@warlock.js/core 5.29.0 → 5.31.0

package/esm/http/csrf-origin-policy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-policy.mjs","names":[],"sources":["../../../../../../../core/src/http/csrf-origin-policy.ts"],"sourcesContent":["/**\n * The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the\n * one comparison every CSRF-Origin check in the framework must agree on.\n *\n * SECURITY, card 8a752ab2 (5.17). Extracted from\n * `@warlock.js/auth`'s `csrf-origin-check.ts` (the ONLY prior owner of this\n * logic) into `@warlock.js/core` so both call sites — the\n * `authMiddleware(\"cookie:*\")` check in `@warlock.js/auth` and the default\n * core HTTP-seam guard in `./csrf-default-guard.ts` — share ONE\n * implementation instead of drifting copies. `@warlock.js/core` cannot depend\n * on `@warlock.js/auth` (the dependency runs the other way), so the shared\n * logic had to move down into `core`, not up into a new shared package —\n * `auth`'s `csrf-origin-check.ts` now delegates to\n * {@link resolveCsrfOriginVerdict} instead of reimplementing it.\n *\n * Reads `auth.csrf.allowedOrigins` directly via `@mongez/config` (the exact\n * same config key `@warlock.js/auth`'s `authConfig.csrf.allowedOrigins()`\n * reads) rather than importing `@warlock.js/auth`, so an app's one\n * `auth.csrf.allowedOrigins` setting governs both checks without `core`\n * taking a hard dependency on `auth`.\n */\nimport config from \"@mongez/config\";\nimport type { Request } from \"./request\";\n\n/** Why {@link resolveCsrfOriginVerdict} refused a request. */\nexport type CsrfOriginCheckReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */\nexport type CsrfOriginVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: CsrfOriginCheckReason };\n\n/**\n * The request's own origin — what an `Origin`/`Referer` header must match.\n *\n * `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never\n * carries a port. A browser's `Origin` header on a non-default port (e.g. any\n * `warlock dev` session) does, so the port must come from the raw `Host`\n * header instead — core exposes no getter for that, so it is read directly\n * here.\n *\n * Trust-proxy-aware for free: `request.protocol` is Fastify's own\n * `request.protocol`, which already honours `http.trustProxy`\n * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this\n * function does not need its own proxy-trust logic on top of that.\n */\nexport function ownOrigin(request: Request): string {\n  // Fastify's `host` keeps the port and honours `X-Forwarded-Host` under\n  // `trustProxy`, so a proxy that rewrites `Host` does not break the match.\n  const fastifyHost = request.baseRequest?.host;\n  const hostHeader = request.header(\"host\");\n  const host =\n    typeof fastifyHost === \"string\" && fastifyHost\n      ? fastifyHost\n      : typeof hostHeader === \"string\" && hostHeader\n        ? hostHeader\n        : request.hostname;\n\n  return `${request.protocol}://${host}`;\n}\n\n/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */\nexport function originOf(rawUrl: string): string | undefined {\n  try {\n    const url = new URL(rawUrl);\n\n    return `${url.protocol}//${url.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Normalize an origin string (`scheme://host[:port]`) so that a default port\n * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin\n * written without a port. Falls back to the raw value if it does not parse\n * as a URL (in which case it will simply fail the exact-match comparison).\n */\nexport function normalizeOrigin(origin: string): string {\n  try {\n    const url = new URL(origin);\n    const isDefaultPort =\n      (url.protocol === \"http:\" && (url.port === \"\" || url.port === \"80\")) ||\n      (url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\"));\n\n    return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;\n  } catch {\n    return origin;\n  }\n}\n\n/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */\nexport function isAllowedCsrfOrigin(origin: string, request: Request): boolean {\n  if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;\n\n  const allowedOrigins: string[] = config.get(\"auth.csrf.allowedOrigins\", []);\n\n  const normalized = normalizeOrigin(origin);\n\n  return allowedOrigins.some(allowed => normalizeOrigin(allowed) === normalized);\n}\n\n/**\n * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):\n * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the\n * request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused\n * otherwise, including when BOTH headers are absent (fail closed).\n *\n * Callers decide WHETHER a request is in scope for this check at all (a\n * cookie-sourced credential / a non-locale cookie, an unsafe method, no route\n * exemption) — this function only answers the Origin/Referer question once a\n * caller has already decided the check applies.\n */\nexport function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict {\n  const origin = request.origin;\n\n  if (origin) {\n    return isAllowedCsrfOrigin(origin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"origin-mismatch\" };\n  }\n\n  const referer = request.header(\"referer\");\n  const refererOrigin = typeof referer === \"string\" ? originOf(referer) : undefined;\n\n  if (refererOrigin) {\n    return isAllowedCsrfOrigin(refererOrigin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"referer-mismatch\" };\n  }\n\n  return { allowed: false, reason: \"missing-origin-and-referer\" };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,UAAU,SAA0B;CAGlD,MAAM,cAAc,QAAQ,aAAa;CACzC,MAAM,aAAa,QAAQ,OAAO,MAAM;CACxC,MAAM,OACJ,OAAO,gBAAgB,YAAY,cAC/B,cACA,OAAO,eAAe,YAAY,aAChC,aACA,QAAQ;CAEhB,OAAO,GAAG,QAAQ,SAAS,KAAK;AAClC;;AAGA,SAAgB,SAAS,QAAoC;CAC3D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAE1B,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAwB;CACtD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,MAAM,gBACH,IAAI,aAAa,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,SAC7D,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;EAEjE,OAAO,GAAG,IAAI,SAAS,IAAI,gBAAgB,IAAI,WAAW,IAAI;CAChE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,oBAAoB,QAAgB,SAA2B;CAC7E,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,OAAO;CAE5E,MAAM,iBAA2B,OAAO,IAAI,4BAA4B,CAAC,CAAC;CAE1E,MAAM,aAAa,gBAAgB,MAAM;CAEzC,OAAO,eAAe,MAAK,YAAW,gBAAgB,OAAO,MAAM,UAAU;AAC/E;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,SAAqC;CAC5E,MAAM,SAAS,QAAQ;CAEvB,IAAI,QACF,OAAO,oBAAoB,QAAQ,OAAO,IACtC,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAkB;CAGlD,MAAM,UAAU,QAAQ,OAAO,SAAS;CACxC,MAAM,gBAAgB,OAAO,YAAY,WAAW,SAAS,OAAO,IAAI;CAExE,IAAI,eACF,OAAO,oBAAoB,eAAe,OAAO,IAC7C,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAmB;CAGnD,OAAO;EAAE,SAAS;EAAO,QAAQ;CAA6B;AAChE"}
+{"version":3,"file":"csrf-origin-policy.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"sourcesContent":["/**\n * The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the\n * one comparison every CSRF-Origin check in the framework must agree on.\n *\n * SECURITY, card 8a752ab2 (5.17). Extracted from\n * `@warlock.js/auth`'s `csrf-origin-check.ts` (the ONLY prior owner of this\n * logic) into `@warlock.js/core` so both call sites — the\n * `authMiddleware(\"cookie:*\")` check in `@warlock.js/auth` and the default\n * core HTTP-seam guard in `./csrf-default-guard.ts` — share ONE\n * implementation instead of drifting copies. `@warlock.js/core` cannot depend\n * on `@warlock.js/auth` (the dependency runs the other way), so the shared\n * logic had to move down into `core`, not up into a new shared package —\n * `auth`'s `csrf-origin-check.ts` now delegates to\n * {@link resolveCsrfOriginVerdict} instead of reimplementing it.\n *\n * Reads `auth.csrf.allowedOrigins` directly via `@mongez/config` (the exact\n * same config key `@warlock.js/auth`'s `authConfig.csrf.allowedOrigins()`\n * reads) rather than importing `@warlock.js/auth`, so an app's one\n * `auth.csrf.allowedOrigins` setting governs both checks without `core`\n * taking a hard dependency on `auth`.\n */\nimport config from \"@mongez/config\";\nimport type { Request } from \"./request\";\n\n/** Why {@link resolveCsrfOriginVerdict} refused a request. */\nexport type CsrfOriginCheckReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */\nexport type CsrfOriginVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: CsrfOriginCheckReason };\n\n/**\n * The request's own origin — what an `Origin`/`Referer` header must match.\n *\n * `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never\n * carries a port. A browser's `Origin` header on a non-default port (e.g. any\n * `warlock dev` session) does, so the port must come from the raw `Host`\n * header instead — core exposes no getter for that, so it is read directly\n * here.\n *\n * Trust-proxy-aware for free: `request.protocol` is Fastify's own\n * `request.protocol`, which already honours `http.trustProxy`\n * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this\n * function does not need its own proxy-trust logic on top of that.\n */\nexport function ownOrigin(request: Request): string {\n  // Fastify's `host` keeps the port and honours `X-Forwarded-Host` under\n  // `trustProxy`, so a proxy that rewrites `Host` does not break the match.\n  const fastifyHost = request.baseRequest?.host;\n  const hostHeader = request.header(\"host\");\n  const host =\n    typeof fastifyHost === \"string\" && fastifyHost\n      ? fastifyHost\n      : typeof hostHeader === \"string\" && hostHeader\n        ? hostHeader\n        : request.hostname;\n\n  return `${request.protocol}://${host}`;\n}\n\n/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */\nexport function originOf(rawUrl: string): string | undefined {\n  try {\n    const url = new URL(rawUrl);\n\n    return `${url.protocol}//${url.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Normalize an origin string (`scheme://host[:port]`) so that a default port\n * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin\n * written without a port. Falls back to the raw value if it does not parse\n * as a URL (in which case it will simply fail the exact-match comparison).\n */\nexport function normalizeOrigin(origin: string): string {\n  try {\n    const url = new URL(origin);\n    const isDefaultPort =\n      (url.protocol === \"http:\" && (url.port === \"\" || url.port === \"80\")) ||\n      (url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\"));\n\n    return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;\n  } catch {\n    return origin;\n  }\n}\n\n/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */\nexport function isAllowedCsrfOrigin(origin: string, request: Request): boolean {\n  if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;\n\n  const allowedOrigins: string[] = config.get(\"auth.csrf.allowedOrigins\", []);\n\n  const normalized = normalizeOrigin(origin);\n\n  return allowedOrigins.some((allowed) => normalizeOrigin(allowed) === normalized);\n}\n\n/**\n * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):\n * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the\n * request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused\n * otherwise, including when BOTH headers are absent (fail closed).\n *\n * Callers decide WHETHER a request is in scope for this check at all (a\n * cookie-sourced credential / a non-locale cookie, an unsafe method, no route\n * exemption) — this function only answers the Origin/Referer question once a\n * caller has already decided the check applies.\n */\nexport function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict {\n  const origin = request.origin;\n\n  if (origin) {\n    return isAllowedCsrfOrigin(origin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"origin-mismatch\" };\n  }\n\n  const referer = request.header(\"referer\");\n  const refererOrigin = typeof referer === \"string\" ? originOf(referer) : undefined;\n\n  if (refererOrigin) {\n    return isAllowedCsrfOrigin(refererOrigin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"referer-mismatch\" };\n  }\n\n  return { allowed: false, reason: \"missing-origin-and-referer\" };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,UAAU,SAA0B;CAGlD,MAAM,cAAc,QAAQ,aAAa;CACzC,MAAM,aAAa,QAAQ,OAAO,MAAM;CACxC,MAAM,OACJ,OAAO,gBAAgB,YAAY,cAC/B,cACA,OAAO,eAAe,YAAY,aAChC,aACA,QAAQ;CAEhB,OAAO,GAAG,QAAQ,SAAS,KAAK;AAClC;;AAGA,SAAgB,SAAS,QAAoC;CAC3D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAE1B,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAwB;CACtD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,MAAM,gBACH,IAAI,aAAa,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,SAC7D,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;EAEjE,OAAO,GAAG,IAAI,SAAS,IAAI,gBAAgB,IAAI,WAAW,IAAI;CAChE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,oBAAoB,QAAgB,SAA2B;CAC7E,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,OAAO;CAE5E,MAAM,iBAA2B,OAAO,IAAI,4BAA4B,CAAC,CAAC;CAE1E,MAAM,aAAa,gBAAgB,MAAM;CAEzC,OAAO,eAAe,MAAM,YAAY,gBAAgB,OAAO,MAAM,UAAU;AACjF;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,SAAqC;CAC5E,MAAM,SAAS,QAAQ;CAEvB,IAAI,QACF,OAAO,oBAAoB,QAAQ,OAAO,IACtC,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAkB;CAGlD,MAAM,UAAU,QAAQ,OAAO,SAAS;CACxC,MAAM,gBAAgB,OAAO,YAAY,WAAW,SAAS,OAAO,IAAI;CAExE,IAAI,eACF,OAAO,oBAAoB,eAAe,OAAO,IAC7C,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAmB;CAGnD,OAAO;EAAE,SAAS;EAAO,QAAQ;CAA6B;AAChE"}

package/esm/http/database/RequestLog.d.mts

@@ -1,89 +1,35 @@
 import { Infer } from "@warlock.js/seal";
 import { Model } from "@warlock.js/cascade";
 
-//#region ../core/src/http/database/RequestLog.d.ts
+//#region ../../packages/core/src/http/database/RequestLog.d.ts
 declare const schema: import("@warlock.js/seal").ObjectValidator<{
   statusCode: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
   responseTime: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
   responseSize: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-  responseBody: import("@warlock.js/seal").RecordValidator & {
+  responseBody: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  responseHeaders: import("@warlock.js/seal").RecordValidator & {
+  };
+  responseHeaders: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
+  };
   ip: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   method: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   route: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  requestHeaders: import("@warlock.js/seal").RecordValidator & {
+  requestHeaders: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
+  };
   userAgent: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   referer: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  requestBody: import("@warlock.js/seal").RecordValidator & {
+  requestBody: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  requestParams: import("@warlock.js/seal").RecordValidator & {
+  };
+  requestParams: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  requestQuery: import("@warlock.js/seal").RecordValidator & {
+  };
+  requestQuery: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-}> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
-  statusCode: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-  responseTime: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-  responseSize: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-  responseBody: import("@warlock.js/seal").RecordValidator & {
-    valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  responseHeaders: import("@warlock.js/seal").RecordValidator & {
-    valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  ip: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  method: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  route: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  requestHeaders: import("@warlock.js/seal").RecordValidator & {
-    valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  userAgent: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  referer: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  requestBody: import("@warlock.js/seal").RecordValidator & {
-    valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  requestParams: import("@warlock.js/seal").RecordValidator & {
-    valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  requestQuery: import("@warlock.js/seal").RecordValidator & {
-    valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-}>, import("@warlock.js/seal").InferInputObjectShape<{
-  statusCode: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-  responseTime: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-  responseSize: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-  responseBody: import("@warlock.js/seal").RecordValidator & {
-    valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  responseHeaders: import("@warlock.js/seal").RecordValidator & {
-    valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  ip: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  method: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  route: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  requestHeaders: import("@warlock.js/seal").RecordValidator & {
-    valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  userAgent: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  referer: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  requestBody: import("@warlock.js/seal").RecordValidator & {
-    valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  requestParams: import("@warlock.js/seal").RecordValidator & {
-    valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  requestQuery: import("@warlock.js/seal").RecordValidator & {
-    valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-}>>;
+  };
+}>;
 type RequestLogSchema = Infer.Output<typeof schema>;
 declare class RequestLog extends Model<RequestLogSchema> {
   /**
@@ -97,84 +43,30 @@ declare class RequestLog extends Model<RequestLogSchema> {
     statusCode: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
     responseTime: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
     responseSize: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-    responseBody: import("@warlock.js/seal").RecordValidator & {
-      valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    responseHeaders: import("@warlock.js/seal").RecordValidator & {
-      valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    ip: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    method: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    route: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    requestHeaders: import("@warlock.js/seal").RecordValidator & {
-      valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    userAgent: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    referer: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    requestBody: import("@warlock.js/seal").RecordValidator & {
-      valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    requestParams: import("@warlock.js/seal").RecordValidator & {
-      valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    requestQuery: import("@warlock.js/seal").RecordValidator & {
-      valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  }> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
-    statusCode: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-    responseTime: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-    responseSize: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-    responseBody: import("@warlock.js/seal").RecordValidator & {
-      valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    responseHeaders: import("@warlock.js/seal").RecordValidator & {
-      valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    ip: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    method: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    route: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    requestHeaders: import("@warlock.js/seal").RecordValidator & {
-      valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    userAgent: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    referer: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    requestBody: import("@warlock.js/seal").RecordValidator & {
-      valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    requestParams: import("@warlock.js/seal").RecordValidator & {
-      valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    requestQuery: import("@warlock.js/seal").RecordValidator & {
-      valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  }>, import("@warlock.js/seal").InferInputObjectShape<{
-    statusCode: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-    responseTime: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-    responseSize: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-    responseBody: import("@warlock.js/seal").RecordValidator & {
+    responseBody: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    responseHeaders: import("@warlock.js/seal").RecordValidator & {
+    };
+    responseHeaders: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
+    };
     ip: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     method: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     route: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    requestHeaders: import("@warlock.js/seal").RecordValidator & {
+    requestHeaders: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
+    };
     userAgent: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     referer: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    requestBody: import("@warlock.js/seal").RecordValidator & {
+    requestBody: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    requestParams: import("@warlock.js/seal").RecordValidator & {
+    };
+    requestParams: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    requestQuery: import("@warlock.js/seal").RecordValidator & {
+    };
+    requestQuery: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  }>>;
+    };
+  }>;
 }
 //#endregion
 export { RequestLog };

package/esm/http/database/RequestLog.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"RequestLog.d.mts","names":[],"sources":["../../../../../../../../core/src/http/database/RequestLog.ts"],"mappings":";;;;cAGM,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiBP,gBAAA,GAAmB,KAAA,CAAM,MAAM,QAAQ,MAAA;AAAA,cAE/B,UAAA,SAAmB,KAAA,CAAM,gBAAA;;;;SAItB,KAAA;;;;SAKA,MAAA,6BAAM,eAAA"}
+{"version":3,"file":"RequestLog.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/database/RequestLog.ts"],"mappings":";;;;cAGM,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiBP,gBAAA,GAAmB,KAAA,CAAM,MAAM,QAAQ,MAAA;AAAA,cAE/B,UAAA,SAAmB,KAAA,CAAM,gBAAA;;;;SAItB,KAAA;;;;SAKA,MAAA,6BAAM,eAAA"}

package/esm/http/database/RequestLog.mjs

@@ -1,7 +1,7 @@
 import { v } from "@warlock.js/seal";
 import { Model } from "@warlock.js/cascade";
 
-//#region ../core/src/http/database/RequestLog.ts
+//#region ../../packages/core/src/http/database/RequestLog.ts
 const schema = v.object({
 	statusCode: v.number(),
 	responseTime: v.number(),

package/esm/http/database/RequestLog.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"RequestLog.mjs","names":[],"sources":["../../../../../../../../core/src/http/database/RequestLog.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { type Infer, v } from \"@warlock.js/seal\";\n\nconst schema = v.object({\n  statusCode: v.number(),\n  responseTime: v.number(),\n  responseSize: v.number(),\n  responseBody: v.record(v.any()),\n  responseHeaders: v.record(v.any()),\n  ip: v.string(),\n  method: v.string(),\n  route: v.string(),\n  requestHeaders: v.record(v.any()),\n  userAgent: v.string(),\n  referer: v.string(),\n  requestBody: v.record(v.any()),\n  requestParams: v.record(v.any()),\n  requestQuery: v.record(v.any()),\n});\n\ntype RequestLogSchema = Infer.Output<typeof schema>;\n\nexport class RequestLog extends Model<RequestLogSchema> {\n  /**\n   * {@inheritdoc}\n   */\n  public static table = \"request_logs\";\n\n  /**\n   * {@inheritdoc}\n   */\n  public static schema = schema;\n}\n"],"mappings":";;;;AAGA,MAAM,SAAS,EAAE,OAAO;CACtB,YAAY,EAAE,OAAO;CACrB,cAAc,EAAE,OAAO;CACvB,cAAc,EAAE,OAAO;CACvB,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;CAC9B,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC;CACjC,IAAI,EAAE,OAAO;CACb,QAAQ,EAAE,OAAO;CACjB,OAAO,EAAE,OAAO;CAChB,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC;CAChC,WAAW,EAAE,OAAO;CACpB,SAAS,EAAE,OAAO;CAClB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;CAC7B,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;CAC/B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAChC,CAAC;AAID,IAAa,aAAb,cAAgC,MAAwB;;eAIhC;;;gBAKC;;AACzB"}
+{"version":3,"file":"RequestLog.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/database/RequestLog.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { type Infer, v } from \"@warlock.js/seal\";\n\nconst schema = v.object({\n  statusCode: v.number(),\n  responseTime: v.number(),\n  responseSize: v.number(),\n  responseBody: v.record(v.any()),\n  responseHeaders: v.record(v.any()),\n  ip: v.string(),\n  method: v.string(),\n  route: v.string(),\n  requestHeaders: v.record(v.any()),\n  userAgent: v.string(),\n  referer: v.string(),\n  requestBody: v.record(v.any()),\n  requestParams: v.record(v.any()),\n  requestQuery: v.record(v.any()),\n});\n\ntype RequestLogSchema = Infer.Output<typeof schema>;\n\nexport class RequestLog extends Model<RequestLogSchema> {\n  /**\n   * {@inheritdoc}\n   */\n  public static table = \"request_logs\";\n\n  /**\n   * {@inheritdoc}\n   */\n  public static schema = schema;\n}\n"],"mappings":";;;;AAGA,MAAM,SAAS,EAAE,OAAO;CACtB,YAAY,EAAE,OAAO;CACrB,cAAc,EAAE,OAAO;CACvB,cAAc,EAAE,OAAO;CACvB,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;CAC9B,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC;CACjC,IAAI,EAAE,OAAO;CACb,QAAQ,EAAE,OAAO;CACjB,OAAO,EAAE,OAAO;CAChB,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC;CAChC,WAAW,EAAE,OAAO;CACpB,SAAS,EAAE,OAAO;CAClB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;CAC7B,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;CAC/B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAChC,CAAC;AAID,IAAa,aAAb,cAAgC,MAAwB;;eAIhC;;;gBAKC;;AACzB"}

package/esm/http/error-codes.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/http/error-codes.d.ts
+//#region ../../packages/core/src/http/error-codes.d.ts
 /**
  * HTTP middleware error codes.
  *

package/esm/http/error-codes.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.d.mts","names":[],"sources":["../../../../../../../core/src/http/error-codes.ts"],"mappings":";;AASA;;;;;;;;aAAY,cAAA;EA8BV;;;;EAzBA,sBAAA;;;;EAKA,qBAAA;;;;EAKA,iBAAA;;;;EAKA,uBAAA;;;;EAKA,YAAA;;;;EAKA,WAAA;;;;EAKA,WAAA;;;;;;;;;;;;;EAcA,kBAAA;AAAA"}
+{"version":3,"file":"error-codes.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/error-codes.ts"],"mappings":";;AASA;;;;;;;;aAAY,cAAA;EA8BV;;;;EAzBA,sBAAA;;;;EAKA,qBAAA;;;;EAKA,iBAAA;;;;EAKA,uBAAA;;;;EAKA,YAAA;;;;EAKA,WAAA;;;;EAKA,WAAA;;;;;;;;;;;;;EAcA,kBAAA;AAAA"}

package/esm/http/error-codes.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/error-codes.ts
+//#region ../../packages/core/src/http/error-codes.ts
 /**
 * HTTP middleware error codes.
 *

package/esm/http/error-codes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.mjs","names":[],"sources":["../../../../../../../core/src/http/error-codes.ts"],"sourcesContent":["/**\n * HTTP middleware error codes.\n *\n * Mirrors the convention used by `@warlock.js/auth`'s `AuthErrorCodes` —\n * stable string identifiers clients can branch on without parsing message text.\n *\n * Range `EC100..EC199` is reserved for `@warlock.js/core` HTTP middleware.\n * `EC001..EC099` belongs to `@warlock.js/auth`.\n */\nexport enum HttpErrorCodes {\n  /**\n   * Same idempotency key reused with a different request body.\n   * Client likely has a bug — same intent must reuse the same body.\n   */\n  IdempotencyKeyConflict = \"EC100\",\n\n  /**\n   * Idempotency key header is malformed (wrong length / non-printable chars).\n   */\n  IdempotencyKeyInvalid = \"EC101\",\n\n  /**\n   * Per-route rate limit exceeded. Different from the global `@fastify/rate-limit` 429.\n   */\n  RateLimitExceeded = \"EC102\",\n\n  /**\n   * Per-route concurrency cap reached — too many in-flight requests against this endpoint.\n   */\n  ConcurrencyLimitReached = \"EC103\",\n\n  /**\n   * Request `Content-Length` exceeds the per-route body cap.\n   */\n  BodyTooLarge = \"EC104\",\n\n  /**\n   * Client IP failed the `ipFilter()` allow/deny check.\n   */\n  IpForbidden = \"EC105\",\n\n  /**\n   * Application is in maintenance mode and the request did not match the allowlist.\n   */\n  Maintenance = \"EC106\",\n\n  /**\n   * Default core CSRF-Origin guard (SECURITY, card 8a752ab2, `./csrf-default-guard.ts`)\n   * refused an unsafe-method, cookie-carrying request whose `Origin`/`Referer`\n   * did not name the request's own origin or an entry in\n   * `auth.csrf.allowedOrigins`.\n   *\n   * Deliberately reuses `@warlock.js/auth`'s `AuthErrorCodes.CsrfOriginMismatch`\n   * value (`EC006`), NOT a fresh `EC1xx` core code: this is the exact same\n   * failure class `authMiddleware(\"cookie:*\")`'s own CSRF-Origin check\n   * reports — one client-visible identifier for \"CSRF Origin check failed\",\n   * regardless of which seam caught it.\n   */\n  CsrfOriginMismatch = \"EC006\",\n}\n"],"mappings":";;;;;;;;;;AASA,IAAY,iBAAL;;;;;CAKL;;;;CAKA;;;;CAKA;;;;CAKA;;;;CAKA;;;;CAKA;;;;CAKA;;;;;;;;;;;;;CAcA;;AACF"}
+{"version":3,"file":"error-codes.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/error-codes.ts"],"sourcesContent":["/**\n * HTTP middleware error codes.\n *\n * Mirrors the convention used by `@warlock.js/auth`'s `AuthErrorCodes` —\n * stable string identifiers clients can branch on without parsing message text.\n *\n * Range `EC100..EC199` is reserved for `@warlock.js/core` HTTP middleware.\n * `EC001..EC099` belongs to `@warlock.js/auth`.\n */\nexport enum HttpErrorCodes {\n  /**\n   * Same idempotency key reused with a different request body.\n   * Client likely has a bug — same intent must reuse the same body.\n   */\n  IdempotencyKeyConflict = \"EC100\",\n\n  /**\n   * Idempotency key header is malformed (wrong length / non-printable chars).\n   */\n  IdempotencyKeyInvalid = \"EC101\",\n\n  /**\n   * Per-route rate limit exceeded. Different from the global `@fastify/rate-limit` 429.\n   */\n  RateLimitExceeded = \"EC102\",\n\n  /**\n   * Per-route concurrency cap reached — too many in-flight requests against this endpoint.\n   */\n  ConcurrencyLimitReached = \"EC103\",\n\n  /**\n   * Request `Content-Length` exceeds the per-route body cap.\n   */\n  BodyTooLarge = \"EC104\",\n\n  /**\n   * Client IP failed the `ipFilter()` allow/deny check.\n   */\n  IpForbidden = \"EC105\",\n\n  /**\n   * Application is in maintenance mode and the request did not match the allowlist.\n   */\n  Maintenance = \"EC106\",\n\n  /**\n   * Default core CSRF-Origin guard (SECURITY, card 8a752ab2, `./csrf-default-guard.ts`)\n   * refused an unsafe-method, cookie-carrying request whose `Origin`/`Referer`\n   * did not name the request's own origin or an entry in\n   * `auth.csrf.allowedOrigins`.\n   *\n   * Deliberately reuses `@warlock.js/auth`'s `AuthErrorCodes.CsrfOriginMismatch`\n   * value (`EC006`), NOT a fresh `EC1xx` core code: this is the exact same\n   * failure class `authMiddleware(\"cookie:*\")`'s own CSRF-Origin check\n   * reports — one client-visible identifier for \"CSRF Origin check failed\",\n   * regardless of which seam caught it.\n   */\n  CsrfOriginMismatch = \"EC006\",\n}\n"],"mappings":";;;;;;;;;;AASA,IAAY,iBAAL;;;;;CAKL;;;;CAKA;;;;CAKA;;;;CAKA;;;;CAKA;;;;CAKA;;;;CAKA;;;;;;;;;;;;;CAcA;;AACF"}

package/esm/http/error-mapper.d.mts

@@ -0,0 +1,48 @@
+import { HttpError } from "./errors/errors.mjs";
+import { Request } from "./request.mjs";
+
+//#region ../../packages/core/src/http/error-mapper.d.ts
+/**
+ * What an {@link HttpErrorMapper} answers for an error it recognises.
+ */
+type HttpErrorMapping = {
+  /**
+   * The HTTP status to answer with.
+   */
+  status: number;
+  /**
+   * The message sent as `{ error }`. Defaults to the original error's message
+   * for a 4xx and to the opaque `"Internal server error."` for a 5xx, so a
+   * mapped server fault never echoes an internal message to the client.
+   */
+  message?: string;
+  /**
+   * Sent as `{ payload }`, like `HttpError.payload`.
+   */
+  payload?: unknown;
+};
+/**
+ * `http.errorMapper`: turns an error thrown by middleware or a handler into an
+ * HTTP answer. Lets domain errors that must also exist outside an HTTP process
+ * (a worker, a CLI, a standalone helper) carry a status without extending
+ * Core's `HttpError`.
+ *
+ * Called only for errors that are not already an `HttpError`. Return a
+ * mapping (or an `HttpError`) to answer with it, or `undefined` to keep the
+ * default handling (a model validation error keeps its configured status,
+ * anything else is an opaque 500).
+ *
+ * @example
+ * ```ts
+ * errorMapper(error) {
+ *   if (error instanceof DomainNotFoundError) return { status: 404 };
+ *   if (error instanceof Error && typeof (error as any).status === "number") {
+ *     return { status: (error as any).status };
+ *   }
+ * }
+ * ```
+ */
+type HttpErrorMapper = (error: unknown, request: Request<any>) => HttpErrorMapping | HttpError | null | undefined;
+//#endregion
+export { HttpErrorMapper, HttpErrorMapping };
+//# sourceMappingURL=error-mapper.d.mts.map

package/esm/http/error-mapper.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-mapper.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/error-mapper.ts"],"mappings":";;;;;;AAQA;KAAY,gBAAA;;;;EAIV,MAAA;EAUA;;AAAO;AAwBT;;EA5BE,OAAA;EA8BS;;;EA1BT,OAAA;AAAA;;;;;;;AA2B+B;;;;;;;;;;;;;;;KAHrB,eAAA,IACV,KAAA,WACA,OAAA,EAAS,OAAA,UACN,gBAAA,GAAmB,SAAA"}

package/esm/http/error-mapper.mjs

@@ -0,0 +1,48 @@
+import { HttpError } from "./errors/errors.mjs";
+import config from "@mongez/config";
+import { log } from "@warlock.js/logger";
+
+//#region ../../packages/core/src/http/error-mapper.ts
+const OPAQUE_SERVER_ERROR = "Internal server error.";
+/**
+* Run the configured `http.errorMapper` and normalise its answer to an
+* `HttpError`, or return the error unchanged when there is no mapper, the
+* error already is an `HttpError`, or the mapper declines it.
+*
+* The mapped `HttpError` keeps the original error's name and stack (for the
+* request log) and carries it as `cause`. A mapper that throws is a bug in the
+* app's mapper, not in the request: it is logged and the original error is
+* handled as if no mapper were configured.
+* @internal
+*/
+function mapRequestError(error, request) {
+	if (error instanceof HttpError) return error;
+	const mapper = config.get("http.errorMapper");
+	if (typeof mapper !== "function") return error;
+	let mapping;
+	try {
+		mapping = mapper(error, request);
+	} catch (mapperError) {
+		log.error("http", "error-mapper", mapperError, { requestId: request.id });
+		return error;
+	}
+	if (!mapping) return error;
+	if (mapping instanceof HttpError) return mapping;
+	if (!Number.isInteger(mapping.status) || mapping.status < 400 || mapping.status > 599) {
+		log.error("http", "error-mapper", /* @__PURE__ */ new Error(`http.errorMapper returned an invalid status: ${String(mapping.status)}`), { requestId: request.id });
+		return error;
+	}
+	const original = error instanceof Error ? error : void 0;
+	const message = mapping.message ?? (mapping.status < 500 && original ? original.message : OPAQUE_SERVER_ERROR);
+	const mapped = new HttpError(mapping.status, message, mapping.payload);
+	if (original) {
+		mapped.name = original.name;
+		mapped.stack = original.stack;
+		mapped.cause = original;
+	}
+	return mapped;
+}
+
+//#endregion
+export { mapRequestError };
+//# sourceMappingURL=error-mapper.mjs.map

package/esm/http/error-mapper.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-mapper.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/error-mapper.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { HttpError } from \"./errors\";\nimport type { Request } from \"./request\";\n\n/**\n * What an {@link HttpErrorMapper} answers for an error it recognises.\n */\nexport type HttpErrorMapping = {\n  /**\n   * The HTTP status to answer with.\n   */\n  status: number;\n  /**\n   * The message sent as `{ error }`. Defaults to the original error's message\n   * for a 4xx and to the opaque `\"Internal server error.\"` for a 5xx, so a\n   * mapped server fault never echoes an internal message to the client.\n   */\n  message?: string;\n  /**\n   * Sent as `{ payload }`, like `HttpError.payload`.\n   */\n  payload?: unknown;\n};\n\n/**\n * `http.errorMapper`: turns an error thrown by middleware or a handler into an\n * HTTP answer. Lets domain errors that must also exist outside an HTTP process\n * (a worker, a CLI, a standalone helper) carry a status without extending\n * Core's `HttpError`.\n *\n * Called only for errors that are not already an `HttpError`. Return a\n * mapping (or an `HttpError`) to answer with it, or `undefined` to keep the\n * default handling (a model validation error keeps its configured status,\n * anything else is an opaque 500).\n *\n * @example\n * ```ts\n * errorMapper(error) {\n *   if (error instanceof DomainNotFoundError) return { status: 404 };\n *   if (error instanceof Error && typeof (error as any).status === \"number\") {\n *     return { status: (error as any).status };\n *   }\n * }\n * ```\n */\nexport type HttpErrorMapper = (\n  error: unknown,\n  request: Request<any>,\n) => HttpErrorMapping | HttpError | null | undefined;\n\nconst OPAQUE_SERVER_ERROR = \"Internal server error.\";\n\n/**\n * Run the configured `http.errorMapper` and normalise its answer to an\n * `HttpError`, or return the error unchanged when there is no mapper, the\n * error already is an `HttpError`, or the mapper declines it.\n *\n * The mapped `HttpError` keeps the original error's name and stack (for the\n * request log) and carries it as `cause`. A mapper that throws is a bug in the\n * app's mapper, not in the request: it is logged and the original error is\n * handled as if no mapper were configured.\n * @internal\n */\nexport function mapRequestError(error: unknown, request: Request<any>): unknown {\n  if (error instanceof HttpError) {\n    return error;\n  }\n\n  const mapper = config.get(\"http.errorMapper\") as HttpErrorMapper | undefined;\n\n  if (typeof mapper !== \"function\") {\n    return error;\n  }\n\n  let mapping: ReturnType<HttpErrorMapper>;\n\n  try {\n    mapping = mapper(error, request);\n  } catch (mapperError) {\n    log.error(\"http\", \"error-mapper\", mapperError, { requestId: request.id });\n\n    return error;\n  }\n\n  if (!mapping) {\n    return error;\n  }\n\n  if (mapping instanceof HttpError) {\n    return mapping;\n  }\n\n  if (!Number.isInteger(mapping.status) || mapping.status < 400 || mapping.status > 599) {\n    log.error(\n      \"http\",\n      \"error-mapper\",\n      new Error(`http.errorMapper returned an invalid status: ${String(mapping.status)}`),\n      { requestId: request.id },\n    );\n\n    return error;\n  }\n\n  const original = error instanceof Error ? error : undefined;\n  const message =\n    mapping.message ?? (mapping.status < 500 && original ? original.message : OPAQUE_SERVER_ERROR);\n\n  const mapped = new HttpError(mapping.status, message, mapping.payload);\n\n  if (original) {\n    mapped.name = original.name;\n    mapped.stack = original.stack;\n    mapped.cause = original;\n  }\n\n  return mapped;\n}\n"],"mappings":";;;;;AAmDA,MAAM,sBAAsB;;;;;;;;;;;;AAa5B,SAAgB,gBAAgB,OAAgB,SAAgC;CAC9E,IAAI,iBAAiB,WACnB,OAAO;CAGT,MAAM,SAAS,OAAO,IAAI,kBAAkB;CAE5C,IAAI,OAAO,WAAW,YACpB,OAAO;CAGT,IAAI;CAEJ,IAAI;EACF,UAAU,OAAO,OAAO,OAAO;CACjC,SAAS,aAAa;EACpB,IAAI,MAAM,QAAQ,gBAAgB,aAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;EAExE,OAAO;CACT;CAEA,IAAI,CAAC,SACH,OAAO;CAGT,IAAI,mBAAmB,WACrB,OAAO;CAGT,IAAI,CAAC,OAAO,UAAU,QAAQ,MAAM,KAAK,QAAQ,SAAS,OAAO,QAAQ,SAAS,KAAK;EACrF,IAAI,MACF,QACA,gCACA,IAAI,MAAM,gDAAgD,OAAO,QAAQ,MAAM,GAAG,GAClF,EAAE,WAAW,QAAQ,GAAG,CAC1B;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,iBAAiB,QAAQ,QAAQ;CAClD,MAAM,UACJ,QAAQ,YAAY,QAAQ,SAAS,OAAO,WAAW,SAAS,UAAU;CAE5E,MAAM,SAAS,IAAI,UAAU,QAAQ,QAAQ,SAAS,QAAQ,OAAO;CAErE,IAAI,UAAU;EACZ,OAAO,OAAO,SAAS;EACvB,OAAO,QAAQ,SAAS;EACxB,OAAO,QAAQ;CACjB;CAEA,OAAO;AACT"}

package/esm/http/errors/errors.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/http/errors/errors.d.ts
+//#region ../../packages/core/src/http/errors/errors.d.ts
 declare class HttpError extends Error {
   status: number;
   message: string;
@@ -50,6 +50,8 @@ declare class NotAllowedError extends HttpError {
  * locale resolution) must not throw on a request that simply has no jar.
  */
 declare class CookieJarUnavailableError extends Error {
+  /** Stable Warlock error code; `warlock explain WL5001` prints the fix. */
+  readonly code = "WL5001";
   constructor(cookieName: string);
 }
 //#endregion

package/esm/http/errors/errors.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../../core/src/http/errors/errors.ts"],"mappings":";cAAa,SAAA,SAAkB,KAAK;EAEzB,MAAA;EACA,OAAA;EACA,OAAA;cAFA,MAAA,UACA,OAAA,UACA,OAAA;AAAA;AAAA,cAOE,qBAAA,SAA8B,SAAS;EAGzC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,iBAAA,SAA0B,SAAS;EAGrC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,cAAA,SAAuB,SAAS;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,WAAA,SAAoB,SAAS;EAG/B,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,aAAA,SAAsB,SAAS;EAGjC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,kBAAA,SAA2B,SAAS;EAGtC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;;;;;;;;;;AAlDa;AAOxB;;cA8Da,yBAAA,SAAkC,KAAK;cAC/B,UAAA;AAAA"}
+{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/errors/errors.ts"],"mappings":";cAAa,SAAA,SAAkB,KAAK;EAEzB,MAAA;EACA,OAAA;EACA,OAAA;cAFA,MAAA,UACA,OAAA,UACA,OAAA;AAAA;AAAA,cAOE,qBAAA,SAA8B,SAAS;EAGzC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,iBAAA,SAA0B,SAAS;EAGrC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,cAAA,SAAuB,SAAS;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,WAAA,SAAoB,SAAS;EAG/B,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,aAAA,SAAsB,SAAS;EAGjC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,kBAAA,SAA2B,SAAS;EAGtC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;;;;;;;;;;AAlDa;AAOxB;;cA8Da,yBAAA,SAAkC,KAAK;EA9DN;EAAA,SAgE5B,IAAA;cAEG,UAAA;AAAA"}

package/esm/http/errors/errors.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/errors/errors.ts
+//#region ../../packages/core/src/http/errors/errors.ts
 var HttpError = class extends Error {
 	constructor(status, message, payload) {
 		super(message);
@@ -79,6 +79,7 @@ var NotAllowedError = class extends HttpError {
 var CookieJarUnavailableError = class extends Error {
 	constructor(cookieName) {
 		super(`Cannot read cookie "${cookieName}": the cookie jar is unavailable because @fastify/cookie is not registered on this Fastify instance. Register the plugin (see core's http/plugins.ts) before reading cookies by name.`);
+		this.code = "WL5001";
 		this.name = "CookieJarUnavailableError";
 	}
 };

package/esm/http/errors/errors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../../../../../../../../core/src/http/errors/errors.ts"],"sourcesContent":["export class HttpError extends Error {\n  public constructor(\n    public status: number,\n    public message: string,\n    public payload?: any,\n  ) {\n    super(message);\n    this.name = \"HttpError\";\n  }\n}\n\nexport class ResourceNotFoundError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(404, message, payload);\n    this.name = \"ResourceNotFoundError\";\n  }\n}\n\nexport class UnAuthorizedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(401, message, payload);\n    this.name = \"UnAuthorizedError\";\n  }\n}\n\nexport class ForbiddenError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(403, message, payload);\n    this.name = \"ForbiddenError\";\n  }\n}\n\nexport class BadRequestError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(400, message, payload);\n    this.name = \"BadRequestError\";\n  }\n}\n\nexport class ServerError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(500, message, payload);\n    this.name = \"ServerError\";\n  }\n}\n\nexport class ConflictError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(409, message, payload);\n    this.name = \"ConflictError\";\n  }\n}\n\nexport class NotAcceptableError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(406, message, payload);\n    this.name = \"NotAcceptableError\";\n  }\n}\n\nexport class NotAllowedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(405, message, payload);\n    this.name = \"NotAllowedError\";\n  }\n}\n\n/**\n * Thrown by `Request.prototype.cookie` / `Request.prototype.hasCookie` when\n * `@fastify/cookie` was never registered on this Fastify instance, so\n * `baseRequest.cookies` is `undefined` rather than an (possibly empty) object.\n *\n * A by-name cookie read is a deliberate assertion by the caller — \"this\n * cookie should be readable here\" — so an unavailable jar is a configuration\n * fault, not an absent cookie, and must not be swallowed into a default\n * value or a silent `false`. Contrast `Request.prototype.cookies`, which\n * stays lenient because the framework's own opportunistic reads (e.g.\n * locale resolution) must not throw on a request that simply has no jar.\n */\nexport class CookieJarUnavailableError extends Error {\n  public constructor(cookieName: string) {\n    super(\n      `Cannot read cookie \"${cookieName}\": the cookie jar is unavailable because ` +\n        \"@fastify/cookie is not registered on this Fastify instance. \" +\n        \"Register the plugin (see core's http/plugins.ts) before reading cookies by name.\",\n    );\n\n    this.name = \"CookieJarUnavailableError\";\n  }\n}\n"],"mappings":";AAAA,IAAa,YAAb,cAA+B,MAAM;CACnC,AAAO,YACL,AAAO,QACP,AAAO,SACP,AAAO,SACP;EACA,MAAM,OAAO;EAJN;EACA;EACA;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,wBAAb,cAA2C,UAAU;CACnD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,UAAU;CAC5C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,cAAb,cAAiC,UAAU;CACzC,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,UAAU;CAC3C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;AAcA,IAAa,4BAAb,cAA+C,MAAM;CACnD,AAAO,YAAY,YAAoB;EACrC,MACE,uBAAuB,WAAW,sLAGpC;EAEA,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/errors/errors.ts"],"sourcesContent":["export class HttpError extends Error {\n  public constructor(\n    public status: number,\n    public message: string,\n    public payload?: any,\n  ) {\n    super(message);\n    this.name = \"HttpError\";\n  }\n}\n\nexport class ResourceNotFoundError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(404, message, payload);\n    this.name = \"ResourceNotFoundError\";\n  }\n}\n\nexport class UnAuthorizedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(401, message, payload);\n    this.name = \"UnAuthorizedError\";\n  }\n}\n\nexport class ForbiddenError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(403, message, payload);\n    this.name = \"ForbiddenError\";\n  }\n}\n\nexport class BadRequestError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(400, message, payload);\n    this.name = \"BadRequestError\";\n  }\n}\n\nexport class ServerError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(500, message, payload);\n    this.name = \"ServerError\";\n  }\n}\n\nexport class ConflictError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(409, message, payload);\n    this.name = \"ConflictError\";\n  }\n}\n\nexport class NotAcceptableError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(406, message, payload);\n    this.name = \"NotAcceptableError\";\n  }\n}\n\nexport class NotAllowedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(405, message, payload);\n    this.name = \"NotAllowedError\";\n  }\n}\n\n/**\n * Thrown by `Request.prototype.cookie` / `Request.prototype.hasCookie` when\n * `@fastify/cookie` was never registered on this Fastify instance, so\n * `baseRequest.cookies` is `undefined` rather than an (possibly empty) object.\n *\n * A by-name cookie read is a deliberate assertion by the caller — \"this\n * cookie should be readable here\" — so an unavailable jar is a configuration\n * fault, not an absent cookie, and must not be swallowed into a default\n * value or a silent `false`. Contrast `Request.prototype.cookies`, which\n * stays lenient because the framework's own opportunistic reads (e.g.\n * locale resolution) must not throw on a request that simply has no jar.\n */\nexport class CookieJarUnavailableError extends Error {\n  /** Stable Warlock error code; `warlock explain WL5001` prints the fix. */\n  public readonly code = \"WL5001\";\n\n  public constructor(cookieName: string) {\n    super(\n      `Cannot read cookie \"${cookieName}\": the cookie jar is unavailable because ` +\n        \"@fastify/cookie is not registered on this Fastify instance. \" +\n        \"Register the plugin (see core's http/plugins.ts) before reading cookies by name.\",\n    );\n\n    this.name = \"CookieJarUnavailableError\";\n  }\n}\n"],"mappings":";AAAA,IAAa,YAAb,cAA+B,MAAM;CACnC,AAAO,YACL,AAAO,QACP,AAAO,SACP,AAAO,SACP;EACA,MAAM,OAAO;EAJN;EACA;EACA;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,wBAAb,cAA2C,UAAU;CACnD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,UAAU;CAC5C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,cAAb,cAAiC,UAAU;CACzC,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,UAAU;CAC3C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;AAcA,IAAa,4BAAb,cAA+C,MAAM;CAInD,AAAO,YAAY,YAAoB;EACrC,MACE,uBAAuB,WAAW,sLAGpC;cAPqB;EASrB,KAAK,OAAO;CACd;AACF"}

package/esm/http/escape-header-value.d.mts

@@ -0,0 +1,18 @@
+//#region ../../packages/core/src/http/escape-header-value.d.ts
+/**
+ * Make any value safe to send as an HTTP header value: CR, LF, NUL and other
+ * control characters (except tab) are removed, so input cannot split the
+ * header or inject another one, characters outside ISO-8859-1 become `?`, and
+ * surrounding whitespace is trimmed.
+ *
+ * Node already refuses a header value with CR/LF, but by throwing — which
+ * turns a crafted value into a 500. Escape values built from request input or
+ * stored user data before `response.header()`:
+ *
+ * @example
+ * response.header("X-Export-Name", escapeHeaderValue(request.input("name")));
+ */
+declare function escapeHeaderValue(value: unknown): string;
+//#endregion
+export { escapeHeaderValue };
+//# sourceMappingURL=escape-header-value.d.mts.map

package/esm/http/escape-header-value.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape-header-value.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/escape-header-value.ts"],"mappings":";;AAsBA;;;;AAAgD;;;;;;;;iBAAhC,iBAAA,CAAkB,KAAc"}

package/esm/http/escape-header-value.mjs

@@ -0,0 +1,27 @@
+//#region ../../packages/core/src/http/escape-header-value.ts
+/**
+* Characters Node refuses in a header value (`ERR_INVALID_CHAR`): control
+* characters other than horizontal tab, and anything outside ISO-8859-1.
+*/
+const FORBIDDEN_CONTROL = /[\u0000-\u0008\u000a-\u001f\u007f]/g;
+const OUTSIDE_LATIN1 = /[\u{100}-\u{10ffff}]/gu;
+/**
+* Make any value safe to send as an HTTP header value: CR, LF, NUL and other
+* control characters (except tab) are removed, so input cannot split the
+* header or inject another one, characters outside ISO-8859-1 become `?`, and
+* surrounding whitespace is trimmed.
+*
+* Node already refuses a header value with CR/LF, but by throwing — which
+* turns a crafted value into a 500. Escape values built from request input or
+* stored user data before `response.header()`:
+*
+* @example
+* response.header("X-Export-Name", escapeHeaderValue(request.input("name")));
+*/
+function escapeHeaderValue(value) {
+	return (typeof value === "string" ? value : String(value)).replace(FORBIDDEN_CONTROL, "").replace(OUTSIDE_LATIN1, "?").trim();
+}
+
+//#endregion
+export { escapeHeaderValue };
+//# sourceMappingURL=escape-header-value.mjs.map

package/esm/http/escape-header-value.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape-header-value.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/escape-header-value.ts"],"sourcesContent":["/**\n * Characters Node refuses in a header value (`ERR_INVALID_CHAR`): control\n * characters other than horizontal tab, and anything outside ISO-8859-1.\n */\n// oxlint-disable-next-line eslint/no-control-regex -- removing control characters is the point.\nconst FORBIDDEN_CONTROL = /[\\u0000-\\u0008\\u000a-\\u001f\\u007f]/g;\n\nconst OUTSIDE_LATIN1 = /[\\u{100}-\\u{10ffff}]/gu;\n\n/**\n * Make any value safe to send as an HTTP header value: CR, LF, NUL and other\n * control characters (except tab) are removed, so input cannot split the\n * header or inject another one, characters outside ISO-8859-1 become `?`, and\n * surrounding whitespace is trimmed.\n *\n * Node already refuses a header value with CR/LF, but by throwing — which\n * turns a crafted value into a 500. Escape values built from request input or\n * stored user data before `response.header()`:\n *\n * @example\n * response.header(\"X-Export-Name\", escapeHeaderValue(request.input(\"name\")));\n */\nexport function escapeHeaderValue(value: unknown): string {\n  const text = typeof value === \"string\" ? value : String(value);\n\n  return text.replace(FORBIDDEN_CONTROL, \"\").replace(OUTSIDE_LATIN1, \"?\").trim();\n}\n"],"mappings":";;;;;AAKA,MAAM,oBAAoB;AAE1B,MAAM,iBAAiB;;;;;;;;;;;;;;AAevB,SAAgB,kBAAkB,OAAwB;CAGxD,QAFa,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK,EAElD,CAAC,QAAQ,mBAAmB,EAAE,CAAC,CAAC,QAAQ,gBAAgB,GAAG,CAAC,CAAC,KAAK;AAC/E"}

package/esm/http/events.d.mts

@@ -1,6 +1,6 @@
 import { Response } from "./response.mjs";
 
-//#region ../core/src/http/events.d.ts
+//#region ../../packages/core/src/http/events.d.ts
 declare function logResponse(response: Response): void;
 declare function wrapResponseInDataKey(response: Response): void;
 //#endregion

package/esm/http/events.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.mts","names":[],"sources":["../../../../../../../core/src/http/events.ts"],"mappings":";;;iBAGgB,WAAA,CAAY,QAAkB,EAAR,QAAQ;AAAA,iBAoB9B,qBAAA,CAAsB,QAAkB,EAAR,QAAQ"}
+{"version":3,"file":"events.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/events.ts"],"mappings":";;;iBAGgB,WAAA,CAAY,QAAkB,EAAR,QAAQ;AAAA,iBAoB9B,qBAAA,CAAsB,QAAkB,EAAR,QAAQ"}

package/esm/http/events.mjs

@@ -1,6 +1,6 @@
 import { RequestLog } from "./database/RequestLog.mjs";
 
-//#region ../core/src/http/events.ts
+//#region ../../packages/core/src/http/events.ts
 function logResponse(response) {
 	const request = response.request;
 	RequestLog.create({

package/esm/http/events.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"events.mjs","names":[],"sources":["../../../../../../../core/src/http/events.ts"],"sourcesContent":["import { RequestLog } from \"./database/RequestLog\";\nimport type { Response } from \"./response\";\n\nexport function logResponse(response: Response) {\n  const request = response.request;\n  RequestLog.create({\n    statusCode: response.statusCode,\n    responseTime: response.getResponseTime(),\n    responseSize: response.getHeader(\"Content-Length\"),\n    responseBody: response.body,\n    responseHeaders: response.getHeaders(),\n    ip: request.ip,\n    method: request.route.method,\n    route: request.route.path,\n    requestHeaders: request.headers,\n    userAgent: request.userAgent,\n    referer: request.referer,\n    // requestBody: request.bodyInputs,\n    requestParams: request.params,\n    requestQuery: request.query,\n  });\n}\n\nexport function wrapResponseInDataKey(response: Response) {\n  if (typeof response.body === \"string\") return;\n\n  if (response.body) {\n    response.body = { data: response.body };\n  }\n}\n"],"mappings":";;;AAGA,SAAgB,YAAY,UAAoB;CAC9C,MAAM,UAAU,SAAS;CACzB,WAAW,OAAO;EAChB,YAAY,SAAS;EACrB,cAAc,SAAS,gBAAgB;EACvC,cAAc,SAAS,UAAU,gBAAgB;EACjD,cAAc,SAAS;EACvB,iBAAiB,SAAS,WAAW;EACrC,IAAI,QAAQ;EACZ,QAAQ,QAAQ,MAAM;EACtB,OAAO,QAAQ,MAAM;EACrB,gBAAgB,QAAQ;EACxB,WAAW,QAAQ;EACnB,SAAS,QAAQ;EAEjB,eAAe,QAAQ;EACvB,cAAc,QAAQ;CACxB,CAAC;AACH;AAEA,SAAgB,sBAAsB,UAAoB;CACxD,IAAI,OAAO,SAAS,SAAS,UAAU;CAEvC,IAAI,SAAS,MACX,SAAS,OAAO,EAAE,MAAM,SAAS,KAAK;AAE1C"}
+{"version":3,"file":"events.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/events.ts"],"sourcesContent":["import { RequestLog } from \"./database/RequestLog\";\nimport type { Response } from \"./response\";\n\nexport function logResponse(response: Response) {\n  const request = response.request;\n  RequestLog.create({\n    statusCode: response.statusCode,\n    responseTime: response.getResponseTime(),\n    responseSize: response.getHeader(\"Content-Length\"),\n    responseBody: response.body,\n    responseHeaders: response.getHeaders(),\n    ip: request.ip,\n    method: request.route.method,\n    route: request.route.path,\n    requestHeaders: request.headers,\n    userAgent: request.userAgent,\n    referer: request.referer,\n    // requestBody: request.bodyInputs,\n    requestParams: request.params,\n    requestQuery: request.query,\n  });\n}\n\nexport function wrapResponseInDataKey(response: Response) {\n  if (typeof response.body === \"string\") return;\n\n  if (response.body) {\n    response.body = { data: response.body };\n  }\n}\n"],"mappings":";;;AAGA,SAAgB,YAAY,UAAoB;CAC9C,MAAM,UAAU,SAAS;CACzB,WAAW,OAAO;EAChB,YAAY,SAAS;EACrB,cAAc,SAAS,gBAAgB;EACvC,cAAc,SAAS,UAAU,gBAAgB;EACjD,cAAc,SAAS;EACvB,iBAAiB,SAAS,WAAW;EACrC,IAAI,QAAQ;EACZ,QAAQ,QAAQ,MAAM;EACtB,OAAO,QAAQ,MAAM;EACrB,gBAAgB,QAAQ;EACxB,WAAW,QAAQ;EACnB,SAAS,QAAQ;EAEjB,eAAe,QAAQ;EACvB,cAAc,QAAQ;CACxB,CAAC;AACH;AAEA,SAAgB,sBAAsB,UAAoB;CACxD,IAAI,OAAO,SAAS,SAAS,UAAU;CAEvC,IAAI,SAAS,MACX,SAAS,OAAO,EAAE,MAAM,SAAS,KAAK;AAE1C"}

package/esm/http/flush-pending-cookies.mjs

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import path from "node:path";
 
-//#region ../core/src/http/flush-pending-cookies.ts
+//#region ../../packages/core/src/http/flush-pending-cookies.ts
 /** The installed `@fastify/cookie` version, or undefined when it can't be resolved. */
 function installedCookiePluginVersion() {
 	try {