@warlock.js/core 5.2.0 → 5.2.2

package/esm/http/health.mjs

@@ -1,7 +1,7 @@
 import { Application } from "../application/application.mjs";
 import "../application/index.mjs";
 
-//#region core/src/http/health.ts
+//#region ../core/src/http/health.ts
 /**
 * Registry behind the built-in `/health` (liveness) and `/ready` (readiness)
 * endpoints. Liveness answers "is the process up?"; readiness answers "should

package/esm/http/health.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"health.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/health.ts"],"sourcesContent":["import { Application } from \"../application\";\n\n/**\n * A readiness probe registered via `health.addCheck(...)`. Returns whether its\n * dependency is currently usable; throwing is treated as a failed check.\n */\nexport type HealthCheck = () => boolean | Promise<boolean>;\n\n/**\n * Result of a liveness/readiness probe. `checks` is present on readiness only,\n * mapping each registered check name to its pass/fail.\n */\nexport type HealthStatus = {\n  status: \"ok\" | \"error\";\n  checks?: Record<string, boolean>;\n};\n\n/**\n * Registry behind the built-in `/health` (liveness) and `/ready` (readiness)\n * endpoints. Liveness answers \"is the process up?\"; readiness answers \"should\n * traffic be routed here?\" — booted, not shutting down, and every registered\n * dependency check passing. Connectors and app code register checks; the HTTP\n * connector exposes the endpoints.\n */\nclass HealthRegistry {\n  private readonly checks = new Map<string, HealthCheck>();\n\n  /**\n   * Register (or replace) a readiness check by name — e.g. a database ping.\n   */\n  public addCheck(name: string, check: HealthCheck): void {\n    this.checks.set(name, check);\n  }\n\n  /**\n   * Remove a previously-registered readiness check.\n   */\n  public removeCheck(name: string): void {\n    this.checks.delete(name);\n  }\n\n  /**\n   * Liveness — the process is up and not tearing down. Orchestrators use it to\n   * decide whether to RESTART the instance, so it ignores dependency checks.\n   */\n  public liveness(): HealthStatus {\n    return { status: Application.isShuttingDown ? \"error\" : \"ok\" };\n  }\n\n  /**\n   * Readiness — should this instance receive traffic? Requires a finished boot,\n   * no in-progress shutdown, and every registered check passing. Load balancers\n   * use it to decide whether to ROUTE to the instance.\n   */\n  public async readiness(): Promise<HealthStatus> {\n    if (!Application.isBooted || Application.isShuttingDown) {\n      return { status: \"error\" };\n    }\n\n    const checks: Record<string, boolean> = {};\n    let allPassed = true;\n\n    for (const [name, check] of this.checks) {\n      const passed = await this.runCheck(check);\n      checks[name] = passed;\n\n      if (!passed) {\n        allPassed = false;\n      }\n    }\n\n    return { status: allPassed ? \"ok\" : \"error\", checks };\n  }\n\n  /**\n   * Register a readiness check asserting the app has at least one route\n   * registered. A booted HTTP app that ends up with zero routes almost always\n   * means a route module failed to register silently, so the instance should\n   * report not-ready (503) rather than 404 every request.\n   *\n   * The route count is passed in as a getter so this registry stays decoupled\n   * from the router (no import cycle). The HTTP connector wires this in after\n   * scanning routes; apps with no HTTP surface simply never register it.\n   *\n   * @param getRouteCount Returns the number of currently-registered routes.\n   * @param name Override the check name (defaults to `\"routes\"`).\n   */\n  public addRoutesRegisteredCheck(getRouteCount: () => number, name = \"routes\"): void {\n    this.addCheck(name, () => getRouteCount() > 0);\n  }\n\n  /**\n   * Run one check. A thrown error counts as a failed check rather than crashing\n   * the probe. The failure is surfaced in the readiness `checks` map and the\n   * 503 status — not logged, since probes poll frequently and a failed check is\n   * a normal signal, not an error event.\n   */\n  private async runCheck(check: HealthCheck): Promise<boolean> {\n    try {\n      return await check();\n    } catch {\n      return false;\n    }\n  }\n}\n\n/**\n * The application's health registry singleton.\n */\nexport const health = new HealthRegistry();\n"],"mappings":";;;;;;;;;;;AAwBA,IAAM,iBAAN,MAAqB;;gCACO,IAAI,IAAyB;;;;;CAKvD,AAAO,SAAS,MAAc,OAA0B;EACtD,KAAK,OAAO,IAAI,MAAM,KAAK;CAC7B;;;;CAKA,AAAO,YAAY,MAAoB;EACrC,KAAK,OAAO,OAAO,IAAI;CACzB;;;;;CAMA,AAAO,WAAyB;EAC9B,OAAO,EAAE,QAAQ,YAAY,iBAAiB,UAAU,KAAK;CAC/D;;;;;;CAOA,MAAa,YAAmC;EAC9C,IAAI,CAAC,YAAY,YAAY,YAAY,gBACvC,OAAO,EAAE,QAAQ,QAAQ;EAG3B,MAAM,SAAkC,CAAC;EACzC,IAAI,YAAY;EAEhB,KAAK,MAAM,CAAC,MAAM,UAAU,KAAK,QAAQ;GACvC,MAAM,SAAS,MAAM,KAAK,SAAS,KAAK;GACxC,OAAO,QAAQ;GAEf,IAAI,CAAC,QACH,YAAY;EAEhB;EAEA,OAAO;GAAE,QAAQ,YAAY,OAAO;GAAS;EAAO;CACtD;;;;;;;;;;;;;;CAeA,AAAO,yBAAyB,eAA6B,OAAO,UAAgB;EAClF,KAAK,SAAS,YAAY,cAAc,IAAI,CAAC;CAC/C;;;;;;;CAQA,MAAc,SAAS,OAAsC;EAC3D,IAAI;GACF,OAAO,MAAM,MAAM;EACrB,QAAQ;GACN,OAAO;EACT;CACF;AACF;;;;AAKA,MAAa,SAAS,IAAI,eAAe"}
+{"version":3,"file":"health.mjs","names":[],"sources":["../../../../../../../core/src/http/health.ts"],"sourcesContent":["import { Application } from \"../application\";\n\n/**\n * A readiness probe registered via `health.addCheck(...)`. Returns whether its\n * dependency is currently usable; throwing is treated as a failed check.\n */\nexport type HealthCheck = () => boolean | Promise<boolean>;\n\n/**\n * Result of a liveness/readiness probe. `checks` is present on readiness only,\n * mapping each registered check name to its pass/fail.\n */\nexport type HealthStatus = {\n  status: \"ok\" | \"error\";\n  checks?: Record<string, boolean>;\n};\n\n/**\n * Registry behind the built-in `/health` (liveness) and `/ready` (readiness)\n * endpoints. Liveness answers \"is the process up?\"; readiness answers \"should\n * traffic be routed here?\" — booted, not shutting down, and every registered\n * dependency check passing. Connectors and app code register checks; the HTTP\n * connector exposes the endpoints.\n */\nclass HealthRegistry {\n  private readonly checks = new Map<string, HealthCheck>();\n\n  /**\n   * Register (or replace) a readiness check by name — e.g. a database ping.\n   */\n  public addCheck(name: string, check: HealthCheck): void {\n    this.checks.set(name, check);\n  }\n\n  /**\n   * Remove a previously-registered readiness check.\n   */\n  public removeCheck(name: string): void {\n    this.checks.delete(name);\n  }\n\n  /**\n   * Liveness — the process is up and not tearing down. Orchestrators use it to\n   * decide whether to RESTART the instance, so it ignores dependency checks.\n   */\n  public liveness(): HealthStatus {\n    return { status: Application.isShuttingDown ? \"error\" : \"ok\" };\n  }\n\n  /**\n   * Readiness — should this instance receive traffic? Requires a finished boot,\n   * no in-progress shutdown, and every registered check passing. Load balancers\n   * use it to decide whether to ROUTE to the instance.\n   */\n  public async readiness(): Promise<HealthStatus> {\n    if (!Application.isBooted || Application.isShuttingDown) {\n      return { status: \"error\" };\n    }\n\n    const checks: Record<string, boolean> = {};\n    let allPassed = true;\n\n    for (const [name, check] of this.checks) {\n      const passed = await this.runCheck(check);\n      checks[name] = passed;\n\n      if (!passed) {\n        allPassed = false;\n      }\n    }\n\n    return { status: allPassed ? \"ok\" : \"error\", checks };\n  }\n\n  /**\n   * Register a readiness check asserting the app has at least one route\n   * registered. A booted HTTP app that ends up with zero routes almost always\n   * means a route module failed to register silently, so the instance should\n   * report not-ready (503) rather than 404 every request.\n   *\n   * The route count is passed in as a getter so this registry stays decoupled\n   * from the router (no import cycle). The HTTP connector wires this in after\n   * scanning routes; apps with no HTTP surface simply never register it.\n   *\n   * @param getRouteCount Returns the number of currently-registered routes.\n   * @param name Override the check name (defaults to `\"routes\"`).\n   */\n  public addRoutesRegisteredCheck(getRouteCount: () => number, name = \"routes\"): void {\n    this.addCheck(name, () => getRouteCount() > 0);\n  }\n\n  /**\n   * Run one check. A thrown error counts as a failed check rather than crashing\n   * the probe. The failure is surfaced in the readiness `checks` map and the\n   * 503 status — not logged, since probes poll frequently and a failed check is\n   * a normal signal, not an error event.\n   */\n  private async runCheck(check: HealthCheck): Promise<boolean> {\n    try {\n      return await check();\n    } catch {\n      return false;\n    }\n  }\n}\n\n/**\n * The application's health registry singleton.\n */\nexport const health = new HealthRegistry();\n"],"mappings":";;;;;;;;;;;AAwBA,IAAM,iBAAN,MAAqB;;gCACO,IAAI,IAAyB;;;;;CAKvD,AAAO,SAAS,MAAc,OAA0B;EACtD,KAAK,OAAO,IAAI,MAAM,KAAK;CAC7B;;;;CAKA,AAAO,YAAY,MAAoB;EACrC,KAAK,OAAO,OAAO,IAAI;CACzB;;;;;CAMA,AAAO,WAAyB;EAC9B,OAAO,EAAE,QAAQ,YAAY,iBAAiB,UAAU,KAAK;CAC/D;;;;;;CAOA,MAAa,YAAmC;EAC9C,IAAI,CAAC,YAAY,YAAY,YAAY,gBACvC,OAAO,EAAE,QAAQ,QAAQ;EAG3B,MAAM,SAAkC,CAAC;EACzC,IAAI,YAAY;EAEhB,KAAK,MAAM,CAAC,MAAM,UAAU,KAAK,QAAQ;GACvC,MAAM,SAAS,MAAM,KAAK,SAAS,KAAK;GACxC,OAAO,QAAQ;GAEf,IAAI,CAAC,QACH,YAAY;EAEhB;EAEA,OAAO;GAAE,QAAQ,YAAY,OAAO;GAAS;EAAO;CACtD;;;;;;;;;;;;;;CAeA,AAAO,yBAAyB,eAA6B,OAAO,UAAgB;EAClF,KAAK,SAAS,YAAY,cAAc,IAAI,CAAC;CAC/C;;;;;;;CAQA,MAAc,SAAS,OAAsC;EAC3D,IAAI;GACF,OAAO,MAAM,MAAM;EACrB,QAAQ;GACN,OAAO;EACT;CACF;AACF;;;;AAKA,MAAa,SAAS,IAAI,eAAe"}

package/esm/http/middleware/cache-response-middleware.d.mts

@@ -1,7 +1,7 @@
 import { Request } from "../request.mjs";
 import { Middleware } from "../../router/types.mjs";
 
-//#region core/src/http/middleware/cache-response-middleware.d.ts
+//#region ../core/src/http/middleware/cache-response-middleware.d.ts
 type CacheMiddlewareOptions = {
   /**
    * Cache key

package/esm/http/middleware/cache-response-middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cache-response-middleware.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/cache-response-middleware.ts"],"mappings":";;;;KAsBY,sBAAA;;AAAZ;;EAIE,QAAA,aAEM,OAAA,EAAS,OAAA,iBACT,OAAA,EAAS,OAAA,KAAY,OAAA;EADZ;;;;;;EAQf,UAAA;EARM;;;;;EAcN,IAAA;EAIA;;;EAAA,GAAA;EAkDc;;;;;;EA3Cd,MAAA;AAAA;AAAA,iBA2Cc,eAAA,CACd,oBAAA,EAAsB,sBAAA,YACrB,UAAU"}
+{"version":3,"file":"cache-response-middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/cache-response-middleware.ts"],"mappings":";;;;KAsBY,sBAAA;;AAAZ;;EAIE,QAAA,aAEM,OAAA,EAAS,OAAA,iBACT,OAAA,EAAS,OAAA,KAAY,OAAA;EADZ;;;;;;EAQf,UAAA;EARM;;;;;EAcN,IAAA;EAIA;;;EAAA,GAAA;EAkDc;;;;;;EA3Cd,MAAA;AAAA;AAAA,iBA2Cc,eAAA,CACd,oBAAA,EAAsB,sBAAA,YACrB,UAAU"}

package/esm/http/middleware/cache-response-middleware.mjs

@@ -2,7 +2,7 @@ import { log } from "@warlock.js/logger";
 import { except } from "@mongez/reinforcements";
 import { cache } from "@warlock.js/cache";
 
-//#region core/src/http/middleware/cache-response-middleware.ts
+//#region ../core/src/http/middleware/cache-response-middleware.ts
 const defaultCacheOptions = { withLocale: true };
 async function parseCacheOptions(cacheOptions, request) {
 	if (typeof cacheOptions === "string") cacheOptions = { cacheKey: cacheOptions };

package/esm/http/middleware/cache-response-middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cache-response-middleware.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/cache-response-middleware.ts"],"sourcesContent":["import { except } from \"@mongez/reinforcements\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router/types\";\nimport type { Request } from \"./../request\";\nimport type { Response } from \"./../response\";\n\n/**\n * Shape persisted to the cache for a cached response. Stores the status and\n * content-type alongside the body so the HIT path can replay the response\n * faithfully via {@link Response.replay} instead of re-entering `send()`.\n */\ntype CachedResponsePayload = {\n  status: number;\n  data: unknown;\n  contentType?: string;\n};\n\n// TODO: Add option to determine whether to cache the response or not\n// TODO: add option to determine what to be cached from the response\n// TODO: add cache middleware config options for example to set the default driver, ttl, etc\n\nexport type CacheMiddlewareOptions = {\n  /**\n   * Cache key\n   */\n  cacheKey:\n    | string\n    | ((request: Request) => string)\n    | ((request: Request) => Promise<string>);\n  /**\n   * If true, then the response will be cached based on the current locale code\n   * This is useful when you have a multi-language website, and you want to cache the response based on the current locale\n   *\n   * @default true\n   */\n  withLocale?: boolean;\n  /**\n   * List of keys from the response object to omit from the cached response\n   *\n   * @default ['user']\n   */\n  omit?: string[];\n  /**\n   * Expires after number of seconds\n   */\n  ttl?: number;\n  /**\n   * Cache driver\n   *\n   * @see config/cache.ts: drivers object\n   * @default cache manager\n   */\n  driver?: string;\n};\n\nconst defaultCacheOptions: Partial<CacheMiddlewareOptions> = {\n  withLocale: true,\n};\n\ntype ParsedCacheOptions = Required<CacheMiddlewareOptions> & {\n  cacheKey: string;\n};\n\nasync function parseCacheOptions(\n  cacheOptions: CacheMiddlewareOptions | string,\n  request: Request,\n) {\n  if (typeof cacheOptions === \"string\") {\n    cacheOptions = {\n      cacheKey: cacheOptions,\n    };\n  }\n\n  if (typeof cacheOptions.cacheKey === \"function\") {\n    cacheOptions.cacheKey = await cacheOptions.cacheKey(request);\n  }\n\n  const finalCacheOptions = {\n    ...defaultCacheOptions,\n    ...cacheOptions,\n  } as ParsedCacheOptions;\n\n  if (finalCacheOptions.withLocale) {\n    const locale = request.getLocaleCode();\n\n    finalCacheOptions.cacheKey = `${finalCacheOptions.cacheKey}:${locale}`;\n  }\n\n  if (!finalCacheOptions.omit) {\n    finalCacheOptions.omit = [\"user\", \"settings\"];\n  }\n\n  return finalCacheOptions;\n}\n\nexport function cacheMiddleware(\n  responseCacheOptions: CacheMiddlewareOptions | string,\n): Middleware {\n  // The `Middleware` return annotation is load-bearing: without it, tsc never\n  // checks this factory's calling convention, which is how the positional v4\n  // shape survived an earlier refactor unnoticed.\n  return async function ({ request, response }) {\n    const { ttl, omit, cacheKey, driver } = await parseCacheOptions(\n      responseCacheOptions,\n      request,\n    );\n    const cacheDriver = driver ? await cache.use(driver) : cache;\n\n    const content = (await cacheDriver.get(cacheKey)) as CachedResponsePayload | null;\n\n    if (content) {\n      // Replay through the standard pipeline (status + content-type preserved)\n      // instead of `baseResponse.send()`, which would re-enter Response.send()\n      // on an already-sent reply, trip the double-send guard, and drop the\n      // status / content-type.\n      return response.replay({\n        status: content.status ?? 200,\n        body: content.data,\n        contentType: content.contentType,\n      });\n    }\n\n    response.onSent((response: Response) => {\n      if (!response.isOk || response.request.path !== request.path) {\n        return;\n      }\n\n      const sentContentType = response.contentType;\n\n      const content: CachedResponsePayload = {\n        status: response.statusCode,\n        data: except(response.parsedBody, omit),\n        contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n      };\n\n      // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n      // write (e.g. Redis down) would surface as an unhandledRejection.\n      cacheDriver.set(cacheKey, content, ttl).catch((error: unknown) => {\n        log.error(\"cache-middleware\", \"set\", error);\n      });\n    });\n  };\n}\n"],"mappings":";;;;;AAwDA,MAAM,sBAAuD,EAC3D,YAAY,KACd;AAMA,eAAe,kBACb,cACA,SACA;CACA,IAAI,OAAO,iBAAiB,UAC1B,eAAe,EACb,UAAU,aACZ;CAGF,IAAI,OAAO,aAAa,aAAa,YACnC,aAAa,WAAW,MAAM,aAAa,SAAS,OAAO;CAG7D,MAAM,oBAAoB;EACxB,GAAG;EACH,GAAG;CACL;CAEA,IAAI,kBAAkB,YAAY;EAChC,MAAM,SAAS,QAAQ,cAAc;EAErC,kBAAkB,WAAW,GAAG,kBAAkB,SAAS,GAAG;CAChE;CAEA,IAAI,CAAC,kBAAkB,MACrB,kBAAkB,OAAO,CAAC,QAAQ,UAAU;CAG9C,OAAO;AACT;AAEA,SAAgB,gBACd,sBACY;CAIZ,OAAO,eAAgB,EAAE,SAAS,YAAY;EAC5C,MAAM,EAAE,KAAK,MAAM,UAAU,WAAW,MAAM,kBAC5C,sBACA,OACF;EACA,MAAM,cAAc,SAAS,MAAM,MAAM,IAAI,MAAM,IAAI;EAEvD,MAAM,UAAW,MAAM,YAAY,IAAI,QAAQ;EAE/C,IAAI,SAKF,OAAO,SAAS,OAAO;GACrB,QAAQ,QAAQ,UAAU;GAC1B,MAAM,QAAQ;GACd,aAAa,QAAQ;EACvB,CAAC;EAGH,SAAS,QAAQ,aAAuB;GACtC,IAAI,CAAC,SAAS,QAAQ,SAAS,QAAQ,SAAS,QAAQ,MACtD;GAGF,MAAM,kBAAkB,SAAS;GAEjC,MAAM,UAAiC;IACrC,QAAQ,SAAS;IACjB,MAAM,OAAO,SAAS,YAAY,IAAI;IACtC,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE;GAIA,YAAY,IAAI,UAAU,SAAS,GAAG,EAAE,OAAO,UAAmB;IAChE,IAAI,MAAM,oBAAoB,OAAO,KAAK;GAC5C,CAAC;EACH,CAAC;CACH;AACF"}
+{"version":3,"file":"cache-response-middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/cache-response-middleware.ts"],"sourcesContent":["import { except } from \"@mongez/reinforcements\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router/types\";\nimport type { Request } from \"./../request\";\nimport type { Response } from \"./../response\";\n\n/**\n * Shape persisted to the cache for a cached response. Stores the status and\n * content-type alongside the body so the HIT path can replay the response\n * faithfully via {@link Response.replay} instead of re-entering `send()`.\n */\ntype CachedResponsePayload = {\n  status: number;\n  data: unknown;\n  contentType?: string;\n};\n\n// TODO: Add option to determine whether to cache the response or not\n// TODO: add option to determine what to be cached from the response\n// TODO: add cache middleware config options for example to set the default driver, ttl, etc\n\nexport type CacheMiddlewareOptions = {\n  /**\n   * Cache key\n   */\n  cacheKey:\n    | string\n    | ((request: Request) => string)\n    | ((request: Request) => Promise<string>);\n  /**\n   * If true, then the response will be cached based on the current locale code\n   * This is useful when you have a multi-language website, and you want to cache the response based on the current locale\n   *\n   * @default true\n   */\n  withLocale?: boolean;\n  /**\n   * List of keys from the response object to omit from the cached response\n   *\n   * @default ['user']\n   */\n  omit?: string[];\n  /**\n   * Expires after number of seconds\n   */\n  ttl?: number;\n  /**\n   * Cache driver\n   *\n   * @see config/cache.ts: drivers object\n   * @default cache manager\n   */\n  driver?: string;\n};\n\nconst defaultCacheOptions: Partial<CacheMiddlewareOptions> = {\n  withLocale: true,\n};\n\ntype ParsedCacheOptions = Required<CacheMiddlewareOptions> & {\n  cacheKey: string;\n};\n\nasync function parseCacheOptions(\n  cacheOptions: CacheMiddlewareOptions | string,\n  request: Request,\n) {\n  if (typeof cacheOptions === \"string\") {\n    cacheOptions = {\n      cacheKey: cacheOptions,\n    };\n  }\n\n  if (typeof cacheOptions.cacheKey === \"function\") {\n    cacheOptions.cacheKey = await cacheOptions.cacheKey(request);\n  }\n\n  const finalCacheOptions = {\n    ...defaultCacheOptions,\n    ...cacheOptions,\n  } as ParsedCacheOptions;\n\n  if (finalCacheOptions.withLocale) {\n    const locale = request.getLocaleCode();\n\n    finalCacheOptions.cacheKey = `${finalCacheOptions.cacheKey}:${locale}`;\n  }\n\n  if (!finalCacheOptions.omit) {\n    finalCacheOptions.omit = [\"user\", \"settings\"];\n  }\n\n  return finalCacheOptions;\n}\n\nexport function cacheMiddleware(\n  responseCacheOptions: CacheMiddlewareOptions | string,\n): Middleware {\n  // The `Middleware` return annotation is load-bearing: without it, tsc never\n  // checks this factory's calling convention, which is how the positional v4\n  // shape survived an earlier refactor unnoticed.\n  return async function ({ request, response }) {\n    const { ttl, omit, cacheKey, driver } = await parseCacheOptions(\n      responseCacheOptions,\n      request,\n    );\n    const cacheDriver = driver ? await cache.use(driver) : cache;\n\n    const content = (await cacheDriver.get(cacheKey)) as CachedResponsePayload | null;\n\n    if (content) {\n      // Replay through the standard pipeline (status + content-type preserved)\n      // instead of `baseResponse.send()`, which would re-enter Response.send()\n      // on an already-sent reply, trip the double-send guard, and drop the\n      // status / content-type.\n      return response.replay({\n        status: content.status ?? 200,\n        body: content.data,\n        contentType: content.contentType,\n      });\n    }\n\n    response.onSent((response: Response) => {\n      if (!response.isOk || response.request.path !== request.path) {\n        return;\n      }\n\n      const sentContentType = response.contentType;\n\n      const content: CachedResponsePayload = {\n        status: response.statusCode,\n        data: except(response.parsedBody, omit),\n        contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n      };\n\n      // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n      // write (e.g. Redis down) would surface as an unhandledRejection.\n      cacheDriver.set(cacheKey, content, ttl).catch((error: unknown) => {\n        log.error(\"cache-middleware\", \"set\", error);\n      });\n    });\n  };\n}\n"],"mappings":";;;;;AAwDA,MAAM,sBAAuD,EAC3D,YAAY,KACd;AAMA,eAAe,kBACb,cACA,SACA;CACA,IAAI,OAAO,iBAAiB,UAC1B,eAAe,EACb,UAAU,aACZ;CAGF,IAAI,OAAO,aAAa,aAAa,YACnC,aAAa,WAAW,MAAM,aAAa,SAAS,OAAO;CAG7D,MAAM,oBAAoB;EACxB,GAAG;EACH,GAAG;CACL;CAEA,IAAI,kBAAkB,YAAY;EAChC,MAAM,SAAS,QAAQ,cAAc;EAErC,kBAAkB,WAAW,GAAG,kBAAkB,SAAS,GAAG;CAChE;CAEA,IAAI,CAAC,kBAAkB,MACrB,kBAAkB,OAAO,CAAC,QAAQ,UAAU;CAG9C,OAAO;AACT;AAEA,SAAgB,gBACd,sBACY;CAIZ,OAAO,eAAgB,EAAE,SAAS,YAAY;EAC5C,MAAM,EAAE,KAAK,MAAM,UAAU,WAAW,MAAM,kBAC5C,sBACA,OACF;EACA,MAAM,cAAc,SAAS,MAAM,MAAM,IAAI,MAAM,IAAI;EAEvD,MAAM,UAAW,MAAM,YAAY,IAAI,QAAQ;EAE/C,IAAI,SAKF,OAAO,SAAS,OAAO;GACrB,QAAQ,QAAQ,UAAU;GAC1B,MAAM,QAAQ;GACd,aAAa,QAAQ;EACvB,CAAC;EAGH,SAAS,QAAQ,aAAuB;GACtC,IAAI,CAAC,SAAS,QAAQ,SAAS,QAAQ,SAAS,QAAQ,MACtD;GAGF,MAAM,kBAAkB,SAAS;GAEjC,MAAM,UAAiC;IACrC,QAAQ,SAAS;IACjB,MAAM,OAAO,SAAS,YAAY,IAAI;IACtC,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE;GAIA,YAAY,IAAI,UAAU,SAAS,GAAG,EAAE,OAAO,UAAmB;IAChE,IAAI,MAAM,oBAAoB,OAAO,KAAK;GAC5C,CAAC;EACH,CAAC;CACH;AACF"}

package/esm/http/middleware/concurrency-limit.middleware.d.mts

@@ -1,6 +1,6 @@
 import { Request } from "../request.mjs";
 import { Middleware } from "../../router/types.mjs";
-//#region core/src/http/middleware/concurrency-limit.middleware.d.ts
+//#region ../core/src/http/middleware/concurrency-limit.middleware.d.ts
 /**
  * Options for the concurrency limit middleware.
  */

package/esm/http/middleware/concurrency-limit.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"concurrency-limit.middleware.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/concurrency-limit.middleware.ts"],"mappings":";;;;;;KASY,uBAAA;EAAuB;;;;;;;;EASjC,YAAA,IAAgB,OAAA,EAAS,OAAO;EAiDlB;;;EA7Cd,YAAA;AAAA;;;;;AAgDW;;;;;;;;;;;;;;;;;;;;;;;;iBAHG,0BAAA,CACd,GAAA,UACA,OAAA,GAAS,uBAAA,GACR,UAAU"}
+{"version":3,"file":"concurrency-limit.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/concurrency-limit.middleware.ts"],"mappings":";;;;;;KASY,uBAAA;EAAuB;;;;;;;;EASjC,YAAA,IAAgB,OAAA,EAAS,OAAO;EAiDlB;;;EA7Cd,YAAA;AAAA;;;;;AAgDW;;;;;;;;;;;;;;;;;;;;;;;;iBAHG,0BAAA,CACd,GAAA,UACA,OAAA,GAAS,uBAAA,GACR,UAAU"}

package/esm/http/middleware/concurrency-limit.middleware.mjs

@@ -1,7 +1,7 @@
 import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
 
-//#region core/src/http/middleware/concurrency-limit.middleware.ts
+//#region ../core/src/http/middleware/concurrency-limit.middleware.ts
 const counters = /* @__PURE__ */ new Map();
 function release(key) {
 	const after = (counters.get(key) || 1) - 1;

package/esm/http/middleware/concurrency-limit.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"concurrency-limit.middleware.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/concurrency-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the concurrency limit middleware.\n */\nexport type ConcurrencyLimitOptions = {\n  /**\n   * Group key generator. Defaults to `request.route.path` — i.e. the cap\n   * applies across all callers of that route. Override to scope per-user\n   * or per-tenant.\n   *\n   * @example\n   * keyGenerator: (request) => `${request.route.path}:${request.user?.id ?? request.ip}`,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nconst counters = new Map<string, number>();\n\nfunction release(key: string) {\n  const after = (counters.get(key) || 1) - 1;\n\n  if (after <= 0) {\n    counters.delete(key);\n\n    return;\n  }\n\n  counters.set(key, after);\n}\n\n/**\n * Cap the number of in-flight requests against a route. Above the cap, new\n * requests get a fast 429 + `Retry-After: 1` — no queue, no timeout.\n *\n * Use for endpoints whose cost is unbounded per-request: report generation,\n * AI completions, image processing, expensive aggregations. Different from\n * `rateLimit()` — rate-limit caps requests-per-time, concurrency caps\n * in-flight requests at any instant.\n *\n * The counter is process-local. With `N` replicas the effective cap is\n * `N × max`. Document this in the route's behavior; if you need shared\n * concurrency across replicas, reach for a `@warlock.js/cache` lock instead.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/reports/generate\", reportController, {\n *   middleware: [middleware.concurrencyLimit(3)],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     middleware.concurrencyLimit(10, {\n *       keyGenerator: (request) => `ai:${request.user?.id ?? request.ip}`,\n *     }),\n *   ],\n * });\n */\nexport function concurrencyLimitMiddleware(\n  max: number,\n  options: ConcurrencyLimitOptions = {},\n): Middleware {\n  return ({ request, response }) => {\n    const key = options.keyGenerator?.(request) || request.route.path;\n    const current = counters.get(key) || 0;\n\n    if (current >= max) {\n      response.header(\"Retry-After\", 1);\n\n      return response.tooManyRequests({\n          error: options.errorMessage || t(\"http.concurrencyLimitReached\"),\n          errorCode: HttpErrorCodes.ConcurrencyLimitReached,\n          limit: max,\n        },\n      );\n    }\n\n    counters.set(key, current + 1);\n\n    let released = false;\n\n    const releaseOnce = () => {\n      if (released) {\n        return;\n      }\n\n      released = true;\n      release(key);\n    };\n\n    // `onSent` only fires from Response.send()/stream().end()/sse().end().\n    // Bare-reply paths (noContent, redirect, sendFile, download, sendBuffer,\n    // raw send) never trigger it, so the slot would leak and the route would\n    // permanently 429 after `max` such requests. Bind to the raw socket\n    // lifecycle as well so the slot frees regardless of response path —\n    // `releaseOnce` is idempotent, so double-firing is harmless.\n    response.onSent((_sentResponse: Response) => releaseOnce());\n    response.baseResponse.raw.once(\"finish\", releaseOnce);\n    response.baseResponse.raw.once(\"close\", releaseOnce);\n  };\n}\n"],"mappings":";;;;AAyBA,MAAM,2BAAW,IAAI,IAAoB;AAEzC,SAAS,QAAQ,KAAa;CAC5B,MAAM,SAAS,SAAS,IAAI,GAAG,KAAK,KAAK;CAEzC,IAAI,SAAS,GAAG;EACd,SAAS,OAAO,GAAG;EAEnB;CACF;CAEA,SAAS,IAAI,KAAK,KAAK;AACzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,2BACd,KACA,UAAmC,CAAC,GACxB;CACZ,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,QAAQ,eAAe,OAAO,KAAK,QAAQ,MAAM;EAC7D,MAAM,UAAU,SAAS,IAAI,GAAG,KAAK;EAErC,IAAI,WAAW,KAAK;GAClB,SAAS,OAAO,eAAe,CAAC;GAEhC,OAAO,SAAS,gBAAgB;IAC5B,OAAO,QAAQ,gBAAgB,EAAE,8BAA8B;IAC/D;IACA,OAAO;GACT,CACF;EACF;EAEA,SAAS,IAAI,KAAK,UAAU,CAAC;EAE7B,IAAI,WAAW;EAEf,MAAM,oBAAoB;GACxB,IAAI,UACF;GAGF,WAAW;GACX,QAAQ,GAAG;EACb;EAQA,SAAS,QAAQ,kBAA4B,YAAY,CAAC;EAC1D,SAAS,aAAa,IAAI,KAAK,UAAU,WAAW;EACpD,SAAS,aAAa,IAAI,KAAK,SAAS,WAAW;CACrD;AACF"}
+{"version":3,"file":"concurrency-limit.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/concurrency-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the concurrency limit middleware.\n */\nexport type ConcurrencyLimitOptions = {\n  /**\n   * Group key generator. Defaults to `request.route.path` — i.e. the cap\n   * applies across all callers of that route. Override to scope per-user\n   * or per-tenant.\n   *\n   * @example\n   * keyGenerator: (request) => `${request.route.path}:${request.user?.id ?? request.ip}`,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nconst counters = new Map<string, number>();\n\nfunction release(key: string) {\n  const after = (counters.get(key) || 1) - 1;\n\n  if (after <= 0) {\n    counters.delete(key);\n\n    return;\n  }\n\n  counters.set(key, after);\n}\n\n/**\n * Cap the number of in-flight requests against a route. Above the cap, new\n * requests get a fast 429 + `Retry-After: 1` — no queue, no timeout.\n *\n * Use for endpoints whose cost is unbounded per-request: report generation,\n * AI completions, image processing, expensive aggregations. Different from\n * `rateLimit()` — rate-limit caps requests-per-time, concurrency caps\n * in-flight requests at any instant.\n *\n * The counter is process-local. With `N` replicas the effective cap is\n * `N × max`. Document this in the route's behavior; if you need shared\n * concurrency across replicas, reach for a `@warlock.js/cache` lock instead.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/reports/generate\", reportController, {\n *   middleware: [middleware.concurrencyLimit(3)],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     middleware.concurrencyLimit(10, {\n *       keyGenerator: (request) => `ai:${request.user?.id ?? request.ip}`,\n *     }),\n *   ],\n * });\n */\nexport function concurrencyLimitMiddleware(\n  max: number,\n  options: ConcurrencyLimitOptions = {},\n): Middleware {\n  return ({ request, response }) => {\n    const key = options.keyGenerator?.(request) || request.route.path;\n    const current = counters.get(key) || 0;\n\n    if (current >= max) {\n      response.header(\"Retry-After\", 1);\n\n      return response.tooManyRequests({\n          error: options.errorMessage || t(\"http.concurrencyLimitReached\"),\n          errorCode: HttpErrorCodes.ConcurrencyLimitReached,\n          limit: max,\n        },\n      );\n    }\n\n    counters.set(key, current + 1);\n\n    let released = false;\n\n    const releaseOnce = () => {\n      if (released) {\n        return;\n      }\n\n      released = true;\n      release(key);\n    };\n\n    // `onSent` only fires from Response.send()/stream().end()/sse().end().\n    // Bare-reply paths (noContent, redirect, sendFile, download, sendBuffer,\n    // raw send) never trigger it, so the slot would leak and the route would\n    // permanently 429 after `max` such requests. Bind to the raw socket\n    // lifecycle as well so the slot frees regardless of response path —\n    // `releaseOnce` is idempotent, so double-firing is harmless.\n    response.onSent((_sentResponse: Response) => releaseOnce());\n    response.baseResponse.raw.once(\"finish\", releaseOnce);\n    response.baseResponse.raw.once(\"close\", releaseOnce);\n  };\n}\n"],"mappings":";;;;AAyBA,MAAM,2BAAW,IAAI,IAAoB;AAEzC,SAAS,QAAQ,KAAa;CAC5B,MAAM,SAAS,SAAS,IAAI,GAAG,KAAK,KAAK;CAEzC,IAAI,SAAS,GAAG;EACd,SAAS,OAAO,GAAG;EAEnB;CACF;CAEA,SAAS,IAAI,KAAK,KAAK;AACzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,2BACd,KACA,UAAmC,CAAC,GACxB;CACZ,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,QAAQ,eAAe,OAAO,KAAK,QAAQ,MAAM;EAC7D,MAAM,UAAU,SAAS,IAAI,GAAG,KAAK;EAErC,IAAI,WAAW,KAAK;GAClB,SAAS,OAAO,eAAe,CAAC;GAEhC,OAAO,SAAS,gBAAgB;IAC5B,OAAO,QAAQ,gBAAgB,EAAE,8BAA8B;IAC/D;IACA,OAAO;GACT,CACF;EACF;EAEA,SAAS,IAAI,KAAK,UAAU,CAAC;EAE7B,IAAI,WAAW;EAEf,MAAM,oBAAoB;GACxB,IAAI,UACF;GAGF,WAAW;GACX,QAAQ,GAAG;EACb;EAQA,SAAS,QAAQ,kBAA4B,YAAY,CAAC;EAC1D,SAAS,aAAa,IAAI,KAAK,UAAU,WAAW;EACpD,SAAS,aAAa,IAAI,KAAK,SAAS,WAAW;CACrD;AACF"}

package/esm/http/middleware/idempotency.middleware.d.mts

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region core/src/http/middleware/idempotency.middleware.d.ts
+//#region ../core/src/http/middleware/idempotency.middleware.d.ts
 /**
  * Options for the idempotency middleware.
  */

package/esm/http/middleware/idempotency.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.middleware.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/idempotency.middleware.ts"],"mappings":";;;;;KAgBY,kBAAA;EAAkB;;;EAI5B,GAAA;EAKA;;;;EAAA,UAAA;EAqDc;;;;;EA/Cd,OAAA;EA+CuE;;AAAU;;EA1CjF,MAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0Cc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}
+{"version":3,"file":"idempotency.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/idempotency.middleware.ts"],"mappings":";;;;;KAgBY,kBAAA;EAAkB;;;EAI5B,GAAA;EAKA;;;;EAAA,UAAA;EAqDc;;;;;EA/Cd,OAAA;EA+CuE;;AAAU;;EA1CjF,MAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0Cc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}

package/esm/http/middleware/idempotency.middleware.mjs

@@ -5,7 +5,7 @@ import config from "@mongez/config";
 import { log } from "@warlock.js/logger";
 import { cache } from "@warlock.js/cache";
 
-//#region core/src/http/middleware/idempotency.middleware.ts
+//#region ../core/src/http/middleware/idempotency.middleware.ts
 const DEFAULT_METHODS = [
 	"POST",
 	"PUT",

package/esm/http/middleware/idempotency.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.middleware.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/idempotency.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\nimport {\n  buildIdempotencyCacheKey,\n  hashBody,\n  isValidIdempotencyKey,\n} from \"./utils/idempotency-key\";\n\n/**\n * Options for the idempotency middleware.\n */\nexport type IdempotencyOptions = {\n  /**\n   * Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).\n   */\n  ttl?: number;\n  /**\n   * Header name carrying the client's key. Falls back to\n   * `http.idempotency.headerName`, then `\"Idempotency-Key\"`.\n   */\n  headerName?: string;\n  /**\n   * HTTP methods eligible for idempotency. Falls back to\n   * `http.idempotency.methods`, then `[\"POST\",\"PUT\",\"PATCH\",\"DELETE\"]`.\n   * Safe methods (GET/HEAD) are skipped regardless.\n   */\n  methods?: string[];\n  /**\n   * Cache driver name. Falls back to `http.idempotency.driver`, then the\n   * default driver of the cache manager.\n   */\n  driver?: string;\n};\n\ntype CachedResponse = {\n  status: number;\n  body: unknown;\n  bodyHash: string;\n  contentType?: string;\n};\n\nconst DEFAULT_METHODS = [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"];\n\n/**\n * Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,\n * same body, within TTL → cached replay; same key, different body → 422\n * `IdempotencyKeyConflict`.\n *\n * **Must run after `authMiddleware`** — the cache key is scoped per-user\n * (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.\n * Anonymous requests fall back to IP scope.\n *\n * The replay sets `Idempotent-Replay: true` on the response for easy\n * client-side / observability detection.\n *\n * Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through\n * even with the header set (RFC: safe methods are already idempotent).\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [authMiddleware(\"client\"), middleware.idempotency()],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries\n *   ],\n * });\n */\nexport function idempotencyMiddleware(options: IdempotencyOptions = {}): Middleware {\n  return async ({ request, response }) => {\n    const headerName =\n      options.headerName ||\n      config.get(\"http.idempotency.headerName\", \"Idempotency-Key\");\n    const methods =\n      options.methods || config.get(\"http.idempotency.methods\", DEFAULT_METHODS);\n    const ttl = options.ttl || config.get(\"http.idempotency.ttl\", 86400);\n    const driverName = options.driver || config.get(\"http.idempotency.driver\");\n\n    if (!methods.includes(request.method.toUpperCase())) return;\n\n    const idempotencyKey = request.header(headerName.toLowerCase());\n\n    if (!idempotencyKey) return;\n\n    if (!isValidIdempotencyKey(idempotencyKey)) {\n      return response.badRequest({\n        error: t(\"http.idempotencyKeyInvalid\"),\n        errorCode: HttpErrorCodes.IdempotencyKeyInvalid,\n      });\n    }\n\n    const cacheDriver = driverName ? await cache.use(driverName) : cache;\n    const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);\n    const bodyHash = hashBody(request.body);\n\n    const cached = (await cacheDriver.get(cacheKey)) as CachedResponse | null;\n\n    if (cached) {\n      if (cached.bodyHash !== bodyHash) {\n        return response.unprocessableEntity({\n          error: t(\"http.idempotencyKeyConflict\"),\n          errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n        });\n      }\n\n      response.header(\"Idempotent-Replay\", \"true\");\n\n      return response.replay({\n        status: cached.status,\n        body: cached.body,\n        contentType: cached.contentType,\n      });\n    }\n\n    response.onSent((sentResponse: Response) => {\n      // Don't cache server errors — clients should be able to retry past a 5xx.\n      // 4xx are deterministic outcomes of the request, so caching is fine.\n      if (sentResponse.statusCode >= 500) return;\n\n      const sentContentType = sentResponse.contentType;\n\n      // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n      // write (e.g. Redis down) would surface as an unhandledRejection.\n      cacheDriver\n        .set(\n          cacheKey,\n          {\n            status: sentResponse.statusCode,\n            body: sentResponse.parsedBody,\n            bodyHash,\n            contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n          },\n          ttl,\n        )\n        .catch((error: unknown) => {\n          log.error(\"idempotency-middleware\", \"set\", error);\n        });\n    });\n  };\n}\n"],"mappings":";;;;;;;;AA8CA,MAAM,kBAAkB;CAAC;CAAQ;CAAO;CAAS;AAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCzD,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,aACJ,QAAQ,cACR,OAAO,IAAI,+BAA+B,iBAAiB;EAC7D,MAAM,UACJ,QAAQ,WAAW,OAAO,IAAI,4BAA4B,eAAe;EAC3E,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAI,wBAAwB,KAAK;EACnE,MAAM,aAAa,QAAQ,UAAU,OAAO,IAAI,yBAAyB;EAEzE,IAAI,CAAC,QAAQ,SAAS,QAAQ,OAAO,YAAY,CAAC,GAAG;EAErD,MAAM,iBAAiB,QAAQ,OAAO,WAAW,YAAY,CAAC;EAE9D,IAAI,CAAC,gBAAgB;EAErB,IAAI,CAAC,sBAAsB,cAAc,GACvC,OAAO,SAAS,WAAW;GACzB,OAAO,EAAE,4BAA4B;GACrC;EACF,CAAC;EAGH,MAAM,cAAc,aAAa,MAAM,MAAM,IAAI,UAAU,IAAI;EAC/D,MAAM,WAAW,yBAAyB,SAAS,cAAc;EACjE,MAAM,WAAW,SAAS,QAAQ,IAAI;EAEtC,MAAM,SAAU,MAAM,YAAY,IAAI,QAAQ;EAE9C,IAAI,QAAQ;GACV,IAAI,OAAO,aAAa,UACtB,OAAO,SAAS,oBAAoB;IAClC,OAAO,EAAE,6BAA6B;IACtC;GACF,CAAC;GAGH,SAAS,OAAO,qBAAqB,MAAM;GAE3C,OAAO,SAAS,OAAO;IACrB,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,aAAa,OAAO;GACtB,CAAC;EACH;EAEA,SAAS,QAAQ,iBAA2B;GAG1C,IAAI,aAAa,cAAc,KAAK;GAEpC,MAAM,kBAAkB,aAAa;GAIrC,YACG,IACC,UACA;IACE,QAAQ,aAAa;IACrB,MAAM,aAAa;IACnB;IACA,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE,GACA,GACF,EACC,OAAO,UAAmB;IACzB,IAAI,MAAM,0BAA0B,OAAO,KAAK;GAClD,CAAC;EACL,CAAC;CACH;AACF"}
+{"version":3,"file":"idempotency.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/idempotency.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\nimport {\n  buildIdempotencyCacheKey,\n  hashBody,\n  isValidIdempotencyKey,\n} from \"./utils/idempotency-key\";\n\n/**\n * Options for the idempotency middleware.\n */\nexport type IdempotencyOptions = {\n  /**\n   * Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).\n   */\n  ttl?: number;\n  /**\n   * Header name carrying the client's key. Falls back to\n   * `http.idempotency.headerName`, then `\"Idempotency-Key\"`.\n   */\n  headerName?: string;\n  /**\n   * HTTP methods eligible for idempotency. Falls back to\n   * `http.idempotency.methods`, then `[\"POST\",\"PUT\",\"PATCH\",\"DELETE\"]`.\n   * Safe methods (GET/HEAD) are skipped regardless.\n   */\n  methods?: string[];\n  /**\n   * Cache driver name. Falls back to `http.idempotency.driver`, then the\n   * default driver of the cache manager.\n   */\n  driver?: string;\n};\n\ntype CachedResponse = {\n  status: number;\n  body: unknown;\n  bodyHash: string;\n  contentType?: string;\n};\n\nconst DEFAULT_METHODS = [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"];\n\n/**\n * Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,\n * same body, within TTL → cached replay; same key, different body → 422\n * `IdempotencyKeyConflict`.\n *\n * **Must run after `authMiddleware`** — the cache key is scoped per-user\n * (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.\n * Anonymous requests fall back to IP scope.\n *\n * The replay sets `Idempotent-Replay: true` on the response for easy\n * client-side / observability detection.\n *\n * Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through\n * even with the header set (RFC: safe methods are already idempotent).\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [authMiddleware(\"client\"), middleware.idempotency()],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries\n *   ],\n * });\n */\nexport function idempotencyMiddleware(options: IdempotencyOptions = {}): Middleware {\n  return async ({ request, response }) => {\n    const headerName =\n      options.headerName ||\n      config.get(\"http.idempotency.headerName\", \"Idempotency-Key\");\n    const methods =\n      options.methods || config.get(\"http.idempotency.methods\", DEFAULT_METHODS);\n    const ttl = options.ttl || config.get(\"http.idempotency.ttl\", 86400);\n    const driverName = options.driver || config.get(\"http.idempotency.driver\");\n\n    if (!methods.includes(request.method.toUpperCase())) return;\n\n    const idempotencyKey = request.header(headerName.toLowerCase());\n\n    if (!idempotencyKey) return;\n\n    if (!isValidIdempotencyKey(idempotencyKey)) {\n      return response.badRequest({\n        error: t(\"http.idempotencyKeyInvalid\"),\n        errorCode: HttpErrorCodes.IdempotencyKeyInvalid,\n      });\n    }\n\n    const cacheDriver = driverName ? await cache.use(driverName) : cache;\n    const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);\n    const bodyHash = hashBody(request.body);\n\n    const cached = (await cacheDriver.get(cacheKey)) as CachedResponse | null;\n\n    if (cached) {\n      if (cached.bodyHash !== bodyHash) {\n        return response.unprocessableEntity({\n          error: t(\"http.idempotencyKeyConflict\"),\n          errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n        });\n      }\n\n      response.header(\"Idempotent-Replay\", \"true\");\n\n      return response.replay({\n        status: cached.status,\n        body: cached.body,\n        contentType: cached.contentType,\n      });\n    }\n\n    response.onSent((sentResponse: Response) => {\n      // Don't cache server errors — clients should be able to retry past a 5xx.\n      // 4xx are deterministic outcomes of the request, so caching is fine.\n      if (sentResponse.statusCode >= 500) return;\n\n      const sentContentType = sentResponse.contentType;\n\n      // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n      // write (e.g. Redis down) would surface as an unhandledRejection.\n      cacheDriver\n        .set(\n          cacheKey,\n          {\n            status: sentResponse.statusCode,\n            body: sentResponse.parsedBody,\n            bodyHash,\n            contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n          },\n          ttl,\n        )\n        .catch((error: unknown) => {\n          log.error(\"idempotency-middleware\", \"set\", error);\n        });\n    });\n  };\n}\n"],"mappings":";;;;;;;;AA8CA,MAAM,kBAAkB;CAAC;CAAQ;CAAO;CAAS;AAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCzD,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,aACJ,QAAQ,cACR,OAAO,IAAI,+BAA+B,iBAAiB;EAC7D,MAAM,UACJ,QAAQ,WAAW,OAAO,IAAI,4BAA4B,eAAe;EAC3E,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAI,wBAAwB,KAAK;EACnE,MAAM,aAAa,QAAQ,UAAU,OAAO,IAAI,yBAAyB;EAEzE,IAAI,CAAC,QAAQ,SAAS,QAAQ,OAAO,YAAY,CAAC,GAAG;EAErD,MAAM,iBAAiB,QAAQ,OAAO,WAAW,YAAY,CAAC;EAE9D,IAAI,CAAC,gBAAgB;EAErB,IAAI,CAAC,sBAAsB,cAAc,GACvC,OAAO,SAAS,WAAW;GACzB,OAAO,EAAE,4BAA4B;GACrC;EACF,CAAC;EAGH,MAAM,cAAc,aAAa,MAAM,MAAM,IAAI,UAAU,IAAI;EAC/D,MAAM,WAAW,yBAAyB,SAAS,cAAc;EACjE,MAAM,WAAW,SAAS,QAAQ,IAAI;EAEtC,MAAM,SAAU,MAAM,YAAY,IAAI,QAAQ;EAE9C,IAAI,QAAQ;GACV,IAAI,OAAO,aAAa,UACtB,OAAO,SAAS,oBAAoB;IAClC,OAAO,EAAE,6BAA6B;IACtC;GACF,CAAC;GAGH,SAAS,OAAO,qBAAqB,MAAM;GAE3C,OAAO,SAAS,OAAO;IACrB,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,aAAa,OAAO;GACtB,CAAC;EACH;EAEA,SAAS,QAAQ,iBAA2B;GAG1C,IAAI,aAAa,cAAc,KAAK;GAEpC,MAAM,kBAAkB,aAAa;GAIrC,YACG,IACC,UACA;IACE,QAAQ,aAAa;IACrB,MAAM,aAAa;IACnB;IACA,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE,GACA,GACF,EACC,OAAO,UAAmB;IACzB,IAAI,MAAM,0BAA0B,OAAO,KAAK;GAClD,CAAC;EACL,CAAC;CACH;AACF"}

package/esm/http/middleware/inject-request-context.d.mts

@@ -2,7 +2,7 @@ import { Request } from "../request.mjs";
 import { Response } from "../response.mjs";
 import { ReturnedResponse } from "../types.mjs";
 
-//#region core/src/http/middleware/inject-request-context.d.ts
+//#region ../core/src/http/middleware/inject-request-context.d.ts
 /**
  * Create request store and execute middleware + handler
  *

package/esm/http/middleware/inject-request-context.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;AAiDA;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;iBAkHK,CAAA,CAAE,OAAA,UAAiB,YAAkB"}
+{"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;AAiDA;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;iBAkHK,CAAA,CAAE,OAAA,UAAiB,YAAkB"}

package/esm/http/middleware/inject-request-context.mjs

@@ -7,7 +7,7 @@ import { trans } from "@mongez/localization";
 import { DatabaseWriterValidationError } from "@warlock.js/cascade";
 import { contextManager } from "@warlock.js/context";
 
-//#region core/src/http/middleware/inject-request-context.ts
+//#region ../core/src/http/middleware/inject-request-context.ts
 /**
 * Request Context Middleware
 *

package/esm/http/middleware/inject-request-context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["C:/Work/Warlock.js/core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\r\n * Request Context Middleware\r\n *\r\n * Creates a unified context for each request using the ContextManager.\r\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\r\n */\r\nimport { trans } from \"@mongez/localization\";\r\nimport { type GenericObject } from \"@mongez/reinforcements\";\r\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\r\nimport { contextManager } from \"@warlock.js/context\";\r\nimport config from \"@mongez/config\";\r\nimport { environment } from \"../../utils\";\r\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\r\nimport {\r\n  BadRequestError,\r\n  ForbiddenError,\r\n  HttpError,\r\n  ResourceNotFoundError,\r\n  ServerError,\r\n  UnAuthorizedError,\r\n} from \"../errors\";\r\nimport { type Request } from \"../request\";\r\nimport { type Response } from \"../response\";\r\nimport { type ReturnedResponse } from \"./../types\";\r\n\r\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\r\n\r\n/**\r\n * Echo `request.id` back as a response header so the FE / proxies / log\r\n * aggregators can correlate by the same value the server logs against.\r\n *\r\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\r\n * Skip when `http.requestId.enabled` is explicitly false.\r\n */\r\nfunction stampRequestIdHeader(request: Request, response: Response) {\r\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\r\n\r\n  if (requestIdConfig.enabled === false) return;\r\n\r\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\r\n\r\n  response.header(headerName, request.id);\r\n}\r\n\r\n/**\r\n * Create request store and execute middleware + handler\r\n *\r\n * Runs all registered contexts together using ContextManager.\r\n */\r\nexport function createRequestStore(\r\n  request: Request<any>,\r\n  response: Response,\r\n): Promise<ReturnedResponse> {\r\n  stampRequestIdHeader(request, response);\r\n\r\n  // Build all context stores using the immutable API\r\n  // Each context defines its own store initialization via buildStore()\r\n  const httpContextStore = contextManager.buildStores({ request, response });\r\n\r\n  // Run all contexts together!\r\n  return contextManager.runAll(httpContextStore, async () => {\r\n    try {\r\n      // Run middleware chain\r\n      const result = await request.runMiddleware();\r\n\r\n      if (result) {\r\n        return result as ReturnedResponse;\r\n      }\r\n\r\n      // Execute route handler\r\n      request.trigger(\"executingAction\", request.route);\r\n\r\n      const handler = request.getHandler();\r\n\r\n      request.log(\"Executing Handler\", \"info\");\r\n\r\n      const output = await handler({ request, response });\r\n\r\n      request.log(\"Handler Executed Successfully\", \"success\");\r\n\r\n      request.trigger(\"executedAction\", request.route);\r\n\r\n      return output as ReturnedResponse;\r\n    } catch (error) {\r\n      request.log(error, \"error\");\r\n      return handleRequestError(error, response);\r\n    }\r\n  });\r\n}\r\n\r\n/**\r\n * Handle request errors\r\n * @internal\r\n */\r\nfunction handleRequestError(error: unknown, response: Response): ReturnedResponse {\r\n  if (error instanceof HttpError) {\r\n    const payload: GenericObject = {\r\n      error: error.message,\r\n    };\r\n    if (error.payload) {\r\n      payload.payload = error.payload;\r\n    }\r\n\r\n    if (environment() === \"development\") {\r\n      payload.stack = error.stack;\r\n    }\r\n\r\n    return response.setStatusCode(error.status).send(payload);\r\n  }\r\n\r\n  if (error instanceof ResourceNotFoundError) {\r\n    return response.notFound({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof UnAuthorizedError) {\r\n    return response.unauthorized({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ForbiddenError) {\r\n    return response.forbidden({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof BadRequestError) {\r\n    return response.badRequest({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof DatabaseWriterValidationError) {\r\n    return response.badRequest({\r\n      errors: error.errors,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ServerError) {\r\n    return response.serverError({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  // Last resort: the error matched none of the known shapes above, so the\r\n  // client gets a deliberately opaque message. Without this line the error\r\n  // itself is discarded here — no stack, no message, nothing in any log — and\r\n  // an unrecognised failure becomes indistinguishable from a working server\r\n  // returning 500. Never swallow the only copy of an error (`65e476ee`).\r\n  console.error(\"[warlock] unhandled request error:\", error);\r\n\r\n  return response.serverError({\r\n    error: \"Internal server error.\",\r\n  });\r\n}\r\n\r\n/**\r\n * Translate a keyword (uses request context for locale)\r\n */\r\nexport function t(keyword: string, placeholders?: any) {\r\n  return (\r\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\r\n    trans(keyword, placeholders)\r\n  );\r\n}\r\n\r\n// `fromRequest` was removed in v5. It cached computed values as dynamic\r\n// properties on the Request instance, which only compiled because of the\r\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\r\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\r\n// per-request lifetime, single-flight, and it never touches the Request object.\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAItC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAEF,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,OAAO,OAAO;GAC1B,OAAO,mBAAmB,OAAO,QAAQ;EAC3C;CACF,CAAC;AACH;;;;;AAMA,SAAS,mBAAmB,OAAgB,UAAsC;CAChF,IAAI,iBAAiB,WAAW;EAC9B,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,EAAE,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,uBACnB,OAAO,SAAS,SAAS;EACvB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,mBACnB,OAAO,SAAS,aAAa;EAC3B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,gBACnB,OAAO,SAAS,UAAU;EACxB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,iBACnB,OAAO,SAAS,WAAW;EACzB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,+BACnB,OAAO,SAAS,WAAW,EACzB,QAAQ,MAAM,OAChB,CAAC;CAGH,IAAI,iBAAiB,aACnB,OAAO,SAAS,YAAY;EAC1B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAQH,QAAQ,MAAM,sCAAsC,KAAK;CAEzD,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAoB;CACrD,OACEA,eAAuB,WAAW,GAAG,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}
+{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\r\n * Request Context Middleware\r\n *\r\n * Creates a unified context for each request using the ContextManager.\r\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\r\n */\r\nimport { trans } from \"@mongez/localization\";\r\nimport { type GenericObject } from \"@mongez/reinforcements\";\r\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\r\nimport { contextManager } from \"@warlock.js/context\";\r\nimport config from \"@mongez/config\";\r\nimport { environment } from \"../../utils\";\r\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\r\nimport {\r\n  BadRequestError,\r\n  ForbiddenError,\r\n  HttpError,\r\n  ResourceNotFoundError,\r\n  ServerError,\r\n  UnAuthorizedError,\r\n} from \"../errors\";\r\nimport { type Request } from \"../request\";\r\nimport { type Response } from \"../response\";\r\nimport { type ReturnedResponse } from \"./../types\";\r\n\r\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\r\n\r\n/**\r\n * Echo `request.id` back as a response header so the FE / proxies / log\r\n * aggregators can correlate by the same value the server logs against.\r\n *\r\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\r\n * Skip when `http.requestId.enabled` is explicitly false.\r\n */\r\nfunction stampRequestIdHeader(request: Request, response: Response) {\r\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\r\n\r\n  if (requestIdConfig.enabled === false) return;\r\n\r\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\r\n\r\n  response.header(headerName, request.id);\r\n}\r\n\r\n/**\r\n * Create request store and execute middleware + handler\r\n *\r\n * Runs all registered contexts together using ContextManager.\r\n */\r\nexport function createRequestStore(\r\n  request: Request<any>,\r\n  response: Response,\r\n): Promise<ReturnedResponse> {\r\n  stampRequestIdHeader(request, response);\r\n\r\n  // Build all context stores using the immutable API\r\n  // Each context defines its own store initialization via buildStore()\r\n  const httpContextStore = contextManager.buildStores({ request, response });\r\n\r\n  // Run all contexts together!\r\n  return contextManager.runAll(httpContextStore, async () => {\r\n    try {\r\n      // Run middleware chain\r\n      const result = await request.runMiddleware();\r\n\r\n      if (result) {\r\n        return result as ReturnedResponse;\r\n      }\r\n\r\n      // Execute route handler\r\n      request.trigger(\"executingAction\", request.route);\r\n\r\n      const handler = request.getHandler();\r\n\r\n      request.log(\"Executing Handler\", \"info\");\r\n\r\n      const output = await handler({ request, response });\r\n\r\n      request.log(\"Handler Executed Successfully\", \"success\");\r\n\r\n      request.trigger(\"executedAction\", request.route);\r\n\r\n      return output as ReturnedResponse;\r\n    } catch (error) {\r\n      request.log(error, \"error\");\r\n      return handleRequestError(error, response);\r\n    }\r\n  });\r\n}\r\n\r\n/**\r\n * Handle request errors\r\n * @internal\r\n */\r\nfunction handleRequestError(error: unknown, response: Response): ReturnedResponse {\r\n  if (error instanceof HttpError) {\r\n    const payload: GenericObject = {\r\n      error: error.message,\r\n    };\r\n    if (error.payload) {\r\n      payload.payload = error.payload;\r\n    }\r\n\r\n    if (environment() === \"development\") {\r\n      payload.stack = error.stack;\r\n    }\r\n\r\n    return response.setStatusCode(error.status).send(payload);\r\n  }\r\n\r\n  if (error instanceof ResourceNotFoundError) {\r\n    return response.notFound({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof UnAuthorizedError) {\r\n    return response.unauthorized({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ForbiddenError) {\r\n    return response.forbidden({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof BadRequestError) {\r\n    return response.badRequest({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof DatabaseWriterValidationError) {\r\n    return response.badRequest({\r\n      errors: error.errors,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ServerError) {\r\n    return response.serverError({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  // Last resort: the error matched none of the known shapes above, so the\r\n  // client gets a deliberately opaque message. Without this line the error\r\n  // itself is discarded here — no stack, no message, nothing in any log — and\r\n  // an unrecognised failure becomes indistinguishable from a working server\r\n  // returning 500. Never swallow the only copy of an error (`65e476ee`).\r\n  console.error(\"[warlock] unhandled request error:\", error);\r\n\r\n  return response.serverError({\r\n    error: \"Internal server error.\",\r\n  });\r\n}\r\n\r\n/**\r\n * Translate a keyword (uses request context for locale)\r\n */\r\nexport function t(keyword: string, placeholders?: any) {\r\n  return (\r\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\r\n    trans(keyword, placeholders)\r\n  );\r\n}\r\n\r\n// `fromRequest` was removed in v5. It cached computed values as dynamic\r\n// properties on the Request instance, which only compiled because of the\r\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\r\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\r\n// per-request lifetime, single-flight, and it never touches the Request object.\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAItC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAEF,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,OAAO,OAAO;GAC1B,OAAO,mBAAmB,OAAO,QAAQ;EAC3C;CACF,CAAC;AACH;;;;;AAMA,SAAS,mBAAmB,OAAgB,UAAsC;CAChF,IAAI,iBAAiB,WAAW;EAC9B,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,EAAE,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,uBACnB,OAAO,SAAS,SAAS;EACvB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,mBACnB,OAAO,SAAS,aAAa;EAC3B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,gBACnB,OAAO,SAAS,UAAU;EACxB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,iBACnB,OAAO,SAAS,WAAW;EACzB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,+BACnB,OAAO,SAAS,WAAW,EACzB,QAAQ,MAAM,OAChB,CAAC;CAGH,IAAI,iBAAiB,aACnB,OAAO,SAAS,YAAY;EAC1B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAQH,QAAQ,MAAM,sCAAsC,KAAK;CAEzD,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAoB;CACrD,OACEA,eAAuB,WAAW,GAAG,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}

package/esm/http/middleware/ip-filter.middleware.d.mts

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region core/src/http/middleware/ip-filter.middleware.d.ts
+//#region ../core/src/http/middleware/ip-filter.middleware.d.ts
 /**
  * Options for the IP filter middleware. Use at least one of `allow` / `deny`.
  *

package/esm/http/middleware/ip-filter.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ip-filter.middleware.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/ip-filter.middleware.ts"],"mappings":";;;;;AAUA;;KAAY,eAAA;EAAe;;;;EAKzB,KAAA;EASY;AA+Bd;;;EAnCE,IAAA;EAmC0C;;;EA/B1C,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Bc,kBAAA,CAAmB,OAAA,EAAS,eAAA,GAAkB,UAAU"}
+{"version":3,"file":"ip-filter.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/ip-filter.middleware.ts"],"mappings":";;;;;AAUA;;KAAY,eAAA;EAAe;;;;EAKzB,KAAA;EASY;AA+Bd;;;EAnCE,IAAA;EAmC0C;;;EA/B1C,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Bc,kBAAA,CAAmB,OAAA,EAAS,eAAA,GAAkB,UAAU"}

package/esm/http/middleware/ip-filter.middleware.mjs

@@ -2,7 +2,7 @@ import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
 import { anyMatch } from "./utils/cidr-match.mjs";
 
-//#region core/src/http/middleware/ip-filter.middleware.ts
+//#region ../core/src/http/middleware/ip-filter.middleware.ts
 /**
 * Allow / deny requests by client IP. Fail-closed: if the IP can't be read,
 * the request is rejected with 403.

package/esm/http/middleware/ip-filter.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ip-filter.middleware.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/ip-filter.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { anyMatch } from \"./utils/cidr-match\";\n\n/**\n * Options for the IP filter middleware. Use at least one of `allow` / `deny`.\n *\n * Precedence: `deny` wins. If a request matches both lists it is denied.\n */\nexport type IpFilterOptions = {\n  /**\n   * Allowlist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. When present,\n   * only IPs matching the list pass through.\n   */\n  allow?: string[];\n  /**\n   * Denylist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. Matched IPs\n   * are rejected regardless of the allowlist.\n   */\n  deny?: string[];\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\n/**\n * Allow / deny requests by client IP. Fail-closed: if the IP can't be read,\n * the request is rejected with 403.\n *\n * Reads the client IP via `request.detectIp()`, which honors the forwarding\n * headers only when `http.trustProxy` is set — otherwise the socket peer\n * address is used, since both headers are client-settable. When opting in,\n * prefer a bounded `http.trustProxy` (a CIDR list of your proxies)\n * over `true`: with `true`, any client that can reach the process directly\n * picks its own IP and this allowlist is decorative.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.group(\n *   {\n *     prefix: \"/admin\",\n *     middleware: [middleware.ipFilter({ allow: [\"10.0.0.0/8\", \"203.0.113.42\"] })],\n *   },\n *   () => {\n *     router.get(\"/dashboard\", dashboardController);\n *   },\n * );\n *\n * router.post(\"/webhooks/provider\", webhookController, {\n *   middleware: [middleware.ipFilter({ allow: [\"198.51.100.0/24\"] })],\n * });\n */\nexport function ipFilterMiddleware(options: IpFilterOptions): Middleware {\n  return ({ request, response }) => {\n    const ip = request.detectIp();\n\n    if (!ip || typeof ip !== \"string\") {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.deny && anyMatch(ip, options.deny)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.allow && !anyMatch(ip, options.allow)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,mBAAmB,SAAsC;CACvE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,CAAC,MAAM,OAAO,OAAO,UACvB,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,QAAQ,SAAS,IAAI,QAAQ,IAAI,GAC3C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,SAAS,CAAC,SAAS,IAAI,QAAQ,KAAK,GAC9C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CAEL;AACF"}
+{"version":3,"file":"ip-filter.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/ip-filter.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { anyMatch } from \"./utils/cidr-match\";\n\n/**\n * Options for the IP filter middleware. Use at least one of `allow` / `deny`.\n *\n * Precedence: `deny` wins. If a request matches both lists it is denied.\n */\nexport type IpFilterOptions = {\n  /**\n   * Allowlist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. When present,\n   * only IPs matching the list pass through.\n   */\n  allow?: string[];\n  /**\n   * Denylist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. Matched IPs\n   * are rejected regardless of the allowlist.\n   */\n  deny?: string[];\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\n/**\n * Allow / deny requests by client IP. Fail-closed: if the IP can't be read,\n * the request is rejected with 403.\n *\n * Reads the client IP via `request.detectIp()`, which honors the forwarding\n * headers only when `http.trustProxy` is set — otherwise the socket peer\n * address is used, since both headers are client-settable. When opting in,\n * prefer a bounded `http.trustProxy` (a CIDR list of your proxies)\n * over `true`: with `true`, any client that can reach the process directly\n * picks its own IP and this allowlist is decorative.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.group(\n *   {\n *     prefix: \"/admin\",\n *     middleware: [middleware.ipFilter({ allow: [\"10.0.0.0/8\", \"203.0.113.42\"] })],\n *   },\n *   () => {\n *     router.get(\"/dashboard\", dashboardController);\n *   },\n * );\n *\n * router.post(\"/webhooks/provider\", webhookController, {\n *   middleware: [middleware.ipFilter({ allow: [\"198.51.100.0/24\"] })],\n * });\n */\nexport function ipFilterMiddleware(options: IpFilterOptions): Middleware {\n  return ({ request, response }) => {\n    const ip = request.detectIp();\n\n    if (!ip || typeof ip !== \"string\") {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.deny && anyMatch(ip, options.deny)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.allow && !anyMatch(ip, options.allow)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,mBAAmB,SAAsC;CACvE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,CAAC,MAAM,OAAO,OAAO,UACvB,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,QAAQ,SAAS,IAAI,QAAQ,IAAI,GAC3C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,SAAS,CAAC,SAAS,IAAI,QAAQ,KAAK,GAC9C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CAEL;AACF"}

package/esm/http/middleware/maintenance.middleware.d.mts

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region core/src/http/middleware/maintenance.middleware.d.ts
+//#region ../core/src/http/middleware/maintenance.middleware.d.ts
 /**
  * Options for the maintenance middleware.
  */

package/esm/http/middleware/maintenance.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.middleware.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/maintenance.middleware.ts"],"mappings":";;;;;KAQY,kBAAA;EAAkB;;;;;;;AAkBhB;EATZ,SAAA;EA0CmC;;;;EArCnC,UAAA;EAqCuE;;AAAU;EAjCjF,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;iBAiCc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}
+{"version":3,"file":"maintenance.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/maintenance.middleware.ts"],"mappings":";;;;;KAQY,kBAAA;EAAkB;;;;;;;AAkBhB;EATZ,SAAA;EA0CmC;;;;EArCnC,UAAA;EAqCuE;;AAAU;EAjCjF,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;iBAiCc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}

package/esm/http/middleware/maintenance.middleware.mjs

@@ -2,7 +2,7 @@ import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
 import config from "@mongez/config";
 
-//#region core/src/http/middleware/maintenance.middleware.ts
+//#region ../core/src/http/middleware/maintenance.middleware.ts
 function isAllowlisted(path, patterns) {
 	return patterns.some((pattern) => {
 		if (pattern.endsWith("*")) return path.startsWith(pattern.slice(0, -1));

package/esm/http/middleware/maintenance.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return ({ request, response }) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist =\n      options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    // `request.path` includes the query string, but allowlist entries are\n    // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n    // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n    const pathname = request.path.split(\"?\")[0];\n\n    if (isAllowlisted(pathname, allowlist)) return;\n\n    const retryAfter =\n      options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,EAAE,SAAS,eAAe;EAGhC,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YACJ,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAK3E,MAAM,WAAW,QAAQ,KAAK,MAAM,GAAG,EAAE;EAEzC,IAAI,cAAc,UAAU,SAAS,GAAG;EAExC,MAAM,aACJ,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAEpE,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return ({ request, response }) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist =\n      options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    // `request.path` includes the query string, but allowlist entries are\n    // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n    // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n    const pathname = request.path.split(\"?\")[0];\n\n    if (isAllowlisted(pathname, allowlist)) return;\n\n    const retryAfter =\n      options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,EAAE,SAAS,eAAe;EAGhC,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YACJ,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAK3E,MAAM,WAAW,QAAQ,KAAK,MAAM,GAAG,EAAE;EAEzC,IAAI,cAAc,UAAU,SAAS,GAAG;EAExC,MAAM,aACJ,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAEpE,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}

package/esm/http/middleware/max-body-size.middleware.d.mts

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region core/src/http/middleware/max-body-size.middleware.d.ts
+//#region ../core/src/http/middleware/max-body-size.middleware.d.ts
 /**
  * Reject requests whose `Content-Length` exceeds the configured cap.
  *

package/esm/http/middleware/max-body-size.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"max-body-size.middleware.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/max-body-size.middleware.ts"],"mappings":";;;;;AAiCA;;;;AAAyE;;;;;;;;;;;;;;;;;;;;;iBAAzD,qBAAA,CAAsB,KAAA,oBAAyB,UAAU"}
+{"version":3,"file":"max-body-size.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/max-body-size.middleware.ts"],"mappings":";;;;;AAiCA;;;;AAAyE;;;;;;;;;;;;;;;;;;;;;iBAAzD,qBAAA,CAAsB,KAAA,oBAAyB,UAAU"}

package/esm/http/middleware/max-body-size.middleware.mjs

@@ -2,7 +2,7 @@ import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
 import { parseSize } from "./utils/parse-size.mjs";
 
-//#region core/src/http/middleware/max-body-size.middleware.ts
+//#region ../core/src/http/middleware/max-body-size.middleware.ts
 /**
 * Reject requests whose `Content-Length` exceeds the configured cap.
 *

package/esm/http/middleware/max-body-size.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"max-body-size.middleware.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/max-body-size.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { parseSize } from \"./utils/parse-size\";\n\n/**\n * Reject requests whose `Content-Length` exceeds the configured cap.\n *\n * ⚠️ **This runs AFTER the body has been parsed, not before it.** Framework\n * middleware executes inside the Fastify route handler, and `@fastify/multipart`\n * is registered with `attachFieldsToBody: true` — so by the time this sees the\n * request, the bytes are already resident. It inspects `Content-Length` and\n * answers 413; it does not and cannot prevent the read.\n *\n * **So this is not a resource-exhaustion control.** For that, lower\n * `http.bodyLimit`, or set `bodyLimit` in the route's own `serverOptions` —\n * Fastify enforces those while reading. This middleware is a per-route\n * convenience for returning a consistent 413, not a replacement for either.\n *\n * The same caveat applies to `concurrencyLimit`: it bounds how many requests\n * run at once, not how many bytes are resident.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/comments\", createCommentController, {\n *   middleware: [middleware.maxBodySize(\"8kb\")],\n * });\n *\n * router.post(\"/uploads\", uploadController, {\n *   middleware: [middleware.maxBodySize(\"10mb\")],\n * });\n */\nexport function maxBodySizeMiddleware(limit: string | number): Middleware {\n  const limitBytes = parseSize(limit);\n\n  return ({ request, response }) => {\n    const contentLengthHeader = request.header(\"content-length\");\n\n    if (!contentLengthHeader) return;\n\n    const contentLength = Number(contentLengthHeader);\n\n    if (!Number.isFinite(contentLength)) return;\n\n    if (contentLength <= limitBytes) return;\n\n    response.header(\"Connection\", \"close\");\n\n    return response.contentTooLarge({\n        error: t(\"http.bodyTooLarge\"),\n        errorCode: HttpErrorCodes.BodyTooLarge,\n        limit: limitBytes,\n        received: contentLength,\n      },\n    );\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,sBAAsB,OAAoC;CACxE,MAAM,aAAa,UAAU,KAAK;CAElC,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,sBAAsB,QAAQ,OAAO,gBAAgB;EAE3D,IAAI,CAAC,qBAAqB;EAE1B,MAAM,gBAAgB,OAAO,mBAAmB;EAEhD,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;EAErC,IAAI,iBAAiB,YAAY;EAEjC,SAAS,OAAO,cAAc,OAAO;EAErC,OAAO,SAAS,gBAAgB;GAC5B,OAAO,EAAE,mBAAmB;GAC5B;GACA,OAAO;GACP,UAAU;EACZ,CACF;CACF;AACF"}
+{"version":3,"file":"max-body-size.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/max-body-size.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { parseSize } from \"./utils/parse-size\";\n\n/**\n * Reject requests whose `Content-Length` exceeds the configured cap.\n *\n * ⚠️ **This runs AFTER the body has been parsed, not before it.** Framework\n * middleware executes inside the Fastify route handler, and `@fastify/multipart`\n * is registered with `attachFieldsToBody: true` — so by the time this sees the\n * request, the bytes are already resident. It inspects `Content-Length` and\n * answers 413; it does not and cannot prevent the read.\n *\n * **So this is not a resource-exhaustion control.** For that, lower\n * `http.bodyLimit`, or set `bodyLimit` in the route's own `serverOptions` —\n * Fastify enforces those while reading. This middleware is a per-route\n * convenience for returning a consistent 413, not a replacement for either.\n *\n * The same caveat applies to `concurrencyLimit`: it bounds how many requests\n * run at once, not how many bytes are resident.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/comments\", createCommentController, {\n *   middleware: [middleware.maxBodySize(\"8kb\")],\n * });\n *\n * router.post(\"/uploads\", uploadController, {\n *   middleware: [middleware.maxBodySize(\"10mb\")],\n * });\n */\nexport function maxBodySizeMiddleware(limit: string | number): Middleware {\n  const limitBytes = parseSize(limit);\n\n  return ({ request, response }) => {\n    const contentLengthHeader = request.header(\"content-length\");\n\n    if (!contentLengthHeader) return;\n\n    const contentLength = Number(contentLengthHeader);\n\n    if (!Number.isFinite(contentLength)) return;\n\n    if (contentLength <= limitBytes) return;\n\n    response.header(\"Connection\", \"close\");\n\n    return response.contentTooLarge({\n        error: t(\"http.bodyTooLarge\"),\n        errorCode: HttpErrorCodes.BodyTooLarge,\n        limit: limitBytes,\n        received: contentLength,\n      },\n    );\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,sBAAsB,OAAoC;CACxE,MAAM,aAAa,UAAU,KAAK;CAElC,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,sBAAsB,QAAQ,OAAO,gBAAgB;EAE3D,IAAI,CAAC,qBAAqB;EAE1B,MAAM,gBAAgB,OAAO,mBAAmB;EAEhD,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;EAErC,IAAI,iBAAiB,YAAY;EAEjC,SAAS,OAAO,cAAc,OAAO;EAErC,OAAO,SAAS,gBAAgB;GAC5B,OAAO,EAAE,mBAAmB;GAC5B;GACA,OAAO;GACP,UAAU;EACZ,CACF;CACF;AACF"}

package/esm/http/middleware/middleware-list.d.mts

@@ -6,7 +6,7 @@ import { maintenanceMiddleware } from "./maintenance.middleware.mjs";
 import { maxBodySizeMiddleware } from "./max-body-size.middleware.mjs";
 import { rateLimitMiddleware } from "./rate-limit.middleware.mjs";
 
-//#region core/src/http/middleware/middleware-list.d.ts
+//#region ../core/src/http/middleware/middleware-list.d.ts
 /**
  * Built-in HTTP middleware factories.
  *

package/esm/http/middleware/middleware-list.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware-list.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/middleware-list.ts"],"mappings":";;;;;;;;;;;AA+BA;;;;;;;;;;;;;;;;;;;;;cAAa,UAAA;EAAA"}
+{"version":3,"file":"middleware-list.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/middleware-list.ts"],"mappings":";;;;;;;;;;;AA+BA;;;;;;;;;;;;;;;;;;;;;cAAa,UAAA;EAAA"}

package/esm/http/middleware/middleware-list.mjs

@@ -6,7 +6,7 @@ import { maintenanceMiddleware } from "./maintenance.middleware.mjs";
 import { maxBodySizeMiddleware } from "./max-body-size.middleware.mjs";
 import { rateLimitMiddleware } from "./rate-limit.middleware.mjs";
 
-//#region core/src/http/middleware/middleware-list.ts
+//#region ../core/src/http/middleware/middleware-list.ts
 /**
 * Built-in HTTP middleware factories.
 *

package/esm/http/middleware/middleware-list.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware-list.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/middleware-list.ts"],"sourcesContent":["import { cacheMiddleware } from \"./cache-response-middleware\";\nimport { concurrencyLimitMiddleware } from \"./concurrency-limit.middleware\";\nimport { idempotencyMiddleware } from \"./idempotency.middleware\";\nimport { ipFilterMiddleware } from \"./ip-filter.middleware\";\nimport { maintenanceMiddleware } from \"./maintenance.middleware\";\nimport { maxBodySizeMiddleware } from \"./max-body-size.middleware\";\nimport { rateLimitMiddleware } from \"./rate-limit.middleware\";\n\n/**\n * Built-in HTTP middleware factories.\n *\n * Single canonical entry point for the framework's middleware suite. Each\n * property is a factory that returns a `Middleware` ready to drop into a\n * route's `middleware` array.\n *\n * Bare names (`rateLimitMiddleware`, etc.) are not exported from the package —\n * always reach for them via this namespace. The internal `*Middleware` suffix\n * naming exists for in-package code organization only.\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware, router } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.rateLimit({ max: 5, duration: 60_000 }),\n *     middleware.idempotency(),\n *   ],\n * });\n */\nexport const middleware = {\n  cache: cacheMiddleware,\n  concurrencyLimit: concurrencyLimitMiddleware,\n  idempotency: idempotencyMiddleware,\n  ipFilter: ipFilterMiddleware,\n  maintenance: maintenanceMiddleware,\n  maxBodySize: maxBodySizeMiddleware,\n  rateLimit: rateLimitMiddleware,\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAa,aAAa;CACxB,OAAO;CACP,kBAAkB;CAClB,aAAa;CACb,UAAU;CACV,aAAa;CACb,aAAa;CACb,WAAW;AACb"}
+{"version":3,"file":"middleware-list.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/middleware-list.ts"],"sourcesContent":["import { cacheMiddleware } from \"./cache-response-middleware\";\nimport { concurrencyLimitMiddleware } from \"./concurrency-limit.middleware\";\nimport { idempotencyMiddleware } from \"./idempotency.middleware\";\nimport { ipFilterMiddleware } from \"./ip-filter.middleware\";\nimport { maintenanceMiddleware } from \"./maintenance.middleware\";\nimport { maxBodySizeMiddleware } from \"./max-body-size.middleware\";\nimport { rateLimitMiddleware } from \"./rate-limit.middleware\";\n\n/**\n * Built-in HTTP middleware factories.\n *\n * Single canonical entry point for the framework's middleware suite. Each\n * property is a factory that returns a `Middleware` ready to drop into a\n * route's `middleware` array.\n *\n * Bare names (`rateLimitMiddleware`, etc.) are not exported from the package —\n * always reach for them via this namespace. The internal `*Middleware` suffix\n * naming exists for in-package code organization only.\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware, router } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.rateLimit({ max: 5, duration: 60_000 }),\n *     middleware.idempotency(),\n *   ],\n * });\n */\nexport const middleware = {\n  cache: cacheMiddleware,\n  concurrencyLimit: concurrencyLimitMiddleware,\n  idempotency: idempotencyMiddleware,\n  ipFilter: ipFilterMiddleware,\n  maintenance: maintenanceMiddleware,\n  maxBodySize: maxBodySizeMiddleware,\n  rateLimit: rateLimitMiddleware,\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAa,aAAa;CACxB,OAAO;CACP,kBAAkB;CAClB,aAAa;CACb,UAAU;CACV,aAAa;CACb,aAAa;CACb,WAAW;AACb"}

package/esm/http/middleware/rate-limit.middleware.d.mts

@@ -1,6 +1,6 @@
 import { Request } from "../request.mjs";
 import { Middleware } from "../../router/types.mjs";
-//#region core/src/http/middleware/rate-limit.middleware.d.ts
+//#region ../core/src/http/middleware/rate-limit.middleware.d.ts
 /**
  * Options for the per-route rate limit middleware.
  */

package/esm/http/middleware/rate-limit.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.middleware.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/rate-limit.middleware.ts"],"mappings":";;;;;;KAQY,gBAAA;EAAgB;;;EAI1B,GAAA;EAIA;;;EAAA,QAAA;EAYA;;AAAY;AA6Cd;;;;EAjDE,YAAA,IAAgB,OAAA,EAAS,OAAO;EAiDE;;;EA7ClC,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;iBA6Cc,mBAAA,CAAoB,OAAA,EAAS,gBAAA,GAAmB,UAAU"}
+{"version":3,"file":"rate-limit.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/rate-limit.middleware.ts"],"mappings":";;;;;;KAQY,gBAAA;EAAgB;;;EAI1B,GAAA;EAIA;;;EAAA,QAAA;EAYA;;AAAY;AA6Cd;;;;EAjDE,YAAA,IAAgB,OAAA,EAAS,OAAO;EAiDE;;;EA7ClC,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;iBA6Cc,mBAAA,CAAoB,OAAA,EAAS,gBAAA,GAAmB,UAAU"}

package/esm/http/middleware/rate-limit.middleware.mjs

@@ -1,7 +1,7 @@
 import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
 
-//#region core/src/http/middleware/rate-limit.middleware.ts
+//#region ../core/src/http/middleware/rate-limit.middleware.ts
 const buckets = /* @__PURE__ */ new Map();
 /**
 * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys

package/esm/http/middleware/rate-limit.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.middleware.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/rate-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the per-route rate limit middleware.\n */\nexport type RateLimitOptions = {\n  /**\n   * Max requests allowed within the time window.\n   */\n  max: number;\n  /**\n   * Time window in milliseconds.\n   */\n  duration: number;\n  /**\n   * Group key generator. Defaults to the client IP. Override to scope per-user,\n   * per-organization, per-tenant, etc.\n   *\n   * @example\n   * keyGenerator: (request) => request.user?.id ?? request.ip,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\ntype Bucket = {\n  count: number;\n  resetAt: number;\n};\n\nconst buckets = new Map<string, Bucket>();\n\n/**\n * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys\n * (rare per-user keys, dynamic path parameters in `keyGenerator`, etc.).\n * Called opportunistically, at most once per minute, not on a timer — keeps\n * the module side-effect-free for testing.\n */\nlet lastPruneAt = 0;\n\nfunction pruneExpired(now: number) {\n  for (const [key, bucket] of buckets) {\n    if (bucket.resetAt <= now) {\n      buckets.delete(key);\n    }\n  }\n}\n\n/**\n * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s\n * global cap (configured via `http.rateLimit`) — both run, and either can\n * 429. Use this for endpoints that need a tighter cap than the global default:\n * login, OTP request, password reset, expensive search, AI completions.\n *\n * The counter lives in-process. With `N` replicas the effective cap is\n * `N × max`. For genuinely shared limits, configure `@fastify/rate-limit`'s\n * Redis store via `http.rateLimit` instead.\n *\n * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on\n * every response; adds `Retry-After` (seconds) on a 429.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],\n * });\n */\nexport function rateLimitMiddleware(options: RateLimitOptions): Middleware {\n  return ({ request, response }) => {\n    const now = Date.now();\n\n    if (now - lastPruneAt > 60_000) {\n      pruneExpired(now);\n      lastPruneAt = now;\n    }\n\n    const groupKey = options.keyGenerator?.(request) || request.detectIp() || \"unknown\";\n    const cacheKey = `${request.route.path}:${groupKey}`;\n\n    let bucket = buckets.get(cacheKey);\n\n    if (!bucket || bucket.resetAt <= now) {\n      bucket = { count: 0, resetAt: now + options.duration };\n      buckets.set(cacheKey, bucket);\n    }\n\n    bucket.count++;\n\n    const remaining = Math.max(0, options.max - bucket.count);\n    const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));\n\n    response.header(\"X-RateLimit-Limit\", options.max);\n    response.header(\"X-RateLimit-Remaining\", remaining);\n    response.header(\"X-RateLimit-Reset\", Math.ceil(bucket.resetAt / 1000));\n\n    if (bucket.count > options.max) {\n      response.header(\"Retry-After\", retryAfter);\n\n      return response.tooManyRequests({\n          error: options.errorMessage || t(\"http.rateLimitExceeded\"),\n          errorCode: HttpErrorCodes.RateLimitExceeded,\n        },\n      );\n    }\n  };\n}\n"],"mappings":";;;;AAoCA,MAAM,0BAAU,IAAI,IAAoB;;;;;;;AAQxC,IAAI,cAAc;AAElB,SAAS,aAAa,KAAa;CACjC,KAAK,MAAM,CAAC,KAAK,WAAW,SAC1B,IAAI,OAAO,WAAW,KACpB,QAAQ,OAAO,GAAG;AAGxB;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,oBAAoB,SAAuC;CACzE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI,MAAM,cAAc,KAAQ;GAC9B,aAAa,GAAG;GAChB,cAAc;EAChB;EAEA,MAAM,WAAW,QAAQ,eAAe,OAAO,KAAK,QAAQ,SAAS,KAAK;EAC1E,MAAM,WAAW,GAAG,QAAQ,MAAM,KAAK,GAAG;EAE1C,IAAI,SAAS,QAAQ,IAAI,QAAQ;EAEjC,IAAI,CAAC,UAAU,OAAO,WAAW,KAAK;GACpC,SAAS;IAAE,OAAO;IAAG,SAAS,MAAM,QAAQ;GAAS;GACrD,QAAQ,IAAI,UAAU,MAAM;EAC9B;EAEA,OAAO;EAEP,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,MAAM,OAAO,KAAK;EACxD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,OAAO,GAAI,CAAC;EAEvE,SAAS,OAAO,qBAAqB,QAAQ,GAAG;EAChD,SAAS,OAAO,yBAAyB,SAAS;EAClD,SAAS,OAAO,qBAAqB,KAAK,KAAK,OAAO,UAAU,GAAI,CAAC;EAErE,IAAI,OAAO,QAAQ,QAAQ,KAAK;GAC9B,SAAS,OAAO,eAAe,UAAU;GAEzC,OAAO,SAAS,gBAAgB;IAC5B,OAAO,QAAQ,gBAAgB,EAAE,wBAAwB;IACzD;GACF,CACF;EACF;CACF;AACF"}
+{"version":3,"file":"rate-limit.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/rate-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the per-route rate limit middleware.\n */\nexport type RateLimitOptions = {\n  /**\n   * Max requests allowed within the time window.\n   */\n  max: number;\n  /**\n   * Time window in milliseconds.\n   */\n  duration: number;\n  /**\n   * Group key generator. Defaults to the client IP. Override to scope per-user,\n   * per-organization, per-tenant, etc.\n   *\n   * @example\n   * keyGenerator: (request) => request.user?.id ?? request.ip,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\ntype Bucket = {\n  count: number;\n  resetAt: number;\n};\n\nconst buckets = new Map<string, Bucket>();\n\n/**\n * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys\n * (rare per-user keys, dynamic path parameters in `keyGenerator`, etc.).\n * Called opportunistically, at most once per minute, not on a timer — keeps\n * the module side-effect-free for testing.\n */\nlet lastPruneAt = 0;\n\nfunction pruneExpired(now: number) {\n  for (const [key, bucket] of buckets) {\n    if (bucket.resetAt <= now) {\n      buckets.delete(key);\n    }\n  }\n}\n\n/**\n * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s\n * global cap (configured via `http.rateLimit`) — both run, and either can\n * 429. Use this for endpoints that need a tighter cap than the global default:\n * login, OTP request, password reset, expensive search, AI completions.\n *\n * The counter lives in-process. With `N` replicas the effective cap is\n * `N × max`. For genuinely shared limits, configure `@fastify/rate-limit`'s\n * Redis store via `http.rateLimit` instead.\n *\n * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on\n * every response; adds `Retry-After` (seconds) on a 429.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],\n * });\n */\nexport function rateLimitMiddleware(options: RateLimitOptions): Middleware {\n  return ({ request, response }) => {\n    const now = Date.now();\n\n    if (now - lastPruneAt > 60_000) {\n      pruneExpired(now);\n      lastPruneAt = now;\n    }\n\n    const groupKey = options.keyGenerator?.(request) || request.detectIp() || \"unknown\";\n    const cacheKey = `${request.route.path}:${groupKey}`;\n\n    let bucket = buckets.get(cacheKey);\n\n    if (!bucket || bucket.resetAt <= now) {\n      bucket = { count: 0, resetAt: now + options.duration };\n      buckets.set(cacheKey, bucket);\n    }\n\n    bucket.count++;\n\n    const remaining = Math.max(0, options.max - bucket.count);\n    const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));\n\n    response.header(\"X-RateLimit-Limit\", options.max);\n    response.header(\"X-RateLimit-Remaining\", remaining);\n    response.header(\"X-RateLimit-Reset\", Math.ceil(bucket.resetAt / 1000));\n\n    if (bucket.count > options.max) {\n      response.header(\"Retry-After\", retryAfter);\n\n      return response.tooManyRequests({\n          error: options.errorMessage || t(\"http.rateLimitExceeded\"),\n          errorCode: HttpErrorCodes.RateLimitExceeded,\n        },\n      );\n    }\n  };\n}\n"],"mappings":";;;;AAoCA,MAAM,0BAAU,IAAI,IAAoB;;;;;;;AAQxC,IAAI,cAAc;AAElB,SAAS,aAAa,KAAa;CACjC,KAAK,MAAM,CAAC,KAAK,WAAW,SAC1B,IAAI,OAAO,WAAW,KACpB,QAAQ,OAAO,GAAG;AAGxB;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,oBAAoB,SAAuC;CACzE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI,MAAM,cAAc,KAAQ;GAC9B,aAAa,GAAG;GAChB,cAAc;EAChB;EAEA,MAAM,WAAW,QAAQ,eAAe,OAAO,KAAK,QAAQ,SAAS,KAAK;EAC1E,MAAM,WAAW,GAAG,QAAQ,MAAM,KAAK,GAAG;EAE1C,IAAI,SAAS,QAAQ,IAAI,QAAQ;EAEjC,IAAI,CAAC,UAAU,OAAO,WAAW,KAAK;GACpC,SAAS;IAAE,OAAO;IAAG,SAAS,MAAM,QAAQ;GAAS;GACrD,QAAQ,IAAI,UAAU,MAAM;EAC9B;EAEA,OAAO;EAEP,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,MAAM,OAAO,KAAK;EACxD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,OAAO,GAAI,CAAC;EAEvE,SAAS,OAAO,qBAAqB,QAAQ,GAAG;EAChD,SAAS,OAAO,yBAAyB,SAAS;EAClD,SAAS,OAAO,qBAAqB,KAAK,KAAK,OAAO,UAAU,GAAI,CAAC;EAErE,IAAI,OAAO,QAAQ,QAAQ,KAAK;GAC9B,SAAS,OAAO,eAAe,UAAU;GAEzC,OAAO,SAAS,gBAAgB;IAC5B,OAAO,QAAQ,gBAAgB,EAAE,wBAAwB;IACzD;GACF,CACF;EACF;CACF;AACF"}

package/esm/http/middleware/utils/cidr-match.d.mts

@@ -1,4 +1,4 @@
-//#region core/src/http/middleware/utils/cidr-match.d.ts
+//#region ../core/src/http/middleware/utils/cidr-match.d.ts
 declare function ipMatches(ip: string, pattern: string): boolean;
 /**
  * Returns true if `ip` matches any pattern in the list.

package/esm/http/middleware/utils/cidr-match.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cidr-match.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/utils/cidr-match.ts"],"mappings":";iBAkCgB,SAAA,CAAU,EAAA,UAAY,OAAe;AAArD;;;;AAAqD;AA0CrD;AA1CA,iBA0CgB,QAAA,CAAS,EAAA,UAAY,QAAkB"}
+{"version":3,"file":"cidr-match.d.mts","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/cidr-match.ts"],"mappings":";iBAkCgB,SAAA,CAAU,EAAA,UAAY,OAAe;AAArD;;;;AAAqD;AA0CrD;AA1CA,iBA0CgB,QAAA,CAAS,EAAA,UAAY,QAAkB"}

package/esm/http/middleware/utils/cidr-match.mjs

@@ -1,4 +1,4 @@
-//#region core/src/http/middleware/utils/cidr-match.ts
+//#region ../core/src/http/middleware/utils/cidr-match.ts
 /**
 * Match an IPv4 address against an exact IP or a CIDR block.
 *

package/esm/http/middleware/utils/cidr-match.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cidr-match.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/utils/cidr-match.ts"],"sourcesContent":["/**\n * Match an IPv4 address against an exact IP or a CIDR block.\n *\n * IPv6 patterns are matched as exact-string only — full IPv6 CIDR support is\n * out of scope; ACLs in production almost always use IPv4 ranges. Add IPv6 CIDR\n * later if a real use-case appears.\n *\n * @example\n * ipMatches(\"10.0.0.5\", \"10.0.0.0/8\");      // true\n * ipMatches(\"10.0.0.5\", \"10.0.0.5\");        // true\n * ipMatches(\"192.168.1.1\", \"10.0.0.0/8\");   // false\n */\nfunction ipv4ToInt(ip: string): number | null {\n  const parts = ip.split(\".\");\n\n  if (parts.length !== 4) {\n    return null;\n  }\n\n  let result = 0;\n\n  for (const part of parts) {\n    const num = Number(part);\n\n    if (!Number.isInteger(num) || num < 0 || num > 255) {\n      return null;\n    }\n\n    result = (result << 8) + num;\n  }\n\n  return result >>> 0;\n}\n\nexport function ipMatches(ip: string, pattern: string): boolean {\n  if (!ip || !pattern) {\n    return false;\n  }\n\n  if (pattern === ip) {\n    return true;\n  }\n\n  if (!pattern.includes(\"/\")) {\n    return false;\n  }\n\n  const [base, bitsRaw] = pattern.split(\"/\");\n  const bits = Number(bitsRaw);\n\n  if (!Number.isInteger(bits) || bits < 0 || bits > 32) {\n    return false;\n  }\n\n  const ipInt = ipv4ToInt(ip);\n  const baseInt = ipv4ToInt(base);\n\n  if (ipInt === null || baseInt === null) {\n    return false;\n  }\n\n  if (bits === 0) {\n    return true;\n  }\n\n  const mask = (~0 << (32 - bits)) >>> 0;\n\n  return (ipInt & mask) === (baseInt & mask);\n}\n\n/**\n * Returns true if `ip` matches any pattern in the list.\n *\n * @example\n * anyMatch(\"10.0.0.5\", [\"192.168.0.0/16\", \"10.0.0.0/8\"]); // true\n */\nexport function anyMatch(ip: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => ipMatches(ip, pattern));\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAS,UAAU,IAA2B;CAC5C,MAAM,QAAQ,GAAG,MAAM,GAAG;CAE1B,IAAI,MAAM,WAAW,GACnB,OAAO;CAGT,IAAI,SAAS;CAEb,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,OAAO,IAAI;EAEvB,IAAI,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,MAAM,KAC7C,OAAO;EAGT,UAAU,UAAU,KAAK;CAC3B;CAEA,OAAO,WAAW;AACpB;AAEA,SAAgB,UAAU,IAAY,SAA0B;CAC9D,IAAI,CAAC,MAAM,CAAC,SACV,OAAO;CAGT,IAAI,YAAY,IACd,OAAO;CAGT,IAAI,CAAC,QAAQ,SAAS,GAAG,GACvB,OAAO;CAGT,MAAM,CAAC,MAAM,WAAW,QAAQ,MAAM,GAAG;CACzC,MAAM,OAAO,OAAO,OAAO;CAE3B,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,IAChD,OAAO;CAGT,MAAM,QAAQ,UAAU,EAAE;CAC1B,MAAM,UAAU,UAAU,IAAI;CAE9B,IAAI,UAAU,QAAQ,YAAY,MAChC,OAAO;CAGT,IAAI,SAAS,GACX,OAAO;CAGT,MAAM,OAAQ,MAAO,KAAK,SAAW;CAErC,QAAQ,QAAQ,WAAW,UAAU;AACvC;;;;;;;AAQA,SAAgB,SAAS,IAAY,UAA6B;CAChE,OAAO,SAAS,MAAM,YAAY,UAAU,IAAI,OAAO,CAAC;AAC1D"}
+{"version":3,"file":"cidr-match.mjs","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/cidr-match.ts"],"sourcesContent":["/**\n * Match an IPv4 address against an exact IP or a CIDR block.\n *\n * IPv6 patterns are matched as exact-string only — full IPv6 CIDR support is\n * out of scope; ACLs in production almost always use IPv4 ranges. Add IPv6 CIDR\n * later if a real use-case appears.\n *\n * @example\n * ipMatches(\"10.0.0.5\", \"10.0.0.0/8\");      // true\n * ipMatches(\"10.0.0.5\", \"10.0.0.5\");        // true\n * ipMatches(\"192.168.1.1\", \"10.0.0.0/8\");   // false\n */\nfunction ipv4ToInt(ip: string): number | null {\n  const parts = ip.split(\".\");\n\n  if (parts.length !== 4) {\n    return null;\n  }\n\n  let result = 0;\n\n  for (const part of parts) {\n    const num = Number(part);\n\n    if (!Number.isInteger(num) || num < 0 || num > 255) {\n      return null;\n    }\n\n    result = (result << 8) + num;\n  }\n\n  return result >>> 0;\n}\n\nexport function ipMatches(ip: string, pattern: string): boolean {\n  if (!ip || !pattern) {\n    return false;\n  }\n\n  if (pattern === ip) {\n    return true;\n  }\n\n  if (!pattern.includes(\"/\")) {\n    return false;\n  }\n\n  const [base, bitsRaw] = pattern.split(\"/\");\n  const bits = Number(bitsRaw);\n\n  if (!Number.isInteger(bits) || bits < 0 || bits > 32) {\n    return false;\n  }\n\n  const ipInt = ipv4ToInt(ip);\n  const baseInt = ipv4ToInt(base);\n\n  if (ipInt === null || baseInt === null) {\n    return false;\n  }\n\n  if (bits === 0) {\n    return true;\n  }\n\n  const mask = (~0 << (32 - bits)) >>> 0;\n\n  return (ipInt & mask) === (baseInt & mask);\n}\n\n/**\n * Returns true if `ip` matches any pattern in the list.\n *\n * @example\n * anyMatch(\"10.0.0.5\", [\"192.168.0.0/16\", \"10.0.0.0/8\"]); // true\n */\nexport function anyMatch(ip: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => ipMatches(ip, pattern));\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAS,UAAU,IAA2B;CAC5C,MAAM,QAAQ,GAAG,MAAM,GAAG;CAE1B,IAAI,MAAM,WAAW,GACnB,OAAO;CAGT,IAAI,SAAS;CAEb,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,OAAO,IAAI;EAEvB,IAAI,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,MAAM,KAC7C,OAAO;EAGT,UAAU,UAAU,KAAK;CAC3B;CAEA,OAAO,WAAW;AACpB;AAEA,SAAgB,UAAU,IAAY,SAA0B;CAC9D,IAAI,CAAC,MAAM,CAAC,SACV,OAAO;CAGT,IAAI,YAAY,IACd,OAAO;CAGT,IAAI,CAAC,QAAQ,SAAS,GAAG,GACvB,OAAO;CAGT,MAAM,CAAC,MAAM,WAAW,QAAQ,MAAM,GAAG;CACzC,MAAM,OAAO,OAAO,OAAO;CAE3B,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,IAChD,OAAO;CAGT,MAAM,QAAQ,UAAU,EAAE;CAC1B,MAAM,UAAU,UAAU,IAAI;CAE9B,IAAI,UAAU,QAAQ,YAAY,MAChC,OAAO;CAGT,IAAI,SAAS,GACX,OAAO;CAGT,MAAM,OAAQ,MAAO,KAAK,SAAW;CAErC,QAAQ,QAAQ,WAAW,UAAU;AACvC;;;;;;;AAQA,SAAgB,SAAS,IAAY,UAA6B;CAChE,OAAO,SAAS,MAAM,YAAY,UAAU,IAAI,OAAO,CAAC;AAC1D"}

package/esm/http/middleware/utils/idempotency-key.d.mts

@@ -1,6 +1,6 @@
 import { Request } from "../../request.mjs";
 
-//#region core/src/http/middleware/utils/idempotency-key.d.ts
+//#region ../core/src/http/middleware/utils/idempotency-key.d.ts
 declare function isValidIdempotencyKey(value: unknown): value is string;
 /**
  * Hash a request body to a stable hex digest.

package/esm/http/middleware/utils/idempotency-key.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency-key.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/utils/idempotency-key.ts"],"mappings":";;;iBAegB,qBAAA,CAAsB,KAAA,YAAiB,KAAK;;AAA5D;;;;AAA4D;AAmB5D;;;;iBAAgB,QAAA,CAAS,IAAa;AAAA,iBAyCtB,wBAAA,CAAyB,OAAA,EAAS,OAAO,EAAE,cAAA"}
+{"version":3,"file":"idempotency-key.d.mts","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/idempotency-key.ts"],"mappings":";;;iBAegB,qBAAA,CAAsB,KAAA,YAAiB,KAAK;;AAA5D;;;;AAA4D;AAmB5D;;;;iBAAgB,QAAA,CAAS,IAAa;AAAA,iBAyCtB,wBAAA,CAAyB,OAAA,EAAS,OAAO,EAAE,cAAA"}

package/esm/http/middleware/utils/idempotency-key.mjs

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 
-//#region core/src/http/middleware/utils/idempotency-key.ts
+//#region ../core/src/http/middleware/utils/idempotency-key.ts
 /**
 * Idempotency-key validation rules.
 *

package/esm/http/middleware/utils/idempotency-key.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency-key.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/middleware/utils/idempotency-key.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { Request } from \"../../request\";\nimport type { RequestUser } from \"../../types\";\n\n/**\n * Idempotency-key validation rules.\n *\n * RFC draft-ietf-httpapi-idempotency-key suggests UUIDs or ULIDs but doesn't\n * mandate a format. We accept any printable ASCII string up to 255 chars —\n * tight enough to reject log-injection (no control characters / newlines),\n * loose enough to accept whatever ID scheme the client picks.\n */\nconst MAX_KEY_LENGTH = 255;\nconst PRINTABLE_ASCII = /^[\\x21-\\x7e]+$/;\n\nexport function isValidIdempotencyKey(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    value.length <= MAX_KEY_LENGTH &&\n    PRINTABLE_ASCII.test(value)\n  );\n}\n\n/**\n * Hash a request body to a stable hex digest.\n *\n * Used to detect \"same key, different body\" — that's a client bug, not a retry.\n * sha256 is overkill for collision resistance here, but it's the dependency-free\n * choice and avoids importing a faster hasher.\n *\n * @example\n * hashBody({ amount: 100, currency: \"USD\" }); // \"a1b2c3...\"\n */\nexport function hashBody(body: unknown): string {\n  const serialized = typeof body === \"string\" ? body : JSON.stringify(body ?? {});\n\n  return createHash(\"sha256\").update(serialized).digest(\"hex\");\n}\n\n/**\n * Build the cache key for an idempotency record.\n *\n * Scope is `userType:userId` when authenticated, falling back to the client IP\n * when anonymous. This prevents user A from replaying user B's key — even if\n * user B used a guessable value — while still letting the primitive work on\n * public endpoints.\n *\n * Idempotency middleware must run **after** `authMiddleware` so `request.user`\n * and `request.decodedAccessToken` are populated.\n *\n * @example\n * buildIdempotencyCacheKey(request, \"01J9XZQ-ABC\"); // \"idem:client:user_123:01J9XZQ-ABC\"\n */\n/**\n * Read `id` off `request.user` without assuming every app's `RequestUser`\n * augmentation declares it.\n *\n * `RequestUser` (`core/src/http/types.ts`) is empty by default — apps narrow\n * it to their own model shape. Adding `id` directly to `RequestUser` here\n * would force that exact field (and type) onto every app: TypeScript\n * interface merging requires all declarations of a shared member to have an\n * identical type, so an app augmenting `RequestUser` with, say, `id: string`\n * only would conflict with a core-declared `id?: string | number`. A local,\n * narrow read survives any augmentation shape (eed20184 step (b) —\n * `implementation/2026-08-20-A2-request-locals.md` §6.2) — no `as any`.\n */\nfunction readUserId(user: RequestUser | undefined): string | number | undefined {\n  if (!user || typeof user !== \"object\" || !(\"id\" in user)) return undefined;\n\n  const id = (user as { id?: unknown }).id;\n\n  return typeof id === \"string\" || typeof id === \"number\" ? id : undefined;\n}\n\nexport function buildIdempotencyCacheKey(request: Request, idempotencyKey: string): string {\n  const userType = request.decodedAccessToken?.userType || \"anonymous\";\n  const userId = readUserId(request.user) || request.detectIp() || \"unknown\";\n\n  return `idem:${userType}:${userId}:${idempotencyKey}`;\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,SAAgB,sBAAsB,OAAiC;CACrE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,kBAChB,gBAAgB,KAAK,KAAK;AAE9B;;;;;;;;;;;AAYA,SAAgB,SAAS,MAAuB;CAC9C,MAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC;CAE9E,OAAO,WAAW,QAAQ,EAAE,OAAO,UAAU,EAAE,OAAO,KAAK;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,WAAW,MAA4D;CAC9E,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OAAO,OAAO;CAEjE,MAAM,KAAM,KAA0B;CAEtC,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,WAAW,KAAK;AACjE;AAEA,SAAgB,yBAAyB,SAAkB,gBAAgC;CAIzF,OAAO,QAHU,QAAQ,oBAAoB,YAAY,YAGjC,GAFT,WAAW,QAAQ,IAAI,KAAK,QAAQ,SAAS,KAAK,UAE/B,GAAG;AACvC"}
+{"version":3,"file":"idempotency-key.mjs","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/idempotency-key.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { Request } from \"../../request\";\nimport type { RequestUser } from \"../../types\";\n\n/**\n * Idempotency-key validation rules.\n *\n * RFC draft-ietf-httpapi-idempotency-key suggests UUIDs or ULIDs but doesn't\n * mandate a format. We accept any printable ASCII string up to 255 chars —\n * tight enough to reject log-injection (no control characters / newlines),\n * loose enough to accept whatever ID scheme the client picks.\n */\nconst MAX_KEY_LENGTH = 255;\nconst PRINTABLE_ASCII = /^[\\x21-\\x7e]+$/;\n\nexport function isValidIdempotencyKey(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    value.length <= MAX_KEY_LENGTH &&\n    PRINTABLE_ASCII.test(value)\n  );\n}\n\n/**\n * Hash a request body to a stable hex digest.\n *\n * Used to detect \"same key, different body\" — that's a client bug, not a retry.\n * sha256 is overkill for collision resistance here, but it's the dependency-free\n * choice and avoids importing a faster hasher.\n *\n * @example\n * hashBody({ amount: 100, currency: \"USD\" }); // \"a1b2c3...\"\n */\nexport function hashBody(body: unknown): string {\n  const serialized = typeof body === \"string\" ? body : JSON.stringify(body ?? {});\n\n  return createHash(\"sha256\").update(serialized).digest(\"hex\");\n}\n\n/**\n * Build the cache key for an idempotency record.\n *\n * Scope is `userType:userId` when authenticated, falling back to the client IP\n * when anonymous. This prevents user A from replaying user B's key — even if\n * user B used a guessable value — while still letting the primitive work on\n * public endpoints.\n *\n * Idempotency middleware must run **after** `authMiddleware` so `request.user`\n * and `request.decodedAccessToken` are populated.\n *\n * @example\n * buildIdempotencyCacheKey(request, \"01J9XZQ-ABC\"); // \"idem:client:user_123:01J9XZQ-ABC\"\n */\n/**\n * Read `id` off `request.user` without assuming every app's `RequestUser`\n * augmentation declares it.\n *\n * `RequestUser` (`core/src/http/types.ts`) is empty by default — apps narrow\n * it to their own model shape. Adding `id` directly to `RequestUser` here\n * would force that exact field (and type) onto every app: TypeScript\n * interface merging requires all declarations of a shared member to have an\n * identical type, so an app augmenting `RequestUser` with, say, `id: string`\n * only would conflict with a core-declared `id?: string | number`. A local,\n * narrow read survives any augmentation shape (eed20184 step (b) —\n * `implementation/2026-08-20-A2-request-locals.md` §6.2) — no `as any`.\n */\nfunction readUserId(user: RequestUser | undefined): string | number | undefined {\n  if (!user || typeof user !== \"object\" || !(\"id\" in user)) return undefined;\n\n  const id = (user as { id?: unknown }).id;\n\n  return typeof id === \"string\" || typeof id === \"number\" ? id : undefined;\n}\n\nexport function buildIdempotencyCacheKey(request: Request, idempotencyKey: string): string {\n  const userType = request.decodedAccessToken?.userType || \"anonymous\";\n  const userId = readUserId(request.user) || request.detectIp() || \"unknown\";\n\n  return `idem:${userType}:${userId}:${idempotencyKey}`;\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,SAAgB,sBAAsB,OAAiC;CACrE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,kBAChB,gBAAgB,KAAK,KAAK;AAE9B;;;;;;;;;;;AAYA,SAAgB,SAAS,MAAuB;CAC9C,MAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC;CAE9E,OAAO,WAAW,QAAQ,EAAE,OAAO,UAAU,EAAE,OAAO,KAAK;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,WAAW,MAA4D;CAC9E,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OAAO,OAAO;CAEjE,MAAM,KAAM,KAA0B;CAEtC,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,WAAW,KAAK;AACjE;AAEA,SAAgB,yBAAyB,SAAkB,gBAAgC;CAIzF,OAAO,QAHU,QAAQ,oBAAoB,YAAY,YAGjC,GAFT,WAAW,QAAQ,IAAI,KAAK,QAAQ,SAAS,KAAK,UAE/B,GAAG;AACvC"}