@warlock.js/core 5.30.0 → 5.32.0

package/esm/http/error-mapper.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error-mapper.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/error-mapper.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { HttpError } from \"./errors\";\nimport type { Request } from \"./request\";\n\n/**\n * What an {@link HttpErrorMapper} answers for an error it recognises.\n */\nexport type HttpErrorMapping = {\n  /**\n   * The HTTP status to answer with.\n   */\n  status: number;\n  /**\n   * The message sent as `{ error }`. Defaults to the original error's message\n   * for a 4xx and to the opaque `\"Internal server error.\"` for a 5xx, so a\n   * mapped server fault never echoes an internal message to the client.\n   */\n  message?: string;\n  /**\n   * Sent as `{ payload }`, like `HttpError.payload`.\n   */\n  payload?: unknown;\n};\n\n/**\n * `http.errorMapper`: turns an error thrown by middleware or a handler into an\n * HTTP answer. Lets domain errors that must also exist outside an HTTP process\n * (a worker, a CLI, a standalone helper) carry a status without extending\n * Core's `HttpError`.\n *\n * Called only for errors that are not already an `HttpError`. Return a\n * mapping (or an `HttpError`) to answer with it, or `undefined` to keep the\n * default handling (a model validation error keeps its configured status,\n * anything else is an opaque 500).\n *\n * @example\n * ```ts\n * errorMapper(error) {\n *   if (error instanceof DomainNotFoundError) return { status: 404 };\n *   if (error instanceof Error && typeof (error as any).status === \"number\") {\n *     return { status: (error as any).status };\n *   }\n * }\n * ```\n */\nexport type HttpErrorMapper = (\n  error: unknown,\n  request: Request<any>,\n) => HttpErrorMapping | HttpError | null | undefined;\n\nconst OPAQUE_SERVER_ERROR = \"Internal server error.\";\n\n/**\n * Run the configured `http.errorMapper` and normalise its answer to an\n * `HttpError`, or return the error unchanged when there is no mapper, the\n * error already is an `HttpError`, or the mapper declines it.\n *\n * The mapped `HttpError` keeps the original error's name and stack (for the\n * request log) and carries it as `cause`. A mapper that throws is a bug in the\n * app's mapper, not in the request: it is logged and the original error is\n * handled as if no mapper were configured.\n * @internal\n */\nexport function mapRequestError(error: unknown, request: Request<any>): unknown {\n  if (error instanceof HttpError) {\n    return error;\n  }\n\n  const mapper = config.get(\"http.errorMapper\") as HttpErrorMapper | undefined;\n\n  if (typeof mapper !== \"function\") {\n    return error;\n  }\n\n  let mapping: ReturnType<HttpErrorMapper>;\n\n  try {\n    mapping = mapper(error, request);\n  } catch (mapperError) {\n    log.error(\"http\", \"error-mapper\", mapperError, { requestId: request.id });\n\n    return error;\n  }\n\n  if (!mapping) {\n    return error;\n  }\n\n  if (mapping instanceof HttpError) {\n    return mapping;\n  }\n\n  if (!Number.isInteger(mapping.status) || mapping.status < 400 || mapping.status > 599) {\n    log.error(\n      \"http\",\n      \"error-mapper\",\n      new Error(`http.errorMapper returned an invalid status: ${String(mapping.status)}`),\n      { requestId: request.id },\n    );\n\n    return error;\n  }\n\n  const original = error instanceof Error ? error : undefined;\n  const message =\n    mapping.message ?? (mapping.status < 500 && original ? original.message : OPAQUE_SERVER_ERROR);\n\n  const mapped = new HttpError(mapping.status, message, mapping.payload);\n\n  if (original) {\n    mapped.name = original.name;\n    mapped.stack = original.stack;\n    mapped.cause = original;\n  }\n\n  return mapped;\n}\n"],"mappings":";;;;;AAmDA,MAAM,sBAAsB;;;;;;;;;;;;AAa5B,SAAgB,gBAAgB,OAAgB,SAAgC;CAC9E,IAAI,iBAAiB,WACnB,OAAO;CAGT,MAAM,SAAS,OAAO,IAAI,kBAAkB;CAE5C,IAAI,OAAO,WAAW,YACpB,OAAO;CAGT,IAAI;CAEJ,IAAI;EACF,UAAU,OAAO,OAAO,OAAO;CACjC,SAAS,aAAa;EACpB,IAAI,MAAM,QAAQ,gBAAgB,aAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;EAExE,OAAO;CACT;CAEA,IAAI,CAAC,SACH,OAAO;CAGT,IAAI,mBAAmB,WACrB,OAAO;CAGT,IAAI,CAAC,OAAO,UAAU,QAAQ,MAAM,KAAK,QAAQ,SAAS,OAAO,QAAQ,SAAS,KAAK;EACrF,IAAI,MACF,QACA,gCACA,IAAI,MAAM,gDAAgD,OAAO,QAAQ,MAAM,GAAG,GAClF,EAAE,WAAW,QAAQ,GAAG,CAC1B;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,iBAAiB,QAAQ,QAAQ;CAClD,MAAM,UACJ,QAAQ,YAAY,QAAQ,SAAS,OAAO,WAAW,SAAS,UAAU;CAE5E,MAAM,SAAS,IAAI,UAAU,QAAQ,QAAQ,SAAS,QAAQ,OAAO;CAErE,IAAI,UAAU;EACZ,OAAO,OAAO,SAAS;EACvB,OAAO,QAAQ,SAAS;EACxB,OAAO,QAAQ;CACjB;CAEA,OAAO;AACT"}
+{"version":3,"file":"error-mapper.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/error-mapper.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { HttpError } from \"./errors\";\nimport type { Request } from \"./request\";\n\n/**\n * What an {@link HttpErrorMapper} answers for an error it recognises.\n */\nexport type HttpErrorMapping = {\n  /**\n   * The HTTP status to answer with.\n   */\n  status: number;\n  /**\n   * The message sent as `{ error }`. Defaults to the original error's message\n   * for a 4xx and to the opaque `\"Internal server error.\"` for a 5xx, so a\n   * mapped server fault never echoes an internal message to the client.\n   */\n  message?: string;\n  /**\n   * Sent as `{ payload }`, like `HttpError.payload`.\n   */\n  payload?: unknown;\n};\n\n/**\n * `http.errorMapper`: turns an error thrown by middleware or a handler into an\n * HTTP answer. Lets domain errors that must also exist outside an HTTP process\n * (a worker, a CLI, a standalone helper) carry a status without extending\n * Core's `HttpError`.\n *\n * Called only for errors that are not already an `HttpError`. Return a\n * mapping (or an `HttpError`) to answer with it, or `undefined` to keep the\n * default handling (a model validation error keeps its configured status,\n * anything else is an opaque 500).\n *\n * @example\n * ```ts\n * errorMapper(error) {\n *   if (error instanceof DomainNotFoundError) return { status: 404 };\n *   if (error instanceof Error && typeof (error as any).status === \"number\") {\n *     return { status: (error as any).status };\n *   }\n * }\n * ```\n */\nexport type HttpErrorMapper = (\n  error: unknown,\n  request: Request<any>,\n) => HttpErrorMapping | HttpError | null | undefined;\n\nconst OPAQUE_SERVER_ERROR = \"Internal server error.\";\n\n/**\n * Run the configured `http.errorMapper` and normalise its answer to an\n * `HttpError`, or return the error unchanged when there is no mapper, the\n * error already is an `HttpError`, or the mapper declines it.\n *\n * The mapped `HttpError` keeps the original error's name and stack (for the\n * request log) and carries it as `cause`. A mapper that throws is a bug in the\n * app's mapper, not in the request: it is logged and the original error is\n * handled as if no mapper were configured.\n * @internal\n */\nexport function mapRequestError(error: unknown, request: Request<any>): unknown {\n  if (error instanceof HttpError) {\n    return error;\n  }\n\n  const mapper = config.get(\"http.errorMapper\") as HttpErrorMapper | undefined;\n\n  if (typeof mapper !== \"function\") {\n    return error;\n  }\n\n  let mapping: ReturnType<HttpErrorMapper>;\n\n  try {\n    mapping = mapper(error, request);\n  } catch (mapperError) {\n    log.error(\"http\", \"error-mapper\", mapperError, { requestId: request.id });\n\n    return error;\n  }\n\n  if (!mapping) {\n    return error;\n  }\n\n  if (mapping instanceof HttpError) {\n    return mapping;\n  }\n\n  if (!Number.isInteger(mapping.status) || mapping.status < 400 || mapping.status > 599) {\n    log.error(\n      \"http\",\n      \"error-mapper\",\n      new Error(`http.errorMapper returned an invalid status: ${String(mapping.status)}`),\n      { requestId: request.id },\n    );\n\n    return error;\n  }\n\n  const original = error instanceof Error ? error : undefined;\n  const message =\n    mapping.message ?? (mapping.status < 500 && original ? original.message : OPAQUE_SERVER_ERROR);\n\n  const mapped = new HttpError(mapping.status, message, mapping.payload);\n\n  if (original) {\n    mapped.name = original.name;\n    mapped.stack = original.stack;\n    mapped.cause = original;\n  }\n\n  return mapped;\n}\n"],"mappings":";;;;;AAmDA,MAAM,sBAAsB;;;;;;;;;;;;AAa5B,SAAgB,gBAAgB,OAAgB,SAAgC;CAC9E,IAAI,iBAAiB,WACnB,OAAO;CAGT,MAAM,SAASA,WAAO,IAAI,kBAAkB;CAE5C,IAAI,OAAO,WAAW,YACpB,OAAO;CAGT,IAAI;CAEJ,IAAI;EACF,UAAU,OAAO,OAAO,OAAO;CACjC,SAAS,aAAa;EACpB,IAAI,MAAM,QAAQ,gBAAgB,aAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;EAExE,OAAO;CACT;CAEA,IAAI,CAAC,SACH,OAAO;CAGT,IAAI,mBAAmB,WACrB,OAAO;CAGT,IAAI,CAAC,OAAO,UAAU,QAAQ,MAAM,KAAK,QAAQ,SAAS,OAAO,QAAQ,SAAS,KAAK;EACrF,IAAI,MACF,QACA,gCACA,IAAI,MAAM,gDAAgD,OAAO,QAAQ,MAAM,GAAG,GAClF,EAAE,WAAW,QAAQ,GAAG,CAC1B;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,iBAAiB,QAAQ,QAAQ;CAClD,MAAM,UACJ,QAAQ,YAAY,QAAQ,SAAS,OAAO,WAAW,SAAS,UAAU;CAE5E,MAAM,SAAS,IAAI,UAAU,QAAQ,QAAQ,SAAS,QAAQ,OAAO;CAErE,IAAI,UAAU;EACZ,OAAO,OAAO,SAAS;EACvB,OAAO,QAAQ,SAAS;EACxB,OAAO,QAAQ;CACjB;CAEA,OAAO;AACT"}

package/esm/http/errors/errors.d.mts

@@ -1,41 +1,41 @@
 //#region ../../packages/core/src/http/errors/errors.d.ts
-declare class HttpError extends Error {
+export declare class HttpError extends Error {
   status: number;
   message: string;
-  payload?: any | undefined;
-  constructor(status: number, message: string, payload?: any | undefined);
+  payload?: any;
+  constructor(status: number, message: string, payload?: any);
 }
-declare class ResourceNotFoundError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class ResourceNotFoundError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class UnAuthorizedError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class UnAuthorizedError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class ForbiddenError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class ForbiddenError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class BadRequestError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class BadRequestError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class ServerError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class ServerError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class ConflictError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class ConflictError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class NotAcceptableError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class NotAcceptableError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class NotAllowedError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class NotAllowedError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
 /**
  * Thrown by `Request.prototype.cookie` / `Request.prototype.hasCookie` when
@@ -49,9 +49,10 @@ declare class NotAllowedError extends HttpError {
  * stays lenient because the framework's own opportunistic reads (e.g.
  * locale resolution) must not throw on a request that simply has no jar.
  */
-declare class CookieJarUnavailableError extends Error {
+export declare class CookieJarUnavailableError extends Error {
+  /** Stable Warlock error code; `warlock explain WL5001` prints the fix. */
+  readonly code = "WL5001";
   constructor(cookieName: string);
 }
 //#endregion
-export { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError };
 //# sourceMappingURL=errors.d.mts.map

package/esm/http/errors/errors.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/errors/errors.ts"],"mappings":";cAAa,SAAA,SAAkB,KAAK;EAEzB,MAAA;EACA,OAAA;EACA,OAAA;cAFA,MAAA,UACA,OAAA,UACA,OAAA;AAAA;AAAA,cAOE,qBAAA,SAA8B,SAAS;EAGzC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,iBAAA,SAA0B,SAAS;EAGrC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,cAAA,SAAuB,SAAS;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,WAAA,SAAoB,SAAS;EAG/B,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,aAAA,SAAsB,SAAS;EAGjC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,kBAAA,SAA2B,SAAS;EAGtC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;;;;;;;;;;AAlDa;AAOxB;;cA8Da,yBAAA,SAAkC,KAAK;cAC/B,UAAA;AAAA"}
+{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/errors/errors.ts"],"mappings":";qBAAa,kBAAkB;EAEpB;EACA;EACA;EAHT,YACS,gBACA,iBACA;;qBAOE,8BAA8B;EAGhC;EAFT,YACE,iBACO;;qBAOE,0BAA0B;EAG5B;EAFT,YACE,iBACO;;qBAOE,uBAAuB;EAGzB;EAFT,YACE,iBACO;;qBAOE,wBAAwB;EAG1B;EAFT,YACE,iBACO;;qBAOE,oBAAoB;EAGtB;EAFT,YACE,iBACO;;qBAOE,sBAAsB;EAGxB;EAFT,YACE,iBACO;;qBAOE,2BAA2B;EAG7B;EAFT,YACE,iBACO;;qBAOE,wBAAwB;EAG1B;EAFT,YACE,iBACO;;;;;;;;;;;;;;qBAmBE,kCAAkC;;WAE7B;EAEhB,YAAmB"}

package/esm/http/errors/errors.mjs

@@ -79,6 +79,7 @@ var NotAllowedError = class extends HttpError {
 var CookieJarUnavailableError = class extends Error {
 	constructor(cookieName) {
 		super(`Cannot read cookie "${cookieName}": the cookie jar is unavailable because @fastify/cookie is not registered on this Fastify instance. Register the plugin (see core's http/plugins.ts) before reading cookies by name.`);
+		this.code = "WL5001";
 		this.name = "CookieJarUnavailableError";
 	}
 };

package/esm/http/errors/errors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/errors/errors.ts"],"sourcesContent":["export class HttpError extends Error {\n  public constructor(\n    public status: number,\n    public message: string,\n    public payload?: any,\n  ) {\n    super(message);\n    this.name = \"HttpError\";\n  }\n}\n\nexport class ResourceNotFoundError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(404, message, payload);\n    this.name = \"ResourceNotFoundError\";\n  }\n}\n\nexport class UnAuthorizedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(401, message, payload);\n    this.name = \"UnAuthorizedError\";\n  }\n}\n\nexport class ForbiddenError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(403, message, payload);\n    this.name = \"ForbiddenError\";\n  }\n}\n\nexport class BadRequestError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(400, message, payload);\n    this.name = \"BadRequestError\";\n  }\n}\n\nexport class ServerError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(500, message, payload);\n    this.name = \"ServerError\";\n  }\n}\n\nexport class ConflictError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(409, message, payload);\n    this.name = \"ConflictError\";\n  }\n}\n\nexport class NotAcceptableError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(406, message, payload);\n    this.name = \"NotAcceptableError\";\n  }\n}\n\nexport class NotAllowedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(405, message, payload);\n    this.name = \"NotAllowedError\";\n  }\n}\n\n/**\n * Thrown by `Request.prototype.cookie` / `Request.prototype.hasCookie` when\n * `@fastify/cookie` was never registered on this Fastify instance, so\n * `baseRequest.cookies` is `undefined` rather than an (possibly empty) object.\n *\n * A by-name cookie read is a deliberate assertion by the caller — \"this\n * cookie should be readable here\" — so an unavailable jar is a configuration\n * fault, not an absent cookie, and must not be swallowed into a default\n * value or a silent `false`. Contrast `Request.prototype.cookies`, which\n * stays lenient because the framework's own opportunistic reads (e.g.\n * locale resolution) must not throw on a request that simply has no jar.\n */\nexport class CookieJarUnavailableError extends Error {\n  public constructor(cookieName: string) {\n    super(\n      `Cannot read cookie \"${cookieName}\": the cookie jar is unavailable because ` +\n        \"@fastify/cookie is not registered on this Fastify instance. \" +\n        \"Register the plugin (see core's http/plugins.ts) before reading cookies by name.\",\n    );\n\n    this.name = \"CookieJarUnavailableError\";\n  }\n}\n"],"mappings":";AAAA,IAAa,YAAb,cAA+B,MAAM;CACnC,AAAO,YACL,AAAO,QACP,AAAO,SACP,AAAO,SACP;EACA,MAAM,OAAO;EAJN;EACA;EACA;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,wBAAb,cAA2C,UAAU;CACnD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,UAAU;CAC5C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,cAAb,cAAiC,UAAU;CACzC,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,UAAU;CAC3C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;AAcA,IAAa,4BAAb,cAA+C,MAAM;CACnD,AAAO,YAAY,YAAoB;EACrC,MACE,uBAAuB,WAAW,sLAGpC;EAEA,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/errors/errors.ts"],"sourcesContent":["export class HttpError extends Error {\n  public constructor(\n    public status: number,\n    public message: string,\n    public payload?: any,\n  ) {\n    super(message);\n    this.name = \"HttpError\";\n  }\n}\n\nexport class ResourceNotFoundError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(404, message, payload);\n    this.name = \"ResourceNotFoundError\";\n  }\n}\n\nexport class UnAuthorizedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(401, message, payload);\n    this.name = \"UnAuthorizedError\";\n  }\n}\n\nexport class ForbiddenError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(403, message, payload);\n    this.name = \"ForbiddenError\";\n  }\n}\n\nexport class BadRequestError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(400, message, payload);\n    this.name = \"BadRequestError\";\n  }\n}\n\nexport class ServerError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(500, message, payload);\n    this.name = \"ServerError\";\n  }\n}\n\nexport class ConflictError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(409, message, payload);\n    this.name = \"ConflictError\";\n  }\n}\n\nexport class NotAcceptableError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(406, message, payload);\n    this.name = \"NotAcceptableError\";\n  }\n}\n\nexport class NotAllowedError extends HttpError {\n  public constructor(\n    message: string,\n    public payload?: any,\n  ) {\n    super(405, message, payload);\n    this.name = \"NotAllowedError\";\n  }\n}\n\n/**\n * Thrown by `Request.prototype.cookie` / `Request.prototype.hasCookie` when\n * `@fastify/cookie` was never registered on this Fastify instance, so\n * `baseRequest.cookies` is `undefined` rather than an (possibly empty) object.\n *\n * A by-name cookie read is a deliberate assertion by the caller — \"this\n * cookie should be readable here\" — so an unavailable jar is a configuration\n * fault, not an absent cookie, and must not be swallowed into a default\n * value or a silent `false`. Contrast `Request.prototype.cookies`, which\n * stays lenient because the framework's own opportunistic reads (e.g.\n * locale resolution) must not throw on a request that simply has no jar.\n */\nexport class CookieJarUnavailableError extends Error {\n  /** Stable Warlock error code; `warlock explain WL5001` prints the fix. */\n  public readonly code = \"WL5001\";\n\n  public constructor(cookieName: string) {\n    super(\n      `Cannot read cookie \"${cookieName}\": the cookie jar is unavailable because ` +\n        \"@fastify/cookie is not registered on this Fastify instance. \" +\n        \"Register the plugin (see core's http/plugins.ts) before reading cookies by name.\",\n    );\n\n    this.name = \"CookieJarUnavailableError\";\n  }\n}\n"],"mappings":";AAAA,IAAa,YAAb,cAA+B,MAAM;CACnC,AAAO,YACL,AAAO,QACP,AAAO,SACP,AAAO,SACP;EACA,MAAM,OAAO;EAJN;EACA;EACA;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,wBAAb,cAA2C,UAAU;CACnD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,UAAU;CAC5C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,cAAb,cAAiC,UAAU;CACzC,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,UAAU;CAC3C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;AAEA,IAAa,kBAAb,cAAqC,UAAU;CAC7C,AAAO,YACL,SACA,AAAO,SACP;EACA,MAAM,KAAK,SAAS,OAAO;EAFpB;EAGP,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;AAcA,IAAa,4BAAb,cAA+C,MAAM;CAInD,AAAO,YAAY,YAAoB;EACrC,MACE,uBAAuB,WAAW,sLAGpC;cAPqB;EASrB,KAAK,OAAO;CACd;AACF"}

package/esm/http/escape-header-value.d.mts

@@ -0,0 +1,17 @@
+//#region ../../packages/core/src/http/escape-header-value.d.ts
+/**
+ * Make any value safe to send as an HTTP header value: CR, LF, NUL and other
+ * control characters (except tab) are removed, so input cannot split the
+ * header or inject another one, characters outside ISO-8859-1 become `?`, and
+ * surrounding whitespace is trimmed.
+ *
+ * Node already refuses a header value with CR/LF, but by throwing — which
+ * turns a crafted value into a 500. Escape values built from request input or
+ * stored user data before `response.header()`:
+ *
+ * @example
+ * response.header("X-Export-Name", escapeHeaderValue(request.input("name")));
+ */
+export declare function escapeHeaderValue(value: unknown): string;
+//#endregion
+//# sourceMappingURL=escape-header-value.d.mts.map

package/esm/http/escape-header-value.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape-header-value.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/escape-header-value.ts"],"mappings":";;;;;;;;;;;;;;wBAsBgB,kBAAkB"}

package/esm/http/escape-header-value.mjs

@@ -0,0 +1,27 @@
+//#region ../../packages/core/src/http/escape-header-value.ts
+/**
+* Characters Node refuses in a header value (`ERR_INVALID_CHAR`): control
+* characters other than horizontal tab, and anything outside ISO-8859-1.
+*/
+const FORBIDDEN_CONTROL = /[\u0000-\u0008\u000a-\u001f\u007f]/g;
+const OUTSIDE_LATIN1 = /[\u{100}-\u{10ffff}]/gu;
+/**
+* Make any value safe to send as an HTTP header value: CR, LF, NUL and other
+* control characters (except tab) are removed, so input cannot split the
+* header or inject another one, characters outside ISO-8859-1 become `?`, and
+* surrounding whitespace is trimmed.
+*
+* Node already refuses a header value with CR/LF, but by throwing — which
+* turns a crafted value into a 500. Escape values built from request input or
+* stored user data before `response.header()`:
+*
+* @example
+* response.header("X-Export-Name", escapeHeaderValue(request.input("name")));
+*/
+function escapeHeaderValue(value) {
+	return (typeof value === "string" ? value : String(value)).replace(FORBIDDEN_CONTROL, "").replace(OUTSIDE_LATIN1, "?").trim();
+}
+
+//#endregion
+export { escapeHeaderValue };
+//# sourceMappingURL=escape-header-value.mjs.map

package/esm/http/escape-header-value.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape-header-value.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/escape-header-value.ts"],"sourcesContent":["/**\n * Characters Node refuses in a header value (`ERR_INVALID_CHAR`): control\n * characters other than horizontal tab, and anything outside ISO-8859-1.\n */\n// oxlint-disable-next-line eslint/no-control-regex -- removing control characters is the point.\nconst FORBIDDEN_CONTROL = /[\\u0000-\\u0008\\u000a-\\u001f\\u007f]/g;\n\nconst OUTSIDE_LATIN1 = /[\\u{100}-\\u{10ffff}]/gu;\n\n/**\n * Make any value safe to send as an HTTP header value: CR, LF, NUL and other\n * control characters (except tab) are removed, so input cannot split the\n * header or inject another one, characters outside ISO-8859-1 become `?`, and\n * surrounding whitespace is trimmed.\n *\n * Node already refuses a header value with CR/LF, but by throwing — which\n * turns a crafted value into a 500. Escape values built from request input or\n * stored user data before `response.header()`:\n *\n * @example\n * response.header(\"X-Export-Name\", escapeHeaderValue(request.input(\"name\")));\n */\nexport function escapeHeaderValue(value: unknown): string {\n  const text = typeof value === \"string\" ? value : String(value);\n\n  return text.replace(FORBIDDEN_CONTROL, \"\").replace(OUTSIDE_LATIN1, \"?\").trim();\n}\n"],"mappings":";;;;;AAKA,MAAM,oBAAoB;AAE1B,MAAM,iBAAiB;;;;;;;;;;;;;;AAevB,SAAgB,kBAAkB,OAAwB;CAGxD,QAFa,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK,EAElD,CAAC,QAAQ,mBAAmB,EAAE,CAAC,CAAC,QAAQ,gBAAgB,GAAG,CAAC,CAAC,KAAK;AAC/E"}

package/esm/http/events.d.mts

@@ -1,8 +1,6 @@
 import { Response } from "./response.mjs";
-
 //#region ../../packages/core/src/http/events.d.ts
-declare function logResponse(response: Response): void;
-declare function wrapResponseInDataKey(response: Response): void;
+export declare function logResponse(response: Response): void;
+export declare function wrapResponseInDataKey(response: Response): void;
 //#endregion
-export { logResponse, wrapResponseInDataKey };
 //# sourceMappingURL=events.d.mts.map

package/esm/http/events.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/events.ts"],"mappings":";;;iBAGgB,WAAA,CAAY,QAAkB,EAAR,QAAQ;AAAA,iBAoB9B,qBAAA,CAAsB,QAAkB,EAAR,QAAQ"}
+{"version":3,"file":"events.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/events.ts"],"mappings":";;wBAGgB,YAAY,UAAU;wBAoBtB,sBAAsB,UAAU"}

package/esm/http/flush-pending-cookies.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"flush-pending-cookies.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/flush-pending-cookies.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport type { FastifyReply } from \"fastify\";\n\ntype ParkedCookie = { name: string; value: string; opts?: Record<string, unknown> };\n\n/** The installed `@fastify/cookie` version, or undefined when it can't be resolved. */\nfunction installedCookiePluginVersion(): string | undefined {\n  try {\n    const require = createRequire(path.join(process.cwd(), \"noop.js\"));\n\n    return (require(require.resolve(\"@fastify/cookie/package.json\")) as { version?: string })\n      .version;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * `@fastify/cookie` only parks cookies set via `reply.setCookie()` in a map\n * keyed by a private symbol; it serialises them in its own `onSend` hook.\n * Raw-path writers (`raw.writeHead`) bypass `onSend`, so they must call this\n * right before writing headers.\n *\n * Serialises the parked cookies, appends them to the `set-cookie` header\n * (skipping any value already present) and clears the map so a later `onSend`\n * cannot send them twice.\n *\n * Throws when the plugin is registered but its parked-cookie symbol cannot be\n * found: silently doing nothing would drop every cookie on raw paths. Does\n * nothing when the plugin is not registered.\n */\nexport function flushPendingCookies(reply: FastifyReply): void {\n  const parkedSymbol = Object.getOwnPropertySymbols(reply).find(\n    symbol => symbol.description === \"fastify.reply.setCookies\",\n  );\n\n  if (!parkedSymbol) {\n    if (typeof (reply as { setCookie?: unknown }).setCookie !== \"function\") return;\n\n    const version = installedCookiePluginVersion();\n\n    throw new Error(\n      `@fastify/cookie's internal cookie storage changed: reply.setCookie exists but the \"fastify.reply.setCookies\" symbol was not found${\n        version ? ` (installed @fastify/cookie@${version})` : \"\"\n      }. Cookies set before a raw-path response would be lost; update flushPendingCookies for this version.`,\n    );\n  }\n\n  const parked = (reply as unknown as Record<symbol, Map<string, ParkedCookie> | null>)[\n    parkedSymbol\n  ];\n\n  if (!parked || parked.size === 0) return;\n\n  const serializeCookie = (\n    reply.server as unknown as {\n      serializeCookie?: (name: string, value: string, opts?: unknown) => string;\n    }\n  ).serializeCookie;\n\n  if (!serializeCookie) return;\n\n  const existing = reply.getHeader(\"set-cookie\");\n  const cookies: string[] =\n    existing === undefined ? [] : Array.isArray(existing) ? [...existing] : [String(existing)];\n\n  for (const cookie of parked.values()) {\n    const serialized = serializeCookie(cookie.name, cookie.value, cookie.opts);\n\n    if (!cookies.includes(serialized)) {\n      cookies.push(serialized);\n    }\n  }\n\n  reply.removeHeader(\"set-cookie\");\n  reply.header(\"set-cookie\", cookies);\n  parked.clear();\n}\n"],"mappings":";;;;;AAOA,SAAS,+BAAmD;CAC1D,IAAI;EACF,MAAM,UAAU,cAAc,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS,CAAC;EAEjE,OAAQ,QAAQ,QAAQ,QAAQ,8BAA8B,CAAC,CAAC,CAC7D;CACL,QAAQ;EACN;CACF;AACF;;;;;;;;;;;;;;;AAgBA,SAAgB,oBAAoB,OAA2B;CAC7D,MAAM,eAAe,OAAO,sBAAsB,KAAK,CAAC,CAAC,MACvD,WAAU,OAAO,gBAAgB,0BACnC;CAEA,IAAI,CAAC,cAAc;EACjB,IAAI,OAAQ,MAAkC,cAAc,YAAY;EAExE,MAAM,UAAU,6BAA6B;EAE7C,MAAM,IAAI,MACR,oIACE,UAAU,+BAA+B,QAAQ,KAAK,GACvD,qGACH;CACF;CAEA,MAAM,SAAU,MACd;CAGF,IAAI,CAAC,UAAU,OAAO,SAAS,GAAG;CAElC,MAAM,kBACJ,MAAM,OAGN;CAEF,IAAI,CAAC,iBAAiB;CAEtB,MAAM,WAAW,MAAM,UAAU,YAAY;CAC7C,MAAM,UACJ,aAAa,SAAY,CAAC,IAAI,MAAM,QAAQ,QAAQ,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,OAAO,QAAQ,CAAC;CAE3F,KAAK,MAAM,UAAU,OAAO,OAAO,GAAG;EACpC,MAAM,aAAa,gBAAgB,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI;EAEzE,IAAI,CAAC,QAAQ,SAAS,UAAU,GAC9B,QAAQ,KAAK,UAAU;CAE3B;CAEA,MAAM,aAAa,YAAY;CAC/B,MAAM,OAAO,cAAc,OAAO;CAClC,OAAO,MAAM;AACf"}
+{"version":3,"file":"flush-pending-cookies.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/flush-pending-cookies.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport type { FastifyReply } from \"fastify\";\n\ntype ParkedCookie = { name: string; value: string; opts?: Record<string, unknown> };\n\n/** The installed `@fastify/cookie` version, or undefined when it can't be resolved. */\nfunction installedCookiePluginVersion(): string | undefined {\n  try {\n    const require = createRequire(path.join(process.cwd(), \"noop.js\"));\n\n    return (require(require.resolve(\"@fastify/cookie/package.json\")) as { version?: string })\n      .version;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * `@fastify/cookie` only parks cookies set via `reply.setCookie()` in a map\n * keyed by a private symbol; it serialises them in its own `onSend` hook.\n * Raw-path writers (`raw.writeHead`) bypass `onSend`, so they must call this\n * right before writing headers.\n *\n * Serialises the parked cookies, appends them to the `set-cookie` header\n * (skipping any value already present) and clears the map so a later `onSend`\n * cannot send them twice.\n *\n * Throws when the plugin is registered but its parked-cookie symbol cannot be\n * found: silently doing nothing would drop every cookie on raw paths. Does\n * nothing when the plugin is not registered.\n */\nexport function flushPendingCookies(reply: FastifyReply): void {\n  const parkedSymbol = Object.getOwnPropertySymbols(reply).find(\n    (symbol) => symbol.description === \"fastify.reply.setCookies\",\n  );\n\n  if (!parkedSymbol) {\n    if (typeof (reply as { setCookie?: unknown }).setCookie !== \"function\") return;\n\n    const version = installedCookiePluginVersion();\n\n    throw new Error(\n      `@fastify/cookie's internal cookie storage changed: reply.setCookie exists but the \"fastify.reply.setCookies\" symbol was not found${\n        version ? ` (installed @fastify/cookie@${version})` : \"\"\n      }. Cookies set before a raw-path response would be lost; update flushPendingCookies for this version.`,\n    );\n  }\n\n  const parked = (reply as unknown as Record<symbol, Map<string, ParkedCookie> | null>)[\n    parkedSymbol\n  ];\n\n  if (!parked || parked.size === 0) return;\n\n  const serializeCookie = (\n    reply.server as unknown as {\n      serializeCookie?: (name: string, value: string, opts?: unknown) => string;\n    }\n  ).serializeCookie;\n\n  if (!serializeCookie) return;\n\n  const existing = reply.getHeader(\"set-cookie\");\n  const cookies: string[] =\n    existing === undefined ? [] : Array.isArray(existing) ? [...existing] : [String(existing)];\n\n  for (const cookie of parked.values()) {\n    const serialized = serializeCookie(cookie.name, cookie.value, cookie.opts);\n\n    if (!cookies.includes(serialized)) {\n      cookies.push(serialized);\n    }\n  }\n\n  reply.removeHeader(\"set-cookie\");\n  reply.header(\"set-cookie\", cookies);\n  parked.clear();\n}\n"],"mappings":";;;;;AAOA,SAAS,+BAAmD;CAC1D,IAAI;EACF,MAAM,UAAU,cAAc,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS,CAAC;EAEjE,OAAQ,QAAQ,QAAQ,QAAQ,8BAA8B,CAAC,CAAC,CAC7D;CACL,QAAQ;EACN;CACF;AACF;;;;;;;;;;;;;;;AAgBA,SAAgB,oBAAoB,OAA2B;CAC7D,MAAM,eAAe,OAAO,sBAAsB,KAAK,CAAC,CAAC,MACtD,WAAW,OAAO,gBAAgB,0BACrC;CAEA,IAAI,CAAC,cAAc;EACjB,IAAI,OAAQ,MAAkC,cAAc,YAAY;EAExE,MAAM,UAAU,6BAA6B;EAE7C,MAAM,IAAI,MACR,oIACE,UAAU,+BAA+B,QAAQ,KAAK,GACvD,qGACH;CACF;CAEA,MAAM,SAAU,MACd;CAGF,IAAI,CAAC,UAAU,OAAO,SAAS,GAAG;CAElC,MAAM,kBACJ,MAAM,OAGN;CAEF,IAAI,CAAC,iBAAiB;CAEtB,MAAM,WAAW,MAAM,UAAU,YAAY;CAC7C,MAAM,UACJ,aAAa,SAAY,CAAC,IAAI,MAAM,QAAQ,QAAQ,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,OAAO,QAAQ,CAAC;CAE3F,KAAK,MAAM,UAAU,OAAO,OAAO,GAAG;EACpC,MAAM,aAAa,gBAAgB,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI;EAEzE,IAAI,CAAC,QAAQ,SAAS,UAAU,GAC9B,QAAQ,KAAK,UAAU;CAE3B;CAEA,MAAM,aAAa,YAAY;CAC/B,MAAM,OAAO,cAAc,OAAO;CAClC,OAAO,MAAM;AACf"}

package/esm/http/health.d.mts

@@ -3,12 +3,12 @@
  * A readiness probe registered via `health.addCheck(...)`. Returns whether its
  * dependency is currently usable; throwing is treated as a failed check.
  */
-type HealthCheck = () => boolean | Promise<boolean>;
+export type HealthCheck = () => boolean | Promise<boolean>;
 /**
  * Result of a liveness/readiness probe. `checks` is present on readiness only,
  * mapping each registered check name to its pass/fail.
  */
-type HealthStatus = {
+export type HealthStatus = {
   status: "ok" | "error";
   checks?: Record<string, boolean>;
 };
@@ -65,7 +65,7 @@ declare class HealthRegistry {
 /**
  * The application's health registry singleton.
  */
-declare const health: HealthRegistry;
+export declare const health: HealthRegistry;
 //#endregion
-export { HealthCheck, HealthStatus, health };
+export {};
 //# sourceMappingURL=health.d.mts.map

package/esm/http/health.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/health.ts"],"mappings":";;AAMA;;;KAAY,WAAA,mBAA8B,OAAO;AAAA;AAMjD;;;AANiD,KAMrC,YAAA;EACV,MAAA;EACA,MAAA,GAAS,MAAM;AAAA;;AAAA;AACf;;;;;cASI,cAAA;EAAA,iBACa,MAAA;EA6BgB;;;EAxB1B,QAAA,CAAS,IAAA,UAAc,KAAA,EAAO,WAAA;EAArB;;;EAOT,WAAA,CAAY,IAAA;EAAA;;;;EAQZ,QAAA,IAAY,YAAA;EASe;;;;;EAArB,SAAA,IAAa,OAAA,CAAQ,YAAA;EA2CZ;AAYxB;;;;AAA0C;;;;;;;;EAtBjC,wBAAA,CAAyB,aAAA,gBAA6B,IAAA;;;;;;;UAU/C,QAAA;AAAA;;;;cAYH,MAAA,EAAM,cAAuB"}
+{"version":3,"file":"health.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/health.ts"],"mappings":";;;;;YAMY,8BAA8B;;;;;YAM9B;EACV;EACA,SAAS;;;;;;;;;cAUL;mBACa;;;;EAKV,SAAS,cAAc,OAAO;;;;EAO9B,YAAY;;;;;EAQZ,YAAY;;;;;;EASN,aAAa,QAAQ;;;;;;;;;;;;;;EAiC3B,yBAAyB,6BAA6B;;;;;;;UAU/C;;;;;qBAYH,QAAM"}

package/esm/http/index.d.mts

@@ -1,5 +1,6 @@
 import { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "./errors/errors.mjs";
-import { HttpLoggingConfig, RequestLogSnapshot, RequestLogSource, RequestLoggingOptions, URL_CREDENTIAL_PARAMS, buildRequestLogSnapshot, redactQueryCredentials, redactUrlCredentials, resolveRequestLoggingOptions } from "./request-log-snapshot.mjs";
+import { ConditionalRequestInput, ConditionalRequestOutcome, EntityTag, evaluateConditionalRequest, matchesIfMatch, matchesIfNoneMatch, parseEntityTag, parseEntityTagList, strongEntityTagMatch, weakEntityTagMatch } from "./conditional-request.mjs";
+import { HttpLoggingConfig, PrivateRequestLoggingRule, RequestLogSnapshot, RequestLogSource, RequestLoggingOptions, URL_CREDENTIAL_PARAMS, buildRequestLogSnapshot, redactQueryCredentials, redactUrlCredentials, resolveRequestLoggingOptions } from "./request-log-snapshot.mjs";
 import { PipeableReactStream, StreamReactResponseOptions, streamReactResponse } from "./stream-react-response.mjs";
 import { XMLable } from "./xmlable.mjs";
 import { CookieOptions, Response, ResponseStatus, SendBufferOptions, SendFileOptions, toSingleLineSseField } from "./response.mjs";
@@ -9,7 +10,7 @@ import { Request, RequestTranslator } from "./request.mjs";
 import { CspConfig, DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives } from "./csp.mjs";
 import { HttpErrorMapper, HttpErrorMapping } from "./error-mapper.mjs";
 import { HttpTracingConfig, TracingContext, TracingHooks, TracingPhaseInfo, TracingRequestEndInfo } from "./tracing/tracing.type.mjs";
-import { DecodedAccessToken, HttpConfigurations, HttpServerOptions, PartialMiddleware, RequestEvent, RequestLocals, ResponseEvent, ResponseSSEController, ResponseSSEOptions, ResponseStreamController, ResponseStreamOptions, ReturnedResponse } from "./types.mjs";
+import { DecodedAccessToken, HttpConfigurations, HttpServerOptions, PartialMiddleware, RequestEvent, RequestLocals, ResponseEvent, ResponseSSEController, ResponseSSEMessageOptions, ResponseSSEOptions, ResponseStreamController, ResponseStreamOptions, ReturnedResponse } from "./types.mjs";
 import { defaultHttpConfigurations, httpConfig } from "./config.mjs";
 import { createHttpApplication, stopHttpApplication } from "./createHttpApplication.mjs";
 import { requiresDefaultCsrfGuard, runDefaultCsrfGuard } from "./csrf-default-guard.mjs";
@@ -26,6 +27,7 @@ import { ImageVariantsConfigError } from "./uploads/image-variants-config-error.
 import { PurgeImageVariantsOptions, purgeImageVariants } from "./uploads/purge-image-variants.mjs";
 import { ResolveImageVariantInput, ResolvedImageVariant, resolveImageVariant } from "./uploads/resolve-image-variant.mjs";
 import { UploadedFileControllerOptions, createUploadedFileController, uploadedFileController } from "./uploads/uploaded-file.controller.mjs";
+import "./uploads/index.mjs";
 import { CacheMiddlewareOptions } from "./middleware/cache-response-middleware.mjs";
 import { ConcurrencyLimitOptions } from "./middleware/concurrency-limit.middleware.mjs";
 import { IdempotencyOptions } from "./middleware/idempotency.middleware.mjs";
@@ -37,14 +39,18 @@ import { createRequestStore, t } from "./middleware/inject-request-context.mjs";
 import { anyMatch, ipMatches } from "./middleware/utils/cidr-match.mjs";
 import { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from "./middleware/utils/idempotency-key.mjs";
 import { parseSize } from "./middleware/utils/parse-size.mjs";
+import "./middleware/index.mjs";
 import { ClosableServer, FastifyInstance, beginHttpDrain, closeServerWithTimeout, getHttpServer, startHttpServer, trackConnectionsForDrain } from "./server.mjs";
 import { registerHttpPlugins, resolvePublicRoot } from "./plugins.mjs";
 import { assertConfiguredHttpPortIsFree, preflightConfiguredHttpPort, remedyLines, shouldPreflightHttpPort } from "./boot-port-preflight.mjs";
 import { PortInUseError, assertPortIsAvailable, isPortAvailable } from "./port-preflight.mjs";
 import { HttpReadyReport, getHttpReadyReport, resetHttpReadyReport, setHttpReadyReport } from "./ready-report.mjs";
 import { HttpServerRebuiltListener, notifyHttpServerRebuilt, onHttpServerRebuilt } from "./server-rebuilt.mjs";
+import { escapeHeaderValue } from "./escape-header-value.mjs";
+import { SafeRedirectOptions, isSafeRedirect, safeRedirect } from "./safe-redirect.mjs";
 import { deriveTraceId, parseTraceparentTraceId } from "./tracing/trace-id.mjs";
 import { TracingContextSource, buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled, registerTracingHooks, resetTracingConfigForTests, resolveTracingConfig } from "./tracing/tracing-dispatcher.mjs";
 import { RequestContextStore, requestContext, useCurrentUser, useRequest, useRequestStore } from "./context/request-context.mjs";
 import { requestMemo } from "./context/request-memo.mjs";
-import { ModelResourceRegistry, Serialized, SerializedWire } from "./serialized.mjs";
+import { ModelResourceRegistry, Serialized, SerializedWire } from "./serialized.mjs";
+export { BadRequestError, type CacheMiddlewareOptions, ClosableServer, type ConcurrencyLimitOptions, ConditionalRequestInput, ConditionalRequestOutcome, ConflictError, CookieJarUnavailableError, CookieOptions, CspConfig, CsrfOriginCheckReason, CsrfOriginVerdict, DEFAULT_CSP_DIRECTIVES, DecodedAccessToken, DetectedImageFormat, EntityTag, FastifyInstance, FileNamingStrategy, FileValidationOptions, ForbiddenError, GenerateImageVariantsOptions, GeneratedImageDescriptor, GeneratedImageVariant, HealthCheck, HealthStatus, HttpConfigurations, HttpError, HttpErrorCodes, type HttpErrorMapper, type HttpErrorMapping, HttpLoggingConfig, HttpReadyReport, HttpServerOptions, HttpServerRebuiltListener, HttpTracingConfig, type IdempotencyOptions, ImageTransformCallback, ImageTransformConfig, ImageVariantDefinition, ImageVariantFit, ImageVariantOutputFormat, ImageVariantsConfigError, InvalidCspDirectiveError, type IpFilterOptions, type MaintenanceOptions, ModelResourceRegistry, NotAcceptableError, NotAllowedError, PartialMiddleware, PipeableReactStream, PortInUseError, PrefixConfig, PrefixOptions, PrivateRequestLoggingRule, PurgeImageVariantsOptions, type RateLimitOptions, Request, RequestContextStore, RequestController, RequestEvent, RequestLocals, RequestLog, RequestLogSnapshot, RequestLogSource, RequestLoggingOptions, RequestTranslator, ResolveImageVariantInput, ResolvedImageVariant, ResolvedImageVariantsConfig, ResourceNotFoundError, Response, ResponseEvent, ResponseSSEController, ResponseSSEMessageOptions, ResponseSSEOptions, ResponseStatus, ResponseStreamController, ResponseStreamOptions, ReturnedResponse, SafeRedirectOptions, SaveAsOptions, SaveOptions, SendBufferOptions, SendFileOptions, Serialized, SerializedWire, ServerError, StreamReactResponseOptions, TracingContext, TracingContextSource, TracingHooks, TracingPhaseInfo, TracingRequestEndInfo, UPLOADS_DEFAULTS, URL_CREDENTIAL_PARAMS, UnAuthorizedError, UploadedFile, UploadedFileControllerOptions, UploadedFileImageOptions, UploadedFileJson, UploadedFileQuery, UploadsConfigurations, UploadsImagesConfigurations, VariantOutputFormat, VariantSourceFormat, XMLable, anyMatch, applyCspHeader, assertConfiguredHttpPortIsFree, assertPortIsAvailable, beginHttpDrain, buildCspHeaderValue, buildIdempotencyCacheKey, buildRequestLogSnapshot, buildTracingContext, closeServerWithTimeout, createHttpApplication, createRequestStore, createUploadedFileController, defaultHttpConfigurations, deriveTraceId, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, escapeHeaderValue, evaluateConditionalRequest, generateImageVariants, getHttpReadyReport, getHttpServer, hashBody, health, httpConfig, ipMatches, isAllowedCsrfOrigin, isPortAvailable, isSafeRedirect, isTracingEnabled, isValidIdempotencyKey, logResponse, matchesIfMatch, matchesIfNoneMatch, mergeCspDirectives, middleware, normalizeOrigin, notifyHttpServerRebuilt, onHttpServerRebuilt, originOf, ownOrigin, parseEntityTag, parseEntityTagList, parseSize, parseTraceparentTraceId, preflightConfiguredHttpPort, purgeImageVariants, redactQueryCredentials, redactUrlCredentials, registerHttpPlugins, registerTracingHooks, remedyLines, requestContext, requestMemo, requiresDefaultCsrfGuard, resetHttpReadyReport, resetTracingConfigForTests, resolveCspConfig, resolveCsrfOriginVerdict, resolveImageVariant, resolvePublicRoot, resolveRequestLoggingOptions, resolveTracingConfig, runDefaultCsrfGuard, safeRedirect, serializeCspDirectives, setHttpReadyReport, shouldPreflightHttpPort, startHttpServer, stopHttpApplication, streamReactResponse, strongEntityTagMatch, t, toSingleLineSseField, trackConnectionsForDrain, uploadedFileController, uploadsConfig, useCurrentUser, useRequest, useRequestStore, validateCspConfigAtBoot, validateCspDirectives, weakEntityTagMatch, wrapResponseInDataKey };

package/esm/http/index.mjs

@@ -8,7 +8,9 @@ import { deriveTraceId, parseTraceparentTraceId } from "./tracing/trace-id.mjs";
 import { buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled, registerTracingHooks, resetTracingConfigForTests, resolveTracingConfig } from "./tracing/tracing-dispatcher.mjs";
 import "./tracing/index.mjs";
 import { createRequestStore, t } from "./middleware/inject-request-context.mjs";
+import { evaluateConditionalRequest, matchesIfMatch, matchesIfNoneMatch, parseEntityTag, parseEntityTagList, strongEntityTagMatch, weakEntityTagMatch } from "./conditional-request.mjs";
 import { defaultHttpConfigurations, httpConfig } from "./config.mjs";
+import { ImageVariantsConfigError } from "./uploads/image-variants-config-error.mjs";
 import { UPLOADS_DEFAULTS, uploadsConfig } from "./uploads-config.mjs";
 import { streamReactResponse } from "./stream-react-response.mjs";
 import { Response, ResponseStatus, toSingleLineSseField } from "./response.mjs";
@@ -22,7 +24,6 @@ import { RequestLog } from "./database/RequestLog.mjs";
 import { logResponse, wrapResponseInDataKey } from "./events.mjs";
 import { health } from "./health.mjs";
 import { RequestController } from "./request-controller.mjs";
-import { ImageVariantsConfigError } from "./uploads/image-variants-config-error.mjs";
 import { generateImageVariants } from "./uploads/generate-image-variants.mjs";
 import { purgeImageVariants } from "./uploads/purge-image-variants.mjs";
 import { resolveImageVariant } from "./uploads/resolve-image-variant.mjs";
@@ -37,6 +38,8 @@ import { PortInUseError, assertPortIsAvailable, isPortAvailable } from "./port-p
 import { assertConfiguredHttpPortIsFree, preflightConfiguredHttpPort, remedyLines, shouldPreflightHttpPort } from "./boot-port-preflight.mjs";
 import { getHttpReadyReport, resetHttpReadyReport, setHttpReadyReport } from "./ready-report.mjs";
 import { notifyHttpServerRebuilt, onHttpServerRebuilt } from "./server-rebuilt.mjs";
+import { escapeHeaderValue } from "./escape-header-value.mjs";
+import { isSafeRedirect, safeRedirect } from "./safe-redirect.mjs";
 import { requestMemo } from "./context/request-memo.mjs";
 
-export {  };
+export { BadRequestError, ConflictError, CookieJarUnavailableError, DEFAULT_CSP_DIRECTIVES, ForbiddenError, HttpError, HttpErrorCodes, ImageVariantsConfigError, InvalidCspDirectiveError, NotAcceptableError, NotAllowedError, PortInUseError, Request, RequestController, RequestLog, ResourceNotFoundError, Response, ResponseStatus, ServerError, UPLOADS_DEFAULTS, URL_CREDENTIAL_PARAMS, UnAuthorizedError, UploadedFile, anyMatch, applyCspHeader, assertConfiguredHttpPortIsFree, assertPortIsAvailable, beginHttpDrain, buildCspHeaderValue, buildIdempotencyCacheKey, buildRequestLogSnapshot, buildTracingContext, closeServerWithTimeout, createHttpApplication, createRequestStore, createUploadedFileController, defaultHttpConfigurations, deriveTraceId, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, escapeHeaderValue, evaluateConditionalRequest, generateImageVariants, getHttpReadyReport, getHttpServer, hashBody, health, httpConfig, ipMatches, isAllowedCsrfOrigin, isPortAvailable, isSafeRedirect, isTracingEnabled, isValidIdempotencyKey, logResponse, matchesIfMatch, matchesIfNoneMatch, mergeCspDirectives, middleware, normalizeOrigin, notifyHttpServerRebuilt, onHttpServerRebuilt, originOf, ownOrigin, parseEntityTag, parseEntityTagList, parseSize, parseTraceparentTraceId, preflightConfiguredHttpPort, purgeImageVariants, redactQueryCredentials, redactUrlCredentials, registerHttpPlugins, registerTracingHooks, remedyLines, requestContext, requestMemo, requiresDefaultCsrfGuard, resetHttpReadyReport, resetTracingConfigForTests, resolveCspConfig, resolveCsrfOriginVerdict, resolveImageVariant, resolvePublicRoot, resolveRequestLoggingOptions, resolveTracingConfig, runDefaultCsrfGuard, safeRedirect, serializeCspDirectives, setHttpReadyReport, shouldPreflightHttpPort, startHttpServer, stopHttpApplication, streamReactResponse, strongEntityTagMatch, t, toSingleLineSseField, trackConnectionsForDrain, uploadedFileController, uploadsConfig, useCurrentUser, useRequest, useRequestStore, validateCspConfigAtBoot, validateCspDirectives, weakEntityTagMatch, wrapResponseInDataKey };

package/esm/http/lazy-static.mjs

@@ -0,0 +1,194 @@
+import path from "node:path";
+import { statSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+//#region ../../packages/core/src/http/lazy-static.ts
+function optionError(field, message, valueError = false) {
+	return Object.assign(valueError ? /* @__PURE__ */ new TypeError(`"${field}" option ${message}`) : /* @__PURE__ */ new Error(`"${field}" option ${message}`), {
+		code: valueError ? "FST_STATIC_INVALID_OPTION_VALUE" : "FST_STATIC_INVALID_OPTION",
+		statusCode: 500
+	});
+}
+/** Validate without importing the plugin's directory-listing module. */
+function staticOptions(server, options) {
+	const root = options.root;
+	const normalize = (entry) => entry instanceof URL && entry.protocol === "file:" ? fileURLToPath(entry) : entry;
+	const normalized = Array.isArray(root) ? root.map(normalize) : root === void 0 ? void 0 : normalize(root);
+	if (options.serve !== false || normalized !== void 0) {
+		if (normalized === void 0) throw optionError("root", "is required");
+		if (Array.isArray(normalized) && normalized.length === 0) throw optionError("root", "array requires one or more paths");
+		if (Array.isArray(normalized) && new Set(normalized).size !== normalized.length) throw optionError("root", "array contains duplicate paths");
+		for (const entry of Array.isArray(normalized) ? normalized : [normalized]) {
+			if (typeof entry !== "string") throw optionError("root", "must be a string", true);
+			if (!path.isAbsolute(entry)) throw optionError("root", "must be an absolute path");
+			try {
+				if (!statSync(entry).isDirectory()) throw optionError("root", "must be a directory");
+			} catch (error) {
+				if (error.code !== "ENOENT") throw error;
+				if (!options.suppressWarning) server.log.warn(`"root" path "${entry}" must exist`);
+			}
+		}
+	}
+	if (options.setHeaders !== void 0 && typeof options.setHeaders !== "function") throw optionError("setHeaders", "must be a function", true);
+	if (options.serve !== false && options.wildcard && typeof options.wildcard !== "boolean") throw optionError("wildcard", "must be a boolean", true);
+	const list = options.list;
+	if (list) {
+		if (Array.isArray(normalized)) throw Object.assign(/* @__PURE__ */ new TypeError("multi-root with list option is not supported"), {
+			code: "FST_STATIC_MULTIROOT_LIST_CONFLICT",
+			statusCode: 500
+		});
+		if (typeof list === "object") {
+			if (list.format && list.format !== "json" && list.format !== "html") throw optionError("list.format", "must be json or html", true);
+			if (list.names && !Array.isArray(list.names)) throw optionError("list.names", "must be an array", true);
+			if (list.jsonFormat != null && list.jsonFormat !== "names" && list.jsonFormat !== "extended") throw optionError("list.jsonFormat", "must be names or extended", true);
+			if (list.format === "html" && typeof list.render !== "function") throw optionError("list.render", "must be a function and is required with html format", true);
+		}
+	}
+	return {
+		...options,
+		root: normalized
+	};
+}
+/** Mirror the plugin's boot-time route snapshot for wildcard:false. */
+async function fileRoutes(options, prefix) {
+	const { glob } = await import("glob");
+	const roots = Array.isArray(options.root) ? options.root : [options.root];
+	const routes = /* @__PURE__ */ new Map();
+	const indexes = new Set(options.index === void 0 ? ["index.html"] : options.index === false ? [] : [options.index].flat());
+	const indexDirectories = /* @__PURE__ */ new Map();
+	for (const root of roots) {
+		if (typeof root !== "string") continue;
+		const rootPath = root.split(path.win32.sep).join(path.posix.sep).replace(/\/?$/, "/");
+		const files = await glob("**/**", {
+			cwd: rootPath,
+			absolute: false,
+			follow: true,
+			nodir: true,
+			dot: options.serveDotFiles,
+			ignore: options.globIgnore
+		});
+		for (const fileName of files) {
+			const file = fileName.split(path.win32.sep).join(path.posix.sep);
+			const url = prefix + file;
+			if (routes.has(url)) continue;
+			routes.set(url, {
+				url,
+				file: `/${file}`,
+				rootPath
+			});
+			const key = path.posix.basename(url);
+			if (indexes.has(key) && !indexDirectories.has(key)) indexDirectories.set(path.posix.dirname(url), rootPath);
+		}
+	}
+	for (const [directory, rootPath] of indexDirectories) {
+		const url = directory + (directory.endsWith("/") ? "" : "/");
+		const file = "/" + url.replace(prefix, "");
+		routes.set(url, {
+			url,
+			file,
+			rootPath
+		});
+		if (options.redirect === true) routes.set(url.replace(/\/$/, ""), {
+			url: url.replace(/\/$/, ""),
+			file: file.replace(/\/$/, ""),
+			rootPath
+		});
+	}
+	return [...routes.values()];
+}
+/**
+* Queue public routes after earlier plugins, and capture upstream handlers on the
+* first file request. Only public Fastify methods are replaced on the facade;
+* the listening application's route/decorator table never changes after ready.
+*/
+function registerLazyStatic(server, input, mount = {}) {
+	const options = staticOptions(server, input);
+	server.register(Object.assign(async (instance) => prepareStatic(instance, options, mount), { [Symbol.for("skip-override")]: true }));
+}
+async function prepareStatic(server, options, mount) {
+	const originalPrefix = options.prefix ?? "/";
+	const prefix = options.prefixAvoidTrailingSlash || originalPrefix.endsWith("/") ? originalPrefix : `${originalPrefix}/`;
+	const handlers = /* @__PURE__ */ new Map();
+	const decorators = /* @__PURE__ */ new Map();
+	let initialized;
+	function initialize() {
+		return initialized ??= (async () => {
+			const facade = Object.create(server);
+			const capture = (route) => {
+				const url = route.url ?? route.path;
+				if (!url) throw new Error("Static plugin declared a route without a path.");
+				for (const method of [route.method].flat()) handlers.set(`${method} ${url}`, route.handler);
+				return facade;
+			};
+			Object.defineProperties(facade, {
+				route: { value: capture },
+				get: { value: (url, route, handler) => capture({
+					...route,
+					url,
+					method: ["GET", "HEAD"],
+					handler
+				}) },
+				decorateReply: { value: (name, handler) => {
+					decorators.set(name, handler);
+					return facade;
+				} }
+			});
+			const { default: staticPlugin } = await import("@fastify/static");
+			await staticPlugin(facade, {
+				...options,
+				decorateReply: true,
+				suppressWarning: true
+			});
+		})();
+	}
+	if (options.decorateReply !== false) for (const name of ["sendFile", "download"]) server.decorateReply(name, function(...args) {
+		initialize().then(() => {
+			const decorator = decorators.get(name);
+			if (!decorator) throw new Error(`Static plugin did not provide ${name}.`);
+			decorator.apply(this, args);
+		}).catch((error) => this.send(error));
+		return this;
+	});
+	if (options.serve === false) return;
+	const routes = options.wildcard === false ? await fileRoutes(options, prefix) : [{ url: prefix + "*" }];
+	if (options.wildcard !== false && options.redirect === true && prefix !== originalPrefix) routes.push({ url: originalPrefix });
+	const schema = { hide: options.schemaHide ?? true };
+	for (const route of routes) server.route({
+		url: route.url,
+		method: ["HEAD", "GET"],
+		constraints: options.constraints,
+		schema,
+		logLevel: options.logLevel,
+		config: {
+			...route.file ? {
+				file: route.file,
+				rootPath: route.rootPath
+			} : {},
+			...mount.rateLimit !== void 0 ? { rateLimit: mount.rateLimit } : {}
+		},
+		errorHandler(error, request, reply) {
+			if (error?.code === "ERR_STREAM_PREMATURE_CLOSE") {
+				reply.request.raw.destroy();
+				return;
+			}
+			return server.errorHandler(error, request, reply);
+		},
+		async handler(request, reply) {
+			await initialize();
+			const handler = handlers.get(`${request.method} ${route.url}`);
+			if (handler) {
+				await handler.call(server, request, reply);
+				return reply;
+			}
+			if (route.file) {
+				const sendFile = decorators.get("sendFile");
+				if (sendFile) return sendFile.call(reply, route.file, route.rootPath);
+			}
+			return reply.callNotFound();
+		}
+	});
+}
+
+//#endregion
+export { registerLazyStatic };
+//# sourceMappingURL=lazy-static.mjs.map

package/esm/http/lazy-static.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lazy-static.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/lazy-static.ts"],"sourcesContent":["import type { FastifyStaticOptions } from \"@fastify/static\";\nimport { statSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type {\n  FastifyInstance,\n  FastifyReply,\n  FastifyRequest,\n  FastifySchema,\n  RouteHandlerMethod,\n  RouteOptions,\n} from \"fastify\";\n\ntype FileRoute = { url: string; file?: string; rootPath?: string };\ntype ReplyDecorator = (this: FastifyReply, ...args: unknown[]) => FastifyReply;\n\nfunction optionError(field: string, message: string, valueError = false): Error {\n  return Object.assign(\n    valueError\n      ? new TypeError(`\"${field}\" option ${message}`)\n      : new Error(`\"${field}\" option ${message}`),\n    {\n      code: valueError ? \"FST_STATIC_INVALID_OPTION_VALUE\" : \"FST_STATIC_INVALID_OPTION\",\n      statusCode: 500,\n    },\n  );\n}\n\n/** Validate without importing the plugin's directory-listing module. */\nfunction staticOptions(\n  server: FastifyInstance,\n  options: FastifyStaticOptions,\n): FastifyStaticOptions {\n  const root = options.root;\n  const normalize = (entry: string | URL): string | URL =>\n    entry instanceof URL && entry.protocol === \"file:\" ? fileURLToPath(entry) : entry;\n  const normalized = Array.isArray(root)\n    ? root.map(normalize)\n    : root === undefined\n      ? undefined\n      : normalize(root);\n  if (options.serve !== false || normalized !== undefined) {\n    if (normalized === undefined) throw optionError(\"root\", \"is required\");\n    if (Array.isArray(normalized) && normalized.length === 0)\n      throw optionError(\"root\", \"array requires one or more paths\");\n    if (Array.isArray(normalized) && new Set(normalized).size !== normalized.length)\n      throw optionError(\"root\", \"array contains duplicate paths\");\n    for (const entry of Array.isArray(normalized) ? normalized : [normalized]) {\n      if (typeof entry !== \"string\") throw optionError(\"root\", \"must be a string\", true);\n      if (!path.isAbsolute(entry)) throw optionError(\"root\", \"must be an absolute path\");\n      try {\n        if (!statSync(entry).isDirectory()) throw optionError(\"root\", \"must be a directory\");\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code !== \"ENOENT\") throw error;\n        if (!options.suppressWarning) server.log.warn(`\"root\" path \"${entry}\" must exist`);\n      }\n    }\n  }\n  if (options.setHeaders !== undefined && typeof options.setHeaders !== \"function\")\n    throw optionError(\"setHeaders\", \"must be a function\", true);\n  if (options.serve !== false && options.wildcard && typeof options.wildcard !== \"boolean\")\n    throw optionError(\"wildcard\", \"must be a boolean\", true);\n  const list = options.list;\n  if (list) {\n    if (Array.isArray(normalized))\n      throw Object.assign(new TypeError(\"multi-root with list option is not supported\"), {\n        code: \"FST_STATIC_MULTIROOT_LIST_CONFLICT\",\n        statusCode: 500,\n      });\n    if (typeof list === \"object\") {\n      if (list.format && list.format !== \"json\" && list.format !== \"html\")\n        throw optionError(\"list.format\", \"must be json or html\", true);\n      if (list.names && !Array.isArray(list.names))\n        throw optionError(\"list.names\", \"must be an array\", true);\n      if (list.jsonFormat != null && list.jsonFormat !== \"names\" && list.jsonFormat !== \"extended\")\n        throw optionError(\"list.jsonFormat\", \"must be names or extended\", true);\n      if (list.format === \"html\" && typeof list.render !== \"function\")\n        throw optionError(\n          \"list.render\",\n          \"must be a function and is required with html format\",\n          true,\n        );\n    }\n  }\n  return { ...options, root: normalized } as FastifyStaticOptions;\n}\n\n/** Mirror the plugin's boot-time route snapshot for wildcard:false. */\nasync function fileRoutes(options: FastifyStaticOptions, prefix: string): Promise<FileRoute[]> {\n  const { glob } = await import(\"glob\");\n  const roots = Array.isArray(options.root) ? options.root : [options.root];\n  const routes = new Map<string, FileRoute>();\n  const indexes = new Set(\n    options.index === undefined\n      ? [\"index.html\"]\n      : options.index === false\n        ? []\n        : [options.index].flat(),\n  );\n  const indexDirectories = new Map<string, string>();\n  for (const root of roots) {\n    if (typeof root !== \"string\") continue;\n    const rootPath = root.split(path.win32.sep).join(path.posix.sep).replace(/\\/?$/, \"/\");\n    const files = await glob(\"**/**\", {\n      cwd: rootPath,\n      absolute: false,\n      follow: true,\n      nodir: true,\n      dot: options.serveDotFiles,\n      ignore: options.globIgnore,\n    });\n    for (const fileName of files) {\n      const file = fileName.split(path.win32.sep).join(path.posix.sep);\n      const url = prefix + file;\n      if (routes.has(url)) continue;\n      routes.set(url, { url, file: `/${file}`, rootPath });\n      // Match upstream: distinct index filenames in later roots replace the\n      // directory route, while duplicate file URLs keep the first root.\n      const key = path.posix.basename(url);\n      if (indexes.has(key) && !indexDirectories.has(key))\n        indexDirectories.set(path.posix.dirname(url), rootPath);\n    }\n  }\n  for (const [directory, rootPath] of indexDirectories) {\n    const url = directory + (directory.endsWith(\"/\") ? \"\" : \"/\");\n    const file = \"/\" + url.replace(prefix, \"\");\n    routes.set(url, { url, file, rootPath });\n    if (options.redirect === true)\n      routes.set(url.replace(/\\/$/, \"\"), {\n        url: url.replace(/\\/$/, \"\"),\n        file: file.replace(/\\/$/, \"\"),\n        rootPath,\n      });\n  }\n  return [...routes.values()];\n}\n\n/**\n * Queue public routes after earlier plugins, and capture upstream handlers on the\n * first file request. Only public Fastify methods are replaced on the facade;\n * the listening application's route/decorator table never changes after ready.\n */\nexport function registerLazyStatic(\n  server: FastifyInstance,\n  input: FastifyStaticOptions,\n  mount: LazyStaticMount = {},\n): void {\n  const options = staticOptions(server, input);\n  // Earlier plugins install onRoute hooks (including global rate limiting).\n  // Keep the decorators on the calling scope, as @fastify/static does.\n  server.register(\n    Object.assign(async (instance: FastifyInstance) => prepareStatic(instance, options, mount), {\n      [Symbol.for(\"skip-override\")]: true,\n    }),\n  );\n}\n\n/**\n * How the file routes of one static mount meet the rate limiter.\n */\nexport type LazyStaticMount = {\n  /**\n   * The `config.rateLimit` of every file route: `false` exempts the mount\n   * from the global limiter, an object gives it its own limit, and\n   * `undefined` leaves it under the global policy.\n   */\n  rateLimit?: false | Record<string, unknown>;\n};\n\nasync function prepareStatic(\n  server: FastifyInstance,\n  options: FastifyStaticOptions,\n  mount: LazyStaticMount,\n): Promise<void> {\n  const originalPrefix = options.prefix ?? \"/\";\n  const prefix =\n    options.prefixAvoidTrailingSlash || originalPrefix.endsWith(\"/\")\n      ? originalPrefix\n      : `${originalPrefix}/`;\n  const handlers = new Map<string, RouteHandlerMethod>();\n  const decorators = new Map<string, ReplyDecorator>();\n  let initialized: Promise<void> | undefined;\n\n  function initialize(): Promise<void> {\n    return (initialized ??= (async () => {\n      const facade = Object.create(server) as FastifyInstance;\n      const capture = (route: RouteOptions): FastifyInstance => {\n        const url = route.url ?? (route as RouteOptions & { path?: string }).path;\n        if (!url) throw new Error(\"Static plugin declared a route without a path.\");\n        for (const method of [route.method].flat()) handlers.set(`${method} ${url}`, route.handler);\n        return facade;\n      };\n      Object.defineProperties(facade, {\n        route: { value: capture },\n        get: {\n          value: (\n            url: string,\n            route: Omit<RouteOptions, \"method\" | \"url\" | \"handler\">,\n            handler: RouteHandlerMethod,\n          ) => capture({ ...route, url, method: [\"GET\", \"HEAD\"], handler }),\n        },\n        decorateReply: {\n          value: (name: string, handler: ReplyDecorator) => {\n            decorators.set(name, handler);\n            return facade;\n          },\n        },\n      });\n      const { default: staticPlugin } = await import(\"@fastify/static\");\n      await staticPlugin(facade, { ...options, decorateReply: true, suppressWarning: true });\n    })());\n  }\n\n  if (options.decorateReply !== false) {\n    for (const name of [\"sendFile\", \"download\"]) {\n      server.decorateReply(name, function (this: FastifyReply, ...args: unknown[]) {\n        void initialize()\n          .then(() => {\n            const decorator = decorators.get(name);\n            if (!decorator) throw new Error(`Static plugin did not provide ${name}.`);\n            decorator.apply(this, args);\n          })\n          .catch((error: unknown) => this.send(error));\n        return this;\n      });\n    }\n  }\n  if (options.serve === false) return;\n  const routes: FileRoute[] =\n    options.wildcard === false ? await fileRoutes(options, prefix) : [{ url: prefix + \"*\" }];\n  if (options.wildcard !== false && options.redirect === true && prefix !== originalPrefix)\n    routes.push({ url: originalPrefix });\n  const schema: FastifySchema & { hide: boolean } = { hide: options.schemaHide ?? true };\n  for (const route of routes) {\n    server.route({\n      url: route.url,\n      method: [\"HEAD\", \"GET\"],\n      constraints: options.constraints,\n      schema,\n      logLevel: options.logLevel,\n      config: {\n        ...(route.file ? { file: route.file, rootPath: route.rootPath } : {}),\n        ...(mount.rateLimit !== undefined ? { rateLimit: mount.rateLimit } : {}),\n      },\n      errorHandler(error, request, reply) {\n        if (error?.code === \"ERR_STREAM_PREMATURE_CLOSE\") {\n          reply.request.raw.destroy();\n          return;\n        }\n        return server.errorHandler(error, request, reply);\n      },\n      async handler(request: FastifyRequest, reply: FastifyReply) {\n        await initialize();\n        const handler = handlers.get(`${request.method} ${route.url}`);\n        if (handler) {\n          await handler.call(server, request, reply);\n          // Some upstream handlers start an async send without returning its\n          // promise. Returning the real reply keeps Fastify from auto-sending.\n          return reply;\n        }\n        // A wildcard:false file may disappear between boot and the first request.\n        if (route.file) {\n          const sendFile = decorators.get(\"sendFile\");\n          if (sendFile) return sendFile.call(reply, route.file, route.rootPath);\n        }\n        return reply.callNotFound();\n      },\n    });\n  }\n}\n"],"mappings":";;;;;AAgBA,SAAS,YAAY,OAAe,SAAiB,aAAa,OAAc;CAC9E,OAAO,OAAO,OACZ,6BACI,IAAI,UAAU,IAAI,MAAM,WAAW,SAAS,oBAC5C,IAAI,MAAM,IAAI,MAAM,WAAW,SAAS,GAC5C;EACE,MAAM,aAAa,oCAAoC;EACvD,YAAY;CACd,CACF;AACF;;AAGA,SAAS,cACP,QACA,SACsB;CACtB,MAAM,OAAO,QAAQ;CACrB,MAAM,aAAa,UACjB,iBAAiB,OAAO,MAAM,aAAa,UAAU,cAAc,KAAK,IAAI;CAC9E,MAAM,aAAa,MAAM,QAAQ,IAAI,IACjC,KAAK,IAAI,SAAS,IAClB,SAAS,SACP,SACA,UAAU,IAAI;CACpB,IAAI,QAAQ,UAAU,SAAS,eAAe,QAAW;EACvD,IAAI,eAAe,QAAW,MAAM,YAAY,QAAQ,aAAa;EACrE,IAAI,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GACrD,MAAM,YAAY,QAAQ,kCAAkC;EAC9D,IAAI,MAAM,QAAQ,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC,SAAS,WAAW,QACvE,MAAM,YAAY,QAAQ,gCAAgC;EAC5D,KAAK,MAAM,SAAS,MAAM,QAAQ,UAAU,IAAI,aAAa,CAAC,UAAU,GAAG;GACzE,IAAI,OAAO,UAAU,UAAU,MAAM,YAAY,QAAQ,oBAAoB,IAAI;GACjF,IAAI,CAAC,KAAK,WAAW,KAAK,GAAG,MAAM,YAAY,QAAQ,0BAA0B;GACjF,IAAI;IACF,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,YAAY,GAAG,MAAM,YAAY,QAAQ,qBAAqB;GACrF,SAAS,OAAO;IACd,IAAK,MAAgC,SAAS,UAAU,MAAM;IAC9D,IAAI,CAAC,QAAQ,iBAAiB,OAAO,IAAI,KAAK,gBAAgB,MAAM,aAAa;GACnF;EACF;CACF;CACA,IAAI,QAAQ,eAAe,UAAa,OAAO,QAAQ,eAAe,YACpE,MAAM,YAAY,cAAc,sBAAsB,IAAI;CAC5D,IAAI,QAAQ,UAAU,SAAS,QAAQ,YAAY,OAAO,QAAQ,aAAa,WAC7E,MAAM,YAAY,YAAY,qBAAqB,IAAI;CACzD,MAAM,OAAO,QAAQ;CACrB,IAAI,MAAM;EACR,IAAI,MAAM,QAAQ,UAAU,GAC1B,MAAM,OAAO,uBAAO,IAAI,UAAU,8CAA8C,GAAG;GACjF,MAAM;GACN,YAAY;EACd,CAAC;EACH,IAAI,OAAO,SAAS,UAAU;GAC5B,IAAI,KAAK,UAAU,KAAK,WAAW,UAAU,KAAK,WAAW,QAC3D,MAAM,YAAY,eAAe,wBAAwB,IAAI;GAC/D,IAAI,KAAK,SAAS,CAAC,MAAM,QAAQ,KAAK,KAAK,GACzC,MAAM,YAAY,cAAc,oBAAoB,IAAI;GAC1D,IAAI,KAAK,cAAc,QAAQ,KAAK,eAAe,WAAW,KAAK,eAAe,YAChF,MAAM,YAAY,mBAAmB,6BAA6B,IAAI;GACxE,IAAI,KAAK,WAAW,UAAU,OAAO,KAAK,WAAW,YACnD,MAAM,YACJ,eACA,uDACA,IACF;EACJ;CACF;CACA,OAAO;EAAE,GAAG;EAAS,MAAM;CAAW;AACxC;;AAGA,eAAe,WAAW,SAA+B,QAAsC;CAC7F,MAAM,EAAE,SAAS,MAAM,OAAO;CAC9B,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,IAAI,QAAQ,OAAO,CAAC,QAAQ,IAAI;CACxE,MAAM,yBAAS,IAAI,IAAuB;CAC1C,MAAM,UAAU,IAAI,IAClB,QAAQ,UAAU,SACd,CAAC,YAAY,IACb,QAAQ,UAAU,QAChB,CAAC,IACD,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,CAC7B;CACA,MAAM,mCAAmB,IAAI,IAAoB;CACjD,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,OAAO,SAAS,UAAU;EAC9B,MAAM,WAAW,KAAK,MAAM,KAAK,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC,QAAQ,QAAQ,GAAG;EACpF,MAAM,QAAQ,MAAM,KAAK,SAAS;GAChC,KAAK;GACL,UAAU;GACV,QAAQ;GACR,OAAO;GACP,KAAK,QAAQ;GACb,QAAQ,QAAQ;EAClB,CAAC;EACD,KAAK,MAAM,YAAY,OAAO;GAC5B,MAAM,OAAO,SAAS,MAAM,KAAK,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG;GAC/D,MAAM,MAAM,SAAS;GACrB,IAAI,OAAO,IAAI,GAAG,GAAG;GACrB,OAAO,IAAI,KAAK;IAAE;IAAK,MAAM,IAAI;IAAQ;GAAS,CAAC;GAGnD,MAAM,MAAM,KAAK,MAAM,SAAS,GAAG;GACnC,IAAI,QAAQ,IAAI,GAAG,KAAK,CAAC,iBAAiB,IAAI,GAAG,GAC/C,iBAAiB,IAAI,KAAK,MAAM,QAAQ,GAAG,GAAG,QAAQ;EAC1D;CACF;CACA,KAAK,MAAM,CAAC,WAAW,aAAa,kBAAkB;EACpD,MAAM,MAAM,aAAa,UAAU,SAAS,GAAG,IAAI,KAAK;EACxD,MAAM,OAAO,MAAM,IAAI,QAAQ,QAAQ,EAAE;EACzC,OAAO,IAAI,KAAK;GAAE;GAAK;GAAM;EAAS,CAAC;EACvC,IAAI,QAAQ,aAAa,MACvB,OAAO,IAAI,IAAI,QAAQ,OAAO,EAAE,GAAG;GACjC,KAAK,IAAI,QAAQ,OAAO,EAAE;GAC1B,MAAM,KAAK,QAAQ,OAAO,EAAE;GAC5B;EACF,CAAC;CACL;CACA,OAAO,CAAC,GAAG,OAAO,OAAO,CAAC;AAC5B;;;;;;AAOA,SAAgB,mBACd,QACA,OACA,QAAyB,CAAC,GACpB;CACN,MAAM,UAAU,cAAc,QAAQ,KAAK;CAG3C,OAAO,SACL,OAAO,OAAO,OAAO,aAA8B,cAAc,UAAU,SAAS,KAAK,GAAG,GACzF,OAAO,IAAI,eAAe,IAAI,KACjC,CAAC,CACH;AACF;AAcA,eAAe,cACb,QACA,SACA,OACe;CACf,MAAM,iBAAiB,QAAQ,UAAU;CACzC,MAAM,SACJ,QAAQ,4BAA4B,eAAe,SAAS,GAAG,IAC3D,iBACA,GAAG,eAAe;CACxB,MAAM,2BAAW,IAAI,IAAgC;CACrD,MAAM,6BAAa,IAAI,IAA4B;CACnD,IAAI;CAEJ,SAAS,aAA4B;EACnC,OAAQ,iBAAiB,YAAY;GACnC,MAAM,SAAS,OAAO,OAAO,MAAM;GACnC,MAAM,WAAW,UAAyC;IACxD,MAAM,MAAM,MAAM,OAAQ,MAA2C;IACrE,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,gDAAgD;IAC1E,KAAK,MAAM,UAAU,CAAC,MAAM,MAAM,CAAC,CAAC,KAAK,GAAG,SAAS,IAAI,GAAG,OAAO,GAAG,OAAO,MAAM,OAAO;IAC1F,OAAO;GACT;GACA,OAAO,iBAAiB,QAAQ;IAC9B,OAAO,EAAE,OAAO,QAAQ;IACxB,KAAK,EACH,QACE,KACA,OACA,YACG,QAAQ;KAAE,GAAG;KAAO;KAAK,QAAQ,CAAC,OAAO,MAAM;KAAG;IAAQ,CAAC,EAClE;IACA,eAAe,EACb,QAAQ,MAAc,YAA4B;KAChD,WAAW,IAAI,MAAM,OAAO;KAC5B,OAAO;IACT,EACF;GACF,CAAC;GACD,MAAM,EAAE,SAAS,iBAAiB,MAAM,OAAO;GAC/C,MAAM,aAAa,QAAQ;IAAE,GAAG;IAAS,eAAe;IAAM,iBAAiB;GAAK,CAAC;EACvF,EAAC,CAAE;CACL;CAEA,IAAI,QAAQ,kBAAkB,OAC5B,KAAK,MAAM,QAAQ,CAAC,YAAY,UAAU,GACxC,OAAO,cAAc,MAAM,SAA8B,GAAG,MAAiB;EAC3E,AAAK,WAAW,CAAC,CACd,WAAW;GACV,MAAM,YAAY,WAAW,IAAI,IAAI;GACrC,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,iCAAiC,KAAK,EAAE;GACxE,UAAU,MAAM,MAAM,IAAI;EAC5B,CAAC,CAAC,CACD,OAAO,UAAmB,KAAK,KAAK,KAAK,CAAC;EAC7C,OAAO;CACT,CAAC;CAGL,IAAI,QAAQ,UAAU,OAAO;CAC7B,MAAM,SACJ,QAAQ,aAAa,QAAQ,MAAM,WAAW,SAAS,MAAM,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC;CACzF,IAAI,QAAQ,aAAa,SAAS,QAAQ,aAAa,QAAQ,WAAW,gBACxE,OAAO,KAAK,EAAE,KAAK,eAAe,CAAC;CACrC,MAAM,SAA4C,EAAE,MAAM,QAAQ,cAAc,KAAK;CACrF,KAAK,MAAM,SAAS,QAClB,OAAO,MAAM;EACX,KAAK,MAAM;EACX,QAAQ,CAAC,QAAQ,KAAK;EACtB,aAAa,QAAQ;EACrB;EACA,UAAU,QAAQ;EAClB,QAAQ;GACN,GAAI,MAAM,OAAO;IAAE,MAAM,MAAM;IAAM,UAAU,MAAM;GAAS,IAAI,CAAC;GACnE,GAAI,MAAM,cAAc,SAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;EACxE;EACA,aAAa,OAAO,SAAS,OAAO;GAClC,IAAI,OAAO,SAAS,8BAA8B;IAChD,MAAM,QAAQ,IAAI,QAAQ;IAC1B;GACF;GACA,OAAO,OAAO,aAAa,OAAO,SAAS,KAAK;EAClD;EACA,MAAM,QAAQ,SAAyB,OAAqB;GAC1D,MAAM,WAAW;GACjB,MAAM,UAAU,SAAS,IAAI,GAAG,QAAQ,OAAO,GAAG,MAAM,KAAK;GAC7D,IAAI,SAAS;IACX,MAAM,QAAQ,KAAK,QAAQ,SAAS,KAAK;IAGzC,OAAO;GACT;GAEA,IAAI,MAAM,MAAM;IACd,MAAM,WAAW,WAAW,IAAI,UAAU;IAC1C,IAAI,UAAU,OAAO,SAAS,KAAK,OAAO,MAAM,MAAM,MAAM,QAAQ;GACtE;GACA,OAAO,MAAM,aAAa;EAC5B;CACF,CAAC;AAEL"}

package/esm/http/middleware/cache-response-middleware.d.mts

@@ -1,8 +1,7 @@
 import { Request } from "../request.mjs";
 import { Middleware } from "../../router/types.mjs";
-
 //#region ../../packages/core/src/http/middleware/cache-response-middleware.d.ts
-type CacheMiddlewareOptions = {
+export type CacheMiddlewareOptions = {
   /**
    * Cache key
    */
@@ -44,7 +43,6 @@ type CacheMiddlewareOptions = {
    */
   tags?: string[] | ((request: Request) => string[]);
 };
-declare function cacheMiddleware(responseCacheOptions: CacheMiddlewareOptions | string): Middleware;
+export declare function cacheMiddleware(responseCacheOptions: CacheMiddlewareOptions | string): Middleware;
 //#endregion
-export { CacheMiddlewareOptions, cacheMiddleware };
 //# sourceMappingURL=cache-response-middleware.d.mts.map