@warlock.js/core 5.20.0 → 5.21.0

package/esm/storage/utils/safe-fetch.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"safe-fetch.mjs","names":[],"sources":["../../../../../../../../core/src/storage/utils/safe-fetch.ts"],"sourcesContent":["import { lookup } from \"node:dns/promises\";\nimport { isIP } from \"@warlock.js/seal\";\nimport { StorageError } from \"./storage-error\";\n\n/**\n * SSRF / resource-exhaustion guard for storage's outbound downloads\n * (`putFromUrl`).\n *\n * NOTE: this MIRRORS `@warlock.js/ai`'s `src/security/private-ip.ts` and\n * `src/security/outbound-policy.ts`. It is duplicated here intentionally\n * because `@warlock.js/core` cannot depend on `@warlock.js/ai`. Pending\n * extraction of a shared security package, keep the two copies in sync.\n */\n\n/** 50 MiB — default cap on a downloaded body (storage files run larger than AI payloads). */\nconst DEFAULT_MAX_BYTES = 50 * 1024 * 1024;\n/** 30s — default per-request timeout. */\nconst DEFAULT_TIMEOUT_MS = 30_000;\n/**\n * Cap on the number of re-validated redirect hops. Mirrors\n * `@warlock.js/ai`'s `DEFAULT_MAX_REDIRECTS`\n * (ai/src/security/outbound-policy.ts:15).\n */\nconst DEFAULT_MAX_REDIRECTS = 5;\n\n/** 3xx statuses whose `Location` a follow re-issues — mirrors ai/src/security/outbound-policy.ts:18. */\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/**\n * Options controlling a guarded outbound fetch. Every field is optional;\n * {@link resolveFetchPolicy} fills safe defaults. The defaults are\n * deliberately strict (https+http, private-IP deny ON, 30s timeout,\n * 50 MiB cap) so a caller that does not tune them still gets a hardened\n * request.\n */\nexport type SafeFetchOptions = {\n  /**\n   * Whether to ALLOW private / loopback / link-local / metadata hosts.\n   * Default `false` — the SSRF guard is on (private hosts are denied).\n   */\n  allowPrivateHosts?: boolean;\n  /**\n   * Maximum response body size in bytes. A declared `content-length` over\n   * this fails fast; otherwise the body is read with a running cap and the\n   * stream is aborted on overflow. Default `52_428_800` (50 MiB).\n   */\n  maxBytes?: number;\n  /** Per-request timeout in milliseconds. Default `30_000`. */\n  timeoutMs?: number;\n  /**\n   * URL schemes permitted for the request, compared case-insensitively.\n   * Default `[\"https\", \"http\"]`.\n   */\n  allowedSchemes?: string[];\n  /**\n   * Injected `fetch` implementation (for tests or proxies). Defaults to the\n   * global `fetch`.\n   */\n  fetch?: typeof fetch;\n};\n\n/** {@link SafeFetchOptions} with every default resolved — never partial. */\ntype ResolvedFetchPolicy = {\n  allowPrivateHosts: boolean;\n  maxBytes: number;\n  timeoutMs: number;\n  allowedSchemes: string[];\n  fetch: typeof fetch;\n};\n\n/**\n * Fill a {@link SafeFetchOptions} with strict defaults: https+http,\n * private-IP deny on, 30s timeout, 50 MiB cap, global `fetch`.\n */\nfunction resolveFetchPolicy(options: SafeFetchOptions = {}): ResolvedFetchPolicy {\n  return {\n    allowPrivateHosts: options.allowPrivateHosts ?? false,\n    maxBytes: options.maxBytes ?? DEFAULT_MAX_BYTES,\n    timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n    allowedSchemes: options.allowedSchemes ?? [\"https\", \"http\"],\n    fetch: options.fetch ?? globalThis.fetch,\n  };\n}\n\n/** Parse a dotted-quad into four octets, or `null` if malformed. */\nfunction parseIpv4(ip: string): [number, number, number, number] | null {\n  const parts = ip.split(\".\");\n  if (parts.length !== 4) {\n    return null;\n  }\n\n  const octets = parts.map((part) => Number(part));\n  if (octets.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) {\n    return null;\n  }\n\n  return octets as [number, number, number, number];\n}\n\nfunction isPrivateIpv4(ip: string): boolean {\n  const octets = parseIpv4(ip);\n  if (!octets) {\n    return true; // unparseable → refuse, fail closed\n  }\n\n  const [a, b] = octets;\n\n  return (\n    a === 0 || // 0.0.0.0/8 \"this network\"\n    a === 10 || // 10.0.0.0/8 private\n    a === 127 || // 127.0.0.0/8 loopback\n    (a === 100 && b >= 64 && b <= 127) || // 100.64.0.0/10 CGNAT\n    (a === 169 && b === 254) || // 169.254.0.0/16 link-local + metadata\n    (a === 172 && b >= 16 && b <= 31) || // 172.16.0.0/12 private\n    (a === 192 && b === 168) || // 192.168.0.0/16 private\n    (a === 192 && b === 0) || // 192.0.0.0/24 + 192.0.2.0/24 (IETF/test)\n    (a === 198 && (b === 18 || b === 19)) || // 198.18.0.0/15 benchmarking\n    (a === 198 && b === 51) || // 198.51.100.0/24 test-net-2\n    (a === 203 && b === 0) || // 203.0.113.0/24 test-net-3\n    a >= 224 // 224.0.0.0/4 multicast + 240.0.0.0/4 reserved + 255.255.255.255\n  );\n}\n\nfunction isPrivateIpv6(ip: string): boolean {\n  const normalized = ip.toLowerCase().split(\"%\")[0]; // drop zone id\n\n  // EVERY fallback in this function returns `true`, and that direction is the\n  // whole point: this is an SSRF guard, and `true` means \"private — refuse\".\n  //\n  // `split` on a non-empty string always yields a first element, so none of\n  // these is reachable today. But the safe answer for an address we could not\n  // classify is to REFUSE it, not to let it through. A `?? \"\"` here would fall\n  // past every check below and return `false` — reporting an unparseable\n  // address as public, which is a fail-OPEN in the one function whose job is\n  // to keep requests off the internal network.\n  if (normalized === undefined) {\n    return true;\n  }\n\n  // IPv4-mapped / -embedded (::ffff:a.b.c.d, ::a.b.c.d) — defer to the v4\n  // check on the trailing dotted-quad so an inward-mapped address is caught.\n  const v4 = normalized.match(/(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})$/);\n  if (v4) {\n    const dottedQuad = v4[1];\n\n    // Capture group 1 exists whenever this pattern matched. Refusing rather\n    // than defaulting, for the reason above.\n    return dottedQuad === undefined ? true : isPrivateIpv4(dottedQuad);\n  }\n\n  if (normalized === \"::1\" || normalized === \"::\") {\n    return true; // loopback / unspecified\n  }\n\n  // Expand only the leading group enough to classify the reserved blocks.\n  const firstGroup = normalized.split(\":\")[0];\n\n  if (firstGroup === undefined) {\n    return true;\n  }\n\n  const head = firstGroup === \"\" ? 0 : Number.parseInt(firstGroup, 16);\n\n  // fc00::/7 unique-local (fc.. / fd..)\n  if ((head & 0xfe00) === 0xfc00) {\n    return true;\n  }\n  // fe80::/10 link-local\n  if ((head & 0xffc0) === 0xfe80) {\n    return true;\n  }\n\n  return false;\n}\n\n/**\n * True when `ip` is a private, loopback, link-local, unique-local,\n * carrier-grade-NAT, unspecified, or otherwise non-public address — the set\n * an SSRF guard must refuse. Accepts IPv4 and IPv6 literals (including\n * IPv4-mapped IPv6 like `::ffff:169.254.169.254`). A non-IP string returns\n * `false` (the caller resolves hostnames via DNS first).\n *\n * The cloud-metadata endpoint `169.254.169.254` is covered by the IPv4\n * link-local range `169.254.0.0/16`.\n */\nexport function isPrivateOrReservedIp(ip: string): boolean {\n  const family = isIP(ip);\n  if (family === 4) {\n    return isPrivateIpv4(ip);\n  }\n  if (family === 6) {\n    return isPrivateIpv6(ip);\n  }\n  return false;\n}\n\n/** Strip the `[ ]` IPv6 brackets `URL.hostname` keeps. */\nfunction stripBrackets(host: string): string {\n  return host.startsWith(\"[\") && host.endsWith(\"]\") ? host.slice(1, -1) : host;\n}\n\n/**\n * Reject when `host` is — or resolves to — a private / reserved address.\n * IP literals are checked directly; hostnames are resolved via DNS and every\n * returned address is checked (a public name pointing inward is caught). A\n * resolution failure fails closed.\n */\nasync function assertHostNotPrivate(host: string, rawUrl: string): Promise<void> {\n  if (isIP(host) !== 0) {\n    if (isPrivateOrReservedIp(host)) {\n      throw new StorageError(`outbound request blocked — \"${host}\" is a private/reserved address`, {\n        context: { url: rawUrl, address: host },\n      });\n    }\n    return;\n  }\n\n  let addresses: Array<{ address: string }>;\n  try {\n    addresses = await lookup(host, { all: true });\n  } catch (cause) {\n    throw new StorageError(\n      `outbound request blocked — could not resolve host \"${host}\" to verify it is public`,\n      { cause, context: { url: rawUrl, host } },\n    );\n  }\n\n  for (const { address } of addresses) {\n    if (isPrivateOrReservedIp(address)) {\n      throw new StorageError(\n        `outbound request blocked — host \"${host}\" resolves to a private/reserved address (${address})`,\n        { context: { url: rawUrl, host, address } },\n      );\n    }\n  }\n}\n\n/**\n * Validate a URL against the policy BEFORE any network call: scheme\n * allowlist and (when private hosts are not allowed) a DNS resolution that\n * rejects private / loopback / link-local / metadata addresses — the SSRF\n * guard. Returns the parsed `URL` on success; throws {@link StorageError}\n * otherwise.\n */\nasync function assertUrlAllowed(rawUrl: string, policy: ResolvedFetchPolicy): Promise<URL> {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new StorageError(`outbound request blocked — invalid URL: ${rawUrl}`, {\n      context: { url: rawUrl },\n    });\n  }\n\n  const scheme = url.protocol.replace(/:$/, \"\").toLowerCase();\n  if (!policy.allowedSchemes.some((s) => s.toLowerCase() === scheme)) {\n    throw new StorageError(\n      `outbound request blocked — scheme \"${scheme}\" is not allowed (allowed: ${policy.allowedSchemes.join(\", \")})`,\n      { context: { url: rawUrl, scheme } },\n    );\n  }\n\n  if (!policy.allowPrivateHosts) {\n    const host = stripBrackets(url.hostname);\n    await assertHostNotPrivate(host, rawUrl);\n  }\n\n  return url;\n}\n\n/**\n * Result of {@link safeFetchToBuffer}: the (capped) body plus the response's\n * content-type, so callers can derive a MIME type and enforce a non-empty\n * content-type check.\n */\nexport type SafeFetchResult = {\n  buffer: Buffer;\n  contentType: string | null;\n  status: number;\n  statusText: string;\n  ok: boolean;\n};\n\n/**\n * SSRF-guarded download: validates the URL (scheme allowlist + post-DNS\n * private-IP deny), performs the request with a timeout via\n * `AbortController`, then streams the body with a hard byte cap — aborting\n * the moment the running total exceeds `maxBytes`. A declared\n * `content-length` over the cap fails fast.\n *\n * Redirects are NEVER delegated to the platform: every hop is issued with\n * `redirect: \"manual\"` and its `Location` is re-run through\n * {@link assertUrlAllowed} — including the DNS-resolution private-IP check\n * — before being followed (capped at {@link DEFAULT_MAX_REDIRECTS}), so a\n * 3xx from an allowed host cannot smuggle the request to a private /\n * metadata target. Mirrors `@warlock.js/ai`'s `guardedFetch`\n * (ai/src/security/outbound-policy.ts:188-284); duplicated per this\n * module's file-header note since core cannot depend on ai.\n *\n * @throws {StorageError} On a blocked URL (initial or redirect target),\n * a redirect-hop bound overflow, timeout, or oversized body.\n */\nexport async function safeFetchToBuffer(\n  rawUrl: string,\n  options: SafeFetchOptions = {},\n): Promise<SafeFetchResult> {\n  const policy = resolveFetchPolicy(options);\n  let url = await assertUrlAllowed(rawUrl, policy);\n\n  const controller = new AbortController();\n  const timer = setTimeout(() => {\n    controller.abort(\n      new StorageError(`outbound request timed out after ${policy.timeoutMs}ms`, {\n        context: { url: rawUrl, timeoutMs: policy.timeoutMs },\n      }),\n    );\n  }, policy.timeoutMs);\n\n  try {\n    let response: Response;\n\n    for (let hop = 0; ; hop++) {\n      response = await policy.fetch(url, { signal: controller.signal, redirect: \"manual\" });\n\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        break;\n      }\n\n      if (hop >= DEFAULT_MAX_REDIRECTS) {\n        throw new StorageError(\n          `outbound request blocked — more than ${DEFAULT_MAX_REDIRECTS} redirects`,\n          { context: { url: rawUrl, maxRedirects: DEFAULT_MAX_REDIRECTS } },\n        );\n      }\n\n      let target: URL;\n      try {\n        target = new URL(location, url);\n      } catch {\n        throw new StorageError(\n          `outbound request blocked — invalid redirect Location: ${location}`,\n          {\n            context: { url: url.toString(), location },\n          },\n        );\n      }\n\n      // Discard the interim body so the connection can be reused.\n      if (response.body) {\n        await response.body.cancel().catch(() => undefined);\n      }\n\n      // The redirect target gets the SAME scheme + private-IP validation\n      // (incl. DNS resolution) as the initial URL — this is what closes\n      // the redirect-based SSRF bypass: a 302 from an allowed host to\n      // 169.254.169.254 is re-validated here, not blindly followed.\n      url = await assertUrlAllowed(target.toString(), policy);\n    }\n\n    const declared = Number(response.headers.get(\"content-length\"));\n    if (Number.isFinite(declared) && declared > policy.maxBytes) {\n      throw new StorageError(\n        `outbound response body too large — declared ${declared} bytes exceeds the ${policy.maxBytes}-byte cap`,\n        { context: { url: rawUrl, declared, maxBytes: policy.maxBytes } },\n      );\n    }\n\n    const buffer = await readBodyCapped(response, policy.maxBytes, rawUrl);\n\n    return {\n      buffer,\n      contentType: response.headers.get(\"content-type\"),\n      status: response.status,\n      statusText: response.statusText,\n      ok: response.ok,\n    };\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * Read a response body into a Buffer with a hard byte cap. The stream is\n * read chunk-by-chunk and cancelled the moment the running total exceeds\n * `maxBytes`. Throws {@link StorageError} on overflow.\n */\nasync function readBodyCapped(\n  response: Response,\n  maxBytes: number,\n  rawUrl: string,\n): Promise<Buffer> {\n  if (!response.body) {\n    const arrayBuffer = await response.arrayBuffer();\n    if (arrayBuffer.byteLength > maxBytes) {\n      throw new StorageError(`outbound response body exceeded the ${maxBytes}-byte cap`, {\n        context: { url: rawUrl, maxBytes },\n      });\n    }\n    return Buffer.from(arrayBuffer);\n  }\n\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) {\n      break;\n    }\n    if (!value) {\n      continue;\n    }\n\n    total += value.byteLength;\n    if (total > maxBytes) {\n      await reader.cancel();\n      throw new StorageError(`outbound response body exceeded the ${maxBytes}-byte cap`, {\n        context: { url: rawUrl, maxBytes },\n      });\n    }\n    chunks.push(value);\n  }\n\n  return Buffer.concat(chunks);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAeA,MAAM,oBAAoB,KAAK,OAAO;;AAEtC,MAAM,qBAAqB;;;;;;AAM3B,MAAM,wBAAwB;;AAG9B,MAAM,oBAAoB,IAAI,IAAI;CAAC;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC;;;;;AAgD3D,SAAS,mBAAmB,UAA4B,CAAC,GAAwB;CAC/E,OAAO;EACL,mBAAmB,QAAQ,qBAAqB;EAChD,UAAU,QAAQ,YAAY;EAC9B,WAAW,QAAQ,aAAa;EAChC,gBAAgB,QAAQ,kBAAkB,CAAC,SAAS,MAAM;EAC1D,OAAO,QAAQ,SAAS,WAAW;CACrC;AACF;;AAGA,SAAS,UAAU,IAAqD;CACtE,MAAM,QAAQ,GAAG,MAAM,GAAG;CAC1B,IAAI,MAAM,WAAW,GACnB,OAAO;CAGT,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,IAAI,CAAC;CAC/C,IAAI,OAAO,MAAM,MAAM,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,KAAK,IAAI,GAAG,GAC7D,OAAO;CAGT,OAAO;AACT;AAEA,SAAS,cAAc,IAAqB;CAC1C,MAAM,SAAS,UAAU,EAAE;CAC3B,IAAI,CAAC,QACH,OAAO;CAGT,MAAM,CAAC,GAAG,KAAK;CAEf,OACE,MAAM,KACN,MAAM,MACN,MAAM,OACL,MAAM,OAAO,KAAK,MAAM,KAAK,OAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,MAAM,KACnB,MAAM,QAAQ,MAAM,MAAM,MAAM,OAChC,MAAM,OAAO,MAAM,MACnB,MAAM,OAAO,MAAM,KACpB,KAAK;AAET;AAEA,SAAS,cAAc,IAAqB;CAC1C,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;CAW/C,IAAI,eAAe,QACjB,OAAO;CAKT,MAAM,KAAK,WAAW,MAAM,uCAAuC;CACnE,IAAI,IAAI;EACN,MAAM,aAAa,GAAG;EAItB,OAAO,eAAe,SAAY,OAAO,cAAc,UAAU;CACnE;CAEA,IAAI,eAAe,SAAS,eAAe,MACzC,OAAO;CAIT,MAAM,aAAa,WAAW,MAAM,GAAG,CAAC,CAAC;CAEzC,IAAI,eAAe,QACjB,OAAO;CAGT,MAAM,OAAO,eAAe,KAAK,IAAI,OAAO,SAAS,YAAY,EAAE;CAGnE,KAAK,OAAO,WAAY,OACtB,OAAO;CAGT,KAAK,OAAO,WAAY,OACtB,OAAO;CAGT,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,sBAAsB,IAAqB;CACzD,MAAM,SAAS,KAAK,EAAE;CACtB,IAAI,WAAW,GACb,OAAO,cAAc,EAAE;CAEzB,IAAI,WAAW,GACb,OAAO,cAAc,EAAE;CAEzB,OAAO;AACT;;AAGA,SAAS,cAAc,MAAsB;CAC3C,OAAO,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI;AAC1E;;;;;;;AAQA,eAAe,qBAAqB,MAAc,QAA+B;CAC/E,IAAI,KAAK,IAAI,MAAM,GAAG;EACpB,IAAI,sBAAsB,IAAI,GAC5B,MAAM,IAAI,aAAa,+BAA+B,KAAK,kCAAkC,EAC3F,SAAS;GAAE,KAAK;GAAQ,SAAS;EAAK,EACxC,CAAC;EAEH;CACF;CAEA,IAAI;CACJ,IAAI;EACF,YAAY,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;CAC9C,SAAS,OAAO;EACd,MAAM,IAAI,aACR,sDAAsD,KAAK,2BAC3D;GAAE;GAAO,SAAS;IAAE,KAAK;IAAQ;GAAK;EAAE,CAC1C;CACF;CAEA,KAAK,MAAM,EAAE,aAAa,WACxB,IAAI,sBAAsB,OAAO,GAC/B,MAAM,IAAI,aACR,oCAAoC,KAAK,4CAA4C,QAAQ,IAC7F,EAAE,SAAS;EAAE,KAAK;EAAQ;EAAM;CAAQ,EAAE,CAC5C;AAGN;;;;;;;;AASA,eAAe,iBAAiB,QAAgB,QAA2C;CACzF,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,MAAM;CACtB,QAAQ;EACN,MAAM,IAAI,aAAa,2CAA2C,UAAU,EAC1E,SAAS,EAAE,KAAK,OAAO,EACzB,CAAC;CACH;CAEA,MAAM,SAAS,IAAI,SAAS,QAAQ,MAAM,EAAE,CAAC,CAAC,YAAY;CAC1D,IAAI,CAAC,OAAO,eAAe,MAAM,MAAM,EAAE,YAAY,MAAM,MAAM,GAC/D,MAAM,IAAI,aACR,sCAAsC,OAAO,6BAA6B,OAAO,eAAe,KAAK,IAAI,EAAE,IAC3G,EAAE,SAAS;EAAE,KAAK;EAAQ;CAAO,EAAE,CACrC;CAGF,IAAI,CAAC,OAAO,mBAEV,MAAM,qBADO,cAAc,IAAI,QACD,GAAG,MAAM;CAGzC,OAAO;AACT;;;;;;;;;;;;;;;;;;;;AAkCA,eAAsB,kBACpB,QACA,UAA4B,CAAC,GACH;CAC1B,MAAM,SAAS,mBAAmB,OAAO;CACzC,IAAI,MAAM,MAAM,iBAAiB,QAAQ,MAAM;CAE/C,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,QAAQ,iBAAiB;EAC7B,WAAW,MACT,IAAI,aAAa,oCAAoC,OAAO,UAAU,KAAK,EACzE,SAAS;GAAE,KAAK;GAAQ,WAAW,OAAO;EAAU,EACtD,CAAC,CACH;CACF,GAAG,OAAO,SAAS;CAEnB,IAAI;EACF,IAAI;EAEJ,KAAK,IAAI,MAAM,IAAK,OAAO;GACzB,WAAW,MAAM,OAAO,MAAM,KAAK;IAAE,QAAQ,WAAW;IAAQ,UAAU;GAAS,CAAC;GAEpF,MAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;GAChD,IAAI,CAAC,kBAAkB,IAAI,SAAS,MAAM,KAAK,aAAa,MAC1D;GAGF,IAAI,OAAO,uBACT,MAAM,IAAI,aACR,wCAAwC,sBAAsB,aAC9D,EAAE,SAAS;IAAE,KAAK;IAAQ,cAAc;GAAsB,EAAE,CAClE;GAGF,IAAI;GACJ,IAAI;IACF,SAAS,IAAI,IAAI,UAAU,GAAG;GAChC,QAAQ;IACN,MAAM,IAAI,aACR,yDAAyD,YACzD,EACE,SAAS;KAAE,KAAK,IAAI,SAAS;KAAG;IAAS,EAC3C,CACF;GACF;GAGA,IAAI,SAAS,MACX,MAAM,SAAS,KAAK,OAAO,CAAC,CAAC,YAAY,MAAS;GAOpD,MAAM,MAAM,iBAAiB,OAAO,SAAS,GAAG,MAAM;EACxD;EAEA,MAAM,WAAW,OAAO,SAAS,QAAQ,IAAI,gBAAgB,CAAC;EAC9D,IAAI,OAAO,SAAS,QAAQ,KAAK,WAAW,OAAO,UACjD,MAAM,IAAI,aACR,+CAA+C,SAAS,qBAAqB,OAAO,SAAS,YAC7F,EAAE,SAAS;GAAE,KAAK;GAAQ;GAAU,UAAU,OAAO;EAAS,EAAE,CAClE;EAKF,OAAO;GACL,cAHmB,eAAe,UAAU,OAAO,UAAU,MAAM;GAInE,aAAa,SAAS,QAAQ,IAAI,cAAc;GAChD,QAAQ,SAAS;GACjB,YAAY,SAAS;GACrB,IAAI,SAAS;EACf;CACF,UAAU;EACR,aAAa,KAAK;CACpB;AACF;;;;;;AAOA,eAAe,eACb,UACA,UACA,QACiB;CACjB,IAAI,CAAC,SAAS,MAAM;EAClB,MAAM,cAAc,MAAM,SAAS,YAAY;EAC/C,IAAI,YAAY,aAAa,UAC3B,MAAM,IAAI,aAAa,uCAAuC,SAAS,YAAY,EACjF,SAAS;GAAE,KAAK;GAAQ;EAAS,EACnC,CAAC;EAEH,OAAO,OAAO,KAAK,WAAW;CAChC;CAEA,MAAM,SAAS,SAAS,KAAK,UAAU;CACvC,MAAM,SAAuB,CAAC;CAC9B,IAAI,QAAQ;CAEZ,SAAS;EACP,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;EAC1C,IAAI,MACF;EAEF,IAAI,CAAC,OACH;EAGF,SAAS,MAAM;EACf,IAAI,QAAQ,UAAU;GACpB,MAAM,OAAO,OAAO;GACpB,MAAM,IAAI,aAAa,uCAAuC,SAAS,YAAY,EACjF,SAAS;IAAE,KAAK;IAAQ;GAAS,EACnC,CAAC;EACH;EACA,OAAO,KAAK,KAAK;CACnB;CAEA,OAAO,OAAO,OAAO,MAAM;AAC7B"}
+{"version":3,"file":"safe-fetch.mjs","names":[],"sources":["../../../../../../../../core/src/storage/utils/safe-fetch.ts"],"sourcesContent":["import { lookup } from \"node:dns/promises\";\nimport { isIP } from \"node:net\";\nimport { isPrivateOrReservedIp } from \"./classify-ip-address\";\nimport { StorageError } from \"./storage-error\";\n\n/**\n * SSRF / resource-exhaustion guard for storage's outbound downloads\n * (`putFromUrl`).\n *\n * NOTE: this MIRRORS `@warlock.js/ai`'s `src/security/private-ip.ts` and\n * `src/security/outbound-policy.ts`. It is duplicated here intentionally\n * because `@warlock.js/core` cannot depend on `@warlock.js/ai`. Pending\n * extraction of a shared security package, keep the two copies in sync.\n */\n\n/** 50 MiB — default cap on a downloaded body (storage files run larger than AI payloads). */\nconst DEFAULT_MAX_BYTES = 50 * 1024 * 1024;\n/** 30s — default per-request timeout. */\nconst DEFAULT_TIMEOUT_MS = 30_000;\n/**\n * Cap on the number of re-validated redirect hops. Mirrors\n * `@warlock.js/ai`'s `DEFAULT_MAX_REDIRECTS`\n * (ai/src/security/outbound-policy.ts:15).\n */\nconst DEFAULT_MAX_REDIRECTS = 5;\n\n/** 3xx statuses whose `Location` a follow re-issues — mirrors ai/src/security/outbound-policy.ts:18. */\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/**\n * Options controlling a guarded outbound fetch. Every field is optional;\n * {@link resolveFetchPolicy} fills safe defaults. The defaults are\n * deliberately strict (https+http, private-IP deny ON, 30s timeout,\n * 50 MiB cap) so a caller that does not tune them still gets a hardened\n * request.\n */\nexport type SafeFetchOptions = {\n  /**\n   * Whether to ALLOW private / loopback / link-local / metadata hosts.\n   * Default `false` — the SSRF guard is on (private hosts are denied).\n   */\n  allowPrivateHosts?: boolean;\n  /**\n   * Maximum response body size in bytes. A declared `content-length` over\n   * this fails fast; otherwise the body is read with a running cap and the\n   * stream is aborted on overflow. Default `52_428_800` (50 MiB).\n   */\n  maxBytes?: number;\n  /** Per-request timeout in milliseconds. Default `30_000`. */\n  timeoutMs?: number;\n  /**\n   * URL schemes permitted for the request, compared case-insensitively.\n   * Default `[\"https\", \"http\"]`.\n   */\n  allowedSchemes?: string[];\n  /**\n   * Injected `fetch` implementation (for tests or proxies). Defaults to the\n   * global `fetch`.\n   */\n  fetch?: typeof fetch;\n};\n\n/** {@link SafeFetchOptions} with every default resolved — never partial. */\ntype ResolvedFetchPolicy = {\n  allowPrivateHosts: boolean;\n  maxBytes: number;\n  timeoutMs: number;\n  allowedSchemes: string[];\n  fetch: typeof fetch;\n};\n\n/**\n * Fill a {@link SafeFetchOptions} with strict defaults: https+http,\n * private-IP deny on, 30s timeout, 50 MiB cap, global `fetch`.\n */\nfunction resolveFetchPolicy(options: SafeFetchOptions = {}): ResolvedFetchPolicy {\n  return {\n    allowPrivateHosts: options.allowPrivateHosts ?? false,\n    maxBytes: options.maxBytes ?? DEFAULT_MAX_BYTES,\n    timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n    allowedSchemes: options.allowedSchemes ?? [\"https\", \"http\"],\n    fetch: options.fetch ?? globalThis.fetch,\n  };\n}\n\nexport { isPrivateOrReservedIp };\n\n/** Strip the `[ ]` IPv6 brackets `URL.hostname` keeps. */\nfunction stripBrackets(host: string): string {\n  return host.startsWith(\"[\") && host.endsWith(\"]\") ? host.slice(1, -1) : host;\n}\n\n/**\n * Reject when `host` is — or resolves to — a private / reserved address.\n * IP literals are checked directly; hostnames are resolved via DNS and every\n * returned address is checked (a public name pointing inward is caught). A\n * resolution failure fails closed.\n */\nasync function assertHostNotPrivate(host: string, rawUrl: string): Promise<void> {\n  if (isIP(host) !== 0) {\n    if (isPrivateOrReservedIp(host)) {\n      throw new StorageError(`outbound request blocked — \"${host}\" is a private/reserved address`, {\n        context: { url: rawUrl, address: host },\n      });\n    }\n    return;\n  }\n\n  let addresses: Array<{ address: string }>;\n  try {\n    addresses = await lookup(host, { all: true });\n  } catch (cause) {\n    throw new StorageError(\n      `outbound request blocked — could not resolve host \"${host}\" to verify it is public`,\n      { cause, context: { url: rawUrl, host } },\n    );\n  }\n\n  for (const { address } of addresses) {\n    if (isPrivateOrReservedIp(address)) {\n      throw new StorageError(\n        `outbound request blocked — host \"${host}\" resolves to a private/reserved address (${address})`,\n        { context: { url: rawUrl, host, address } },\n      );\n    }\n  }\n}\n\n/**\n * Validate a URL against the policy BEFORE any network call: scheme\n * allowlist and (when private hosts are not allowed) a DNS resolution that\n * rejects private / loopback / link-local / metadata addresses — the SSRF\n * guard. Returns the parsed `URL` on success; throws {@link StorageError}\n * otherwise.\n */\nasync function assertUrlAllowed(rawUrl: string, policy: ResolvedFetchPolicy): Promise<URL> {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new StorageError(`outbound request blocked — invalid URL: ${rawUrl}`, {\n      context: { url: rawUrl },\n    });\n  }\n\n  const scheme = url.protocol.replace(/:$/, \"\").toLowerCase();\n  if (!policy.allowedSchemes.some((s) => s.toLowerCase() === scheme)) {\n    throw new StorageError(\n      `outbound request blocked — scheme \"${scheme}\" is not allowed (allowed: ${policy.allowedSchemes.join(\", \")})`,\n      { context: { url: rawUrl, scheme } },\n    );\n  }\n\n  if (!policy.allowPrivateHosts) {\n    const host = stripBrackets(url.hostname);\n    await assertHostNotPrivate(host, rawUrl);\n  }\n\n  return url;\n}\n\n/**\n * Result of {@link safeFetchToBuffer}: the (capped) body plus the response's\n * content-type, so callers can derive a MIME type and enforce a non-empty\n * content-type check.\n */\nexport type SafeFetchResult = {\n  buffer: Buffer;\n  contentType: string | null;\n  status: number;\n  statusText: string;\n  ok: boolean;\n};\n\n/**\n * SSRF-guarded download: validates the URL (scheme allowlist + post-DNS\n * private-IP deny), performs the request with a timeout via\n * `AbortController`, then streams the body with a hard byte cap — aborting\n * the moment the running total exceeds `maxBytes`. A declared\n * `content-length` over the cap fails fast.\n *\n * Redirects are NEVER delegated to the platform: every hop is issued with\n * `redirect: \"manual\"` and its `Location` is re-run through\n * {@link assertUrlAllowed} — including the DNS-resolution private-IP check\n * — before being followed (capped at {@link DEFAULT_MAX_REDIRECTS}), so a\n * 3xx from an allowed host cannot smuggle the request to a private /\n * metadata target. Mirrors `@warlock.js/ai`'s `guardedFetch`\n * (ai/src/security/outbound-policy.ts:188-284); duplicated per this\n * module's file-header note since core cannot depend on ai.\n *\n * @throws {StorageError} On a blocked URL (initial or redirect target),\n * a redirect-hop bound overflow, timeout, or oversized body.\n */\nexport async function safeFetchToBuffer(\n  rawUrl: string,\n  options: SafeFetchOptions = {},\n): Promise<SafeFetchResult> {\n  const policy = resolveFetchPolicy(options);\n  let url = await assertUrlAllowed(rawUrl, policy);\n\n  const controller = new AbortController();\n  const timer = setTimeout(() => {\n    controller.abort(\n      new StorageError(`outbound request timed out after ${policy.timeoutMs}ms`, {\n        context: { url: rawUrl, timeoutMs: policy.timeoutMs },\n      }),\n    );\n  }, policy.timeoutMs);\n\n  try {\n    let response: Response;\n\n    for (let hop = 0; ; hop++) {\n      response = await policy.fetch(url, { signal: controller.signal, redirect: \"manual\" });\n\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        break;\n      }\n\n      if (hop >= DEFAULT_MAX_REDIRECTS) {\n        throw new StorageError(\n          `outbound request blocked — more than ${DEFAULT_MAX_REDIRECTS} redirects`,\n          { context: { url: rawUrl, maxRedirects: DEFAULT_MAX_REDIRECTS } },\n        );\n      }\n\n      let target: URL;\n      try {\n        target = new URL(location, url);\n      } catch {\n        throw new StorageError(\n          `outbound request blocked — invalid redirect Location: ${location}`,\n          {\n            context: { url: url.toString(), location },\n          },\n        );\n      }\n\n      // Discard the interim body so the connection can be reused.\n      if (response.body) {\n        await response.body.cancel().catch(() => undefined);\n      }\n\n      // The redirect target gets the SAME scheme + private-IP validation\n      // (incl. DNS resolution) as the initial URL — this is what closes\n      // the redirect-based SSRF bypass: a 302 from an allowed host to\n      // 169.254.169.254 is re-validated here, not blindly followed.\n      url = await assertUrlAllowed(target.toString(), policy);\n    }\n\n    const declared = Number(response.headers.get(\"content-length\"));\n    if (Number.isFinite(declared) && declared > policy.maxBytes) {\n      throw new StorageError(\n        `outbound response body too large — declared ${declared} bytes exceeds the ${policy.maxBytes}-byte cap`,\n        { context: { url: rawUrl, declared, maxBytes: policy.maxBytes } },\n      );\n    }\n\n    const buffer = await readBodyCapped(response, policy.maxBytes, rawUrl);\n\n    return {\n      buffer,\n      contentType: response.headers.get(\"content-type\"),\n      status: response.status,\n      statusText: response.statusText,\n      ok: response.ok,\n    };\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * Read a response body into a Buffer with a hard byte cap. The stream is\n * read chunk-by-chunk and cancelled the moment the running total exceeds\n * `maxBytes`. Throws {@link StorageError} on overflow.\n */\nasync function readBodyCapped(\n  response: Response,\n  maxBytes: number,\n  rawUrl: string,\n): Promise<Buffer> {\n  if (!response.body) {\n    const arrayBuffer = await response.arrayBuffer();\n    if (arrayBuffer.byteLength > maxBytes) {\n      throw new StorageError(`outbound response body exceeded the ${maxBytes}-byte cap`, {\n        context: { url: rawUrl, maxBytes },\n      });\n    }\n    return Buffer.from(arrayBuffer);\n  }\n\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) {\n      break;\n    }\n    if (!value) {\n      continue;\n    }\n\n    total += value.byteLength;\n    if (total > maxBytes) {\n      await reader.cancel();\n      throw new StorageError(`outbound response body exceeded the ${maxBytes}-byte cap`, {\n        context: { url: rawUrl, maxBytes },\n      });\n    }\n    chunks.push(value);\n  }\n\n  return Buffer.concat(chunks);\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAM,oBAAoB,KAAK,OAAO;;AAEtC,MAAM,qBAAqB;;;;;;AAM3B,MAAM,wBAAwB;;AAG9B,MAAM,oBAAoB,IAAI,IAAI;CAAC;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC;;;;;AAgD3D,SAAS,mBAAmB,UAA4B,CAAC,GAAwB;CAC/E,OAAO;EACL,mBAAmB,QAAQ,qBAAqB;EAChD,UAAU,QAAQ,YAAY;EAC9B,WAAW,QAAQ,aAAa;EAChC,gBAAgB,QAAQ,kBAAkB,CAAC,SAAS,MAAM;EAC1D,OAAO,QAAQ,SAAS,WAAW;CACrC;AACF;;AAKA,SAAS,cAAc,MAAsB;CAC3C,OAAO,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI;AAC1E;;;;;;;AAQA,eAAe,qBAAqB,MAAc,QAA+B;CAC/E,IAAI,KAAK,IAAI,MAAM,GAAG;EACpB,IAAI,sBAAsB,IAAI,GAC5B,MAAM,IAAI,aAAa,+BAA+B,KAAK,kCAAkC,EAC3F,SAAS;GAAE,KAAK;GAAQ,SAAS;EAAK,EACxC,CAAC;EAEH;CACF;CAEA,IAAI;CACJ,IAAI;EACF,YAAY,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;CAC9C,SAAS,OAAO;EACd,MAAM,IAAI,aACR,sDAAsD,KAAK,2BAC3D;GAAE;GAAO,SAAS;IAAE,KAAK;IAAQ;GAAK;EAAE,CAC1C;CACF;CAEA,KAAK,MAAM,EAAE,aAAa,WACxB,IAAI,sBAAsB,OAAO,GAC/B,MAAM,IAAI,aACR,oCAAoC,KAAK,4CAA4C,QAAQ,IAC7F,EAAE,SAAS;EAAE,KAAK;EAAQ;EAAM;CAAQ,EAAE,CAC5C;AAGN;;;;;;;;AASA,eAAe,iBAAiB,QAAgB,QAA2C;CACzF,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,MAAM;CACtB,QAAQ;EACN,MAAM,IAAI,aAAa,2CAA2C,UAAU,EAC1E,SAAS,EAAE,KAAK,OAAO,EACzB,CAAC;CACH;CAEA,MAAM,SAAS,IAAI,SAAS,QAAQ,MAAM,EAAE,CAAC,CAAC,YAAY;CAC1D,IAAI,CAAC,OAAO,eAAe,MAAM,MAAM,EAAE,YAAY,MAAM,MAAM,GAC/D,MAAM,IAAI,aACR,sCAAsC,OAAO,6BAA6B,OAAO,eAAe,KAAK,IAAI,EAAE,IAC3G,EAAE,SAAS;EAAE,KAAK;EAAQ;CAAO,EAAE,CACrC;CAGF,IAAI,CAAC,OAAO,mBAEV,MAAM,qBADO,cAAc,IAAI,QACD,GAAG,MAAM;CAGzC,OAAO;AACT;;;;;;;;;;;;;;;;;;;;AAkCA,eAAsB,kBACpB,QACA,UAA4B,CAAC,GACH;CAC1B,MAAM,SAAS,mBAAmB,OAAO;CACzC,IAAI,MAAM,MAAM,iBAAiB,QAAQ,MAAM;CAE/C,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,QAAQ,iBAAiB;EAC7B,WAAW,MACT,IAAI,aAAa,oCAAoC,OAAO,UAAU,KAAK,EACzE,SAAS;GAAE,KAAK;GAAQ,WAAW,OAAO;EAAU,EACtD,CAAC,CACH;CACF,GAAG,OAAO,SAAS;CAEnB,IAAI;EACF,IAAI;EAEJ,KAAK,IAAI,MAAM,IAAK,OAAO;GACzB,WAAW,MAAM,OAAO,MAAM,KAAK;IAAE,QAAQ,WAAW;IAAQ,UAAU;GAAS,CAAC;GAEpF,MAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;GAChD,IAAI,CAAC,kBAAkB,IAAI,SAAS,MAAM,KAAK,aAAa,MAC1D;GAGF,IAAI,OAAO,uBACT,MAAM,IAAI,aACR,wCAAwC,sBAAsB,aAC9D,EAAE,SAAS;IAAE,KAAK;IAAQ,cAAc;GAAsB,EAAE,CAClE;GAGF,IAAI;GACJ,IAAI;IACF,SAAS,IAAI,IAAI,UAAU,GAAG;GAChC,QAAQ;IACN,MAAM,IAAI,aACR,yDAAyD,YACzD,EACE,SAAS;KAAE,KAAK,IAAI,SAAS;KAAG;IAAS,EAC3C,CACF;GACF;GAGA,IAAI,SAAS,MACX,MAAM,SAAS,KAAK,OAAO,CAAC,CAAC,YAAY,MAAS;GAOpD,MAAM,MAAM,iBAAiB,OAAO,SAAS,GAAG,MAAM;EACxD;EAEA,MAAM,WAAW,OAAO,SAAS,QAAQ,IAAI,gBAAgB,CAAC;EAC9D,IAAI,OAAO,SAAS,QAAQ,KAAK,WAAW,OAAO,UACjD,MAAM,IAAI,aACR,+CAA+C,SAAS,qBAAqB,OAAO,SAAS,YAC7F,EAAE,SAAS;GAAE,KAAK;GAAQ;GAAU,UAAU,OAAO;EAAS,EAAE,CAClE;EAKF,OAAO;GACL,cAHmB,eAAe,UAAU,OAAO,UAAU,MAAM;GAInE,aAAa,SAAS,QAAQ,IAAI,cAAc;GAChD,QAAQ,SAAS;GACjB,YAAY,SAAS;GACrB,IAAI,SAAS;EACf;CACF,UAAU;EACR,aAAa,KAAK;CACpB;AACF;;;;;;AAOA,eAAe,eACb,UACA,UACA,QACiB;CACjB,IAAI,CAAC,SAAS,MAAM;EAClB,MAAM,cAAc,MAAM,SAAS,YAAY;EAC/C,IAAI,YAAY,aAAa,UAC3B,MAAM,IAAI,aAAa,uCAAuC,SAAS,YAAY,EACjF,SAAS;GAAE,KAAK;GAAQ;EAAS,EACnC,CAAC;EAEH,OAAO,OAAO,KAAK,WAAW;CAChC;CAEA,MAAM,SAAS,SAAS,KAAK,UAAU;CACvC,MAAM,SAAuB,CAAC;CAC9B,IAAI,QAAQ;CAEZ,SAAS;EACP,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;EAC1C,IAAI,MACF;EAEF,IAAI,CAAC,OACH;EAGF,SAAS,MAAM;EACf,IAAI,QAAQ,UAAU;GACpB,MAAM,OAAO,OAAO;GACpB,MAAM,IAAI,aAAa,uCAAuC,SAAS,YAAY,EACjF,SAAS;IAAE,KAAK;IAAQ;GAAS,EACnC,CAAC;EACH;EACA,OAAO,KAAK,KAAK;CACnB;CAEA,OAAO,OAAO,OAAO,MAAM;AAC7B"}

package/esm/updater/update-warlock-packages.mjs

@@ -54,6 +54,14 @@ async function updateWarlockPackages(options = {}) {
 			updates: []
 		};
 	}
+	const failedLookups = resolved.filter((dependency) => !dependency.latest);
+	if (failedLookups.length > 0) {
+		console.log(`${colors.yellow("⚠")} Could not look up ${failedLookups.map((dependency) => dependency.name).join(", ")} — no versions were changed, to keep @warlock.js packages in lockstep. Try again.`);
+		return {
+			outcome: "registry-unreachable",
+			updates: []
+		};
+	}
 	const updates = resolvePackageUpdates(resolved);
 	if (updates.length === 0) {
 		console.log(`${colors.green("✓")} All @warlock.js packages are already up to date.`);
@@ -154,9 +162,11 @@ function resolvePackageUpdates(resolved) {
 function parseSpec(spec) {
 	const match = spec.trim().match(/^(\^|~)?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/);
 	if (!match) return;
+	const version = match[2];
+	if (version === void 0) return;
 	return {
 		operator: match[1] ?? "",
-		version: match[2]
+		version
 	};
 }
 /** Write the resolved bumps back into the package.json object in place. */

package/esm/updater/update-warlock-packages.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"update-warlock-packages.mjs","names":[],"sources":["../../../../../../../core/src/updater/update-warlock-packages.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { fileExistsAsync, getJsonFileAsync, putJsonFileAsync } from \"@warlock.js/fs\";\nimport { execSync } from \"node:child_process\";\nimport { rootPath } from \"../utils\";\nimport { fetchLatestVersion } from \"../utils/npm-registry\";\nimport { isNewerVersion } from \"../utils/version-compare\";\nimport { detectPackageManager, getInstallCommand } from \"./package-manager\";\n\n/** Scope prefix that identifies a Warlock framework package. */\nconst WARLOCK_SCOPE = \"@warlock.js/\";\n\n/** The dependency maps in package.json we update, in display order. */\nconst DEPENDENCY_SECTIONS = [\"dependencies\", \"devDependencies\"] as const;\n\ntype DependencySection = (typeof DEPENDENCY_SECTIONS)[number];\n\ntype DependencyMap = Record<string, string>;\n\ntype PackageJson = Record<string, unknown> & {\n  dependencies?: DependencyMap;\n  devDependencies?: DependencyMap;\n};\n\n/** A `@warlock.js/*` dependency found in package.json. */\ntype WarlockDependency = {\n  name: string;\n  section: DependencySection;\n  /** The current spec exactly as written, e.g. `^4.2.0`. */\n  current: string;\n};\n\n/** A dependency whose latest version has been resolved from the registry. */\nexport type ResolvedDependency = WarlockDependency & {\n  /** Latest version from npm, or `undefined` when the lookup failed. */\n  latest: string | undefined;\n};\n\n/** A concrete version bump to write back into package.json. */\nexport type PackageUpdate = {\n  name: string;\n  section: DependencySection;\n  /** Existing spec, e.g. `^4.2.0`. */\n  from: string;\n  /** New spec with the original range operator preserved, e.g. `^4.3.0`. */\n  to: string;\n};\n\n/** Options accepted by {@link updateWarlockPackages}. */\nexport type UpdateWarlockPackagesOptions = {\n  /** Run the package manager install after rewriting versions (default true). */\n  install?: boolean;\n  /**\n   * Report what would change without touching package.json or node_modules.\n   * Resolves with the `outdated` outcome instead of `updated`.\n   */\n  dryRun?: boolean;\n};\n\n/**\n * How an update run ended. Callers branch on this instead of re-deriving the\n * situation from the printed output — the dev-server `u` shortcut needs to\n * know whether restarting is warranted, and whether it may offer a retry.\n */\nexport type UpdateOutcome =\n  /** No package.json at the project root — nothing to do. */\n  | \"no-package-json\"\n  /** package.json carries no `@warlock.js/*` dependency. */\n  | \"no-packages\"\n  /** Every registry lookup failed — offline, DNS down, or npm unreachable. */\n  | \"registry-unreachable\"\n  /** Every package is already at (or ahead of) its latest published version. */\n  | \"up-to-date\"\n  /** Newer versions exist, and a dry run left everything untouched. */\n  | \"outdated\"\n  /** Versions were rewritten (and installed, unless `install: false`). */\n  | \"updated\"\n  /** Versions were rewritten but the package manager install failed. */\n  | \"install-failed\";\n\n/** The result of an update run. */\nexport type UpdateWarlockPackagesResult = {\n  outcome: UpdateOutcome;\n  /** The bumps written to package.json — empty unless `outcome` wrote any. */\n  updates: PackageUpdate[];\n  /** The install failure, present only for `install-failed`. */\n  error?: Error;\n};\n\n/**\n * Update every `@warlock.js/*` package listed in the project's root\n * package.json to its latest published version, then reconcile `node_modules`\n * via the detected package manager.\n *\n * The original range operator on each dependency (`^`, `~`, or an exact pin)\n * is preserved; specs that aren't a plain semver — `workspace:*`, `*`,\n * `latest`, git/file URLs — are left untouched. Only genuine upgrades are\n * written, so re-running on an already-current project is a no-op.\n *\n * Resolves rather than throws on the two failures a caller is expected to\n * survive — an unreachable registry and a failed install — so the dev-server\n * shortcut can report them and keep serving.\n */\nexport async function updateWarlockPackages(\n  options: UpdateWarlockPackagesOptions = {},\n): Promise<UpdateWarlockPackagesResult> {\n  const runInstall = options.install ?? true;\n  const packageJsonPath = rootPath(\"package.json\");\n\n  if (!(await fileExistsAsync(packageJsonPath))) {\n    console.log(`${colors.red(\"✖\")} No package.json found at the project root.`);\n    return { outcome: \"no-package-json\", updates: [] };\n  }\n\n  const packageJson = (await getJsonFileAsync(packageJsonPath)) as PackageJson;\n  const dependencies = collectWarlockDependencies(packageJson);\n\n  if (dependencies.length === 0) {\n    console.log(`${colors.yellow(\"⚠\")} No @warlock.js packages found in package.json.`);\n    return { outcome: \"no-packages\", updates: [] };\n  }\n\n  console.log(\n    `${colors.cyan(\"›\")} Checking ${colors.bold(String(dependencies.length))} ` +\n      `@warlock.js package(s) for updates…`,\n  );\n\n  const resolved = await resolveLatestVersions(dependencies);\n\n  // Distinguish \"nothing newer\" from \"we never got an answer\". Without this,\n  // an offline run reports every package as up to date, which is a lie.\n  if (isRegistryUnreachable(resolved)) {\n    console.log(\n      `${colors.yellow(\"⚠\")} Could not reach the npm registry — ` +\n        `no versions were changed. Check your connection and try again.`,\n    );\n    return { outcome: \"registry-unreachable\", updates: [] };\n  }\n\n  const updates = resolvePackageUpdates(resolved);\n\n  if (updates.length === 0) {\n    console.log(`${colors.green(\"✓\")} All @warlock.js packages are already up to date.`);\n    return { outcome: \"up-to-date\", updates: [] };\n  }\n\n  if (options.dryRun) {\n    printUpdates(updates, { pending: true });\n    return { outcome: \"outdated\", updates };\n  }\n\n  applyUpdates(packageJson, updates);\n  await putJsonFileAsync(packageJsonPath, packageJson);\n\n  printUpdates(updates);\n\n  if (!runInstall) {\n    console.log(\n      colors.dim(\"Skipped install (--no-install). Run your package manager to apply the changes.\"),\n    );\n    return { outcome: \"updated\", updates };\n  }\n\n  try {\n    await installDependencies();\n  } catch (error) {\n    console.log(\n      `${colors.red(\"✖\")} The install failed. package.json is already updated — ` +\n        `re-run your package manager install to finish.`,\n    );\n    return { outcome: \"install-failed\", updates, error: error as Error };\n  }\n\n  return { outcome: \"updated\", updates };\n}\n\n/**\n * Whether *every* lookup came back empty, which in practice means the\n * registry was never reached. A single failed package (unpublished, renamed,\n * private) leaves the rest resolvable and is not treated as an outage.\n */\nexport function isRegistryUnreachable(resolved: ResolvedDependency[]): boolean {\n  return resolved.length > 0 && resolved.every((dependency) => !dependency.latest);\n}\n\n/** Collect every `@warlock.js/*` dependency across the relevant sections. */\nfunction collectWarlockDependencies(packageJson: PackageJson): WarlockDependency[] {\n  const dependencies: WarlockDependency[] = [];\n\n  for (const section of DEPENDENCY_SECTIONS) {\n    const map = packageJson[section];\n\n    if (!map) {\n      continue;\n    }\n\n    for (const [name, current] of Object.entries(map)) {\n      if (name.startsWith(WARLOCK_SCOPE)) {\n        dependencies.push({ name, section, current });\n      }\n    }\n  }\n\n  return dependencies;\n}\n\n/** Resolve each dependency's latest version from the registry in parallel. */\nasync function resolveLatestVersions(\n  dependencies: WarlockDependency[],\n): Promise<ResolvedDependency[]> {\n  return Promise.all(\n    dependencies.map(async (dependency) => ({\n      ...dependency,\n      latest: await fetchLatestVersion(dependency.name),\n    })),\n  );\n}\n\n/**\n * Turn resolved dependencies into the concrete set of version bumps to write.\n * Pure (no I/O) so it can be unit-tested directly: skips lookups that failed,\n * non-semver specs, and anything already at (or ahead of) the latest version,\n * and preserves the original range operator on everything it does rewrite.\n */\nexport function resolvePackageUpdates(resolved: ResolvedDependency[]): PackageUpdate[] {\n  const updates: PackageUpdate[] = [];\n\n  for (const dependency of resolved) {\n    if (!dependency.latest) {\n      continue;\n    }\n\n    const parsed = parseSpec(dependency.current);\n\n    if (!parsed) {\n      continue;\n    }\n\n    if (!isNewerVersion(dependency.latest, parsed.version)) {\n      continue;\n    }\n\n    updates.push({\n      name: dependency.name,\n      section: dependency.section,\n      from: dependency.current,\n      to: `${parsed.operator}${dependency.latest}`,\n    });\n  }\n\n  return updates;\n}\n\n/**\n * Split a dependency spec into its range operator and concrete version.\n * Returns `undefined` for specs we won't touch — `workspace:*`, `*`,\n * `latest`, multi-part ranges, or git/file URLs — leaving them exactly as\n * the author wrote them.\n */\nfunction parseSpec(spec: string): { operator: string; version: string } | undefined {\n  const match = spec.trim().match(/^(\\^|~)?(\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?)$/);\n\n  if (!match) {\n    return undefined;\n  }\n\n  return { operator: match[1] ?? \"\", version: match[2] };\n}\n\n/** Write the resolved bumps back into the package.json object in place. */\nfunction applyUpdates(packageJson: PackageJson, updates: PackageUpdate[]): void {\n  for (const update of updates) {\n    const map = packageJson[update.section];\n\n    if (map) {\n      map[update.name] = update.to;\n    }\n  }\n}\n\n/** Print the version bumps — applied, or pending on a dry run. */\nfunction printUpdates(updates: PackageUpdate[], { pending = false } = {}): void {\n  const headline = pending\n    ? `${colors.yellow(\"↑\")} ${colors.bold(String(updates.length))} package(s) can be updated:`\n    : `${colors.green(\"✓\")} Updated ${colors.bold(String(updates.length))} package(s):`;\n\n  console.log(headline);\n\n  for (const update of updates) {\n    console.log(\n      `   ${colors.cyan(update.name)}  ` +\n        `${colors.dim(update.from)} ${colors.dim(\"→\")} ${colors.greenBright(update.to)}`,\n    );\n  }\n}\n\n/** Reconcile node_modules to the rewritten package.json via the project PM. */\nasync function installDependencies(): Promise<void> {\n  const packageManager = await detectPackageManager();\n  const installCommand = getInstallCommand(packageManager);\n\n  console.log(`${colors.cyan(\"›\")} Running ${colors.bold(installCommand)}…`);\n\n  execSync(installCommand, { cwd: process.cwd(), stdio: \"inherit\" });\n}\n"],"mappings":";;;;;;;;;;;AASA,MAAM,gBAAgB;;AAGtB,MAAM,sBAAsB,CAAC,gBAAgB,iBAAiB;;;;;;;;;;;;;;;AA0F9D,eAAsB,sBACpB,UAAwC,CAAC,GACH;CACtC,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,kBAAkB,SAAS,cAAc;CAE/C,IAAI,CAAE,MAAM,gBAAgB,eAAe,GAAI;EAC7C,QAAQ,IAAI,GAAG,OAAO,IAAI,GAAG,EAAE,4CAA4C;EAC3E,OAAO;GAAE,SAAS;GAAmB,SAAS,CAAC;EAAE;CACnD;CAEA,MAAM,cAAe,MAAM,iBAAiB,eAAe;CAC3D,MAAM,eAAe,2BAA2B,WAAW;CAE3D,IAAI,aAAa,WAAW,GAAG;EAC7B,QAAQ,IAAI,GAAG,OAAO,OAAO,GAAG,EAAE,gDAAgD;EAClF,OAAO;GAAE,SAAS;GAAe,SAAS,CAAC;EAAE;CAC/C;CAEA,QAAQ,IACN,GAAG,OAAO,KAAK,GAAG,EAAE,YAAY,OAAO,KAAK,OAAO,aAAa,MAAM,CAAC,EAAE,qCAE3E;CAEA,MAAM,WAAW,MAAM,sBAAsB,YAAY;CAIzD,IAAI,sBAAsB,QAAQ,GAAG;EACnC,QAAQ,IACN,GAAG,OAAO,OAAO,GAAG,EAAE,mGAExB;EACA,OAAO;GAAE,SAAS;GAAwB,SAAS,CAAC;EAAE;CACxD;CAEA,MAAM,UAAU,sBAAsB,QAAQ;CAE9C,IAAI,QAAQ,WAAW,GAAG;EACxB,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,kDAAkD;EACnF,OAAO;GAAE,SAAS;GAAc,SAAS,CAAC;EAAE;CAC9C;CAEA,IAAI,QAAQ,QAAQ;EAClB,aAAa,SAAS,EAAE,SAAS,KAAK,CAAC;EACvC,OAAO;GAAE,SAAS;GAAY;EAAQ;CACxC;CAEA,aAAa,aAAa,OAAO;CACjC,MAAM,iBAAiB,iBAAiB,WAAW;CAEnD,aAAa,OAAO;CAEpB,IAAI,CAAC,YAAY;EACf,QAAQ,IACN,OAAO,IAAI,gFAAgF,CAC7F;EACA,OAAO;GAAE,SAAS;GAAW;EAAQ;CACvC;CAEA,IAAI;EACF,MAAM,oBAAoB;CAC5B,SAAS,OAAO;EACd,QAAQ,IACN,GAAG,OAAO,IAAI,GAAG,EAAE,sGAErB;EACA,OAAO;GAAE,SAAS;GAAkB;GAAgB;EAAe;CACrE;CAEA,OAAO;EAAE,SAAS;EAAW;CAAQ;AACvC;;;;;;AAOA,SAAgB,sBAAsB,UAAyC;CAC7E,OAAO,SAAS,SAAS,KAAK,SAAS,OAAO,eAAe,CAAC,WAAW,MAAM;AACjF;;AAGA,SAAS,2BAA2B,aAA+C;CACjF,MAAM,eAAoC,CAAC;CAE3C,KAAK,MAAM,WAAW,qBAAqB;EACzC,MAAM,MAAM,YAAY;EAExB,IAAI,CAAC,KACH;EAGF,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,GAAG,GAC9C,IAAI,KAAK,WAAW,aAAa,GAC/B,aAAa,KAAK;GAAE;GAAM;GAAS;EAAQ,CAAC;CAGlD;CAEA,OAAO;AACT;;AAGA,eAAe,sBACb,cAC+B;CAC/B,OAAO,QAAQ,IACb,aAAa,IAAI,OAAO,gBAAgB;EACtC,GAAG;EACH,QAAQ,MAAM,mBAAmB,WAAW,IAAI;CAClD,EAAE,CACJ;AACF;;;;;;;AAQA,SAAgB,sBAAsB,UAAiD;CACrF,MAAM,UAA2B,CAAC;CAElC,KAAK,MAAM,cAAc,UAAU;EACjC,IAAI,CAAC,WAAW,QACd;EAGF,MAAM,SAAS,UAAU,WAAW,OAAO;EAE3C,IAAI,CAAC,QACH;EAGF,IAAI,CAAC,eAAe,WAAW,QAAQ,OAAO,OAAO,GACnD;EAGF,QAAQ,KAAK;GACX,MAAM,WAAW;GACjB,SAAS,WAAW;GACpB,MAAM,WAAW;GACjB,IAAI,GAAG,OAAO,WAAW,WAAW;EACtC,CAAC;CACH;CAEA,OAAO;AACT;;;;;;;AAQA,SAAS,UAAU,MAAiE;CAClF,MAAM,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,8CAA8C;CAE9E,IAAI,CAAC,OACH;CAGF,OAAO;EAAE,UAAU,MAAM,MAAM;EAAI,SAAS,MAAM;CAAG;AACvD;;AAGA,SAAS,aAAa,aAA0B,SAAgC;CAC9E,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,MAAM,YAAY,OAAO;EAE/B,IAAI,KACF,IAAI,OAAO,QAAQ,OAAO;CAE9B;AACF;;AAGA,SAAS,aAAa,SAA0B,EAAE,UAAU,UAAU,CAAC,GAAS;CAC9E,MAAM,WAAW,UACb,GAAG,OAAO,OAAO,GAAG,EAAE,GAAG,OAAO,KAAK,OAAO,QAAQ,MAAM,CAAC,EAAE,+BAC7D,GAAG,OAAO,MAAM,GAAG,EAAE,WAAW,OAAO,KAAK,OAAO,QAAQ,MAAM,CAAC,EAAE;CAExE,QAAQ,IAAI,QAAQ;CAEpB,KAAK,MAAM,UAAU,SACnB,QAAQ,IACN,MAAM,OAAO,KAAK,OAAO,IAAI,EAAE,IAC1B,OAAO,IAAI,OAAO,IAAI,EAAE,GAAG,OAAO,IAAI,GAAG,EAAE,GAAG,OAAO,YAAY,OAAO,EAAE,GACjF;AAEJ;;AAGA,eAAe,sBAAqC;CAElD,MAAM,iBAAiB,kBAAkB,MADZ,qBAAqB,CACK;CAEvD,QAAQ,IAAI,GAAG,OAAO,KAAK,GAAG,EAAE,WAAW,OAAO,KAAK,cAAc,EAAE,EAAE;CAEzE,SAAS,gBAAgB;EAAE,KAAK,QAAQ,IAAI;EAAG,OAAO;CAAU,CAAC;AACnE"}
+{"version":3,"file":"update-warlock-packages.mjs","names":[],"sources":["../../../../../../../core/src/updater/update-warlock-packages.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { fileExistsAsync, getJsonFileAsync, putJsonFileAsync } from \"@warlock.js/fs\";\nimport { execSync } from \"node:child_process\";\nimport { rootPath } from \"../utils\";\nimport { fetchLatestVersion } from \"../utils/npm-registry\";\nimport { isNewerVersion } from \"../utils/version-compare\";\nimport { detectPackageManager, getInstallCommand } from \"./package-manager\";\n\n/** Scope prefix that identifies a Warlock framework package. */\nconst WARLOCK_SCOPE = \"@warlock.js/\";\n\n/** The dependency maps in package.json we update, in display order. */\nconst DEPENDENCY_SECTIONS = [\"dependencies\", \"devDependencies\"] as const;\n\ntype DependencySection = (typeof DEPENDENCY_SECTIONS)[number];\n\ntype DependencyMap = Record<string, string>;\n\ntype PackageJson = Record<string, unknown> & {\n  dependencies?: DependencyMap;\n  devDependencies?: DependencyMap;\n};\n\n/** A `@warlock.js/*` dependency found in package.json. */\ntype WarlockDependency = {\n  name: string;\n  section: DependencySection;\n  /** The current spec exactly as written, e.g. `^4.2.0`. */\n  current: string;\n};\n\n/** A dependency whose latest version has been resolved from the registry. */\nexport type ResolvedDependency = WarlockDependency & {\n  /** Latest version from npm, or `undefined` when the lookup failed. */\n  latest: string | undefined;\n};\n\n/** A concrete version bump to write back into package.json. */\nexport type PackageUpdate = {\n  name: string;\n  section: DependencySection;\n  /** Existing spec, e.g. `^4.2.0`. */\n  from: string;\n  /** New spec with the original range operator preserved, e.g. `^4.3.0`. */\n  to: string;\n};\n\n/** Options accepted by {@link updateWarlockPackages}. */\nexport type UpdateWarlockPackagesOptions = {\n  /** Run the package manager install after rewriting versions (default true). */\n  install?: boolean;\n  /**\n   * Report what would change without touching package.json or node_modules.\n   * Resolves with the `outdated` outcome instead of `updated`.\n   */\n  dryRun?: boolean;\n};\n\n/**\n * How an update run ended. Callers branch on this instead of re-deriving the\n * situation from the printed output — the dev-server `u` shortcut needs to\n * know whether restarting is warranted, and whether it may offer a retry.\n */\nexport type UpdateOutcome =\n  /** No package.json at the project root — nothing to do. */\n  | \"no-package-json\"\n  /** package.json carries no `@warlock.js/*` dependency. */\n  | \"no-packages\"\n  /** Every registry lookup failed — offline, DNS down, or npm unreachable. */\n  | \"registry-unreachable\"\n  /** Every package is already at (or ahead of) its latest published version. */\n  | \"up-to-date\"\n  /** Newer versions exist, and a dry run left everything untouched. */\n  | \"outdated\"\n  /** Versions were rewritten (and installed, unless `install: false`). */\n  | \"updated\"\n  /** Versions were rewritten but the package manager install failed. */\n  | \"install-failed\";\n\n/** The result of an update run. */\nexport type UpdateWarlockPackagesResult = {\n  outcome: UpdateOutcome;\n  /** The bumps written to package.json — empty unless `outcome` wrote any. */\n  updates: PackageUpdate[];\n  /** The install failure, present only for `install-failed`. */\n  error?: Error;\n};\n\n/**\n * Update every `@warlock.js/*` package listed in the project's root\n * package.json to its latest published version, then reconcile `node_modules`\n * via the detected package manager.\n *\n * The original range operator on each dependency (`^`, `~`, or an exact pin)\n * is preserved; specs that aren't a plain semver — `workspace:*`, `*`,\n * `latest`, git/file URLs — are left untouched. Only genuine upgrades are\n * written, so re-running on an already-current project is a no-op.\n *\n * Resolves rather than throws on the two failures a caller is expected to\n * survive — an unreachable registry and a failed install — so the dev-server\n * shortcut can report them and keep serving.\n */\nexport async function updateWarlockPackages(\n  options: UpdateWarlockPackagesOptions = {},\n): Promise<UpdateWarlockPackagesResult> {\n  const runInstall = options.install ?? true;\n  const packageJsonPath = rootPath(\"package.json\");\n\n  if (!(await fileExistsAsync(packageJsonPath))) {\n    console.log(`${colors.red(\"✖\")} No package.json found at the project root.`);\n    return { outcome: \"no-package-json\", updates: [] };\n  }\n\n  const packageJson = (await getJsonFileAsync(packageJsonPath)) as PackageJson;\n  const dependencies = collectWarlockDependencies(packageJson);\n\n  if (dependencies.length === 0) {\n    console.log(`${colors.yellow(\"⚠\")} No @warlock.js packages found in package.json.`);\n    return { outcome: \"no-packages\", updates: [] };\n  }\n\n  console.log(\n    `${colors.cyan(\"›\")} Checking ${colors.bold(String(dependencies.length))} ` +\n      `@warlock.js package(s) for updates…`,\n  );\n\n  const resolved = await resolveLatestVersions(dependencies);\n\n  // Distinguish \"nothing newer\" from \"we never got an answer\". Without this,\n  // an offline run reports every package as up to date, which is a lie.\n  if (isRegistryUnreachable(resolved)) {\n    console.log(\n      `${colors.yellow(\"⚠\")} Could not reach the npm registry — ` +\n        `no versions were changed. Check your connection and try again.`,\n    );\n    return { outcome: \"registry-unreachable\", updates: [] };\n  }\n\n  // A partial failure would bump some family members and leave others behind,\n  // a lockstep drift reported as success. Refuse the whole run instead.\n  const failedLookups = resolved.filter((dependency) => !dependency.latest);\n\n  if (failedLookups.length > 0) {\n    console.log(\n      `${colors.yellow(\"⚠\")} Could not look up ${failedLookups.map((dependency) => dependency.name).join(\", \")} — ` +\n        `no versions were changed, to keep @warlock.js packages in lockstep. Try again.`,\n    );\n    return { outcome: \"registry-unreachable\", updates: [] };\n  }\n\n  const updates = resolvePackageUpdates(resolved);\n\n  if (updates.length === 0) {\n    console.log(`${colors.green(\"✓\")} All @warlock.js packages are already up to date.`);\n    return { outcome: \"up-to-date\", updates: [] };\n  }\n\n  if (options.dryRun) {\n    printUpdates(updates, { pending: true });\n    return { outcome: \"outdated\", updates };\n  }\n\n  applyUpdates(packageJson, updates);\n  await putJsonFileAsync(packageJsonPath, packageJson);\n\n  printUpdates(updates);\n\n  if (!runInstall) {\n    console.log(\n      colors.dim(\"Skipped install (--no-install). Run your package manager to apply the changes.\"),\n    );\n    return { outcome: \"updated\", updates };\n  }\n\n  try {\n    await installDependencies();\n  } catch (error) {\n    console.log(\n      `${colors.red(\"✖\")} The install failed. package.json is already updated — ` +\n        `re-run your package manager install to finish.`,\n    );\n    return { outcome: \"install-failed\", updates, error: error as Error };\n  }\n\n  return { outcome: \"updated\", updates };\n}\n\n/**\n * Whether *every* lookup came back empty, which in practice means the\n * registry was never reached. A single failed package (unpublished, renamed,\n * private) leaves the rest resolvable and is not treated as an outage.\n */\nexport function isRegistryUnreachable(resolved: ResolvedDependency[]): boolean {\n  return resolved.length > 0 && resolved.every((dependency) => !dependency.latest);\n}\n\n/** Collect every `@warlock.js/*` dependency across the relevant sections. */\nfunction collectWarlockDependencies(packageJson: PackageJson): WarlockDependency[] {\n  const dependencies: WarlockDependency[] = [];\n\n  for (const section of DEPENDENCY_SECTIONS) {\n    const map = packageJson[section];\n\n    if (!map) {\n      continue;\n    }\n\n    for (const [name, current] of Object.entries(map)) {\n      if (name.startsWith(WARLOCK_SCOPE)) {\n        dependencies.push({ name, section, current });\n      }\n    }\n  }\n\n  return dependencies;\n}\n\n/** Resolve each dependency's latest version from the registry in parallel. */\nasync function resolveLatestVersions(\n  dependencies: WarlockDependency[],\n): Promise<ResolvedDependency[]> {\n  return Promise.all(\n    dependencies.map(async (dependency) => ({\n      ...dependency,\n      latest: await fetchLatestVersion(dependency.name),\n    })),\n  );\n}\n\n/**\n * Turn resolved dependencies into the concrete set of version bumps to write.\n * Pure (no I/O) so it can be unit-tested directly: skips lookups that failed,\n * non-semver specs, and anything already at (or ahead of) the latest version,\n * and preserves the original range operator on everything it does rewrite.\n */\nexport function resolvePackageUpdates(resolved: ResolvedDependency[]): PackageUpdate[] {\n  const updates: PackageUpdate[] = [];\n\n  for (const dependency of resolved) {\n    if (!dependency.latest) {\n      continue;\n    }\n\n    const parsed = parseSpec(dependency.current);\n\n    if (!parsed) {\n      continue;\n    }\n\n    if (!isNewerVersion(dependency.latest, parsed.version)) {\n      continue;\n    }\n\n    updates.push({\n      name: dependency.name,\n      section: dependency.section,\n      from: dependency.current,\n      to: `${parsed.operator}${dependency.latest}`,\n    });\n  }\n\n  return updates;\n}\n\n/**\n * Split a dependency spec into its range operator and concrete version.\n * Returns `undefined` for specs we won't touch — `workspace:*`, `*`,\n * `latest`, multi-part ranges, or git/file URLs — leaving them exactly as\n * the author wrote them.\n */\nfunction parseSpec(spec: string): { operator: string; version: string } | undefined {\n  const match = spec.trim().match(/^(\\^|~)?(\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?)$/);\n\n  if (!match) {\n    return undefined;\n  }\n\n  const version = match[2];\n\n  if (version === undefined) {\n    return undefined;\n  }\n\n  return { operator: match[1] ?? \"\", version };\n}\n\n/** Write the resolved bumps back into the package.json object in place. */\nfunction applyUpdates(packageJson: PackageJson, updates: PackageUpdate[]): void {\n  for (const update of updates) {\n    const map = packageJson[update.section];\n\n    if (map) {\n      map[update.name] = update.to;\n    }\n  }\n}\n\n/** Print the version bumps — applied, or pending on a dry run. */\nfunction printUpdates(updates: PackageUpdate[], { pending = false } = {}): void {\n  const headline = pending\n    ? `${colors.yellow(\"↑\")} ${colors.bold(String(updates.length))} package(s) can be updated:`\n    : `${colors.green(\"✓\")} Updated ${colors.bold(String(updates.length))} package(s):`;\n\n  console.log(headline);\n\n  for (const update of updates) {\n    console.log(\n      `   ${colors.cyan(update.name)}  ` +\n        `${colors.dim(update.from)} ${colors.dim(\"→\")} ${colors.greenBright(update.to)}`,\n    );\n  }\n}\n\n/** Reconcile node_modules to the rewritten package.json via the project PM. */\nasync function installDependencies(): Promise<void> {\n  const packageManager = await detectPackageManager();\n  const installCommand = getInstallCommand(packageManager);\n\n  console.log(`${colors.cyan(\"›\")} Running ${colors.bold(installCommand)}…`);\n\n  execSync(installCommand, { cwd: process.cwd(), stdio: \"inherit\" });\n}\n"],"mappings":";;;;;;;;;;;AASA,MAAM,gBAAgB;;AAGtB,MAAM,sBAAsB,CAAC,gBAAgB,iBAAiB;;;;;;;;;;;;;;;AA0F9D,eAAsB,sBACpB,UAAwC,CAAC,GACH;CACtC,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,kBAAkB,SAAS,cAAc;CAE/C,IAAI,CAAE,MAAM,gBAAgB,eAAe,GAAI;EAC7C,QAAQ,IAAI,GAAG,OAAO,IAAI,GAAG,EAAE,4CAA4C;EAC3E,OAAO;GAAE,SAAS;GAAmB,SAAS,CAAC;EAAE;CACnD;CAEA,MAAM,cAAe,MAAM,iBAAiB,eAAe;CAC3D,MAAM,eAAe,2BAA2B,WAAW;CAE3D,IAAI,aAAa,WAAW,GAAG;EAC7B,QAAQ,IAAI,GAAG,OAAO,OAAO,GAAG,EAAE,gDAAgD;EAClF,OAAO;GAAE,SAAS;GAAe,SAAS,CAAC;EAAE;CAC/C;CAEA,QAAQ,IACN,GAAG,OAAO,KAAK,GAAG,EAAE,YAAY,OAAO,KAAK,OAAO,aAAa,MAAM,CAAC,EAAE,qCAE3E;CAEA,MAAM,WAAW,MAAM,sBAAsB,YAAY;CAIzD,IAAI,sBAAsB,QAAQ,GAAG;EACnC,QAAQ,IACN,GAAG,OAAO,OAAO,GAAG,EAAE,mGAExB;EACA,OAAO;GAAE,SAAS;GAAwB,SAAS,CAAC;EAAE;CACxD;CAIA,MAAM,gBAAgB,SAAS,QAAQ,eAAe,CAAC,WAAW,MAAM;CAExE,IAAI,cAAc,SAAS,GAAG;EAC5B,QAAQ,IACN,GAAG,OAAO,OAAO,GAAG,EAAE,qBAAqB,cAAc,KAAK,eAAe,WAAW,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,kFAE3G;EACA,OAAO;GAAE,SAAS;GAAwB,SAAS,CAAC;EAAE;CACxD;CAEA,MAAM,UAAU,sBAAsB,QAAQ;CAE9C,IAAI,QAAQ,WAAW,GAAG;EACxB,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,kDAAkD;EACnF,OAAO;GAAE,SAAS;GAAc,SAAS,CAAC;EAAE;CAC9C;CAEA,IAAI,QAAQ,QAAQ;EAClB,aAAa,SAAS,EAAE,SAAS,KAAK,CAAC;EACvC,OAAO;GAAE,SAAS;GAAY;EAAQ;CACxC;CAEA,aAAa,aAAa,OAAO;CACjC,MAAM,iBAAiB,iBAAiB,WAAW;CAEnD,aAAa,OAAO;CAEpB,IAAI,CAAC,YAAY;EACf,QAAQ,IACN,OAAO,IAAI,gFAAgF,CAC7F;EACA,OAAO;GAAE,SAAS;GAAW;EAAQ;CACvC;CAEA,IAAI;EACF,MAAM,oBAAoB;CAC5B,SAAS,OAAO;EACd,QAAQ,IACN,GAAG,OAAO,IAAI,GAAG,EAAE,sGAErB;EACA,OAAO;GAAE,SAAS;GAAkB;GAAgB;EAAe;CACrE;CAEA,OAAO;EAAE,SAAS;EAAW;CAAQ;AACvC;;;;;;AAOA,SAAgB,sBAAsB,UAAyC;CAC7E,OAAO,SAAS,SAAS,KAAK,SAAS,OAAO,eAAe,CAAC,WAAW,MAAM;AACjF;;AAGA,SAAS,2BAA2B,aAA+C;CACjF,MAAM,eAAoC,CAAC;CAE3C,KAAK,MAAM,WAAW,qBAAqB;EACzC,MAAM,MAAM,YAAY;EAExB,IAAI,CAAC,KACH;EAGF,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,GAAG,GAC9C,IAAI,KAAK,WAAW,aAAa,GAC/B,aAAa,KAAK;GAAE;GAAM;GAAS;EAAQ,CAAC;CAGlD;CAEA,OAAO;AACT;;AAGA,eAAe,sBACb,cAC+B;CAC/B,OAAO,QAAQ,IACb,aAAa,IAAI,OAAO,gBAAgB;EACtC,GAAG;EACH,QAAQ,MAAM,mBAAmB,WAAW,IAAI;CAClD,EAAE,CACJ;AACF;;;;;;;AAQA,SAAgB,sBAAsB,UAAiD;CACrF,MAAM,UAA2B,CAAC;CAElC,KAAK,MAAM,cAAc,UAAU;EACjC,IAAI,CAAC,WAAW,QACd;EAGF,MAAM,SAAS,UAAU,WAAW,OAAO;EAE3C,IAAI,CAAC,QACH;EAGF,IAAI,CAAC,eAAe,WAAW,QAAQ,OAAO,OAAO,GACnD;EAGF,QAAQ,KAAK;GACX,MAAM,WAAW;GACjB,SAAS,WAAW;GACpB,MAAM,WAAW;GACjB,IAAI,GAAG,OAAO,WAAW,WAAW;EACtC,CAAC;CACH;CAEA,OAAO;AACT;;;;;;;AAQA,SAAS,UAAU,MAAiE;CAClF,MAAM,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,8CAA8C;CAE9E,IAAI,CAAC,OACH;CAGF,MAAM,UAAU,MAAM;CAEtB,IAAI,YAAY,QACd;CAGF,OAAO;EAAE,UAAU,MAAM,MAAM;EAAI;CAAQ;AAC7C;;AAGA,SAAS,aAAa,aAA0B,SAAgC;CAC9E,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,MAAM,YAAY,OAAO;EAE/B,IAAI,KACF,IAAI,OAAO,QAAQ,OAAO;CAE9B;AACF;;AAGA,SAAS,aAAa,SAA0B,EAAE,UAAU,UAAU,CAAC,GAAS;CAC9E,MAAM,WAAW,UACb,GAAG,OAAO,OAAO,GAAG,EAAE,GAAG,OAAO,KAAK,OAAO,QAAQ,MAAM,CAAC,EAAE,+BAC7D,GAAG,OAAO,MAAM,GAAG,EAAE,WAAW,OAAO,KAAK,OAAO,QAAQ,MAAM,CAAC,EAAE;CAExE,QAAQ,IAAI,QAAQ;CAEpB,KAAK,MAAM,UAAU,SACnB,QAAQ,IACN,MAAM,OAAO,KAAK,OAAO,IAAI,EAAE,IAC1B,OAAO,IAAI,OAAO,IAAI,EAAE,GAAG,OAAO,IAAI,GAAG,EAAE,GAAG,OAAO,YAAY,OAAO,EAAE,GACjF;AAEJ;;AAGA,eAAe,sBAAqC;CAElD,MAAM,iBAAiB,kBAAkB,MADZ,qBAAqB,CACK;CAEvD,QAAQ,IAAI,GAAG,OAAO,KAAK,GAAG,EAAE,WAAW,OAAO,KAAK,cAAc,EAAE,EAAE;CAEzE,SAAS,gBAAgB;EAAE,KAAK,QAAQ,IAAI;EAAG,OAAO;CAAU,CAAC;AACnE"}

package/esm/use-cases/use-case-broadcast.mjs

@@ -19,7 +19,13 @@ async function broadcastUseCaseResult(params) {
 	if (!channels || channels.length === 0) return;
 	const projector = typeof broadcast === "object" ? broadcast.output : void 0;
 	const event = typeof broadcast === "object" && broadcast.event ? broadcast.event : name;
-	const payload = projector ? projector(output, result) : output;
+	let payload = output;
+	if (projector) try {
+		payload = projector(output, result);
+	} catch (error) {
+		log.error("use-cases", name, "broadcast projector failed", { error });
+		return;
+	}
 	const broadcastEvent = {
 		useCase: name,
 		event,

package/esm/use-cases/use-case-broadcast.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"use-case-broadcast.mjs","names":[],"sources":["../../../../../../../core/src/use-cases/use-case-broadcast.ts"],"sourcesContent":["import { log } from \"@warlock.js/logger\";\nimport type {\n  UseCaseBroadcastEvent,\n  UseCaseBroadcastOption,\n  UseCaseConfigurations,\n  UseCaseResult,\n} from \"./types\";\n\n/**\n * Broadcast a successful use-case result through the globally-configured channels.\n *\n * Fires only when the use case opted in (`broadcast`) and the global transport is\n * enabled with at least one channel. Fan-out is isolated via `Promise.allSettled` —\n * a failing channel is logged and never affects the use case or sibling channels.\n *\n * @example\n * await broadcastUseCaseResult({ name, id, output, result, broadcast, config });\n */\nexport async function broadcastUseCaseResult<Output>(params: {\n  name: string;\n  id: string;\n  output: Output;\n  result: UseCaseResult<Output>;\n  broadcast?: UseCaseBroadcastOption<Output>;\n  config?: UseCaseConfigurations[\"broadcast\"];\n}): Promise<void> {\n  const { name, id, output, result, broadcast, config } = params;\n\n  if (!broadcast) {\n    return;\n  }\n\n  if (config?.enabled === false) {\n    return;\n  }\n\n  const channels = config?.channels;\n\n  if (!channels || channels.length === 0) {\n    return;\n  }\n\n  const projector = typeof broadcast === \"object\" ? broadcast.output : undefined;\n  const event = typeof broadcast === \"object\" && broadcast.event ? broadcast.event : name;\n  const payload = projector ? projector(output, result) : output;\n\n  const broadcastEvent: UseCaseBroadcastEvent = {\n    useCase: name,\n    event,\n    id,\n    at: new Date(),\n    payload,\n  };\n\n  const outcomes = await Promise.allSettled(\n    channels.map((channel) => channel.broadcast(broadcastEvent)),\n  );\n\n  for (const outcome of outcomes) {\n    if (outcome.status === \"rejected\") {\n      log.error(\"use-cases\", name, \"broadcast channel failed\", { error: outcome.reason });\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,eAAsB,uBAA+B,QAOnC;CAChB,MAAM,EAAE,MAAM,IAAI,QAAQ,QAAQ,WAAW,WAAW;CAExD,IAAI,CAAC,WACH;CAGF,IAAI,QAAQ,YAAY,OACtB;CAGF,MAAM,WAAW,QAAQ;CAEzB,IAAI,CAAC,YAAY,SAAS,WAAW,GACnC;CAGF,MAAM,YAAY,OAAO,cAAc,WAAW,UAAU,SAAS;CACrE,MAAM,QAAQ,OAAO,cAAc,YAAY,UAAU,QAAQ,UAAU,QAAQ;CACnF,MAAM,UAAU,YAAY,UAAU,QAAQ,MAAM,IAAI;CAExD,MAAM,iBAAwC;EAC5C,SAAS;EACT;EACA;EACA,oBAAI,IAAI,KAAK;EACb;CACF;CAEA,MAAM,WAAW,MAAM,QAAQ,WAC7B,SAAS,KAAK,YAAY,QAAQ,UAAU,cAAc,CAAC,CAC7D;CAEA,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,WAAW,YACrB,IAAI,MAAM,aAAa,MAAM,4BAA4B,EAAE,OAAO,QAAQ,OAAO,CAAC;AAGxF"}
+{"version":3,"file":"use-case-broadcast.mjs","names":[],"sources":["../../../../../../../core/src/use-cases/use-case-broadcast.ts"],"sourcesContent":["import { log } from \"@warlock.js/logger\";\nimport type {\n  UseCaseBroadcastEvent,\n  UseCaseBroadcastOption,\n  UseCaseConfigurations,\n  UseCaseResult,\n} from \"./types\";\n\n/**\n * Broadcast a successful use-case result through the globally-configured channels.\n *\n * Fires only when the use case opted in (`broadcast`) and the global transport is\n * enabled with at least one channel. Fan-out is isolated via `Promise.allSettled` —\n * a failing channel is logged and never affects the use case or sibling channels.\n *\n * @example\n * await broadcastUseCaseResult({ name, id, output, result, broadcast, config });\n */\nexport async function broadcastUseCaseResult<Output>(params: {\n  name: string;\n  id: string;\n  output: Output;\n  result: UseCaseResult<Output>;\n  broadcast?: UseCaseBroadcastOption<Output>;\n  config?: UseCaseConfigurations[\"broadcast\"];\n}): Promise<void> {\n  const { name, id, output, result, broadcast, config } = params;\n\n  if (!broadcast) {\n    return;\n  }\n\n  if (config?.enabled === false) {\n    return;\n  }\n\n  const channels = config?.channels;\n\n  if (!channels || channels.length === 0) {\n    return;\n  }\n\n  const projector = typeof broadcast === \"object\" ? broadcast.output : undefined;\n  const event = typeof broadcast === \"object\" && broadcast.event ? broadcast.event : name;\n  let payload: unknown = output;\n\n  if (projector) {\n    try {\n      payload = projector(output, result);\n    } catch (error) {\n      log.error(\"use-cases\", name, \"broadcast projector failed\", { error });\n\n      return;\n    }\n  }\n\n  const broadcastEvent: UseCaseBroadcastEvent = {\n    useCase: name,\n    event,\n    id,\n    at: new Date(),\n    payload,\n  };\n\n  const outcomes = await Promise.allSettled(\n    channels.map((channel) => channel.broadcast(broadcastEvent)),\n  );\n\n  for (const outcome of outcomes) {\n    if (outcome.status === \"rejected\") {\n      log.error(\"use-cases\", name, \"broadcast channel failed\", { error: outcome.reason });\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,eAAsB,uBAA+B,QAOnC;CAChB,MAAM,EAAE,MAAM,IAAI,QAAQ,QAAQ,WAAW,WAAW;CAExD,IAAI,CAAC,WACH;CAGF,IAAI,QAAQ,YAAY,OACtB;CAGF,MAAM,WAAW,QAAQ;CAEzB,IAAI,CAAC,YAAY,SAAS,WAAW,GACnC;CAGF,MAAM,YAAY,OAAO,cAAc,WAAW,UAAU,SAAS;CACrE,MAAM,QAAQ,OAAO,cAAc,YAAY,UAAU,QAAQ,UAAU,QAAQ;CACnF,IAAI,UAAmB;CAEvB,IAAI,WACF,IAAI;EACF,UAAU,UAAU,QAAQ,MAAM;CACpC,SAAS,OAAO;EACd,IAAI,MAAM,aAAa,MAAM,8BAA8B,EAAE,MAAM,CAAC;EAEpE;CACF;CAGF,MAAM,iBAAwC;EAC5C,SAAS;EACT;EACA;EACA,oBAAI,IAAI,KAAK;EACb;CACF;CAEA,MAAM,WAAW,MAAM,QAAQ,WAC7B,SAAS,KAAK,YAAY,QAAQ,UAAU,cAAc,CAAC,CAC7D;CAEA,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,WAAW,YACrB,IAAI,MAAM,aAAa,MAAM,4BAA4B,EAAE,OAAO,QAAQ,OAAO,CAAC;AAGxF"}

package/esm/use-cases/use-cases-registry.mjs

@@ -99,13 +99,32 @@ async function getUseCaseHistory(name) {
 * unbounded — oldest entries (and their ids) are evicted past MAX_HISTORY_ENTRIES.
 */
 async function addUseCaseHistory(name, result) {
+	if (!(config.get("use-cases")?.history?.enabled ?? process.env.NODE_ENV !== "production")) return;
+	const current = (historyWrites.get(name) ?? Promise.resolve()).catch(() => void 0).then(() => writeHistory(name, result));
+	historyWrites.set(name, current);
+	try {
+		await current;
+	} finally {
+		if (historyWrites.get(name) === current) historyWrites.delete(name);
+	}
+}
+/**
+* Per-use-case write chain so the list read-modify-write never interleaves
+* within a process (keeps the cap enforced under concurrency).
+*/
+const historyWrites = /* @__PURE__ */ new Map();
+async function writeHistory(name, result) {
 	const useCaseConfig = config.get("use-cases");
-	if (useCaseConfig?.history?.enabled === false) return;
 	const ttl = resolveHistoryTtl(useCaseConfig);
 	const maxEntries = useCaseConfig?.history?.maxEntries ?? 100;
 	const key = `use-case:history:${name}:${result.id}`;
 	const listKey = `use-case:history:${name}:list`;
-	await cache.set(key, result, ttl);
+	const projection = {
+		...result,
+		output: void 0,
+		ctx: void 0
+	};
+	await cache.set(key, projection, ttl);
 	const list = await cache.get(listKey) || [];
 	list.push(result.id);
 	while (list.length > maxEntries) {

package/esm/use-cases/use-cases-registry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"use-cases-registry.mjs","names":[],"sources":["../../../../../../../core/src/use-cases/use-cases-registry.ts"],"sourcesContent":["import { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport { config } from \"../config\";\nimport { type RegisteredUseCase, type UseCaseConfigurations, type UseCaseResult } from \"./types\";\n\n/**\n * Store registered use cases\n */\nconst useCaseRegister = new Map<string, RegisteredUseCase>();\n\n/**\n * Register a use case\n */\nexport function $registerUseCase<Output, Input>(\n  name: string,\n  useCase: RegisteredUseCase<Output, Input>,\n) {\n  if (useCaseRegister.has(name) && process.env.NODE_ENV !== \"production\") {\n    log.warn(\"use-cases\", \"registering\", `Use case \"${name}\" is already registered. Overwriting.`);\n  }\n\n  useCaseRegister.set(name, useCase);\n}\n\n/**\n * Unregister a use case.\n *\n * Dropping the history namespace is best-effort: `$cleanup` is synchronous, so the\n * async cache removal is fire-and-forget with a `.catch` guard — a rejecting cache\n * driver must never turn cleanup into an unhandled rejection.\n */\nexport function $unregisterUseCase(name: string) {\n  useCaseRegister.delete(name);\n\n  Promise.resolve(cache.removeNamespace(`use-case:history:${name}`)).catch((error) => {\n    log.error(\"use-cases\", name, \"history namespace removal failed\", { error });\n  });\n}\n\n/**\n * Get a use case.\n *\n * Returns the `RegisteredUseCase` shape — including the runtime `calls` counters\n * the registry actually stores — so consumers can read call stats without an\n * ad-hoc cast.\n */\nexport function getUseCase<Output, Input>(name: string) {\n  return useCaseRegister.get(name) as RegisteredUseCase<Output, Input> | undefined;\n}\n\n/**\n * Get all use cases\n */\nexport function getUseCases() {\n  return useCaseRegister;\n}\n\n/**\n * Increase use case success calls\n */\nexport function increaseUseCaseSuccessCalls(name: string): number {\n  const useCase = useCaseRegister.get(name);\n  if (useCase) {\n    useCase.calls.success++;\n    useCase.calls.total++;\n\n    return useCase.calls.success;\n  }\n\n  return 0;\n}\n\n/**\n * Increase use case failed calls\n */\nexport function increaseUseCaseFailedCalls(name: string): number {\n  const useCase = useCaseRegister.get(name);\n  if (useCase) {\n    useCase.calls.failed++;\n    useCase.calls.total++;\n\n    return useCase.calls.failed;\n  }\n\n  return 0;\n}\n\n/**\n * Resolve the history cache TTL (seconds) from config.\n * `false` means \"use the cache driver's default\", represented as `undefined`.\n */\nfunction resolveHistoryTtl(useCaseConfig?: UseCaseConfigurations): number | undefined {\n  const ttlConfig = useCaseConfig?.history?.ttl ?? 3600; // 1 hour default\n\n  return ttlConfig === false ? undefined : ttlConfig;\n}\n\n/**\n * Get use case history from cache.\n *\n * Prunes ids whose entries have expired so the list can't accumulate dead refs.\n */\nexport async function getUseCaseHistory(name: string): Promise<UseCaseResult<any>[]> {\n  const listKey = `use-case:history:${name}:list`;\n  const ids = (await cache.get<string[]>(listKey)) || [];\n\n  const entries = await Promise.all(\n    ids.map(async (id: string) => ({\n      id,\n      result: await cache.get<UseCaseResult<any>>(`use-case:history:${name}:${id}`),\n    })),\n  );\n\n  const liveEntries = entries.filter((entry) => Boolean(entry.result));\n\n  if (liveEntries.length !== ids.length) {\n    const useCaseConfig = config.get<UseCaseConfigurations>(\"use-cases\");\n\n    await cache.set(\n      listKey,\n      liveEntries.map((entry) => entry.id),\n      resolveHistoryTtl(useCaseConfig),\n    );\n  }\n\n  return liveEntries.map((entry) => entry.result) as UseCaseResult<any>[];\n}\n\n/**\n * Add use case history to cache, capping the per-use-case list so it can't grow\n * unbounded — oldest entries (and their ids) are evicted past MAX_HISTORY_ENTRIES.\n */\nexport async function addUseCaseHistory(name: string, result: UseCaseResult<any>) {\n  const useCaseConfig = config.get<UseCaseConfigurations>(\"use-cases\");\n\n  if (useCaseConfig?.history?.enabled === false) return;\n\n  const ttl = resolveHistoryTtl(useCaseConfig);\n  const maxEntries = useCaseConfig?.history?.maxEntries ?? 100;\n  const key = `use-case:history:${name}:${result.id}`;\n  const listKey = `use-case:history:${name}:list`;\n\n  await cache.set(key, result, ttl);\n\n  const list = (await cache.get<string[]>(listKey)) || [];\n\n  list.push(result.id);\n\n  while (list.length > maxEntries) {\n    const evictedId = list.shift();\n\n    if (evictedId) {\n      await cache.remove(`use-case:history:${name}:${evictedId}`);\n    }\n  }\n\n  await cache.set(listKey, list, ttl);\n}\n"],"mappings":";;;;;;;;;AAQA,MAAM,kCAAkB,IAAI,IAA+B;;;;AAK3D,SAAgB,iBACd,MACA,SACA;CACA,IAAI,gBAAgB,IAAI,IAAI,KAAK,QAAQ,IAAI,aAAa,cACxD,IAAI,KAAK,aAAa,eAAe,aAAa,KAAK,sCAAsC;CAG/F,gBAAgB,IAAI,MAAM,OAAO;AACnC;;;;;;;;AASA,SAAgB,mBAAmB,MAAc;CAC/C,gBAAgB,OAAO,IAAI;CAE3B,QAAQ,QAAQ,MAAM,gBAAgB,oBAAoB,MAAM,CAAC,CAAC,CAAC,OAAO,UAAU;EAClF,IAAI,MAAM,aAAa,MAAM,oCAAoC,EAAE,MAAM,CAAC;CAC5E,CAAC;AACH;;;;;;;;AASA,SAAgB,WAA0B,MAAc;CACtD,OAAO,gBAAgB,IAAI,IAAI;AACjC;;;;AAKA,SAAgB,cAAc;CAC5B,OAAO;AACT;;;;AAKA,SAAgB,4BAA4B,MAAsB;CAChE,MAAM,UAAU,gBAAgB,IAAI,IAAI;CACxC,IAAI,SAAS;EACX,QAAQ,MAAM;EACd,QAAQ,MAAM;EAEd,OAAO,QAAQ,MAAM;CACvB;CAEA,OAAO;AACT;;;;AAKA,SAAgB,2BAA2B,MAAsB;CAC/D,MAAM,UAAU,gBAAgB,IAAI,IAAI;CACxC,IAAI,SAAS;EACX,QAAQ,MAAM;EACd,QAAQ,MAAM;EAEd,OAAO,QAAQ,MAAM;CACvB;CAEA,OAAO;AACT;;;;;AAMA,SAAS,kBAAkB,eAA2D;CACpF,MAAM,YAAY,eAAe,SAAS,OAAO;CAEjD,OAAO,cAAc,QAAQ,SAAY;AAC3C;;;;;;AAOA,eAAsB,kBAAkB,MAA6C;CACnF,MAAM,UAAU,oBAAoB,KAAK;CACzC,MAAM,MAAO,MAAM,MAAM,IAAc,OAAO,KAAM,CAAC;CASrD,MAAM,eAAc,MAPE,QAAQ,IAC5B,IAAI,IAAI,OAAO,QAAgB;EAC7B;EACA,QAAQ,MAAM,MAAM,IAAwB,oBAAoB,KAAK,GAAG,IAAI;CAC9E,EAAE,CACJ,EAE2B,CAAC,QAAQ,UAAU,QAAQ,MAAM,MAAM,CAAC;CAEnE,IAAI,YAAY,WAAW,IAAI,QAAQ;EACrC,MAAM,gBAAgB,OAAO,IAA2B,WAAW;EAEnE,MAAM,MAAM,IACV,SACA,YAAY,KAAK,UAAU,MAAM,EAAE,GACnC,kBAAkB,aAAa,CACjC;CACF;CAEA,OAAO,YAAY,KAAK,UAAU,MAAM,MAAM;AAChD;;;;;AAMA,eAAsB,kBAAkB,MAAc,QAA4B;CAChF,MAAM,gBAAgB,OAAO,IAA2B,WAAW;CAEnE,IAAI,eAAe,SAAS,YAAY,OAAO;CAE/C,MAAM,MAAM,kBAAkB,aAAa;CAC3C,MAAM,aAAa,eAAe,SAAS,cAAc;CACzD,MAAM,MAAM,oBAAoB,KAAK,GAAG,OAAO;CAC/C,MAAM,UAAU,oBAAoB,KAAK;CAEzC,MAAM,MAAM,IAAI,KAAK,QAAQ,GAAG;CAEhC,MAAM,OAAQ,MAAM,MAAM,IAAc,OAAO,KAAM,CAAC;CAEtD,KAAK,KAAK,OAAO,EAAE;CAEnB,OAAO,KAAK,SAAS,YAAY;EAC/B,MAAM,YAAY,KAAK,MAAM;EAE7B,IAAI,WACF,MAAM,MAAM,OAAO,oBAAoB,KAAK,GAAG,WAAW;CAE9D;CAEA,MAAM,MAAM,IAAI,SAAS,MAAM,GAAG;AACpC"}
+{"version":3,"file":"use-cases-registry.mjs","names":[],"sources":["../../../../../../../core/src/use-cases/use-cases-registry.ts"],"sourcesContent":["import { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport { config } from \"../config\";\nimport { type RegisteredUseCase, type UseCaseConfigurations, type UseCaseResult } from \"./types\";\n\n/**\n * Store registered use cases\n */\nconst useCaseRegister = new Map<string, RegisteredUseCase>();\n\n/**\n * Register a use case\n */\nexport function $registerUseCase<Output, Input>(\n  name: string,\n  useCase: RegisteredUseCase<Output, Input>,\n) {\n  if (useCaseRegister.has(name) && process.env.NODE_ENV !== \"production\") {\n    log.warn(\"use-cases\", \"registering\", `Use case \"${name}\" is already registered. Overwriting.`);\n  }\n\n  useCaseRegister.set(name, useCase);\n}\n\n/**\n * Unregister a use case.\n *\n * Dropping the history namespace is best-effort: `$cleanup` is synchronous, so the\n * async cache removal is fire-and-forget with a `.catch` guard — a rejecting cache\n * driver must never turn cleanup into an unhandled rejection.\n */\nexport function $unregisterUseCase(name: string) {\n  useCaseRegister.delete(name);\n\n  Promise.resolve(cache.removeNamespace(`use-case:history:${name}`)).catch((error) => {\n    log.error(\"use-cases\", name, \"history namespace removal failed\", { error });\n  });\n}\n\n/**\n * Get a use case.\n *\n * Returns the `RegisteredUseCase` shape — including the runtime `calls` counters\n * the registry actually stores — so consumers can read call stats without an\n * ad-hoc cast.\n */\nexport function getUseCase<Output, Input>(name: string) {\n  return useCaseRegister.get(name) as RegisteredUseCase<Output, Input> | undefined;\n}\n\n/**\n * Get all use cases\n */\nexport function getUseCases() {\n  return useCaseRegister;\n}\n\n/**\n * Increase use case success calls\n */\nexport function increaseUseCaseSuccessCalls(name: string): number {\n  const useCase = useCaseRegister.get(name);\n  if (useCase) {\n    useCase.calls.success++;\n    useCase.calls.total++;\n\n    return useCase.calls.success;\n  }\n\n  return 0;\n}\n\n/**\n * Increase use case failed calls\n */\nexport function increaseUseCaseFailedCalls(name: string): number {\n  const useCase = useCaseRegister.get(name);\n  if (useCase) {\n    useCase.calls.failed++;\n    useCase.calls.total++;\n\n    return useCase.calls.failed;\n  }\n\n  return 0;\n}\n\n/**\n * Resolve the history cache TTL (seconds) from config.\n * `false` means \"use the cache driver's default\", represented as `undefined`.\n */\nfunction resolveHistoryTtl(useCaseConfig?: UseCaseConfigurations): number | undefined {\n  const ttlConfig = useCaseConfig?.history?.ttl ?? 3600; // 1 hour default\n\n  return ttlConfig === false ? undefined : ttlConfig;\n}\n\n/**\n * Get use case history from cache.\n *\n * Prunes ids whose entries have expired so the list can't accumulate dead refs.\n */\nexport async function getUseCaseHistory(name: string): Promise<UseCaseResult<any>[]> {\n  const listKey = `use-case:history:${name}:list`;\n  const ids = (await cache.get<string[]>(listKey)) || [];\n\n  const entries = await Promise.all(\n    ids.map(async (id: string) => ({\n      id,\n      result: await cache.get<UseCaseResult<any>>(`use-case:history:${name}:${id}`),\n    })),\n  );\n\n  const liveEntries = entries.filter((entry) => Boolean(entry.result));\n\n  if (liveEntries.length !== ids.length) {\n    const useCaseConfig = config.get<UseCaseConfigurations>(\"use-cases\");\n\n    await cache.set(\n      listKey,\n      liveEntries.map((entry) => entry.id),\n      resolveHistoryTtl(useCaseConfig),\n    );\n  }\n\n  return liveEntries.map((entry) => entry.result) as UseCaseResult<any>[];\n}\n\n/**\n * Add use case history to cache, capping the per-use-case list so it can't grow\n * unbounded — oldest entries (and their ids) are evicted past MAX_HISTORY_ENTRIES.\n */\nexport async function addUseCaseHistory(name: string, result: UseCaseResult<any>) {\n  const useCaseConfig = config.get<UseCaseConfigurations>(\"use-cases\");\n\n  // On by default outside production; opt in to production with `history.enabled: true`.\n  const enabled = useCaseConfig?.history?.enabled ?? process.env.NODE_ENV !== \"production\";\n\n  if (!enabled) return;\n\n  const previous = historyWrites.get(name) ?? Promise.resolve();\n  const current = previous.catch(() => undefined).then(() => writeHistory(name, result));\n\n  historyWrites.set(name, current);\n\n  try {\n    await current;\n  } finally {\n    if (historyWrites.get(name) === current) {\n      historyWrites.delete(name);\n    }\n  }\n}\n\n/**\n * Per-use-case write chain so the list read-modify-write never interleaves\n * within a process (keeps the cap enforced under concurrency).\n */\nconst historyWrites = new Map<string, Promise<unknown>>();\n\nasync function writeHistory(name: string, result: UseCaseResult<any>) {\n  const useCaseConfig = config.get<UseCaseConfigurations>(\"use-cases\");\n  const ttl = resolveHistoryTtl(useCaseConfig);\n  const maxEntries = useCaseConfig?.history?.maxEntries ?? 100;\n  const key = `use-case:history:${name}:${result.id}`;\n  const listKey = `use-case:history:${name}:list`;\n\n  // Store a projection only: `output` and `ctx` (tokens, payloads) never reach the cache.\n  const projection = { ...result, output: undefined, ctx: undefined } as unknown as UseCaseResult<any>;\n\n  await cache.set(key, projection, ttl);\n\n  const list = (await cache.get<string[]>(listKey)) || [];\n\n  list.push(result.id);\n\n  while (list.length > maxEntries) {\n    const evictedId = list.shift();\n\n    if (evictedId) {\n      await cache.remove(`use-case:history:${name}:${evictedId}`);\n    }\n  }\n\n  await cache.set(listKey, list, ttl);\n}\n"],"mappings":";;;;;;;;;AAQA,MAAM,kCAAkB,IAAI,IAA+B;;;;AAK3D,SAAgB,iBACd,MACA,SACA;CACA,IAAI,gBAAgB,IAAI,IAAI,KAAK,QAAQ,IAAI,aAAa,cACxD,IAAI,KAAK,aAAa,eAAe,aAAa,KAAK,sCAAsC;CAG/F,gBAAgB,IAAI,MAAM,OAAO;AACnC;;;;;;;;AASA,SAAgB,mBAAmB,MAAc;CAC/C,gBAAgB,OAAO,IAAI;CAE3B,QAAQ,QAAQ,MAAM,gBAAgB,oBAAoB,MAAM,CAAC,CAAC,CAAC,OAAO,UAAU;EAClF,IAAI,MAAM,aAAa,MAAM,oCAAoC,EAAE,MAAM,CAAC;CAC5E,CAAC;AACH;;;;;;;;AASA,SAAgB,WAA0B,MAAc;CACtD,OAAO,gBAAgB,IAAI,IAAI;AACjC;;;;AAKA,SAAgB,cAAc;CAC5B,OAAO;AACT;;;;AAKA,SAAgB,4BAA4B,MAAsB;CAChE,MAAM,UAAU,gBAAgB,IAAI,IAAI;CACxC,IAAI,SAAS;EACX,QAAQ,MAAM;EACd,QAAQ,MAAM;EAEd,OAAO,QAAQ,MAAM;CACvB;CAEA,OAAO;AACT;;;;AAKA,SAAgB,2BAA2B,MAAsB;CAC/D,MAAM,UAAU,gBAAgB,IAAI,IAAI;CACxC,IAAI,SAAS;EACX,QAAQ,MAAM;EACd,QAAQ,MAAM;EAEd,OAAO,QAAQ,MAAM;CACvB;CAEA,OAAO;AACT;;;;;AAMA,SAAS,kBAAkB,eAA2D;CACpF,MAAM,YAAY,eAAe,SAAS,OAAO;CAEjD,OAAO,cAAc,QAAQ,SAAY;AAC3C;;;;;;AAOA,eAAsB,kBAAkB,MAA6C;CACnF,MAAM,UAAU,oBAAoB,KAAK;CACzC,MAAM,MAAO,MAAM,MAAM,IAAc,OAAO,KAAM,CAAC;CASrD,MAAM,eAAc,MAPE,QAAQ,IAC5B,IAAI,IAAI,OAAO,QAAgB;EAC7B;EACA,QAAQ,MAAM,MAAM,IAAwB,oBAAoB,KAAK,GAAG,IAAI;CAC9E,EAAE,CACJ,EAE2B,CAAC,QAAQ,UAAU,QAAQ,MAAM,MAAM,CAAC;CAEnE,IAAI,YAAY,WAAW,IAAI,QAAQ;EACrC,MAAM,gBAAgB,OAAO,IAA2B,WAAW;EAEnE,MAAM,MAAM,IACV,SACA,YAAY,KAAK,UAAU,MAAM,EAAE,GACnC,kBAAkB,aAAa,CACjC;CACF;CAEA,OAAO,YAAY,KAAK,UAAU,MAAM,MAAM;AAChD;;;;;AAMA,eAAsB,kBAAkB,MAAc,QAA4B;CAMhF,IAAI,EALkB,OAAO,IAA2B,WAG5B,CAAC,EAAE,SAAS,WAAW,QAAQ,IAAI,aAAa,eAE9D;CAGd,MAAM,WADW,cAAc,IAAI,IAAI,KAAK,QAAQ,QAAQ,EACpC,CAAC,YAAY,MAAS,CAAC,CAAC,WAAW,aAAa,MAAM,MAAM,CAAC;CAErF,cAAc,IAAI,MAAM,OAAO;CAE/B,IAAI;EACF,MAAM;CACR,UAAU;EACR,IAAI,cAAc,IAAI,IAAI,MAAM,SAC9B,cAAc,OAAO,IAAI;CAE7B;AACF;;;;;AAMA,MAAM,gCAAgB,IAAI,IAA8B;AAExD,eAAe,aAAa,MAAc,QAA4B;CACpE,MAAM,gBAAgB,OAAO,IAA2B,WAAW;CACnE,MAAM,MAAM,kBAAkB,aAAa;CAC3C,MAAM,aAAa,eAAe,SAAS,cAAc;CACzD,MAAM,MAAM,oBAAoB,KAAK,GAAG,OAAO;CAC/C,MAAM,UAAU,oBAAoB,KAAK;CAGzC,MAAM,aAAa;EAAE,GAAG;EAAQ,QAAQ;EAAW,KAAK;CAAU;CAElE,MAAM,MAAM,IAAI,KAAK,YAAY,GAAG;CAEpC,MAAM,OAAQ,MAAM,MAAM,IAAc,OAAO,KAAM,CAAC;CAEtD,KAAK,KAAK,OAAO,EAAE;CAEnB,OAAO,KAAK,SAAS,YAAY;EAC/B,MAAM,YAAY,KAAK,MAAM;EAE7B,IAAI,WACF,MAAM,MAAM,OAAO,oBAAoB,KAAK,GAAG,WAAW;CAE9D;CAEA,MAAM,MAAM,IAAI,SAAS,MAAM,GAAG;AACpC"}

package/esm/utils/database-log.mjs

@@ -31,9 +31,6 @@ var DatabaseLog = class extends LogChannel {
 		if (message instanceof Error) {
 			data.stack = message.stack;
 			data.content = message.message;
-		} else {
-			data.content = message;
-			data.stack = (/* @__PURE__ */ new Error()).stack;
 		}
 		try {
 			await this.model.create(data);

package/esm/utils/database-log.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"database-log.mjs","names":[],"sources":["../../../../../../../core/src/utils/database-log.ts"],"sourcesContent":["import type { ChildModel, Model } from \"@warlock.js/cascade\";\nimport type { BasicLogConfigurations, LoggingData } from \"@warlock.js/logger\";\nimport { LogChannel, type LogContract, type LogMessage } from \"@warlock.js/logger\";\nimport { DatabaseLogModel } from \"../database/models/database-log\";\n\nexport type DatabaseLogOptions = BasicLogConfigurations & {\n  /**\n   * Model to use for logging\n   */\n  model?: typeof DatabaseLogModel;\n};\n\nexport class DatabaseLog extends LogChannel<DatabaseLogOptions> implements LogContract {\n  /**\n   * {@inheritdoc}\n   */\n  public name = \"database\";\n\n  /**\n   * Database model\n   */\n  public get model(): ChildModel<Model> {\n    return this.config(\"model\") ?? DatabaseLogModel;\n  }\n\n  /**\n   * {@inheritdoc}\n   */\n  public async log(log: LoggingData) {\n    const { module, action, message, type: level } = log;\n\n    if (!this.model.getDataSource().driver?.isConnected) return;\n\n    if (!this.shouldBeLogged(log)) return;\n\n    const data: LogMessage = {\n      module,\n      action,\n      content: message,\n      level,\n      date: new Date().toISOString(),\n    };\n\n    if (message instanceof Error) {\n      data.stack = message.stack;\n      data.content = message.message;\n    } else {\n      data.content = message;\n      data.stack = new Error().stack;\n    }\n\n    try {\n      await this.model.create(data);\n    } catch (error) {\n      console.log(\"Error\", error);\n    }\n  }\n}\n"],"mappings":";;;;;AAYA,IAAa,cAAb,cAAiC,WAAsD;;;cAIvE;;;;;CAKd,IAAW,QAA2B;EACpC,OAAO,KAAK,OAAO,OAAO,KAAK;CACjC;;;;CAKA,MAAa,IAAI,KAAkB;EACjC,MAAM,EAAE,QAAQ,QAAQ,SAAS,MAAM,UAAU;EAEjD,IAAI,CAAC,KAAK,MAAM,cAAc,CAAC,CAAC,QAAQ,aAAa;EAErD,IAAI,CAAC,KAAK,eAAe,GAAG,GAAG;EAE/B,MAAM,OAAmB;GACvB;GACA;GACA,SAAS;GACT;GACA,uBAAM,IAAI,KAAK,EAAC,CAAC,YAAY;EAC/B;EAEA,IAAI,mBAAmB,OAAO;GAC5B,KAAK,QAAQ,QAAQ;GACrB,KAAK,UAAU,QAAQ;EACzB,OAAO;GACL,KAAK,UAAU;GACf,KAAK,yBAAQ,IAAI,MAAM,EAAC,CAAC;EAC3B;EAEA,IAAI;GACF,MAAM,KAAK,MAAM,OAAO,IAAI;EAC9B,SAAS,OAAO;GACd,QAAQ,IAAI,SAAS,KAAK;EAC5B;CACF;AACF"}
+{"version":3,"file":"database-log.mjs","names":[],"sources":["../../../../../../../core/src/utils/database-log.ts"],"sourcesContent":["import type { ChildModel, Model } from \"@warlock.js/cascade\";\nimport type { BasicLogConfigurations, LoggingData } from \"@warlock.js/logger\";\nimport { LogChannel, type LogContract, type LogMessage } from \"@warlock.js/logger\";\nimport { DatabaseLogModel } from \"../database/models/database-log\";\n\nexport type DatabaseLogOptions = BasicLogConfigurations & {\n  /**\n   * Model to use for logging\n   */\n  model?: typeof DatabaseLogModel;\n};\n\nexport class DatabaseLog extends LogChannel<DatabaseLogOptions> implements LogContract {\n  /**\n   * {@inheritdoc}\n   */\n  public name = \"database\";\n\n  /**\n   * Database model\n   */\n  public get model(): ChildModel<Model> {\n    return this.config(\"model\") ?? DatabaseLogModel;\n  }\n\n  /**\n   * {@inheritdoc}\n   */\n  public async log(log: LoggingData) {\n    const { module, action, message, type: level } = log;\n\n    if (!this.model.getDataSource().driver?.isConnected) return;\n\n    if (!this.shouldBeLogged(log)) return;\n\n    const data: LogMessage = {\n      module,\n      action,\n      content: message,\n      level,\n      date: new Date().toISOString(),\n    };\n\n    if (message instanceof Error) {\n      data.stack = message.stack;\n      data.content = message.message;\n    }\n\n    try {\n      await this.model.create(data);\n    } catch (error) {\n      console.log(\"Error\", error);\n    }\n  }\n}\n"],"mappings":";;;;;AAYA,IAAa,cAAb,cAAiC,WAAsD;;;cAIvE;;;;;CAKd,IAAW,QAA2B;EACpC,OAAO,KAAK,OAAO,OAAO,KAAK;CACjC;;;;CAKA,MAAa,IAAI,KAAkB;EACjC,MAAM,EAAE,QAAQ,QAAQ,SAAS,MAAM,UAAU;EAEjD,IAAI,CAAC,KAAK,MAAM,cAAc,CAAC,CAAC,QAAQ,aAAa;EAErD,IAAI,CAAC,KAAK,eAAe,GAAG,GAAG;EAE/B,MAAM,OAAmB;GACvB;GACA;GACA,SAAS;GACT;GACA,uBAAM,IAAI,KAAK,EAAC,CAAC,YAAY;EAC/B;EAEA,IAAI,mBAAmB,OAAO;GAC5B,KAAK,QAAQ,QAAQ;GACrB,KAAK,UAAU,QAAQ;EACzB;EAEA,IAAI;GACF,MAAM,KAAK,MAAM,OAAO,IAAI;EAC9B,SAAS,OAAO;GACd,QAAQ,IAAI,SAAS,KAAK;EAC5B;CACF;AACF"}

package/esm/utils/queue.d.mts

@@ -18,7 +18,9 @@ declare class Queue<T> {
   /** Flag to determine if execution should be parallel or sequential. */
   private readonly executeInParallel;
   /** The batch size for processing items. */
-  private readonly batchSize;
+  private readonly batchSize?;
+  /** Called when the execute function rejects. */
+  private readonly onError;
   /** Whether the current queue is busy executing */
   private isExecuting;
   /**
@@ -29,7 +31,7 @@ declare class Queue<T> {
    * @param executeInParallel - Whether to execute the function in parallel or sequentially.
    * @param batchSize - The number of items to process in each batch.
    */
-  constructor(executeFn: (items: T[]) => Promise<void>, executeInParallel: boolean | undefined, executeEvery: number | undefined, batchSize: number, maxSize?: number);
+  constructor(executeFn: (items: T[]) => Promise<void>, executeInParallel?: boolean, executeEvery?: number, batchSize?: number, maxSize?: number, onError?: (error: unknown) => void);
   /**
    * Adds an item to the queue.
    * Triggers execution if the queue reaches the maximum size.
@@ -42,8 +44,8 @@ declare class Queue<T> {
    */
   private startTimer;
   /**
-   * Executes the function with the current items in the queue.
-   * Processes items in batches and resets the timer.
+   * Executes the function with the queued items until the queue is drained.
+   * Rejections from the execute function are passed to `onError`.
    */
   private execute;
 }

package/esm/utils/queue.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"queue.d.mts","names":[],"sources":["../../../../../../../core/src/utils/queue.ts"],"mappings":";;AAKA;;;;cAAa,KAAA;EAqDU;EAAA,QAnDb,KAAA;EAmDc;EAAA,iBAhDL,OAAA;EAHT;EAAA,iBAMS,QAAA;EAAA;EAAA,iBAGA,SAAA;EAGT;EAAA,QAAA,KAAA;EAMS;EAAA,iBAHA,iBAAA;;mBAGA,SAAA;EAcH;EAAA,QAXN,WAAA;EAWN;;;;;;;;cAAA,SAAA,GAAY,KAAA,EAAO,CAAA,OAAQ,OAAA,QAC3B,iBAAA,uBACA,YAAA,sBACA,SAAA,UACA,OAAA;EAyCY;;AAAO;;;;EA1Bd,OAAA,CAAQ,IAAA,EAAM,CAAA;;;;UAcb,UAAA;;;;;UAYM,OAAA;AAAA"}
+{"version":3,"file":"queue.d.mts","names":[],"sources":["../../../../../../../core/src/utils/queue.ts"],"mappings":";;AAKA;;;;cAAa,KAAA;EA0DU;EAAA,QAxDb,KAAA;EAwDc;EAAA,iBArDL,OAAA;EAHT;EAAA,iBAMS,QAAA;EAAA;EAAA,iBAGA,SAAA;EAGT;EAAA,QAAA,KAAA;EAMS;EAAA,iBAHA,iBAAA;EAST;EAAA,iBANS,SAAA;EAiBI;EAAA,iBAdJ,OAAA;EAcY;EAAA,QAXrB,WAAA;EAYN;;;;;;;;cADA,SAAA,GAAY,KAAA,EAAO,CAAA,OAAQ,OAAA,QAC3B,iBAAA,YACA,YAAA,WACA,SAAA,WACA,OAAA,WACA,OAAA,IAAU,KAAA;EA8BJ;;;AAaa;;;EA3Bd,OAAA,CAAQ,IAAA,EAAM,CAAA;;;;UAcb,UAAA;;;;;UAaM,OAAA;AAAA"}

package/esm/utils/queue.mjs

@@ -13,10 +13,11 @@ var Queue = class {
 	* @param executeInParallel - Whether to execute the function in parallel or sequentially.
 	* @param batchSize - The number of items to process in each batch.
 	*/
-	constructor(executeFn, executeInParallel = true, executeEvery = 5e3, batchSize, maxSize) {
+	constructor(executeFn, executeInParallel = true, executeEvery = 5e3, batchSize, maxSize, onError = (error) => console.error("Queue execution failed", error)) {
 		this.items = [];
 		this.timer = null;
 		this.isExecuting = false;
+		this.onError = onError;
 		this.executeFn = executeFn;
 		this.maxSize = maxSize;
 		this.interval = executeEvery;
@@ -32,7 +33,7 @@ var Queue = class {
 	enqueue(item) {
 		this.items.push(item);
 		if (this.maxSize && this.items.length >= this.maxSize) this.execute();
-		if (!this.timer) this.startTimer();
+		if (!this.timer && !this.isExecuting) this.startTimer();
 	}
 	/**
 	* Starts a timer to execute the queue after the specified interval.
@@ -41,23 +42,33 @@ var Queue = class {
 		this.timer = setInterval(() => {
 			if (this.items.length > 0) this.execute();
 		}, this.interval);
+		this.timer.unref?.();
 	}
 	/**
-	* Executes the function with the current items in the queue.
-	* Processes items in batches and resets the timer.
+	* Executes the function with the queued items until the queue is drained.
+	* Rejections from the execute function are passed to `onError`.
 	*/
 	async execute() {
 		if (this.timer) {
 			clearInterval(this.timer);
 			this.timer = null;
 		}
+		if (this.isExecuting) return;
 		this.isExecuting = true;
-		if (this.batchSize) {
-			const itemsToProcess = this.items.splice(0, this.batchSize);
-			if (this.executeInParallel) await Promise.all(itemsToProcess.map((item) => this.executeFn([item])));
-			else for (const item of itemsToProcess) await this.executeFn([item]);
+		try {
+			while (this.items.length > 0) {
+				const batch = this.items.splice(0, this.batchSize || this.items.length);
+				try {
+					if (!this.batchSize) await this.executeFn(batch);
+					else if (this.executeInParallel) await Promise.all(batch.map((item) => this.executeFn([item])));
+					else for (const item of batch) await this.executeFn([item]);
+				} catch (error) {
+					this.onError(error);
+				}
+			}
+		} finally {
+			this.isExecuting = false;
 		}
-		this.isExecuting = false;
 	}
 };
 

package/esm/utils/queue.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"queue.mjs","names":[],"sources":["../../../../../../../core/src/utils/queue.ts"],"sourcesContent":["/**\n * A utility class for managing a queue of operations.\n * Allows enqueuing values and executing a function when the queue reaches a certain size or after a specified interval.\n * Supports both parallel and sequential execution of the queued operations.\n */\nexport class Queue<T> {\n  /** The items currently in the queue. */\n  private items: T[] = [];\n\n  /** The maximum size of the queue before triggering execution. */\n  private readonly maxSize?: number;\n\n  /** The interval in milliseconds after which the queue will be executed if not already triggered by size. */\n  private readonly interval: number;\n\n  /** The function to execute with the items in the queue. */\n  private readonly executeFn: (items: T[]) => Promise<void>;\n\n  /** Timer for managing the interval-based execution. */\n  private timer: NodeJS.Timeout | null = null;\n\n  /** Flag to determine if execution should be parallel or sequential. */\n  private readonly executeInParallel: boolean;\n\n  /** The batch size for processing items. */\n  private readonly batchSize: number;\n\n  /** Whether the current queue is busy executing */\n  private isExecuting = false;\n\n  /**\n   * Constructs a new Queue instance.\n   * @param executeFn - The function to execute with the items in the queue.\n   * @param maxSize - The maximum number of items before the queue is executed.\n   * @param executeEvery - The time in milliseconds after which the queue is executed if not already triggered.\n   * @param executeInParallel - Whether to execute the function in parallel or sequentially.\n   * @param batchSize - The number of items to process in each batch.\n   */\n  public constructor(\n    executeFn: (items: T[]) => Promise<void>,\n    executeInParallel: boolean = true,\n    executeEvery: number = 5000,\n    batchSize: number,\n    maxSize?: number,\n  ) {\n    this.executeFn = executeFn;\n    this.maxSize = maxSize;\n    this.interval = executeEvery;\n    this.executeInParallel = executeInParallel;\n    this.batchSize = batchSize;\n  }\n\n  /**\n   * Adds an item to the queue.\n   * Triggers execution if the queue reaches the maximum size.\n   * Starts a timer if not already running.\n   * @param item - The item to add to the queue.\n   */\n  public enqueue(item: T): void {\n    this.items.push(item);\n    if (this.maxSize && this.items.length >= this.maxSize) {\n      this.execute();\n    }\n\n    if (!this.timer) {\n      this.startTimer();\n    }\n  }\n\n  /**\n   * Starts a timer to execute the queue after the specified interval.\n   */\n  private startTimer(): void {\n    this.timer = setInterval(() => {\n      if (this.items.length > 0) {\n        this.execute();\n      }\n    }, this.interval);\n  }\n\n  /**\n   * Executes the function with the current items in the queue.\n   * Processes items in batches and resets the timer.\n   */\n  private async execute(): Promise<void> {\n    if (this.timer) {\n      clearInterval(this.timer);\n      this.timer = null;\n    }\n\n    this.isExecuting = true;\n\n    // Now there are couple scenarios:\n    // 1. Batch size has value, we need to check if its going to be executed in parallel or sequentially\n    // 2. Batch size is not provided, we will execute all items in a single call\n    if (this.batchSize) {\n      const itemsToProcess = this.items.splice(0, this.batchSize);\n      if (this.executeInParallel) {\n        await Promise.all(itemsToProcess.map((item) => this.executeFn([item])));\n      } else {\n        for (const item of itemsToProcess) {\n          await this.executeFn([item]);\n        }\n      }\n    }\n\n    this.isExecuting = false;\n  }\n}\n"],"mappings":";;;;;;AAKA,IAAa,QAAb,MAAsB;;;;;;;;;CAiCpB,AAAO,YACL,WACA,oBAA6B,MAC7B,eAAuB,KACvB,WACA,SACA;eArCmB,CAAC;eAYiB;qBASjB;EAiBpB,KAAK,YAAY;EACjB,KAAK,UAAU;EACf,KAAK,WAAW;EAChB,KAAK,oBAAoB;EACzB,KAAK,YAAY;CACnB;;;;;;;CAQA,AAAO,QAAQ,MAAe;EAC5B,KAAK,MAAM,KAAK,IAAI;EACpB,IAAI,KAAK,WAAW,KAAK,MAAM,UAAU,KAAK,SAC5C,KAAK,QAAQ;EAGf,IAAI,CAAC,KAAK,OACR,KAAK,WAAW;CAEpB;;;;CAKA,AAAQ,aAAmB;EACzB,KAAK,QAAQ,kBAAkB;GAC7B,IAAI,KAAK,MAAM,SAAS,GACtB,KAAK,QAAQ;EAEjB,GAAG,KAAK,QAAQ;CAClB;;;;;CAMA,MAAc,UAAyB;EACrC,IAAI,KAAK,OAAO;GACd,cAAc,KAAK,KAAK;GACxB,KAAK,QAAQ;EACf;EAEA,KAAK,cAAc;EAKnB,IAAI,KAAK,WAAW;GAClB,MAAM,iBAAiB,KAAK,MAAM,OAAO,GAAG,KAAK,SAAS;GAC1D,IAAI,KAAK,mBACP,MAAM,QAAQ,IAAI,eAAe,KAAK,SAAS,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAEtE,KAAK,MAAM,QAAQ,gBACjB,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC;EAGjC;EAEA,KAAK,cAAc;CACrB;AACF"}
+{"version":3,"file":"queue.mjs","names":[],"sources":["../../../../../../../core/src/utils/queue.ts"],"sourcesContent":["/**\n * A utility class for managing a queue of operations.\n * Allows enqueuing values and executing a function when the queue reaches a certain size or after a specified interval.\n * Supports both parallel and sequential execution of the queued operations.\n */\nexport class Queue<T> {\n  /** The items currently in the queue. */\n  private items: T[] = [];\n\n  /** The maximum size of the queue before triggering execution. */\n  private readonly maxSize?: number;\n\n  /** The interval in milliseconds after which the queue will be executed if not already triggered by size. */\n  private readonly interval: number;\n\n  /** The function to execute with the items in the queue. */\n  private readonly executeFn: (items: T[]) => Promise<void>;\n\n  /** Timer for managing the interval-based execution. */\n  private timer: NodeJS.Timeout | null = null;\n\n  /** Flag to determine if execution should be parallel or sequential. */\n  private readonly executeInParallel: boolean;\n\n  /** The batch size for processing items. */\n  private readonly batchSize?: number;\n\n  /** Called when the execute function rejects. */\n  private readonly onError: (error: unknown) => void;\n\n  /** Whether the current queue is busy executing */\n  private isExecuting = false;\n\n  /**\n   * Constructs a new Queue instance.\n   * @param executeFn - The function to execute with the items in the queue.\n   * @param maxSize - The maximum number of items before the queue is executed.\n   * @param executeEvery - The time in milliseconds after which the queue is executed if not already triggered.\n   * @param executeInParallel - Whether to execute the function in parallel or sequentially.\n   * @param batchSize - The number of items to process in each batch.\n   */\n  public constructor(\n    executeFn: (items: T[]) => Promise<void>,\n    executeInParallel: boolean = true,\n    executeEvery: number = 5000,\n    batchSize?: number,\n    maxSize?: number,\n    onError: (error: unknown) => void = (error) => console.error(\"Queue execution failed\", error),\n  ) {\n    this.onError = onError;\n    this.executeFn = executeFn;\n    this.maxSize = maxSize;\n    this.interval = executeEvery;\n    this.executeInParallel = executeInParallel;\n    this.batchSize = batchSize;\n  }\n\n  /**\n   * Adds an item to the queue.\n   * Triggers execution if the queue reaches the maximum size.\n   * Starts a timer if not already running.\n   * @param item - The item to add to the queue.\n   */\n  public enqueue(item: T): void {\n    this.items.push(item);\n    if (this.maxSize && this.items.length >= this.maxSize) {\n      void this.execute();\n    }\n\n    if (!this.timer && !this.isExecuting) {\n      this.startTimer();\n    }\n  }\n\n  /**\n   * Starts a timer to execute the queue after the specified interval.\n   */\n  private startTimer(): void {\n    this.timer = setInterval(() => {\n      if (this.items.length > 0) {\n        void this.execute();\n      }\n    }, this.interval);\n    this.timer.unref?.();\n  }\n\n  /**\n   * Executes the function with the queued items until the queue is drained.\n   * Rejections from the execute function are passed to `onError`.\n   */\n  private async execute(): Promise<void> {\n    if (this.timer) {\n      clearInterval(this.timer);\n      this.timer = null;\n    }\n\n    // the running drain loop will pick up newly enqueued items\n    if (this.isExecuting) return;\n\n    this.isExecuting = true;\n\n    try {\n      while (this.items.length > 0) {\n        // Without a batch size, all items go in a single call\n        const batch = this.items.splice(0, this.batchSize || this.items.length);\n\n        try {\n          if (!this.batchSize) {\n            await this.executeFn(batch);\n          } else if (this.executeInParallel) {\n            await Promise.all(batch.map((item) => this.executeFn([item])));\n          } else {\n            for (const item of batch) {\n              await this.executeFn([item]);\n            }\n          }\n        } catch (error) {\n          this.onError(error);\n        }\n      }\n    } finally {\n      this.isExecuting = false;\n    }\n  }\n}\n"],"mappings":";;;;;;AAKA,IAAa,QAAb,MAAsB;;;;;;;;;CAoCpB,AAAO,YACL,WACA,oBAA6B,MAC7B,eAAuB,KACvB,WACA,SACA,WAAqC,UAAU,QAAQ,MAAM,0BAA0B,KAAK,GAC5F;eAzCmB,CAAC;eAYiB;qBAYjB;EAkBpB,KAAK,UAAU;EACf,KAAK,YAAY;EACjB,KAAK,UAAU;EACf,KAAK,WAAW;EAChB,KAAK,oBAAoB;EACzB,KAAK,YAAY;CACnB;;;;;;;CAQA,AAAO,QAAQ,MAAe;EAC5B,KAAK,MAAM,KAAK,IAAI;EACpB,IAAI,KAAK,WAAW,KAAK,MAAM,UAAU,KAAK,SAC5C,AAAK,KAAK,QAAQ;EAGpB,IAAI,CAAC,KAAK,SAAS,CAAC,KAAK,aACvB,KAAK,WAAW;CAEpB;;;;CAKA,AAAQ,aAAmB;EACzB,KAAK,QAAQ,kBAAkB;GAC7B,IAAI,KAAK,MAAM,SAAS,GACtB,AAAK,KAAK,QAAQ;EAEtB,GAAG,KAAK,QAAQ;EAChB,KAAK,MAAM,QAAQ;CACrB;;;;;CAMA,MAAc,UAAyB;EACrC,IAAI,KAAK,OAAO;GACd,cAAc,KAAK,KAAK;GACxB,KAAK,QAAQ;EACf;EAGA,IAAI,KAAK,aAAa;EAEtB,KAAK,cAAc;EAEnB,IAAI;GACF,OAAO,KAAK,MAAM,SAAS,GAAG;IAE5B,MAAM,QAAQ,KAAK,MAAM,OAAO,GAAG,KAAK,aAAa,KAAK,MAAM,MAAM;IAEtE,IAAI;KACF,IAAI,CAAC,KAAK,WACR,MAAM,KAAK,UAAU,KAAK;UACrB,IAAI,KAAK,mBACd,MAAM,QAAQ,IAAI,MAAM,KAAK,SAAS,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;UAE7D,KAAK,MAAM,QAAQ,OACjB,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC;IAGjC,SAAS,OAAO;KACd,KAAK,QAAQ,KAAK;IACpB;GACF;EACF,UAAU;GACR,KAAK,cAAc;EACrB;CACF;AACF"}

package/esm/validation/database/exists-except-current-id.mjs

@@ -11,11 +11,15 @@ const existsExceptCurrentIdRule = {
 	name: "existsExceptCurrentId",
 	defaultErrorMessage: "The :input must exist",
 	async validate(value, context) {
-		const { Model, query, column = context.key, exceptCurrentIdColumn = "id" } = this.context.options;
+		const { Model, query, column = context.key, exceptCurrentIdColumn = "id", param = "id" } = this.context.options;
 		const { request } = useRequestStore();
 		const dbQuery = resolveModelClass(Model).query();
 		dbQuery.where(column, value);
-		dbQuery.where(exceptCurrentIdColumn, "!=", request.int("id"));
+		const rawId = request.input(param);
+		if (rawId !== void 0 && rawId !== null && rawId !== "") {
+			const currentId = typeof rawId === "string" && /^\d{1,15}$/.test(rawId) ? Number(rawId) : rawId;
+			dbQuery.where(exceptCurrentIdColumn, "!=", currentId);
+		}
 		if (query) await query({
 			query: dbQuery,
 			value,

package/esm/validation/database/exists-except-current-id.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"exists-except-current-id.mjs","names":[],"sources":["../../../../../../../../core/src/validation/database/exists-except-current-id.ts"],"sourcesContent":["import { resolveModelClass } from \"@warlock.js/cascade\";\nimport { invalidRule, VALID_RULE, type SchemaRule } from \"@warlock.js/seal\";\nimport { useRequestStore } from \"../../http\";\nimport type { ExistsExceptCurrentIdRuleOptions } from \"../types\";\n\n/**\n * Exists except current ID rule\n */\nexport const existsExceptCurrentIdRule: SchemaRule<ExistsExceptCurrentIdRuleOptions> = {\n  name: \"existsExceptCurrentId\",\n  defaultErrorMessage: \"The :input must exist\",\n  async validate(value: any, context) {\n    const {\n      Model,\n      query,\n      column = context.key,\n      exceptCurrentIdColumn = \"id\",\n    } = this.context.options;\n\n    const { request } = useRequestStore();\n\n    const ResolvedModelClass = resolveModelClass(Model);\n\n    const dbQuery = ResolvedModelClass.query();\n\n    dbQuery.where(column, value);\n    dbQuery.where(exceptCurrentIdColumn, \"!=\", request.int(\"id\"));\n\n    if (query) {\n      await query({\n        query: dbQuery,\n        value,\n        allValues: context.allValues,\n      });\n    }\n\n    const document = await dbQuery.first();\n    return document ? VALID_RULE : invalidRule(this, context);\n  },\n};\n"],"mappings":";;;;;;;;;AAQA,MAAa,4BAA0E;CACrF,MAAM;CACN,qBAAqB;CACrB,MAAM,SAAS,OAAY,SAAS;EAClC,MAAM,EACJ,OACA,OACA,SAAS,QAAQ,KACjB,wBAAwB,SACtB,KAAK,QAAQ;EAEjB,MAAM,EAAE,YAAY,gBAAgB;EAIpC,MAAM,UAFqB,kBAAkB,KAEZ,CAAC,CAAC,MAAM;EAEzC,QAAQ,MAAM,QAAQ,KAAK;EAC3B,QAAQ,MAAM,uBAAuB,MAAM,QAAQ,IAAI,IAAI,CAAC;EAE5D,IAAI,OACF,MAAM,MAAM;GACV,OAAO;GACP;GACA,WAAW,QAAQ;EACrB,CAAC;EAIH,OAAO,MADgB,QAAQ,MAAM,IACnB,aAAa,YAAY,MAAM,OAAO;CAC1D;AACF"}
+{"version":3,"file":"exists-except-current-id.mjs","names":[],"sources":["../../../../../../../../core/src/validation/database/exists-except-current-id.ts"],"sourcesContent":["import { resolveModelClass } from \"@warlock.js/cascade\";\nimport { invalidRule, VALID_RULE, type SchemaRule } from \"@warlock.js/seal\";\nimport { useRequestStore } from \"../../http\";\nimport type { ExistsExceptCurrentIdRuleOptions } from \"../types\";\n\n/**\n * Exists except current ID rule\n */\nexport const existsExceptCurrentIdRule: SchemaRule<ExistsExceptCurrentIdRuleOptions> = {\n  name: \"existsExceptCurrentId\",\n  defaultErrorMessage: \"The :input must exist\",\n  async validate(value: any, context) {\n    const {\n      Model,\n      query,\n      column = context.key,\n      exceptCurrentIdColumn = \"id\",\n      param = \"id\",\n    } = this.context.options as ExistsExceptCurrentIdRuleOptions & { param?: string };\n\n    const { request } = useRequestStore();\n\n    const ResolvedModelClass = resolveModelClass(Model);\n\n    const dbQuery = ResolvedModelClass.query();\n\n    dbQuery.where(column, value);\n    // Read the current id from the configured route param, keeping ObjectId/UUID strings intact\n    const rawId = request.input(param);\n\n    if (rawId !== undefined && rawId !== null && rawId !== \"\") {\n      const currentId =\n        typeof rawId === \"string\" && /^\\d{1,15}$/.test(rawId) ? Number(rawId) : rawId;\n\n      dbQuery.where(exceptCurrentIdColumn, \"!=\", currentId);\n    }\n\n    if (query) {\n      await query({\n        query: dbQuery,\n        value,\n        allValues: context.allValues,\n      });\n    }\n\n    const document = await dbQuery.first();\n    return document ? VALID_RULE : invalidRule(this, context);\n  },\n};\n"],"mappings":";;;;;;;;;AAQA,MAAa,4BAA0E;CACrF,MAAM;CACN,qBAAqB;CACrB,MAAM,SAAS,OAAY,SAAS;EAClC,MAAM,EACJ,OACA,OACA,SAAS,QAAQ,KACjB,wBAAwB,MACxB,QAAQ,SACN,KAAK,QAAQ;EAEjB,MAAM,EAAE,YAAY,gBAAgB;EAIpC,MAAM,UAFqB,kBAAkB,KAEZ,CAAC,CAAC,MAAM;EAEzC,QAAQ,MAAM,QAAQ,KAAK;EAE3B,MAAM,QAAQ,QAAQ,MAAM,KAAK;EAEjC,IAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,IAAI;GACzD,MAAM,YACJ,OAAO,UAAU,YAAY,aAAa,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;GAE1E,QAAQ,MAAM,uBAAuB,MAAM,SAAS;EACtD;EAEA,IAAI,OACF,MAAM,MAAM;GACV,OAAO;GACP;GACA,WAAW,QAAQ;EACrB,CAAC;EAIH,OAAO,MADgB,QAAQ,MAAM,IACnB,aAAa,YAAY,MAAM,OAAO;CAC1D;AACF"}

package/esm/validation/database/unique-except-current-id.mjs

@@ -11,11 +11,15 @@ const uniqueExceptCurrentIdRule = {
 	name: "uniqueExceptCurrentId",
 	defaultErrorMessage: "The :input must be unique",
 	async validate(value, context) {
-		const { Model, column = context.key, exceptCurrentIdColumn = "id", query } = this.context.options;
+		const { Model, column = context.key, exceptCurrentIdColumn = "id", query, param = "id" } = this.context.options;
 		const { request } = useRequestStore();
 		const dbQuery = resolveModelClass(Model).query();
 		dbQuery.where(column, value);
-		dbQuery.where(exceptCurrentIdColumn, "!=", request.input("id"));
+		const rawId = request.input(param);
+		if (rawId !== void 0 && rawId !== null && rawId !== "") {
+			const currentId = typeof rawId === "string" && /^\d{1,15}$/.test(rawId) ? Number(rawId) : rawId;
+			dbQuery.where(exceptCurrentIdColumn, "!=", currentId);
+		}
 		if (query) await query({
 			query: dbQuery,
 			value,

package/esm/validation/database/unique-except-current-id.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"unique-except-current-id.mjs","names":[],"sources":["../../../../../../../../core/src/validation/database/unique-except-current-id.ts"],"sourcesContent":["import { resolveModelClass } from \"@warlock.js/cascade\";\nimport { invalidRule, VALID_RULE, type SchemaRule } from \"@warlock.js/seal\";\nimport { useRequestStore } from \"../../http\";\nimport type { UniqueExceptCurrentIdRuleOptions } from \"../types\";\n/**\n * Unique except current ID rule\n */\nexport const uniqueExceptCurrentIdRule: SchemaRule<UniqueExceptCurrentIdRuleOptions> = {\n  name: \"uniqueExceptCurrentId\",\n  defaultErrorMessage: \"The :input must be unique\",\n  async validate(value: any, context) {\n    const {\n      Model,\n      column = context.key,\n      exceptCurrentIdColumn = \"id\",\n      query,\n    } = this.context.options;\n\n    const { request } = useRequestStore();\n\n    const ResolvedModelClass = resolveModelClass(Model);\n\n    const dbQuery = ResolvedModelClass.query();\n\n    dbQuery.where(column, value);\n    dbQuery.where(exceptCurrentIdColumn, \"!=\", request.input(\"id\"));\n\n    if (query) {\n      await query({\n        query: dbQuery,\n        value,\n        allValues: context.allValues,\n      });\n    }\n\n    const document = await dbQuery.first();\n    return document ? invalidRule(this, context) : VALID_RULE;\n  },\n};\n"],"mappings":";;;;;;;;;AAOA,MAAa,4BAA0E;CACrF,MAAM;CACN,qBAAqB;CACrB,MAAM,SAAS,OAAY,SAAS;EAClC,MAAM,EACJ,OACA,SAAS,QAAQ,KACjB,wBAAwB,MACxB,UACE,KAAK,QAAQ;EAEjB,MAAM,EAAE,YAAY,gBAAgB;EAIpC,MAAM,UAFqB,kBAAkB,KAEZ,CAAC,CAAC,MAAM;EAEzC,QAAQ,MAAM,QAAQ,KAAK;EAC3B,QAAQ,MAAM,uBAAuB,MAAM,QAAQ,MAAM,IAAI,CAAC;EAE9D,IAAI,OACF,MAAM,MAAM;GACV,OAAO;GACP;GACA,WAAW,QAAQ;EACrB,CAAC;EAIH,OAAO,MADgB,QAAQ,MAAM,IACnB,YAAY,MAAM,OAAO,IAAI;CACjD;AACF"}
+{"version":3,"file":"unique-except-current-id.mjs","names":[],"sources":["../../../../../../../../core/src/validation/database/unique-except-current-id.ts"],"sourcesContent":["import { resolveModelClass } from \"@warlock.js/cascade\";\nimport { invalidRule, VALID_RULE, type SchemaRule } from \"@warlock.js/seal\";\nimport { useRequestStore } from \"../../http\";\nimport type { UniqueExceptCurrentIdRuleOptions } from \"../types\";\n/**\n * Unique except current ID rule\n */\nexport const uniqueExceptCurrentIdRule: SchemaRule<UniqueExceptCurrentIdRuleOptions> = {\n  name: \"uniqueExceptCurrentId\",\n  defaultErrorMessage: \"The :input must be unique\",\n  async validate(value: any, context) {\n    const {\n      Model,\n      column = context.key,\n      exceptCurrentIdColumn = \"id\",\n      query,\n      param = \"id\",\n    } = this.context.options as UniqueExceptCurrentIdRuleOptions & { param?: string };\n\n    const { request } = useRequestStore();\n\n    const ResolvedModelClass = resolveModelClass(Model);\n\n    const dbQuery = ResolvedModelClass.query();\n\n    dbQuery.where(column, value);\n    // Read the current id from the configured route param, keeping ObjectId/UUID strings intact\n    const rawId = request.input(param);\n\n    if (rawId !== undefined && rawId !== null && rawId !== \"\") {\n      const currentId =\n        typeof rawId === \"string\" && /^\\d{1,15}$/.test(rawId) ? Number(rawId) : rawId;\n\n      dbQuery.where(exceptCurrentIdColumn, \"!=\", currentId);\n    }\n\n    if (query) {\n      await query({\n        query: dbQuery,\n        value,\n        allValues: context.allValues,\n      });\n    }\n\n    const document = await dbQuery.first();\n    return document ? invalidRule(this, context) : VALID_RULE;\n  },\n};\n"],"mappings":";;;;;;;;;AAOA,MAAa,4BAA0E;CACrF,MAAM;CACN,qBAAqB;CACrB,MAAM,SAAS,OAAY,SAAS;EAClC,MAAM,EACJ,OACA,SAAS,QAAQ,KACjB,wBAAwB,MACxB,OACA,QAAQ,SACN,KAAK,QAAQ;EAEjB,MAAM,EAAE,YAAY,gBAAgB;EAIpC,MAAM,UAFqB,kBAAkB,KAEZ,CAAC,CAAC,MAAM;EAEzC,QAAQ,MAAM,QAAQ,KAAK;EAE3B,MAAM,QAAQ,QAAQ,MAAM,KAAK;EAEjC,IAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,IAAI;GACzD,MAAM,YACJ,OAAO,UAAU,YAAY,aAAa,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;GAE1E,QAAQ,MAAM,uBAAuB,MAAM,SAAS;EACtD;EAEA,IAAI,OACF,MAAM,MAAM;GACV,OAAO;GACP;GACA,WAAW,QAAQ;EACrB,CAAC;EAIH,OAAO,MADgB,QAAQ,MAAM,IACnB,YAAY,MAAM,OAAO,IAAI;CACjD;AACF"}

package/esm/validation/init.mjs

@@ -5,7 +5,7 @@ import { databasePlugin } from "./plugins/database-plugin.mjs";
 import { filePlugin } from "./plugins/file-plugin.mjs";
 import { localizedPlugin } from "./plugins/localized-plugin.mjs";
 import "./plugins/index.mjs";
-import { configureSeal, registerPlugin } from "@warlock.js/seal";
+import { configureSeal, getSealConfig, registerPlugin } from "@warlock.js/seal";
 
 //#region ../core/src/validation/init.ts
 /**
@@ -14,7 +14,6 @@ import { configureSeal, registerPlugin } from "@warlock.js/seal";
 * This file configures Seal to use Warlock's localization system
 */
 configureSeal({
-	firstErrorOnly: config.key("validation.firstErrorOnly", true),
 	translateRule({ rule, attributes }) {
 		const translateRule = config.key("validation.translateRule");
 		if (translateRule) return translateRule({
@@ -38,6 +37,11 @@ configureSeal({
 		return output === translationKey ? attribute : output;
 	}
 });
+Object.defineProperty(getSealConfig(), "firstErrorOnly", {
+	configurable: true,
+	enumerable: true,
+	get: () => config.key("validation.firstErrorOnly", true)
+});
 registerPlugin(databasePlugin);
 registerPlugin(filePlugin);
 registerPlugin(localizedPlugin);

package/esm/validation/init.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"init.mjs","names":[],"sources":["../../../../../../../core/src/validation/init.ts"],"sourcesContent":["/**\n * Initialize Seal with Warlock Framework Settings\n *\n * This file configures Seal to use Warlock's localization system\n */\n\n// Auto-register framework plugins\nimport { configureSeal, registerPlugin } from \"@warlock.js/seal\";\nimport { config } from \"../config\";\nimport { t } from \"../http/middleware/inject-request-context\";\nimport { databasePlugin, filePlugin, localizedPlugin } from \"./plugins\";\n\n// Configure Seal to use Warlock's localization\nconfigureSeal({\n  firstErrorOnly: config.key(\"validation.firstErrorOnly\", true),\n  translateRule({ rule, attributes }) {\n    const translateRule = config.key(\"validation.translateRule\");\n\n    if (translateRule) {\n      return translateRule({ rule, attributes });\n    }\n\n    const translationGroup = config.key(\"validation.translationGroup\", \"validation\");\n\n    const translationKey = `${translationGroup}.${rule.name}`;\n    const translation = t(translationKey, attributes);\n\n    return translation === translationKey\n      ? rule.errorMessage || rule.defaultErrorMessage\n      : translation;\n  },\n\n  translateAttribute({ attribute, context, rule }) {\n    const translateAttribute = config.key(\"validation.translateAttribute\");\n\n    if (translateAttribute) {\n      return translateAttribute({ attribute, context, rule });\n    }\n\n    const attributeGroup = config.key(\"validation.attributeGroup\") ?? \"attributes\";\n\n    const translationKey = `${attributeGroup ? attributeGroup + \".\" : \"\"}${attribute}`;\n\n    const output = t(translationKey, context.allValues);\n    return output === translationKey ? attribute : output;\n  },\n});\n\n// Register plugins to inject methods\nregisterPlugin(databasePlugin);\nregisterPlugin(filePlugin);\nregisterPlugin(localizedPlugin);\n"],"mappings":";;;;;;;;;;;;;;;AAaA,cAAc;CACZ,gBAAgB,OAAO,IAAI,6BAA6B,IAAI;CAC5D,cAAc,EAAE,MAAM,cAAc;EAClC,MAAM,gBAAgB,OAAO,IAAI,0BAA0B;EAE3D,IAAI,eACF,OAAO,cAAc;GAAE;GAAM;EAAW,CAAC;EAK3C,MAAM,iBAAiB,GAFE,OAAO,IAAI,+BAA+B,YAE1B,EAAE,GAAG,KAAK;EACnD,MAAM,cAAc,EAAE,gBAAgB,UAAU;EAEhD,OAAO,gBAAgB,iBACnB,KAAK,gBAAgB,KAAK,sBAC1B;CACN;CAEA,mBAAmB,EAAE,WAAW,SAAS,QAAQ;EAC/C,MAAM,qBAAqB,OAAO,IAAI,+BAA+B;EAErE,IAAI,oBACF,OAAO,mBAAmB;GAAE;GAAW;GAAS;EAAK,CAAC;EAGxD,MAAM,iBAAiB,OAAO,IAAI,2BAA2B,KAAK;EAElE,MAAM,iBAAiB,GAAG,iBAAiB,iBAAiB,MAAM,KAAK;EAEvE,MAAM,SAAS,EAAE,gBAAgB,QAAQ,SAAS;EAClD,OAAO,WAAW,iBAAiB,YAAY;CACjD;AACF,CAAC;AAGD,eAAe,cAAc;AAC7B,eAAe,UAAU;AACzB,eAAe,eAAe"}
+{"version":3,"file":"init.mjs","names":[],"sources":["../../../../../../../core/src/validation/init.ts"],"sourcesContent":["/**\n * Initialize Seal with Warlock Framework Settings\n *\n * This file configures Seal to use Warlock's localization system\n */\n\n// Auto-register framework plugins\nimport { configureSeal, getSealConfig, registerPlugin } from \"@warlock.js/seal\";\nimport { config } from \"../config\";\nimport { t } from \"../http/middleware/inject-request-context\";\nimport { databasePlugin, filePlugin, localizedPlugin } from \"./plugins\";\n\n// Configure Seal to use Warlock's localization\nconfigureSeal({\n  translateRule({ rule, attributes }) {\n    const translateRule = config.key(\"validation.translateRule\");\n\n    if (translateRule) {\n      return translateRule({ rule, attributes });\n    }\n\n    const translationGroup = config.key(\"validation.translationGroup\", \"validation\");\n\n    const translationKey = `${translationGroup}.${rule.name}`;\n    const translation = t(translationKey, attributes);\n\n    return translation === translationKey\n      ? rule.errorMessage || rule.defaultErrorMessage\n      : translation;\n  },\n\n  translateAttribute({ attribute, context, rule }) {\n    const translateAttribute = config.key(\"validation.translateAttribute\");\n\n    if (translateAttribute) {\n      return translateAttribute({ attribute, context, rule });\n    }\n\n    const attributeGroup = config.key(\"validation.attributeGroup\") ?? \"attributes\";\n\n    const translationKey = `${attributeGroup ? attributeGroup + \".\" : \"\"}${attribute}`;\n\n    const output = t(translationKey, context.allValues);\n    return output === translationKey ? attribute : output;\n  },\n});\n\n// App config is not loaded yet when this module is imported, so resolve\n// firstErrorOnly lazily on every read instead of capturing it once.\nObject.defineProperty(getSealConfig(), \"firstErrorOnly\", {\n  configurable: true,\n  enumerable: true,\n  get: () => config.key(\"validation.firstErrorOnly\", true),\n});\n\n// Register plugins to inject methods\nregisterPlugin(databasePlugin);\nregisterPlugin(filePlugin);\nregisterPlugin(localizedPlugin);\n"],"mappings":";;;;;;;;;;;;;;;AAaA,cAAc;CACZ,cAAc,EAAE,MAAM,cAAc;EAClC,MAAM,gBAAgB,OAAO,IAAI,0BAA0B;EAE3D,IAAI,eACF,OAAO,cAAc;GAAE;GAAM;EAAW,CAAC;EAK3C,MAAM,iBAAiB,GAFE,OAAO,IAAI,+BAA+B,YAE1B,EAAE,GAAG,KAAK;EACnD,MAAM,cAAc,EAAE,gBAAgB,UAAU;EAEhD,OAAO,gBAAgB,iBACnB,KAAK,gBAAgB,KAAK,sBAC1B;CACN;CAEA,mBAAmB,EAAE,WAAW,SAAS,QAAQ;EAC/C,MAAM,qBAAqB,OAAO,IAAI,+BAA+B;EAErE,IAAI,oBACF,OAAO,mBAAmB;GAAE;GAAW;GAAS;EAAK,CAAC;EAGxD,MAAM,iBAAiB,OAAO,IAAI,2BAA2B,KAAK;EAElE,MAAM,iBAAiB,GAAG,iBAAiB,iBAAiB,MAAM,KAAK;EAEvE,MAAM,SAAS,EAAE,gBAAgB,QAAQ,SAAS;EAClD,OAAO,WAAW,iBAAiB,YAAY;CACjD;AACF,CAAC;AAID,OAAO,eAAe,cAAc,GAAG,kBAAkB;CACvD,cAAc;CACd,YAAY;CACZ,WAAW,OAAO,IAAI,6BAA6B,IAAI;AACzD,CAAC;AAGD,eAAe,cAAc;AAC7B,eAAe,UAAU;AACzB,eAAe,eAAe"}

package/esm/validation/validateAll.mjs

@@ -1,3 +1,4 @@
+import { Response } from "../http/response.mjs";
 import { v } from "@warlock.js/seal";
 import config from "@mongez/config";
 import { log } from "@warlock.js/logger";
@@ -43,9 +44,9 @@ async function validateAll(validation, request, response) {
 			response
 		});
 		if (result) {
-			if (!response.statusCode) response.setStatusCode(config.get("validation.responseStatus", 400));
 			log.info("validation", "failed", "Validation failed");
-			return result;
+			if (result instanceof Response) return result;
+			return response.send(result, config.get("validation.responseStatus", 400));
 		}
 		log.info("validation", "passed", "Validation passed");
 	}