@warlock.js/core 5.25.0 → 5.26.0

package/esm/http/build-rate-limit-options.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"build-rate-limit-options.mjs","names":[],"sources":["../../../../../../../core/src/http/build-rate-limit-options.ts"],"sourcesContent":["import type { RateLimitPluginOptions } from \"@fastify/rate-limit\";\n\n/**\n * `@fastify/rate-limit` options that `http.rateLimit` passes straight through.\n */\nconst passthroughKeys = [\n  \"redis\",\n  \"nameSpace\",\n  \"keyGenerator\",\n  \"skipOnError\",\n  \"allowList\",\n  \"continueExceeding\",\n  \"enableDraftSpec\",\n  \"global\",\n  \"hook\",\n  \"cache\",\n  \"errorResponseBuilder\",\n  \"addHeaders\",\n  \"addHeadersOnExceeding\",\n] as const;\n\n/**\n * Shape of the `http.rateLimit` config.\n */\nexport type HttpRateLimitConfig = Pick<RateLimitPluginOptions, (typeof passthroughKeys)[number]> & {\n  /**\n   * Set `false` to skip registering the global rate limiter.\n   *\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Max requests per time window.\n   *\n   * @default 60\n   */\n  max?: number;\n  /**\n   * Time window in milliseconds. Alias of `timeWindow`.\n   *\n   * @default 60 * 1000\n   */\n  duration?: number;\n  /**\n   * Time window; takes precedence over `duration` when both are set.\n   */\n  timeWindow?: RateLimitPluginOptions[\"timeWindow\"];\n};\n\n/**\n * Build the `@fastify/rate-limit` plugin options from `http.rateLimit`.\n * Returns `null` when the limiter is disabled.\n */\nexport function buildRateLimitOptions(\n  config: HttpRateLimitConfig | undefined,\n): RateLimitPluginOptions | null {\n  const source = config ?? {};\n\n  if (source.enabled === false) {\n    return null;\n  }\n\n  const options: Record<string, unknown> = {\n    max: source.max ?? 60,\n    timeWindow: source.timeWindow ?? source.duration ?? 60 * 1000,\n  };\n\n  for (const key of passthroughKeys) {\n    if (source[key] !== undefined) {\n      options[key] = source[key];\n    }\n  }\n\n  return options as RateLimitPluginOptions;\n}\n"],"mappings":";;;;AAKA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAkCA,SAAgB,sBACd,QAC+B;CAC/B,MAAM,SAAS,UAAU,CAAC;CAE1B,IAAI,OAAO,YAAY,OACrB,OAAO;CAGT,MAAM,UAAmC;EACvC,KAAK,OAAO,OAAO;EACnB,YAAY,OAAO,cAAc,OAAO,YAAY,KAAK;CAC3D;CAEA,KAAK,MAAM,OAAO,iBAChB,IAAI,OAAO,SAAS,QAClB,QAAQ,OAAO,OAAO;CAI1B,OAAO;AACT"}
+{"version":3,"file":"build-rate-limit-options.mjs","names":[],"sources":["../../../../../../../core/src/http/build-rate-limit-options.ts"],"sourcesContent":["import type { RateLimitPluginOptions } from \"@fastify/rate-limit\";\n\n/**\n * `@fastify/rate-limit` options that `http.rateLimit` passes straight through.\n */\nconst passthroughKeys = [\n  \"redis\",\n  \"nameSpace\",\n  \"keyGenerator\",\n  \"ipv6Subnet\",\n  \"skipOnError\",\n  \"allowList\",\n  \"continueExceeding\",\n  \"enableDraftSpec\",\n  \"global\",\n  \"hook\",\n  \"cache\",\n  \"errorResponseBuilder\",\n  \"addHeaders\",\n  \"addHeadersOnExceeding\",\n] as const;\n\n/**\n * Shape of the `http.rateLimit` config.\n */\nexport type HttpRateLimitConfig = Omit<\n  Pick<RateLimitPluginOptions, (typeof passthroughKeys)[number]>,\n  \"ipv6Subnet\"\n> & {\n  /**\n   * IPv6 subnet size used to group client addresses.\n   *\n   * @default 64\n   */\n  ipv6Subnet?: RateLimitPluginOptions[\"ipv6Subnet\"];\n  /**\n   * Set `false` to skip registering the global rate limiter.\n   *\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Max requests per time window.\n   *\n   * @default 60\n   */\n  max?: number;\n  /**\n   * Time window in milliseconds. Alias of `timeWindow`.\n   *\n   * @default 60 * 1000\n   */\n  duration?: number;\n  /**\n   * Time window; takes precedence over `duration` when both are set.\n   */\n  timeWindow?: RateLimitPluginOptions[\"timeWindow\"];\n};\n\n/**\n * Build the `@fastify/rate-limit` plugin options from `http.rateLimit`.\n * Returns `null` when the limiter is disabled.\n */\nexport function buildRateLimitOptions(\n  config: HttpRateLimitConfig | undefined,\n): RateLimitPluginOptions | null {\n  const source = config ?? {};\n\n  if (source.enabled === false) {\n    return null;\n  }\n\n  const options: Record<string, unknown> = {\n    max: source.max ?? 60,\n    timeWindow: source.timeWindow ?? source.duration ?? 60 * 1000,\n  };\n\n  for (const key of passthroughKeys) {\n    if (source[key] !== undefined) {\n      options[key] = source[key];\n    }\n  }\n\n  return options as RateLimitPluginOptions;\n}\n"],"mappings":";;;;AAKA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AA2CA,SAAgB,sBACd,QAC+B;CAC/B,MAAM,SAAS,UAAU,CAAC;CAE1B,IAAI,OAAO,YAAY,OACrB,OAAO;CAGT,MAAM,UAAmC;EACvC,KAAK,OAAO,OAAO;EACnB,YAAY,OAAO,cAAc,OAAO,YAAY,KAAK;CAC3D;CAEA,KAAK,MAAM,OAAO,iBAChB,IAAI,OAAO,SAAS,QAClB,QAAQ,OAAO,OAAO;CAI1B,OAAO;AACT"}

package/esm/http/errors/errors.d.mts

@@ -52,22 +52,6 @@ declare class NotAllowedError extends HttpError {
 declare class CookieJarUnavailableError extends Error {
   constructor(cookieName: string);
 }
-/**
- * Thrown by `Request.prototype.user` in development to catch a call site
- * still reading the removed `request.user` getter/setter after the 5.12.0
- * move: the authenticated user now lives at `request.locals.user`, written
- * by `@warlock.js/auth`'s middleware.
- *
- * Development-only diagnostic, not a runtime contract other code should
- * catch — the getter itself is typed `never`, so a caller that still
- * compiles against `request.user` only does so via `any`/an outdated type.
- * Kept in core (not auth) because `request.user` is a core `Request`
- * accessor and core cannot depend on `@warlock.js/auth` to react to it.
- * Slated for removal one release after 5.12.0 — see the CHANGELOG.
- */
-declare class RequestUserMovedError extends Error {
-  constructor();
-}
 //#endregion
-export { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, RequestUserMovedError, ResourceNotFoundError, ServerError, UnAuthorizedError };
+export { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError };
 //# sourceMappingURL=errors.d.mts.map

package/esm/http/errors/errors.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../../core/src/http/errors/errors.ts"],"mappings":";cAAa,SAAA,SAAkB,KAAK;EAEzB,MAAA;EACA,OAAA;EACA,OAAA;cAFA,MAAA,UACA,OAAA,UACA,OAAA;AAAA;AAAA,cAOE,qBAAA,SAA8B,SAAS;EAGzC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,iBAAA,SAA0B,SAAS;EAGrC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,cAAA,SAAuB,SAAS;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,WAAA,SAAoB,SAAS;EAG/B,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,aAAA,SAAsB,SAAS;EAGjC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,kBAAA,SAA2B,SAAS;EAGtC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;;;;;;;;;;AAlDa;AAOxB;;cA8Da,yBAAA,SAAkC,KAAK;cAC/B,UAAA;AAAA;;;;;;AA5DG;AAOxB;;;;;;;cA6Ea,qBAAA,SAA8B,KAAK;EAAL,WAAA;AAAA"}
+{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../../core/src/http/errors/errors.ts"],"mappings":";cAAa,SAAA,SAAkB,KAAK;EAEzB,MAAA;EACA,OAAA;EACA,OAAA;cAFA,MAAA,UACA,OAAA,UACA,OAAA;AAAA;AAAA,cAOE,qBAAA,SAA8B,SAAS;EAGzC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,iBAAA,SAA0B,SAAS;EAGrC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,cAAA,SAAuB,SAAS;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,WAAA,SAAoB,SAAS;EAG/B,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,aAAA,SAAsB,SAAS;EAGjC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,kBAAA,SAA2B,SAAS;EAGtC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;;;;;;;;;;AAlDa;AAOxB;;cA8Da,yBAAA,SAAkC,KAAK;cAC/B,UAAA;AAAA"}

package/esm/http/errors/errors.mjs

@@ -82,26 +82,7 @@ var CookieJarUnavailableError = class extends Error {
 		this.name = "CookieJarUnavailableError";
 	}
 };
-/**
-* Thrown by `Request.prototype.user` in development to catch a call site
-* still reading the removed `request.user` getter/setter after the 5.12.0
-* move: the authenticated user now lives at `request.locals.user`, written
-* by `@warlock.js/auth`'s middleware.
-*
-* Development-only diagnostic, not a runtime contract other code should
-* catch — the getter itself is typed `never`, so a caller that still
-* compiles against `request.user` only does so via `any`/an outdated type.
-* Kept in core (not auth) because `request.user` is a core `Request`
-* accessor and core cannot depend on `@warlock.js/auth` to react to it.
-* Slated for removal one release after 5.12.0 — see the CHANGELOG.
-*/
-var RequestUserMovedError = class extends Error {
-	constructor() {
-		super("request.user has been removed. The authenticated user now lives at request.locals.user, set by @warlock.js/auth's middleware.");
-		this.name = "RequestUserMovedError";
-	}
-};
 
 //#endregion
-export { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, RequestUserMovedError, ResourceNotFoundError, ServerError, UnAuthorizedError };
+export { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError };
 //# sourceMappingURL=errors.mjs.map

package/esm/http/errors/errors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../../../../../../../../core/src/http/errors/errors.ts"],"sourcesContent":["export class HttpError extends Error {\n  public constructor(\n    public status: number,\n    public message: string,\n    public payload?: any,\n  ) {\n    super(message);\n    this.name = \"HttpError\";\n  }\n}\n\nexport class ResourceNotFoundError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(404, message, payload);\n    this.name = \"ResourceNotFoundError\";\n  }\n}\n\nexport class UnAuthorizedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(401, message, payload);\n    this.name = \"UnAuthorizedError\";\n  }\n}\n\nexport class ForbiddenError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(403, message, payload);\n    this.name = \"ForbiddenError\";\n  }\n}\n\nexport class BadRequestError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(400, message, payload);\n    this.name = \"BadRequestError\";\n  }\n}\n\nexport class ServerError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(500, message, payload);\n    this.name = \"ServerError\";\n  }\n}\n\nexport class ConflictError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(409, message, payload);\n    this.name = \"ConflictError\";\n  }\n}\n\nexport class NotAcceptableError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(406, message, payload);\n    this.name = \"NotAcceptableError\";\n  }\n}\n\nexport class NotAllowedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(405, message, payload);\n    this.name = \"NotAllowedError\";\n  }\n}\n\n/**\n * Thrown by `Request.prototype.cookie` / `Request.prototype.hasCookie` when\n * `@fastify/cookie` was never registered on this Fastify instance, so\n * `baseRequest.cookies` is `undefined` rather than an (possibly empty) object.\n *\n * A by-name cookie read is a deliberate assertion by the caller — \"this\n * cookie should be readable here\" — so an unavailable jar is a configuration\n * fault, not an absent cookie, and must not be swallowed into a default\n * value or a silent `false`. Contrast `Request.prototype.cookies`, which\n * stays lenient because the framework's own opportunistic reads (e.g.\n * locale resolution) must not throw on a request that simply has no jar.\n */\nexport class CookieJarUnavailableError extends Error {\n  public constructor(cookieName: string) {\n    super(\n      `Cannot read cookie \"${cookieName}\": the cookie jar is unavailable because ` +\n        \"@fastify/cookie is not registered on this Fastify instance. \" +\n        \"Register the plugin (see core's http/plugins.ts) before reading cookies by name.\",\n    );\n\n    this.name = \"CookieJarUnavailableError\";\n  }\n}\n\n/**\n * Thrown by `Request.prototype.user` in development to catch a call site\n * still reading the removed `request.user` getter/setter after the 5.12.0\n * move: the authenticated user now lives at `request.locals.user`, written\n * by `@warlock.js/auth`'s middleware.\n *\n * Development-only diagnostic, not a runtime contract other code should\n * catch — the getter itself is typed `never`, so a caller that still\n * compiles against `request.user` only does so via `any`/an outdated type.\n * Kept in core (not auth) because `request.user` is a core `Request`\n * accessor and core cannot depend on `@warlock.js/auth` to react to it.\n * Slated for removal one release after 5.12.0 — see the CHANGELOG.\n */\nexport class RequestUserMovedError extends Error {\n  public constructor() {\n    super(\n      \"request.user has been removed. The authenticated user now lives at \" +\n        \"request.locals.user, set by @warlock.js/auth's middleware.\",\n    );\n    this.name = \"RequestUserMovedError\";\n  }\n}\n"],"mappings":";AAAA,IAAa,YAAb,cAA+B,MAAM;CACnC,AAAO,YACL,AAAO,QACP,AAAO,SACP,AAAO,SACP;EACA,MAAM,OAAO;EAJN;EACA;EACA;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,wBAAb,cAA2C,UAAU;CACnD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,UAAU;CAC5C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,cAAb,cAAiC,UAAU;CACzC,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,UAAU;CAC3C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;AAcA,IAAa,4BAAb,cAA+C,MAAM;CACnD,AAAO,YAAY,YAAoB;EACrC,MACE,uBAAuB,WAAW,sLAGpC;EAEA,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;AAeA,IAAa,wBAAb,cAA2C,MAAM;CAC/C,AAAO,cAAc;EACnB,MACE,+HAEF;EACA,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../../../../../../core/src/http/errors/errors.ts"],"sourcesContent":["export class HttpError extends Error {\n  public constructor(\n    public status: number,\n    public message: string,\n    public payload?: any,\n  ) {\n    super(message);\n    this.name = \"HttpError\";\n  }\n}\n\nexport class ResourceNotFoundError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(404, message, payload);\n    this.name = \"ResourceNotFoundError\";\n  }\n}\n\nexport class UnAuthorizedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(401, message, payload);\n    this.name = \"UnAuthorizedError\";\n  }\n}\n\nexport class ForbiddenError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(403, message, payload);\n    this.name = \"ForbiddenError\";\n  }\n}\n\nexport class BadRequestError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(400, message, payload);\n    this.name = \"BadRequestError\";\n  }\n}\n\nexport class ServerError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(500, message, payload);\n    this.name = \"ServerError\";\n  }\n}\n\nexport class ConflictError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(409, message, payload);\n    this.name = \"ConflictError\";\n  }\n}\n\nexport class NotAcceptableError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(406, message, payload);\n    this.name = \"NotAcceptableError\";\n  }\n}\n\nexport class NotAllowedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(405, message, payload);\n    this.name = \"NotAllowedError\";\n  }\n}\n\n/**\n * Thrown by `Request.prototype.cookie` / `Request.prototype.hasCookie` when\n * `@fastify/cookie` was never registered on this Fastify instance, so\n * `baseRequest.cookies` is `undefined` rather than an (possibly empty) object.\n *\n * A by-name cookie read is a deliberate assertion by the caller — \"this\n * cookie should be readable here\" — so an unavailable jar is a configuration\n * fault, not an absent cookie, and must not be swallowed into a default\n * value or a silent `false`. Contrast `Request.prototype.cookies`, which\n * stays lenient because the framework's own opportunistic reads (e.g.\n * locale resolution) must not throw on a request that simply has no jar.\n */\nexport class CookieJarUnavailableError extends Error {\n  public constructor(cookieName: string) {\n    super(\n      `Cannot read cookie \"${cookieName}\": the cookie jar is unavailable because ` +\n        \"@fastify/cookie is not registered on this Fastify instance. \" +\n        \"Register the plugin (see core's http/plugins.ts) before reading cookies by name.\",\n    );\n\n    this.name = \"CookieJarUnavailableError\";\n  }\n}\n"],"mappings":";AAAA,IAAa,YAAb,cAA+B,MAAM;CACnC,AAAO,YACL,AAAO,QACP,AAAO,SACP,AAAO,SACP;EACA,MAAM,OAAO;EAJN;EACA;EACA;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,wBAAb,cAA2C,UAAU;CACnD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,UAAU;CAC5C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,cAAb,cAAiC,UAAU;CACzC,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,UAAU;CAC3C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;AAcA,IAAa,4BAAb,cAA+C,MAAM;CACnD,AAAO,YAAY,YAAoB;EACrC,MACE,uBAAuB,WAAW,sLAGpC;EAEA,KAAK,OAAO;CACd;AACF"}

package/esm/http/index.d.mts

@@ -3,7 +3,7 @@ import { XMLable } from "./xmlable.mjs";
 import { CookieOptions, Response, ResponseStatus, SendBufferOptions, SendFileOptions } from "./response.mjs";
 import { FileNamingStrategy, ImageTransformCallback, ImageTransformConfig, ImageVariantDefinition, ImageVariantFit, ImageVariantOutputFormat, PrefixConfig, PrefixOptions, SaveAsOptions, SaveOptions, UploadedFileImageOptions, UploadsConfigurations, UploadsImagesConfigurations } from "./uploads-types.mjs";
 import { FileValidationOptions, UploadedFile, UploadedFileJson } from "./uploaded-file.mjs";
-import { Request } from "./request.mjs";
+import { Request, RequestTranslator } from "./request.mjs";
 import { CspConfig, DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives } from "./csp.mjs";
 import { HttpTracingConfig, TracingContext, TracingHooks, TracingPhaseInfo, TracingRequestEndInfo } from "./tracing/tracing.type.mjs";
 import { DecodedAccessToken, HttpConfigurations, PartialMiddleware, RequestEvent, RequestLocals, ResponseEvent, ResponseSSEController, ResponseStreamController, ReturnedResponse } from "./types.mjs";
@@ -21,7 +21,7 @@ import { DetectedImageFormat, GeneratedImageDescriptor, GeneratedImageVariant, R
 import { GenerateImageVariantsOptions, generateImageVariants } from "./uploads/generate-image-variants.mjs";
 import { ImageVariantsConfigError } from "./uploads/image-variants-config-error.mjs";
 import { uploadedFileController } from "./uploads/uploaded-file.controller.mjs";
-import { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, RequestUserMovedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./errors/errors.mjs";
+import { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./errors/errors.mjs";
 import { CacheMiddlewareOptions } from "./middleware/cache-response-middleware.mjs";
 import { ConcurrencyLimitOptions } from "./middleware/concurrency-limit.middleware.mjs";
 import { IdempotencyOptions } from "./middleware/idempotency.middleware.mjs";

package/esm/http/index.mjs

@@ -3,7 +3,7 @@ import { DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, build
 import { HttpErrorCodes } from "./error-codes.mjs";
 import { isAllowedCsrfOrigin, normalizeOrigin, originOf, ownOrigin, resolveCsrfOriginVerdict } from "./csrf-origin-policy.mjs";
 import { requiresDefaultCsrfGuard, runDefaultCsrfGuard } from "./csrf-default-guard.mjs";
-import { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, RequestUserMovedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./errors/errors.mjs";
+import { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./errors/errors.mjs";
 import { deriveTraceId, parseTraceparentTraceId } from "./tracing/trace-id.mjs";
 import { buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled, registerTracingHooks, resetTracingConfigForTests, resolveTracingConfig } from "./tracing/tracing-dispatcher.mjs";
 import "./tracing/index.mjs";

package/esm/http/middleware/inject-request-context.d.mts

@@ -12,7 +12,7 @@ declare function createRequestStore(request: Request<any>, response: Response):
 /**
  * Translate a keyword (uses request context for locale)
  */
-declare function t(keyword: string, placeholders?: any): any;
+declare function t(keyword: string, placeholders?: Record<string, unknown>): string;
 //#endregion
 export { createRequestStore, t };
 //# sourceMappingURL=inject-request-context.d.mts.map

package/esm/http/middleware/inject-request-context.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;AA8CA;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;iBA2KK,CAAA,CAAE,OAAA,UAAiB,YAAkB"}
+{"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;AA8CA;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;iBA2KK,CAAA,CAAE,OAAA,UAAiB,YAAA,GAAe,MAAM"}

package/esm/http/middleware/inject-request-context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\n * Request Context Middleware\n *\n * Creates a unified context for each request using the ContextManager.\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\n */\nimport { trans } from \"@mongez/localization\";\nimport { type GenericObject } from \"@mongez/reinforcements\";\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\nimport { contextManager } from \"@warlock.js/context\";\nimport { log } from \"@warlock.js/logger\";\nimport config from \"@mongez/config\";\nimport { environment } from \"../../utils\";\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\nimport { applyCspHeader } from \"../csp\";\nimport { runDefaultCsrfGuard } from \"../csrf-default-guard\";\nimport { HttpError } from \"../errors\";\nimport { type Request } from \"../request\";\nimport { type Response } from \"../response\";\nimport { buildTracingContext, dispatchPhase, isTracingEnabled } from \"../tracing\";\nimport { type ReturnedResponse } from \"./../types\";\n\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\n\n/**\n * Echo `request.id` back as a response header so the FE / proxies / log\n * aggregators can correlate by the same value the server logs against.\n *\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\n * Skip when `http.requestId.enabled` is explicitly false.\n */\nfunction stampRequestIdHeader(request: Request, response: Response) {\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\n\n  if (requestIdConfig.enabled === false) return;\n\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\n\n  response.header(headerName, request.id);\n}\n\n/**\n * Create request store and execute middleware + handler\n *\n * Runs all registered contexts together using ContextManager.\n */\nexport function createRequestStore(\n  request: Request<any>,\n  response: Response,\n): Promise<ReturnedResponse> {\n  stampRequestIdHeader(request, response);\n\n  // Stamped this early — before any middleware or handler runs — so the\n  // header carries the SAME nonce the web layer later reads off\n  // `request.nonce` for its `<script>` tags: `request.nonce` caches on first\n  // read, and this is deliberately the first read. A no-op when the app\n  // hasn't opted into `http.csp` (see `csp.ts`).\n  applyCspHeader(request, response);\n\n  // Build all context stores using the immutable API\n  // Each context defines its own store initialization via buildStore()\n  const httpContextStore = contextManager.buildStores({ request, response });\n\n  // Run all contexts together!\n  return contextManager.runAll(httpContextStore, async () => {\n    try {\n      // Default CSRF-Origin guard (SECURITY, card 8a752ab2) — the earliest\n      // seam common to every request, BEFORE the route's own middleware\n      // (`request.runMiddleware()` below) and before any app handler, so it\n      // applies even to a route that never attaches\n      // `authMiddleware(\"cookie:*\")`. See `../csrf-default-guard.ts` for the\n      // full scope rule and `{ csrf: false }` exemption.\n      const csrfGuardResponse = await runDefaultCsrfGuard(request, response, t, (reason) => {\n        log.error(\n          \"http\",\n          \"csrf-default-guard\",\n          new Error(`Default CSRF Origin guard refused request: ${reason}`),\n        );\n      });\n\n      if (csrfGuardResponse) {\n        return csrfGuardResponse as ReturnedResponse;\n      }\n\n      // Run middleware chain\n      const result = await request.runMiddleware();\n\n      if (result) {\n        return result as ReturnedResponse;\n      }\n\n      // Execute route handler\n      request.trigger(\"executingAction\", request.route);\n\n      const handler = request.getHandler();\n\n      request.log(\"Executing Handler\", \"info\");\n\n      const tracingEnabled = isTracingEnabled();\n      const handlerStartedAt = tracingEnabled ? performance.now() : 0;\n\n      const output = await handler({ request, response });\n\n      if (tracingEnabled) {\n        dispatchPhase(buildTracingContext(request), {\n          name: \"handler\",\n          durationMs: performance.now() - handlerStartedAt,\n        });\n      }\n\n      request.log(\"Handler Executed Successfully\", \"success\");\n\n      request.trigger(\"executedAction\", request.route);\n\n      return output as ReturnedResponse;\n    } catch (error) {\n      request.log(error, \"error\");\n      return handleRequestError(error, response, request);\n    }\n  });\n}\n\n/**\n * Unconditional floor for an unhandled request error (canon 8d3c13a8): route it\n * through the logger, and when no logger channel is configured (nothing would\n * record it) fall back to `console.error` so the only copy is never lost.\n * @internal\n */\nfunction reportUnhandledRequestError(error: unknown, request: Request<any>) {\n  log.error(\"http\", \"unhandled-request-error\", error, { requestId: request.id });\n\n  if (log.channels.length === 0) {\n    console.error(`[http] unhandled-request-error (requestId: ${request.id})`, error);\n  }\n}\n\n/**\n * Handle request errors\n * @internal\n */\nfunction handleRequestError(\n  error: unknown,\n  response: Response,\n  request: Request<any>,\n): ReturnedResponse {\n  // Availability floor, not a cache-policy nit: `handleRequestError` is the\n  // single funnel every unhandled error in every Warlock app passes through\n  // (`createRequestStore`'s catch above), and none of the branches below set\n  // a `Cache-Control` header. Without this, an error response — a 500 as\n  // much as a 401/403/404 carrying per-request/-user state — can be stored\n  // by a shared cache or CDN and replayed to other requests/users long after\n  // the condition that caused it is gone: a cached 500 becomes an outage\n  // that outlives its cause; a cached 401/403 becomes a leak across users.\n  // Set once, here, before any branch runs — not per branch — because the\n  // branches below do not partition by status. `ResourceNotFoundError`,\n  // `UnAuthorizedError`, `ForbiddenError`, `BadRequestError` and `ServerError`\n  // all extend `HttpError`, so the `HttpError` branch answers for every one of\n  // them, and a raw `HttpError` can carry any caller-chosen status, 4xx or 5xx.\n  // Gating the floor on the eventual status would mean re-deriving that status\n  // per branch — one rule meeting one form while others reach the same output.\n  // Applying it once, unconditionally, is both simpler and safer.\n  response.header(\"Cache-Control\", \"private, no-store\");\n\n  if (error instanceof HttpError) {\n    // 5xx HttpErrors (e.g. `ServerError`) are server faults: send them to the\n    // logger channels too, tagged with the request id.\n    if (error.status >= 500) {\n      log.error(\"http\", \"request-error\", error, { requestId: request.id });\n    }\n\n    const payload: GenericObject = {\n      error: error.message,\n    };\n    if (error.payload) {\n      payload.payload = error.payload;\n    }\n\n    if (environment() === \"development\") {\n      payload.stack = error.stack;\n    }\n\n    return response.setStatusCode(error.status).send(payload);\n  }\n\n  if (error instanceof DatabaseWriterValidationError) {\n    log.error(\"http\", \"model-write-validation-error\", error, {\n      requestId: request.id,\n      errors: error.errors,\n    });\n\n    const status = config.get(\"http.modelValidationErrorStatus\", 500);\n\n    // A 4xx status means the app treats this as the client's fault, so the\n    // field errors are useful to it; a 5xx stays opaque.\n    if (status < 500) {\n      return response.setStatusCode(status).send({\n        errors: error.errors,\n      });\n    }\n\n    return response.setStatusCode(status).send({\n      error: \"Internal server error.\",\n    });\n  }\n\n  // Last resort: the error matched none of the known shapes above, so the\n  // client gets a deliberately opaque message. Without this line the error\n  // itself is discarded here — no stack, no message, nothing in any log — and\n  // an unrecognised failure becomes indistinguishable from a working server\n  // returning 500. Never swallow the only copy of an error (`65e476ee`).\n  reportUnhandledRequestError(error, request);\n\n  return response.serverError({\n    error: \"Internal server error.\",\n  });\n}\n\n/**\n * Translate a keyword (uses request context for locale)\n */\nexport function t(keyword: string, placeholders?: any) {\n  return (\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\n    trans(keyword, placeholders)\n  );\n}\n\n// `fromRequest` was removed in v5. It cached computed values as dynamic\n// properties on the Request instance, which only compiled because of the\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\n// per-request lifetime, single-flight, and it never touches the Request object.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAOtC,eAAe,SAAS,QAAQ;CAIhC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAOF,MAAM,oBAAoB,MAAM,oBAAoB,SAAS,UAAU,IAAI,WAAW;IACpF,IAAI,MACF,QACA,sCACA,IAAI,MAAM,8CAA8C,QAAQ,CAClE;GACF,CAAC;GAED,IAAI,mBACF,OAAO;GAIT,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,iBAAiB,iBAAiB;GACxC,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,IAAI;GAE9D,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,IAAI,gBACF,cAAc,oBAAoB,OAAO,GAAG;IAC1C,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;GAClC,CAAC;GAGH,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,OAAO,OAAO;GAC1B,OAAO,mBAAmB,OAAO,UAAU,OAAO;EACpD;CACF,CAAC;AACH;;;;;;;AAQA,SAAS,4BAA4B,OAAgB,SAAuB;CAC1E,IAAI,MAAM,QAAQ,2BAA2B,OAAO,EAAE,WAAW,QAAQ,GAAG,CAAC;CAE7E,IAAI,IAAI,SAAS,WAAW,GAC1B,QAAQ,MAAM,8CAA8C,QAAQ,GAAG,IAAI,KAAK;AAEpF;;;;;AAMA,SAAS,mBACP,OACA,UACA,SACkB;CAiBlB,SAAS,OAAO,iBAAiB,mBAAmB;CAEpD,IAAI,iBAAiB,WAAW;EAG9B,IAAI,MAAM,UAAU,KAClB,IAAI,MAAM,QAAQ,iBAAiB,OAAO,EAAE,WAAW,QAAQ,GAAG,CAAC;EAGrE,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,+BAA+B;EAClD,IAAI,MAAM,QAAQ,gCAAgC,OAAO;GACvD,WAAW,QAAQ;GACnB,QAAQ,MAAM;EAChB,CAAC;EAED,MAAM,SAAS,OAAO,IAAI,mCAAmC,GAAG;EAIhE,IAAI,SAAS,KACX,OAAO,SAAS,cAAc,MAAM,CAAC,CAAC,KAAK,EACzC,QAAQ,MAAM,OAChB,CAAC;EAGH,OAAO,SAAS,cAAc,MAAM,CAAC,CAAC,KAAK,EACzC,OAAO,yBACT,CAAC;CACH;CAOA,4BAA4B,OAAO,OAAO;CAE1C,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAoB;CACrD,OACEA,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}
+{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\n * Request Context Middleware\n *\n * Creates a unified context for each request using the ContextManager.\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\n */\nimport { trans } from \"@mongez/localization\";\nimport { type GenericObject } from \"@mongez/reinforcements\";\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\nimport { contextManager } from \"@warlock.js/context\";\nimport { log } from \"@warlock.js/logger\";\nimport config from \"@mongez/config\";\nimport { environment } from \"../../utils\";\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\nimport { applyCspHeader } from \"../csp\";\nimport { runDefaultCsrfGuard } from \"../csrf-default-guard\";\nimport { HttpError } from \"../errors\";\nimport { type Request } from \"../request\";\nimport { type Response } from \"../response\";\nimport { buildTracingContext, dispatchPhase, isTracingEnabled } from \"../tracing\";\nimport { type ReturnedResponse } from \"./../types\";\n\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\n\n/**\n * Echo `request.id` back as a response header so the FE / proxies / log\n * aggregators can correlate by the same value the server logs against.\n *\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\n * Skip when `http.requestId.enabled` is explicitly false.\n */\nfunction stampRequestIdHeader(request: Request, response: Response) {\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\n\n  if (requestIdConfig.enabled === false) return;\n\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\n\n  response.header(headerName, request.id);\n}\n\n/**\n * Create request store and execute middleware + handler\n *\n * Runs all registered contexts together using ContextManager.\n */\nexport function createRequestStore(\n  request: Request<any>,\n  response: Response,\n): Promise<ReturnedResponse> {\n  stampRequestIdHeader(request, response);\n\n  // Stamped this early — before any middleware or handler runs — so the\n  // header carries the SAME nonce the web layer later reads off\n  // `request.nonce` for its `<script>` tags: `request.nonce` caches on first\n  // read, and this is deliberately the first read. A no-op when the app\n  // hasn't opted into `http.csp` (see `csp.ts`).\n  applyCspHeader(request, response);\n\n  // Build all context stores using the immutable API\n  // Each context defines its own store initialization via buildStore()\n  const httpContextStore = contextManager.buildStores({ request, response });\n\n  // Run all contexts together!\n  return contextManager.runAll(httpContextStore, async () => {\n    try {\n      // Default CSRF-Origin guard (SECURITY, card 8a752ab2) — the earliest\n      // seam common to every request, BEFORE the route's own middleware\n      // (`request.runMiddleware()` below) and before any app handler, so it\n      // applies even to a route that never attaches\n      // `authMiddleware(\"cookie:*\")`. See `../csrf-default-guard.ts` for the\n      // full scope rule and `{ csrf: false }` exemption.\n      const csrfGuardResponse = await runDefaultCsrfGuard(request, response, t, (reason) => {\n        log.error(\n          \"http\",\n          \"csrf-default-guard\",\n          new Error(`Default CSRF Origin guard refused request: ${reason}`),\n        );\n      });\n\n      if (csrfGuardResponse) {\n        return csrfGuardResponse as ReturnedResponse;\n      }\n\n      // Run middleware chain\n      const result = await request.runMiddleware();\n\n      if (result) {\n        return result as ReturnedResponse;\n      }\n\n      // Execute route handler\n      request.trigger(\"executingAction\", request.route);\n\n      const handler = request.getHandler();\n\n      request.log(\"Executing Handler\", \"info\");\n\n      const tracingEnabled = isTracingEnabled();\n      const handlerStartedAt = tracingEnabled ? performance.now() : 0;\n\n      const output = await handler({ request, response });\n\n      if (tracingEnabled) {\n        dispatchPhase(buildTracingContext(request), {\n          name: \"handler\",\n          durationMs: performance.now() - handlerStartedAt,\n        });\n      }\n\n      request.log(\"Handler Executed Successfully\", \"success\");\n\n      request.trigger(\"executedAction\", request.route);\n\n      return output as ReturnedResponse;\n    } catch (error) {\n      request.log(error, \"error\");\n      return handleRequestError(error, response, request);\n    }\n  });\n}\n\n/**\n * Unconditional floor for an unhandled request error (canon 8d3c13a8): route it\n * through the logger, and when no logger channel is configured (nothing would\n * record it) fall back to `console.error` so the only copy is never lost.\n * @internal\n */\nfunction reportUnhandledRequestError(error: unknown, request: Request<any>) {\n  log.error(\"http\", \"unhandled-request-error\", error, { requestId: request.id });\n\n  if (log.channels.length === 0) {\n    console.error(`[http] unhandled-request-error (requestId: ${request.id})`, error);\n  }\n}\n\n/**\n * Handle request errors\n * @internal\n */\nfunction handleRequestError(\n  error: unknown,\n  response: Response,\n  request: Request<any>,\n): ReturnedResponse {\n  // Availability floor, not a cache-policy nit: `handleRequestError` is the\n  // single funnel every unhandled error in every Warlock app passes through\n  // (`createRequestStore`'s catch above), and none of the branches below set\n  // a `Cache-Control` header. Without this, an error response — a 500 as\n  // much as a 401/403/404 carrying per-request/-user state — can be stored\n  // by a shared cache or CDN and replayed to other requests/users long after\n  // the condition that caused it is gone: a cached 500 becomes an outage\n  // that outlives its cause; a cached 401/403 becomes a leak across users.\n  // Set once, here, before any branch runs — not per branch — because the\n  // branches below do not partition by status. `ResourceNotFoundError`,\n  // `UnAuthorizedError`, `ForbiddenError`, `BadRequestError` and `ServerError`\n  // all extend `HttpError`, so the `HttpError` branch answers for every one of\n  // them, and a raw `HttpError` can carry any caller-chosen status, 4xx or 5xx.\n  // Gating the floor on the eventual status would mean re-deriving that status\n  // per branch — one rule meeting one form while others reach the same output.\n  // Applying it once, unconditionally, is both simpler and safer.\n  response.header(\"Cache-Control\", \"private, no-store\");\n\n  if (error instanceof HttpError) {\n    // 5xx HttpErrors (e.g. `ServerError`) are server faults: send them to the\n    // logger channels too, tagged with the request id.\n    if (error.status >= 500) {\n      log.error(\"http\", \"request-error\", error, { requestId: request.id });\n    }\n\n    const payload: GenericObject = {\n      error: error.message,\n    };\n    if (error.payload) {\n      payload.payload = error.payload;\n    }\n\n    if (environment() === \"development\") {\n      payload.stack = error.stack;\n    }\n\n    return response.setStatusCode(error.status).send(payload);\n  }\n\n  if (error instanceof DatabaseWriterValidationError) {\n    log.error(\"http\", \"model-write-validation-error\", error, {\n      requestId: request.id,\n      errors: error.errors,\n    });\n\n    const status = config.get(\"http.modelValidationErrorStatus\", 500);\n\n    // A 4xx status means the app treats this as the client's fault, so the\n    // field errors are useful to it; a 5xx stays opaque.\n    if (status < 500) {\n      return response.setStatusCode(status).send({\n        errors: error.errors,\n      });\n    }\n\n    return response.setStatusCode(status).send({\n      error: \"Internal server error.\",\n    });\n  }\n\n  // Last resort: the error matched none of the known shapes above, so the\n  // client gets a deliberately opaque message. Without this line the error\n  // itself is discarded here — no stack, no message, nothing in any log — and\n  // an unrecognised failure becomes indistinguishable from a working server\n  // returning 500. Never swallow the only copy of an error (`65e476ee`).\n  reportUnhandledRequestError(error, request);\n\n  return response.serverError({\n    error: \"Internal server error.\",\n  });\n}\n\n/**\n * Translate a keyword (uses request context for locale)\n */\nexport function t(keyword: string, placeholders?: Record<string, unknown>): string {\n  return (\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\n    trans(keyword, placeholders)\n  );\n}\n\n// `fromRequest` was removed in v5. It cached computed values as dynamic\n// properties on the Request instance, which only compiled because of the\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\n// per-request lifetime, single-flight, and it never touches the Request object.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAOtC,eAAe,SAAS,QAAQ;CAIhC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAOF,MAAM,oBAAoB,MAAM,oBAAoB,SAAS,UAAU,IAAI,WAAW;IACpF,IAAI,MACF,QACA,sCACA,IAAI,MAAM,8CAA8C,QAAQ,CAClE;GACF,CAAC;GAED,IAAI,mBACF,OAAO;GAIT,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,iBAAiB,iBAAiB;GACxC,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,IAAI;GAE9D,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,IAAI,gBACF,cAAc,oBAAoB,OAAO,GAAG;IAC1C,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;GAClC,CAAC;GAGH,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,OAAO,OAAO;GAC1B,OAAO,mBAAmB,OAAO,UAAU,OAAO;EACpD;CACF,CAAC;AACH;;;;;;;AAQA,SAAS,4BAA4B,OAAgB,SAAuB;CAC1E,IAAI,MAAM,QAAQ,2BAA2B,OAAO,EAAE,WAAW,QAAQ,GAAG,CAAC;CAE7E,IAAI,IAAI,SAAS,WAAW,GAC1B,QAAQ,MAAM,8CAA8C,QAAQ,GAAG,IAAI,KAAK;AAEpF;;;;;AAMA,SAAS,mBACP,OACA,UACA,SACkB;CAiBlB,SAAS,OAAO,iBAAiB,mBAAmB;CAEpD,IAAI,iBAAiB,WAAW;EAG9B,IAAI,MAAM,UAAU,KAClB,IAAI,MAAM,QAAQ,iBAAiB,OAAO,EAAE,WAAW,QAAQ,GAAG,CAAC;EAGrE,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,+BAA+B;EAClD,IAAI,MAAM,QAAQ,gCAAgC,OAAO;GACvD,WAAW,QAAQ;GACnB,QAAQ,MAAM;EAChB,CAAC;EAED,MAAM,SAAS,OAAO,IAAI,mCAAmC,GAAG;EAIhE,IAAI,SAAS,KACX,OAAO,SAAS,cAAc,MAAM,CAAC,CAAC,KAAK,EACzC,QAAQ,MAAM,OAChB,CAAC;EAGH,OAAO,SAAS,cAAc,MAAM,CAAC,CAAC,KAAK,EACzC,OAAO,yBACT,CAAC;CACH;CAOA,4BAA4B,OAAO,OAAO;CAE1C,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAgD;CACjF,OACEA,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}

package/esm/http/middleware/rate-limit.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/rate-limit.middleware.ts"],"mappings":";;;;;;KAQY,gBAAA;EAAgB;;;EAI1B,GAAA;EAIA;;;EAAA,QAAA;EAaA;;;;;;AAU0C;EAf1C,YAAA,IAAgB,OAAA,EAAS,OAAA;EAoEQ;;;;EA/DjC,GAAA;EA+D8D;;AAAU;;EA1DxE,MAAA;;;;;EAKA,YAAA,cAA0B,OAAA,EAAS,OAAO;AAAA;;;;;;;;;;;;;;;;;;;;;iBAqD5B,mBAAA,CAAoB,OAAA,EAAS,gBAAA,GAAmB,UAAU"}
+{"version":3,"file":"rate-limit.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/rate-limit.middleware.ts"],"mappings":";;;;;;KASY,gBAAA;EAAgB;;;EAI1B,GAAA;EAIA;;;EAAA,QAAA;EAaA;;;;;;AAU0C;EAf1C,YAAA,IAAgB,OAAA,EAAS,OAAA;EAqEQ;;;;EAhEjC,GAAA;EAgE8D;;AAAU;;EA3DxE,MAAA;;;;;EAKA,YAAA,cAA0B,OAAA,EAAS,OAAO;AAAA;;;;;;;;;;;;;;;;;;;;;iBAsD5B,mBAAA,CAAoB,OAAA,EAAS,gBAAA,GAAmB,UAAU"}

package/esm/http/middleware/rate-limit.middleware.mjs

@@ -1,8 +1,10 @@
 import { HttpErrorCodes } from "../error-codes.mjs";
 import { t } from "./inject-request-context.mjs";
+import { normalizeIP } from "@fastify/rate-limit";
 
 //#region ../core/src/http/middleware/rate-limit.middleware.ts
 const buckets = /* @__PURE__ */ new Map();
+const defaultIpv6Subnet = 64;
 /**
 * Each `rateLimitMiddleware()` call is its own limiter. Page actions share one
 * route, so without this two limits on the same page (say `like` and
@@ -53,7 +55,9 @@ function rateLimitMiddleware(options) {
 			if (id !== void 0 && id !== null && id !== "") userKey = `user:${String(id)}`;
 			else if (options.guests === "skip") return;
 		}
-		const groupKey = options.keyGenerator?.(request) || userKey || request.detectIp() || "unknown";
+		const ip = request.detectIp();
+		const ipKey = ip ? normalizeIP(ip, defaultIpv6Subnet) : "unknown";
+		const groupKey = options.keyGenerator?.(request) || userKey || ipKey;
 		const cacheKey = `${limiterId}:${request.route.path}:${groupKey}`;
 		let bucket = buckets.get(cacheKey);
 		if (!bucket || bucket.resetAt <= now) {

package/esm/http/middleware/rate-limit.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/rate-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the per-route rate limit middleware.\n */\nexport type RateLimitOptions = {\n  /**\n   * Max requests allowed within the time window.\n   */\n  max: number;\n  /**\n   * Time window in milliseconds.\n   */\n  duration: number;\n  /**\n   * Group key generator. Defaults to the client IP. Override to scope per-user,\n   * per-organization, per-tenant, etc.\n   *\n   * @example\n   * keyGenerator: (request) => request.locals.user?.id ?? request.ip,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Key the bucket to the signed-in user (`request.locals.user.id`). Works on\n   * routes and page actions alike. `keyGenerator` wins when both are set.\n   */\n  key?: \"user\";\n  /**\n   * With `key: \"user\"`, what to do for unauthenticated requests: bucket them\n   * by IP (default) or skip limiting entirely.\n   */\n  guests?: \"ip\" | \"skip\";\n  /**\n   * Override the default error message. Pass a function to build it per\n   * request, e.g. to translate it into the visitor's locale.\n   */\n  errorMessage?: string | ((request: Request) => string);\n};\n\ntype Bucket = {\n  count: number;\n  resetAt: number;\n};\n\nconst buckets = new Map<string, Bucket>();\n\n/**\n * Each `rateLimitMiddleware()` call is its own limiter. Page actions share one\n * route, so without this two limits on the same page (say `like` and\n * `comment`) would count into one bucket.\n */\nlet nextLimiterId = 0;\n\n/**\n * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys\n * (rare per-user keys, dynamic path parameters in `keyGenerator`, etc.).\n * Called opportunistically, at most once per minute, not on a timer — keeps\n * the module side-effect-free for testing.\n */\nlet lastPruneAt = 0;\n\nfunction pruneExpired(now: number) {\n  for (const [key, bucket] of buckets) {\n    if (bucket.resetAt <= now) {\n      buckets.delete(key);\n    }\n  }\n}\n\n/**\n * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s\n * global cap (configured via `http.rateLimit`) — both run, and either can\n * 429. Use this for endpoints that need a tighter cap than the global default:\n * login, OTP request, password reset, expensive search, AI completions.\n *\n * The counter of THIS middleware always lives in-process. With `N` replicas\n * its effective cap is `N × max`. The global limit can be shared across\n * replicas by setting `http.rateLimit.redis` (an ioredis instance); that\n * does not affect this per-route middleware.\n *\n * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on\n * every response; adds `Retry-After` (seconds) on a 429.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],\n * });\n */\nexport function rateLimitMiddleware(options: RateLimitOptions): Middleware {\n  const limiterId = nextLimiterId++;\n\n  return ({ request, response }) => {\n    const now = Date.now();\n\n    if (now - lastPruneAt > 60_000) {\n      pruneExpired(now);\n      lastPruneAt = now;\n    }\n\n    let userKey: string | undefined;\n\n    if (options.key === \"user\" && !options.keyGenerator) {\n      const id = (request.locals as { user?: { id?: unknown } } | undefined)?.user?.id;\n\n      if (id !== undefined && id !== null && id !== \"\") {\n        userKey = `user:${String(id)}`;\n      } else if (options.guests === \"skip\") {\n        return;\n      }\n    }\n\n    const groupKey = options.keyGenerator?.(request) || userKey || request.detectIp() || \"unknown\";\n    const cacheKey = `${limiterId}:${request.route.path}:${groupKey}`;\n\n    let bucket = buckets.get(cacheKey);\n\n    if (!bucket || bucket.resetAt <= now) {\n      bucket = { count: 0, resetAt: now + options.duration };\n      buckets.set(cacheKey, bucket);\n    }\n\n    bucket.count++;\n\n    const remaining = Math.max(0, options.max - bucket.count);\n    const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));\n\n    response.header(\"X-RateLimit-Limit\", options.max);\n    response.header(\"X-RateLimit-Remaining\", remaining);\n    response.header(\"X-RateLimit-Reset\", Math.ceil(bucket.resetAt / 1000));\n\n    if (bucket.count > options.max) {\n      response.header(\"Retry-After\", retryAfter);\n\n      return response.tooManyRequests({\n        error:\n          (typeof options.errorMessage === \"function\"\n            ? options.errorMessage(request)\n            : options.errorMessage) || t(\"http.rateLimitExceeded\"),\n        errorCode: HttpErrorCodes.RateLimitExceeded,\n      });\n    }\n  };\n}\n"],"mappings":";;;;AA+CA,MAAM,0BAAU,IAAI,IAAoB;;;;;;AAOxC,IAAI,gBAAgB;;;;;;;AAQpB,IAAI,cAAc;AAElB,SAAS,aAAa,KAAa;CACjC,KAAK,MAAM,CAAC,KAAK,WAAW,SAC1B,IAAI,OAAO,WAAW,KACpB,QAAQ,OAAO,GAAG;AAGxB;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,oBAAoB,SAAuC;CACzE,MAAM,YAAY;CAElB,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI,MAAM,cAAc,KAAQ;GAC9B,aAAa,GAAG;GAChB,cAAc;EAChB;EAEA,IAAI;EAEJ,IAAI,QAAQ,QAAQ,UAAU,CAAC,QAAQ,cAAc;GACnD,MAAM,KAAM,QAAQ,QAAoD,MAAM;GAE9E,IAAI,OAAO,UAAa,OAAO,QAAQ,OAAO,IAC5C,UAAU,QAAQ,OAAO,EAAE;QACtB,IAAI,QAAQ,WAAW,QAC5B;EAEJ;EAEA,MAAM,WAAW,QAAQ,eAAe,OAAO,KAAK,WAAW,QAAQ,SAAS,KAAK;EACrF,MAAM,WAAW,GAAG,UAAU,GAAG,QAAQ,MAAM,KAAK,GAAG;EAEvD,IAAI,SAAS,QAAQ,IAAI,QAAQ;EAEjC,IAAI,CAAC,UAAU,OAAO,WAAW,KAAK;GACpC,SAAS;IAAE,OAAO;IAAG,SAAS,MAAM,QAAQ;GAAS;GACrD,QAAQ,IAAI,UAAU,MAAM;EAC9B;EAEA,OAAO;EAEP,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,MAAM,OAAO,KAAK;EACxD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,OAAO,GAAI,CAAC;EAEvE,SAAS,OAAO,qBAAqB,QAAQ,GAAG;EAChD,SAAS,OAAO,yBAAyB,SAAS;EAClD,SAAS,OAAO,qBAAqB,KAAK,KAAK,OAAO,UAAU,GAAI,CAAC;EAErE,IAAI,OAAO,QAAQ,QAAQ,KAAK;GAC9B,SAAS,OAAO,eAAe,UAAU;GAEzC,OAAO,SAAS,gBAAgB;IAC9B,QACG,OAAO,QAAQ,iBAAiB,aAC7B,QAAQ,aAAa,OAAO,IAC5B,QAAQ,iBAAiB,EAAE,wBAAwB;IACzD;GACF,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"rate-limit.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/rate-limit.middleware.ts"],"sourcesContent":["import { normalizeIP } from \"@fastify/rate-limit\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the per-route rate limit middleware.\n */\nexport type RateLimitOptions = {\n  /**\n   * Max requests allowed within the time window.\n   */\n  max: number;\n  /**\n   * Time window in milliseconds.\n   */\n  duration: number;\n  /**\n   * Group key generator. Defaults to the client IP. Override to scope per-user,\n   * per-organization, per-tenant, etc.\n   *\n   * @example\n   * keyGenerator: (request) => request.locals.user?.id ?? request.ip,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Key the bucket to the signed-in user (`request.locals.user.id`). Works on\n   * routes and page actions alike. `keyGenerator` wins when both are set.\n   */\n  key?: \"user\";\n  /**\n   * With `key: \"user\"`, what to do for unauthenticated requests: bucket them\n   * by IP (default) or skip limiting entirely.\n   */\n  guests?: \"ip\" | \"skip\";\n  /**\n   * Override the default error message. Pass a function to build it per\n   * request, e.g. to translate it into the visitor's locale.\n   */\n  errorMessage?: string | ((request: Request) => string);\n};\n\ntype Bucket = {\n  count: number;\n  resetAt: number;\n};\n\nconst buckets = new Map<string, Bucket>();\nconst defaultIpv6Subnet = 64;\n\n/**\n * Each `rateLimitMiddleware()` call is its own limiter. Page actions share one\n * route, so without this two limits on the same page (say `like` and\n * `comment`) would count into one bucket.\n */\nlet nextLimiterId = 0;\n\n/**\n * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys\n * (rare per-user keys, dynamic path parameters in `keyGenerator`, etc.).\n * Called opportunistically, at most once per minute, not on a timer — keeps\n * the module side-effect-free for testing.\n */\nlet lastPruneAt = 0;\n\nfunction pruneExpired(now: number) {\n  for (const [key, bucket] of buckets) {\n    if (bucket.resetAt <= now) {\n      buckets.delete(key);\n    }\n  }\n}\n\n/**\n * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s\n * global cap (configured via `http.rateLimit`) — both run, and either can\n * 429. Use this for endpoints that need a tighter cap than the global default:\n * login, OTP request, password reset, expensive search, AI completions.\n *\n * The counter of THIS middleware always lives in-process. With `N` replicas\n * its effective cap is `N × max`. The global limit can be shared across\n * replicas by setting `http.rateLimit.redis` (an ioredis instance); that\n * does not affect this per-route middleware.\n *\n * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on\n * every response; adds `Retry-After` (seconds) on a 429.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],\n * });\n */\nexport function rateLimitMiddleware(options: RateLimitOptions): Middleware {\n  const limiterId = nextLimiterId++;\n\n  return ({ request, response }) => {\n    const now = Date.now();\n\n    if (now - lastPruneAt > 60_000) {\n      pruneExpired(now);\n      lastPruneAt = now;\n    }\n\n    let userKey: string | undefined;\n\n    if (options.key === \"user\" && !options.keyGenerator) {\n      const id = (request.locals as { user?: { id?: unknown } } | undefined)?.user?.id;\n\n      if (id !== undefined && id !== null && id !== \"\") {\n        userKey = `user:${String(id)}`;\n      } else if (options.guests === \"skip\") {\n        return;\n      }\n    }\n\n    const ip = request.detectIp();\n    const ipKey = ip ? normalizeIP(ip, defaultIpv6Subnet) : \"unknown\";\n    const groupKey = options.keyGenerator?.(request) || userKey || ipKey;\n    const cacheKey = `${limiterId}:${request.route.path}:${groupKey}`;\n\n    let bucket = buckets.get(cacheKey);\n\n    if (!bucket || bucket.resetAt <= now) {\n      bucket = { count: 0, resetAt: now + options.duration };\n      buckets.set(cacheKey, bucket);\n    }\n\n    bucket.count++;\n\n    const remaining = Math.max(0, options.max - bucket.count);\n    const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));\n\n    response.header(\"X-RateLimit-Limit\", options.max);\n    response.header(\"X-RateLimit-Remaining\", remaining);\n    response.header(\"X-RateLimit-Reset\", Math.ceil(bucket.resetAt / 1000));\n\n    if (bucket.count > options.max) {\n      response.header(\"Retry-After\", retryAfter);\n\n      return response.tooManyRequests({\n        error:\n          (typeof options.errorMessage === \"function\"\n            ? options.errorMessage(request)\n            : options.errorMessage) || t(\"http.rateLimitExceeded\"),\n        errorCode: HttpErrorCodes.RateLimitExceeded,\n      });\n    }\n  };\n}\n"],"mappings":";;;;;AAgDA,MAAM,0BAAU,IAAI,IAAoB;AACxC,MAAM,oBAAoB;;;;;;AAO1B,IAAI,gBAAgB;;;;;;;AAQpB,IAAI,cAAc;AAElB,SAAS,aAAa,KAAa;CACjC,KAAK,MAAM,CAAC,KAAK,WAAW,SAC1B,IAAI,OAAO,WAAW,KACpB,QAAQ,OAAO,GAAG;AAGxB;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,oBAAoB,SAAuC;CACzE,MAAM,YAAY;CAElB,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI,MAAM,cAAc,KAAQ;GAC9B,aAAa,GAAG;GAChB,cAAc;EAChB;EAEA,IAAI;EAEJ,IAAI,QAAQ,QAAQ,UAAU,CAAC,QAAQ,cAAc;GACnD,MAAM,KAAM,QAAQ,QAAoD,MAAM;GAE9E,IAAI,OAAO,UAAa,OAAO,QAAQ,OAAO,IAC5C,UAAU,QAAQ,OAAO,EAAE;QACtB,IAAI,QAAQ,WAAW,QAC5B;EAEJ;EAEA,MAAM,KAAK,QAAQ,SAAS;EAC5B,MAAM,QAAQ,KAAK,YAAY,IAAI,iBAAiB,IAAI;EACxD,MAAM,WAAW,QAAQ,eAAe,OAAO,KAAK,WAAW;EAC/D,MAAM,WAAW,GAAG,UAAU,GAAG,QAAQ,MAAM,KAAK,GAAG;EAEvD,IAAI,SAAS,QAAQ,IAAI,QAAQ;EAEjC,IAAI,CAAC,UAAU,OAAO,WAAW,KAAK;GACpC,SAAS;IAAE,OAAO;IAAG,SAAS,MAAM,QAAQ;GAAS;GACrD,QAAQ,IAAI,UAAU,MAAM;EAC9B;EAEA,OAAO;EAEP,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,MAAM,OAAO,KAAK;EACxD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,OAAO,GAAI,CAAC;EAEvE,SAAS,OAAO,qBAAqB,QAAQ,GAAG;EAChD,SAAS,OAAO,yBAAyB,SAAS;EAClD,SAAS,OAAO,qBAAqB,KAAK,KAAK,OAAO,UAAU,GAAI,CAAC;EAErE,IAAI,OAAO,QAAQ,QAAQ,KAAK;GAC9B,SAAS,OAAO,eAAe,UAAU;GAEzC,OAAO,SAAS,gBAAgB;IAC9B,QACG,OAAO,QAAQ,iBAAiB,aAC7B,QAAQ,aAAa,OAAO,IAC5B,QAAQ,iBAAiB,EAAE,wBAAwB;IACzD;GACF,CAAC;EACH;CACF;AACF"}

package/esm/http/request.d.mts

@@ -3,7 +3,6 @@ import { UploadedFile } from "./uploaded-file.mjs";
 import { DecodedAccessToken, RequestEvent, RequestLocals } from "./types.mjs";
 import { Middleware, RequestHandler, Route } from "../router/types.mjs";
 import { BaseValidator } from "@warlock.js/seal";
-import { trans } from "@mongez/localization";
 import { LogLevel } from "@warlock.js/logger";
 import { FastifyRequest } from "fastify";
 import { IncomingHttpHeaders } from "node:http2";
@@ -11,6 +10,8 @@ import { IncomingHttpHeaders } from "node:http2";
 //#region ../core/src/http/request.d.ts
 type StandardHeaders = { [K in keyof IncomingHttpHeaders as string extends K ? never : number extends K ? never : K]: IncomingHttpHeaders[K] };
 type HeaderKeys = keyof StandardHeaders;
+/** A request-bound translator: keyword in, translated string out. */
+type RequestTranslator = (keyword: string, placeholders?: Record<string, unknown>) => string;
 declare class Request<RequestValidation = any> {
   /**
    * Underlying Fastify request — a public escape hatch to capabilities the
@@ -54,24 +55,6 @@ declare class Request<RequestValidation = any> {
    */
   get decodedAccessToken(): DecodedAccessToken | undefined;
   set decodedAccessToken(value: DecodedAccessToken | undefined);
-  /**
-   * REMOVED in 5.12.0 — the authenticated user now lives at
-   * `request.locals.user`, a key `@warlock.js/auth` declares via module
-   * augmentation on `RequestLocals` and writes from its middleware after a
-   * successful token resolution. `RequestUser` moved out of core to
-   * `@warlock.js/auth` alongside it.
-   *
-   * This getter is a development-time diagnostic only, kept for one release
-   * so a call site that still reads `request.user` fails loudly at runtime
-   * instead of silently reading `undefined`. It is typed `never` so it
-   * cannot reintroduce an auth-shaped type into core, and it throws
-   * unconditionally outside production so the failure is impossible to miss
-   * in local dev — see `RequestUserMovedError`.
-   *
-   * There is no setter: nothing in core or downstream packages should ever
-   * assign to `request.user` again.
-   */
-  get user(): never;
   /**
    * Private, server-only, per-request data bag.
    *
@@ -134,14 +117,14 @@ declare class Request<RequestValidation = any> {
    */
   static current: Request;
   /**
-   * Translation method
-   * Type of it is the same as the type of trans function
+   * Translate a keyword in this request's locale. Returns the translated
+   * string, or the keyword itself when no translation exists.
    */
-  trans: ReturnType<typeof trans>;
+  trans: RequestTranslator;
   /**
    * Alias to trans method
    */
-  t: ReturnType<typeof trans>;
+  t: RequestTranslator;
   /**
    * Locale code
    */
@@ -611,5 +594,5 @@ declare class Request<RequestValidation = any> {
   setHeader(key: HeaderKeys, value: string): this;
 }
 //#endregion
-export { Request };
+export { Request, RequestTranslator };
 //# sourceMappingURL=request.d.mts.map

package/esm/http/request.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.mts","names":[],"sources":["../../../../../../../core/src/http/request.ts"],"mappings":";;;;;;;;;;;KAiCK,eAAA,iBAIU,mBAAA,mBAAsC,CAAA,0BAA2B,CAAA,WAAY,CAAA,GACvF,mBAAA,CAAoB,CAAA;AAAA,KAGpB,UAAA,SAAmB,eAAe;AAAA,cAE1B,OAAA;;;;;;;;;;;;;;;;;EAiBJ,WAAA,EAAc,cAAA;EAtBG;AAAA;;EA2BjB,QAAA,EAAW,QAAA;EAxBmB;AAAA;AAEvC;EA2BS,KAAA,EAAQ,KAAA;EA3BG;;;EAAA,UAgCR,OAAA;EAcuB;;;EAAA,QATzB,mBAAA;EAsHwB;;;;;;;EAAA,IA7GrB,kBAAA,IAAsB,kBAAA;EAAA,IAItB,kBAAA,CAAmB,KAAA,EAAO,kBAAA;EAuV7B;;;;;;;;;;;;;;;;;EAAA,IAjUG,IAAA;EAy2BS;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAr0Bb,MAAA,EAAQ,aAAA;EAyCD;;;;EAAA,UAnCJ,MAAA;EA8CH;;;;;;;;;;;;;;;;;;;;;;EAAA,IAtBI,KAAA;EAgKW;;;EAAA,OArJR,OAAA,EAAS,OAAA;EA4ML;;;;EAtMX,KAAA,EAAO,UAAA,QAAkB,KAAA;EA+NrB;;;EA1NJ,CAAA,EAAG,UAAA,QAAkB,KAAA;EAiOqB;;;EAAA,UAlNvC,OAAA;EAyNI;;;EAAA,UApNJ,aAAA,GAAgB,iBAAA;EAqNxB;;;EAhNK,EAAA;EAoOC;;;;;EA7ND,OAAA;EA8PI;;;EAzPJ,SAAA;EAkSI;;;EA7RJ,OAAA;EAkVG;;;EA7UH,UAAA,CAAW,OAAA,EAAS,cAAA;EAqWjB;;;;;;;;;EAAA,UAxUA,gBAAA;EA4hBW;;;;;;;EAAA,UAlgBX,cAAA;EA2iBH;;;;;EAAA,iBA/hBU,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EAsiBxC;;;EA1hBJ,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EAkjB3C;;;;;;;;EAAA,UAtiBD,WAAA,CAAY,SAAA;EAwmBL;;;;EAAA,UAplBP,aAAA;EAimBH;;;EAAA,IAvkBI,MAAA;EA8kBmB;;;EAAA,IArkBnB,MAAA,CAAO,UAAA;EAglBE;;;EAzkBb,aAAA,CAAc,UAAA;EA6lBY;;;;;EAllB1B,aAAA,CAAc,wBAAA;EA+qBK;;;EAAA,IAxqBf,QAAA;EAsrBJ;;;EA/qBM,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA,4BAAA,gBAAA;EAsrB/D;;;EA/qBJ,MAAA,gCAAsC,UAAA,EAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EA6rBK;;;EAAA,IArrBI,OAAA,IAAW,MAAA;EAgsBN;;;;;;;EAAA,QArrBR,wBAAA;EAiuBkB;;;EAxtBnB,MAAA,CAAO,IAAA,UAAc,YAAA;EAyuBjB;;;EA1tBJ,SAAA,CAAU,IAAA;EAkvBN;;;EAAA,IAzuBA,MAAA;EAyvBJ;;;EAAA,IAlvBI,QAAA;EAyyBJ;;;EAAA,IAlyBI,MAAA;EAozBJ;;;EAAA,IA7yBI,YAAA;EAozBc;;;EAAA,IAhyBd,kBAAA;EAg0BA;;;;;EAAA,IA/yBA,WAAA;EA+zBe;;;EAAA,IAhzBf,aAAA;EAw0BA;;;EAAA,IAj0BA,MAAA;EAw5BA;;;EAcuB;;;;;;;EAAA,UAx5BxB,gBAAA,CAAiB,GAAA;;;;;;YASjB,gBAAA,CAAiB,GAAA;;;;;;;;;;YAejB,aAAA,CAAc,KAAA,OAAY,UAAA,WAAqB,KAAA,GAAQ,KAAA;EAAA,UAMvD,YAAA;;;;;YAmBA,UAAA;;;;YASA,SAAA,CAAU,IAAA;;;;YAkLV,UAAA,CAAW,IAAA;;;;EAsBd,QAAA,CAAS,KAAA,EAAO,KAAA;;;;EAYhB,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;;;;EAOpC,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA,iCAAa,iBAAA;;;;EAOzC,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;;;;MAiBrB,IAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;;;;;;EAYE,aAAA,IAAa,OAAA,CAAA,QAAA;;;;;;EAuCnB,UAAA,IAAU,cAAA,CAAA,OAAA;;;;;EAQV,SAAA,UAAmB,iBAAA,EAAmB,MAAA,UAAgB,MAAA,sBAA4B,MAAA;;;;EAalF,eAAA,IAAmB,MAAA,aAAmB,iBAAA;;;;EAOtC,gBAAA,CAAiB,IAAA,EAAM,iBAAA;;;;;;;;EAWjB,OAAA,IAAO,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YAoBJ,iBAAA,IAAiB,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YA4DvB,kBAAA,IAAsB,UAAA;;;;EAiCzB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,IAAS,IAAA;;;;MASL,IAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA;;;;;;;;;;;EAcJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MAUlB,KAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA;;;;EAOA,eAAA;;;;EAUA,iBAAA;;;;EAmBA,KAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCJ,QAAA;;;;MAoCI,MAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;MAOA,SAAA;;;;MAOA,OAAA,gBAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}
+{"version":3,"file":"request.d.mts","names":[],"sources":["../../../../../../../core/src/http/request.ts"],"mappings":";;;;;;;;;;KAiCK,eAAA,iBAIU,mBAAA,mBAAsC,CAAA,0BAA2B,CAAA,WAAY,CAAA,GACvF,mBAAA,CAAoB,CAAA;AAAA,KAGpB,UAAA,SAAmB,eAAe;;KAG3B,iBAAA,IAAqB,OAAA,UAAiB,YAAA,GAAe,MAAM;AAAA,cAE1D,OAAA;EATwC;;;;;;;;;;;;;;;AAC3B;EAyBjB,WAAA,EAAc,cAAA;EAtBR;;;EA2BN,QAAA,EAAW,QAAA;EAxBR;;;EA6BH,KAAA,EAAQ,KAAA;EA7BgB;;;EAAA,UAkCrB,OAAA;EAlC4E;AAExF;;EAFwF,QAuC9E,mBAAA;EApBa;;;;;;;EAAA,IA6BV,kBAAA,IAAsB,kBAAA;EAAA,IAItB,kBAAA,CAAmB,KAAA,EAAO,kBAAA;EAyGX;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAxEnB,MAAA,EAAQ,aAAA;EA+hCa;;;;EAAA,UAzhClB,MAAA;EAxEH;;;;;;;;;;;;;;;;;;;;;;EAAA,IAgGI,KAAA;EAqCD;;;EAAA,OA1BI,OAAA,EAAS,OAAA;EA2ChB;;;;EArCA,KAAA,EAAO,iBAAA;EAoDI;;;EA/CX,CAAA,EAAG,iBAAA;EAkHwB;;;EAAA,UAnGxB,OAAA;EA+G2B;;;EAAA,UA1G3B,aAAA,GAAgB,iBAAA;EA0IhB;;;EArIH,EAAA;EA+KA;;;;;EAxKA,OAAA;EAiM2B;;;EA5L3B,SAAA;EA4LmE;;;EAvLnE,OAAA;EA+LC;;;EA1LD,UAAA,CAAW,OAAA,EAAS,cAAA;EAmMhB;;;;;;;;;EAAA,UAtKD,gBAAA;EAgOC;;;;;;;EAAA,UAtMD,cAAA;EA+RA;;;;;EAAA,iBAnRO,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EAqSM;;;EAzRlD,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EA2TlC;;;;;;;;EAAA,UA/SV,WAAA,CAAY,SAAA;EAmgBqB;;;;EAAA,UA/ejC,aAAA;EAsfsC;;;EAAA,IA5drC,MAAA;EAmec;;;EAAA,IA1dd,MAAA,CAAO,UAAA;EAqgBL;;;EA9fN,aAAA,CAAc,UAAA;EAqiBJ;;;;;EA1hBV,aAAA,CAAc,wBAAA;EAkiBwB;;;EAAA,IA3hBlC,QAAA;EAwiBkC;;;EAjiBhC,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA,4BAAA,gBAAA;EAmjB7D;;;EA5iBN,MAAA,gCAAsC,UAAA,EAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EA8jBc;;;EAAA,IAtjBL,OAAA,IAAW,MAAA;EAknBZ;;;;;;;EAAA,QAvmBF,wBAAA;EAspBD;;;EA7oBA,MAAA,CAAO,IAAA,UAAc,YAAA;EAopBjB;;;EAroBJ,SAAA,CAAU,IAAA;EAqpBV;;;EAAA,IA5oBI,MAAA;EAupBK;;;EAAA,IAhpBL,QAAA;EAgqBiB;;;EAAA,IAzpBjB,MAAA;EAqrBe;;;EAAA,IA9qBf,YAAA;EA+rBA;;;EAAA,IA3qBA,kBAAA;EAmsBA;;;;;EAAA,IAlrBA,WAAA;EAmtBJ;;;EAAA,IApsBI,aAAA;EAivBJ;;;EAAA,IA1uBI,MAAA;EA4vBJ;;;EAqBA;;;;;;;EAAA,UAnwBG,gBAAA,CAAiB,GAAA;EA8xBd;;;;;EAAA,UArxBH,gBAAA,CAAiB,GAAA;EAk1BpB;;;;;;;;;EAAA,UAh0BG,aAAA,CAAc,KAAA,OAAY,UAAA,WAAqB,KAAA,GAAQ,KAAA;EAAA,UAMvD,YAAA;EAi4BwB;;AAAa;;EAAb,UA92BxB,UAAA;;;;YASA,SAAA,CAAU,IAAA;;;;YAkLV,UAAA,CAAW,IAAA;;;;EAsBd,QAAA,CAAS,KAAA,EAAO,KAAA;;;;EAYhB,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;;;;EAOpC,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA,iCAAa,iBAAA;;;;EAOzC,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;;;;MAiBrB,IAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;;;;;;EAYE,aAAA,IAAa,OAAA,CAAA,QAAA;;;;;;EAuCnB,UAAA,IAAU,cAAA,CAAA,OAAA;;;;;EAQV,SAAA,UAAmB,iBAAA,EAAmB,MAAA,UAAgB,MAAA,sBAA4B,MAAA;;;;EAalF,eAAA,IAAmB,MAAA,aAAmB,iBAAA;;;;EAOtC,gBAAA,CAAiB,IAAA,EAAM,iBAAA;;;;;;;;EAWjB,OAAA,IAAO,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YAoBJ,iBAAA,IAAiB,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YA4DvB,kBAAA,IAAsB,UAAA;;;;EAiCzB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,IAAS,IAAA;;;;MASL,IAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA;;;;;;;;;;;EAcJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MAUlB,KAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA;;;;EAOA,eAAA;;;;EAUA,iBAAA;;;;EAmBA,KAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCJ,QAAA;;;;MAoCI,MAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;MAOA,SAAA;;;;MAOA,OAAA,gBAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}

package/esm/http/request.mjs

@@ -1,11 +1,10 @@
 import { config } from "../config/config-getter.mjs";
 import { LOCALE_COOKIE_NAME, LOCALE_PREFERENCE_COOKIE_NAME, resolveLocaleConfiguration } from "../config/locale-configuration.mjs";
-import { CookieJarUnavailableError, RequestUserMovedError } from "./errors/errors.mjs";
+import { CookieJarUnavailableError } from "./errors/errors.mjs";
 import { deriveTraceId } from "./tracing/trace-id.mjs";
 import { buildTracingContext, dispatchPhase, isTracingEnabled } from "./tracing/tracing-dispatcher.mjs";
 import "./tracing/index.mjs";
 import { createRequestStore } from "./middleware/inject-request-context.mjs";
-import { Application } from "../application/application.mjs";
 import { Response } from "./response.mjs";
 import { validateAll } from "../validation/validateAll.mjs";
 import { UploadedFile } from "./uploaded-file.mjs";
@@ -45,26 +44,6 @@ var Request = class Request {
 		this.locals.authDerived = true;
 	}
 	/**
-	* REMOVED in 5.12.0 — the authenticated user now lives at
-	* `request.locals.user`, a key `@warlock.js/auth` declares via module
-	* augmentation on `RequestLocals` and writes from its middleware after a
-	* successful token resolution. `RequestUser` moved out of core to
-	* `@warlock.js/auth` alongside it.
-	*
-	* This getter is a development-time diagnostic only, kept for one release
-	* so a call site that still reads `request.user` fails loudly at runtime
-	* instead of silently reading `undefined`. It is typed `never` so it
-	* cannot reintroduce an auth-shaped type into core, and it throws
-	* unconditionally outside production so the failure is impossible to miss
-	* in local dev — see `RequestUserMovedError`.
-	*
-	* There is no setter: nothing in core or downstream packages should ever
-	* assign to `request.user` again.
-	*/
-	get user() {
-		if (Application.isDevelopment) throw new RequestUserMovedError();
-	}
-	/**
 	* Per-request Content-Security-Policy nonce — a fresh, unguessable value
 	* the web layer hands to `<Scripts nonce={...} />` (the inline payload
 	* script) and to the `Content-Security-Policy` header, so a strict