@warlock.js/core 5.30.0 → 5.32.0

package/esm/http/bounded-stream-queue.mjs

@@ -0,0 +1,97 @@
+//#region ../../packages/core/src/http/bounded-stream-queue.ts
+function validateStreamQueueOptions(options) {
+	if (options.onOverflow !== void 0 && options.onOverflow !== "drop" && options.onOverflow !== "disconnect") throw new TypeError("onOverflow must be \"drop\" or \"disconnect\"");
+	if (options.maxQueuedBytes !== void 0 && (!Number.isSafeInteger(options.maxQueuedBytes) || options.maxQueuedBytes < 0)) throw new RangeError("maxQueuedBytes must be a non-negative safe integer");
+}
+function createBoundedStreamQueue(raw, transport, options) {
+	validateStreamQueueOptions(options);
+	const limit = options.maxQueuedBytes ?? 1048576;
+	const pending = [];
+	const waiters = /* @__PURE__ */ new Set();
+	let bytes = 0;
+	let ending = false;
+	let dropped = 0;
+	let onFinished;
+	function settle(drained) {
+		for (const resolve of waiters) resolve(drained);
+		waiters.clear();
+	}
+	function cleanup() {
+		raw.off("drain", flush);
+		raw.off("close", close);
+	}
+	function close() {
+		ending = true;
+		pending.length = 0;
+		bytes = 0;
+		onFinished = void 0;
+		cleanup();
+		settle(false);
+	}
+	function flush() {
+		if (transport.closed) return close();
+		while (pending.length && !raw.writableNeedDrain) {
+			const item = pending.shift();
+			bytes -= item.bytes;
+			raw.write(item.data);
+		}
+		if (!pending.length && !raw.writableNeedDrain) settle(!ending);
+		if (!pending.length && onFinished) {
+			const finish = onFinished;
+			onFinished = void 0;
+			cleanup();
+			settle(false);
+			finish();
+		}
+	}
+	raw.on("drain", flush);
+	raw.once("close", close);
+	return {
+		get dropped() {
+			return dropped;
+		},
+		get ending() {
+			return ending;
+		},
+		get backpressured() {
+			return pending.length > 0 || transport.backpressured;
+		},
+		enqueue(data) {
+			if (typeof data !== "string" && !(data instanceof Uint8Array)) throw new TypeError("Stream data must be a string or Uint8Array");
+			if (ending || transport.closed) return false;
+			const size = typeof data === "string" ? Buffer.byteLength(data) : data.byteLength;
+			if (bytes + (raw.writableLength ?? 0) + size > limit) {
+				if (options.onOverflow === "drop") dropped++;
+				else {
+					transport.disconnect();
+					close();
+					raw.destroy();
+				}
+				return false;
+			}
+			if (pending.length || raw.writableNeedDrain) {
+				pending.push({
+					data: typeof data === "string" ? data : Buffer.from(data),
+					bytes: size
+				});
+				bytes += size;
+			} else raw.write(data);
+			return true;
+		},
+		waitForDrain() {
+			if (ending || transport.closed) return Promise.resolve(false);
+			if (!pending.length && !raw.writableNeedDrain) return Promise.resolve(true);
+			return new Promise((resolve) => waiters.add(resolve));
+		},
+		finish(callback) {
+			if (ending || transport.closed) return;
+			ending = true;
+			onFinished = callback;
+			flush();
+		}
+	};
+}
+
+//#endregion
+export { createBoundedStreamQueue, validateStreamQueueOptions };
+//# sourceMappingURL=bounded-stream-queue.mjs.map

package/esm/http/bounded-stream-queue.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-stream-queue.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/bounded-stream-queue.ts"],"sourcesContent":["import type { ServerResponse } from \"node:http\";\nimport type { StreamTransport } from \"./stream-transport\";\n\nexport type StreamQueueOptions = {\n  /** Total unsent bytes, including Node's writable buffer. Defaults to 1 MiB for enqueue(). */\n  maxQueuedBytes?: number;\n  /** Disconnect the slow client (default), or reject the newest chunk without disconnecting. */\n  onOverflow?: \"disconnect\" | \"drop\";\n};\n\nexport function validateStreamQueueOptions(options: StreamQueueOptions): void {\n  if (\n    options.onOverflow !== undefined &&\n    options.onOverflow !== \"drop\" &&\n    options.onOverflow !== \"disconnect\"\n  ) {\n    throw new TypeError('onOverflow must be \"drop\" or \"disconnect\"');\n  }\n  if (\n    options.maxQueuedBytes !== undefined &&\n    (!Number.isSafeInteger(options.maxQueuedBytes) || options.maxQueuedBytes < 0)\n  ) {\n    throw new RangeError(\"maxQueuedBytes must be a non-negative safe integer\");\n  }\n}\n\nexport function createBoundedStreamQueue(\n  raw: ServerResponse,\n  transport: StreamTransport,\n  options: StreamQueueOptions,\n) {\n  validateStreamQueueOptions(options);\n  const limit = options.maxQueuedBytes ?? 1024 * 1024;\n  const pending: Array<{ data: string | Uint8Array; bytes: number }> = [];\n  const waiters = new Set<(drained: boolean) => void>();\n  let bytes = 0;\n  let ending = false;\n  let dropped = 0;\n  let onFinished: (() => void) | undefined;\n\n  function settle(drained: boolean) {\n    for (const resolve of waiters) resolve(drained);\n    waiters.clear();\n  }\n  function cleanup() {\n    raw.off(\"drain\", flush);\n    raw.off(\"close\", close);\n  }\n  function close() {\n    ending = true;\n    pending.length = 0;\n    bytes = 0;\n    onFinished = undefined;\n    cleanup();\n    settle(false);\n  }\n  function flush() {\n    if (transport.closed) return close();\n    while (pending.length && !raw.writableNeedDrain) {\n      const item = pending.shift()!;\n      bytes -= item.bytes;\n      raw.write(item.data);\n    }\n    if (!pending.length && !raw.writableNeedDrain) settle(!ending);\n    if (!pending.length && onFinished) {\n      const finish = onFinished;\n      onFinished = undefined;\n      cleanup();\n      settle(false);\n      finish();\n    }\n  }\n  raw.on(\"drain\", flush);\n  raw.once(\"close\", close);\n\n  return {\n    get dropped() {\n      return dropped;\n    },\n    get ending() {\n      return ending;\n    },\n    get backpressured() {\n      return pending.length > 0 || transport.backpressured;\n    },\n    enqueue(data: string | Uint8Array): boolean {\n      if (typeof data !== \"string\" && !(data instanceof Uint8Array))\n        throw new TypeError(\"Stream data must be a string or Uint8Array\");\n      if (ending || transport.closed) return false;\n      const size = typeof data === \"string\" ? Buffer.byteLength(data) : data.byteLength;\n      if (bytes + (raw.writableLength ?? 0) + size > limit) {\n        if (options.onOverflow === \"drop\") dropped++;\n        else {\n          transport.disconnect();\n          close();\n          raw.destroy();\n        }\n        return false;\n      }\n      if (pending.length || raw.writableNeedDrain) {\n        // Own the bytes: a producer may reuse its Uint8Array after enqueue().\n        pending.push({ data: typeof data === \"string\" ? data : Buffer.from(data), bytes: size });\n        bytes += size;\n      } else {\n        raw.write(data);\n      }\n      return true;\n    },\n    waitForDrain(): Promise<boolean> {\n      if (ending || transport.closed) return Promise.resolve(false);\n      if (!pending.length && !raw.writableNeedDrain) return Promise.resolve(true);\n      return new Promise((resolve) => waiters.add(resolve));\n    },\n    finish(callback: () => void) {\n      if (ending || transport.closed) return;\n      ending = true;\n      onFinished = callback;\n      flush();\n    },\n  };\n}\n"],"mappings":";AAUA,SAAgB,2BAA2B,SAAmC;CAC5E,IACE,QAAQ,eAAe,UACvB,QAAQ,eAAe,UACvB,QAAQ,eAAe,cAEvB,MAAM,IAAI,UAAU,+CAA2C;CAEjE,IACE,QAAQ,mBAAmB,WAC1B,CAAC,OAAO,cAAc,QAAQ,cAAc,KAAK,QAAQ,iBAAiB,IAE3E,MAAM,IAAI,WAAW,oDAAoD;AAE7E;AAEA,SAAgB,yBACd,KACA,WACA,SACA;CACA,2BAA2B,OAAO;CAClC,MAAM,QAAQ,QAAQ,kBAAkB;CACxC,MAAM,UAA+D,CAAC;CACtE,MAAM,0BAAU,IAAI,IAAgC;CACpD,IAAI,QAAQ;CACZ,IAAI,SAAS;CACb,IAAI,UAAU;CACd,IAAI;CAEJ,SAAS,OAAO,SAAkB;EAChC,KAAK,MAAM,WAAW,SAAS,QAAQ,OAAO;EAC9C,QAAQ,MAAM;CAChB;CACA,SAAS,UAAU;EACjB,IAAI,IAAI,SAAS,KAAK;EACtB,IAAI,IAAI,SAAS,KAAK;CACxB;CACA,SAAS,QAAQ;EACf,SAAS;EACT,QAAQ,SAAS;EACjB,QAAQ;EACR,aAAa;EACb,QAAQ;EACR,OAAO,KAAK;CACd;CACA,SAAS,QAAQ;EACf,IAAI,UAAU,QAAQ,OAAO,MAAM;EACnC,OAAO,QAAQ,UAAU,CAAC,IAAI,mBAAmB;GAC/C,MAAM,OAAO,QAAQ,MAAM;GAC3B,SAAS,KAAK;GACd,IAAI,MAAM,KAAK,IAAI;EACrB;EACA,IAAI,CAAC,QAAQ,UAAU,CAAC,IAAI,mBAAmB,OAAO,CAAC,MAAM;EAC7D,IAAI,CAAC,QAAQ,UAAU,YAAY;GACjC,MAAM,SAAS;GACf,aAAa;GACb,QAAQ;GACR,OAAO,KAAK;GACZ,OAAO;EACT;CACF;CACA,IAAI,GAAG,SAAS,KAAK;CACrB,IAAI,KAAK,SAAS,KAAK;CAEvB,OAAO;EACL,IAAI,UAAU;GACZ,OAAO;EACT;EACA,IAAI,SAAS;GACX,OAAO;EACT;EACA,IAAI,gBAAgB;GAClB,OAAO,QAAQ,SAAS,KAAK,UAAU;EACzC;EACA,QAAQ,MAAoC;GAC1C,IAAI,OAAO,SAAS,YAAY,EAAE,gBAAgB,aAChD,MAAM,IAAI,UAAU,4CAA4C;GAClE,IAAI,UAAU,UAAU,QAAQ,OAAO;GACvC,MAAM,OAAO,OAAO,SAAS,WAAW,OAAO,WAAW,IAAI,IAAI,KAAK;GACvE,IAAI,SAAS,IAAI,kBAAkB,KAAK,OAAO,OAAO;IACpD,IAAI,QAAQ,eAAe,QAAQ;SAC9B;KACH,UAAU,WAAW;KACrB,MAAM;KACN,IAAI,QAAQ;IACd;IACA,OAAO;GACT;GACA,IAAI,QAAQ,UAAU,IAAI,mBAAmB;IAE3C,QAAQ,KAAK;KAAE,MAAM,OAAO,SAAS,WAAW,OAAO,OAAO,KAAK,IAAI;KAAG,OAAO;IAAK,CAAC;IACvF,SAAS;GACX,OACE,IAAI,MAAM,IAAI;GAEhB,OAAO;EACT;EACA,eAAiC;GAC/B,IAAI,UAAU,UAAU,QAAQ,OAAO,QAAQ,QAAQ,KAAK;GAC5D,IAAI,CAAC,QAAQ,UAAU,CAAC,IAAI,mBAAmB,OAAO,QAAQ,QAAQ,IAAI;GAC1E,OAAO,IAAI,SAAS,YAAY,QAAQ,IAAI,OAAO,CAAC;EACtD;EACA,OAAO,UAAsB;GAC3B,IAAI,UAAU,UAAU,QAAQ;GAChC,SAAS;GACT,aAAa;GACb,MAAM;EACR;CACF;AACF"}

package/esm/http/build-cors-options.mjs

@@ -1,4 +1,4 @@
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 
 //#region ../../packages/core/src/http/build-cors-options.ts
 /**
@@ -23,7 +23,7 @@ const defaultCorsOptions = {
 function buildCorsOptions() {
 	return {
 		...defaultCorsOptions,
-		...config.get("http.cors", {})
+		...baseConfig.get("http.cors", {})
 	};
 }
 

package/esm/http/build-cors-options.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"build-cors-options.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/build-cors-options.ts"],"sourcesContent":["import type { FastifyCorsOptions } from \"@fastify/cors\";\nimport config from \"@mongez/config\";\n\n/**\n * Framework CORS defaults, applied only where the application has said nothing.\n *\n * `origin: \"*\"` is deliberately NOT paired with `credentials: true` here —\n * browsers reject that combination for credentialed requests, so shipping both\n * would break the legitimate case while appearing permissive.\n */\nconst defaultCorsOptions: FastifyCorsOptions = {\n  origin: \"*\",\n  methods: \"*\",\n};\n\n/**\n * Resolve the CORS options handed to `@fastify/cors`.\n *\n * The application's `http.cors` is spread LAST so a configured allow-list wins.\n * Spreading the framework defaults last instead made `http.cors` unreachable —\n * every app got `origin: \"*\"` no matter what it configured, in every release up\n * to 4.12.0. Keep this order.\n */\nexport function buildCorsOptions(): FastifyCorsOptions {\n  return {\n    ...defaultCorsOptions,\n    ...config.get(\"http.cors\", {}),\n  };\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAM,qBAAyC;CAC7C,QAAQ;CACR,SAAS;AACX;;;;;;;;;AAUA,SAAgB,mBAAuC;CACrD,OAAO;EACL,GAAG;EACH,GAAG,OAAO,IAAI,aAAa,CAAC,CAAC;CAC/B;AACF"}
+{"version":3,"file":"build-cors-options.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/build-cors-options.ts"],"sourcesContent":["import type { FastifyCorsOptions } from \"@fastify/cors\";\nimport config from \"@mongez/config\";\n\n/**\n * Framework CORS defaults, applied only where the application has said nothing.\n *\n * `origin: \"*\"` is deliberately NOT paired with `credentials: true` here —\n * browsers reject that combination for credentialed requests, so shipping both\n * would break the legitimate case while appearing permissive.\n */\nconst defaultCorsOptions: FastifyCorsOptions = {\n  origin: \"*\",\n  methods: \"*\",\n};\n\n/**\n * Resolve the CORS options handed to `@fastify/cors`.\n *\n * The application's `http.cors` is spread LAST so a configured allow-list wins.\n * Spreading the framework defaults last instead made `http.cors` unreachable —\n * every app got `origin: \"*\"` no matter what it configured, in every release up\n * to 4.12.0. Keep this order.\n */\nexport function buildCorsOptions(): FastifyCorsOptions {\n  return {\n    ...defaultCorsOptions,\n    ...config.get(\"http.cors\", {}),\n  };\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAM,qBAAyC;CAC7C,QAAQ;CACR,SAAS;AACX;;;;;;;;;AAUA,SAAgB,mBAAuC;CACrD,OAAO;EACL,GAAG;EACH,GAAGA,WAAO,IAAI,aAAa,CAAC,CAAC;CAC/B;AACF"}

package/esm/http/build-rate-limit-options.d.mts

@@ -1,5 +1,4 @@
 import { RateLimitPluginOptions } from "@fastify/rate-limit";
-
 //#region ../../packages/core/src/http/build-rate-limit-options.d.ts
 /**
  * `@fastify/rate-limit` options that `http.rateLimit` passes straight through.
@@ -8,7 +7,7 @@ declare const passthroughKeys: readonly ["redis", "nameSpace", "keyGenerator", "
 /**
  * Shape of the `http.rateLimit` config.
  */
-type HttpRateLimitConfig = Omit<Pick<RateLimitPluginOptions, (typeof passthroughKeys)[number]>, "ipv6Subnet"> & {
+export type HttpRateLimitConfig = Omit<Pick<RateLimitPluginOptions, (typeof passthroughKeys)[number]>, "ipv6Subnet"> & {
   /**
    * IPv6 subnet size used to group client addresses.
    *
@@ -21,6 +20,19 @@ type HttpRateLimitConfig = Omit<Pick<RateLimitPluginOptions, (typeof passthrough
    * @default true
    */
   enabled?: boolean;
+  /**
+   * Count static files against the global limiter: the public folder, every
+   * `router.directory()` mount, `router.file()` routes and the web package's
+   * built assets.
+   *
+   * Off by default, so one page load's asset requests do not spend the
+   * client's quota; pages and API routes stay limited either way. A mount's
+   * own `rateLimit` option (`router.directory(options, { rateLimit })`) wins
+   * over this setting. Built-in health probes follow `http.health.rateLimit`.
+   *
+   * @default false
+   */
+  staticFiles?: boolean;
   /**
    * Max requests per time window.
    *
@@ -60,5 +72,5 @@ type HttpRateLimitConfig = Omit<Pick<RateLimitPluginOptions, (typeof passthrough
   store?: "memory" | "cache" | RateLimitPluginOptions["store"];
 };
 //#endregion
-export { HttpRateLimitConfig };
+export {};
 //# sourceMappingURL=build-rate-limit-options.d.mts.map

package/esm/http/build-rate-limit-options.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"build-rate-limit-options.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/build-rate-limit-options.ts"],"mappings":";;;;;AAAkE;cAM5D,eAAA;;;AAeI;KAKE,mBAAA,GAAsB,IAAA,CAChC,IAAA,CAAK,sBAAA,UAAgC,eAAA;EADR;;;;;EAS7B,UAAA,GAAa,sBAAA;EAAA;;;;;EAMb,OAAA;EAdA;;;;;EAoBA,GAAA;EAAA;;;;;EAMA,QAAA;EAyBmD;AAAA;;EArBnD,UAAA,GAAa,sBAAA;;;;;;;;;;;;;;;;;;;;;EAqBb,KAAA,wBAA6B,sBAAA;AAAA"}
+{"version":3,"file":"build-rate-limit-options.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/build-rate-limit-options.ts"],"mappings":";;;;;cAMM;;;;YAoBM,sBAAsB,KAChC,KAAK,gCAAgC;;;;;;EAQrC,aAAa;;;;;;EAMb;;;;;;;;;;;;;EAaA;;;;;;EAMA;;;;;;EAMA;;;;EAIA,aAAa;;;;;;;;;;;;;;;;;;;;;EAqBb,6BAA6B"}

package/esm/http/build-rate-limit-options.mjs

@@ -29,7 +29,7 @@ function buildRateLimitOptions(config) {
 	if (source.enabled === false) return null;
 	const options = {
 		max: source.max ?? 60,
-		timeWindow: source.timeWindow ?? source.duration ?? 60 * 1e3
+		timeWindow: source.timeWindow ?? source.duration ?? 6e4
 	};
 	for (const key of passthroughKeys) if (source[key] !== void 0) options[key] = source[key];
 	if (source.store === "cache") {

package/esm/http/build-rate-limit-options.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"build-rate-limit-options.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/build-rate-limit-options.ts"],"sourcesContent":["import type { RateLimitPluginOptions } from \"@fastify/rate-limit\";\nimport { CacheRateLimitStore } from \"./rate-limit-cache-store\";\n\n/**\n * `@fastify/rate-limit` options that `http.rateLimit` passes straight through.\n */\nconst passthroughKeys = [\n  \"redis\",\n  \"nameSpace\",\n  \"keyGenerator\",\n  \"ipv6Subnet\",\n  \"skipOnError\",\n  \"allowList\",\n  \"continueExceeding\",\n  \"enableDraftSpec\",\n  \"global\",\n  \"hook\",\n  \"cache\",\n  \"errorResponseBuilder\",\n  \"addHeaders\",\n  \"addHeadersOnExceeding\",\n] as const;\n\n/**\n * Shape of the `http.rateLimit` config.\n */\nexport type HttpRateLimitConfig = Omit<\n  Pick<RateLimitPluginOptions, (typeof passthroughKeys)[number]>,\n  \"ipv6Subnet\"\n> & {\n  /**\n   * IPv6 subnet size used to group client addresses.\n   *\n   * @default 64\n   */\n  ipv6Subnet?: RateLimitPluginOptions[\"ipv6Subnet\"];\n  /**\n   * Set `false` to skip registering the global rate limiter.\n   *\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Max requests per time window.\n   *\n   * @default 60\n   */\n  max?: number;\n  /**\n   * Time window in milliseconds. Alias of `timeWindow`.\n   *\n   * @default 60 * 1000\n   */\n  duration?: number;\n  /**\n   * Time window; takes precedence over `duration` when both are set.\n   */\n  timeWindow?: RateLimitPluginOptions[\"timeWindow\"];\n  /**\n   * Where request counts are kept.\n   *\n   * - `\"memory\"` (default): in this process. With N processes behind a load\n   *   balancer every client gets N times `max`.\n   * - `\"cache\"`: in `@warlock.js/cache`, so every process using the same\n   *   shared driver (Redis, database) counts together. Per-route\n   *   `middleware.rateLimit()` follows this setting unless it sets its own\n   *   `store`. Windows are fixed and aligned to the clock. A cache outage\n   *   fails open on both limiters (`skipOnError` defaults to `true` here) and\n   *   is logged at most once a minute. The `null` and `file` cache drivers\n   *   are refused (they cannot count): requests pass and the refusal is\n   *   logged the same way.\n   * - a `@fastify/rate-limit` store class, passed through as is.\n   *\n   * `redis` still works and needs an ioredis client; the `redis` driver of\n   * `@warlock.js/cache` uses node-redis, so share it through `\"cache\"`.\n   *\n   * @default \"memory\"\n   */\n  store?: \"memory\" | \"cache\" | RateLimitPluginOptions[\"store\"];\n};\n\n/**\n * Build the `@fastify/rate-limit` plugin options from `http.rateLimit`.\n * Returns `null` when the limiter is disabled.\n */\nexport function buildRateLimitOptions(\n  config: HttpRateLimitConfig | undefined,\n): RateLimitPluginOptions | null {\n  const source = config ?? {};\n\n  if (source.enabled === false) {\n    return null;\n  }\n\n  const options: Record<string, unknown> = {\n    max: source.max ?? 60,\n    timeWindow: source.timeWindow ?? source.duration ?? 60 * 1000,\n  };\n\n  for (const key of passthroughKeys) {\n    if (source[key] !== undefined) {\n      options[key] = source[key];\n    }\n  }\n\n  if (source.store === \"cache\") {\n    options[\"store\"] = CacheRateLimitStore;\n\n    // `@fastify/rate-limit` defaults to `skipOnError: false`, which turns\n    // every request into a 500 while the cache is down. Fail open instead,\n    // like the per-route middleware; the store logs the outage.\n    if (source.skipOnError === undefined) {\n      options[\"skipOnError\"] = true;\n    }\n  } else if (typeof source.store === \"function\") {\n    options[\"store\"] = source.store;\n  }\n\n  return options as RateLimitPluginOptions;\n}\n"],"mappings":";;;;;;AAMA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAgEA,SAAgB,sBACd,QAC+B;CAC/B,MAAM,SAAS,UAAU,CAAC;CAE1B,IAAI,OAAO,YAAY,OACrB,OAAO;CAGT,MAAM,UAAmC;EACvC,KAAK,OAAO,OAAO;EACnB,YAAY,OAAO,cAAc,OAAO,YAAY,KAAK;CAC3D;CAEA,KAAK,MAAM,OAAO,iBAChB,IAAI,OAAO,SAAS,QAClB,QAAQ,OAAO,OAAO;CAI1B,IAAI,OAAO,UAAU,SAAS;EAC5B,QAAQ,WAAW;EAKnB,IAAI,OAAO,gBAAgB,QACzB,QAAQ,iBAAiB;CAE7B,OAAO,IAAI,OAAO,OAAO,UAAU,YACjC,QAAQ,WAAW,OAAO;CAG5B,OAAO;AACT"}
+{"version":3,"file":"build-rate-limit-options.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/build-rate-limit-options.ts"],"sourcesContent":["import type { RateLimitPluginOptions } from \"@fastify/rate-limit\";\nimport { CacheRateLimitStore } from \"./rate-limit-cache-store\";\n\n/**\n * `@fastify/rate-limit` options that `http.rateLimit` passes straight through.\n */\nconst passthroughKeys = [\n  \"redis\",\n  \"nameSpace\",\n  \"keyGenerator\",\n  \"ipv6Subnet\",\n  \"skipOnError\",\n  \"allowList\",\n  \"continueExceeding\",\n  \"enableDraftSpec\",\n  \"global\",\n  \"hook\",\n  \"cache\",\n  \"errorResponseBuilder\",\n  \"addHeaders\",\n  \"addHeadersOnExceeding\",\n] as const;\n\n/**\n * Shape of the `http.rateLimit` config.\n */\nexport type HttpRateLimitConfig = Omit<\n  Pick<RateLimitPluginOptions, (typeof passthroughKeys)[number]>,\n  \"ipv6Subnet\"\n> & {\n  /**\n   * IPv6 subnet size used to group client addresses.\n   *\n   * @default 64\n   */\n  ipv6Subnet?: RateLimitPluginOptions[\"ipv6Subnet\"];\n  /**\n   * Set `false` to skip registering the global rate limiter.\n   *\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Count static files against the global limiter: the public folder, every\n   * `router.directory()` mount, `router.file()` routes and the web package's\n   * built assets.\n   *\n   * Off by default, so one page load's asset requests do not spend the\n   * client's quota; pages and API routes stay limited either way. A mount's\n   * own `rateLimit` option (`router.directory(options, { rateLimit })`) wins\n   * over this setting. Built-in health probes follow `http.health.rateLimit`.\n   *\n   * @default false\n   */\n  staticFiles?: boolean;\n  /**\n   * Max requests per time window.\n   *\n   * @default 60\n   */\n  max?: number;\n  /**\n   * Time window in milliseconds. Alias of `timeWindow`.\n   *\n   * @default 60 * 1000\n   */\n  duration?: number;\n  /**\n   * Time window; takes precedence over `duration` when both are set.\n   */\n  timeWindow?: RateLimitPluginOptions[\"timeWindow\"];\n  /**\n   * Where request counts are kept.\n   *\n   * - `\"memory\"` (default): in this process. With N processes behind a load\n   *   balancer every client gets N times `max`.\n   * - `\"cache\"`: in `@warlock.js/cache`, so every process using the same\n   *   shared driver (Redis, database) counts together. Per-route\n   *   `middleware.rateLimit()` follows this setting unless it sets its own\n   *   `store`. Windows are fixed and aligned to the clock. A cache outage\n   *   fails open on both limiters (`skipOnError` defaults to `true` here) and\n   *   is logged at most once a minute. The `null` and `file` cache drivers\n   *   are refused (they cannot count): requests pass and the refusal is\n   *   logged the same way.\n   * - a `@fastify/rate-limit` store class, passed through as is.\n   *\n   * `redis` still works and needs an ioredis client; the `redis` driver of\n   * `@warlock.js/cache` uses node-redis, so share it through `\"cache\"`.\n   *\n   * @default \"memory\"\n   */\n  store?: \"memory\" | \"cache\" | RateLimitPluginOptions[\"store\"];\n};\n\n/**\n * Build the `@fastify/rate-limit` plugin options from `http.rateLimit`.\n * Returns `null` when the limiter is disabled.\n */\nexport function buildRateLimitOptions(\n  config: HttpRateLimitConfig | undefined,\n): RateLimitPluginOptions | null {\n  const source = config ?? {};\n\n  if (source.enabled === false) {\n    return null;\n  }\n\n  const options: Record<string, unknown> = {\n    max: source.max ?? 60,\n    timeWindow: source.timeWindow ?? source.duration ?? 60 * 1000,\n  };\n\n  for (const key of passthroughKeys) {\n    if (source[key] !== undefined) {\n      options[key] = source[key];\n    }\n  }\n\n  if (source.store === \"cache\") {\n    options[\"store\"] = CacheRateLimitStore;\n\n    // `@fastify/rate-limit` defaults to `skipOnError: false`, which turns\n    // every request into a 500 while the cache is down. Fail open instead,\n    // like the per-route middleware; the store logs the outage.\n    if (source.skipOnError === undefined) {\n      options[\"skipOnError\"] = true;\n    }\n  } else if (typeof source.store === \"function\") {\n    options[\"store\"] = source.store;\n  }\n\n  return options as RateLimitPluginOptions;\n}\n"],"mappings":";;;;;;AAMA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AA6EA,SAAgB,sBACd,QAC+B;CAC/B,MAAM,SAAS,UAAU,CAAC;CAE1B,IAAI,OAAO,YAAY,OACrB,OAAO;CAGT,MAAM,UAAmC;EACvC,KAAK,OAAO,OAAO;EACnB,YAAY,OAAO,cAAc,OAAO,YAAY;CACtD;CAEA,KAAK,MAAM,OAAO,iBAChB,IAAI,OAAO,SAAS,QAClB,QAAQ,OAAO,OAAO;CAI1B,IAAI,OAAO,UAAU,SAAS;EAC5B,QAAQ,WAAW;EAKnB,IAAI,OAAO,gBAAgB,QACzB,QAAQ,iBAAiB;CAE7B,OAAO,IAAI,OAAO,OAAO,UAAU,YACjC,QAAQ,WAAW,OAAO;CAG5B,OAAO;AACT"}

package/esm/http/conditional-request.d.mts

@@ -0,0 +1,87 @@
+//#region ../../packages/core/src/http/conditional-request.d.ts
+/**
+ * HTTP conditional requests (RFC 9110 §13): entity-tag comparison and the
+ * precedence of the precondition headers.
+ *
+ * Two comparisons exist (RFC 9110 §8.8.3.2):
+ *
+ * - **strong**: both tags are strong (no `W/` prefix) and their opaque tags are
+ *   identical. `If-Match` uses it (§13.1.1), so a weak validator never
+ *   satisfies `If-Match`.
+ * - **weak**: the opaque tags are identical, whatever their `W/` prefixes.
+ *   `If-None-Match` uses it (§13.1.2), so `W/"a"` matches `"a"`.
+ *
+ * Source: https://www.rfc-editor.org/rfc/rfc9110 (sections 8.8.3, 13.1, 13.2).
+ */
+/**
+ * One parsed entity tag. `opaque` keeps its quotes, so `"a"` and `a` differ.
+ */
+export type EntityTag = {
+  weak: boolean;
+  opaque: string;
+};
+/**
+ * Parse one entity tag: an optional case-sensitive `W/` prefix, then the
+ * opaque tag. A value without quotes is kept as its own opaque tag so an
+ * application-supplied unquoted ETag still compares with itself.
+ */
+export declare function parseEntityTag(value: string): EntityTag | undefined;
+/**
+ * Parse an `If-Match` / `If-None-Match` value: `"*"` or a comma-separated list
+ * of entity tags. A comma inside a quoted tag is part of the tag.
+ */
+export declare function parseEntityTagList(header: unknown): "*" | EntityTag[] | undefined;
+/**
+ * Weak comparison: the opaque tags are identical.
+ */
+export declare function weakEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
+/**
+ * Strong comparison: neither tag is weak and the opaque tags are identical.
+ */
+export declare function strongEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
+/**
+ * Whether an `If-None-Match` header matches the current entity tag, with weak
+ * comparison. `*` matches any current representation.
+ */
+export declare function matchesIfNoneMatch(header: unknown, etag: string): boolean;
+/**
+ * Whether an `If-Match` header is satisfied by the current entity tag, with
+ * strong comparison. `*` is satisfied by any current representation, so it
+ * fails only when there is none (`etag` undefined).
+ */
+export declare function matchesIfMatch(header: unknown, etag: string | undefined): boolean;
+/**
+ * The request headers and current validators a precondition check reads.
+ */
+export type ConditionalRequestInput = {
+  method: string;
+  /** Current entity tag, quoted, optionally `W/`-prefixed. */
+  etag?: string;
+  /** Current modification time. HTTP dates have second precision. */
+  lastModified?: Date | number;
+  ifMatch?: unknown;
+  ifNoneMatch?: unknown;
+  ifModifiedSince?: unknown;
+  ifUnmodifiedSince?: unknown;
+};
+/**
+ * What a precondition check decided:
+ *
+ * - `"proceed"`: send the normal response;
+ * - `"not-modified"`: answer a GET or HEAD with 304;
+ * - `"precondition-failed"`: answer with 412.
+ */
+export type ConditionalRequestOutcome = "proceed" | "not-modified" | "precondition-failed";
+/**
+ * Evaluate the precondition headers in RFC 9110 §13.2.2 order:
+ *
+ * 1. `If-Match` (strong comparison) — false is 412;
+ * 2. otherwise `If-Unmodified-Since` — modified after the date is 412;
+ * 3. `If-None-Match` (weak comparison) — a match is 304 for GET/HEAD, else 412;
+ * 4. otherwise, for GET/HEAD, `If-Modified-Since` — not modified since is 304.
+ *
+ * An invalid date is ignored, as the RFC requires.
+ */
+export declare function evaluateConditionalRequest(input: ConditionalRequestInput): ConditionalRequestOutcome;
+//#endregion
+//# sourceMappingURL=conditional-request.d.mts.map

package/esm/http/conditional-request.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditional-request.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/conditional-request.ts"],"mappings":";;;;;;;;;;;;;;;;;;YAkBY;EACV;EACA;;;;;;;wBAQc,eAAe,gBAAgB;;;;;wBAiB/B,mBAAmB,wBAAwB;;;;wBA+B3C,mBAAmB,OAAO,WAAW,QAAQ;;;;wBAO7C,qBAAqB,OAAO,WAAW,QAAQ;;;;;wBAQ/C,mBAAmB,iBAAiB;;;;;;wBAgBpC,eAAe,iBAAiB;;;;YAiBpC;EACV;;EAEA;;EAEA,eAAe;EACf;EACA;EACA;EACA;;;;;;;;;YAUU;;;;;;;;;;;wBAgCI,2BACd,OAAO,0BACN"}

package/esm/http/conditional-request.mjs

@@ -0,0 +1,121 @@
+//#region ../../packages/core/src/http/conditional-request.ts
+/**
+* Parse one entity tag: an optional case-sensitive `W/` prefix, then the
+* opaque tag. A value without quotes is kept as its own opaque tag so an
+* application-supplied unquoted ETag still compares with itself.
+*/
+function parseEntityTag(value) {
+	const trimmed = value.trim();
+	if (trimmed === "") return void 0;
+	const weak = trimmed.startsWith("W/");
+	const opaque = weak ? trimmed.slice(2) : trimmed;
+	if (opaque === "") return void 0;
+	return {
+		weak,
+		opaque
+	};
+}
+/**
+* Parse an `If-Match` / `If-None-Match` value: `"*"` or a comma-separated list
+* of entity tags. A comma inside a quoted tag is part of the tag.
+*/
+function parseEntityTagList(header) {
+	const value = Array.isArray(header) ? header.join(",") : header;
+	if (typeof value !== "string" || value.trim() === "") return void 0;
+	if (value.trim() === "*") return "*";
+	const tags = [];
+	let start = 0;
+	let quoted = false;
+	for (let index = 0; index <= value.length; index++) {
+		const character = value[index];
+		if (character === "\"") quoted = !quoted;
+		if (index === value.length || character === "," && !quoted) {
+			const tag = parseEntityTag(value.slice(start, index));
+			if (tag) tags.push(tag);
+			start = index + 1;
+		}
+	}
+	return tags;
+}
+/**
+* Weak comparison: the opaque tags are identical.
+*/
+function weakEntityTagMatch(first, second) {
+	return first.opaque === second.opaque;
+}
+/**
+* Strong comparison: neither tag is weak and the opaque tags are identical.
+*/
+function strongEntityTagMatch(first, second) {
+	return !first.weak && !second.weak && first.opaque === second.opaque;
+}
+/**
+* Whether an `If-None-Match` header matches the current entity tag, with weak
+* comparison. `*` matches any current representation.
+*/
+function matchesIfNoneMatch(header, etag) {
+	const tags = parseEntityTagList(header);
+	const current = parseEntityTag(etag);
+	if (tags === void 0 || current === void 0) return false;
+	if (tags === "*") return true;
+	return tags.some((tag) => weakEntityTagMatch(tag, current));
+}
+/**
+* Whether an `If-Match` header is satisfied by the current entity tag, with
+* strong comparison. `*` is satisfied by any current representation, so it
+* fails only when there is none (`etag` undefined).
+*/
+function matchesIfMatch(header, etag) {
+	const tags = parseEntityTagList(header);
+	if (tags === void 0) return true;
+	if (tags === "*") return etag !== void 0;
+	const current = etag === void 0 ? void 0 : parseEntityTag(etag);
+	if (current === void 0) return false;
+	return tags.some((tag) => strongEntityTagMatch(tag, current));
+}
+function isPresent(header) {
+	if (Array.isArray(header)) return header.length > 0;
+	return typeof header === "string" && header.trim() !== "";
+}
+function toSeconds(value) {
+	return Math.floor((value instanceof Date ? value.getTime() : value) / 1e3);
+}
+function parseHttpDate(header) {
+	const value = Array.isArray(header) ? header[0] : header;
+	if (typeof value !== "string") return void 0;
+	const time = new Date(value).getTime();
+	return Number.isFinite(time) ? Math.floor(time / 1e3) : void 0;
+}
+/**
+* Evaluate the precondition headers in RFC 9110 §13.2.2 order:
+*
+* 1. `If-Match` (strong comparison) — false is 412;
+* 2. otherwise `If-Unmodified-Since` — modified after the date is 412;
+* 3. `If-None-Match` (weak comparison) — a match is 304 for GET/HEAD, else 412;
+* 4. otherwise, for GET/HEAD, `If-Modified-Since` — not modified since is 304.
+*
+* An invalid date is ignored, as the RFC requires.
+*/
+function evaluateConditionalRequest(input) {
+	const method = input.method.toUpperCase();
+	const safe = method === "GET" || method === "HEAD";
+	if (isPresent(input.ifMatch)) {
+		if (!matchesIfMatch(input.ifMatch, input.etag)) return "precondition-failed";
+	} else if (isPresent(input.ifUnmodifiedSince) && input.lastModified !== void 0) {
+		const since = parseHttpDate(input.ifUnmodifiedSince);
+		if (since !== void 0 && toSeconds(input.lastModified) > since) return "precondition-failed";
+	}
+	if (isPresent(input.ifNoneMatch)) {
+		if (input.etag !== void 0 && matchesIfNoneMatch(input.ifNoneMatch, input.etag)) return safe ? "not-modified" : "precondition-failed";
+		return "proceed";
+	}
+	if (safe && isPresent(input.ifModifiedSince) && input.lastModified !== void 0) {
+		const since = parseHttpDate(input.ifModifiedSince);
+		if (since !== void 0 && toSeconds(input.lastModified) <= since) return "not-modified";
+	}
+	return "proceed";
+}
+
+//#endregion
+export { evaluateConditionalRequest, matchesIfMatch, matchesIfNoneMatch, parseEntityTag, parseEntityTagList, strongEntityTagMatch, weakEntityTagMatch };
+//# sourceMappingURL=conditional-request.mjs.map

package/esm/http/conditional-request.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditional-request.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/conditional-request.ts"],"sourcesContent":["/**\n * HTTP conditional requests (RFC 9110 §13): entity-tag comparison and the\n * precedence of the precondition headers.\n *\n * Two comparisons exist (RFC 9110 §8.8.3.2):\n *\n * - **strong**: both tags are strong (no `W/` prefix) and their opaque tags are\n *   identical. `If-Match` uses it (§13.1.1), so a weak validator never\n *   satisfies `If-Match`.\n * - **weak**: the opaque tags are identical, whatever their `W/` prefixes.\n *   `If-None-Match` uses it (§13.1.2), so `W/\"a\"` matches `\"a\"`.\n *\n * Source: https://www.rfc-editor.org/rfc/rfc9110 (sections 8.8.3, 13.1, 13.2).\n */\n\n/**\n * One parsed entity tag. `opaque` keeps its quotes, so `\"a\"` and `a` differ.\n */\nexport type EntityTag = {\n  weak: boolean;\n  opaque: string;\n};\n\n/**\n * Parse one entity tag: an optional case-sensitive `W/` prefix, then the\n * opaque tag. A value without quotes is kept as its own opaque tag so an\n * application-supplied unquoted ETag still compares with itself.\n */\nexport function parseEntityTag(value: string): EntityTag | undefined {\n  const trimmed = value.trim();\n\n  if (trimmed === \"\") return undefined;\n\n  const weak = trimmed.startsWith(\"W/\");\n  const opaque = weak ? trimmed.slice(2) : trimmed;\n\n  if (opaque === \"\") return undefined;\n\n  return { weak, opaque };\n}\n\n/**\n * Parse an `If-Match` / `If-None-Match` value: `\"*\"` or a comma-separated list\n * of entity tags. A comma inside a quoted tag is part of the tag.\n */\nexport function parseEntityTagList(header: unknown): \"*\" | EntityTag[] | undefined {\n  const value = Array.isArray(header) ? header.join(\",\") : header;\n\n  if (typeof value !== \"string\" || value.trim() === \"\") return undefined;\n\n  if (value.trim() === \"*\") return \"*\";\n\n  const tags: EntityTag[] = [];\n  let start = 0;\n  let quoted = false;\n\n  for (let index = 0; index <= value.length; index++) {\n    const character = value[index];\n\n    if (character === '\"') quoted = !quoted;\n\n    if (index === value.length || (character === \",\" && !quoted)) {\n      const tag = parseEntityTag(value.slice(start, index));\n\n      if (tag) tags.push(tag);\n\n      start = index + 1;\n    }\n  }\n\n  return tags;\n}\n\n/**\n * Weak comparison: the opaque tags are identical.\n */\nexport function weakEntityTagMatch(first: EntityTag, second: EntityTag): boolean {\n  return first.opaque === second.opaque;\n}\n\n/**\n * Strong comparison: neither tag is weak and the opaque tags are identical.\n */\nexport function strongEntityTagMatch(first: EntityTag, second: EntityTag): boolean {\n  return !first.weak && !second.weak && first.opaque === second.opaque;\n}\n\n/**\n * Whether an `If-None-Match` header matches the current entity tag, with weak\n * comparison. `*` matches any current representation.\n */\nexport function matchesIfNoneMatch(header: unknown, etag: string): boolean {\n  const tags = parseEntityTagList(header);\n  const current = parseEntityTag(etag);\n\n  if (tags === undefined || current === undefined) return false;\n\n  if (tags === \"*\") return true;\n\n  return tags.some((tag) => weakEntityTagMatch(tag, current));\n}\n\n/**\n * Whether an `If-Match` header is satisfied by the current entity tag, with\n * strong comparison. `*` is satisfied by any current representation, so it\n * fails only when there is none (`etag` undefined).\n */\nexport function matchesIfMatch(header: unknown, etag: string | undefined): boolean {\n  const tags = parseEntityTagList(header);\n\n  if (tags === undefined) return true;\n\n  if (tags === \"*\") return etag !== undefined;\n\n  const current = etag === undefined ? undefined : parseEntityTag(etag);\n\n  if (current === undefined) return false;\n\n  return tags.some((tag) => strongEntityTagMatch(tag, current));\n}\n\n/**\n * The request headers and current validators a precondition check reads.\n */\nexport type ConditionalRequestInput = {\n  method: string;\n  /** Current entity tag, quoted, optionally `W/`-prefixed. */\n  etag?: string;\n  /** Current modification time. HTTP dates have second precision. */\n  lastModified?: Date | number;\n  ifMatch?: unknown;\n  ifNoneMatch?: unknown;\n  ifModifiedSince?: unknown;\n  ifUnmodifiedSince?: unknown;\n};\n\n/**\n * What a precondition check decided:\n *\n * - `\"proceed\"`: send the normal response;\n * - `\"not-modified\"`: answer a GET or HEAD with 304;\n * - `\"precondition-failed\"`: answer with 412.\n */\nexport type ConditionalRequestOutcome = \"proceed\" | \"not-modified\" | \"precondition-failed\";\n\nfunction isPresent(header: unknown): boolean {\n  if (Array.isArray(header)) return header.length > 0;\n\n  return typeof header === \"string\" && header.trim() !== \"\";\n}\n\nfunction toSeconds(value: Date | number): number {\n  return Math.floor((value instanceof Date ? value.getTime() : value) / 1000);\n}\n\nfunction parseHttpDate(header: unknown): number | undefined {\n  const value = Array.isArray(header) ? header[0] : header;\n\n  if (typeof value !== \"string\") return undefined;\n\n  const time = new Date(value).getTime();\n\n  return Number.isFinite(time) ? Math.floor(time / 1000) : undefined;\n}\n\n/**\n * Evaluate the precondition headers in RFC 9110 §13.2.2 order:\n *\n * 1. `If-Match` (strong comparison) — false is 412;\n * 2. otherwise `If-Unmodified-Since` — modified after the date is 412;\n * 3. `If-None-Match` (weak comparison) — a match is 304 for GET/HEAD, else 412;\n * 4. otherwise, for GET/HEAD, `If-Modified-Since` — not modified since is 304.\n *\n * An invalid date is ignored, as the RFC requires.\n */\nexport function evaluateConditionalRequest(\n  input: ConditionalRequestInput,\n): ConditionalRequestOutcome {\n  const method = input.method.toUpperCase();\n  const safe = method === \"GET\" || method === \"HEAD\";\n\n  if (isPresent(input.ifMatch)) {\n    if (!matchesIfMatch(input.ifMatch, input.etag)) return \"precondition-failed\";\n  } else if (isPresent(input.ifUnmodifiedSince) && input.lastModified !== undefined) {\n    const since = parseHttpDate(input.ifUnmodifiedSince);\n\n    if (since !== undefined && toSeconds(input.lastModified) > since) {\n      return \"precondition-failed\";\n    }\n  }\n\n  if (isPresent(input.ifNoneMatch)) {\n    if (input.etag !== undefined && matchesIfNoneMatch(input.ifNoneMatch, input.etag)) {\n      return safe ? \"not-modified\" : \"precondition-failed\";\n    }\n\n    return \"proceed\";\n  }\n\n  if (safe && isPresent(input.ifModifiedSince) && input.lastModified !== undefined) {\n    const since = parseHttpDate(input.ifModifiedSince);\n\n    if (since !== undefined && toSeconds(input.lastModified) <= since) {\n      return \"not-modified\";\n    }\n  }\n\n  return \"proceed\";\n}\n"],"mappings":";;;;;;AA4BA,SAAgB,eAAe,OAAsC;CACnE,MAAM,UAAU,MAAM,KAAK;CAE3B,IAAI,YAAY,IAAI,OAAO;CAE3B,MAAM,OAAO,QAAQ,WAAW,IAAI;CACpC,MAAM,SAAS,OAAO,QAAQ,MAAM,CAAC,IAAI;CAEzC,IAAI,WAAW,IAAI,OAAO;CAE1B,OAAO;EAAE;EAAM;CAAO;AACxB;;;;;AAMA,SAAgB,mBAAmB,QAAgD;CACjF,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK,GAAG,IAAI;CAEzD,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,IAAI,OAAO;CAE7D,IAAI,MAAM,KAAK,MAAM,KAAK,OAAO;CAEjC,MAAM,OAAoB,CAAC;CAC3B,IAAI,QAAQ;CACZ,IAAI,SAAS;CAEb,KAAK,IAAI,QAAQ,GAAG,SAAS,MAAM,QAAQ,SAAS;EAClD,MAAM,YAAY,MAAM;EAExB,IAAI,cAAc,MAAK,SAAS,CAAC;EAEjC,IAAI,UAAU,MAAM,UAAW,cAAc,OAAO,CAAC,QAAS;GAC5D,MAAM,MAAM,eAAe,MAAM,MAAM,OAAO,KAAK,CAAC;GAEpD,IAAI,KAAK,KAAK,KAAK,GAAG;GAEtB,QAAQ,QAAQ;EAClB;CACF;CAEA,OAAO;AACT;;;;AAKA,SAAgB,mBAAmB,OAAkB,QAA4B;CAC/E,OAAO,MAAM,WAAW,OAAO;AACjC;;;;AAKA,SAAgB,qBAAqB,OAAkB,QAA4B;CACjF,OAAO,CAAC,MAAM,QAAQ,CAAC,OAAO,QAAQ,MAAM,WAAW,OAAO;AAChE;;;;;AAMA,SAAgB,mBAAmB,QAAiB,MAAuB;CACzE,MAAM,OAAO,mBAAmB,MAAM;CACtC,MAAM,UAAU,eAAe,IAAI;CAEnC,IAAI,SAAS,UAAa,YAAY,QAAW,OAAO;CAExD,IAAI,SAAS,KAAK,OAAO;CAEzB,OAAO,KAAK,MAAM,QAAQ,mBAAmB,KAAK,OAAO,CAAC;AAC5D;;;;;;AAOA,SAAgB,eAAe,QAAiB,MAAmC;CACjF,MAAM,OAAO,mBAAmB,MAAM;CAEtC,IAAI,SAAS,QAAW,OAAO;CAE/B,IAAI,SAAS,KAAK,OAAO,SAAS;CAElC,MAAM,UAAU,SAAS,SAAY,SAAY,eAAe,IAAI;CAEpE,IAAI,YAAY,QAAW,OAAO;CAElC,OAAO,KAAK,MAAM,QAAQ,qBAAqB,KAAK,OAAO,CAAC;AAC9D;AA0BA,SAAS,UAAU,QAA0B;CAC3C,IAAI,MAAM,QAAQ,MAAM,GAAG,OAAO,OAAO,SAAS;CAElD,OAAO,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM;AACzD;AAEA,SAAS,UAAU,OAA8B;CAC/C,OAAO,KAAK,OAAO,iBAAiB,OAAO,MAAM,QAAQ,IAAI,SAAS,GAAI;AAC5E;AAEA,SAAS,cAAc,QAAqC;CAC1D,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;CAElD,IAAI,OAAO,UAAU,UAAU,OAAO;CAEtC,MAAM,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,QAAQ;CAErC,OAAO,OAAO,SAAS,IAAI,IAAI,KAAK,MAAM,OAAO,GAAI,IAAI;AAC3D;;;;;;;;;;;AAYA,SAAgB,2BACd,OAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY;CACxC,MAAM,OAAO,WAAW,SAAS,WAAW;CAE5C,IAAI,UAAU,MAAM,OAAO,GACzB;MAAI,CAAC,eAAe,MAAM,SAAS,MAAM,IAAI,GAAG,OAAO;CAAqB,OACvE,IAAI,UAAU,MAAM,iBAAiB,KAAK,MAAM,iBAAiB,QAAW;EACjF,MAAM,QAAQ,cAAc,MAAM,iBAAiB;EAEnD,IAAI,UAAU,UAAa,UAAU,MAAM,YAAY,IAAI,OACzD,OAAO;CAEX;CAEA,IAAI,UAAU,MAAM,WAAW,GAAG;EAChC,IAAI,MAAM,SAAS,UAAa,mBAAmB,MAAM,aAAa,MAAM,IAAI,GAC9E,OAAO,OAAO,iBAAiB;EAGjC,OAAO;CACT;CAEA,IAAI,QAAQ,UAAU,MAAM,eAAe,KAAK,MAAM,iBAAiB,QAAW;EAChF,MAAM,QAAQ,cAAc,MAAM,eAAe;EAEjD,IAAI,UAAU,UAAa,UAAU,MAAM,YAAY,KAAK,OAC1D,OAAO;CAEX;CAEA,OAAO;AACT"}

package/esm/http/config.d.mts

@@ -1,14 +1,12 @@
 import { HttpConfigurations } from "./types.mjs";
-
 //#region ../../packages/core/src/http/config.d.ts
 /**
  * Default http configurations
  */
-declare const defaultHttpConfigurations: HttpConfigurations;
+export declare const defaultHttpConfigurations: HttpConfigurations;
 /**
  * Get http configurations for the given key
  */
-declare function httpConfig(key: string): any;
+export declare function httpConfig(key: string): any;
 //#endregion
-export { defaultHttpConfigurations, httpConfig };
 //# sourceMappingURL=config.d.mts.map

package/esm/http/config.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"mappings":";;;;;AAOA;cAAa,yBAAA,EAA2B,kBAYvC;;;AAAA;iBAKe,UAAA,CAAW,GAAW"}
+{"version":3,"file":"config.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"mappings":";;;;;qBAOa,2BAA2B;;;;wBAiBxB,WAAW"}

package/esm/http/config.mjs

@@ -1,4 +1,4 @@
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { get } from "@mongez/reinforcements";
 
 //#region ../../packages/core/src/http/config.ts
@@ -18,7 +18,7 @@ const defaultHttpConfigurations = {
 * Get http configurations for the given key
 */
 function httpConfig(key) {
-	return config.get(`http.${key}`, get(defaultHttpConfigurations, key));
+	return baseConfig.get(`http.${key}`, get(defaultHttpConfigurations, key));
 }
 
 //#endregion

package/esm/http/config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { get } from \"@mongez/reinforcements\";\nimport type { HttpConfigurations } from \"./types\";\n\n/**\n * Default http configurations\n */\nexport const defaultHttpConfigurations: HttpConfigurations = {\n  port: 3000,\n  host: \"0.0.0.0\",\n  middleware: {\n    all: [],\n    only: {\n      middleware: [],\n    },\n    except: {\n      middleware: [],\n    },\n  },\n};\n\n/**\n * Get http configurations for the given key\n */\nexport function httpConfig(key: string): any {\n  return config.get(`http.${key}`, get(defaultHttpConfigurations, key));\n}\n"],"mappings":";;;;;;;AAOA,MAAa,4BAAgD;CAC3D,MAAM;CACN,MAAM;CACN,YAAY;EACV,KAAK,CAAC;EACN,MAAM,EACJ,YAAY,CAAC,EACf;EACA,QAAQ,EACN,YAAY,CAAC,EACf;CACF;AACF;;;;AAKA,SAAgB,WAAW,KAAkB;CAC3C,OAAO,OAAO,IAAI,QAAQ,OAAO,IAAI,2BAA2B,GAAG,CAAC;AACtE"}
+{"version":3,"file":"config.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { get } from \"@mongez/reinforcements\";\nimport type { HttpConfigurations } from \"./types\";\n\n/**\n * Default http configurations\n */\nexport const defaultHttpConfigurations: HttpConfigurations = {\n  port: 3000,\n  host: \"0.0.0.0\",\n  middleware: {\n    all: [],\n    only: {\n      middleware: [],\n    },\n    except: {\n      middleware: [],\n    },\n  },\n};\n\n/**\n * Get http configurations for the given key\n */\nexport function httpConfig(key: string): any {\n  return config.get(`http.${key}`, get(defaultHttpConfigurations, key));\n}\n"],"mappings":";;;;;;;AAOA,MAAa,4BAAgD;CAC3D,MAAM;CACN,MAAM;CACN,YAAY;EACV,KAAK,CAAC;EACN,MAAM,EACJ,YAAY,CAAC,EACf;EACA,QAAQ,EACN,YAAY,CAAC,EACf;CACF;AACF;;;;AAKA,SAAgB,WAAW,KAAkB;CAC3C,OAAOA,WAAO,IAAI,QAAQ,OAAO,IAAI,2BAA2B,GAAG,CAAC;AACtE"}

package/esm/http/context/request-context.d.mts

@@ -2,12 +2,11 @@ import { Response } from "../response.mjs";
 import { Request } from "../request.mjs";
 import { Model } from "@warlock.js/cascade";
 import { Context } from "@warlock.js/context";
-
 //#region ../../packages/core/src/http/context/request-context.d.ts
 /**
  * Request Context Store
  */
-type RequestContextStore<User extends Model = Model> = {
+export type RequestContextStore<User extends Model = Model> = {
   request: Request<User>;
   response: Response;
 };
@@ -52,13 +51,13 @@ declare class RequestContext<User extends Model = Model> extends Context<Request
 /**
  * Global request context instance
  */
-declare const requestContext: RequestContext<Model<import("@warlock.js/cascade").ModelSchema>>;
+export declare const requestContext: RequestContext<Model<import("@warlock.js/cascade").ModelSchema>>;
 /**
  * Use request store (for backward compatibility)
  */
-declare function useRequestStore<UserType extends Model = Model>(): RequestContextStore<UserType>;
-declare function useRequest<UserType extends Model = Model>(): Request<UserType>;
-declare function useCurrentUser<UserType extends Model = Model>(): UserType;
+export declare function useRequestStore<UserType extends Model = Model>(): RequestContextStore<UserType>;
+export declare function useRequest<UserType extends Model = Model>(): Request<UserType>;
+export declare function useCurrentUser<UserType extends Model = Model>(): UserType;
 //#endregion
-export { RequestContextStore, requestContext, useCurrentUser, useRequest, useRequestStore };
+export {};
 //# sourceMappingURL=request-context.d.mts.map

package/esm/http/context/request-context.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-context.ts"],"mappings":";;;;;;;;AAQA;KAAY,mBAAA,cAAiC,KAAA,GAAQ,KAAA;EACnD,OAAA,EAAS,OAAA,CAAQ,IAAA;EACjB,QAAA,EAAU,QAAA;AAAA;;;;;;;cASN,cAAA,cAA4B,KAAA,GAAQ,KAAA,UAAe,OAAA,CAAQ,mBAAA,CAAoB,IAAA;EAXhC;;;EAe5C,UAAA,IAAc,OAAA,CAAQ,IAAA;EAb7B;;;EAoBO,WAAA,IAAe,QAAA;EAXlB;;;;;;;;;;;;;;;;;EAgCG,OAAA;EAhCiC;;;EAyCjC,UAAA,CAAW,OAAA,GAAU,MAAA,gBAAsB,mBAAA,CAAoB,IAAA;AAAA;;;;cAW3D,cAAA,EAAc,cAAA,CAAA,KAAA,+BAAA,WAAA;;;;iBAOX,eAAA,kBAAiC,KAAA,GAAQ,KAAA,KACX,mBAAA,CAAoB,QAAA;AAAA,iBAGlD,UAAA,kBAA4B,KAAA,GAAQ,KAAA,KACZ,OAAA,CAAQ,QAAA;AAAA,iBAGhC,cAAA,kBAAgC,KAAA,GAAQ,KAAA,KAOnB,QAAA"}
+{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-context.ts"],"mappings":";;;;;;;;YAQY,oBAAoB,aAAa,QAAQ;EACnD,SAAS,QAAQ;EACjB,UAAU;;;;;;;;cASN,eAAe,aAAa,QAAQ,eAAe,QAAQ,oBAAoB;;;;EAI5E,cAAc,QAAQ;;;;EAOtB,eAAe;;;;;;;;;;;;;;;;;;EAqBf;;;;EASA,WAAW,UAAU,sBAAsB,oBAAoB;;;;;qBAW3D,gBAAc,eAAA,oCAAA;;;;wBAOX,gBAAgB,iBAAiB,QAAQ,UACX,oBAAoB;wBAGlD,WAAW,iBAAiB,QAAQ,UACZ,QAAQ;wBAGhC,eAAe,iBAAiB,QAAQ,UAOnB"}

package/esm/http/context/request-memo.d.mts

@@ -15,7 +15,6 @@
  * leak this helper exists to prevent — so calling it outside a request
  * context throws instead of silently memoizing across requests.
  */
-declare function requestMemo<T>(key: string, fn: () => Promise<T>): Promise<T>;
+export declare function requestMemo<T>(key: string, fn: () => Promise<T>): Promise<T>;
 //#endregion
-export { requestMemo };
 //# sourceMappingURL=request-memo.d.mts.map

package/esm/http/context/request-memo.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-memo.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-memo.ts"],"mappings":";;AA2BA;;;;;;;;;;;;;;;iBAAgB,WAAA,IAAe,GAAA,UAAa,EAAA,QAAU,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA"}
+{"version":3,"file":"request-memo.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-memo.ts"],"mappings":";;;;;;;;;;;;;;;;;wBA2BgB,YAAY,GAAG,aAAa,UAAU,QAAQ,KAAK,QAAQ"}

package/esm/http/createHttpApplication.d.mts

@@ -1,6 +1,5 @@
 //#region ../../packages/core/src/http/createHttpApplication.d.ts
-declare function createHttpApplication(): Promise<void>;
-declare function stopHttpApplication(): Promise<void>;
+export declare function createHttpApplication(): Promise<void>;
+export declare function stopHttpApplication(): Promise<void>;
 //#endregion
-export { createHttpApplication, stopHttpApplication };
 //# sourceMappingURL=createHttpApplication.d.mts.map

package/esm/http/createHttpApplication.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"createHttpApplication.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"mappings":";iBASsB,qBAAA,IAAqB,OAAA;AAAA,iBAmCrB,mBAAA,IAAmB,OAAA"}
+{"version":3,"file":"createHttpApplication.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"mappings":";wBASsB,yBAAqB;wBAmCrB,uBAAmB"}

package/esm/http/createHttpApplication.mjs

@@ -5,7 +5,7 @@ import { router } from "../router/router.mjs";
 import "../router/index.mjs";
 import { registerHttpPlugins } from "./plugins.mjs";
 import { getHttpServer, startHttpServer } from "./server.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { log } from "@warlock.js/logger";
 
 //#region ../../packages/core/src/http/createHttpApplication.ts
@@ -21,7 +21,7 @@ async function createHttpApplication() {
 			port,
 			host: httpConfig("host")
 		});
-		const baseUrl = config.get("app.baseUrl");
+		const baseUrl = baseConfig.get("app.baseUrl");
 		setBaseUrl(baseUrl);
 		log.success("http", "server", `Server is listening on ${baseUrl}`);
 	} catch (error) {

package/esm/http/createHttpApplication.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createHttpApplication.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { validateCspConfigAtBoot } from \"./csp\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  // Fail loudly, before the server ever binds a port, when `http.csp` is\n  // enabled with a malformed directive — never silently repair it and never\n  // wait for the first request to discover it.\n  validateCspConfigAtBoot();\n\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,wBAAwB;CAI5C,wBAAwB;CAExB,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAU,OAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}
+{"version":3,"file":"createHttpApplication.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { validateCspConfigAtBoot } from \"./csp\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  // Fail loudly, before the server ever binds a port, when `http.csp` is\n  // enabled with a malformed directive — never silently repair it and never\n  // wait for the first request to discover it.\n  validateCspConfigAtBoot();\n\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,wBAAwB;CAI5C,wBAAwB;CAExB,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAUA,WAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}