@warlock.js/core 5.16.0 → 5.17.0

package/esm/http/csrf-default-guard.mjs

@@ -0,0 +1,156 @@
+import { LOCALE_COOKIE_NAME, LOCALE_PREFERENCE_COOKIE_NAME } from "../config/locale-configuration.mjs";
+import { HttpErrorCodes } from "./error-codes.mjs";
+import { resolveCsrfOriginVerdict } from "./csrf-origin-policy.mjs";
+
+//#region ../core/src/http/csrf-default-guard.ts
+/**
+* The DEFAULT core CSRF-Origin guard — SECURITY, card 8a752ab2 (5.17), lead
+* ruling from Aria (`releases/v5.17-web-readiness-audit.md` §3.1, quoted):
+*
+* > "Scope the default guard to unsafe browser requests carrying a
+* > non-locale credential-looking cookie (fail closed on unknown names), at
+* > an early core/auth HTTP seam before app handlers; give explicit,
+* > narrowly scoped route-level exemptions for third-party callbacks and
+* > machine-to-machine routes, documented as dangerous. Reuse current
+* > same-origin/allowedOrigins policy, trustProxy-aware own origin, and fail
+* > closed on missing Origin/Referer where in scope."
+*
+* Before this guard, the CSRF Origin check (`csrf-origin-policy.ts`, moved
+* here from `@warlock.js/auth` in this same change) only ran inside
+* `authMiddleware("cookie:*")` — a cookie-authenticated write reaching any
+* OTHER path (an app-owned optional-auth pattern reading its own `token`
+* cookie without ever calling `authMiddleware`) was never checked at all.
+*
+* This guard closes that gap at the earliest seam common to EVERY request —
+* production (`Router.scan()`) and the dev wildcard dispatcher both funnel
+* into `Router["handleRoute"]` → `request.execute()` →
+* `createRequestStore()` (`./middleware/inject-request-context.ts`), which is
+* where this is wired, BEFORE `request.runMiddleware()` runs the route's own
+* middleware (so it applies with or without `authMiddleware` on the route)
+* and before any app handler. It lives in `@warlock.js/core`, not
+* `@warlock.js/auth`, because `core` — not `auth` — is a dependency of every
+* Warlock app, so this is the only seam that reaches an app that never
+* installs `@warlock.js/auth` at all.
+*
+* Scope (mirrors `web`'s page-cache Cookie-header bypass rule,
+* `web/src/server/page-cache-cookie-bypass.ts`, card ad861076 — same
+* fail-closed strict-parse posture, independently reimplemented here because
+* `core` cannot depend on `web`, the dependency runs the other way):
+* - method is POST/PUT/PATCH/DELETE, AND
+* - the `Cookie` header carries any cookie other than the framework's own
+*   `locale` cookies (legacy plus the browser preference; a header that fails to parse cleanly counts as
+*   carrying one — fail closed), AND
+* - the route is not exempted via `{ csrf: false }` (`RouteOptions.csrf`,
+*   `../router/types.ts`) — a narrow, per-route, explicitly "dangerous" opt
+*   out for third-party callbacks and machine-to-machine routes.
+*
+* A header-only API request (`Authorization: Bearer …`, no `Cookie` header
+* at all) never reaches the cookie check above and is entirely unaffected.
+*/
+/** HTTP methods the default CSRF guard is scoped to — every unsafe method. */
+const UNSAFE_METHODS = new Set([
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+/**
+* Strictly parse a raw `Cookie` request header into a set of cookie names, or
+* `undefined` when the header does not parse cleanly.
+*
+* Deliberately NOT a lenient cookie parser that silently drops malformed
+* pairs and returns whatever it could salvage: a header this function cannot
+* fully account for must read as "unknown cookies present", never as "the
+* pairs we understood, minus the ones we didn't" — dropping a pair is how a
+* malformed header could otherwise be misread as carrying only the locale
+* cookie (or none) and wrongly skip the guard. Mirrors
+* `web/src/server/page-cache-cookie-bypass.ts`'s `parseCookieHeaderStrict`.
+*
+* Fails (`undefined`) on:
+* - an empty or whitespace-only header;
+* - any empty segment between/around `;`;
+* - any segment with no `=`, or an empty name.
+*/
+function parseCookieNamesStrict(rawHeader) {
+	if (rawHeader.trim() === "") return void 0;
+	const names = /* @__PURE__ */ new Set();
+	for (const segment of rawHeader.split(";")) {
+		const pair = segment.trim();
+		if (pair === "") return void 0;
+		const separatorIndex = pair.indexOf("=");
+		if (separatorIndex <= 0) return void 0;
+		const name = pair.slice(0, separatorIndex).trim();
+		if (name === "") return void 0;
+		names.add(name);
+	}
+	return names;
+}
+/**
+* Whether the request carries a `Cookie` header naming anything other than
+* the framework's locale cookies.
+*
+* - No `Cookie` header at all ⇒ `false` — nothing to guard on.
+* - A header that fails to parse cleanly ⇒ `true` — fails CLOSED.
+* - A header whose parsed names are a non-empty set equal to exactly
+*   `{locale}` ⇒ `false` — the one exemption.
+* - Anything else (any other cookie name, alone or alongside `locale`) ⇒ `true`.
+*/
+function carriesNonLocaleCookie(request) {
+	const rawCookieHeader = request.header("cookie", void 0);
+	if (rawCookieHeader === void 0 || rawCookieHeader === null) return false;
+	if (typeof rawCookieHeader !== "string") return true;
+	const names = parseCookieNamesStrict(rawCookieHeader);
+	if (names === void 0 || names.size === 0) return true;
+	for (const name of names) if (name !== "locale" && name !== "warlock.locale-preference") return true;
+	return false;
+}
+/**
+* Whether the matched route opted out of the default CSRF guard via
+* `{ csrf: false }` (`RouteOptions.csrf`). Any other value — including
+* `undefined` — leaves the route in scope.
+*/
+function isCsrfExempt(request) {
+	return request.route?.csrf === false;
+}
+/**
+* Whether the current request is in scope for the default core CSRF-Origin
+* guard at all.
+*/
+function requiresDefaultCsrfGuard(request) {
+	if (!UNSAFE_METHODS.has(request.method.toUpperCase())) return false;
+	if (isCsrfExempt(request)) return false;
+	return carriesNonLocaleCookie(request);
+}
+/**
+* Run the default core CSRF-Origin guard for the current request.
+*
+* Returns `undefined` when the request is out of scope or passes the
+* Origin/Referer check — the caller continues into route middleware and the
+* handler as normal. Returns the 403 {@link Response} when the guard refuses
+* the request; the caller must return that value immediately, the same
+* short-circuit contract every other middleware in the chain follows.
+*
+* Uses the SAME translated message and client-visible error code
+* `authMiddleware("cookie:*")`'s own CSRF-Origin check uses
+* (`auth.errors.csrfOriginMismatch`, `HttpErrorCodes.CsrfOriginMismatch` /
+* `AuthErrorCodes.CsrfOriginMismatch`, both `"EC006"`) — one message, one
+* error code, regardless of which seam caught the request. Logs exactly once
+* per rejection here; a route that also carries `authMiddleware("cookie:*")`
+* never reaches that middleware's own check for a request THIS guard already
+* rejected, because a guard rejection short-circuits `runMiddleware()`
+* entirely — so a rejected request is never logged twice.
+*/
+async function runDefaultCsrfGuard(request, response, translate, logRejection) {
+	if (!requiresDefaultCsrfGuard(request)) return void 0;
+	const verdict = resolveCsrfOriginVerdict(request);
+	if (verdict.allowed) return void 0;
+	logRejection(verdict.reason);
+	return response.forbidden({
+		error: translate("auth.errors.csrfOriginMismatch"),
+		errorCode: "EC006"
+	});
+}
+
+//#endregion
+export { requiresDefaultCsrfGuard, runDefaultCsrfGuard };
+//# sourceMappingURL=csrf-default-guard.mjs.map

package/esm/http/csrf-default-guard.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-default-guard.mjs","names":[],"sources":["../../../../../../../core/src/http/csrf-default-guard.ts"],"sourcesContent":["/**\n * The DEFAULT core CSRF-Origin guard — SECURITY, card 8a752ab2 (5.17), lead\n * ruling from Aria (`releases/v5.17-web-readiness-audit.md` §3.1, quoted):\n *\n * > \"Scope the default guard to unsafe browser requests carrying a\n * > non-locale credential-looking cookie (fail closed on unknown names), at\n * > an early core/auth HTTP seam before app handlers; give explicit,\n * > narrowly scoped route-level exemptions for third-party callbacks and\n * > machine-to-machine routes, documented as dangerous. Reuse current\n * > same-origin/allowedOrigins policy, trustProxy-aware own origin, and fail\n * > closed on missing Origin/Referer where in scope.\"\n *\n * Before this guard, the CSRF Origin check (`csrf-origin-policy.ts`, moved\n * here from `@warlock.js/auth` in this same change) only ran inside\n * `authMiddleware(\"cookie:*\")` — a cookie-authenticated write reaching any\n * OTHER path (an app-owned optional-auth pattern reading its own `token`\n * cookie without ever calling `authMiddleware`) was never checked at all.\n *\n * This guard closes that gap at the earliest seam common to EVERY request —\n * production (`Router.scan()`) and the dev wildcard dispatcher both funnel\n * into `Router[\"handleRoute\"]` → `request.execute()` →\n * `createRequestStore()` (`./middleware/inject-request-context.ts`), which is\n * where this is wired, BEFORE `request.runMiddleware()` runs the route's own\n * middleware (so it applies with or without `authMiddleware` on the route)\n * and before any app handler. It lives in `@warlock.js/core`, not\n * `@warlock.js/auth`, because `core` — not `auth` — is a dependency of every\n * Warlock app, so this is the only seam that reaches an app that never\n * installs `@warlock.js/auth` at all.\n *\n * Scope (mirrors `web`'s page-cache Cookie-header bypass rule,\n * `web/src/server/page-cache-cookie-bypass.ts`, card ad861076 — same\n * fail-closed strict-parse posture, independently reimplemented here because\n * `core` cannot depend on `web`, the dependency runs the other way):\n * - method is POST/PUT/PATCH/DELETE, AND\n * - the `Cookie` header carries any cookie other than the framework's own\n *   `locale` cookies (legacy plus the browser preference; a header that fails to parse cleanly counts as\n *   carrying one — fail closed), AND\n * - the route is not exempted via `{ csrf: false }` (`RouteOptions.csrf`,\n *   `../router/types.ts`) — a narrow, per-route, explicitly \"dangerous\" opt\n *   out for third-party callbacks and machine-to-machine routes.\n *\n * A header-only API request (`Authorization: Bearer …`, no `Cookie` header\n * at all) never reaches the cookie check above and is entirely unaffected.\n */\nimport { LOCALE_COOKIE_NAME, LOCALE_PREFERENCE_COOKIE_NAME } from \"../config/locale-configuration\";\nimport { HttpErrorCodes } from \"./error-codes\";\nimport { resolveCsrfOriginVerdict } from \"./csrf-origin-policy\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/** HTTP methods the default CSRF guard is scoped to — every unsafe method. */\nconst UNSAFE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Strictly parse a raw `Cookie` request header into a set of cookie names, or\n * `undefined` when the header does not parse cleanly.\n *\n * Deliberately NOT a lenient cookie parser that silently drops malformed\n * pairs and returns whatever it could salvage: a header this function cannot\n * fully account for must read as \"unknown cookies present\", never as \"the\n * pairs we understood, minus the ones we didn't\" — dropping a pair is how a\n * malformed header could otherwise be misread as carrying only the locale\n * cookie (or none) and wrongly skip the guard. Mirrors\n * `web/src/server/page-cache-cookie-bypass.ts`'s `parseCookieHeaderStrict`.\n *\n * Fails (`undefined`) on:\n * - an empty or whitespace-only header;\n * - any empty segment between/around `;`;\n * - any segment with no `=`, or an empty name.\n */\nfunction parseCookieNamesStrict(rawHeader: string): Set<string> | undefined {\n  if (rawHeader.trim() === \"\") return undefined;\n\n  const names = new Set<string>();\n\n  for (const segment of rawHeader.split(\";\")) {\n    const pair = segment.trim();\n\n    if (pair === \"\") return undefined;\n\n    const separatorIndex = pair.indexOf(\"=\");\n\n    if (separatorIndex <= 0) return undefined;\n\n    const name = pair.slice(0, separatorIndex).trim();\n\n    if (name === \"\") return undefined;\n\n    names.add(name);\n  }\n\n  return names;\n}\n\n/**\n * Whether the request carries a `Cookie` header naming anything other than\n * the framework's locale cookies.\n *\n * - No `Cookie` header at all ⇒ `false` — nothing to guard on.\n * - A header that fails to parse cleanly ⇒ `true` — fails CLOSED.\n * - A header whose parsed names are a non-empty set equal to exactly\n *   `{locale}` ⇒ `false` — the one exemption.\n * - Anything else (any other cookie name, alone or alongside `locale`) ⇒ `true`.\n */\nfunction carriesNonLocaleCookie(request: Request): boolean {\n  const rawCookieHeader = request.header(\"cookie\", undefined);\n\n  // Only an ABSENT header is cookie-free. A present header in any other\n  // shape (an array from a duplicated Cookie header) fails closed.\n  if (rawCookieHeader === undefined || rawCookieHeader === null) return false;\n\n  if (typeof rawCookieHeader !== \"string\") return true;\n\n  const names = parseCookieNamesStrict(rawCookieHeader);\n\n  if (names === undefined || names.size === 0) return true;\n\n  for (const name of names) {\n    if (name !== LOCALE_COOKIE_NAME && name !== LOCALE_PREFERENCE_COOKIE_NAME) return true;\n  }\n\n  return false;\n}\n\n/**\n * Whether the matched route opted out of the default CSRF guard via\n * `{ csrf: false }` (`RouteOptions.csrf`). Any other value — including\n * `undefined` — leaves the route in scope.\n */\nfunction isCsrfExempt(request: Request): boolean {\n  return request.route?.csrf === false;\n}\n\n/**\n * Whether the current request is in scope for the default core CSRF-Origin\n * guard at all.\n */\nexport function requiresDefaultCsrfGuard(request: Request): boolean {\n  if (!UNSAFE_METHODS.has(request.method.toUpperCase())) return false;\n\n  if (isCsrfExempt(request)) return false;\n\n  return carriesNonLocaleCookie(request);\n}\n\n/**\n * Run the default core CSRF-Origin guard for the current request.\n *\n * Returns `undefined` when the request is out of scope or passes the\n * Origin/Referer check — the caller continues into route middleware and the\n * handler as normal. Returns the 403 {@link Response} when the guard refuses\n * the request; the caller must return that value immediately, the same\n * short-circuit contract every other middleware in the chain follows.\n *\n * Uses the SAME translated message and client-visible error code\n * `authMiddleware(\"cookie:*\")`'s own CSRF-Origin check uses\n * (`auth.errors.csrfOriginMismatch`, `HttpErrorCodes.CsrfOriginMismatch` /\n * `AuthErrorCodes.CsrfOriginMismatch`, both `\"EC006\"`) — one message, one\n * error code, regardless of which seam caught the request. Logs exactly once\n * per rejection here; a route that also carries `authMiddleware(\"cookie:*\")`\n * never reaches that middleware's own check for a request THIS guard already\n * rejected, because a guard rejection short-circuits `runMiddleware()`\n * entirely — so a rejected request is never logged twice.\n */\nexport async function runDefaultCsrfGuard(\n  request: Request,\n  response: Response,\n  translate: (key: string) => string,\n  logRejection: (reason: string) => void,\n): Promise<Response | undefined> {\n  if (!requiresDefaultCsrfGuard(request)) return undefined;\n\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (verdict.allowed) return undefined;\n\n  logRejection(verdict.reason);\n\n  return response.forbidden({\n    error: translate(\"auth.errors.csrfOriginMismatch\"),\n    errorCode: HttpErrorCodes.CsrfOriginMismatch,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAM,iBAAiB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBjE,SAAS,uBAAuB,WAA4C;CAC1E,IAAI,UAAU,KAAK,MAAM,IAAI,OAAO;CAEpC,MAAM,wBAAQ,IAAI,IAAY;CAE9B,KAAK,MAAM,WAAW,UAAU,MAAM,GAAG,GAAG;EAC1C,MAAM,OAAO,QAAQ,KAAK;EAE1B,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,iBAAiB,KAAK,QAAQ,GAAG;EAEvC,IAAI,kBAAkB,GAAG,OAAO;EAEhC,MAAM,OAAO,KAAK,MAAM,GAAG,cAAc,CAAC,CAAC,KAAK;EAEhD,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,IAAI,IAAI;CAChB;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAS,uBAAuB,SAA2B;CACzD,MAAM,kBAAkB,QAAQ,OAAO,UAAU,MAAS;CAI1D,IAAI,oBAAoB,UAAa,oBAAoB,MAAM,OAAO;CAEtE,IAAI,OAAO,oBAAoB,UAAU,OAAO;CAEhD,MAAM,QAAQ,uBAAuB,eAAe;CAEpD,IAAI,UAAU,UAAa,MAAM,SAAS,GAAG,OAAO;CAEpD,KAAK,MAAM,QAAQ,OACjB,IAAI,qBAA+B,sCAAwC,OAAO;CAGpF,OAAO;AACT;;;;;;AAOA,SAAS,aAAa,SAA2B;CAC/C,OAAO,QAAQ,OAAO,SAAS;AACjC;;;;;AAMA,SAAgB,yBAAyB,SAA2B;CAClE,IAAI,CAAC,eAAe,IAAI,QAAQ,OAAO,YAAY,CAAC,GAAG,OAAO;CAE9D,IAAI,aAAa,OAAO,GAAG,OAAO;CAElC,OAAO,uBAAuB,OAAO;AACvC;;;;;;;;;;;;;;;;;;;;AAqBA,eAAsB,oBACpB,SACA,UACA,WACA,cAC+B;CAC/B,IAAI,CAAC,yBAAyB,OAAO,GAAG,OAAO;CAE/C,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,QAAQ,SAAS,OAAO;CAE5B,aAAa,QAAQ,MAAM;CAE3B,OAAO,SAAS,UAAU;EACxB,OAAO,UAAU,gCAAgC;EACjD;CACF,CAAC;AACH"}

package/esm/http/csrf-origin-policy.d.mts

@@ -0,0 +1,53 @@
+import { Request } from "./request.mjs";
+
+//#region ../core/src/http/csrf-origin-policy.d.ts
+/** Why {@link resolveCsrfOriginVerdict} refused a request. */
+type CsrfOriginCheckReason = "origin-mismatch" | "referer-mismatch" | "missing-origin-and-referer";
+/** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */
+type CsrfOriginVerdict = {
+  allowed: true;
+} | {
+  allowed: false;
+  reason: CsrfOriginCheckReason;
+};
+/**
+ * The request's own origin — what an `Origin`/`Referer` header must match.
+ *
+ * `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never
+ * carries a port. A browser's `Origin` header on a non-default port (e.g. any
+ * `warlock dev` session) does, so the port must come from the raw `Host`
+ * header instead — core exposes no getter for that, so it is read directly
+ * here.
+ *
+ * Trust-proxy-aware for free: `request.protocol` is Fastify's own
+ * `request.protocol`, which already honours `http.trustProxy`
+ * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this
+ * function does not need its own proxy-trust logic on top of that.
+ */
+declare function ownOrigin(request: Request): string;
+/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */
+declare function originOf(rawUrl: string): string | undefined;
+/**
+ * Normalize an origin string (`scheme://host[:port]`) so that a default port
+ * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin
+ * written without a port. Falls back to the raw value if it does not parse
+ * as a URL (in which case it will simply fail the exact-match comparison).
+ */
+declare function normalizeOrigin(origin: string): string;
+/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */
+declare function isAllowedCsrfOrigin(origin: string, request: Request): boolean;
+/**
+ * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):
+ * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the
+ * request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused
+ * otherwise, including when BOTH headers are absent (fail closed).
+ *
+ * Callers decide WHETHER a request is in scope for this check at all (a
+ * cookie-sourced credential / a non-locale cookie, an unsafe method, no route
+ * exemption) — this function only answers the Origin/Referer question once a
+ * caller has already decided the check applies.
+ */
+declare function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict;
+//#endregion
+export { CsrfOriginCheckReason, CsrfOriginVerdict, isAllowedCsrfOrigin, normalizeOrigin, originOf, ownOrigin, resolveCsrfOriginVerdict };
+//# sourceMappingURL=csrf-origin-policy.d.mts.map

package/esm/http/csrf-origin-policy.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-origin-policy.d.mts","names":[],"sources":["../../../../../../../core/src/http/csrf-origin-policy.ts"],"mappings":";;;;KAyBY,qBAAA;AAAZ;AAAA,KAMY,iBAAA;EACN,OAAA;AAAA;EACA,OAAA;EAAgB,MAAA,EAAQ,qBAAqB;AAAA;;;;;;;;AAAA;AAgBnD;;;;AAA0C;AAQ1C;iBARgB,SAAA,CAAU,OAAgB,EAAP,OAAO;;iBAQ1B,QAAA,CAAS,MAAc;AAAA;AAgBvC;;;;AAA8C;AAhBP,iBAgBvB,eAAA,CAAgB,MAAc;;iBAc9B,mBAAA,CAAoB,MAAA,UAAgB,OAAA,EAAS,OAAO;;;;;;AAAA;AAmBpE;;;;;iBAAgB,wBAAA,CAAyB,OAAA,EAAS,OAAA,GAAU,iBAAiB"}

package/esm/http/csrf-origin-policy.mjs

@@ -0,0 +1,104 @@
+import config from "@mongez/config";
+
+//#region ../core/src/http/csrf-origin-policy.ts
+/**
+* The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the
+* one comparison every CSRF-Origin check in the framework must agree on.
+*
+* SECURITY, card 8a752ab2 (5.17). Extracted from
+* `@warlock.js/auth`'s `csrf-origin-check.ts` (the ONLY prior owner of this
+* logic) into `@warlock.js/core` so both call sites — the
+* `authMiddleware("cookie:*")` check in `@warlock.js/auth` and the default
+* core HTTP-seam guard in `./csrf-default-guard.ts` — share ONE
+* implementation instead of drifting copies. `@warlock.js/core` cannot depend
+* on `@warlock.js/auth` (the dependency runs the other way), so the shared
+* logic had to move down into `core`, not up into a new shared package —
+* `auth`'s `csrf-origin-check.ts` now delegates to
+* {@link resolveCsrfOriginVerdict} instead of reimplementing it.
+*
+* Reads `auth.csrf.allowedOrigins` directly via `@mongez/config` (the exact
+* same config key `@warlock.js/auth`'s `authConfig.csrf.allowedOrigins()`
+* reads) rather than importing `@warlock.js/auth`, so an app's one
+* `auth.csrf.allowedOrigins` setting governs both checks without `core`
+* taking a hard dependency on `auth`.
+*/
+/**
+* The request's own origin — what an `Origin`/`Referer` header must match.
+*
+* `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never
+* carries a port. A browser's `Origin` header on a non-default port (e.g. any
+* `warlock dev` session) does, so the port must come from the raw `Host`
+* header instead — core exposes no getter for that, so it is read directly
+* here.
+*
+* Trust-proxy-aware for free: `request.protocol` is Fastify's own
+* `request.protocol`, which already honours `http.trustProxy`
+* (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this
+* function does not need its own proxy-trust logic on top of that.
+*/
+function ownOrigin(request) {
+	const hostHeader = request.header("host");
+	const host = typeof hostHeader === "string" && hostHeader ? hostHeader : request.hostname;
+	return `${request.protocol}://${host}`;
+}
+/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */
+function originOf(rawUrl) {
+	try {
+		const url = new URL(rawUrl);
+		return `${url.protocol}//${url.host}`;
+	} catch {
+		return;
+	}
+}
+/**
+* Normalize an origin string (`scheme://host[:port]`) so that a default port
+* (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin
+* written without a port. Falls back to the raw value if it does not parse
+* as a URL (in which case it will simply fail the exact-match comparison).
+*/
+function normalizeOrigin(origin) {
+	try {
+		const url = new URL(origin);
+		const isDefaultPort = url.protocol === "http:" && (url.port === "" || url.port === "80") || url.protocol === "https:" && (url.port === "" || url.port === "443");
+		return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;
+	} catch {
+		return origin;
+	}
+}
+/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */
+function isAllowedCsrfOrigin(origin, request) {
+	if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;
+	return config.get("auth.csrf.allowedOrigins", []).includes(origin);
+}
+/**
+* The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):
+* allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the
+* request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused
+* otherwise, including when BOTH headers are absent (fail closed).
+*
+* Callers decide WHETHER a request is in scope for this check at all (a
+* cookie-sourced credential / a non-locale cookie, an unsafe method, no route
+* exemption) — this function only answers the Origin/Referer question once a
+* caller has already decided the check applies.
+*/
+function resolveCsrfOriginVerdict(request) {
+	const origin = request.origin;
+	if (origin) return isAllowedCsrfOrigin(origin, request) ? { allowed: true } : {
+		allowed: false,
+		reason: "origin-mismatch"
+	};
+	const referer = request.header("referer");
+	const refererOrigin = typeof referer === "string" ? originOf(referer) : void 0;
+	if (refererOrigin) return isAllowedCsrfOrigin(refererOrigin, request) ? { allowed: true } : {
+		allowed: false,
+		reason: "referer-mismatch"
+	};
+	return {
+		allowed: false,
+		reason: "missing-origin-and-referer"
+	};
+}
+
+//#endregion
+export { isAllowedCsrfOrigin, normalizeOrigin, originOf, ownOrigin, resolveCsrfOriginVerdict };
+//# sourceMappingURL=csrf-origin-policy.mjs.map

package/esm/http/csrf-origin-policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-origin-policy.mjs","names":[],"sources":["../../../../../../../core/src/http/csrf-origin-policy.ts"],"sourcesContent":["/**\n * The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the\n * one comparison every CSRF-Origin check in the framework must agree on.\n *\n * SECURITY, card 8a752ab2 (5.17). Extracted from\n * `@warlock.js/auth`'s `csrf-origin-check.ts` (the ONLY prior owner of this\n * logic) into `@warlock.js/core` so both call sites — the\n * `authMiddleware(\"cookie:*\")` check in `@warlock.js/auth` and the default\n * core HTTP-seam guard in `./csrf-default-guard.ts` — share ONE\n * implementation instead of drifting copies. `@warlock.js/core` cannot depend\n * on `@warlock.js/auth` (the dependency runs the other way), so the shared\n * logic had to move down into `core`, not up into a new shared package —\n * `auth`'s `csrf-origin-check.ts` now delegates to\n * {@link resolveCsrfOriginVerdict} instead of reimplementing it.\n *\n * Reads `auth.csrf.allowedOrigins` directly via `@mongez/config` (the exact\n * same config key `@warlock.js/auth`'s `authConfig.csrf.allowedOrigins()`\n * reads) rather than importing `@warlock.js/auth`, so an app's one\n * `auth.csrf.allowedOrigins` setting governs both checks without `core`\n * taking a hard dependency on `auth`.\n */\nimport config from \"@mongez/config\";\nimport type { Request } from \"./request\";\n\n/** Why {@link resolveCsrfOriginVerdict} refused a request. */\nexport type CsrfOriginCheckReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */\nexport type CsrfOriginVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: CsrfOriginCheckReason };\n\n/**\n * The request's own origin — what an `Origin`/`Referer` header must match.\n *\n * `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never\n * carries a port. A browser's `Origin` header on a non-default port (e.g. any\n * `warlock dev` session) does, so the port must come from the raw `Host`\n * header instead — core exposes no getter for that, so it is read directly\n * here.\n *\n * Trust-proxy-aware for free: `request.protocol` is Fastify's own\n * `request.protocol`, which already honours `http.trustProxy`\n * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this\n * function does not need its own proxy-trust logic on top of that.\n */\nexport function ownOrigin(request: Request): string {\n  const hostHeader = request.header(\"host\");\n  const host = typeof hostHeader === \"string\" && hostHeader ? hostHeader : request.hostname;\n\n  return `${request.protocol}://${host}`;\n}\n\n/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */\nexport function originOf(rawUrl: string): string | undefined {\n  try {\n    const url = new URL(rawUrl);\n\n    return `${url.protocol}//${url.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Normalize an origin string (`scheme://host[:port]`) so that a default port\n * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin\n * written without a port. Falls back to the raw value if it does not parse\n * as a URL (in which case it will simply fail the exact-match comparison).\n */\nexport function normalizeOrigin(origin: string): string {\n  try {\n    const url = new URL(origin);\n    const isDefaultPort =\n      (url.protocol === \"http:\" && (url.port === \"\" || url.port === \"80\")) ||\n      (url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\"));\n\n    return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;\n  } catch {\n    return origin;\n  }\n}\n\n/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */\nexport function isAllowedCsrfOrigin(origin: string, request: Request): boolean {\n  if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;\n\n  const allowedOrigins: string[] = config.get(\"auth.csrf.allowedOrigins\", []);\n\n  return allowedOrigins.includes(origin);\n}\n\n/**\n * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):\n * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the\n * request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused\n * otherwise, including when BOTH headers are absent (fail closed).\n *\n * Callers decide WHETHER a request is in scope for this check at all (a\n * cookie-sourced credential / a non-locale cookie, an unsafe method, no route\n * exemption) — this function only answers the Origin/Referer question once a\n * caller has already decided the check applies.\n */\nexport function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict {\n  const origin = request.origin;\n\n  if (origin) {\n    return isAllowedCsrfOrigin(origin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"origin-mismatch\" };\n  }\n\n  const referer = request.header(\"referer\");\n  const refererOrigin = typeof referer === \"string\" ? originOf(referer) : undefined;\n\n  if (refererOrigin) {\n    return isAllowedCsrfOrigin(refererOrigin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"referer-mismatch\" };\n  }\n\n  return { allowed: false, reason: \"missing-origin-and-referer\" };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,UAAU,SAA0B;CAClD,MAAM,aAAa,QAAQ,OAAO,MAAM;CACxC,MAAM,OAAO,OAAO,eAAe,YAAY,aAAa,aAAa,QAAQ;CAEjF,OAAO,GAAG,QAAQ,SAAS,KAAK;AAClC;;AAGA,SAAgB,SAAS,QAAoC;CAC3D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAE1B,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAwB;CACtD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,MAAM,gBACH,IAAI,aAAa,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,SAC7D,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;EAEjE,OAAO,GAAG,IAAI,SAAS,IAAI,gBAAgB,IAAI,WAAW,IAAI;CAChE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,oBAAoB,QAAgB,SAA2B;CAC7E,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,OAAO;CAI5E,OAFiC,OAAO,IAAI,4BAA4B,CAAC,CAErD,CAAC,CAAC,SAAS,MAAM;AACvC;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,SAAqC;CAC5E,MAAM,SAAS,QAAQ;CAEvB,IAAI,QACF,OAAO,oBAAoB,QAAQ,OAAO,IACtC,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAkB;CAGlD,MAAM,UAAU,QAAQ,OAAO,SAAS;CACxC,MAAM,gBAAgB,OAAO,YAAY,WAAW,SAAS,OAAO,IAAI;CAExE,IAAI,eACF,OAAO,oBAAoB,eAAe,OAAO,IAC7C,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAmB;CAGnD,OAAO;EAAE,SAAS;EAAO,QAAQ;CAA6B;AAChE"}

package/esm/http/error-codes.d.mts

@@ -37,7 +37,20 @@ declare enum HttpErrorCodes {
   /**
    * Application is in maintenance mode and the request did not match the allowlist.
    */
-  Maintenance = "EC106"
+  Maintenance = "EC106",
+  /**
+   * Default core CSRF-Origin guard (SECURITY, card 8a752ab2, `./csrf-default-guard.ts`)
+   * refused an unsafe-method, cookie-carrying request whose `Origin`/`Referer`
+   * did not name the request's own origin or an entry in
+   * `auth.csrf.allowedOrigins`.
+   *
+   * Deliberately reuses `@warlock.js/auth`'s `AuthErrorCodes.CsrfOriginMismatch`
+   * value (`EC006`), NOT a fresh `EC1xx` core code: this is the exact same
+   * failure class `authMiddleware("cookie:*")`'s own CSRF-Origin check
+   * reports — one client-visible identifier for "CSRF Origin check failed",
+   * regardless of which seam caught it.
+   */
+  CsrfOriginMismatch = "EC006"
 }
 //#endregion
 export { HttpErrorCodes };

package/esm/http/error-codes.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.d.mts","names":[],"sources":["../../../../../../../core/src/http/error-codes.ts"],"mappings":";;AASA;;;;;;;;aAAY,cAAA;EA8BV;;;AAKW;EA9BX,sBAAA;;;;EAKA,qBAAA;;;;EAKA,iBAAA;;;;EAKA,uBAAA;;;;EAKA,YAAA;;;;EAKA,WAAA;;;;EAKA,WAAA;AAAA"}
+{"version":3,"file":"error-codes.d.mts","names":[],"sources":["../../../../../../../core/src/http/error-codes.ts"],"mappings":";;AASA;;;;;;;;aAAY,cAAA;EA8BV;;;;EAzBA,sBAAA;;;;EAKA,qBAAA;;;;EAKA,iBAAA;;;;EAKA,uBAAA;;;;EAKA,YAAA;;;;EAKA,WAAA;;;;EAKA,WAAA;;;;;;;;;;;;;EAcA,kBAAA;AAAA"}

package/esm/http/error-codes.mjs

@@ -38,6 +38,19 @@ let HttpErrorCodes = /* @__PURE__ */ function(HttpErrorCodes) {
 	* Application is in maintenance mode and the request did not match the allowlist.
 	*/
 	HttpErrorCodes["Maintenance"] = "EC106";
+	/**
+	* Default core CSRF-Origin guard (SECURITY, card 8a752ab2, `./csrf-default-guard.ts`)
+	* refused an unsafe-method, cookie-carrying request whose `Origin`/`Referer`
+	* did not name the request's own origin or an entry in
+	* `auth.csrf.allowedOrigins`.
+	*
+	* Deliberately reuses `@warlock.js/auth`'s `AuthErrorCodes.CsrfOriginMismatch`
+	* value (`EC006`), NOT a fresh `EC1xx` core code: this is the exact same
+	* failure class `authMiddleware("cookie:*")`'s own CSRF-Origin check
+	* reports — one client-visible identifier for "CSRF Origin check failed",
+	* regardless of which seam caught it.
+	*/
+	HttpErrorCodes["CsrfOriginMismatch"] = "EC006";
 	return HttpErrorCodes;
 }({});
 

package/esm/http/error-codes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.mjs","names":[],"sources":["../../../../../../../core/src/http/error-codes.ts"],"sourcesContent":["/**\n * HTTP middleware error codes.\n *\n * Mirrors the convention used by `@warlock.js/auth`'s `AuthErrorCodes` —\n * stable string identifiers clients can branch on without parsing message text.\n *\n * Range `EC100..EC199` is reserved for `@warlock.js/core` HTTP middleware.\n * `EC001..EC099` belongs to `@warlock.js/auth`.\n */\nexport enum HttpErrorCodes {\n  /**\n   * Same idempotency key reused with a different request body.\n   * Client likely has a bug — same intent must reuse the same body.\n   */\n  IdempotencyKeyConflict = \"EC100\",\n\n  /**\n   * Idempotency key header is malformed (wrong length / non-printable chars).\n   */\n  IdempotencyKeyInvalid = \"EC101\",\n\n  /**\n   * Per-route rate limit exceeded. Different from the global `@fastify/rate-limit` 429.\n   */\n  RateLimitExceeded = \"EC102\",\n\n  /**\n   * Per-route concurrency cap reached — too many in-flight requests against this endpoint.\n   */\n  ConcurrencyLimitReached = \"EC103\",\n\n  /**\n   * Request `Content-Length` exceeds the per-route body cap.\n   */\n  BodyTooLarge = \"EC104\",\n\n  /**\n   * Client IP failed the `ipFilter()` allow/deny check.\n   */\n  IpForbidden = \"EC105\",\n\n  /**\n   * Application is in maintenance mode and the request did not match the allowlist.\n   */\n  Maintenance = \"EC106\",\n}\n"],"mappings":";;;;;;;;;;AASA,IAAY,iBAAL;;;;;CAKL;;;;CAKA;;;;CAKA;;;;CAKA;;;;CAKA;;;;CAKA;;;;CAKA;;AACF"}
+{"version":3,"file":"error-codes.mjs","names":[],"sources":["../../../../../../../core/src/http/error-codes.ts"],"sourcesContent":["/**\n * HTTP middleware error codes.\n *\n * Mirrors the convention used by `@warlock.js/auth`'s `AuthErrorCodes` —\n * stable string identifiers clients can branch on without parsing message text.\n *\n * Range `EC100..EC199` is reserved for `@warlock.js/core` HTTP middleware.\n * `EC001..EC099` belongs to `@warlock.js/auth`.\n */\nexport enum HttpErrorCodes {\n  /**\n   * Same idempotency key reused with a different request body.\n   * Client likely has a bug — same intent must reuse the same body.\n   */\n  IdempotencyKeyConflict = \"EC100\",\n\n  /**\n   * Idempotency key header is malformed (wrong length / non-printable chars).\n   */\n  IdempotencyKeyInvalid = \"EC101\",\n\n  /**\n   * Per-route rate limit exceeded. Different from the global `@fastify/rate-limit` 429.\n   */\n  RateLimitExceeded = \"EC102\",\n\n  /**\n   * Per-route concurrency cap reached — too many in-flight requests against this endpoint.\n   */\n  ConcurrencyLimitReached = \"EC103\",\n\n  /**\n   * Request `Content-Length` exceeds the per-route body cap.\n   */\n  BodyTooLarge = \"EC104\",\n\n  /**\n   * Client IP failed the `ipFilter()` allow/deny check.\n   */\n  IpForbidden = \"EC105\",\n\n  /**\n   * Application is in maintenance mode and the request did not match the allowlist.\n   */\n  Maintenance = \"EC106\",\n\n  /**\n   * Default core CSRF-Origin guard (SECURITY, card 8a752ab2, `./csrf-default-guard.ts`)\n   * refused an unsafe-method, cookie-carrying request whose `Origin`/`Referer`\n   * did not name the request's own origin or an entry in\n   * `auth.csrf.allowedOrigins`.\n   *\n   * Deliberately reuses `@warlock.js/auth`'s `AuthErrorCodes.CsrfOriginMismatch`\n   * value (`EC006`), NOT a fresh `EC1xx` core code: this is the exact same\n   * failure class `authMiddleware(\"cookie:*\")`'s own CSRF-Origin check\n   * reports — one client-visible identifier for \"CSRF Origin check failed\",\n   * regardless of which seam caught it.\n   */\n  CsrfOriginMismatch = \"EC006\",\n}\n"],"mappings":";;;;;;;;;;AASA,IAAY,iBAAL;;;;;CAKL;;;;CAKA;;;;CAKA;;;;CAKA;;;;CAKA;;;;CAKA;;;;CAKA;;;;;;;;;;;;;CAcA;;AACF"}

package/esm/http/index.d.mts

@@ -1,7 +1,7 @@
 import { PipeableReactStream, StreamReactResponseOptions, streamReactResponse } from "./stream-react-response.mjs";
 import { XMLable } from "./xmlable.mjs";
 import { CookieOptions, Response, ResponseStatus, SendBufferOptions, SendFileOptions } from "./response.mjs";
-import { FileNamingStrategy, ImageTransformCallback, ImageTransformConfig, PrefixConfig, PrefixOptions, SaveAsOptions, SaveOptions, UploadedFileImageOptions, UploadsConfigurations } from "./uploads-types.mjs";
+import { FileNamingStrategy, ImageTransformCallback, ImageTransformConfig, ImageVariantDefinition, ImageVariantFit, ImageVariantOutputFormat, PrefixConfig, PrefixOptions, SaveAsOptions, SaveOptions, UploadedFileImageOptions, UploadsConfigurations, UploadsImagesConfigurations } from "./uploads-types.mjs";
 import { FileValidationOptions, UploadedFile, UploadedFileJson } from "./uploaded-file.mjs";
 import { Request } from "./request.mjs";
 import { CspConfig, DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives } from "./csp.mjs";
@@ -9,12 +9,18 @@ import { HttpTracingConfig, TracingContext, TracingHooks, TracingPhaseInfo, Trac
 import { DecodedAccessToken, HttpConfigurations, PartialMiddleware, RequestEvent, RequestLocals, ResponseEvent, ResponseSSEController, ResponseStreamController, ReturnedResponse } from "./types.mjs";
 import { defaultHttpConfigurations, httpConfig } from "./config.mjs";
 import { createHttpApplication, stopHttpApplication } from "./createHttpApplication.mjs";
+import { requiresDefaultCsrfGuard, runDefaultCsrfGuard } from "./csrf-default-guard.mjs";
+import { CsrfOriginCheckReason, CsrfOriginVerdict, isAllowedCsrfOrigin, normalizeOrigin, originOf, ownOrigin, resolveCsrfOriginVerdict } from "./csrf-origin-policy.mjs";
 import { RequestLog } from "./database/RequestLog.mjs";
 import { HttpErrorCodes } from "./error-codes.mjs";
 import { logResponse, wrapResponseInDataKey } from "./events.mjs";
 import { HealthCheck, HealthStatus, health } from "./health.mjs";
 import { RequestController } from "./request-controller.mjs";
 import { UPLOADS_DEFAULTS, uploadsConfig } from "./uploads-config.mjs";
+import { DetectedImageFormat, GeneratedImageDescriptor, GeneratedImageVariant, ResolvedImageVariantsConfig, UploadedFileQuery, VariantOutputFormat, VariantSourceFormat } from "./uploads/image-variant-types.mjs";
+import { GenerateImageVariantsOptions, generateImageVariants } from "./uploads/generate-image-variants.mjs";
+import { ImageVariantsConfigError } from "./uploads/image-variants-config-error.mjs";
+import { uploadedFileController } from "./uploads/uploaded-file.controller.mjs";
 import { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, RequestUserMovedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./errors/errors.mjs";
 import { CacheMiddlewareOptions } from "./middleware/cache-response-middleware.mjs";
 import { ConcurrencyLimitOptions } from "./middleware/concurrency-limit.middleware.mjs";

package/esm/http/index.mjs

@@ -1,5 +1,8 @@
 import { requestContext, useCurrentUser, useRequest, useRequestStore } from "./context/request-context.mjs";
 import { DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives } from "./csp.mjs";
+import { HttpErrorCodes } from "./error-codes.mjs";
+import { isAllowedCsrfOrigin, normalizeOrigin, originOf, ownOrigin, resolveCsrfOriginVerdict } from "./csrf-origin-policy.mjs";
+import { requiresDefaultCsrfGuard, runDefaultCsrfGuard } from "./csrf-default-guard.mjs";
 import { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, RequestUserMovedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./errors/errors.mjs";
 import { deriveTraceId, parseTraceparentTraceId } from "./tracing/trace-id.mjs";
 import { buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled, resetTracingConfigForTests, resolveTracingConfig } from "./tracing/tracing-dispatcher.mjs";
@@ -15,10 +18,13 @@ import { registerHttpPlugins } from "./plugins.mjs";
 import { closeServerWithTimeout, getHttpServer, startHttpServer } from "./server.mjs";
 import { createHttpApplication, stopHttpApplication } from "./createHttpApplication.mjs";
 import { RequestLog } from "./database/RequestLog.mjs";
-import { HttpErrorCodes } from "./error-codes.mjs";
 import { logResponse, wrapResponseInDataKey } from "./events.mjs";
 import { health } from "./health.mjs";
 import { RequestController } from "./request-controller.mjs";
+import { ImageVariantsConfigError } from "./uploads/image-variants-config-error.mjs";
+import { generateImageVariants } from "./uploads/generate-image-variants.mjs";
+import { uploadedFileController } from "./uploads/uploaded-file.controller.mjs";
+import "./uploads/index.mjs";
 import { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from "./middleware/utils/idempotency-key.mjs";
 import { anyMatch, ipMatches } from "./middleware/utils/cidr-match.mjs";
 import { parseSize } from "./middleware/utils/parse-size.mjs";

package/esm/http/middleware/concurrency-limit.middleware.mjs

@@ -1,5 +1,5 @@
-import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
+import { t } from "./inject-request-context.mjs";
 
 //#region ../core/src/http/middleware/concurrency-limit.middleware.ts
 const counters = /* @__PURE__ */ new Map();

package/esm/http/middleware/idempotency.middleware.mjs

@@ -1,5 +1,5 @@
-import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
+import { t } from "./inject-request-context.mjs";
 import { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from "./utils/idempotency-key.mjs";
 import config from "@mongez/config";
 import { log } from "@warlock.js/logger";

package/esm/http/middleware/inject-request-context.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;AA4CA;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;iBAkHK,CAAA,CAAE,OAAA,UAAiB,YAAkB"}
+{"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;AA8CA;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;iBAoIK,CAAA,CAAE,OAAA,UAAiB,YAAkB"}

package/esm/http/middleware/inject-request-context.mjs

@@ -2,6 +2,7 @@ import { environment } from "../../utils/environment.mjs";
 import { requestContext } from "../context/request-context.mjs";
 import "../../utils/index.mjs";
 import { applyCspHeader } from "../csp.mjs";
+import { runDefaultCsrfGuard } from "../csrf-default-guard.mjs";
 import { HttpError } from "../errors/errors.mjs";
 import { buildTracingContext, dispatchPhase, isTracingEnabled } from "../tracing/tracing-dispatcher.mjs";
 import "../tracing/index.mjs";
@@ -9,6 +10,7 @@ import config from "@mongez/config";
 import { trans } from "@mongez/localization";
 import { DatabaseWriterValidationError } from "@warlock.js/cascade";
 import { contextManager } from "@warlock.js/context";
+import { log } from "@warlock.js/logger";
 
 //#region ../core/src/http/middleware/inject-request-context.ts
 /**
@@ -44,6 +46,10 @@ function createRequestStore(request, response) {
 	});
 	return contextManager.runAll(httpContextStore, async () => {
 		try {
+			const csrfGuardResponse = await runDefaultCsrfGuard(request, response, t, (reason) => {
+				log.error("http", "csrf-default-guard", /* @__PURE__ */ new Error(`Default CSRF Origin guard refused request: ${reason}`));
+			});
+			if (csrfGuardResponse) return csrfGuardResponse;
 			const result = await request.runMiddleware();
 			if (result) return result;
 			request.trigger("executingAction", request.route);

package/esm/http/middleware/inject-request-context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\n * Request Context Middleware\n *\n * Creates a unified context for each request using the ContextManager.\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\n */\nimport { trans } from \"@mongez/localization\";\nimport { type GenericObject } from \"@mongez/reinforcements\";\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\nimport { contextManager } from \"@warlock.js/context\";\nimport config from \"@mongez/config\";\nimport { environment } from \"../../utils\";\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\nimport { applyCspHeader } from \"../csp\";\nimport { HttpError } from \"../errors\";\nimport { type Request } from \"../request\";\nimport { type Response } from \"../response\";\nimport { buildTracingContext, dispatchPhase, isTracingEnabled } from \"../tracing\";\nimport { type ReturnedResponse } from \"./../types\";\n\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\n\n/**\n * Echo `request.id` back as a response header so the FE / proxies / log\n * aggregators can correlate by the same value the server logs against.\n *\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\n * Skip when `http.requestId.enabled` is explicitly false.\n */\nfunction stampRequestIdHeader(request: Request, response: Response) {\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\n\n  if (requestIdConfig.enabled === false) return;\n\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\n\n  response.header(headerName, request.id);\n}\n\n/**\n * Create request store and execute middleware + handler\n *\n * Runs all registered contexts together using ContextManager.\n */\nexport function createRequestStore(\n  request: Request<any>,\n  response: Response,\n): Promise<ReturnedResponse> {\n  stampRequestIdHeader(request, response);\n\n  // Stamped this early — before any middleware or handler runs — so the\n  // header carries the SAME nonce the web layer later reads off\n  // `request.nonce` for its `<script>` tags: `request.nonce` caches on first\n  // read, and this is deliberately the first read. A no-op when the app\n  // hasn't opted into `http.csp` (see `csp.ts`).\n  applyCspHeader(request, response);\n\n  // Build all context stores using the immutable API\n  // Each context defines its own store initialization via buildStore()\n  const httpContextStore = contextManager.buildStores({ request, response });\n\n  // Run all contexts together!\n  return contextManager.runAll(httpContextStore, async () => {\n    try {\n      // Run middleware chain\n      const result = await request.runMiddleware();\n\n      if (result) {\n        return result as ReturnedResponse;\n      }\n\n      // Execute route handler\n      request.trigger(\"executingAction\", request.route);\n\n      const handler = request.getHandler();\n\n      request.log(\"Executing Handler\", \"info\");\n\n      const tracingEnabled = isTracingEnabled();\n      const handlerStartedAt = tracingEnabled ? performance.now() : 0;\n\n      const output = await handler({ request, response });\n\n      if (tracingEnabled) {\n        dispatchPhase(buildTracingContext(request), {\n          name: \"handler\",\n          durationMs: performance.now() - handlerStartedAt,\n        });\n      }\n\n      request.log(\"Handler Executed Successfully\", \"success\");\n\n      request.trigger(\"executedAction\", request.route);\n\n      return output as ReturnedResponse;\n    } catch (error) {\n      request.log(error, \"error\");\n      return handleRequestError(error, response);\n    }\n  });\n}\n\n/**\n * Handle request errors\n * @internal\n */\nfunction handleRequestError(error: unknown, response: Response): ReturnedResponse {\n  // Availability floor, not a cache-policy nit: `handleRequestError` is the\n  // single funnel every unhandled error in every Warlock app passes through\n  // (`createRequestStore`'s catch above), and none of the branches below set\n  // a `Cache-Control` header. Without this, an error response — a 500 as\n  // much as a 401/403/404 carrying per-request/-user state — can be stored\n  // by a shared cache or CDN and replayed to other requests/users long after\n  // the condition that caused it is gone: a cached 500 becomes an outage\n  // that outlives its cause; a cached 401/403 becomes a leak across users.\n  // Set once, here, before any branch runs — not per branch — because the\n  // branches below do not partition by status. `ResourceNotFoundError`,\n  // `UnAuthorizedError`, `ForbiddenError`, `BadRequestError` and `ServerError`\n  // all extend `HttpError`, so the `HttpError` branch answers for every one of\n  // them, and a raw `HttpError` can carry any caller-chosen status, 4xx or 5xx.\n  // Gating the floor on the eventual status would mean re-deriving that status\n  // per branch — one rule meeting one form while others reach the same output.\n  // Applying it once, unconditionally, is both simpler and safer.\n  response.header(\"Cache-Control\", \"private, no-store\");\n\n  if (error instanceof HttpError) {\n    const payload: GenericObject = {\n      error: error.message,\n    };\n    if (error.payload) {\n      payload.payload = error.payload;\n    }\n\n    if (environment() === \"development\") {\n      payload.stack = error.stack;\n    }\n\n    return response.setStatusCode(error.status).send(payload);\n  }\n\n  if (error instanceof DatabaseWriterValidationError) {\n    return response.badRequest({\n      errors: error.errors,\n    });\n  }\n\n  // Last resort: the error matched none of the known shapes above, so the\n  // client gets a deliberately opaque message. Without this line the error\n  // itself is discarded here — no stack, no message, nothing in any log — and\n  // an unrecognised failure becomes indistinguishable from a working server\n  // returning 500. Never swallow the only copy of an error (`65e476ee`).\n  console.error(\"[warlock] unhandled request error:\", error);\n\n  return response.serverError({\n    error: \"Internal server error.\",\n  });\n}\n\n/**\n * Translate a keyword (uses request context for locale)\n */\nexport function t(keyword: string, placeholders?: any) {\n  return (\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\n    trans(keyword, placeholders)\n  );\n}\n\n// `fromRequest` was removed in v5. It cached computed values as dynamic\n// properties on the Request instance, which only compiled because of the\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\n// per-request lifetime, single-flight, and it never touches the Request object.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAOtC,eAAe,SAAS,QAAQ;CAIhC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAEF,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,iBAAiB,iBAAiB;GACxC,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,IAAI;GAE9D,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,IAAI,gBACF,cAAc,oBAAoB,OAAO,GAAG;IAC1C,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;GAClC,CAAC;GAGH,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,OAAO,OAAO;GAC1B,OAAO,mBAAmB,OAAO,QAAQ;EAC3C;CACF,CAAC;AACH;;;;;AAMA,SAAS,mBAAmB,OAAgB,UAAsC;CAiBhF,SAAS,OAAO,iBAAiB,mBAAmB;CAEpD,IAAI,iBAAiB,WAAW;EAC9B,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,+BACnB,OAAO,SAAS,WAAW,EACzB,QAAQ,MAAM,OAChB,CAAC;CAQH,QAAQ,MAAM,sCAAsC,KAAK;CAEzD,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAoB;CACrD,OACEA,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}
+{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\n * Request Context Middleware\n *\n * Creates a unified context for each request using the ContextManager.\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\n */\nimport { trans } from \"@mongez/localization\";\nimport { type GenericObject } from \"@mongez/reinforcements\";\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\nimport { contextManager } from \"@warlock.js/context\";\nimport { log } from \"@warlock.js/logger\";\nimport config from \"@mongez/config\";\nimport { environment } from \"../../utils\";\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\nimport { applyCspHeader } from \"../csp\";\nimport { runDefaultCsrfGuard } from \"../csrf-default-guard\";\nimport { HttpError } from \"../errors\";\nimport { type Request } from \"../request\";\nimport { type Response } from \"../response\";\nimport { buildTracingContext, dispatchPhase, isTracingEnabled } from \"../tracing\";\nimport { type ReturnedResponse } from \"./../types\";\n\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\n\n/**\n * Echo `request.id` back as a response header so the FE / proxies / log\n * aggregators can correlate by the same value the server logs against.\n *\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\n * Skip when `http.requestId.enabled` is explicitly false.\n */\nfunction stampRequestIdHeader(request: Request, response: Response) {\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\n\n  if (requestIdConfig.enabled === false) return;\n\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\n\n  response.header(headerName, request.id);\n}\n\n/**\n * Create request store and execute middleware + handler\n *\n * Runs all registered contexts together using ContextManager.\n */\nexport function createRequestStore(\n  request: Request<any>,\n  response: Response,\n): Promise<ReturnedResponse> {\n  stampRequestIdHeader(request, response);\n\n  // Stamped this early — before any middleware or handler runs — so the\n  // header carries the SAME nonce the web layer later reads off\n  // `request.nonce` for its `<script>` tags: `request.nonce` caches on first\n  // read, and this is deliberately the first read. A no-op when the app\n  // hasn't opted into `http.csp` (see `csp.ts`).\n  applyCspHeader(request, response);\n\n  // Build all context stores using the immutable API\n  // Each context defines its own store initialization via buildStore()\n  const httpContextStore = contextManager.buildStores({ request, response });\n\n  // Run all contexts together!\n  return contextManager.runAll(httpContextStore, async () => {\n    try {\n      // Default CSRF-Origin guard (SECURITY, card 8a752ab2) — the earliest\n      // seam common to every request, BEFORE the route's own middleware\n      // (`request.runMiddleware()` below) and before any app handler, so it\n      // applies even to a route that never attaches\n      // `authMiddleware(\"cookie:*\")`. See `../csrf-default-guard.ts` for the\n      // full scope rule and `{ csrf: false }` exemption.\n      const csrfGuardResponse = await runDefaultCsrfGuard(request, response, t, (reason) => {\n        log.error(\n          \"http\",\n          \"csrf-default-guard\",\n          new Error(`Default CSRF Origin guard refused request: ${reason}`),\n        );\n      });\n\n      if (csrfGuardResponse) {\n        return csrfGuardResponse as ReturnedResponse;\n      }\n\n      // Run middleware chain\n      const result = await request.runMiddleware();\n\n      if (result) {\n        return result as ReturnedResponse;\n      }\n\n      // Execute route handler\n      request.trigger(\"executingAction\", request.route);\n\n      const handler = request.getHandler();\n\n      request.log(\"Executing Handler\", \"info\");\n\n      const tracingEnabled = isTracingEnabled();\n      const handlerStartedAt = tracingEnabled ? performance.now() : 0;\n\n      const output = await handler({ request, response });\n\n      if (tracingEnabled) {\n        dispatchPhase(buildTracingContext(request), {\n          name: \"handler\",\n          durationMs: performance.now() - handlerStartedAt,\n        });\n      }\n\n      request.log(\"Handler Executed Successfully\", \"success\");\n\n      request.trigger(\"executedAction\", request.route);\n\n      return output as ReturnedResponse;\n    } catch (error) {\n      request.log(error, \"error\");\n      return handleRequestError(error, response);\n    }\n  });\n}\n\n/**\n * Handle request errors\n * @internal\n */\nfunction handleRequestError(error: unknown, response: Response): ReturnedResponse {\n  // Availability floor, not a cache-policy nit: `handleRequestError` is the\n  // single funnel every unhandled error in every Warlock app passes through\n  // (`createRequestStore`'s catch above), and none of the branches below set\n  // a `Cache-Control` header. Without this, an error response — a 500 as\n  // much as a 401/403/404 carrying per-request/-user state — can be stored\n  // by a shared cache or CDN and replayed to other requests/users long after\n  // the condition that caused it is gone: a cached 500 becomes an outage\n  // that outlives its cause; a cached 401/403 becomes a leak across users.\n  // Set once, here, before any branch runs — not per branch — because the\n  // branches below do not partition by status. `ResourceNotFoundError`,\n  // `UnAuthorizedError`, `ForbiddenError`, `BadRequestError` and `ServerError`\n  // all extend `HttpError`, so the `HttpError` branch answers for every one of\n  // them, and a raw `HttpError` can carry any caller-chosen status, 4xx or 5xx.\n  // Gating the floor on the eventual status would mean re-deriving that status\n  // per branch — one rule meeting one form while others reach the same output.\n  // Applying it once, unconditionally, is both simpler and safer.\n  response.header(\"Cache-Control\", \"private, no-store\");\n\n  if (error instanceof HttpError) {\n    const payload: GenericObject = {\n      error: error.message,\n    };\n    if (error.payload) {\n      payload.payload = error.payload;\n    }\n\n    if (environment() === \"development\") {\n      payload.stack = error.stack;\n    }\n\n    return response.setStatusCode(error.status).send(payload);\n  }\n\n  if (error instanceof DatabaseWriterValidationError) {\n    return response.badRequest({\n      errors: error.errors,\n    });\n  }\n\n  // Last resort: the error matched none of the known shapes above, so the\n  // client gets a deliberately opaque message. Without this line the error\n  // itself is discarded here — no stack, no message, nothing in any log — and\n  // an unrecognised failure becomes indistinguishable from a working server\n  // returning 500. Never swallow the only copy of an error (`65e476ee`).\n  console.error(\"[warlock] unhandled request error:\", error);\n\n  return response.serverError({\n    error: \"Internal server error.\",\n  });\n}\n\n/**\n * Translate a keyword (uses request context for locale)\n */\nexport function t(keyword: string, placeholders?: any) {\n  return (\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\n    trans(keyword, placeholders)\n  );\n}\n\n// `fromRequest` was removed in v5. It cached computed values as dynamic\n// properties on the Request instance, which only compiled because of the\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\n// per-request lifetime, single-flight, and it never touches the Request object.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAOtC,eAAe,SAAS,QAAQ;CAIhC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAOF,MAAM,oBAAoB,MAAM,oBAAoB,SAAS,UAAU,IAAI,WAAW;IACpF,IAAI,MACF,QACA,sCACA,IAAI,MAAM,8CAA8C,QAAQ,CAClE;GACF,CAAC;GAED,IAAI,mBACF,OAAO;GAIT,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,iBAAiB,iBAAiB;GACxC,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,IAAI;GAE9D,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,IAAI,gBACF,cAAc,oBAAoB,OAAO,GAAG;IAC1C,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;GAClC,CAAC;GAGH,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,OAAO,OAAO;GAC1B,OAAO,mBAAmB,OAAO,QAAQ;EAC3C;CACF,CAAC;AACH;;;;;AAMA,SAAS,mBAAmB,OAAgB,UAAsC;CAiBhF,SAAS,OAAO,iBAAiB,mBAAmB;CAEpD,IAAI,iBAAiB,WAAW;EAC9B,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,+BACnB,OAAO,SAAS,WAAW,EACzB,QAAQ,MAAM,OAChB,CAAC;CAQH,QAAQ,MAAM,sCAAsC,KAAK;CAEzD,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAoB;CACrD,OACEA,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}

package/esm/http/middleware/ip-filter.middleware.mjs

@@ -1,5 +1,5 @@
-import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
+import { t } from "./inject-request-context.mjs";
 import { anyMatch } from "./utils/cidr-match.mjs";
 
 //#region ../core/src/http/middleware/ip-filter.middleware.ts

package/esm/http/middleware/maintenance.middleware.mjs

@@ -1,5 +1,5 @@
-import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
+import { t } from "./inject-request-context.mjs";
 import config from "@mongez/config";
 
 //#region ../core/src/http/middleware/maintenance.middleware.ts

package/esm/http/middleware/max-body-size.middleware.mjs

@@ -1,5 +1,5 @@
-import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
+import { t } from "./inject-request-context.mjs";
 import { parseSize } from "./utils/parse-size.mjs";
 
 //#region ../core/src/http/middleware/max-body-size.middleware.ts

package/esm/http/middleware/rate-limit.middleware.mjs

@@ -1,5 +1,5 @@
-import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
+import { t } from "./inject-request-context.mjs";
 
 //#region ../core/src/http/middleware/rate-limit.middleware.ts
 const buckets = /* @__PURE__ */ new Map();

package/esm/http/request.d.mts

@@ -210,8 +210,8 @@ declare class Request<RequestValidation = any> {
    */
   protected cacheLocale(candidate: unknown): string;
   /**
-   * Resolve the first present Mode B source. Unsupported values fail closed to
-   * the configured default instead of widening the application's locale set.
+   * Resolve the first present Mode B source, skipping unsupported browser
+   * preferences. Other unsupported values resolve to the configured default.
    */
   protected resolveLocale(): string;
   /**