@warlock.js/core 5.2.2 → 5.2.4

package/esm/generations/stubs.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"stubs.mjs","names":[],"sources":["../../../../../../../core/src/generations/stubs.ts"],"sourcesContent":["export const accessConfigStub = `import { type AccessConfigurations } from \"@warlock.js/access\";\r\nimport { DatabaseAccessResolver } from \"app/access/services/access-resolver\";\r\n\r\n/**\r\n * Authorization configuration — read by @warlock.js/access on boot.\r\n *\r\n * The resolver is the one required piece: it tells the engine how to read a\r\n * user's roles + permissions. The ejected DatabaseAccessResolver reads roles\r\n * from the user_roles table and maps them through the roles catalog table (so\r\n * roles + their permissions are managed at runtime, in the DB).\r\n *\r\n * For a fixed, code-defined catalog with no tables, swap in DefaultAccessResolver:\r\n *   import { DefaultAccessResolver } from \"@warlock.js/access\";\r\n *   resolver: new DefaultAccessResolver({ admin: [\"*\"], editor: [\"orders.*\"] }),\r\n *\r\n * Multi-tenant? Add a \\`resolveTenant()\\` to the resolver to read the active\r\n * tenant from the request; checks then scope to it automatically.\r\n */\r\nconst access: AccessConfigurations = {\r\n  resolver: new DatabaseAccessResolver(),\r\n\r\n  // Cache resolved permission sets (default \"10m\").\r\n  // cache: { ttl: \"10m\" },\r\n};\r\n\r\nexport default access;\r\n`;\r\n\r\nexport const aiConfigStub = `import type { AIConfig } from \"@warlock.js/ai\";\r\n\r\n// >>> warlock:ai-packages (auto-managed) >>>\r\n// Satellite packages augment the \"ai\" object on import — e.g. ai.workspace,\r\n// ai.tools / ai.mcp, and panoptic's ai.config({ panoptic }) wiring. The command\r\n// \"warlock add ai-workspace | ai-tools | ai-panoptic\" adds the matching\r\n// side-effect import below; keep them so the augmentation + runtime registration\r\n// load before the ai connector applies this config.\r\n// <<< warlock:ai-packages <<<\r\n\r\n/**\r\n * AI configuration — applied on boot by the ai connector, which calls\r\n * ai.config(...) with the object below. Cross-cutting defaults live here\r\n * (shared cache / snapshot stores, observability); per-call options always win.\r\n *\r\n * Wire a default model from a provider you installed, e.g.:\r\n *   import { OpenAISDK } from \"@warlock.js/ai-openai\";\r\n *   const openai = OpenAISDK({ apiKey: env(\"OPENAI_API_KEY\") });\r\n *   // then pass openai.model({ name: \"gpt-4o-mini\" }) into your agents.\r\n */\r\nconst ai: Partial<AIConfig> = {\r\n  // Default cache driver for cache-backed AI features (semantic cache, rag / memory vector stores).\r\n  // defaultStore: cache.driver(\"redis\", { client }),\r\n\r\n  // Observability — requires \"warlock add ai-panoptic\". Exporters + the local dashboard.\r\n  // panoptic: { exporters: [], dashboard: false, observeAll: false },\r\n};\r\n\r\nexport default ai;\r\n`;\r\n\r\nexport const accessRoleModelStub = `import { Model, RegisterModel } from \"@warlock.js/cascade\";\r\nimport { type Infer, v } from \"@warlock.js/seal\";\r\n\r\n/**\r\n * Validation schema for the roles catalog — mirrors the migration columns\r\n * (snake_case). Each row is a role name plus the permission strings it grants;\r\n * wildcards work (\"orders.*\", \"*\"). The DatabaseAccessResolver maps a user's\r\n * assigned role names through this table to their effective permissions.\r\n */\r\nexport const roleSchema = v.object({\r\n  name: v.string(),\r\n  permissions: v.array(v.string()).default([]),\r\n});\r\n\r\nexport type RoleSchema = Infer<typeof roleSchema>;\r\n\r\n/**\r\n * The roles catalog — role name → the permissions it grants. Managed at runtime\r\n * (admins add roles + edit their permissions), unlike a fixed code map. Read by\r\n * DatabaseAccessResolver.resolvePermissions to expand a user's roles to permissions.\r\n */\r\n@RegisterModel()\r\nexport class Role extends Model<RoleSchema> {\r\n  public static table = \"roles\";\r\n\r\n  public static schema = roleSchema;\r\n\r\n  /** The permission strings this role grants. */\r\n  public get permissions(): string[] {\r\n    return this.get<string[]>(\"permissions\", []);\r\n  }\r\n}\r\n`;\r\n\r\nexport const accessRoleModelIndexStub = `export * from \"./role.model\";\r\n`;\r\n\r\nexport const accessRoleMigrationStub = `import { arrayText, Migration, text } from \"@warlock.js/cascade\";\r\nimport { Role } from \"../role.model\";\r\n\r\n/**\r\n * Roles catalog table. \\`name\\` is unique (one row per role); \\`permissions\\` is a\r\n * text array of the permission strings the role grants.\r\n */\r\nexport default Migration.create(Role, {\r\n  name: text().notNullable().unique(),\r\n  permissions: arrayText().nullable(),\r\n});\r\n`;\r\n\r\nexport const accessUserRoleModelStub = `import { access } from \"@warlock.js/access\";\r\nimport type { Auth } from \"@warlock.js/auth\";\r\nimport { Model, RegisterModel } from \"@warlock.js/cascade\";\r\nimport { type Infer, v } from \"@warlock.js/seal\";\r\n\r\n/**\r\n * Validation schema for a role assignment — mirrors the migration columns\r\n * (snake_case). \\`tenant\\` is nullable: a null tenant is a GLOBAL assignment.\r\n */\r\nexport const userRoleSchema = v.object({\r\n  user_id: v.string(),\r\n  user_type: v.string(),\r\n  role: v.string(),\r\n  tenant: v.string().optional(),\r\n});\r\n\r\nexport type UserRoleSchema = Infer<typeof userRoleSchema>;\r\n\r\n/**\r\n * The role-assignment table — which roles a user holds, optionally per tenant.\r\n * Read by DatabaseAccessResolver.resolveRoles; mutated via the statics below.\r\n * \\`assign\\` / \\`revoke\\` flush the cached permission set automatically, so callers\r\n * never need to call \\`access.flush(user, tenant)\\` themselves.\r\n */\r\n@RegisterModel()\r\nexport class UserRole extends Model<UserRoleSchema> {\r\n  public static table = \"user_roles\";\r\n\r\n  public static schema = userRoleSchema;\r\n\r\n  /**\r\n   * Role names assigned to the user in the given tenant.\r\n   *\r\n   * An unresolved tenant (\\`undefined\\`) scopes to GLOBAL roles only — the rows\r\n   * stored with no tenant (\\`null\\`) — never the union across every tenant. The\r\n   * union would be a privilege-escalation: a user who is \\`owner\\` in one tenant\r\n   * must not be treated as \\`owner\\` everywhere just because a check didn't carry\r\n   * a tenant. This mirrors how \\`assign(user, role)\\` stores a global row.\r\n   */\r\n  public static async rolesFor(user: Auth, tenant?: string): Promise<string[]> {\r\n    const rows = await this.query()\r\n      .where({\r\n        user_id: user.id,\r\n        user_type: user.userType,\r\n        tenant: tenant ?? null,\r\n      })\r\n      .get();\r\n\r\n    // De-dupe so a duplicate row (a concurrent assign that slipped past the\r\n    // existence check) can't distort the resolved set.\r\n    return [...new Set(rows.map((row) => row.get(\"role\") as string))];\r\n  }\r\n\r\n  /**\r\n   * Assign a role to the user. No-op if the assignment already exists.\r\n   * Flushes the user's cached permission set automatically.\r\n   */\r\n  public static async assign(user: Auth, role: string, tenant?: string): Promise<void> {\r\n    const existing = await this.first({\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      role,\r\n      tenant: tenant ?? null,\r\n    });\r\n\r\n    if (existing) return;\r\n\r\n    await this.create({\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      role,\r\n      tenant,\r\n    });\r\n\r\n    await access.flush(user, tenant);\r\n  }\r\n\r\n  /**\r\n   * Remove a role assignment from the user.\r\n   * Flushes the user's cached permission set automatically.\r\n   */\r\n  public static async revoke(user: Auth, role: string, tenant?: string): Promise<void> {\r\n    await this.delete({\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      role,\r\n      tenant: tenant ?? null,\r\n    });\r\n\r\n    await access.flush(user, tenant);\r\n  }\r\n}\r\n`;\r\n\r\nexport const accessUserRoleModelIndexStub = `export * from \"./user-role.model\";\r\n`;\r\n\r\nexport const accessUserRoleMigrationStub = `import { Migration, text, uuid } from \"@warlock.js/cascade\";\r\nimport { UserRole } from \"../user-role.model\";\r\n\r\n/**\r\n * Role-assignment table. \\`user_id\\` is a UUID — override this migration if your\r\n * user ids are integers. The composite index powers the per-user (per-tenant)\r\n * lookup the resolver runs on every check.\r\n */\r\nexport default Migration.create(\r\n  UserRole,\r\n  {\r\n    user_id: uuid().notNullable().index(),\r\n    user_type: text().notNullable(),\r\n    role: text().notNullable().index(),\r\n    tenant: text().nullable().index(),\r\n  },\r\n  {\r\n    index: [{ columns: [\"user_id\", \"user_type\", \"tenant\"] }],\r\n  },\r\n);\r\n`;\r\n\r\nexport const accessResolverStub = `import type { AccessResolver } from \"@warlock.js/access\";\r\nimport type { Auth } from \"@warlock.js/auth\";\r\nimport { Role } from \"app/access/models/role\";\r\nimport { UserRole } from \"app/access/models/user-role\";\r\n\r\n/**\r\n * The app's access adapter — connects @warlock.js/access to the ejected role\r\n * tables. Roles come from the user_roles assignment table; permissions are\r\n * expanded by mapping those role names through the roles catalog table. Both\r\n * are managed at runtime (in the DB), so admins can add roles + edit their\r\n * permissions without a deploy.\r\n *\r\n * The engine owns the hard parts (wildcard matching, caching, fail-closed); this\r\n * resolver only fetches — keep it dumb, never cache inside it.\r\n */\r\nexport class DatabaseAccessResolver implements AccessResolver {\r\n  /** The role names this user holds (powers \\`hasRole\\` / \\`hasAnyRole\\`). */\r\n  public async resolveRoles(user: Auth, tenant?: string): Promise<string[]> {\r\n    return UserRole.rolesFor(user, tenant);\r\n  }\r\n\r\n  /** The effective permission strings this user has (powers \\`can\\` / \\`authorize\\`). */\r\n  public async resolvePermissions(user: Auth, tenant?: string): Promise<string[]> {\r\n    const names = await this.resolveRoles(user, tenant);\r\n\r\n    if (names.length === 0) return [];\r\n\r\n    const roles = await Role.query().whereIn(\"name\", names).get();\r\n\r\n    // Flatten + de-dupe so two roles granting the same permission yield one entry.\r\n    return [...new Set(roles.flatMap((role) => role.permissions))];\r\n  }\r\n\r\n  /**\r\n   * Optional. Resolve the ambient tenant when a check doesn't pass one\r\n   * explicitly — derive it from the authenticated user (safer than reading\r\n   * client request input, which a caller could spoof). Uncomment + adapt for a\r\n   * multi-tenant app (single-tenant apps leave this off and return undefined).\r\n   */\r\n  // public resolveTenant(user: Auth): string | undefined {\r\n  //   return user.get(\"organization_id\");\r\n  // }\r\n}\r\n`;\r\n\r\nexport const socketConfigStub = `import type { SocketOptions } from \"@warlock.js/core\";\r\n\r\n/**\r\n * Socket.IO configuration — read by the framework's socket connector\r\n * on boot. When the HTTP server is running the socket server attaches\r\n * to it; otherwise it listens on its own configured port.\r\n *\r\n * Remove this file to disable the socket server entirely.\r\n */\r\nexport default {\r\n  options: {\r\n    cors: {\r\n      origin: \"*\",\r\n    },\r\n  },\r\n} as SocketOptions;\r\n`;\r\n\r\nexport const communicatorsConfigStub = `import { env } from \"@warlock.js/core\";\r\nimport type { BrokerConfigurations, RabbitMQClientOptions } from \"@warlock.js/herald\";\r\n\r\nconst heraldConfigurations: BrokerConfigurations<RabbitMQClientOptions> = {\r\n  driver: \"rabbitmq\",\r\n  name: \"default\",\r\n  isDefault: true,\r\n\r\n  // ============================================================================\r\n  // Connection Settings\r\n  // ============================================================================\r\n\r\n  host: env(\"RABBITMQ_HOST\", \"localhost\"),\r\n  port: env(\"RABBITMQ_PORT\", 5672),\r\n  username: env(\"RABBITMQ_USERNAME\", \"guest\"),\r\n  password: env(\"RABBITMQ_PASSWORD\", \"guest\"),\r\n  vhost: env(\"RABBITMQ_VHOST\", \"/\"),\r\n\r\n  // Or use connection URI (takes precedence over host/port)\r\n  // uri: env(\"RABBITMQ_URL\"),\r\n\r\n  // ============================================================================\r\n  // Connection Options\r\n  // ============================================================================\r\n\r\n  /** Heartbeat interval in seconds */\r\n  heartbeat: 60,\r\n\r\n  /** Connection timeout in milliseconds */\r\n  connectionTimeout: 10000,\r\n\r\n  /** Enable automatic reconnection on disconnect */\r\n  reconnect: true,\r\n\r\n  /** Delay between reconnection attempts in milliseconds */\r\n  reconnectDelay: 5_000,\r\n\r\n  // ============================================================================\r\n  // Consumer Options\r\n  // ============================================================================\r\n\r\n  /** Default prefetch count (number of unacknowledged messages per consumer) */\r\n  prefetch: 10,\r\n\r\n  // ============================================================================\r\n  // Client Options (Native amqplib options)\r\n  // ============================================================================\r\n  // These options are passed directly to amqplib.connect()\r\n  // for low-level configuration like frame size, TLS, socket options, etc.\r\n  // ============================================================================\r\n  clientOptions: {\r\n    // Frame max size in bytes (0 = no limit)\r\n    // frameMax: 0,\r\n\r\n    // Channel max (0 = unlimited)\r\n    // channelMax: 0,\r\n\r\n    // Socket options\r\n    socket: {\r\n      // Enable TCP keep-alive\r\n      keepAlive: true,\r\n\r\n      // Disable Nagle's algorithm for lower latency\r\n      noDelay: true,\r\n\r\n      // Socket timeout (in addition to heartbeat)\r\n      // timeout: 30000,\r\n    },\r\n\r\n    // TLS/SSL options (uncomment for secure connections)\r\n    // socket: {\r\n    //   ca: fs.readFileSync('/path/to/ca.pem'),\r\n    //   cert: fs.readFileSync('/path/to/cert.pem'),\r\n    //   key: fs.readFileSync('/path/to/key.pem'),\r\n    //   rejectUnauthorized: true,\r\n    // },\r\n  },\r\n};\r\n\r\nexport default heraldConfigurations;\r\n`;\r\n\r\nexport const notificationsConfigStub = `import { type NotificationConfig, inApp, mailChannel } from \"@warlock.js/notifications\";\r\nimport { Notification } from \"app/notifications/notification.model\";\r\n\r\n/**\r\n * Notifications configuration. Auto-loaded from src/config on boot — the\r\n * framework's notifications connector reads this default export and hands it to\r\n * setNotificationConfig, so this file stays declarative (no side-effect call).\r\n *\r\n * Each channel is payload-typed, so notify.mail(...) / notify.database(...)\r\n * and defineNotification are type-checked against the registry.\r\n *\r\n * Channels enabled here:\r\n *   - mail     wraps @warlock.js/core sendMail; route is notifiable.email.\r\n *              The \"from\" address defaults to config/mail.ts; override per\r\n *              channel with mailChannel({ from: \"no-reply@yourapp.com\" }).\r\n *   - database in-app store backed by the Notification model. The \"inApp\"\r\n *              facade exposes the recipient-scoped read API: listUnread,\r\n *              countUnread, markAsRead, dismiss, ...\r\n *\r\n * Async delivery (.queue()) is OPTIONAL: run \"npx warlock add herald\",\r\n * import { heraldQueue } from \"@warlock.js/notifications\", and uncomment the\r\n * queue line below.\r\n */\r\nconst config: NotificationConfig = {\r\n  channels: {\r\n    mail: mailChannel(),\r\n    database: inApp.configure({ model: Notification }),\r\n  },\r\n\r\n  // Async queue — requires @warlock.js/herald (npx warlock add herald):\r\n  // queue: heraldQueue(),\r\n};\r\n\r\nexport default config;\r\n`;\r\n\r\nexport const notificationModelStub = `import { RegisterModel } from \"@warlock.js/cascade\";\r\nimport { DatabaseNotification, type NotificationColumnMap } from \"@warlock.js/notifications\";\r\nimport { v } from \"@warlock.js/seal\";\r\n\r\n/**\r\n * Validation schema for the notifications table — mirrors the migration\r\n * columns (snake_case). Cascade validates + casts every write against it:\r\n * nullable columns use .nullish() (may be absent or null), and payload is\r\n * free-form JSON. Keep this in sync with the migration + columnMap when you\r\n * add or rename columns.\r\n */\r\nconst notificationSchema = v.object({\r\n  user_id: v.string(),\r\n  type: v.string(),\r\n  title: v.string(),\r\n  body: v.string().nullish(),\r\n  payload: v.record(v.any()).nullish(),\r\n  read_at: v.date().nullish(),\r\n  idempotency_key: v.string().nullish(),\r\n});\r\n\r\n/**\r\n * In-app notification model.\r\n *\r\n * Extends the package's DatabaseNotification base, which provides the stable\r\n * accessors (recipientId, tenantId, isRead, readAt, markRead) — all derived\r\n * from the columnMap below. The read/write API lives on the inApp facade\r\n * (configured in config/notifications.ts); you rarely touch this class directly.\r\n */\r\n@RegisterModel()\r\nexport class Notification extends DatabaseNotification {\r\n  public static table = \"notifications\";\r\n  public static schema = notificationSchema;\r\n\r\n  /**\r\n   * Maps the in-app store's roles to your columns. This default is\r\n   * single-tenant + read_at-only. Add tenant: \"organization_id\" for\r\n   * multi-tenant; use isRead: \"is_read\" (instead of, or alongside, readAt) to\r\n   * track a boolean read flag. The migration + accessors all follow this map.\r\n   */\r\n  public static columnMap: NotificationColumnMap = { readAt: \"read_at\" };\r\n}\r\n`;\r\n\r\nexport const notificationMigrationStub = `import { Migration } from \"@warlock.js/cascade\";\r\nimport { notificationColumns } from \"@warlock.js/notifications\";\r\nimport { Notification } from \"../notification.model\";\r\n\r\n/**\r\n * Notifications table.\r\n *\r\n * Columns come from notificationColumns(Notification) — the recipient / tenant\r\n * / read-state names follow the model's columnMap; type / title / body /\r\n * payload / idempotency_key are fixed. Spread it to add your own columns\r\n * (remember to mirror them in the model schema):\r\n *\r\n *   import { uuid } from \"@warlock.js/cascade\";\r\n *\r\n *   export default Migration.create(Notification, {\r\n *     ...notificationColumns(Notification),\r\n *     // category_id: uuid().index().nullable(),\r\n *   });\r\n */\r\nexport default Migration.create(Notification, notificationColumns(Notification));\r\n`;\r\n\r\nexport const notificationControllersStub = `import { type Request, type RequestHandler, type Response } from \"@warlock.js/core\";\r\nimport { inApp } from \"@warlock.js/notifications\";\r\n\r\n/**\r\n * The authenticated user's notification HTTP surface — thin wrappers over the\r\n * recipient-scoped \\`inApp\\` facade (a foreign id can never touch another user's\r\n * rows). Notifications are produced by domain events, never over HTTP, so there\r\n * is no create. Trim or split these as your app grows.\r\n */\r\n\r\n/** GET /notifications — list, most recent first (page / limit / type / unread via query). */\r\nexport const listNotificationsController: RequestHandler = async (\r\n  request: Request,\r\n  response: Response,\r\n) => {\r\n  const { data, pagination } = await inApp.list(request.user!, request.all());\r\n\r\n  return response.success({ notifications: data, pagination });\r\n};\r\n\r\nlistNotificationsController.description = \"List notifications\";\r\n\r\n/** GET /notifications/unread-count — drives the bell badge. */\r\nexport const unreadNotificationsCountController: RequestHandler = async (\r\n  request: Request,\r\n  response: Response,\r\n) => {\r\n  const count = await inApp.countUnread(request.user!);\r\n\r\n  return response.success({ count });\r\n};\r\n\r\nunreadNotificationsCountController.description = \"Unread notifications count\";\r\n\r\n/** PATCH /notifications/:id/read — mark one read, return the updated row. */\r\nexport const markNotificationReadController: RequestHandler = async (\r\n  request: Request,\r\n  response: Response,\r\n) => {\r\n  const id = request.input(\"id\");\r\n\r\n  await inApp.markAsRead(request.user!, id);\r\n  const notification = await inApp.find(request.user!, id);\r\n\r\n  return response.success({ notification });\r\n};\r\n\r\nmarkNotificationReadController.description = \"Mark notification read\";\r\n\r\n/** PATCH /notifications/read-all — mark every unread one read. */\r\nexport const markAllNotificationsReadController: RequestHandler = async (\r\n  request: Request,\r\n  response: Response,\r\n) => {\r\n  const count = await inApp.markAsRead(request.user!);\r\n\r\n  return response.success({ count });\r\n};\r\n\r\nmarkAllNotificationsReadController.description = \"Mark all notifications read\";\r\n\r\n/** DELETE /notifications — dismiss all for the user. */\r\nexport const clearNotificationsController: RequestHandler = async (\r\n  request: Request,\r\n  response: Response,\r\n) => {\r\n  await inApp.dismiss(request.user!);\r\n\r\n  return response.noContent();\r\n};\r\n\r\nclearNotificationsController.description = \"Clear notifications\";\r\n\r\n/** DELETE /notifications/:id — dismiss one. */\r\nexport const deleteNotificationController: RequestHandler = async (\r\n  request: Request,\r\n  response: Response,\r\n) => {\r\n  await inApp.dismiss(request.user!, request.input(\"id\"));\r\n\r\n  return response.noContent();\r\n};\r\n\r\ndeleteNotificationController.description = \"Delete notification\";\r\n`;\r\n\r\nexport const notificationRoutesStub = `import { authMiddleware } from \"@warlock.js/auth\";\r\nimport { router } from \"@warlock.js/core\";\r\nimport {\r\n  clearNotificationsController,\r\n  deleteNotificationController,\r\n  listNotificationsController,\r\n  markAllNotificationsReadController,\r\n  markNotificationReadController,\r\n  unreadNotificationsCountController,\r\n} from \"./controllers/notifications.controller\";\r\n\r\n/**\r\n * Notification routes — the authenticated user's read + dismiss surface.\r\n *\r\n * Notifications are produced by domain events (never created over HTTP), so\r\n * there is no POST. Every route is gated by \\`authMiddleware\\` and recipient-\r\n * scoped by \\`inApp\\` (a foreign id touches zero rows). Delete any endpoint you\r\n * don't need; if your app reads notifications over sockets/GraphQL instead,\r\n * delete this file + the controllers entirely.\r\n */\r\nrouter.group({ prefix: \"/notifications\", middleware: [authMiddleware([])] }, () => {\r\n  router.get(\"/\", listNotificationsController);\r\n  router.get(\"/unread-count\", unreadNotificationsCountController);\r\n  router.patch(\"/read-all\", markAllNotificationsReadController);\r\n  router.patch(\"/:id/read\", markNotificationReadController);\r\n  router.delete(\"/\", clearNotificationsController);\r\n  router.delete(\"/:id\", deleteNotificationController);\r\n});\r\n`;\r\n\r\n/**\r\n * `src/web/root.tsx` — the application root for the SSR page layer.\r\n *\r\n * Deliberately minimal. The framework ships a default root, so this exists to\r\n * give you a place to start rather than because anything requires it. The\r\n * reference app (`v5/app/src/web/root.tsx`) is where to look for the fuller\r\n * shape: middleware, an app-level loader, locales, an ErrorBoundary.\r\n */\r\nexport const webRootStub = `import { Head, Scripts } from \"@warlock.js/web\";\r\nimport type { AppProps } from \"@warlock.js/web\";\r\n\r\n/**\r\n * The application root.\r\n *\r\n * NOT async, and it receives no request/response: it renders on the server and\r\n * again in the browser during hydration, where neither exists.\r\n */\r\nexport default function App({ children }: AppProps) {\r\n  return (\r\n    <html lang=\"en\">\r\n      <head>\r\n        {/*\r\n          Placement only. The framework injects the page's \\`metadata\\`, the\r\n          stylesheet and preload tags for this route, and the canonical links\r\n          into <head> by default — <Head /> just says WHERE they land.\r\n\r\n          Do not add a <title> here: the page's \\`metadata\\` owns it, and a root\r\n          that emits one too produces two.\r\n        */}\r\n        <Head />\r\n      </head>\r\n      <body>\r\n        {/*\r\n          REQUIRED — this is the hydration mount point, not a styling wrapper.\r\n\r\n          The browser runtime looks up \\`#root\\` and hydrates that element only.\r\n          Remove this div, or rename the id, and the page still renders from the\r\n          server but never becomes interactive: the runtime throws in the console\r\n          and nothing on screen changes.\r\n\r\n          Wrap it in your own markup freely, and put anything that must live\r\n          outside the hydrated tree (a static footer, a portal target) outside\r\n          it — just keep an element with \\`id=\"root\"\\` around {children}.\r\n        */}\r\n        <div id=\"root\">{children}</div>\r\n        {/*\r\n          The hydration payload and module tags. Written explicitly because\r\n          placement occasionally matters — a CSP nonce, or ordering against\r\n          your own scripts.\r\n        */}\r\n        <Scripts />\r\n      </body>\r\n    </html>\r\n  );\r\n}\r\n`;\r\n\r\n/**\r\n * `src/app/contact/controllers/contact.controller.ts` — a real API endpoint\r\n * for the Web starter's contact form. It intentionally has no persistence\r\n * dependency: replace the acknowledgement with a mail/job/database action.\r\n */\r\nexport const webContactControllerStub = `import { type Request, type RequestHandler } from \"@warlock.js/core\";\r\nimport { type Infer, v } from \"@warlock.js/seal\";\r\n\r\nexport const contactSchema = v.object({\r\n  name: v.string().min(2).required(),\r\n  email: v.email().required(),\r\n  message: v.string().min(10).required(),\r\n});\r\n\r\nexport type ContactSchema = Infer.Output<typeof contactSchema>;\r\n\r\n/** POST /api/contact — validates the starter contact form. */\r\nexport const contactController: RequestHandler<Request<ContactSchema>> = async ({ request, response }) => {\r\n  const contact = request.validated();\r\n\r\n  // Replace this with delivery/persistence for your app. Keeping the accepted\r\n  // payload visible makes the endpoint useful while remaining side-effect free.\r\n  return response.success({\r\n    message: \"Thanks, \" + contact.name + \". Your message has been received.\",\r\n  });\r\n};\r\n\r\ncontactController.validation = { schema: contactSchema };\r\n`;\r\n\r\n/** `src/app/contact/routes.ts` — discovered by the standard app route loader. */\r\nexport const webContactRoutesStub = `import { router } from \"@warlock.js/core\";\r\nimport { contactController } from \"./controllers/contact.controller\";\r\n\r\nrouter.post(\"/api/contact\", contactController);\r\n`;\r\n\r\n/**\r\n * `src/web/home.page.tsx` — one page, so \\`warlock dev\\` has something to serve\r\n * the moment this finishes.\r\n */\r\nexport const webHomePageStub = `import { http } from \"@mongez/http\";\r\nimport { Form, useFormControl, type FormControlProps } from \"@mongez/react-form\";\r\nimport { extend, setCurrentLocaleCode } from \"@mongez/localization\";\r\nimport { transX } from \"@mongez/react-localization\";\r\nimport { v } from \"@warlock.js/seal\";\r\nimport { useState } from \"react\";\r\nimport { Link, type PageProps } from \"@warlock.js/web\";\r\n\r\n/**\r\n * A page route is an ordinary Warlock route whose handler renders React\r\n * instead of returning JSON.\r\n *\r\n * The URL is the one this file DECLARES below. This page answers \\`GET \"/\"\\`\r\n * because \\`route = \"/\"\\`, not because of where the file lives. A page file with\r\n * no \\`route\\` export is REFUSED by both the dev server and the build.\r\n */\r\nexport const route = \"/\";\r\n\r\nexport const metadata = { title: \"Home\" };\r\n\r\nconst contactSchema = v.object({\r\n  name: v.string().min(2).required(),\r\n  email: v.email().required(),\r\n  message: v.string().min(10).required(),\r\n});\r\n\r\nextend(\"en\", {\r\n  starter: {\r\n    title: \"Your Warlock app is running.\",\r\n    introduction: \"This page is rendered on the server and hydrated in the browser.\",\r\n    language: \"العربية\",\r\n    contact: \"Send a message\",\r\n    name: \"Name\",\r\n    email: \"Email\",\r\n    message: \"Message\",\r\n    submit: \"Send message\",\r\n    sent: \"Thanks — your message has been received.\",\r\n  },\r\n});\r\nextend(\"ar\", {\r\n  starter: {\r\n    title: \"تطبيق Warlock يعمل الآن.\",\r\n    introduction: \"تُعرض هذه الصفحة على الخادم ثم تُفعَّل في المتصفح.\",\r\n    language: \"English\",\r\n    contact: \"أرسل رسالة\",\r\n    name: \"الاسم\",\r\n    email: \"البريد الإلكتروني\",\r\n    message: \"الرسالة\",\r\n    submit: \"إرسال الرسالة\",\r\n    sent: \"شكرًا — تم استلام رسالتك.\",\r\n  },\r\n});\r\n\r\nfunction TextInput({ label, ...controlProps }: FormControlProps & { label: string }) {\r\n  const { error, getErrorProps, getInputProps } = useFormControl(controlProps);\r\n\r\n  return (\r\n    <div className=\"wk-field\">\r\n      <label htmlFor={controlProps.name}>{label}</label>\r\n      <input {...getInputProps()} />\r\n      {error && <p {...getErrorProps()}>{error}</p>}\r\n    </div>\r\n  );\r\n}\r\n\r\n/**\r\n * Add a \\`loader\\` export to fetch data on the server, and it arrives here as\r\n * \\`data\\`, typed:\r\n *\r\n *   export const loader = (async () => ({ items: await itemsRepository.all() }));\r\n *   export default function HomePage({ data }: PageProps<typeof loader>) { ... }\r\n */\r\nexport default function HomePage(_props: PageProps) {\r\n  // Live state. If the button below does nothing, the page rendered on the\r\n  // server but never hydrated — the runtime never mounted at \\`#root\\`. This is\r\n  // deliberately here so that failure is impossible to miss.\r\n  const [count, setCount] = useState(0);\r\n  const [locale, setLocale] = useState<\"en\" | \"ar\">(\"en\");\r\n  const [submitted, setSubmitted] = useState(false);\r\n  const [submitError, setSubmitError] = useState<string | null>(null);\r\n\r\n  const toggleLocale = () => {\r\n    const nextLocale = locale === \"en\" ? \"ar\" : \"en\";\r\n    setCurrentLocaleCode(nextLocale);\r\n    setLocale(nextLocale);\r\n  };\r\n\r\n  return (\r\n    <>\r\n      {/*\r\n        Self-contained, dependency-free styling: plain CSS, system fonts, and\r\n        CSS custom properties, scoped to this page. No CSS framework, no utility\r\n        classes, no external stylesheet — this page looks the same whether or\r\n        not \\`warlock add tailwind\\` has ever been run.\r\n      */}\r\n      <style>{\\`\r\n        .wk-home {\r\n          --wk-fg: #0f172a;\r\n          --wk-muted: #64748b;\r\n          --wk-accent: #4f46e5;\r\n          --wk-border: #e2e8f0;\r\n          font-family: system-ui, -apple-system, \"Segoe UI\", Roboto, sans-serif;\r\n          color: var(--wk-fg);\r\n          max-width: 42rem;\r\n          margin: 4rem auto;\r\n          padding: 0 1.5rem;\r\n          line-height: 1.6;\r\n        }\r\n        .wk-home h1 { font-size: 2.25rem; margin: 0 0 0.5rem; }\r\n        .wk-home p { color: var(--wk-muted); margin: 0 0 1.5rem; }\r\n        .wk-home code {\r\n          font-family: ui-monospace, \"SFMono-Regular\", Menlo, monospace;\r\n          background: #f1f5f9;\r\n          padding: 0.1rem 0.35rem;\r\n          border-radius: 0.25rem;\r\n        }\r\n        .wk-check {\r\n          border: 1px solid var(--wk-border);\r\n          border-radius: 0.75rem;\r\n          padding: 1.25rem 1.5rem;\r\n          margin: 2rem 0;\r\n        }\r\n        .wk-check strong { display: block; font-size: 1.5rem; }\r\n        .wk-check button {\r\n          font: inherit;\r\n          cursor: pointer;\r\n          background: var(--wk-accent);\r\n          color: #fff;\r\n          border: 0;\r\n          border-radius: 0.5rem;\r\n          padding: 0.5rem 1rem;\r\n          margin-top: 0.75rem;\r\n        }\r\n        .wk-links { display: flex; gap: 1.25rem; font-size: 0.95rem; }\r\n        .wk-links a { color: var(--wk-accent); text-decoration: none; }\r\n        .wk-links a:hover { text-decoration: underline; }\r\n        .wk-language { margin-left: auto; }\r\n        .wk-contact { margin-top: 2rem; }\r\n        .wk-field { display: grid; gap: 0.35rem; margin: 0.8rem 0; }\r\n        .wk-field input, .wk-field textarea { font: inherit; padding: 0.55rem; }\r\n        .wk-field p, .wk-submit-error { color: #b91c1c; margin: 0; }\r\n        .wk-success { color: #047857; }\r\n      \\`}</style>\r\n\r\n      <main className=\"wk-home\" dir={locale === \"ar\" ? \"rtl\" : \"ltr\"}>\r\n        <nav className=\"wk-links\" aria-label=\"Starter links\">\r\n          <a href=\"https://warlock.js.org\" target=\"_blank\" rel=\"noreferrer\">Docs</a>\r\n          <Link href=\"/\" aria-current=\"page\">Home</Link>\r\n          <button\r\n            className=\"wk-language\"\r\n            type=\"button\"\r\n            aria-pressed={locale === \"ar\"}\r\n            onClick={toggleLocale}\r\n          >\r\n            {transX(\"starter.language\")}\r\n          </button>\r\n        </nav>\r\n\r\n        <h1>{transX(\"starter.title\")}</h1>\r\n        <p>{transX(\"starter.introduction\")}</p>\r\n\r\n        <section className=\"wk-check\">\r\n          <label>If this number goes up when you click, React is hydrated:</label>\r\n          <strong>{count}</strong>\r\n          <button type=\"button\" onClick={() => setCount(c => c + 1)}>\r\n            Count up\r\n          </button>\r\n        </section>\r\n\r\n        <section className=\"wk-contact\" aria-labelledby=\"contact-heading\">\r\n          <h2 id=\"contact-heading\">{transX(\"starter.contact\")}</h2>\r\n          <Form<typeof contactSchema>\r\n            schema={contactSchema}\r\n            onSubmit={async ({ form, values }) => {\r\n              setSubmitted(false);\r\n              setSubmitError(null);\r\n              const result = await http.post<{ message: string }>(\"/api/contact\", values);\r\n\r\n              if (result.error) {\r\n                if (result.error.isValidationError) {\r\n                  const body = result.error.body as {\r\n                    errors?: Array<{ input: string; error: string }>;\r\n                    message?: string;\r\n                  };\r\n                  form.setErrors(\r\n                    Object.fromEntries(\r\n                      (body.errors ?? []).map(({ input, error }) => [input, error]),\r\n                    ),\r\n                  );\r\n                  setSubmitError(body.message ?? \"Please correct the highlighted fields.\");\r\n                } else {\r\n                  setSubmitError(\"Your message could not be sent. Please try again.\");\r\n                }\r\n                return;\r\n              }\r\n\r\n              setSubmitted(true);\r\n              form.reset();\r\n            }}\r\n          >\r\n            <TextInput name=\"name\" label={transX(\"starter.name\")} autoComplete=\"name\" />\r\n            <TextInput name=\"email\" label={transX(\"starter.email\")} type=\"email\" autoComplete=\"email\" />\r\n            <ContactMessage />\r\n            <button type=\"submit\">{transX(\"starter.submit\")}</button>\r\n            {submitError && <p className=\"wk-submit-error\" role=\"alert\">{submitError}</p>}\r\n            {submitted && <p className=\"wk-success\" role=\"status\">{transX(\"starter.sent\")}</p>}\r\n          </Form>\r\n        </section>\r\n      </main>\r\n    </>\r\n  );\r\n}\r\n\r\nfunction ContactMessage() {\r\n  const { error, getErrorProps, getInputProps } = useFormControl({ name: \"message\" });\r\n\r\n  return (\r\n    <div className=\"wk-field\">\r\n      <label htmlFor=\"message\">{transX(\"starter.message\")}</label>\r\n      <textarea {...getInputProps()} rows={5} />\r\n      {error && <p {...getErrorProps()}>{error}</p>}\r\n    </div>\r\n  );\r\n}\r\n`;\r\n"],"mappings":";AAAA,MAAa,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BhC,MAAa,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+B5B,MAAa,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCnC,MAAa,2BAA2B;;AAGxC,MAAa,0BAA0B;;;;;;;;;;;;AAavC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8FvC,MAAa,+BAA+B;;AAG5C,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;AAsB3C,MAAa,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6ClC,MAAa,mBAAmB;;;;;;;;;;;;;;;;;AAkBhC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFvC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCvC,MAAa,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CrC,MAAa,4BAA4B;;;;;;;;;;;;;;;;;;;;;AAsBzC,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsF3C,MAAa,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCtC,MAAa,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsD3B,MAAa,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;AA0BxC,MAAa,uBAAuB;;;;;;;;;AAUpC,MAAa,kBAAkB"}
+{"version":3,"file":"stubs.mjs","names":[],"sources":["../../../../../../../core/src/generations/stubs.ts"],"sourcesContent":["export const accessConfigStub = `import { type AccessConfigurations } from \"@warlock.js/access\";\r\nimport { DatabaseAccessResolver } from \"app/access/services/access-resolver\";\r\n\r\n/**\r\n * Authorization configuration — read by @warlock.js/access on boot.\r\n *\r\n * The resolver is the one required piece: it tells the engine how to read a\r\n * user's roles + permissions. The ejected DatabaseAccessResolver reads roles\r\n * from the user_roles table and maps them through the roles catalog table (so\r\n * roles + their permissions are managed at runtime, in the DB).\r\n *\r\n * For a fixed, code-defined catalog with no tables, swap in DefaultAccessResolver:\r\n *   import { DefaultAccessResolver } from \"@warlock.js/access\";\r\n *   resolver: new DefaultAccessResolver({ admin: [\"*\"], editor: [\"orders.*\"] }),\r\n *\r\n * Multi-tenant? Add a \\`resolveTenant()\\` to the resolver to read the active\r\n * tenant from the request; checks then scope to it automatically.\r\n */\r\nconst access: AccessConfigurations = {\r\n  resolver: new DatabaseAccessResolver(),\r\n\r\n  // Cache resolved permission sets (default \"10m\").\r\n  // cache: { ttl: \"10m\" },\r\n};\r\n\r\nexport default access;\r\n`;\r\n\r\nexport const aiConfigStub = `import type { AIConfig } from \"@warlock.js/ai\";\r\n\r\n// >>> warlock:ai-packages (auto-managed) >>>\r\n// Satellite packages augment the \"ai\" object on import — e.g. ai.workspace,\r\n// ai.tools / ai.mcp, and panoptic's ai.config({ panoptic }) wiring. The command\r\n// \"warlock add ai-workspace | ai-tools | ai-panoptic\" adds the matching\r\n// side-effect import below; keep them so the augmentation + runtime registration\r\n// load before the ai connector applies this config.\r\n// <<< warlock:ai-packages <<<\r\n\r\n/**\r\n * AI configuration — applied on boot by the ai connector, which calls\r\n * ai.config(...) with the object below. Cross-cutting defaults live here\r\n * (shared cache / snapshot stores, observability); per-call options always win.\r\n *\r\n * Wire a default model from a provider you installed, e.g.:\r\n *   import { OpenAISDK } from \"@warlock.js/ai-openai\";\r\n *   const openai = OpenAISDK({ apiKey: env(\"OPENAI_API_KEY\") });\r\n *   // then pass openai.model({ name: \"gpt-4o-mini\" }) into your agents.\r\n */\r\nconst ai: Partial<AIConfig> = {\r\n  // Default cache driver for cache-backed AI features (semantic cache, rag / memory vector stores).\r\n  // defaultStore: cache.driver(\"redis\", { client }),\r\n\r\n  // Observability — requires \"warlock add ai-panoptic\". Exporters + the local dashboard.\r\n  // panoptic: { exporters: [], dashboard: false, observeAll: false },\r\n};\r\n\r\nexport default ai;\r\n`;\r\n\r\nexport const accessRoleModelStub = `import { Model, RegisterModel } from \"@warlock.js/cascade\";\r\nimport { type Infer, v } from \"@warlock.js/seal\";\r\n\r\n/**\r\n * Validation schema for the roles catalog — mirrors the migration columns\r\n * (snake_case). Each row is a role name plus the permission strings it grants;\r\n * wildcards work (\"orders.*\", \"*\"). The DatabaseAccessResolver maps a user's\r\n * assigned role names through this table to their effective permissions.\r\n */\r\nexport const roleSchema = v.object({\r\n  name: v.string(),\r\n  permissions: v.array(v.string()).default([]),\r\n});\r\n\r\nexport type RoleSchema = Infer<typeof roleSchema>;\r\n\r\n/**\r\n * The roles catalog — role name → the permissions it grants. Managed at runtime\r\n * (admins add roles + edit their permissions), unlike a fixed code map. Read by\r\n * DatabaseAccessResolver.resolvePermissions to expand a user's roles to permissions.\r\n */\r\n@RegisterModel()\r\nexport class Role extends Model<RoleSchema> {\r\n  public static table = \"roles\";\r\n\r\n  public static schema = roleSchema;\r\n\r\n  /** The permission strings this role grants. */\r\n  public get permissions(): string[] {\r\n    return this.get<string[]>(\"permissions\", []);\r\n  }\r\n}\r\n`;\r\n\r\nexport const accessRoleModelIndexStub = `export * from \"./role.model\";\r\n`;\r\n\r\nexport const accessRoleMigrationStub = `import { arrayText, Migration, text } from \"@warlock.js/cascade\";\r\nimport { Role } from \"../role.model\";\r\n\r\n/**\r\n * Roles catalog table. \\`name\\` is unique (one row per role); \\`permissions\\` is a\r\n * text array of the permission strings the role grants.\r\n */\r\nexport default Migration.create(Role, {\r\n  name: text().notNullable().unique(),\r\n  permissions: arrayText().nullable(),\r\n});\r\n`;\r\n\r\nexport const accessUserRoleModelStub = `import { access } from \"@warlock.js/access\";\r\nimport type { Auth } from \"@warlock.js/auth\";\r\nimport { Model, RegisterModel } from \"@warlock.js/cascade\";\r\nimport { type Infer, v } from \"@warlock.js/seal\";\r\n\r\n/**\r\n * Validation schema for a role assignment — mirrors the migration columns\r\n * (snake_case). \\`tenant\\` is nullable: a null tenant is a GLOBAL assignment.\r\n */\r\nexport const userRoleSchema = v.object({\r\n  user_id: v.string(),\r\n  user_type: v.string(),\r\n  role: v.string(),\r\n  tenant: v.string().optional(),\r\n});\r\n\r\nexport type UserRoleSchema = Infer<typeof userRoleSchema>;\r\n\r\n/**\r\n * The role-assignment table — which roles a user holds, optionally per tenant.\r\n * Read by DatabaseAccessResolver.resolveRoles; mutated via the statics below.\r\n * \\`assign\\` / \\`revoke\\` flush the cached permission set automatically, so callers\r\n * never need to call \\`access.flush(user, tenant)\\` themselves.\r\n */\r\n@RegisterModel()\r\nexport class UserRole extends Model<UserRoleSchema> {\r\n  public static table = \"user_roles\";\r\n\r\n  public static schema = userRoleSchema;\r\n\r\n  /**\r\n   * Role names assigned to the user in the given tenant.\r\n   *\r\n   * An unresolved tenant (\\`undefined\\`) scopes to GLOBAL roles only — the rows\r\n   * stored with no tenant (\\`null\\`) — never the union across every tenant. The\r\n   * union would be a privilege-escalation: a user who is \\`owner\\` in one tenant\r\n   * must not be treated as \\`owner\\` everywhere just because a check didn't carry\r\n   * a tenant. This mirrors how \\`assign(user, role)\\` stores a global row.\r\n   */\r\n  public static async rolesFor(user: Auth, tenant?: string): Promise<string[]> {\r\n    const rows = await this.query()\r\n      .where({\r\n        user_id: user.id,\r\n        user_type: user.userType,\r\n        tenant: tenant ?? null,\r\n      })\r\n      .get();\r\n\r\n    // De-dupe so a duplicate row (a concurrent assign that slipped past the\r\n    // existence check) can't distort the resolved set.\r\n    return [...new Set(rows.map((row) => row.get(\"role\") as string))];\r\n  }\r\n\r\n  /**\r\n   * Assign a role to the user. No-op if the assignment already exists.\r\n   * Flushes the user's cached permission set automatically.\r\n   */\r\n  public static async assign(user: Auth, role: string, tenant?: string): Promise<void> {\r\n    const existing = await this.first({\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      role,\r\n      tenant: tenant ?? null,\r\n    });\r\n\r\n    if (existing) return;\r\n\r\n    await this.create({\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      role,\r\n      tenant,\r\n    });\r\n\r\n    await access.flush(user, tenant);\r\n  }\r\n\r\n  /**\r\n   * Remove a role assignment from the user.\r\n   * Flushes the user's cached permission set automatically.\r\n   */\r\n  public static async revoke(user: Auth, role: string, tenant?: string): Promise<void> {\r\n    await this.delete({\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      role,\r\n      tenant: tenant ?? null,\r\n    });\r\n\r\n    await access.flush(user, tenant);\r\n  }\r\n}\r\n`;\r\n\r\nexport const accessUserRoleModelIndexStub = `export * from \"./user-role.model\";\r\n`;\r\n\r\nexport const accessUserRoleMigrationStub = `import { Migration, text, uuid } from \"@warlock.js/cascade\";\r\nimport { UserRole } from \"../user-role.model\";\r\n\r\n/**\r\n * Role-assignment table. \\`user_id\\` is a UUID — override this migration if your\r\n * user ids are integers. The composite index powers the per-user (per-tenant)\r\n * lookup the resolver runs on every check.\r\n */\r\nexport default Migration.create(\r\n  UserRole,\r\n  {\r\n    user_id: uuid().notNullable().index(),\r\n    user_type: text().notNullable(),\r\n    role: text().notNullable().index(),\r\n    tenant: text().nullable().index(),\r\n  },\r\n  {\r\n    index: [{ columns: [\"user_id\", \"user_type\", \"tenant\"] }],\r\n  },\r\n);\r\n`;\r\n\r\nexport const accessResolverStub = `import type { AccessResolver } from \"@warlock.js/access\";\r\nimport type { Auth } from \"@warlock.js/auth\";\r\nimport { Role } from \"app/access/models/role\";\r\nimport { UserRole } from \"app/access/models/user-role\";\r\n\r\n/**\r\n * The app's access adapter — connects @warlock.js/access to the ejected role\r\n * tables. Roles come from the user_roles assignment table; permissions are\r\n * expanded by mapping those role names through the roles catalog table. Both\r\n * are managed at runtime (in the DB), so admins can add roles + edit their\r\n * permissions without a deploy.\r\n *\r\n * The engine owns the hard parts (wildcard matching, caching, fail-closed); this\r\n * resolver only fetches — keep it dumb, never cache inside it.\r\n */\r\nexport class DatabaseAccessResolver implements AccessResolver {\r\n  /** The role names this user holds (powers \\`hasRole\\` / \\`hasAnyRole\\`). */\r\n  public async resolveRoles(user: Auth, tenant?: string): Promise<string[]> {\r\n    return UserRole.rolesFor(user, tenant);\r\n  }\r\n\r\n  /** The effective permission strings this user has (powers \\`can\\` / \\`authorize\\`). */\r\n  public async resolvePermissions(user: Auth, tenant?: string): Promise<string[]> {\r\n    const names = await this.resolveRoles(user, tenant);\r\n\r\n    if (names.length === 0) return [];\r\n\r\n    const roles = await Role.query().whereIn(\"name\", names).get();\r\n\r\n    // Flatten + de-dupe so two roles granting the same permission yield one entry.\r\n    return [...new Set(roles.flatMap((role) => role.permissions))];\r\n  }\r\n\r\n  /**\r\n   * Optional. Resolve the ambient tenant when a check doesn't pass one\r\n   * explicitly — derive it from the authenticated user (safer than reading\r\n   * client request input, which a caller could spoof). Uncomment + adapt for a\r\n   * multi-tenant app (single-tenant apps leave this off and return undefined).\r\n   */\r\n  // public resolveTenant(user: Auth): string | undefined {\r\n  //   return user.get(\"organization_id\");\r\n  // }\r\n}\r\n`;\r\n\r\nexport const socketConfigStub = `import type { SocketOptions } from \"@warlock.js/core\";\r\n\r\n/**\r\n * Socket.IO configuration — read by the framework's socket connector\r\n * on boot. When the HTTP server is running the socket server attaches\r\n * to it; otherwise it listens on its own configured port.\r\n *\r\n * Remove this file to disable the socket server entirely.\r\n */\r\nexport default {\r\n  options: {\r\n    cors: {\r\n      origin: \"*\",\r\n    },\r\n  },\r\n} as SocketOptions;\r\n`;\r\n\r\nexport const communicatorsConfigStub = `import { env } from \"@warlock.js/core\";\r\nimport type { BrokerConfigurations, RabbitMQClientOptions } from \"@warlock.js/herald\";\r\n\r\nconst heraldConfigurations: BrokerConfigurations<RabbitMQClientOptions> = {\r\n  driver: \"rabbitmq\",\r\n  name: \"default\",\r\n  isDefault: true,\r\n\r\n  // ============================================================================\r\n  // Connection Settings\r\n  // ============================================================================\r\n\r\n  host: env(\"RABBITMQ_HOST\", \"localhost\"),\r\n  port: env(\"RABBITMQ_PORT\", 5672),\r\n  username: env(\"RABBITMQ_USERNAME\", \"guest\"),\r\n  password: env(\"RABBITMQ_PASSWORD\", \"guest\"),\r\n  vhost: env(\"RABBITMQ_VHOST\", \"/\"),\r\n\r\n  // Or use connection URI (takes precedence over host/port)\r\n  // uri: env(\"RABBITMQ_URL\"),\r\n\r\n  // ============================================================================\r\n  // Connection Options\r\n  // ============================================================================\r\n\r\n  /** Heartbeat interval in seconds */\r\n  heartbeat: 60,\r\n\r\n  /** Connection timeout in milliseconds */\r\n  connectionTimeout: 10000,\r\n\r\n  /** Enable automatic reconnection on disconnect */\r\n  reconnect: true,\r\n\r\n  /** Delay between reconnection attempts in milliseconds */\r\n  reconnectDelay: 5_000,\r\n\r\n  // ============================================================================\r\n  // Consumer Options\r\n  // ============================================================================\r\n\r\n  /** Default prefetch count (number of unacknowledged messages per consumer) */\r\n  prefetch: 10,\r\n\r\n  // ============================================================================\r\n  // Client Options (Native amqplib options)\r\n  // ============================================================================\r\n  // These options are passed directly to amqplib.connect()\r\n  // for low-level configuration like frame size, TLS, socket options, etc.\r\n  // ============================================================================\r\n  clientOptions: {\r\n    // Frame max size in bytes (0 = no limit)\r\n    // frameMax: 0,\r\n\r\n    // Channel max (0 = unlimited)\r\n    // channelMax: 0,\r\n\r\n    // Socket options\r\n    socket: {\r\n      // Enable TCP keep-alive\r\n      keepAlive: true,\r\n\r\n      // Disable Nagle's algorithm for lower latency\r\n      noDelay: true,\r\n\r\n      // Socket timeout (in addition to heartbeat)\r\n      // timeout: 30000,\r\n    },\r\n\r\n    // TLS/SSL options (uncomment for secure connections)\r\n    // socket: {\r\n    //   ca: fs.readFileSync('/path/to/ca.pem'),\r\n    //   cert: fs.readFileSync('/path/to/cert.pem'),\r\n    //   key: fs.readFileSync('/path/to/key.pem'),\r\n    //   rejectUnauthorized: true,\r\n    // },\r\n  },\r\n};\r\n\r\nexport default heraldConfigurations;\r\n`;\r\n\r\nexport const notificationsConfigStub = `import { type NotificationConfig, inApp, mailChannel } from \"@warlock.js/notifications\";\r\nimport { Notification } from \"app/notifications/notification.model\";\r\n\r\n/**\r\n * Notifications configuration. Auto-loaded from src/config on boot — the\r\n * framework's notifications connector reads this default export and hands it to\r\n * setNotificationConfig, so this file stays declarative (no side-effect call).\r\n *\r\n * Each channel is payload-typed, so notify.mail(...) / notify.database(...)\r\n * and defineNotification are type-checked against the registry.\r\n *\r\n * Channels enabled here:\r\n *   - mail     wraps @warlock.js/core sendMail; route is notifiable.email.\r\n *              The \"from\" address defaults to config/mail.ts; override per\r\n *              channel with mailChannel({ from: \"no-reply@yourapp.com\" }).\r\n *   - database in-app store backed by the Notification model. The \"inApp\"\r\n *              facade exposes the recipient-scoped read API: listUnread,\r\n *              countUnread, markAsRead, dismiss, ...\r\n *\r\n * Async delivery (.queue()) is OPTIONAL: run \"npx warlock add herald\",\r\n * import { heraldQueue } from \"@warlock.js/notifications\", and uncomment the\r\n * queue line below.\r\n */\r\nconst config: NotificationConfig = {\r\n  channels: {\r\n    mail: mailChannel(),\r\n    database: inApp.configure({ model: Notification }),\r\n  },\r\n\r\n  // Async queue — requires @warlock.js/herald (npx warlock add herald):\r\n  // queue: heraldQueue(),\r\n};\r\n\r\nexport default config;\r\n`;\r\n\r\nexport const notificationModelStub = `import { RegisterModel } from \"@warlock.js/cascade\";\r\nimport { DatabaseNotification, type NotificationColumnMap } from \"@warlock.js/notifications\";\r\nimport { v } from \"@warlock.js/seal\";\r\n\r\n/**\r\n * Validation schema for the notifications table — mirrors the migration\r\n * columns (snake_case). Cascade validates + casts every write against it:\r\n * nullable columns use .nullish() (may be absent or null), and payload is\r\n * free-form JSON. Keep this in sync with the migration + columnMap when you\r\n * add or rename columns.\r\n */\r\nconst notificationSchema = v.object({\r\n  user_id: v.string(),\r\n  type: v.string(),\r\n  title: v.string(),\r\n  body: v.string().nullish(),\r\n  payload: v.record(v.any()).nullish(),\r\n  read_at: v.date().nullish(),\r\n  idempotency_key: v.string().nullish(),\r\n});\r\n\r\n/**\r\n * In-app notification model.\r\n *\r\n * Extends the package's DatabaseNotification base, which provides the stable\r\n * accessors (recipientId, tenantId, isRead, readAt, markRead) — all derived\r\n * from the columnMap below. The read/write API lives on the inApp facade\r\n * (configured in config/notifications.ts); you rarely touch this class directly.\r\n */\r\n@RegisterModel()\r\nexport class Notification extends DatabaseNotification {\r\n  public static table = \"notifications\";\r\n  public static schema = notificationSchema;\r\n\r\n  /**\r\n   * Maps the in-app store's roles to your columns. This default is\r\n   * single-tenant + read_at-only. Add tenant: \"organization_id\" for\r\n   * multi-tenant; use isRead: \"is_read\" (instead of, or alongside, readAt) to\r\n   * track a boolean read flag. The migration + accessors all follow this map.\r\n   */\r\n  public static columnMap: NotificationColumnMap = { readAt: \"read_at\" };\r\n}\r\n`;\r\n\r\nexport const notificationMigrationStub = `import { Migration } from \"@warlock.js/cascade\";\r\nimport { notificationColumns } from \"@warlock.js/notifications\";\r\nimport { Notification } from \"../notification.model\";\r\n\r\n/**\r\n * Notifications table.\r\n *\r\n * Columns come from notificationColumns(Notification) — the recipient / tenant\r\n * / read-state names follow the model's columnMap; type / title / body /\r\n * payload / idempotency_key are fixed. Spread it to add your own columns\r\n * (remember to mirror them in the model schema):\r\n *\r\n *   import { uuid } from \"@warlock.js/cascade\";\r\n *\r\n *   export default Migration.create(Notification, {\r\n *     ...notificationColumns(Notification),\r\n *     // category_id: uuid().index().nullable(),\r\n *   });\r\n */\r\nexport default Migration.create(Notification, notificationColumns(Notification));\r\n`;\r\n\r\nexport const notificationControllersStub = `import { type Request, type RequestHandler, type Response } from \"@warlock.js/core\";\r\nimport { inApp } from \"@warlock.js/notifications\";\r\n\r\n/**\r\n * The authenticated user's notification HTTP surface — thin wrappers over the\r\n * recipient-scoped \\`inApp\\` facade (a foreign id can never touch another user's\r\n * rows). Notifications are produced by domain events, never over HTTP, so there\r\n * is no create. Trim or split these as your app grows.\r\n */\r\n\r\n/** GET /notifications — list, most recent first (page / limit / type / unread via query). */\r\nexport const listNotificationsController: RequestHandler = async (\r\n  request: Request,\r\n  response: Response,\r\n) => {\r\n  const { data, pagination } = await inApp.list(request.user!, request.all());\r\n\r\n  return response.success({ notifications: data, pagination });\r\n};\r\n\r\nlistNotificationsController.description = \"List notifications\";\r\n\r\n/** GET /notifications/unread-count — drives the bell badge. */\r\nexport const unreadNotificationsCountController: RequestHandler = async (\r\n  request: Request,\r\n  response: Response,\r\n) => {\r\n  const count = await inApp.countUnread(request.user!);\r\n\r\n  return response.success({ count });\r\n};\r\n\r\nunreadNotificationsCountController.description = \"Unread notifications count\";\r\n\r\n/** PATCH /notifications/:id/read — mark one read, return the updated row. */\r\nexport const markNotificationReadController: RequestHandler = async (\r\n  request: Request,\r\n  response: Response,\r\n) => {\r\n  const id = request.input(\"id\");\r\n\r\n  await inApp.markAsRead(request.user!, id);\r\n  const notification = await inApp.find(request.user!, id);\r\n\r\n  return response.success({ notification });\r\n};\r\n\r\nmarkNotificationReadController.description = \"Mark notification read\";\r\n\r\n/** PATCH /notifications/read-all — mark every unread one read. */\r\nexport const markAllNotificationsReadController: RequestHandler = async (\r\n  request: Request,\r\n  response: Response,\r\n) => {\r\n  const count = await inApp.markAsRead(request.user!);\r\n\r\n  return response.success({ count });\r\n};\r\n\r\nmarkAllNotificationsReadController.description = \"Mark all notifications read\";\r\n\r\n/** DELETE /notifications — dismiss all for the user. */\r\nexport const clearNotificationsController: RequestHandler = async (\r\n  request: Request,\r\n  response: Response,\r\n) => {\r\n  await inApp.dismiss(request.user!);\r\n\r\n  return response.noContent();\r\n};\r\n\r\nclearNotificationsController.description = \"Clear notifications\";\r\n\r\n/** DELETE /notifications/:id — dismiss one. */\r\nexport const deleteNotificationController: RequestHandler = async (\r\n  request: Request,\r\n  response: Response,\r\n) => {\r\n  await inApp.dismiss(request.user!, request.input(\"id\"));\r\n\r\n  return response.noContent();\r\n};\r\n\r\ndeleteNotificationController.description = \"Delete notification\";\r\n`;\r\n\r\nexport const notificationRoutesStub = `import { authMiddleware } from \"@warlock.js/auth\";\r\nimport { router } from \"@warlock.js/core\";\r\nimport {\r\n  clearNotificationsController,\r\n  deleteNotificationController,\r\n  listNotificationsController,\r\n  markAllNotificationsReadController,\r\n  markNotificationReadController,\r\n  unreadNotificationsCountController,\r\n} from \"./controllers/notifications.controller\";\r\n\r\n/**\r\n * Notification routes — the authenticated user's read + dismiss surface.\r\n *\r\n * Notifications are produced by domain events (never created over HTTP), so\r\n * there is no POST. Every route is gated by \\`authMiddleware\\` and recipient-\r\n * scoped by \\`inApp\\` (a foreign id touches zero rows). Delete any endpoint you\r\n * don't need; if your app reads notifications over sockets/GraphQL instead,\r\n * delete this file + the controllers entirely.\r\n */\r\nrouter.group({ prefix: \"/notifications\", middleware: [authMiddleware([])] }, () => {\r\n  router.get(\"/\", listNotificationsController);\r\n  router.get(\"/unread-count\", unreadNotificationsCountController);\r\n  router.patch(\"/read-all\", markAllNotificationsReadController);\r\n  router.patch(\"/:id/read\", markNotificationReadController);\r\n  router.delete(\"/\", clearNotificationsController);\r\n  router.delete(\"/:id\", deleteNotificationController);\r\n});\r\n`;\r\n\r\n/**\r\n * `src/web/root.tsx` — the application root for the SSR page layer.\r\n *\r\n * Deliberately minimal. The framework ships a default root, so this exists to\r\n * give you a place to start rather than because anything requires it. The\r\n * reference app (`v5/app/src/web/root.tsx`) is where to look for the fuller\r\n * shape: middleware, an app-level loader, locales, an ErrorBoundary.\r\n */\r\nexport const webRootStub = `import { Head, Scripts } from \"@warlock.js/web\";\r\nimport type { AppProps } from \"@warlock.js/web\";\r\n\r\n/**\r\n * The application root.\r\n *\r\n * NOT async, and it receives no request/response: it renders on the server and\r\n * again in the browser during hydration, where neither exists.\r\n */\r\nexport default function App({ children }: AppProps) {\r\n  return (\r\n    <html lang=\"en\">\r\n      <head>\r\n        {/*\r\n          Placement only. The framework injects the page's \\`metadata\\`, the\r\n          stylesheet and preload tags for this route, and the canonical links\r\n          into <head> by default — <Head /> just says WHERE they land.\r\n\r\n          Do not add a <title> here: the page's \\`metadata\\` owns it, and a root\r\n          that emits one too produces two.\r\n        */}\n        <Head />\n        <link rel=\"icon\" href=\"data:,\" />\n      </head>\r\n      <body>\r\n        {/*\r\n          REQUIRED — this is the hydration mount point, not a styling wrapper.\r\n\r\n          The browser runtime looks up \\`#root\\` and hydrates that element only.\r\n          Remove this div, or rename the id, and the page still renders from the\r\n          server but never becomes interactive: the runtime throws in the console\r\n          and nothing on screen changes.\r\n\r\n          Wrap it in your own markup freely, and put anything that must live\r\n          outside the hydrated tree (a static footer, a portal target) outside\r\n          it — just keep an element with \\`id=\"root\"\\` around {children}.\r\n        */}\r\n        <div id=\"root\">{children}</div>\r\n        {/*\r\n          The hydration payload and module tags. Written explicitly because\r\n          placement occasionally matters — a CSP nonce, or ordering against\r\n          your own scripts.\r\n        */}\r\n        <Scripts />\r\n      </body>\r\n    </html>\r\n  );\r\n}\r\n`;\r\n\r\n/**\r\n * `src/app/contact/controllers/contact.controller.ts` — a real API endpoint\r\n * for the Web starter's contact form. It intentionally has no persistence\r\n * dependency: replace the acknowledgement with a mail/job/database action.\r\n */\r\nexport const webContactControllerStub = `import { type Request, type RequestHandler } from \"@warlock.js/core\";\r\nimport { type Infer, v } from \"@warlock.js/seal\";\r\n\r\nexport const contactSchema = v.object({\r\n  name: v.string().min(2).required(),\r\n  email: v.email().required(),\r\n  message: v.string().min(10).required(),\r\n});\r\n\r\nexport type ContactSchema = Infer.Output<typeof contactSchema>;\r\n\r\n/** POST /api/contact — validates the starter contact form. */\r\nexport const contactController: RequestHandler<Request<ContactSchema>> = async ({ request, response }) => {\r\n  const contact = request.validated();\r\n\r\n  // Replace this with delivery/persistence for your app. Keeping the accepted\r\n  // payload visible makes the endpoint useful while remaining side-effect free.\r\n  return response.success({\r\n    message: \"Thanks, \" + contact.name + \". Your message has been received.\",\r\n  });\r\n};\r\n\r\ncontactController.validation = { schema: contactSchema };\r\n`;\r\n\r\n/** `src/app/contact/routes.ts` — discovered by the standard app route loader. */\r\nexport const webContactRoutesStub = `import { router } from \"@warlock.js/core\";\r\nimport { contactController } from \"./controllers/contact.controller\";\r\n\r\nrouter.post(\"/api/contact\", contactController);\r\n`;\r\n\n/**\n * `src/web/index.register.ts` — universal static setup for the starter page.\n *\n * The page re-exports this stable binding so Warlock's `register()` lifecycle\n * still sees it in both realms without making React Fast Refresh treat every\n * JSX edit as an incompatible function-export replacement.\n */\nexport const webHomeRegisterStub = `import { extend } from \"@mongez/localization\";\n\nexport function register() {\n  extend(\"en\", {\n    starter: {\n      title: \"Your Warlock app is running.\",\n      introduction: \"This page is rendered on the server and hydrated in the browser.\",\n      language: \"العربية\",\n      contact: \"Send a message\",\n      name: \"Name\",\n      email: \"Email\",\n      message: \"Message\",\n      submit: \"Send message\",\n      sent: \"Thanks — your message has been received.\",\n    },\n  });\n  extend(\"ar\", {\n    starter: {\n      title: \"تطبيق Warlock يعمل الآن.\",\n      introduction: \"تُعرض هذه الصفحة على الخادم ثم تُفعَّل في المتصفح.\",\n      language: \"English\",\n      contact: \"أرسل رسالة\",\n      name: \"الاسم\",\n      email: \"البريد الإلكتروني\",\n      message: \"الرسالة\",\n      submit: \"إرسال الرسالة\",\n      sent: \"شكرًا — تم استلام رسالتك.\",\n    },\n  });\n}\n`;\n\n/**\n * `src/web/index.page.tsx` — one page, so \\`warlock dev\\` has something to serve\n * the moment this finishes.\n */\nexport const webHomePageStub = `import { http } from \"@mongez/http\";\nimport { Form, useFormControl, type FormControlProps } from \"@mongez/react-form\";\nimport { setCurrentLocaleCode } from \"@mongez/localization\";\nimport { transX } from \"@mongez/react-localization\";\nimport { v } from \"@warlock.js/seal\";\nimport { useState } from \"react\";\nimport { Link, type PageProps } from \"@warlock.js/web\";\n\nexport { register } from \"./index.register\";\n\n/**\n * A page route is an ordinary Warlock route whose handler renders React\n * instead of returning JSON.\n *\n * The URL and stable hydration name are the ones this file DECLARES below.\n * This page answers \\`GET \"/\"\\` because \\`route.path = \"/\"\\`, not because of\n * where the file lives. A page file with\n * no \\`route\\` export is REFUSED by both the dev server and the build.\n */\nexport const route = { path: \"/\", name: \"index\" } as const;\n\nexport const metadata = { title: \"Home\" };\n\nconst contactSchema = v.object({\n  name: v.string().min(2).required(),\n  email: v.email().required(),\n  message: v.string().min(10).required(),\n});\n\nfunction TextInput({ label, ...controlProps }: FormControlProps & { label: string }) {\n  const { error, getErrorProps, getInputProps } = useFormControl(controlProps);\r\n\r\n  return (\r\n    <div className=\"wk-field\">\r\n      <label htmlFor={controlProps.name}>{label}</label>\r\n      <input {...getInputProps()} />\r\n      {error && <p {...getErrorProps()}>{error}</p>}\r\n    </div>\r\n  );\r\n}\r\n\r\n/**\r\n * Add a \\`loader\\` export to fetch data on the server, and it arrives here as\r\n * \\`data\\`, typed:\r\n *\r\n *   export const loader = (async () => ({ items: await itemsRepository.all() }));\r\n *   export default function HomePage({ data }: PageProps<typeof loader>) { ... }\r\n */\r\nexport default function HomePage(_props: PageProps) {\r\n  // Live state. If the button below does nothing, the page rendered on the\r\n  // server but never hydrated — the runtime never mounted at \\`#root\\`. This is\r\n  // deliberately here so that failure is impossible to miss.\r\n  const [count, setCount] = useState(0);\r\n  const [locale, setLocale] = useState<\"en\" | \"ar\">(\"en\");\r\n  const [submitted, setSubmitted] = useState(false);\r\n  const [submitError, setSubmitError] = useState<string | null>(null);\r\n\r\n  const toggleLocale = () => {\r\n    const nextLocale = locale === \"en\" ? \"ar\" : \"en\";\r\n    setCurrentLocaleCode(nextLocale);\r\n    setLocale(nextLocale);\r\n  };\r\n\r\n  return (\r\n    <>\r\n      {/*\r\n        Self-contained, dependency-free styling: plain CSS, system fonts, and\r\n        CSS custom properties, scoped to this page. No CSS framework, no utility\r\n        classes, no external stylesheet — this page looks the same whether or\r\n        not \\`warlock add tailwind\\` has ever been run.\r\n      */}\r\n      <style>{\\`\r\n        .wk-home {\r\n          --wk-fg: #0f172a;\r\n          --wk-muted: #64748b;\r\n          --wk-accent: #4f46e5;\r\n          --wk-border: #e2e8f0;\r\n          font-family: system-ui, -apple-system, \"Segoe UI\", Roboto, sans-serif;\r\n          color: var(--wk-fg);\r\n          max-width: 42rem;\r\n          margin: 4rem auto;\r\n          padding: 0 1.5rem;\r\n          line-height: 1.6;\r\n        }\r\n        .wk-home h1 { font-size: 2.25rem; margin: 0 0 0.5rem; }\r\n        .wk-home p { color: var(--wk-muted); margin: 0 0 1.5rem; }\r\n        .wk-home code {\r\n          font-family: ui-monospace, \"SFMono-Regular\", Menlo, monospace;\r\n          background: #f1f5f9;\r\n          padding: 0.1rem 0.35rem;\r\n          border-radius: 0.25rem;\r\n        }\r\n        .wk-check {\r\n          border: 1px solid var(--wk-border);\r\n          border-radius: 0.75rem;\r\n          padding: 1.25rem 1.5rem;\r\n          margin: 2rem 0;\r\n        }\r\n        .wk-check strong { display: block; font-size: 1.5rem; }\r\n        .wk-check button {\r\n          font: inherit;\r\n          cursor: pointer;\r\n          background: var(--wk-accent);\r\n          color: #fff;\r\n          border: 0;\r\n          border-radius: 0.5rem;\r\n          padding: 0.5rem 1rem;\r\n          margin-top: 0.75rem;\r\n        }\r\n        .wk-links { display: flex; gap: 1.25rem; font-size: 0.95rem; }\r\n        .wk-links a { color: var(--wk-accent); text-decoration: none; }\r\n        .wk-links a:hover { text-decoration: underline; }\r\n        .wk-language { margin-left: auto; }\r\n        .wk-contact { margin-top: 2rem; }\r\n        .wk-field { display: grid; gap: 0.35rem; margin: 0.8rem 0; }\r\n        .wk-field input, .wk-field textarea { font: inherit; padding: 0.55rem; }\r\n        .wk-field p, .wk-submit-error { color: #b91c1c; margin: 0; }\r\n        .wk-success { color: #047857; }\r\n      \\`}</style>\r\n\r\n      <main className=\"wk-home\" dir={locale === \"ar\" ? \"rtl\" : \"ltr\"}>\r\n        <nav className=\"wk-links\" aria-label=\"Starter links\">\r\n          <a href=\"https://warlock.js.org\" target=\"_blank\" rel=\"noreferrer\">Docs</a>\r\n          <Link href=\"/\" aria-current=\"page\">Home</Link>\r\n          <button\r\n            className=\"wk-language\"\r\n            type=\"button\"\r\n            aria-pressed={locale === \"ar\"}\r\n            onClick={toggleLocale}\r\n          >\r\n            {transX(\"starter.language\")}\r\n          </button>\r\n        </nav>\r\n\r\n        <h1>{transX(\"starter.title\")}</h1>\r\n        <p>{transX(\"starter.introduction\")}</p>\r\n\r\n        <section className=\"wk-check\">\r\n          <label>If this number goes up when you click, React is hydrated:</label>\r\n          <strong>{count}</strong>\r\n          <button type=\"button\" onClick={() => setCount(c => c + 1)}>\r\n            Count up\r\n          </button>\r\n        </section>\r\n\r\n        <section className=\"wk-contact\" aria-labelledby=\"contact-heading\">\r\n          <h2 id=\"contact-heading\">{transX(\"starter.contact\")}</h2>\r\n          <Form<typeof contactSchema>\n            id=\"contact-form\"\n            schema={contactSchema}\n            onSubmit={async ({ form, values }) => {\r\n              setSubmitted(false);\r\n              setSubmitError(null);\r\n              const result = await http.post<{ message: string }>(\"/api/contact\", values);\r\n\r\n              if (result.error) {\r\n                if (result.error.isValidationError) {\r\n                  const body = result.error.body as {\r\n                    errors?: Array<{ input: string; error: string }>;\r\n                    message?: string;\r\n                  };\r\n                  form.setErrors(\r\n                    Object.fromEntries(\r\n                      (body.errors ?? []).map(({ input, error }) => [input, error]),\r\n                    ),\r\n                  );\r\n                  setSubmitError(body.message ?? \"Please correct the highlighted fields.\");\r\n                } else {\r\n                  setSubmitError(\"Your message could not be sent. Please try again.\");\r\n                }\r\n                return;\r\n              }\r\n\r\n              setSubmitted(true);\r\n              form.reset();\r\n            }}\r\n          >\r\n            <TextInput name=\"name\" label={transX(\"starter.name\")} autoComplete=\"name\" />\r\n            <TextInput name=\"email\" label={transX(\"starter.email\")} type=\"email\" autoComplete=\"email\" />\r\n            <ContactMessage />\r\n            <button type=\"submit\">{transX(\"starter.submit\")}</button>\r\n            {submitError && <p className=\"wk-submit-error\" role=\"alert\">{submitError}</p>}\r\n            {submitted && <p className=\"wk-success\" role=\"status\">{transX(\"starter.sent\")}</p>}\r\n          </Form>\r\n        </section>\r\n      </main>\r\n    </>\r\n  );\r\n}\r\n\r\nfunction ContactMessage() {\r\n  const { error, getErrorProps, getInputProps } = useFormControl({ name: \"message\" });\r\n\r\n  return (\r\n    <div className=\"wk-field\">\r\n      <label htmlFor=\"message\">{transX(\"starter.message\")}</label>\r\n      <textarea {...getInputProps()} rows={5} />\r\n      {error && <p {...getErrorProps()}>{error}</p>}\r\n    </div>\r\n  );\r\n}\r\n`;\r\n"],"mappings":";AAAA,MAAa,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BhC,MAAa,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+B5B,MAAa,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCnC,MAAa,2BAA2B;;AAGxC,MAAa,0BAA0B;;;;;;;;;;;;AAavC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8FvC,MAAa,+BAA+B;;AAG5C,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;AAsB3C,MAAa,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6ClC,MAAa,mBAAmB;;;;;;;;;;;;;;;;;AAkBhC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFvC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCvC,MAAa,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CrC,MAAa,4BAA4B;;;;;;;;;;;;;;;;;;;;;AAsBzC,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsF3C,MAAa,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCtC,MAAa,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuD3B,MAAa,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;AA0BxC,MAAa,uBAAuB;;;;;;;;;;;;AAapC,MAAa,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCnC,MAAa,kBAAkB"}

package/esm/http/boot-port-preflight.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"boot-port-preflight.d.mts","names":[],"sources":["../../../../../../../core/src/http/boot-port-preflight.ts"],"mappings":";;AAuBA;;;;AAA+D;AA0C/D;;;;AAA4D;;;;iBA1CtC,8BAAA,CAAA,GAAkC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0CzC,2BAAA,CAAA,GAA+B,OAAO"}
+{"version":3,"file":"boot-port-preflight.d.mts","names":[],"sources":["../../../../../../../core/src/http/boot-port-preflight.ts"],"mappings":";;AAuBA;;;;AAA+D;AA0C/D;;;;AAA4D;;;;iBA1CtC,8BAAA,IAAkC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0CzC,2BAAA,IAA+B,OAAO"}

package/esm/http/context/request-context.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../../../../../../../core/src/http/context/request-context.ts"],"mappings":";;;;;;;;;AASA;KAAY,mBAAA,cAAiC,KAAA,GAAQ,KAAA;EACnD,OAAA,EAAS,OAAA,CAAQ,IAAA;EACjB,QAAA,EAAU,QAAA;AAAA;;;;;;;cASN,cAAA,cAA4B,KAAA,GAAQ,KAAA,UAAe,OAAA,CAAQ,mBAAA,CAAoB,IAAA;EAXhC;;;EAe5C,UAAA,CAAA,GAAc,OAAA,CAAQ,IAAA;EAb7B;;;EAoBO,WAAA,CAAA,GAAe,QAAA;EAXlB;;;;;;;;;;;;;EA4BG,OAAA,CAAA,GAAW,WAAA;EA5BqC;;;EAmChD,UAAA,CAAW,OAAA,GAAU,MAAA,gBAAsB,mBAAA,CAAoB,IAAA;AAAA;;;;cAW3D,cAAA,EAAc,cAAA,CAAA,KAAA,+BAAA,WAAA;;;;iBAOX,eAAA,kBAAiC,KAAA,GAAQ,KAAA,CAAA,CAAA,GACX,mBAAA,CAAoB,QAAA;AAAA,iBAGlD,UAAA,kBAA4B,KAAA,GAAQ,KAAA,CAAA,CAAA,GACZ,OAAA,CAAQ,QAAA;AAAA,iBAGhC,cAAA,kBAAgC,KAAA,GAAQ,KAAA,CAAA,CAAA,GAOR,QAAA"}
+{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../../../../../../../core/src/http/context/request-context.ts"],"mappings":";;;;;;;;;AASA;KAAY,mBAAA,cAAiC,KAAA,GAAQ,KAAA;EACnD,OAAA,EAAS,OAAA,CAAQ,IAAA;EACjB,QAAA,EAAU,QAAA;AAAA;;;;;;;cASN,cAAA,cAA4B,KAAA,GAAQ,KAAA,UAAe,OAAA,CAAQ,mBAAA,CAAoB,IAAA;EAXhC;;;EAe5C,UAAA,IAAc,OAAA,CAAQ,IAAA;EAb7B;;;EAoBO,WAAA,IAAe,QAAA;EAXlB;;;;;;;;;;;;;EA4BG,OAAA,IAAW,WAAA;EA5BqC;;;EAmChD,UAAA,CAAW,OAAA,GAAU,MAAA,gBAAsB,mBAAA,CAAoB,IAAA;AAAA;;;;cAW3D,cAAA,EAAc,cAAA,CAAA,KAAA,+BAAA,WAAA;;;;iBAOX,eAAA,kBAAiC,KAAA,GAAQ,KAAA,KACX,mBAAA,CAAoB,QAAA;AAAA,iBAGlD,UAAA,kBAA4B,KAAA,GAAQ,KAAA,KACZ,OAAA,CAAQ,QAAA;AAAA,iBAGhC,cAAA,kBAAgC,KAAA,GAAQ,KAAA,KAOR,QAAA"}

package/esm/http/context/request-context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.mjs","names":[],"sources":["../../../../../../../../core/src/http/context/request-context.ts"],"sourcesContent":["import type { Model } from \"@warlock.js/cascade\";\nimport { Context, contextManager } from \"@warlock.js/context\";\nimport type { Request } from \"../request\";\nimport type { Response } from \"../response\";\nimport type { RequestUser } from \"../types\";\n\n/**\n * Request Context Store\n */\nexport type RequestContextStore<User extends Model = Model> = {\n  request: Request<User>;\n  response: Response;\n};\n\n/**\n * Request Context\n *\n * Manages request-scoped data (request, response, user) using AsyncLocalStorage.\n * Extends the base Context class for consistent API.\n */\nclass RequestContext<User extends Model = Model> extends Context<RequestContextStore<User>> {\n  /**\n   * Get the current request\n   */\n  public getRequest(): Request<User> | undefined {\n    return this.get(\"request\");\n  }\n\n  /**\n   * Get the current response\n   */\n  public getResponse(): Response | undefined {\n    return this.get(\"response\");\n  }\n\n  /**\n   * Get the current user.\n   *\n   * Reads `request.user`, typed via the `RequestUser` module-augmentation\n   * surface (`core/src/http/types.ts`) — NOT the `User` generic above. That\n   * generic actually binds `Request<User>`'s `RequestValidation` parameter\n   * (see `RequestContextStore`), not \"the user type\"; there is no `Request`\n   * generic for the user today, so returning it as `User` was never sound\n   * (eed20184 step (b) inventory, `implementation/2026-08-20-A2-request-locals.md`\n   * §6.1). Callers that need a concrete model type — e.g.\n   * `useCurrentUser<MyUserModel>()` — cast at the call site; the app owns\n   * that shape via its own `RequestUser` augmentation.\n   */\n  public getUser(): RequestUser | undefined {\n    return this.getRequest()?.user;\n  }\n\n  /**\n   * Build the initial request store from HTTP context\n   */\n  public buildStore(payload?: Record<string, any>): RequestContextStore<User> {\n    return {\n      request: payload?.request,\n      response: payload?.response,\n    };\n  }\n}\n\n/**\n * Global request context instance\n */\nexport const requestContext = new RequestContext();\n\ncontextManager.register(\"request\", requestContext);\n\n/**\n * Use request store (for backward compatibility)\n */\nexport function useRequestStore<UserType extends Model = Model>() {\n  return (requestContext.getStore() || {}) as RequestContextStore<UserType>;\n}\n\nexport function useRequest<UserType extends Model = Model>() {\n  return requestContext.getRequest() as Request<UserType>;\n}\n\nexport function useCurrentUser<UserType extends Model = Model>() {\n  // `getUser()` returns the declared `RequestUser` surface (empty by\n  // default), which is structurally unrelated to `Model` — this is the app\n  // boundary where the caller's own `RequestUser` augmentation is expected\n  // to actually be its `UserType` model instance. `unknown` is the\n  // documented double-assertion for \"these ARE the same value, TS just\n  // can't see the two augmented shapes are related\" — not `any`.\n  return requestContext.getUser() as unknown as UserType;\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAM,iBAAN,cAAyD,QAAmC;;;;CAI1F,AAAO,aAAwC;EAC7C,OAAO,KAAK,IAAI,SAAS;CAC3B;;;;CAKA,AAAO,cAAoC;EACzC,OAAO,KAAK,IAAI,UAAU;CAC5B;;;;;;;;;;;;;;CAeA,AAAO,UAAmC;EACxC,OAAO,KAAK,WAAW,GAAG;CAC5B;;;;CAKA,AAAO,WAAW,SAA0D;EAC1E,OAAO;GACL,SAAS,SAAS;GAClB,UAAU,SAAS;EACrB;CACF;AACF;;;;AAKA,MAAa,iBAAiB,IAAI,eAAe;AAEjD,eAAe,SAAS,WAAW,cAAc;;;;AAKjD,SAAgB,kBAAkD;CAChE,OAAQ,eAAe,SAAS,KAAK,CAAC;AACxC;AAEA,SAAgB,aAA6C;CAC3D,OAAO,eAAe,WAAW;AACnC;AAEA,SAAgB,iBAAiD;CAO/D,OAAO,eAAe,QAAQ;AAChC"}
+{"version":3,"file":"request-context.mjs","names":[],"sources":["../../../../../../../../core/src/http/context/request-context.ts"],"sourcesContent":["import type { Model } from \"@warlock.js/cascade\";\nimport { Context, contextManager } from \"@warlock.js/context\";\nimport type { Request } from \"../request\";\nimport type { Response } from \"../response\";\nimport type { RequestUser } from \"../types\";\n\n/**\n * Request Context Store\n */\nexport type RequestContextStore<User extends Model = Model> = {\n  request: Request<User>;\n  response: Response;\n};\n\n/**\n * Request Context\n *\n * Manages request-scoped data (request, response, user) using AsyncLocalStorage.\n * Extends the base Context class for consistent API.\n */\nclass RequestContext<User extends Model = Model> extends Context<RequestContextStore<User>> {\n  /**\n   * Get the current request\n   */\n  public getRequest(): Request<User> | undefined {\n    return this.get(\"request\");\n  }\n\n  /**\n   * Get the current response\n   */\n  public getResponse(): Response | undefined {\n    return this.get(\"response\");\n  }\n\n  /**\n   * Get the current user.\n   *\n   * Reads `request.user`, typed via the `RequestUser` module-augmentation\n   * surface (`core/src/http/types.ts`) — NOT the `User` generic above. That\n   * generic actually binds `Request<User>`'s `RequestValidation` parameter\n   * (see `RequestContextStore`), not \"the user type\"; there is no `Request`\n   * generic for the user today, so returning it as `User` was never sound\n   * (eed20184 step (b) inventory, `implementation/2026-08-20-A2-request-locals.md`\n   * §6.1). Callers that need a concrete model type — e.g.\n   * `useCurrentUser<MyUserModel>()` — cast at the call site; the app owns\n   * that shape via its own `RequestUser` augmentation.\n   */\n  public getUser(): RequestUser | undefined {\n    return this.getRequest()?.user;\n  }\n\n  /**\n   * Build the initial request store from HTTP context\n   */\n  public buildStore(payload?: Record<string, any>): RequestContextStore<User> {\n    return {\n      request: payload?.request,\n      response: payload?.response,\n    };\n  }\n}\n\n/**\n * Global request context instance\n */\nexport const requestContext = new RequestContext();\n\ncontextManager.register(\"request\", requestContext);\n\n/**\n * Use request store (for backward compatibility)\n */\nexport function useRequestStore<UserType extends Model = Model>() {\n  return (requestContext.getStore() || {}) as RequestContextStore<UserType>;\n}\n\nexport function useRequest<UserType extends Model = Model>() {\n  return requestContext.getRequest() as Request<UserType>;\n}\n\nexport function useCurrentUser<UserType extends Model = Model>() {\n  // `getUser()` returns the declared `RequestUser` surface (empty by\n  // default), which is structurally unrelated to `Model` — this is the app\n  // boundary where the caller's own `RequestUser` augmentation is expected\n  // to actually be its `UserType` model instance. `unknown` is the\n  // documented double-assertion for \"these ARE the same value, TS just\n  // can't see the two augmented shapes are related\" — not `any`.\n  return requestContext.getUser() as unknown as UserType;\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAM,iBAAN,cAAyD,QAAmC;;;;CAI1F,AAAO,aAAwC;EAC7C,OAAO,KAAK,IAAI,SAAS;CAC3B;;;;CAKA,AAAO,cAAoC;EACzC,OAAO,KAAK,IAAI,UAAU;CAC5B;;;;;;;;;;;;;;CAeA,AAAO,UAAmC;EACxC,OAAO,KAAK,WAAW,CAAC,EAAE;CAC5B;;;;CAKA,AAAO,WAAW,SAA0D;EAC1E,OAAO;GACL,SAAS,SAAS;GAClB,UAAU,SAAS;EACrB;CACF;AACF;;;;AAKA,MAAa,iBAAiB,IAAI,eAAe;AAEjD,eAAe,SAAS,WAAW,cAAc;;;;AAKjD,SAAgB,kBAAkD;CAChE,OAAQ,eAAe,SAAS,KAAK,CAAC;AACxC;AAEA,SAAgB,aAA6C;CAC3D,OAAO,eAAe,WAAW;AACnC;AAEA,SAAgB,iBAAiD;CAO/D,OAAO,eAAe,QAAQ;AAChC"}

package/esm/http/context/request-memo.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-memo.d.mts","names":[],"sources":["../../../../../../../../core/src/http/context/request-memo.ts"],"mappings":";;AA2BA;;;;;;;;;;;;;;;iBAAgB,WAAA,GAAA,CAAe,GAAA,UAAa,EAAA,QAAU,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA"}
+{"version":3,"file":"request-memo.d.mts","names":[],"sources":["../../../../../../../../core/src/http/context/request-memo.ts"],"mappings":";;AA2BA;;;;;;;;;;;;;;;iBAAgB,WAAA,IAAe,GAAA,UAAa,EAAA,QAAU,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA"}

package/esm/http/context/request-memo.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request-memo.mjs","names":[],"sources":["../../../../../../../../core/src/http/context/request-memo.ts"],"sourcesContent":["import { requestContext, type RequestContextStore } from \"./request-context\";\n\n/**\n * In-flight/settled promises for the current request, keyed by the caller's\n * key. Never a process-global map: the outer key is the request's own store\n * object (fresh per request, see `RequestContext.buildStore`), so two\n * concurrent requests can never share — or even see — each other's entries,\n * and everything is GC-eligible once the request's ALS frame ends.\n */\nconst requestMemoStores = new WeakMap<RequestContextStore, Map<string, Promise<any>>>();\n\n/**\n * Single-flight, request-scoped memoization.\n *\n * The first call for a given `key` within the current request runs `fn` once\n * and caches the resulting promise; any call for the same `key` issued while\n * that promise is still pending — or after it has resolved — gets that exact\n * promise back, so parallel loaders that all need the same value never issue\n * duplicate work. A rejection is evicted immediately, so the next call for\n * that `key` retries `fn` from scratch instead of caching the failure.\n *\n * Must run inside a request context (established by\n * `createRequestStore`/`contextManager.runAll` for every HTTP request). There\n * is deliberately no process-global fallback — that is the exact cross-request\n * leak this helper exists to prevent — so calling it outside a request\n * context throws instead of silently memoizing across requests.\n */\nexport function requestMemo<T>(key: string, fn: () => Promise<T>): Promise<T> {\n  const store = requestContext.getStore();\n\n  if (!store) {\n    throw new Error(\n      \"requestMemo() was called outside a request context. \" +\n        \"It caches work for the lifetime of a single request and must run inside \" +\n        \"code executed by the HTTP request pipeline (middleware, a loader, or a \" +\n        \"controller) — call it from there. If you need to share a value across \" +\n        \"requests, use a process-level cache instead; requestMemo will not fall \" +\n        \"back to one.\",\n    );\n  }\n\n  let entries = requestMemoStores.get(store);\n\n  if (!entries) {\n    entries = new Map();\n    requestMemoStores.set(store, entries);\n  }\n\n  const cached = entries.get(key);\n\n  if (cached) return cached;\n\n  const promise = (async () => fn())().catch(error => {\n    entries!.delete(key);\n    throw error;\n  });\n\n  entries.set(key, promise);\n\n  return promise;\n}\n"],"mappings":";;;;;;;;;;AASA,MAAM,oCAAoB,IAAI,QAAwD;;;;;;;;;;;;;;;;;AAkBtF,SAAgB,YAAe,KAAa,IAAkC;CAC5E,MAAM,QAAQ,eAAe,SAAS;CAEtC,IAAI,CAAC,OACH,MAAM,IAAI,MACR,8VAMF;CAGF,IAAI,UAAU,kBAAkB,IAAI,KAAK;CAEzC,IAAI,CAAC,SAAS;EACZ,0BAAU,IAAI,IAAI;EAClB,kBAAkB,IAAI,OAAO,OAAO;CACtC;CAEA,MAAM,SAAS,QAAQ,IAAI,GAAG;CAE9B,IAAI,QAAQ,OAAO;CAEnB,MAAM,WAAW,YAAY,GAAG,GAAG,EAAE,OAAM,UAAS;EAClD,QAAS,OAAO,GAAG;EACnB,MAAM;CACR,CAAC;CAED,QAAQ,IAAI,KAAK,OAAO;CAExB,OAAO;AACT"}
+{"version":3,"file":"request-memo.mjs","names":[],"sources":["../../../../../../../../core/src/http/context/request-memo.ts"],"sourcesContent":["import { requestContext, type RequestContextStore } from \"./request-context\";\n\n/**\n * In-flight/settled promises for the current request, keyed by the caller's\n * key. Never a process-global map: the outer key is the request's own store\n * object (fresh per request, see `RequestContext.buildStore`), so two\n * concurrent requests can never share — or even see — each other's entries,\n * and everything is GC-eligible once the request's ALS frame ends.\n */\nconst requestMemoStores = new WeakMap<RequestContextStore, Map<string, Promise<any>>>();\n\n/**\n * Single-flight, request-scoped memoization.\n *\n * The first call for a given `key` within the current request runs `fn` once\n * and caches the resulting promise; any call for the same `key` issued while\n * that promise is still pending — or after it has resolved — gets that exact\n * promise back, so parallel loaders that all need the same value never issue\n * duplicate work. A rejection is evicted immediately, so the next call for\n * that `key` retries `fn` from scratch instead of caching the failure.\n *\n * Must run inside a request context (established by\n * `createRequestStore`/`contextManager.runAll` for every HTTP request). There\n * is deliberately no process-global fallback — that is the exact cross-request\n * leak this helper exists to prevent — so calling it outside a request\n * context throws instead of silently memoizing across requests.\n */\nexport function requestMemo<T>(key: string, fn: () => Promise<T>): Promise<T> {\n  const store = requestContext.getStore();\n\n  if (!store) {\n    throw new Error(\n      \"requestMemo() was called outside a request context. \" +\n        \"It caches work for the lifetime of a single request and must run inside \" +\n        \"code executed by the HTTP request pipeline (middleware, a loader, or a \" +\n        \"controller) — call it from there. If you need to share a value across \" +\n        \"requests, use a process-level cache instead; requestMemo will not fall \" +\n        \"back to one.\",\n    );\n  }\n\n  let entries = requestMemoStores.get(store);\n\n  if (!entries) {\n    entries = new Map();\n    requestMemoStores.set(store, entries);\n  }\n\n  const cached = entries.get(key);\n\n  if (cached) return cached;\n\n  const promise = (async () => fn())().catch(error => {\n    entries!.delete(key);\n    throw error;\n  });\n\n  entries.set(key, promise);\n\n  return promise;\n}\n"],"mappings":";;;;;;;;;;AASA,MAAM,oCAAoB,IAAI,QAAwD;;;;;;;;;;;;;;;;;AAkBtF,SAAgB,YAAe,KAAa,IAAkC;CAC5E,MAAM,QAAQ,eAAe,SAAS;CAEtC,IAAI,CAAC,OACH,MAAM,IAAI,MACR,8VAMF;CAGF,IAAI,UAAU,kBAAkB,IAAI,KAAK;CAEzC,IAAI,CAAC,SAAS;EACZ,0BAAU,IAAI,IAAI;EAClB,kBAAkB,IAAI,OAAO,OAAO;CACtC;CAEA,MAAM,SAAS,QAAQ,IAAI,GAAG;CAE9B,IAAI,QAAQ,OAAO;CAEnB,MAAM,WAAW,YAAY,GAAG,EAAC,CAAE,CAAC,CAAC,OAAM,UAAS;EAClD,QAAS,OAAO,GAAG;EACnB,MAAM;CACR,CAAC;CAED,QAAQ,IAAI,KAAK,OAAO;CAExB,OAAO;AACT"}

package/esm/http/createHttpApplication.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"createHttpApplication.d.mts","names":[],"sources":["../../../../../../../core/src/http/createHttpApplication.ts"],"mappings":";iBAQsB,qBAAA,CAAA,GAAqB,OAAA;AAAA,iBA8BrB,mBAAA,CAAA,GAAmB,OAAA"}
+{"version":3,"file":"createHttpApplication.d.mts","names":[],"sources":["../../../../../../../core/src/http/createHttpApplication.ts"],"mappings":";iBAQsB,qBAAA,IAAqB,OAAA;AAAA,iBA8BrB,mBAAA,IAAmB,OAAA"}

package/esm/http/createHttpApplication.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createHttpApplication.mjs","names":[],"sources":["../../../../../../../core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;AAQA,eAAsB,wBAAwB;CAC5C,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAU,OAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,GAAG,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}
+{"version":3,"file":"createHttpApplication.mjs","names":[],"sources":["../../../../../../../core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;AAQA,eAAsB,wBAAwB;CAC5C,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAU,OAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}

package/esm/http/health.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.mts","names":[],"sources":["../../../../../../../core/src/http/health.ts"],"mappings":";;AAMA;;;KAAY,WAAA,mBAA8B,OAAO;AAAA;AAMjD;;;AANiD,KAMrC,YAAA;EACV,MAAA;EACA,MAAA,GAAS,MAAM;AAAA;;AAAA;AACf;;;;;cASI,cAAA;EAAA,iBACa,MAAA;EA6BgB;;;EAxB1B,QAAA,CAAS,IAAA,UAAc,KAAA,EAAO,WAAA;EAArB;;;EAOT,WAAA,CAAY,IAAA;EAAA;;;;EAQZ,QAAA,CAAA,GAAY,YAAA;EASe;;;;;EAArB,SAAA,CAAA,GAAa,OAAA,CAAQ,YAAA;EA2CZ;AAYxB;;;;AAA0C;;;;;;;;EAtBjC,wBAAA,CAAyB,aAAA,gBAA6B,IAAA;;;;;;;UAU/C,QAAA;AAAA;;;;cAYH,MAAA,EAAM,cAAuB"}
+{"version":3,"file":"health.d.mts","names":[],"sources":["../../../../../../../core/src/http/health.ts"],"mappings":";;AAMA;;;KAAY,WAAA,mBAA8B,OAAO;AAAA;AAMjD;;;AANiD,KAMrC,YAAA;EACV,MAAA;EACA,MAAA,GAAS,MAAM;AAAA;;AAAA;AACf;;;;;cASI,cAAA;EAAA,iBACa,MAAA;EA6BgB;;;EAxB1B,QAAA,CAAS,IAAA,UAAc,KAAA,EAAO,WAAA;EAArB;;;EAOT,WAAA,CAAY,IAAA;EAAA;;;;EAQZ,QAAA,IAAY,YAAA;EASe;;;;;EAArB,SAAA,IAAa,OAAA,CAAQ,YAAA;EA2CZ;AAYxB;;;;AAA0C;;;;;;;;EAtBjC,wBAAA,CAAyB,aAAA,gBAA6B,IAAA;;;;;;;UAU/C,QAAA;AAAA;;;;cAYH,MAAA,EAAM,cAAuB"}

package/esm/http/middleware/cache-response-middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cache-response-middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/cache-response-middleware.ts"],"sourcesContent":["import { except } from \"@mongez/reinforcements\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router/types\";\nimport type { Request } from \"./../request\";\nimport type { Response } from \"./../response\";\n\n/**\n * Shape persisted to the cache for a cached response. Stores the status and\n * content-type alongside the body so the HIT path can replay the response\n * faithfully via {@link Response.replay} instead of re-entering `send()`.\n */\ntype CachedResponsePayload = {\n  status: number;\n  data: unknown;\n  contentType?: string;\n};\n\n// TODO: Add option to determine whether to cache the response or not\n// TODO: add option to determine what to be cached from the response\n// TODO: add cache middleware config options for example to set the default driver, ttl, etc\n\nexport type CacheMiddlewareOptions = {\n  /**\n   * Cache key\n   */\n  cacheKey:\n    | string\n    | ((request: Request) => string)\n    | ((request: Request) => Promise<string>);\n  /**\n   * If true, then the response will be cached based on the current locale code\n   * This is useful when you have a multi-language website, and you want to cache the response based on the current locale\n   *\n   * @default true\n   */\n  withLocale?: boolean;\n  /**\n   * List of keys from the response object to omit from the cached response\n   *\n   * @default ['user']\n   */\n  omit?: string[];\n  /**\n   * Expires after number of seconds\n   */\n  ttl?: number;\n  /**\n   * Cache driver\n   *\n   * @see config/cache.ts: drivers object\n   * @default cache manager\n   */\n  driver?: string;\n};\n\nconst defaultCacheOptions: Partial<CacheMiddlewareOptions> = {\n  withLocale: true,\n};\n\ntype ParsedCacheOptions = Required<CacheMiddlewareOptions> & {\n  cacheKey: string;\n};\n\nasync function parseCacheOptions(\n  cacheOptions: CacheMiddlewareOptions | string,\n  request: Request,\n) {\n  if (typeof cacheOptions === \"string\") {\n    cacheOptions = {\n      cacheKey: cacheOptions,\n    };\n  }\n\n  if (typeof cacheOptions.cacheKey === \"function\") {\n    cacheOptions.cacheKey = await cacheOptions.cacheKey(request);\n  }\n\n  const finalCacheOptions = {\n    ...defaultCacheOptions,\n    ...cacheOptions,\n  } as ParsedCacheOptions;\n\n  if (finalCacheOptions.withLocale) {\n    const locale = request.getLocaleCode();\n\n    finalCacheOptions.cacheKey = `${finalCacheOptions.cacheKey}:${locale}`;\n  }\n\n  if (!finalCacheOptions.omit) {\n    finalCacheOptions.omit = [\"user\", \"settings\"];\n  }\n\n  return finalCacheOptions;\n}\n\nexport function cacheMiddleware(\n  responseCacheOptions: CacheMiddlewareOptions | string,\n): Middleware {\n  // The `Middleware` return annotation is load-bearing: without it, tsc never\n  // checks this factory's calling convention, which is how the positional v4\n  // shape survived an earlier refactor unnoticed.\n  return async function ({ request, response }) {\n    const { ttl, omit, cacheKey, driver } = await parseCacheOptions(\n      responseCacheOptions,\n      request,\n    );\n    const cacheDriver = driver ? await cache.use(driver) : cache;\n\n    const content = (await cacheDriver.get(cacheKey)) as CachedResponsePayload | null;\n\n    if (content) {\n      // Replay through the standard pipeline (status + content-type preserved)\n      // instead of `baseResponse.send()`, which would re-enter Response.send()\n      // on an already-sent reply, trip the double-send guard, and drop the\n      // status / content-type.\n      return response.replay({\n        status: content.status ?? 200,\n        body: content.data,\n        contentType: content.contentType,\n      });\n    }\n\n    response.onSent((response: Response) => {\n      if (!response.isOk || response.request.path !== request.path) {\n        return;\n      }\n\n      const sentContentType = response.contentType;\n\n      const content: CachedResponsePayload = {\n        status: response.statusCode,\n        data: except(response.parsedBody, omit),\n        contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n      };\n\n      // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n      // write (e.g. Redis down) would surface as an unhandledRejection.\n      cacheDriver.set(cacheKey, content, ttl).catch((error: unknown) => {\n        log.error(\"cache-middleware\", \"set\", error);\n      });\n    });\n  };\n}\n"],"mappings":";;;;;AAwDA,MAAM,sBAAuD,EAC3D,YAAY,KACd;AAMA,eAAe,kBACb,cACA,SACA;CACA,IAAI,OAAO,iBAAiB,UAC1B,eAAe,EACb,UAAU,aACZ;CAGF,IAAI,OAAO,aAAa,aAAa,YACnC,aAAa,WAAW,MAAM,aAAa,SAAS,OAAO;CAG7D,MAAM,oBAAoB;EACxB,GAAG;EACH,GAAG;CACL;CAEA,IAAI,kBAAkB,YAAY;EAChC,MAAM,SAAS,QAAQ,cAAc;EAErC,kBAAkB,WAAW,GAAG,kBAAkB,SAAS,GAAG;CAChE;CAEA,IAAI,CAAC,kBAAkB,MACrB,kBAAkB,OAAO,CAAC,QAAQ,UAAU;CAG9C,OAAO;AACT;AAEA,SAAgB,gBACd,sBACY;CAIZ,OAAO,eAAgB,EAAE,SAAS,YAAY;EAC5C,MAAM,EAAE,KAAK,MAAM,UAAU,WAAW,MAAM,kBAC5C,sBACA,OACF;EACA,MAAM,cAAc,SAAS,MAAM,MAAM,IAAI,MAAM,IAAI;EAEvD,MAAM,UAAW,MAAM,YAAY,IAAI,QAAQ;EAE/C,IAAI,SAKF,OAAO,SAAS,OAAO;GACrB,QAAQ,QAAQ,UAAU;GAC1B,MAAM,QAAQ;GACd,aAAa,QAAQ;EACvB,CAAC;EAGH,SAAS,QAAQ,aAAuB;GACtC,IAAI,CAAC,SAAS,QAAQ,SAAS,QAAQ,SAAS,QAAQ,MACtD;GAGF,MAAM,kBAAkB,SAAS;GAEjC,MAAM,UAAiC;IACrC,QAAQ,SAAS;IACjB,MAAM,OAAO,SAAS,YAAY,IAAI;IACtC,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE;GAIA,YAAY,IAAI,UAAU,SAAS,GAAG,EAAE,OAAO,UAAmB;IAChE,IAAI,MAAM,oBAAoB,OAAO,KAAK;GAC5C,CAAC;EACH,CAAC;CACH;AACF"}
+{"version":3,"file":"cache-response-middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/cache-response-middleware.ts"],"sourcesContent":["import { except } from \"@mongez/reinforcements\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router/types\";\nimport type { Request } from \"./../request\";\nimport type { Response } from \"./../response\";\n\n/**\n * Shape persisted to the cache for a cached response. Stores the status and\n * content-type alongside the body so the HIT path can replay the response\n * faithfully via {@link Response.replay} instead of re-entering `send()`.\n */\ntype CachedResponsePayload = {\n  status: number;\n  data: unknown;\n  contentType?: string;\n};\n\n// TODO: Add option to determine whether to cache the response or not\n// TODO: add option to determine what to be cached from the response\n// TODO: add cache middleware config options for example to set the default driver, ttl, etc\n\nexport type CacheMiddlewareOptions = {\n  /**\n   * Cache key\n   */\n  cacheKey:\n    | string\n    | ((request: Request) => string)\n    | ((request: Request) => Promise<string>);\n  /**\n   * If true, then the response will be cached based on the current locale code\n   * This is useful when you have a multi-language website, and you want to cache the response based on the current locale\n   *\n   * @default true\n   */\n  withLocale?: boolean;\n  /**\n   * List of keys from the response object to omit from the cached response\n   *\n   * @default ['user']\n   */\n  omit?: string[];\n  /**\n   * Expires after number of seconds\n   */\n  ttl?: number;\n  /**\n   * Cache driver\n   *\n   * @see config/cache.ts: drivers object\n   * @default cache manager\n   */\n  driver?: string;\n};\n\nconst defaultCacheOptions: Partial<CacheMiddlewareOptions> = {\n  withLocale: true,\n};\n\ntype ParsedCacheOptions = Required<CacheMiddlewareOptions> & {\n  cacheKey: string;\n};\n\nasync function parseCacheOptions(\n  cacheOptions: CacheMiddlewareOptions | string,\n  request: Request,\n) {\n  if (typeof cacheOptions === \"string\") {\n    cacheOptions = {\n      cacheKey: cacheOptions,\n    };\n  }\n\n  if (typeof cacheOptions.cacheKey === \"function\") {\n    cacheOptions.cacheKey = await cacheOptions.cacheKey(request);\n  }\n\n  const finalCacheOptions = {\n    ...defaultCacheOptions,\n    ...cacheOptions,\n  } as ParsedCacheOptions;\n\n  if (finalCacheOptions.withLocale) {\n    const locale = request.getLocaleCode();\n\n    finalCacheOptions.cacheKey = `${finalCacheOptions.cacheKey}:${locale}`;\n  }\n\n  if (!finalCacheOptions.omit) {\n    finalCacheOptions.omit = [\"user\", \"settings\"];\n  }\n\n  return finalCacheOptions;\n}\n\nexport function cacheMiddleware(\n  responseCacheOptions: CacheMiddlewareOptions | string,\n): Middleware {\n  // The `Middleware` return annotation is load-bearing: without it, tsc never\n  // checks this factory's calling convention, which is how the positional v4\n  // shape survived an earlier refactor unnoticed.\n  return async function ({ request, response }) {\n    const { ttl, omit, cacheKey, driver } = await parseCacheOptions(\n      responseCacheOptions,\n      request,\n    );\n    const cacheDriver = driver ? await cache.use(driver) : cache;\n\n    const content = (await cacheDriver.get(cacheKey)) as CachedResponsePayload | null;\n\n    if (content) {\n      // Replay through the standard pipeline (status + content-type preserved)\n      // instead of `baseResponse.send()`, which would re-enter Response.send()\n      // on an already-sent reply, trip the double-send guard, and drop the\n      // status / content-type.\n      return response.replay({\n        status: content.status ?? 200,\n        body: content.data,\n        contentType: content.contentType,\n      });\n    }\n\n    response.onSent((response: Response) => {\n      if (!response.isOk || response.request.path !== request.path) {\n        return;\n      }\n\n      const sentContentType = response.contentType;\n\n      const content: CachedResponsePayload = {\n        status: response.statusCode,\n        data: except(response.parsedBody, omit),\n        contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n      };\n\n      // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n      // write (e.g. Redis down) would surface as an unhandledRejection.\n      cacheDriver.set(cacheKey, content, ttl).catch((error: unknown) => {\n        log.error(\"cache-middleware\", \"set\", error);\n      });\n    });\n  };\n}\n"],"mappings":";;;;;AAwDA,MAAM,sBAAuD,EAC3D,YAAY,KACd;AAMA,eAAe,kBACb,cACA,SACA;CACA,IAAI,OAAO,iBAAiB,UAC1B,eAAe,EACb,UAAU,aACZ;CAGF,IAAI,OAAO,aAAa,aAAa,YACnC,aAAa,WAAW,MAAM,aAAa,SAAS,OAAO;CAG7D,MAAM,oBAAoB;EACxB,GAAG;EACH,GAAG;CACL;CAEA,IAAI,kBAAkB,YAAY;EAChC,MAAM,SAAS,QAAQ,cAAc;EAErC,kBAAkB,WAAW,GAAG,kBAAkB,SAAS,GAAG;CAChE;CAEA,IAAI,CAAC,kBAAkB,MACrB,kBAAkB,OAAO,CAAC,QAAQ,UAAU;CAG9C,OAAO;AACT;AAEA,SAAgB,gBACd,sBACY;CAIZ,OAAO,eAAgB,EAAE,SAAS,YAAY;EAC5C,MAAM,EAAE,KAAK,MAAM,UAAU,WAAW,MAAM,kBAC5C,sBACA,OACF;EACA,MAAM,cAAc,SAAS,MAAM,MAAM,IAAI,MAAM,IAAI;EAEvD,MAAM,UAAW,MAAM,YAAY,IAAI,QAAQ;EAE/C,IAAI,SAKF,OAAO,SAAS,OAAO;GACrB,QAAQ,QAAQ,UAAU;GAC1B,MAAM,QAAQ;GACd,aAAa,QAAQ;EACvB,CAAC;EAGH,SAAS,QAAQ,aAAuB;GACtC,IAAI,CAAC,SAAS,QAAQ,SAAS,QAAQ,SAAS,QAAQ,MACtD;GAGF,MAAM,kBAAkB,SAAS;GAEjC,MAAM,UAAiC;IACrC,QAAQ,SAAS;IACjB,MAAM,OAAO,SAAS,YAAY,IAAI;IACtC,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE;GAIA,YAAY,IAAI,UAAU,SAAS,GAAG,CAAC,CAAC,OAAO,UAAmB;IAChE,IAAI,MAAM,oBAAoB,OAAO,KAAK;GAC5C,CAAC;EACH,CAAC;CACH;AACF"}

package/esm/http/middleware/idempotency.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/idempotency.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\nimport {\n  buildIdempotencyCacheKey,\n  hashBody,\n  isValidIdempotencyKey,\n} from \"./utils/idempotency-key\";\n\n/**\n * Options for the idempotency middleware.\n */\nexport type IdempotencyOptions = {\n  /**\n   * Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).\n   */\n  ttl?: number;\n  /**\n   * Header name carrying the client's key. Falls back to\n   * `http.idempotency.headerName`, then `\"Idempotency-Key\"`.\n   */\n  headerName?: string;\n  /**\n   * HTTP methods eligible for idempotency. Falls back to\n   * `http.idempotency.methods`, then `[\"POST\",\"PUT\",\"PATCH\",\"DELETE\"]`.\n   * Safe methods (GET/HEAD) are skipped regardless.\n   */\n  methods?: string[];\n  /**\n   * Cache driver name. Falls back to `http.idempotency.driver`, then the\n   * default driver of the cache manager.\n   */\n  driver?: string;\n};\n\ntype CachedResponse = {\n  status: number;\n  body: unknown;\n  bodyHash: string;\n  contentType?: string;\n};\n\nconst DEFAULT_METHODS = [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"];\n\n/**\n * Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,\n * same body, within TTL → cached replay; same key, different body → 422\n * `IdempotencyKeyConflict`.\n *\n * **Must run after `authMiddleware`** — the cache key is scoped per-user\n * (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.\n * Anonymous requests fall back to IP scope.\n *\n * The replay sets `Idempotent-Replay: true` on the response for easy\n * client-side / observability detection.\n *\n * Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through\n * even with the header set (RFC: safe methods are already idempotent).\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [authMiddleware(\"client\"), middleware.idempotency()],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries\n *   ],\n * });\n */\nexport function idempotencyMiddleware(options: IdempotencyOptions = {}): Middleware {\n  return async ({ request, response }) => {\n    const headerName =\n      options.headerName ||\n      config.get(\"http.idempotency.headerName\", \"Idempotency-Key\");\n    const methods =\n      options.methods || config.get(\"http.idempotency.methods\", DEFAULT_METHODS);\n    const ttl = options.ttl || config.get(\"http.idempotency.ttl\", 86400);\n    const driverName = options.driver || config.get(\"http.idempotency.driver\");\n\n    if (!methods.includes(request.method.toUpperCase())) return;\n\n    const idempotencyKey = request.header(headerName.toLowerCase());\n\n    if (!idempotencyKey) return;\n\n    if (!isValidIdempotencyKey(idempotencyKey)) {\n      return response.badRequest({\n        error: t(\"http.idempotencyKeyInvalid\"),\n        errorCode: HttpErrorCodes.IdempotencyKeyInvalid,\n      });\n    }\n\n    const cacheDriver = driverName ? await cache.use(driverName) : cache;\n    const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);\n    const bodyHash = hashBody(request.body);\n\n    const cached = (await cacheDriver.get(cacheKey)) as CachedResponse | null;\n\n    if (cached) {\n      if (cached.bodyHash !== bodyHash) {\n        return response.unprocessableEntity({\n          error: t(\"http.idempotencyKeyConflict\"),\n          errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n        });\n      }\n\n      response.header(\"Idempotent-Replay\", \"true\");\n\n      return response.replay({\n        status: cached.status,\n        body: cached.body,\n        contentType: cached.contentType,\n      });\n    }\n\n    response.onSent((sentResponse: Response) => {\n      // Don't cache server errors — clients should be able to retry past a 5xx.\n      // 4xx are deterministic outcomes of the request, so caching is fine.\n      if (sentResponse.statusCode >= 500) return;\n\n      const sentContentType = sentResponse.contentType;\n\n      // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n      // write (e.g. Redis down) would surface as an unhandledRejection.\n      cacheDriver\n        .set(\n          cacheKey,\n          {\n            status: sentResponse.statusCode,\n            body: sentResponse.parsedBody,\n            bodyHash,\n            contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n          },\n          ttl,\n        )\n        .catch((error: unknown) => {\n          log.error(\"idempotency-middleware\", \"set\", error);\n        });\n    });\n  };\n}\n"],"mappings":";;;;;;;;AA8CA,MAAM,kBAAkB;CAAC;CAAQ;CAAO;CAAS;AAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCzD,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,aACJ,QAAQ,cACR,OAAO,IAAI,+BAA+B,iBAAiB;EAC7D,MAAM,UACJ,QAAQ,WAAW,OAAO,IAAI,4BAA4B,eAAe;EAC3E,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAI,wBAAwB,KAAK;EACnE,MAAM,aAAa,QAAQ,UAAU,OAAO,IAAI,yBAAyB;EAEzE,IAAI,CAAC,QAAQ,SAAS,QAAQ,OAAO,YAAY,CAAC,GAAG;EAErD,MAAM,iBAAiB,QAAQ,OAAO,WAAW,YAAY,CAAC;EAE9D,IAAI,CAAC,gBAAgB;EAErB,IAAI,CAAC,sBAAsB,cAAc,GACvC,OAAO,SAAS,WAAW;GACzB,OAAO,EAAE,4BAA4B;GACrC;EACF,CAAC;EAGH,MAAM,cAAc,aAAa,MAAM,MAAM,IAAI,UAAU,IAAI;EAC/D,MAAM,WAAW,yBAAyB,SAAS,cAAc;EACjE,MAAM,WAAW,SAAS,QAAQ,IAAI;EAEtC,MAAM,SAAU,MAAM,YAAY,IAAI,QAAQ;EAE9C,IAAI,QAAQ;GACV,IAAI,OAAO,aAAa,UACtB,OAAO,SAAS,oBAAoB;IAClC,OAAO,EAAE,6BAA6B;IACtC;GACF,CAAC;GAGH,SAAS,OAAO,qBAAqB,MAAM;GAE3C,OAAO,SAAS,OAAO;IACrB,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,aAAa,OAAO;GACtB,CAAC;EACH;EAEA,SAAS,QAAQ,iBAA2B;GAG1C,IAAI,aAAa,cAAc,KAAK;GAEpC,MAAM,kBAAkB,aAAa;GAIrC,YACG,IACC,UACA;IACE,QAAQ,aAAa;IACrB,MAAM,aAAa;IACnB;IACA,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE,GACA,GACF,EACC,OAAO,UAAmB;IACzB,IAAI,MAAM,0BAA0B,OAAO,KAAK;GAClD,CAAC;EACL,CAAC;CACH;AACF"}
+{"version":3,"file":"idempotency.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/idempotency.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\nimport {\n  buildIdempotencyCacheKey,\n  hashBody,\n  isValidIdempotencyKey,\n} from \"./utils/idempotency-key\";\n\n/**\n * Options for the idempotency middleware.\n */\nexport type IdempotencyOptions = {\n  /**\n   * Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).\n   */\n  ttl?: number;\n  /**\n   * Header name carrying the client's key. Falls back to\n   * `http.idempotency.headerName`, then `\"Idempotency-Key\"`.\n   */\n  headerName?: string;\n  /**\n   * HTTP methods eligible for idempotency. Falls back to\n   * `http.idempotency.methods`, then `[\"POST\",\"PUT\",\"PATCH\",\"DELETE\"]`.\n   * Safe methods (GET/HEAD) are skipped regardless.\n   */\n  methods?: string[];\n  /**\n   * Cache driver name. Falls back to `http.idempotency.driver`, then the\n   * default driver of the cache manager.\n   */\n  driver?: string;\n};\n\ntype CachedResponse = {\n  status: number;\n  body: unknown;\n  bodyHash: string;\n  contentType?: string;\n};\n\nconst DEFAULT_METHODS = [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"];\n\n/**\n * Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,\n * same body, within TTL → cached replay; same key, different body → 422\n * `IdempotencyKeyConflict`.\n *\n * **Must run after `authMiddleware`** — the cache key is scoped per-user\n * (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.\n * Anonymous requests fall back to IP scope.\n *\n * The replay sets `Idempotent-Replay: true` on the response for easy\n * client-side / observability detection.\n *\n * Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through\n * even with the header set (RFC: safe methods are already idempotent).\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [authMiddleware(\"client\"), middleware.idempotency()],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries\n *   ],\n * });\n */\nexport function idempotencyMiddleware(options: IdempotencyOptions = {}): Middleware {\n  return async ({ request, response }) => {\n    const headerName =\n      options.headerName ||\n      config.get(\"http.idempotency.headerName\", \"Idempotency-Key\");\n    const methods =\n      options.methods || config.get(\"http.idempotency.methods\", DEFAULT_METHODS);\n    const ttl = options.ttl || config.get(\"http.idempotency.ttl\", 86400);\n    const driverName = options.driver || config.get(\"http.idempotency.driver\");\n\n    if (!methods.includes(request.method.toUpperCase())) return;\n\n    const idempotencyKey = request.header(headerName.toLowerCase());\n\n    if (!idempotencyKey) return;\n\n    if (!isValidIdempotencyKey(idempotencyKey)) {\n      return response.badRequest({\n        error: t(\"http.idempotencyKeyInvalid\"),\n        errorCode: HttpErrorCodes.IdempotencyKeyInvalid,\n      });\n    }\n\n    const cacheDriver = driverName ? await cache.use(driverName) : cache;\n    const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);\n    const bodyHash = hashBody(request.body);\n\n    const cached = (await cacheDriver.get(cacheKey)) as CachedResponse | null;\n\n    if (cached) {\n      if (cached.bodyHash !== bodyHash) {\n        return response.unprocessableEntity({\n          error: t(\"http.idempotencyKeyConflict\"),\n          errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n        });\n      }\n\n      response.header(\"Idempotent-Replay\", \"true\");\n\n      return response.replay({\n        status: cached.status,\n        body: cached.body,\n        contentType: cached.contentType,\n      });\n    }\n\n    response.onSent((sentResponse: Response) => {\n      // Don't cache server errors — clients should be able to retry past a 5xx.\n      // 4xx are deterministic outcomes of the request, so caching is fine.\n      if (sentResponse.statusCode >= 500) return;\n\n      const sentContentType = sentResponse.contentType;\n\n      // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n      // write (e.g. Redis down) would surface as an unhandledRejection.\n      cacheDriver\n        .set(\n          cacheKey,\n          {\n            status: sentResponse.statusCode,\n            body: sentResponse.parsedBody,\n            bodyHash,\n            contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n          },\n          ttl,\n        )\n        .catch((error: unknown) => {\n          log.error(\"idempotency-middleware\", \"set\", error);\n        });\n    });\n  };\n}\n"],"mappings":";;;;;;;;AA8CA,MAAM,kBAAkB;CAAC;CAAQ;CAAO;CAAS;AAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCzD,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,aACJ,QAAQ,cACR,OAAO,IAAI,+BAA+B,iBAAiB;EAC7D,MAAM,UACJ,QAAQ,WAAW,OAAO,IAAI,4BAA4B,eAAe;EAC3E,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAI,wBAAwB,KAAK;EACnE,MAAM,aAAa,QAAQ,UAAU,OAAO,IAAI,yBAAyB;EAEzE,IAAI,CAAC,QAAQ,SAAS,QAAQ,OAAO,YAAY,CAAC,GAAG;EAErD,MAAM,iBAAiB,QAAQ,OAAO,WAAW,YAAY,CAAC;EAE9D,IAAI,CAAC,gBAAgB;EAErB,IAAI,CAAC,sBAAsB,cAAc,GACvC,OAAO,SAAS,WAAW;GACzB,OAAO,EAAE,4BAA4B;GACrC;EACF,CAAC;EAGH,MAAM,cAAc,aAAa,MAAM,MAAM,IAAI,UAAU,IAAI;EAC/D,MAAM,WAAW,yBAAyB,SAAS,cAAc;EACjE,MAAM,WAAW,SAAS,QAAQ,IAAI;EAEtC,MAAM,SAAU,MAAM,YAAY,IAAI,QAAQ;EAE9C,IAAI,QAAQ;GACV,IAAI,OAAO,aAAa,UACtB,OAAO,SAAS,oBAAoB;IAClC,OAAO,EAAE,6BAA6B;IACtC;GACF,CAAC;GAGH,SAAS,OAAO,qBAAqB,MAAM;GAE3C,OAAO,SAAS,OAAO;IACrB,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,aAAa,OAAO;GACtB,CAAC;EACH;EAEA,SAAS,QAAQ,iBAA2B;GAG1C,IAAI,aAAa,cAAc,KAAK;GAEpC,MAAM,kBAAkB,aAAa;GAIrC,YACG,IACC,UACA;IACE,QAAQ,aAAa;IACrB,MAAM,aAAa;IACnB;IACA,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE,GACA,GACF,CAAC,CACA,OAAO,UAAmB;IACzB,IAAI,MAAM,0BAA0B,OAAO,KAAK;GAClD,CAAC;EACL,CAAC;CACH;AACF"}

package/esm/http/middleware/inject-request-context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\r\n * Request Context Middleware\r\n *\r\n * Creates a unified context for each request using the ContextManager.\r\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\r\n */\r\nimport { trans } from \"@mongez/localization\";\r\nimport { type GenericObject } from \"@mongez/reinforcements\";\r\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\r\nimport { contextManager } from \"@warlock.js/context\";\r\nimport config from \"@mongez/config\";\r\nimport { environment } from \"../../utils\";\r\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\r\nimport {\r\n  BadRequestError,\r\n  ForbiddenError,\r\n  HttpError,\r\n  ResourceNotFoundError,\r\n  ServerError,\r\n  UnAuthorizedError,\r\n} from \"../errors\";\r\nimport { type Request } from \"../request\";\r\nimport { type Response } from \"../response\";\r\nimport { type ReturnedResponse } from \"./../types\";\r\n\r\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\r\n\r\n/**\r\n * Echo `request.id` back as a response header so the FE / proxies / log\r\n * aggregators can correlate by the same value the server logs against.\r\n *\r\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\r\n * Skip when `http.requestId.enabled` is explicitly false.\r\n */\r\nfunction stampRequestIdHeader(request: Request, response: Response) {\r\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\r\n\r\n  if (requestIdConfig.enabled === false) return;\r\n\r\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\r\n\r\n  response.header(headerName, request.id);\r\n}\r\n\r\n/**\r\n * Create request store and execute middleware + handler\r\n *\r\n * Runs all registered contexts together using ContextManager.\r\n */\r\nexport function createRequestStore(\r\n  request: Request<any>,\r\n  response: Response,\r\n): Promise<ReturnedResponse> {\r\n  stampRequestIdHeader(request, response);\r\n\r\n  // Build all context stores using the immutable API\r\n  // Each context defines its own store initialization via buildStore()\r\n  const httpContextStore = contextManager.buildStores({ request, response });\r\n\r\n  // Run all contexts together!\r\n  return contextManager.runAll(httpContextStore, async () => {\r\n    try {\r\n      // Run middleware chain\r\n      const result = await request.runMiddleware();\r\n\r\n      if (result) {\r\n        return result as ReturnedResponse;\r\n      }\r\n\r\n      // Execute route handler\r\n      request.trigger(\"executingAction\", request.route);\r\n\r\n      const handler = request.getHandler();\r\n\r\n      request.log(\"Executing Handler\", \"info\");\r\n\r\n      const output = await handler({ request, response });\r\n\r\n      request.log(\"Handler Executed Successfully\", \"success\");\r\n\r\n      request.trigger(\"executedAction\", request.route);\r\n\r\n      return output as ReturnedResponse;\r\n    } catch (error) {\r\n      request.log(error, \"error\");\r\n      return handleRequestError(error, response);\r\n    }\r\n  });\r\n}\r\n\r\n/**\r\n * Handle request errors\r\n * @internal\r\n */\r\nfunction handleRequestError(error: unknown, response: Response): ReturnedResponse {\r\n  if (error instanceof HttpError) {\r\n    const payload: GenericObject = {\r\n      error: error.message,\r\n    };\r\n    if (error.payload) {\r\n      payload.payload = error.payload;\r\n    }\r\n\r\n    if (environment() === \"development\") {\r\n      payload.stack = error.stack;\r\n    }\r\n\r\n    return response.setStatusCode(error.status).send(payload);\r\n  }\r\n\r\n  if (error instanceof ResourceNotFoundError) {\r\n    return response.notFound({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof UnAuthorizedError) {\r\n    return response.unauthorized({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ForbiddenError) {\r\n    return response.forbidden({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof BadRequestError) {\r\n    return response.badRequest({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof DatabaseWriterValidationError) {\r\n    return response.badRequest({\r\n      errors: error.errors,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ServerError) {\r\n    return response.serverError({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  // Last resort: the error matched none of the known shapes above, so the\r\n  // client gets a deliberately opaque message. Without this line the error\r\n  // itself is discarded here — no stack, no message, nothing in any log — and\r\n  // an unrecognised failure becomes indistinguishable from a working server\r\n  // returning 500. Never swallow the only copy of an error (`65e476ee`).\r\n  console.error(\"[warlock] unhandled request error:\", error);\r\n\r\n  return response.serverError({\r\n    error: \"Internal server error.\",\r\n  });\r\n}\r\n\r\n/**\r\n * Translate a keyword (uses request context for locale)\r\n */\r\nexport function t(keyword: string, placeholders?: any) {\r\n  return (\r\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\r\n    trans(keyword, placeholders)\r\n  );\r\n}\r\n\r\n// `fromRequest` was removed in v5. It cached computed values as dynamic\r\n// properties on the Request instance, which only compiled because of the\r\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\r\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\r\n// per-request lifetime, single-flight, and it never touches the Request object.\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAItC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAEF,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,OAAO,OAAO;GAC1B,OAAO,mBAAmB,OAAO,QAAQ;EAC3C;CACF,CAAC;AACH;;;;;AAMA,SAAS,mBAAmB,OAAgB,UAAsC;CAChF,IAAI,iBAAiB,WAAW;EAC9B,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,EAAE,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,uBACnB,OAAO,SAAS,SAAS;EACvB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,mBACnB,OAAO,SAAS,aAAa;EAC3B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,gBACnB,OAAO,SAAS,UAAU;EACxB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,iBACnB,OAAO,SAAS,WAAW;EACzB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,+BACnB,OAAO,SAAS,WAAW,EACzB,QAAQ,MAAM,OAChB,CAAC;CAGH,IAAI,iBAAiB,aACnB,OAAO,SAAS,YAAY;EAC1B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAQH,QAAQ,MAAM,sCAAsC,KAAK;CAEzD,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAoB;CACrD,OACEA,eAAuB,WAAW,GAAG,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}
+{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\r\n * Request Context Middleware\r\n *\r\n * Creates a unified context for each request using the ContextManager.\r\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\r\n */\r\nimport { trans } from \"@mongez/localization\";\r\nimport { type GenericObject } from \"@mongez/reinforcements\";\r\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\r\nimport { contextManager } from \"@warlock.js/context\";\r\nimport config from \"@mongez/config\";\r\nimport { environment } from \"../../utils\";\r\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\r\nimport {\r\n  BadRequestError,\r\n  ForbiddenError,\r\n  HttpError,\r\n  ResourceNotFoundError,\r\n  ServerError,\r\n  UnAuthorizedError,\r\n} from \"../errors\";\r\nimport { type Request } from \"../request\";\r\nimport { type Response } from \"../response\";\r\nimport { type ReturnedResponse } from \"./../types\";\r\n\r\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\r\n\r\n/**\r\n * Echo `request.id` back as a response header so the FE / proxies / log\r\n * aggregators can correlate by the same value the server logs against.\r\n *\r\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\r\n * Skip when `http.requestId.enabled` is explicitly false.\r\n */\r\nfunction stampRequestIdHeader(request: Request, response: Response) {\r\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\r\n\r\n  if (requestIdConfig.enabled === false) return;\r\n\r\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\r\n\r\n  response.header(headerName, request.id);\r\n}\r\n\r\n/**\r\n * Create request store and execute middleware + handler\r\n *\r\n * Runs all registered contexts together using ContextManager.\r\n */\r\nexport function createRequestStore(\r\n  request: Request<any>,\r\n  response: Response,\r\n): Promise<ReturnedResponse> {\r\n  stampRequestIdHeader(request, response);\r\n\r\n  // Build all context stores using the immutable API\r\n  // Each context defines its own store initialization via buildStore()\r\n  const httpContextStore = contextManager.buildStores({ request, response });\r\n\r\n  // Run all contexts together!\r\n  return contextManager.runAll(httpContextStore, async () => {\r\n    try {\r\n      // Run middleware chain\r\n      const result = await request.runMiddleware();\r\n\r\n      if (result) {\r\n        return result as ReturnedResponse;\r\n      }\r\n\r\n      // Execute route handler\r\n      request.trigger(\"executingAction\", request.route);\r\n\r\n      const handler = request.getHandler();\r\n\r\n      request.log(\"Executing Handler\", \"info\");\r\n\r\n      const output = await handler({ request, response });\r\n\r\n      request.log(\"Handler Executed Successfully\", \"success\");\r\n\r\n      request.trigger(\"executedAction\", request.route);\r\n\r\n      return output as ReturnedResponse;\r\n    } catch (error) {\r\n      request.log(error, \"error\");\r\n      return handleRequestError(error, response);\r\n    }\r\n  });\r\n}\r\n\r\n/**\r\n * Handle request errors\r\n * @internal\r\n */\r\nfunction handleRequestError(error: unknown, response: Response): ReturnedResponse {\r\n  if (error instanceof HttpError) {\r\n    const payload: GenericObject = {\r\n      error: error.message,\r\n    };\r\n    if (error.payload) {\r\n      payload.payload = error.payload;\r\n    }\r\n\r\n    if (environment() === \"development\") {\r\n      payload.stack = error.stack;\r\n    }\r\n\r\n    return response.setStatusCode(error.status).send(payload);\r\n  }\r\n\r\n  if (error instanceof ResourceNotFoundError) {\r\n    return response.notFound({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof UnAuthorizedError) {\r\n    return response.unauthorized({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ForbiddenError) {\r\n    return response.forbidden({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof BadRequestError) {\r\n    return response.badRequest({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  if (error instanceof DatabaseWriterValidationError) {\r\n    return response.badRequest({\r\n      errors: error.errors,\r\n    });\r\n  }\r\n\r\n  if (error instanceof ServerError) {\r\n    return response.serverError({\r\n      error: error.message,\r\n      ...error.payload,\r\n    });\r\n  }\r\n\r\n  // Last resort: the error matched none of the known shapes above, so the\r\n  // client gets a deliberately opaque message. Without this line the error\r\n  // itself is discarded here — no stack, no message, nothing in any log — and\r\n  // an unrecognised failure becomes indistinguishable from a working server\r\n  // returning 500. Never swallow the only copy of an error (`65e476ee`).\r\n  console.error(\"[warlock] unhandled request error:\", error);\r\n\r\n  return response.serverError({\r\n    error: \"Internal server error.\",\r\n  });\r\n}\r\n\r\n/**\r\n * Translate a keyword (uses request context for locale)\r\n */\r\nexport function t(keyword: string, placeholders?: any) {\r\n  return (\r\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\r\n    trans(keyword, placeholders)\r\n  );\r\n}\r\n\r\n// `fromRequest` was removed in v5. It cached computed values as dynamic\r\n// properties on the Request instance, which only compiled because of the\r\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\r\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\r\n// per-request lifetime, single-flight, and it never touches the Request object.\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAItC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAEF,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,OAAO,OAAO;GAC1B,OAAO,mBAAmB,OAAO,QAAQ;EAC3C;CACF,CAAC;AACH;;;;;AAMA,SAAS,mBAAmB,OAAgB,UAAsC;CAChF,IAAI,iBAAiB,WAAW;EAC9B,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,uBACnB,OAAO,SAAS,SAAS;EACvB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,mBACnB,OAAO,SAAS,aAAa;EAC3B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,gBACnB,OAAO,SAAS,UAAU;EACxB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,iBACnB,OAAO,SAAS,WAAW;EACzB,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAGH,IAAI,iBAAiB,+BACnB,OAAO,SAAS,WAAW,EACzB,QAAQ,MAAM,OAChB,CAAC;CAGH,IAAI,iBAAiB,aACnB,OAAO,SAAS,YAAY;EAC1B,OAAO,MAAM;EACb,GAAG,MAAM;CACX,CAAC;CAQH,QAAQ,MAAM,sCAAsC,KAAK;CAEzD,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAoB;CACrD,OACEA,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}

package/esm/http/middleware/maintenance.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return ({ request, response }) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist =\n      options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    // `request.path` includes the query string, but allowlist entries are\n    // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n    // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n    const pathname = request.path.split(\"?\")[0];\n\n    if (isAllowlisted(pathname, allowlist)) return;\n\n    const retryAfter =\n      options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,EAAE,SAAS,eAAe;EAGhC,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YACJ,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAK3E,MAAM,WAAW,QAAQ,KAAK,MAAM,GAAG,EAAE;EAEzC,IAAI,cAAc,UAAU,SAAS,GAAG;EAExC,MAAM,aACJ,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAEpE,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return ({ request, response }) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist =\n      options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    // `request.path` includes the query string, but allowlist entries are\n    // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n    // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n    const pathname = request.path.split(\"?\")[0];\n\n    if (isAllowlisted(pathname, allowlist)) return;\n\n    const retryAfter =\n      options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,EAAE,SAAS,eAAe;EAGhC,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YACJ,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAK3E,MAAM,WAAW,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC;EAEzC,IAAI,cAAc,UAAU,SAAS,GAAG;EAExC,MAAM,aACJ,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAEpE,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}

package/esm/http/middleware/utils/idempotency-key.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency-key.mjs","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/idempotency-key.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { Request } from \"../../request\";\nimport type { RequestUser } from \"../../types\";\n\n/**\n * Idempotency-key validation rules.\n *\n * RFC draft-ietf-httpapi-idempotency-key suggests UUIDs or ULIDs but doesn't\n * mandate a format. We accept any printable ASCII string up to 255 chars —\n * tight enough to reject log-injection (no control characters / newlines),\n * loose enough to accept whatever ID scheme the client picks.\n */\nconst MAX_KEY_LENGTH = 255;\nconst PRINTABLE_ASCII = /^[\\x21-\\x7e]+$/;\n\nexport function isValidIdempotencyKey(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    value.length <= MAX_KEY_LENGTH &&\n    PRINTABLE_ASCII.test(value)\n  );\n}\n\n/**\n * Hash a request body to a stable hex digest.\n *\n * Used to detect \"same key, different body\" — that's a client bug, not a retry.\n * sha256 is overkill for collision resistance here, but it's the dependency-free\n * choice and avoids importing a faster hasher.\n *\n * @example\n * hashBody({ amount: 100, currency: \"USD\" }); // \"a1b2c3...\"\n */\nexport function hashBody(body: unknown): string {\n  const serialized = typeof body === \"string\" ? body : JSON.stringify(body ?? {});\n\n  return createHash(\"sha256\").update(serialized).digest(\"hex\");\n}\n\n/**\n * Build the cache key for an idempotency record.\n *\n * Scope is `userType:userId` when authenticated, falling back to the client IP\n * when anonymous. This prevents user A from replaying user B's key — even if\n * user B used a guessable value — while still letting the primitive work on\n * public endpoints.\n *\n * Idempotency middleware must run **after** `authMiddleware` so `request.user`\n * and `request.decodedAccessToken` are populated.\n *\n * @example\n * buildIdempotencyCacheKey(request, \"01J9XZQ-ABC\"); // \"idem:client:user_123:01J9XZQ-ABC\"\n */\n/**\n * Read `id` off `request.user` without assuming every app's `RequestUser`\n * augmentation declares it.\n *\n * `RequestUser` (`core/src/http/types.ts`) is empty by default — apps narrow\n * it to their own model shape. Adding `id` directly to `RequestUser` here\n * would force that exact field (and type) onto every app: TypeScript\n * interface merging requires all declarations of a shared member to have an\n * identical type, so an app augmenting `RequestUser` with, say, `id: string`\n * only would conflict with a core-declared `id?: string | number`. A local,\n * narrow read survives any augmentation shape (eed20184 step (b) —\n * `implementation/2026-08-20-A2-request-locals.md` §6.2) — no `as any`.\n */\nfunction readUserId(user: RequestUser | undefined): string | number | undefined {\n  if (!user || typeof user !== \"object\" || !(\"id\" in user)) return undefined;\n\n  const id = (user as { id?: unknown }).id;\n\n  return typeof id === \"string\" || typeof id === \"number\" ? id : undefined;\n}\n\nexport function buildIdempotencyCacheKey(request: Request, idempotencyKey: string): string {\n  const userType = request.decodedAccessToken?.userType || \"anonymous\";\n  const userId = readUserId(request.user) || request.detectIp() || \"unknown\";\n\n  return `idem:${userType}:${userId}:${idempotencyKey}`;\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,SAAgB,sBAAsB,OAAiC;CACrE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,kBAChB,gBAAgB,KAAK,KAAK;AAE9B;;;;;;;;;;;AAYA,SAAgB,SAAS,MAAuB;CAC9C,MAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC;CAE9E,OAAO,WAAW,QAAQ,EAAE,OAAO,UAAU,EAAE,OAAO,KAAK;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,WAAW,MAA4D;CAC9E,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OAAO,OAAO;CAEjE,MAAM,KAAM,KAA0B;CAEtC,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,WAAW,KAAK;AACjE;AAEA,SAAgB,yBAAyB,SAAkB,gBAAgC;CAIzF,OAAO,QAHU,QAAQ,oBAAoB,YAAY,YAGjC,GAFT,WAAW,QAAQ,IAAI,KAAK,QAAQ,SAAS,KAAK,UAE/B,GAAG;AACvC"}
+{"version":3,"file":"idempotency-key.mjs","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/idempotency-key.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { Request } from \"../../request\";\nimport type { RequestUser } from \"../../types\";\n\n/**\n * Idempotency-key validation rules.\n *\n * RFC draft-ietf-httpapi-idempotency-key suggests UUIDs or ULIDs but doesn't\n * mandate a format. We accept any printable ASCII string up to 255 chars —\n * tight enough to reject log-injection (no control characters / newlines),\n * loose enough to accept whatever ID scheme the client picks.\n */\nconst MAX_KEY_LENGTH = 255;\nconst PRINTABLE_ASCII = /^[\\x21-\\x7e]+$/;\n\nexport function isValidIdempotencyKey(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    value.length <= MAX_KEY_LENGTH &&\n    PRINTABLE_ASCII.test(value)\n  );\n}\n\n/**\n * Hash a request body to a stable hex digest.\n *\n * Used to detect \"same key, different body\" — that's a client bug, not a retry.\n * sha256 is overkill for collision resistance here, but it's the dependency-free\n * choice and avoids importing a faster hasher.\n *\n * @example\n * hashBody({ amount: 100, currency: \"USD\" }); // \"a1b2c3...\"\n */\nexport function hashBody(body: unknown): string {\n  const serialized = typeof body === \"string\" ? body : JSON.stringify(body ?? {});\n\n  return createHash(\"sha256\").update(serialized).digest(\"hex\");\n}\n\n/**\n * Build the cache key for an idempotency record.\n *\n * Scope is `userType:userId` when authenticated, falling back to the client IP\n * when anonymous. This prevents user A from replaying user B's key — even if\n * user B used a guessable value — while still letting the primitive work on\n * public endpoints.\n *\n * Idempotency middleware must run **after** `authMiddleware` so `request.user`\n * and `request.decodedAccessToken` are populated.\n *\n * @example\n * buildIdempotencyCacheKey(request, \"01J9XZQ-ABC\"); // \"idem:client:user_123:01J9XZQ-ABC\"\n */\n/**\n * Read `id` off `request.user` without assuming every app's `RequestUser`\n * augmentation declares it.\n *\n * `RequestUser` (`core/src/http/types.ts`) is empty by default — apps narrow\n * it to their own model shape. Adding `id` directly to `RequestUser` here\n * would force that exact field (and type) onto every app: TypeScript\n * interface merging requires all declarations of a shared member to have an\n * identical type, so an app augmenting `RequestUser` with, say, `id: string`\n * only would conflict with a core-declared `id?: string | number`. A local,\n * narrow read survives any augmentation shape (eed20184 step (b) —\n * `implementation/2026-08-20-A2-request-locals.md` §6.2) — no `as any`.\n */\nfunction readUserId(user: RequestUser | undefined): string | number | undefined {\n  if (!user || typeof user !== \"object\" || !(\"id\" in user)) return undefined;\n\n  const id = (user as { id?: unknown }).id;\n\n  return typeof id === \"string\" || typeof id === \"number\" ? id : undefined;\n}\n\nexport function buildIdempotencyCacheKey(request: Request, idempotencyKey: string): string {\n  const userType = request.decodedAccessToken?.userType || \"anonymous\";\n  const userId = readUserId(request.user) || request.detectIp() || \"unknown\";\n\n  return `idem:${userType}:${userId}:${idempotencyKey}`;\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,SAAgB,sBAAsB,OAAiC;CACrE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,kBAChB,gBAAgB,KAAK,KAAK;AAE9B;;;;;;;;;;;AAYA,SAAgB,SAAS,MAAuB;CAC9C,MAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC;CAE9E,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,WAAW,MAA4D;CAC9E,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OAAO,OAAO;CAEjE,MAAM,KAAM,KAA0B;CAEtC,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,WAAW,KAAK;AACjE;AAEA,SAAgB,yBAAyB,SAAkB,gBAAgC;CAIzF,OAAO,QAHU,QAAQ,oBAAoB,YAAY,YAGjC,GAFT,WAAW,QAAQ,IAAI,KAAK,QAAQ,SAAS,KAAK,UAE/B,GAAG;AACvC"}

package/esm/http/ready-report.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ready-report.d.mts","names":[],"sources":["../../../../../../../core/src/http/ready-report.ts"],"mappings":";;AAiCA;;;;;;;;;;;AAYW;AAQX;;;;AAAwD;AASxD;;;;AAAqD;AAKrD;;;;AAAoC;;;;;KAlCxB,eAAA;2EAEV,YAAA;EAEA,GAAA;EAEA,YAAA;EAEA,IAAA;EAEA,UAAA;EAEA,SAAA;AAAA;;;;iBAQc,kBAAA,CAAmB,IAAqB,EAAf,eAAe;;;;;;iBASxC,kBAAA,CAAA,GAAsB,eAAe;;iBAKrC,oBAAA,CAAA"}
+{"version":3,"file":"ready-report.d.mts","names":[],"sources":["../../../../../../../core/src/http/ready-report.ts"],"mappings":";;AAiCA;;;;;;;;;;;AAYW;AAQX;;;;AAAwD;AASxD;;;;AAAqD;AAKrD;;;;AAAoC;;;;;KAlCxB,eAAA;2EAEV,YAAA;EAEA,GAAA;EAEA,YAAA;EAEA,IAAA;EAEA,UAAA;EAEA,SAAA;AAAA;;;;iBAQc,kBAAA,CAAmB,IAAqB,EAAf,eAAe;;;;;;iBASxC,kBAAA,IAAsB,eAAe;;iBAKrC,oBAAA"}

package/esm/http/request-controller.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-controller.d.mts","names":[],"sources":["../../../../../../../core/src/http/request-controller.ts"],"mappings":";;;;;;uBAKsB,iBAAA,YAA6B,yBAAA;EAAA,SAE/B,OAAA,EAAS,OAAA;EAAA,SACT,QAAA,EAAU,QAAA;cADV,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA;EAAA,SAKZ,OAAA,CAAA,GAAW,OAAA,CAAQ,gBAAA;AAAA"}
+{"version":3,"file":"request-controller.d.mts","names":[],"sources":["../../../../../../../core/src/http/request-controller.ts"],"mappings":";;;;;;uBAKsB,iBAAA,YAA6B,yBAAA;EAAA,SAE/B,OAAA,EAAS,OAAA;EAAA,SACT,QAAA,EAAU,QAAA;cADV,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA;EAAA,SAKZ,OAAA,IAAW,OAAA,CAAQ,gBAAA;AAAA"}

package/esm/http/request.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.mts","names":[],"sources":["../../../../../../../core/src/http/request.ts"],"mappings":";;;;;;;;;;;KA4BK,eAAA,iBAIU,mBAAA,mBAAsC,CAAA,0BAE9B,CAAA,WAEb,CAAA,GACL,mBAAA,CAAoB,CAAA;AAAA,KAGpB,UAAA,SAAmB,eAAe;AAAA,cAE1B,OAAA;;;;;;;;;;;;;;;;EAgBJ,WAAA,EAAc,cAAA;EArBG;AAAA;AAAA;EA0BjB,QAAA,EAAW,QAAA;;;AAvBmB;EA4B9B,KAAA,EAAQ,KAAA;EA1BG;;;EAAA,UA+BR,OAAA;EALK;;;EAUR,kBAAA;EAoHyB;;;;;;;;;;;;;;;;;;;;;;EA5FzB,IAAA,GAAO,WAAA;EAkuBX;;;;;;;;;;;;;;;;;;;;;;;;;;;;EApsBI,MAAA,EAAQ,aAAA;EAqBL;;;;;;;;;;;EARH,gBAAA,CAAA;EA0EmB;;;;EAAA,UAlEhB,MAAA;EAsFiB;;;;;;;;;;;;;;;;;;;;;;EAAA,IA9DhB,KAAA,CAAA;EAuNW;;;EAAA,OA5MR,OAAA,EAAS,OAAA;EAsNhB;;;;EAhNA,KAAA,EAAO,UAAA,QAAkB,KAAA;EAiN9B;;;EA5MK,CAAA,EAAG,UAAA,QAAkB,KAAA;EA4NrB;;;EAAA,UA7MG,OAAA;EA0NO;;;EAAA,UArNP,aAAA,GAAgB,iBAAA;EAiPf;;;EA5OJ,EAAA;EAgSI;;;EA3RJ,SAAA;EAuTL;;;EAlTK,OAAA;EA2TG;;;EAtTH,UAAA,CAAW,OAAA,EAAS,cAAA;EAidN;;;;;;;;;EAAA,UAtbX,gBAAA,CAAA;EA+dA;;;;;EAAA,iBAvcO,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EA8c1B;;;EAlclB,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EAifzC;;;;;;;;EAAA,UAreH,WAAA,CAAY,SAAA;EA4gBI;;;;EAAA,UApfhB,aAAA,CAAA;EAmgBgB;;;EAAA,IAtff,MAAA,CAAA;EA6fa;;;EAAA,IApfb,MAAA,CAAO,UAAA;EA+fE;;;EAxfb,aAAA,CAAc,UAAA;EA4gBY;;;;;EAjgB1B,aAAA,CAAc,wBAAA;EAwkBd;;;EAAA,IAjkBI,QAAA,CAAA;EAwkBA;;;EAjkBE,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA,4BAAA,gBAAA;EA+kBnE;;;EArkBA,MAAA,gCAAsC,UAAA,CAAA,CAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EA4kBgB;;;EAAA,IApkBP,OAAA,CAAA,GAAW,MAAA;EAwlBX;;;EAjlBJ,MAAA,CAAO,IAAA,UAAc,YAAA;EAimBjB;;;EAplBJ,SAAA,CAAU,IAAA;EAinBV;;;EAAA,IA1mBI,MAAA,CAAA;EAwnBJ;;;EAAA,IAjnBI,QAAA,CAAA;EAioBJ;;;EAAA,IA1nBI,MAAA,CAAA;EA0oBJ;;;EAAA,IAnoBI,YAAA,CAAA;EAmrBC;;;EAAA,IAtqBD,kBAAA,CAAA;EAwrBG;;;;;EAAA,IAvqBH,WAAA,CAAA;EAmsBa;;;EAAA,IAprBb,aAAA,CAAA;EAssBgB;;;EAAA,IA/rBhB,MAAA,CAAA;EAitBJ;;;EAeI;;;;;;;EAAA,UAltBD,gBAAA,CAAiB,GAAA;EAkzBmB;;;;;;AAOC;;;EAPD,UAryBpC,aAAA,CACR,KAAA,OACA,UAAA,WACA,KAAA,GAAQ,KAAA;EAAA,UAOA,YAAA,CAAA;;;;YAeA,SAAA,CAAU,IAAA;;;;YA4IV,UAAA,CAAW,IAAA;;;;EAsBd,QAAA,CAAS,KAAA,EAAO,KAAA;;;;EAYhB,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;;;;EAOpC,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA,iCAAa,iBAAA;;;;EAOzC,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;;;;MAqBrB,IAAA,CAAA;;;;MAOA,GAAA,CAAA;;;;MAOA,OAAA,CAAA;;;;;;;;;EAYE,aAAA,CAAA,GAAa,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;EA+BnB,UAAA,CAAA,GAAU,cAAA,CAAA,OAAA;;;;;EAQV,SAAA,UAAmB,iBAAA,CAAA,CACxB,MAAA,UAAgB,MAAA,sBACf,MAAA;;;;EAaI,eAAA,CAAA,GAAmB,MAAA,aAAmB,iBAAA;;;;EAOtC,gBAAA,CAAiB,IAAA,EAAM,iBAAA;;;;;;;;EAWjB,OAAA,CAAA,GAAO,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YAoBJ,iBAAA,CAAA,GAAiB,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YAkDvB,kBAAA,CAAA,GAAsB,UAAA;;;;EAczB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,CAAA,GAAS,IAAA;;;;MASL,IAAA,CAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA,CAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA,CAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MASlB,KAAA,CAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA,CAAA;;;;EAOA,eAAA,CAAA;;;;EAUA,iBAAA,CAAA;;;;EAmBA,KAAA,CAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA,CAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCJ,QAAA,CAAA;;;;MA+BI,MAAA,CAAA;;;;MAOA,GAAA,CAAA;;;;MAOA,OAAA,CAAA;;;;MAOA,SAAA,CAAA;;;;MAOA,OAAA,CAAA,eAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}
+{"version":3,"file":"request.d.mts","names":[],"sources":["../../../../../../../core/src/http/request.ts"],"mappings":";;;;;;;;;;;KA4BK,eAAA,iBAIU,mBAAA,mBAAsC,CAAA,0BAE9B,CAAA,WAEb,CAAA,GACL,mBAAA,CAAoB,CAAA;AAAA,KAGpB,UAAA,SAAmB,eAAe;AAAA,cAE1B,OAAA;;;;;;;;;;;;;;;;EAgBJ,WAAA,EAAc,cAAA;EArBG;AAAA;AAAA;EA0BjB,QAAA,EAAW,QAAA;;;AAvBmB;EA4B9B,KAAA,EAAQ,KAAA;EA1BG;;;EAAA,UA+BR,OAAA;EALK;;;EAUR,kBAAA;EAoHyB;;;;;;;;;;;;;;;;;;;;;;EA5FzB,IAAA,GAAO,WAAA;EAkuBX;;;;;;;;;;;;;;;;;;;;;;;;;;;;EApsBI,MAAA,EAAQ,aAAA;EAqBL;;;;;;;;;;;EARH,gBAAA;EA0EmB;;;;EAAA,UAlEhB,MAAA;EAsFiB;;;;;;;;;;;;;;;;;;;;;;EAAA,IA9DhB,KAAA;EAuNW;;;EAAA,OA5MR,OAAA,EAAS,OAAA;EAsNhB;;;;EAhNA,KAAA,EAAO,UAAA,QAAkB,KAAA;EAiN9B;;;EA5MK,CAAA,EAAG,UAAA,QAAkB,KAAA;EA4NrB;;;EAAA,UA7MG,OAAA;EA0NO;;;EAAA,UArNP,aAAA,GAAgB,iBAAA;EAiPf;;;EA5OJ,EAAA;EAgSI;;;EA3RJ,SAAA;EAuTL;;;EAlTK,OAAA;EA2TG;;;EAtTH,UAAA,CAAW,OAAA,EAAS,cAAA;EAidN;;;;;;;;;EAAA,UAtbX,gBAAA;EA+dA;;;;;EAAA,iBAvcO,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EA8c1B;;;EAlclB,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EAifzC;;;;;;;;EAAA,UAreH,WAAA,CAAY,SAAA;EA4gBI;;;;EAAA,UApfhB,aAAA;EAmgBgB;;;EAAA,IAtff,MAAA;EA6fa;;;EAAA,IApfb,MAAA,CAAO,UAAA;EA+fE;;;EAxfb,aAAA,CAAc,UAAA;EA4gBY;;;;;EAjgB1B,aAAA,CAAc,wBAAA;EAwkBd;;;EAAA,IAjkBI,QAAA;EAwkBA;;;EAjkBE,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA,4BAAA,gBAAA;EA+kBnE;;;EArkBA,MAAA,gCAAsC,UAAA,EAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EA4kBgB;;;EAAA,IApkBP,OAAA,IAAW,MAAA;EAwlBX;;;EAjlBJ,MAAA,CAAO,IAAA,UAAc,YAAA;EAimBjB;;;EAplBJ,SAAA,CAAU,IAAA;EAinBV;;;EAAA,IA1mBI,MAAA;EAwnBJ;;;EAAA,IAjnBI,QAAA;EAioBJ;;;EAAA,IA1nBI,MAAA;EA0oBJ;;;EAAA,IAnoBI,YAAA;EAmrBC;;;EAAA,IAtqBD,kBAAA;EAwrBG;;;;;EAAA,IAvqBH,WAAA;EAmsBa;;;EAAA,IAprBb,aAAA;EAssBgB;;;EAAA,IA/rBhB,MAAA;EAitBJ;;;EAeI;;;;;;;EAAA,UAltBD,gBAAA,CAAiB,GAAA;EAkzBmB;;;;;;AAOC;;;EAPD,UAryBpC,aAAA,CACR,KAAA,OACA,UAAA,WACA,KAAA,GAAQ,KAAA;EAAA,UAOA,YAAA;;;;YAeA,SAAA,CAAU,IAAA;;;;YA4IV,UAAA,CAAW,IAAA;;;;EAsBd,QAAA,CAAS,KAAA,EAAO,KAAA;;;;EAYhB,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;;;;EAOpC,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA,iCAAa,iBAAA;;;;EAOzC,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;;;;MAqBrB,IAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;;;;;;EAYE,aAAA,IAAa,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;EA+BnB,UAAA,IAAU,cAAA,CAAA,OAAA;;;;;EAQV,SAAA,UAAmB,iBAAA,EACxB,MAAA,UAAgB,MAAA,sBACf,MAAA;;;;EAaI,eAAA,IAAmB,MAAA,aAAmB,iBAAA;;;;EAOtC,gBAAA,CAAiB,IAAA,EAAM,iBAAA;;;;;;;;EAWjB,OAAA,IAAO,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YAoBJ,iBAAA,IAAiB,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YAkDvB,kBAAA,IAAsB,UAAA;;;;EAczB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,IAAS,IAAA;;;;MASL,IAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MASlB,KAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA;;;;EAOA,eAAA;;;;EAUA,iBAAA;;;;EAmBA,KAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCJ,QAAA;;;;MA+BI,MAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;MAOA,SAAA;;;;MAOA,OAAA,gBAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}