enabled`
+   * is set `true`. See `csp.ts` for the default policy and merge rules, and
+   * the `configure-app` / `send-response` skills for usage.
+   */
+  csp?: CspConfig;
   /**
    * Rate limit
    */
@@ -407,6 +407,12 @@ interface HttpConfigurations {
      */
     except?: PartialMiddleware;
   };
+  /**
+   * Opt-in request tracing hooks. OFF by default; resolved
+   * once at boot, not per request — see `resolveTracingConfig` in
+   * `./tracing/tracing-dispatcher.ts`.
+   */
+  tracing?: HttpTracingConfig;
 }
 type ResponseStreamController = {
   /**
@@ -453,5 +459,5 @@ type ResponseSSEController = {
   ended: boolean;
 };
 //#endregion
-export { DecodedAccessToken, HttpConfigurations, PartialMiddleware, RequestEvent, RequestLocals, RequestUser, ResponseEvent, ResponseSSEController, ResponseStreamController, ReturnedResponse };
+export { DecodedAccessToken, HttpConfigurations, PartialMiddleware, RequestEvent, RequestLocals, ResponseEvent, ResponseSSEController, ResponseStreamController, ReturnedResponse };
 //# sourceMappingURL=types.d.mts.map

package/esm/http/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../core/src/http/types.ts"],"mappings":";;;;;;;KAMY,YAAA;;;AAAZ;;;;AAAwB;AA0BxB;;;;AAQa;AAoBb;;;;AAA4B;AAc5B;;;;AACU;AAMV;UAjDiB,aAAA;;;;;;;;EAQf,WAAW;AAAA;;;;;;;;;;AAiEF;AAKX;;;;AAAyB;AAiEzB;;UAnHiB,WAAA;;;;;;AAkIO;AAMxB;;;;;;KA1HY,kBAAA;EACV,QAAQ;AAAA;;;;KAME,gBAAA;;;;AAIR;;;;EAIA,OAAA,CAAQ,QAAA;;;;EAIR,MAAA;;;;EAIA,OAAA,CAAQ,MAAA;;;;;;;;EAQR,OAAA;;;;KAKQ,aAAA;;;;;;;;;;;;;;;AAgTkB;;;;;;;;;;;;;;AAoBvB;AAGP;;AAHO;;;;;;;;;;;;;;;;;;;;;;AA2BA;;;;;;;;;;UA9RU,iBAAA;;;;;EAKf,MAAA;;;;;;EAMA,WAAA;;;;EAIA,UAAA,EAAY,UAAU;AAAA;;;;UAMP,kBAAA;;;;EAIf,IAAA;;;;EAIA,GAAA;;;;EAIA,IAAA,GAAO,kBAAA;;;;;;EAMP,eAAA;;;;;;;;;;EAUA,SAAA;;;;;;;;;;;;;;;;;;;;EAoBA,UAAA,mCAA6C,OAAA,UAAiB,GAAA;EAC9D,OAAA;;;;IAIE,MAAA;;;;IAIA,OAAA,GAAU,sBAAA;EAAA;;;;EAKZ,SAAA;;;;;;IAME,GAAA;;;;;;IAMA,QAAA;EAAA;;;;;;;;EASF,SAAA;;;;;;IAME,MAAA;;;;IAIA,SAAA;;;;;;;IAOA,OAAA;EAAA;;;;EAKF,WAAA;;;;;;IAME,GAAA;;;;;;IAMA,UAAA;;;;;;;IAOA,OAAA;;;;IAIA,MAAA;EAAA;;;;EAKF,WAAA;;;;;;;IAOE,OAAA;;;;;;IAMA,SAAA;;;;;;IAMA,UAAA;EAAA;;;;EAKF,gBAAA;;;;;;;IAOE,OAAA;;;;;;;;IAQA,qBAAA;EAAA;;;;EAKF,MAAA;;;;;;IAME,OAAA;;;;;;;IAOA,IAAA;;;;;;;IAOA,aAAA;EAAA;;;;EAKF,IAAA;;;;EAIA,UAAA;;;;IAIE,GAAA,GAAM,UAAA;;;;IAIN,IAAA,GAAO,iBAAA;;;;IAIP,MAAA,GAAS,iBAAA;EAAA;AAAA;AAAA,KAID,wBAAA;;;;EAIV,IAAA,GAAO,IAAA;;;;EAIP,MAAA,GAAS,IAAA,EAAM,KAAA,CAAM,SAAS;;;;EAI9B,GAAA;;;;EAIA,KAAA;AAAA;AAAA,KAGU,qBAAA;;;;;;;EAOV,IAAA,GAAO,KAAA,UAAe,IAAA,OAAW,EAAA,cAAgB,qBAAA;;;;EAIjD,OAAA,GAAU,OAAA,aAAoB,qBAAA;;;;EAI9B,GAAA,QAAW,qBAAA;;;;;EAKX,YAAA,GAAe,OAAA,iBAAwB,qBAAA;;;;EAIvC,KAAA;AAAA"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../core/src/http/types.ts"],"mappings":";;;;;;;;;KAQY,YAAA;;;AAAZ;;;;AAAwB;AA0BxB;;;;AAca;AAeb;;;;AACU;AAMV;;;;;;UApCiB,aAAA;EAoDL;;;;;;;;;;;;;EAtCV,WAAW;AAAA;;;;AAmDY;AAiEzB;;;;;;;;KArGY,kBAAA;EACV,QAAQ;AAAA;;;;KAME,gBAAA;;;;AAIR;;;;EAIA,OAAA,CAAQ,QAAA;;;;EAIR,MAAA;;;;EAIA,OAAA,CAAQ,MAAA;;;;;;;;EAQR,OAAA;;;;KAKQ,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiUiB;AAG7B;;AAH6B;;;;;;;;;;;AAmBtB;;;;;;;;;;;;;;;;;;;;;UAnRU,iBAAA;EA0SwB;;;AAIlC;EAzSL,MAAA;;;;;;EAMA,WAAA;;;;EAIA,UAAA,EAAY,UAAU;AAAA;;;;UAMP,kBAAA;;;;EAIf,IAAA;;;;EAIA,GAAA;;;;EAIA,IAAA,GAAO,kBAAA;;;;;;EAMP,eAAA;;;;;;;;;;EAUA,SAAA;;;;;;;;;;;;;;;;;;;;EAoBA,UAAA,mCAA6C,OAAA,UAAiB,GAAA;EAC9D,OAAA;;;;IAIE,MAAA;;;;IAIA,OAAA,GAAU,sBAAA;EAAA;;;;;;;;;;EAWZ,GAAA,GAAM,SAAA;;;;EAIN,SAAA;;;;;;IAME,GAAA;;;;;;IAMA,QAAA;EAAA;;;;;;;;EASF,SAAA;;;;;;IAME,MAAA;;;;IAIA,SAAA;;;;;;;IAOA,OAAA;EAAA;;;;EAKF,WAAA;;;;;;IAME,GAAA;;;;;;IAMA,UAAA;;;;;;;IAOA,OAAA;;;;IAIA,MAAA;EAAA;;;;EAKF,WAAA;;;;;;;IAOE,OAAA;;;;;;IAMA,SAAA;;;;;;IAMA,UAAA;EAAA;;;;EAKF,gBAAA;;;;;;;IAOE,OAAA;;;;;;;;IAQA,qBAAA;EAAA;;;;EAKF,MAAA;;;;;;IAME,OAAA;;;;;;;IAOA,IAAA;;;;;;;IAOA,aAAA;EAAA;;;;EAKF,IAAA;;;;EAIA,UAAA;;;;IAIE,GAAA,GAAM,UAAA;;;;IAIN,IAAA,GAAO,iBAAA;;;;IAIP,MAAA,GAAS,iBAAA;EAAA;;;;;;EAOX,OAAA,GAAU,iBAAA;AAAA;AAAA,KAGA,wBAAA;;;;EAIV,IAAA,GAAO,IAAA;;;;EAIP,MAAA,GAAS,IAAA,EAAM,KAAA,CAAM,SAAS;;;;EAI9B,GAAA;;;;EAIA,KAAA;AAAA;AAAA,KAGU,qBAAA;;;;;;;EAOV,IAAA,GAAO,KAAA,UAAe,IAAA,OAAW,EAAA,cAAgB,qBAAA;;;;EAIjD,OAAA,GAAU,OAAA,aAAoB,qBAAA;;;;EAI9B,GAAA,QAAW,qBAAA;;;;;EAKX,YAAA,GAAe,OAAA,iBAAwB,qBAAA;;;;EAIvC,KAAA;AAAA"}

package/esm/index.d.mts

@@ -15,12 +15,15 @@ import { DOSpacesDriver } from "./storage/drivers/do-spaces-driver.mjs";
 import { LocalDriver } from "./storage/drivers/local-driver.mjs";
 import { R2Driver } from "./storage/drivers/r2-driver.mjs";
 import { S3Driver } from "./storage/drivers/s3-driver.mjs";
+import { PipeableReactStream, StreamReactResponseOptions, streamReactResponse } from "./http/stream-react-response.mjs";
+import { CookieOptions, Response, ResponseStatus, SendBufferOptions, SendFileOptions } from "./http/response.mjs";
 import { Image, ImageFormat, ImageInput, ImageTransformOptions, WatermarkConfig } from "./image/image.mjs";
 import { FileNamingStrategy, ImageTransformCallback, ImageTransformConfig, PrefixConfig, PrefixOptions, SaveAsOptions, SaveOptions, UploadedFileImageOptions, UploadsConfigurations } from "./http/uploads-types.mjs";
 import { FileValidationOptions, UploadedFile, UploadedFileJson } from "./http/uploaded-file.mjs";
 import { Request } from "./http/request.mjs";
-import { CookieOptions, Response, ResponseStatus, SendBufferOptions, SendFileOptions } from "./http/response.mjs";
-import { DecodedAccessToken, HttpConfigurations, PartialMiddleware, RequestEvent, RequestLocals, RequestUser, ResponseEvent, ResponseSSEController, ResponseStreamController, ReturnedResponse } from "./http/types.mjs";
+import { CspConfig, DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives } from "./http/csp.mjs";
+import { HttpTracingConfig, TracingContext, TracingHooks, TracingPhaseInfo, TracingRequestEndInfo } from "./http/tracing/tracing.type.mjs";
+import { DecodedAccessToken, HttpConfigurations, PartialMiddleware, RequestEvent, RequestLocals, ResponseEvent, ResponseSSEController, ResponseStreamController, ReturnedResponse } from "./http/types.mjs";
 import { defaultHttpConfigurations, httpConfig } from "./http/config.mjs";
 import { createHttpApplication, stopHttpApplication } from "./http/createHttpApplication.mjs";
 import { RequestLog } from "./http/database/RequestLog.mjs";
@@ -29,7 +32,7 @@ import { logResponse, wrapResponseInDataKey } from "./http/events.mjs";
 import { HealthCheck, HealthStatus, health } from "./http/health.mjs";
 import { RequestController } from "./http/request-controller.mjs";
 import { UPLOADS_DEFAULTS, uploadsConfig } from "./http/uploads-config.mjs";
-import { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./http/errors/errors.mjs";
+import { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, RequestUserMovedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./http/errors/errors.mjs";
 import { CacheMiddlewareOptions } from "./http/middleware/cache-response-middleware.mjs";
 import { ConcurrencyLimitOptions } from "./http/middleware/concurrency-limit.middleware.mjs";
 import { IdempotencyOptions } from "./http/middleware/idempotency.middleware.mjs";
@@ -46,6 +49,8 @@ import { registerHttpPlugins } from "./http/plugins.mjs";
 import { assertConfiguredHttpPortIsFree, preflightConfiguredHttpPort, remedyLines, shouldPreflightHttpPort } from "./http/boot-port-preflight.mjs";
 import { PortInUseError, assertPortIsAvailable, isPortAvailable } from "./http/port-preflight.mjs";
 import { HttpReadyReport, getHttpReadyReport, resetHttpReadyReport, setHttpReadyReport } from "./http/ready-report.mjs";
+import { deriveTraceId, parseTraceparentTraceId } from "./http/tracing/trace-id.mjs";
+import { TracingContextSource, buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled, resetTracingConfigForTests, resolveTracingConfig } from "./http/tracing/tracing-dispatcher.mjs";
 import { RequestContextStore, requestContext, useCurrentUser, useRequest, useRequestStore } from "./http/context/request-context.mjs";
 import { requestMemo } from "./http/context/request-memo.mjs";
 import { LocalizedObject, getLocalized } from "./utils/get-localized.mjs";
@@ -161,7 +166,7 @@ import { WarlockConfigManager, isUnknownTsExtensionError, warlockConfigManager }
 import { env } from "@mongez/dotenv";
 import { colors } from "@mongez/copper";
 export * from "@mongez/localization";
-export { $registerUseCase, $unregisterUseCase, AccessConnector, AggregateExpressionInput, AggregateExpressions, AiConnector, AllRepositoryOptions, AppConfigurations, Application, BOOT_SIGNAL_ENV_KEY, BOOT_SIGNAL_VERSION, BadRequestError, BadSchemaUseCaseError, BaseConnector, type BenchmarkChannel, type BenchmarkConfigurations, type BenchmarkErrorResult, type BenchmarkOptions, BenchmarkProfiler, type BenchmarkProfilerOptions, type BenchmarkResult, BenchmarkSnapshots, type BenchmarkSnapshotsOptions, type BenchmarkStats, type BenchmarkSuccessResult, BootContext, BootListener, BootSignal, BootSignalType, BootValidator, CLICommand, type CLICommandAction, type CLICommandOption, type CLICommandOptions, type CLICommandPreload, type CLICommandSource, CacheConnector, type CacheMiddlewareOptions, CachedRepositoryOptions, type CapturedMail, CascadeAdapter, CascadeQueryBuilder, ChunkCallback, ClosableServer, CloudDriver, CloudStorageDriverContract, CloudStorageDriverOptions, CloudStorageFileData, type CommandActionData, type ConcurrencyLimitOptions, ConfigKey, ConfigKeyRegistry, ConfigName, ConfigRegistry, ConfigSpecialHandlers, ConflictError, Connector, ConnectorBuildContext, ConnectorBuildContribution, ConnectorBuildGenerateResult, ConnectorEsbuildPatch, ConnectorLifecyclePhase, ConnectorName, ConnectorPriority, ConnectorsManager, ConsoleChannel, ContainerTypes, CookieOptions, CursorPaginationOptions, CursorPaginationResult, DOSpacesDriver, DatabaseCacheDriver, type DatabaseCacheOptions, DatabaseConnector, DatabaseLog, DatabaseLogModel, DatabaseLogOptions, DecodedAccessToken, DefineResourceOptions, DeleteManyResult, EncryptionConfigurations, EncryptionPasswordConfigurations, Environment, EventSubscription, ExistsExceptCurrentIdRuleOptions, ExistsExceptCurrentUserRuleOptions, FastifyInstance, FileNamingStrategy, FileValidationOptions, FileValidator, FileVisibility, FilterFunction, FilterOperator, FilterOptions, FilterRule, FilterRules, ForbiddenError, GroupByFields, GroupedRoutesOptions, HealthCheck, HealthStatus, HeraldConnector, HttpConfigurations, HttpConnector, HttpContext, HttpError, HttpErrorCodes, HttpReadyReport, type IdempotencyOptions, Image, ImageFormat, ImageInput, ImageTransformCallback, ImageTransformConfig, ImageTransformOptions, type IpFilterOptions, ListOptions, LocalDriver, LocalStorageDriverOptions, LocalizedObject, LogConfigurations, LoggerConnector, MAIL_EVENTS, Mail, type MailAddress, type MailAttachment, type MailConfigurations, MailError, type MailErrorCode, type MailEvents, type MailMode, type MailOptions, type MailPriority, type MailResult, MailerConnector, type MailersConfig, type MaintenanceOptions, Middleware, MiddlewareResponse, MimeTypes, NoopChannel, type NormalizedMail, NotAcceptableError, NotAllowedError, NotificationsConnector, PaginationMode, PaginationResult, PartialMiddleware, PartialPick, Path, PipelineOptions, PortInUseError, PositionalHandlerSuspect, PrefixConfig, PrefixOptions, PresignedOptions, PresignedUploadOptions, PutDirectoryOptions, PutDirectoryResult, PutFromUrlOptions, PutOptions, QueryBuilderContract, Queue, R2Driver, R2StorageDriverOptions, type RateLimitOptions, RegisterConfiguredConnectorsOptions, RegisterResource, RegisteredUseCase, RepositoryAdapterContract, RepositoryConfigurations, RepositoryEvent, RepositoryManager, RepositoryOptions, RepositoryOptionsWithCursor, RepositoryOptionsWithPages, Request, RequestContextStore, RequestController, RequestControllerContract, RequestEvent, RequestHandler, RequestHandlerType, RequestHandlerValidation, RequestLocals, RequestLog, RequestMethod, RequestUser, type ResolvedCLICommandOption, Resource, ResourceArraySchema, ResourceCastType, ResourceConstructor, ResourceContract, ResourceFieldBuilder, ResourceFieldBuilderDateOutputOptions, ResourceFieldConfig, ResourceMethod, ResourceNotFoundError, ResourceOutputValueCastType, ResourceSchema, ResourceSelfReference, Response, ResponseBodyValue, ResponseEvent, ResponseSSEController, ResponseSchema, ResponseStatus, ResponseStreamController, Restful, RestfulMiddleware, ReturnedResponse, Route, RouteOptions, RouteRegistry, RouteResource, Router, RouterGroupCallback, RouterStacks, RuntimeStrategy, S3Driver, type SESConfigurations, type SMTPConfigurations, SafeFetchOptions, SafeFetchResult, SaveAsOptions, SaveMode, SaveOptions, ScopedStorage, ScopedStorageContract, SeedClock, SeedContext, SeedRecordRef, SeedResult, Seeder, SeederDependencyCycleError, SeederMetadata, SendBufferOptions, SendFileOptions, ServerError, ShutdownListener, SocketConnector, SocketOptions, Storage, StorageConfigurations, StorageConnector, StorageCopyEventPayload, StorageDriverConfig, StorageDriverContextStore, StorageDriverContract, StorageDriverName, StorageDriverRegistry, StorageDriverType, StorageError, StorageErrorOptions, StorageEventHandler, StorageEventPayload, StorageEventType, StorageFile, StorageFileData, StorageFileInfo, StorageManagerContract, StoragePutEventPayload, TemporaryTokenError, TemporaryTokenPayload, TemporaryTokenValidation, Track, TrackableModel, TypedAllRepositoryOptions, TypedRepositoryOptions, TypedRepositoryOptionsWithCursor, TypedRepositoryOptionsWithPages, UPLOADS_DEFAULTS, UnAuthorizedError, UniqueExceptCurrentIdRuleOptions, UniqueExceptCurrentUserRuleOptions, UnknownSeederDependencyError, UploadedFile, UploadedFileImageOptions, UploadedFileJson, UploadsConfigurations, UseCase, UseCaseAfterMiddleware, UseCaseBeforeMiddleware, UseCaseBroadcastChannel, UseCaseBroadcastEvent, UseCaseBroadcastOption, UseCaseConfigurations, UseCaseContext, UseCaseErrorResult, UseCaseEventsCallbacksMap, UseCaseGuard, UseCaseHandler, UseCaseOnExecutingContext, UseCaseResult, UseCaseRuntimeOptions, UseCaseWithSchema, ValidationConfiguration, WarlockConfig, WarlockConfigManager, WatermarkConfig, WhereOperator, addUseCaseHistory, anyMatch, app, appLog, appPath, assertConfiguredHttpPortIsFree, assertMailCount, assertMailSent, assertNoReservedConnectorNames, assertPortIsAvailable, assertUniqueConnectorNames, assetsUrl, bootstrap, broadcastUseCaseResult, buildIdempotencyCacheKey, cachePath, captureMail, clearPositionalHandlerSuspects, clearTestMailbox, closeAllMailers, closeMailer, closeServerWithTimeout, colors, command, config, configPath, configSpecialHandlers, connectorsManager, container, createHttpApplication, createRequestStore, decrypt, defaultHttpConfigurations, defineConfig, defineResource, describePositionalHandlerSuspect, displayEnvironmentMode, encrypt, ensureFatalIsVisible, env, environment, existsExceptCurrentIdRule, existsExceptCurrentUserRule, fetchLatestVersion, fileExtensionRule, fileRule, fileTypeRule, findMailsBySubject, findMailsTo, fireLifecycleEvent, forgetPositionalHandlerSuspects, generateMailId, getDefaultMailConfig, getHttpReadyReport, getHttpServer, getLastMail, getLocalized, getMailEventName, getMailMode, getMailboxSize, getMailer, getMailerConfig, getMimeType, getPoolStats, getSocketServer, getTestMailbox, getUseCase, getUseCaseHistory, getUseCases, globalEventsCallbacksMap, globalUseCasesEvents, hashBody, hashPassword, health, hmacHash, httpConfig, imageRule, increaseUseCaseFailedCalls, increaseUseCaseSuccessCalls, inspectHandlerSignature, ipMatches, isBootSignal, isDevelopmentMode, isNewerVersion, isPortAvailable, isPrivateOrReservedIp, isProductionMode, isTestMode, isUnknownTsExtensionError, isValidIdempotencyKey, listPositionalHandlerSuspects, loadS3, logResponse, logsPath, looksLikePositionalHandler, mailEvents, matchesDerivedRouteName, measure, middleware, normalizeRequestPath, normalizeRoutePath, parseSize, paths, preflightConfiguredHttpPort, promiseAllObject, publicPath, publicUrl, registerAppConfig, registerConfiguredConnectors, registerHttpPlugins, remedyLines, renderReact, renderReactMail, reportPositionalHandlerSuspects, requestContext, requestMemo, resetHttpReadyReport, resetMailConfig, resolveMailConfig, resolveWithinRoot, rootPath, routeNameMethodSuffix, router, runPipeline, safeFetchToBuffer, sanitizePath, seeder, sendBootSignal, sendMail, setBaseUrl, setConfig, setEnvironment, setHttpReadyReport, setLogConfigurations, setMailConfigurations, setMailMode, shouldPreflightHttpPort, sleep, sluggable, srcPath, startHttpServer, stopHttpApplication, storage, storageConfig, storageConfigurations, storageDriverContext, storagePath, t, tempPath, toJson, uniqueExceptCurrentIdRule, uniqueExceptCurrentUserRule, uploadedFileMetadataSchema, uploadsConfig, uploadsPath, uploadsUrl, url, useCase, useComputedModel, useComputedSlug, useCurrentUser, useHashedPassword, useRequest, useRequestStore, verifyMailer, verifyPassword, warlockConfigManager, warlockPath, wasMailSentTo, wasMailSentWithSubject, wrapResponseInDataKey };
+export { $registerUseCase, $unregisterUseCase, AccessConnector, AggregateExpressionInput, AggregateExpressions, AiConnector, AllRepositoryOptions, AppConfigurations, Application, BOOT_SIGNAL_ENV_KEY, BOOT_SIGNAL_VERSION, BadRequestError, BadSchemaUseCaseError, BaseConnector, type BenchmarkChannel, type BenchmarkConfigurations, type BenchmarkErrorResult, type BenchmarkOptions, BenchmarkProfiler, type BenchmarkProfilerOptions, type BenchmarkResult, BenchmarkSnapshots, type BenchmarkSnapshotsOptions, type BenchmarkStats, type BenchmarkSuccessResult, BootContext, BootListener, BootSignal, BootSignalType, BootValidator, CLICommand, type CLICommandAction, type CLICommandOption, type CLICommandOptions, type CLICommandPreload, type CLICommandSource, CacheConnector, type CacheMiddlewareOptions, CachedRepositoryOptions, type CapturedMail, CascadeAdapter, CascadeQueryBuilder, ChunkCallback, ClosableServer, CloudDriver, CloudStorageDriverContract, CloudStorageDriverOptions, CloudStorageFileData, type CommandActionData, type ConcurrencyLimitOptions, ConfigKey, ConfigKeyRegistry, ConfigName, ConfigRegistry, ConfigSpecialHandlers, ConflictError, Connector, ConnectorBuildContext, ConnectorBuildContribution, ConnectorBuildGenerateResult, ConnectorEsbuildPatch, ConnectorLifecyclePhase, ConnectorName, ConnectorPriority, ConnectorsManager, ConsoleChannel, ContainerTypes, CookieOptions, CspConfig, CursorPaginationOptions, CursorPaginationResult, DEFAULT_CSP_DIRECTIVES, DOSpacesDriver, DatabaseCacheDriver, type DatabaseCacheOptions, DatabaseConnector, DatabaseLog, DatabaseLogModel, DatabaseLogOptions, DecodedAccessToken, DefineResourceOptions, DeleteManyResult, EncryptionConfigurations, EncryptionPasswordConfigurations, Environment, EventSubscription, ExistsExceptCurrentIdRuleOptions, ExistsExceptCurrentUserRuleOptions, FastifyInstance, FileNamingStrategy, FileValidationOptions, FileValidator, FileVisibility, FilterFunction, FilterOperator, FilterOptions, FilterRule, FilterRules, ForbiddenError, GroupByFields, GroupedRoutesOptions, HealthCheck, HealthStatus, HeraldConnector, HttpConfigurations, HttpConnector, HttpContext, HttpError, HttpErrorCodes, HttpReadyReport, HttpTracingConfig, type IdempotencyOptions, Image, ImageFormat, ImageInput, ImageTransformCallback, ImageTransformConfig, ImageTransformOptions, InvalidCspDirectiveError, type IpFilterOptions, ListOptions, LocalDriver, LocalStorageDriverOptions, LocalizedObject, LogConfigurations, LoggerConnector, MAIL_EVENTS, Mail, type MailAddress, type MailAttachment, type MailConfigurations, MailError, type MailErrorCode, type MailEvents, type MailMode, type MailOptions, type MailPriority, type MailResult, MailerConnector, type MailersConfig, type MaintenanceOptions, Middleware, MiddlewareResponse, MimeTypes, NoopChannel, type NormalizedMail, NotAcceptableError, NotAllowedError, NotificationsConnector, PaginationMode, PaginationResult, PartialMiddleware, PartialPick, Path, PipeableReactStream, PipelineOptions, PortInUseError, PositionalHandlerSuspect, PrefixConfig, PrefixOptions, PresignedOptions, PresignedUploadOptions, PutDirectoryOptions, PutDirectoryResult, PutFromUrlOptions, PutOptions, QueryBuilderContract, Queue, R2Driver, R2StorageDriverOptions, type RateLimitOptions, RegisterConfiguredConnectorsOptions, RegisterResource, RegisteredUseCase, RepositoryAdapterContract, RepositoryConfigurations, RepositoryEvent, RepositoryManager, RepositoryOptions, RepositoryOptionsWithCursor, RepositoryOptionsWithPages, Request, RequestContextStore, RequestController, RequestControllerContract, RequestEvent, RequestHandler, RequestHandlerType, RequestHandlerValidation, RequestLocals, RequestLog, RequestMethod, RequestUserMovedError, type ResolvedCLICommandOption, Resource, ResourceArraySchema, ResourceCastType, ResourceConstructor, ResourceContract, ResourceFieldBuilder, ResourceFieldBuilderDateOutputOptions, ResourceFieldConfig, ResourceMethod, ResourceNotFoundError, ResourceOutputValueCastType, ResourceSchema, ResourceSelfReference, Response, ResponseBodyValue, ResponseEvent, ResponseSSEController, ResponseSchema, ResponseStatus, ResponseStreamController, Restful, RestfulMiddleware, ReturnedResponse, Route, RouteOptions, RouteRegistry, RouteResource, Router, RouterGroupCallback, RouterStacks, RuntimeStrategy, S3Driver, type SESConfigurations, type SMTPConfigurations, SafeFetchOptions, SafeFetchResult, SaveAsOptions, SaveMode, SaveOptions, ScopedStorage, ScopedStorageContract, SeedClock, SeedContext, SeedRecordRef, SeedResult, Seeder, SeederDependencyCycleError, SeederMetadata, SendBufferOptions, SendFileOptions, ServerError, ShutdownListener, SocketConnector, SocketOptions, Storage, StorageConfigurations, StorageConnector, StorageCopyEventPayload, StorageDriverConfig, StorageDriverContextStore, StorageDriverContract, StorageDriverName, StorageDriverRegistry, StorageDriverType, StorageError, StorageErrorOptions, StorageEventHandler, StorageEventPayload, StorageEventType, StorageFile, StorageFileData, StorageFileInfo, StorageManagerContract, StoragePutEventPayload, StreamReactResponseOptions, TemporaryTokenError, TemporaryTokenPayload, TemporaryTokenValidation, TracingContext, TracingContextSource, TracingHooks, TracingPhaseInfo, TracingRequestEndInfo, Track, TrackableModel, TypedAllRepositoryOptions, TypedRepositoryOptions, TypedRepositoryOptionsWithCursor, TypedRepositoryOptionsWithPages, UPLOADS_DEFAULTS, UnAuthorizedError, UniqueExceptCurrentIdRuleOptions, UniqueExceptCurrentUserRuleOptions, UnknownSeederDependencyError, UploadedFile, UploadedFileImageOptions, UploadedFileJson, UploadsConfigurations, UseCase, UseCaseAfterMiddleware, UseCaseBeforeMiddleware, UseCaseBroadcastChannel, UseCaseBroadcastEvent, UseCaseBroadcastOption, UseCaseConfigurations, UseCaseContext, UseCaseErrorResult, UseCaseEventsCallbacksMap, UseCaseGuard, UseCaseHandler, UseCaseOnExecutingContext, UseCaseResult, UseCaseRuntimeOptions, UseCaseWithSchema, ValidationConfiguration, WarlockConfig, WarlockConfigManager, WatermarkConfig, WhereOperator, addUseCaseHistory, anyMatch, app, appLog, appPath, applyCspHeader, assertConfiguredHttpPortIsFree, assertMailCount, assertMailSent, assertNoReservedConnectorNames, assertPortIsAvailable, assertUniqueConnectorNames, assetsUrl, bootstrap, broadcastUseCaseResult, buildCspHeaderValue, buildIdempotencyCacheKey, buildTracingContext, cachePath, captureMail, clearPositionalHandlerSuspects, clearTestMailbox, closeAllMailers, closeMailer, closeServerWithTimeout, colors, command, config, configPath, configSpecialHandlers, connectorsManager, container, createHttpApplication, createRequestStore, decrypt, defaultHttpConfigurations, defineConfig, defineResource, deriveTraceId, describePositionalHandlerSuspect, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, displayEnvironmentMode, encrypt, ensureFatalIsVisible, env, environment, existsExceptCurrentIdRule, existsExceptCurrentUserRule, fetchLatestVersion, fileExtensionRule, fileRule, fileTypeRule, findMailsBySubject, findMailsTo, fireLifecycleEvent, forgetPositionalHandlerSuspects, generateMailId, getDefaultMailConfig, getHttpReadyReport, getHttpServer, getLastMail, getLocalized, getMailEventName, getMailMode, getMailboxSize, getMailer, getMailerConfig, getMimeType, getPoolStats, getSocketServer, getTestMailbox, getUseCase, getUseCaseHistory, getUseCases, globalEventsCallbacksMap, globalUseCasesEvents, hashBody, hashPassword, health, hmacHash, httpConfig, imageRule, increaseUseCaseFailedCalls, increaseUseCaseSuccessCalls, inspectHandlerSignature, ipMatches, isBootSignal, isDevelopmentMode, isNewerVersion, isPortAvailable, isPrivateOrReservedIp, isProductionMode, isTestMode, isTracingEnabled, isUnknownTsExtensionError, isValidIdempotencyKey, listPositionalHandlerSuspects, loadS3, logResponse, logsPath, looksLikePositionalHandler, mailEvents, matchesDerivedRouteName, measure, mergeCspDirectives, middleware, normalizeRequestPath, normalizeRoutePath, parseSize, parseTraceparentTraceId, paths, preflightConfiguredHttpPort, promiseAllObject, publicPath, publicUrl, registerAppConfig, registerConfiguredConnectors, registerHttpPlugins, remedyLines, renderReact, renderReactMail, reportPositionalHandlerSuspects, requestContext, requestMemo, resetHttpReadyReport, resetMailConfig, resetTracingConfigForTests, resolveCspConfig, resolveMailConfig, resolveTracingConfig, resolveWithinRoot, rootPath, routeNameMethodSuffix, router, runPipeline, safeFetchToBuffer, sanitizePath, seeder, sendBootSignal, sendMail, serializeCspDirectives, setBaseUrl, setConfig, setEnvironment, setHttpReadyReport, setLogConfigurations, setMailConfigurations, setMailMode, shouldPreflightHttpPort, sleep, sluggable, srcPath, startHttpServer, stopHttpApplication, storage, storageConfig, storageConfigurations, storageDriverContext, storagePath, streamReactResponse, t, tempPath, toJson, uniqueExceptCurrentIdRule, uniqueExceptCurrentUserRule, uploadedFileMetadataSchema, uploadsConfig, uploadsPath, uploadsUrl, url, useCase, useComputedModel, useComputedSlug, useCurrentUser, useHashedPassword, useRequest, useRequestStore, validateCspConfigAtBoot, validateCspDirectives, verifyMailer, verifyPassword, warlockConfigManager, warlockPath, wasMailSentTo, wasMailSentWithSubject, wrapResponseInDataKey };
 import "./config/types.mjs";
 import "./http/request.mjs";
 import "./http/types.mjs";

package/esm/index.mjs

@@ -20,7 +20,10 @@ import { toJson } from "./utils/to-json.mjs";
 import { assetsUrl, publicUrl, setBaseUrl, uploadsUrl, url } from "./utils/urls.mjs";
 import { isNewerVersion } from "./utils/version-compare.mjs";
 import "./utils/index.mjs";
-import { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./http/errors/errors.mjs";
+import { DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives } from "./http/csp.mjs";
+import { BadRequestError, ConflictError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, RequestUserMovedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./http/errors/errors.mjs";
+import { deriveTraceId, parseTraceparentTraceId } from "./http/tracing/trace-id.mjs";
+import { buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled, resetTracingConfigForTests, resolveTracingConfig } from "./http/tracing/tracing-dispatcher.mjs";
 import { createRequestStore, t } from "./http/middleware/inject-request-context.mjs";
 import { defaultHttpConfigurations, httpConfig } from "./http/config.mjs";
 import { normalizeRoutePath } from "./router/normalize-route-path.mjs";
@@ -47,6 +50,7 @@ import { S3Driver } from "./storage/drivers/s3-driver.mjs";
 import { Storage, storage } from "./storage/storage.mjs";
 import "./storage/index.mjs";
 import { renderReact } from "./react/index.mjs";
+import { streamReactResponse } from "./http/stream-react-response.mjs";
 import { Response, ResponseStatus } from "./http/response.mjs";
 import { Image } from "./image/image.mjs";
 import "./image/index.mjs";
@@ -159,4 +163,4 @@ import { colors } from "@mongez/copper";
 
 export * from "@mongez/localization"
 
-export { $registerUseCase, $unregisterUseCase, AccessConnector, AiConnector, Application, BOOT_SIGNAL_ENV_KEY, BOOT_SIGNAL_VERSION, BadRequestError, BadSchemaUseCaseError, BaseConnector, BenchmarkProfiler, BenchmarkSnapshots, CLICommand, CacheConnector, CascadeAdapter, CascadeQueryBuilder, CloudDriver, ConfigSpecialHandlers, ConflictError, ConnectorLifecyclePhase, ConnectorPriority, ConnectorsManager, ConsoleChannel, DOSpacesDriver, DatabaseCacheDriver, DatabaseConnector, DatabaseLog, DatabaseLogModel, FileValidator, ForbiddenError, HeraldConnector, HttpConnector, HttpError, HttpErrorCodes, Image, LocalDriver, LoggerConnector, MAIL_EVENTS, Mail, MailError, MailerConnector, MimeTypes, NoopChannel, NotAcceptableError, NotAllowedError, NotificationsConnector, Path, PortInUseError, Queue, R2Driver, RegisterResource, RepositoryManager, Request, RequestController, RequestLog, Resource, ResourceFieldBuilder, ResourceNotFoundError, Response, ResponseStatus, Restful, RouteRegistry, Router, S3Driver, ScopedStorage, SeederDependencyCycleError, ServerError, SocketConnector, Storage, StorageConnector, StorageError, StorageFile, UPLOADS_DEFAULTS, UnAuthorizedError, UnknownSeederDependencyError, UploadedFile, WarlockConfigManager, addUseCaseHistory, anyMatch, app, appLog, appPath, assertConfiguredHttpPortIsFree, assertMailCount, assertMailSent, assertNoReservedConnectorNames, assertPortIsAvailable, assertUniqueConnectorNames, assetsUrl, bootstrap, broadcastUseCaseResult, buildIdempotencyCacheKey, cachePath, captureMail, clearPositionalHandlerSuspects, clearTestMailbox, closeAllMailers, closeMailer, closeServerWithTimeout, colors, command, config, configPath, configSpecialHandlers, connectorsManager, container, createHttpApplication, createRequestStore, decrypt, defaultHttpConfigurations, defineConfig, defineResource, describePositionalHandlerSuspect, displayEnvironmentMode, encrypt, ensureFatalIsVisible, env, environment, existsExceptCurrentIdRule, existsExceptCurrentUserRule, fetchLatestVersion, fileExtensionRule, fileRule, fileTypeRule, findMailsBySubject, findMailsTo, fireLifecycleEvent, forgetPositionalHandlerSuspects, generateMailId, getDefaultMailConfig, getHttpReadyReport, getHttpServer, getLastMail, getLocalized, getMailEventName, getMailMode, getMailboxSize, getMailer, getMailerConfig, getMimeType, getPoolStats, getSocketServer, getTestMailbox, getUseCase, getUseCaseHistory, getUseCases, globalEventsCallbacksMap, globalUseCasesEvents, hashBody, hashPassword, health, hmacHash, httpConfig, imageRule, increaseUseCaseFailedCalls, increaseUseCaseSuccessCalls, inspectHandlerSignature, ipMatches, isBootSignal, isDevelopmentMode, isNewerVersion, isPortAvailable, isPrivateOrReservedIp, isProductionMode, isTestMode, isUnknownTsExtensionError, isValidIdempotencyKey, listPositionalHandlerSuspects, loadS3, logResponse, logsPath, looksLikePositionalHandler, mailEvents, matchesDerivedRouteName, measure, middleware, normalizeRequestPath, normalizeRoutePath, parseSize, paths, preflightConfiguredHttpPort, promiseAllObject, publicPath, publicUrl, registerAppConfig, registerConfiguredConnectors, registerHttpPlugins, remedyLines, renderReact, renderReactMail, reportPositionalHandlerSuspects, requestContext, requestMemo, resetHttpReadyReport, resetMailConfig, resolveMailConfig, resolveWithinRoot, rootPath, routeNameMethodSuffix, router, runPipeline, safeFetchToBuffer, sanitizePath, seeder, sendBootSignal, sendMail, setBaseUrl, setConfig, setEnvironment, setHttpReadyReport, setLogConfigurations, setMailConfigurations, setMailMode, shouldPreflightHttpPort, sleep, sluggable, srcPath, startHttpServer, stopHttpApplication, storage, storageConfig, storageConfigurations, storageDriverContext, storagePath, t, tempPath, toJson, uniqueExceptCurrentIdRule, uniqueExceptCurrentUserRule, uploadedFileMetadataSchema, uploadsConfig, uploadsPath, uploadsUrl, url, useCase, useComputedModel, useComputedSlug, useCurrentUser, useHashedPassword, useRequest, useRequestStore, verifyMailer, verifyPassword, warlockConfigManager, warlockPath, wasMailSentTo, wasMailSentWithSubject, wrapResponseInDataKey };
+export { $registerUseCase, $unregisterUseCase, AccessConnector, AiConnector, Application, BOOT_SIGNAL_ENV_KEY, BOOT_SIGNAL_VERSION, BadRequestError, BadSchemaUseCaseError, BaseConnector, BenchmarkProfiler, BenchmarkSnapshots, CLICommand, CacheConnector, CascadeAdapter, CascadeQueryBuilder, CloudDriver, ConfigSpecialHandlers, ConflictError, ConnectorLifecyclePhase, ConnectorPriority, ConnectorsManager, ConsoleChannel, DEFAULT_CSP_DIRECTIVES, DOSpacesDriver, DatabaseCacheDriver, DatabaseConnector, DatabaseLog, DatabaseLogModel, FileValidator, ForbiddenError, HeraldConnector, HttpConnector, HttpError, HttpErrorCodes, Image, InvalidCspDirectiveError, LocalDriver, LoggerConnector, MAIL_EVENTS, Mail, MailError, MailerConnector, MimeTypes, NoopChannel, NotAcceptableError, NotAllowedError, NotificationsConnector, Path, PortInUseError, Queue, R2Driver, RegisterResource, RepositoryManager, Request, RequestController, RequestLog, RequestUserMovedError, Resource, ResourceFieldBuilder, ResourceNotFoundError, Response, ResponseStatus, Restful, RouteRegistry, Router, S3Driver, ScopedStorage, SeederDependencyCycleError, ServerError, SocketConnector, Storage, StorageConnector, StorageError, StorageFile, UPLOADS_DEFAULTS, UnAuthorizedError, UnknownSeederDependencyError, UploadedFile, WarlockConfigManager, addUseCaseHistory, anyMatch, app, appLog, appPath, applyCspHeader, assertConfiguredHttpPortIsFree, assertMailCount, assertMailSent, assertNoReservedConnectorNames, assertPortIsAvailable, assertUniqueConnectorNames, assetsUrl, bootstrap, broadcastUseCaseResult, buildCspHeaderValue, buildIdempotencyCacheKey, buildTracingContext, cachePath, captureMail, clearPositionalHandlerSuspects, clearTestMailbox, closeAllMailers, closeMailer, closeServerWithTimeout, colors, command, config, configPath, configSpecialHandlers, connectorsManager, container, createHttpApplication, createRequestStore, decrypt, defaultHttpConfigurations, defineConfig, defineResource, deriveTraceId, describePositionalHandlerSuspect, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, displayEnvironmentMode, encrypt, ensureFatalIsVisible, env, environment, existsExceptCurrentIdRule, existsExceptCurrentUserRule, fetchLatestVersion, fileExtensionRule, fileRule, fileTypeRule, findMailsBySubject, findMailsTo, fireLifecycleEvent, forgetPositionalHandlerSuspects, generateMailId, getDefaultMailConfig, getHttpReadyReport, getHttpServer, getLastMail, getLocalized, getMailEventName, getMailMode, getMailboxSize, getMailer, getMailerConfig, getMimeType, getPoolStats, getSocketServer, getTestMailbox, getUseCase, getUseCaseHistory, getUseCases, globalEventsCallbacksMap, globalUseCasesEvents, hashBody, hashPassword, health, hmacHash, httpConfig, imageRule, increaseUseCaseFailedCalls, increaseUseCaseSuccessCalls, inspectHandlerSignature, ipMatches, isBootSignal, isDevelopmentMode, isNewerVersion, isPortAvailable, isPrivateOrReservedIp, isProductionMode, isTestMode, isTracingEnabled, isUnknownTsExtensionError, isValidIdempotencyKey, listPositionalHandlerSuspects, loadS3, logResponse, logsPath, looksLikePositionalHandler, mailEvents, matchesDerivedRouteName, measure, mergeCspDirectives, middleware, normalizeRequestPath, normalizeRoutePath, parseSize, parseTraceparentTraceId, paths, preflightConfiguredHttpPort, promiseAllObject, publicPath, publicUrl, registerAppConfig, registerConfiguredConnectors, registerHttpPlugins, remedyLines, renderReact, renderReactMail, reportPositionalHandlerSuspects, requestContext, requestMemo, resetHttpReadyReport, resetMailConfig, resetTracingConfigForTests, resolveCspConfig, resolveMailConfig, resolveTracingConfig, resolveWithinRoot, rootPath, routeNameMethodSuffix, router, runPipeline, safeFetchToBuffer, sanitizePath, seeder, sendBootSignal, sendMail, serializeCspDirectives, setBaseUrl, setConfig, setEnvironment, setHttpReadyReport, setLogConfigurations, setMailConfigurations, setMailMode, shouldPreflightHttpPort, sleep, sluggable, srcPath, startHttpServer, stopHttpApplication, storage, storageConfig, storageConfigurations, storageDriverContext, storagePath, streamReactResponse, t, tempPath, toJson, uniqueExceptCurrentIdRule, uniqueExceptCurrentUserRule, uploadedFileMetadataSchema, uploadsConfig, uploadsPath, uploadsUrl, url, useCase, useComputedModel, useComputedSlug, useCurrentUser, useHashedPassword, useRequest, useRequestStore, validateCspConfigAtBoot, validateCspDirectives, verifyMailer, verifyPassword, warlockConfigManager, warlockPath, wasMailSentTo, wasMailSentWithSubject, wrapResponseInDataKey };

package/esm/production/esbuild-preflight.mjs

@@ -0,0 +1,47 @@
+import esbuild from "esbuild";
+
+//#region ../core/src/production/esbuild-preflight.ts
+/**
+* The exact substring esbuild's own loader throws when the platform-specific
+* binary package (e.g. `@esbuild/win32-x64`) never got installed. This is
+* the signature pnpm's build-script approval gate leaves behind: it blocks
+* esbuild's postinstall script, so the binary is never linked into place,
+* and any later call into esbuild dies with this message instead of a
+* project-shaped one.
+*
+* Source: `pkgAndSubpathForCurrentPlatform` in esbuild's `lib/main.js`.
+*/
+const UNLINKED_BINARY_SIGNATURE = "could not be found, and is needed by esbuild";
+/**
+* Fail fast, before bundling, when esbuild's native binary is not linked.
+*
+* Runs a single trivial `transformSync` call — the cheapest operation that
+* forces esbuild to resolve its platform binary — so it adds no measurable
+* delay to `warlock build`. Only called from the production build path;
+* never from `warlock dev`.
+*
+* A healthy esbuild install is a no-op. A binary genuinely missing because
+* pnpm blocked its postinstall script is turned into a message that names
+* the cause and the fix. Any other failure (a real syntax error, a platform
+* mismatch, …) is rethrown unchanged — this preflight only owns the one
+* known failure mode.
+*/
+function assertEsbuildBinaryIsLinked() {
+	try {
+		esbuild.transformSync("", { loader: "js" });
+	} catch (error) {
+		if (isUnlinkedBinaryError(error)) throw new Error("esbuild's native binary is not installed for this platform, so `warlock build` cannot bundle.\n\nThis usually happens when pnpm's build-script approval gate blocked esbuild's postinstall script, so the platform binary was never linked. Fix it with:\n\n  pnpm approve-builds\n\nthen reinstall, or reinstall dependencies with build scripts enabled if esbuild was excluded on purpose.");
+		throw error;
+	}
+}
+/**
+* Narrow an unknown thrown value down to esbuild's known "binary not
+* linked" failure, identified by the fixed substring esbuild itself throws.
+*/
+function isUnlinkedBinaryError(error) {
+	return error instanceof Error && error.message.includes(UNLINKED_BINARY_SIGNATURE);
+}
+
+//#endregion
+export { assertEsbuildBinaryIsLinked };
+//# sourceMappingURL=esbuild-preflight.mjs.map

package/esm/production/esbuild-preflight.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"esbuild-preflight.mjs","names":[],"sources":["../../../../../../../core/src/production/esbuild-preflight.ts"],"sourcesContent":["import esbuild from \"esbuild\";\n\n/**\n * The exact substring esbuild's own loader throws when the platform-specific\n * binary package (e.g. `@esbuild/win32-x64`) never got installed. This is\n * the signature pnpm's build-script approval gate leaves behind: it blocks\n * esbuild's postinstall script, so the binary is never linked into place,\n * and any later call into esbuild dies with this message instead of a\n * project-shaped one.\n *\n * Source: `pkgAndSubpathForCurrentPlatform` in esbuild's `lib/main.js`.\n */\nconst UNLINKED_BINARY_SIGNATURE = \"could not be found, and is needed by esbuild\";\n\n/**\n * Fail fast, before bundling, when esbuild's native binary is not linked.\n *\n * Runs a single trivial `transformSync` call — the cheapest operation that\n * forces esbuild to resolve its platform binary — so it adds no measurable\n * delay to `warlock build`. Only called from the production build path;\n * never from `warlock dev`.\n *\n * A healthy esbuild install is a no-op. A binary genuinely missing because\n * pnpm blocked its postinstall script is turned into a message that names\n * the cause and the fix. Any other failure (a real syntax error, a platform\n * mismatch, …) is rethrown unchanged — this preflight only owns the one\n * known failure mode.\n */\nexport function assertEsbuildBinaryIsLinked(): void {\n  try {\n    esbuild.transformSync(\"\", { loader: \"js\" });\n  } catch (error) {\n    if (isUnlinkedBinaryError(error)) {\n      throw new Error(\n        \"esbuild's native binary is not installed for this platform, so \" +\n          \"`warlock build` cannot bundle.\\n\\n\" +\n          \"This usually happens when pnpm's build-script approval gate \" +\n          \"blocked esbuild's postinstall script, so the platform binary \" +\n          \"was never linked. Fix it with:\\n\\n\" +\n          \"  pnpm approve-builds\\n\\n\" +\n          \"then reinstall, or reinstall dependencies with build scripts \" +\n          \"enabled if esbuild was excluded on purpose.\",\n      );\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Narrow an unknown thrown value down to esbuild's known \"binary not\n * linked\" failure, identified by the fixed substring esbuild itself throws.\n */\nfunction isUnlinkedBinaryError(error: unknown): boolean {\n  return error instanceof Error && error.message.includes(UNLINKED_BINARY_SIGNATURE);\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,MAAM,4BAA4B;;;;;;;;;;;;;;;AAgBlC,SAAgB,8BAAoC;CAClD,IAAI;EACF,QAAQ,cAAc,IAAI,EAAE,QAAQ,KAAK,CAAC;CAC5C,SAAS,OAAO;EACd,IAAI,sBAAsB,KAAK,GAC7B,MAAM,IAAI,MACR,+XAQF;EAGF,MAAM;CACR;AACF;;;;;AAMA,SAAS,sBAAsB,OAAyB;CACtD,OAAO,iBAAiB,SAAS,MAAM,QAAQ,SAAS,yBAAyB;AACnF"}

package/esm/production/production-builder.mjs

@@ -9,6 +9,7 @@ import { bundleFrameworkDependencies } from "./bundle-framework-dependencies.mjs
 import { dedupe, runEmitContributions, runGenerateContributions } from "./build-contributions.mjs";
 import { writeDistBuildManifestAsync } from "./dist-build-manifest.mjs";
 import { nativeNodeModulesPlugin } from "./esbuild-plugins.mjs";
+import { assertEsbuildBinaryIsLinked } from "./esbuild-preflight.mjs";
 import { commitDistAsync, createTempOutputDir, rollbackDistAsync, stageDistAsync } from "./promote-dist.mjs";
 import { resolveBuildConfig } from "./resolve-build-config.mjs";
 import { tsconfigPathAliases } from "./tsconfig-path-aliases.mjs";
@@ -116,6 +117,7 @@ var ProductionBuilder = class {
 	*/
 	async build() {
 		console.log(colors.cyan("Building for production...\n"));
+		assertEsbuildBinaryIsLinked();
 		await this.initializeOptions();
 		const finalOutDir = this.options.outdir;
 		const tempOutDir = createTempOutputDir(finalOutDir);
@@ -419,21 +421,21 @@ bootstrap();
 		const singleBundle = this.options.singleBundle === true;
 		const esmShim = this.options.esmShim !== false;
 		const userBanner = this.options.banner;
-		const strippable = this.options;
-		delete strippable.outFile;
-		delete strippable.entryPath;
-		delete this.options.singleBundle;
-		delete this.options.esmShim;
-		delete this.options.banner;
+		const esbuildOptions = { ...this.options };
+		delete esbuildOptions.outFile;
+		delete esbuildOptions.entryPath;
+		delete esbuildOptions.singleBundle;
+		delete esbuildOptions.esmShim;
+		delete esbuildOptions.banner;
 		await ensureDirectoryAsync(writeOutDir);
 		const alias = this.buildAliasMapFromTsconfig();
-		const perEdgeExternals = !singleBundle && this.options.packages === void 0;
-		const isEsm = (this.options.format ?? "esm") === "esm";
+		const perEdgeExternals = !singleBundle && esbuildOptions.packages === void 0;
+		const isEsm = (esbuildOptions.format ?? "esm") === "esm";
 		const banner = mergeBanner(userBanner, esmShim && isEsm ? ESM_INTEROP_SHIM : void 0);
 		const { define: contributedDefine, external: contributedExternal, loader: contributedLoader, ...contributedOptions } = this.contributedEsbuild;
-		const userDefine = this.options.define;
-		const userExternal = this.options.external;
-		const userLoader = this.options.loader;
+		const userDefine = esbuildOptions.define;
+		const userExternal = esbuildOptions.external;
+		const userLoader = esbuildOptions.loader;
 		const define = contributedDefine || userDefine ? {
 			...contributedDefine,
 			...userDefine
@@ -451,8 +453,8 @@ bootstrap();
 				bundle: true,
 				splitting: !singleBundle,
 				packages: singleBundle || perEdgeExternals ? "bundle" : "external",
-				minify: this.options.minify,
-				sourcemap: this.options.sourcemap === true ? "linked" : this.options.sourcemap,
+				minify: esbuildOptions.minify,
+				sourcemap: esbuildOptions.sourcemap === true ? "linked" : esbuildOptions.sourcemap,
 				format: "esm",
 				target: ["node22"],
 				entryNames: entryName,
@@ -466,7 +468,7 @@ bootstrap();
 					})] : []
 				],
 				...contributedOptions,
-				...this.options,
+				...esbuildOptions,
 				outdir: writeOutDir,
 				...define ? { define } : {},
 				...external ? { external } : {},
@@ -511,7 +513,9 @@ bootstrap();
 		const baseUrl = path.resolve(process.cwd(), tsconfigManager.baseUrl);
 		for (const [from, to] of Object.entries(tsconfigManager.aliases)) {
 			if (from.endsWith("/*") || !Array.isArray(to) || to.length === 0) continue;
-			alias[from] = path.resolve(baseUrl, to[0]);
+			const target = to[0];
+			if (target === void 0) continue;
+			alias[from] = path.resolve(baseUrl, target);
 		}
 		return alias;
 	}