@warlock.js/core 5.29.0 → 5.31.0

package/esm/http/middleware/inject-request-context.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;AA8CA;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;iBAqNK,CAAA,CAAE,OAAA,UAAiB,YAAA,GAAe,MAAM"}
+{"version":3,"file":"inject-request-context.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/inject-request-context.ts"],"mappings":";;;;;;;AA+CA;;;iBAAgB,kBAAA,CACd,OAAA,EAAS,OAAA,OACT,QAAA,EAAU,QAAA,GACT,OAAA,CAAQ,gBAAA;;;;iBAuNK,CAAA,CAAE,OAAA,UAAiB,YAAA,GAAe,MAAM"}

package/esm/http/middleware/inject-request-context.mjs

@@ -4,6 +4,7 @@ import "../../utils/index.mjs";
 import { applyCspHeader } from "../csp.mjs";
 import { runDefaultCsrfGuard } from "../csrf-default-guard.mjs";
 import { HttpError } from "../errors/errors.mjs";
+import { mapRequestError } from "../error-mapper.mjs";
 import { buildTracingContext, dispatchPhase, isTracingEnabled } from "../tracing/tracing-dispatcher.mjs";
 import "../tracing/index.mjs";
 import config from "@mongez/config";
@@ -12,7 +13,7 @@ import { DatabaseWriterValidationError } from "@warlock.js/cascade";
 import { contextManager } from "@warlock.js/context";
 import { log } from "@warlock.js/logger";
 
-//#region ../core/src/http/middleware/inject-request-context.ts
+//#region ../../packages/core/src/http/middleware/inject-request-context.ts
 /**
 * Request Context Middleware
 *
@@ -68,7 +69,8 @@ function createRequestStore(request, response) {
 			request.log("Handler Executed Successfully", "success");
 			request.trigger("executedAction", request.route);
 			return output;
-		} catch (error) {
+		} catch (thrown) {
+			const error = mapRequestError(thrown, request);
 			logRequestError(error, request);
 			return handleRequestError(error, response, request);
 		}

package/esm/http/middleware/inject-request-context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\n * Request Context Middleware\n *\n * Creates a unified context for each request using the ContextManager.\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\n */\nimport { trans } from \"@mongez/localization\";\nimport { type GenericObject } from \"@mongez/reinforcements\";\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\nimport { contextManager } from \"@warlock.js/context\";\nimport { log } from \"@warlock.js/logger\";\nimport config from \"@mongez/config\";\nimport { environment } from \"../../utils\";\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\nimport { applyCspHeader } from \"../csp\";\nimport { runDefaultCsrfGuard } from \"../csrf-default-guard\";\nimport { HttpError } from \"../errors\";\nimport { type Request } from \"../request\";\nimport { type Response } from \"../response\";\nimport { buildTracingContext, dispatchPhase, isTracingEnabled } from \"../tracing\";\nimport { type ReturnedResponse } from \"./../types\";\n\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\n\n/**\n * Echo `request.id` back as a response header so the FE / proxies / log\n * aggregators can correlate by the same value the server logs against.\n *\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\n * Skip when `http.requestId.enabled` is explicitly false.\n */\nfunction stampRequestIdHeader(request: Request, response: Response) {\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\n\n  if (requestIdConfig.enabled === false) return;\n\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\n\n  response.header(headerName, request.id);\n}\n\n/**\n * Create request store and execute middleware + handler\n *\n * Runs all registered contexts together using ContextManager.\n */\nexport function createRequestStore(\n  request: Request<any>,\n  response: Response,\n): Promise<ReturnedResponse> {\n  stampRequestIdHeader(request, response);\n\n  // Stamped this early — before any middleware or handler runs — so the\n  // header carries the SAME nonce the web layer later reads off\n  // `request.nonce` for its `<script>` tags: `request.nonce` caches on first\n  // read, and this is deliberately the first read. A no-op when the app\n  // hasn't opted into `http.csp` (see `csp.ts`).\n  applyCspHeader(request, response);\n\n  // Build all context stores using the immutable API\n  // Each context defines its own store initialization via buildStore()\n  const httpContextStore = contextManager.buildStores({ request, response });\n\n  // Run all contexts together!\n  return contextManager.runAll(httpContextStore, async () => {\n    try {\n      // Default CSRF-Origin guard (SECURITY, card 8a752ab2) — the earliest\n      // seam common to every request, BEFORE the route's own middleware\n      // (`request.runMiddleware()` below) and before any app handler, so it\n      // applies even to a route that never attaches\n      // `authMiddleware(\"cookie:*\")`. See `../csrf-default-guard.ts` for the\n      // full scope rule and `{ csrf: false }` exemption.\n      const csrfGuardResponse = await runDefaultCsrfGuard(request, response, t, (reason) => {\n        log.error(\n          \"http\",\n          \"csrf-default-guard\",\n          new Error(`Default CSRF Origin guard refused request: ${reason}`),\n        );\n      });\n\n      if (csrfGuardResponse) {\n        return csrfGuardResponse as ReturnedResponse;\n      }\n\n      // Run middleware chain\n      const result = await request.runMiddleware();\n\n      if (result) {\n        return result as ReturnedResponse;\n      }\n\n      // Execute route handler\n      request.trigger(\"executingAction\", request.route);\n\n      const handler = request.getHandler();\n\n      request.log(\"Executing Handler\", \"info\");\n\n      const tracingEnabled = isTracingEnabled();\n      const handlerStartedAt = tracingEnabled ? performance.now() : 0;\n\n      const output = await handler({ request, response });\n\n      if (tracingEnabled) {\n        dispatchPhase(buildTracingContext(request), {\n          name: \"handler\",\n          durationMs: performance.now() - handlerStartedAt,\n        });\n      }\n\n      request.log(\"Handler Executed Successfully\", \"success\");\n\n      request.trigger(\"executedAction\", request.route);\n\n      return output as ReturnedResponse;\n    } catch (error) {\n      logRequestError(error, request);\n      return handleRequestError(error, response, request);\n    }\n  });\n}\n\n/**\n * The HTTP status an error will be answered with, or `undefined` when it is not\n * one of the known HTTP-answerable shapes (those fall through to the opaque 500).\n *\n * Single source for `handleRequestError` and the request logger, so the rule\n * that decides the response status is the same rule that decides the log level.\n * @internal\n */\nfunction resolveRequestErrorStatus(error: unknown): number | undefined {\n  if (error instanceof HttpError) {\n    return error.status;\n  }\n\n  if (error instanceof DatabaseWriterValidationError) {\n    return config.get(\"http.modelValidationErrorStatus\", 500);\n  }\n\n  return undefined;\n}\n\n/**\n * Log a request error at the right severity. An error answered with a 4xx is an\n * expected client error (a thrown 404/409/422): one `warn` line, no stack.\n * Everything else (5xx, unknown errors) keeps the error-level entry with its stack.\n * @internal\n */\nfunction logRequestError(error: unknown, request: Request<any>) {\n  const status = resolveRequestErrorStatus(error);\n\n  if (status !== undefined && status < 500 && error instanceof Error) {\n    request.log(`${error.name}: ${error.message} (${status})`, \"warn\");\n\n    return;\n  }\n\n  request.log(error, \"error\");\n}\n\n/**\n * Unconditional floor for an unhandled request error (canon 8d3c13a8): route it\n * through the logger, and when no logger channel is configured (nothing would\n * record it) fall back to `console.error` so the only copy is never lost.\n * @internal\n */\nfunction reportUnhandledRequestError(error: unknown, request: Request<any>) {\n  log.error(\"http\", \"unhandled-request-error\", error, { requestId: request.id });\n\n  if (log.channels.length === 0) {\n    console.error(`[http] unhandled-request-error (requestId: ${request.id})`, error);\n  }\n}\n\n/**\n * Handle request errors\n * @internal\n */\nfunction handleRequestError(\n  error: unknown,\n  response: Response,\n  request: Request<any>,\n): ReturnedResponse {\n  // Availability floor, not a cache-policy nit: `handleRequestError` is the\n  // single funnel every unhandled error in every Warlock app passes through\n  // (`createRequestStore`'s catch above), and none of the branches below set\n  // a `Cache-Control` header. Without this, an error response — a 500 as\n  // much as a 401/403/404 carrying per-request/-user state — can be stored\n  // by a shared cache or CDN and replayed to other requests/users long after\n  // the condition that caused it is gone: a cached 500 becomes an outage\n  // that outlives its cause; a cached 401/403 becomes a leak across users.\n  // Set once, here, before any branch runs — not per branch — because the\n  // branches below do not partition by status. `ResourceNotFoundError`,\n  // `UnAuthorizedError`, `ForbiddenError`, `BadRequestError` and `ServerError`\n  // all extend `HttpError`, so the `HttpError` branch answers for every one of\n  // them, and a raw `HttpError` can carry any caller-chosen status, 4xx or 5xx.\n  // Gating the floor on the eventual status would mean re-deriving that status\n  // per branch — one rule meeting one form while others reach the same output.\n  // Applying it once, unconditionally, is both simpler and safer.\n  response.header(\"Cache-Control\", \"private, no-store\");\n\n  if (error instanceof HttpError) {\n    // 5xx HttpErrors (e.g. `ServerError`) are server faults: send them to the\n    // logger channels too, tagged with the request id.\n    if (error.status >= 500) {\n      log.error(\"http\", \"request-error\", error, { requestId: request.id });\n    }\n\n    const payload: GenericObject = {\n      error: error.message,\n    };\n    if (error.payload) {\n      payload.payload = error.payload;\n    }\n\n    if (environment() === \"development\") {\n      payload.stack = error.stack;\n    }\n\n    return response.setStatusCode(error.status).send(payload);\n  }\n\n  if (error instanceof DatabaseWriterValidationError) {\n    const status = resolveRequestErrorStatus(error) as number;\n\n    // A 4xx is an expected client error, already logged as a one-line warn by\n    // `logRequestError`; only a 5xx gets the error-level entry with its stack.\n    if (status >= 500) {\n      log.error(\"http\", \"model-write-validation-error\", error, {\n        requestId: request.id,\n        errors: error.errors,\n      });\n    }\n\n    // A 4xx status means the app treats this as the client's fault, so the\n    // field errors are useful to it; a 5xx stays opaque.\n    if (status < 500) {\n      return response.setStatusCode(status).send({\n        errors: error.errors,\n      });\n    }\n\n    return response.setStatusCode(status).send({\n      error: \"Internal server error.\",\n    });\n  }\n\n  // Last resort: the error matched none of the known shapes above, so the\n  // client gets a deliberately opaque message. Without this line the error\n  // itself is discarded here — no stack, no message, nothing in any log — and\n  // an unrecognised failure becomes indistinguishable from a working server\n  // returning 500. Never swallow the only copy of an error (`65e476ee`).\n  reportUnhandledRequestError(error, request);\n\n  return response.serverError({\n    error: \"Internal server error.\",\n  });\n}\n\n/**\n * Translate a keyword (uses request context for locale)\n */\nexport function t(keyword: string, placeholders?: Record<string, unknown>): string {\n  return (\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\n    trans(keyword, placeholders)\n  );\n}\n\n// `fromRequest` was removed in v5. It cached computed values as dynamic\n// properties on the Request instance, which only compiled because of the\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\n// per-request lifetime, single-flight, and it never touches the Request object.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAOtC,eAAe,SAAS,QAAQ;CAIhC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAOF,MAAM,oBAAoB,MAAM,oBAAoB,SAAS,UAAU,IAAI,WAAW;IACpF,IAAI,MACF,QACA,sCACA,IAAI,MAAM,8CAA8C,QAAQ,CAClE;GACF,CAAC;GAED,IAAI,mBACF,OAAO;GAIT,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,iBAAiB,iBAAiB;GACxC,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,IAAI;GAE9D,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,IAAI,gBACF,cAAc,oBAAoB,OAAO,GAAG;IAC1C,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;GAClC,CAAC;GAGH,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,OAAO;GACd,gBAAgB,OAAO,OAAO;GAC9B,OAAO,mBAAmB,OAAO,UAAU,OAAO;EACpD;CACF,CAAC;AACH;;;;;;;;;AAUA,SAAS,0BAA0B,OAAoC;CACrE,IAAI,iBAAiB,WACnB,OAAO,MAAM;CAGf,IAAI,iBAAiB,+BACnB,OAAO,OAAO,IAAI,mCAAmC,GAAG;AAI5D;;;;;;;AAQA,SAAS,gBAAgB,OAAgB,SAAuB;CAC9D,MAAM,SAAS,0BAA0B,KAAK;CAE9C,IAAI,WAAW,UAAa,SAAS,OAAO,iBAAiB,OAAO;EAClE,QAAQ,IAAI,GAAG,MAAM,KAAK,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,MAAM;EAEjE;CACF;CAEA,QAAQ,IAAI,OAAO,OAAO;AAC5B;;;;;;;AAQA,SAAS,4BAA4B,OAAgB,SAAuB;CAC1E,IAAI,MAAM,QAAQ,2BAA2B,OAAO,EAAE,WAAW,QAAQ,GAAG,CAAC;CAE7E,IAAI,IAAI,SAAS,WAAW,GAC1B,QAAQ,MAAM,8CAA8C,QAAQ,GAAG,IAAI,KAAK;AAEpF;;;;;AAMA,SAAS,mBACP,OACA,UACA,SACkB;CAiBlB,SAAS,OAAO,iBAAiB,mBAAmB;CAEpD,IAAI,iBAAiB,WAAW;EAG9B,IAAI,MAAM,UAAU,KAClB,IAAI,MAAM,QAAQ,iBAAiB,OAAO,EAAE,WAAW,QAAQ,GAAG,CAAC;EAGrE,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,+BAA+B;EAClD,MAAM,SAAS,0BAA0B,KAAK;EAI9C,IAAI,UAAU,KACZ,IAAI,MAAM,QAAQ,gCAAgC,OAAO;GACvD,WAAW,QAAQ;GACnB,QAAQ,MAAM;EAChB,CAAC;EAKH,IAAI,SAAS,KACX,OAAO,SAAS,cAAc,MAAM,CAAC,CAAC,KAAK,EACzC,QAAQ,MAAM,OAChB,CAAC;EAGH,OAAO,SAAS,cAAc,MAAM,CAAC,CAAC,KAAK,EACzC,OAAO,yBACT,CAAC;CACH;CAOA,4BAA4B,OAAO,OAAO;CAE1C,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAgD;CACjF,OACEA,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}
+{"version":3,"file":"inject-request-context.mjs","names":["requestContextInstance"],"sources":["../../../../../../../../../packages/core/src/http/middleware/inject-request-context.ts"],"sourcesContent":["/**\n * Request Context Middleware\n *\n * Creates a unified context for each request using the ContextManager.\n * All framework contexts (request, storage, database) are available throughout the request lifecycle.\n */\nimport { trans } from \"@mongez/localization\";\nimport { type GenericObject } from \"@mongez/reinforcements\";\nimport { DatabaseWriterValidationError } from \"@warlock.js/cascade\";\nimport { contextManager } from \"@warlock.js/context\";\nimport { log } from \"@warlock.js/logger\";\nimport config from \"@mongez/config\";\nimport { environment } from \"../../utils\";\nimport { requestContext as requestContextInstance } from \"../context/request-context\";\nimport { applyCspHeader } from \"../csp\";\nimport { runDefaultCsrfGuard } from \"../csrf-default-guard\";\nimport { mapRequestError } from \"../error-mapper\";\nimport { HttpError } from \"../errors\";\nimport { type Request } from \"../request\";\nimport { type Response } from \"../response\";\nimport { buildTracingContext, dispatchPhase, isTracingEnabled } from \"../tracing\";\nimport { type ReturnedResponse } from \"./../types\";\n\n// Contexts are now registered in core/context/init-contexts.ts via initializeContexts()\n\n/**\n * Echo `request.id` back as a response header so the FE / proxies / log\n * aggregators can correlate by the same value the server logs against.\n *\n * Reads the header name from `http.requestId.header` (default `X-Request-Id`).\n * Skip when `http.requestId.enabled` is explicitly false.\n */\nfunction stampRequestIdHeader(request: Request, response: Response) {\n  const requestIdConfig = config.get(\"http.requestId\", {} as Record<string, any>);\n\n  if (requestIdConfig.enabled === false) return;\n\n  const headerName = requestIdConfig.header || \"X-Request-Id\";\n\n  response.header(headerName, request.id);\n}\n\n/**\n * Create request store and execute middleware + handler\n *\n * Runs all registered contexts together using ContextManager.\n */\nexport function createRequestStore(\n  request: Request<any>,\n  response: Response,\n): Promise<ReturnedResponse> {\n  stampRequestIdHeader(request, response);\n\n  // Stamped this early — before any middleware or handler runs — so the\n  // header carries the SAME nonce the web layer later reads off\n  // `request.nonce` for its `<script>` tags: `request.nonce` caches on first\n  // read, and this is deliberately the first read. A no-op when the app\n  // hasn't opted into `http.csp` (see `csp.ts`).\n  applyCspHeader(request, response);\n\n  // Build all context stores using the immutable API\n  // Each context defines its own store initialization via buildStore()\n  const httpContextStore = contextManager.buildStores({ request, response });\n\n  // Run all contexts together!\n  return contextManager.runAll(httpContextStore, async () => {\n    try {\n      // Default CSRF-Origin guard (SECURITY, card 8a752ab2) — the earliest\n      // seam common to every request, BEFORE the route's own middleware\n      // (`request.runMiddleware()` below) and before any app handler, so it\n      // applies even to a route that never attaches\n      // `authMiddleware(\"cookie:*\")`. See `../csrf-default-guard.ts` for the\n      // full scope rule and `{ csrf: false }` exemption.\n      const csrfGuardResponse = await runDefaultCsrfGuard(request, response, t, (reason) => {\n        log.error(\n          \"http\",\n          \"csrf-default-guard\",\n          new Error(`Default CSRF Origin guard refused request: ${reason}`),\n        );\n      });\n\n      if (csrfGuardResponse) {\n        return csrfGuardResponse as ReturnedResponse;\n      }\n\n      // Run middleware chain\n      const result = await request.runMiddleware();\n\n      if (result) {\n        return result as ReturnedResponse;\n      }\n\n      // Execute route handler\n      request.trigger(\"executingAction\", request.route);\n\n      const handler = request.getHandler();\n\n      request.log(\"Executing Handler\", \"info\");\n\n      const tracingEnabled = isTracingEnabled();\n      const handlerStartedAt = tracingEnabled ? performance.now() : 0;\n\n      const output = await handler({ request, response });\n\n      if (tracingEnabled) {\n        dispatchPhase(buildTracingContext(request), {\n          name: \"handler\",\n          durationMs: performance.now() - handlerStartedAt,\n        });\n      }\n\n      request.log(\"Handler Executed Successfully\", \"success\");\n\n      request.trigger(\"executedAction\", request.route);\n\n      return output as ReturnedResponse;\n    } catch (thrown) {\n      const error = mapRequestError(thrown, request);\n\n      logRequestError(error, request);\n      return handleRequestError(error, response, request);\n    }\n  });\n}\n\n/**\n * The HTTP status an error will be answered with, or `undefined` when it is not\n * one of the known HTTP-answerable shapes (those fall through to the opaque 500).\n *\n * Single source for `handleRequestError` and the request logger, so the rule\n * that decides the response status is the same rule that decides the log level.\n * @internal\n */\nfunction resolveRequestErrorStatus(error: unknown): number | undefined {\n  if (error instanceof HttpError) {\n    return error.status;\n  }\n\n  if (error instanceof DatabaseWriterValidationError) {\n    return config.get(\"http.modelValidationErrorStatus\", 500);\n  }\n\n  return undefined;\n}\n\n/**\n * Log a request error at the right severity. An error answered with a 4xx is an\n * expected client error (a thrown 404/409/422): one `warn` line, no stack.\n * Everything else (5xx, unknown errors) keeps the error-level entry with its stack.\n * @internal\n */\nfunction logRequestError(error: unknown, request: Request<any>) {\n  const status = resolveRequestErrorStatus(error);\n\n  if (status !== undefined && status < 500 && error instanceof Error) {\n    request.log(`${error.name}: ${error.message} (${status})`, \"warn\");\n\n    return;\n  }\n\n  request.log(error, \"error\");\n}\n\n/**\n * Unconditional floor for an unhandled request error (canon 8d3c13a8): route it\n * through the logger, and when no logger channel is configured (nothing would\n * record it) fall back to `console.error` so the only copy is never lost.\n * @internal\n */\nfunction reportUnhandledRequestError(error: unknown, request: Request<any>) {\n  log.error(\"http\", \"unhandled-request-error\", error, { requestId: request.id });\n\n  if (log.channels.length === 0) {\n    console.error(`[http] unhandled-request-error (requestId: ${request.id})`, error);\n  }\n}\n\n/**\n * Handle request errors\n * @internal\n */\nfunction handleRequestError(\n  error: unknown,\n  response: Response,\n  request: Request<any>,\n): ReturnedResponse {\n  // Availability floor, not a cache-policy nit: `handleRequestError` is the\n  // single funnel every unhandled error in every Warlock app passes through\n  // (`createRequestStore`'s catch above), and none of the branches below set\n  // a `Cache-Control` header. Without this, an error response — a 500 as\n  // much as a 401/403/404 carrying per-request/-user state — can be stored\n  // by a shared cache or CDN and replayed to other requests/users long after\n  // the condition that caused it is gone: a cached 500 becomes an outage\n  // that outlives its cause; a cached 401/403 becomes a leak across users.\n  // Set once, here, before any branch runs — not per branch — because the\n  // branches below do not partition by status. `ResourceNotFoundError`,\n  // `UnAuthorizedError`, `ForbiddenError`, `BadRequestError` and `ServerError`\n  // all extend `HttpError`, so the `HttpError` branch answers for every one of\n  // them, and a raw `HttpError` can carry any caller-chosen status, 4xx or 5xx.\n  // Gating the floor on the eventual status would mean re-deriving that status\n  // per branch — one rule meeting one form while others reach the same output.\n  // Applying it once, unconditionally, is both simpler and safer.\n  response.header(\"Cache-Control\", \"private, no-store\");\n\n  if (error instanceof HttpError) {\n    // 5xx HttpErrors (e.g. `ServerError`) are server faults: send them to the\n    // logger channels too, tagged with the request id.\n    if (error.status >= 500) {\n      log.error(\"http\", \"request-error\", error, { requestId: request.id });\n    }\n\n    const payload: GenericObject = {\n      error: error.message,\n    };\n    if (error.payload) {\n      payload.payload = error.payload;\n    }\n\n    if (environment() === \"development\") {\n      payload.stack = error.stack;\n    }\n\n    return response.setStatusCode(error.status).send(payload);\n  }\n\n  if (error instanceof DatabaseWriterValidationError) {\n    const status = resolveRequestErrorStatus(error) as number;\n\n    // A 4xx is an expected client error, already logged as a one-line warn by\n    // `logRequestError`; only a 5xx gets the error-level entry with its stack.\n    if (status >= 500) {\n      log.error(\"http\", \"model-write-validation-error\", error, {\n        requestId: request.id,\n        errors: error.errors,\n      });\n    }\n\n    // A 4xx status means the app treats this as the client's fault, so the\n    // field errors are useful to it; a 5xx stays opaque.\n    if (status < 500) {\n      return response.setStatusCode(status).send({\n        errors: error.errors,\n      });\n    }\n\n    return response.setStatusCode(status).send({\n      error: \"Internal server error.\",\n    });\n  }\n\n  // Last resort: the error matched none of the known shapes above, so the\n  // client gets a deliberately opaque message. Without this line the error\n  // itself is discarded here — no stack, no message, nothing in any log — and\n  // an unrecognised failure becomes indistinguishable from a working server\n  // returning 500. Never swallow the only copy of an error (`65e476ee`).\n  reportUnhandledRequestError(error, request);\n\n  return response.serverError({\n    error: \"Internal server error.\",\n  });\n}\n\n/**\n * Translate a keyword (uses request context for locale)\n */\nexport function t(keyword: string, placeholders?: Record<string, unknown>): string {\n  return (\n    requestContextInstance.getRequest()?.trans(keyword, placeholders) ||\n    trans(keyword, placeholders)\n  );\n}\n\n// `fromRequest` was removed in v5. It cached computed values as dynamic\n// properties on the Request instance, which only compiled because of the\n// `[key: string]: any` index signature that v5 deletes (eed20184). Use\n// `requestMemo(key, fn)` from `../context/request-memo` instead — same\n// per-request lifetime, single-flight, and it never touches the Request object.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAS,qBAAqB,SAAkB,UAAoB;CAClE,MAAM,kBAAkB,OAAO,IAAI,kBAAkB,CAAC,CAAwB;CAE9E,IAAI,gBAAgB,YAAY,OAAO;CAEvC,MAAM,aAAa,gBAAgB,UAAU;CAE7C,SAAS,OAAO,YAAY,QAAQ,EAAE;AACxC;;;;;;AAOA,SAAgB,mBACd,SACA,UAC2B;CAC3B,qBAAqB,SAAS,QAAQ;CAOtC,eAAe,SAAS,QAAQ;CAIhC,MAAM,mBAAmB,eAAe,YAAY;EAAE;EAAS;CAAS,CAAC;CAGzE,OAAO,eAAe,OAAO,kBAAkB,YAAY;EACzD,IAAI;GAOF,MAAM,oBAAoB,MAAM,oBAAoB,SAAS,UAAU,IAAI,WAAW;IACpF,IAAI,MACF,QACA,sCACA,IAAI,MAAM,8CAA8C,QAAQ,CAClE;GACF,CAAC;GAED,IAAI,mBACF,OAAO;GAIT,MAAM,SAAS,MAAM,QAAQ,cAAc;GAE3C,IAAI,QACF,OAAO;GAIT,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK;GAEhD,MAAM,UAAU,QAAQ,WAAW;GAEnC,QAAQ,IAAI,qBAAqB,MAAM;GAEvC,MAAM,iBAAiB,iBAAiB;GACxC,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,IAAI;GAE9D,MAAM,SAAS,MAAM,QAAQ;IAAE;IAAS;GAAS,CAAC;GAElD,IAAI,gBACF,cAAc,oBAAoB,OAAO,GAAG;IAC1C,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;GAClC,CAAC;GAGH,QAAQ,IAAI,iCAAiC,SAAS;GAEtD,QAAQ,QAAQ,kBAAkB,QAAQ,KAAK;GAE/C,OAAO;EACT,SAAS,QAAQ;GACf,MAAM,QAAQ,gBAAgB,QAAQ,OAAO;GAE7C,gBAAgB,OAAO,OAAO;GAC9B,OAAO,mBAAmB,OAAO,UAAU,OAAO;EACpD;CACF,CAAC;AACH;;;;;;;;;AAUA,SAAS,0BAA0B,OAAoC;CACrE,IAAI,iBAAiB,WACnB,OAAO,MAAM;CAGf,IAAI,iBAAiB,+BACnB,OAAO,OAAO,IAAI,mCAAmC,GAAG;AAI5D;;;;;;;AAQA,SAAS,gBAAgB,OAAgB,SAAuB;CAC9D,MAAM,SAAS,0BAA0B,KAAK;CAE9C,IAAI,WAAW,UAAa,SAAS,OAAO,iBAAiB,OAAO;EAClE,QAAQ,IAAI,GAAG,MAAM,KAAK,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,MAAM;EAEjE;CACF;CAEA,QAAQ,IAAI,OAAO,OAAO;AAC5B;;;;;;;AAQA,SAAS,4BAA4B,OAAgB,SAAuB;CAC1E,IAAI,MAAM,QAAQ,2BAA2B,OAAO,EAAE,WAAW,QAAQ,GAAG,CAAC;CAE7E,IAAI,IAAI,SAAS,WAAW,GAC1B,QAAQ,MAAM,8CAA8C,QAAQ,GAAG,IAAI,KAAK;AAEpF;;;;;AAMA,SAAS,mBACP,OACA,UACA,SACkB;CAiBlB,SAAS,OAAO,iBAAiB,mBAAmB;CAEpD,IAAI,iBAAiB,WAAW;EAG9B,IAAI,MAAM,UAAU,KAClB,IAAI,MAAM,QAAQ,iBAAiB,OAAO,EAAE,WAAW,QAAQ,GAAG,CAAC;EAGrE,MAAM,UAAyB,EAC7B,OAAO,MAAM,QACf;EACA,IAAI,MAAM,SACR,QAAQ,UAAU,MAAM;EAG1B,IAAI,YAAY,MAAM,eACpB,QAAQ,QAAQ,MAAM;EAGxB,OAAO,SAAS,cAAc,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO;CAC1D;CAEA,IAAI,iBAAiB,+BAA+B;EAClD,MAAM,SAAS,0BAA0B,KAAK;EAI9C,IAAI,UAAU,KACZ,IAAI,MAAM,QAAQ,gCAAgC,OAAO;GACvD,WAAW,QAAQ;GACnB,QAAQ,MAAM;EAChB,CAAC;EAKH,IAAI,SAAS,KACX,OAAO,SAAS,cAAc,MAAM,CAAC,CAAC,KAAK,EACzC,QAAQ,MAAM,OAChB,CAAC;EAGH,OAAO,SAAS,cAAc,MAAM,CAAC,CAAC,KAAK,EACzC,OAAO,yBACT,CAAC;CACH;CAOA,4BAA4B,OAAO,OAAO;CAE1C,OAAO,SAAS,YAAY,EAC1B,OAAO,yBACT,CAAC;AACH;;;;AAKA,SAAgB,EAAE,SAAiB,cAAgD;CACjF,OACEA,eAAuB,WAAW,CAAC,EAAE,MAAM,SAAS,YAAY,KAChE,MAAM,SAAS,YAAY;AAE/B"}

package/esm/http/middleware/ip-filter.middleware.d.mts

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/ip-filter.middleware.d.ts
+//#region ../../packages/core/src/http/middleware/ip-filter.middleware.d.ts
 /**
  * Options for the IP filter middleware. Use at least one of `allow` / `deny`.
  *

package/esm/http/middleware/ip-filter.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ip-filter.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/ip-filter.middleware.ts"],"mappings":";;;;;AAUA;;KAAY,eAAA;EAAe;;;;EAKzB,KAAA;EASY;AA+Bd;;;EAnCE,IAAA;EAmC0C;;;EA/B1C,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Bc,kBAAA,CAAmB,OAAA,EAAS,eAAA,GAAkB,UAAU"}
+{"version":3,"file":"ip-filter.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/ip-filter.middleware.ts"],"mappings":";;;;;AAUA;;KAAY,eAAA;EAAe;;;;EAKzB,KAAA;EASY;AA+Bd;;;EAnCE,IAAA;EAmC0C;;;EA/B1C,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Bc,kBAAA,CAAmB,OAAA,EAAS,eAAA,GAAkB,UAAU"}

package/esm/http/middleware/ip-filter.middleware.mjs

@@ -2,7 +2,7 @@ import { HttpErrorCodes } from "../error-codes.mjs";
 import { t } from "./inject-request-context.mjs";
 import { anyMatch } from "./utils/cidr-match.mjs";
 
-//#region ../core/src/http/middleware/ip-filter.middleware.ts
+//#region ../../packages/core/src/http/middleware/ip-filter.middleware.ts
 /**
 * Allow / deny requests by client IP. Fail-closed: if the IP can't be read,
 * the request is rejected with 403.

package/esm/http/middleware/ip-filter.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ip-filter.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/ip-filter.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { anyMatch } from \"./utils/cidr-match\";\n\n/**\n * Options for the IP filter middleware. Use at least one of `allow` / `deny`.\n *\n * Precedence: `deny` wins. If a request matches both lists it is denied.\n */\nexport type IpFilterOptions = {\n  /**\n   * Allowlist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. When present,\n   * only IPs matching the list pass through.\n   */\n  allow?: string[];\n  /**\n   * Denylist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. Matched IPs\n   * are rejected regardless of the allowlist.\n   */\n  deny?: string[];\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\n/**\n * Allow / deny requests by client IP. Fail-closed: if the IP can't be read,\n * the request is rejected with 403.\n *\n * Reads the client IP via `request.detectIp()`, which honors the forwarding\n * headers only when `http.trustProxy` is set — otherwise the socket peer\n * address is used, since both headers are client-settable. When opting in,\n * prefer a bounded `http.trustProxy` (a CIDR list of your proxies)\n * over `true`: with `true`, any client that can reach the process directly\n * picks its own IP and this allowlist is decorative.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.group(\n *   {\n *     prefix: \"/admin\",\n *     middleware: [middleware.ipFilter({ allow: [\"10.0.0.0/8\", \"203.0.113.42\"] })],\n *   },\n *   () => {\n *     router.get(\"/dashboard\", dashboardController);\n *   },\n * );\n *\n * router.post(\"/webhooks/provider\", webhookController, {\n *   middleware: [middleware.ipFilter({ allow: [\"198.51.100.0/24\"] })],\n * });\n */\nexport function ipFilterMiddleware(options: IpFilterOptions): Middleware {\n  return ({ request, response }) => {\n    const ip = request.detectIp();\n\n    if (!ip || typeof ip !== \"string\") {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.deny && anyMatch(ip, options.deny)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.allow && !anyMatch(ip, options.allow)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,mBAAmB,SAAsC;CACvE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,CAAC,MAAM,OAAO,OAAO,UACvB,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,QAAQ,SAAS,IAAI,QAAQ,IAAI,GAC3C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,SAAS,CAAC,SAAS,IAAI,QAAQ,KAAK,GAC9C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CAEL;AACF"}
+{"version":3,"file":"ip-filter.middleware.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/ip-filter.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { anyMatch } from \"./utils/cidr-match\";\n\n/**\n * Options for the IP filter middleware. Use at least one of `allow` / `deny`.\n *\n * Precedence: `deny` wins. If a request matches both lists it is denied.\n */\nexport type IpFilterOptions = {\n  /**\n   * Allowlist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. When present,\n   * only IPs matching the list pass through.\n   */\n  allow?: string[];\n  /**\n   * Denylist of exact IPv4 / IPv6 strings or IPv4 CIDR blocks. Matched IPs\n   * are rejected regardless of the allowlist.\n   */\n  deny?: string[];\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\n/**\n * Allow / deny requests by client IP. Fail-closed: if the IP can't be read,\n * the request is rejected with 403.\n *\n * Reads the client IP via `request.detectIp()`, which honors the forwarding\n * headers only when `http.trustProxy` is set — otherwise the socket peer\n * address is used, since both headers are client-settable. When opting in,\n * prefer a bounded `http.trustProxy` (a CIDR list of your proxies)\n * over `true`: with `true`, any client that can reach the process directly\n * picks its own IP and this allowlist is decorative.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.group(\n *   {\n *     prefix: \"/admin\",\n *     middleware: [middleware.ipFilter({ allow: [\"10.0.0.0/8\", \"203.0.113.42\"] })],\n *   },\n *   () => {\n *     router.get(\"/dashboard\", dashboardController);\n *   },\n * );\n *\n * router.post(\"/webhooks/provider\", webhookController, {\n *   middleware: [middleware.ipFilter({ allow: [\"198.51.100.0/24\"] })],\n * });\n */\nexport function ipFilterMiddleware(options: IpFilterOptions): Middleware {\n  return ({ request, response }) => {\n    const ip = request.detectIp();\n\n    if (!ip || typeof ip !== \"string\") {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.deny && anyMatch(ip, options.deny)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n\n    if (options.allow && !anyMatch(ip, options.allow)) {\n      return response.forbidden({\n        error: options.errorMessage || t(\"http.ipForbidden\"),\n        errorCode: HttpErrorCodes.IpForbidden,\n      });\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,mBAAmB,SAAsC;CACvE,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,CAAC,MAAM,OAAO,OAAO,UACvB,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,QAAQ,SAAS,IAAI,QAAQ,IAAI,GAC3C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;EAGH,IAAI,QAAQ,SAAS,CAAC,SAAS,IAAI,QAAQ,KAAK,GAC9C,OAAO,SAAS,UAAU;GACxB,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CAEL;AACF"}

package/esm/http/middleware/maintenance.middleware.d.mts

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/maintenance.middleware.d.ts
+//#region ../../packages/core/src/http/middleware/maintenance.middleware.d.ts
 /**
  * Options for the maintenance middleware.
  */

package/esm/http/middleware/maintenance.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/maintenance.middleware.ts"],"mappings":";;;;;KAQY,kBAAA;EAAkB;;;;;;;AAkBhB;EATZ,SAAA;EA0CmC;;;;EArCnC,UAAA;EAqCuE;;AAAU;EAjCjF,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;iBAiCc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}
+{"version":3,"file":"maintenance.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/maintenance.middleware.ts"],"mappings":";;;;;KAQY,kBAAA;EAAkB;;;;;;;AAkBhB;EATZ,SAAA;EA0CmC;;;;EArCnC,UAAA;EAqCuE;;AAAU;EAjCjF,YAAA;AAAA;;;;;;;;;;;;;;;;;;;;;iBAiCc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}

package/esm/http/middleware/maintenance.middleware.mjs

@@ -2,7 +2,7 @@ import { HttpErrorCodes } from "../error-codes.mjs";
 import { t } from "./inject-request-context.mjs";
 import config from "@mongez/config";
 
-//#region ../core/src/http/middleware/maintenance.middleware.ts
+//#region ../../packages/core/src/http/middleware/maintenance.middleware.ts
 function isAllowlisted(path, patterns) {
 	return patterns.some((pattern) => {
 		if (pattern.endsWith("*")) return path.startsWith(pattern.slice(0, -1));

package/esm/http/middleware/maintenance.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return ({ request, response }) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist = options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    // `request.path` includes the query string, but allowlist entries are\n    // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n    // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n    const pathname = request.path.split(\"?\")[0] ?? \"/\";\n\n    if (isAllowlisted(pathname, allowlist)) return;\n\n    const retryAfter = options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,EAAE,SAAS,eAAe;EAGhC,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YAAY,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAO3F,IAAI,cAFa,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,KAEnB,SAAS,GAAG;EAExC,MAAM,aAAa,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAErF,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return ({ request, response }) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist = options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    // `request.path` includes the query string, but allowlist entries are\n    // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n    // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n    const pathname = request.path.split(\"?\")[0] ?? \"/\";\n\n    if (isAllowlisted(pathname, allowlist)) return;\n\n    const retryAfter = options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,EAAE,SAAS,eAAe;EAGhC,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YAAY,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAO3F,IAAI,cAFa,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,KAEnB,SAAS,GAAG;EAExC,MAAM,aAAa,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAErF,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}

package/esm/http/middleware/max-body-size.middleware.d.mts

@@ -1,5 +1,5 @@
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/max-body-size.middleware.d.ts
+//#region ../../packages/core/src/http/middleware/max-body-size.middleware.d.ts
 /**
  * Reject requests whose `Content-Length` exceeds the configured cap.
  *

package/esm/http/middleware/max-body-size.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"max-body-size.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/max-body-size.middleware.ts"],"mappings":";;;;;AAiCA;;;;AAAyE;;;;;;;;;;;;;;;;;;;;;iBAAzD,qBAAA,CAAsB,KAAA,oBAAyB,UAAU"}
+{"version":3,"file":"max-body-size.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/max-body-size.middleware.ts"],"mappings":";;;;;AAiCA;;;;AAAyE;;;;;;;;;;;;;;;;;;;;;iBAAzD,qBAAA,CAAsB,KAAA,oBAAyB,UAAU"}

package/esm/http/middleware/max-body-size.middleware.mjs

@@ -2,7 +2,7 @@ import { HttpErrorCodes } from "../error-codes.mjs";
 import { t } from "./inject-request-context.mjs";
 import { parseSize } from "./utils/parse-size.mjs";
 
-//#region ../core/src/http/middleware/max-body-size.middleware.ts
+//#region ../../packages/core/src/http/middleware/max-body-size.middleware.ts
 /**
 * Reject requests whose `Content-Length` exceeds the configured cap.
 *

package/esm/http/middleware/max-body-size.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"max-body-size.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/max-body-size.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { parseSize } from \"./utils/parse-size\";\n\n/**\n * Reject requests whose `Content-Length` exceeds the configured cap.\n *\n * ⚠️ **This runs AFTER the body has been parsed, not before it.** Framework\n * middleware executes inside the Fastify route handler, and `@fastify/multipart`\n * is registered with `attachFieldsToBody: true` — so by the time this sees the\n * request, the bytes are already resident. It inspects `Content-Length` and\n * answers 413; it does not and cannot prevent the read.\n *\n * **So this is not a resource-exhaustion control.** For that, lower\n * `http.bodyLimit`, or set `bodyLimit` in the route's own `serverOptions` —\n * Fastify enforces those while reading. This middleware is a per-route\n * convenience for returning a consistent 413, not a replacement for either.\n *\n * The same caveat applies to `concurrencyLimit`: it bounds how many requests\n * run at once, not how many bytes are resident.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/comments\", createCommentController, {\n *   middleware: [middleware.maxBodySize(\"8kb\")],\n * });\n *\n * router.post(\"/uploads\", uploadController, {\n *   middleware: [middleware.maxBodySize(\"10mb\")],\n * });\n */\nexport function maxBodySizeMiddleware(limit: string | number): Middleware {\n  const limitBytes = parseSize(limit);\n\n  return ({ request, response }) => {\n    const contentLengthHeader = request.header(\"content-length\");\n\n    if (!contentLengthHeader) return;\n\n    const contentLength = Number(contentLengthHeader);\n\n    if (!Number.isFinite(contentLength)) return;\n\n    if (contentLength <= limitBytes) return;\n\n    response.header(\"Connection\", \"close\");\n\n    return response.contentTooLarge({\n      error: t(\"http.bodyTooLarge\"),\n      errorCode: HttpErrorCodes.BodyTooLarge,\n      limit: limitBytes,\n      received: contentLength,\n    });\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,sBAAsB,OAAoC;CACxE,MAAM,aAAa,UAAU,KAAK;CAElC,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,sBAAsB,QAAQ,OAAO,gBAAgB;EAE3D,IAAI,CAAC,qBAAqB;EAE1B,MAAM,gBAAgB,OAAO,mBAAmB;EAEhD,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;EAErC,IAAI,iBAAiB,YAAY;EAEjC,SAAS,OAAO,cAAc,OAAO;EAErC,OAAO,SAAS,gBAAgB;GAC9B,OAAO,EAAE,mBAAmB;GAC5B;GACA,OAAO;GACP,UAAU;EACZ,CAAC;CACH;AACF"}
+{"version":3,"file":"max-body-size.middleware.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/max-body-size.middleware.ts"],"sourcesContent":["import type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\nimport { parseSize } from \"./utils/parse-size\";\n\n/**\n * Reject requests whose `Content-Length` exceeds the configured cap.\n *\n * ⚠️ **This runs AFTER the body has been parsed, not before it.** Framework\n * middleware executes inside the Fastify route handler, and `@fastify/multipart`\n * is registered with `attachFieldsToBody: true` — so by the time this sees the\n * request, the bytes are already resident. It inspects `Content-Length` and\n * answers 413; it does not and cannot prevent the read.\n *\n * **So this is not a resource-exhaustion control.** For that, lower\n * `http.bodyLimit`, or set `bodyLimit` in the route's own `serverOptions` —\n * Fastify enforces those while reading. This middleware is a per-route\n * convenience for returning a consistent 413, not a replacement for either.\n *\n * The same caveat applies to `concurrencyLimit`: it bounds how many requests\n * run at once, not how many bytes are resident.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/comments\", createCommentController, {\n *   middleware: [middleware.maxBodySize(\"8kb\")],\n * });\n *\n * router.post(\"/uploads\", uploadController, {\n *   middleware: [middleware.maxBodySize(\"10mb\")],\n * });\n */\nexport function maxBodySizeMiddleware(limit: string | number): Middleware {\n  const limitBytes = parseSize(limit);\n\n  return ({ request, response }) => {\n    const contentLengthHeader = request.header(\"content-length\");\n\n    if (!contentLengthHeader) return;\n\n    const contentLength = Number(contentLengthHeader);\n\n    if (!Number.isFinite(contentLength)) return;\n\n    if (contentLength <= limitBytes) return;\n\n    response.header(\"Connection\", \"close\");\n\n    return response.contentTooLarge({\n      error: t(\"http.bodyTooLarge\"),\n      errorCode: HttpErrorCodes.BodyTooLarge,\n      limit: limitBytes,\n      received: contentLength,\n    });\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,sBAAsB,OAAoC;CACxE,MAAM,aAAa,UAAU,KAAK;CAElC,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,sBAAsB,QAAQ,OAAO,gBAAgB;EAE3D,IAAI,CAAC,qBAAqB;EAE1B,MAAM,gBAAgB,OAAO,mBAAmB;EAEhD,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;EAErC,IAAI,iBAAiB,YAAY;EAEjC,SAAS,OAAO,cAAc,OAAO;EAErC,OAAO,SAAS,gBAAgB;GAC9B,OAAO,EAAE,mBAAmB;GAC5B;GACA,OAAO;GACP,UAAU;EACZ,CAAC;CACH;AACF"}

package/esm/http/middleware/middleware-list.d.mts

@@ -6,7 +6,7 @@ import { maintenanceMiddleware } from "./maintenance.middleware.mjs";
 import { maxBodySizeMiddleware } from "./max-body-size.middleware.mjs";
 import { rateLimitMiddleware } from "./rate-limit.middleware.mjs";
 
-//#region ../core/src/http/middleware/middleware-list.d.ts
+//#region ../../packages/core/src/http/middleware/middleware-list.d.ts
 /**
  * Built-in HTTP middleware factories.
  *

package/esm/http/middleware/middleware-list.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware-list.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/middleware-list.ts"],"mappings":";;;;;;;;;;;AA+BA;;;;;;;;;;;;;;;;;;;;;cAAa,UAAA;EAAA"}
+{"version":3,"file":"middleware-list.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/middleware-list.ts"],"mappings":";;;;;;;;;;;AA+BA;;;;;;;;;;;;;;;;;;;;;cAAa,UAAA;EAAA"}

package/esm/http/middleware/middleware-list.mjs

@@ -6,7 +6,7 @@ import { maintenanceMiddleware } from "./maintenance.middleware.mjs";
 import { maxBodySizeMiddleware } from "./max-body-size.middleware.mjs";
 import { rateLimitMiddleware } from "./rate-limit.middleware.mjs";
 
-//#region ../core/src/http/middleware/middleware-list.ts
+//#region ../../packages/core/src/http/middleware/middleware-list.ts
 /**
 * Built-in HTTP middleware factories.
 *

package/esm/http/middleware/middleware-list.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware-list.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/middleware-list.ts"],"sourcesContent":["import { cacheMiddleware } from \"./cache-response-middleware\";\nimport { concurrencyLimitMiddleware } from \"./concurrency-limit.middleware\";\nimport { idempotencyMiddleware } from \"./idempotency.middleware\";\nimport { ipFilterMiddleware } from \"./ip-filter.middleware\";\nimport { maintenanceMiddleware } from \"./maintenance.middleware\";\nimport { maxBodySizeMiddleware } from \"./max-body-size.middleware\";\nimport { rateLimitMiddleware } from \"./rate-limit.middleware\";\n\n/**\n * Built-in HTTP middleware factories.\n *\n * Single canonical entry point for the framework's middleware suite. Each\n * property is a factory that returns a `Middleware` ready to drop into a\n * route's `middleware` array.\n *\n * Bare names (`rateLimitMiddleware`, etc.) are not exported from the package —\n * always reach for them via this namespace. The internal `*Middleware` suffix\n * naming exists for in-package code organization only.\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware, router } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.rateLimit({ max: 5, duration: 60_000 }),\n *     middleware.idempotency(),\n *   ],\n * });\n */\nexport const middleware = {\n  cache: cacheMiddleware,\n  concurrencyLimit: concurrencyLimitMiddleware,\n  idempotency: idempotencyMiddleware,\n  ipFilter: ipFilterMiddleware,\n  maintenance: maintenanceMiddleware,\n  maxBodySize: maxBodySizeMiddleware,\n  rateLimit: rateLimitMiddleware,\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAa,aAAa;CACxB,OAAO;CACP,kBAAkB;CAClB,aAAa;CACb,UAAU;CACV,aAAa;CACb,aAAa;CACb,WAAW;AACb"}
+{"version":3,"file":"middleware-list.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/middleware-list.ts"],"sourcesContent":["import { cacheMiddleware } from \"./cache-response-middleware\";\nimport { concurrencyLimitMiddleware } from \"./concurrency-limit.middleware\";\nimport { idempotencyMiddleware } from \"./idempotency.middleware\";\nimport { ipFilterMiddleware } from \"./ip-filter.middleware\";\nimport { maintenanceMiddleware } from \"./maintenance.middleware\";\nimport { maxBodySizeMiddleware } from \"./max-body-size.middleware\";\nimport { rateLimitMiddleware } from \"./rate-limit.middleware\";\n\n/**\n * Built-in HTTP middleware factories.\n *\n * Single canonical entry point for the framework's middleware suite. Each\n * property is a factory that returns a `Middleware` ready to drop into a\n * route's `middleware` array.\n *\n * Bare names (`rateLimitMiddleware`, etc.) are not exported from the package —\n * always reach for them via this namespace. The internal `*Middleware` suffix\n * naming exists for in-package code organization only.\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware, router } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.rateLimit({ max: 5, duration: 60_000 }),\n *     middleware.idempotency(),\n *   ],\n * });\n */\nexport const middleware = {\n  cache: cacheMiddleware,\n  concurrencyLimit: concurrencyLimitMiddleware,\n  idempotency: idempotencyMiddleware,\n  ipFilter: ipFilterMiddleware,\n  maintenance: maintenanceMiddleware,\n  maxBodySize: maxBodySizeMiddleware,\n  rateLimit: rateLimitMiddleware,\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAa,aAAa;CACxB,OAAO;CACP,kBAAkB;CAClB,aAAa;CACb,UAAU;CACV,aAAa;CACb,aAAa;CACb,WAAW;AACb"}

package/esm/http/middleware/rate-limit.middleware.d.mts

@@ -1,6 +1,6 @@
 import { Request } from "../request.mjs";
 import { Middleware } from "../../router/types.mjs";
-//#region ../core/src/http/middleware/rate-limit.middleware.d.ts
+//#region ../../packages/core/src/http/middleware/rate-limit.middleware.d.ts
 /**
  * Options for the per-route rate limit middleware.
  */
@@ -36,6 +36,18 @@ type RateLimitOptions = {
    * request, e.g. to translate it into the visitor's locale.
    */
   errorMessage?: string | ((request: Request) => string);
+  /**
+   * Where this limiter counts: `"memory"` (this process) or `"cache"`
+   * (`@warlock.js/cache`, shared by every process using the same driver).
+   * Defaults to `http.rateLimit.store` when that is `"cache"`, else `"memory"`.
+   */
+  store?: "memory" | "cache";
+  /**
+   * Stable name for this limiter's shared counters. Without it, limiters are
+   * told apart by the order they were created, which matches across processes
+   * running the same code; set a name when limiters are created conditionally.
+   */
+  name?: string;
 };
 /**
  * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s
@@ -43,10 +55,13 @@ type RateLimitOptions = {
  * 429. Use this for endpoints that need a tighter cap than the global default:
  * login, OTP request, password reset, expensive search, AI completions.
  *
- * The counter of THIS middleware always lives in-process. With `N` replicas
- * its effective cap is `N × max`. The global limit can be shared across
- * replicas by setting `http.rateLimit.redis` (an ioredis instance); that
- * does not affect this per-route middleware.
+ * The counter lives in-process by default, so with `N` replicas the
+ * effective cap is `N × max`. Set `store: "cache"` (or `http.rateLimit.store:
+ * "cache"`, which this follows) to count in `@warlock.js/cache` instead, so
+ * every process sharing the cache driver counts together. A cache outage
+ * fails open: the request is let through and the error is logged (at most
+ * once a minute). The `null` and `file` cache drivers are refused the same
+ * way: they cannot count, so the limiter lets requests through and logs why.
  *
  * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on
  * every response; adds `Retry-After` (seconds) on a 429.

package/esm/http/middleware/rate-limit.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.middleware.d.mts","names":[],"sources":["../../../../../../../../core/src/http/middleware/rate-limit.middleware.ts"],"mappings":";;;;;;KASY,gBAAA;EAAgB;;;EAI1B,GAAA;EAIA;;;EAAA,QAAA;EAaA;;;;;;AAU0C;EAf1C,YAAA,IAAgB,OAAA,EAAS,OAAA;EAqEQ;;;;EAhEjC,GAAA;EAgE8D;;AAAU;;EA3DxE,MAAA;;;;;EAKA,YAAA,cAA0B,OAAA,EAAS,OAAO;AAAA;;;;;;;;;;;;;;;;;;;;;iBAsD5B,mBAAA,CAAoB,OAAA,EAAS,gBAAA,GAAmB,UAAU"}
+{"version":3,"file":"rate-limit.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/rate-limit.middleware.ts"],"mappings":";;;;;;KAWY,gBAAA;EAAgB;;;EAI1B,GAAA;EAIA;;;EAAA,QAAA;EAaA;;;;;;;EALA,YAAA,IAAgB,OAAA,EAAS,OAAA;EA2BrB;AA+DN;;;EArFE,GAAA;EAqF2C;;;;EAhF3C,MAAA;;;;;EAKA,YAAA,cAA0B,OAAA,EAAS,OAAO;;;;;;EAM1C,KAAA;;;;;;EAMA,IAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;iBA+Dc,mBAAA,CAAoB,OAAA,EAAS,gBAAA,GAAmB,UAAU"}

package/esm/http/middleware/rate-limit.middleware.mjs

@@ -1,8 +1,10 @@
 import { HttpErrorCodes } from "../error-codes.mjs";
 import { t } from "./inject-request-context.mjs";
+import { incrementSharedRateLimit, logSharedRateLimitError } from "../rate-limit-cache-store.mjs";
+import config from "@mongez/config";
 import { normalizeIP } from "@fastify/rate-limit";
 
-//#region ../core/src/http/middleware/rate-limit.middleware.ts
+//#region ../../packages/core/src/http/middleware/rate-limit.middleware.ts
 const buckets = /* @__PURE__ */ new Map();
 const defaultIpv6Subnet = 64;
 /**
@@ -21,16 +23,23 @@ let lastPruneAt = 0;
 function pruneExpired(now) {
 	for (const [key, bucket] of buckets) if (bucket.resetAt <= now) buckets.delete(key);
 }
+function resolveStore(options) {
+	if (options.store) return options.store;
+	return config.get("http.rateLimit.store") === "cache" ? "cache" : "memory";
+}
 /**
 * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s
 * global cap (configured via `http.rateLimit`) — both run, and either can
 * 429. Use this for endpoints that need a tighter cap than the global default:
 * login, OTP request, password reset, expensive search, AI completions.
 *
-* The counter of THIS middleware always lives in-process. With `N` replicas
-* its effective cap is `N × max`. The global limit can be shared across
-* replicas by setting `http.rateLimit.redis` (an ioredis instance); that
-* does not affect this per-route middleware.
+* The counter lives in-process by default, so with `N` replicas the
+* effective cap is `N × max`. Set `store: "cache"` (or `http.rateLimit.store:
+* "cache"`, which this follows) to count in `@warlock.js/cache` instead, so
+* every process sharing the cache driver counts together. A cache outage
+* fails open: the request is let through and the error is logged (at most
+* once a minute). The `null` and `file` cache drivers are refused the same
+* way: they cannot count, so the limiter lets requests through and logs why.
 *
 * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on
 * every response; adds `Retry-After` (seconds) on a 429.
@@ -43,7 +52,7 @@ function pruneExpired(now) {
 */
 function rateLimitMiddleware(options) {
 	const limiterId = nextLimiterId++;
-	return ({ request, response }) => {
+	return async ({ request, response }) => {
 		const now = Date.now();
 		if (now - lastPruneAt > 6e4) {
 			pruneExpired(now);
@@ -59,15 +68,28 @@ function rateLimitMiddleware(options) {
 		const ipKey = ip ? normalizeIP(ip, defaultIpv6Subnet) : "unknown";
 		const groupKey = options.keyGenerator?.(request) || userKey || ipKey;
 		const cacheKey = `${limiterId}:${request.route.path}:${groupKey}`;
-		let bucket = buckets.get(cacheKey);
-		if (!bucket || bucket.resetAt <= now) {
+		let bucket;
+		if (resolveStore(options) === "cache") try {
+			const shared = await incrementSharedRateLimit(`route.${options.name ?? limiterId}.${request.route.path}`, groupKey, options.duration, now);
 			bucket = {
-				count: 0,
-				resetAt: now + options.duration
+				count: shared.current,
+				resetAt: shared.resetAt
 			};
-			buckets.set(cacheKey, bucket);
+		} catch (error) {
+			logSharedRateLimitError(error);
+			return;
+		}
+		else {
+			bucket = buckets.get(cacheKey);
+			if (!bucket || bucket.resetAt <= now) {
+				bucket = {
+					count: 0,
+					resetAt: now + options.duration
+				};
+				buckets.set(cacheKey, bucket);
+			}
+			bucket.count++;
 		}
-		bucket.count++;
 		const remaining = Math.max(0, options.max - bucket.count);
 		const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1e3));
 		response.header("X-RateLimit-Limit", options.max);

package/esm/http/middleware/rate-limit.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.middleware.mjs","names":[],"sources":["../../../../../../../../core/src/http/middleware/rate-limit.middleware.ts"],"sourcesContent":["import { normalizeIP } from \"@fastify/rate-limit\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Request } from \"../request\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the per-route rate limit middleware.\n */\nexport type RateLimitOptions = {\n  /**\n   * Max requests allowed within the time window.\n   */\n  max: number;\n  /**\n   * Time window in milliseconds.\n   */\n  duration: number;\n  /**\n   * Group key generator. Defaults to the client IP. Override to scope per-user,\n   * per-organization, per-tenant, etc.\n   *\n   * @example\n   * keyGenerator: (request) => request.locals.user?.id ?? request.ip,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Key the bucket to the signed-in user (`request.locals.user.id`). Works on\n   * routes and page actions alike. `keyGenerator` wins when both are set.\n   */\n  key?: \"user\";\n  /**\n   * With `key: \"user\"`, what to do for unauthenticated requests: bucket them\n   * by IP (default) or skip limiting entirely.\n   */\n  guests?: \"ip\" | \"skip\";\n  /**\n   * Override the default error message. Pass a function to build it per\n   * request, e.g. to translate it into the visitor's locale.\n   */\n  errorMessage?: string | ((request: Request) => string);\n};\n\ntype Bucket = {\n  count: number;\n  resetAt: number;\n};\n\nconst buckets = new Map<string, Bucket>();\nconst defaultIpv6Subnet = 64;\n\n/**\n * Each `rateLimitMiddleware()` call is its own limiter. Page actions share one\n * route, so without this two limits on the same page (say `like` and\n * `comment`) would count into one bucket.\n */\nlet nextLimiterId = 0;\n\n/**\n * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys\n * (rare per-user keys, dynamic path parameters in `keyGenerator`, etc.).\n * Called opportunistically, at most once per minute, not on a timer — keeps\n * the module side-effect-free for testing.\n */\nlet lastPruneAt = 0;\n\nfunction pruneExpired(now: number) {\n  for (const [key, bucket] of buckets) {\n    if (bucket.resetAt <= now) {\n      buckets.delete(key);\n    }\n  }\n}\n\n/**\n * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s\n * global cap (configured via `http.rateLimit`) — both run, and either can\n * 429. Use this for endpoints that need a tighter cap than the global default:\n * login, OTP request, password reset, expensive search, AI completions.\n *\n * The counter of THIS middleware always lives in-process. With `N` replicas\n * its effective cap is `N × max`. The global limit can be shared across\n * replicas by setting `http.rateLimit.redis` (an ioredis instance); that\n * does not affect this per-route middleware.\n *\n * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on\n * every response; adds `Retry-After` (seconds) on a 429.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],\n * });\n */\nexport function rateLimitMiddleware(options: RateLimitOptions): Middleware {\n  const limiterId = nextLimiterId++;\n\n  return ({ request, response }) => {\n    const now = Date.now();\n\n    if (now - lastPruneAt > 60_000) {\n      pruneExpired(now);\n      lastPruneAt = now;\n    }\n\n    let userKey: string | undefined;\n\n    if (options.key === \"user\" && !options.keyGenerator) {\n      const id = (request.locals as { user?: { id?: unknown } } | undefined)?.user?.id;\n\n      if (id !== undefined && id !== null && id !== \"\") {\n        userKey = `user:${String(id)}`;\n      } else if (options.guests === \"skip\") {\n        return;\n      }\n    }\n\n    const ip = request.detectIp();\n    const ipKey = ip ? normalizeIP(ip, defaultIpv6Subnet) : \"unknown\";\n    const groupKey = options.keyGenerator?.(request) || userKey || ipKey;\n    const cacheKey = `${limiterId}:${request.route.path}:${groupKey}`;\n\n    let bucket = buckets.get(cacheKey);\n\n    if (!bucket || bucket.resetAt <= now) {\n      bucket = { count: 0, resetAt: now + options.duration };\n      buckets.set(cacheKey, bucket);\n    }\n\n    bucket.count++;\n\n    const remaining = Math.max(0, options.max - bucket.count);\n    const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));\n\n    response.header(\"X-RateLimit-Limit\", options.max);\n    response.header(\"X-RateLimit-Remaining\", remaining);\n    response.header(\"X-RateLimit-Reset\", Math.ceil(bucket.resetAt / 1000));\n\n    if (bucket.count > options.max) {\n      response.header(\"Retry-After\", retryAfter);\n\n      return response.tooManyRequests({\n        error:\n          (typeof options.errorMessage === \"function\"\n            ? options.errorMessage(request)\n            : options.errorMessage) || t(\"http.rateLimitExceeded\"),\n        errorCode: HttpErrorCodes.RateLimitExceeded,\n      });\n    }\n  };\n}\n"],"mappings":";;;;;AAgDA,MAAM,0BAAU,IAAI,IAAoB;AACxC,MAAM,oBAAoB;;;;;;AAO1B,IAAI,gBAAgB;;;;;;;AAQpB,IAAI,cAAc;AAElB,SAAS,aAAa,KAAa;CACjC,KAAK,MAAM,CAAC,KAAK,WAAW,SAC1B,IAAI,OAAO,WAAW,KACpB,QAAQ,OAAO,GAAG;AAGxB;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,oBAAoB,SAAuC;CACzE,MAAM,YAAY;CAElB,QAAQ,EAAE,SAAS,eAAe;EAChC,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI,MAAM,cAAc,KAAQ;GAC9B,aAAa,GAAG;GAChB,cAAc;EAChB;EAEA,IAAI;EAEJ,IAAI,QAAQ,QAAQ,UAAU,CAAC,QAAQ,cAAc;GACnD,MAAM,KAAM,QAAQ,QAAoD,MAAM;GAE9E,IAAI,OAAO,UAAa,OAAO,QAAQ,OAAO,IAC5C,UAAU,QAAQ,OAAO,EAAE;QACtB,IAAI,QAAQ,WAAW,QAC5B;EAEJ;EAEA,MAAM,KAAK,QAAQ,SAAS;EAC5B,MAAM,QAAQ,KAAK,YAAY,IAAI,iBAAiB,IAAI;EACxD,MAAM,WAAW,QAAQ,eAAe,OAAO,KAAK,WAAW;EAC/D,MAAM,WAAW,GAAG,UAAU,GAAG,QAAQ,MAAM,KAAK,GAAG;EAEvD,IAAI,SAAS,QAAQ,IAAI,QAAQ;EAEjC,IAAI,CAAC,UAAU,OAAO,WAAW,KAAK;GACpC,SAAS;IAAE,OAAO;IAAG,SAAS,MAAM,QAAQ;GAAS;GACrD,QAAQ,IAAI,UAAU,MAAM;EAC9B;EAEA,OAAO;EAEP,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,MAAM,OAAO,KAAK;EACxD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,OAAO,GAAI,CAAC;EAEvE,SAAS,OAAO,qBAAqB,QAAQ,GAAG;EAChD,SAAS,OAAO,yBAAyB,SAAS;EAClD,SAAS,OAAO,qBAAqB,KAAK,KAAK,OAAO,UAAU,GAAI,CAAC;EAErE,IAAI,OAAO,QAAQ,QAAQ,KAAK;GAC9B,SAAS,OAAO,eAAe,UAAU;GAEzC,OAAO,SAAS,gBAAgB;IAC9B,QACG,OAAO,QAAQ,iBAAiB,aAC7B,QAAQ,aAAa,OAAO,IAC5B,QAAQ,iBAAiB,EAAE,wBAAwB;IACzD;GACF,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"rate-limit.middleware.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/rate-limit.middleware.ts"],"sourcesContent":["import { normalizeIP } from \"@fastify/rate-limit\";\nimport config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { incrementSharedRateLimit, logSharedRateLimitError } from \"../rate-limit-cache-store\";\nimport type { Request } from \"../request\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the per-route rate limit middleware.\n */\nexport type RateLimitOptions = {\n  /**\n   * Max requests allowed within the time window.\n   */\n  max: number;\n  /**\n   * Time window in milliseconds.\n   */\n  duration: number;\n  /**\n   * Group key generator. Defaults to the client IP. Override to scope per-user,\n   * per-organization, per-tenant, etc.\n   *\n   * @example\n   * keyGenerator: (request) => request.locals.user?.id ?? request.ip,\n   */\n  keyGenerator?: (request: Request) => string;\n  /**\n   * Key the bucket to the signed-in user (`request.locals.user.id`). Works on\n   * routes and page actions alike. `keyGenerator` wins when both are set.\n   */\n  key?: \"user\";\n  /**\n   * With `key: \"user\"`, what to do for unauthenticated requests: bucket them\n   * by IP (default) or skip limiting entirely.\n   */\n  guests?: \"ip\" | \"skip\";\n  /**\n   * Override the default error message. Pass a function to build it per\n   * request, e.g. to translate it into the visitor's locale.\n   */\n  errorMessage?: string | ((request: Request) => string);\n  /**\n   * Where this limiter counts: `\"memory\"` (this process) or `\"cache\"`\n   * (`@warlock.js/cache`, shared by every process using the same driver).\n   * Defaults to `http.rateLimit.store` when that is `\"cache\"`, else `\"memory\"`.\n   */\n  store?: \"memory\" | \"cache\";\n  /**\n   * Stable name for this limiter's shared counters. Without it, limiters are\n   * told apart by the order they were created, which matches across processes\n   * running the same code; set a name when limiters are created conditionally.\n   */\n  name?: string;\n};\n\ntype Bucket = {\n  count: number;\n  resetAt: number;\n};\n\nconst buckets = new Map<string, Bucket>();\nconst defaultIpv6Subnet = 64;\n\n/**\n * Each `rateLimitMiddleware()` call is its own limiter. Page actions share one\n * route, so without this two limits on the same page (say `like` and\n * `comment`) would count into one bucket.\n */\nlet nextLimiterId = 0;\n\n/**\n * Sweep expired buckets so the Map doesn't grow unbounded with one-shot keys\n * (rare per-user keys, dynamic path parameters in `keyGenerator`, etc.).\n * Called opportunistically, at most once per minute, not on a timer — keeps\n * the module side-effect-free for testing.\n */\nlet lastPruneAt = 0;\n\nfunction pruneExpired(now: number) {\n  for (const [key, bucket] of buckets) {\n    if (bucket.resetAt <= now) {\n      buckets.delete(key);\n    }\n  }\n}\n\nfunction resolveStore(options: RateLimitOptions): \"memory\" | \"cache\" {\n  if (options.store) return options.store;\n\n  return config.get(\"http.rateLimit.store\") === \"cache\" ? \"cache\" : \"memory\";\n}\n\n/**\n * Per-route / per-group rate limit. Layers on top of `@fastify/rate-limit`'s\n * global cap (configured via `http.rateLimit`) — both run, and either can\n * 429. Use this for endpoints that need a tighter cap than the global default:\n * login, OTP request, password reset, expensive search, AI completions.\n *\n * The counter lives in-process by default, so with `N` replicas the\n * effective cap is `N × max`. Set `store: \"cache\"` (or `http.rateLimit.store:\n * \"cache\"`, which this follows) to count in `@warlock.js/cache` instead, so\n * every process sharing the cache driver counts together. A cache outage\n * fails open: the request is let through and the error is logged (at most\n * once a minute). The `null` and `file` cache drivers are refused the same\n * way: they cannot count, so the limiter lets requests through and logs why.\n *\n * Sets `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` on\n * every response; adds `Retry-After` (seconds) on a 429.\n *\n * @example\n * import { middleware } from \"@warlock.js/core\";\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [middleware.rateLimit({ max: 5, duration: 60_000 })],\n * });\n */\nexport function rateLimitMiddleware(options: RateLimitOptions): Middleware {\n  const limiterId = nextLimiterId++;\n\n  return async ({ request, response }) => {\n    const now = Date.now();\n\n    if (now - lastPruneAt > 60_000) {\n      pruneExpired(now);\n      lastPruneAt = now;\n    }\n\n    let userKey: string | undefined;\n\n    if (options.key === \"user\" && !options.keyGenerator) {\n      const id = (request.locals as { user?: { id?: unknown } } | undefined)?.user?.id;\n\n      if (id !== undefined && id !== null && id !== \"\") {\n        userKey = `user:${String(id)}`;\n      } else if (options.guests === \"skip\") {\n        return undefined;\n      }\n    }\n\n    const ip = request.detectIp();\n    const ipKey = ip ? normalizeIP(ip, defaultIpv6Subnet) : \"unknown\";\n    const groupKey = options.keyGenerator?.(request) || userKey || ipKey;\n    const cacheKey = `${limiterId}:${request.route.path}:${groupKey}`;\n\n    let bucket: Bucket | undefined;\n\n    if (resolveStore(options) === \"cache\") {\n      try {\n        const shared = await incrementSharedRateLimit(\n          `route.${options.name ?? limiterId}.${request.route.path}`,\n          groupKey,\n          options.duration,\n          now,\n        );\n\n        bucket = { count: shared.current, resetAt: shared.resetAt };\n      } catch (error) {\n        // Fail open, and report the outage at most once a minute rather\n        // than once per request.\n        logSharedRateLimitError(error);\n\n        return undefined;\n      }\n    } else {\n      bucket = buckets.get(cacheKey);\n\n      if (!bucket || bucket.resetAt <= now) {\n        bucket = { count: 0, resetAt: now + options.duration };\n        buckets.set(cacheKey, bucket);\n      }\n\n      bucket.count++;\n    }\n\n    const remaining = Math.max(0, options.max - bucket.count);\n    const retryAfter = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));\n\n    response.header(\"X-RateLimit-Limit\", options.max);\n    response.header(\"X-RateLimit-Remaining\", remaining);\n    response.header(\"X-RateLimit-Reset\", Math.ceil(bucket.resetAt / 1000));\n\n    if (bucket.count > options.max) {\n      response.header(\"Retry-After\", retryAfter);\n\n      return response.tooManyRequests({\n        error:\n          (typeof options.errorMessage === \"function\"\n            ? options.errorMessage(request)\n            : options.errorMessage) || t(\"http.rateLimitExceeded\"),\n        errorCode: HttpErrorCodes.RateLimitExceeded,\n      });\n    }\n\n    return undefined;\n  };\n}\n"],"mappings":";;;;;;;AA8DA,MAAM,0BAAU,IAAI,IAAoB;AACxC,MAAM,oBAAoB;;;;;;AAO1B,IAAI,gBAAgB;;;;;;;AAQpB,IAAI,cAAc;AAElB,SAAS,aAAa,KAAa;CACjC,KAAK,MAAM,CAAC,KAAK,WAAW,SAC1B,IAAI,OAAO,WAAW,KACpB,QAAQ,OAAO,GAAG;AAGxB;AAEA,SAAS,aAAa,SAA+C;CACnE,IAAI,QAAQ,OAAO,OAAO,QAAQ;CAElC,OAAO,OAAO,IAAI,sBAAsB,MAAM,UAAU,UAAU;AACpE;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,oBAAoB,SAAuC;CACzE,MAAM,YAAY;CAElB,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI,MAAM,cAAc,KAAQ;GAC9B,aAAa,GAAG;GAChB,cAAc;EAChB;EAEA,IAAI;EAEJ,IAAI,QAAQ,QAAQ,UAAU,CAAC,QAAQ,cAAc;GACnD,MAAM,KAAM,QAAQ,QAAoD,MAAM;GAE9E,IAAI,OAAO,UAAa,OAAO,QAAQ,OAAO,IAC5C,UAAU,QAAQ,OAAO,EAAE;QACtB,IAAI,QAAQ,WAAW,QAC5B;EAEJ;EAEA,MAAM,KAAK,QAAQ,SAAS;EAC5B,MAAM,QAAQ,KAAK,YAAY,IAAI,iBAAiB,IAAI;EACxD,MAAM,WAAW,QAAQ,eAAe,OAAO,KAAK,WAAW;EAC/D,MAAM,WAAW,GAAG,UAAU,GAAG,QAAQ,MAAM,KAAK,GAAG;EAEvD,IAAI;EAEJ,IAAI,aAAa,OAAO,MAAM,SAC5B,IAAI;GACF,MAAM,SAAS,MAAM,yBACnB,SAAS,QAAQ,QAAQ,UAAU,GAAG,QAAQ,MAAM,QACpD,UACA,QAAQ,UACR,GACF;GAEA,SAAS;IAAE,OAAO,OAAO;IAAS,SAAS,OAAO;GAAQ;EAC5D,SAAS,OAAO;GAGd,wBAAwB,KAAK;GAE7B;EACF;OACK;GACL,SAAS,QAAQ,IAAI,QAAQ;GAE7B,IAAI,CAAC,UAAU,OAAO,WAAW,KAAK;IACpC,SAAS;KAAE,OAAO;KAAG,SAAS,MAAM,QAAQ;IAAS;IACrD,QAAQ,IAAI,UAAU,MAAM;GAC9B;GAEA,OAAO;EACT;EAEA,MAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,MAAM,OAAO,KAAK;EACxD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,OAAO,GAAI,CAAC;EAEvE,SAAS,OAAO,qBAAqB,QAAQ,GAAG;EAChD,SAAS,OAAO,yBAAyB,SAAS;EAClD,SAAS,OAAO,qBAAqB,KAAK,KAAK,OAAO,UAAU,GAAI,CAAC;EAErE,IAAI,OAAO,QAAQ,QAAQ,KAAK;GAC9B,SAAS,OAAO,eAAe,UAAU;GAEzC,OAAO,SAAS,gBAAgB;IAC9B,QACG,OAAO,QAAQ,iBAAiB,aAC7B,QAAQ,aAAa,OAAO,IAC5B,QAAQ,iBAAiB,EAAE,wBAAwB;IACzD;GACF,CAAC;EACH;CAGF;AACF"}

package/esm/http/middleware/utils/cidr-match.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/http/middleware/utils/cidr-match.d.ts
+//#region ../../packages/core/src/http/middleware/utils/cidr-match.d.ts
 declare function ipMatches(rawIp: string, rawPattern: string): boolean;
 /**
  * Returns true if `ip` matches any pattern in the list.

package/esm/http/middleware/utils/cidr-match.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cidr-match.d.mts","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/cidr-match.ts"],"mappings":";iBA2CgB,SAAA,CAAU,KAAA,UAAe,UAAkB;AAA3D;;;;AAA2D;AAkD3D;AAlDA,iBAkDgB,QAAA,CAAS,EAAA,UAAY,QAAkB"}
+{"version":3,"file":"cidr-match.d.mts","names":[],"sources":["../../../../../../../../../../packages/core/src/http/middleware/utils/cidr-match.ts"],"mappings":";iBA2CgB,SAAA,CAAU,KAAA,UAAe,UAAkB;AAA3D;;;;AAA2D;AAkD3D;AAlDA,iBAkDgB,QAAA,CAAS,EAAA,UAAY,QAAkB"}

package/esm/http/middleware/utils/cidr-match.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/middleware/utils/cidr-match.ts
+//#region ../../packages/core/src/http/middleware/utils/cidr-match.ts
 /**
 * Match an IPv4 address against an exact IP or a CIDR block.
 *

package/esm/http/middleware/utils/cidr-match.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cidr-match.mjs","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/cidr-match.ts"],"sourcesContent":["/**\n * Match an IPv4 address against an exact IP or a CIDR block.\n *\n * IPv6 patterns are matched as exact-string only — full IPv6 CIDR support is\n * out of scope; ACLs in production almost always use IPv4 ranges. Add IPv6 CIDR\n * later if a real use-case appears.\n *\n * @example\n * ipMatches(\"10.0.0.5\", \"10.0.0.0/8\");      // true\n * ipMatches(\"10.0.0.5\", \"10.0.0.5\");        // true\n * ipMatches(\"192.168.1.1\", \"10.0.0.0/8\");   // false\n */\nfunction ipv4ToInt(ip: string): number | null {\n  const parts = ip.split(\".\");\n\n  if (parts.length !== 4) {\n    return null;\n  }\n\n  let result = 0;\n\n  for (const part of parts) {\n    const num = Number(part);\n\n    if (!Number.isInteger(num) || num < 0 || num > 255) {\n      return null;\n    }\n\n    result = (result << 8) + num;\n  }\n\n  return result >>> 0;\n}\n\nconst IPV4_MAPPED_PREFIX = /^::ffff:(?=\\d+\\.\\d+\\.\\d+\\.\\d+$)/i;\n\n/**\n * Normalize IPv4-mapped IPv6 (`::ffff:1.2.3.4`) to plain IPv4.\n */\nfunction normalizeIp(value: string): string {\n  return value.replace(IPV4_MAPPED_PREFIX, \"\");\n}\n\nexport function ipMatches(rawIp: string, rawPattern: string): boolean {\n  if (!rawIp || !rawPattern) {\n    return false;\n  }\n\n  const ip = normalizeIp(rawIp);\n  const pattern = normalizeIp(rawPattern);\n\n  if (pattern === ip) {\n    return true;\n  }\n\n  if (!pattern.includes(\"/\")) {\n    return false;\n  }\n\n  const [base, bitsRaw] = pattern.split(\"/\");\n\n  if (base === undefined || bitsRaw === undefined) {\n    return false;\n  }\n\n  const bits = Number(bitsRaw);\n\n  if (!Number.isInteger(bits) || bits < 0 || bits > 32) {\n    return false;\n  }\n\n  const ipInt = ipv4ToInt(ip);\n  const baseInt = ipv4ToInt(base);\n\n  if (ipInt === null || baseInt === null) {\n    return false;\n  }\n\n  if (bits === 0) {\n    return true;\n  }\n\n  const mask = (~0 << (32 - bits)) >>> 0;\n\n  return (ipInt & mask) === (baseInt & mask);\n}\n\n/**\n * Returns true if `ip` matches any pattern in the list.\n *\n * @example\n * anyMatch(\"10.0.0.5\", [\"192.168.0.0/16\", \"10.0.0.0/8\"]); // true\n */\nexport function anyMatch(ip: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => ipMatches(ip, pattern));\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAS,UAAU,IAA2B;CAC5C,MAAM,QAAQ,GAAG,MAAM,GAAG;CAE1B,IAAI,MAAM,WAAW,GACnB,OAAO;CAGT,IAAI,SAAS;CAEb,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,OAAO,IAAI;EAEvB,IAAI,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,MAAM,KAC7C,OAAO;EAGT,UAAU,UAAU,KAAK;CAC3B;CAEA,OAAO,WAAW;AACpB;AAEA,MAAM,qBAAqB;;;;AAK3B,SAAS,YAAY,OAAuB;CAC1C,OAAO,MAAM,QAAQ,oBAAoB,EAAE;AAC7C;AAEA,SAAgB,UAAU,OAAe,YAA6B;CACpE,IAAI,CAAC,SAAS,CAAC,YACb,OAAO;CAGT,MAAM,KAAK,YAAY,KAAK;CAC5B,MAAM,UAAU,YAAY,UAAU;CAEtC,IAAI,YAAY,IACd,OAAO;CAGT,IAAI,CAAC,QAAQ,SAAS,GAAG,GACvB,OAAO;CAGT,MAAM,CAAC,MAAM,WAAW,QAAQ,MAAM,GAAG;CAEzC,IAAI,SAAS,UAAa,YAAY,QACpC,OAAO;CAGT,MAAM,OAAO,OAAO,OAAO;CAE3B,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,IAChD,OAAO;CAGT,MAAM,QAAQ,UAAU,EAAE;CAC1B,MAAM,UAAU,UAAU,IAAI;CAE9B,IAAI,UAAU,QAAQ,YAAY,MAChC,OAAO;CAGT,IAAI,SAAS,GACX,OAAO;CAGT,MAAM,OAAQ,MAAO,KAAK,SAAW;CAErC,QAAQ,QAAQ,WAAW,UAAU;AACvC;;;;;;;AAQA,SAAgB,SAAS,IAAY,UAA6B;CAChE,OAAO,SAAS,MAAM,YAAY,UAAU,IAAI,OAAO,CAAC;AAC1D"}
+{"version":3,"file":"cidr-match.mjs","names":[],"sources":["../../../../../../../../../../packages/core/src/http/middleware/utils/cidr-match.ts"],"sourcesContent":["/**\n * Match an IPv4 address against an exact IP or a CIDR block.\n *\n * IPv6 patterns are matched as exact-string only — full IPv6 CIDR support is\n * out of scope; ACLs in production almost always use IPv4 ranges. Add IPv6 CIDR\n * later if a real use-case appears.\n *\n * @example\n * ipMatches(\"10.0.0.5\", \"10.0.0.0/8\");      // true\n * ipMatches(\"10.0.0.5\", \"10.0.0.5\");        // true\n * ipMatches(\"192.168.1.1\", \"10.0.0.0/8\");   // false\n */\nfunction ipv4ToInt(ip: string): number | null {\n  const parts = ip.split(\".\");\n\n  if (parts.length !== 4) {\n    return null;\n  }\n\n  let result = 0;\n\n  for (const part of parts) {\n    const num = Number(part);\n\n    if (!Number.isInteger(num) || num < 0 || num > 255) {\n      return null;\n    }\n\n    result = (result << 8) + num;\n  }\n\n  return result >>> 0;\n}\n\nconst IPV4_MAPPED_PREFIX = /^::ffff:(?=\\d+\\.\\d+\\.\\d+\\.\\d+$)/i;\n\n/**\n * Normalize IPv4-mapped IPv6 (`::ffff:1.2.3.4`) to plain IPv4.\n */\nfunction normalizeIp(value: string): string {\n  return value.replace(IPV4_MAPPED_PREFIX, \"\");\n}\n\nexport function ipMatches(rawIp: string, rawPattern: string): boolean {\n  if (!rawIp || !rawPattern) {\n    return false;\n  }\n\n  const ip = normalizeIp(rawIp);\n  const pattern = normalizeIp(rawPattern);\n\n  if (pattern === ip) {\n    return true;\n  }\n\n  if (!pattern.includes(\"/\")) {\n    return false;\n  }\n\n  const [base, bitsRaw] = pattern.split(\"/\");\n\n  if (base === undefined || bitsRaw === undefined) {\n    return false;\n  }\n\n  const bits = Number(bitsRaw);\n\n  if (!Number.isInteger(bits) || bits < 0 || bits > 32) {\n    return false;\n  }\n\n  const ipInt = ipv4ToInt(ip);\n  const baseInt = ipv4ToInt(base);\n\n  if (ipInt === null || baseInt === null) {\n    return false;\n  }\n\n  if (bits === 0) {\n    return true;\n  }\n\n  const mask = (~0 << (32 - bits)) >>> 0;\n\n  return (ipInt & mask) === (baseInt & mask);\n}\n\n/**\n * Returns true if `ip` matches any pattern in the list.\n *\n * @example\n * anyMatch(\"10.0.0.5\", [\"192.168.0.0/16\", \"10.0.0.0/8\"]); // true\n */\nexport function anyMatch(ip: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => ipMatches(ip, pattern));\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAS,UAAU,IAA2B;CAC5C,MAAM,QAAQ,GAAG,MAAM,GAAG;CAE1B,IAAI,MAAM,WAAW,GACnB,OAAO;CAGT,IAAI,SAAS;CAEb,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,OAAO,IAAI;EAEvB,IAAI,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,MAAM,KAC7C,OAAO;EAGT,UAAU,UAAU,KAAK;CAC3B;CAEA,OAAO,WAAW;AACpB;AAEA,MAAM,qBAAqB;;;;AAK3B,SAAS,YAAY,OAAuB;CAC1C,OAAO,MAAM,QAAQ,oBAAoB,EAAE;AAC7C;AAEA,SAAgB,UAAU,OAAe,YAA6B;CACpE,IAAI,CAAC,SAAS,CAAC,YACb,OAAO;CAGT,MAAM,KAAK,YAAY,KAAK;CAC5B,MAAM,UAAU,YAAY,UAAU;CAEtC,IAAI,YAAY,IACd,OAAO;CAGT,IAAI,CAAC,QAAQ,SAAS,GAAG,GACvB,OAAO;CAGT,MAAM,CAAC,MAAM,WAAW,QAAQ,MAAM,GAAG;CAEzC,IAAI,SAAS,UAAa,YAAY,QACpC,OAAO;CAGT,MAAM,OAAO,OAAO,OAAO;CAE3B,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,IAChD,OAAO;CAGT,MAAM,QAAQ,UAAU,EAAE;CAC1B,MAAM,UAAU,UAAU,IAAI;CAE9B,IAAI,UAAU,QAAQ,YAAY,MAChC,OAAO;CAGT,IAAI,SAAS,GACX,OAAO;CAGT,MAAM,OAAQ,MAAO,KAAK,SAAW;CAErC,QAAQ,QAAQ,WAAW,UAAU;AACvC;;;;;;;AAQA,SAAgB,SAAS,IAAY,UAA6B;CAChE,OAAO,SAAS,MAAM,YAAY,UAAU,IAAI,OAAO,CAAC;AAC1D"}

package/esm/http/middleware/utils/idempotency-key.d.mts

@@ -1,6 +1,6 @@
 import { Request } from "../../request.mjs";
 
-//#region ../core/src/http/middleware/utils/idempotency-key.d.ts
+//#region ../../packages/core/src/http/middleware/utils/idempotency-key.d.ts
 declare function isValidIdempotencyKey(value: unknown): value is string;
 /**
  * Hash a request body to a stable hex digest.

package/esm/http/middleware/utils/idempotency-key.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency-key.d.mts","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/idempotency-key.ts"],"mappings":";;;iBAcgB,qBAAA,CAAsB,KAAA,YAAiB,KAAK;;AAA5D;;;;AAA4D;AAmB5D;;;;iBAAgB,QAAA,CAAS,IAAa;AAAA,iBAuCtB,wBAAA,CAAyB,OAAA,EAAS,OAAO,EAAE,cAAA"}
+{"version":3,"file":"idempotency-key.d.mts","names":[],"sources":["../../../../../../../../../../packages/core/src/http/middleware/utils/idempotency-key.ts"],"mappings":";;;iBAcgB,qBAAA,CAAsB,KAAA,YAAiB,KAAK;;AAA5D;;;;AAA4D;AAmB5D;;;;iBAAgB,QAAA,CAAS,IAAa;AAAA,iBAuCtB,wBAAA,CAAyB,OAAA,EAAS,OAAO,EAAE,cAAA"}

package/esm/http/middleware/utils/idempotency-key.mjs

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 
-//#region ../core/src/http/middleware/utils/idempotency-key.ts
+//#region ../../packages/core/src/http/middleware/utils/idempotency-key.ts
 /**
 * Idempotency-key validation rules.
 *

package/esm/http/middleware/utils/idempotency-key.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency-key.mjs","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/idempotency-key.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { Request } from \"../../request\";\n\n/**\n * Idempotency-key validation rules.\n *\n * RFC draft-ietf-httpapi-idempotency-key suggests UUIDs or ULIDs but doesn't\n * mandate a format. We accept any printable ASCII string up to 255 chars —\n * tight enough to reject log-injection (no control characters / newlines),\n * loose enough to accept whatever ID scheme the client picks.\n */\nconst MAX_KEY_LENGTH = 255;\nconst PRINTABLE_ASCII = /^[\\x21-\\x7e]+$/;\n\nexport function isValidIdempotencyKey(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    value.length <= MAX_KEY_LENGTH &&\n    PRINTABLE_ASCII.test(value)\n  );\n}\n\n/**\n * Hash a request body to a stable hex digest.\n *\n * Used to detect \"same key, different body\" — that's a client bug, not a retry.\n * sha256 is overkill for collision resistance here, but it's the dependency-free\n * choice and avoids importing a faster hasher.\n *\n * @example\n * hashBody({ amount: 100, currency: \"USD\" }); // \"a1b2c3...\"\n */\nexport function hashBody(body: unknown): string {\n  const serialized = typeof body === \"string\" ? body : JSON.stringify(body ?? {});\n\n  return createHash(\"sha256\").update(serialized).digest(\"hex\");\n}\n\n/**\n * Build the cache key for an idempotency record.\n *\n * Scope is `userType:userId` when authenticated, falling back to the client IP\n * when anonymous. This prevents user A from replaying user B's key — even if\n * user B used a guessable value — while still letting the primitive work on\n * public endpoints.\n *\n * Idempotency middleware must run **after** `authMiddleware` so\n * `request.locals.user` (written by `@warlock.js/auth`) and\n * `request.decodedAccessToken` are populated.\n *\n * @example\n * buildIdempotencyCacheKey(request, \"01J9XZQ-ABC\"); // \"idem:client:user_123:01J9XZQ-ABC\"\n */\n/**\n * Read `id` off `request.locals.user` without assuming any app's\n * `RequestUser` augmentation (declared by `@warlock.js/auth`, which core\n * cannot import) declares it, and without assuming `@warlock.js/auth` is\n * even installed — hence the untyped `unknown` read here rather than a\n * typed `RequestLocals[\"user\"]` access.\n *\n * A local, narrow runtime read survives any augmentation shape — no\n * `as any`.\n */\nfunction readUserId(user: unknown): string | number | undefined {\n  if (!user || typeof user !== \"object\" || !(\"id\" in user)) return undefined;\n\n  const id = (user as { id?: unknown }).id;\n\n  return typeof id === \"string\" || typeof id === \"number\" ? id : undefined;\n}\n\nexport function buildIdempotencyCacheKey(request: Request, idempotencyKey: string): string {\n  const userType = request.decodedAccessToken?.userType || \"anonymous\";\n  const locals = request.locals as Record<string, unknown>;\n  const userId = readUserId(locals.user) || request.detectIp() || \"unknown\";\n\n  // scope by endpoint so one key reused on another route/method never replays\n  // that other endpoint's response\n  const method = (request.route?.method || request.method || \"\").toUpperCase();\n  const routePath = request.route?.path || \"\";\n\n  return `idem:${userType}:${userId}:${method}:${routePath}:${idempotencyKey}`;\n}\n"],"mappings":";;;;;;;;;;;AAWA,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,SAAgB,sBAAsB,OAAiC;CACrE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,kBAChB,gBAAgB,KAAK,KAAK;AAE9B;;;;;;;;;;;AAYA,SAAgB,SAAS,MAAuB;CAC9C,MAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC;CAE9E,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAS,WAAW,MAA4C;CAC9D,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OAAO,OAAO;CAEjE,MAAM,KAAM,KAA0B;CAEtC,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,WAAW,KAAK;AACjE;AAEA,SAAgB,yBAAyB,SAAkB,gBAAgC;CACzF,MAAM,WAAW,QAAQ,oBAAoB,YAAY;CACzD,MAAM,SAAS,QAAQ;CAQvB,OAAO,QAAQ,SAAS,GAPT,WAAW,OAAO,IAAI,KAAK,QAAQ,SAAS,KAAK,UAO9B,IAHlB,QAAQ,OAAO,UAAU,QAAQ,UAAU,GAAE,CAAE,YAGrB,EAAE,GAF1B,QAAQ,OAAO,QAAQ,GAEgB,GAAG;AAC9D"}
+{"version":3,"file":"idempotency-key.mjs","names":[],"sources":["../../../../../../../../../../packages/core/src/http/middleware/utils/idempotency-key.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { Request } from \"../../request\";\n\n/**\n * Idempotency-key validation rules.\n *\n * RFC draft-ietf-httpapi-idempotency-key suggests UUIDs or ULIDs but doesn't\n * mandate a format. We accept any printable ASCII string up to 255 chars —\n * tight enough to reject log-injection (no control characters / newlines),\n * loose enough to accept whatever ID scheme the client picks.\n */\nconst MAX_KEY_LENGTH = 255;\nconst PRINTABLE_ASCII = /^[\\x21-\\x7e]+$/;\n\nexport function isValidIdempotencyKey(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length > 0 &&\n    value.length <= MAX_KEY_LENGTH &&\n    PRINTABLE_ASCII.test(value)\n  );\n}\n\n/**\n * Hash a request body to a stable hex digest.\n *\n * Used to detect \"same key, different body\" — that's a client bug, not a retry.\n * sha256 is overkill for collision resistance here, but it's the dependency-free\n * choice and avoids importing a faster hasher.\n *\n * @example\n * hashBody({ amount: 100, currency: \"USD\" }); // \"a1b2c3...\"\n */\nexport function hashBody(body: unknown): string {\n  const serialized = typeof body === \"string\" ? body : JSON.stringify(body ?? {});\n\n  return createHash(\"sha256\").update(serialized).digest(\"hex\");\n}\n\n/**\n * Build the cache key for an idempotency record.\n *\n * Scope is `userType:userId` when authenticated, falling back to the client IP\n * when anonymous. This prevents user A from replaying user B's key — even if\n * user B used a guessable value — while still letting the primitive work on\n * public endpoints.\n *\n * Idempotency middleware must run **after** `authMiddleware` so\n * `request.locals.user` (written by `@warlock.js/auth`) and\n * `request.decodedAccessToken` are populated.\n *\n * @example\n * buildIdempotencyCacheKey(request, \"01J9XZQ-ABC\"); // \"idem:client:user_123:01J9XZQ-ABC\"\n */\n/**\n * Read `id` off `request.locals.user` without assuming any app's\n * `RequestUser` augmentation (declared by `@warlock.js/auth`, which core\n * cannot import) declares it, and without assuming `@warlock.js/auth` is\n * even installed — hence the untyped `unknown` read here rather than a\n * typed `RequestLocals[\"user\"]` access.\n *\n * A local, narrow runtime read survives any augmentation shape — no\n * `as any`.\n */\nfunction readUserId(user: unknown): string | number | undefined {\n  if (!user || typeof user !== \"object\" || !(\"id\" in user)) return undefined;\n\n  const id = (user as { id?: unknown }).id;\n\n  return typeof id === \"string\" || typeof id === \"number\" ? id : undefined;\n}\n\nexport function buildIdempotencyCacheKey(request: Request, idempotencyKey: string): string {\n  const userType = request.decodedAccessToken?.userType || \"anonymous\";\n  const locals = request.locals as Record<string, unknown>;\n  const userId = readUserId(locals.user) || request.detectIp() || \"unknown\";\n\n  // scope by endpoint so one key reused on another route/method never replays\n  // that other endpoint's response\n  const method = (request.route?.method || request.method || \"\").toUpperCase();\n  const routePath = request.route?.path || \"\";\n\n  return `idem:${userType}:${userId}:${method}:${routePath}:${idempotencyKey}`;\n}\n"],"mappings":";;;;;;;;;;;AAWA,MAAM,iBAAiB;AACvB,MAAM,kBAAkB;AAExB,SAAgB,sBAAsB,OAAiC;CACrE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,kBAChB,gBAAgB,KAAK,KAAK;AAE9B;;;;;;;;;;;AAYA,SAAgB,SAAS,MAAuB;CAC9C,MAAM,aAAa,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC;CAE9E,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAS,WAAW,MAA4C;CAC9D,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OAAO,OAAO;CAEjE,MAAM,KAAM,KAA0B;CAEtC,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,WAAW,KAAK;AACjE;AAEA,SAAgB,yBAAyB,SAAkB,gBAAgC;CACzF,MAAM,WAAW,QAAQ,oBAAoB,YAAY;CACzD,MAAM,SAAS,QAAQ;CAQvB,OAAO,QAAQ,SAAS,GAPT,WAAW,OAAO,IAAI,KAAK,QAAQ,SAAS,KAAK,UAO9B,IAHlB,QAAQ,OAAO,UAAU,QAAQ,UAAU,GAAE,CAAE,YAGrB,EAAE,GAF1B,QAAQ,OAAO,QAAQ,GAEgB,GAAG;AAC9D"}

package/esm/http/middleware/utils/parse-size.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/http/middleware/utils/parse-size.d.ts
+//#region ../../packages/core/src/http/middleware/utils/parse-size.d.ts
 declare function parseSize(value: string | number): number;
 //#endregion
 export { parseSize };

package/esm/http/middleware/utils/parse-size.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-size.d.mts","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/parse-size.ts"],"mappings":";iBAkBgB,SAAA,CAAU,KAAsB"}
+{"version":3,"file":"parse-size.d.mts","names":[],"sources":["../../../../../../../../../../packages/core/src/http/middleware/utils/parse-size.ts"],"mappings":";iBAkBgB,SAAA,CAAU,KAAsB"}

package/esm/http/middleware/utils/parse-size.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/middleware/utils/parse-size.ts
+//#region ../../packages/core/src/http/middleware/utils/parse-size.ts
 /**
 * Parse a human-readable size string into bytes.
 *

package/esm/http/middleware/utils/parse-size.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"parse-size.mjs","names":[],"sources":["../../../../../../../../../core/src/http/middleware/utils/parse-size.ts"],"sourcesContent":["/**\n * Parse a human-readable size string into bytes.\n *\n * Accepts `\"2mb\"`, `\"500kb\"`, `\"1.5gb\"`, `\"1024\"`, `\"1024b\"`, etc. Case-insensitive.\n * Numeric input is returned untouched (already bytes).\n *\n * @example\n * parseSize(\"2mb\");     // 2_097_152\n * parseSize(\"500kb\");   // 512_000\n * parseSize(4096);      // 4096\n */\nconst UNITS: Record<string, number> = {\n  b: 1,\n  kb: 1024,\n  mb: 1024 * 1024,\n  gb: 1024 * 1024 * 1024,\n};\n\nexport function parseSize(value: string | number): number {\n  if (typeof value === \"number\") {\n    return value;\n  }\n\n  const match = /^(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb)?$/i.exec(value.trim());\n\n  if (!match) {\n    throw new Error(`Invalid size value: ${value}`);\n  }\n\n  const [, amount, rawUnit = \"b\"] = match;\n  const unit = rawUnit.toLowerCase();\n  const multiplier = UNITS[unit];\n\n  if (!multiplier) {\n    throw new Error(`Unknown size unit: ${unit}`);\n  }\n\n  return Math.floor(Number(amount) * multiplier);\n}\n"],"mappings":";;;;;;;;;;;;AAWA,MAAM,QAAgC;CACpC,GAAG;CACH,IAAI;CACJ,IAAI,OAAO;CACX,IAAI,OAAO,OAAO;AACpB;AAEA,SAAgB,UAAU,OAAgC;CACxD,IAAI,OAAO,UAAU,UACnB,OAAO;CAGT,MAAM,QAAQ,qCAAqC,KAAK,MAAM,KAAK,CAAC;CAEpE,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,uBAAuB,OAAO;CAGhD,MAAM,GAAG,QAAQ,UAAU,OAAO;CAClC,MAAM,OAAO,QAAQ,YAAY;CACjC,MAAM,aAAa,MAAM;CAEzB,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,sBAAsB,MAAM;CAG9C,OAAO,KAAK,MAAM,OAAO,MAAM,IAAI,UAAU;AAC/C"}
+{"version":3,"file":"parse-size.mjs","names":[],"sources":["../../../../../../../../../../packages/core/src/http/middleware/utils/parse-size.ts"],"sourcesContent":["/**\n * Parse a human-readable size string into bytes.\n *\n * Accepts `\"2mb\"`, `\"500kb\"`, `\"1.5gb\"`, `\"1024\"`, `\"1024b\"`, etc. Case-insensitive.\n * Numeric input is returned untouched (already bytes).\n *\n * @example\n * parseSize(\"2mb\");     // 2_097_152\n * parseSize(\"500kb\");   // 512_000\n * parseSize(4096);      // 4096\n */\nconst UNITS: Record<string, number> = {\n  b: 1,\n  kb: 1024,\n  mb: 1024 * 1024,\n  gb: 1024 * 1024 * 1024,\n};\n\nexport function parseSize(value: string | number): number {\n  if (typeof value === \"number\") {\n    return value;\n  }\n\n  const match = /^(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb)?$/i.exec(value.trim());\n\n  if (!match) {\n    throw new Error(`Invalid size value: ${value}`);\n  }\n\n  const [, amount, rawUnit = \"b\"] = match;\n  const unit = rawUnit.toLowerCase();\n  const multiplier = UNITS[unit];\n\n  if (!multiplier) {\n    throw new Error(`Unknown size unit: ${unit}`);\n  }\n\n  return Math.floor(Number(amount) * multiplier);\n}\n"],"mappings":";;;;;;;;;;;;AAWA,MAAM,QAAgC;CACpC,GAAG;CACH,IAAI;CACJ,IAAI,OAAO;CACX,IAAI,OAAO,OAAO;AACpB;AAEA,SAAgB,UAAU,OAAgC;CACxD,IAAI,OAAO,UAAU,UACnB,OAAO;CAGT,MAAM,QAAQ,qCAAqC,KAAK,MAAM,KAAK,CAAC;CAEpE,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,uBAAuB,OAAO;CAGhD,MAAM,GAAG,QAAQ,UAAU,OAAO;CAClC,MAAM,OAAO,QAAQ,YAAY;CACjC,MAAM,aAAa,MAAM;CAEzB,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,sBAAsB,MAAM;CAG9C,OAAO,KAAK,MAAM,OAAO,MAAM,IAAI,UAAU;AAC/C"}

package/esm/http/parse-urlencoded-body.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/parse-urlencoded-body.ts
+//#region ../../packages/core/src/http/parse-urlencoded-body.ts
 /**
 * Decode an `application/x-www-form-urlencoded` request body into a plain
 * object, the shape `request.ts`'s `parseBody` already expects from JSON and

package/esm/http/parse-urlencoded-body.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"parse-urlencoded-body.mjs","names":[],"sources":["../../../../../../../core/src/http/parse-urlencoded-body.ts"],"sourcesContent":["/**\n * Decode an `application/x-www-form-urlencoded` request body into a plain\n * object, the shape `request.ts`'s `parseBody` already expects from JSON and\n * multipart bodies.\n *\n * Repeated keys become arrays (`code=a&code=b` -> `{ code: [\"a\", \"b\"] }`);\n * every other key stays a single string. Bracket-notation keys (`a[b]=1`) are\n * NOT expanded here — they are handed through as literal keys and, like any\n * JSON or query-string key of that shape, are expanded later by the shared\n * `parseBody` nesting logic in `request.ts`. This function's only job is the\n * urlencoded -> flat-object step; it does not duplicate that logic.\n */\nexport function parseUrlencodedBody(raw: string): Record<string, string | string[]> {\n  const params = new URLSearchParams(raw);\n  const body: Record<string, string | string[]> = {};\n\n  for (const key of params.keys()) {\n    if (Object.prototype.hasOwnProperty.call(body, key)) continue;\n\n    const values = params.getAll(key);\n\n    body[key] = values.length > 1 ? values : (values[0] ?? \"\");\n  }\n\n  return body;\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAgB,oBAAoB,KAAgD;CAClF,MAAM,SAAS,IAAI,gBAAgB,GAAG;CACtC,MAAM,OAA0C,CAAC;CAEjD,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG;EAC/B,IAAI,OAAO,UAAU,eAAe,KAAK,MAAM,GAAG,GAAG;EAErD,MAAM,SAAS,OAAO,OAAO,GAAG;EAEhC,KAAK,OAAO,OAAO,SAAS,IAAI,SAAU,OAAO,MAAM;CACzD;CAEA,OAAO;AACT"}
+{"version":3,"file":"parse-urlencoded-body.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/parse-urlencoded-body.ts"],"sourcesContent":["/**\n * Decode an `application/x-www-form-urlencoded` request body into a plain\n * object, the shape `request.ts`'s `parseBody` already expects from JSON and\n * multipart bodies.\n *\n * Repeated keys become arrays (`code=a&code=b` -> `{ code: [\"a\", \"b\"] }`);\n * every other key stays a single string. Bracket-notation keys (`a[b]=1`) are\n * NOT expanded here — they are handed through as literal keys and, like any\n * JSON or query-string key of that shape, are expanded later by the shared\n * `parseBody` nesting logic in `request.ts`. This function's only job is the\n * urlencoded -> flat-object step; it does not duplicate that logic.\n */\nexport function parseUrlencodedBody(raw: string): Record<string, string | string[]> {\n  const params = new URLSearchParams(raw);\n  const body: Record<string, string | string[]> = {};\n\n  for (const key of params.keys()) {\n    if (Object.prototype.hasOwnProperty.call(body, key)) continue;\n\n    const values = params.getAll(key);\n\n    body[key] = values.length > 1 ? values : (values[0] ?? \"\");\n  }\n\n  return body;\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAgB,oBAAoB,KAAgD;CAClF,MAAM,SAAS,IAAI,gBAAgB,GAAG;CACtC,MAAM,OAA0C,CAAC;CAEjD,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG;EAC/B,IAAI,OAAO,UAAU,eAAe,KAAK,MAAM,GAAG,GAAG;EAErD,MAAM,SAAS,OAAO,OAAO,GAAG;EAEhC,KAAK,OAAO,OAAO,SAAS,IAAI,SAAU,OAAO,MAAM;CACzD;CAEA,OAAO;AACT"}