npm - @warlock.js/core - Versions diffs - 5.28.0 → 5.30.0 - Mend

@warlock.js/core 5.28.0 → 5.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1396) hide show

package/esm/http/index.mjs CHANGED Viewed

@@ -9,13 +9,14 @@ import { buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequest
 import "./tracing/index.mjs";
 import { createRequestStore, t } from "./middleware/inject-request-context.mjs";
 import { defaultHttpConfigurations, httpConfig } from "./config.mjs";
-import { streamReactResponse } from "./stream-react-response.mjs";
-import { Response, ResponseStatus } from "./response.mjs";
 import { UPLOADS_DEFAULTS, uploadsConfig } from "./uploads-config.mjs";
+import { streamReactResponse } from "./stream-react-response.mjs";
+import { Response, ResponseStatus, toSingleLineSseField } from "./response.mjs";
 import { UploadedFile } from "./uploaded-file.mjs";
+import { URL_CREDENTIAL_PARAMS, buildRequestLogSnapshot, redactQueryCredentials, redactUrlCredentials, resolveRequestLoggingOptions } from "./request-log-snapshot.mjs";
 import { Request } from "./request.mjs";
-import { registerHttpPlugins } from "./plugins.mjs";
-import { closeServerWithTimeout, getHttpServer, startHttpServer } from "./server.mjs";
+import { registerHttpPlugins, resolvePublicRoot } from "./plugins.mjs";
+import { beginHttpDrain, closeServerWithTimeout, getHttpServer, startHttpServer, trackConnectionsForDrain } from "./server.mjs";
 import { createHttpApplication, stopHttpApplication } from "./createHttpApplication.mjs";
 import { RequestLog } from "./database/RequestLog.mjs";
 import { logResponse, wrapResponseInDataKey } from "./events.mjs";
@@ -23,7 +24,9 @@ import { health } from "./health.mjs";
 import { RequestController } from "./request-controller.mjs";
 import { ImageVariantsConfigError } from "./uploads/image-variants-config-error.mjs";
 import { generateImageVariants } from "./uploads/generate-image-variants.mjs";
-import { uploadedFileController } from "./uploads/uploaded-file.controller.mjs";
+import { purgeImageVariants } from "./uploads/purge-image-variants.mjs";
+import { resolveImageVariant } from "./uploads/resolve-image-variant.mjs";
+import { createUploadedFileController, uploadedFileController } from "./uploads/uploaded-file.controller.mjs";
 import "./uploads/index.mjs";
 import { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from "./middleware/utils/idempotency-key.mjs";
 import { anyMatch, ipMatches } from "./middleware/utils/cidr-match.mjs";

package/esm/http/middleware/cache-response-middleware.d.mts CHANGED Viewed

@@ -1,7 +1,7 @@
 import { Request } from "../request.mjs";
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/cache-response-middleware.d.ts
+//#region ../../packages/core/src/http/middleware/cache-response-middleware.d.ts
 type CacheMiddlewareOptions = {
   /**
    * Cache key

package/esm/http/middleware/cache-response-middleware.d.mts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cache-response-middleware.d.mts","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/cache-response-middleware.ts"],"mappings":";;;;KAsBY,sBAAA;;AAAZ;;EAIE,QAAA,aAAqB,OAAA,EAAS,OAAA,iBAAwB,OAAA,EAAS,OAAA,KAAY,OAAA;EAA7C;;;;;;EAO9B,UAAA;EAP8B;;;;;EAa9B,IAAA;EAAA;;;EAIA,GAAA;EAmB6B;;;AAAO;AA+DtC;;EA3EE,MAAA;EA2EgG;;;;;AAAA;;;;;;EA/DhG,IAAA,gBAAoB,OAAA,EAAS,OAAA;AAAA;AAAA,iBA+Df,eAAA,CAAgB,oBAAA,EAAsB,sBAAA,YAAkC,UAAU"}
1	+ {"version":3,"file":"cache-response-middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/cache-response-middleware.ts"],"mappings":";;;;KAsBY,sBAAA;;AAAZ;;EAIE,QAAA,aAAqB,OAAA,EAAS,OAAA,iBAAwB,OAAA,EAAS,OAAA,KAAY,OAAA;EAA7C;;;;;;EAO9B,UAAA;EAP8B;;;;;EAa9B,IAAA;EAAA;;;EAIA,GAAA;EAmB6B;;;AAAO;AA+DtC;;EA3EE,MAAA;EA2EgG;;;;;AAAA;;;;;;EA/DhG,IAAA,gBAAoB,OAAA,EAAS,OAAA;AAAA;AAAA,iBA+Df,eAAA,CAAgB,oBAAA,EAAsB,sBAAA,YAAkC,UAAU"}

package/esm/http/middleware/cache-response-middleware.mjs CHANGED Viewed

@@ -2,7 +2,7 @@ import { log } from "@warlock.js/logger";
 import { except } from "@mongez/reinforcements";
 import { cache } from "@warlock.js/cache";
-//#region ../core/src/http/middleware/cache-response-middleware.ts
+//#region ../../packages/core/src/http/middleware/cache-response-middleware.ts
 const defaultCacheOptions = { withLocale: true };
 /**
 * Resolves `CacheMiddlewareOptions.tags` — a static list or a function of

package/esm/http/middleware/cache-response-middleware.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cache-response-middleware.mjs","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/cache-response-middleware.ts"],"sourcesContent":["import { except } from \"@mongez/reinforcements\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router/types\";\nimport type { Request } from \"./../request\";\nimport type { Response } from \"./../response\";\n\n/*\n Shape persisted to the cache for a cached response. Stores the status and\n * content-type alongside the body so the HIT path can replay the response\n * faithfully via {@link Response.replay} instead of re-entering `send()`.\n /\ntype CachedResponsePayload = {\n status: number;\n data: unknown;\n contentType?: string;\n};\n\n// TODO: Add option to determine whether to cache the response or not\n// TODO: add option to determine what to be cached from the response\n// TODO: add cache middleware config options for example to set the default driver, ttl, etc\n\nexport type CacheMiddlewareOptions = {\n /\n Cache key\n /\n cacheKey: string \| ((request: Request) => string) \| ((request: Request) => Promise<string>);\n /\n If true, then the response will be cached based on the current locale code\n * This is useful when you have a multi-language website, and you want to cache the response based on the current locale\n \n @default true\n /\n withLocale?: boolean;\n /\n List of keys from the response object to omit from the cached response\n \n @default ['user']\n /\n omit?: string[];\n /\n Expires after number of seconds\n /\n ttl?: number;\n /\n Cache driver\n \n @see config/cache.ts: drivers object\n * @default cache manager\n /\n driver?: string;\n /\n Tags this cached response is stored under, mirroring `route.cache.tags`\n * on `@warlock.js/web`'s page cache (`PageCacheOptIn.tags`,\n * `web/src/routing/route-identity.ts`) so the two caches share one mental\n * model: `cache.tags([...]).invalidate()` from `@warlock.js/cache` evicts\n * a tagged API response the same way it evicts a tagged page. Either a\n * static list, or a function of the request — resolved once per request,\n * right before the response is stored.\n \n @default undefined (untagged — behaves exactly as before this option existed)\n /\n tags?: string[] \| ((request: Request) => string[]);\n};\n\nconst defaultCacheOptions: Partial<CacheMiddlewareOptions> = {\n withLocale: true,\n};\n\ntype ParsedCacheOptions = Required<Omit<CacheMiddlewareOptions, \"tags\">> & {\n cacheKey: string;\n /* Resolved, concrete tag list — see {@link resolveCacheTags}. /\n tags: string[];\n};\n\n/\n Resolves `CacheMiddlewareOptions.tags` — a static list or a function of\n * the request — into a concrete list at store time. Mirrors\n * `resolveCacheTags` in `@warlock.js/web`'s `create-page-route-handler.ts`,\n * the equivalent seam for `route.cache.tags`.\n */\nfunction resolveCacheTags(tags: CacheMiddlewareOptions[\"tags\"], request: Request): string[] {\n if (tags === undefined) return [];\n\n return typeof tags === \"function\" ? tags(request) : tags;\n}\n\nasync function parseCacheOptions(cacheOptions: CacheMiddlewareOptions \| string, request: Request) {\n if (typeof cacheOptions === \"string\") {\n cacheOptions = {\n cacheKey: cacheOptions,\n };\n }\n\n // Everything below resolves into a fresh per-request object; the options\n // the factory closed over are shared across all requests and users, so they\n // must never be written to.\n const resolvedCacheKey =\n typeof cacheOptions.cacheKey === \"function\"\n ? await cacheOptions.cacheKey(request)\n : cacheOptions.cacheKey;\n\n const tags = resolveCacheTags(cacheOptions.tags, request);\n\n const finalCacheOptions = {\n ...defaultCacheOptions,\n ...cacheOptions,\n cacheKey: resolvedCacheKey,\n tags: [...tags],\n omit: cacheOptions.omit ? [...cacheOptions.omit] : undefined,\n } as unknown as ParsedCacheOptions;\n\n if (finalCacheOptions.withLocale) {\n const locale = request.getLocaleCode();\n\n finalCacheOptions.cacheKey = `${finalCacheOptions.cacheKey}:${locale}`;\n }\n\n if (!finalCacheOptions.omit) {\n finalCacheOptions.omit = [\"user\", \"settings\"];\n }\n\n return finalCacheOptions;\n}\n\nexport function cacheMiddleware(responseCacheOptions: CacheMiddlewareOptions \| string): Middleware {\n // The `Middleware` return annotation is load-bearing: without it, tsc never\n // checks this factory's calling convention, which is how the positional v4\n // shape survived an earlier refactor unnoticed.\n return async function ({ request, response }) {\n const { ttl, omit, cacheKey, driver, tags } = await parseCacheOptions(\n responseCacheOptions,\n request,\n );\n const cacheDriver = driver ? await cache.use(driver) : cache;\n\n const content = (await cacheDriver.get(cacheKey)) as CachedResponsePayload \| null;\n\n if (content) {\n // Replay through the standard pipeline (status + content-type preserved)\n // instead of `baseResponse.send()`, which would re-enter Response.send()\n // on an already-sent reply, trip the double-send guard, and drop the\n // status / content-type.\n return response.replay({\n status: content.status ?? 200,\n body: content.data,\n contentType: content.contentType,\n });\n }\n\n response.onSent((response: Response) => {\n if (!response.isOk \|\| response.request.path !== request.path) {\n return;\n }\n\n const sentContentType = response.contentType;\n\n const content: CachedResponsePayload = {\n status: response.statusCode,\n data: except(response.parsedBody, omit),\n contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n };\n\n // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n // write (e.g. Redis down) would surface as an unhandledRejection.\n //\n // Tagged and untagged writes go through separate calls rather than a\n // shared branch-free path so an untagged route's write stays byte\n // identical to what it was before `tags` existed.\n const write =\n tags.length > 0\n ? cacheDriver.tags(tags).set(cacheKey, content, ttl)\n : cacheDriver.set(cacheKey, content, ttl);\n\n write.catch((error: unknown) => {\n log.error(\"cache-middleware\", \"set\", error);\n });\n });\n };\n}\n"],"mappings":";;;;;AAiEA,MAAM,sBAAuD,EAC3D,YAAY,KACd;;;;;;;AAcA,SAAS,iBAAiB,MAAsC,SAA4B;CAC1F,IAAI,SAAS,QAAW,OAAO,CAAC;CAEhC,OAAO,OAAO,SAAS,aAAa,KAAK,OAAO,IAAI;AACtD;AAEA,eAAe,kBAAkB,cAA+C,SAAkB;CAChG,IAAI,OAAO,iBAAiB,UAC1B,eAAe,EACb,UAAU,aACZ;CAMF,MAAM,mBACJ,OAAO,aAAa,aAAa,aAC7B,MAAM,aAAa,SAAS,OAAO,IACnC,aAAa;CAEnB,MAAM,OAAO,iBAAiB,aAAa,MAAM,OAAO;CAExD,MAAM,oBAAoB;EACxB,GAAG;EACH,GAAG;EACH,UAAU;EACV,MAAM,CAAC,GAAG,IAAI;EACd,MAAM,aAAa,OAAO,CAAC,GAAG,aAAa,IAAI,IAAI;CACrD;CAEA,IAAI,kBAAkB,YAAY;EAChC,MAAM,SAAS,QAAQ,cAAc;EAErC,kBAAkB,WAAW,GAAG,kBAAkB,SAAS,GAAG;CAChE;CAEA,IAAI,CAAC,kBAAkB,MACrB,kBAAkB,OAAO,CAAC,QAAQ,UAAU;CAG9C,OAAO;AACT;AAEA,SAAgB,gBAAgB,sBAAmE;CAIjG,OAAO,eAAgB,EAAE,SAAS,YAAY;EAC5C,MAAM,EAAE,KAAK,MAAM,UAAU,QAAQ,SAAS,MAAM,kBAClD,sBACA,OACF;EACA,MAAM,cAAc,SAAS,MAAM,MAAM,IAAI,MAAM,IAAI;EAEvD,MAAM,UAAW,MAAM,YAAY,IAAI,QAAQ;EAE/C,IAAI,SAKF,OAAO,SAAS,OAAO;GACrB,QAAQ,QAAQ,UAAU;GAC1B,MAAM,QAAQ;GACd,aAAa,QAAQ;EACvB,CAAC;EAGH,SAAS,QAAQ,aAAuB;GACtC,IAAI,CAAC,SAAS,QAAQ,SAAS,QAAQ,SAAS,QAAQ,MACtD;GAGF,MAAM,kBAAkB,SAAS;GAEjC,MAAM,UAAiC;IACrC,QAAQ,SAAS;IACjB,MAAM,OAAO,SAAS,YAAY,IAAI;IACtC,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE;GAaA,CAJE,KAAK,SAAS,IACV,YAAY,KAAK,IAAI,CAAC,CAAC,IAAI,UAAU,SAAS,GAAG,IACjD,YAAY,IAAI,UAAU,SAAS,GAAG,EAEvC,CAAC,OAAO,UAAmB;IAC9B,IAAI,MAAM,oBAAoB,OAAO,KAAK;GAC5C,CAAC;EACH,CAAC;CACH;AACF"}
1	+ {"version":3,"file":"cache-response-middleware.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/cache-response-middleware.ts"],"sourcesContent":["import { except } from \"@mongez/reinforcements\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router/types\";\nimport type { Request } from \"./../request\";\nimport type { Response } from \"./../response\";\n\n/*\n Shape persisted to the cache for a cached response. Stores the status and\n * content-type alongside the body so the HIT path can replay the response\n * faithfully via {@link Response.replay} instead of re-entering `send()`.\n /\ntype CachedResponsePayload = {\n status: number;\n data: unknown;\n contentType?: string;\n};\n\n// TODO: Add option to determine whether to cache the response or not\n// TODO: add option to determine what to be cached from the response\n// TODO: add cache middleware config options for example to set the default driver, ttl, etc\n\nexport type CacheMiddlewareOptions = {\n /\n Cache key\n /\n cacheKey: string \| ((request: Request) => string) \| ((request: Request) => Promise<string>);\n /\n If true, then the response will be cached based on the current locale code\n * This is useful when you have a multi-language website, and you want to cache the response based on the current locale\n \n @default true\n /\n withLocale?: boolean;\n /\n List of keys from the response object to omit from the cached response\n \n @default ['user']\n /\n omit?: string[];\n /\n Expires after number of seconds\n /\n ttl?: number;\n /\n Cache driver\n \n @see config/cache.ts: drivers object\n * @default cache manager\n /\n driver?: string;\n /\n Tags this cached response is stored under, mirroring `route.cache.tags`\n * on `@warlock.js/web`'s page cache (`PageCacheOptIn.tags`,\n * `web/src/routing/route-identity.ts`) so the two caches share one mental\n * model: `cache.tags([...]).invalidate()` from `@warlock.js/cache` evicts\n * a tagged API response the same way it evicts a tagged page. Either a\n * static list, or a function of the request — resolved once per request,\n * right before the response is stored.\n \n @default undefined (untagged — behaves exactly as before this option existed)\n /\n tags?: string[] \| ((request: Request) => string[]);\n};\n\nconst defaultCacheOptions: Partial<CacheMiddlewareOptions> = {\n withLocale: true,\n};\n\ntype ParsedCacheOptions = Required<Omit<CacheMiddlewareOptions, \"tags\">> & {\n cacheKey: string;\n /* Resolved, concrete tag list — see {@link resolveCacheTags}. /\n tags: string[];\n};\n\n/\n Resolves `CacheMiddlewareOptions.tags` — a static list or a function of\n * the request — into a concrete list at store time. Mirrors\n * `resolveCacheTags` in `@warlock.js/web`'s `create-page-route-handler.ts`,\n * the equivalent seam for `route.cache.tags`.\n */\nfunction resolveCacheTags(tags: CacheMiddlewareOptions[\"tags\"], request: Request): string[] {\n if (tags === undefined) return [];\n\n return typeof tags === \"function\" ? tags(request) : tags;\n}\n\nasync function parseCacheOptions(cacheOptions: CacheMiddlewareOptions \| string, request: Request) {\n if (typeof cacheOptions === \"string\") {\n cacheOptions = {\n cacheKey: cacheOptions,\n };\n }\n\n // Everything below resolves into a fresh per-request object; the options\n // the factory closed over are shared across all requests and users, so they\n // must never be written to.\n const resolvedCacheKey =\n typeof cacheOptions.cacheKey === \"function\"\n ? await cacheOptions.cacheKey(request)\n : cacheOptions.cacheKey;\n\n const tags = resolveCacheTags(cacheOptions.tags, request);\n\n const finalCacheOptions = {\n ...defaultCacheOptions,\n ...cacheOptions,\n cacheKey: resolvedCacheKey,\n tags: [...tags],\n omit: cacheOptions.omit ? [...cacheOptions.omit] : undefined,\n } as unknown as ParsedCacheOptions;\n\n if (finalCacheOptions.withLocale) {\n const locale = request.getLocaleCode();\n\n finalCacheOptions.cacheKey = `${finalCacheOptions.cacheKey}:${locale}`;\n }\n\n if (!finalCacheOptions.omit) {\n finalCacheOptions.omit = [\"user\", \"settings\"];\n }\n\n return finalCacheOptions;\n}\n\nexport function cacheMiddleware(responseCacheOptions: CacheMiddlewareOptions \| string): Middleware {\n // The `Middleware` return annotation is load-bearing: without it, tsc never\n // checks this factory's calling convention, which is how the positional v4\n // shape survived an earlier refactor unnoticed.\n return async function ({ request, response }) {\n const { ttl, omit, cacheKey, driver, tags } = await parseCacheOptions(\n responseCacheOptions,\n request,\n );\n const cacheDriver = driver ? await cache.use(driver) : cache;\n\n const content = (await cacheDriver.get(cacheKey)) as CachedResponsePayload \| null;\n\n if (content) {\n // Replay through the standard pipeline (status + content-type preserved)\n // instead of `baseResponse.send()`, which would re-enter Response.send()\n // on an already-sent reply, trip the double-send guard, and drop the\n // status / content-type.\n return response.replay({\n status: content.status ?? 200,\n body: content.data,\n contentType: content.contentType,\n });\n }\n\n response.onSent((response: Response) => {\n if (!response.isOk \|\| response.request.path !== request.path) {\n return;\n }\n\n const sentContentType = response.contentType;\n\n const content: CachedResponsePayload = {\n status: response.statusCode,\n data: except(response.parsedBody, omit),\n contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n };\n\n // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n // write (e.g. Redis down) would surface as an unhandledRejection.\n //\n // Tagged and untagged writes go through separate calls rather than a\n // shared branch-free path so an untagged route's write stays byte\n // identical to what it was before `tags` existed.\n const write =\n tags.length > 0\n ? cacheDriver.tags(tags).set(cacheKey, content, ttl)\n : cacheDriver.set(cacheKey, content, ttl);\n\n write.catch((error: unknown) => {\n log.error(\"cache-middleware\", \"set\", error);\n });\n });\n };\n}\n"],"mappings":";;;;;AAiEA,MAAM,sBAAuD,EAC3D,YAAY,KACd;;;;;;;AAcA,SAAS,iBAAiB,MAAsC,SAA4B;CAC1F,IAAI,SAAS,QAAW,OAAO,CAAC;CAEhC,OAAO,OAAO,SAAS,aAAa,KAAK,OAAO,IAAI;AACtD;AAEA,eAAe,kBAAkB,cAA+C,SAAkB;CAChG,IAAI,OAAO,iBAAiB,UAC1B,eAAe,EACb,UAAU,aACZ;CAMF,MAAM,mBACJ,OAAO,aAAa,aAAa,aAC7B,MAAM,aAAa,SAAS,OAAO,IACnC,aAAa;CAEnB,MAAM,OAAO,iBAAiB,aAAa,MAAM,OAAO;CAExD,MAAM,oBAAoB;EACxB,GAAG;EACH,GAAG;EACH,UAAU;EACV,MAAM,CAAC,GAAG,IAAI;EACd,MAAM,aAAa,OAAO,CAAC,GAAG,aAAa,IAAI,IAAI;CACrD;CAEA,IAAI,kBAAkB,YAAY;EAChC,MAAM,SAAS,QAAQ,cAAc;EAErC,kBAAkB,WAAW,GAAG,kBAAkB,SAAS,GAAG;CAChE;CAEA,IAAI,CAAC,kBAAkB,MACrB,kBAAkB,OAAO,CAAC,QAAQ,UAAU;CAG9C,OAAO;AACT;AAEA,SAAgB,gBAAgB,sBAAmE;CAIjG,OAAO,eAAgB,EAAE,SAAS,YAAY;EAC5C,MAAM,EAAE,KAAK,MAAM,UAAU,QAAQ,SAAS,MAAM,kBAClD,sBACA,OACF;EACA,MAAM,cAAc,SAAS,MAAM,MAAM,IAAI,MAAM,IAAI;EAEvD,MAAM,UAAW,MAAM,YAAY,IAAI,QAAQ;EAE/C,IAAI,SAKF,OAAO,SAAS,OAAO;GACrB,QAAQ,QAAQ,UAAU;GAC1B,MAAM,QAAQ;GACd,aAAa,QAAQ;EACvB,CAAC;EAGH,SAAS,QAAQ,aAAuB;GACtC,IAAI,CAAC,SAAS,QAAQ,SAAS,QAAQ,SAAS,QAAQ,MACtD;GAGF,MAAM,kBAAkB,SAAS;GAEjC,MAAM,UAAiC;IACrC,QAAQ,SAAS;IACjB,MAAM,OAAO,SAAS,YAAY,IAAI;IACtC,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE;GAaA,CAJE,KAAK,SAAS,IACV,YAAY,KAAK,IAAI,CAAC,CAAC,IAAI,UAAU,SAAS,GAAG,IACjD,YAAY,IAAI,UAAU,SAAS,GAAG,EAEvC,CAAC,OAAO,UAAmB;IAC9B,IAAI,MAAM,oBAAoB,OAAO,KAAK;GAC5C,CAAC;EACH,CAAC;CACH;AACF"}

package/esm/http/middleware/concurrency-limit.middleware.d.mts CHANGED Viewed

@@ -1,6 +1,6 @@
 import { Request } from "../request.mjs";
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/concurrency-limit.middleware.d.ts
+//#region ../../packages/core/src/http/middleware/concurrency-limit.middleware.d.ts
 /**
  * Options for the concurrency limit middleware.
  */

package/esm/http/middleware/concurrency-limit.middleware.d.mts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"concurrency-limit.middleware.d.mts","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/concurrency-limit.middleware.ts"],"mappings":";;;;;;KASY,uBAAA;EAAuB;;;;;;;;EASjC,YAAA,IAAgB,OAAA,EAAS,OAAO;EAiDlB;;;EA7Cd,YAAA;AAAA;;;;;AAgDW;;;;;;;;;;;;;;;;;;;;;;;;iBAHG,0BAAA,CACd,GAAA,UACA,OAAA,GAAS,uBAAA,GACR,UAAU"}
1	+ {"version":3,"file":"concurrency-limit.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/concurrency-limit.middleware.ts"],"mappings":";;;;;;KASY,uBAAA;EAAuB;;;;;;;;EASjC,YAAA,IAAgB,OAAA,EAAS,OAAO;EAiDlB;;;EA7Cd,YAAA;AAAA;;;;;AAgDW;;;;;;;;;;;;;;;;;;;;;;;;iBAHG,0BAAA,CACd,GAAA,UACA,OAAA,GAAS,uBAAA,GACR,UAAU"}

package/esm/http/middleware/concurrency-limit.middleware.mjs CHANGED Viewed

@@ -1,7 +1,7 @@
 import { HttpErrorCodes } from "../error-codes.mjs";
 import { t } from "./inject-request-context.mjs";
-//#region ../core/src/http/middleware/concurrency-limit.middleware.ts
+//#region ../../packages/core/src/http/middleware/concurrency-limit.middleware.ts
 const counters = /* @__PURE__ */ new Map();
 function release(key) {
 	const after = (counters.get(key) || 1) - 1;

package/esm/http/middleware/concurrency-limit.middleware.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"concurrency-limit.middleware.mjs","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/concurrency-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\n\n/*\n Options for the concurrency limit middleware.\n /\nexport type ConcurrencyLimitOptions = {\n /\n Group key generator. Defaults to `request.route.path` — i.e. the cap\n * applies across all callers of that route. Override to scope per-user\n * or per-tenant.\n \n @example\n * keyGenerator: (request) => `${request.route.path}:${request.locals.user?.id ?? request.ip}`,\n /\n keyGenerator?: (request: Request) => string;\n /\n Override the default error message.\n /\n errorMessage?: string;\n};\n\nconst counters = new Map<string, number>();\n\nfunction release(key: string) {\n const after = (counters.get(key) \|\| 1) - 1;\n\n if (after <= 0) {\n counters.delete(key);\n\n return;\n }\n\n counters.set(key, after);\n}\n\n/\n Cap the number of in-flight requests against a route. Above the cap, new\n * requests get a fast 429 + `Retry-After: 1` — no queue, no timeout.\n \n Use for endpoints whose cost is unbounded per-request: report generation,\n * AI completions, image processing, expensive aggregations. Different from\n * `rateLimit()` — rate-limit caps requests-per-time, concurrency caps\n * in-flight requests at any instant.\n \n The counter is process-local. With `N` replicas the effective cap is\n * `N × max`. Document this in the route's behavior; if you need shared\n * concurrency across replicas, reach for a `@warlock.js/cache` lock instead.\n \n @example\n * import { middleware } from \"@warlock.js/core\";\n \n router.post(\"/reports/generate\", reportController, {\n * middleware: [middleware.concurrencyLimit(3)],\n * });\n \n router.post(\"/ai/summarize\", summarizeController, {\n * middleware: [\n * middleware.concurrencyLimit(10, {\n * keyGenerator: (request) => `ai:${request.locals.user?.id ?? request.ip}`,\n * }),\n * ],\n * });\n */\nexport function concurrencyLimitMiddleware(\n max: number,\n options: ConcurrencyLimitOptions = {},\n): Middleware {\n return ({ request, response }) => {\n const key = options.keyGenerator?.(request) \|\| request.route.path;\n const current = counters.get(key) \|\| 0;\n\n if (current >= max) {\n response.header(\"Retry-After\", 1);\n\n return response.tooManyRequests({\n error: options.errorMessage \|\| t(\"http.concurrencyLimitReached\"),\n errorCode: HttpErrorCodes.ConcurrencyLimitReached,\n limit: max,\n });\n }\n\n counters.set(key, current + 1);\n\n let released = false;\n\n const releaseOnce = () => {\n if (released) {\n return;\n }\n\n released = true;\n release(key);\n };\n\n // `onSent` only fires from Response.send()/stream().end()/sse().end().\n // Bare-reply paths (noContent, redirect, sendFile, download, sendBuffer,\n // raw send) never trigger it, so the slot would leak and the route would\n // permanently 429 after `max` such requests. Bind to the raw socket\n // lifecycle as well so the slot frees regardless of response path —\n // `releaseOnce` is idempotent, so double-firing is harmless.\n response.onSent((_sentResponse: Response) => releaseOnce());\n response.baseResponse.raw.once(\"finish\", releaseOnce);\n response.baseResponse.raw.once(\"close\", releaseOnce);\n };\n}\n"],"mappings":";;;;AAyBA,MAAM,2BAAW,IAAI,IAAoB;AAEzC,SAAS,QAAQ,KAAa;CAC5B,MAAM,SAAS,SAAS,IAAI,GAAG,KAAK,KAAK;CAEzC,IAAI,SAAS,GAAG;EACd,SAAS,OAAO,GAAG;EAEnB;CACF;CAEA,SAAS,IAAI,KAAK,KAAK;AACzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,2BACd,KACA,UAAmC,CAAC,GACxB;CACZ,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,QAAQ,eAAe,OAAO,KAAK,QAAQ,MAAM;EAC7D,MAAM,UAAU,SAAS,IAAI,GAAG,KAAK;EAErC,IAAI,WAAW,KAAK;GAClB,SAAS,OAAO,eAAe,CAAC;GAEhC,OAAO,SAAS,gBAAgB;IAC9B,OAAO,QAAQ,gBAAgB,EAAE,8BAA8B;IAC/D;IACA,OAAO;GACT,CAAC;EACH;EAEA,SAAS,IAAI,KAAK,UAAU,CAAC;EAE7B,IAAI,WAAW;EAEf,MAAM,oBAAoB;GACxB,IAAI,UACF;GAGF,WAAW;GACX,QAAQ,GAAG;EACb;EAQA,SAAS,QAAQ,kBAA4B,YAAY,CAAC;EAC1D,SAAS,aAAa,IAAI,KAAK,UAAU,WAAW;EACpD,SAAS,aAAa,IAAI,KAAK,SAAS,WAAW;CACrD;AACF"}
1	+ {"version":3,"file":"concurrency-limit.middleware.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/concurrency-limit.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\n\n/*\n Options for the concurrency limit middleware.\n /\nexport type ConcurrencyLimitOptions = {\n /\n Group key generator. Defaults to `request.route.path` — i.e. the cap\n * applies across all callers of that route. Override to scope per-user\n * or per-tenant.\n \n @example\n * keyGenerator: (request) => `${request.route.path}:${request.locals.user?.id ?? request.ip}`,\n /\n keyGenerator?: (request: Request) => string;\n /\n Override the default error message.\n /\n errorMessage?: string;\n};\n\nconst counters = new Map<string, number>();\n\nfunction release(key: string) {\n const after = (counters.get(key) \|\| 1) - 1;\n\n if (after <= 0) {\n counters.delete(key);\n\n return;\n }\n\n counters.set(key, after);\n}\n\n/\n Cap the number of in-flight requests against a route. Above the cap, new\n * requests get a fast 429 + `Retry-After: 1` — no queue, no timeout.\n \n Use for endpoints whose cost is unbounded per-request: report generation,\n * AI completions, image processing, expensive aggregations. Different from\n * `rateLimit()` — rate-limit caps requests-per-time, concurrency caps\n * in-flight requests at any instant.\n \n The counter is process-local. With `N` replicas the effective cap is\n * `N × max`. Document this in the route's behavior; if you need shared\n * concurrency across replicas, reach for a `@warlock.js/cache` lock instead.\n \n @example\n * import { middleware } from \"@warlock.js/core\";\n \n router.post(\"/reports/generate\", reportController, {\n * middleware: [middleware.concurrencyLimit(3)],\n * });\n \n router.post(\"/ai/summarize\", summarizeController, {\n * middleware: [\n * middleware.concurrencyLimit(10, {\n * keyGenerator: (request) => `ai:${request.locals.user?.id ?? request.ip}`,\n * }),\n * ],\n * });\n */\nexport function concurrencyLimitMiddleware(\n max: number,\n options: ConcurrencyLimitOptions = {},\n): Middleware {\n return ({ request, response }) => {\n const key = options.keyGenerator?.(request) \|\| request.route.path;\n const current = counters.get(key) \|\| 0;\n\n if (current >= max) {\n response.header(\"Retry-After\", 1);\n\n return response.tooManyRequests({\n error: options.errorMessage \|\| t(\"http.concurrencyLimitReached\"),\n errorCode: HttpErrorCodes.ConcurrencyLimitReached,\n limit: max,\n });\n }\n\n counters.set(key, current + 1);\n\n let released = false;\n\n const releaseOnce = () => {\n if (released) {\n return;\n }\n\n released = true;\n release(key);\n };\n\n // `onSent` only fires from Response.send()/stream().end()/sse().end().\n // Bare-reply paths (noContent, redirect, sendFile, download, sendBuffer,\n // raw send) never trigger it, so the slot would leak and the route would\n // permanently 429 after `max` such requests. Bind to the raw socket\n // lifecycle as well so the slot frees regardless of response path —\n // `releaseOnce` is idempotent, so double-firing is harmless.\n response.onSent((_sentResponse: Response) => releaseOnce());\n response.baseResponse.raw.once(\"finish\", releaseOnce);\n response.baseResponse.raw.once(\"close\", releaseOnce);\n };\n}\n"],"mappings":";;;;AAyBA,MAAM,2BAAW,IAAI,IAAoB;AAEzC,SAAS,QAAQ,KAAa;CAC5B,MAAM,SAAS,SAAS,IAAI,GAAG,KAAK,KAAK;CAEzC,IAAI,SAAS,GAAG;EACd,SAAS,OAAO,GAAG;EAEnB;CACF;CAEA,SAAS,IAAI,KAAK,KAAK;AACzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,2BACd,KACA,UAAmC,CAAC,GACxB;CACZ,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,QAAQ,eAAe,OAAO,KAAK,QAAQ,MAAM;EAC7D,MAAM,UAAU,SAAS,IAAI,GAAG,KAAK;EAErC,IAAI,WAAW,KAAK;GAClB,SAAS,OAAO,eAAe,CAAC;GAEhC,OAAO,SAAS,gBAAgB;IAC9B,OAAO,QAAQ,gBAAgB,EAAE,8BAA8B;IAC/D;IACA,OAAO;GACT,CAAC;EACH;EAEA,SAAS,IAAI,KAAK,UAAU,CAAC;EAE7B,IAAI,WAAW;EAEf,MAAM,oBAAoB;GACxB,IAAI,UACF;GAGF,WAAW;GACX,QAAQ,GAAG;EACb;EAQA,SAAS,QAAQ,kBAA4B,YAAY,CAAC;EAC1D,SAAS,aAAa,IAAI,KAAK,UAAU,WAAW;EACpD,SAAS,aAAa,IAAI,KAAK,SAAS,WAAW;CACrD;AACF"}

package/esm/http/middleware/idempotency.middleware.d.mts CHANGED Viewed

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/idempotency.middleware.d.ts
+//#region ../../packages/core/src/http/middleware/idempotency.middleware.d.ts
 /**
  * Options for the idempotency middleware.
  */

package/esm/http/middleware/idempotency.middleware.d.mts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"idempotency.middleware.d.mts","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/idempotency.middleware.ts"],"mappings":";;;;;KAYY,kBAAA;EAAkB;;;EAI5B,GAAA;EAKA;;;;EAAA,cAAA;EAgBM;AA+CR;;;EA1DE,UAAA;EA0D6C;;;;AAAoC;EApDjF,OAAA;;;;;EAKA,MAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Cc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}
1	+ {"version":3,"file":"idempotency.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/idempotency.middleware.ts"],"mappings":";;;;;KAYY,kBAAA;EAAkB;;;EAI5B,GAAA;EAKA;;;;EAAA,cAAA;EAgBM;AA+CR;;;EA1DE,UAAA;EA0D6C;;;;AAAoC;EApDjF,OAAA;;;;;EAKA,MAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Cc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}

package/esm/http/middleware/idempotency.middleware.mjs CHANGED Viewed

@@ -5,7 +5,7 @@ import config from "@mongez/config";
 import { log } from "@warlock.js/logger";
 import { cache } from "@warlock.js/cache";
-//#region ../core/src/http/middleware/idempotency.middleware.ts
+//#region ../../packages/core/src/http/middleware/idempotency.middleware.ts
 const DEFAULT_METHODS = [
 	"POST",
 	"PUT",

package/esm/http/middleware/idempotency.middleware.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"idempotency.middleware.mjs","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/idempotency.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\nimport { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from \"./utils/idempotency-key\";\n\n/*\n Options for the idempotency middleware.\n /\nexport type IdempotencyOptions = {\n /\n Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).\n /\n ttl?: number;\n /\n TTL in seconds of the in-flight reservation held while the handler runs.\n * Falls back to `http.idempotency.reservationTtl`, then `60`.\n /\n reservationTtl?: number;\n /\n Header name carrying the client's key. Falls back to\n * `http.idempotency.headerName`, then `\"Idempotency-Key\"`.\n /\n headerName?: string;\n /\n HTTP methods eligible for idempotency. Falls back to\n * `http.idempotency.methods`, then `[\"POST\",\"PUT\",\"PATCH\",\"DELETE\"]`.\n * Safe methods (GET/HEAD) are skipped regardless.\n /\n methods?: string[];\n /\n Cache driver name. Falls back to `http.idempotency.driver`, then the\n * default driver of the cache manager.\n /\n driver?: string;\n};\n\ntype CachedResponse = {\n status: number;\n body: unknown;\n bodyHash: string;\n contentType?: string;\n};\n\ntype InFlightReservation = {\n state: \"in-flight\";\n startedAt: number;\n};\n\nconst DEFAULT_METHODS = [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"];\n\n/\n Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,\n * same body, within TTL → cached replay; same key, different body → 422\n * `IdempotencyKeyConflict`.\n \n Must run after `authMiddleware` — the cache key is scoped per-user\n * (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.\n * Anonymous requests fall back to IP scope.\n \n The replay sets `Idempotent-Replay: true` on the response for easy\n * client-side / observability detection.\n \n Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through\n * even with the header set (RFC: safe methods are already idempotent).\n \n @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware } from \"@warlock.js/core\";\n \n router.post(\"/orders\", createOrderController, {\n * middleware: [authMiddleware(\"client\"), middleware.idempotency()],\n * });\n \n router.post(\"/ai/summarize\", summarizeController, {\n * middleware: [\n * authMiddleware(\"client\"),\n * middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries\n * ],\n * });\n */\nexport function idempotencyMiddleware(options: IdempotencyOptions = {}): Middleware {\n return async ({ request, response }) => {\n const headerName =\n options.headerName \|\| config.get(\"http.idempotency.headerName\", \"Idempotency-Key\");\n const methods = options.methods \|\| config.get(\"http.idempotency.methods\", DEFAULT_METHODS);\n const ttl = options.ttl \|\| config.get(\"http.idempotency.ttl\", 86400);\n const reservationTtl =\n options.reservationTtl \|\| config.get(\"http.idempotency.reservationTtl\", 60);\n const driverName = options.driver \|\| config.get(\"http.idempotency.driver\");\n\n if (!methods.includes(request.method.toUpperCase())) return;\n\n const idempotencyKey = request.header(headerName.toLowerCase());\n\n if (!idempotencyKey) return;\n\n if (!isValidIdempotencyKey(idempotencyKey)) {\n return response.badRequest({\n error: t(\"http.idempotencyKeyInvalid\"),\n errorCode: HttpErrorCodes.IdempotencyKeyInvalid,\n });\n }\n\n const cacheDriver = driverName ? await cache.use(driverName) : cache;\n const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);\n const bodyHash = hashBody(request.body);\n\n const respondToExisting = (existing: CachedResponse \| InFlightReservation \| undefined \| null) => {\n if (!existing \|\| (existing as InFlightReservation).state === \"in-flight\") {\n response.header(\"Retry-After\", \"1\");\n\n return response.conflict({\n error: \"A request with this Idempotency-Key is already in progress\",\n errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n });\n }\n\n const cached = existing as CachedResponse;\n\n if (cached.bodyHash !== bodyHash) {\n return response.unprocessableEntity({\n error: t(\"http.idempotencyKeyConflict\"),\n errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n });\n }\n\n response.header(\"Idempotent-Replay\", \"true\");\n\n return response.replay({\n status: cached.status,\n body: cached.body,\n contentType: cached.contentType,\n });\n };\n\n // Fast path: a finished (or in-flight) request is already recorded.\n let existing: CachedResponse \| InFlightReservation \| null = null;\n\n try {\n existing = (await cacheDriver.get(cacheKey)) as CachedResponse \| InFlightReservation \| null;\n } catch (error) {\n // The cache is an optimisation of idempotency, not a gate on writes:\n // when it is down, fail open (the handler runs) and log it.\n log.error(\"idempotency-middleware\", \"get\", error);\n }\n\n if (existing) return respondToExisting(existing);\n\n // Reserve the key atomically before the handler runs, so concurrent\n // requests with the same key can't both execute it.\n try {\n const reservation = (await cacheDriver.set(\n cacheKey,\n { state: \"in-flight\", startedAt: Date.now() } satisfies InFlightReservation,\n { onConflict: \"create\", ttl: reservationTtl },\n )) as { wasSet?: boolean; existing?: CachedResponse \| InFlightReservation } \| undefined;\n\n if (reservation && reservation.wasSet === false) {\n return respondToExisting(reservation.existing);\n }\n } catch (error) {\n log.error(\"idempotency-middleware\", \"reserve\", error);\n }\n\n response.onSent((sentResponse: Response) => {\n // Don't cache server errors — clients should be able to retry past a 5xx.\n // 4xx are deterministic outcomes of the request, so caching is fine.\n // Free the reservation so a retry can run.\n if (sentResponse.statusCode >= 500) {\n // Wrapped so a synchronous throw is caught as well as a rejection.\n Promise.resolve()\n .then(() => cacheDriver.remove(cacheKey))\n .catch((error: unknown) => {\n log.error(\"idempotency-middleware\", \"remove\", error);\n });\n\n return;\n }\n\n const sentContentType = sentResponse.contentType;\n\n // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n // write (e.g. Redis down) would surface as an unhandledRejection.\n cacheDriver\n .set(\n cacheKey,\n {\n status: sentResponse.statusCode,\n body: sentResponse.parsedBody,\n bodyHash,\n contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n },\n ttl,\n )\n .catch((error: unknown) => {\n log.error(\"idempotency-middleware\", \"set\", error);\n });\n });\n };\n}\n"],"mappings":";;;;;;;;AAoDA,MAAM,kBAAkB;CAAC;CAAQ;CAAO;CAAS;AAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCzD,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,aACJ,QAAQ,cAAc,OAAO,IAAI,+BAA+B,iBAAiB;EACnF,MAAM,UAAU,QAAQ,WAAW,OAAO,IAAI,4BAA4B,eAAe;EACzF,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAI,wBAAwB,KAAK;EACnE,MAAM,iBACJ,QAAQ,kBAAkB,OAAO,IAAI,mCAAmC,EAAE;EAC5E,MAAM,aAAa,QAAQ,UAAU,OAAO,IAAI,yBAAyB;EAEzE,IAAI,CAAC,QAAQ,SAAS,QAAQ,OAAO,YAAY,CAAC,GAAG;EAErD,MAAM,iBAAiB,QAAQ,OAAO,WAAW,YAAY,CAAC;EAE9D,IAAI,CAAC,gBAAgB;EAErB,IAAI,CAAC,sBAAsB,cAAc,GACvC,OAAO,SAAS,WAAW;GACzB,OAAO,EAAE,4BAA4B;GACrC;EACF,CAAC;EAGH,MAAM,cAAc,aAAa,MAAM,MAAM,IAAI,UAAU,IAAI;EAC/D,MAAM,WAAW,yBAAyB,SAAS,cAAc;EACjE,MAAM,WAAW,SAAS,QAAQ,IAAI;EAEtC,MAAM,qBAAqB,aAAsE;GAC/F,IAAI,CAAC,YAAa,SAAiC,UAAU,aAAa;IACxE,SAAS,OAAO,eAAe,GAAG;IAElC,OAAO,SAAS,SAAS;KACvB,OAAO;KACP;IACF,CAAC;GACH;GAEA,MAAM,SAAS;GAEf,IAAI,OAAO,aAAa,UACtB,OAAO,SAAS,oBAAoB;IAClC,OAAO,EAAE,6BAA6B;IACtC;GACF,CAAC;GAGH,SAAS,OAAO,qBAAqB,MAAM;GAE3C,OAAO,SAAS,OAAO;IACrB,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,aAAa,OAAO;GACtB,CAAC;EACH;EAGA,IAAI,WAAwD;EAE5D,IAAI;GACF,WAAY,MAAM,YAAY,IAAI,QAAQ;EAC5C,SAAS,OAAO;GAGd,IAAI,MAAM,0BAA0B,OAAO,KAAK;EAClD;EAEA,IAAI,UAAU,OAAO,kBAAkB,QAAQ;EAI/C,IAAI;GACF,MAAM,cAAe,MAAM,YAAY,IACrC,UACA;IAAE,OAAO;IAAa,WAAW,KAAK,IAAI;GAAE,GAC5C;IAAE,YAAY;IAAU,KAAK;GAAe,CAC9C;GAEA,IAAI,eAAe,YAAY,WAAW,OACxC,OAAO,kBAAkB,YAAY,QAAQ;EAEjD,SAAS,OAAO;GACd,IAAI,MAAM,0BAA0B,WAAW,KAAK;EACtD;EAEA,SAAS,QAAQ,iBAA2B;GAI1C,IAAI,aAAa,cAAc,KAAK;IAElC,QAAQ,QAAQ,CAAC,CACd,WAAW,YAAY,OAAO,QAAQ,CAAC,CAAC,CACxC,OAAO,UAAmB;KACzB,IAAI,MAAM,0BAA0B,UAAU,KAAK;IACrD,CAAC;IAEH;GACF;GAEA,MAAM,kBAAkB,aAAa;GAIrC,YACG,IACC,UACA;IACE,QAAQ,aAAa;IACrB,MAAM,aAAa;IACnB;IACA,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE,GACA,GACF,CAAC,CACA,OAAO,UAAmB;IACzB,IAAI,MAAM,0BAA0B,OAAO,KAAK;GAClD,CAAC;EACL,CAAC;CACH;AACF"}
1	+ {"version":3,"file":"idempotency.middleware.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/idempotency.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\nimport { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from \"./utils/idempotency-key\";\n\n/*\n Options for the idempotency middleware.\n /\nexport type IdempotencyOptions = {\n /\n Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).\n /\n ttl?: number;\n /\n TTL in seconds of the in-flight reservation held while the handler runs.\n * Falls back to `http.idempotency.reservationTtl`, then `60`.\n /\n reservationTtl?: number;\n /\n Header name carrying the client's key. Falls back to\n * `http.idempotency.headerName`, then `\"Idempotency-Key\"`.\n /\n headerName?: string;\n /\n HTTP methods eligible for idempotency. Falls back to\n * `http.idempotency.methods`, then `[\"POST\",\"PUT\",\"PATCH\",\"DELETE\"]`.\n * Safe methods (GET/HEAD) are skipped regardless.\n /\n methods?: string[];\n /\n Cache driver name. Falls back to `http.idempotency.driver`, then the\n * default driver of the cache manager.\n /\n driver?: string;\n};\n\ntype CachedResponse = {\n status: number;\n body: unknown;\n bodyHash: string;\n contentType?: string;\n};\n\ntype InFlightReservation = {\n state: \"in-flight\";\n startedAt: number;\n};\n\nconst DEFAULT_METHODS = [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"];\n\n/\n Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,\n * same body, within TTL → cached replay; same key, different body → 422\n * `IdempotencyKeyConflict`.\n \n Must run after `authMiddleware` — the cache key is scoped per-user\n * (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.\n * Anonymous requests fall back to IP scope.\n \n The replay sets `Idempotent-Replay: true` on the response for easy\n * client-side / observability detection.\n \n Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through\n * even with the header set (RFC: safe methods are already idempotent).\n \n @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware } from \"@warlock.js/core\";\n \n router.post(\"/orders\", createOrderController, {\n * middleware: [authMiddleware(\"client\"), middleware.idempotency()],\n * });\n \n router.post(\"/ai/summarize\", summarizeController, {\n * middleware: [\n * authMiddleware(\"client\"),\n * middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries\n * ],\n * });\n */\nexport function idempotencyMiddleware(options: IdempotencyOptions = {}): Middleware {\n return async ({ request, response }) => {\n const headerName =\n options.headerName \|\| config.get(\"http.idempotency.headerName\", \"Idempotency-Key\");\n const methods = options.methods \|\| config.get(\"http.idempotency.methods\", DEFAULT_METHODS);\n const ttl = options.ttl \|\| config.get(\"http.idempotency.ttl\", 86400);\n const reservationTtl =\n options.reservationTtl \|\| config.get(\"http.idempotency.reservationTtl\", 60);\n const driverName = options.driver \|\| config.get(\"http.idempotency.driver\");\n\n if (!methods.includes(request.method.toUpperCase())) return;\n\n const idempotencyKey = request.header(headerName.toLowerCase());\n\n if (!idempotencyKey) return;\n\n if (!isValidIdempotencyKey(idempotencyKey)) {\n return response.badRequest({\n error: t(\"http.idempotencyKeyInvalid\"),\n errorCode: HttpErrorCodes.IdempotencyKeyInvalid,\n });\n }\n\n const cacheDriver = driverName ? await cache.use(driverName) : cache;\n const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);\n const bodyHash = hashBody(request.body);\n\n const respondToExisting = (existing: CachedResponse \| InFlightReservation \| undefined \| null) => {\n if (!existing \|\| (existing as InFlightReservation).state === \"in-flight\") {\n response.header(\"Retry-After\", \"1\");\n\n return response.conflict({\n error: \"A request with this Idempotency-Key is already in progress\",\n errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n });\n }\n\n const cached = existing as CachedResponse;\n\n if (cached.bodyHash !== bodyHash) {\n return response.unprocessableEntity({\n error: t(\"http.idempotencyKeyConflict\"),\n errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n });\n }\n\n response.header(\"Idempotent-Replay\", \"true\");\n\n return response.replay({\n status: cached.status,\n body: cached.body,\n contentType: cached.contentType,\n });\n };\n\n // Fast path: a finished (or in-flight) request is already recorded.\n let existing: CachedResponse \| InFlightReservation \| null = null;\n\n try {\n existing = (await cacheDriver.get(cacheKey)) as CachedResponse \| InFlightReservation \| null;\n } catch (error) {\n // The cache is an optimisation of idempotency, not a gate on writes:\n // when it is down, fail open (the handler runs) and log it.\n log.error(\"idempotency-middleware\", \"get\", error);\n }\n\n if (existing) return respondToExisting(existing);\n\n // Reserve the key atomically before the handler runs, so concurrent\n // requests with the same key can't both execute it.\n try {\n const reservation = (await cacheDriver.set(\n cacheKey,\n { state: \"in-flight\", startedAt: Date.now() } satisfies InFlightReservation,\n { onConflict: \"create\", ttl: reservationTtl },\n )) as { wasSet?: boolean; existing?: CachedResponse \| InFlightReservation } \| undefined;\n\n if (reservation && reservation.wasSet === false) {\n return respondToExisting(reservation.existing);\n }\n } catch (error) {\n log.error(\"idempotency-middleware\", \"reserve\", error);\n }\n\n response.onSent((sentResponse: Response) => {\n // Don't cache server errors — clients should be able to retry past a 5xx.\n // 4xx are deterministic outcomes of the request, so caching is fine.\n // Free the reservation so a retry can run.\n if (sentResponse.statusCode >= 500) {\n // Wrapped so a synchronous throw is caught as well as a rejection.\n Promise.resolve()\n .then(() => cacheDriver.remove(cacheKey))\n .catch((error: unknown) => {\n log.error(\"idempotency-middleware\", \"remove\", error);\n });\n\n return;\n }\n\n const sentContentType = sentResponse.contentType;\n\n // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n // write (e.g. Redis down) would surface as an unhandledRejection.\n cacheDriver\n .set(\n cacheKey,\n {\n status: sentResponse.statusCode,\n body: sentResponse.parsedBody,\n bodyHash,\n contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n },\n ttl,\n )\n .catch((error: unknown) => {\n log.error(\"idempotency-middleware\", \"set\", error);\n });\n });\n };\n}\n"],"mappings":";;;;;;;;AAoDA,MAAM,kBAAkB;CAAC;CAAQ;CAAO;CAAS;AAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCzD,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,aACJ,QAAQ,cAAc,OAAO,IAAI,+BAA+B,iBAAiB;EACnF,MAAM,UAAU,QAAQ,WAAW,OAAO,IAAI,4BAA4B,eAAe;EACzF,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAI,wBAAwB,KAAK;EACnE,MAAM,iBACJ,QAAQ,kBAAkB,OAAO,IAAI,mCAAmC,EAAE;EAC5E,MAAM,aAAa,QAAQ,UAAU,OAAO,IAAI,yBAAyB;EAEzE,IAAI,CAAC,QAAQ,SAAS,QAAQ,OAAO,YAAY,CAAC,GAAG;EAErD,MAAM,iBAAiB,QAAQ,OAAO,WAAW,YAAY,CAAC;EAE9D,IAAI,CAAC,gBAAgB;EAErB,IAAI,CAAC,sBAAsB,cAAc,GACvC,OAAO,SAAS,WAAW;GACzB,OAAO,EAAE,4BAA4B;GACrC;EACF,CAAC;EAGH,MAAM,cAAc,aAAa,MAAM,MAAM,IAAI,UAAU,IAAI;EAC/D,MAAM,WAAW,yBAAyB,SAAS,cAAc;EACjE,MAAM,WAAW,SAAS,QAAQ,IAAI;EAEtC,MAAM,qBAAqB,aAAsE;GAC/F,IAAI,CAAC,YAAa,SAAiC,UAAU,aAAa;IACxE,SAAS,OAAO,eAAe,GAAG;IAElC,OAAO,SAAS,SAAS;KACvB,OAAO;KACP;IACF,CAAC;GACH;GAEA,MAAM,SAAS;GAEf,IAAI,OAAO,aAAa,UACtB,OAAO,SAAS,oBAAoB;IAClC,OAAO,EAAE,6BAA6B;IACtC;GACF,CAAC;GAGH,SAAS,OAAO,qBAAqB,MAAM;GAE3C,OAAO,SAAS,OAAO;IACrB,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,aAAa,OAAO;GACtB,CAAC;EACH;EAGA,IAAI,WAAwD;EAE5D,IAAI;GACF,WAAY,MAAM,YAAY,IAAI,QAAQ;EAC5C,SAAS,OAAO;GAGd,IAAI,MAAM,0BAA0B,OAAO,KAAK;EAClD;EAEA,IAAI,UAAU,OAAO,kBAAkB,QAAQ;EAI/C,IAAI;GACF,MAAM,cAAe,MAAM,YAAY,IACrC,UACA;IAAE,OAAO;IAAa,WAAW,KAAK,IAAI;GAAE,GAC5C;IAAE,YAAY;IAAU,KAAK;GAAe,CAC9C;GAEA,IAAI,eAAe,YAAY,WAAW,OACxC,OAAO,kBAAkB,YAAY,QAAQ;EAEjD,SAAS,OAAO;GACd,IAAI,MAAM,0BAA0B,WAAW,KAAK;EACtD;EAEA,SAAS,QAAQ,iBAA2B;GAI1C,IAAI,aAAa,cAAc,KAAK;IAElC,QAAQ,QAAQ,CAAC,CACd,WAAW,YAAY,OAAO,QAAQ,CAAC,CAAC,CACxC,OAAO,UAAmB;KACzB,IAAI,MAAM,0BAA0B,UAAU,KAAK;IACrD,CAAC;IAEH;GACF;GAEA,MAAM,kBAAkB,aAAa;GAIrC,YACG,IACC,UACA;IACE,QAAQ,aAAa;IACrB,MAAM,aAAa;IACnB;IACA,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE,GACA,GACF,CAAC,CACA,OAAO,UAAmB;IACzB,IAAI,MAAM,0BAA0B,OAAO,KAAK;GAClD,CAAC;EACL,CAAC;CACH;AACF"}

package/esm/http/middleware/inject-request-context.d.mts CHANGED Viewed

@@ -2,7 +2,7 @@ import { Response } from "../response.mjs";
 import { Request } from "../request.mjs";
 import { ReturnedResponse } from "../types.mjs";
-//#region ../core/src/http/middleware/inject-request-context.d.ts
+//#region ../../packages/core/src/http/middleware/inject-request-context.d.ts
 /**
  * Create request store and execute middleware + handler
  *

package/esm/http/middleware/inject-request-context.d.mts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;~~AA8CA~~;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;~~iBAqNK~~,CAAA,CAAE,OAAA,UAAiB,YAAA,GAAe,MAAM"}
1	+ {"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;AA+CA;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;iBAuNK,CAAA,CAAE,OAAA,UAAiB,YAAA,GAAe,MAAM"}

package/esm/http/middleware/inject-request-context.mjs CHANGED Viewed

@@ -4,6 +4,7 @@ import "../../utils/index.mjs";
 import { applyCspHeader } from "../csp.mjs";
 import { runDefaultCsrfGuard } from "../csrf-default-guard.mjs";
 import { HttpError } from "../errors/errors.mjs";
+import { mapRequestError } from "../error-mapper.mjs";
 import { buildTracingContext, dispatchPhase, isTracingEnabled } from "../tracing/tracing-dispatcher.mjs";
 import "../tracing/index.mjs";
 import config from "@mongez/config";
@@ -12,7 +13,7 @@ import { DatabaseWriterValidationError } from "@warlock.js/cascade";
 import { contextManager } from "@warlock.js/context";
 import { log } from "@warlock.js/logger";
-//#region ../core/src/http/middleware/inject-request-context.ts
+//#region ../../packages/core/src/http/middleware/inject-request-context.ts
 /**
 * Request Context Middleware
 *
@@ -68,7 +69,8 @@ function createRequestStore(request, response) {
 			request.log("Handler Executed Successfully", "success");
 			request.trigger("executedAction", request.route);
 			return output;
-		} catch (error) {
+		} catch (thrown) {
+			const error = mapRequestError(thrown, request);
 			logRequestError(error, request);
 			return handleRequestError(error, response, request);
 		}

package/esm/http/middleware/inject-request-context.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/*\n Request Context Middleware\n \n Creates a unified context for each request using the ContextManager.\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\n /\nimport { trans } from \"@mongez/localization\";\nimport { type GenericObject } from \"@mongez/reinforcements\";\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\nimport { contextManager } from \"@warlock.js/context\";\nimport { log } from \"@warlock.js/logger\";\nimport config from \"@mongez/config\";\nimport { environment } from \"../../utils\";\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\nimport { applyCspHeader } from \"../csp\";\nimport { runDefaultCsrfGuard } from \"../csrf-default-guard\";\nimport { HttpError } from \"../errors\";\nimport { type Request } from \"../request\";\nimport { type Response } from \"../response\";\nimport { buildTracingContext, dispatchPhase, isTracingEnabled } from \"../tracing\";\nimport { type ReturnedResponse } from \"./../types\";\n\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\n\n/\n Echo `request.id` back as a response header so the FE / proxies / log\n * aggregators can correlate by the same value the server logs against.\n \n Reads the header name from `http.requestId.header` (default `X-Request-Id`).\n * Skip when `http.requestId.enabled` is explicitly false.\n /\nfunction stampRequestIdHeader(request: Request, response: Response) {\n const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\n\n if (requestIdConfig.enabled === false) return;\n\n const headerName = requestIdConfig.header \|\| \"X-Request-Id\";\n\n response.header(headerName, request.id);\n}\n\n/\n Create request store and execute middleware + handler\n \n Runs all registered contexts together using ContextManager.\n /\nexport function createRequestStore(\n request: Request<any>,\n response: Response,\n): Promise<ReturnedResponse> {\n stampRequestIdHeader(request, response);\n\n // Stamped this early — before any middleware or handler runs — so the\n // header carries the SAME nonce the web layer later reads off\n // `request.nonce` for its `<script>` tags: `request.nonce` caches on first\n // read, and this is deliberately the first read. A no-op when the app\n // hasn't opted into `http.csp` (see `csp.ts`).\n applyCspHeader(request, response);\n\n // Build all context stores using the immutable API\n // Each context defines its own store initialization via buildStore()\n const httpContextStore = contextManager.buildStores({ request, response });\n\n // Run all contexts together!\n return contextManager.runAll(httpContextStore, async () => {\n try {\n // Default CSRF-Origin guard (SECURITY, card 8a752ab2) — the earliest\n // seam common to every request, BEFORE the route's own middleware\n // (`request.runMiddleware()` below) and before any app handler, so it\n // applies even to a route that never attaches\n // `authMiddleware(\"cookie:\")`. See `../csrf-default-guard.ts` for the\n // full scope rule and `{ csrf: false }` exemption.\n const csrfGuardResponse = await runDefaultCsrfGuard(request, response, t, (reason) => {\n log.error(\n \"http\",\n \"csrf-default-guard\",\n new Error(`Default CSRF Origin guard refused request: ${reason}`),\n );\n });\n\n if (csrfGuardResponse) {\n return csrfGuardResponse as ReturnedResponse;\n }\n\n // Run middleware chain\n const result = await request.runMiddleware();\n\n if (result) {\n return result as ReturnedResponse;\n }\n\n // Execute route handler\n request.trigger(\"executingAction\", request.route);\n\n const handler = request.getHandler();\n\n request.log(\"Executing Handler\", \"info\");\n\n const tracingEnabled = isTracingEnabled();\n const handlerStartedAt = tracingEnabled ? performance.now() : 0;\n\n const output = await handler({ request, response });\n\n if (tracingEnabled) {\n dispatchPhase(buildTracingContext(request), {\n name: \"handler\",\n durationMs: performance.now() - handlerStartedAt,\n });\n }\n\n request.log(\"Handler Executed Successfully\", \"success\");\n\n request.trigger(\"executedAction\", request.route);\n\n return output as ReturnedResponse;\n } catch (error) {\n logRequestError(error, request);\n return handleRequestError(error, response, request);\n }\n });\n}\n\n/*\n The HTTP status an error will be answered with, or `undefined` when it is not\n * one of the known HTTP-answerable shapes (those fall through to the opaque 500).\n \n Single source for `handleRequestError` and the request logger, so the rule\n * that decides the response status is the same rule that decides the log level.\n * @internal\n /\nfunction resolveRequestErrorStatus(error: unknown): number \| undefined {\n if (error instanceof HttpError) {\n return error.status;\n }\n\n if (error instanceof DatabaseWriterValidationError) {\n return config.get(\"http.modelValidationErrorStatus\", 500);\n }\n\n return undefined;\n}\n\n/\n Log a request error at the right severity. An error answered with a 4xx is an\n * expected client error (a thrown 404/409/422): one `warn` line, no stack.\n * Everything else (5xx, unknown errors) keeps the error-level entry with its stack.\n * @internal\n /\nfunction logRequestError(error: unknown, request: Request<any>) {\n const status = resolveRequestErrorStatus(error);\n\n if (status !== undefined && status < 500 && error instanceof Error) {\n request.log(`${error.name}: ${error.message} (${status})`, \"warn\");\n\n return;\n }\n\n request.log(error, \"error\");\n}\n\n/\n Unconditional floor for an unhandled request error (canon 8d3c13a8): route it\n * through the logger, and when no logger channel is configured (nothing would\n * record it) fall back to `console.error` so the only copy is never lost.\n * @internal\n /\nfunction reportUnhandledRequestError(error: unknown, request: Request<any>) {\n log.error(\"http\", \"unhandled-request-error\", error, { requestId: request.id });\n\n if (log.channels.length === 0) {\n console.error(`[http] unhandled-request-error (requestId: ${request.id})`, error);\n }\n}\n\n/\n Handle request errors\n * @internal\n /\nfunction handleRequestError(\n error: unknown,\n response: Response,\n request: Request<any>,\n): ReturnedResponse {\n // Availability floor, not a cache-policy nit: `handleRequestError` is the\n // single funnel every unhandled error in every Warlock app passes through\n // (`createRequestStore`'s catch above), and none of the branches below set\n // a `Cache-Control` header. Without this, an error response — a 500 as\n // much as a 401/403/404 carrying per-request/-user state — can be stored\n // by a shared cache or CDN and replayed to other requests/users long after\n // the condition that caused it is gone: a cached 500 becomes an outage\n // that outlives its cause; a cached 401/403 becomes a leak across users.\n // Set once, here, before any branch runs — not per branch — because the\n // branches below do not partition by status. `ResourceNotFoundError`,\n // `UnAuthorizedError`, `ForbiddenError`, `BadRequestError` and `ServerError`\n // all extend `HttpError`, so the `HttpError` branch answers for every one of\n // them, and a raw `HttpError` can carry any caller-chosen status, 4xx or 5xx.\n // Gating the floor on the eventual status would mean re-deriving that status\n // per branch — one rule meeting one form while others reach the same output.\n // Applying it once, unconditionally, is both simpler and safer.\n response.header(\"Cache-Control\", \"private, no-store\");\n\n if (error instanceof HttpError) {\n // 5xx HttpErrors (e.g. `ServerError`) are server faults: send them to the\n // logger channels too, tagged with the request id.\n if (error.status >= 500) {\n log.error(\"http\", \"request-error\", error, { requestId: request.id });\n }\n\n const payload: GenericObject = {\n error: error.message,\n };\n if (error.payload) {\n payload.payload = error.payload;\n }\n\n if (environment() === \"development\") {\n payload.stack = error.stack;\n }\n\n return response.setStatusCode(error.status).send(payload);\n }\n\n if (error instanceof DatabaseWriterValidationError) {\n const status = resolveRequestErrorStatus(error) as number;\n\n // A 4xx is an expected client error, already logged as a one-line warn by\n // `logRequestError`; only a 5xx gets the error-level entry with its stack.\n if (status >= 500) {\n log.error(\"http\", \"model-write-validation-error\", error, {\n requestId: request.id,\n errors: error.errors,\n });\n }\n\n // A 4xx status means the app treats this as the client's fault, so the\n // field errors are useful to it; a 5xx stays opaque.\n if (status < 500) {\n return response.setStatusCode(status).send({\n errors: error.errors,\n });\n }\n\n return response.setStatusCode(status).send({\n error: \"Internal server error.\",\n });\n }\n\n // Last resort: the error matched none of the known shapes above, so the\n // client gets a deliberately opaque message. Without this line the error\n // itself is discarded here — no stack, no message, nothing in any log — and\n // an unrecognised failure becomes indistinguishable from a working server\n // returning 500. Never swallow the only copy of an error (`65e476ee`).\n reportUnhandledRequestError(error, request);\n\n return response.serverError({\n error: \"Internal server error.\",\n });\n}\n\n/\n Translate a keyword (uses request context for locale)\n */\nexport function t(keyword: string, placeholders?: Record<string, unknown>): string {\n return (\n requestContextInstance.getRequest()?.trans(keyword, placeholders) \|\|\n trans(keyword, placeholders)\n );\n}\n\n// `fromRequest` was removed in v5. It cached computed values as dynamic\n// properties on the Request instance, which only compiled because of the\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\n// per-request lifetime, single-flight, and it never touches the Request object.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAOtC,eAAe,SAAS,QAAQ;CAIhC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAOF,MAAM,oBAAoB,MAAM,oBAAoB,SAAS,UAAU,IAAI,WAAW;IACpF,IAAI,MACF,QACA,sCACA,IAAI,MAAM,8CAA8C,QAAQ,CAClE;GACF,CAAC;GAED,IAAI,mBACF,OAAO;GAIT,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,iBAAiB,iBAAiB;GACxC,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,IAAI;GAE9D,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,IAAI,gBACF,cAAc,oBAAoB,OAAO,GAAG;IAC1C,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;GAClC,CAAC;GAGH,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAO;GACd,gBAAgB,OAAO,OAAO;GAC9B,OAAO,mBAAmB,OAAO,UAAU,OAAO;EACpD;CACF,CAAC;AACH;;;;;;;;;AAUA,SAAS,0BAA0B,OAAoC;CACrE,IAAI,iBAAiB,WACnB,OAAO,MAAM;CAGf,IAAI,iBAAiB,+BACnB,OAAO,OAAO,IAAI,mCAAmC,GAAG;AAI5D;;;;;;;AAQA,SAAS,gBAAgB,OAAgB,SAAuB;CAC9D,MAAM,SAAS,0BAA0B,KAAK;CAE9C,IAAI,WAAW,UAAa,SAAS,OAAO,iBAAiB,OAAO;EAClE,QAAQ,IAAI,GAAG,MAAM,KAAK,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,MAAM;EAEjE;CACF;CAEA,QAAQ,IAAI,OAAO,OAAO;AAC5B;;;;;;;AAQA,SAAS,4BAA4B,OAAgB,SAAuB;CAC1E,IAAI,MAAM,QAAQ,2BAA2B,OAAO,EAAE,WAAW,QAAQ,GAAG,CAAC;CAE7E,IAAI,IAAI,SAAS,WAAW,GAC1B,QAAQ,MAAM,8CAA8C,QAAQ,GAAG,IAAI,KAAK;AAEpF;;;;;AAMA,SAAS,mBACP,OACA,UACA,SACkB;CAiBlB,SAAS,OAAO,iBAAiB,mBAAmB;CAEpD,IAAI,iBAAiB,WAAW;EAG9B,IAAI,MAAM,UAAU,KAClB,IAAI,MAAM,QAAQ,iBAAiB,OAAO,EAAE,WAAW,QAAQ,GAAG,CAAC;EAGrE,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,+BAA+B;EAClD,MAAM,SAAS,0BAA0B,KAAK;EAI9C,IAAI,UAAU,KACZ,IAAI,MAAM,QAAQ,gCAAgC,OAAO;GACvD,WAAW,QAAQ;GACnB,QAAQ,MAAM;EAChB,CAAC;EAKH,IAAI,SAAS,KACX,OAAO,SAAS,cAAc,MAAM,CAAC,CAAC,KAAK,EACzC,QAAQ,MAAM,OAChB,CAAC;EAGH,OAAO,SAAS,cAAc,MAAM,CAAC,CAAC,KAAK,EACzC,OAAO,yBACT,CAAC;CACH;CAOA,4BAA4B,OAAO,OAAO;CAE1C,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAgD;CACjF,OACEA,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}
1	+ {"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../../packages/core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/*\n Request Context Middleware\n \n Creates a unified context for each request using the ContextManager.\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\n /\nimport { trans } from \"@mongez/localization\";\nimport { type GenericObject } from \"@mongez/reinforcements\";\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\nimport { contextManager } from \"@warlock.js/context\";\nimport { log } from \"@warlock.js/logger\";\nimport config from \"@mongez/config\";\nimport { environment } from \"../../utils\";\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\nimport { applyCspHeader } from \"../csp\";\nimport { runDefaultCsrfGuard } from \"../csrf-default-guard\";\nimport { mapRequestError } from \"../error-mapper\";\nimport { HttpError } from \"../errors\";\nimport { type Request } from \"../request\";\nimport { type Response } from \"../response\";\nimport { buildTracingContext, dispatchPhase, isTracingEnabled } from \"../tracing\";\nimport { type ReturnedResponse } from \"./../types\";\n\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\n\n/\n Echo `request.id` back as a response header so the FE / proxies / log\n * aggregators can correlate by the same value the server logs against.\n \n Reads the header name from `http.requestId.header` (default `X-Request-Id`).\n * Skip when `http.requestId.enabled` is explicitly false.\n /\nfunction stampRequestIdHeader(request: Request, response: Response) {\n const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\n\n if (requestIdConfig.enabled === false) return;\n\n const headerName = requestIdConfig.header \|\| \"X-Request-Id\";\n\n response.header(headerName, request.id);\n}\n\n/\n Create request store and execute middleware + handler\n \n Runs all registered contexts together using ContextManager.\n /\nexport function createRequestStore(\n request: Request<any>,\n response: Response,\n): Promise<ReturnedResponse> {\n stampRequestIdHeader(request, response);\n\n // Stamped this early — before any middleware or handler runs — so the\n // header carries the SAME nonce the web layer later reads off\n // `request.nonce` for its `<script>` tags: `request.nonce` caches on first\n // read, and this is deliberately the first read. A no-op when the app\n // hasn't opted into `http.csp` (see `csp.ts`).\n applyCspHeader(request, response);\n\n // Build all context stores using the immutable API\n // Each context defines its own store initialization via buildStore()\n const httpContextStore = contextManager.buildStores({ request, response });\n\n // Run all contexts together!\n return contextManager.runAll(httpContextStore, async () => {\n try {\n // Default CSRF-Origin guard (SECURITY, card 8a752ab2) — the earliest\n // seam common to every request, BEFORE the route's own middleware\n // (`request.runMiddleware()` below) and before any app handler, so it\n // applies even to a route that never attaches\n // `authMiddleware(\"cookie:\")`. See `../csrf-default-guard.ts` for the\n // full scope rule and `{ csrf: false }` exemption.\n const csrfGuardResponse = await runDefaultCsrfGuard(request, response, t, (reason) => {\n log.error(\n \"http\",\n \"csrf-default-guard\",\n new Error(`Default CSRF Origin guard refused request: ${reason}`),\n );\n });\n\n if (csrfGuardResponse) {\n return csrfGuardResponse as ReturnedResponse;\n }\n\n // Run middleware chain\n const result = await request.runMiddleware();\n\n if (result) {\n return result as ReturnedResponse;\n }\n\n // Execute route handler\n request.trigger(\"executingAction\", request.route);\n\n const handler = request.getHandler();\n\n request.log(\"Executing Handler\", \"info\");\n\n const tracingEnabled = isTracingEnabled();\n const handlerStartedAt = tracingEnabled ? performance.now() : 0;\n\n const output = await handler({ request, response });\n\n if (tracingEnabled) {\n dispatchPhase(buildTracingContext(request), {\n name: \"handler\",\n durationMs: performance.now() - handlerStartedAt,\n });\n }\n\n request.log(\"Handler Executed Successfully\", \"success\");\n\n request.trigger(\"executedAction\", request.route);\n\n return output as ReturnedResponse;\n } catch (thrown) {\n const error = mapRequestError(thrown, request);\n\n logRequestError(error, request);\n return handleRequestError(error, response, request);\n }\n });\n}\n\n/*\n The HTTP status an error will be answered with, or `undefined` when it is not\n * one of the known HTTP-answerable shapes (those fall through to the opaque 500).\n \n Single source for `handleRequestError` and the request logger, so the rule\n * that decides the response status is the same rule that decides the log level.\n * @internal\n /\nfunction resolveRequestErrorStatus(error: unknown): number \| undefined {\n if (error instanceof HttpError) {\n return error.status;\n }\n\n if (error instanceof DatabaseWriterValidationError) {\n return config.get(\"http.modelValidationErrorStatus\", 500);\n }\n\n return undefined;\n}\n\n/\n Log a request error at the right severity. An error answered with a 4xx is an\n * expected client error (a thrown 404/409/422): one `warn` line, no stack.\n * Everything else (5xx, unknown errors) keeps the error-level entry with its stack.\n * @internal\n /\nfunction logRequestError(error: unknown, request: Request<any>) {\n const status = resolveRequestErrorStatus(error);\n\n if (status !== undefined && status < 500 && error instanceof Error) {\n request.log(`${error.name}: ${error.message} (${status})`, \"warn\");\n\n return;\n }\n\n request.log(error, \"error\");\n}\n\n/\n Unconditional floor for an unhandled request error (canon 8d3c13a8): route it\n * through the logger, and when no logger channel is configured (nothing would\n * record it) fall back to `console.error` so the only copy is never lost.\n * @internal\n /\nfunction reportUnhandledRequestError(error: unknown, request: Request<any>) {\n log.error(\"http\", \"unhandled-request-error\", error, { requestId: request.id });\n\n if (log.channels.length === 0) {\n console.error(`[http] unhandled-request-error (requestId: ${request.id})`, error);\n }\n}\n\n/\n Handle request errors\n * @internal\n /\nfunction handleRequestError(\n error: unknown,\n response: Response,\n request: Request<any>,\n): ReturnedResponse {\n // Availability floor, not a cache-policy nit: `handleRequestError` is the\n // single funnel every unhandled error in every Warlock app passes through\n // (`createRequestStore`'s catch above), and none of the branches below set\n // a `Cache-Control` header. Without this, an error response — a 500 as\n // much as a 401/403/404 carrying per-request/-user state — can be stored\n // by a shared cache or CDN and replayed to other requests/users long after\n // the condition that caused it is gone: a cached 500 becomes an outage\n // that outlives its cause; a cached 401/403 becomes a leak across users.\n // Set once, here, before any branch runs — not per branch — because the\n // branches below do not partition by status. `ResourceNotFoundError`,\n // `UnAuthorizedError`, `ForbiddenError`, `BadRequestError` and `ServerError`\n // all extend `HttpError`, so the `HttpError` branch answers for every one of\n // them, and a raw `HttpError` can carry any caller-chosen status, 4xx or 5xx.\n // Gating the floor on the eventual status would mean re-deriving that status\n // per branch — one rule meeting one form while others reach the same output.\n // Applying it once, unconditionally, is both simpler and safer.\n response.header(\"Cache-Control\", \"private, no-store\");\n\n if (error instanceof HttpError) {\n // 5xx HttpErrors (e.g. `ServerError`) are server faults: send them to the\n // logger channels too, tagged with the request id.\n if (error.status >= 500) {\n log.error(\"http\", \"request-error\", error, { requestId: request.id });\n }\n\n const payload: GenericObject = {\n error: error.message,\n };\n if (error.payload) {\n payload.payload = error.payload;\n }\n\n if (environment() === \"development\") {\n payload.stack = error.stack;\n }\n\n return response.setStatusCode(error.status).send(payload);\n }\n\n if (error instanceof DatabaseWriterValidationError) {\n const status = resolveRequestErrorStatus(error) as number;\n\n // A 4xx is an expected client error, already logged as a one-line warn by\n // `logRequestError`; only a 5xx gets the error-level entry with its stack.\n if (status >= 500) {\n log.error(\"http\", \"model-write-validation-error\", error, {\n requestId: request.id,\n errors: error.errors,\n });\n }\n\n // A 4xx status means the app treats this as the client's fault, so the\n // field errors are useful to it; a 5xx stays opaque.\n if (status < 500) {\n return response.setStatusCode(status).send({\n errors: error.errors,\n });\n }\n\n return response.setStatusCode(status).send({\n error: \"Internal server error.\",\n });\n }\n\n // Last resort: the error matched none of the known shapes above, so the\n // client gets a deliberately opaque message. Without this line the error\n // itself is discarded here — no stack, no message, nothing in any log — and\n // an unrecognised failure becomes indistinguishable from a working server\n // returning 500. Never swallow the only copy of an error (`65e476ee`).\n reportUnhandledRequestError(error, request);\n\n return response.serverError({\n error: \"Internal server error.\",\n });\n}\n\n/\n Translate a keyword (uses request context for locale)\n */\nexport function t(keyword: string, placeholders?: Record<string, unknown>): string {\n return (\n requestContextInstance.getRequest()?.trans(keyword, placeholders) \|\|\n trans(keyword, placeholders)\n );\n}\n\n// `fromRequest` was removed in v5. It cached computed values as dynamic\n// properties on the Request instance, which only compiled because of the\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\n// per-request lifetime, single-flight, and it never touches the Request object.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAOtC,eAAe,SAAS,QAAQ;CAIhC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAOF,MAAM,oBAAoB,MAAM,oBAAoB,SAAS,UAAU,IAAI,WAAW;IACpF,IAAI,MACF,QACA,sCACA,IAAI,MAAM,8CAA8C,QAAQ,CAClE;GACF,CAAC;GAED,IAAI,mBACF,OAAO;GAIT,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,iBAAiB,iBAAiB;GACxC,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,IAAI;GAE9D,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,IAAI,gBACF,cAAc,oBAAoB,OAAO,GAAG;IAC1C,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;GAClC,CAAC;GAGH,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,QAAQ;GACf,MAAM,QAAQ,gBAAgB,QAAQ,OAAO;GAE7C,gBAAgB,OAAO,OAAO;GAC9B,OAAO,mBAAmB,OAAO,UAAU,OAAO;EACpD;CACF,CAAC;AACH;;;;;;;;;AAUA,SAAS,0BAA0B,OAAoC;CACrE,IAAI,iBAAiB,WACnB,OAAO,MAAM;CAGf,IAAI,iBAAiB,+BACnB,OAAO,OAAO,IAAI,mCAAmC,GAAG;AAI5D;;;;;;;AAQA,SAAS,gBAAgB,OAAgB,SAAuB;CAC9D,MAAM,SAAS,0BAA0B,KAAK;CAE9C,IAAI,WAAW,UAAa,SAAS,OAAO,iBAAiB,OAAO;EAClE,QAAQ,IAAI,GAAG,MAAM,KAAK,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,MAAM;EAEjE;CACF;CAEA,QAAQ,IAAI,OAAO,OAAO;AAC5B;;;;;;;AAQA,SAAS,4BAA4B,OAAgB,SAAuB;CAC1E,IAAI,MAAM,QAAQ,2BAA2B,OAAO,EAAE,WAAW,QAAQ,GAAG,CAAC;CAE7E,IAAI,IAAI,SAAS,WAAW,GAC1B,QAAQ,MAAM,8CAA8C,QAAQ,GAAG,IAAI,KAAK;AAEpF;;;;;AAMA,SAAS,mBACP,OACA,UACA,SACkB;CAiBlB,SAAS,OAAO,iBAAiB,mBAAmB;CAEpD,IAAI,iBAAiB,WAAW;EAG9B,IAAI,MAAM,UAAU,KAClB,IAAI,MAAM,QAAQ,iBAAiB,OAAO,EAAE,WAAW,QAAQ,GAAG,CAAC;EAGrE,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,+BAA+B;EAClD,MAAM,SAAS,0BAA0B,KAAK;EAI9C,IAAI,UAAU,KACZ,IAAI,MAAM,QAAQ,gCAAgC,OAAO;GACvD,WAAW,QAAQ;GACnB,QAAQ,MAAM;EAChB,CAAC;EAKH,IAAI,SAAS,KACX,OAAO,SAAS,cAAc,MAAM,CAAC,CAAC,KAAK,EACzC,QAAQ,MAAM,OAChB,CAAC;EAGH,OAAO,SAAS,cAAc,MAAM,CAAC,CAAC,KAAK,EACzC,OAAO,yBACT,CAAC;CACH;CAOA,4BAA4B,OAAO,OAAO;CAE1C,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAgD;CACjF,OACEA,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}

package/esm/http/middleware/ip-filter.middleware.d.mts CHANGED Viewed

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/ip-filter.middleware.d.ts
+//#region ../../packages/core/src/http/middleware/ip-filter.middleware.d.ts
 /**
  * Options for the IP filter middleware. Use at least one of `allow` / `deny`.
  *

package/esm/http/middleware/ip-filter.middleware.d.mts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ip-filter.middleware.d.mts","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/ip-filter.middleware.ts"],"mappings":";;;;;AAUA;;KAAY,eAAA;EAAe;;;;EAKzB,KAAA;EASY;AA+Bd;;;EAnCE,IAAA;EAmC0C;;;EA/B1C,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Bc,kBAAA,CAAmB,OAAA,EAAS,eAAA,GAAkB,UAAU"}
1	+ {"version":3,"file":"ip-filter.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/ip-filter.middleware.ts"],"mappings":";;;;;AAUA;;KAAY,eAAA;EAAe;;;;EAKzB,KAAA;EASY;AA+Bd;;;EAnCE,IAAA;EAmC0C;;;EA/B1C,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Bc,kBAAA,CAAmB,OAAA,EAAS,eAAA,GAAkB,UAAU"}

package/esm/http/middleware/ip-filter.middleware.mjs CHANGED Viewed

@@ -2,7 +2,7 @@ import { HttpErrorCodes } from "../error-codes.mjs";
 import { t } from "./inject-request-context.mjs";
 import { anyMatch } from "./utils/cidr-match.mjs";
-//#region ../core/src/http/middleware/ip-filter.middleware.ts
+//#region ../../packages/core/src/http/middleware/ip-filter.middleware.ts
 /**
 * Allow / deny requests by client IP. Fail-closed: if the IP can't be read,
 * the request is rejected with 403.

package/esm/http/middleware/ip-filter.middleware.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ip-filter.middleware.mjs","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/ip-filter.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { anyMatch } from \"./utils/cidr-match\";\n\n/*\n Options for the IP filter middleware. Use at least one of `allow` / `deny`.\n \n Precedence: `deny` wins. If a request matches both lists it is denied.\n /\nexport type IpFilterOptions = {\n /\n Allowlist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. When present,\n * only IPs matching the list pass through.\n /\n allow?: string[];\n /\n Denylist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. Matched IPs\n * are rejected regardless of the allowlist.\n /\n deny?: string[];\n /\n Override the default error message.\n /\n errorMessage?: string;\n};\n\n/\n Allow / deny requests by client IP. Fail-closed: if the IP can't be read,\n * the request is rejected with 403.\n \n Reads the client IP via `request.detectIp()`, which honors the forwarding\n * headers only when `http.trustProxy` is set — otherwise the socket peer\n * address is used, since both headers are client-settable. When opting in,\n * prefer a bounded `http.trustProxy` (a CIDR list of your proxies)\n * over `true`: with `true`, any client that can reach the process directly\n * picks its own IP and this allowlist is decorative.\n \n @example\n * import { middleware } from \"@warlock.js/core\";\n \n router.group(\n * {\n * prefix: \"/admin\",\n * middleware: [middleware.ipFilter({ allow: [\"10.0.0.0/8\", \"203.0.113.42\"] })],\n * },\n * () => {\n * router.get(\"/dashboard\", dashboardController);\n * },\n * );\n \n router.post(\"/webhooks/provider\", webhookController, {\n * middleware: [middleware.ipFilter({ allow: [\"198.51.100.0/24\"] })],\n * });\n */\nexport function ipFilterMiddleware(options: IpFilterOptions): Middleware {\n return ({ request, response }) => {\n const ip = request.detectIp();\n\n if (!ip \|\| typeof ip !== \"string\") {\n return response.forbidden({\n error: options.errorMessage \|\| t(\"http.ipForbidden\"),\n errorCode: HttpErrorCodes.IpForbidden,\n });\n }\n\n if (options.deny && anyMatch(ip, options.deny)) {\n return response.forbidden({\n error: options.errorMessage \|\| t(\"http.ipForbidden\"),\n errorCode: HttpErrorCodes.IpForbidden,\n });\n }\n\n if (options.allow && !anyMatch(ip, options.allow)) {\n return response.forbidden({\n error: options.errorMessage \|\| t(\"http.ipForbidden\"),\n errorCode: HttpErrorCodes.IpForbidden,\n });\n }\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,mBAAmB,SAAsC;CACvE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,CAAC,MAAM,OAAO,OAAO,UACvB,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,QAAQ,SAAS,IAAI,QAAQ,IAAI,GAC3C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,SAAS,CAAC,SAAS,IAAI,QAAQ,KAAK,GAC9C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CAEL;AACF"}
1	+ {"version":3,"file":"ip-filter.middleware.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/ip-filter.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { anyMatch } from \"./utils/cidr-match\";\n\n/*\n Options for the IP filter middleware. Use at least one of `allow` / `deny`.\n \n Precedence: `deny` wins. If a request matches both lists it is denied.\n /\nexport type IpFilterOptions = {\n /\n Allowlist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. When present,\n * only IPs matching the list pass through.\n /\n allow?: string[];\n /\n Denylist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. Matched IPs\n * are rejected regardless of the allowlist.\n /\n deny?: string[];\n /\n Override the default error message.\n /\n errorMessage?: string;\n};\n\n/\n Allow / deny requests by client IP. Fail-closed: if the IP can't be read,\n * the request is rejected with 403.\n \n Reads the client IP via `request.detectIp()`, which honors the forwarding\n * headers only when `http.trustProxy` is set — otherwise the socket peer\n * address is used, since both headers are client-settable. When opting in,\n * prefer a bounded `http.trustProxy` (a CIDR list of your proxies)\n * over `true`: with `true`, any client that can reach the process directly\n * picks its own IP and this allowlist is decorative.\n \n @example\n * import { middleware } from \"@warlock.js/core\";\n \n router.group(\n * {\n * prefix: \"/admin\",\n * middleware: [middleware.ipFilter({ allow: [\"10.0.0.0/8\", \"203.0.113.42\"] })],\n * },\n * () => {\n * router.get(\"/dashboard\", dashboardController);\n * },\n * );\n \n router.post(\"/webhooks/provider\", webhookController, {\n * middleware: [middleware.ipFilter({ allow: [\"198.51.100.0/24\"] })],\n * });\n */\nexport function ipFilterMiddleware(options: IpFilterOptions): Middleware {\n return ({ request, response }) => {\n const ip = request.detectIp();\n\n if (!ip \|\| typeof ip !== \"string\") {\n return response.forbidden({\n error: options.errorMessage \|\| t(\"http.ipForbidden\"),\n errorCode: HttpErrorCodes.IpForbidden,\n });\n }\n\n if (options.deny && anyMatch(ip, options.deny)) {\n return response.forbidden({\n error: options.errorMessage \|\| t(\"http.ipForbidden\"),\n errorCode: HttpErrorCodes.IpForbidden,\n });\n }\n\n if (options.allow && !anyMatch(ip, options.allow)) {\n return response.forbidden({\n error: options.errorMessage \|\| t(\"http.ipForbidden\"),\n errorCode: HttpErrorCodes.IpForbidden,\n });\n }\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,mBAAmB,SAAsC;CACvE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,CAAC,MAAM,OAAO,OAAO,UACvB,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,QAAQ,SAAS,IAAI,QAAQ,IAAI,GAC3C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,SAAS,CAAC,SAAS,IAAI,QAAQ,KAAK,GAC9C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CAEL;AACF"}

package/esm/http/middleware/maintenance.middleware.d.mts CHANGED Viewed

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/maintenance.middleware.d.ts
+//#region ../../packages/core/src/http/middleware/maintenance.middleware.d.ts
 /**
  * Options for the maintenance middleware.
  */

package/esm/http/middleware/maintenance.middleware.d.mts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"maintenance.middleware.d.mts","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/maintenance.middleware.ts"],"mappings":";;;;;KAQY,kBAAA;EAAkB;;;;;;;AAkBhB;EATZ,SAAA;EA0CmC;;;;EArCnC,UAAA;EAqCuE;;AAAU;EAjCjF,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;iBAiCc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}
1	+ {"version":3,"file":"maintenance.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/maintenance.middleware.ts"],"mappings":";;;;;KAQY,kBAAA;EAAkB;;;;;;;AAkBhB;EATZ,SAAA;EA0CmC;;;;EArCnC,UAAA;EAqCuE;;AAAU;EAjCjF,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;iBAiCc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}

package/esm/http/middleware/maintenance.middleware.mjs CHANGED Viewed

@@ -2,7 +2,7 @@ import { HttpErrorCodes } from "../error-codes.mjs";
 import { t } from "./inject-request-context.mjs";
 import config from "@mongez/config";
-//#region ../core/src/http/middleware/maintenance.middleware.ts
+//#region ../../packages/core/src/http/middleware/maintenance.middleware.ts
 function isAllowlisted(path, patterns) {
 	return patterns.some((pattern) => {
 		if (pattern.endsWith("*")) return path.startsWith(pattern.slice(0, -1));

package/esm/http/middleware/maintenance.middleware.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/*\n Options for the maintenance middleware.\n /\nexport type MaintenanceOptions = {\n /\n Path prefixes (ending in ``) or exact paths to bypass even when\n maintenance is on. Falls back to `http.maintenance.allowlist`, then\n * `[\"/health\"]`.\n \n @example\n * allowlist: [\"/health\", \"/admin/\", \"/webhooks/stripe\"]\n /\n allowlist?: string[];\n /*\n Seconds advertised in the `Retry-After` header. Falls back to\n * `http.maintenance.retryAfter`, then `60`.\n /\n retryAfter?: number;\n /\n Override the default error message.\n /\n errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n return patterns.some((pattern) => {\n if (pattern.endsWith(\"\")) {\n return path.startsWith(pattern.slice(0, -1));\n }\n\n return path === pattern;\n });\n}\n\n/*\n Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n \n Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n \n @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n \n export default {\n * maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n * middleware: {\n * all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/\"] })],\n },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n return ({ request, response }) => {\n const enabled = config.get(\"http.maintenance.enabled\", false);\n\n if (!enabled) return;\n\n const allowlist = options.allowlist \|\| config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n // `request.path` includes the query string, but allowlist entries are\n // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n const pathname = request.path.split(\"?\")[0] ?? \"/\";\n\n if (isAllowlisted(pathname, allowlist)) return;\n\n const retryAfter = options.retryAfter \|\| config.get(\"http.maintenance.retryAfter\", 60);\n\n response.header(\"Retry-After\", retryAfter);\n\n return response.serviceUnavailable({\n error: options.errorMessage \|\| t(\"http.maintenance\"),\n errorCode: HttpErrorCodes.Maintenance,\n });\n };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,EAAE,SAAS,eAAe;EAGhC,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YAAY,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAO3F,IAAI,cAFa,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,KAEnB,SAAS,GAAG;EAExC,MAAM,aAAa,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAErF,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}
1	+ {"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/*\n Options for the maintenance middleware.\n /\nexport type MaintenanceOptions = {\n /\n Path prefixes (ending in ``) or exact paths to bypass even when\n maintenance is on. Falls back to `http.maintenance.allowlist`, then\n * `[\"/health\"]`.\n \n @example\n * allowlist: [\"/health\", \"/admin/\", \"/webhooks/stripe\"]\n /\n allowlist?: string[];\n /*\n Seconds advertised in the `Retry-After` header. Falls back to\n * `http.maintenance.retryAfter`, then `60`.\n /\n retryAfter?: number;\n /\n Override the default error message.\n /\n errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n return patterns.some((pattern) => {\n if (pattern.endsWith(\"\")) {\n return path.startsWith(pattern.slice(0, -1));\n }\n\n return path === pattern;\n });\n}\n\n/*\n Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n \n Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n \n @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n \n export default {\n * maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n * middleware: {\n * all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/\"] })],\n },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n return ({ request, response }) => {\n const enabled = config.get(\"http.maintenance.enabled\", false);\n\n if (!enabled) return;\n\n const allowlist = options.allowlist \|\| config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n // `request.path` includes the query string, but allowlist entries are\n // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n const pathname = request.path.split(\"?\")[0] ?? \"/\";\n\n if (isAllowlisted(pathname, allowlist)) return;\n\n const retryAfter = options.retryAfter \|\| config.get(\"http.maintenance.retryAfter\", 60);\n\n response.header(\"Retry-After\", retryAfter);\n\n return response.serviceUnavailable({\n error: options.errorMessage \|\| t(\"http.maintenance\"),\n errorCode: HttpErrorCodes.Maintenance,\n });\n };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,EAAE,SAAS,eAAe;EAGhC,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YAAY,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAO3F,IAAI,cAFa,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,KAEnB,SAAS,GAAG;EAExC,MAAM,aAAa,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAErF,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}

package/esm/http/middleware/max-body-size.middleware.d.mts CHANGED Viewed

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/max-body-size.middleware.d.ts
+//#region ../../packages/core/src/http/middleware/max-body-size.middleware.d.ts
 /**
  * Reject requests whose `Content-Length` exceeds the configured cap.
  *

package/esm/http/middleware/max-body-size.middleware.d.mts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"max-body-size.middleware.d.mts","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/max-body-size.middleware.ts"],"mappings":";;;;;AAiCA;;;;AAAyE;;;;;;;;;;;;;;;;;;;;;iBAAzD,qBAAA,CAAsB,KAAA,oBAAyB,UAAU"}
1	+ {"version":3,"file":"max-body-size.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/max-body-size.middleware.ts"],"mappings":";;;;;AAiCA;;;;AAAyE;;;;;;;;;;;;;;;;;;;;;iBAAzD,qBAAA,CAAsB,KAAA,oBAAyB,UAAU"}

package/esm/http/middleware/max-body-size.middleware.mjs CHANGED Viewed

@@ -2,7 +2,7 @@ import { HttpErrorCodes } from "../error-codes.mjs";
 import { t } from "./inject-request-context.mjs";
 import { parseSize } from "./utils/parse-size.mjs";
-//#region ../core/src/http/middleware/max-body-size.middleware.ts
+//#region ../../packages/core/src/http/middleware/max-body-size.middleware.ts
 /**
 * Reject requests whose `Content-Length` exceeds the configured cap.
 *

package/esm/http/middleware/max-body-size.middleware.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"max-body-size.middleware.mjs","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/max-body-size.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { parseSize } from \"./utils/parse-size\";\n\n/*\n Reject requests whose `Content-Length` exceeds the configured cap.\n \n ⚠️ This runs AFTER the body has been parsed, not before it. Framework\n * middleware executes inside the Fastify route handler, and `@fastify/multipart`\n * is registered with `attachFieldsToBody: true` — so by the time this sees the\n * request, the bytes are already resident. It inspects `Content-Length` and\n * answers 413; it does not and cannot prevent the read.\n \n So this is not a resource-exhaustion control. For that, lower\n * `http.bodyLimit`, or set `bodyLimit` in the route's own `serverOptions` —\n * Fastify enforces those while reading. This middleware is a per-route\n * convenience for returning a consistent 413, not a replacement for either.\n \n The same caveat applies to `concurrencyLimit`: it bounds how many requests\n * run at once, not how many bytes are resident.\n \n @example\n * import { middleware } from \"@warlock.js/core\";\n \n router.post(\"/comments\", createCommentController, {\n * middleware: [middleware.maxBodySize(\"8kb\")],\n * });\n \n router.post(\"/uploads\", uploadController, {\n * middleware: [middleware.maxBodySize(\"10mb\")],\n * });\n */\nexport function maxBodySizeMiddleware(limit: string \| number): Middleware {\n const limitBytes = parseSize(limit);\n\n return ({ request, response }) => {\n const contentLengthHeader = request.header(\"content-length\");\n\n if (!contentLengthHeader) return;\n\n const contentLength = Number(contentLengthHeader);\n\n if (!Number.isFinite(contentLength)) return;\n\n if (contentLength <= limitBytes) return;\n\n response.header(\"Connection\", \"close\");\n\n return response.contentTooLarge({\n error: t(\"http.bodyTooLarge\"),\n errorCode: HttpErrorCodes.BodyTooLarge,\n limit: limitBytes,\n received: contentLength,\n });\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,sBAAsB,OAAoC;CACxE,MAAM,aAAa,UAAU,KAAK;CAElC,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,sBAAsB,QAAQ,OAAO,gBAAgB;EAE3D,IAAI,CAAC,qBAAqB;EAE1B,MAAM,gBAAgB,OAAO,mBAAmB;EAEhD,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;EAErC,IAAI,iBAAiB,YAAY;EAEjC,SAAS,OAAO,cAAc,OAAO;EAErC,OAAO,SAAS,gBAAgB;GAC9B,OAAO,EAAE,mBAAmB;GAC5B;GACA,OAAO;GACP,UAAU;EACZ,CAAC;CACH;AACF"}
1	+ {"version":3,"file":"max-body-size.middleware.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/max-body-size.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { parseSize } from \"./utils/parse-size\";\n\n/*\n Reject requests whose `Content-Length` exceeds the configured cap.\n \n ⚠️ This runs AFTER the body has been parsed, not before it. Framework\n * middleware executes inside the Fastify route handler, and `@fastify/multipart`\n * is registered with `attachFieldsToBody: true` — so by the time this sees the\n * request, the bytes are already resident. It inspects `Content-Length` and\n * answers 413; it does not and cannot prevent the read.\n \n So this is not a resource-exhaustion control. For that, lower\n * `http.bodyLimit`, or set `bodyLimit` in the route's own `serverOptions` —\n * Fastify enforces those while reading. This middleware is a per-route\n * convenience for returning a consistent 413, not a replacement for either.\n \n The same caveat applies to `concurrencyLimit`: it bounds how many requests\n * run at once, not how many bytes are resident.\n \n @example\n * import { middleware } from \"@warlock.js/core\";\n \n router.post(\"/comments\", createCommentController, {\n * middleware: [middleware.maxBodySize(\"8kb\")],\n * });\n \n router.post(\"/uploads\", uploadController, {\n * middleware: [middleware.maxBodySize(\"10mb\")],\n * });\n */\nexport function maxBodySizeMiddleware(limit: string \| number): Middleware {\n const limitBytes = parseSize(limit);\n\n return ({ request, response }) => {\n const contentLengthHeader = request.header(\"content-length\");\n\n if (!contentLengthHeader) return;\n\n const contentLength = Number(contentLengthHeader);\n\n if (!Number.isFinite(contentLength)) return;\n\n if (contentLength <= limitBytes) return;\n\n response.header(\"Connection\", \"close\");\n\n return response.contentTooLarge({\n error: t(\"http.bodyTooLarge\"),\n errorCode: HttpErrorCodes.BodyTooLarge,\n limit: limitBytes,\n received: contentLength,\n });\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,sBAAsB,OAAoC;CACxE,MAAM,aAAa,UAAU,KAAK;CAElC,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,sBAAsB,QAAQ,OAAO,gBAAgB;EAE3D,IAAI,CAAC,qBAAqB;EAE1B,MAAM,gBAAgB,OAAO,mBAAmB;EAEhD,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;EAErC,IAAI,iBAAiB,YAAY;EAEjC,SAAS,OAAO,cAAc,OAAO;EAErC,OAAO,SAAS,gBAAgB;GAC9B,OAAO,EAAE,mBAAmB;GAC5B;GACA,OAAO;GACP,UAAU;EACZ,CAAC;CACH;AACF"}

package/esm/http/middleware/middleware-list.d.mts CHANGED Viewed

@@ -6,7 +6,7 @@ import { maintenanceMiddleware } from "./maintenance.middleware.mjs";
 import { maxBodySizeMiddleware } from "./max-body-size.middleware.mjs";
 import { rateLimitMiddleware } from "./rate-limit.middleware.mjs";
-//#region ../core/src/http/middleware/middleware-list.d.ts
+//#region ../../packages/core/src/http/middleware/middleware-list.d.ts
 /**
  * Built-in HTTP middleware factories.
  *

package/esm/http/middleware/middleware-list.d.mts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"middleware-list.d.mts","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/middleware-list.ts"],"mappings":";;;;;;;;;;;AA+BA;;;;;;;;;;;;;;;;;;;;;cAAa,UAAA;EAAA"}
1	+ {"version":3,"file":"middleware-list.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/middleware-list.ts"],"mappings":";;;;;;;;;;;AA+BA;;;;;;;;;;;;;;;;;;;;;cAAa,UAAA;EAAA"}

package/esm/http/middleware/middleware-list.mjs CHANGED Viewed

@@ -6,7 +6,7 @@ import { maintenanceMiddleware } from "./maintenance.middleware.mjs";
 import { maxBodySizeMiddleware } from "./max-body-size.middleware.mjs";
 import { rateLimitMiddleware } from "./rate-limit.middleware.mjs";
-//#region ../core/src/http/middleware/middleware-list.ts
+//#region ../../packages/core/src/http/middleware/middleware-list.ts
 /**
 * Built-in HTTP middleware factories.
 *

package/esm/http/middleware/middleware-list.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"middleware-list.mjs","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/middleware-list.ts"],"sourcesContent":["import { cacheMiddleware } from \"./cache-response-middleware\";\nimport { concurrencyLimitMiddleware } from \"./concurrency-limit.middleware\";\nimport { idempotencyMiddleware } from \"./idempotency.middleware\";\nimport { ipFilterMiddleware } from \"./ip-filter.middleware\";\nimport { maintenanceMiddleware } from \"./maintenance.middleware\";\nimport { maxBodySizeMiddleware } from \"./max-body-size.middleware\";\nimport { rateLimitMiddleware } from \"./rate-limit.middleware\";\n\n/*\n Built-in HTTP middleware factories.\n \n Single canonical entry point for the framework's middleware suite. Each\n * property is a factory that returns a `Middleware` ready to drop into a\n * route's `middleware` array.\n \n Bare names (`rateLimitMiddleware`, etc.) are not exported from the package —\n * always reach for them via this namespace. The internal `Middleware` suffix\n naming exists for in-package code organization only.\n \n @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware, router } from \"@warlock.js/core\";\n \n router.post(\"/orders\", createOrderController, {\n * middleware: [\n * authMiddleware(\"client\"),\n * middleware.rateLimit({ max: 5, duration: 60_000 }),\n * middleware.idempotency(),\n * ],\n * });\n */\nexport const middleware = {\n cache: cacheMiddleware,\n concurrencyLimit: concurrencyLimitMiddleware,\n idempotency: idempotencyMiddleware,\n ipFilter: ipFilterMiddleware,\n maintenance: maintenanceMiddleware,\n maxBodySize: maxBodySizeMiddleware,\n rateLimit: rateLimitMiddleware,\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAa,aAAa;CACxB,OAAO;CACP,kBAAkB;CAClB,aAAa;CACb,UAAU;CACV,aAAa;CACb,aAAa;CACb,WAAW;AACb"}
1	+ {"version":3,"file":"middleware-list.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/middleware-list.ts"],"sourcesContent":["import { cacheMiddleware } from \"./cache-response-middleware\";\nimport { concurrencyLimitMiddleware } from \"./concurrency-limit.middleware\";\nimport { idempotencyMiddleware } from \"./idempotency.middleware\";\nimport { ipFilterMiddleware } from \"./ip-filter.middleware\";\nimport { maintenanceMiddleware } from \"./maintenance.middleware\";\nimport { maxBodySizeMiddleware } from \"./max-body-size.middleware\";\nimport { rateLimitMiddleware } from \"./rate-limit.middleware\";\n\n/*\n Built-in HTTP middleware factories.\n \n Single canonical entry point for the framework's middleware suite. Each\n * property is a factory that returns a `Middleware` ready to drop into a\n * route's `middleware` array.\n \n Bare names (`rateLimitMiddleware`, etc.) are not exported from the package —\n * always reach for them via this namespace. The internal `Middleware` suffix\n naming exists for in-package code organization only.\n \n @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware, router } from \"@warlock.js/core\";\n \n router.post(\"/orders\", createOrderController, {\n * middleware: [\n * authMiddleware(\"client\"),\n * middleware.rateLimit({ max: 5, duration: 60_000 }),\n * middleware.idempotency(),\n * ],\n * });\n */\nexport const middleware = {\n cache: cacheMiddleware,\n concurrencyLimit: concurrencyLimitMiddleware,\n idempotency: idempotencyMiddleware,\n ipFilter: ipFilterMiddleware,\n maintenance: maintenanceMiddleware,\n maxBodySize: maxBodySizeMiddleware,\n rateLimit: rateLimitMiddleware,\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAa,aAAa;CACxB,OAAO;CACP,kBAAkB;CAClB,aAAa;CACb,UAAU;CACV,aAAa;CACb,aAAa;CACb,WAAW;AACb"}

package/esm/http/middleware/rate-limit.middleware.d.mts CHANGED Viewed

@@ -1,6 +1,6 @@
 import { Request } from "../request.mjs";
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/rate-limit.middleware.d.ts
+//#region ../../packages/core/src/http/middleware/rate-limit.middleware.d.ts
 /**
  * Options for the per-route rate limit middleware.
  */
@@ -36,6 +36,18 @@ type RateLimitOptions = {
    * request, e.g. to translate it into the visitor's locale.
    */
   errorMessage?: string | ((request: Request) => string);
+  /**
+   * Where this limiter counts: `"memory"` (this process) or `"cache"`
+   * (`@warlock.js/cache`, shared by every process using the same driver).
+   * Defaults to `http.rateLimit.store` when that is `"cache"`, else `"memory"`.
+   */
+  store?: "memory" | "cache";
+  /**
+   * Stable name for this limiter's shared counters. Without it, limiters are
+   * told apart by the order they were created, which matches across processes
+   * running the same code; set a name when limiters are created conditionally.
+   */
+  name?: string;
 };
 /**
  * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s
@@ -43,10 +55,13 @@ type RateLimitOptions = {
  * 429. Use this for endpoints that need a tighter cap than the global default:
  * login, OTP request, password reset, expensive search, AI completions.
  *
- * The counter of THIS middleware always lives in-process. With `N` replicas
- * its effective cap is `N × max`. The global limit can be shared across
- * replicas by setting `http.rateLimit.redis` (an ioredis instance); that
- * does not affect this per-route middleware.
+ * The counter lives in-process by default, so with `N` replicas the
+ * effective cap is `N × max`. Set `store: "cache"` (or `http.rateLimit.store:
+ * "cache"`, which this follows) to count in `@warlock.js/cache` instead, so
+ * every process sharing the cache driver counts together. A cache outage
+ * fails open: the request is let through and the error is logged (at most
+ * once a minute). The `null` and `file` cache drivers are refused the same
+ * way: they cannot count, so the limiter lets requests through and logs why.
  *
  * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on
  * every response; adds `Retry-After` (seconds) on a 429.

package/esm/http/middleware/rate-limit.middleware.d.mts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rate-limit.middleware.d.mts","names":[],"sources":["~~../../../../../../../../~~core/src/http/middleware/rate-limit.middleware.ts"],"mappings":";;;;;;~~KASY~~,gBAAA;EAAgB;;;EAI1B,GAAA;EAIA;;;EAAA,QAAA;EAaA~~;;;;;;AAU0C;EAf1C~~,YAAA,IAAgB,OAAA,EAAS,OAAA;~~EAqEQ;;;;EAhEjC~~,GAAA;~~EAgE8D;;AAAU;;EA3DxE~~,MAAA;;;;;EAKA,YAAA,cAA0B,OAAA,EAAS,OAAO;AAAA~~;;;;;;;;;;;;;;;;;;;;;iBAsD5B~~,mBAAA,CAAoB,OAAA,EAAS,gBAAA,GAAmB,UAAU"}
1	+ {"version":3,"file":"rate-limit.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/rate-limit.middleware.ts"],"mappings":";;;;;;KAWY,gBAAA;EAAgB;;;EAI1B,GAAA;EAIA;;;EAAA,QAAA;EAaA;;;;;;;EALA,YAAA,IAAgB,OAAA,EAAS,OAAA;EA2BrB;AA+DN;;;EArFE,GAAA;EAqF2C;;;;EAhF3C,MAAA;;;;;EAKA,YAAA,cAA0B,OAAA,EAAS,OAAO;;;;;;EAM1C,KAAA;;;;;;EAMA,IAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;iBA+Dc,mBAAA,CAAoB,OAAA,EAAS,gBAAA,GAAmB,UAAU"}