@warlock.js/core 5.29.0 → 5.31.0

package/esm/http/conditional-request.d.mts

@@ -0,0 +1,86 @@
+//#region ../../packages/core/src/http/conditional-request.d.ts
+/**
+ * HTTP conditional requests (RFC 9110 §13): entity-tag comparison and the
+ * precedence of the precondition headers.
+ *
+ * Two comparisons exist (RFC 9110 §8.8.3.2):
+ *
+ * - **strong**: both tags are strong (no `W/` prefix) and their opaque tags are
+ *   identical. `If-Match` uses it (§13.1.1), so a weak validator never
+ *   satisfies `If-Match`.
+ * - **weak**: the opaque tags are identical, whatever their `W/` prefixes.
+ *   `If-None-Match` uses it (§13.1.2), so `W/"a"` matches `"a"`.
+ *
+ * Source: https://www.rfc-editor.org/rfc/rfc9110 (sections 8.8.3, 13.1, 13.2).
+ */
+/**
+ * One parsed entity tag. `opaque` keeps its quotes, so `"a"` and `a` differ.
+ */
+type EntityTag = {
+  weak: boolean;
+  opaque: string;
+};
+/**
+ * Parse one entity tag: an optional case-sensitive `W/` prefix, then the
+ * opaque tag. A value without quotes is kept as its own opaque tag so an
+ * application-supplied unquoted ETag still compares with itself.
+ */
+declare function parseEntityTag(value: string): EntityTag | undefined;
+/**
+ * Parse an `If-Match` / `If-None-Match` value: `"*"` or a comma-separated list
+ * of entity tags. A comma inside a quoted tag is part of the tag.
+ */
+declare function parseEntityTagList(header: unknown): "*" | EntityTag[] | undefined;
+/**
+ * Weak comparison: the opaque tags are identical.
+ */
+declare function weakEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
+/**
+ * Strong comparison: neither tag is weak and the opaque tags are identical.
+ */
+declare function strongEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
+/**
+ * Whether an `If-None-Match` header matches the current entity tag, with weak
+ * comparison. `*` matches any current representation.
+ */
+declare function matchesIfNoneMatch(header: unknown, etag: string): boolean;
+/**
+ * Whether an `If-Match` header is satisfied by the current entity tag, with
+ * strong comparison. `*` is satisfied by any current representation, so it
+ * fails only when there is none (`etag` undefined).
+ */
+declare function matchesIfMatch(header: unknown, etag: string | undefined): boolean;
+/**
+ * The request headers and current validators a precondition check reads.
+ */
+type ConditionalRequestInput = {
+  method: string; /** Current entity tag, quoted, optionally `W/`-prefixed. */
+  etag?: string; /** Current modification time. HTTP dates have second precision. */
+  lastModified?: Date | number;
+  ifMatch?: unknown;
+  ifNoneMatch?: unknown;
+  ifModifiedSince?: unknown;
+  ifUnmodifiedSince?: unknown;
+};
+/**
+ * What a precondition check decided:
+ *
+ * - `"proceed"`: send the normal response;
+ * - `"not-modified"`: answer a GET or HEAD with 304;
+ * - `"precondition-failed"`: answer with 412.
+ */
+type ConditionalRequestOutcome = "proceed" | "not-modified" | "precondition-failed";
+/**
+ * Evaluate the precondition headers in RFC 9110 §13.2.2 order:
+ *
+ * 1. `If-Match` (strong comparison) — false is 412;
+ * 2. otherwise `If-Unmodified-Since` — modified after the date is 412;
+ * 3. `If-None-Match` (weak comparison) — a match is 304 for GET/HEAD, else 412;
+ * 4. otherwise, for GET/HEAD, `If-Modified-Since` — not modified since is 304.
+ *
+ * An invalid date is ignored, as the RFC requires.
+ */
+declare function evaluateConditionalRequest(input: ConditionalRequestInput): ConditionalRequestOutcome;
+//#endregion
+export { ConditionalRequestInput, ConditionalRequestOutcome, EntityTag, evaluateConditionalRequest, matchesIfMatch, matchesIfNoneMatch, parseEntityTag, parseEntityTagList, strongEntityTagMatch, weakEntityTagMatch };
+//# sourceMappingURL=conditional-request.d.mts.map

package/esm/http/conditional-request.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditional-request.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/conditional-request.ts"],"mappings":";;AAkBA;;;;AAEQ;AAQR;;;;AAAwD;AAiBxD;;;;AAAoE;AA+BpE;KA1DY,SAAA;EACV,IAAA;EACA,MAAM;AAAA;;;;;AAwD8D;iBAhDtD,cAAA,CAAe,KAAA,WAAgB,SAAS;;;;;iBAiBxC,kBAAA,CAAmB,MAAA,kBAAwB,SAAS;;;;iBA+BpD,kBAAA,CAAmB,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,SAAS;AAetE;;;AAAA,iBARgB,oBAAA,CAAqB,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,SAAS;AAQR;AAgBhE;;;AAhBgE,iBAAhD,kBAAA,CAAmB,MAAA,WAAiB,IAAY;AAgBQ;AAiBxE;;;;AAjBwE,iBAAxD,cAAA,CAAe,MAAA,WAAiB,IAAwB;;;;KAiB5D,uBAAA;EACV,MAAA,UAOA;EALA,IAAA,WAMiB;EAJjB,YAAA,GAAe,IAAI;EACnB,OAAA;EACA,WAAA;EACA,eAAA;EACA,iBAAA;AAAA;AA0CF;;;;;;;AAAA,KAhCY,yBAAA;AAkCgB;;;;;;;;;;AAAA,iBAFZ,0BAAA,CACd,KAAA,EAAO,uBAAA,GACN,yBAAyB"}

package/esm/http/conditional-request.mjs

@@ -0,0 +1,121 @@
+//#region ../../packages/core/src/http/conditional-request.ts
+/**
+* Parse one entity tag: an optional case-sensitive `W/` prefix, then the
+* opaque tag. A value without quotes is kept as its own opaque tag so an
+* application-supplied unquoted ETag still compares with itself.
+*/
+function parseEntityTag(value) {
+	const trimmed = value.trim();
+	if (trimmed === "") return void 0;
+	const weak = trimmed.startsWith("W/");
+	const opaque = weak ? trimmed.slice(2) : trimmed;
+	if (opaque === "") return void 0;
+	return {
+		weak,
+		opaque
+	};
+}
+/**
+* Parse an `If-Match` / `If-None-Match` value: `"*"` or a comma-separated list
+* of entity tags. A comma inside a quoted tag is part of the tag.
+*/
+function parseEntityTagList(header) {
+	const value = Array.isArray(header) ? header.join(",") : header;
+	if (typeof value !== "string" || value.trim() === "") return void 0;
+	if (value.trim() === "*") return "*";
+	const tags = [];
+	let start = 0;
+	let quoted = false;
+	for (let index = 0; index <= value.length; index++) {
+		const character = value[index];
+		if (character === "\"") quoted = !quoted;
+		if (index === value.length || character === "," && !quoted) {
+			const tag = parseEntityTag(value.slice(start, index));
+			if (tag) tags.push(tag);
+			start = index + 1;
+		}
+	}
+	return tags;
+}
+/**
+* Weak comparison: the opaque tags are identical.
+*/
+function weakEntityTagMatch(first, second) {
+	return first.opaque === second.opaque;
+}
+/**
+* Strong comparison: neither tag is weak and the opaque tags are identical.
+*/
+function strongEntityTagMatch(first, second) {
+	return !first.weak && !second.weak && first.opaque === second.opaque;
+}
+/**
+* Whether an `If-None-Match` header matches the current entity tag, with weak
+* comparison. `*` matches any current representation.
+*/
+function matchesIfNoneMatch(header, etag) {
+	const tags = parseEntityTagList(header);
+	const current = parseEntityTag(etag);
+	if (tags === void 0 || current === void 0) return false;
+	if (tags === "*") return true;
+	return tags.some((tag) => weakEntityTagMatch(tag, current));
+}
+/**
+* Whether an `If-Match` header is satisfied by the current entity tag, with
+* strong comparison. `*` is satisfied by any current representation, so it
+* fails only when there is none (`etag` undefined).
+*/
+function matchesIfMatch(header, etag) {
+	const tags = parseEntityTagList(header);
+	if (tags === void 0) return true;
+	if (tags === "*") return etag !== void 0;
+	const current = etag === void 0 ? void 0 : parseEntityTag(etag);
+	if (current === void 0) return false;
+	return tags.some((tag) => strongEntityTagMatch(tag, current));
+}
+function isPresent(header) {
+	if (Array.isArray(header)) return header.length > 0;
+	return typeof header === "string" && header.trim() !== "";
+}
+function toSeconds(value) {
+	return Math.floor((value instanceof Date ? value.getTime() : value) / 1e3);
+}
+function parseHttpDate(header) {
+	const value = Array.isArray(header) ? header[0] : header;
+	if (typeof value !== "string") return void 0;
+	const time = new Date(value).getTime();
+	return Number.isFinite(time) ? Math.floor(time / 1e3) : void 0;
+}
+/**
+* Evaluate the precondition headers in RFC 9110 §13.2.2 order:
+*
+* 1. `If-Match` (strong comparison) — false is 412;
+* 2. otherwise `If-Unmodified-Since` — modified after the date is 412;
+* 3. `If-None-Match` (weak comparison) — a match is 304 for GET/HEAD, else 412;
+* 4. otherwise, for GET/HEAD, `If-Modified-Since` — not modified since is 304.
+*
+* An invalid date is ignored, as the RFC requires.
+*/
+function evaluateConditionalRequest(input) {
+	const method = input.method.toUpperCase();
+	const safe = method === "GET" || method === "HEAD";
+	if (isPresent(input.ifMatch)) {
+		if (!matchesIfMatch(input.ifMatch, input.etag)) return "precondition-failed";
+	} else if (isPresent(input.ifUnmodifiedSince) && input.lastModified !== void 0) {
+		const since = parseHttpDate(input.ifUnmodifiedSince);
+		if (since !== void 0 && toSeconds(input.lastModified) > since) return "precondition-failed";
+	}
+	if (isPresent(input.ifNoneMatch)) {
+		if (input.etag !== void 0 && matchesIfNoneMatch(input.ifNoneMatch, input.etag)) return safe ? "not-modified" : "precondition-failed";
+		return "proceed";
+	}
+	if (safe && isPresent(input.ifModifiedSince) && input.lastModified !== void 0) {
+		const since = parseHttpDate(input.ifModifiedSince);
+		if (since !== void 0 && toSeconds(input.lastModified) <= since) return "not-modified";
+	}
+	return "proceed";
+}
+
+//#endregion
+export { evaluateConditionalRequest, matchesIfMatch, matchesIfNoneMatch, parseEntityTag, parseEntityTagList, strongEntityTagMatch, weakEntityTagMatch };
+//# sourceMappingURL=conditional-request.mjs.map

package/esm/http/conditional-request.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditional-request.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/conditional-request.ts"],"sourcesContent":["/**\n * HTTP conditional requests (RFC 9110 §13): entity-tag comparison and the\n * precedence of the precondition headers.\n *\n * Two comparisons exist (RFC 9110 §8.8.3.2):\n *\n * - **strong**: both tags are strong (no `W/` prefix) and their opaque tags are\n *   identical. `If-Match` uses it (§13.1.1), so a weak validator never\n *   satisfies `If-Match`.\n * - **weak**: the opaque tags are identical, whatever their `W/` prefixes.\n *   `If-None-Match` uses it (§13.1.2), so `W/\"a\"` matches `\"a\"`.\n *\n * Source: https://www.rfc-editor.org/rfc/rfc9110 (sections 8.8.3, 13.1, 13.2).\n */\n\n/**\n * One parsed entity tag. `opaque` keeps its quotes, so `\"a\"` and `a` differ.\n */\nexport type EntityTag = {\n  weak: boolean;\n  opaque: string;\n};\n\n/**\n * Parse one entity tag: an optional case-sensitive `W/` prefix, then the\n * opaque tag. A value without quotes is kept as its own opaque tag so an\n * application-supplied unquoted ETag still compares with itself.\n */\nexport function parseEntityTag(value: string): EntityTag | undefined {\n  const trimmed = value.trim();\n\n  if (trimmed === \"\") return undefined;\n\n  const weak = trimmed.startsWith(\"W/\");\n  const opaque = weak ? trimmed.slice(2) : trimmed;\n\n  if (opaque === \"\") return undefined;\n\n  return { weak, opaque };\n}\n\n/**\n * Parse an `If-Match` / `If-None-Match` value: `\"*\"` or a comma-separated list\n * of entity tags. A comma inside a quoted tag is part of the tag.\n */\nexport function parseEntityTagList(header: unknown): \"*\" | EntityTag[] | undefined {\n  const value = Array.isArray(header) ? header.join(\",\") : header;\n\n  if (typeof value !== \"string\" || value.trim() === \"\") return undefined;\n\n  if (value.trim() === \"*\") return \"*\";\n\n  const tags: EntityTag[] = [];\n  let start = 0;\n  let quoted = false;\n\n  for (let index = 0; index <= value.length; index++) {\n    const character = value[index];\n\n    if (character === '\"') quoted = !quoted;\n\n    if (index === value.length || (character === \",\" && !quoted)) {\n      const tag = parseEntityTag(value.slice(start, index));\n\n      if (tag) tags.push(tag);\n\n      start = index + 1;\n    }\n  }\n\n  return tags;\n}\n\n/**\n * Weak comparison: the opaque tags are identical.\n */\nexport function weakEntityTagMatch(first: EntityTag, second: EntityTag): boolean {\n  return first.opaque === second.opaque;\n}\n\n/**\n * Strong comparison: neither tag is weak and the opaque tags are identical.\n */\nexport function strongEntityTagMatch(first: EntityTag, second: EntityTag): boolean {\n  return !first.weak && !second.weak && first.opaque === second.opaque;\n}\n\n/**\n * Whether an `If-None-Match` header matches the current entity tag, with weak\n * comparison. `*` matches any current representation.\n */\nexport function matchesIfNoneMatch(header: unknown, etag: string): boolean {\n  const tags = parseEntityTagList(header);\n  const current = parseEntityTag(etag);\n\n  if (tags === undefined || current === undefined) return false;\n\n  if (tags === \"*\") return true;\n\n  return tags.some((tag) => weakEntityTagMatch(tag, current));\n}\n\n/**\n * Whether an `If-Match` header is satisfied by the current entity tag, with\n * strong comparison. `*` is satisfied by any current representation, so it\n * fails only when there is none (`etag` undefined).\n */\nexport function matchesIfMatch(header: unknown, etag: string | undefined): boolean {\n  const tags = parseEntityTagList(header);\n\n  if (tags === undefined) return true;\n\n  if (tags === \"*\") return etag !== undefined;\n\n  const current = etag === undefined ? undefined : parseEntityTag(etag);\n\n  if (current === undefined) return false;\n\n  return tags.some((tag) => strongEntityTagMatch(tag, current));\n}\n\n/**\n * The request headers and current validators a precondition check reads.\n */\nexport type ConditionalRequestInput = {\n  method: string;\n  /** Current entity tag, quoted, optionally `W/`-prefixed. */\n  etag?: string;\n  /** Current modification time. HTTP dates have second precision. */\n  lastModified?: Date | number;\n  ifMatch?: unknown;\n  ifNoneMatch?: unknown;\n  ifModifiedSince?: unknown;\n  ifUnmodifiedSince?: unknown;\n};\n\n/**\n * What a precondition check decided:\n *\n * - `\"proceed\"`: send the normal response;\n * - `\"not-modified\"`: answer a GET or HEAD with 304;\n * - `\"precondition-failed\"`: answer with 412.\n */\nexport type ConditionalRequestOutcome = \"proceed\" | \"not-modified\" | \"precondition-failed\";\n\nfunction isPresent(header: unknown): boolean {\n  if (Array.isArray(header)) return header.length > 0;\n\n  return typeof header === \"string\" && header.trim() !== \"\";\n}\n\nfunction toSeconds(value: Date | number): number {\n  return Math.floor((value instanceof Date ? value.getTime() : value) / 1000);\n}\n\nfunction parseHttpDate(header: unknown): number | undefined {\n  const value = Array.isArray(header) ? header[0] : header;\n\n  if (typeof value !== \"string\") return undefined;\n\n  const time = new Date(value).getTime();\n\n  return Number.isFinite(time) ? Math.floor(time / 1000) : undefined;\n}\n\n/**\n * Evaluate the precondition headers in RFC 9110 §13.2.2 order:\n *\n * 1. `If-Match` (strong comparison) — false is 412;\n * 2. otherwise `If-Unmodified-Since` — modified after the date is 412;\n * 3. `If-None-Match` (weak comparison) — a match is 304 for GET/HEAD, else 412;\n * 4. otherwise, for GET/HEAD, `If-Modified-Since` — not modified since is 304.\n *\n * An invalid date is ignored, as the RFC requires.\n */\nexport function evaluateConditionalRequest(\n  input: ConditionalRequestInput,\n): ConditionalRequestOutcome {\n  const method = input.method.toUpperCase();\n  const safe = method === \"GET\" || method === \"HEAD\";\n\n  if (isPresent(input.ifMatch)) {\n    if (!matchesIfMatch(input.ifMatch, input.etag)) return \"precondition-failed\";\n  } else if (isPresent(input.ifUnmodifiedSince) && input.lastModified !== undefined) {\n    const since = parseHttpDate(input.ifUnmodifiedSince);\n\n    if (since !== undefined && toSeconds(input.lastModified) > since) {\n      return \"precondition-failed\";\n    }\n  }\n\n  if (isPresent(input.ifNoneMatch)) {\n    if (input.etag !== undefined && matchesIfNoneMatch(input.ifNoneMatch, input.etag)) {\n      return safe ? \"not-modified\" : \"precondition-failed\";\n    }\n\n    return \"proceed\";\n  }\n\n  if (safe && isPresent(input.ifModifiedSince) && input.lastModified !== undefined) {\n    const since = parseHttpDate(input.ifModifiedSince);\n\n    if (since !== undefined && toSeconds(input.lastModified) <= since) {\n      return \"not-modified\";\n    }\n  }\n\n  return \"proceed\";\n}\n"],"mappings":";;;;;;AA4BA,SAAgB,eAAe,OAAsC;CACnE,MAAM,UAAU,MAAM,KAAK;CAE3B,IAAI,YAAY,IAAI,OAAO;CAE3B,MAAM,OAAO,QAAQ,WAAW,IAAI;CACpC,MAAM,SAAS,OAAO,QAAQ,MAAM,CAAC,IAAI;CAEzC,IAAI,WAAW,IAAI,OAAO;CAE1B,OAAO;EAAE;EAAM;CAAO;AACxB;;;;;AAMA,SAAgB,mBAAmB,QAAgD;CACjF,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK,GAAG,IAAI;CAEzD,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,IAAI,OAAO;CAE7D,IAAI,MAAM,KAAK,MAAM,KAAK,OAAO;CAEjC,MAAM,OAAoB,CAAC;CAC3B,IAAI,QAAQ;CACZ,IAAI,SAAS;CAEb,KAAK,IAAI,QAAQ,GAAG,SAAS,MAAM,QAAQ,SAAS;EAClD,MAAM,YAAY,MAAM;EAExB,IAAI,cAAc,MAAK,SAAS,CAAC;EAEjC,IAAI,UAAU,MAAM,UAAW,cAAc,OAAO,CAAC,QAAS;GAC5D,MAAM,MAAM,eAAe,MAAM,MAAM,OAAO,KAAK,CAAC;GAEpD,IAAI,KAAK,KAAK,KAAK,GAAG;GAEtB,QAAQ,QAAQ;EAClB;CACF;CAEA,OAAO;AACT;;;;AAKA,SAAgB,mBAAmB,OAAkB,QAA4B;CAC/E,OAAO,MAAM,WAAW,OAAO;AACjC;;;;AAKA,SAAgB,qBAAqB,OAAkB,QAA4B;CACjF,OAAO,CAAC,MAAM,QAAQ,CAAC,OAAO,QAAQ,MAAM,WAAW,OAAO;AAChE;;;;;AAMA,SAAgB,mBAAmB,QAAiB,MAAuB;CACzE,MAAM,OAAO,mBAAmB,MAAM;CACtC,MAAM,UAAU,eAAe,IAAI;CAEnC,IAAI,SAAS,UAAa,YAAY,QAAW,OAAO;CAExD,IAAI,SAAS,KAAK,OAAO;CAEzB,OAAO,KAAK,MAAM,QAAQ,mBAAmB,KAAK,OAAO,CAAC;AAC5D;;;;;;AAOA,SAAgB,eAAe,QAAiB,MAAmC;CACjF,MAAM,OAAO,mBAAmB,MAAM;CAEtC,IAAI,SAAS,QAAW,OAAO;CAE/B,IAAI,SAAS,KAAK,OAAO,SAAS;CAElC,MAAM,UAAU,SAAS,SAAY,SAAY,eAAe,IAAI;CAEpE,IAAI,YAAY,QAAW,OAAO;CAElC,OAAO,KAAK,MAAM,QAAQ,qBAAqB,KAAK,OAAO,CAAC;AAC9D;AA0BA,SAAS,UAAU,QAA0B;CAC3C,IAAI,MAAM,QAAQ,MAAM,GAAG,OAAO,OAAO,SAAS;CAElD,OAAO,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM;AACzD;AAEA,SAAS,UAAU,OAA8B;CAC/C,OAAO,KAAK,OAAO,iBAAiB,OAAO,MAAM,QAAQ,IAAI,SAAS,GAAI;AAC5E;AAEA,SAAS,cAAc,QAAqC;CAC1D,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;CAElD,IAAI,OAAO,UAAU,UAAU,OAAO;CAEtC,MAAM,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,QAAQ;CAErC,OAAO,OAAO,SAAS,IAAI,IAAI,KAAK,MAAM,OAAO,GAAI,IAAI;AAC3D;;;;;;;;;;;AAYA,SAAgB,2BACd,OAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY;CACxC,MAAM,OAAO,WAAW,SAAS,WAAW;CAE5C,IAAI,UAAU,MAAM,OAAO,GACzB;MAAI,CAAC,eAAe,MAAM,SAAS,MAAM,IAAI,GAAG,OAAO;CAAqB,OACvE,IAAI,UAAU,MAAM,iBAAiB,KAAK,MAAM,iBAAiB,QAAW;EACjF,MAAM,QAAQ,cAAc,MAAM,iBAAiB;EAEnD,IAAI,UAAU,UAAa,UAAU,MAAM,YAAY,IAAI,OACzD,OAAO;CAEX;CAEA,IAAI,UAAU,MAAM,WAAW,GAAG;EAChC,IAAI,MAAM,SAAS,UAAa,mBAAmB,MAAM,aAAa,MAAM,IAAI,GAC9E,OAAO,OAAO,iBAAiB;EAGjC,OAAO;CACT;CAEA,IAAI,QAAQ,UAAU,MAAM,eAAe,KAAK,MAAM,iBAAiB,QAAW;EAChF,MAAM,QAAQ,cAAc,MAAM,eAAe;EAEjD,IAAI,UAAU,UAAa,UAAU,MAAM,YAAY,KAAK,OAC1D,OAAO;CAEX;CAEA,OAAO;AACT"}

package/esm/http/config.d.mts

@@ -1,6 +1,6 @@
 import { HttpConfigurations } from "./types.mjs";
 
-//#region ../core/src/http/config.d.ts
+//#region ../../packages/core/src/http/config.d.ts
 /**
  * Default http configurations
  */

package/esm/http/config.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.mts","names":[],"sources":["../../../../../../../core/src/http/config.ts"],"mappings":";;;;;AAOA;cAAa,yBAAA,EAA2B,kBAYvC;;;AAAA;iBAKe,UAAA,CAAW,GAAW"}
+{"version":3,"file":"config.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"mappings":";;;;;AAOA;cAAa,yBAAA,EAA2B,kBAYvC;;;AAAA;iBAKe,UAAA,CAAW,GAAW"}

package/esm/http/config.mjs

@@ -1,7 +1,7 @@
 import config from "@mongez/config";
 import { get } from "@mongez/reinforcements";
 
-//#region ../core/src/http/config.ts
+//#region ../../packages/core/src/http/config.ts
 /**
 * Default http configurations
 */

package/esm/http/config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.mjs","names":[],"sources":["../../../../../../../core/src/http/config.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { get } from \"@mongez/reinforcements\";\nimport type { HttpConfigurations } from \"./types\";\n\n/**\n * Default http configurations\n */\nexport const defaultHttpConfigurations: HttpConfigurations = {\n  port: 3000,\n  host: \"0.0.0.0\",\n  middleware: {\n    all: [],\n    only: {\n      middleware: [],\n    },\n    except: {\n      middleware: [],\n    },\n  },\n};\n\n/**\n * Get http configurations for the given key\n */\nexport function httpConfig(key: string): any {\n  return config.get(`http.${key}`, get(defaultHttpConfigurations, key));\n}\n"],"mappings":";;;;;;;AAOA,MAAa,4BAAgD;CAC3D,MAAM;CACN,MAAM;CACN,YAAY;EACV,KAAK,CAAC;EACN,MAAM,EACJ,YAAY,CAAC,EACf;EACA,QAAQ,EACN,YAAY,CAAC,EACf;CACF;AACF;;;;AAKA,SAAgB,WAAW,KAAkB;CAC3C,OAAO,OAAO,IAAI,QAAQ,OAAO,IAAI,2BAA2B,GAAG,CAAC;AACtE"}
+{"version":3,"file":"config.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { get } from \"@mongez/reinforcements\";\nimport type { HttpConfigurations } from \"./types\";\n\n/**\n * Default http configurations\n */\nexport const defaultHttpConfigurations: HttpConfigurations = {\n  port: 3000,\n  host: \"0.0.0.0\",\n  middleware: {\n    all: [],\n    only: {\n      middleware: [],\n    },\n    except: {\n      middleware: [],\n    },\n  },\n};\n\n/**\n * Get http configurations for the given key\n */\nexport function httpConfig(key: string): any {\n  return config.get(`http.${key}`, get(defaultHttpConfigurations, key));\n}\n"],"mappings":";;;;;;;AAOA,MAAa,4BAAgD;CAC3D,MAAM;CACN,MAAM;CACN,YAAY;EACV,KAAK,CAAC;EACN,MAAM,EACJ,YAAY,CAAC,EACf;EACA,QAAQ,EACN,YAAY,CAAC,EACf;CACF;AACF;;;;AAKA,SAAgB,WAAW,KAAkB;CAC3C,OAAO,OAAO,IAAI,QAAQ,OAAO,IAAI,2BAA2B,GAAG,CAAC;AACtE"}

package/esm/http/context/request-context.d.mts

@@ -3,7 +3,7 @@ import { Request } from "../request.mjs";
 import { Model } from "@warlock.js/cascade";
 import { Context } from "@warlock.js/context";
 
-//#region ../core/src/http/context/request-context.d.ts
+//#region ../../packages/core/src/http/context/request-context.d.ts
 /**
  * Request Context Store
  */

package/esm/http/context/request-context.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../../../../../../../core/src/http/context/request-context.ts"],"mappings":";;;;;;;;AAQA;KAAY,mBAAA,cAAiC,KAAA,GAAQ,KAAA;EACnD,OAAA,EAAS,OAAA,CAAQ,IAAA;EACjB,QAAA,EAAU,QAAA;AAAA;;;;;;;cASN,cAAA,cAA4B,KAAA,GAAQ,KAAA,UAAe,OAAA,CAAQ,mBAAA,CAAoB,IAAA;EAXhC;;;EAe5C,UAAA,IAAc,OAAA,CAAQ,IAAA;EAb7B;;;EAoBO,WAAA,IAAe,QAAA;EAXlB;;;;;;;;;;;;;;;;;EAgCG,OAAA;EAhCiC;;;EAyCjC,UAAA,CAAW,OAAA,GAAU,MAAA,gBAAsB,mBAAA,CAAoB,IAAA;AAAA;;;;cAW3D,cAAA,EAAc,cAAA,CAAA,KAAA,+BAAA,WAAA;;;;iBAOX,eAAA,kBAAiC,KAAA,GAAQ,KAAA,KACX,mBAAA,CAAoB,QAAA;AAAA,iBAGlD,UAAA,kBAA4B,KAAA,GAAQ,KAAA,KACZ,OAAA,CAAQ,QAAA;AAAA,iBAGhC,cAAA,kBAAgC,KAAA,GAAQ,KAAA,KAOnB,QAAA"}
+{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-context.ts"],"mappings":";;;;;;;;AAQA;KAAY,mBAAA,cAAiC,KAAA,GAAQ,KAAA;EACnD,OAAA,EAAS,OAAA,CAAQ,IAAA;EACjB,QAAA,EAAU,QAAA;AAAA;;;;;;;cASN,cAAA,cAA4B,KAAA,GAAQ,KAAA,UAAe,OAAA,CAAQ,mBAAA,CAAoB,IAAA;EAXhC;;;EAe5C,UAAA,IAAc,OAAA,CAAQ,IAAA;EAb7B;;;EAoBO,WAAA,IAAe,QAAA;EAXlB;;;;;;;;;;;;;;;;;EAgCG,OAAA;EAhCiC;;;EAyCjC,UAAA,CAAW,OAAA,GAAU,MAAA,gBAAsB,mBAAA,CAAoB,IAAA;AAAA;;;;cAW3D,cAAA,EAAc,cAAA,CAAA,KAAA,+BAAA,WAAA;;;;iBAOX,eAAA,kBAAiC,KAAA,GAAQ,KAAA,KACX,mBAAA,CAAoB,QAAA;AAAA,iBAGlD,UAAA,kBAA4B,KAAA,GAAQ,KAAA,KACZ,OAAA,CAAQ,QAAA;AAAA,iBAGhC,cAAA,kBAAgC,KAAA,GAAQ,KAAA,KAOnB,QAAA"}

package/esm/http/context/request-context.mjs

@@ -1,6 +1,6 @@
 import { Context, contextManager } from "@warlock.js/context";
 
-//#region ../core/src/http/context/request-context.ts
+//#region ../../packages/core/src/http/context/request-context.ts
 /**
 * Request Context
 *

package/esm/http/context/request-context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.mjs","names":[],"sources":["../../../../../../../../core/src/http/context/request-context.ts"],"sourcesContent":["import type { Model } from \"@warlock.js/cascade\";\nimport { Context, contextManager } from \"@warlock.js/context\";\nimport type { Request } from \"../request\";\nimport type { Response } from \"../response\";\n\n/**\n * Request Context Store\n */\nexport type RequestContextStore<User extends Model = Model> = {\n  request: Request<User>;\n  response: Response;\n};\n\n/**\n * Request Context\n *\n * Manages request-scoped data (request, response, user) using AsyncLocalStorage.\n * Extends the base Context class for consistent API.\n */\nclass RequestContext<User extends Model = Model> extends Context<RequestContextStore<User>> {\n  /**\n   * Get the current request\n   */\n  public getRequest(): Request<User> | undefined {\n    return this.get(\"request\");\n  }\n\n  /**\n   * Get the current response\n   */\n  public getResponse(): Response | undefined {\n    return this.get(\"response\");\n  }\n\n  /**\n   * Get the current user.\n   *\n   * Reads `request.locals.user` — a key core itself does not declare on\n   * `RequestLocals`. `@warlock.js/auth` augments `RequestLocals` with\n   * `user?: RequestUser` and its middleware is the sole writer, but core\n   * cannot import `@warlock.js/auth` (that would invert the dependency), so\n   * this accessor cannot reference the `user` key by name at the type level\n   * and instead reads `locals` as an untyped bag. The return type is\n   * `unknown`, not the `User` generic above: that generic actually binds\n   * `Request<User>`'s `RequestValidation` parameter (see\n   * `RequestContextStore`), not \"the user type\" — there is no `Request`\n   * generic for the user today, so returning it as `User` was never sound.\n   * Callers that need a concrete model type — e.g.\n   * `useCurrentUser<MyUserModel>()` — cast at the call site; the app owns\n   * that shape via `@warlock.js/auth`'s `RequestUser` augmentation.\n   */\n  public getUser(): unknown {\n    const locals = this.getRequest()?.locals as Record<string, unknown> | undefined;\n\n    return locals?.user;\n  }\n\n  /**\n   * Build the initial request store from HTTP context\n   */\n  public buildStore(payload?: Record<string, any>): RequestContextStore<User> {\n    return {\n      request: payload?.request,\n      response: payload?.response,\n    };\n  }\n}\n\n/**\n * Global request context instance\n */\nexport const requestContext = new RequestContext();\n\ncontextManager.register(\"request\", requestContext);\n\n/**\n * Use request store (for backward compatibility)\n */\nexport function useRequestStore<UserType extends Model = Model>() {\n  return (requestContext.getStore() || {}) as RequestContextStore<UserType>;\n}\n\nexport function useRequest<UserType extends Model = Model>() {\n  return requestContext.getRequest() as Request<UserType>;\n}\n\nexport function useCurrentUser<UserType extends Model = Model>() {\n  // `getUser()` returns `unknown` — core has no type for `request.locals.user`\n  // (that key belongs to `@warlock.js/auth`'s `RequestLocals` augmentation).\n  // This is the app boundary where the caller's own `RequestUser`\n  // augmentation is expected to actually be its `UserType` model instance;\n  // `@warlock.js/auth` exposes a typed `currentUser()` helper over this same\n  // store for callers that want that guarantee without a manual assertion.\n  return requestContext.getUser() as UserType;\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAM,iBAAN,cAAyD,QAAmC;;;;CAI1F,AAAO,aAAwC;EAC7C,OAAO,KAAK,IAAI,SAAS;CAC3B;;;;CAKA,AAAO,cAAoC;EACzC,OAAO,KAAK,IAAI,UAAU;CAC5B;;;;;;;;;;;;;;;;;;CAmBA,AAAO,UAAmB;EAGxB,QAFe,KAAK,WAAW,CAAC,EAAE,OAErB,EAAE;CACjB;;;;CAKA,AAAO,WAAW,SAA0D;EAC1E,OAAO;GACL,SAAS,SAAS;GAClB,UAAU,SAAS;EACrB;CACF;AACF;;;;AAKA,MAAa,iBAAiB,IAAI,eAAe;AAEjD,eAAe,SAAS,WAAW,cAAc;;;;AAKjD,SAAgB,kBAAkD;CAChE,OAAQ,eAAe,SAAS,KAAK,CAAC;AACxC;AAEA,SAAgB,aAA6C;CAC3D,OAAO,eAAe,WAAW;AACnC;AAEA,SAAgB,iBAAiD;CAO/D,OAAO,eAAe,QAAQ;AAChC"}
+{"version":3,"file":"request-context.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-context.ts"],"sourcesContent":["import type { Model } from \"@warlock.js/cascade\";\nimport { Context, contextManager } from \"@warlock.js/context\";\nimport type { Request } from \"../request\";\nimport type { Response } from \"../response\";\n\n/**\n * Request Context Store\n */\nexport type RequestContextStore<User extends Model = Model> = {\n  request: Request<User>;\n  response: Response;\n};\n\n/**\n * Request Context\n *\n * Manages request-scoped data (request, response, user) using AsyncLocalStorage.\n * Extends the base Context class for consistent API.\n */\nclass RequestContext<User extends Model = Model> extends Context<RequestContextStore<User>> {\n  /**\n   * Get the current request\n   */\n  public getRequest(): Request<User> | undefined {\n    return this.get(\"request\");\n  }\n\n  /**\n   * Get the current response\n   */\n  public getResponse(): Response | undefined {\n    return this.get(\"response\");\n  }\n\n  /**\n   * Get the current user.\n   *\n   * Reads `request.locals.user` — a key core itself does not declare on\n   * `RequestLocals`. `@warlock.js/auth` augments `RequestLocals` with\n   * `user?: RequestUser` and its middleware is the sole writer, but core\n   * cannot import `@warlock.js/auth` (that would invert the dependency), so\n   * this accessor cannot reference the `user` key by name at the type level\n   * and instead reads `locals` as an untyped bag. The return type is\n   * `unknown`, not the `User` generic above: that generic actually binds\n   * `Request<User>`'s `RequestValidation` parameter (see\n   * `RequestContextStore`), not \"the user type\" — there is no `Request`\n   * generic for the user today, so returning it as `User` was never sound.\n   * Callers that need a concrete model type — e.g.\n   * `useCurrentUser<MyUserModel>()` — cast at the call site; the app owns\n   * that shape via `@warlock.js/auth`'s `RequestUser` augmentation.\n   */\n  public getUser(): unknown {\n    const locals = this.getRequest()?.locals as Record<string, unknown> | undefined;\n\n    return locals?.user;\n  }\n\n  /**\n   * Build the initial request store from HTTP context\n   */\n  public buildStore(payload?: Record<string, any>): RequestContextStore<User> {\n    return {\n      request: payload?.request,\n      response: payload?.response,\n    };\n  }\n}\n\n/**\n * Global request context instance\n */\nexport const requestContext = new RequestContext();\n\ncontextManager.register(\"request\", requestContext);\n\n/**\n * Use request store (for backward compatibility)\n */\nexport function useRequestStore<UserType extends Model = Model>() {\n  return (requestContext.getStore() || {}) as RequestContextStore<UserType>;\n}\n\nexport function useRequest<UserType extends Model = Model>() {\n  return requestContext.getRequest() as Request<UserType>;\n}\n\nexport function useCurrentUser<UserType extends Model = Model>() {\n  // `getUser()` returns `unknown` — core has no type for `request.locals.user`\n  // (that key belongs to `@warlock.js/auth`'s `RequestLocals` augmentation).\n  // This is the app boundary where the caller's own `RequestUser`\n  // augmentation is expected to actually be its `UserType` model instance;\n  // `@warlock.js/auth` exposes a typed `currentUser()` helper over this same\n  // store for callers that want that guarantee without a manual assertion.\n  return requestContext.getUser() as UserType;\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAM,iBAAN,cAAyD,QAAmC;;;;CAI1F,AAAO,aAAwC;EAC7C,OAAO,KAAK,IAAI,SAAS;CAC3B;;;;CAKA,AAAO,cAAoC;EACzC,OAAO,KAAK,IAAI,UAAU;CAC5B;;;;;;;;;;;;;;;;;;CAmBA,AAAO,UAAmB;EAGxB,QAFe,KAAK,WAAW,CAAC,EAAE,OAErB,EAAE;CACjB;;;;CAKA,AAAO,WAAW,SAA0D;EAC1E,OAAO;GACL,SAAS,SAAS;GAClB,UAAU,SAAS;EACrB;CACF;AACF;;;;AAKA,MAAa,iBAAiB,IAAI,eAAe;AAEjD,eAAe,SAAS,WAAW,cAAc;;;;AAKjD,SAAgB,kBAAkD;CAChE,OAAQ,eAAe,SAAS,KAAK,CAAC;AACxC;AAEA,SAAgB,aAA6C;CAC3D,OAAO,eAAe,WAAW;AACnC;AAEA,SAAgB,iBAAiD;CAO/D,OAAO,eAAe,QAAQ;AAChC"}

package/esm/http/context/request-memo.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/http/context/request-memo.d.ts
+//#region ../../packages/core/src/http/context/request-memo.d.ts
 /**
  * Single-flight, request-scoped memoization.
  *

package/esm/http/context/request-memo.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-memo.d.mts","names":[],"sources":["../../../../../../../../core/src/http/context/request-memo.ts"],"mappings":";;AA2BA;;;;;;;;;;;;;;;iBAAgB,WAAA,IAAe,GAAA,UAAa,EAAA,QAAU,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA"}
+{"version":3,"file":"request-memo.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-memo.ts"],"mappings":";;AA2BA;;;;;;;;;;;;;;;iBAAgB,WAAA,IAAe,GAAA,UAAa,EAAA,QAAU,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA"}

package/esm/http/context/request-memo.mjs

@@ -1,6 +1,6 @@
 import { requestContext } from "./request-context.mjs";
 
-//#region ../core/src/http/context/request-memo.ts
+//#region ../../packages/core/src/http/context/request-memo.ts
 /**
 * In-flight/settled promises for the current request, keyed by the caller's
 * key. Never a process-global map: the outer key is the request's own store

package/esm/http/context/request-memo.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request-memo.mjs","names":[],"sources":["../../../../../../../../core/src/http/context/request-memo.ts"],"sourcesContent":["import { requestContext, type RequestContextStore } from \"./request-context\";\n\n/**\n * In-flight/settled promises for the current request, keyed by the caller's\n * key. Never a process-global map: the outer key is the request's own store\n * object (fresh per request, see `RequestContext.buildStore`), so two\n * concurrent requests can never share — or even see — each other's entries,\n * and everything is GC-eligible once the request's ALS frame ends.\n */\nconst requestMemoStores = new WeakMap<RequestContextStore, Map<string, Promise<any>>>();\n\n/**\n * Single-flight, request-scoped memoization.\n *\n * The first call for a given `key` within the current request runs `fn` once\n * and caches the resulting promise; any call for the same `key` issued while\n * that promise is still pending — or after it has resolved — gets that exact\n * promise back, so parallel loaders that all need the same value never issue\n * duplicate work. A rejection is evicted immediately, so the next call for\n * that `key` retries `fn` from scratch instead of caching the failure.\n *\n * Must run inside a request context (established by\n * `createRequestStore`/`contextManager.runAll` for every HTTP request). There\n * is deliberately no process-global fallback — that is the exact cross-request\n * leak this helper exists to prevent — so calling it outside a request\n * context throws instead of silently memoizing across requests.\n */\nexport function requestMemo<T>(key: string, fn: () => Promise<T>): Promise<T> {\n  const store = requestContext.getStore();\n\n  if (!store) {\n    throw new Error(\n      \"requestMemo() was called outside a request context. \" +\n        \"It caches work for the lifetime of a single request and must run inside \" +\n        \"code executed by the HTTP request pipeline (middleware, a loader, or a \" +\n        \"controller) — call it from there. If you need to share a value across \" +\n        \"requests, use a process-level cache instead; requestMemo will not fall \" +\n        \"back to one.\",\n    );\n  }\n\n  let entries = requestMemoStores.get(store);\n\n  if (!entries) {\n    entries = new Map();\n    requestMemoStores.set(store, entries);\n  }\n\n  const cached = entries.get(key);\n\n  if (cached) return cached;\n\n  const promise = (async () => fn())().catch((error) => {\n    entries!.delete(key);\n    throw error;\n  });\n\n  entries.set(key, promise);\n\n  return promise;\n}\n"],"mappings":";;;;;;;;;;AASA,MAAM,oCAAoB,IAAI,QAAwD;;;;;;;;;;;;;;;;;AAkBtF,SAAgB,YAAe,KAAa,IAAkC;CAC5E,MAAM,QAAQ,eAAe,SAAS;CAEtC,IAAI,CAAC,OACH,MAAM,IAAI,MACR,8VAMF;CAGF,IAAI,UAAU,kBAAkB,IAAI,KAAK;CAEzC,IAAI,CAAC,SAAS;EACZ,0BAAU,IAAI,IAAI;EAClB,kBAAkB,IAAI,OAAO,OAAO;CACtC;CAEA,MAAM,SAAS,QAAQ,IAAI,GAAG;CAE9B,IAAI,QAAQ,OAAO;CAEnB,MAAM,WAAW,YAAY,GAAG,EAAC,CAAE,CAAC,CAAC,OAAO,UAAU;EACpD,QAAS,OAAO,GAAG;EACnB,MAAM;CACR,CAAC;CAED,QAAQ,IAAI,KAAK,OAAO;CAExB,OAAO;AACT"}
+{"version":3,"file":"request-memo.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-memo.ts"],"sourcesContent":["import { requestContext, type RequestContextStore } from \"./request-context\";\n\n/**\n * In-flight/settled promises for the current request, keyed by the caller's\n * key. Never a process-global map: the outer key is the request's own store\n * object (fresh per request, see `RequestContext.buildStore`), so two\n * concurrent requests can never share — or even see — each other's entries,\n * and everything is GC-eligible once the request's ALS frame ends.\n */\nconst requestMemoStores = new WeakMap<RequestContextStore, Map<string, Promise<any>>>();\n\n/**\n * Single-flight, request-scoped memoization.\n *\n * The first call for a given `key` within the current request runs `fn` once\n * and caches the resulting promise; any call for the same `key` issued while\n * that promise is still pending — or after it has resolved — gets that exact\n * promise back, so parallel loaders that all need the same value never issue\n * duplicate work. A rejection is evicted immediately, so the next call for\n * that `key` retries `fn` from scratch instead of caching the failure.\n *\n * Must run inside a request context (established by\n * `createRequestStore`/`contextManager.runAll` for every HTTP request). There\n * is deliberately no process-global fallback — that is the exact cross-request\n * leak this helper exists to prevent — so calling it outside a request\n * context throws instead of silently memoizing across requests.\n */\nexport function requestMemo<T>(key: string, fn: () => Promise<T>): Promise<T> {\n  const store = requestContext.getStore();\n\n  if (!store) {\n    throw new Error(\n      \"requestMemo() was called outside a request context. \" +\n        \"It caches work for the lifetime of a single request and must run inside \" +\n        \"code executed by the HTTP request pipeline (middleware, a loader, or a \" +\n        \"controller) — call it from there. If you need to share a value across \" +\n        \"requests, use a process-level cache instead; requestMemo will not fall \" +\n        \"back to one.\",\n    );\n  }\n\n  let entries = requestMemoStores.get(store);\n\n  if (!entries) {\n    entries = new Map();\n    requestMemoStores.set(store, entries);\n  }\n\n  const cached = entries.get(key);\n\n  if (cached) return cached;\n\n  const promise = (async () => fn())().catch((error) => {\n    entries!.delete(key);\n    throw error;\n  });\n\n  entries.set(key, promise);\n\n  return promise;\n}\n"],"mappings":";;;;;;;;;;AASA,MAAM,oCAAoB,IAAI,QAAwD;;;;;;;;;;;;;;;;;AAkBtF,SAAgB,YAAe,KAAa,IAAkC;CAC5E,MAAM,QAAQ,eAAe,SAAS;CAEtC,IAAI,CAAC,OACH,MAAM,IAAI,MACR,8VAMF;CAGF,IAAI,UAAU,kBAAkB,IAAI,KAAK;CAEzC,IAAI,CAAC,SAAS;EACZ,0BAAU,IAAI,IAAI;EAClB,kBAAkB,IAAI,OAAO,OAAO;CACtC;CAEA,MAAM,SAAS,QAAQ,IAAI,GAAG;CAE9B,IAAI,QAAQ,OAAO;CAEnB,MAAM,WAAW,YAAY,GAAG,EAAC,CAAE,CAAC,CAAC,OAAO,UAAU;EACpD,QAAS,OAAO,GAAG;EACnB,MAAM;CACR,CAAC;CAED,QAAQ,IAAI,KAAK,OAAO;CAExB,OAAO;AACT"}

package/esm/http/createHttpApplication.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/http/createHttpApplication.d.ts
+//#region ../../packages/core/src/http/createHttpApplication.d.ts
 declare function createHttpApplication(): Promise<void>;
 declare function stopHttpApplication(): Promise<void>;
 //#endregion

package/esm/http/createHttpApplication.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"createHttpApplication.d.mts","names":[],"sources":["../../../../../../../core/src/http/createHttpApplication.ts"],"mappings":";iBASsB,qBAAA,IAAqB,OAAA;AAAA,iBAmCrB,mBAAA,IAAmB,OAAA"}
+{"version":3,"file":"createHttpApplication.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"mappings":";iBASsB,qBAAA,IAAqB,OAAA;AAAA,iBAmCrB,mBAAA,IAAmB,OAAA"}

package/esm/http/createHttpApplication.mjs

@@ -8,7 +8,7 @@ import { getHttpServer, startHttpServer } from "./server.mjs";
 import config from "@mongez/config";
 import { log } from "@warlock.js/logger";
 
-//#region ../core/src/http/createHttpApplication.ts
+//#region ../../packages/core/src/http/createHttpApplication.ts
 async function createHttpApplication() {
 	validateCspConfigAtBoot();
 	const server = startHttpServer();

package/esm/http/createHttpApplication.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createHttpApplication.mjs","names":[],"sources":["../../../../../../../core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { validateCspConfigAtBoot } from \"./csp\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  // Fail loudly, before the server ever binds a port, when `http.csp` is\n  // enabled with a malformed directive — never silently repair it and never\n  // wait for the first request to discover it.\n  validateCspConfigAtBoot();\n\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,wBAAwB;CAI5C,wBAAwB;CAExB,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAU,OAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}
+{"version":3,"file":"createHttpApplication.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { validateCspConfigAtBoot } from \"./csp\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  // Fail loudly, before the server ever binds a port, when `http.csp` is\n  // enabled with a malformed directive — never silently repair it and never\n  // wait for the first request to discover it.\n  validateCspConfigAtBoot();\n\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,wBAAwB;CAI5C,wBAAwB;CAExB,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAU,OAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}

package/esm/http/csp.d.mts

@@ -1,7 +1,7 @@
 import { Response } from "./response.mjs";
 import { Request } from "./request.mjs";
 
-//#region ../core/src/http/csp.d.ts
+//#region ../../packages/core/src/http/csp.d.ts
 /**
  * App-facing `http.csp` configuration shape.
  *
@@ -71,6 +71,8 @@ declare const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>
 declare class InvalidCspDirectiveError extends Error {
   readonly directive: string;
   readonly value: string;
+  /** Stable Warlock error code; `warlock explain WL1004` prints the fix. */
+  readonly code = "WL1004";
   constructor(directive: string, value: string, reason: string);
 }
 /**

package/esm/http/csp.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csp.d.mts","names":[],"sources":["../../../../../../../core/src/http/csp.ts"],"mappings":";;;;;;AAwBA;;;;;;;;;AAyBqB;AASrB;;;;AAAoD;AAsBpD;;;KAxDY,SAAA;EAwDkC;;;;EAnD5C,OAAA;EAsDkB;;;AACF;AAkBlB;;;;AAAsF;EA/DpF,UAAA;EA2F8B;;;AAAa;AAe7C;;;;AAAuC;EAhGrC,UAAA,GAAa,MAAM;AAAA;;;;;;;cASR,sBAAA,EAAwB,QAAQ,CAAC,MAAA;AA6GrC;AAqCT;;;;AAA2E;AAU3E;;;;;;AA/CS,cAvFI,wBAAA,SAAiC,KAAK;EAAA,SAE/B,SAAA;EAAA,SACA,KAAA;cADA,SAAA,UACA,KAAA,UAChB,MAAA;AAAA;;;;;;;;iBAkBY,qBAAA,CAAsB,UAAgD,EAApC,MAAM;;;;iBA4BxC,gBAAA,IAAoB,SAAS;;;;;;;;;;;;iBAe7B,uBAAA;;;;;;;;;;;;iBAmBA,kBAAA,CACd,aAAA,EAAe,MAAA,gCACf,KAAA,WACC,MAAM;;;;;iBAqCO,sBAAA,CAAuB,UAAoC,EAAxB,MAAM;;;;;iBAUzC,mBAAA,CAAoB,SAAA,EAAW,SAAS,EAAE,KAAA;;;;;;;;;;;;;;;iBAkB1C,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,QAAQ"}
+{"version":3,"file":"csp.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"mappings":";;;;;;AAwBA;;;;;;;;;AAyBqB;AASrB;;;;AAAoD;AAsBpD;;;KAxDY,SAAA;EAwDkC;;;;EAnD5C,OAAA;EAwDkB;;;;AAEF;AAkBlB;;;;EAlEE,UAAA;EA8Fc;;;;AAA6B;AAe7C;;;;EAnGE,UAAA,GAAa,MAAM;AAAA;;;;;;;cASR,sBAAA,EAAwB,QAAQ,CAAC,MAAA;;AAgHrC;AAmCT;;;;AAA2E;AAU3E;;;;;cAvIa,wBAAA,SAAiC,KAAK;EAAA,SAK/B,SAAA;EAAA,SACA,KAAA;EAiImD;EAAA,SArIrD,IAAA;cAGE,SAAA,UACA,KAAA,UAChB,MAAA;AAAA;;;;;;;AAkJ+D;iBAhInD,qBAAA,CAAsB,UAAgD,EAApC,MAAM;;;;iBA4BxC,gBAAA,IAAoB,SAAS;;;;;;;;;;;;iBAe7B,uBAAA;;;;;;;;;;;;iBAmBA,kBAAA,CACd,aAAA,EAAe,MAAA,gCACf,KAAA,WACC,MAAM;;;;;iBAmCO,sBAAA,CAAuB,UAAoC,EAAxB,MAAM;;;;;iBAUzC,mBAAA,CAAoB,SAAA,EAAW,SAAS,EAAE,KAAA;;;;;;;;;;;;;;;iBAkB1C,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,QAAQ"}

package/esm/http/csp.mjs

@@ -1,6 +1,6 @@
 import config from "@mongez/config";
 
-//#region ../core/src/http/csp.ts
+//#region ../../packages/core/src/http/csp.ts
 /**
 * The policy every `http.csp`-enabled app starts from. Deliberately
 * conservative — same-origin by default, no plugins, no framing by other
@@ -33,6 +33,7 @@ var InvalidCspDirectiveError = class extends Error {
 		super(`Invalid "http.csp.directives" entry — directive "${directive}" has a value ${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; the framework will not silently repair it.`);
 		this.directive = directive;
 		this.value = value;
+		this.code = "WL1004";
 		this.name = "InvalidCspDirectiveError";
 	}
 };

package/esm/http/csp.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csp.mjs","names":[],"sources":["../../../../../../../core/src/http/csp.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/**\n * App-facing `http.csp` configuration shape.\n *\n * Disabled by default: an app that never sets `http.csp` (or sets\n * `enabled: false`) gets no `Content-Security-Policy` header at all — zero\n * behaviour change for every existing app. Opting in only swaps `enabled` to\n * `true`; `reportOnly` and `directives` are optional refinements on top.\n *\n * @example\n * ```ts title=\"src/config/http.ts\"\n * const httpConfigurations: HttpConfigurations = {\n *   csp: {\n *     enabled: true,\n *     directives: {\n *       \"img-src\": [\"'self'\", \"data:\", \"https://cdn.example.com\"],\n *     },\n *   },\n * };\n * ```\n */\nexport type CspConfig = {\n  /**\n   * Turn the header on. Everything else in this type is inert while this is\n   * `false`/unset.\n   */\n  enabled: boolean;\n  /**\n   * Emit `Content-Security-Policy-Report-Only` instead of the enforcing\n   * `Content-Security-Policy` header — the browser reports violations\n   * (via `report-to`/`report-uri`, if the app's directives configure one)\n   * without blocking anything. Use this to observe a policy safely before\n   * enforcing it.\n   *\n   * @default false\n   */\n  reportOnly?: boolean;\n  /**\n   * App-supplied directive values. A directive named here REPLACES the\n   * framework's default list for that directive entirely (the two lists are\n   * never merged element-wise) — declare the full value list you want.\n   *\n   * `script-src` is special-cased regardless of whether it is declared here:\n   * the current request's CSP nonce (`'nonce-<value>'`) is always appended to\n   * it, so the framework's own inline/module scripts keep working.\n   */\n  directives?: Record<string, string[]>;\n};\n\n/**\n * The policy every `http.csp`-enabled app starts from. Deliberately\n * conservative — same-origin by default, no plugins, no framing by other\n * sites — and documented here rather than only in the skill, since this is\n * the literal set an app's `directives` entry replaces one key at a time.\n */\nexport const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>> = {\n  \"default-src\": [\"'self'\"],\n  \"script-src\": [\"'self'\"],\n  \"style-src\": [\"'self'\"],\n  \"img-src\": [\"'self'\", \"data:\"],\n  \"object-src\": [\"'none'\"],\n  \"base-uri\": [\"'self'\"],\n  \"frame-ancestors\": [\"'self'\"],\n};\n\n/**\n * Thrown at boot when `http.csp.directives` contains a value the framework\n * refuses to ship as-is, rather than silently dropping or rewriting it.\n *\n * Two shapes are rejected:\n * - a value containing `;` — CSP directives are `;`-delimited, so a `;`\n *   inside one value would prematurely close it and let the remainder be\n *   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.\n * - a value with an odd number of `'` characters — every CSP keyword\n *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an\n *   unbalanced count means a keyword was truncated or malformed.\n */\nexport class InvalidCspDirectiveError extends Error {\n  public constructor(\n    public readonly directive: string,\n    public readonly value: string,\n    reason: string,\n  ) {\n    super(\n      `Invalid \"http.csp.directives\" entry — directive \"${directive}\" has a value ` +\n        `${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; ` +\n        `the framework will not silently repair it.`,\n    );\n    this.name = \"InvalidCspDirectiveError\";\n  }\n}\n\n/**\n * Validate every directive value an app supplied, throwing\n * {@link InvalidCspDirectiveError} on the first offender.\n *\n * Exported so boot code and tests can call it directly, independent of\n * whether `http.csp` happens to be enabled.\n */\nexport function validateCspDirectives(directives: Record<string, string[]> | undefined): void {\n  if (!directives) return;\n\n  for (const [directive, values] of Object.entries(directives)) {\n    for (const value of values) {\n      if (value.includes(\";\")) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"contains a ';' character, which would truncate the directive.\",\n        );\n      }\n\n      const quoteCount = (value.match(/'/g) ?? []).length;\n      if (quoteCount % 2 !== 0) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"has an unbalanced number of ' characters.\",\n        );\n      }\n    }\n  }\n}\n\n/**\n * Read the app's `http.csp` config, if any.\n */\nexport function resolveCspConfig(): CspConfig | undefined {\n  return config.get(\"http.csp\");\n}\n\n/**\n * Fail the boot loudly when `http.csp` is enabled with invalid directives.\n *\n * Called once, from {@link createHttpApplication} before the server starts\n * listening — never per-request. A per-request validation would let an app\n * boot successfully and only discover the bad config on first traffic;\n * checking once at boot surfaces it immediately, the same way a malformed\n * `warlock.config.ts` would.\n *\n * @throws {InvalidCspDirectiveError} when a directive value is malformed.\n */\nexport function validateCspConfigAtBoot(): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  validateCspDirectives(cspConfig.directives);\n}\n\n/**\n * Merge the app's directives over the framework defaults and fold in the\n * request's nonce.\n *\n * Per-directive replacement, not element-wise merging: a directive the app\n * names wins outright, everything else falls back to\n * {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains\n * `'nonce-<nonce>'` on top, whichever list it started from, so the\n * framework's own inline payload script and hydration module script are\n * never blocked by an app's own policy.\n */\nexport function mergeCspDirectives(\n  appDirectives: Record<string, string[]> | undefined,\n  nonce: string,\n): Record<string, string[]> {\n  const merged: Record<string, string[]> = {};\n\n  for (const [directive, defaultValues] of Object.entries(DEFAULT_CSP_DIRECTIVES)) {\n    merged[directive] = appDirectives?.[directive]\n      ? [...appDirectives[directive]]\n      : [...defaultValues];\n  }\n\n  if (appDirectives) {\n    for (const [directive, values] of Object.entries(appDirectives)) {\n      if (!(directive in merged)) {\n        merged[directive] = [...values];\n      }\n    }\n  }\n\n  // `merged[\"script-src\"]` is always populated by the loop above —\n  // `DEFAULT_CSP_DIRECTIVES` (:59-67) declares a `script-src` entry, and every\n  // one of its keys is copied into `merged` unconditionally — but its type is\n  // `Record<string, string[]>`, so `noUncheckedIndexedAccess` still widens the\n  // read to `string[] | undefined`. Narrowed once, locally, rather than\n  // asserted away.\n  const scriptSrc = merged[\"script-src\"] ?? [];\n  const nonceSource = `'nonce-${nonce}'`;\n\n  merged[\"script-src\"] = scriptSrc.includes(nonceSource)\n    ? scriptSrc\n    : [...scriptSrc, nonceSource];\n\n  return merged;\n}\n\n/**\n * Serialize a merged directive map into a header value —\n * `\"default-src 'self'; script-src 'self' 'nonce-...'; ...\"`.\n */\nexport function serializeCspDirectives(directives: Record<string, string[]>): string {\n  return Object.entries(directives)\n    .map(([directive, values]) => `${directive} ${values.join(\" \")}`)\n    .join(\"; \");\n}\n\n/**\n * Build the full `Content-Security-Policy` (or `-Report-Only`) header value\n * for one request, using that request's own nonce.\n */\nexport function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string {\n  return serializeCspDirectives(mergeCspDirectives(cspConfig.directives, nonce));\n}\n\n/**\n * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,\n * `Content-Security-Policy-Report-Only`) header on the response, when the\n * app opted in via `http.csp.enabled`.\n *\n * A no-op when `http.csp` is absent or `enabled` is falsy — the default,\n * behaviour-preserving state for every app that hasn't opted in.\n *\n * Reads `request.nonce`, which lazily generates and caches the per-request\n * nonce (`request.ts`) — calling this early in the request lifecycle (see\n * `inject-request-context.ts`) means the SAME nonce this stamps into the\n * header is the one still available later for the web layer's `<script>`\n * tags to read off `request.nonce`.\n */\nexport function applyCspHeader(request: Request, response: Response): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  const headerName = cspConfig.reportOnly\n    ? \"Content-Security-Policy-Report-Only\"\n    : \"Content-Security-Policy\";\n\n  response.header(headerName, buildCspHeaderValue(cspConfig, request.nonce));\n}\n"],"mappings":";;;;;;;;;AA0DA,MAAa,yBAAsE;CACjF,eAAe,CAAC,QAAQ;CACxB,cAAc,CAAC,QAAQ;CACvB,aAAa,CAAC,QAAQ;CACtB,WAAW,CAAC,UAAU,OAAO;CAC7B,cAAc,CAAC,QAAQ;CACvB,YAAY,CAAC,QAAQ;CACrB,mBAAmB,CAAC,QAAQ;AAC9B;;;;;;;;;;;;;AAcA,IAAa,2BAAb,cAA8C,MAAM;CAClD,AAAO,YACL,AAAgB,WAChB,AAAgB,OAChB,QACA;EACA,MACE,oDAAoD,UAAU,gBACzD,KAAK,UAAU,KAAK,EAAE,QAAQ,OAAO,qFAE5C;EARgB;EACA;EAQhB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,sBAAsB,YAAwD;CAC5F,IAAI,CAAC,YAAY;CAEjB,KAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,UAAU,GACzD,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,GAAG,GACpB,MAAM,IAAI,yBACR,WACA,OACA,+DACF;EAIF,KADoB,MAAM,MAAM,IAAI,KAAK,CAAC,EAAC,CAAE,SAC5B,MAAM,GACrB,MAAM,IAAI,yBACR,WACA,OACA,2CACF;CAEJ;AAEJ;;;;AAKA,SAAgB,mBAA0C;CACxD,OAAO,OAAO,IAAI,UAAU;AAC9B;;;;;;;;;;;;AAaA,SAAgB,0BAAgC;CAC9C,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,sBAAsB,UAAU,UAAU;AAC5C;;;;;;;;;;;;AAaA,SAAgB,mBACd,eACA,OAC0B;CAC1B,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,WAAW,kBAAkB,OAAO,QAAQ,sBAAsB,GAC5E,OAAO,aAAa,gBAAgB,aAChC,CAAC,GAAG,cAAc,UAAU,IAC5B,CAAC,GAAG,aAAa;CAGvB,IAAI,eACF;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,aAAa,GAC5D,IAAI,EAAE,aAAa,SACjB,OAAO,aAAa,CAAC,GAAG,MAAM;CAElC;CASF,MAAM,YAAY,OAAO,iBAAiB,CAAC;CAC3C,MAAM,cAAc,UAAU,MAAM;CAEpC,OAAO,gBAAgB,UAAU,SAAS,WAAW,IACjD,YACA,CAAC,GAAG,WAAW,WAAW;CAE9B,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,YAA8C;CACnF,OAAO,OAAO,QAAQ,UAAU,CAAC,CAC9B,KAAK,CAAC,WAAW,YAAY,GAAG,UAAU,GAAG,OAAO,KAAK,GAAG,GAAG,CAAC,CAChE,KAAK,IAAI;AACd;;;;;AAMA,SAAgB,oBAAoB,WAAsB,OAAuB;CAC/E,OAAO,uBAAuB,mBAAmB,UAAU,YAAY,KAAK,CAAC;AAC/E;;;;;;;;;;;;;;;AAgBA,SAAgB,eAAe,SAAkB,UAA0B;CACzE,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,MAAM,aAAa,UAAU,aACzB,wCACA;CAEJ,SAAS,OAAO,YAAY,oBAAoB,WAAW,QAAQ,KAAK,CAAC;AAC3E"}
+{"version":3,"file":"csp.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/**\n * App-facing `http.csp` configuration shape.\n *\n * Disabled by default: an app that never sets `http.csp` (or sets\n * `enabled: false`) gets no `Content-Security-Policy` header at all — zero\n * behaviour change for every existing app. Opting in only swaps `enabled` to\n * `true`; `reportOnly` and `directives` are optional refinements on top.\n *\n * @example\n * ```ts title=\"src/config/http.ts\"\n * const httpConfigurations: HttpConfigurations = {\n *   csp: {\n *     enabled: true,\n *     directives: {\n *       \"img-src\": [\"'self'\", \"data:\", \"https://cdn.example.com\"],\n *     },\n *   },\n * };\n * ```\n */\nexport type CspConfig = {\n  /**\n   * Turn the header on. Everything else in this type is inert while this is\n   * `false`/unset.\n   */\n  enabled: boolean;\n  /**\n   * Emit `Content-Security-Policy-Report-Only` instead of the enforcing\n   * `Content-Security-Policy` header — the browser reports violations\n   * (via `report-to`/`report-uri`, if the app's directives configure one)\n   * without blocking anything. Use this to observe a policy safely before\n   * enforcing it.\n   *\n   * @default false\n   */\n  reportOnly?: boolean;\n  /**\n   * App-supplied directive values. A directive named here REPLACES the\n   * framework's default list for that directive entirely (the two lists are\n   * never merged element-wise) — declare the full value list you want.\n   *\n   * `script-src` is special-cased regardless of whether it is declared here:\n   * the current request's CSP nonce (`'nonce-<value>'`) is always appended to\n   * it, so the framework's own inline/module scripts keep working.\n   */\n  directives?: Record<string, string[]>;\n};\n\n/**\n * The policy every `http.csp`-enabled app starts from. Deliberately\n * conservative — same-origin by default, no plugins, no framing by other\n * sites — and documented here rather than only in the skill, since this is\n * the literal set an app's `directives` entry replaces one key at a time.\n */\nexport const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>> = {\n  \"default-src\": [\"'self'\"],\n  \"script-src\": [\"'self'\"],\n  \"style-src\": [\"'self'\"],\n  \"img-src\": [\"'self'\", \"data:\"],\n  \"object-src\": [\"'none'\"],\n  \"base-uri\": [\"'self'\"],\n  \"frame-ancestors\": [\"'self'\"],\n};\n\n/**\n * Thrown at boot when `http.csp.directives` contains a value the framework\n * refuses to ship as-is, rather than silently dropping or rewriting it.\n *\n * Two shapes are rejected:\n * - a value containing `;` — CSP directives are `;`-delimited, so a `;`\n *   inside one value would prematurely close it and let the remainder be\n *   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.\n * - a value with an odd number of `'` characters — every CSP keyword\n *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an\n *   unbalanced count means a keyword was truncated or malformed.\n */\nexport class InvalidCspDirectiveError extends Error {\n  /** Stable Warlock error code; `warlock explain WL1004` prints the fix. */\n  public readonly code = \"WL1004\";\n\n  public constructor(\n    public readonly directive: string,\n    public readonly value: string,\n    reason: string,\n  ) {\n    super(\n      `Invalid \"http.csp.directives\" entry — directive \"${directive}\" has a value ` +\n        `${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; ` +\n        `the framework will not silently repair it.`,\n    );\n    this.name = \"InvalidCspDirectiveError\";\n  }\n}\n\n/**\n * Validate every directive value an app supplied, throwing\n * {@link InvalidCspDirectiveError} on the first offender.\n *\n * Exported so boot code and tests can call it directly, independent of\n * whether `http.csp` happens to be enabled.\n */\nexport function validateCspDirectives(directives: Record<string, string[]> | undefined): void {\n  if (!directives) return;\n\n  for (const [directive, values] of Object.entries(directives)) {\n    for (const value of values) {\n      if (value.includes(\";\")) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"contains a ';' character, which would truncate the directive.\",\n        );\n      }\n\n      const quoteCount = (value.match(/'/g) ?? []).length;\n      if (quoteCount % 2 !== 0) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"has an unbalanced number of ' characters.\",\n        );\n      }\n    }\n  }\n}\n\n/**\n * Read the app's `http.csp` config, if any.\n */\nexport function resolveCspConfig(): CspConfig | undefined {\n  return config.get(\"http.csp\");\n}\n\n/**\n * Fail the boot loudly when `http.csp` is enabled with invalid directives.\n *\n * Called once, from {@link createHttpApplication} before the server starts\n * listening — never per-request. A per-request validation would let an app\n * boot successfully and only discover the bad config on first traffic;\n * checking once at boot surfaces it immediately, the same way a malformed\n * `warlock.config.ts` would.\n *\n * @throws {InvalidCspDirectiveError} when a directive value is malformed.\n */\nexport function validateCspConfigAtBoot(): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  validateCspDirectives(cspConfig.directives);\n}\n\n/**\n * Merge the app's directives over the framework defaults and fold in the\n * request's nonce.\n *\n * Per-directive replacement, not element-wise merging: a directive the app\n * names wins outright, everything else falls back to\n * {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains\n * `'nonce-<nonce>'` on top, whichever list it started from, so the\n * framework's own inline payload script and hydration module script are\n * never blocked by an app's own policy.\n */\nexport function mergeCspDirectives(\n  appDirectives: Record<string, string[]> | undefined,\n  nonce: string,\n): Record<string, string[]> {\n  const merged: Record<string, string[]> = {};\n\n  for (const [directive, defaultValues] of Object.entries(DEFAULT_CSP_DIRECTIVES)) {\n    merged[directive] = appDirectives?.[directive]\n      ? [...appDirectives[directive]]\n      : [...defaultValues];\n  }\n\n  if (appDirectives) {\n    for (const [directive, values] of Object.entries(appDirectives)) {\n      if (!(directive in merged)) {\n        merged[directive] = [...values];\n      }\n    }\n  }\n\n  // `merged[\"script-src\"]` is always populated by the loop above —\n  // `DEFAULT_CSP_DIRECTIVES` (:59-67) declares a `script-src` entry, and every\n  // one of its keys is copied into `merged` unconditionally — but its type is\n  // `Record<string, string[]>`, so `noUncheckedIndexedAccess` still widens the\n  // read to `string[] | undefined`. Narrowed once, locally, rather than\n  // asserted away.\n  const scriptSrc = merged[\"script-src\"] ?? [];\n  const nonceSource = `'nonce-${nonce}'`;\n\n  merged[\"script-src\"] = scriptSrc.includes(nonceSource) ? scriptSrc : [...scriptSrc, nonceSource];\n\n  return merged;\n}\n\n/**\n * Serialize a merged directive map into a header value —\n * `\"default-src 'self'; script-src 'self' 'nonce-...'; ...\"`.\n */\nexport function serializeCspDirectives(directives: Record<string, string[]>): string {\n  return Object.entries(directives)\n    .map(([directive, values]) => `${directive} ${values.join(\" \")}`)\n    .join(\"; \");\n}\n\n/**\n * Build the full `Content-Security-Policy` (or `-Report-Only`) header value\n * for one request, using that request's own nonce.\n */\nexport function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string {\n  return serializeCspDirectives(mergeCspDirectives(cspConfig.directives, nonce));\n}\n\n/**\n * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,\n * `Content-Security-Policy-Report-Only`) header on the response, when the\n * app opted in via `http.csp.enabled`.\n *\n * A no-op when `http.csp` is absent or `enabled` is falsy — the default,\n * behaviour-preserving state for every app that hasn't opted in.\n *\n * Reads `request.nonce`, which lazily generates and caches the per-request\n * nonce (`request.ts`) — calling this early in the request lifecycle (see\n * `inject-request-context.ts`) means the SAME nonce this stamps into the\n * header is the one still available later for the web layer's `<script>`\n * tags to read off `request.nonce`.\n */\nexport function applyCspHeader(request: Request, response: Response): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  const headerName = cspConfig.reportOnly\n    ? \"Content-Security-Policy-Report-Only\"\n    : \"Content-Security-Policy\";\n\n  response.header(headerName, buildCspHeaderValue(cspConfig, request.nonce));\n}\n"],"mappings":";;;;;;;;;AA0DA,MAAa,yBAAsE;CACjF,eAAe,CAAC,QAAQ;CACxB,cAAc,CAAC,QAAQ;CACvB,aAAa,CAAC,QAAQ;CACtB,WAAW,CAAC,UAAU,OAAO;CAC7B,cAAc,CAAC,QAAQ;CACvB,YAAY,CAAC,QAAQ;CACrB,mBAAmB,CAAC,QAAQ;AAC9B;;;;;;;;;;;;;AAcA,IAAa,2BAAb,cAA8C,MAAM;CAIlD,AAAO,YACL,AAAgB,WAChB,AAAgB,OAChB,QACA;EACA,MACE,oDAAoD,UAAU,gBACzD,KAAK,UAAU,KAAK,EAAE,QAAQ,OAAO,qFAE5C;EARgB;EACA;cAJK;EAYrB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,sBAAsB,YAAwD;CAC5F,IAAI,CAAC,YAAY;CAEjB,KAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,UAAU,GACzD,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,GAAG,GACpB,MAAM,IAAI,yBACR,WACA,OACA,+DACF;EAIF,KADoB,MAAM,MAAM,IAAI,KAAK,CAAC,EAAC,CAAE,SAC5B,MAAM,GACrB,MAAM,IAAI,yBACR,WACA,OACA,2CACF;CAEJ;AAEJ;;;;AAKA,SAAgB,mBAA0C;CACxD,OAAO,OAAO,IAAI,UAAU;AAC9B;;;;;;;;;;;;AAaA,SAAgB,0BAAgC;CAC9C,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,sBAAsB,UAAU,UAAU;AAC5C;;;;;;;;;;;;AAaA,SAAgB,mBACd,eACA,OAC0B;CAC1B,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,WAAW,kBAAkB,OAAO,QAAQ,sBAAsB,GAC5E,OAAO,aAAa,gBAAgB,aAChC,CAAC,GAAG,cAAc,UAAU,IAC5B,CAAC,GAAG,aAAa;CAGvB,IAAI,eACF;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,aAAa,GAC5D,IAAI,EAAE,aAAa,SACjB,OAAO,aAAa,CAAC,GAAG,MAAM;CAElC;CASF,MAAM,YAAY,OAAO,iBAAiB,CAAC;CAC3C,MAAM,cAAc,UAAU,MAAM;CAEpC,OAAO,gBAAgB,UAAU,SAAS,WAAW,IAAI,YAAY,CAAC,GAAG,WAAW,WAAW;CAE/F,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,YAA8C;CACnF,OAAO,OAAO,QAAQ,UAAU,CAAC,CAC9B,KAAK,CAAC,WAAW,YAAY,GAAG,UAAU,GAAG,OAAO,KAAK,GAAG,GAAG,CAAC,CAChE,KAAK,IAAI;AACd;;;;;AAMA,SAAgB,oBAAoB,WAAsB,OAAuB;CAC/E,OAAO,uBAAuB,mBAAmB,UAAU,YAAY,KAAK,CAAC;AAC/E;;;;;;;;;;;;;;;AAgBA,SAAgB,eAAe,SAAkB,UAA0B;CACzE,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,MAAM,aAAa,UAAU,aACzB,wCACA;CAEJ,SAAS,OAAO,YAAY,oBAAoB,WAAW,QAAQ,KAAK,CAAC;AAC3E"}

package/esm/http/csrf-default-guard.d.mts

@@ -1,7 +1,7 @@
 import { Response } from "./response.mjs";
 import { Request } from "./request.mjs";
 
-//#region ../core/src/http/csrf-default-guard.d.ts
+//#region ../../packages/core/src/http/csrf-default-guard.d.ts
 /**
  * Whether the current request is in scope for the default core CSRF-Origin
  * guard at all.

package/esm/http/csrf-default-guard.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-default-guard.d.mts","names":[],"sources":["../../../../../../../core/src/http/csrf-default-guard.ts"],"mappings":";;;;;;AAyIA;;iBAAgB,wBAAA,CAAyB,OAAgB,EAAP,OAAO;;AAAA;AA2BzD;;;;;;;;;;;;;;;;;iBAAsB,mBAAA,CACpB,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,SAAA,GAAY,GAAA,qBACZ,YAAA,GAAe,MAAA,oBACd,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"csrf-default-guard.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"mappings":";;;;;;AAyIA;;iBAAgB,wBAAA,CAAyB,OAAgB,EAAP,OAAO;;AAAA;AA2BzD;;;;;;;;;;;;;;;;;iBAAsB,mBAAA,CACpB,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,SAAA,GAAY,GAAA,qBACZ,YAAA,GAAe,MAAA,oBACd,OAAA,CAAQ,QAAA"}

package/esm/http/csrf-default-guard.mjs

@@ -2,7 +2,7 @@ import { LOCALE_COOKIE_NAME, LOCALE_PREFERENCE_COOKIE_NAME } from "../config/loc
 import { HttpErrorCodes } from "./error-codes.mjs";
 import { resolveCsrfOriginVerdict } from "./csrf-origin-policy.mjs";
 
-//#region ../core/src/http/csrf-default-guard.ts
+//#region ../../packages/core/src/http/csrf-default-guard.ts
 /**
 * The DEFAULT core CSRF-Origin guard — SECURITY, card 8a752ab2 (5.17), lead
 * ruling from Aria (`releases/v5.17-web-readiness-audit.md` §3.1, quoted):

package/esm/http/csrf-default-guard.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-default-guard.mjs","names":[],"sources":["../../../../../../../core/src/http/csrf-default-guard.ts"],"sourcesContent":["/**\n * The DEFAULT core CSRF-Origin guard — SECURITY, card 8a752ab2 (5.17), lead\n * ruling from Aria (`releases/v5.17-web-readiness-audit.md` §3.1, quoted):\n *\n * > \"Scope the default guard to unsafe browser requests carrying a\n * > non-locale credential-looking cookie (fail closed on unknown names), at\n * > an early core/auth HTTP seam before app handlers; give explicit,\n * > narrowly scoped route-level exemptions for third-party callbacks and\n * > machine-to-machine routes, documented as dangerous. Reuse current\n * > same-origin/allowedOrigins policy, trustProxy-aware own origin, and fail\n * > closed on missing Origin/Referer where in scope.\"\n *\n * Before this guard, the CSRF Origin check (`csrf-origin-policy.ts`, moved\n * here from `@warlock.js/auth` in this same change) only ran inside\n * `authMiddleware(\"cookie:*\")` — a cookie-authenticated write reaching any\n * OTHER path (an app-owned optional-auth pattern reading its own `token`\n * cookie without ever calling `authMiddleware`) was never checked at all.\n *\n * This guard closes that gap at the earliest seam common to EVERY request —\n * production (`Router.scan()`) and the dev wildcard dispatcher both funnel\n * into `Router[\"handleRoute\"]` → `request.execute()` →\n * `createRequestStore()` (`./middleware/inject-request-context.ts`), which is\n * where this is wired, BEFORE `request.runMiddleware()` runs the route's own\n * middleware (so it applies with or without `authMiddleware` on the route)\n * and before any app handler. It lives in `@warlock.js/core`, not\n * `@warlock.js/auth`, because `core` — not `auth` — is a dependency of every\n * Warlock app, so this is the only seam that reaches an app that never\n * installs `@warlock.js/auth` at all.\n *\n * Scope (mirrors `web`'s page-cache Cookie-header bypass rule,\n * `web/src/server/page-cache-cookie-bypass.ts`, card ad861076 — same\n * fail-closed strict-parse posture, independently reimplemented here because\n * `core` cannot depend on `web`, the dependency runs the other way):\n * - method is POST/PUT/PATCH/DELETE, AND\n * - the `Cookie` header carries any cookie other than the framework's own\n *   `locale` cookies (legacy plus the browser preference; a header that fails to parse cleanly counts as\n *   carrying one — fail closed), AND\n * - the route is not exempted via `{ csrf: false }` (`RouteOptions.csrf`,\n *   `../router/types.ts`) — a narrow, per-route, explicitly \"dangerous\" opt\n *   out for third-party callbacks and machine-to-machine routes.\n *\n * A header-only API request (`Authorization: Bearer …`, no `Cookie` header\n * at all) never reaches the cookie check above and is entirely unaffected.\n */\nimport { LOCALE_COOKIE_NAME, LOCALE_PREFERENCE_COOKIE_NAME } from \"../config/locale-configuration\";\nimport { HttpErrorCodes } from \"./error-codes\";\nimport { resolveCsrfOriginVerdict } from \"./csrf-origin-policy\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/** HTTP methods the default CSRF guard is scoped to — every unsafe method. */\nconst UNSAFE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Strictly parse a raw `Cookie` request header into a set of cookie names, or\n * `undefined` when the header does not parse cleanly.\n *\n * Deliberately NOT a lenient cookie parser that silently drops malformed\n * pairs and returns whatever it could salvage: a header this function cannot\n * fully account for must read as \"unknown cookies present\", never as \"the\n * pairs we understood, minus the ones we didn't\" — dropping a pair is how a\n * malformed header could otherwise be misread as carrying only the locale\n * cookie (or none) and wrongly skip the guard. Mirrors\n * `web/src/server/page-cache-cookie-bypass.ts`'s `parseCookieHeaderStrict`.\n *\n * Fails (`undefined`) on:\n * - an empty or whitespace-only header;\n * - any empty segment between/around `;`;\n * - any segment with no `=`, or an empty name.\n */\nfunction parseCookieNamesStrict(rawHeader: string): Set<string> | undefined {\n  if (rawHeader.trim() === \"\") return undefined;\n\n  const names = new Set<string>();\n\n  for (const segment of rawHeader.split(\";\")) {\n    const pair = segment.trim();\n\n    if (pair === \"\") return undefined;\n\n    const separatorIndex = pair.indexOf(\"=\");\n\n    if (separatorIndex <= 0) return undefined;\n\n    const name = pair.slice(0, separatorIndex).trim();\n\n    if (name === \"\") return undefined;\n\n    names.add(name);\n  }\n\n  return names;\n}\n\n/**\n * Whether the request carries a `Cookie` header naming anything other than\n * the framework's locale cookies.\n *\n * - No `Cookie` header at all ⇒ `false` — nothing to guard on.\n * - A header that fails to parse cleanly ⇒ `true` — fails CLOSED.\n * - A header whose parsed names are a non-empty set equal to exactly\n *   `{locale}` ⇒ `false` — the one exemption.\n * - Anything else (any other cookie name, alone or alongside `locale`) ⇒ `true`.\n */\nfunction carriesNonLocaleCookie(request: Request): boolean {\n  const rawCookieHeader = request.header(\"cookie\", undefined);\n\n  // Only an ABSENT header is cookie-free. A present header in any other\n  // shape (an array from a duplicated Cookie header) fails closed.\n  if (rawCookieHeader === undefined || rawCookieHeader === null) return false;\n\n  if (typeof rawCookieHeader !== \"string\") return true;\n\n  const names = parseCookieNamesStrict(rawCookieHeader);\n\n  if (names === undefined || names.size === 0) return true;\n\n  for (const name of names) {\n    if (name !== LOCALE_COOKIE_NAME && name !== LOCALE_PREFERENCE_COOKIE_NAME) return true;\n  }\n\n  return false;\n}\n\n/**\n * Whether the matched route opted out of the default CSRF guard via\n * `{ csrf: false }` (`RouteOptions.csrf`). Any other value — including\n * `undefined` — leaves the route in scope.\n */\nfunction isCsrfExempt(request: Request): boolean {\n  return request.route?.csrf === false;\n}\n\n/**\n * Whether the current request is in scope for the default core CSRF-Origin\n * guard at all.\n */\nexport function requiresDefaultCsrfGuard(request: Request): boolean {\n  if (!UNSAFE_METHODS.has(request.method.toUpperCase())) return false;\n\n  if (isCsrfExempt(request)) return false;\n\n  return carriesNonLocaleCookie(request);\n}\n\n/**\n * Run the default core CSRF-Origin guard for the current request.\n *\n * Returns `undefined` when the request is out of scope or passes the\n * Origin/Referer check — the caller continues into route middleware and the\n * handler as normal. Returns the 403 {@link Response} when the guard refuses\n * the request; the caller must return that value immediately, the same\n * short-circuit contract every other middleware in the chain follows.\n *\n * Uses the SAME translated message and client-visible error code\n * `authMiddleware(\"cookie:*\")`'s own CSRF-Origin check uses\n * (`auth.errors.csrfOriginMismatch`, `HttpErrorCodes.CsrfOriginMismatch` /\n * `AuthErrorCodes.CsrfOriginMismatch`, both `\"EC006\"`) — one message, one\n * error code, regardless of which seam caught the request. Logs exactly once\n * per rejection here; a route that also carries `authMiddleware(\"cookie:*\")`\n * never reaches that middleware's own check for a request THIS guard already\n * rejected, because a guard rejection short-circuits `runMiddleware()`\n * entirely — so a rejected request is never logged twice.\n */\nexport async function runDefaultCsrfGuard(\n  request: Request,\n  response: Response,\n  translate: (key: string) => string,\n  logRejection: (reason: string) => void,\n): Promise<Response | undefined> {\n  if (!requiresDefaultCsrfGuard(request)) return undefined;\n\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (verdict.allowed) return undefined;\n\n  logRejection(verdict.reason);\n\n  return response.forbidden({\n    error: translate(\"auth.errors.csrfOriginMismatch\"),\n    errorCode: HttpErrorCodes.CsrfOriginMismatch,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAM,iBAAiB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBjE,SAAS,uBAAuB,WAA4C;CAC1E,IAAI,UAAU,KAAK,MAAM,IAAI,OAAO;CAEpC,MAAM,wBAAQ,IAAI,IAAY;CAE9B,KAAK,MAAM,WAAW,UAAU,MAAM,GAAG,GAAG;EAC1C,MAAM,OAAO,QAAQ,KAAK;EAE1B,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,iBAAiB,KAAK,QAAQ,GAAG;EAEvC,IAAI,kBAAkB,GAAG,OAAO;EAEhC,MAAM,OAAO,KAAK,MAAM,GAAG,cAAc,CAAC,CAAC,KAAK;EAEhD,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,IAAI,IAAI;CAChB;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAS,uBAAuB,SAA2B;CACzD,MAAM,kBAAkB,QAAQ,OAAO,UAAU,MAAS;CAI1D,IAAI,oBAAoB,UAAa,oBAAoB,MAAM,OAAO;CAEtE,IAAI,OAAO,oBAAoB,UAAU,OAAO;CAEhD,MAAM,QAAQ,uBAAuB,eAAe;CAEpD,IAAI,UAAU,UAAa,MAAM,SAAS,GAAG,OAAO;CAEpD,KAAK,MAAM,QAAQ,OACjB,IAAI,qBAA+B,sCAAwC,OAAO;CAGpF,OAAO;AACT;;;;;;AAOA,SAAS,aAAa,SAA2B;CAC/C,OAAO,QAAQ,OAAO,SAAS;AACjC;;;;;AAMA,SAAgB,yBAAyB,SAA2B;CAClE,IAAI,CAAC,eAAe,IAAI,QAAQ,OAAO,YAAY,CAAC,GAAG,OAAO;CAE9D,IAAI,aAAa,OAAO,GAAG,OAAO;CAElC,OAAO,uBAAuB,OAAO;AACvC;;;;;;;;;;;;;;;;;;;;AAqBA,eAAsB,oBACpB,SACA,UACA,WACA,cAC+B;CAC/B,IAAI,CAAC,yBAAyB,OAAO,GAAG,OAAO;CAE/C,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,QAAQ,SAAS,OAAO;CAE5B,aAAa,QAAQ,MAAM;CAE3B,OAAO,SAAS,UAAU;EACxB,OAAO,UAAU,gCAAgC;EACjD;CACF,CAAC;AACH"}
+{"version":3,"file":"csrf-default-guard.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"sourcesContent":["/**\n * The DEFAULT core CSRF-Origin guard — SECURITY, card 8a752ab2 (5.17), lead\n * ruling from Aria (`releases/v5.17-web-readiness-audit.md` §3.1, quoted):\n *\n * > \"Scope the default guard to unsafe browser requests carrying a\n * > non-locale credential-looking cookie (fail closed on unknown names), at\n * > an early core/auth HTTP seam before app handlers; give explicit,\n * > narrowly scoped route-level exemptions for third-party callbacks and\n * > machine-to-machine routes, documented as dangerous. Reuse current\n * > same-origin/allowedOrigins policy, trustProxy-aware own origin, and fail\n * > closed on missing Origin/Referer where in scope.\"\n *\n * Before this guard, the CSRF Origin check (`csrf-origin-policy.ts`, moved\n * here from `@warlock.js/auth` in this same change) only ran inside\n * `authMiddleware(\"cookie:*\")` — a cookie-authenticated write reaching any\n * OTHER path (an app-owned optional-auth pattern reading its own `token`\n * cookie without ever calling `authMiddleware`) was never checked at all.\n *\n * This guard closes that gap at the earliest seam common to EVERY request —\n * production (`Router.scan()`) and the dev wildcard dispatcher both funnel\n * into `Router[\"handleRoute\"]` → `request.execute()` →\n * `createRequestStore()` (`./middleware/inject-request-context.ts`), which is\n * where this is wired, BEFORE `request.runMiddleware()` runs the route's own\n * middleware (so it applies with or without `authMiddleware` on the route)\n * and before any app handler. It lives in `@warlock.js/core`, not\n * `@warlock.js/auth`, because `core` — not `auth` — is a dependency of every\n * Warlock app, so this is the only seam that reaches an app that never\n * installs `@warlock.js/auth` at all.\n *\n * Scope (mirrors `web`'s page-cache Cookie-header bypass rule,\n * `web/src/server/page-cache-cookie-bypass.ts`, card ad861076 — same\n * fail-closed strict-parse posture, independently reimplemented here because\n * `core` cannot depend on `web`, the dependency runs the other way):\n * - method is POST/PUT/PATCH/DELETE, AND\n * - the `Cookie` header carries any cookie other than the framework's own\n *   `locale` cookies (legacy plus the browser preference; a header that fails to parse cleanly counts as\n *   carrying one — fail closed), AND\n * - the route is not exempted via `{ csrf: false }` (`RouteOptions.csrf`,\n *   `../router/types.ts`) — a narrow, per-route, explicitly \"dangerous\" opt\n *   out for third-party callbacks and machine-to-machine routes.\n *\n * A header-only API request (`Authorization: Bearer …`, no `Cookie` header\n * at all) never reaches the cookie check above and is entirely unaffected.\n */\nimport { LOCALE_COOKIE_NAME, LOCALE_PREFERENCE_COOKIE_NAME } from \"../config/locale-configuration\";\nimport { HttpErrorCodes } from \"./error-codes\";\nimport { resolveCsrfOriginVerdict } from \"./csrf-origin-policy\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/** HTTP methods the default CSRF guard is scoped to — every unsafe method. */\nconst UNSAFE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Strictly parse a raw `Cookie` request header into a set of cookie names, or\n * `undefined` when the header does not parse cleanly.\n *\n * Deliberately NOT a lenient cookie parser that silently drops malformed\n * pairs and returns whatever it could salvage: a header this function cannot\n * fully account for must read as \"unknown cookies present\", never as \"the\n * pairs we understood, minus the ones we didn't\" — dropping a pair is how a\n * malformed header could otherwise be misread as carrying only the locale\n * cookie (or none) and wrongly skip the guard. Mirrors\n * `web/src/server/page-cache-cookie-bypass.ts`'s `parseCookieHeaderStrict`.\n *\n * Fails (`undefined`) on:\n * - an empty or whitespace-only header;\n * - any empty segment between/around `;`;\n * - any segment with no `=`, or an empty name.\n */\nfunction parseCookieNamesStrict(rawHeader: string): Set<string> | undefined {\n  if (rawHeader.trim() === \"\") return undefined;\n\n  const names = new Set<string>();\n\n  for (const segment of rawHeader.split(\";\")) {\n    const pair = segment.trim();\n\n    if (pair === \"\") return undefined;\n\n    const separatorIndex = pair.indexOf(\"=\");\n\n    if (separatorIndex <= 0) return undefined;\n\n    const name = pair.slice(0, separatorIndex).trim();\n\n    if (name === \"\") return undefined;\n\n    names.add(name);\n  }\n\n  return names;\n}\n\n/**\n * Whether the request carries a `Cookie` header naming anything other than\n * the framework's locale cookies.\n *\n * - No `Cookie` header at all ⇒ `false` — nothing to guard on.\n * - A header that fails to parse cleanly ⇒ `true` — fails CLOSED.\n * - A header whose parsed names are a non-empty set equal to exactly\n *   `{locale}` ⇒ `false` — the one exemption.\n * - Anything else (any other cookie name, alone or alongside `locale`) ⇒ `true`.\n */\nfunction carriesNonLocaleCookie(request: Request): boolean {\n  const rawCookieHeader = request.header(\"cookie\", undefined);\n\n  // Only an ABSENT header is cookie-free. A present header in any other\n  // shape (an array from a duplicated Cookie header) fails closed.\n  if (rawCookieHeader === undefined || rawCookieHeader === null) return false;\n\n  if (typeof rawCookieHeader !== \"string\") return true;\n\n  const names = parseCookieNamesStrict(rawCookieHeader);\n\n  if (names === undefined || names.size === 0) return true;\n\n  for (const name of names) {\n    if (name !== LOCALE_COOKIE_NAME && name !== LOCALE_PREFERENCE_COOKIE_NAME) return true;\n  }\n\n  return false;\n}\n\n/**\n * Whether the matched route opted out of the default CSRF guard via\n * `{ csrf: false }` (`RouteOptions.csrf`). Any other value — including\n * `undefined` — leaves the route in scope.\n */\nfunction isCsrfExempt(request: Request): boolean {\n  return request.route?.csrf === false;\n}\n\n/**\n * Whether the current request is in scope for the default core CSRF-Origin\n * guard at all.\n */\nexport function requiresDefaultCsrfGuard(request: Request): boolean {\n  if (!UNSAFE_METHODS.has(request.method.toUpperCase())) return false;\n\n  if (isCsrfExempt(request)) return false;\n\n  return carriesNonLocaleCookie(request);\n}\n\n/**\n * Run the default core CSRF-Origin guard for the current request.\n *\n * Returns `undefined` when the request is out of scope or passes the\n * Origin/Referer check — the caller continues into route middleware and the\n * handler as normal. Returns the 403 {@link Response} when the guard refuses\n * the request; the caller must return that value immediately, the same\n * short-circuit contract every other middleware in the chain follows.\n *\n * Uses the SAME translated message and client-visible error code\n * `authMiddleware(\"cookie:*\")`'s own CSRF-Origin check uses\n * (`auth.errors.csrfOriginMismatch`, `HttpErrorCodes.CsrfOriginMismatch` /\n * `AuthErrorCodes.CsrfOriginMismatch`, both `\"EC006\"`) — one message, one\n * error code, regardless of which seam caught the request. Logs exactly once\n * per rejection here; a route that also carries `authMiddleware(\"cookie:*\")`\n * never reaches that middleware's own check for a request THIS guard already\n * rejected, because a guard rejection short-circuits `runMiddleware()`\n * entirely — so a rejected request is never logged twice.\n */\nexport async function runDefaultCsrfGuard(\n  request: Request,\n  response: Response,\n  translate: (key: string) => string,\n  logRejection: (reason: string) => void,\n): Promise<Response | undefined> {\n  if (!requiresDefaultCsrfGuard(request)) return undefined;\n\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (verdict.allowed) return undefined;\n\n  logRejection(verdict.reason);\n\n  return response.forbidden({\n    error: translate(\"auth.errors.csrfOriginMismatch\"),\n    errorCode: HttpErrorCodes.CsrfOriginMismatch,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAM,iBAAiB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBjE,SAAS,uBAAuB,WAA4C;CAC1E,IAAI,UAAU,KAAK,MAAM,IAAI,OAAO;CAEpC,MAAM,wBAAQ,IAAI,IAAY;CAE9B,KAAK,MAAM,WAAW,UAAU,MAAM,GAAG,GAAG;EAC1C,MAAM,OAAO,QAAQ,KAAK;EAE1B,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,iBAAiB,KAAK,QAAQ,GAAG;EAEvC,IAAI,kBAAkB,GAAG,OAAO;EAEhC,MAAM,OAAO,KAAK,MAAM,GAAG,cAAc,CAAC,CAAC,KAAK;EAEhD,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,IAAI,IAAI;CAChB;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAS,uBAAuB,SAA2B;CACzD,MAAM,kBAAkB,QAAQ,OAAO,UAAU,MAAS;CAI1D,IAAI,oBAAoB,UAAa,oBAAoB,MAAM,OAAO;CAEtE,IAAI,OAAO,oBAAoB,UAAU,OAAO;CAEhD,MAAM,QAAQ,uBAAuB,eAAe;CAEpD,IAAI,UAAU,UAAa,MAAM,SAAS,GAAG,OAAO;CAEpD,KAAK,MAAM,QAAQ,OACjB,IAAI,qBAA+B,sCAAwC,OAAO;CAGpF,OAAO;AACT;;;;;;AAOA,SAAS,aAAa,SAA2B;CAC/C,OAAO,QAAQ,OAAO,SAAS;AACjC;;;;;AAMA,SAAgB,yBAAyB,SAA2B;CAClE,IAAI,CAAC,eAAe,IAAI,QAAQ,OAAO,YAAY,CAAC,GAAG,OAAO;CAE9D,IAAI,aAAa,OAAO,GAAG,OAAO;CAElC,OAAO,uBAAuB,OAAO;AACvC;;;;;;;;;;;;;;;;;;;;AAqBA,eAAsB,oBACpB,SACA,UACA,WACA,cAC+B;CAC/B,IAAI,CAAC,yBAAyB,OAAO,GAAG,OAAO;CAE/C,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,QAAQ,SAAS,OAAO;CAE5B,aAAa,QAAQ,MAAM;CAE3B,OAAO,SAAS,UAAU;EACxB,OAAO,UAAU,gCAAgC;EACjD;CACF,CAAC;AACH"}

package/esm/http/csrf-origin-policy.d.mts

@@ -1,6 +1,6 @@
 import { Request } from "./request.mjs";
 
-//#region ../core/src/http/csrf-origin-policy.d.ts
+//#region ../../packages/core/src/http/csrf-origin-policy.d.ts
 /** Why {@link resolveCsrfOriginVerdict} refused a request. */
 type CsrfOriginCheckReason = "origin-mismatch" | "referer-mismatch" | "missing-origin-and-referer";
 /** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */

package/esm/http/csrf-origin-policy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-policy.d.mts","names":[],"sources":["../../../../../../../core/src/http/csrf-origin-policy.ts"],"mappings":";;;;KAyBY,qBAAA;AAAZ;AAAA,KAMY,iBAAA;EACN,OAAA;AAAA;EACA,OAAA;EAAgB,MAAA,EAAQ,qBAAqB;AAAA;;;;;;;;AAAA;AAgBnD;;;;AAA0C;AAgB1C;iBAhBgB,SAAA,CAAU,OAAgB,EAAP,OAAO;;iBAgB1B,QAAA,CAAS,MAAc;AAAA;AAgBvC;;;;AAA8C;AAhBP,iBAgBvB,eAAA,CAAgB,MAAc;;iBAc9B,mBAAA,CAAoB,MAAA,UAAgB,OAAA,EAAS,OAAO;;;;;;AAAA;AAqBpE;;;;;iBAAgB,wBAAA,CAAyB,OAAA,EAAS,OAAA,GAAU,iBAAiB"}
+{"version":3,"file":"csrf-origin-policy.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"mappings":";;;;KAyBY,qBAAA;AAAZ;AAAA,KAMY,iBAAA;EACN,OAAA;AAAA;EACA,OAAA;EAAgB,MAAA,EAAQ,qBAAqB;AAAA;;;;;;;;AAAA;AAgBnD;;;;AAA0C;AAgB1C;iBAhBgB,SAAA,CAAU,OAAgB,EAAP,OAAO;;iBAgB1B,QAAA,CAAS,MAAc;AAAA;AAgBvC;;;;AAA8C;AAhBP,iBAgBvB,eAAA,CAAgB,MAAc;;iBAc9B,mBAAA,CAAoB,MAAA,UAAgB,OAAA,EAAS,OAAO;;;;;;AAAA;AAqBpE;;;;;iBAAgB,wBAAA,CAAyB,OAAA,EAAS,OAAA,GAAU,iBAAiB"}

package/esm/http/csrf-origin-policy.mjs

@@ -1,6 +1,6 @@
 import config from "@mongez/config";
 
-//#region ../core/src/http/csrf-origin-policy.ts
+//#region ../../packages/core/src/http/csrf-origin-policy.ts
 /**
 * The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the
 * one comparison every CSRF-Origin check in the framework must agree on.