@warlock.js/core 5.30.0 → 5.32.0

package/esm/http/csp.d.mts

@@ -1,6 +1,5 @@
 import { Response } from "./response.mjs";
 import { Request } from "./request.mjs";
-
 //#region ../../packages/core/src/http/csp.d.ts
 /**
  * App-facing `http.csp` configuration shape.
@@ -22,7 +21,7 @@ import { Request } from "./request.mjs";
  * };
  * ```
  */
-type CspConfig = {
+export type CspConfig = {
   /**
    * Turn the header on. Everything else in this type is inert while this is
    * `false`/unset.
@@ -55,7 +54,7 @@ type CspConfig = {
  * sites — and documented here rather than only in the skill, since this is
  * the literal set an app's `directives` entry replaces one key at a time.
  */
-declare const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>>;
+export declare const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>>;
 /**
  * Thrown at boot when `http.csp.directives` contains a value the framework
  * refuses to ship as-is, rather than silently dropping or rewriting it.
@@ -68,9 +67,11 @@ declare const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>
  *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an
  *   unbalanced count means a keyword was truncated or malformed.
  */
-declare class InvalidCspDirectiveError extends Error {
+export declare class InvalidCspDirectiveError extends Error {
   readonly directive: string;
   readonly value: string;
+  /** Stable Warlock error code; `warlock explain WL1004` prints the fix. */
+  readonly code = "WL1004";
   constructor(directive: string, value: string, reason: string);
 }
 /**
@@ -80,11 +81,11 @@ declare class InvalidCspDirectiveError extends Error {
  * Exported so boot code and tests can call it directly, independent of
  * whether `http.csp` happens to be enabled.
  */
-declare function validateCspDirectives(directives: Record<string, string[]> | undefined): void;
+export declare function validateCspDirectives(directives: Record<string, string[]> | undefined): void;
 /**
  * Read the app's `http.csp` config, if any.
  */
-declare function resolveCspConfig(): CspConfig | undefined;
+export declare function resolveCspConfig(): CspConfig | undefined;
 /**
  * Fail the boot loudly when `http.csp` is enabled with invalid directives.
  *
@@ -96,7 +97,7 @@ declare function resolveCspConfig(): CspConfig | undefined;
  *
  * @throws {InvalidCspDirectiveError} when a directive value is malformed.
  */
-declare function validateCspConfigAtBoot(): void;
+export declare function validateCspConfigAtBoot(): void;
 /**
  * Merge the app's directives over the framework defaults and fold in the
  * request's nonce.
@@ -108,17 +109,17 @@ declare function validateCspConfigAtBoot(): void;
  * framework's own inline payload script and hydration module script are
  * never blocked by an app's own policy.
  */
-declare function mergeCspDirectives(appDirectives: Record<string, string[]> | undefined, nonce: string): Record<string, string[]>;
+export declare function mergeCspDirectives(appDirectives: Record<string, string[]> | undefined, nonce: string): Record<string, string[]>;
 /**
  * Serialize a merged directive map into a header value —
  * `"default-src 'self'; script-src 'self' 'nonce-...'; ..."`.
  */
-declare function serializeCspDirectives(directives: Record<string, string[]>): string;
+export declare function serializeCspDirectives(directives: Record<string, string[]>): string;
 /**
  * Build the full `Content-Security-Policy` (or `-Report-Only`) header value
  * for one request, using that request's own nonce.
  */
-declare function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string;
+export declare function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string;
 /**
  * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,
  * `Content-Security-Policy-Report-Only`) header on the response, when the
@@ -133,7 +134,6 @@ declare function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): strin
  * header is the one still available later for the web layer's `<script>`
  * tags to read off `request.nonce`.
  */
-declare function applyCspHeader(request: Request, response: Response): void;
+export declare function applyCspHeader(request: Request, response: Response): void;
 //#endregion
-export { CspConfig, DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives };
 //# sourceMappingURL=csp.d.mts.map

package/esm/http/csp.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csp.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"mappings":";;;;;;AAwBA;;;;;;;;;AAyBqB;AASrB;;;;AAAoD;AAsBpD;;;KAxDY,SAAA;EAwDkC;;;;EAnD5C,OAAA;EAsDkB;;;AACF;AAkBlB;;;;AAAsF;EA/DpF,UAAA;EA2F8B;;;AAAa;AAe7C;;;;AAAuC;EAhGrC,UAAA,GAAa,MAAM;AAAA;;;;;;;cASR,sBAAA,EAAwB,QAAQ,CAAC,MAAA;AA6GrC;AAqCT;;;;AAA2E;AAU3E;;;;;;AA/CS,cAvFI,wBAAA,SAAiC,KAAK;EAAA,SAE/B,SAAA;EAAA,SACA,KAAA;cADA,SAAA,UACA,KAAA,UAChB,MAAA;AAAA;;;;;;;;iBAkBY,qBAAA,CAAsB,UAAgD,EAApC,MAAM;;;;iBA4BxC,gBAAA,IAAoB,SAAS;;;;;;;;;;;;iBAe7B,uBAAA;;;;;;;;;;;;iBAmBA,kBAAA,CACd,aAAA,EAAe,MAAA,gCACf,KAAA,WACC,MAAM;;;;;iBAqCO,sBAAA,CAAuB,UAAoC,EAAxB,MAAM;;;;;iBAUzC,mBAAA,CAAoB,SAAA,EAAW,SAAS,EAAE,KAAA;;;;;;;;;;;;;;;iBAkB1C,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,QAAQ"}
+{"version":3,"file":"csp.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;YAwBY;;;;;EAKV;;;;;;;;;;EAUA;;;;;;;;;;EAUA,aAAa;;;;;;;;qBASF,wBAAwB,SAAS;;;;;;;;;;;;;qBAsBjC,iCAAiC;WAK1B;WACA;;WAJF;EAEhB,YACkB,mBACA,eAChB;;;;;;;;;wBAkBY,sBAAsB,YAAY;;;;wBA4BlC,oBAAoB;;;;;;;;;;;;wBAepB;;;;;;;;;;;;wBAmBA,mBACd,eAAe,sCACf,gBACC;;;;;wBAmCa,uBAAuB,YAAY;;;;;wBAUnC,oBAAoB,WAAW,WAAW;;;;;;;;;;;;;;;wBAkB1C,eAAe,SAAS,SAAS,UAAU"}

package/esm/http/csp.mjs

@@ -1,4 +1,4 @@
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 
 //#region ../../packages/core/src/http/csp.ts
 /**
@@ -33,6 +33,7 @@ var InvalidCspDirectiveError = class extends Error {
 		super(`Invalid "http.csp.directives" entry — directive "${directive}" has a value ${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; the framework will not silently repair it.`);
 		this.directive = directive;
 		this.value = value;
+		this.code = "WL1004";
 		this.name = "InvalidCspDirectiveError";
 	}
 };
@@ -54,7 +55,7 @@ function validateCspDirectives(directives) {
 * Read the app's `http.csp` config, if any.
 */
 function resolveCspConfig() {
-	return config.get("http.csp");
+	return baseConfig.get("http.csp");
 }
 /**
 * Fail the boot loudly when `http.csp` is enabled with invalid directives.

package/esm/http/csp.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csp.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/**\n * App-facing `http.csp` configuration shape.\n *\n * Disabled by default: an app that never sets `http.csp` (or sets\n * `enabled: false`) gets no `Content-Security-Policy` header at all — zero\n * behaviour change for every existing app. Opting in only swaps `enabled` to\n * `true`; `reportOnly` and `directives` are optional refinements on top.\n *\n * @example\n * ```ts title=\"src/config/http.ts\"\n * const httpConfigurations: HttpConfigurations = {\n *   csp: {\n *     enabled: true,\n *     directives: {\n *       \"img-src\": [\"'self'\", \"data:\", \"https://cdn.example.com\"],\n *     },\n *   },\n * };\n * ```\n */\nexport type CspConfig = {\n  /**\n   * Turn the header on. Everything else in this type is inert while this is\n   * `false`/unset.\n   */\n  enabled: boolean;\n  /**\n   * Emit `Content-Security-Policy-Report-Only` instead of the enforcing\n   * `Content-Security-Policy` header — the browser reports violations\n   * (via `report-to`/`report-uri`, if the app's directives configure one)\n   * without blocking anything. Use this to observe a policy safely before\n   * enforcing it.\n   *\n   * @default false\n   */\n  reportOnly?: boolean;\n  /**\n   * App-supplied directive values. A directive named here REPLACES the\n   * framework's default list for that directive entirely (the two lists are\n   * never merged element-wise) — declare the full value list you want.\n   *\n   * `script-src` is special-cased regardless of whether it is declared here:\n   * the current request's CSP nonce (`'nonce-<value>'`) is always appended to\n   * it, so the framework's own inline/module scripts keep working.\n   */\n  directives?: Record<string, string[]>;\n};\n\n/**\n * The policy every `http.csp`-enabled app starts from. Deliberately\n * conservative — same-origin by default, no plugins, no framing by other\n * sites — and documented here rather than only in the skill, since this is\n * the literal set an app's `directives` entry replaces one key at a time.\n */\nexport const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>> = {\n  \"default-src\": [\"'self'\"],\n  \"script-src\": [\"'self'\"],\n  \"style-src\": [\"'self'\"],\n  \"img-src\": [\"'self'\", \"data:\"],\n  \"object-src\": [\"'none'\"],\n  \"base-uri\": [\"'self'\"],\n  \"frame-ancestors\": [\"'self'\"],\n};\n\n/**\n * Thrown at boot when `http.csp.directives` contains a value the framework\n * refuses to ship as-is, rather than silently dropping or rewriting it.\n *\n * Two shapes are rejected:\n * - a value containing `;` — CSP directives are `;`-delimited, so a `;`\n *   inside one value would prematurely close it and let the remainder be\n *   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.\n * - a value with an odd number of `'` characters — every CSP keyword\n *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an\n *   unbalanced count means a keyword was truncated or malformed.\n */\nexport class InvalidCspDirectiveError extends Error {\n  public constructor(\n    public readonly directive: string,\n    public readonly value: string,\n    reason: string,\n  ) {\n    super(\n      `Invalid \"http.csp.directives\" entry — directive \"${directive}\" has a value ` +\n        `${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; ` +\n        `the framework will not silently repair it.`,\n    );\n    this.name = \"InvalidCspDirectiveError\";\n  }\n}\n\n/**\n * Validate every directive value an app supplied, throwing\n * {@link InvalidCspDirectiveError} on the first offender.\n *\n * Exported so boot code and tests can call it directly, independent of\n * whether `http.csp` happens to be enabled.\n */\nexport function validateCspDirectives(directives: Record<string, string[]> | undefined): void {\n  if (!directives) return;\n\n  for (const [directive, values] of Object.entries(directives)) {\n    for (const value of values) {\n      if (value.includes(\";\")) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"contains a ';' character, which would truncate the directive.\",\n        );\n      }\n\n      const quoteCount = (value.match(/'/g) ?? []).length;\n      if (quoteCount % 2 !== 0) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"has an unbalanced number of ' characters.\",\n        );\n      }\n    }\n  }\n}\n\n/**\n * Read the app's `http.csp` config, if any.\n */\nexport function resolveCspConfig(): CspConfig | undefined {\n  return config.get(\"http.csp\");\n}\n\n/**\n * Fail the boot loudly when `http.csp` is enabled with invalid directives.\n *\n * Called once, from {@link createHttpApplication} before the server starts\n * listening — never per-request. A per-request validation would let an app\n * boot successfully and only discover the bad config on first traffic;\n * checking once at boot surfaces it immediately, the same way a malformed\n * `warlock.config.ts` would.\n *\n * @throws {InvalidCspDirectiveError} when a directive value is malformed.\n */\nexport function validateCspConfigAtBoot(): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  validateCspDirectives(cspConfig.directives);\n}\n\n/**\n * Merge the app's directives over the framework defaults and fold in the\n * request's nonce.\n *\n * Per-directive replacement, not element-wise merging: a directive the app\n * names wins outright, everything else falls back to\n * {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains\n * `'nonce-<nonce>'` on top, whichever list it started from, so the\n * framework's own inline payload script and hydration module script are\n * never blocked by an app's own policy.\n */\nexport function mergeCspDirectives(\n  appDirectives: Record<string, string[]> | undefined,\n  nonce: string,\n): Record<string, string[]> {\n  const merged: Record<string, string[]> = {};\n\n  for (const [directive, defaultValues] of Object.entries(DEFAULT_CSP_DIRECTIVES)) {\n    merged[directive] = appDirectives?.[directive]\n      ? [...appDirectives[directive]]\n      : [...defaultValues];\n  }\n\n  if (appDirectives) {\n    for (const [directive, values] of Object.entries(appDirectives)) {\n      if (!(directive in merged)) {\n        merged[directive] = [...values];\n      }\n    }\n  }\n\n  // `merged[\"script-src\"]` is always populated by the loop above —\n  // `DEFAULT_CSP_DIRECTIVES` (:59-67) declares a `script-src` entry, and every\n  // one of its keys is copied into `merged` unconditionally — but its type is\n  // `Record<string, string[]>`, so `noUncheckedIndexedAccess` still widens the\n  // read to `string[] | undefined`. Narrowed once, locally, rather than\n  // asserted away.\n  const scriptSrc = merged[\"script-src\"] ?? [];\n  const nonceSource = `'nonce-${nonce}'`;\n\n  merged[\"script-src\"] = scriptSrc.includes(nonceSource)\n    ? scriptSrc\n    : [...scriptSrc, nonceSource];\n\n  return merged;\n}\n\n/**\n * Serialize a merged directive map into a header value —\n * `\"default-src 'self'; script-src 'self' 'nonce-...'; ...\"`.\n */\nexport function serializeCspDirectives(directives: Record<string, string[]>): string {\n  return Object.entries(directives)\n    .map(([directive, values]) => `${directive} ${values.join(\" \")}`)\n    .join(\"; \");\n}\n\n/**\n * Build the full `Content-Security-Policy` (or `-Report-Only`) header value\n * for one request, using that request's own nonce.\n */\nexport function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string {\n  return serializeCspDirectives(mergeCspDirectives(cspConfig.directives, nonce));\n}\n\n/**\n * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,\n * `Content-Security-Policy-Report-Only`) header on the response, when the\n * app opted in via `http.csp.enabled`.\n *\n * A no-op when `http.csp` is absent or `enabled` is falsy — the default,\n * behaviour-preserving state for every app that hasn't opted in.\n *\n * Reads `request.nonce`, which lazily generates and caches the per-request\n * nonce (`request.ts`) — calling this early in the request lifecycle (see\n * `inject-request-context.ts`) means the SAME nonce this stamps into the\n * header is the one still available later for the web layer's `<script>`\n * tags to read off `request.nonce`.\n */\nexport function applyCspHeader(request: Request, response: Response): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  const headerName = cspConfig.reportOnly\n    ? \"Content-Security-Policy-Report-Only\"\n    : \"Content-Security-Policy\";\n\n  response.header(headerName, buildCspHeaderValue(cspConfig, request.nonce));\n}\n"],"mappings":";;;;;;;;;AA0DA,MAAa,yBAAsE;CACjF,eAAe,CAAC,QAAQ;CACxB,cAAc,CAAC,QAAQ;CACvB,aAAa,CAAC,QAAQ;CACtB,WAAW,CAAC,UAAU,OAAO;CAC7B,cAAc,CAAC,QAAQ;CACvB,YAAY,CAAC,QAAQ;CACrB,mBAAmB,CAAC,QAAQ;AAC9B;;;;;;;;;;;;;AAcA,IAAa,2BAAb,cAA8C,MAAM;CAClD,AAAO,YACL,AAAgB,WAChB,AAAgB,OAChB,QACA;EACA,MACE,oDAAoD,UAAU,gBACzD,KAAK,UAAU,KAAK,EAAE,QAAQ,OAAO,qFAE5C;EARgB;EACA;EAQhB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,sBAAsB,YAAwD;CAC5F,IAAI,CAAC,YAAY;CAEjB,KAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,UAAU,GACzD,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,GAAG,GACpB,MAAM,IAAI,yBACR,WACA,OACA,+DACF;EAIF,KADoB,MAAM,MAAM,IAAI,KAAK,CAAC,EAAC,CAAE,SAC5B,MAAM,GACrB,MAAM,IAAI,yBACR,WACA,OACA,2CACF;CAEJ;AAEJ;;;;AAKA,SAAgB,mBAA0C;CACxD,OAAO,OAAO,IAAI,UAAU;AAC9B;;;;;;;;;;;;AAaA,SAAgB,0BAAgC;CAC9C,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,sBAAsB,UAAU,UAAU;AAC5C;;;;;;;;;;;;AAaA,SAAgB,mBACd,eACA,OAC0B;CAC1B,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,WAAW,kBAAkB,OAAO,QAAQ,sBAAsB,GAC5E,OAAO,aAAa,gBAAgB,aAChC,CAAC,GAAG,cAAc,UAAU,IAC5B,CAAC,GAAG,aAAa;CAGvB,IAAI,eACF;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,aAAa,GAC5D,IAAI,EAAE,aAAa,SACjB,OAAO,aAAa,CAAC,GAAG,MAAM;CAElC;CASF,MAAM,YAAY,OAAO,iBAAiB,CAAC;CAC3C,MAAM,cAAc,UAAU,MAAM;CAEpC,OAAO,gBAAgB,UAAU,SAAS,WAAW,IACjD,YACA,CAAC,GAAG,WAAW,WAAW;CAE9B,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,YAA8C;CACnF,OAAO,OAAO,QAAQ,UAAU,CAAC,CAC9B,KAAK,CAAC,WAAW,YAAY,GAAG,UAAU,GAAG,OAAO,KAAK,GAAG,GAAG,CAAC,CAChE,KAAK,IAAI;AACd;;;;;AAMA,SAAgB,oBAAoB,WAAsB,OAAuB;CAC/E,OAAO,uBAAuB,mBAAmB,UAAU,YAAY,KAAK,CAAC;AAC/E;;;;;;;;;;;;;;;AAgBA,SAAgB,eAAe,SAAkB,UAA0B;CACzE,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,MAAM,aAAa,UAAU,aACzB,wCACA;CAEJ,SAAS,OAAO,YAAY,oBAAoB,WAAW,QAAQ,KAAK,CAAC;AAC3E"}
+{"version":3,"file":"csp.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/**\n * App-facing `http.csp` configuration shape.\n *\n * Disabled by default: an app that never sets `http.csp` (or sets\n * `enabled: false`) gets no `Content-Security-Policy` header at all — zero\n * behaviour change for every existing app. Opting in only swaps `enabled` to\n * `true`; `reportOnly` and `directives` are optional refinements on top.\n *\n * @example\n * ```ts title=\"src/config/http.ts\"\n * const httpConfigurations: HttpConfigurations = {\n *   csp: {\n *     enabled: true,\n *     directives: {\n *       \"img-src\": [\"'self'\", \"data:\", \"https://cdn.example.com\"],\n *     },\n *   },\n * };\n * ```\n */\nexport type CspConfig = {\n  /**\n   * Turn the header on. Everything else in this type is inert while this is\n   * `false`/unset.\n   */\n  enabled: boolean;\n  /**\n   * Emit `Content-Security-Policy-Report-Only` instead of the enforcing\n   * `Content-Security-Policy` header — the browser reports violations\n   * (via `report-to`/`report-uri`, if the app's directives configure one)\n   * without blocking anything. Use this to observe a policy safely before\n   * enforcing it.\n   *\n   * @default false\n   */\n  reportOnly?: boolean;\n  /**\n   * App-supplied directive values. A directive named here REPLACES the\n   * framework's default list for that directive entirely (the two lists are\n   * never merged element-wise) — declare the full value list you want.\n   *\n   * `script-src` is special-cased regardless of whether it is declared here:\n   * the current request's CSP nonce (`'nonce-<value>'`) is always appended to\n   * it, so the framework's own inline/module scripts keep working.\n   */\n  directives?: Record<string, string[]>;\n};\n\n/**\n * The policy every `http.csp`-enabled app starts from. Deliberately\n * conservative — same-origin by default, no plugins, no framing by other\n * sites — and documented here rather than only in the skill, since this is\n * the literal set an app's `directives` entry replaces one key at a time.\n */\nexport const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>> = {\n  \"default-src\": [\"'self'\"],\n  \"script-src\": [\"'self'\"],\n  \"style-src\": [\"'self'\"],\n  \"img-src\": [\"'self'\", \"data:\"],\n  \"object-src\": [\"'none'\"],\n  \"base-uri\": [\"'self'\"],\n  \"frame-ancestors\": [\"'self'\"],\n};\n\n/**\n * Thrown at boot when `http.csp.directives` contains a value the framework\n * refuses to ship as-is, rather than silently dropping or rewriting it.\n *\n * Two shapes are rejected:\n * - a value containing `;` — CSP directives are `;`-delimited, so a `;`\n *   inside one value would prematurely close it and let the remainder be\n *   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.\n * - a value with an odd number of `'` characters — every CSP keyword\n *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an\n *   unbalanced count means a keyword was truncated or malformed.\n */\nexport class InvalidCspDirectiveError extends Error {\n  /** Stable Warlock error code; `warlock explain WL1004` prints the fix. */\n  public readonly code = \"WL1004\";\n\n  public constructor(\n    public readonly directive: string,\n    public readonly value: string,\n    reason: string,\n  ) {\n    super(\n      `Invalid \"http.csp.directives\" entry — directive \"${directive}\" has a value ` +\n        `${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; ` +\n        `the framework will not silently repair it.`,\n    );\n    this.name = \"InvalidCspDirectiveError\";\n  }\n}\n\n/**\n * Validate every directive value an app supplied, throwing\n * {@link InvalidCspDirectiveError} on the first offender.\n *\n * Exported so boot code and tests can call it directly, independent of\n * whether `http.csp` happens to be enabled.\n */\nexport function validateCspDirectives(directives: Record<string, string[]> | undefined): void {\n  if (!directives) return;\n\n  for (const [directive, values] of Object.entries(directives)) {\n    for (const value of values) {\n      if (value.includes(\";\")) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"contains a ';' character, which would truncate the directive.\",\n        );\n      }\n\n      const quoteCount = (value.match(/'/g) ?? []).length;\n      if (quoteCount % 2 !== 0) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"has an unbalanced number of ' characters.\",\n        );\n      }\n    }\n  }\n}\n\n/**\n * Read the app's `http.csp` config, if any.\n */\nexport function resolveCspConfig(): CspConfig | undefined {\n  return config.get(\"http.csp\");\n}\n\n/**\n * Fail the boot loudly when `http.csp` is enabled with invalid directives.\n *\n * Called once, from {@link createHttpApplication} before the server starts\n * listening — never per-request. A per-request validation would let an app\n * boot successfully and only discover the bad config on first traffic;\n * checking once at boot surfaces it immediately, the same way a malformed\n * `warlock.config.ts` would.\n *\n * @throws {InvalidCspDirectiveError} when a directive value is malformed.\n */\nexport function validateCspConfigAtBoot(): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  validateCspDirectives(cspConfig.directives);\n}\n\n/**\n * Merge the app's directives over the framework defaults and fold in the\n * request's nonce.\n *\n * Per-directive replacement, not element-wise merging: a directive the app\n * names wins outright, everything else falls back to\n * {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains\n * `'nonce-<nonce>'` on top, whichever list it started from, so the\n * framework's own inline payload script and hydration module script are\n * never blocked by an app's own policy.\n */\nexport function mergeCspDirectives(\n  appDirectives: Record<string, string[]> | undefined,\n  nonce: string,\n): Record<string, string[]> {\n  const merged: Record<string, string[]> = {};\n\n  for (const [directive, defaultValues] of Object.entries(DEFAULT_CSP_DIRECTIVES)) {\n    merged[directive] = appDirectives?.[directive]\n      ? [...appDirectives[directive]]\n      : [...defaultValues];\n  }\n\n  if (appDirectives) {\n    for (const [directive, values] of Object.entries(appDirectives)) {\n      if (!(directive in merged)) {\n        merged[directive] = [...values];\n      }\n    }\n  }\n\n  // `merged[\"script-src\"]` is always populated by the loop above —\n  // `DEFAULT_CSP_DIRECTIVES` (:59-67) declares a `script-src` entry, and every\n  // one of its keys is copied into `merged` unconditionally — but its type is\n  // `Record<string, string[]>`, so `noUncheckedIndexedAccess` still widens the\n  // read to `string[] | undefined`. Narrowed once, locally, rather than\n  // asserted away.\n  const scriptSrc = merged[\"script-src\"] ?? [];\n  const nonceSource = `'nonce-${nonce}'`;\n\n  merged[\"script-src\"] = scriptSrc.includes(nonceSource) ? scriptSrc : [...scriptSrc, nonceSource];\n\n  return merged;\n}\n\n/**\n * Serialize a merged directive map into a header value —\n * `\"default-src 'self'; script-src 'self' 'nonce-...'; ...\"`.\n */\nexport function serializeCspDirectives(directives: Record<string, string[]>): string {\n  return Object.entries(directives)\n    .map(([directive, values]) => `${directive} ${values.join(\" \")}`)\n    .join(\"; \");\n}\n\n/**\n * Build the full `Content-Security-Policy` (or `-Report-Only`) header value\n * for one request, using that request's own nonce.\n */\nexport function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string {\n  return serializeCspDirectives(mergeCspDirectives(cspConfig.directives, nonce));\n}\n\n/**\n * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,\n * `Content-Security-Policy-Report-Only`) header on the response, when the\n * app opted in via `http.csp.enabled`.\n *\n * A no-op when `http.csp` is absent or `enabled` is falsy — the default,\n * behaviour-preserving state for every app that hasn't opted in.\n *\n * Reads `request.nonce`, which lazily generates and caches the per-request\n * nonce (`request.ts`) — calling this early in the request lifecycle (see\n * `inject-request-context.ts`) means the SAME nonce this stamps into the\n * header is the one still available later for the web layer's `<script>`\n * tags to read off `request.nonce`.\n */\nexport function applyCspHeader(request: Request, response: Response): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  const headerName = cspConfig.reportOnly\n    ? \"Content-Security-Policy-Report-Only\"\n    : \"Content-Security-Policy\";\n\n  response.header(headerName, buildCspHeaderValue(cspConfig, request.nonce));\n}\n"],"mappings":";;;;;;;;;AA0DA,MAAa,yBAAsE;CACjF,eAAe,CAAC,QAAQ;CACxB,cAAc,CAAC,QAAQ;CACvB,aAAa,CAAC,QAAQ;CACtB,WAAW,CAAC,UAAU,OAAO;CAC7B,cAAc,CAAC,QAAQ;CACvB,YAAY,CAAC,QAAQ;CACrB,mBAAmB,CAAC,QAAQ;AAC9B;;;;;;;;;;;;;AAcA,IAAa,2BAAb,cAA8C,MAAM;CAIlD,AAAO,YACL,AAAgB,WAChB,AAAgB,OAChB,QACA;EACA,MACE,oDAAoD,UAAU,gBACzD,KAAK,UAAU,KAAK,EAAE,QAAQ,OAAO,qFAE5C;EARgB;EACA;cAJK;EAYrB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,sBAAsB,YAAwD;CAC5F,IAAI,CAAC,YAAY;CAEjB,KAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,UAAU,GACzD,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,GAAG,GACpB,MAAM,IAAI,yBACR,WACA,OACA,+DACF;EAIF,KADoB,MAAM,MAAM,IAAI,KAAK,CAAC,EAAC,CAAE,SAC5B,MAAM,GACrB,MAAM,IAAI,yBACR,WACA,OACA,2CACF;CAEJ;AAEJ;;;;AAKA,SAAgB,mBAA0C;CACxD,OAAOA,WAAO,IAAI,UAAU;AAC9B;;;;;;;;;;;;AAaA,SAAgB,0BAAgC;CAC9C,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,sBAAsB,UAAU,UAAU;AAC5C;;;;;;;;;;;;AAaA,SAAgB,mBACd,eACA,OAC0B;CAC1B,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,WAAW,kBAAkB,OAAO,QAAQ,sBAAsB,GAC5E,OAAO,aAAa,gBAAgB,aAChC,CAAC,GAAG,cAAc,UAAU,IAC5B,CAAC,GAAG,aAAa;CAGvB,IAAI,eACF;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,aAAa,GAC5D,IAAI,EAAE,aAAa,SACjB,OAAO,aAAa,CAAC,GAAG,MAAM;CAElC;CASF,MAAM,YAAY,OAAO,iBAAiB,CAAC;CAC3C,MAAM,cAAc,UAAU,MAAM;CAEpC,OAAO,gBAAgB,UAAU,SAAS,WAAW,IAAI,YAAY,CAAC,GAAG,WAAW,WAAW;CAE/F,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,YAA8C;CACnF,OAAO,OAAO,QAAQ,UAAU,CAAC,CAC9B,KAAK,CAAC,WAAW,YAAY,GAAG,UAAU,GAAG,OAAO,KAAK,GAAG,GAAG,CAAC,CAChE,KAAK,IAAI;AACd;;;;;AAMA,SAAgB,oBAAoB,WAAsB,OAAuB;CAC/E,OAAO,uBAAuB,mBAAmB,UAAU,YAAY,KAAK,CAAC;AAC/E;;;;;;;;;;;;;;;AAgBA,SAAgB,eAAe,SAAkB,UAA0B;CACzE,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,MAAM,aAAa,UAAU,aACzB,wCACA;CAEJ,SAAS,OAAO,YAAY,oBAAoB,WAAW,QAAQ,KAAK,CAAC;AAC3E"}

package/esm/http/csrf-default-guard.d.mts

@@ -1,12 +1,11 @@
 import { Response } from "./response.mjs";
 import { Request } from "./request.mjs";
-
 //#region ../../packages/core/src/http/csrf-default-guard.d.ts
 /**
  * Whether the current request is in scope for the default core CSRF-Origin
  * guard at all.
  */
-declare function requiresDefaultCsrfGuard(request: Request): boolean;
+export declare function requiresDefaultCsrfGuard(request: Request): boolean;
 /**
  * Run the default core CSRF-Origin guard for the current request.
  *
@@ -26,7 +25,6 @@ declare function requiresDefaultCsrfGuard(request: Request): boolean;
  * rejected, because a guard rejection short-circuits `runMiddleware()`
  * entirely — so a rejected request is never logged twice.
  */
-declare function runDefaultCsrfGuard(request: Request, response: Response, translate: (key: string) => string, logRejection: (reason: string) => void): Promise<Response | undefined>;
+export declare function runDefaultCsrfGuard(request: Request, response: Response, translate: (key: string) => string, logRejection: (reason: string) => void): Promise<Response | undefined>;
 //#endregion
-export { requiresDefaultCsrfGuard, runDefaultCsrfGuard };
 //# sourceMappingURL=csrf-default-guard.d.mts.map

package/esm/http/csrf-default-guard.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-default-guard.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"mappings":";;;;;;AAyIA;;iBAAgB,wBAAA,CAAyB,OAAgB,EAAP,OAAO;;AAAA;AA2BzD;;;;;;;;;;;;;;;;;iBAAsB,mBAAA,CACpB,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,SAAA,GAAY,GAAA,qBACZ,YAAA,GAAe,MAAA,oBACd,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"csrf-default-guard.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"mappings":";;;;;;;wBAyIgB,yBAAyB,SAAS;;;;;;;;;;;;;;;;;;;;wBA2B5B,oBACpB,SAAS,SACT,UAAU,UACV,YAAY,wBACZ,eAAe,0BACd,QAAQ"}

package/esm/http/csrf-default-guard.mjs

@@ -48,7 +48,7 @@ import { resolveCsrfOriginVerdict } from "./csrf-origin-policy.mjs";
 * at all) never reaches the cookie check above and is entirely unaffected.
 */
 /** HTTP methods the default CSRF guard is scoped to — every unsafe method. */
-const UNSAFE_METHODS = new Set([
+const UNSAFE_METHODS = /* @__PURE__ */ new Set([
 	"POST",
 	"PUT",
 	"PATCH",

package/esm/http/csrf-default-guard.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-default-guard.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"sourcesContent":["/**\n * The DEFAULT core CSRF-Origin guard — SECURITY, card 8a752ab2 (5.17), lead\n * ruling from Aria (`releases/v5.17-web-readiness-audit.md` §3.1, quoted):\n *\n * > \"Scope the default guard to unsafe browser requests carrying a\n * > non-locale credential-looking cookie (fail closed on unknown names), at\n * > an early core/auth HTTP seam before app handlers; give explicit,\n * > narrowly scoped route-level exemptions for third-party callbacks and\n * > machine-to-machine routes, documented as dangerous. Reuse current\n * > same-origin/allowedOrigins policy, trustProxy-aware own origin, and fail\n * > closed on missing Origin/Referer where in scope.\"\n *\n * Before this guard, the CSRF Origin check (`csrf-origin-policy.ts`, moved\n * here from `@warlock.js/auth` in this same change) only ran inside\n * `authMiddleware(\"cookie:*\")` — a cookie-authenticated write reaching any\n * OTHER path (an app-owned optional-auth pattern reading its own `token`\n * cookie without ever calling `authMiddleware`) was never checked at all.\n *\n * This guard closes that gap at the earliest seam common to EVERY request —\n * production (`Router.scan()`) and the dev wildcard dispatcher both funnel\n * into `Router[\"handleRoute\"]` → `request.execute()` →\n * `createRequestStore()` (`./middleware/inject-request-context.ts`), which is\n * where this is wired, BEFORE `request.runMiddleware()` runs the route's own\n * middleware (so it applies with or without `authMiddleware` on the route)\n * and before any app handler. It lives in `@warlock.js/core`, not\n * `@warlock.js/auth`, because `core` — not `auth` — is a dependency of every\n * Warlock app, so this is the only seam that reaches an app that never\n * installs `@warlock.js/auth` at all.\n *\n * Scope (mirrors `web`'s page-cache Cookie-header bypass rule,\n * `web/src/server/page-cache-cookie-bypass.ts`, card ad861076 — same\n * fail-closed strict-parse posture, independently reimplemented here because\n * `core` cannot depend on `web`, the dependency runs the other way):\n * - method is POST/PUT/PATCH/DELETE, AND\n * - the `Cookie` header carries any cookie other than the framework's own\n *   `locale` cookies (legacy plus the browser preference; a header that fails to parse cleanly counts as\n *   carrying one — fail closed), AND\n * - the route is not exempted via `{ csrf: false }` (`RouteOptions.csrf`,\n *   `../router/types.ts`) — a narrow, per-route, explicitly \"dangerous\" opt\n *   out for third-party callbacks and machine-to-machine routes.\n *\n * A header-only API request (`Authorization: Bearer …`, no `Cookie` header\n * at all) never reaches the cookie check above and is entirely unaffected.\n */\nimport { LOCALE_COOKIE_NAME, LOCALE_PREFERENCE_COOKIE_NAME } from \"../config/locale-configuration\";\nimport { HttpErrorCodes } from \"./error-codes\";\nimport { resolveCsrfOriginVerdict } from \"./csrf-origin-policy\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/** HTTP methods the default CSRF guard is scoped to — every unsafe method. */\nconst UNSAFE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Strictly parse a raw `Cookie` request header into a set of cookie names, or\n * `undefined` when the header does not parse cleanly.\n *\n * Deliberately NOT a lenient cookie parser that silently drops malformed\n * pairs and returns whatever it could salvage: a header this function cannot\n * fully account for must read as \"unknown cookies present\", never as \"the\n * pairs we understood, minus the ones we didn't\" — dropping a pair is how a\n * malformed header could otherwise be misread as carrying only the locale\n * cookie (or none) and wrongly skip the guard. Mirrors\n * `web/src/server/page-cache-cookie-bypass.ts`'s `parseCookieHeaderStrict`.\n *\n * Fails (`undefined`) on:\n * - an empty or whitespace-only header;\n * - any empty segment between/around `;`;\n * - any segment with no `=`, or an empty name.\n */\nfunction parseCookieNamesStrict(rawHeader: string): Set<string> | undefined {\n  if (rawHeader.trim() === \"\") return undefined;\n\n  const names = new Set<string>();\n\n  for (const segment of rawHeader.split(\";\")) {\n    const pair = segment.trim();\n\n    if (pair === \"\") return undefined;\n\n    const separatorIndex = pair.indexOf(\"=\");\n\n    if (separatorIndex <= 0) return undefined;\n\n    const name = pair.slice(0, separatorIndex).trim();\n\n    if (name === \"\") return undefined;\n\n    names.add(name);\n  }\n\n  return names;\n}\n\n/**\n * Whether the request carries a `Cookie` header naming anything other than\n * the framework's locale cookies.\n *\n * - No `Cookie` header at all ⇒ `false` — nothing to guard on.\n * - A header that fails to parse cleanly ⇒ `true` — fails CLOSED.\n * - A header whose parsed names are a non-empty set equal to exactly\n *   `{locale}` ⇒ `false` — the one exemption.\n * - Anything else (any other cookie name, alone or alongside `locale`) ⇒ `true`.\n */\nfunction carriesNonLocaleCookie(request: Request): boolean {\n  const rawCookieHeader = request.header(\"cookie\", undefined);\n\n  // Only an ABSENT header is cookie-free. A present header in any other\n  // shape (an array from a duplicated Cookie header) fails closed.\n  if (rawCookieHeader === undefined || rawCookieHeader === null) return false;\n\n  if (typeof rawCookieHeader !== \"string\") return true;\n\n  const names = parseCookieNamesStrict(rawCookieHeader);\n\n  if (names === undefined || names.size === 0) return true;\n\n  for (const name of names) {\n    if (name !== LOCALE_COOKIE_NAME && name !== LOCALE_PREFERENCE_COOKIE_NAME) return true;\n  }\n\n  return false;\n}\n\n/**\n * Whether the matched route opted out of the default CSRF guard via\n * `{ csrf: false }` (`RouteOptions.csrf`). Any other value — including\n * `undefined` — leaves the route in scope.\n */\nfunction isCsrfExempt(request: Request): boolean {\n  return request.route?.csrf === false;\n}\n\n/**\n * Whether the current request is in scope for the default core CSRF-Origin\n * guard at all.\n */\nexport function requiresDefaultCsrfGuard(request: Request): boolean {\n  if (!UNSAFE_METHODS.has(request.method.toUpperCase())) return false;\n\n  if (isCsrfExempt(request)) return false;\n\n  return carriesNonLocaleCookie(request);\n}\n\n/**\n * Run the default core CSRF-Origin guard for the current request.\n *\n * Returns `undefined` when the request is out of scope or passes the\n * Origin/Referer check — the caller continues into route middleware and the\n * handler as normal. Returns the 403 {@link Response} when the guard refuses\n * the request; the caller must return that value immediately, the same\n * short-circuit contract every other middleware in the chain follows.\n *\n * Uses the SAME translated message and client-visible error code\n * `authMiddleware(\"cookie:*\")`'s own CSRF-Origin check uses\n * (`auth.errors.csrfOriginMismatch`, `HttpErrorCodes.CsrfOriginMismatch` /\n * `AuthErrorCodes.CsrfOriginMismatch`, both `\"EC006\"`) — one message, one\n * error code, regardless of which seam caught the request. Logs exactly once\n * per rejection here; a route that also carries `authMiddleware(\"cookie:*\")`\n * never reaches that middleware's own check for a request THIS guard already\n * rejected, because a guard rejection short-circuits `runMiddleware()`\n * entirely — so a rejected request is never logged twice.\n */\nexport async function runDefaultCsrfGuard(\n  request: Request,\n  response: Response,\n  translate: (key: string) => string,\n  logRejection: (reason: string) => void,\n): Promise<Response | undefined> {\n  if (!requiresDefaultCsrfGuard(request)) return undefined;\n\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (verdict.allowed) return undefined;\n\n  logRejection(verdict.reason);\n\n  return response.forbidden({\n    error: translate(\"auth.errors.csrfOriginMismatch\"),\n    errorCode: HttpErrorCodes.CsrfOriginMismatch,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAM,iBAAiB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBjE,SAAS,uBAAuB,WAA4C;CAC1E,IAAI,UAAU,KAAK,MAAM,IAAI,OAAO;CAEpC,MAAM,wBAAQ,IAAI,IAAY;CAE9B,KAAK,MAAM,WAAW,UAAU,MAAM,GAAG,GAAG;EAC1C,MAAM,OAAO,QAAQ,KAAK;EAE1B,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,iBAAiB,KAAK,QAAQ,GAAG;EAEvC,IAAI,kBAAkB,GAAG,OAAO;EAEhC,MAAM,OAAO,KAAK,MAAM,GAAG,cAAc,CAAC,CAAC,KAAK;EAEhD,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,IAAI,IAAI;CAChB;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAS,uBAAuB,SAA2B;CACzD,MAAM,kBAAkB,QAAQ,OAAO,UAAU,MAAS;CAI1D,IAAI,oBAAoB,UAAa,oBAAoB,MAAM,OAAO;CAEtE,IAAI,OAAO,oBAAoB,UAAU,OAAO;CAEhD,MAAM,QAAQ,uBAAuB,eAAe;CAEpD,IAAI,UAAU,UAAa,MAAM,SAAS,GAAG,OAAO;CAEpD,KAAK,MAAM,QAAQ,OACjB,IAAI,qBAA+B,sCAAwC,OAAO;CAGpF,OAAO;AACT;;;;;;AAOA,SAAS,aAAa,SAA2B;CAC/C,OAAO,QAAQ,OAAO,SAAS;AACjC;;;;;AAMA,SAAgB,yBAAyB,SAA2B;CAClE,IAAI,CAAC,eAAe,IAAI,QAAQ,OAAO,YAAY,CAAC,GAAG,OAAO;CAE9D,IAAI,aAAa,OAAO,GAAG,OAAO;CAElC,OAAO,uBAAuB,OAAO;AACvC;;;;;;;;;;;;;;;;;;;;AAqBA,eAAsB,oBACpB,SACA,UACA,WACA,cAC+B;CAC/B,IAAI,CAAC,yBAAyB,OAAO,GAAG,OAAO;CAE/C,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,QAAQ,SAAS,OAAO;CAE5B,aAAa,QAAQ,MAAM;CAE3B,OAAO,SAAS,UAAU;EACxB,OAAO,UAAU,gCAAgC;EACjD;CACF,CAAC;AACH"}
+{"version":3,"file":"csrf-default-guard.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"sourcesContent":["/**\n * The DEFAULT core CSRF-Origin guard — SECURITY, card 8a752ab2 (5.17), lead\n * ruling from Aria (`releases/v5.17-web-readiness-audit.md` §3.1, quoted):\n *\n * > \"Scope the default guard to unsafe browser requests carrying a\n * > non-locale credential-looking cookie (fail closed on unknown names), at\n * > an early core/auth HTTP seam before app handlers; give explicit,\n * > narrowly scoped route-level exemptions for third-party callbacks and\n * > machine-to-machine routes, documented as dangerous. Reuse current\n * > same-origin/allowedOrigins policy, trustProxy-aware own origin, and fail\n * > closed on missing Origin/Referer where in scope.\"\n *\n * Before this guard, the CSRF Origin check (`csrf-origin-policy.ts`, moved\n * here from `@warlock.js/auth` in this same change) only ran inside\n * `authMiddleware(\"cookie:*\")` — a cookie-authenticated write reaching any\n * OTHER path (an app-owned optional-auth pattern reading its own `token`\n * cookie without ever calling `authMiddleware`) was never checked at all.\n *\n * This guard closes that gap at the earliest seam common to EVERY request —\n * production (`Router.scan()`) and the dev wildcard dispatcher both funnel\n * into `Router[\"handleRoute\"]` → `request.execute()` →\n * `createRequestStore()` (`./middleware/inject-request-context.ts`), which is\n * where this is wired, BEFORE `request.runMiddleware()` runs the route's own\n * middleware (so it applies with or without `authMiddleware` on the route)\n * and before any app handler. It lives in `@warlock.js/core`, not\n * `@warlock.js/auth`, because `core` — not `auth` — is a dependency of every\n * Warlock app, so this is the only seam that reaches an app that never\n * installs `@warlock.js/auth` at all.\n *\n * Scope (mirrors `web`'s page-cache Cookie-header bypass rule,\n * `web/src/server/page-cache-cookie-bypass.ts`, card ad861076 — same\n * fail-closed strict-parse posture, independently reimplemented here because\n * `core` cannot depend on `web`, the dependency runs the other way):\n * - method is POST/PUT/PATCH/DELETE, AND\n * - the `Cookie` header carries any cookie other than the framework's own\n *   `locale` cookies (legacy plus the browser preference; a header that fails to parse cleanly counts as\n *   carrying one — fail closed), AND\n * - the route is not exempted via `{ csrf: false }` (`RouteOptions.csrf`,\n *   `../router/types.ts`) — a narrow, per-route, explicitly \"dangerous\" opt\n *   out for third-party callbacks and machine-to-machine routes.\n *\n * A header-only API request (`Authorization: Bearer …`, no `Cookie` header\n * at all) never reaches the cookie check above and is entirely unaffected.\n */\nimport { LOCALE_COOKIE_NAME, LOCALE_PREFERENCE_COOKIE_NAME } from \"../config/locale-configuration\";\nimport { HttpErrorCodes } from \"./error-codes\";\nimport { resolveCsrfOriginVerdict } from \"./csrf-origin-policy\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/** HTTP methods the default CSRF guard is scoped to — every unsafe method. */\nconst UNSAFE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Strictly parse a raw `Cookie` request header into a set of cookie names, or\n * `undefined` when the header does not parse cleanly.\n *\n * Deliberately NOT a lenient cookie parser that silently drops malformed\n * pairs and returns whatever it could salvage: a header this function cannot\n * fully account for must read as \"unknown cookies present\", never as \"the\n * pairs we understood, minus the ones we didn't\" — dropping a pair is how a\n * malformed header could otherwise be misread as carrying only the locale\n * cookie (or none) and wrongly skip the guard. Mirrors\n * `web/src/server/page-cache-cookie-bypass.ts`'s `parseCookieHeaderStrict`.\n *\n * Fails (`undefined`) on:\n * - an empty or whitespace-only header;\n * - any empty segment between/around `;`;\n * - any segment with no `=`, or an empty name.\n */\nfunction parseCookieNamesStrict(rawHeader: string): Set<string> | undefined {\n  if (rawHeader.trim() === \"\") return undefined;\n\n  const names = new Set<string>();\n\n  for (const segment of rawHeader.split(\";\")) {\n    const pair = segment.trim();\n\n    if (pair === \"\") return undefined;\n\n    const separatorIndex = pair.indexOf(\"=\");\n\n    if (separatorIndex <= 0) return undefined;\n\n    const name = pair.slice(0, separatorIndex).trim();\n\n    if (name === \"\") return undefined;\n\n    names.add(name);\n  }\n\n  return names;\n}\n\n/**\n * Whether the request carries a `Cookie` header naming anything other than\n * the framework's locale cookies.\n *\n * - No `Cookie` header at all ⇒ `false` — nothing to guard on.\n * - A header that fails to parse cleanly ⇒ `true` — fails CLOSED.\n * - A header whose parsed names are a non-empty set equal to exactly\n *   `{locale}` ⇒ `false` — the one exemption.\n * - Anything else (any other cookie name, alone or alongside `locale`) ⇒ `true`.\n */\nfunction carriesNonLocaleCookie(request: Request): boolean {\n  const rawCookieHeader = request.header(\"cookie\", undefined);\n\n  // Only an ABSENT header is cookie-free. A present header in any other\n  // shape (an array from a duplicated Cookie header) fails closed.\n  if (rawCookieHeader === undefined || rawCookieHeader === null) return false;\n\n  if (typeof rawCookieHeader !== \"string\") return true;\n\n  const names = parseCookieNamesStrict(rawCookieHeader);\n\n  if (names === undefined || names.size === 0) return true;\n\n  for (const name of names) {\n    if (name !== LOCALE_COOKIE_NAME && name !== LOCALE_PREFERENCE_COOKIE_NAME) return true;\n  }\n\n  return false;\n}\n\n/**\n * Whether the matched route opted out of the default CSRF guard via\n * `{ csrf: false }` (`RouteOptions.csrf`). Any other value — including\n * `undefined` — leaves the route in scope.\n */\nfunction isCsrfExempt(request: Request): boolean {\n  return request.route?.csrf === false;\n}\n\n/**\n * Whether the current request is in scope for the default core CSRF-Origin\n * guard at all.\n */\nexport function requiresDefaultCsrfGuard(request: Request): boolean {\n  if (!UNSAFE_METHODS.has(request.method.toUpperCase())) return false;\n\n  if (isCsrfExempt(request)) return false;\n\n  return carriesNonLocaleCookie(request);\n}\n\n/**\n * Run the default core CSRF-Origin guard for the current request.\n *\n * Returns `undefined` when the request is out of scope or passes the\n * Origin/Referer check — the caller continues into route middleware and the\n * handler as normal. Returns the 403 {@link Response} when the guard refuses\n * the request; the caller must return that value immediately, the same\n * short-circuit contract every other middleware in the chain follows.\n *\n * Uses the SAME translated message and client-visible error code\n * `authMiddleware(\"cookie:*\")`'s own CSRF-Origin check uses\n * (`auth.errors.csrfOriginMismatch`, `HttpErrorCodes.CsrfOriginMismatch` /\n * `AuthErrorCodes.CsrfOriginMismatch`, both `\"EC006\"`) — one message, one\n * error code, regardless of which seam caught the request. Logs exactly once\n * per rejection here; a route that also carries `authMiddleware(\"cookie:*\")`\n * never reaches that middleware's own check for a request THIS guard already\n * rejected, because a guard rejection short-circuits `runMiddleware()`\n * entirely — so a rejected request is never logged twice.\n */\nexport async function runDefaultCsrfGuard(\n  request: Request,\n  response: Response,\n  translate: (key: string) => string,\n  logRejection: (reason: string) => void,\n): Promise<Response | undefined> {\n  if (!requiresDefaultCsrfGuard(request)) return undefined;\n\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (verdict.allowed) return undefined;\n\n  logRejection(verdict.reason);\n\n  return response.forbidden({\n    error: translate(\"auth.errors.csrfOriginMismatch\"),\n    errorCode: HttpErrorCodes.CsrfOriginMismatch,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAM,iCAAiB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBjE,SAAS,uBAAuB,WAA4C;CAC1E,IAAI,UAAU,KAAK,MAAM,IAAI,OAAO;CAEpC,MAAM,wBAAQ,IAAI,IAAY;CAE9B,KAAK,MAAM,WAAW,UAAU,MAAM,GAAG,GAAG;EAC1C,MAAM,OAAO,QAAQ,KAAK;EAE1B,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,iBAAiB,KAAK,QAAQ,GAAG;EAEvC,IAAI,kBAAkB,GAAG,OAAO;EAEhC,MAAM,OAAO,KAAK,MAAM,GAAG,cAAc,CAAC,CAAC,KAAK;EAEhD,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,IAAI,IAAI;CAChB;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAS,uBAAuB,SAA2B;CACzD,MAAM,kBAAkB,QAAQ,OAAO,UAAU,MAAS;CAI1D,IAAI,oBAAoB,UAAa,oBAAoB,MAAM,OAAO;CAEtE,IAAI,OAAO,oBAAoB,UAAU,OAAO;CAEhD,MAAM,QAAQ,uBAAuB,eAAe;CAEpD,IAAI,UAAU,UAAa,MAAM,SAAS,GAAG,OAAO;CAEpD,KAAK,MAAM,QAAQ,OACjB,IAAI,qBAA+B,sCAAwC,OAAO;CAGpF,OAAO;AACT;;;;;;AAOA,SAAS,aAAa,SAA2B;CAC/C,OAAO,QAAQ,OAAO,SAAS;AACjC;;;;;AAMA,SAAgB,yBAAyB,SAA2B;CAClE,IAAI,CAAC,eAAe,IAAI,QAAQ,OAAO,YAAY,CAAC,GAAG,OAAO;CAE9D,IAAI,aAAa,OAAO,GAAG,OAAO;CAElC,OAAO,uBAAuB,OAAO;AACvC;;;;;;;;;;;;;;;;;;;;AAqBA,eAAsB,oBACpB,SACA,UACA,WACA,cAC+B;CAC/B,IAAI,CAAC,yBAAyB,OAAO,GAAG,OAAO;CAE/C,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,QAAQ,SAAS,OAAO;CAE5B,aAAa,QAAQ,MAAM;CAE3B,OAAO,SAAS,UAAU;EACxB,OAAO,UAAU,gCAAgC;EACjD;CACF,CAAC;AACH"}

package/esm/http/csrf-origin-policy.d.mts

@@ -1,10 +1,9 @@
 import { Request } from "./request.mjs";
-
 //#region ../../packages/core/src/http/csrf-origin-policy.d.ts
 /** Why {@link resolveCsrfOriginVerdict} refused a request. */
-type CsrfOriginCheckReason = "origin-mismatch" | "referer-mismatch" | "missing-origin-and-referer";
+export type CsrfOriginCheckReason = "origin-mismatch" | "referer-mismatch" | "missing-origin-and-referer";
 /** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */
-type CsrfOriginVerdict = {
+export type CsrfOriginVerdict = {
   allowed: true;
 } | {
   allowed: false;
@@ -24,18 +23,18 @@ type CsrfOriginVerdict = {
  * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this
  * function does not need its own proxy-trust logic on top of that.
  */
-declare function ownOrigin(request: Request): string;
+export declare function ownOrigin(request: Request): string;
 /** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */
-declare function originOf(rawUrl: string): string | undefined;
+export declare function originOf(rawUrl: string): string | undefined;
 /**
  * Normalize an origin string (`scheme://host[:port]`) so that a default port
  * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin
  * written without a port. Falls back to the raw value if it does not parse
  * as a URL (in which case it will simply fail the exact-match comparison).
  */
-declare function normalizeOrigin(origin: string): string;
+export declare function normalizeOrigin(origin: string): string;
 /** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */
-declare function isAllowedCsrfOrigin(origin: string, request: Request): boolean;
+export declare function isAllowedCsrfOrigin(origin: string, request: Request): boolean;
 /**
  * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):
  * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the
@@ -47,7 +46,6 @@ declare function isAllowedCsrfOrigin(origin: string, request: Request): boolean;
  * exemption) — this function only answers the Origin/Referer question once a
  * caller has already decided the check applies.
  */
-declare function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict;
+export declare function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict;
 //#endregion
-export { CsrfOriginCheckReason, CsrfOriginVerdict, isAllowedCsrfOrigin, normalizeOrigin, originOf, ownOrigin, resolveCsrfOriginVerdict };
 //# sourceMappingURL=csrf-origin-policy.d.mts.map

package/esm/http/csrf-origin-policy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-policy.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"mappings":";;;;KAyBY,qBAAA;AAAZ;AAAA,KAMY,iBAAA;EACN,OAAA;AAAA;EACA,OAAA;EAAgB,MAAA,EAAQ,qBAAqB;AAAA;;;;;;;;AAAA;AAgBnD;;;;AAA0C;AAgB1C;iBAhBgB,SAAA,CAAU,OAAgB,EAAP,OAAO;;iBAgB1B,QAAA,CAAS,MAAc;AAAA;AAgBvC;;;;AAA8C;AAhBP,iBAgBvB,eAAA,CAAgB,MAAc;;iBAc9B,mBAAA,CAAoB,MAAA,UAAgB,OAAA,EAAS,OAAO;;;;;;AAAA;AAqBpE;;;;;iBAAgB,wBAAA,CAAyB,OAAA,EAAS,OAAA,GAAU,iBAAiB"}
+{"version":3,"file":"csrf-origin-policy.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"mappings":";;;YAyBY;;YAMA;EACN;;EACA;EAAgB,QAAQ;;;;;;;;;;;;;;;;wBAgBd,UAAU,SAAS;;wBAgBnB,SAAS;;;;;;;wBAgBT,gBAAgB;;wBAchB,oBAAoB,gBAAgB,SAAS;;;;;;;;;;;;wBAqB7C,yBAAyB,SAAS,UAAU"}

package/esm/http/csrf-origin-policy.mjs

@@ -1,4 +1,4 @@
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 
 //#region ../../packages/core/src/http/csrf-origin-policy.ts
 /**
@@ -69,7 +69,7 @@ function normalizeOrigin(origin) {
 /** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */
 function isAllowedCsrfOrigin(origin, request) {
 	if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;
-	const allowedOrigins = config.get("auth.csrf.allowedOrigins", []);
+	const allowedOrigins = baseConfig.get("auth.csrf.allowedOrigins", []);
 	const normalized = normalizeOrigin(origin);
 	return allowedOrigins.some((allowed) => normalizeOrigin(allowed) === normalized);
 }

package/esm/http/csrf-origin-policy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-policy.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"sourcesContent":["/**\n * The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the\n * one comparison every CSRF-Origin check in the framework must agree on.\n *\n * SECURITY, card 8a752ab2 (5.17). Extracted from\n * `@warlock.js/auth`'s `csrf-origin-check.ts` (the ONLY prior owner of this\n * logic) into `@warlock.js/core` so both call sites — the\n * `authMiddleware(\"cookie:*\")` check in `@warlock.js/auth` and the default\n * core HTTP-seam guard in `./csrf-default-guard.ts` — share ONE\n * implementation instead of drifting copies. `@warlock.js/core` cannot depend\n * on `@warlock.js/auth` (the dependency runs the other way), so the shared\n * logic had to move down into `core`, not up into a new shared package —\n * `auth`'s `csrf-origin-check.ts` now delegates to\n * {@link resolveCsrfOriginVerdict} instead of reimplementing it.\n *\n * Reads `auth.csrf.allowedOrigins` directly via `@mongez/config` (the exact\n * same config key `@warlock.js/auth`'s `authConfig.csrf.allowedOrigins()`\n * reads) rather than importing `@warlock.js/auth`, so an app's one\n * `auth.csrf.allowedOrigins` setting governs both checks without `core`\n * taking a hard dependency on `auth`.\n */\nimport config from \"@mongez/config\";\nimport type { Request } from \"./request\";\n\n/** Why {@link resolveCsrfOriginVerdict} refused a request. */\nexport type CsrfOriginCheckReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */\nexport type CsrfOriginVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: CsrfOriginCheckReason };\n\n/**\n * The request's own origin — what an `Origin`/`Referer` header must match.\n *\n * `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never\n * carries a port. A browser's `Origin` header on a non-default port (e.g. any\n * `warlock dev` session) does, so the port must come from the raw `Host`\n * header instead — core exposes no getter for that, so it is read directly\n * here.\n *\n * Trust-proxy-aware for free: `request.protocol` is Fastify's own\n * `request.protocol`, which already honours `http.trustProxy`\n * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this\n * function does not need its own proxy-trust logic on top of that.\n */\nexport function ownOrigin(request: Request): string {\n  // Fastify's `host` keeps the port and honours `X-Forwarded-Host` under\n  // `trustProxy`, so a proxy that rewrites `Host` does not break the match.\n  const fastifyHost = request.baseRequest?.host;\n  const hostHeader = request.header(\"host\");\n  const host =\n    typeof fastifyHost === \"string\" && fastifyHost\n      ? fastifyHost\n      : typeof hostHeader === \"string\" && hostHeader\n        ? hostHeader\n        : request.hostname;\n\n  return `${request.protocol}://${host}`;\n}\n\n/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */\nexport function originOf(rawUrl: string): string | undefined {\n  try {\n    const url = new URL(rawUrl);\n\n    return `${url.protocol}//${url.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Normalize an origin string (`scheme://host[:port]`) so that a default port\n * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin\n * written without a port. Falls back to the raw value if it does not parse\n * as a URL (in which case it will simply fail the exact-match comparison).\n */\nexport function normalizeOrigin(origin: string): string {\n  try {\n    const url = new URL(origin);\n    const isDefaultPort =\n      (url.protocol === \"http:\" && (url.port === \"\" || url.port === \"80\")) ||\n      (url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\"));\n\n    return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;\n  } catch {\n    return origin;\n  }\n}\n\n/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */\nexport function isAllowedCsrfOrigin(origin: string, request: Request): boolean {\n  if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;\n\n  const allowedOrigins: string[] = config.get(\"auth.csrf.allowedOrigins\", []);\n\n  const normalized = normalizeOrigin(origin);\n\n  return allowedOrigins.some(allowed => normalizeOrigin(allowed) === normalized);\n}\n\n/**\n * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):\n * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the\n * request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused\n * otherwise, including when BOTH headers are absent (fail closed).\n *\n * Callers decide WHETHER a request is in scope for this check at all (a\n * cookie-sourced credential / a non-locale cookie, an unsafe method, no route\n * exemption) — this function only answers the Origin/Referer question once a\n * caller has already decided the check applies.\n */\nexport function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict {\n  const origin = request.origin;\n\n  if (origin) {\n    return isAllowedCsrfOrigin(origin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"origin-mismatch\" };\n  }\n\n  const referer = request.header(\"referer\");\n  const refererOrigin = typeof referer === \"string\" ? originOf(referer) : undefined;\n\n  if (refererOrigin) {\n    return isAllowedCsrfOrigin(refererOrigin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"referer-mismatch\" };\n  }\n\n  return { allowed: false, reason: \"missing-origin-and-referer\" };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,UAAU,SAA0B;CAGlD,MAAM,cAAc,QAAQ,aAAa;CACzC,MAAM,aAAa,QAAQ,OAAO,MAAM;CACxC,MAAM,OACJ,OAAO,gBAAgB,YAAY,cAC/B,cACA,OAAO,eAAe,YAAY,aAChC,aACA,QAAQ;CAEhB,OAAO,GAAG,QAAQ,SAAS,KAAK;AAClC;;AAGA,SAAgB,SAAS,QAAoC;CAC3D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAE1B,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAwB;CACtD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,MAAM,gBACH,IAAI,aAAa,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,SAC7D,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;EAEjE,OAAO,GAAG,IAAI,SAAS,IAAI,gBAAgB,IAAI,WAAW,IAAI;CAChE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,oBAAoB,QAAgB,SAA2B;CAC7E,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,OAAO;CAE5E,MAAM,iBAA2B,OAAO,IAAI,4BAA4B,CAAC,CAAC;CAE1E,MAAM,aAAa,gBAAgB,MAAM;CAEzC,OAAO,eAAe,MAAK,YAAW,gBAAgB,OAAO,MAAM,UAAU;AAC/E;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,SAAqC;CAC5E,MAAM,SAAS,QAAQ;CAEvB,IAAI,QACF,OAAO,oBAAoB,QAAQ,OAAO,IACtC,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAkB;CAGlD,MAAM,UAAU,QAAQ,OAAO,SAAS;CACxC,MAAM,gBAAgB,OAAO,YAAY,WAAW,SAAS,OAAO,IAAI;CAExE,IAAI,eACF,OAAO,oBAAoB,eAAe,OAAO,IAC7C,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAmB;CAGnD,OAAO;EAAE,SAAS;EAAO,QAAQ;CAA6B;AAChE"}
+{"version":3,"file":"csrf-origin-policy.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"sourcesContent":["/**\n * The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the\n * one comparison every CSRF-Origin check in the framework must agree on.\n *\n * SECURITY, card 8a752ab2 (5.17). Extracted from\n * `@warlock.js/auth`'s `csrf-origin-check.ts` (the ONLY prior owner of this\n * logic) into `@warlock.js/core` so both call sites — the\n * `authMiddleware(\"cookie:*\")` check in `@warlock.js/auth` and the default\n * core HTTP-seam guard in `./csrf-default-guard.ts` — share ONE\n * implementation instead of drifting copies. `@warlock.js/core` cannot depend\n * on `@warlock.js/auth` (the dependency runs the other way), so the shared\n * logic had to move down into `core`, not up into a new shared package —\n * `auth`'s `csrf-origin-check.ts` now delegates to\n * {@link resolveCsrfOriginVerdict} instead of reimplementing it.\n *\n * Reads `auth.csrf.allowedOrigins` directly via `@mongez/config` (the exact\n * same config key `@warlock.js/auth`'s `authConfig.csrf.allowedOrigins()`\n * reads) rather than importing `@warlock.js/auth`, so an app's one\n * `auth.csrf.allowedOrigins` setting governs both checks without `core`\n * taking a hard dependency on `auth`.\n */\nimport config from \"@mongez/config\";\nimport type { Request } from \"./request\";\n\n/** Why {@link resolveCsrfOriginVerdict} refused a request. */\nexport type CsrfOriginCheckReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */\nexport type CsrfOriginVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: CsrfOriginCheckReason };\n\n/**\n * The request's own origin — what an `Origin`/`Referer` header must match.\n *\n * `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never\n * carries a port. A browser's `Origin` header on a non-default port (e.g. any\n * `warlock dev` session) does, so the port must come from the raw `Host`\n * header instead — core exposes no getter for that, so it is read directly\n * here.\n *\n * Trust-proxy-aware for free: `request.protocol` is Fastify's own\n * `request.protocol`, which already honours `http.trustProxy`\n * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this\n * function does not need its own proxy-trust logic on top of that.\n */\nexport function ownOrigin(request: Request): string {\n  // Fastify's `host` keeps the port and honours `X-Forwarded-Host` under\n  // `trustProxy`, so a proxy that rewrites `Host` does not break the match.\n  const fastifyHost = request.baseRequest?.host;\n  const hostHeader = request.header(\"host\");\n  const host =\n    typeof fastifyHost === \"string\" && fastifyHost\n      ? fastifyHost\n      : typeof hostHeader === \"string\" && hostHeader\n        ? hostHeader\n        : request.hostname;\n\n  return `${request.protocol}://${host}`;\n}\n\n/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */\nexport function originOf(rawUrl: string): string | undefined {\n  try {\n    const url = new URL(rawUrl);\n\n    return `${url.protocol}//${url.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Normalize an origin string (`scheme://host[:port]`) so that a default port\n * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin\n * written without a port. Falls back to the raw value if it does not parse\n * as a URL (in which case it will simply fail the exact-match comparison).\n */\nexport function normalizeOrigin(origin: string): string {\n  try {\n    const url = new URL(origin);\n    const isDefaultPort =\n      (url.protocol === \"http:\" && (url.port === \"\" || url.port === \"80\")) ||\n      (url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\"));\n\n    return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;\n  } catch {\n    return origin;\n  }\n}\n\n/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */\nexport function isAllowedCsrfOrigin(origin: string, request: Request): boolean {\n  if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;\n\n  const allowedOrigins: string[] = config.get(\"auth.csrf.allowedOrigins\", []);\n\n  const normalized = normalizeOrigin(origin);\n\n  return allowedOrigins.some((allowed) => normalizeOrigin(allowed) === normalized);\n}\n\n/**\n * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):\n * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the\n * request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused\n * otherwise, including when BOTH headers are absent (fail closed).\n *\n * Callers decide WHETHER a request is in scope for this check at all (a\n * cookie-sourced credential / a non-locale cookie, an unsafe method, no route\n * exemption) — this function only answers the Origin/Referer question once a\n * caller has already decided the check applies.\n */\nexport function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict {\n  const origin = request.origin;\n\n  if (origin) {\n    return isAllowedCsrfOrigin(origin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"origin-mismatch\" };\n  }\n\n  const referer = request.header(\"referer\");\n  const refererOrigin = typeof referer === \"string\" ? originOf(referer) : undefined;\n\n  if (refererOrigin) {\n    return isAllowedCsrfOrigin(refererOrigin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"referer-mismatch\" };\n  }\n\n  return { allowed: false, reason: \"missing-origin-and-referer\" };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,UAAU,SAA0B;CAGlD,MAAM,cAAc,QAAQ,aAAa;CACzC,MAAM,aAAa,QAAQ,OAAO,MAAM;CACxC,MAAM,OACJ,OAAO,gBAAgB,YAAY,cAC/B,cACA,OAAO,eAAe,YAAY,aAChC,aACA,QAAQ;CAEhB,OAAO,GAAG,QAAQ,SAAS,KAAK;AAClC;;AAGA,SAAgB,SAAS,QAAoC;CAC3D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAE1B,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAwB;CACtD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,MAAM,gBACH,IAAI,aAAa,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,SAC7D,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;EAEjE,OAAO,GAAG,IAAI,SAAS,IAAI,gBAAgB,IAAI,WAAW,IAAI;CAChE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,oBAAoB,QAAgB,SAA2B;CAC7E,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,OAAO;CAE5E,MAAM,iBAA2BA,WAAO,IAAI,4BAA4B,CAAC,CAAC;CAE1E,MAAM,aAAa,gBAAgB,MAAM;CAEzC,OAAO,eAAe,MAAM,YAAY,gBAAgB,OAAO,MAAM,UAAU;AACjF;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,SAAqC;CAC5E,MAAM,SAAS,QAAQ;CAEvB,IAAI,QACF,OAAO,oBAAoB,QAAQ,OAAO,IACtC,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAkB;CAGlD,MAAM,UAAU,QAAQ,OAAO,SAAS;CACxC,MAAM,gBAAgB,OAAO,YAAY,WAAW,SAAS,OAAO,IAAI;CAExE,IAAI,eACF,OAAO,oBAAoB,eAAe,OAAO,IAC7C,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAmB;CAGnD,OAAO;EAAE,SAAS;EAAO,QAAQ;CAA6B;AAChE"}

package/esm/http/database/RequestLog.d.mts

@@ -1,67 +1,36 @@
 import { Infer } from "@warlock.js/seal";
 import { Model } from "@warlock.js/cascade";
-
 //#region ../../packages/core/src/http/database/RequestLog.d.ts
 declare const schema: import("@warlock.js/seal").ObjectValidator<{
   statusCode: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
   responseTime: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
   responseSize: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-  responseBody: import("@warlock.js/seal").RecordValidator & {
+  responseBody: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  responseHeaders: import("@warlock.js/seal").RecordValidator & {
+  };
+  responseHeaders: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
+  };
   ip: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   method: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   route: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  requestHeaders: import("@warlock.js/seal").RecordValidator & {
+  requestHeaders: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
+  };
   userAgent: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   referer: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  requestBody: import("@warlock.js/seal").RecordValidator & {
+  requestBody: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  requestParams: import("@warlock.js/seal").RecordValidator & {
+  };
+  requestParams: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  requestQuery: import("@warlock.js/seal").RecordValidator & {
+  };
+  requestQuery: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-}> & import("@warlock.js/seal").StandardSchemaV1<{
-  statusCode: number;
-  responseTime: number;
-  responseSize: number;
-  responseBody: Record<string, any>;
-  responseHeaders: Record<string, any>;
-  ip: string;
-  method: string;
-  route: string;
-  requestHeaders: Record<string, any>;
-  userAgent: string;
-  referer: string;
-  requestBody: Record<string, any>;
-  requestParams: Record<string, any>;
-  requestQuery: Record<string, any>;
-}, {
-  statusCode: number;
-  responseTime: number;
-  responseSize: number;
-  responseBody: Record<string, any>;
-  responseHeaders: Record<string, any>;
-  ip: string;
-  method: string;
-  route: string;
-  requestHeaders: Record<string, any>;
-  userAgent: string;
-  referer: string;
-  requestBody: Record<string, any>;
-  requestParams: Record<string, any>;
-  requestQuery: Record<string, any>;
+  };
 }>;
 type RequestLogSchema = Infer.Output<typeof schema>;
-declare class RequestLog extends Model<RequestLogSchema> {
+export declare class RequestLog extends Model<RequestLogSchema> {
   /**
    * {@inheritdoc}
    */
@@ -73,61 +42,31 @@ declare class RequestLog extends Model<RequestLogSchema> {
     statusCode: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
     responseTime: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
     responseSize: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-    responseBody: import("@warlock.js/seal").RecordValidator & {
+    responseBody: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    responseHeaders: import("@warlock.js/seal").RecordValidator & {
+    };
+    responseHeaders: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
+    };
     ip: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     method: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     route: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    requestHeaders: import("@warlock.js/seal").RecordValidator & {
+    requestHeaders: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
+    };
     userAgent: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     referer: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    requestBody: import("@warlock.js/seal").RecordValidator & {
+    requestBody: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    requestParams: import("@warlock.js/seal").RecordValidator & {
+    };
+    requestParams: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-    requestQuery: import("@warlock.js/seal").RecordValidator & {
+    };
+    requestQuery: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>>;
-  }> & import("@warlock.js/seal").StandardSchemaV1<{
-    statusCode: number;
-    responseTime: number;
-    responseSize: number;
-    responseBody: Record<string, any>;
-    responseHeaders: Record<string, any>;
-    ip: string;
-    method: string;
-    route: string;
-    requestHeaders: Record<string, any>;
-    userAgent: string;
-    referer: string;
-    requestBody: Record<string, any>;
-    requestParams: Record<string, any>;
-    requestQuery: Record<string, any>;
-  }, {
-    statusCode: number;
-    responseTime: number;
-    responseSize: number;
-    responseBody: Record<string, any>;
-    responseHeaders: Record<string, any>;
-    ip: string;
-    method: string;
-    route: string;
-    requestHeaders: Record<string, any>;
-    userAgent: string;
-    referer: string;
-    requestBody: Record<string, any>;
-    requestParams: Record<string, any>;
-    requestQuery: Record<string, any>;
+    };
   }>;
 }
 //#endregion
-export { RequestLog };
+export {};
 //# sourceMappingURL=RequestLog.d.mts.map

package/esm/http/database/RequestLog.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"RequestLog.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/database/RequestLog.ts"],"mappings":";;;;cAGM,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiBP,gBAAA,GAAmB,KAAA,CAAM,MAAM,QAAQ,MAAA;AAAA,cAE/B,UAAA,SAAmB,KAAA,CAAM,gBAAA;;;;SAItB,KAAA;;;;SAKA,MAAA,6BAAM,eAAA"}
+{"version":3,"file":"RequestLog.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/database/RequestLog.ts"],"mappings":";;;cAGM,mCAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiBP,mBAAmB,MAAM,cAAc;qBAE/B,mBAAmB,MAAM;;;;SAItB;;;;SAKA,mCAAM"}

package/esm/http/error-codes.d.mts

@@ -8,7 +8,7 @@
  * Range `EC100..EC199` is reserved for `@warlock.js/core` HTTP middleware.
  * `EC001..EC099` belongs to `@warlock.js/auth`.
  */
-declare enum HttpErrorCodes {
+export declare enum HttpErrorCodes {
   /**
    * Same idempotency key reused with a different request body.
    * Client likely has a bug — same intent must reuse the same body.
@@ -53,5 +53,4 @@ declare enum HttpErrorCodes {
   CsrfOriginMismatch = "EC006"
 }
 //#endregion
-export { HttpErrorCodes };
 //# sourceMappingURL=error-codes.d.mts.map

package/esm/http/error-codes.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/error-codes.ts"],"mappings":";;AASA;;;;;;;;aAAY,cAAA;EA8BV;;;;EAzBA,sBAAA;;;;EAKA,qBAAA;;;;EAKA,iBAAA;;;;EAKA,uBAAA;;;;EAKA,YAAA;;;;EAKA,WAAA;;;;EAKA,WAAA;;;;;;;;;;;;;EAcA,kBAAA;AAAA"}
+{"version":3,"file":"error-codes.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/error-codes.ts"],"mappings":";;;;;;;;;;oBASY;;;;;EAKV;;;;EAKA;;;;EAKA;;;;EAKA;;;;EAKA;;;;EAKA;;;;EAKA;;;;;;;;;;;;;EAcA"}

package/esm/http/error-mapper.d.mts

@@ -1,11 +1,10 @@
 import { HttpError } from "./errors/errors.mjs";
 import { Request } from "./request.mjs";
-
 //#region ../../packages/core/src/http/error-mapper.d.ts
 /**
  * What an {@link HttpErrorMapper} answers for an error it recognises.
  */
-type HttpErrorMapping = {
+export type HttpErrorMapping = {
   /**
    * The HTTP status to answer with.
    */
@@ -42,7 +41,6 @@ type HttpErrorMapping = {
  * }
  * ```
  */
-type HttpErrorMapper = (error: unknown, request: Request<any>) => HttpErrorMapping | HttpError | null | undefined;
+export type HttpErrorMapper = (error: unknown, request: Request<any>) => HttpErrorMapping | HttpError | null | undefined;
 //#endregion
-export { HttpErrorMapper, HttpErrorMapping };
 //# sourceMappingURL=error-mapper.d.mts.map

package/esm/http/error-mapper.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"error-mapper.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/error-mapper.ts"],"mappings":";;;;;;AAQA;KAAY,gBAAA;;;;EAIV,MAAA;EAUA;;AAAO;AAwBT;;EA5BE,OAAA;EA8BS;;;EA1BT,OAAA;AAAA;;;;;;;AA2B+B;;;;;;;;;;;;;;;KAHrB,eAAA,IACV,KAAA,WACA,OAAA,EAAS,OAAA,UACN,gBAAA,GAAmB,SAAA"}
+{"version":3,"file":"error-mapper.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/error-mapper.ts"],"mappings":";;;;;;YAQY;;;;EAIV;;;;;;EAMA;;;;EAIA;;;;;;;;;;;;;;;;;;;;;;;YAwBU,mBACV,gBACA,SAAS,iBACN,mBAAmB"}

package/esm/http/error-mapper.mjs

@@ -1,5 +1,5 @@
 import { HttpError } from "./errors/errors.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { log } from "@warlock.js/logger";
 
 //#region ../../packages/core/src/http/error-mapper.ts
@@ -17,7 +17,7 @@ const OPAQUE_SERVER_ERROR = "Internal server error.";
 */
 function mapRequestError(error, request) {
 	if (error instanceof HttpError) return error;
-	const mapper = config.get("http.errorMapper");
+	const mapper = baseConfig.get("http.errorMapper");
 	if (typeof mapper !== "function") return error;
 	let mapping;
 	try {