@warlock.js/core 5.30.0 → 5.31.0

package/esm/http/conditional-request.mjs

@@ -0,0 +1,121 @@
+//#region ../../packages/core/src/http/conditional-request.ts
+/**
+* Parse one entity tag: an optional case-sensitive `W/` prefix, then the
+* opaque tag. A value without quotes is kept as its own opaque tag so an
+* application-supplied unquoted ETag still compares with itself.
+*/
+function parseEntityTag(value) {
+	const trimmed = value.trim();
+	if (trimmed === "") return void 0;
+	const weak = trimmed.startsWith("W/");
+	const opaque = weak ? trimmed.slice(2) : trimmed;
+	if (opaque === "") return void 0;
+	return {
+		weak,
+		opaque
+	};
+}
+/**
+* Parse an `If-Match` / `If-None-Match` value: `"*"` or a comma-separated list
+* of entity tags. A comma inside a quoted tag is part of the tag.
+*/
+function parseEntityTagList(header) {
+	const value = Array.isArray(header) ? header.join(",") : header;
+	if (typeof value !== "string" || value.trim() === "") return void 0;
+	if (value.trim() === "*") return "*";
+	const tags = [];
+	let start = 0;
+	let quoted = false;
+	for (let index = 0; index <= value.length; index++) {
+		const character = value[index];
+		if (character === "\"") quoted = !quoted;
+		if (index === value.length || character === "," && !quoted) {
+			const tag = parseEntityTag(value.slice(start, index));
+			if (tag) tags.push(tag);
+			start = index + 1;
+		}
+	}
+	return tags;
+}
+/**
+* Weak comparison: the opaque tags are identical.
+*/
+function weakEntityTagMatch(first, second) {
+	return first.opaque === second.opaque;
+}
+/**
+* Strong comparison: neither tag is weak and the opaque tags are identical.
+*/
+function strongEntityTagMatch(first, second) {
+	return !first.weak && !second.weak && first.opaque === second.opaque;
+}
+/**
+* Whether an `If-None-Match` header matches the current entity tag, with weak
+* comparison. `*` matches any current representation.
+*/
+function matchesIfNoneMatch(header, etag) {
+	const tags = parseEntityTagList(header);
+	const current = parseEntityTag(etag);
+	if (tags === void 0 || current === void 0) return false;
+	if (tags === "*") return true;
+	return tags.some((tag) => weakEntityTagMatch(tag, current));
+}
+/**
+* Whether an `If-Match` header is satisfied by the current entity tag, with
+* strong comparison. `*` is satisfied by any current representation, so it
+* fails only when there is none (`etag` undefined).
+*/
+function matchesIfMatch(header, etag) {
+	const tags = parseEntityTagList(header);
+	if (tags === void 0) return true;
+	if (tags === "*") return etag !== void 0;
+	const current = etag === void 0 ? void 0 : parseEntityTag(etag);
+	if (current === void 0) return false;
+	return tags.some((tag) => strongEntityTagMatch(tag, current));
+}
+function isPresent(header) {
+	if (Array.isArray(header)) return header.length > 0;
+	return typeof header === "string" && header.trim() !== "";
+}
+function toSeconds(value) {
+	return Math.floor((value instanceof Date ? value.getTime() : value) / 1e3);
+}
+function parseHttpDate(header) {
+	const value = Array.isArray(header) ? header[0] : header;
+	if (typeof value !== "string") return void 0;
+	const time = new Date(value).getTime();
+	return Number.isFinite(time) ? Math.floor(time / 1e3) : void 0;
+}
+/**
+* Evaluate the precondition headers in RFC 9110 §13.2.2 order:
+*
+* 1. `If-Match` (strong comparison) — false is 412;
+* 2. otherwise `If-Unmodified-Since` — modified after the date is 412;
+* 3. `If-None-Match` (weak comparison) — a match is 304 for GET/HEAD, else 412;
+* 4. otherwise, for GET/HEAD, `If-Modified-Since` — not modified since is 304.
+*
+* An invalid date is ignored, as the RFC requires.
+*/
+function evaluateConditionalRequest(input) {
+	const method = input.method.toUpperCase();
+	const safe = method === "GET" || method === "HEAD";
+	if (isPresent(input.ifMatch)) {
+		if (!matchesIfMatch(input.ifMatch, input.etag)) return "precondition-failed";
+	} else if (isPresent(input.ifUnmodifiedSince) && input.lastModified !== void 0) {
+		const since = parseHttpDate(input.ifUnmodifiedSince);
+		if (since !== void 0 && toSeconds(input.lastModified) > since) return "precondition-failed";
+	}
+	if (isPresent(input.ifNoneMatch)) {
+		if (input.etag !== void 0 && matchesIfNoneMatch(input.ifNoneMatch, input.etag)) return safe ? "not-modified" : "precondition-failed";
+		return "proceed";
+	}
+	if (safe && isPresent(input.ifModifiedSince) && input.lastModified !== void 0) {
+		const since = parseHttpDate(input.ifModifiedSince);
+		if (since !== void 0 && toSeconds(input.lastModified) <= since) return "not-modified";
+	}
+	return "proceed";
+}
+
+//#endregion
+export { evaluateConditionalRequest, matchesIfMatch, matchesIfNoneMatch, parseEntityTag, parseEntityTagList, strongEntityTagMatch, weakEntityTagMatch };
+//# sourceMappingURL=conditional-request.mjs.map

package/esm/http/conditional-request.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditional-request.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/conditional-request.ts"],"sourcesContent":["/**\n * HTTP conditional requests (RFC 9110 §13): entity-tag comparison and the\n * precedence of the precondition headers.\n *\n * Two comparisons exist (RFC 9110 §8.8.3.2):\n *\n * - **strong**: both tags are strong (no `W/` prefix) and their opaque tags are\n *   identical. `If-Match` uses it (§13.1.1), so a weak validator never\n *   satisfies `If-Match`.\n * - **weak**: the opaque tags are identical, whatever their `W/` prefixes.\n *   `If-None-Match` uses it (§13.1.2), so `W/\"a\"` matches `\"a\"`.\n *\n * Source: https://www.rfc-editor.org/rfc/rfc9110 (sections 8.8.3, 13.1, 13.2).\n */\n\n/**\n * One parsed entity tag. `opaque` keeps its quotes, so `\"a\"` and `a` differ.\n */\nexport type EntityTag = {\n  weak: boolean;\n  opaque: string;\n};\n\n/**\n * Parse one entity tag: an optional case-sensitive `W/` prefix, then the\n * opaque tag. A value without quotes is kept as its own opaque tag so an\n * application-supplied unquoted ETag still compares with itself.\n */\nexport function parseEntityTag(value: string): EntityTag | undefined {\n  const trimmed = value.trim();\n\n  if (trimmed === \"\") return undefined;\n\n  const weak = trimmed.startsWith(\"W/\");\n  const opaque = weak ? trimmed.slice(2) : trimmed;\n\n  if (opaque === \"\") return undefined;\n\n  return { weak, opaque };\n}\n\n/**\n * Parse an `If-Match` / `If-None-Match` value: `\"*\"` or a comma-separated list\n * of entity tags. A comma inside a quoted tag is part of the tag.\n */\nexport function parseEntityTagList(header: unknown): \"*\" | EntityTag[] | undefined {\n  const value = Array.isArray(header) ? header.join(\",\") : header;\n\n  if (typeof value !== \"string\" || value.trim() === \"\") return undefined;\n\n  if (value.trim() === \"*\") return \"*\";\n\n  const tags: EntityTag[] = [];\n  let start = 0;\n  let quoted = false;\n\n  for (let index = 0; index <= value.length; index++) {\n    const character = value[index];\n\n    if (character === '\"') quoted = !quoted;\n\n    if (index === value.length || (character === \",\" && !quoted)) {\n      const tag = parseEntityTag(value.slice(start, index));\n\n      if (tag) tags.push(tag);\n\n      start = index + 1;\n    }\n  }\n\n  return tags;\n}\n\n/**\n * Weak comparison: the opaque tags are identical.\n */\nexport function weakEntityTagMatch(first: EntityTag, second: EntityTag): boolean {\n  return first.opaque === second.opaque;\n}\n\n/**\n * Strong comparison: neither tag is weak and the opaque tags are identical.\n */\nexport function strongEntityTagMatch(first: EntityTag, second: EntityTag): boolean {\n  return !first.weak && !second.weak && first.opaque === second.opaque;\n}\n\n/**\n * Whether an `If-None-Match` header matches the current entity tag, with weak\n * comparison. `*` matches any current representation.\n */\nexport function matchesIfNoneMatch(header: unknown, etag: string): boolean {\n  const tags = parseEntityTagList(header);\n  const current = parseEntityTag(etag);\n\n  if (tags === undefined || current === undefined) return false;\n\n  if (tags === \"*\") return true;\n\n  return tags.some((tag) => weakEntityTagMatch(tag, current));\n}\n\n/**\n * Whether an `If-Match` header is satisfied by the current entity tag, with\n * strong comparison. `*` is satisfied by any current representation, so it\n * fails only when there is none (`etag` undefined).\n */\nexport function matchesIfMatch(header: unknown, etag: string | undefined): boolean {\n  const tags = parseEntityTagList(header);\n\n  if (tags === undefined) return true;\n\n  if (tags === \"*\") return etag !== undefined;\n\n  const current = etag === undefined ? undefined : parseEntityTag(etag);\n\n  if (current === undefined) return false;\n\n  return tags.some((tag) => strongEntityTagMatch(tag, current));\n}\n\n/**\n * The request headers and current validators a precondition check reads.\n */\nexport type ConditionalRequestInput = {\n  method: string;\n  /** Current entity tag, quoted, optionally `W/`-prefixed. */\n  etag?: string;\n  /** Current modification time. HTTP dates have second precision. */\n  lastModified?: Date | number;\n  ifMatch?: unknown;\n  ifNoneMatch?: unknown;\n  ifModifiedSince?: unknown;\n  ifUnmodifiedSince?: unknown;\n};\n\n/**\n * What a precondition check decided:\n *\n * - `\"proceed\"`: send the normal response;\n * - `\"not-modified\"`: answer a GET or HEAD with 304;\n * - `\"precondition-failed\"`: answer with 412.\n */\nexport type ConditionalRequestOutcome = \"proceed\" | \"not-modified\" | \"precondition-failed\";\n\nfunction isPresent(header: unknown): boolean {\n  if (Array.isArray(header)) return header.length > 0;\n\n  return typeof header === \"string\" && header.trim() !== \"\";\n}\n\nfunction toSeconds(value: Date | number): number {\n  return Math.floor((value instanceof Date ? value.getTime() : value) / 1000);\n}\n\nfunction parseHttpDate(header: unknown): number | undefined {\n  const value = Array.isArray(header) ? header[0] : header;\n\n  if (typeof value !== \"string\") return undefined;\n\n  const time = new Date(value).getTime();\n\n  return Number.isFinite(time) ? Math.floor(time / 1000) : undefined;\n}\n\n/**\n * Evaluate the precondition headers in RFC 9110 §13.2.2 order:\n *\n * 1. `If-Match` (strong comparison) — false is 412;\n * 2. otherwise `If-Unmodified-Since` — modified after the date is 412;\n * 3. `If-None-Match` (weak comparison) — a match is 304 for GET/HEAD, else 412;\n * 4. otherwise, for GET/HEAD, `If-Modified-Since` — not modified since is 304.\n *\n * An invalid date is ignored, as the RFC requires.\n */\nexport function evaluateConditionalRequest(\n  input: ConditionalRequestInput,\n): ConditionalRequestOutcome {\n  const method = input.method.toUpperCase();\n  const safe = method === \"GET\" || method === \"HEAD\";\n\n  if (isPresent(input.ifMatch)) {\n    if (!matchesIfMatch(input.ifMatch, input.etag)) return \"precondition-failed\";\n  } else if (isPresent(input.ifUnmodifiedSince) && input.lastModified !== undefined) {\n    const since = parseHttpDate(input.ifUnmodifiedSince);\n\n    if (since !== undefined && toSeconds(input.lastModified) > since) {\n      return \"precondition-failed\";\n    }\n  }\n\n  if (isPresent(input.ifNoneMatch)) {\n    if (input.etag !== undefined && matchesIfNoneMatch(input.ifNoneMatch, input.etag)) {\n      return safe ? \"not-modified\" : \"precondition-failed\";\n    }\n\n    return \"proceed\";\n  }\n\n  if (safe && isPresent(input.ifModifiedSince) && input.lastModified !== undefined) {\n    const since = parseHttpDate(input.ifModifiedSince);\n\n    if (since !== undefined && toSeconds(input.lastModified) <= since) {\n      return \"not-modified\";\n    }\n  }\n\n  return \"proceed\";\n}\n"],"mappings":";;;;;;AA4BA,SAAgB,eAAe,OAAsC;CACnE,MAAM,UAAU,MAAM,KAAK;CAE3B,IAAI,YAAY,IAAI,OAAO;CAE3B,MAAM,OAAO,QAAQ,WAAW,IAAI;CACpC,MAAM,SAAS,OAAO,QAAQ,MAAM,CAAC,IAAI;CAEzC,IAAI,WAAW,IAAI,OAAO;CAE1B,OAAO;EAAE;EAAM;CAAO;AACxB;;;;;AAMA,SAAgB,mBAAmB,QAAgD;CACjF,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK,GAAG,IAAI;CAEzD,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,IAAI,OAAO;CAE7D,IAAI,MAAM,KAAK,MAAM,KAAK,OAAO;CAEjC,MAAM,OAAoB,CAAC;CAC3B,IAAI,QAAQ;CACZ,IAAI,SAAS;CAEb,KAAK,IAAI,QAAQ,GAAG,SAAS,MAAM,QAAQ,SAAS;EAClD,MAAM,YAAY,MAAM;EAExB,IAAI,cAAc,MAAK,SAAS,CAAC;EAEjC,IAAI,UAAU,MAAM,UAAW,cAAc,OAAO,CAAC,QAAS;GAC5D,MAAM,MAAM,eAAe,MAAM,MAAM,OAAO,KAAK,CAAC;GAEpD,IAAI,KAAK,KAAK,KAAK,GAAG;GAEtB,QAAQ,QAAQ;EAClB;CACF;CAEA,OAAO;AACT;;;;AAKA,SAAgB,mBAAmB,OAAkB,QAA4B;CAC/E,OAAO,MAAM,WAAW,OAAO;AACjC;;;;AAKA,SAAgB,qBAAqB,OAAkB,QAA4B;CACjF,OAAO,CAAC,MAAM,QAAQ,CAAC,OAAO,QAAQ,MAAM,WAAW,OAAO;AAChE;;;;;AAMA,SAAgB,mBAAmB,QAAiB,MAAuB;CACzE,MAAM,OAAO,mBAAmB,MAAM;CACtC,MAAM,UAAU,eAAe,IAAI;CAEnC,IAAI,SAAS,UAAa,YAAY,QAAW,OAAO;CAExD,IAAI,SAAS,KAAK,OAAO;CAEzB,OAAO,KAAK,MAAM,QAAQ,mBAAmB,KAAK,OAAO,CAAC;AAC5D;;;;;;AAOA,SAAgB,eAAe,QAAiB,MAAmC;CACjF,MAAM,OAAO,mBAAmB,MAAM;CAEtC,IAAI,SAAS,QAAW,OAAO;CAE/B,IAAI,SAAS,KAAK,OAAO,SAAS;CAElC,MAAM,UAAU,SAAS,SAAY,SAAY,eAAe,IAAI;CAEpE,IAAI,YAAY,QAAW,OAAO;CAElC,OAAO,KAAK,MAAM,QAAQ,qBAAqB,KAAK,OAAO,CAAC;AAC9D;AA0BA,SAAS,UAAU,QAA0B;CAC3C,IAAI,MAAM,QAAQ,MAAM,GAAG,OAAO,OAAO,SAAS;CAElD,OAAO,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM;AACzD;AAEA,SAAS,UAAU,OAA8B;CAC/C,OAAO,KAAK,OAAO,iBAAiB,OAAO,MAAM,QAAQ,IAAI,SAAS,GAAI;AAC5E;AAEA,SAAS,cAAc,QAAqC;CAC1D,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;CAElD,IAAI,OAAO,UAAU,UAAU,OAAO;CAEtC,MAAM,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,QAAQ;CAErC,OAAO,OAAO,SAAS,IAAI,IAAI,KAAK,MAAM,OAAO,GAAI,IAAI;AAC3D;;;;;;;;;;;AAYA,SAAgB,2BACd,OAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY;CACxC,MAAM,OAAO,WAAW,SAAS,WAAW;CAE5C,IAAI,UAAU,MAAM,OAAO,GACzB;MAAI,CAAC,eAAe,MAAM,SAAS,MAAM,IAAI,GAAG,OAAO;CAAqB,OACvE,IAAI,UAAU,MAAM,iBAAiB,KAAK,MAAM,iBAAiB,QAAW;EACjF,MAAM,QAAQ,cAAc,MAAM,iBAAiB;EAEnD,IAAI,UAAU,UAAa,UAAU,MAAM,YAAY,IAAI,OACzD,OAAO;CAEX;CAEA,IAAI,UAAU,MAAM,WAAW,GAAG;EAChC,IAAI,MAAM,SAAS,UAAa,mBAAmB,MAAM,aAAa,MAAM,IAAI,GAC9E,OAAO,OAAO,iBAAiB;EAGjC,OAAO;CACT;CAEA,IAAI,QAAQ,UAAU,MAAM,eAAe,KAAK,MAAM,iBAAiB,QAAW;EAChF,MAAM,QAAQ,cAAc,MAAM,eAAe;EAEjD,IAAI,UAAU,UAAa,UAAU,MAAM,YAAY,KAAK,OAC1D,OAAO;CAEX;CAEA,OAAO;AACT"}

package/esm/http/csp.d.mts

@@ -71,6 +71,8 @@ declare const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>
 declare class InvalidCspDirectiveError extends Error {
   readonly directive: string;
   readonly value: string;
+  /** Stable Warlock error code; `warlock explain WL1004` prints the fix. */
+  readonly code = "WL1004";
   constructor(directive: string, value: string, reason: string);
 }
 /**

package/esm/http/csp.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csp.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"mappings":";;;;;;AAwBA;;;;;;;;;AAyBqB;AASrB;;;;AAAoD;AAsBpD;;;KAxDY,SAAA;EAwDkC;;;;EAnD5C,OAAA;EAsDkB;;;AACF;AAkBlB;;;;AAAsF;EA/DpF,UAAA;EA2F8B;;;AAAa;AAe7C;;;;AAAuC;EAhGrC,UAAA,GAAa,MAAM;AAAA;;;;;;;cASR,sBAAA,EAAwB,QAAQ,CAAC,MAAA;AA6GrC;AAqCT;;;;AAA2E;AAU3E;;;;;;AA/CS,cAvFI,wBAAA,SAAiC,KAAK;EAAA,SAE/B,SAAA;EAAA,SACA,KAAA;cADA,SAAA,UACA,KAAA,UAChB,MAAA;AAAA;;;;;;;;iBAkBY,qBAAA,CAAsB,UAAgD,EAApC,MAAM;;;;iBA4BxC,gBAAA,IAAoB,SAAS;;;;;;;;;;;;iBAe7B,uBAAA;;;;;;;;;;;;iBAmBA,kBAAA,CACd,aAAA,EAAe,MAAA,gCACf,KAAA,WACC,MAAM;;;;;iBAqCO,sBAAA,CAAuB,UAAoC,EAAxB,MAAM;;;;;iBAUzC,mBAAA,CAAoB,SAAA,EAAW,SAAS,EAAE,KAAA;;;;;;;;;;;;;;;iBAkB1C,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,QAAQ"}
+{"version":3,"file":"csp.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"mappings":";;;;;;AAwBA;;;;;;;;;AAyBqB;AASrB;;;;AAAoD;AAsBpD;;;KAxDY,SAAA;EAwDkC;;;;EAnD5C,OAAA;EAwDkB;;;;AAEF;AAkBlB;;;;EAlEE,UAAA;EA8Fc;;;;AAA6B;AAe7C;;;;EAnGE,UAAA,GAAa,MAAM;AAAA;;;;;;;cASR,sBAAA,EAAwB,QAAQ,CAAC,MAAA;;AAgHrC;AAmCT;;;;AAA2E;AAU3E;;;;;cAvIa,wBAAA,SAAiC,KAAK;EAAA,SAK/B,SAAA;EAAA,SACA,KAAA;EAiImD;EAAA,SArIrD,IAAA;cAGE,SAAA,UACA,KAAA,UAChB,MAAA;AAAA;;;;;;;AAkJ+D;iBAhInD,qBAAA,CAAsB,UAAgD,EAApC,MAAM;;;;iBA4BxC,gBAAA,IAAoB,SAAS;;;;;;;;;;;;iBAe7B,uBAAA;;;;;;;;;;;;iBAmBA,kBAAA,CACd,aAAA,EAAe,MAAA,gCACf,KAAA,WACC,MAAM;;;;;iBAmCO,sBAAA,CAAuB,UAAoC,EAAxB,MAAM;;;;;iBAUzC,mBAAA,CAAoB,SAAA,EAAW,SAAS,EAAE,KAAA;;;;;;;;;;;;;;;iBAkB1C,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,QAAQ"}

package/esm/http/csp.mjs

@@ -33,6 +33,7 @@ var InvalidCspDirectiveError = class extends Error {
 		super(`Invalid "http.csp.directives" entry — directive "${directive}" has a value ${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; the framework will not silently repair it.`);
 		this.directive = directive;
 		this.value = value;
+		this.code = "WL1004";
 		this.name = "InvalidCspDirectiveError";
 	}
 };

package/esm/http/csp.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csp.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/**\n * App-facing `http.csp` configuration shape.\n *\n * Disabled by default: an app that never sets `http.csp` (or sets\n * `enabled: false`) gets no `Content-Security-Policy` header at all — zero\n * behaviour change for every existing app. Opting in only swaps `enabled` to\n * `true`; `reportOnly` and `directives` are optional refinements on top.\n *\n * @example\n * ```ts title=\"src/config/http.ts\"\n * const httpConfigurations: HttpConfigurations = {\n *   csp: {\n *     enabled: true,\n *     directives: {\n *       \"img-src\": [\"'self'\", \"data:\", \"https://cdn.example.com\"],\n *     },\n *   },\n * };\n * ```\n */\nexport type CspConfig = {\n  /**\n   * Turn the header on. Everything else in this type is inert while this is\n   * `false`/unset.\n   */\n  enabled: boolean;\n  /**\n   * Emit `Content-Security-Policy-Report-Only` instead of the enforcing\n   * `Content-Security-Policy` header — the browser reports violations\n   * (via `report-to`/`report-uri`, if the app's directives configure one)\n   * without blocking anything. Use this to observe a policy safely before\n   * enforcing it.\n   *\n   * @default false\n   */\n  reportOnly?: boolean;\n  /**\n   * App-supplied directive values. A directive named here REPLACES the\n   * framework's default list for that directive entirely (the two lists are\n   * never merged element-wise) — declare the full value list you want.\n   *\n   * `script-src` is special-cased regardless of whether it is declared here:\n   * the current request's CSP nonce (`'nonce-<value>'`) is always appended to\n   * it, so the framework's own inline/module scripts keep working.\n   */\n  directives?: Record<string, string[]>;\n};\n\n/**\n * The policy every `http.csp`-enabled app starts from. Deliberately\n * conservative — same-origin by default, no plugins, no framing by other\n * sites — and documented here rather than only in the skill, since this is\n * the literal set an app's `directives` entry replaces one key at a time.\n */\nexport const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>> = {\n  \"default-src\": [\"'self'\"],\n  \"script-src\": [\"'self'\"],\n  \"style-src\": [\"'self'\"],\n  \"img-src\": [\"'self'\", \"data:\"],\n  \"object-src\": [\"'none'\"],\n  \"base-uri\": [\"'self'\"],\n  \"frame-ancestors\": [\"'self'\"],\n};\n\n/**\n * Thrown at boot when `http.csp.directives` contains a value the framework\n * refuses to ship as-is, rather than silently dropping or rewriting it.\n *\n * Two shapes are rejected:\n * - a value containing `;` — CSP directives are `;`-delimited, so a `;`\n *   inside one value would prematurely close it and let the remainder be\n *   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.\n * - a value with an odd number of `'` characters — every CSP keyword\n *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an\n *   unbalanced count means a keyword was truncated or malformed.\n */\nexport class InvalidCspDirectiveError extends Error {\n  public constructor(\n    public readonly directive: string,\n    public readonly value: string,\n    reason: string,\n  ) {\n    super(\n      `Invalid \"http.csp.directives\" entry — directive \"${directive}\" has a value ` +\n        `${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; ` +\n        `the framework will not silently repair it.`,\n    );\n    this.name = \"InvalidCspDirectiveError\";\n  }\n}\n\n/**\n * Validate every directive value an app supplied, throwing\n * {@link InvalidCspDirectiveError} on the first offender.\n *\n * Exported so boot code and tests can call it directly, independent of\n * whether `http.csp` happens to be enabled.\n */\nexport function validateCspDirectives(directives: Record<string, string[]> | undefined): void {\n  if (!directives) return;\n\n  for (const [directive, values] of Object.entries(directives)) {\n    for (const value of values) {\n      if (value.includes(\";\")) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"contains a ';' character, which would truncate the directive.\",\n        );\n      }\n\n      const quoteCount = (value.match(/'/g) ?? []).length;\n      if (quoteCount % 2 !== 0) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"has an unbalanced number of ' characters.\",\n        );\n      }\n    }\n  }\n}\n\n/**\n * Read the app's `http.csp` config, if any.\n */\nexport function resolveCspConfig(): CspConfig | undefined {\n  return config.get(\"http.csp\");\n}\n\n/**\n * Fail the boot loudly when `http.csp` is enabled with invalid directives.\n *\n * Called once, from {@link createHttpApplication} before the server starts\n * listening — never per-request. A per-request validation would let an app\n * boot successfully and only discover the bad config on first traffic;\n * checking once at boot surfaces it immediately, the same way a malformed\n * `warlock.config.ts` would.\n *\n * @throws {InvalidCspDirectiveError} when a directive value is malformed.\n */\nexport function validateCspConfigAtBoot(): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  validateCspDirectives(cspConfig.directives);\n}\n\n/**\n * Merge the app's directives over the framework defaults and fold in the\n * request's nonce.\n *\n * Per-directive replacement, not element-wise merging: a directive the app\n * names wins outright, everything else falls back to\n * {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains\n * `'nonce-<nonce>'` on top, whichever list it started from, so the\n * framework's own inline payload script and hydration module script are\n * never blocked by an app's own policy.\n */\nexport function mergeCspDirectives(\n  appDirectives: Record<string, string[]> | undefined,\n  nonce: string,\n): Record<string, string[]> {\n  const merged: Record<string, string[]> = {};\n\n  for (const [directive, defaultValues] of Object.entries(DEFAULT_CSP_DIRECTIVES)) {\n    merged[directive] = appDirectives?.[directive]\n      ? [...appDirectives[directive]]\n      : [...defaultValues];\n  }\n\n  if (appDirectives) {\n    for (const [directive, values] of Object.entries(appDirectives)) {\n      if (!(directive in merged)) {\n        merged[directive] = [...values];\n      }\n    }\n  }\n\n  // `merged[\"script-src\"]` is always populated by the loop above —\n  // `DEFAULT_CSP_DIRECTIVES` (:59-67) declares a `script-src` entry, and every\n  // one of its keys is copied into `merged` unconditionally — but its type is\n  // `Record<string, string[]>`, so `noUncheckedIndexedAccess` still widens the\n  // read to `string[] | undefined`. Narrowed once, locally, rather than\n  // asserted away.\n  const scriptSrc = merged[\"script-src\"] ?? [];\n  const nonceSource = `'nonce-${nonce}'`;\n\n  merged[\"script-src\"] = scriptSrc.includes(nonceSource)\n    ? scriptSrc\n    : [...scriptSrc, nonceSource];\n\n  return merged;\n}\n\n/**\n * Serialize a merged directive map into a header value —\n * `\"default-src 'self'; script-src 'self' 'nonce-...'; ...\"`.\n */\nexport function serializeCspDirectives(directives: Record<string, string[]>): string {\n  return Object.entries(directives)\n    .map(([directive, values]) => `${directive} ${values.join(\" \")}`)\n    .join(\"; \");\n}\n\n/**\n * Build the full `Content-Security-Policy` (or `-Report-Only`) header value\n * for one request, using that request's own nonce.\n */\nexport function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string {\n  return serializeCspDirectives(mergeCspDirectives(cspConfig.directives, nonce));\n}\n\n/**\n * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,\n * `Content-Security-Policy-Report-Only`) header on the response, when the\n * app opted in via `http.csp.enabled`.\n *\n * A no-op when `http.csp` is absent or `enabled` is falsy — the default,\n * behaviour-preserving state for every app that hasn't opted in.\n *\n * Reads `request.nonce`, which lazily generates and caches the per-request\n * nonce (`request.ts`) — calling this early in the request lifecycle (see\n * `inject-request-context.ts`) means the SAME nonce this stamps into the\n * header is the one still available later for the web layer's `<script>`\n * tags to read off `request.nonce`.\n */\nexport function applyCspHeader(request: Request, response: Response): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  const headerName = cspConfig.reportOnly\n    ? \"Content-Security-Policy-Report-Only\"\n    : \"Content-Security-Policy\";\n\n  response.header(headerName, buildCspHeaderValue(cspConfig, request.nonce));\n}\n"],"mappings":";;;;;;;;;AA0DA,MAAa,yBAAsE;CACjF,eAAe,CAAC,QAAQ;CACxB,cAAc,CAAC,QAAQ;CACvB,aAAa,CAAC,QAAQ;CACtB,WAAW,CAAC,UAAU,OAAO;CAC7B,cAAc,CAAC,QAAQ;CACvB,YAAY,CAAC,QAAQ;CACrB,mBAAmB,CAAC,QAAQ;AAC9B;;;;;;;;;;;;;AAcA,IAAa,2BAAb,cAA8C,MAAM;CAClD,AAAO,YACL,AAAgB,WAChB,AAAgB,OAChB,QACA;EACA,MACE,oDAAoD,UAAU,gBACzD,KAAK,UAAU,KAAK,EAAE,QAAQ,OAAO,qFAE5C;EARgB;EACA;EAQhB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,sBAAsB,YAAwD;CAC5F,IAAI,CAAC,YAAY;CAEjB,KAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,UAAU,GACzD,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,GAAG,GACpB,MAAM,IAAI,yBACR,WACA,OACA,+DACF;EAIF,KADoB,MAAM,MAAM,IAAI,KAAK,CAAC,EAAC,CAAE,SAC5B,MAAM,GACrB,MAAM,IAAI,yBACR,WACA,OACA,2CACF;CAEJ;AAEJ;;;;AAKA,SAAgB,mBAA0C;CACxD,OAAO,OAAO,IAAI,UAAU;AAC9B;;;;;;;;;;;;AAaA,SAAgB,0BAAgC;CAC9C,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,sBAAsB,UAAU,UAAU;AAC5C;;;;;;;;;;;;AAaA,SAAgB,mBACd,eACA,OAC0B;CAC1B,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,WAAW,kBAAkB,OAAO,QAAQ,sBAAsB,GAC5E,OAAO,aAAa,gBAAgB,aAChC,CAAC,GAAG,cAAc,UAAU,IAC5B,CAAC,GAAG,aAAa;CAGvB,IAAI,eACF;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,aAAa,GAC5D,IAAI,EAAE,aAAa,SACjB,OAAO,aAAa,CAAC,GAAG,MAAM;CAElC;CASF,MAAM,YAAY,OAAO,iBAAiB,CAAC;CAC3C,MAAM,cAAc,UAAU,MAAM;CAEpC,OAAO,gBAAgB,UAAU,SAAS,WAAW,IACjD,YACA,CAAC,GAAG,WAAW,WAAW;CAE9B,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,YAA8C;CACnF,OAAO,OAAO,QAAQ,UAAU,CAAC,CAC9B,KAAK,CAAC,WAAW,YAAY,GAAG,UAAU,GAAG,OAAO,KAAK,GAAG,GAAG,CAAC,CAChE,KAAK,IAAI;AACd;;;;;AAMA,SAAgB,oBAAoB,WAAsB,OAAuB;CAC/E,OAAO,uBAAuB,mBAAmB,UAAU,YAAY,KAAK,CAAC;AAC/E;;;;;;;;;;;;;;;AAgBA,SAAgB,eAAe,SAAkB,UAA0B;CACzE,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,MAAM,aAAa,UAAU,aACzB,wCACA;CAEJ,SAAS,OAAO,YAAY,oBAAoB,WAAW,QAAQ,KAAK,CAAC;AAC3E"}
+{"version":3,"file":"csp.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/**\n * App-facing `http.csp` configuration shape.\n *\n * Disabled by default: an app that never sets `http.csp` (or sets\n * `enabled: false`) gets no `Content-Security-Policy` header at all — zero\n * behaviour change for every existing app. Opting in only swaps `enabled` to\n * `true`; `reportOnly` and `directives` are optional refinements on top.\n *\n * @example\n * ```ts title=\"src/config/http.ts\"\n * const httpConfigurations: HttpConfigurations = {\n *   csp: {\n *     enabled: true,\n *     directives: {\n *       \"img-src\": [\"'self'\", \"data:\", \"https://cdn.example.com\"],\n *     },\n *   },\n * };\n * ```\n */\nexport type CspConfig = {\n  /**\n   * Turn the header on. Everything else in this type is inert while this is\n   * `false`/unset.\n   */\n  enabled: boolean;\n  /**\n   * Emit `Content-Security-Policy-Report-Only` instead of the enforcing\n   * `Content-Security-Policy` header — the browser reports violations\n   * (via `report-to`/`report-uri`, if the app's directives configure one)\n   * without blocking anything. Use this to observe a policy safely before\n   * enforcing it.\n   *\n   * @default false\n   */\n  reportOnly?: boolean;\n  /**\n   * App-supplied directive values. A directive named here REPLACES the\n   * framework's default list for that directive entirely (the two lists are\n   * never merged element-wise) — declare the full value list you want.\n   *\n   * `script-src` is special-cased regardless of whether it is declared here:\n   * the current request's CSP nonce (`'nonce-<value>'`) is always appended to\n   * it, so the framework's own inline/module scripts keep working.\n   */\n  directives?: Record<string, string[]>;\n};\n\n/**\n * The policy every `http.csp`-enabled app starts from. Deliberately\n * conservative — same-origin by default, no plugins, no framing by other\n * sites — and documented here rather than only in the skill, since this is\n * the literal set an app's `directives` entry replaces one key at a time.\n */\nexport const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>> = {\n  \"default-src\": [\"'self'\"],\n  \"script-src\": [\"'self'\"],\n  \"style-src\": [\"'self'\"],\n  \"img-src\": [\"'self'\", \"data:\"],\n  \"object-src\": [\"'none'\"],\n  \"base-uri\": [\"'self'\"],\n  \"frame-ancestors\": [\"'self'\"],\n};\n\n/**\n * Thrown at boot when `http.csp.directives` contains a value the framework\n * refuses to ship as-is, rather than silently dropping or rewriting it.\n *\n * Two shapes are rejected:\n * - a value containing `;` — CSP directives are `;`-delimited, so a `;`\n *   inside one value would prematurely close it and let the remainder be\n *   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.\n * - a value with an odd number of `'` characters — every CSP keyword\n *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an\n *   unbalanced count means a keyword was truncated or malformed.\n */\nexport class InvalidCspDirectiveError extends Error {\n  /** Stable Warlock error code; `warlock explain WL1004` prints the fix. */\n  public readonly code = \"WL1004\";\n\n  public constructor(\n    public readonly directive: string,\n    public readonly value: string,\n    reason: string,\n  ) {\n    super(\n      `Invalid \"http.csp.directives\" entry — directive \"${directive}\" has a value ` +\n        `${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; ` +\n        `the framework will not silently repair it.`,\n    );\n    this.name = \"InvalidCspDirectiveError\";\n  }\n}\n\n/**\n * Validate every directive value an app supplied, throwing\n * {@link InvalidCspDirectiveError} on the first offender.\n *\n * Exported so boot code and tests can call it directly, independent of\n * whether `http.csp` happens to be enabled.\n */\nexport function validateCspDirectives(directives: Record<string, string[]> | undefined): void {\n  if (!directives) return;\n\n  for (const [directive, values] of Object.entries(directives)) {\n    for (const value of values) {\n      if (value.includes(\";\")) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"contains a ';' character, which would truncate the directive.\",\n        );\n      }\n\n      const quoteCount = (value.match(/'/g) ?? []).length;\n      if (quoteCount % 2 !== 0) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"has an unbalanced number of ' characters.\",\n        );\n      }\n    }\n  }\n}\n\n/**\n * Read the app's `http.csp` config, if any.\n */\nexport function resolveCspConfig(): CspConfig | undefined {\n  return config.get(\"http.csp\");\n}\n\n/**\n * Fail the boot loudly when `http.csp` is enabled with invalid directives.\n *\n * Called once, from {@link createHttpApplication} before the server starts\n * listening — never per-request. A per-request validation would let an app\n * boot successfully and only discover the bad config on first traffic;\n * checking once at boot surfaces it immediately, the same way a malformed\n * `warlock.config.ts` would.\n *\n * @throws {InvalidCspDirectiveError} when a directive value is malformed.\n */\nexport function validateCspConfigAtBoot(): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  validateCspDirectives(cspConfig.directives);\n}\n\n/**\n * Merge the app's directives over the framework defaults and fold in the\n * request's nonce.\n *\n * Per-directive replacement, not element-wise merging: a directive the app\n * names wins outright, everything else falls back to\n * {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains\n * `'nonce-<nonce>'` on top, whichever list it started from, so the\n * framework's own inline payload script and hydration module script are\n * never blocked by an app's own policy.\n */\nexport function mergeCspDirectives(\n  appDirectives: Record<string, string[]> | undefined,\n  nonce: string,\n): Record<string, string[]> {\n  const merged: Record<string, string[]> = {};\n\n  for (const [directive, defaultValues] of Object.entries(DEFAULT_CSP_DIRECTIVES)) {\n    merged[directive] = appDirectives?.[directive]\n      ? [...appDirectives[directive]]\n      : [...defaultValues];\n  }\n\n  if (appDirectives) {\n    for (const [directive, values] of Object.entries(appDirectives)) {\n      if (!(directive in merged)) {\n        merged[directive] = [...values];\n      }\n    }\n  }\n\n  // `merged[\"script-src\"]` is always populated by the loop above —\n  // `DEFAULT_CSP_DIRECTIVES` (:59-67) declares a `script-src` entry, and every\n  // one of its keys is copied into `merged` unconditionally — but its type is\n  // `Record<string, string[]>`, so `noUncheckedIndexedAccess` still widens the\n  // read to `string[] | undefined`. Narrowed once, locally, rather than\n  // asserted away.\n  const scriptSrc = merged[\"script-src\"] ?? [];\n  const nonceSource = `'nonce-${nonce}'`;\n\n  merged[\"script-src\"] = scriptSrc.includes(nonceSource) ? scriptSrc : [...scriptSrc, nonceSource];\n\n  return merged;\n}\n\n/**\n * Serialize a merged directive map into a header value —\n * `\"default-src 'self'; script-src 'self' 'nonce-...'; ...\"`.\n */\nexport function serializeCspDirectives(directives: Record<string, string[]>): string {\n  return Object.entries(directives)\n    .map(([directive, values]) => `${directive} ${values.join(\" \")}`)\n    .join(\"; \");\n}\n\n/**\n * Build the full `Content-Security-Policy` (or `-Report-Only`) header value\n * for one request, using that request's own nonce.\n */\nexport function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string {\n  return serializeCspDirectives(mergeCspDirectives(cspConfig.directives, nonce));\n}\n\n/**\n * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,\n * `Content-Security-Policy-Report-Only`) header on the response, when the\n * app opted in via `http.csp.enabled`.\n *\n * A no-op when `http.csp` is absent or `enabled` is falsy — the default,\n * behaviour-preserving state for every app that hasn't opted in.\n *\n * Reads `request.nonce`, which lazily generates and caches the per-request\n * nonce (`request.ts`) — calling this early in the request lifecycle (see\n * `inject-request-context.ts`) means the SAME nonce this stamps into the\n * header is the one still available later for the web layer's `<script>`\n * tags to read off `request.nonce`.\n */\nexport function applyCspHeader(request: Request, response: Response): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  const headerName = cspConfig.reportOnly\n    ? \"Content-Security-Policy-Report-Only\"\n    : \"Content-Security-Policy\";\n\n  response.header(headerName, buildCspHeaderValue(cspConfig, request.nonce));\n}\n"],"mappings":";;;;;;;;;AA0DA,MAAa,yBAAsE;CACjF,eAAe,CAAC,QAAQ;CACxB,cAAc,CAAC,QAAQ;CACvB,aAAa,CAAC,QAAQ;CACtB,WAAW,CAAC,UAAU,OAAO;CAC7B,cAAc,CAAC,QAAQ;CACvB,YAAY,CAAC,QAAQ;CACrB,mBAAmB,CAAC,QAAQ;AAC9B;;;;;;;;;;;;;AAcA,IAAa,2BAAb,cAA8C,MAAM;CAIlD,AAAO,YACL,AAAgB,WAChB,AAAgB,OAChB,QACA;EACA,MACE,oDAAoD,UAAU,gBACzD,KAAK,UAAU,KAAK,EAAE,QAAQ,OAAO,qFAE5C;EARgB;EACA;cAJK;EAYrB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,sBAAsB,YAAwD;CAC5F,IAAI,CAAC,YAAY;CAEjB,KAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,UAAU,GACzD,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,GAAG,GACpB,MAAM,IAAI,yBACR,WACA,OACA,+DACF;EAIF,KADoB,MAAM,MAAM,IAAI,KAAK,CAAC,EAAC,CAAE,SAC5B,MAAM,GACrB,MAAM,IAAI,yBACR,WACA,OACA,2CACF;CAEJ;AAEJ;;;;AAKA,SAAgB,mBAA0C;CACxD,OAAO,OAAO,IAAI,UAAU;AAC9B;;;;;;;;;;;;AAaA,SAAgB,0BAAgC;CAC9C,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,sBAAsB,UAAU,UAAU;AAC5C;;;;;;;;;;;;AAaA,SAAgB,mBACd,eACA,OAC0B;CAC1B,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,WAAW,kBAAkB,OAAO,QAAQ,sBAAsB,GAC5E,OAAO,aAAa,gBAAgB,aAChC,CAAC,GAAG,cAAc,UAAU,IAC5B,CAAC,GAAG,aAAa;CAGvB,IAAI,eACF;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,aAAa,GAC5D,IAAI,EAAE,aAAa,SACjB,OAAO,aAAa,CAAC,GAAG,MAAM;CAElC;CASF,MAAM,YAAY,OAAO,iBAAiB,CAAC;CAC3C,MAAM,cAAc,UAAU,MAAM;CAEpC,OAAO,gBAAgB,UAAU,SAAS,WAAW,IAAI,YAAY,CAAC,GAAG,WAAW,WAAW;CAE/F,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,YAA8C;CACnF,OAAO,OAAO,QAAQ,UAAU,CAAC,CAC9B,KAAK,CAAC,WAAW,YAAY,GAAG,UAAU,GAAG,OAAO,KAAK,GAAG,GAAG,CAAC,CAChE,KAAK,IAAI;AACd;;;;;AAMA,SAAgB,oBAAoB,WAAsB,OAAuB;CAC/E,OAAO,uBAAuB,mBAAmB,UAAU,YAAY,KAAK,CAAC;AAC/E;;;;;;;;;;;;;;;AAgBA,SAAgB,eAAe,SAAkB,UAA0B;CACzE,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,MAAM,aAAa,UAAU,aACzB,wCACA;CAEJ,SAAS,OAAO,YAAY,oBAAoB,WAAW,QAAQ,KAAK,CAAC;AAC3E"}

package/esm/http/csrf-origin-policy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-policy.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"sourcesContent":["/**\n * The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the\n * one comparison every CSRF-Origin check in the framework must agree on.\n *\n * SECURITY, card 8a752ab2 (5.17). Extracted from\n * `@warlock.js/auth`'s `csrf-origin-check.ts` (the ONLY prior owner of this\n * logic) into `@warlock.js/core` so both call sites — the\n * `authMiddleware(\"cookie:*\")` check in `@warlock.js/auth` and the default\n * core HTTP-seam guard in `./csrf-default-guard.ts` — share ONE\n * implementation instead of drifting copies. `@warlock.js/core` cannot depend\n * on `@warlock.js/auth` (the dependency runs the other way), so the shared\n * logic had to move down into `core`, not up into a new shared package —\n * `auth`'s `csrf-origin-check.ts` now delegates to\n * {@link resolveCsrfOriginVerdict} instead of reimplementing it.\n *\n * Reads `auth.csrf.allowedOrigins` directly via `@mongez/config` (the exact\n * same config key `@warlock.js/auth`'s `authConfig.csrf.allowedOrigins()`\n * reads) rather than importing `@warlock.js/auth`, so an app's one\n * `auth.csrf.allowedOrigins` setting governs both checks without `core`\n * taking a hard dependency on `auth`.\n */\nimport config from \"@mongez/config\";\nimport type { Request } from \"./request\";\n\n/** Why {@link resolveCsrfOriginVerdict} refused a request. */\nexport type CsrfOriginCheckReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */\nexport type CsrfOriginVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: CsrfOriginCheckReason };\n\n/**\n * The request's own origin — what an `Origin`/`Referer` header must match.\n *\n * `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never\n * carries a port. A browser's `Origin` header on a non-default port (e.g. any\n * `warlock dev` session) does, so the port must come from the raw `Host`\n * header instead — core exposes no getter for that, so it is read directly\n * here.\n *\n * Trust-proxy-aware for free: `request.protocol` is Fastify's own\n * `request.protocol`, which already honours `http.trustProxy`\n * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this\n * function does not need its own proxy-trust logic on top of that.\n */\nexport function ownOrigin(request: Request): string {\n  // Fastify's `host` keeps the port and honours `X-Forwarded-Host` under\n  // `trustProxy`, so a proxy that rewrites `Host` does not break the match.\n  const fastifyHost = request.baseRequest?.host;\n  const hostHeader = request.header(\"host\");\n  const host =\n    typeof fastifyHost === \"string\" && fastifyHost\n      ? fastifyHost\n      : typeof hostHeader === \"string\" && hostHeader\n        ? hostHeader\n        : request.hostname;\n\n  return `${request.protocol}://${host}`;\n}\n\n/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */\nexport function originOf(rawUrl: string): string | undefined {\n  try {\n    const url = new URL(rawUrl);\n\n    return `${url.protocol}//${url.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Normalize an origin string (`scheme://host[:port]`) so that a default port\n * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin\n * written without a port. Falls back to the raw value if it does not parse\n * as a URL (in which case it will simply fail the exact-match comparison).\n */\nexport function normalizeOrigin(origin: string): string {\n  try {\n    const url = new URL(origin);\n    const isDefaultPort =\n      (url.protocol === \"http:\" && (url.port === \"\" || url.port === \"80\")) ||\n      (url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\"));\n\n    return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;\n  } catch {\n    return origin;\n  }\n}\n\n/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */\nexport function isAllowedCsrfOrigin(origin: string, request: Request): boolean {\n  if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;\n\n  const allowedOrigins: string[] = config.get(\"auth.csrf.allowedOrigins\", []);\n\n  const normalized = normalizeOrigin(origin);\n\n  return allowedOrigins.some(allowed => normalizeOrigin(allowed) === normalized);\n}\n\n/**\n * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):\n * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the\n * request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused\n * otherwise, including when BOTH headers are absent (fail closed).\n *\n * Callers decide WHETHER a request is in scope for this check at all (a\n * cookie-sourced credential / a non-locale cookie, an unsafe method, no route\n * exemption) — this function only answers the Origin/Referer question once a\n * caller has already decided the check applies.\n */\nexport function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict {\n  const origin = request.origin;\n\n  if (origin) {\n    return isAllowedCsrfOrigin(origin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"origin-mismatch\" };\n  }\n\n  const referer = request.header(\"referer\");\n  const refererOrigin = typeof referer === \"string\" ? originOf(referer) : undefined;\n\n  if (refererOrigin) {\n    return isAllowedCsrfOrigin(refererOrigin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"referer-mismatch\" };\n  }\n\n  return { allowed: false, reason: \"missing-origin-and-referer\" };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,UAAU,SAA0B;CAGlD,MAAM,cAAc,QAAQ,aAAa;CACzC,MAAM,aAAa,QAAQ,OAAO,MAAM;CACxC,MAAM,OACJ,OAAO,gBAAgB,YAAY,cAC/B,cACA,OAAO,eAAe,YAAY,aAChC,aACA,QAAQ;CAEhB,OAAO,GAAG,QAAQ,SAAS,KAAK;AAClC;;AAGA,SAAgB,SAAS,QAAoC;CAC3D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAE1B,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAwB;CACtD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,MAAM,gBACH,IAAI,aAAa,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,SAC7D,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;EAEjE,OAAO,GAAG,IAAI,SAAS,IAAI,gBAAgB,IAAI,WAAW,IAAI;CAChE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,oBAAoB,QAAgB,SAA2B;CAC7E,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,OAAO;CAE5E,MAAM,iBAA2B,OAAO,IAAI,4BAA4B,CAAC,CAAC;CAE1E,MAAM,aAAa,gBAAgB,MAAM;CAEzC,OAAO,eAAe,MAAK,YAAW,gBAAgB,OAAO,MAAM,UAAU;AAC/E;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,SAAqC;CAC5E,MAAM,SAAS,QAAQ;CAEvB,IAAI,QACF,OAAO,oBAAoB,QAAQ,OAAO,IACtC,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAkB;CAGlD,MAAM,UAAU,QAAQ,OAAO,SAAS;CACxC,MAAM,gBAAgB,OAAO,YAAY,WAAW,SAAS,OAAO,IAAI;CAExE,IAAI,eACF,OAAO,oBAAoB,eAAe,OAAO,IAC7C,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAmB;CAGnD,OAAO;EAAE,SAAS;EAAO,QAAQ;CAA6B;AAChE"}
+{"version":3,"file":"csrf-origin-policy.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"sourcesContent":["/**\n * The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the\n * one comparison every CSRF-Origin check in the framework must agree on.\n *\n * SECURITY, card 8a752ab2 (5.17). Extracted from\n * `@warlock.js/auth`'s `csrf-origin-check.ts` (the ONLY prior owner of this\n * logic) into `@warlock.js/core` so both call sites — the\n * `authMiddleware(\"cookie:*\")` check in `@warlock.js/auth` and the default\n * core HTTP-seam guard in `./csrf-default-guard.ts` — share ONE\n * implementation instead of drifting copies. `@warlock.js/core` cannot depend\n * on `@warlock.js/auth` (the dependency runs the other way), so the shared\n * logic had to move down into `core`, not up into a new shared package —\n * `auth`'s `csrf-origin-check.ts` now delegates to\n * {@link resolveCsrfOriginVerdict} instead of reimplementing it.\n *\n * Reads `auth.csrf.allowedOrigins` directly via `@mongez/config` (the exact\n * same config key `@warlock.js/auth`'s `authConfig.csrf.allowedOrigins()`\n * reads) rather than importing `@warlock.js/auth`, so an app's one\n * `auth.csrf.allowedOrigins` setting governs both checks without `core`\n * taking a hard dependency on `auth`.\n */\nimport config from \"@mongez/config\";\nimport type { Request } from \"./request\";\n\n/** Why {@link resolveCsrfOriginVerdict} refused a request. */\nexport type CsrfOriginCheckReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */\nexport type CsrfOriginVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: CsrfOriginCheckReason };\n\n/**\n * The request's own origin — what an `Origin`/`Referer` header must match.\n *\n * `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never\n * carries a port. A browser's `Origin` header on a non-default port (e.g. any\n * `warlock dev` session) does, so the port must come from the raw `Host`\n * header instead — core exposes no getter for that, so it is read directly\n * here.\n *\n * Trust-proxy-aware for free: `request.protocol` is Fastify's own\n * `request.protocol`, which already honours `http.trustProxy`\n * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this\n * function does not need its own proxy-trust logic on top of that.\n */\nexport function ownOrigin(request: Request): string {\n  // Fastify's `host` keeps the port and honours `X-Forwarded-Host` under\n  // `trustProxy`, so a proxy that rewrites `Host` does not break the match.\n  const fastifyHost = request.baseRequest?.host;\n  const hostHeader = request.header(\"host\");\n  const host =\n    typeof fastifyHost === \"string\" && fastifyHost\n      ? fastifyHost\n      : typeof hostHeader === \"string\" && hostHeader\n        ? hostHeader\n        : request.hostname;\n\n  return `${request.protocol}://${host}`;\n}\n\n/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */\nexport function originOf(rawUrl: string): string | undefined {\n  try {\n    const url = new URL(rawUrl);\n\n    return `${url.protocol}//${url.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Normalize an origin string (`scheme://host[:port]`) so that a default port\n * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin\n * written without a port. Falls back to the raw value if it does not parse\n * as a URL (in which case it will simply fail the exact-match comparison).\n */\nexport function normalizeOrigin(origin: string): string {\n  try {\n    const url = new URL(origin);\n    const isDefaultPort =\n      (url.protocol === \"http:\" && (url.port === \"\" || url.port === \"80\")) ||\n      (url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\"));\n\n    return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;\n  } catch {\n    return origin;\n  }\n}\n\n/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */\nexport function isAllowedCsrfOrigin(origin: string, request: Request): boolean {\n  if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;\n\n  const allowedOrigins: string[] = config.get(\"auth.csrf.allowedOrigins\", []);\n\n  const normalized = normalizeOrigin(origin);\n\n  return allowedOrigins.some((allowed) => normalizeOrigin(allowed) === normalized);\n}\n\n/**\n * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):\n * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the\n * request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused\n * otherwise, including when BOTH headers are absent (fail closed).\n *\n * Callers decide WHETHER a request is in scope for this check at all (a\n * cookie-sourced credential / a non-locale cookie, an unsafe method, no route\n * exemption) — this function only answers the Origin/Referer question once a\n * caller has already decided the check applies.\n */\nexport function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict {\n  const origin = request.origin;\n\n  if (origin) {\n    return isAllowedCsrfOrigin(origin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"origin-mismatch\" };\n  }\n\n  const referer = request.header(\"referer\");\n  const refererOrigin = typeof referer === \"string\" ? originOf(referer) : undefined;\n\n  if (refererOrigin) {\n    return isAllowedCsrfOrigin(refererOrigin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"referer-mismatch\" };\n  }\n\n  return { allowed: false, reason: \"missing-origin-and-referer\" };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,UAAU,SAA0B;CAGlD,MAAM,cAAc,QAAQ,aAAa;CACzC,MAAM,aAAa,QAAQ,OAAO,MAAM;CACxC,MAAM,OACJ,OAAO,gBAAgB,YAAY,cAC/B,cACA,OAAO,eAAe,YAAY,aAChC,aACA,QAAQ;CAEhB,OAAO,GAAG,QAAQ,SAAS,KAAK;AAClC;;AAGA,SAAgB,SAAS,QAAoC;CAC3D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAE1B,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAwB;CACtD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,MAAM,gBACH,IAAI,aAAa,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,SAC7D,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;EAEjE,OAAO,GAAG,IAAI,SAAS,IAAI,gBAAgB,IAAI,WAAW,IAAI;CAChE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,oBAAoB,QAAgB,SAA2B;CAC7E,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,OAAO;CAE5E,MAAM,iBAA2B,OAAO,IAAI,4BAA4B,CAAC,CAAC;CAE1E,MAAM,aAAa,gBAAgB,MAAM;CAEzC,OAAO,eAAe,MAAM,YAAY,gBAAgB,OAAO,MAAM,UAAU;AACjF;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,SAAqC;CAC5E,MAAM,SAAS,QAAQ;CAEvB,IAAI,QACF,OAAO,oBAAoB,QAAQ,OAAO,IACtC,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAkB;CAGlD,MAAM,UAAU,QAAQ,OAAO,SAAS;CACxC,MAAM,gBAAgB,OAAO,YAAY,WAAW,SAAS,OAAO,IAAI;CAExE,IAAI,eACF,OAAO,oBAAoB,eAAe,OAAO,IAC7C,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAmB;CAGnD,OAAO;EAAE,SAAS;EAAO,QAAQ;CAA6B;AAChE"}

package/esm/http/database/RequestLog.d.mts

@@ -6,59 +6,29 @@ declare const schema: import("@warlock.js/seal").ObjectValidator<{
   statusCode: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
   responseTime: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
   responseSize: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-  responseBody: import("@warlock.js/seal").RecordValidator & {
+  responseBody: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  responseHeaders: import("@warlock.js/seal").RecordValidator & {
+  };
+  responseHeaders: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
+  };
   ip: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   method: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   route: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  requestHeaders: import("@warlock.js/seal").RecordValidator & {
+  requestHeaders: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
+  };
   userAgent: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   referer: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  requestBody: import("@warlock.js/seal").RecordValidator & {
+  requestBody: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  requestParams: import("@warlock.js/seal").RecordValidator & {
+  };
+  requestParams: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  requestQuery: import("@warlock.js/seal").RecordValidator & {
+  };
+  requestQuery: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-}> & import("@warlock.js/seal").StandardSchemaV1<{
-  statusCode: number;
-  responseTime: number;
-  responseSize: number;
-  responseBody: Record<string, any>;
-  responseHeaders: Record<string, any>;
-  ip: string;
-  method: string;
-  route: string;
-  requestHeaders: Record<string, any>;
-  userAgent: string;
-  referer: string;
-  requestBody: Record<string, any>;
-  requestParams: Record<string, any>;
-  requestQuery: Record<string, any>;
-}, {
-  statusCode: number;
-  responseTime: number;
-  responseSize: number;
-  responseBody: Record<string, any>;
-  responseHeaders: Record<string, any>;
-  ip: string;
-  method: string;
-  route: string;
-  requestHeaders: Record<string, any>;
-  userAgent: string;
-  referer: string;
-  requestBody: Record<string, any>;
-  requestParams: Record<string, any>;
-  requestQuery: Record<string, any>;
+  };
 }>;
 type RequestLogSchema = Infer.Output<typeof schema>;
 declare class RequestLog extends Model<RequestLogSchema> {
@@ -73,59 +43,29 @@ declare class RequestLog extends Model<RequestLogSchema> {
     statusCode: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
     responseTime: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
     responseSize: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-    responseBody: import("@warlock.js/seal").RecordValidator & {
+    responseBody: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    responseHeaders: import("@warlock.js/seal").RecordValidator & {
+    };
+    responseHeaders: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
+    };
     ip: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     method: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     route: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    requestHeaders: import("@warlock.js/seal").RecordValidator & {
+    requestHeaders: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
+    };
     userAgent: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     referer: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    requestBody: import("@warlock.js/seal").RecordValidator & {
+    requestBody: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    requestParams: import("@warlock.js/seal").RecordValidator & {
+    };
+    requestParams: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    requestQuery: import("@warlock.js/seal").RecordValidator & {
+    };
+    requestQuery: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  }> & import("@warlock.js/seal").StandardSchemaV1<{
-    statusCode: number;
-    responseTime: number;
-    responseSize: number;
-    responseBody: Record<string, any>;
-    responseHeaders: Record<string, any>;
-    ip: string;
-    method: string;
-    route: string;
-    requestHeaders: Record<string, any>;
-    userAgent: string;
-    referer: string;
-    requestBody: Record<string, any>;
-    requestParams: Record<string, any>;
-    requestQuery: Record<string, any>;
-  }, {
-    statusCode: number;
-    responseTime: number;
-    responseSize: number;
-    responseBody: Record<string, any>;
-    responseHeaders: Record<string, any>;
-    ip: string;
-    method: string;
-    route: string;
-    requestHeaders: Record<string, any>;
-    userAgent: string;
-    referer: string;
-    requestBody: Record<string, any>;
-    requestParams: Record<string, any>;
-    requestQuery: Record<string, any>;
+    };
   }>;
 }
 //#endregion

package/esm/http/database/RequestLog.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"RequestLog.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/database/RequestLog.ts"],"mappings":";;;;cAGM,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiBP,gBAAA,GAAmB,KAAA,CAAM,MAAM,QAAQ,MAAA;AAAA,cAE/B,UAAA,SAAmB,KAAA,CAAM,gBAAA;;;;SAItB,KAAA;;;;SAKA,MAAA,6BAAM,eAAA"}
+{"version":3,"file":"RequestLog.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/database/RequestLog.ts"],"mappings":";;;;cAGM,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiBP,gBAAA,GAAmB,KAAA,CAAM,MAAM,QAAQ,MAAA;AAAA,cAE/B,UAAA,SAAmB,KAAA,CAAM,gBAAA;;;;SAItB,KAAA;;;;SAKA,MAAA,6BAAM,eAAA"}

package/esm/http/errors/errors.d.mts

@@ -50,6 +50,8 @@ declare class NotAllowedError extends HttpError {
  * locale resolution) must not throw on a request that simply has no jar.
  */
 declare class CookieJarUnavailableError extends Error {
+  /** Stable Warlock error code; `warlock explain WL5001` prints the fix. */
+  readonly code = "WL5001";
   constructor(cookieName: string);
 }
 //#endregion

package/esm/http/errors/errors.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/errors/errors.ts"],"mappings":";cAAa,SAAA,SAAkB,KAAK;EAEzB,MAAA;EACA,OAAA;EACA,OAAA;cAFA,MAAA,UACA,OAAA,UACA,OAAA;AAAA;AAAA,cAOE,qBAAA,SAA8B,SAAS;EAGzC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,iBAAA,SAA0B,SAAS;EAGrC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,cAAA,SAAuB,SAAS;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,WAAA,SAAoB,SAAS;EAG/B,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,aAAA,SAAsB,SAAS;EAGjC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,kBAAA,SAA2B,SAAS;EAGtC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;;;;;;;;;;AAlDa;AAOxB;;cA8Da,yBAAA,SAAkC,KAAK;cAC/B,UAAA;AAAA"}
+{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/errors/errors.ts"],"mappings":";cAAa,SAAA,SAAkB,KAAK;EAEzB,MAAA;EACA,OAAA;EACA,OAAA;cAFA,MAAA,UACA,OAAA,UACA,OAAA;AAAA;AAAA,cAOE,qBAAA,SAA8B,SAAS;EAGzC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,iBAAA,SAA0B,SAAS;EAGrC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,cAAA,SAAuB,SAAS;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,WAAA,SAAoB,SAAS;EAG/B,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,aAAA,SAAsB,SAAS;EAGjC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,kBAAA,SAA2B,SAAS;EAGtC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;;;;;;;;;;AAlDa;AAOxB;;cA8Da,yBAAA,SAAkC,KAAK;EA9DN;EAAA,SAgE5B,IAAA;cAEG,UAAA;AAAA"}

package/esm/http/errors/errors.mjs

@@ -79,6 +79,7 @@ var NotAllowedError = class extends HttpError {
 var CookieJarUnavailableError = class extends Error {
 	constructor(cookieName) {
 		super(`Cannot read cookie "${cookieName}": the cookie jar is unavailable because @fastify/cookie is not registered on this Fastify instance. Register the plugin (see core's http/plugins.ts) before reading cookies by name.`);
+		this.code = "WL5001";
 		this.name = "CookieJarUnavailableError";
 	}
 };

package/esm/http/errors/errors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/errors/errors.ts"],"sourcesContent":["export class HttpError extends Error {\n  public constructor(\n    public status: number,\n    public message: string,\n    public payload?: any,\n  ) {\n    super(message);\n    this.name = \"HttpError\";\n  }\n}\n\nexport class ResourceNotFoundError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(404, message, payload);\n    this.name = \"ResourceNotFoundError\";\n  }\n}\n\nexport class UnAuthorizedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(401, message, payload);\n    this.name = \"UnAuthorizedError\";\n  }\n}\n\nexport class ForbiddenError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(403, message, payload);\n    this.name = \"ForbiddenError\";\n  }\n}\n\nexport class BadRequestError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(400, message, payload);\n    this.name = \"BadRequestError\";\n  }\n}\n\nexport class ServerError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(500, message, payload);\n    this.name = \"ServerError\";\n  }\n}\n\nexport class ConflictError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(409, message, payload);\n    this.name = \"ConflictError\";\n  }\n}\n\nexport class NotAcceptableError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(406, message, payload);\n    this.name = \"NotAcceptableError\";\n  }\n}\n\nexport class NotAllowedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(405, message, payload);\n    this.name = \"NotAllowedError\";\n  }\n}\n\n/**\n * Thrown by `Request.prototype.cookie` / `Request.prototype.hasCookie` when\n * `@fastify/cookie` was never registered on this Fastify instance, so\n * `baseRequest.cookies` is `undefined` rather than an (possibly empty) object.\n *\n * A by-name cookie read is a deliberate assertion by the caller — \"this\n * cookie should be readable here\" — so an unavailable jar is a configuration\n * fault, not an absent cookie, and must not be swallowed into a default\n * value or a silent `false`. Contrast `Request.prototype.cookies`, which\n * stays lenient because the framework's own opportunistic reads (e.g.\n * locale resolution) must not throw on a request that simply has no jar.\n */\nexport class CookieJarUnavailableError extends Error {\n  public constructor(cookieName: string) {\n    super(\n      `Cannot read cookie \"${cookieName}\": the cookie jar is unavailable because ` +\n        \"@fastify/cookie is not registered on this Fastify instance. \" +\n        \"Register the plugin (see core's http/plugins.ts) before reading cookies by name.\",\n    );\n\n    this.name = \"CookieJarUnavailableError\";\n  }\n}\n"],"mappings":";AAAA,IAAa,YAAb,cAA+B,MAAM;CACnC,AAAO,YACL,AAAO,QACP,AAAO,SACP,AAAO,SACP;EACA,MAAM,OAAO;EAJN;EACA;EACA;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,wBAAb,cAA2C,UAAU;CACnD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,UAAU;CAC5C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,cAAb,cAAiC,UAAU;CACzC,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,UAAU;CAC3C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;AAcA,IAAa,4BAAb,cAA+C,MAAM;CACnD,AAAO,YAAY,YAAoB;EACrC,MACE,uBAAuB,WAAW,sLAGpC;EAEA,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/errors/errors.ts"],"sourcesContent":["export class HttpError extends Error {\n  public constructor(\n    public status: number,\n    public message: string,\n    public payload?: any,\n  ) {\n    super(message);\n    this.name = \"HttpError\";\n  }\n}\n\nexport class ResourceNotFoundError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(404, message, payload);\n    this.name = \"ResourceNotFoundError\";\n  }\n}\n\nexport class UnAuthorizedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(401, message, payload);\n    this.name = \"UnAuthorizedError\";\n  }\n}\n\nexport class ForbiddenError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(403, message, payload);\n    this.name = \"ForbiddenError\";\n  }\n}\n\nexport class BadRequestError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(400, message, payload);\n    this.name = \"BadRequestError\";\n  }\n}\n\nexport class ServerError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(500, message, payload);\n    this.name = \"ServerError\";\n  }\n}\n\nexport class ConflictError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(409, message, payload);\n    this.name = \"ConflictError\";\n  }\n}\n\nexport class NotAcceptableError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(406, message, payload);\n    this.name = \"NotAcceptableError\";\n  }\n}\n\nexport class NotAllowedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(405, message, payload);\n    this.name = \"NotAllowedError\";\n  }\n}\n\n/**\n * Thrown by `Request.prototype.cookie` / `Request.prototype.hasCookie` when\n * `@fastify/cookie` was never registered on this Fastify instance, so\n * `baseRequest.cookies` is `undefined` rather than an (possibly empty) object.\n *\n * A by-name cookie read is a deliberate assertion by the caller — \"this\n * cookie should be readable here\" — so an unavailable jar is a configuration\n * fault, not an absent cookie, and must not be swallowed into a default\n * value or a silent `false`. Contrast `Request.prototype.cookies`, which\n * stays lenient because the framework's own opportunistic reads (e.g.\n * locale resolution) must not throw on a request that simply has no jar.\n */\nexport class CookieJarUnavailableError extends Error {\n  /** Stable Warlock error code; `warlock explain WL5001` prints the fix. */\n  public readonly code = \"WL5001\";\n\n  public constructor(cookieName: string) {\n    super(\n      `Cannot read cookie \"${cookieName}\": the cookie jar is unavailable because ` +\n        \"@fastify/cookie is not registered on this Fastify instance. \" +\n        \"Register the plugin (see core's http/plugins.ts) before reading cookies by name.\",\n    );\n\n    this.name = \"CookieJarUnavailableError\";\n  }\n}\n"],"mappings":";AAAA,IAAa,YAAb,cAA+B,MAAM;CACnC,AAAO,YACL,AAAO,QACP,AAAO,SACP,AAAO,SACP;EACA,MAAM,OAAO;EAJN;EACA;EACA;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,wBAAb,cAA2C,UAAU;CACnD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,UAAU;CAC5C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,cAAb,cAAiC,UAAU;CACzC,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,UAAU;CAC3C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;AAcA,IAAa,4BAAb,cAA+C,MAAM;CAInD,AAAO,YAAY,YAAoB;EACrC,MACE,uBAAuB,WAAW,sLAGpC;cAPqB;EASrB,KAAK,OAAO;CACd;AACF"}

package/esm/http/escape-header-value.d.mts

@@ -0,0 +1,18 @@
+//#region ../../packages/core/src/http/escape-header-value.d.ts
+/**
+ * Make any value safe to send as an HTTP header value: CR, LF, NUL and other
+ * control characters (except tab) are removed, so input cannot split the
+ * header or inject another one, characters outside ISO-8859-1 become `?`, and
+ * surrounding whitespace is trimmed.
+ *
+ * Node already refuses a header value with CR/LF, but by throwing — which
+ * turns a crafted value into a 500. Escape values built from request input or
+ * stored user data before `response.header()`:
+ *
+ * @example
+ * response.header("X-Export-Name", escapeHeaderValue(request.input("name")));
+ */
+declare function escapeHeaderValue(value: unknown): string;
+//#endregion
+export { escapeHeaderValue };
+//# sourceMappingURL=escape-header-value.d.mts.map

package/esm/http/escape-header-value.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape-header-value.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/escape-header-value.ts"],"mappings":";;AAsBA;;;;AAAgD;;;;;;;;iBAAhC,iBAAA,CAAkB,KAAc"}

package/esm/http/escape-header-value.mjs

@@ -0,0 +1,27 @@
+//#region ../../packages/core/src/http/escape-header-value.ts
+/**
+* Characters Node refuses in a header value (`ERR_INVALID_CHAR`): control
+* characters other than horizontal tab, and anything outside ISO-8859-1.
+*/
+const FORBIDDEN_CONTROL = /[\u0000-\u0008\u000a-\u001f\u007f]/g;
+const OUTSIDE_LATIN1 = /[\u{100}-\u{10ffff}]/gu;
+/**
+* Make any value safe to send as an HTTP header value: CR, LF, NUL and other
+* control characters (except tab) are removed, so input cannot split the
+* header or inject another one, characters outside ISO-8859-1 become `?`, and
+* surrounding whitespace is trimmed.
+*
+* Node already refuses a header value with CR/LF, but by throwing — which
+* turns a crafted value into a 500. Escape values built from request input or
+* stored user data before `response.header()`:
+*
+* @example
+* response.header("X-Export-Name", escapeHeaderValue(request.input("name")));
+*/
+function escapeHeaderValue(value) {
+	return (typeof value === "string" ? value : String(value)).replace(FORBIDDEN_CONTROL, "").replace(OUTSIDE_LATIN1, "?").trim();
+}
+
+//#endregion
+export { escapeHeaderValue };
+//# sourceMappingURL=escape-header-value.mjs.map

package/esm/http/escape-header-value.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape-header-value.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/escape-header-value.ts"],"sourcesContent":["/**\n * Characters Node refuses in a header value (`ERR_INVALID_CHAR`): control\n * characters other than horizontal tab, and anything outside ISO-8859-1.\n */\n// oxlint-disable-next-line eslint/no-control-regex -- removing control characters is the point.\nconst FORBIDDEN_CONTROL = /[\\u0000-\\u0008\\u000a-\\u001f\\u007f]/g;\n\nconst OUTSIDE_LATIN1 = /[\\u{100}-\\u{10ffff}]/gu;\n\n/**\n * Make any value safe to send as an HTTP header value: CR, LF, NUL and other\n * control characters (except tab) are removed, so input cannot split the\n * header or inject another one, characters outside ISO-8859-1 become `?`, and\n * surrounding whitespace is trimmed.\n *\n * Node already refuses a header value with CR/LF, but by throwing — which\n * turns a crafted value into a 500. Escape values built from request input or\n * stored user data before `response.header()`:\n *\n * @example\n * response.header(\"X-Export-Name\", escapeHeaderValue(request.input(\"name\")));\n */\nexport function escapeHeaderValue(value: unknown): string {\n  const text = typeof value === \"string\" ? value : String(value);\n\n  return text.replace(FORBIDDEN_CONTROL, \"\").replace(OUTSIDE_LATIN1, \"?\").trim();\n}\n"],"mappings":";;;;;AAKA,MAAM,oBAAoB;AAE1B,MAAM,iBAAiB;;;;;;;;;;;;;;AAevB,SAAgB,kBAAkB,OAAwB;CAGxD,QAFa,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK,EAElD,CAAC,QAAQ,mBAAmB,EAAE,CAAC,CAAC,QAAQ,gBAAgB,GAAG,CAAC,CAAC,KAAK;AAC/E"}

package/esm/http/flush-pending-cookies.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"flush-pending-cookies.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/flush-pending-cookies.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport type { FastifyReply } from \"fastify\";\n\ntype ParkedCookie = { name: string; value: string; opts?: Record<string, unknown> };\n\n/** The installed `@fastify/cookie` version, or undefined when it can't be resolved. */\nfunction installedCookiePluginVersion(): string | undefined {\n  try {\n    const require = createRequire(path.join(process.cwd(), \"noop.js\"));\n\n    return (require(require.resolve(\"@fastify/cookie/package.json\")) as { version?: string })\n      .version;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * `@fastify/cookie` only parks cookies set via `reply.setCookie()` in a map\n * keyed by a private symbol; it serialises them in its own `onSend` hook.\n * Raw-path writers (`raw.writeHead`) bypass `onSend`, so they must call this\n * right before writing headers.\n *\n * Serialises the parked cookies, appends them to the `set-cookie` header\n * (skipping any value already present) and clears the map so a later `onSend`\n * cannot send them twice.\n *\n * Throws when the plugin is registered but its parked-cookie symbol cannot be\n * found: silently doing nothing would drop every cookie on raw paths. Does\n * nothing when the plugin is not registered.\n */\nexport function flushPendingCookies(reply: FastifyReply): void {\n  const parkedSymbol = Object.getOwnPropertySymbols(reply).find(\n    symbol => symbol.description === \"fastify.reply.setCookies\",\n  );\n\n  if (!parkedSymbol) {\n    if (typeof (reply as { setCookie?: unknown }).setCookie !== \"function\") return;\n\n    const version = installedCookiePluginVersion();\n\n    throw new Error(\n      `@fastify/cookie's internal cookie storage changed: reply.setCookie exists but the \"fastify.reply.setCookies\" symbol was not found${\n        version ? ` (installed @fastify/cookie@${version})` : \"\"\n      }. Cookies set before a raw-path response would be lost; update flushPendingCookies for this version.`,\n    );\n  }\n\n  const parked = (reply as unknown as Record<symbol, Map<string, ParkedCookie> | null>)[\n    parkedSymbol\n  ];\n\n  if (!parked || parked.size === 0) return;\n\n  const serializeCookie = (\n    reply.server as unknown as {\n      serializeCookie?: (name: string, value: string, opts?: unknown) => string;\n    }\n  ).serializeCookie;\n\n  if (!serializeCookie) return;\n\n  const existing = reply.getHeader(\"set-cookie\");\n  const cookies: string[] =\n    existing === undefined ? [] : Array.isArray(existing) ? [...existing] : [String(existing)];\n\n  for (const cookie of parked.values()) {\n    const serialized = serializeCookie(cookie.name, cookie.value, cookie.opts);\n\n    if (!cookies.includes(serialized)) {\n      cookies.push(serialized);\n    }\n  }\n\n  reply.removeHeader(\"set-cookie\");\n  reply.header(\"set-cookie\", cookies);\n  parked.clear();\n}\n"],"mappings":";;;;;AAOA,SAAS,+BAAmD;CAC1D,IAAI;EACF,MAAM,UAAU,cAAc,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS,CAAC;EAEjE,OAAQ,QAAQ,QAAQ,QAAQ,8BAA8B,CAAC,CAAC,CAC7D;CACL,QAAQ;EACN;CACF;AACF;;;;;;;;;;;;;;;AAgBA,SAAgB,oBAAoB,OAA2B;CAC7D,MAAM,eAAe,OAAO,sBAAsB,KAAK,CAAC,CAAC,MACvD,WAAU,OAAO,gBAAgB,0BACnC;CAEA,IAAI,CAAC,cAAc;EACjB,IAAI,OAAQ,MAAkC,cAAc,YAAY;EAExE,MAAM,UAAU,6BAA6B;EAE7C,MAAM,IAAI,MACR,oIACE,UAAU,+BAA+B,QAAQ,KAAK,GACvD,qGACH;CACF;CAEA,MAAM,SAAU,MACd;CAGF,IAAI,CAAC,UAAU,OAAO,SAAS,GAAG;CAElC,MAAM,kBACJ,MAAM,OAGN;CAEF,IAAI,CAAC,iBAAiB;CAEtB,MAAM,WAAW,MAAM,UAAU,YAAY;CAC7C,MAAM,UACJ,aAAa,SAAY,CAAC,IAAI,MAAM,QAAQ,QAAQ,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,OAAO,QAAQ,CAAC;CAE3F,KAAK,MAAM,UAAU,OAAO,OAAO,GAAG;EACpC,MAAM,aAAa,gBAAgB,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI;EAEzE,IAAI,CAAC,QAAQ,SAAS,UAAU,GAC9B,QAAQ,KAAK,UAAU;CAE3B;CAEA,MAAM,aAAa,YAAY;CAC/B,MAAM,OAAO,cAAc,OAAO;CAClC,OAAO,MAAM;AACf"}
+{"version":3,"file":"flush-pending-cookies.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/flush-pending-cookies.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport type { FastifyReply } from \"fastify\";\n\ntype ParkedCookie = { name: string; value: string; opts?: Record<string, unknown> };\n\n/** The installed `@fastify/cookie` version, or undefined when it can't be resolved. */\nfunction installedCookiePluginVersion(): string | undefined {\n  try {\n    const require = createRequire(path.join(process.cwd(), \"noop.js\"));\n\n    return (require(require.resolve(\"@fastify/cookie/package.json\")) as { version?: string })\n      .version;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * `@fastify/cookie` only parks cookies set via `reply.setCookie()` in a map\n * keyed by a private symbol; it serialises them in its own `onSend` hook.\n * Raw-path writers (`raw.writeHead`) bypass `onSend`, so they must call this\n * right before writing headers.\n *\n * Serialises the parked cookies, appends them to the `set-cookie` header\n * (skipping any value already present) and clears the map so a later `onSend`\n * cannot send them twice.\n *\n * Throws when the plugin is registered but its parked-cookie symbol cannot be\n * found: silently doing nothing would drop every cookie on raw paths. Does\n * nothing when the plugin is not registered.\n */\nexport function flushPendingCookies(reply: FastifyReply): void {\n  const parkedSymbol = Object.getOwnPropertySymbols(reply).find(\n    (symbol) => symbol.description === \"fastify.reply.setCookies\",\n  );\n\n  if (!parkedSymbol) {\n    if (typeof (reply as { setCookie?: unknown }).setCookie !== \"function\") return;\n\n    const version = installedCookiePluginVersion();\n\n    throw new Error(\n      `@fastify/cookie's internal cookie storage changed: reply.setCookie exists but the \"fastify.reply.setCookies\" symbol was not found${\n        version ? ` (installed @fastify/cookie@${version})` : \"\"\n      }. Cookies set before a raw-path response would be lost; update flushPendingCookies for this version.`,\n    );\n  }\n\n  const parked = (reply as unknown as Record<symbol, Map<string, ParkedCookie> | null>)[\n    parkedSymbol\n  ];\n\n  if (!parked || parked.size === 0) return;\n\n  const serializeCookie = (\n    reply.server as unknown as {\n      serializeCookie?: (name: string, value: string, opts?: unknown) => string;\n    }\n  ).serializeCookie;\n\n  if (!serializeCookie) return;\n\n  const existing = reply.getHeader(\"set-cookie\");\n  const cookies: string[] =\n    existing === undefined ? [] : Array.isArray(existing) ? [...existing] : [String(existing)];\n\n  for (const cookie of parked.values()) {\n    const serialized = serializeCookie(cookie.name, cookie.value, cookie.opts);\n\n    if (!cookies.includes(serialized)) {\n      cookies.push(serialized);\n    }\n  }\n\n  reply.removeHeader(\"set-cookie\");\n  reply.header(\"set-cookie\", cookies);\n  parked.clear();\n}\n"],"mappings":";;;;;AAOA,SAAS,+BAAmD;CAC1D,IAAI;EACF,MAAM,UAAU,cAAc,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS,CAAC;EAEjE,OAAQ,QAAQ,QAAQ,QAAQ,8BAA8B,CAAC,CAAC,CAC7D;CACL,QAAQ;EACN;CACF;AACF;;;;;;;;;;;;;;;AAgBA,SAAgB,oBAAoB,OAA2B;CAC7D,MAAM,eAAe,OAAO,sBAAsB,KAAK,CAAC,CAAC,MACtD,WAAW,OAAO,gBAAgB,0BACrC;CAEA,IAAI,CAAC,cAAc;EACjB,IAAI,OAAQ,MAAkC,cAAc,YAAY;EAExE,MAAM,UAAU,6BAA6B;EAE7C,MAAM,IAAI,MACR,oIACE,UAAU,+BAA+B,QAAQ,KAAK,GACvD,qGACH;CACF;CAEA,MAAM,SAAU,MACd;CAGF,IAAI,CAAC,UAAU,OAAO,SAAS,GAAG;CAElC,MAAM,kBACJ,MAAM,OAGN;CAEF,IAAI,CAAC,iBAAiB;CAEtB,MAAM,WAAW,MAAM,UAAU,YAAY;CAC7C,MAAM,UACJ,aAAa,SAAY,CAAC,IAAI,MAAM,QAAQ,QAAQ,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,OAAO,QAAQ,CAAC;CAE3F,KAAK,MAAM,UAAU,OAAO,OAAO,GAAG;EACpC,MAAM,aAAa,gBAAgB,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI;EAEzE,IAAI,CAAC,QAAQ,SAAS,UAAU,GAC9B,QAAQ,KAAK,UAAU;CAE3B;CAEA,MAAM,aAAa,YAAY;CAC/B,MAAM,OAAO,cAAc,OAAO;CAClC,OAAO,MAAM;AACf"}

package/esm/http/index.d.mts

@@ -1,5 +1,6 @@
 import { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./errors/errors.mjs";
-import { HttpLoggingConfig, RequestLogSnapshot, RequestLogSource, RequestLoggingOptions, URL_CREDENTIAL_PARAMS, buildRequestLogSnapshot, redactQueryCredentials, redactUrlCredentials, resolveRequestLoggingOptions } from "./request-log-snapshot.mjs";
+import { ConditionalRequestInput, ConditionalRequestOutcome, EntityTag, evaluateConditionalRequest, matchesIfMatch, matchesIfNoneMatch, parseEntityTag, parseEntityTagList, strongEntityTagMatch, weakEntityTagMatch } from "./conditional-request.mjs";
+import { HttpLoggingConfig, PrivateRequestLoggingRule, RequestLogSnapshot, RequestLogSource, RequestLoggingOptions, URL_CREDENTIAL_PARAMS, buildRequestLogSnapshot, redactQueryCredentials, redactUrlCredentials, resolveRequestLoggingOptions } from "./request-log-snapshot.mjs";
 import { PipeableReactStream, StreamReactResponseOptions, streamReactResponse } from "./stream-react-response.mjs";
 import { XMLable } from "./xmlable.mjs";
 import { CookieOptions, Response, ResponseStatus, SendBufferOptions, SendFileOptions, toSingleLineSseField } from "./response.mjs";
@@ -9,7 +10,7 @@ import { Request, RequestTranslator } from "./request.mjs";
 import { CspConfig, DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives } from "./csp.mjs";
 import { HttpErrorMapper, HttpErrorMapping } from "./error-mapper.mjs";
 import { HttpTracingConfig, TracingContext, TracingHooks, TracingPhaseInfo, TracingRequestEndInfo } from "./tracing/tracing.type.mjs";
-import { DecodedAccessToken, HttpConfigurations, HttpServerOptions, PartialMiddleware, RequestEvent, RequestLocals, ResponseEvent, ResponseSSEController, ResponseSSEOptions, ResponseStreamController, ResponseStreamOptions, ReturnedResponse } from "./types.mjs";
+import { DecodedAccessToken, HttpConfigurations, HttpServerOptions, PartialMiddleware, RequestEvent, RequestLocals, ResponseEvent, ResponseSSEController, ResponseSSEMessageOptions, ResponseSSEOptions, ResponseStreamController, ResponseStreamOptions, ReturnedResponse } from "./types.mjs";
 import { defaultHttpConfigurations, httpConfig } from "./config.mjs";
 import { createHttpApplication, stopHttpApplication } from "./createHttpApplication.mjs";
 import { requiresDefaultCsrfGuard, runDefaultCsrfGuard } from "./csrf-default-guard.mjs";
@@ -43,6 +44,8 @@ import { assertConfiguredHttpPortIsFree, preflightConfiguredHttpPort, remedyLine
 import { PortInUseError, assertPortIsAvailable, isPortAvailable } from "./port-preflight.mjs";
 import { HttpReadyReport, getHttpReadyReport, resetHttpReadyReport, setHttpReadyReport } from "./ready-report.mjs";
 import { HttpServerRebuiltListener, notifyHttpServerRebuilt, onHttpServerRebuilt } from "./server-rebuilt.mjs";
+import { escapeHeaderValue } from "./escape-header-value.mjs";
+import { SafeRedirectOptions, isSafeRedirect, safeRedirect } from "./safe-redirect.mjs";
 import { deriveTraceId, parseTraceparentTraceId } from "./tracing/trace-id.mjs";
 import { TracingContextSource, buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled, registerTracingHooks, resetTracingConfigForTests, resolveTracingConfig } from "./tracing/tracing-dispatcher.mjs";
 import { RequestContextStore, requestContext, useCurrentUser, useRequest, useRequestStore } from "./context/request-context.mjs";

package/esm/http/index.mjs

@@ -8,7 +8,9 @@ import { deriveTraceId, parseTraceparentTraceId } from "./tracing/trace-id.mjs";
 import { buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled, registerTracingHooks, resetTracingConfigForTests, resolveTracingConfig } from "./tracing/tracing-dispatcher.mjs";
 import "./tracing/index.mjs";
 import { createRequestStore, t } from "./middleware/inject-request-context.mjs";
+import { evaluateConditionalRequest, matchesIfMatch, matchesIfNoneMatch, parseEntityTag, parseEntityTagList, strongEntityTagMatch, weakEntityTagMatch } from "./conditional-request.mjs";
 import { defaultHttpConfigurations, httpConfig } from "./config.mjs";
+import { ImageVariantsConfigError } from "./uploads/image-variants-config-error.mjs";
 import { UPLOADS_DEFAULTS, uploadsConfig } from "./uploads-config.mjs";
 import { streamReactResponse } from "./stream-react-response.mjs";
 import { Response, ResponseStatus, toSingleLineSseField } from "./response.mjs";
@@ -22,7 +24,6 @@ import { RequestLog } from "./database/RequestLog.mjs";
 import { logResponse, wrapResponseInDataKey } from "./events.mjs";
 import { health } from "./health.mjs";
 import { RequestController } from "./request-controller.mjs";
-import { ImageVariantsConfigError } from "./uploads/image-variants-config-error.mjs";
 import { generateImageVariants } from "./uploads/generate-image-variants.mjs";
 import { purgeImageVariants } from "./uploads/purge-image-variants.mjs";
 import { resolveImageVariant } from "./uploads/resolve-image-variant.mjs";
@@ -37,6 +38,8 @@ import { PortInUseError, assertPortIsAvailable, isPortAvailable } from "./port-p
 import { assertConfiguredHttpPortIsFree, preflightConfiguredHttpPort, remedyLines, shouldPreflightHttpPort } from "./boot-port-preflight.mjs";
 import { getHttpReadyReport, resetHttpReadyReport, setHttpReadyReport } from "./ready-report.mjs";
 import { notifyHttpServerRebuilt, onHttpServerRebuilt } from "./server-rebuilt.mjs";
+import { escapeHeaderValue } from "./escape-header-value.mjs";
+import { isSafeRedirect, safeRedirect } from "./safe-redirect.mjs";
 import { requestMemo } from "./context/request-memo.mjs";
 
 export {  };