@warlock.js/core 5.30.0 → 5.31.0

package/esm/generations/stubs.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"stubs.mjs","names":[],"sources":["../../../../../../../../packages/core/src/generations/stubs.ts"],"sourcesContent":["export const accessConfigStub = `import { type AccessConfigurations } from \"@warlock.js/access\";\nimport { DatabaseAccessResolver } from \"app/access/services/access-resolver\";\n\n/**\n * Authorization configuration — read by @warlock.js/access on boot.\n *\n * The resolver is the one required piece: it tells the engine how to read a\n * user's roles + permissions. The ejected DatabaseAccessResolver reads roles\n * from the user_roles table and maps them through the roles catalog table (so\n * roles + their permissions are managed at runtime, in the DB).\n *\n * For a fixed, code-defined catalog with no tables, swap in DefaultAccessResolver:\n *   import { DefaultAccessResolver } from \"@warlock.js/access\";\n *   resolver: new DefaultAccessResolver({ admin: [\"*\"], editor: [\"orders.*\"] }),\n *\n * Multi-tenant? Add a \\`resolveTenant()\\` to the resolver to read the active\n * tenant from the request; checks then scope to it automatically.\n */\nconst access: AccessConfigurations = {\n  resolver: new DatabaseAccessResolver(),\n\n  // Cache resolved permission sets (default \"10m\").\n  // cache: { ttl: \"10m\" },\n};\n\nexport default access;\n`;\n\nexport const aiConfigStub = `import type { AIConfig } from \"@warlock.js/ai\";\n\n// >>> warlock:ai-packages (auto-managed) >>>\n// Satellite packages augment the \"ai\" object on import — e.g. ai.workspace,\n// ai.tools / ai.mcp, and panoptic's ai.config({ panoptic }) wiring. The command\n// \"warlock add ai-workspace | ai-tools | ai-panoptic\" adds the matching\n// side-effect import below; keep them so the augmentation + runtime registration\n// load before the ai connector applies this config.\n// <<< warlock:ai-packages <<<\n\n/**\n * AI configuration — applied on boot by the ai connector, which calls\n * ai.config(...) with the object below. Cross-cutting defaults live here\n * (shared cache / snapshot stores, observability); per-call options always win.\n *\n * Wire a default model from a provider you installed, e.g.:\n *   import { OpenAISDK } from \"@warlock.js/ai-openai\";\n *   const openai = OpenAISDK({ apiKey: env(\"OPENAI_API_KEY\") });\n *   // then pass openai.model({ name: \"gpt-4o-mini\" }) into your agents.\n */\nconst ai: Partial<AIConfig> = {\n  // Default cache driver for cache-backed AI features (semantic cache, rag / memory vector stores).\n  // defaultStore: cache.driver(\"redis\", { client }),\n\n  // Observability — requires \"warlock add ai-panoptic\". Exporters + the local dashboard.\n  // panoptic: { exporters: [], dashboard: false, observeAll: false },\n};\n\nexport default ai;\n`;\n\nexport const accessRoleModelStub = `import { Model, RegisterModel } from \"@warlock.js/cascade\";\nimport { type Infer, v } from \"@warlock.js/seal\";\n\n/**\n * Validation schema for the roles catalog — mirrors the migration columns\n * (snake_case). Each row is a role name plus the permission strings it grants;\n * wildcards work (\"orders.*\", \"*\"). The DatabaseAccessResolver maps a user's\n * assigned role names through this table to their effective permissions.\n */\nexport const roleSchema = v.object({\n  name: v.string(),\n  permissions: v.array(v.string()).default([]),\n});\n\nexport type RoleSchema = Infer<typeof roleSchema>;\n\n/**\n * The roles catalog — role name → the permissions it grants. Managed at runtime\n * (admins add roles + edit their permissions), unlike a fixed code map. Read by\n * DatabaseAccessResolver.resolvePermissions to expand a user's roles to permissions.\n */\n@RegisterModel()\nexport class Role extends Model<RoleSchema> {\n  public static table = \"roles\";\n\n  public static schema = roleSchema;\n\n  /** The permission strings this role grants. */\n  public get permissions(): string[] {\n    return this.get<string[]>(\"permissions\", []);\n  }\n}\n`;\n\nexport const accessRoleModelIndexStub = `export * from \"./role.model\";\n`;\n\nexport const accessRoleMigrationStub = `import { arrayText, Migration, text } from \"@warlock.js/cascade\";\nimport { Role } from \"../role.model\";\n\n/**\n * Roles catalog table. \\`name\\` is unique (one row per role); \\`permissions\\` is a\n * text array of the permission strings the role grants.\n */\nexport default Migration.create(Role, {\n  name: text().notNullable().unique(),\n  permissions: arrayText().nullable(),\n});\n`;\n\nexport const accessUserRoleModelStub = `import { access } from \"@warlock.js/access\";\nimport type { Auth } from \"@warlock.js/auth\";\nimport { Model, RegisterModel } from \"@warlock.js/cascade\";\nimport { type Infer, v } from \"@warlock.js/seal\";\n\n/**\n * Validation schema for a role assignment — mirrors the migration columns\n * (snake_case). \\`tenant\\` is nullable: a null tenant is a GLOBAL assignment.\n */\nexport const userRoleSchema = v.object({\n  user_id: v.string(),\n  user_type: v.string(),\n  role: v.string(),\n  tenant: v.string().optional(),\n});\n\nexport type UserRoleSchema = Infer<typeof userRoleSchema>;\n\n/**\n * The role-assignment table — which roles a user holds, optionally per tenant.\n * Read by DatabaseAccessResolver.resolveRoles; mutated via the statics below.\n * \\`assign\\` / \\`revoke\\` flush the cached permission set automatically, so callers\n * never need to call \\`access.flush(user, tenant)\\` themselves.\n */\n@RegisterModel()\nexport class UserRole extends Model<UserRoleSchema> {\n  public static table = \"user_roles\";\n\n  public static schema = userRoleSchema;\n\n  /**\n   * Role names assigned to the user in the given tenant.\n   *\n   * An unresolved tenant (\\`undefined\\`) scopes to GLOBAL roles only — the rows\n   * stored with no tenant (\\`null\\`) — never the union across every tenant. The\n   * union would be a privilege-escalation: a user who is \\`owner\\` in one tenant\n   * must not be treated as \\`owner\\` everywhere just because a check didn't carry\n   * a tenant. This mirrors how \\`assign(user, role)\\` stores a global row.\n   */\n  public static async rolesFor(user: Auth, tenant?: string): Promise<string[]> {\n    const rows = await this.query()\n      .where({\n        user_id: user.id,\n        user_type: user.userType,\n        tenant: tenant ?? null,\n      })\n      .get();\n\n    // De-dupe so a duplicate row (a concurrent assign that slipped past the\n    // existence check) can't distort the resolved set.\n    return [...new Set(rows.map((row) => row.get(\"role\") as string))];\n  }\n\n  /**\n   * Assign a role to the user. No-op if the assignment already exists.\n   * Flushes the user's cached permission set automatically.\n   */\n  public static async assign(user: Auth, role: string, tenant?: string): Promise<void> {\n    const existing = await this.first({\n      user_id: user.id,\n      user_type: user.userType,\n      role,\n      tenant: tenant ?? null,\n    });\n\n    if (existing) return;\n\n    await this.create({\n      user_id: user.id,\n      user_type: user.userType,\n      role,\n      tenant,\n    });\n\n    await access.flush(user, tenant);\n  }\n\n  /**\n   * Remove a role assignment from the user.\n   * Flushes the user's cached permission set automatically.\n   */\n  public static async revoke(user: Auth, role: string, tenant?: string): Promise<void> {\n    await this.delete({\n      user_id: user.id,\n      user_type: user.userType,\n      role,\n      tenant: tenant ?? null,\n    });\n\n    await access.flush(user, tenant);\n  }\n}\n`;\n\nexport const accessUserRoleModelIndexStub = `export * from \"./user-role.model\";\n`;\n\nexport const accessUserRoleMigrationStub = `import { Migration, text, uuid } from \"@warlock.js/cascade\";\nimport { UserRole } from \"../user-role.model\";\n\n/**\n * Role-assignment table. \\`user_id\\` is a UUID — override this migration if your\n * user ids are integers. The composite index powers the per-user (per-tenant)\n * lookup the resolver runs on every check.\n */\nexport default Migration.create(\n  UserRole,\n  {\n    user_id: uuid().notNullable().index(),\n    user_type: text().notNullable(),\n    role: text().notNullable().index(),\n    tenant: text().nullable().index(),\n  },\n  {\n    index: [{ columns: [\"user_id\", \"user_type\", \"tenant\"] }],\n  },\n);\n`;\n\nexport const accessResolverStub = `import type { AccessResolver } from \"@warlock.js/access\";\nimport type { Auth } from \"@warlock.js/auth\";\nimport { Role } from \"app/access/models/role\";\nimport { UserRole } from \"app/access/models/user-role\";\n\n/**\n * The app's access adapter — connects @warlock.js/access to the ejected role\n * tables. Roles come from the user_roles assignment table; permissions are\n * expanded by mapping those role names through the roles catalog table. Both\n * are managed at runtime (in the DB), so admins can add roles + edit their\n * permissions without a deploy.\n *\n * The engine owns the hard parts (wildcard matching, caching, fail-closed); this\n * resolver only fetches — keep it dumb, never cache inside it.\n */\nexport class DatabaseAccessResolver implements AccessResolver {\n  /** The role names this user holds (powers \\`hasRole\\` / \\`hasAnyRole\\`). */\n  public async resolveRoles(user: Auth, tenant?: string): Promise<string[]> {\n    return UserRole.rolesFor(user, tenant);\n  }\n\n  /** The effective permission strings this user has (powers \\`can\\` / \\`authorize\\`). */\n  public async resolvePermissions(user: Auth, tenant?: string): Promise<string[]> {\n    const names = await this.resolveRoles(user, tenant);\n\n    if (names.length === 0) return [];\n\n    const roles = await Role.query().whereIn(\"name\", names).get();\n\n    // Flatten + de-dupe so two roles granting the same permission yield one entry.\n    return [...new Set(roles.flatMap((role) => role.permissions))];\n  }\n\n  /**\n   * Optional. Resolve the ambient tenant when a check doesn't pass one\n   * explicitly — derive it from the authenticated user (safer than reading\n   * client request input, which a caller could spoof). Uncomment + adapt for a\n   * multi-tenant app (single-tenant apps leave this off and return undefined).\n   */\n  // public resolveTenant(user: Auth): string | undefined {\n  //   return user.get(\"organization_id\");\n  // }\n}\n`;\n\nexport const socketConfigStub = `import type { SocketOptions } from \"@warlock.js/core\";\n\n/**\n * Socket.IO configuration — read by the framework's socket connector\n * on boot. When the HTTP server is running the socket server attaches\n * to it; otherwise it listens on its own configured port.\n *\n * Remove this file to disable the socket server entirely.\n */\nexport default {\n  options: {\n    cors: {\n      origin: \"*\",\n    },\n  },\n} as SocketOptions;\n`;\n\nexport const communicatorsConfigStub = `import { env } from \"@warlock.js/core\";\nimport type { BrokerConfigurations, RabbitMQClientOptions } from \"@warlock.js/herald\";\n\nconst heraldConfigurations: BrokerConfigurations<RabbitMQClientOptions> = {\n  driver: \"rabbitmq\",\n  name: \"default\",\n  isDefault: true,\n\n  // ============================================================================\n  // Connection Settings\n  // ============================================================================\n\n  host: env(\"RABBITMQ_HOST\", \"localhost\"),\n  port: env(\"RABBITMQ_PORT\", 5672),\n  username: env(\"RABBITMQ_USERNAME\", \"guest\"),\n  password: env(\"RABBITMQ_PASSWORD\", \"guest\"),\n  vhost: env(\"RABBITMQ_VHOST\", \"/\"),\n\n  // Or use connection URI (takes precedence over host/port)\n  // uri: env(\"RABBITMQ_URL\"),\n\n  // ============================================================================\n  // Connection Options\n  // ============================================================================\n\n  /** Heartbeat interval in seconds */\n  heartbeat: 60,\n\n  /** Connection timeout in milliseconds */\n  connectionTimeout: 10000,\n\n  /** Enable automatic reconnection on disconnect */\n  reconnect: true,\n\n  /** Delay between reconnection attempts in milliseconds */\n  reconnectDelay: 5_000,\n\n  // ============================================================================\n  // Consumer Options\n  // ============================================================================\n\n  /** Default prefetch count (number of unacknowledged messages per consumer) */\n  prefetch: 10,\n\n  // ============================================================================\n  // Client Options (Native amqplib options)\n  // ============================================================================\n  // These options are passed directly to amqplib.connect()\n  // for low-level configuration like frame size, TLS, socket options, etc.\n  // ============================================================================\n  clientOptions: {\n    // Frame max size in bytes (0 = no limit)\n    // frameMax: 0,\n\n    // Channel max (0 = unlimited)\n    // channelMax: 0,\n\n    // Socket options\n    socket: {\n      // Enable TCP keep-alive\n      keepAlive: true,\n\n      // Disable Nagle's algorithm for lower latency\n      noDelay: true,\n\n      // Socket timeout (in addition to heartbeat)\n      // timeout: 30000,\n    },\n\n    // TLS/SSL options (uncomment for secure connections)\n    // socket: {\n    //   ca: fs.readFileSync('/path/to/ca.pem'),\n    //   cert: fs.readFileSync('/path/to/cert.pem'),\n    //   key: fs.readFileSync('/path/to/key.pem'),\n    //   rejectUnauthorized: true,\n    // },\n  },\n};\n\nexport default heraldConfigurations;\n`;\n\nexport const notificationsConfigStub = `import { type NotificationConfig, inApp, mailChannel } from \"@warlock.js/notifications\";\nimport { Notification } from \"app/notifications/models/notification/notification.model\";\n\n/**\n * Notifications configuration. Auto-loaded from src/config on boot — the\n * framework's notifications connector reads this default export and hands it to\n * setNotificationConfig, so this file stays declarative (no side-effect call).\n *\n * Each channel is payload-typed, so notify.mail(...) / notify.database(...)\n * and defineNotification are type-checked against the registry.\n *\n * Channels enabled here:\n *   - mail     wraps @warlock.js/core sendMail; route is notifiable.email.\n *              The \"from\" address defaults to config/mail.ts; override per\n *              channel with mailChannel({ from: \"no-reply@yourapp.com\" }).\n *   - database in-app store backed by the Notification model. The \"inApp\"\n *              facade exposes the recipient-scoped read API: listUnread,\n *              countUnread, markAsRead, dismiss, ...\n *\n * Async delivery (.queue()) is OPTIONAL: run \"npx warlock add herald\",\n * import { heraldQueue } from \"@warlock.js/notifications\", and uncomment the\n * queue line below.\n */\nconst config: NotificationConfig = {\n  channels: {\n    mail: mailChannel(),\n    database: inApp.configure({ model: Notification }),\n  },\n\n  // Async queue — requires @warlock.js/herald (npx warlock add herald):\n  // queue: heraldQueue(),\n};\n\nexport default config;\n`;\n\n/** `src/app/notifications/models/notification/notification.model.ts`. */\nexport const notificationModelStub = `import { RegisterModel } from \"@warlock.js/cascade\";\nimport { DatabaseNotification, type NotificationColumnMap } from \"@warlock.js/notifications\";\nimport { v } from \"@warlock.js/seal\";\nimport { NotificationResource } from \"../../resources/notification.resource\";\n\n/**\n * Validation schema for the notifications table — mirrors the migration\n * columns (snake_case). Cascade validates + casts every write against it:\n * nullable columns use .nullish() (may be absent or null), and payload is\n * free-form JSON. Keep this in sync with the migration + columnMap when you\n * add or rename columns.\n *\n * user_id accepts a string or an integer so it matches whichever id type your\n * users use (and the idType you pass to notificationColumns in the migration).\n * Narrow it to that one type.\n */\nconst notificationSchema = v.object({\n  user_id: v.union([v.string(), v.int()]),\n  type: v.string(),\n  title: v.string(),\n  body: v.string().nullish(),\n  payload: v.record(v.any()).nullish(),\n  read_at: v.date().nullish(),\n  idempotency_key: v.string().nullish(),\n});\n\n/**\n * In-app notification model.\n *\n * Extends the package's DatabaseNotification base, which provides the stable\n * accessors (recipientId, tenantId, isRead, readAt, markRead) — all derived\n * from the columnMap below. The read/write API lives on the inApp facade\n * (configured in config/notifications.ts); you rarely touch this class directly.\n */\n@RegisterModel()\nexport class Notification extends DatabaseNotification {\n  public static table = \"notifications\";\n  public static schema = notificationSchema;\n\n  /** Every response that returns a notification is shaped by this resource. */\n  public static resource = NotificationResource;\n\n  /**\n   * Maps the in-app store's roles to your columns. This default is\n   * single-tenant + read_at-only. Add tenant: \"organization_id\" for\n   * multi-tenant; use isRead: \"is_read\" (instead of, or alongside, readAt) to\n   * track a boolean read flag. The migration, the accessors and the resource\n   * all follow this map.\n   */\n  public static columnMap: NotificationColumnMap = { readAt: \"read_at\" };\n}\n`;\n\n/** The notifications migration, under `models/notification/migrations/`. */\nexport const notificationMigrationStub = `import { Migration } from \"@warlock.js/cascade\";\nimport { notificationColumns } from \"@warlock.js/notifications\";\nimport { Notification } from \"../notification.model\";\n\n/**\n * Notifications table.\n *\n * Columns come from notificationColumns(Notification) — the recipient / tenant\n * / read-state names follow the model's columnMap; type / title / body /\n * payload / idempotency_key are fixed. The recipient column is a UUID unless\n * you pass { idType: \"integer\" } (or \"bigint\" / \"string\") to match your users.\n * Spread it to add your own columns (and mirror them in the model schema):\n *\n *   import { uuid } from \"@warlock.js/cascade\";\n *\n *   export default Migration.create(Notification, {\n *     ...notificationColumns(Notification, { idType: \"integer\" }),\n *     // category_id: uuid().index().nullable(),\n *   });\n */\nexport default Migration.create(Notification, notificationColumns(Notification));\n`;\n\n/** `src/app/notifications/resources/notification.resource.ts` — the output shape. */\nexport const notificationResourceStub = `import { defineResource } from \"@warlock.js/core\";\n\n/**\n * What every notification endpoint returns, whatever columns the model holds.\n * readAt reads the default read_at column; change it if you change the model's\n * columnMap.\n */\nexport const NotificationResource = defineResource({\n  schema: {\n    // Passed through as stored: a UUID string or an integer, per the migration.\n    id: (id: string | number) => id,\n    type: \"string\",\n    title: \"string\",\n    body: \"string?\",\n    payload: \"object?\",\n    readAt: [\"read_at\", \"date?\"],\n    createdAt: \"date?\",\n  },\n});\n`;\n\n/** `src/app/notifications/schema/list-notifications.schema.ts` — the validated list query. */\nexport const listNotificationsSchemaStub = `import { type Infer, v } from \"@warlock.js/seal\";\n\n/**\n * Query for GET /notifications. Only these keys reach the store (others, such\n * as a cache-busting \\`_\\`, are dropped rather than rejected), and limit is\n * capped so one request cannot read every row. Query values arrive as strings,\n * so the numbers and the flag are coerced.\n */\nexport const listNotificationsSchema = v.object({\n  page: v.int().coerce().min(1).optional(),\n  limit: v.int().coerce().min(1).max(50).optional(),\n  type: v.string().optional(),\n  unread: v.boolean().coerce().optional(),\n}).stripUnknown();\n\nexport type ListNotificationsSchema = Infer<typeof listNotificationsSchema>;\n`;\n\n/** `src/app/notifications/types/notifications-request.type.ts` — the guarded request. */\nexport const notificationsRequestTypeStub = `import type { Request, RequestHandler, RequestLocals } from \"@warlock.js/core\";\nimport type { Id } from \"@warlock.js/notifications\";\n\n/**\n * A request that passed authMiddleware, so locals.user is always set. Only the\n * user's id is declared because that is all the inApp store needs. If your\n * app has its own guarded request type, use it instead.\n */\nexport type NotificationsRequest<Payload = unknown> = Request<Payload> & {\n  locals: RequestLocals & { user: { id: Id } };\n};\n\nexport type NotificationsRequestHandler<Payload = unknown> = RequestHandler<\n  NotificationsRequest<Payload>\n>;\n`;\n\n/** `src/app/notifications/services/mark-notification-read.service.ts`. */\nexport const markNotificationReadServiceStub = `import { ResourceNotFoundError, t } from \"@warlock.js/core\";\nimport { type Id, inApp } from \"@warlock.js/notifications\";\n\n/**\n * Mark one of the user's notifications read and return it. inApp is scoped to\n * the recipient, so another user's id changes nothing and answers 404 here.\n */\nexport async function markNotificationReadService(userId: Id, notificationId: Id) {\n  await inApp.markAsRead(userId, notificationId);\n\n  const notification = await inApp.find(userId, notificationId);\n\n  if (!notification) {\n    throw new ResourceNotFoundError(t(\"notifications.notFound\"));\n  }\n\n  return notification;\n}\n`;\n\n/** `src/app/notifications/controllers/list-notifications.controller.ts`. */\nexport const listNotificationsControllerStub = `import { inApp } from \"@warlock.js/notifications\";\nimport {\n  type ListNotificationsSchema,\n  listNotificationsSchema,\n} from \"../schema/list-notifications.schema\";\nimport type { NotificationsRequestHandler } from \"../types/notifications-request.type\";\n\n/** GET /notifications — the user's notifications, most recent first. */\nexport const listNotificationsController: NotificationsRequestHandler<\n  ListNotificationsSchema\n> = async ({ request, response }) => {\n  const { data, pagination } = await inApp.list(request.locals.user.id, request.validated());\n\n  return response.success({ notifications: data, pagination });\n};\n\nlistNotificationsController.description = \"List notifications\";\n\nlistNotificationsController.validation = {\n  schema: listNotificationsSchema,\n  validating: [\"query\"],\n};\n`;\n\n/** `src/app/notifications/controllers/unread-notifications-count.controller.ts`. */\nexport const unreadNotificationsCountControllerStub = `import { inApp } from \"@warlock.js/notifications\";\nimport type { NotificationsRequestHandler } from \"../types/notifications-request.type\";\n\n/** GET /notifications/unread-count — drives the bell badge. */\nexport const unreadNotificationsCountController: NotificationsRequestHandler = async ({\n  request,\n  response,\n}) => {\n  const count = await inApp.countUnread(request.locals.user.id);\n\n  return response.success({ count });\n};\n\nunreadNotificationsCountController.description = \"Unread notifications count\";\n`;\n\n/** `src/app/notifications/controllers/mark-notification-read.controller.ts`. */\nexport const markNotificationReadControllerStub = `import { markNotificationReadService } from \"../services/mark-notification-read.service\";\nimport type { NotificationsRequestHandler } from \"../types/notifications-request.type\";\n\n/** PATCH /notifications/:id/read — mark one read and return it. */\nexport const markNotificationReadController: NotificationsRequestHandler = async ({\n  request,\n  response,\n}) => {\n  // Route params are strings. A numeric id is an integer id (the default\n  // MongoDB stack); anything else, such as a UUID, stays a string.\n  const rawId = request.string(\"id\");\n  const id = /^\\\\d+$/.test(rawId) ? Number(rawId) : rawId;\n\n  const notification = await markNotificationReadService(request.locals.user.id, id);\n\n  return response.success({ notification });\n};\n\nmarkNotificationReadController.description = \"Mark notification read\";\n`;\n\n/** `src/app/notifications/controllers/mark-all-notifications-read.controller.ts`. */\nexport const markAllNotificationsReadControllerStub = `import { inApp } from \"@warlock.js/notifications\";\nimport type { NotificationsRequestHandler } from \"../types/notifications-request.type\";\n\n/** PATCH /notifications/read-all — mark every unread one read. */\nexport const markAllNotificationsReadController: NotificationsRequestHandler = async ({\n  request,\n  response,\n}) => {\n  const count = await inApp.markAsRead(request.locals.user.id);\n\n  return response.success({ count });\n};\n\nmarkAllNotificationsReadController.description = \"Mark all notifications read\";\n`;\n\n/** `src/app/notifications/routes.ts` — the four read endpoints behind `authMiddleware`. */\nexport const notificationRoutesStub = `import { authMiddleware } from \"@warlock.js/auth\";\nimport { router } from \"@warlock.js/core\";\nimport { listNotificationsController } from \"./controllers/list-notifications.controller\";\nimport { markAllNotificationsReadController } from \"./controllers/mark-all-notifications-read.controller\";\nimport { markNotificationReadController } from \"./controllers/mark-notification-read.controller\";\nimport { unreadNotificationsCountController } from \"./controllers/unread-notifications-count.controller\";\n\n/**\n * The signed-in user's own notifications.\n *\n * Notifications come from domain events, so there is no create. Dismissing is\n * left out on purpose; add it when the product needs it (inApp.dismiss).\n *\n * authMiddleware([]) admits any signed-in user. To limit who may read\n * notifications, add a permission gate to the group:\n *\n *   import { gate } from \"@warlock.js/access\";\n *\n *   router.group({ middleware: [authMiddleware([]), gate(\"notifications.read\")] }, ...);\n */\nrouter.group({ middleware: [authMiddleware([])] }, () => {\n  const notifications = router.route(\"/notifications\");\n\n  notifications.list(listNotificationsController);\n  notifications.nest(\"/unread-count\").get(unreadNotificationsCountController);\n  notifications.nest(\"/read-all\").patch(markAllNotificationsReadController);\n  notifications.nest(\"/:id/read\").patch(markNotificationReadController);\n});\n`;\n\n/** `src/app/notifications/utils/locales.json` — the module's translations. */\nexport const notificationLocalesStub = `{\n  \"notFound\": { \"en\": \"Notification not found\" }\n}\n`;\n\n/**\n * A controller spec for the notifications module, written only when the app\n * has the test feature. It checks the one thing true in every app — the route\n * refuses a request with no signed-in user — and leaves the signed-in cases to\n * the app, which owns its login helper.\n */\nexport function notificationControllerSpecStub(method: \"GET\" | \"PATCH\", path: string): string {\n  const helper = method === \"GET\" ? \"testGet\" : \"testPatch\";\n\n  return `import { ${helper} } from \"@warlock.js/core/tests\";\nimport { describe, expect, it } from \"vitest\";\n\ndescribe(\"${method} ${path}\", () => {\n  it(\"answers 401 without a signed-in user\", async () => {\n    const response = await ${helper}(\"${path}\");\n\n    expect(response.status).toBe(401);\n  });\n\n  // Add the signed-in cases with your app's login helper, including that\n  // another user's notifications are never returned or changed.\n});\n`;\n}\n\n/**\n * `src/web/root.tsx` — the application root for the SSR page layer.\n *\n * Deliberately minimal. The framework ships a default root, so this exists to\n * give you a place to start rather than because anything requires it. The\n * reference app (`v5/app/src/web/root.tsx`) is where to look for the fuller\n * shape: middleware, an app-level loader, locales, an ErrorBoundary.\n */\nexport const webRootStub = `import type { AppProps } from \"@warlock.js/web\";\nimport { Head, Scripts } from \"@warlock.js/web\";\n\n/**\n * The application root.\n *\n * NOT async, and it receives no request/response: it renders on the server and\n * again in the browser during hydration, where neither exists.\n */\nexport default function App({ children }: AppProps) {\n  return (\n    <html lang=\"en\">\n      <head>\n        {/*\n          <Head /> also renders the viewport tag (width=device-width,\n          initial-scale=1). Change it with \\`metadata.viewport\\`,\n          or set it to false to leave it out; do not add a second one here.\n        */}\n        {/*\n          Placement only. The framework injects the page's \\`metadata\\`, the\n          stylesheet and preload tags for this route, and the canonical links\n          into <head> by default — <Head /> just says WHERE they land.\n\n          Do not add a <title> here: the page's \\`metadata\\` owns it, and a root\n          that emits one too produces two.\n        */}\n        <Head />\n        <link rel=\"icon\" href=\"data:,\" />\n      </head>\n      <body>\n        {/*\n          REQUIRED — this is the hydration mount point, not a styling wrapper.\n\n          The browser runtime looks up \\`#vessel\\` and hydrates that element only.\n          Remove this div, or rename the id, and the page still renders from the\n          server but never becomes interactive: the runtime throws in the console\n          and nothing on screen changes.\n\n          Wrap it in your own markup freely, and put anything that must live\n          outside the hydrated tree (a static footer, a portal target) outside\n          it — just keep an element with \\`id=\"vessel\"\\` around {children}.\n        */}\n        <div id=\"vessel\">{children}</div>\n        {/*\n          The hydration payload and module tags. Written explicitly because\n          placement occasionally matters — a CSP nonce, or ordering against\n          your own scripts.\n        */}\n        <Scripts />\n      </body>\n    </html>\n  );\n}\n`;\n\n/**\n * `src/app/contact/controllers/contact.controller.ts` — a real API endpoint\n * for the Web starter's contact form. It intentionally has no persistence\n * dependency: replace the acknowledgement with a mail/job/database action.\n */\nexport const webContactControllerStub = `import { type Request, type RequestHandler } from \"@warlock.js/core\";\nimport { type Infer, v } from \"@warlock.js/seal\";\n\nexport const contactSchema = v.object({\n  name: v.string().min(2),\n  email: v.email(),\n  message: v.string().min(10),\n});\n\nexport type ContactSchema = Infer.Output<typeof contactSchema>;\n\n/** POST /api/contact — validates the starter contact form. */\nexport const contactController: RequestHandler<Request<ContactSchema>> = async ({\n  request,\n  response,\n}) => {\n  const contact = request.validated();\n\n  // Replace this with delivery/persistence for your app. Keeping the accepted\n  // payload visible makes the endpoint useful while remaining side-effect free.\n  return response.success({\n    message: \"Thanks, \" + contact.name + \". Your message has been received.\",\n  });\n};\n\ncontactController.validation = { schema: contactSchema };\n`;\n\n/** `src/app/contact/routes.ts` — discovered by the standard app route loader. */\nexport const webContactRoutesStub = `import { router } from \"@warlock.js/core\";\nimport { contactController } from \"./controllers/contact.controller\";\n\nrouter.post(\"/api/contact\", contactController);\n`;\n\n/**\n * `src/web/index.register.ts` — universal static setup for the starter page.\n *\n * The page re-exports this stable binding so Warlock's `register()` lifecycle\n * still sees it in both realms without making React Fast Refresh treat every\n * JSX edit as an incompatible function-export replacement.\n */\nexport const webHomeRegisterStub = `import { extend } from \"@mongez/localization\";\n\nexport function register() {\n  extend(\"en\", {\n    starter: {\n      title: \"Your Warlock app is running.\",\n      introduction: \"This page is rendered on the server and hydrated in the browser.\",\n      language: \"العربية\",\n      contact: \"Send a message\",\n      name: \"Name\",\n      email: \"Email\",\n      message: \"Message\",\n      submit: \"Send message\",\n      sent: \"Thanks — your message has been received.\",\n    },\n  });\n  extend(\"ar\", {\n    starter: {\n      title: \"تطبيق Warlock يعمل الآن.\",\n      introduction: \"تُعرض هذه الصفحة على الخادم ثم تُفعَّل في المتصفح.\",\n      language: \"English\",\n      contact: \"أرسل رسالة\",\n      name: \"الاسم\",\n      email: \"البريد الإلكتروني\",\n      message: \"الرسالة\",\n      submit: \"إرسال الرسالة\",\n      sent: \"شكرًا — تم استلام رسالتك.\",\n    },\n  });\n}\n`;\n\n/**\n * `src/web/index.page.tsx` — one page, so \\`warlock dev\\` has something to serve\n * the moment this finishes.\n */\nexport const webHomePageStub = `import { http } from \"@mongez/http\";\nimport { setCurrentLocaleCode } from \"@mongez/localization\";\nimport { Form, useFormControl, type FormControlProps } from \"@mongez/react-form\";\nimport { transX } from \"@mongez/react-localization\";\nimport { v } from \"@warlock.js/seal\";\nimport { Link, type PageConfig, type PageProps } from \"@warlock.js/web\";\nimport { useState } from \"react\";\n\nexport { register } from \"./index.register\";\n\n/**\n * A page route is an ordinary Warlock route whose handler renders React\n * instead of returning JSON.\n *\n * The URL and stable hydration name are the ones this file DECLARES below.\n * This page answers \\`GET \"/\"\\` because \\`config.route.path = \"/\"\\`, not because of\n * where the file lives. A page file with\n * no \\`config.route\\` declaration derives its URL from the filesystem.\n */\nexport const config: PageConfig = {\n  route: { path: \"/\", name: \"index\" },\n  metadata: { title: \"Home\" },\n};\n\nconst contactSchema = v.object({\n  name: v.string().min(2),\n  email: v.email(),\n  message: v.string().min(10),\n});\n\nfunction TextInput({ label, ...controlProps }: FormControlProps & { label: string }) {\n  const { error, getErrorProps, getInputProps } = useFormControl(controlProps);\n\n  return (\n    <div className=\"wk-field\">\n      <label htmlFor={controlProps.name}>{label}</label>\n      <input {...getInputProps()} />\n      {error && <p {...getErrorProps()}>{error}</p>}\n    </div>\n  );\n}\n\n/**\n * Add a \\`loader\\` export to fetch data on the server, and it arrives here as\n * \\`data\\`, typed:\n *\n *   export const loader = (async () => ({ items: await itemsRepository.all() }));\n *   export default function HomePage({ data }: PageProps<typeof loader>) { ... }\n */\nexport default function HomePage(_props: PageProps) {\n  // Live state. If the button below does nothing, the page rendered on the\n  // server but never hydrated — the runtime never mounted at \\`#vessel\\`. This is\n  // deliberately here so that failure is impossible to miss.\n  const [count, setCount] = useState(0);\n  const [locale, setLocale] = useState<\"en\" | \"ar\">(\"en\");\n  const [submitted, setSubmitted] = useState(false);\n  const [submitError, setSubmitError] = useState<string | null>(null);\n\n  const toggleLocale = () => {\n    const nextLocale = locale === \"en\" ? \"ar\" : \"en\";\n    setCurrentLocaleCode(nextLocale);\n    setLocale(nextLocale);\n  };\n\n  return (\n    <>\n      {/*\n        Self-contained, dependency-free styling: plain CSS, system fonts, and\n        CSS custom properties, scoped to this page. No CSS framework, no utility\n        classes, no external stylesheet — this page looks the same whether or\n        not \\`warlock add tailwind\\` has ever been run.\n      */}\n      <style>{\\`\n        .wk-home {\n          --wk-fg: #0f172a;\n          --wk-muted: #64748b;\n          --wk-accent: #4f46e5;\n          --wk-border: #e2e8f0;\n          font-family: system-ui, -apple-system, \"Segoe UI\", Roboto, sans-serif;\n          color: var(--wk-fg);\n          max-width: 42rem;\n          margin: 4rem auto;\n          padding: 0 1.5rem;\n          line-height: 1.6;\n        }\n        .wk-home h1 { font-size: 2.25rem; margin: 0 0 0.5rem; }\n        .wk-home p { color: var(--wk-muted); margin: 0 0 1.5rem; }\n        .wk-home code {\n          font-family: ui-monospace, \"SFMono-Regular\", Menlo, monospace;\n          background: #f1f5f9;\n          padding: 0.1rem 0.35rem;\n          border-radius: 0.25rem;\n        }\n        .wk-check {\n          border: 1px solid var(--wk-border);\n          border-radius: 0.75rem;\n          padding: 1.25rem 1.5rem;\n          margin: 2rem 0;\n        }\n        .wk-check strong { display: block; font-size: 1.5rem; }\n        .wk-check button {\n          font: inherit;\n          cursor: pointer;\n          background: var(--wk-accent);\n          color: #fff;\n          border: 0;\n          border-radius: 0.5rem;\n          padding: 0.5rem 1rem;\n          margin-top: 0.75rem;\n        }\n        .wk-links { display: flex; gap: 1.25rem; font-size: 0.95rem; }\n        .wk-links a { color: var(--wk-accent); text-decoration: none; }\n        .wk-links a:hover { text-decoration: underline; }\n        .wk-language { margin-left: auto; }\n        .wk-contact { margin-top: 2rem; }\n        .wk-field { display: grid; gap: 0.35rem; margin: 0.8rem 0; }\n        .wk-field input, .wk-field textarea { font: inherit; padding: 0.55rem; }\n        .wk-field p, .wk-submit-error { color: #b91c1c; margin: 0; }\n        .wk-success { color: #047857; }\n      \\`}</style>\n\n      <main className=\"wk-home\" dir={locale === \"ar\" ? \"rtl\" : \"ltr\"}>\n        <nav className=\"wk-links\" aria-label=\"Starter links\">\n          <a href=\"https://warlock.js.org\" target=\"_blank\" rel=\"noreferrer\">\n            Docs\n          </a>\n          <Link href=\"/\" aria-current=\"page\">\n            Home\n          </Link>\n          <button\n            className=\"wk-language\"\n            type=\"button\"\n            aria-pressed={locale === \"ar\"}\n            onClick={toggleLocale}\n          >\n            {transX(\"starter.language\")}\n          </button>\n        </nav>\n\n        <h1>{transX(\"starter.title\")}</h1>\n        <p>{transX(\"starter.introduction\")}</p>\n\n        <section className=\"wk-check\">\n          <label>If this number goes up when you click, React is hydrated:</label>\n          <strong>{count}</strong>\n          <button type=\"button\" onClick={() => setCount((c) => c + 1)}>\n            Count up\n          </button>\n        </section>\n\n        <section className=\"wk-contact\" aria-labelledby=\"contact-heading\">\n          <h2 id=\"contact-heading\">{transX(\"starter.contact\")}</h2>\n          <Form<typeof contactSchema>\n            id=\"contact-form\"\n            schema={contactSchema}\n            onSubmit={async ({ form, values }) => {\n              setSubmitted(false);\n              setSubmitError(null);\n              const result = await http.post<{ message: string }>(\"/api/contact\", values);\n\n              if (result.error) {\n                if (result.error.isValidationError) {\n                  const body = result.error.body as {\n                    errors?: Array<{ input: string; error: string }>;\n                    message?: string;\n                  };\n                  form.setErrors(\n                    Object.fromEntries(\n                      (body.errors ?? []).map(({ input, error }) => [input, error]),\n                    ),\n                  );\n                  setSubmitError(body.message ?? \"Please correct the highlighted fields.\");\n                } else {\n                  setSubmitError(\"Your message could not be sent. Please try again.\");\n                }\n                return;\n              }\n\n              setSubmitted(true);\n              form.reset();\n            }}\n          >\n            <TextInput name=\"name\" label={transX(\"starter.name\")} autoComplete=\"name\" />\n            <TextInput\n              name=\"email\"\n              label={transX(\"starter.email\")}\n              type=\"email\"\n              autoComplete=\"email\"\n            />\n            <ContactMessage />\n            <button type=\"submit\">{transX(\"starter.submit\")}</button>\n            {submitError && (\n              <p className=\"wk-submit-error\" role=\"alert\">\n                {submitError}\n              </p>\n            )}\n            {submitted && (\n              <p className=\"wk-success\" role=\"status\">\n                {transX(\"starter.sent\")}\n              </p>\n            )}\n          </Form>\n        </section>\n      </main>\n    </>\n  );\n}\n\nfunction ContactMessage() {\n  const { error, getErrorProps, getInputProps } = useFormControl({ name: \"message\" });\n\n  return (\n    <div className=\"wk-field\">\n      <label htmlFor=\"message\">{transX(\"starter.message\")}</label>\n      <textarea {...getInputProps()} rows={5} />\n      {error && <p {...getErrorProps()}>{error}</p>}\n    </div>\n  );\n}\n`;\n"],"mappings":";AAAA,MAAa,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BhC,MAAa,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+B5B,MAAa,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCnC,MAAa,2BAA2B;;AAGxC,MAAa,0BAA0B;;;;;;;;;;;;AAavC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8FvC,MAAa,+BAA+B;;AAG5C,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;AAsB3C,MAAa,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6ClC,MAAa,mBAAmB;;;;;;;;;;;;;;;;;AAkBhC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFvC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCvC,MAAa,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDrC,MAAa,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;AAwBzC,MAAa,2BAA2B;;;;;;;;;;;;;;;;;;;;;AAsBxC,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;AAmB3C,MAAa,+BAA+B;;;;;;;;;;;;;;;;;AAkB5C,MAAa,kCAAkC;;;;;;;;;;;;;;;;;;;;AAqB/C,MAAa,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;AAyB/C,MAAa,yCAAyC;;;;;;;;;;;;;;;;AAiBtD,MAAa,qCAAqC;;;;;;;;;;;;;;;;;;;;;AAsBlD,MAAa,yCAAyC;;;;;;;;;;;;;;;;AAiBtD,MAAa,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BtC,MAAa,0BAA0B;;;;;;;;;;AAWvC,SAAgB,+BAA+B,QAAyB,MAAsB;CAC5F,MAAM,SAAS,WAAW,QAAQ,YAAY;CAE9C,OAAO,YAAY,OAAO;;;YAGhB,OAAO,GAAG,KAAK;;6BAEE,OAAO,IAAI,KAAK;;;;;;;;;AAS7C;;;;;;;;;AAUA,MAAa,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4D3B,MAAa,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BxC,MAAa,uBAAuB;;;;;;;;;;;;AAapC,MAAa,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCnC,MAAa,kBAAkB"}
+{"version":3,"file":"stubs.mjs","names":[],"sources":["../../../../../../../../packages/core/src/generations/stubs.ts"],"sourcesContent":["export const accessConfigStub = `import { type AccessConfigurations } from \"@warlock.js/access\";\nimport { DatabaseAccessResolver } from \"app/access/services/access-resolver\";\n\n/**\n * Authorization configuration — read by @warlock.js/access on boot.\n *\n * The resolver is the one required piece: it tells the engine how to read a\n * user's roles + permissions. The ejected DatabaseAccessResolver reads roles\n * from the user_roles table and maps them through the roles catalog table (so\n * roles + their permissions are managed at runtime, in the DB).\n *\n * For a fixed, code-defined catalog with no tables, swap in DefaultAccessResolver:\n *   import { DefaultAccessResolver } from \"@warlock.js/access\";\n *   resolver: new DefaultAccessResolver({ admin: [\"*\"], editor: [\"orders.*\"] }),\n *\n * Multi-tenant? Add a \\`resolveTenant()\\` to the resolver to read the active\n * tenant from the request; checks then scope to it automatically.\n */\nconst access: AccessConfigurations = {\n  resolver: new DatabaseAccessResolver(),\n\n  // Cache resolved permission sets (default \"10m\").\n  // cache: { ttl: \"10m\" },\n};\n\nexport default access;\n`;\n\nexport const aiConfigStub = `import type { AIConfig } from \"@warlock.js/ai\";\n\n// >>> warlock:ai-packages (auto-managed) >>>\n// Satellite packages augment the \"ai\" object on import — e.g. ai.workspace,\n// ai.tools / ai.mcp, and panoptic's ai.config({ panoptic }) wiring. The command\n// \"warlock add ai-workspace | ai-tools | ai-panoptic\" adds the matching\n// side-effect import below; keep them so the augmentation + runtime registration\n// load before the ai connector applies this config.\n// <<< warlock:ai-packages <<<\n\n/**\n * AI configuration — applied on boot by the ai connector, which calls\n * ai.config(...) with the object below. Cross-cutting defaults live here\n * (shared cache / snapshot stores, observability); per-call options always win.\n *\n * Wire a default model from a provider you installed, e.g.:\n *   import { OpenAISDK } from \"@warlock.js/ai-openai\";\n *   const openai = OpenAISDK({ apiKey: env(\"OPENAI_API_KEY\") });\n *   // then pass openai.model({ name: \"gpt-4o-mini\" }) into your agents.\n */\nconst ai: Partial<AIConfig> = {\n  // Default cache driver for cache-backed AI features (semantic cache, rag / memory vector stores).\n  // defaultStore: cache.driver(\"redis\", { client }),\n\n  // Observability — requires \"warlock add ai-panoptic\". Exporters + the local dashboard.\n  // panoptic: { exporters: [], dashboard: false, observeAll: false },\n};\n\nexport default ai;\n`;\n\nexport const accessRoleModelStub = `import { Model, RegisterModel } from \"@warlock.js/cascade\";\nimport { type Infer, v } from \"@warlock.js/seal\";\n\n/**\n * Validation schema for the roles catalog — mirrors the migration columns\n * (snake_case). Each row is a role name plus the permission strings it grants;\n * wildcards work (\"orders.*\", \"*\"). The DatabaseAccessResolver maps a user's\n * assigned role names through this table to their effective permissions.\n */\nexport const roleSchema = v.object({\n  name: v.string(),\n  permissions: v.array(v.string()).default([]),\n});\n\nexport type RoleSchema = Infer<typeof roleSchema>;\n\n/**\n * The roles catalog — role name → the permissions it grants. Managed at runtime\n * (admins add roles + edit their permissions), unlike a fixed code map. Read by\n * DatabaseAccessResolver.resolvePermissions to expand a user's roles to permissions.\n */\n@RegisterModel()\nexport class Role extends Model<RoleSchema> {\n  public static table = \"roles\";\n\n  public static schema = roleSchema;\n\n  /** The permission strings this role grants. */\n  public get permissions(): string[] {\n    return this.get<string[]>(\"permissions\", []);\n  }\n}\n`;\n\nexport const accessRoleModelIndexStub = `export * from \"./role.model\";\n`;\n\nexport const accessRoleMigrationStub = `import { arrayText, Migration, text } from \"@warlock.js/cascade\";\nimport { Role } from \"../role.model\";\n\n/**\n * Roles catalog table. \\`name\\` is unique (one row per role); \\`permissions\\` is a\n * text array of the permission strings the role grants.\n */\nexport default Migration.create(Role, {\n  name: text().notNullable().unique(),\n  permissions: arrayText().nullable(),\n});\n`;\n\nexport const accessUserRoleModelStub = `import { access } from \"@warlock.js/access\";\nimport type { Auth } from \"@warlock.js/auth\";\nimport { Model, RegisterModel } from \"@warlock.js/cascade\";\nimport { type Infer, v } from \"@warlock.js/seal\";\n\n/**\n * Validation schema for a role assignment — mirrors the migration columns\n * (snake_case). \\`tenant\\` is nullable: a null tenant is a GLOBAL assignment.\n */\nexport const userRoleSchema = v.object({\n  user_id: v.string(),\n  user_type: v.string(),\n  role: v.string(),\n  tenant: v.string().optional(),\n});\n\nexport type UserRoleSchema = Infer<typeof userRoleSchema>;\n\n/**\n * The role-assignment table — which roles a user holds, optionally per tenant.\n * Read by DatabaseAccessResolver.resolveRoles; mutated via the statics below.\n * \\`assign\\` / \\`revoke\\` flush the cached permission set automatically, so callers\n * never need to call \\`access.flush(user, tenant)\\` themselves.\n */\n@RegisterModel()\nexport class UserRole extends Model<UserRoleSchema> {\n  public static table = \"user_roles\";\n\n  public static schema = userRoleSchema;\n\n  /**\n   * Role names assigned to the user in the given tenant.\n   *\n   * An unresolved tenant (\\`undefined\\`) scopes to GLOBAL roles only — the rows\n   * stored with no tenant (\\`null\\`) — never the union across every tenant. The\n   * union would be a privilege-escalation: a user who is \\`owner\\` in one tenant\n   * must not be treated as \\`owner\\` everywhere just because a check didn't carry\n   * a tenant. This mirrors how \\`assign(user, role)\\` stores a global row.\n   */\n  public static async rolesFor(user: Auth, tenant?: string): Promise<string[]> {\n    const rows = await this.query()\n      .where({\n        user_id: user.id,\n        user_type: user.userType,\n        tenant: tenant ?? null,\n      })\n      .get();\n\n    // De-dupe so a duplicate row (a concurrent assign that slipped past the\n    // existence check) can't distort the resolved set.\n    return [...new Set(rows.map((row) => row.get(\"role\") as string))];\n  }\n\n  /**\n   * Assign a role to the user. No-op if the assignment already exists.\n   * Flushes the user's cached permission set automatically.\n   */\n  public static async assign(user: Auth, role: string, tenant?: string): Promise<void> {\n    const existing = await this.first({\n      user_id: user.id,\n      user_type: user.userType,\n      role,\n      tenant: tenant ?? null,\n    });\n\n    if (existing) return;\n\n    await this.create({\n      user_id: user.id,\n      user_type: user.userType,\n      role,\n      tenant,\n    });\n\n    await access.flush(user, tenant);\n  }\n\n  /**\n   * Remove a role assignment from the user.\n   * Flushes the user's cached permission set automatically.\n   */\n  public static async revoke(user: Auth, role: string, tenant?: string): Promise<void> {\n    await this.delete({\n      user_id: user.id,\n      user_type: user.userType,\n      role,\n      tenant: tenant ?? null,\n    });\n\n    await access.flush(user, tenant);\n  }\n}\n`;\n\nexport const accessUserRoleModelIndexStub = `export * from \"./user-role.model\";\n`;\n\nexport const accessUserRoleMigrationStub = `import { Migration, text, uuid } from \"@warlock.js/cascade\";\nimport { UserRole } from \"../user-role.model\";\n\n/**\n * Role-assignment table. \\`user_id\\` is a UUID — override this migration if your\n * user ids are integers. The composite index powers the per-user (per-tenant)\n * lookup the resolver runs on every check.\n */\nexport default Migration.create(\n  UserRole,\n  {\n    user_id: uuid().notNullable().index(),\n    user_type: text().notNullable(),\n    role: text().notNullable().index(),\n    tenant: text().nullable().index(),\n  },\n  {\n    index: [{ columns: [\"user_id\", \"user_type\", \"tenant\"] }],\n  },\n);\n`;\n\nexport const accessResolverStub = `import type { AccessResolver } from \"@warlock.js/access\";\nimport type { Auth } from \"@warlock.js/auth\";\nimport { Role } from \"app/access/models/role\";\nimport { UserRole } from \"app/access/models/user-role\";\n\n/**\n * The app's access adapter — connects @warlock.js/access to the ejected role\n * tables. Roles come from the user_roles assignment table; permissions are\n * expanded by mapping those role names through the roles catalog table. Both\n * are managed at runtime (in the DB), so admins can add roles + edit their\n * permissions without a deploy.\n *\n * The engine owns the hard parts (wildcard matching, caching, fail-closed); this\n * resolver only fetches — keep it dumb, never cache inside it.\n */\nexport class DatabaseAccessResolver implements AccessResolver {\n  /** The role names this user holds (powers \\`hasRole\\` / \\`hasAnyRole\\`). */\n  public async resolveRoles(user: Auth, tenant?: string): Promise<string[]> {\n    return UserRole.rolesFor(user, tenant);\n  }\n\n  /** The effective permission strings this user has (powers \\`can\\` / \\`authorize\\`). */\n  public async resolvePermissions(user: Auth, tenant?: string): Promise<string[]> {\n    const names = await this.resolveRoles(user, tenant);\n\n    if (names.length === 0) return [];\n\n    const roles = await Role.query().whereIn(\"name\", names).get();\n\n    // Flatten + de-dupe so two roles granting the same permission yield one entry.\n    return [...new Set(roles.flatMap((role) => role.permissions))];\n  }\n\n  /**\n   * Optional. Resolve the ambient tenant when a check doesn't pass one\n   * explicitly — derive it from the authenticated user (safer than reading\n   * client request input, which a caller could spoof). Uncomment + adapt for a\n   * multi-tenant app (single-tenant apps leave this off and return undefined).\n   */\n  // public resolveTenant(user: Auth): string | undefined {\n  //   return user.get(\"organization_id\");\n  // }\n}\n`;\n\nexport const socketConfigStub = `import type { SocketOptions } from \"@warlock.js/core\";\n\n/**\n * Socket.IO configuration — read by the framework's socket connector\n * on boot. When the HTTP server is running the socket server attaches\n * to it; otherwise it listens on its own configured port.\n *\n * Remove this file to disable the socket server entirely.\n */\nexport default {\n  options: {\n    cors: {\n      origin: \"*\",\n    },\n  },\n} as SocketOptions;\n`;\n\nexport const communicatorsConfigStub = `import { env } from \"@warlock.js/core\";\nimport type { BrokerConfigurations, RabbitMQClientOptions } from \"@warlock.js/herald\";\n\nconst heraldConfigurations: BrokerConfigurations<RabbitMQClientOptions> = {\n  driver: \"rabbitmq\",\n  name: \"default\",\n  isDefault: true,\n\n  // ============================================================================\n  // Connection Settings\n  // ============================================================================\n\n  host: env(\"RABBITMQ_HOST\", \"localhost\"),\n  port: env(\"RABBITMQ_PORT\", 5672),\n  username: env(\"RABBITMQ_USERNAME\", \"guest\"),\n  password: env(\"RABBITMQ_PASSWORD\", \"guest\"),\n  vhost: env(\"RABBITMQ_VHOST\", \"/\"),\n\n  // Or use connection URI (takes precedence over host/port)\n  // uri: env(\"RABBITMQ_URL\"),\n\n  // ============================================================================\n  // Connection Options\n  // ============================================================================\n\n  /** Heartbeat interval in seconds */\n  heartbeat: 60,\n\n  /** Connection timeout in milliseconds */\n  connectionTimeout: 10000,\n\n  /** Enable automatic reconnection on disconnect */\n  reconnect: true,\n\n  /** Delay between reconnection attempts in milliseconds */\n  reconnectDelay: 5_000,\n\n  // ============================================================================\n  // Consumer Options\n  // ============================================================================\n\n  /** Default prefetch count (number of unacknowledged messages per consumer) */\n  prefetch: 10,\n\n  // ============================================================================\n  // Client Options (Native amqplib options)\n  // ============================================================================\n  // These options are passed directly to amqplib.connect()\n  // for low-level configuration like frame size, TLS, socket options, etc.\n  // ============================================================================\n  clientOptions: {\n    // Frame max size in bytes (0 = no limit)\n    // frameMax: 0,\n\n    // Channel max (0 = unlimited)\n    // channelMax: 0,\n\n    // Socket options\n    socket: {\n      // Enable TCP keep-alive\n      keepAlive: true,\n\n      // Disable Nagle's algorithm for lower latency\n      noDelay: true,\n\n      // Socket timeout (in addition to heartbeat)\n      // timeout: 30000,\n    },\n\n    // TLS/SSL options (uncomment for secure connections)\n    // socket: {\n    //   ca: fs.readFileSync('/path/to/ca.pem'),\n    //   cert: fs.readFileSync('/path/to/cert.pem'),\n    //   key: fs.readFileSync('/path/to/key.pem'),\n    //   rejectUnauthorized: true,\n    // },\n  },\n};\n\nexport default heraldConfigurations;\n`;\n\nexport const notificationsConfigStub = `import { type NotificationConfig, inApp, mailChannel } from \"@warlock.js/notifications\";\nimport { Notification } from \"app/notifications/models/notification/notification.model\";\n\n/**\n * Notifications configuration. Auto-loaded from src/config on boot — the\n * framework's notifications connector reads this default export and hands it to\n * setNotificationConfig, so this file stays declarative (no side-effect call).\n *\n * Each channel is payload-typed, so notify.mail(...) / notify.database(...)\n * and defineNotification are type-checked against the registry.\n *\n * Channels enabled here:\n *   - mail     wraps @warlock.js/core sendMail; route is notifiable.email.\n *              The \"from\" address defaults to config/mail.ts; override per\n *              channel with mailChannel({ from: \"no-reply@yourapp.com\" }).\n *   - database in-app store backed by the Notification model. The \"inApp\"\n *              facade exposes the recipient-scoped read API: listUnread,\n *              countUnread, markAsRead, dismiss, ...\n *\n * Async delivery (.queue()) is OPTIONAL: run \"npx warlock add herald\",\n * import { heraldQueue } from \"@warlock.js/notifications\", and uncomment the\n * queue line below.\n */\nconst config: NotificationConfig = {\n  channels: {\n    mail: mailChannel(),\n    database: inApp.configure({ model: Notification }),\n  },\n\n  // Async queue — requires @warlock.js/herald (npx warlock add herald):\n  // queue: heraldQueue(),\n};\n\nexport default config;\n`;\n\n/** `src/app/notifications/models/notification/notification.model.ts`. */\nexport const notificationModelStub = `import { RegisterModel } from \"@warlock.js/cascade\";\nimport { DatabaseNotification, type NotificationColumnMap } from \"@warlock.js/notifications\";\nimport { v } from \"@warlock.js/seal\";\nimport { NotificationResource } from \"../../resources/notification.resource\";\n\n/**\n * Validation schema for the notifications table — mirrors the migration\n * columns (snake_case). Cascade validates + casts every write against it:\n * nullable columns use .nullish() (may be absent or null), and payload is\n * free-form JSON. Keep this in sync with the migration + columnMap when you\n * add or rename columns.\n *\n * user_id accepts a string or an integer so it matches whichever id type your\n * users use (and the idType you pass to notificationColumns in the migration).\n * Narrow it to that one type.\n */\nconst notificationSchema = v.object({\n  user_id: v.union([v.string(), v.int()]),\n  type: v.string(),\n  title: v.string(),\n  body: v.string().nullish(),\n  payload: v.record(v.any()).nullish(),\n  read_at: v.date().nullish(),\n  idempotency_key: v.string().nullish(),\n});\n\n/**\n * In-app notification model.\n *\n * Extends the package's DatabaseNotification base, which provides the stable\n * accessors (recipientId, tenantId, isRead, readAt, markRead) — all derived\n * from the columnMap below. The read/write API lives on the inApp facade\n * (configured in config/notifications.ts); you rarely touch this class directly.\n */\n@RegisterModel()\nexport class Notification extends DatabaseNotification {\n  public static table = \"notifications\";\n  public static schema = notificationSchema;\n\n  /** Every response that returns a notification is shaped by this resource. */\n  public static resource = NotificationResource;\n\n  /**\n   * Maps the in-app store's roles to your columns. This default is\n   * single-tenant + read_at-only. Add tenant: \"organization_id\" for\n   * multi-tenant; use isRead: \"is_read\" (instead of, or alongside, readAt) to\n   * track a boolean read flag. The migration, the accessors and the resource\n   * all follow this map.\n   */\n  public static columnMap: NotificationColumnMap = { readAt: \"read_at\" };\n}\n`;\n\n/** The notifications migration, under `models/notification/migrations/`. */\nexport const notificationMigrationStub = `import { Migration } from \"@warlock.js/cascade\";\nimport { notificationColumns } from \"@warlock.js/notifications\";\nimport { Notification } from \"../notification.model\";\n\n/**\n * Notifications table.\n *\n * Columns come from notificationColumns(Notification) — the recipient / tenant\n * / read-state names follow the model's columnMap; type / title / body /\n * payload / idempotency_key are fixed. The recipient column is a UUID unless\n * you pass { idType: \"integer\" } (or \"bigint\" / \"string\") to match your users.\n * Spread it to add your own columns (and mirror them in the model schema):\n *\n *   import { uuid } from \"@warlock.js/cascade\";\n *\n *   export default Migration.create(Notification, {\n *     ...notificationColumns(Notification, { idType: \"integer\" }),\n *     // category_id: uuid().index().nullable(),\n *   });\n */\nexport default Migration.create(Notification, notificationColumns(Notification));\n`;\n\n/** `src/app/notifications/resources/notification.resource.ts` — the output shape. */\nexport const notificationResourceStub = `import { defineResource } from \"@warlock.js/core\";\n\n/**\n * What every notification endpoint returns, whatever columns the model holds.\n * readAt reads the default read_at column; change it if you change the model's\n * columnMap.\n */\nexport const NotificationResource = defineResource({\n  schema: {\n    // Passed through as stored: a UUID string or an integer, per the migration.\n    id: (id: string | number) => id,\n    type: \"string\",\n    title: \"string\",\n    body: \"string?\",\n    payload: \"object?\",\n    readAt: [\"read_at\", \"date?\"],\n    createdAt: \"date?\",\n  },\n});\n`;\n\n/** `src/app/notifications/schema/list-notifications.schema.ts` — the validated list query. */\nexport const listNotificationsSchemaStub = `import { type Infer, v } from \"@warlock.js/seal\";\n\n/**\n * Query for GET /notifications. Only these keys reach the store (others, such\n * as a cache-busting \\`_\\`, are dropped rather than rejected), and limit is\n * capped so one request cannot read every row. Query values arrive as strings,\n * so the numbers and the flag are coerced.\n */\nexport const listNotificationsSchema = v.object({\n  page: v.int().coerce().min(1).optional(),\n  limit: v.int().coerce().min(1).max(50).optional(),\n  type: v.string().optional(),\n  unread: v.boolean().coerce().optional(),\n}).stripUnknown();\n\nexport type ListNotificationsSchema = Infer<typeof listNotificationsSchema>;\n`;\n\n/** `src/app/notifications/types/notifications-request.type.ts` — the guarded request. */\nexport const notificationsRequestTypeStub = `import type { Request, RequestHandler, RequestLocals } from \"@warlock.js/core\";\nimport type { Id } from \"@warlock.js/notifications\";\n\n/**\n * A request that passed authMiddleware, so locals.user is always set. Only the\n * user's id is declared because that is all the inApp store needs. If your\n * app has its own guarded request type, use it instead.\n */\nexport type NotificationsRequest<Payload = unknown> = Request<Payload> & {\n  locals: RequestLocals & { user: { id: Id } };\n};\n\nexport type NotificationsRequestHandler<Payload = unknown> = RequestHandler<\n  NotificationsRequest<Payload>\n>;\n`;\n\n/** `src/app/notifications/services/mark-notification-read.service.ts`. */\nexport const markNotificationReadServiceStub = `import { ResourceNotFoundError, t } from \"@warlock.js/core\";\nimport { type Id, inApp } from \"@warlock.js/notifications\";\n\n/**\n * Mark one of the user's notifications read and return it. inApp is scoped to\n * the recipient, so another user's id changes nothing and answers 404 here.\n */\nexport async function markNotificationReadService(userId: Id, notificationId: Id) {\n  await inApp.markAsRead(userId, notificationId);\n\n  const notification = await inApp.find(userId, notificationId);\n\n  if (!notification) {\n    throw new ResourceNotFoundError(t(\"notifications.notFound\"));\n  }\n\n  return notification;\n}\n`;\n\n/** `src/app/notifications/controllers/list-notifications.controller.ts`. */\nexport const listNotificationsControllerStub = `import { inApp } from \"@warlock.js/notifications\";\nimport {\n  type ListNotificationsSchema,\n  listNotificationsSchema,\n} from \"../schema/list-notifications.schema\";\nimport type { NotificationsRequestHandler } from \"../types/notifications-request.type\";\n\n/** GET /notifications — the user's notifications, most recent first. */\nexport const listNotificationsController: NotificationsRequestHandler<\n  ListNotificationsSchema\n> = async ({ request, response }) => {\n  const { data, pagination } = await inApp.list(request.locals.user.id, request.validated());\n\n  return response.success({ notifications: data, pagination });\n};\n\nlistNotificationsController.description = \"List notifications\";\n\nlistNotificationsController.validation = {\n  schema: listNotificationsSchema,\n  validating: [\"query\"],\n};\n`;\n\n/** `src/app/notifications/controllers/unread-notifications-count.controller.ts`. */\nexport const unreadNotificationsCountControllerStub = `import { inApp } from \"@warlock.js/notifications\";\nimport type { NotificationsRequestHandler } from \"../types/notifications-request.type\";\n\n/** GET /notifications/unread-count — drives the bell badge. */\nexport const unreadNotificationsCountController: NotificationsRequestHandler = async ({\n  request,\n  response,\n}) => {\n  const count = await inApp.countUnread(request.locals.user.id);\n\n  return response.success({ count });\n};\n\nunreadNotificationsCountController.description = \"Unread notifications count\";\n`;\n\n/** `src/app/notifications/controllers/mark-notification-read.controller.ts`. */\nexport const markNotificationReadControllerStub = `import { markNotificationReadService } from \"../services/mark-notification-read.service\";\nimport type { NotificationsRequestHandler } from \"../types/notifications-request.type\";\n\n/** PATCH /notifications/:id/read — mark one read and return it. */\nexport const markNotificationReadController: NotificationsRequestHandler = async ({\n  request,\n  response,\n}) => {\n  // Route params are strings. A numeric id is an integer id (the default\n  // MongoDB stack); anything else, such as a UUID, stays a string.\n  const rawId = request.string(\"id\");\n  const id = /^\\\\d+$/.test(rawId) ? Number(rawId) : rawId;\n\n  const notification = await markNotificationReadService(request.locals.user.id, id);\n\n  return response.success({ notification });\n};\n\nmarkNotificationReadController.description = \"Mark notification read\";\n`;\n\n/** `src/app/notifications/controllers/mark-all-notifications-read.controller.ts`. */\nexport const markAllNotificationsReadControllerStub = `import { inApp } from \"@warlock.js/notifications\";\nimport type { NotificationsRequestHandler } from \"../types/notifications-request.type\";\n\n/** PATCH /notifications/read-all — mark every unread one read. */\nexport const markAllNotificationsReadController: NotificationsRequestHandler = async ({\n  request,\n  response,\n}) => {\n  const count = await inApp.markAsRead(request.locals.user.id);\n\n  return response.success({ count });\n};\n\nmarkAllNotificationsReadController.description = \"Mark all notifications read\";\n`;\n\n/** `src/app/notifications/routes.ts` — the four read endpoints behind `authMiddleware`. */\nexport const notificationRoutesStub = `import { authMiddleware } from \"@warlock.js/auth\";\nimport { router } from \"@warlock.js/core\";\nimport { listNotificationsController } from \"./controllers/list-notifications.controller\";\nimport { markAllNotificationsReadController } from \"./controllers/mark-all-notifications-read.controller\";\nimport { markNotificationReadController } from \"./controllers/mark-notification-read.controller\";\nimport { unreadNotificationsCountController } from \"./controllers/unread-notifications-count.controller\";\n\n/**\n * The signed-in user's own notifications.\n *\n * Notifications come from domain events, so there is no create. Dismissing is\n * left out on purpose; add it when the product needs it (inApp.dismiss).\n *\n * authMiddleware([]) admits any signed-in user. To limit who may read\n * notifications, add a permission gate to the group:\n *\n *   import { gate } from \"@warlock.js/access\";\n *\n *   router.group({ middleware: [authMiddleware([]), gate(\"notifications.read\")] }, ...);\n */\nrouter.group({ middleware: [authMiddleware([])] }, () => {\n  const notifications = router.route(\"/notifications\");\n\n  notifications.list(listNotificationsController);\n  notifications.nest(\"/unread-count\").get(unreadNotificationsCountController);\n  notifications.nest(\"/read-all\").patch(markAllNotificationsReadController);\n  notifications.nest(\"/:id/read\").patch(markNotificationReadController);\n});\n`;\n\n/** `src/app/notifications/utils/locales.json` — the module's translations. */\nexport const notificationLocalesStub = `{\n  \"notFound\": { \"en\": \"Notification not found\" }\n}\n`;\n\n/** Shared fixtures for the generated signed-in notification controller specs. */\nexport const notificationTestFixtureStub = `import type { Auth } from \"@warlock.js/auth\";\nimport type { ChildModel } from \"@warlock.js/cascade\";\nimport { config } from \"@warlock.js/core\";\nimport { actingAs, type AuthenticatedTestClient } from \"@warlock.js/core/tests\";\nimport { randomUUID } from \"node:crypto\";\nimport { Notification } from \"../models/notification/notification.model\";\n\n/** Isolated recipients and rows; adjust user fields if your auth model requires more. */\nexport async function createNotificationTestFixture() {\n  const User = config.key<ChildModel<Auth>>(\"auth.userType.user\");\n  if (!User) throw new Error(\"Notification specs need the configured auth.userType.user model.\");\n  const users: Auth[] = [];\n  const clients: AuthenticatedTestClient[] = [];\n  const rows: Notification[] = [];\n\n  async function cleanup() {\n    const credentials = await Promise.allSettled(\n      clients.splice(0).map((client) => client.dispose()),\n    );\n    const notifications = await Promise.allSettled(\n      rows.splice(0).map((row) => row.destroy({ strategy: \"permanent\" })),\n    );\n    const recipients = await Promise.allSettled(\n      users.splice(0).map((user) => user.destroy({ strategy: \"permanent\" })),\n    );\n    const errors = [...credentials, ...notifications, ...recipients]\n      .filter((result): result is PromiseRejectedResult => result.status === \"rejected\")\n      .map((result) => result.reason);\n    if (errors.length) throw new AggregateError(errors, \"Notification fixture cleanup failed.\");\n  }\n\n  const createUser = async () => {\n    const user = await User.create({\n      name: \"Notification test user\",\n      email: \"notifications-\" + randomUUID() + \"@example.test\",\n      password: \"test-password\",\n    });\n    users.push(user);\n    return user;\n  };\n  const signIn = async (user: Auth) => {\n    const client = await actingAs(user);\n    clients.push(client);\n    return client;\n  };\n  const createNotification = async (recipientId: string | number, title: string, readAt?: Date) => {\n    const row = await Notification.create({\n      user_id: recipientId,\n      type: \"test\",\n      title,\n      read_at: readAt,\n    });\n    rows.push(row);\n    return row;\n  };\n\n  try {\n    const user = await createUser();\n    const otherUser = await createUser();\n    const client = await signIn(user);\n    const otherClient = await signIn(otherUser);\n    const own = await createNotification(user.id, \"Own unread notification\");\n    const alreadyRead = await createNotification(user.id, \"Own read notification\", new Date());\n    const foreign = await createNotification(otherUser.id, \"Other user's notification\");\n    await createNotification(otherUser.id, \"Other user's second notification\");\n    return { user, otherUser, client, otherClient, own, alreadyRead, foreign, cleanup };\n  } catch (error) {\n    // Preserve the setup failure after attempting every owned resource's cleanup.\n    await cleanup().catch(() => undefined);\n    throw error;\n  }\n}\n`;\n\n/** A spec for each generated controller, including authenticated recipient isolation. */\nexport function notificationControllerSpecStub(method: \"GET\" | \"PATCH\", path: string): string {\n  const helper = method === \"GET\" ? \"testGet\" : \"testPatch\";\n  let signedInCases: string;\n  if (path === \"/notifications\") {\n    signedInCases = `    it(\"lists only the signed-in recipient's rows, ignoring a forged recipient query\", async () => {\n      const response = await fixture.client.get(\n        \"/notifications?recipientId=\" + fixture.otherUser.id,\n      );\n      const body = await expectJson<{ notifications: { id: string | number }[] }>(response);\n      expect(body.notifications.map((row) => row.id)).toEqual(\n        expect.arrayContaining([fixture.own.id, fixture.alreadyRead.id]),\n      );\n      expect(body.notifications).toHaveLength(2);\n    });\n\n    it(\"applies unread and paging query filters\", async () => {\n      const response = await fixture.client.get(\"/notifications?unread=true&limit=1\");\n      const body = await expectJson<{ notifications: { id: string | number }[] }>(response);\n      expect(body.notifications.map((row) => row.id)).toEqual([fixture.own.id]);\n    });\n\n    it(\"rejects a list limit above the schema's cap\", async () => {\n      expect((await fixture.client.get(\"/notifications?limit=999\")).status).toBe(422);\n    });`;\n  } else if (path === \"/notifications/unread-count\") {\n    signedInCases = `    it(\"counts only this recipient's unread notifications\", async () => {\n      const own = await expectJson<{ count: number }>(\n        await fixture.client.get(\"/notifications/unread-count\"),\n      );\n      const other = await expectJson<{ count: number }>(\n        await fixture.otherClient.get(\"/notifications/unread-count\"),\n      );\n      expect(own.count).toBe(1);\n      expect(other.count).toBe(2);\n    });`;\n  } else if (path === \"/notifications/read-all\") {\n    signedInCases = `    it(\"marks only this recipient's unread rows and leaves another recipient unchanged\", async () => {\n      const body = await expectJson<{ count: number }>(\n        await fixture.client.patch(\"/notifications/read-all\"),\n      );\n      expect(body.count).toBe(1);\n      expect((await Notification.find(fixture.own.id))?.isRead).toBe(true);\n      expect((await Notification.find(fixture.foreign.id))?.isRead).toBe(false);\n      const other = await expectJson<{ count: number }>(\n        await fixture.otherClient.get(\"/notifications/unread-count\"),\n      );\n      expect(other.count).toBe(2);\n      const again = await expectJson<{ count: number }>(\n        await fixture.client.patch(\"/notifications/read-all\"),\n      );\n      expect(again.count).toBe(0);\n    });`;\n  } else {\n    signedInCases = `    it(\"marks its own notification read and returns it\", async () => {\n      const response = await fixture.client.patch(\"/notifications/\" + fixture.own.id + \"/read\");\n      const body = await expectJson<{\n        notification: { id: string | number; readAt?: string | null };\n      }>(response);\n      expect(body.notification.id).toBe(fixture.own.id);\n      expect(body.notification.readAt).toBeTruthy();\n      expect((await Notification.find(fixture.own.id))?.isRead).toBe(true);\n    });\n\n    it(\"answers 404 for another recipient's notification without changing it\", async () => {\n      const response = await fixture.client.patch(\"/notifications/\" + fixture.foreign.id + \"/read\");\n      expect(response.status).toBe(404);\n      expect((await Notification.find(fixture.foreign.id))?.isRead).toBe(false);\n    });`;\n  }\n  const modelImport =\n    method === \"PATCH\"\n      ? 'import { Notification } from \"../models/notification/notification.model\";\\n'\n      : \"\";\n  return `import { expectJson, ${helper} } from \"@warlock.js/core/tests\";\nimport { afterEach, beforeEach, describe, expect, it } from \"vitest\";\n${modelImport}import { createNotificationTestFixture } from \"../tests/notifications.fixture\";\n\ndescribe(\"${method} ${path}\", () => {\n  it(\"answers 401 without a signed-in user\", async () => {\n    const response = await ${helper}(\"${path}\");\n    expect(response.status).toBe(401);\n  });\n\n  describe(\"signed in\", () => {\n    let fixture: Awaited<ReturnType<typeof createNotificationTestFixture>> | undefined;\n    beforeEach(async () => {\n      fixture = await createNotificationTestFixture();\n    });\n    afterEach(async () => {\n      const current = fixture;\n      fixture = undefined;\n      await current?.cleanup();\n    });\n\n${signedInCases.replaceAll(\"fixture.\", \"fixture!.\")}\n  });\n});\n`;\n}\n\n/**\n * `src/web/root.tsx` — the application root for the SSR page layer.\n *\n * Deliberately minimal. The framework ships a default root, so this exists to\n * give you a place to start rather than because anything requires it. The\n * reference app (`v5/app/src/web/root.tsx`) is where to look for the fuller\n * shape: middleware, an app-level loader, locales, an ErrorBoundary.\n */\nexport const webRootStub = `import type { AppProps } from \"@warlock.js/web\";\nimport { Head, Scripts } from \"@warlock.js/web\";\n\n/**\n * The application root.\n *\n * NOT async, and it receives no request/response: it renders on the server and\n * again in the browser during hydration, where neither exists.\n */\nexport default function App({ children }: AppProps) {\n  return (\n    <html lang=\"en\">\n      <head>\n        {/*\n          <Head /> also renders the viewport tag (width=device-width,\n          initial-scale=1). Change it with \\`metadata.viewport\\`,\n          or set it to false to leave it out; do not add a second one here.\n        */}\n        {/*\n          Placement only. The framework injects the page's \\`metadata\\`, the\n          stylesheet and preload tags for this route, and the canonical links\n          into <head> by default — <Head /> just says WHERE they land.\n\n          Do not add a <title> here: the page's \\`metadata\\` owns it, and a root\n          that emits one too produces two.\n        */}\n        <Head />\n        <link rel=\"icon\" href=\"data:,\" />\n      </head>\n      <body>\n        {/*\n          REQUIRED — this is the hydration mount point, not a styling wrapper.\n\n          The browser runtime looks up \\`#vessel\\` and hydrates that element only.\n          Remove this div, or rename the id, and the page still renders from the\n          server but never becomes interactive: the runtime throws in the console\n          and nothing on screen changes.\n\n          Wrap it in your own markup freely, and put anything that must live\n          outside the hydrated tree (a static footer, a portal target) outside\n          it — just keep an element with \\`id=\"vessel\"\\` around {children}.\n        */}\n        <div id=\"vessel\">{children}</div>\n        {/*\n          The hydration payload and module tags. Written explicitly because\n          placement occasionally matters — a CSP nonce, or ordering against\n          your own scripts.\n        */}\n        <Scripts />\n      </body>\n    </html>\n  );\n}\n`;\n\n/**\n * `src/app/contact/controllers/contact.controller.ts` — a real API endpoint\n * for the Web starter's contact form. It intentionally has no persistence\n * dependency: replace the acknowledgement with a mail/job/database action.\n */\nexport const webContactControllerStub = `import { type Request, type RequestHandler } from \"@warlock.js/core\";\nimport { type Infer, v } from \"@warlock.js/seal\";\n\nexport const contactSchema = v.object({\n  name: v.string().min(2),\n  email: v.email(),\n  message: v.string().min(10),\n});\n\nexport type ContactSchema = Infer.Output<typeof contactSchema>;\n\n/** POST /api/contact — validates the starter contact form. */\nexport const contactController: RequestHandler<Request<ContactSchema>> = async ({\n  request,\n  response,\n}) => {\n  const contact = request.validated();\n\n  // Replace this with delivery/persistence for your app. Keeping the accepted\n  // payload visible makes the endpoint useful while remaining side-effect free.\n  return response.success({\n    message: \"Thanks, \" + contact.name + \". Your message has been received.\",\n  });\n};\n\ncontactController.validation = { schema: contactSchema };\n`;\n\n/** `src/app/contact/routes.ts` — discovered by the standard app route loader. */\nexport const webContactRoutesStub = `import { router } from \"@warlock.js/core\";\nimport { contactController } from \"./controllers/contact.controller\";\n\nrouter.post(\"/api/contact\", contactController, { public: true });\n`;\n\n/**\n * `src/web/index.register.ts` — universal static setup for the starter page.\n *\n * The page re-exports this stable binding so Warlock's `register()` lifecycle\n * still sees it in both realms without making React Fast Refresh treat every\n * JSX edit as an incompatible function-export replacement.\n */\nexport const webHomeRegisterStub = `import { extend } from \"@mongez/localization\";\n\nexport function register() {\n  extend(\"en\", {\n    starter: {\n      title: \"Your Warlock app is running.\",\n      introduction: \"This page is rendered on the server and hydrated in the browser.\",\n      language: \"العربية\",\n      contact: \"Send a message\",\n      name: \"Name\",\n      email: \"Email\",\n      message: \"Message\",\n      submit: \"Send message\",\n      sent: \"Thanks — your message has been received.\",\n    },\n  });\n  extend(\"ar\", {\n    starter: {\n      title: \"تطبيق Warlock يعمل الآن.\",\n      introduction: \"تُعرض هذه الصفحة على الخادم ثم تُفعَّل في المتصفح.\",\n      language: \"English\",\n      contact: \"أرسل رسالة\",\n      name: \"الاسم\",\n      email: \"البريد الإلكتروني\",\n      message: \"الرسالة\",\n      submit: \"إرسال الرسالة\",\n      sent: \"شكرًا — تم استلام رسالتك.\",\n    },\n  });\n}\n`;\n\n/**\n * `src/web/index.page.tsx` — one page, so \\`warlock dev\\` has something to serve\n * the moment this finishes.\n */\nexport const webHomePageStub = `import { http } from \"@mongez/http\";\nimport { setCurrentLocaleCode } from \"@mongez/localization\";\nimport { Form, useFormControl, type FormControlProps } from \"@mongez/react-form\";\nimport { transX } from \"@mongez/react-localization\";\nimport { v } from \"@warlock.js/seal\";\nimport { Link, type PageConfig, type PageProps } from \"@warlock.js/web\";\nimport { useState } from \"react\";\n\nexport { register } from \"./index.register\";\n\n/**\n * A page route is an ordinary Warlock route whose handler renders React\n * instead of returning JSON.\n *\n * The URL and stable hydration name are the ones this file DECLARES below.\n * This page answers \\`GET \"/\"\\` because \\`config.route.path = \"/\"\\`, not because of\n * where the file lives. A page file with\n * no \\`config.route\\` declaration derives its URL from the filesystem.\n */\nexport const config: PageConfig = {\n  route: { path: \"/\", name: \"index\" },\n  metadata: { title: \"Home\" },\n};\n\nconst contactSchema = v.object({\n  name: v.string().min(2),\n  email: v.email(),\n  message: v.string().min(10),\n});\n\nfunction TextInput({ label, ...controlProps }: FormControlProps & { label: string }) {\n  const { error, getErrorProps, getInputProps } = useFormControl(controlProps);\n\n  return (\n    <div className=\"wk-field\">\n      <label htmlFor={controlProps.name}>{label}</label>\n      <input {...getInputProps()} />\n      {error && <p {...getErrorProps()}>{error}</p>}\n    </div>\n  );\n}\n\n/**\n * Add a \\`loader\\` export to fetch data on the server, and it arrives here as\n * \\`data\\`, typed:\n *\n *   export const loader = (async () => ({ items: await itemsRepository.all() }));\n *   export default function HomePage({ data }: PageProps<typeof loader>) { ... }\n */\nexport default function HomePage(_props: PageProps) {\n  // Live state. If the button below does nothing, the page rendered on the\n  // server but never hydrated — the runtime never mounted at \\`#vessel\\`. This is\n  // deliberately here so that failure is impossible to miss.\n  const [count, setCount] = useState(0);\n  const [locale, setLocale] = useState<\"en\" | \"ar\">(\"en\");\n  const [submitted, setSubmitted] = useState(false);\n  const [submitError, setSubmitError] = useState<string | null>(null);\n\n  const toggleLocale = () => {\n    const nextLocale = locale === \"en\" ? \"ar\" : \"en\";\n    setCurrentLocaleCode(nextLocale);\n    setLocale(nextLocale);\n  };\n\n  return (\n    <>\n      {/*\n        Self-contained, dependency-free styling: plain CSS, system fonts, and\n        CSS custom properties, scoped to this page. No CSS framework, no utility\n        classes, no external stylesheet — this page looks the same whether or\n        not \\`warlock add tailwind\\` has ever been run.\n      */}\n      <style>{\\`\n        .wk-home {\n          --wk-fg: #0f172a;\n          --wk-muted: #64748b;\n          --wk-accent: #4f46e5;\n          --wk-border: #e2e8f0;\n          font-family: system-ui, -apple-system, \"Segoe UI\", Roboto, sans-serif;\n          color: var(--wk-fg);\n          max-width: 42rem;\n          margin: 4rem auto;\n          padding: 0 1.5rem;\n          line-height: 1.6;\n        }\n        .wk-home h1 { font-size: 2.25rem; margin: 0 0 0.5rem; }\n        .wk-home p { color: var(--wk-muted); margin: 0 0 1.5rem; }\n        .wk-home code {\n          font-family: ui-monospace, \"SFMono-Regular\", Menlo, monospace;\n          background: #f1f5f9;\n          padding: 0.1rem 0.35rem;\n          border-radius: 0.25rem;\n        }\n        .wk-check {\n          border: 1px solid var(--wk-border);\n          border-radius: 0.75rem;\n          padding: 1.25rem 1.5rem;\n          margin: 2rem 0;\n        }\n        .wk-check strong { display: block; font-size: 1.5rem; }\n        .wk-check button {\n          font: inherit;\n          cursor: pointer;\n          background: var(--wk-accent);\n          color: #fff;\n          border: 0;\n          border-radius: 0.5rem;\n          padding: 0.5rem 1rem;\n          margin-top: 0.75rem;\n        }\n        .wk-links { display: flex; gap: 1.25rem; font-size: 0.95rem; }\n        .wk-links a { color: var(--wk-accent); text-decoration: none; }\n        .wk-links a:hover { text-decoration: underline; }\n        .wk-language { margin-left: auto; }\n        .wk-contact { margin-top: 2rem; }\n        .wk-field { display: grid; gap: 0.35rem; margin: 0.8rem 0; }\n        .wk-field input, .wk-field textarea { font: inherit; padding: 0.55rem; }\n        .wk-field p, .wk-submit-error { color: #b91c1c; margin: 0; }\n        .wk-success { color: #047857; }\n      \\`}</style>\n\n      <main className=\"wk-home\" dir={locale === \"ar\" ? \"rtl\" : \"ltr\"}>\n        <nav className=\"wk-links\" aria-label=\"Starter links\">\n          <a href=\"https://warlock.js.org\" target=\"_blank\" rel=\"noreferrer\">\n            Docs\n          </a>\n          <Link href=\"/\" aria-current=\"page\">\n            Home\n          </Link>\n          <button\n            className=\"wk-language\"\n            type=\"button\"\n            aria-pressed={locale === \"ar\"}\n            onClick={toggleLocale}\n          >\n            {transX(\"starter.language\")}\n          </button>\n        </nav>\n\n        <h1>{transX(\"starter.title\")}</h1>\n        <p>{transX(\"starter.introduction\")}</p>\n\n        <section className=\"wk-check\">\n          <label>If this number goes up when you click, React is hydrated:</label>\n          <strong>{count}</strong>\n          <button type=\"button\" onClick={() => setCount((c) => c + 1)}>\n            Count up\n          </button>\n        </section>\n\n        <section className=\"wk-contact\" aria-labelledby=\"contact-heading\">\n          <h2 id=\"contact-heading\">{transX(\"starter.contact\")}</h2>\n          <Form<typeof contactSchema>\n            id=\"contact-form\"\n            schema={contactSchema}\n            onSubmit={async ({ form, values }) => {\n              setSubmitted(false);\n              setSubmitError(null);\n              const result = await http.post<{ message: string }>(\"/api/contact\", values);\n\n              if (result.error) {\n                if (result.error.isValidationError) {\n                  const body = result.error.body as {\n                    errors?: Array<{ input: string; error: string }>;\n                    message?: string;\n                  };\n                  form.setErrors(\n                    Object.fromEntries(\n                      (body.errors ?? []).map(({ input, error }) => [input, error]),\n                    ),\n                  );\n                  setSubmitError(body.message ?? \"Please correct the highlighted fields.\");\n                } else {\n                  setSubmitError(\"Your message could not be sent. Please try again.\");\n                }\n                return;\n              }\n\n              setSubmitted(true);\n              form.reset();\n            }}\n          >\n            <TextInput name=\"name\" label={transX(\"starter.name\")} autoComplete=\"name\" />\n            <TextInput\n              name=\"email\"\n              label={transX(\"starter.email\")}\n              type=\"email\"\n              autoComplete=\"email\"\n            />\n            <ContactMessage />\n            <button type=\"submit\">{transX(\"starter.submit\")}</button>\n            {submitError && (\n              <p className=\"wk-submit-error\" role=\"alert\">\n                {submitError}\n              </p>\n            )}\n            {submitted && (\n              <p className=\"wk-success\" role=\"status\">\n                {transX(\"starter.sent\")}\n              </p>\n            )}\n          </Form>\n        </section>\n      </main>\n    </>\n  );\n}\n\nfunction ContactMessage() {\n  const { error, getErrorProps, getInputProps } = useFormControl({ name: \"message\" });\n\n  return (\n    <div className=\"wk-field\">\n      <label htmlFor=\"message\">{transX(\"starter.message\")}</label>\n      <textarea {...getInputProps()} rows={5} />\n      {error && <p {...getErrorProps()}>{error}</p>}\n    </div>\n  );\n}\n`;\n"],"mappings":";AAAA,MAAa,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BhC,MAAa,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+B5B,MAAa,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCnC,MAAa,2BAA2B;;AAGxC,MAAa,0BAA0B;;;;;;;;;;;;AAavC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8FvC,MAAa,+BAA+B;;AAG5C,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;AAsB3C,MAAa,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6ClC,MAAa,mBAAmB;;;;;;;;;;;;;;;;;AAkBhC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFvC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCvC,MAAa,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDrC,MAAa,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;AAwBzC,MAAa,2BAA2B;;;;;;;;;;;;;;;;;;;;;AAsBxC,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;AAmB3C,MAAa,+BAA+B;;;;;;;;;;;;;;;;;AAkB5C,MAAa,kCAAkC;;;;;;;;;;;;;;;;;;;;AAqB/C,MAAa,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;AAyB/C,MAAa,yCAAyC;;;;;;;;;;;;;;;;AAiBtD,MAAa,qCAAqC;;;;;;;;;;;;;;;;;;;;;AAsBlD,MAAa,yCAAyC;;;;;;;;;;;;;;;;AAiBtD,MAAa,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BtC,MAAa,0BAA0B;;;;;AAMvC,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2E3C,SAAgB,+BAA+B,QAAyB,MAAsB;CAC5F,MAAM,SAAS,WAAW,QAAQ,YAAY;CAC9C,IAAI;CACJ,IAAI,SAAS,kBACX,gBAAgB;;;;;;;;;;;;;;;;;;;;MAoBX,IAAI,SAAS,+BAClB,gBAAgB;;;;;;;;;;MAUX,IAAI,SAAS,2BAClB,gBAAgB;;;;;;;;;;;;;;;;MAiBhB,gBAAgB;;;;;;;;;;;;;;;CAoBlB,OAAO,wBAAwB,OAAO;;EAHpC,WAAW,UACP,kFACA,GAGM;;YAEF,OAAO,GAAG,KAAK;;6BAEE,OAAO,IAAI,KAAK;;;;;;;;;;;;;;;EAe3C,cAAc,WAAW,YAAY,WAAW,EAAE;;;;AAIpD;;;;;;;;;AAUA,MAAa,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4D3B,MAAa,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BxC,MAAa,uBAAuB;;;;;;;;;;;;AAapC,MAAa,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCnC,MAAa,kBAAkB"}

package/esm/http/bounded-stream-queue.d.mts

@@ -0,0 +1,10 @@
+import { ServerResponse } from "node:http";
+
+//#region ../../packages/core/src/http/bounded-stream-queue.d.ts
+type StreamQueueOptions = {
+  /** Total unsent bytes, including Node's writable buffer. Defaults to 1 MiB for enqueue(). */maxQueuedBytes?: number; /** Disconnect the slow client (default), or reject the newest chunk without disconnecting. */
+  onOverflow?: "disconnect" | "drop";
+};
+//#endregion
+export { StreamQueueOptions };
+//# sourceMappingURL=bounded-stream-queue.d.mts.map

package/esm/http/bounded-stream-queue.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-stream-queue.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/bounded-stream-queue.ts"],"mappings":";;;KAGY,kBAAA;EAAA,6FAEV,cAAA;EAEA,UAAU;AAAA"}

package/esm/http/bounded-stream-queue.mjs

@@ -0,0 +1,97 @@
+//#region ../../packages/core/src/http/bounded-stream-queue.ts
+function validateStreamQueueOptions(options) {
+	if (options.onOverflow !== void 0 && options.onOverflow !== "drop" && options.onOverflow !== "disconnect") throw new TypeError("onOverflow must be \"drop\" or \"disconnect\"");
+	if (options.maxQueuedBytes !== void 0 && (!Number.isSafeInteger(options.maxQueuedBytes) || options.maxQueuedBytes < 0)) throw new RangeError("maxQueuedBytes must be a non-negative safe integer");
+}
+function createBoundedStreamQueue(raw, transport, options) {
+	validateStreamQueueOptions(options);
+	const limit = options.maxQueuedBytes ?? 1024 * 1024;
+	const pending = [];
+	const waiters = /* @__PURE__ */ new Set();
+	let bytes = 0;
+	let ending = false;
+	let dropped = 0;
+	let onFinished;
+	function settle(drained) {
+		for (const resolve of waiters) resolve(drained);
+		waiters.clear();
+	}
+	function cleanup() {
+		raw.off("drain", flush);
+		raw.off("close", close);
+	}
+	function close() {
+		ending = true;
+		pending.length = 0;
+		bytes = 0;
+		onFinished = void 0;
+		cleanup();
+		settle(false);
+	}
+	function flush() {
+		if (transport.closed) return close();
+		while (pending.length && !raw.writableNeedDrain) {
+			const item = pending.shift();
+			bytes -= item.bytes;
+			raw.write(item.data);
+		}
+		if (!pending.length && !raw.writableNeedDrain) settle(!ending);
+		if (!pending.length && onFinished) {
+			const finish = onFinished;
+			onFinished = void 0;
+			cleanup();
+			settle(false);
+			finish();
+		}
+	}
+	raw.on("drain", flush);
+	raw.once("close", close);
+	return {
+		get dropped() {
+			return dropped;
+		},
+		get ending() {
+			return ending;
+		},
+		get backpressured() {
+			return pending.length > 0 || transport.backpressured;
+		},
+		enqueue(data) {
+			if (typeof data !== "string" && !(data instanceof Uint8Array)) throw new TypeError("Stream data must be a string or Uint8Array");
+			if (ending || transport.closed) return false;
+			const size = typeof data === "string" ? Buffer.byteLength(data) : data.byteLength;
+			if (bytes + (raw.writableLength ?? 0) + size > limit) {
+				if (options.onOverflow === "drop") dropped++;
+				else {
+					transport.disconnect();
+					close();
+					raw.destroy();
+				}
+				return false;
+			}
+			if (pending.length || raw.writableNeedDrain) {
+				pending.push({
+					data: typeof data === "string" ? data : Buffer.from(data),
+					bytes: size
+				});
+				bytes += size;
+			} else raw.write(data);
+			return true;
+		},
+		waitForDrain() {
+			if (ending || transport.closed) return Promise.resolve(false);
+			if (!pending.length && !raw.writableNeedDrain) return Promise.resolve(true);
+			return new Promise((resolve) => waiters.add(resolve));
+		},
+		finish(callback) {
+			if (ending || transport.closed) return;
+			ending = true;
+			onFinished = callback;
+			flush();
+		}
+	};
+}
+
+//#endregion
+export { createBoundedStreamQueue, validateStreamQueueOptions };
+//# sourceMappingURL=bounded-stream-queue.mjs.map

package/esm/http/bounded-stream-queue.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-stream-queue.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/bounded-stream-queue.ts"],"sourcesContent":["import type { ServerResponse } from \"node:http\";\nimport type { StreamTransport } from \"./stream-transport\";\n\nexport type StreamQueueOptions = {\n  /** Total unsent bytes, including Node's writable buffer. Defaults to 1 MiB for enqueue(). */\n  maxQueuedBytes?: number;\n  /** Disconnect the slow client (default), or reject the newest chunk without disconnecting. */\n  onOverflow?: \"disconnect\" | \"drop\";\n};\n\nexport function validateStreamQueueOptions(options: StreamQueueOptions): void {\n  if (\n    options.onOverflow !== undefined &&\n    options.onOverflow !== \"drop\" &&\n    options.onOverflow !== \"disconnect\"\n  ) {\n    throw new TypeError('onOverflow must be \"drop\" or \"disconnect\"');\n  }\n  if (\n    options.maxQueuedBytes !== undefined &&\n    (!Number.isSafeInteger(options.maxQueuedBytes) || options.maxQueuedBytes < 0)\n  ) {\n    throw new RangeError(\"maxQueuedBytes must be a non-negative safe integer\");\n  }\n}\n\nexport function createBoundedStreamQueue(\n  raw: ServerResponse,\n  transport: StreamTransport,\n  options: StreamQueueOptions,\n) {\n  validateStreamQueueOptions(options);\n  const limit = options.maxQueuedBytes ?? 1024 * 1024;\n  const pending: Array<{ data: string | Uint8Array; bytes: number }> = [];\n  const waiters = new Set<(drained: boolean) => void>();\n  let bytes = 0;\n  let ending = false;\n  let dropped = 0;\n  let onFinished: (() => void) | undefined;\n\n  function settle(drained: boolean) {\n    for (const resolve of waiters) resolve(drained);\n    waiters.clear();\n  }\n  function cleanup() {\n    raw.off(\"drain\", flush);\n    raw.off(\"close\", close);\n  }\n  function close() {\n    ending = true;\n    pending.length = 0;\n    bytes = 0;\n    onFinished = undefined;\n    cleanup();\n    settle(false);\n  }\n  function flush() {\n    if (transport.closed) return close();\n    while (pending.length && !raw.writableNeedDrain) {\n      const item = pending.shift()!;\n      bytes -= item.bytes;\n      raw.write(item.data);\n    }\n    if (!pending.length && !raw.writableNeedDrain) settle(!ending);\n    if (!pending.length && onFinished) {\n      const finish = onFinished;\n      onFinished = undefined;\n      cleanup();\n      settle(false);\n      finish();\n    }\n  }\n  raw.on(\"drain\", flush);\n  raw.once(\"close\", close);\n\n  return {\n    get dropped() {\n      return dropped;\n    },\n    get ending() {\n      return ending;\n    },\n    get backpressured() {\n      return pending.length > 0 || transport.backpressured;\n    },\n    enqueue(data: string | Uint8Array): boolean {\n      if (typeof data !== \"string\" && !(data instanceof Uint8Array))\n        throw new TypeError(\"Stream data must be a string or Uint8Array\");\n      if (ending || transport.closed) return false;\n      const size = typeof data === \"string\" ? Buffer.byteLength(data) : data.byteLength;\n      if (bytes + (raw.writableLength ?? 0) + size > limit) {\n        if (options.onOverflow === \"drop\") dropped++;\n        else {\n          transport.disconnect();\n          close();\n          raw.destroy();\n        }\n        return false;\n      }\n      if (pending.length || raw.writableNeedDrain) {\n        // Own the bytes: a producer may reuse its Uint8Array after enqueue().\n        pending.push({ data: typeof data === \"string\" ? data : Buffer.from(data), bytes: size });\n        bytes += size;\n      } else {\n        raw.write(data);\n      }\n      return true;\n    },\n    waitForDrain(): Promise<boolean> {\n      if (ending || transport.closed) return Promise.resolve(false);\n      if (!pending.length && !raw.writableNeedDrain) return Promise.resolve(true);\n      return new Promise((resolve) => waiters.add(resolve));\n    },\n    finish(callback: () => void) {\n      if (ending || transport.closed) return;\n      ending = true;\n      onFinished = callback;\n      flush();\n    },\n  };\n}\n"],"mappings":";AAUA,SAAgB,2BAA2B,SAAmC;CAC5E,IACE,QAAQ,eAAe,UACvB,QAAQ,eAAe,UACvB,QAAQ,eAAe,cAEvB,MAAM,IAAI,UAAU,+CAA2C;CAEjE,IACE,QAAQ,mBAAmB,WAC1B,CAAC,OAAO,cAAc,QAAQ,cAAc,KAAK,QAAQ,iBAAiB,IAE3E,MAAM,IAAI,WAAW,oDAAoD;AAE7E;AAEA,SAAgB,yBACd,KACA,WACA,SACA;CACA,2BAA2B,OAAO;CAClC,MAAM,QAAQ,QAAQ,kBAAkB,OAAO;CAC/C,MAAM,UAA+D,CAAC;CACtE,MAAM,0BAAU,IAAI,IAAgC;CACpD,IAAI,QAAQ;CACZ,IAAI,SAAS;CACb,IAAI,UAAU;CACd,IAAI;CAEJ,SAAS,OAAO,SAAkB;EAChC,KAAK,MAAM,WAAW,SAAS,QAAQ,OAAO;EAC9C,QAAQ,MAAM;CAChB;CACA,SAAS,UAAU;EACjB,IAAI,IAAI,SAAS,KAAK;EACtB,IAAI,IAAI,SAAS,KAAK;CACxB;CACA,SAAS,QAAQ;EACf,SAAS;EACT,QAAQ,SAAS;EACjB,QAAQ;EACR,aAAa;EACb,QAAQ;EACR,OAAO,KAAK;CACd;CACA,SAAS,QAAQ;EACf,IAAI,UAAU,QAAQ,OAAO,MAAM;EACnC,OAAO,QAAQ,UAAU,CAAC,IAAI,mBAAmB;GAC/C,MAAM,OAAO,QAAQ,MAAM;GAC3B,SAAS,KAAK;GACd,IAAI,MAAM,KAAK,IAAI;EACrB;EACA,IAAI,CAAC,QAAQ,UAAU,CAAC,IAAI,mBAAmB,OAAO,CAAC,MAAM;EAC7D,IAAI,CAAC,QAAQ,UAAU,YAAY;GACjC,MAAM,SAAS;GACf,aAAa;GACb,QAAQ;GACR,OAAO,KAAK;GACZ,OAAO;EACT;CACF;CACA,IAAI,GAAG,SAAS,KAAK;CACrB,IAAI,KAAK,SAAS,KAAK;CAEvB,OAAO;EACL,IAAI,UAAU;GACZ,OAAO;EACT;EACA,IAAI,SAAS;GACX,OAAO;EACT;EACA,IAAI,gBAAgB;GAClB,OAAO,QAAQ,SAAS,KAAK,UAAU;EACzC;EACA,QAAQ,MAAoC;GAC1C,IAAI,OAAO,SAAS,YAAY,EAAE,gBAAgB,aAChD,MAAM,IAAI,UAAU,4CAA4C;GAClE,IAAI,UAAU,UAAU,QAAQ,OAAO;GACvC,MAAM,OAAO,OAAO,SAAS,WAAW,OAAO,WAAW,IAAI,IAAI,KAAK;GACvE,IAAI,SAAS,IAAI,kBAAkB,KAAK,OAAO,OAAO;IACpD,IAAI,QAAQ,eAAe,QAAQ;SAC9B;KACH,UAAU,WAAW;KACrB,MAAM;KACN,IAAI,QAAQ;IACd;IACA,OAAO;GACT;GACA,IAAI,QAAQ,UAAU,IAAI,mBAAmB;IAE3C,QAAQ,KAAK;KAAE,MAAM,OAAO,SAAS,WAAW,OAAO,OAAO,KAAK,IAAI;KAAG,OAAO;IAAK,CAAC;IACvF,SAAS;GACX,OACE,IAAI,MAAM,IAAI;GAEhB,OAAO;EACT;EACA,eAAiC;GAC/B,IAAI,UAAU,UAAU,QAAQ,OAAO,QAAQ,QAAQ,KAAK;GAC5D,IAAI,CAAC,QAAQ,UAAU,CAAC,IAAI,mBAAmB,OAAO,QAAQ,QAAQ,IAAI;GAC1E,OAAO,IAAI,SAAS,YAAY,QAAQ,IAAI,OAAO,CAAC;EACtD;EACA,OAAO,UAAsB;GAC3B,IAAI,UAAU,UAAU,QAAQ;GAChC,SAAS;GACT,aAAa;GACb,MAAM;EACR;CACF;AACF"}

package/esm/http/build-rate-limit-options.d.mts

@@ -21,6 +21,19 @@ type HttpRateLimitConfig = Omit<Pick<RateLimitPluginOptions, (typeof passthrough
    * @default true
    */
   enabled?: boolean;
+  /**
+   * Count static files against the global limiter: the public folder, every
+   * `router.directory()` mount, `router.file()` routes and the web package's
+   * built assets.
+   *
+   * Off by default, so one page load's asset requests do not spend the
+   * client's quota; pages and API routes stay limited either way. A mount's
+   * own `rateLimit` option (`router.directory(options, { rateLimit })`) wins
+   * over this setting. Built-in health probes follow `http.health.rateLimit`.
+   *
+   * @default false
+   */
+  staticFiles?: boolean;
   /**
    * Max requests per time window.
    *

package/esm/http/build-rate-limit-options.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"build-rate-limit-options.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/build-rate-limit-options.ts"],"mappings":";;;;;AAAkE;cAM5D,eAAA;;;AAeI;KAKE,mBAAA,GAAsB,IAAA,CAChC,IAAA,CAAK,sBAAA,UAAgC,eAAA;EADR;;;;;EAS7B,UAAA,GAAa,sBAAA;EAAA;;;;;EAMb,OAAA;EAdA;;;;;EAoBA,GAAA;EAAA;;;;;EAMA,QAAA;EAyBmD;AAAA;;EArBnD,UAAA,GAAa,sBAAA;;;;;;;;;;;;;;;;;;;;;EAqBb,KAAA,wBAA6B,sBAAA;AAAA"}
+{"version":3,"file":"build-rate-limit-options.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/build-rate-limit-options.ts"],"mappings":";;;;;AAAkE;cAM5D,eAAA;;;AAeI;KAKE,mBAAA,GAAsB,IAAA,CAChC,IAAA,CAAK,sBAAA,UAAgC,eAAA;EADR;;;;;EAS7B,UAAA,GAAa,sBAAA;EAAA;;;;;EAMb,OAAA;EAdA;;;;;;;;;;;;EA2BA,WAAA;EAqCmD;AAAA;;;;EA/BnD,GAAA;;;;;;EAMA,QAAA;;;;EAIA,UAAA,GAAa,sBAAA;;;;;;;;;;;;;;;;;;;;;EAqBb,KAAA,wBAA6B,sBAAA;AAAA"}

package/esm/http/build-rate-limit-options.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"build-rate-limit-options.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/build-rate-limit-options.ts"],"sourcesContent":["import type { RateLimitPluginOptions } from \"@fastify/rate-limit\";\nimport { CacheRateLimitStore } from \"./rate-limit-cache-store\";\n\n/**\n * `@fastify/rate-limit` options that `http.rateLimit` passes straight through.\n */\nconst passthroughKeys = [\n  \"redis\",\n  \"nameSpace\",\n  \"keyGenerator\",\n  \"ipv6Subnet\",\n  \"skipOnError\",\n  \"allowList\",\n  \"continueExceeding\",\n  \"enableDraftSpec\",\n  \"global\",\n  \"hook\",\n  \"cache\",\n  \"errorResponseBuilder\",\n  \"addHeaders\",\n  \"addHeadersOnExceeding\",\n] as const;\n\n/**\n * Shape of the `http.rateLimit` config.\n */\nexport type HttpRateLimitConfig = Omit<\n  Pick<RateLimitPluginOptions, (typeof passthroughKeys)[number]>,\n  \"ipv6Subnet\"\n> & {\n  /**\n   * IPv6 subnet size used to group client addresses.\n   *\n   * @default 64\n   */\n  ipv6Subnet?: RateLimitPluginOptions[\"ipv6Subnet\"];\n  /**\n   * Set `false` to skip registering the global rate limiter.\n   *\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Max requests per time window.\n   *\n   * @default 60\n   */\n  max?: number;\n  /**\n   * Time window in milliseconds. Alias of `timeWindow`.\n   *\n   * @default 60 * 1000\n   */\n  duration?: number;\n  /**\n   * Time window; takes precedence over `duration` when both are set.\n   */\n  timeWindow?: RateLimitPluginOptions[\"timeWindow\"];\n  /**\n   * Where request counts are kept.\n   *\n   * - `\"memory\"` (default): in this process. With N processes behind a load\n   *   balancer every client gets N times `max`.\n   * - `\"cache\"`: in `@warlock.js/cache`, so every process using the same\n   *   shared driver (Redis, database) counts together. Per-route\n   *   `middleware.rateLimit()` follows this setting unless it sets its own\n   *   `store`. Windows are fixed and aligned to the clock. A cache outage\n   *   fails open on both limiters (`skipOnError` defaults to `true` here) and\n   *   is logged at most once a minute. The `null` and `file` cache drivers\n   *   are refused (they cannot count): requests pass and the refusal is\n   *   logged the same way.\n   * - a `@fastify/rate-limit` store class, passed through as is.\n   *\n   * `redis` still works and needs an ioredis client; the `redis` driver of\n   * `@warlock.js/cache` uses node-redis, so share it through `\"cache\"`.\n   *\n   * @default \"memory\"\n   */\n  store?: \"memory\" | \"cache\" | RateLimitPluginOptions[\"store\"];\n};\n\n/**\n * Build the `@fastify/rate-limit` plugin options from `http.rateLimit`.\n * Returns `null` when the limiter is disabled.\n */\nexport function buildRateLimitOptions(\n  config: HttpRateLimitConfig | undefined,\n): RateLimitPluginOptions | null {\n  const source = config ?? {};\n\n  if (source.enabled === false) {\n    return null;\n  }\n\n  const options: Record<string, unknown> = {\n    max: source.max ?? 60,\n    timeWindow: source.timeWindow ?? source.duration ?? 60 * 1000,\n  };\n\n  for (const key of passthroughKeys) {\n    if (source[key] !== undefined) {\n      options[key] = source[key];\n    }\n  }\n\n  if (source.store === \"cache\") {\n    options[\"store\"] = CacheRateLimitStore;\n\n    // `@fastify/rate-limit` defaults to `skipOnError: false`, which turns\n    // every request into a 500 while the cache is down. Fail open instead,\n    // like the per-route middleware; the store logs the outage.\n    if (source.skipOnError === undefined) {\n      options[\"skipOnError\"] = true;\n    }\n  } else if (typeof source.store === \"function\") {\n    options[\"store\"] = source.store;\n  }\n\n  return options as RateLimitPluginOptions;\n}\n"],"mappings":";;;;;;AAMA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAgEA,SAAgB,sBACd,QAC+B;CAC/B,MAAM,SAAS,UAAU,CAAC;CAE1B,IAAI,OAAO,YAAY,OACrB,OAAO;CAGT,MAAM,UAAmC;EACvC,KAAK,OAAO,OAAO;EACnB,YAAY,OAAO,cAAc,OAAO,YAAY,KAAK;CAC3D;CAEA,KAAK,MAAM,OAAO,iBAChB,IAAI,OAAO,SAAS,QAClB,QAAQ,OAAO,OAAO;CAI1B,IAAI,OAAO,UAAU,SAAS;EAC5B,QAAQ,WAAW;EAKnB,IAAI,OAAO,gBAAgB,QACzB,QAAQ,iBAAiB;CAE7B,OAAO,IAAI,OAAO,OAAO,UAAU,YACjC,QAAQ,WAAW,OAAO;CAG5B,OAAO;AACT"}
+{"version":3,"file":"build-rate-limit-options.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/build-rate-limit-options.ts"],"sourcesContent":["import type { RateLimitPluginOptions } from \"@fastify/rate-limit\";\nimport { CacheRateLimitStore } from \"./rate-limit-cache-store\";\n\n/**\n * `@fastify/rate-limit` options that `http.rateLimit` passes straight through.\n */\nconst passthroughKeys = [\n  \"redis\",\n  \"nameSpace\",\n  \"keyGenerator\",\n  \"ipv6Subnet\",\n  \"skipOnError\",\n  \"allowList\",\n  \"continueExceeding\",\n  \"enableDraftSpec\",\n  \"global\",\n  \"hook\",\n  \"cache\",\n  \"errorResponseBuilder\",\n  \"addHeaders\",\n  \"addHeadersOnExceeding\",\n] as const;\n\n/**\n * Shape of the `http.rateLimit` config.\n */\nexport type HttpRateLimitConfig = Omit<\n  Pick<RateLimitPluginOptions, (typeof passthroughKeys)[number]>,\n  \"ipv6Subnet\"\n> & {\n  /**\n   * IPv6 subnet size used to group client addresses.\n   *\n   * @default 64\n   */\n  ipv6Subnet?: RateLimitPluginOptions[\"ipv6Subnet\"];\n  /**\n   * Set `false` to skip registering the global rate limiter.\n   *\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Count static files against the global limiter: the public folder, every\n   * `router.directory()` mount, `router.file()` routes and the web package's\n   * built assets.\n   *\n   * Off by default, so one page load's asset requests do not spend the\n   * client's quota; pages and API routes stay limited either way. A mount's\n   * own `rateLimit` option (`router.directory(options, { rateLimit })`) wins\n   * over this setting. Built-in health probes follow `http.health.rateLimit`.\n   *\n   * @default false\n   */\n  staticFiles?: boolean;\n  /**\n   * Max requests per time window.\n   *\n   * @default 60\n   */\n  max?: number;\n  /**\n   * Time window in milliseconds. Alias of `timeWindow`.\n   *\n   * @default 60 * 1000\n   */\n  duration?: number;\n  /**\n   * Time window; takes precedence over `duration` when both are set.\n   */\n  timeWindow?: RateLimitPluginOptions[\"timeWindow\"];\n  /**\n   * Where request counts are kept.\n   *\n   * - `\"memory\"` (default): in this process. With N processes behind a load\n   *   balancer every client gets N times `max`.\n   * - `\"cache\"`: in `@warlock.js/cache`, so every process using the same\n   *   shared driver (Redis, database) counts together. Per-route\n   *   `middleware.rateLimit()` follows this setting unless it sets its own\n   *   `store`. Windows are fixed and aligned to the clock. A cache outage\n   *   fails open on both limiters (`skipOnError` defaults to `true` here) and\n   *   is logged at most once a minute. The `null` and `file` cache drivers\n   *   are refused (they cannot count): requests pass and the refusal is\n   *   logged the same way.\n   * - a `@fastify/rate-limit` store class, passed through as is.\n   *\n   * `redis` still works and needs an ioredis client; the `redis` driver of\n   * `@warlock.js/cache` uses node-redis, so share it through `\"cache\"`.\n   *\n   * @default \"memory\"\n   */\n  store?: \"memory\" | \"cache\" | RateLimitPluginOptions[\"store\"];\n};\n\n/**\n * Build the `@fastify/rate-limit` plugin options from `http.rateLimit`.\n * Returns `null` when the limiter is disabled.\n */\nexport function buildRateLimitOptions(\n  config: HttpRateLimitConfig | undefined,\n): RateLimitPluginOptions | null {\n  const source = config ?? {};\n\n  if (source.enabled === false) {\n    return null;\n  }\n\n  const options: Record<string, unknown> = {\n    max: source.max ?? 60,\n    timeWindow: source.timeWindow ?? source.duration ?? 60 * 1000,\n  };\n\n  for (const key of passthroughKeys) {\n    if (source[key] !== undefined) {\n      options[key] = source[key];\n    }\n  }\n\n  if (source.store === \"cache\") {\n    options[\"store\"] = CacheRateLimitStore;\n\n    // `@fastify/rate-limit` defaults to `skipOnError: false`, which turns\n    // every request into a 500 while the cache is down. Fail open instead,\n    // like the per-route middleware; the store logs the outage.\n    if (source.skipOnError === undefined) {\n      options[\"skipOnError\"] = true;\n    }\n  } else if (typeof source.store === \"function\") {\n    options[\"store\"] = source.store;\n  }\n\n  return options as RateLimitPluginOptions;\n}\n"],"mappings":";;;;;;AAMA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AA6EA,SAAgB,sBACd,QAC+B;CAC/B,MAAM,SAAS,UAAU,CAAC;CAE1B,IAAI,OAAO,YAAY,OACrB,OAAO;CAGT,MAAM,UAAmC;EACvC,KAAK,OAAO,OAAO;EACnB,YAAY,OAAO,cAAc,OAAO,YAAY,KAAK;CAC3D;CAEA,KAAK,MAAM,OAAO,iBAChB,IAAI,OAAO,SAAS,QAClB,QAAQ,OAAO,OAAO;CAI1B,IAAI,OAAO,UAAU,SAAS;EAC5B,QAAQ,WAAW;EAKnB,IAAI,OAAO,gBAAgB,QACzB,QAAQ,iBAAiB;CAE7B,OAAO,IAAI,OAAO,OAAO,UAAU,YACjC,QAAQ,WAAW,OAAO;CAG5B,OAAO;AACT"}

package/esm/http/conditional-request.d.mts

@@ -0,0 +1,86 @@
+//#region ../../packages/core/src/http/conditional-request.d.ts
+/**
+ * HTTP conditional requests (RFC 9110 §13): entity-tag comparison and the
+ * precedence of the precondition headers.
+ *
+ * Two comparisons exist (RFC 9110 §8.8.3.2):
+ *
+ * - **strong**: both tags are strong (no `W/` prefix) and their opaque tags are
+ *   identical. `If-Match` uses it (§13.1.1), so a weak validator never
+ *   satisfies `If-Match`.
+ * - **weak**: the opaque tags are identical, whatever their `W/` prefixes.
+ *   `If-None-Match` uses it (§13.1.2), so `W/"a"` matches `"a"`.
+ *
+ * Source: https://www.rfc-editor.org/rfc/rfc9110 (sections 8.8.3, 13.1, 13.2).
+ */
+/**
+ * One parsed entity tag. `opaque` keeps its quotes, so `"a"` and `a` differ.
+ */
+type EntityTag = {
+  weak: boolean;
+  opaque: string;
+};
+/**
+ * Parse one entity tag: an optional case-sensitive `W/` prefix, then the
+ * opaque tag. A value without quotes is kept as its own opaque tag so an
+ * application-supplied unquoted ETag still compares with itself.
+ */
+declare function parseEntityTag(value: string): EntityTag | undefined;
+/**
+ * Parse an `If-Match` / `If-None-Match` value: `"*"` or a comma-separated list
+ * of entity tags. A comma inside a quoted tag is part of the tag.
+ */
+declare function parseEntityTagList(header: unknown): "*" | EntityTag[] | undefined;
+/**
+ * Weak comparison: the opaque tags are identical.
+ */
+declare function weakEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
+/**
+ * Strong comparison: neither tag is weak and the opaque tags are identical.
+ */
+declare function strongEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
+/**
+ * Whether an `If-None-Match` header matches the current entity tag, with weak
+ * comparison. `*` matches any current representation.
+ */
+declare function matchesIfNoneMatch(header: unknown, etag: string): boolean;
+/**
+ * Whether an `If-Match` header is satisfied by the current entity tag, with
+ * strong comparison. `*` is satisfied by any current representation, so it
+ * fails only when there is none (`etag` undefined).
+ */
+declare function matchesIfMatch(header: unknown, etag: string | undefined): boolean;
+/**
+ * The request headers and current validators a precondition check reads.
+ */
+type ConditionalRequestInput = {
+  method: string; /** Current entity tag, quoted, optionally `W/`-prefixed. */
+  etag?: string; /** Current modification time. HTTP dates have second precision. */
+  lastModified?: Date | number;
+  ifMatch?: unknown;
+  ifNoneMatch?: unknown;
+  ifModifiedSince?: unknown;
+  ifUnmodifiedSince?: unknown;
+};
+/**
+ * What a precondition check decided:
+ *
+ * - `"proceed"`: send the normal response;
+ * - `"not-modified"`: answer a GET or HEAD with 304;
+ * - `"precondition-failed"`: answer with 412.
+ */
+type ConditionalRequestOutcome = "proceed" | "not-modified" | "precondition-failed";
+/**
+ * Evaluate the precondition headers in RFC 9110 §13.2.2 order:
+ *
+ * 1. `If-Match` (strong comparison) — false is 412;
+ * 2. otherwise `If-Unmodified-Since` — modified after the date is 412;
+ * 3. `If-None-Match` (weak comparison) — a match is 304 for GET/HEAD, else 412;
+ * 4. otherwise, for GET/HEAD, `If-Modified-Since` — not modified since is 304.
+ *
+ * An invalid date is ignored, as the RFC requires.
+ */
+declare function evaluateConditionalRequest(input: ConditionalRequestInput): ConditionalRequestOutcome;
+//#endregion
+export { ConditionalRequestInput, ConditionalRequestOutcome, EntityTag, evaluateConditionalRequest, matchesIfMatch, matchesIfNoneMatch, parseEntityTag, parseEntityTagList, strongEntityTagMatch, weakEntityTagMatch };
+//# sourceMappingURL=conditional-request.d.mts.map

package/esm/http/conditional-request.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditional-request.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/conditional-request.ts"],"mappings":";;AAkBA;;;;AAEQ;AAQR;;;;AAAwD;AAiBxD;;;;AAAoE;AA+BpE;KA1DY,SAAA;EACV,IAAA;EACA,MAAM;AAAA;;;;;AAwD8D;iBAhDtD,cAAA,CAAe,KAAA,WAAgB,SAAS;;;;;iBAiBxC,kBAAA,CAAmB,MAAA,kBAAwB,SAAS;;;;iBA+BpD,kBAAA,CAAmB,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,SAAS;AAetE;;;AAAA,iBARgB,oBAAA,CAAqB,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,SAAS;AAQR;AAgBhE;;;AAhBgE,iBAAhD,kBAAA,CAAmB,MAAA,WAAiB,IAAY;AAgBQ;AAiBxE;;;;AAjBwE,iBAAxD,cAAA,CAAe,MAAA,WAAiB,IAAwB;;;;KAiB5D,uBAAA;EACV,MAAA,UAOA;EALA,IAAA,WAMiB;EAJjB,YAAA,GAAe,IAAI;EACnB,OAAA;EACA,WAAA;EACA,eAAA;EACA,iBAAA;AAAA;AA0CF;;;;;;;AAAA,KAhCY,yBAAA;AAkCgB;;;;;;;;;;AAAA,iBAFZ,0BAAA,CACd,KAAA,EAAO,uBAAA,GACN,yBAAyB"}