@warlock.js/core 5.31.0 → 5.32.0

package/esm/http/conditional-request.d.mts

@@ -16,7 +16,7 @@
 /**
  * One parsed entity tag. `opaque` keeps its quotes, so `"a"` and `a` differ.
  */
-type EntityTag = {
+export type EntityTag = {
   weak: boolean;
   opaque: string;
 };
@@ -25,37 +25,39 @@ type EntityTag = {
  * opaque tag. A value without quotes is kept as its own opaque tag so an
  * application-supplied unquoted ETag still compares with itself.
  */
-declare function parseEntityTag(value: string): EntityTag | undefined;
+export declare function parseEntityTag(value: string): EntityTag | undefined;
 /**
  * Parse an `If-Match` / `If-None-Match` value: `"*"` or a comma-separated list
  * of entity tags. A comma inside a quoted tag is part of the tag.
  */
-declare function parseEntityTagList(header: unknown): "*" | EntityTag[] | undefined;
+export declare function parseEntityTagList(header: unknown): "*" | EntityTag[] | undefined;
 /**
  * Weak comparison: the opaque tags are identical.
  */
-declare function weakEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
+export declare function weakEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
 /**
  * Strong comparison: neither tag is weak and the opaque tags are identical.
  */
-declare function strongEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
+export declare function strongEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
 /**
  * Whether an `If-None-Match` header matches the current entity tag, with weak
  * comparison. `*` matches any current representation.
  */
-declare function matchesIfNoneMatch(header: unknown, etag: string): boolean;
+export declare function matchesIfNoneMatch(header: unknown, etag: string): boolean;
 /**
  * Whether an `If-Match` header is satisfied by the current entity tag, with
  * strong comparison. `*` is satisfied by any current representation, so it
  * fails only when there is none (`etag` undefined).
  */
-declare function matchesIfMatch(header: unknown, etag: string | undefined): boolean;
+export declare function matchesIfMatch(header: unknown, etag: string | undefined): boolean;
 /**
  * The request headers and current validators a precondition check reads.
  */
-type ConditionalRequestInput = {
-  method: string; /** Current entity tag, quoted, optionally `W/`-prefixed. */
-  etag?: string; /** Current modification time. HTTP dates have second precision. */
+export type ConditionalRequestInput = {
+  method: string;
+  /** Current entity tag, quoted, optionally `W/`-prefixed. */
+  etag?: string;
+  /** Current modification time. HTTP dates have second precision. */
   lastModified?: Date | number;
   ifMatch?: unknown;
   ifNoneMatch?: unknown;
@@ -69,7 +71,7 @@ type ConditionalRequestInput = {
  * - `"not-modified"`: answer a GET or HEAD with 304;
  * - `"precondition-failed"`: answer with 412.
  */
-type ConditionalRequestOutcome = "proceed" | "not-modified" | "precondition-failed";
+export type ConditionalRequestOutcome = "proceed" | "not-modified" | "precondition-failed";
 /**
  * Evaluate the precondition headers in RFC 9110 §13.2.2 order:
  *
@@ -80,7 +82,6 @@ type ConditionalRequestOutcome = "proceed" | "not-modified" | "precondition-fail
  *
  * An invalid date is ignored, as the RFC requires.
  */
-declare function evaluateConditionalRequest(input: ConditionalRequestInput): ConditionalRequestOutcome;
+export declare function evaluateConditionalRequest(input: ConditionalRequestInput): ConditionalRequestOutcome;
 //#endregion
-export { ConditionalRequestInput, ConditionalRequestOutcome, EntityTag, evaluateConditionalRequest, matchesIfMatch, matchesIfNoneMatch, parseEntityTag, parseEntityTagList, strongEntityTagMatch, weakEntityTagMatch };
 //# sourceMappingURL=conditional-request.d.mts.map

package/esm/http/conditional-request.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"conditional-request.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/conditional-request.ts"],"mappings":";;AAkBA;;;;AAEQ;AAQR;;;;AAAwD;AAiBxD;;;;AAAoE;AA+BpE;KA1DY,SAAA;EACV,IAAA;EACA,MAAM;AAAA;;;;;AAwD8D;iBAhDtD,cAAA,CAAe,KAAA,WAAgB,SAAS;;;;;iBAiBxC,kBAAA,CAAmB,MAAA,kBAAwB,SAAS;;;;iBA+BpD,kBAAA,CAAmB,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,SAAS;AAetE;;;AAAA,iBARgB,oBAAA,CAAqB,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,SAAS;AAQR;AAgBhE;;;AAhBgE,iBAAhD,kBAAA,CAAmB,MAAA,WAAiB,IAAY;AAgBQ;AAiBxE;;;;AAjBwE,iBAAxD,cAAA,CAAe,MAAA,WAAiB,IAAwB;;;;KAiB5D,uBAAA;EACV,MAAA,UAOA;EALA,IAAA,WAMiB;EAJjB,YAAA,GAAe,IAAI;EACnB,OAAA;EACA,WAAA;EACA,eAAA;EACA,iBAAA;AAAA;AA0CF;;;;;;;AAAA,KAhCY,yBAAA;AAkCgB;;;;;;;;;;AAAA,iBAFZ,0BAAA,CACd,KAAA,EAAO,uBAAA,GACN,yBAAyB"}
+{"version":3,"file":"conditional-request.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/conditional-request.ts"],"mappings":";;;;;;;;;;;;;;;;;;YAkBY;EACV;EACA;;;;;;;wBAQc,eAAe,gBAAgB;;;;;wBAiB/B,mBAAmB,wBAAwB;;;;wBA+B3C,mBAAmB,OAAO,WAAW,QAAQ;;;;wBAO7C,qBAAqB,OAAO,WAAW,QAAQ;;;;;wBAQ/C,mBAAmB,iBAAiB;;;;;;wBAgBpC,eAAe,iBAAiB;;;;YAiBpC;EACV;;EAEA;;EAEA,eAAe;EACf;EACA;EACA;EACA;;;;;;;;;YAUU;;;;;;;;;;;wBAgCI,2BACd,OAAO,0BACN"}

package/esm/http/config.d.mts

@@ -1,14 +1,12 @@
 import { HttpConfigurations } from "./types.mjs";
-
 //#region ../../packages/core/src/http/config.d.ts
 /**
  * Default http configurations
  */
-declare const defaultHttpConfigurations: HttpConfigurations;
+export declare const defaultHttpConfigurations: HttpConfigurations;
 /**
  * Get http configurations for the given key
  */
-declare function httpConfig(key: string): any;
+export declare function httpConfig(key: string): any;
 //#endregion
-export { defaultHttpConfigurations, httpConfig };
 //# sourceMappingURL=config.d.mts.map

package/esm/http/config.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"mappings":";;;;;AAOA;cAAa,yBAAA,EAA2B,kBAYvC;;;AAAA;iBAKe,UAAA,CAAW,GAAW"}
+{"version":3,"file":"config.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"mappings":";;;;;qBAOa,2BAA2B;;;;wBAiBxB,WAAW"}

package/esm/http/config.mjs

@@ -1,4 +1,4 @@
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { get } from "@mongez/reinforcements";
 
 //#region ../../packages/core/src/http/config.ts
@@ -18,7 +18,7 @@ const defaultHttpConfigurations = {
 * Get http configurations for the given key
 */
 function httpConfig(key) {
-	return config.get(`http.${key}`, get(defaultHttpConfigurations, key));
+	return baseConfig.get(`http.${key}`, get(defaultHttpConfigurations, key));
 }
 
 //#endregion

package/esm/http/config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { get } from \"@mongez/reinforcements\";\nimport type { HttpConfigurations } from \"./types\";\n\n/**\n * Default http configurations\n */\nexport const defaultHttpConfigurations: HttpConfigurations = {\n  port: 3000,\n  host: \"0.0.0.0\",\n  middleware: {\n    all: [],\n    only: {\n      middleware: [],\n    },\n    except: {\n      middleware: [],\n    },\n  },\n};\n\n/**\n * Get http configurations for the given key\n */\nexport function httpConfig(key: string): any {\n  return config.get(`http.${key}`, get(defaultHttpConfigurations, key));\n}\n"],"mappings":";;;;;;;AAOA,MAAa,4BAAgD;CAC3D,MAAM;CACN,MAAM;CACN,YAAY;EACV,KAAK,CAAC;EACN,MAAM,EACJ,YAAY,CAAC,EACf;EACA,QAAQ,EACN,YAAY,CAAC,EACf;CACF;AACF;;;;AAKA,SAAgB,WAAW,KAAkB;CAC3C,OAAO,OAAO,IAAI,QAAQ,OAAO,IAAI,2BAA2B,GAAG,CAAC;AACtE"}
+{"version":3,"file":"config.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { get } from \"@mongez/reinforcements\";\nimport type { HttpConfigurations } from \"./types\";\n\n/**\n * Default http configurations\n */\nexport const defaultHttpConfigurations: HttpConfigurations = {\n  port: 3000,\n  host: \"0.0.0.0\",\n  middleware: {\n    all: [],\n    only: {\n      middleware: [],\n    },\n    except: {\n      middleware: [],\n    },\n  },\n};\n\n/**\n * Get http configurations for the given key\n */\nexport function httpConfig(key: string): any {\n  return config.get(`http.${key}`, get(defaultHttpConfigurations, key));\n}\n"],"mappings":";;;;;;;AAOA,MAAa,4BAAgD;CAC3D,MAAM;CACN,MAAM;CACN,YAAY;EACV,KAAK,CAAC;EACN,MAAM,EACJ,YAAY,CAAC,EACf;EACA,QAAQ,EACN,YAAY,CAAC,EACf;CACF;AACF;;;;AAKA,SAAgB,WAAW,KAAkB;CAC3C,OAAOA,WAAO,IAAI,QAAQ,OAAO,IAAI,2BAA2B,GAAG,CAAC;AACtE"}

package/esm/http/context/request-context.d.mts

@@ -2,12 +2,11 @@ import { Response } from "../response.mjs";
 import { Request } from "../request.mjs";
 import { Model } from "@warlock.js/cascade";
 import { Context } from "@warlock.js/context";
-
 //#region ../../packages/core/src/http/context/request-context.d.ts
 /**
  * Request Context Store
  */
-type RequestContextStore<User extends Model = Model> = {
+export type RequestContextStore<User extends Model = Model> = {
   request: Request<User>;
   response: Response;
 };
@@ -52,13 +51,13 @@ declare class RequestContext<User extends Model = Model> extends Context<Request
 /**
  * Global request context instance
  */
-declare const requestContext: RequestContext<Model<import("@warlock.js/cascade").ModelSchema>>;
+export declare const requestContext: RequestContext<Model<import("@warlock.js/cascade").ModelSchema>>;
 /**
  * Use request store (for backward compatibility)
  */
-declare function useRequestStore<UserType extends Model = Model>(): RequestContextStore<UserType>;
-declare function useRequest<UserType extends Model = Model>(): Request<UserType>;
-declare function useCurrentUser<UserType extends Model = Model>(): UserType;
+export declare function useRequestStore<UserType extends Model = Model>(): RequestContextStore<UserType>;
+export declare function useRequest<UserType extends Model = Model>(): Request<UserType>;
+export declare function useCurrentUser<UserType extends Model = Model>(): UserType;
 //#endregion
-export { RequestContextStore, requestContext, useCurrentUser, useRequest, useRequestStore };
+export {};
 //# sourceMappingURL=request-context.d.mts.map

package/esm/http/context/request-context.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-context.ts"],"mappings":";;;;;;;;AAQA;KAAY,mBAAA,cAAiC,KAAA,GAAQ,KAAA;EACnD,OAAA,EAAS,OAAA,CAAQ,IAAA;EACjB,QAAA,EAAU,QAAA;AAAA;;;;;;;cASN,cAAA,cAA4B,KAAA,GAAQ,KAAA,UAAe,OAAA,CAAQ,mBAAA,CAAoB,IAAA;EAXhC;;;EAe5C,UAAA,IAAc,OAAA,CAAQ,IAAA;EAb7B;;;EAoBO,WAAA,IAAe,QAAA;EAXlB;;;;;;;;;;;;;;;;;EAgCG,OAAA;EAhCiC;;;EAyCjC,UAAA,CAAW,OAAA,GAAU,MAAA,gBAAsB,mBAAA,CAAoB,IAAA;AAAA;;;;cAW3D,cAAA,EAAc,cAAA,CAAA,KAAA,+BAAA,WAAA;;;;iBAOX,eAAA,kBAAiC,KAAA,GAAQ,KAAA,KACX,mBAAA,CAAoB,QAAA;AAAA,iBAGlD,UAAA,kBAA4B,KAAA,GAAQ,KAAA,KACZ,OAAA,CAAQ,QAAA;AAAA,iBAGhC,cAAA,kBAAgC,KAAA,GAAQ,KAAA,KAOnB,QAAA"}
+{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-context.ts"],"mappings":";;;;;;;;YAQY,oBAAoB,aAAa,QAAQ;EACnD,SAAS,QAAQ;EACjB,UAAU;;;;;;;;cASN,eAAe,aAAa,QAAQ,eAAe,QAAQ,oBAAoB;;;;EAI5E,cAAc,QAAQ;;;;EAOtB,eAAe;;;;;;;;;;;;;;;;;;EAqBf;;;;EASA,WAAW,UAAU,sBAAsB,oBAAoB;;;;;qBAW3D,gBAAc,eAAA,oCAAA;;;;wBAOX,gBAAgB,iBAAiB,QAAQ,UACX,oBAAoB;wBAGlD,WAAW,iBAAiB,QAAQ,UACZ,QAAQ;wBAGhC,eAAe,iBAAiB,QAAQ,UAOnB"}

package/esm/http/context/request-memo.d.mts

@@ -15,7 +15,6 @@
  * leak this helper exists to prevent — so calling it outside a request
  * context throws instead of silently memoizing across requests.
  */
-declare function requestMemo<T>(key: string, fn: () => Promise<T>): Promise<T>;
+export declare function requestMemo<T>(key: string, fn: () => Promise<T>): Promise<T>;
 //#endregion
-export { requestMemo };
 //# sourceMappingURL=request-memo.d.mts.map

package/esm/http/context/request-memo.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-memo.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-memo.ts"],"mappings":";;AA2BA;;;;;;;;;;;;;;;iBAAgB,WAAA,IAAe,GAAA,UAAa,EAAA,QAAU,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA"}
+{"version":3,"file":"request-memo.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-memo.ts"],"mappings":";;;;;;;;;;;;;;;;;wBA2BgB,YAAY,GAAG,aAAa,UAAU,QAAQ,KAAK,QAAQ"}

package/esm/http/createHttpApplication.d.mts

@@ -1,6 +1,5 @@
 //#region ../../packages/core/src/http/createHttpApplication.d.ts
-declare function createHttpApplication(): Promise<void>;
-declare function stopHttpApplication(): Promise<void>;
+export declare function createHttpApplication(): Promise<void>;
+export declare function stopHttpApplication(): Promise<void>;
 //#endregion
-export { createHttpApplication, stopHttpApplication };
 //# sourceMappingURL=createHttpApplication.d.mts.map

package/esm/http/createHttpApplication.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"createHttpApplication.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"mappings":";iBASsB,qBAAA,IAAqB,OAAA;AAAA,iBAmCrB,mBAAA,IAAmB,OAAA"}
+{"version":3,"file":"createHttpApplication.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"mappings":";wBASsB,yBAAqB;wBAmCrB,uBAAmB"}

package/esm/http/createHttpApplication.mjs

@@ -5,7 +5,7 @@ import { router } from "../router/router.mjs";
 import "../router/index.mjs";
 import { registerHttpPlugins } from "./plugins.mjs";
 import { getHttpServer, startHttpServer } from "./server.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { log } from "@warlock.js/logger";
 
 //#region ../../packages/core/src/http/createHttpApplication.ts
@@ -21,7 +21,7 @@ async function createHttpApplication() {
 			port,
 			host: httpConfig("host")
 		});
-		const baseUrl = config.get("app.baseUrl");
+		const baseUrl = baseConfig.get("app.baseUrl");
 		setBaseUrl(baseUrl);
 		log.success("http", "server", `Server is listening on ${baseUrl}`);
 	} catch (error) {

package/esm/http/createHttpApplication.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createHttpApplication.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { validateCspConfigAtBoot } from \"./csp\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  // Fail loudly, before the server ever binds a port, when `http.csp` is\n  // enabled with a malformed directive — never silently repair it and never\n  // wait for the first request to discover it.\n  validateCspConfigAtBoot();\n\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,wBAAwB;CAI5C,wBAAwB;CAExB,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAU,OAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}
+{"version":3,"file":"createHttpApplication.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { validateCspConfigAtBoot } from \"./csp\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  // Fail loudly, before the server ever binds a port, when `http.csp` is\n  // enabled with a malformed directive — never silently repair it and never\n  // wait for the first request to discover it.\n  validateCspConfigAtBoot();\n\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,wBAAwB;CAI5C,wBAAwB;CAExB,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAUA,WAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}

package/esm/http/csp.d.mts

@@ -1,6 +1,5 @@
 import { Response } from "./response.mjs";
 import { Request } from "./request.mjs";
-
 //#region ../../packages/core/src/http/csp.d.ts
 /**
  * App-facing `http.csp` configuration shape.
@@ -22,7 +21,7 @@ import { Request } from "./request.mjs";
  * };
  * ```
  */
-type CspConfig = {
+export type CspConfig = {
   /**
    * Turn the header on. Everything else in this type is inert while this is
    * `false`/unset.
@@ -55,7 +54,7 @@ type CspConfig = {
  * sites — and documented here rather than only in the skill, since this is
  * the literal set an app's `directives` entry replaces one key at a time.
  */
-declare const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>>;
+export declare const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>>;
 /**
  * Thrown at boot when `http.csp.directives` contains a value the framework
  * refuses to ship as-is, rather than silently dropping or rewriting it.
@@ -68,7 +67,7 @@ declare const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>
  *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an
  *   unbalanced count means a keyword was truncated or malformed.
  */
-declare class InvalidCspDirectiveError extends Error {
+export declare class InvalidCspDirectiveError extends Error {
   readonly directive: string;
   readonly value: string;
   /** Stable Warlock error code; `warlock explain WL1004` prints the fix. */
@@ -82,11 +81,11 @@ declare class InvalidCspDirectiveError extends Error {
  * Exported so boot code and tests can call it directly, independent of
  * whether `http.csp` happens to be enabled.
  */
-declare function validateCspDirectives(directives: Record<string, string[]> | undefined): void;
+export declare function validateCspDirectives(directives: Record<string, string[]> | undefined): void;
 /**
  * Read the app's `http.csp` config, if any.
  */
-declare function resolveCspConfig(): CspConfig | undefined;
+export declare function resolveCspConfig(): CspConfig | undefined;
 /**
  * Fail the boot loudly when `http.csp` is enabled with invalid directives.
  *
@@ -98,7 +97,7 @@ declare function resolveCspConfig(): CspConfig | undefined;
  *
  * @throws {InvalidCspDirectiveError} when a directive value is malformed.
  */
-declare function validateCspConfigAtBoot(): void;
+export declare function validateCspConfigAtBoot(): void;
 /**
  * Merge the app's directives over the framework defaults and fold in the
  * request's nonce.
@@ -110,17 +109,17 @@ declare function validateCspConfigAtBoot(): void;
  * framework's own inline payload script and hydration module script are
  * never blocked by an app's own policy.
  */
-declare function mergeCspDirectives(appDirectives: Record<string, string[]> | undefined, nonce: string): Record<string, string[]>;
+export declare function mergeCspDirectives(appDirectives: Record<string, string[]> | undefined, nonce: string): Record<string, string[]>;
 /**
  * Serialize a merged directive map into a header value —
  * `"default-src 'self'; script-src 'self' 'nonce-...'; ..."`.
  */
-declare function serializeCspDirectives(directives: Record<string, string[]>): string;
+export declare function serializeCspDirectives(directives: Record<string, string[]>): string;
 /**
  * Build the full `Content-Security-Policy` (or `-Report-Only`) header value
  * for one request, using that request's own nonce.
  */
-declare function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string;
+export declare function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string;
 /**
  * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,
  * `Content-Security-Policy-Report-Only`) header on the response, when the
@@ -135,7 +134,6 @@ declare function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): strin
  * header is the one still available later for the web layer's `<script>`
  * tags to read off `request.nonce`.
  */
-declare function applyCspHeader(request: Request, response: Response): void;
+export declare function applyCspHeader(request: Request, response: Response): void;
 //#endregion
-export { CspConfig, DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives };
 //# sourceMappingURL=csp.d.mts.map

package/esm/http/csp.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csp.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"mappings":";;;;;;AAwBA;;;;;;;;;AAyBqB;AASrB;;;;AAAoD;AAsBpD;;;KAxDY,SAAA;EAwDkC;;;;EAnD5C,OAAA;EAwDkB;;;;AAEF;AAkBlB;;;;EAlEE,UAAA;EA8Fc;;;;AAA6B;AAe7C;;;;EAnGE,UAAA,GAAa,MAAM;AAAA;;;;;;;cASR,sBAAA,EAAwB,QAAQ,CAAC,MAAA;;AAgHrC;AAmCT;;;;AAA2E;AAU3E;;;;;cAvIa,wBAAA,SAAiC,KAAK;EAAA,SAK/B,SAAA;EAAA,SACA,KAAA;EAiImD;EAAA,SArIrD,IAAA;cAGE,SAAA,UACA,KAAA,UAChB,MAAA;AAAA;;;;;;;AAkJ+D;iBAhInD,qBAAA,CAAsB,UAAgD,EAApC,MAAM;;;;iBA4BxC,gBAAA,IAAoB,SAAS;;;;;;;;;;;;iBAe7B,uBAAA;;;;;;;;;;;;iBAmBA,kBAAA,CACd,aAAA,EAAe,MAAA,gCACf,KAAA,WACC,MAAM;;;;;iBAmCO,sBAAA,CAAuB,UAAoC,EAAxB,MAAM;;;;;iBAUzC,mBAAA,CAAoB,SAAA,EAAW,SAAS,EAAE,KAAA;;;;;;;;;;;;;;;iBAkB1C,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,QAAQ"}
+{"version":3,"file":"csp.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;YAwBY;;;;;EAKV;;;;;;;;;;EAUA;;;;;;;;;;EAUA,aAAa;;;;;;;;qBASF,wBAAwB,SAAS;;;;;;;;;;;;;qBAsBjC,iCAAiC;WAK1B;WACA;;WAJF;EAEhB,YACkB,mBACA,eAChB;;;;;;;;;wBAkBY,sBAAsB,YAAY;;;;wBA4BlC,oBAAoB;;;;;;;;;;;;wBAepB;;;;;;;;;;;;wBAmBA,mBACd,eAAe,sCACf,gBACC;;;;;wBAmCa,uBAAuB,YAAY;;;;;wBAUnC,oBAAoB,WAAW,WAAW;;;;;;;;;;;;;;;wBAkB1C,eAAe,SAAS,SAAS,UAAU"}

package/esm/http/csp.mjs

@@ -1,4 +1,4 @@
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 
 //#region ../../packages/core/src/http/csp.ts
 /**
@@ -55,7 +55,7 @@ function validateCspDirectives(directives) {
 * Read the app's `http.csp` config, if any.
 */
 function resolveCspConfig() {
-	return config.get("http.csp");
+	return baseConfig.get("http.csp");
 }
 /**
 * Fail the boot loudly when `http.csp` is enabled with invalid directives.

package/esm/http/csp.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csp.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/**\n * App-facing `http.csp` configuration shape.\n *\n * Disabled by default: an app that never sets `http.csp` (or sets\n * `enabled: false`) gets no `Content-Security-Policy` header at all — zero\n * behaviour change for every existing app. Opting in only swaps `enabled` to\n * `true`; `reportOnly` and `directives` are optional refinements on top.\n *\n * @example\n * ```ts title=\"src/config/http.ts\"\n * const httpConfigurations: HttpConfigurations = {\n *   csp: {\n *     enabled: true,\n *     directives: {\n *       \"img-src\": [\"'self'\", \"data:\", \"https://cdn.example.com\"],\n *     },\n *   },\n * };\n * ```\n */\nexport type CspConfig = {\n  /**\n   * Turn the header on. Everything else in this type is inert while this is\n   * `false`/unset.\n   */\n  enabled: boolean;\n  /**\n   * Emit `Content-Security-Policy-Report-Only` instead of the enforcing\n   * `Content-Security-Policy` header — the browser reports violations\n   * (via `report-to`/`report-uri`, if the app's directives configure one)\n   * without blocking anything. Use this to observe a policy safely before\n   * enforcing it.\n   *\n   * @default false\n   */\n  reportOnly?: boolean;\n  /**\n   * App-supplied directive values. A directive named here REPLACES the\n   * framework's default list for that directive entirely (the two lists are\n   * never merged element-wise) — declare the full value list you want.\n   *\n   * `script-src` is special-cased regardless of whether it is declared here:\n   * the current request's CSP nonce (`'nonce-<value>'`) is always appended to\n   * it, so the framework's own inline/module scripts keep working.\n   */\n  directives?: Record<string, string[]>;\n};\n\n/**\n * The policy every `http.csp`-enabled app starts from. Deliberately\n * conservative — same-origin by default, no plugins, no framing by other\n * sites — and documented here rather than only in the skill, since this is\n * the literal set an app's `directives` entry replaces one key at a time.\n */\nexport const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>> = {\n  \"default-src\": [\"'self'\"],\n  \"script-src\": [\"'self'\"],\n  \"style-src\": [\"'self'\"],\n  \"img-src\": [\"'self'\", \"data:\"],\n  \"object-src\": [\"'none'\"],\n  \"base-uri\": [\"'self'\"],\n  \"frame-ancestors\": [\"'self'\"],\n};\n\n/**\n * Thrown at boot when `http.csp.directives` contains a value the framework\n * refuses to ship as-is, rather than silently dropping or rewriting it.\n *\n * Two shapes are rejected:\n * - a value containing `;` — CSP directives are `;`-delimited, so a `;`\n *   inside one value would prematurely close it and let the remainder be\n *   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.\n * - a value with an odd number of `'` characters — every CSP keyword\n *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an\n *   unbalanced count means a keyword was truncated or malformed.\n */\nexport class InvalidCspDirectiveError extends Error {\n  /** Stable Warlock error code; `warlock explain WL1004` prints the fix. */\n  public readonly code = \"WL1004\";\n\n  public constructor(\n    public readonly directive: string,\n    public readonly value: string,\n    reason: string,\n  ) {\n    super(\n      `Invalid \"http.csp.directives\" entry — directive \"${directive}\" has a value ` +\n        `${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; ` +\n        `the framework will not silently repair it.`,\n    );\n    this.name = \"InvalidCspDirectiveError\";\n  }\n}\n\n/**\n * Validate every directive value an app supplied, throwing\n * {@link InvalidCspDirectiveError} on the first offender.\n *\n * Exported so boot code and tests can call it directly, independent of\n * whether `http.csp` happens to be enabled.\n */\nexport function validateCspDirectives(directives: Record<string, string[]> | undefined): void {\n  if (!directives) return;\n\n  for (const [directive, values] of Object.entries(directives)) {\n    for (const value of values) {\n      if (value.includes(\";\")) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"contains a ';' character, which would truncate the directive.\",\n        );\n      }\n\n      const quoteCount = (value.match(/'/g) ?? []).length;\n      if (quoteCount % 2 !== 0) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"has an unbalanced number of ' characters.\",\n        );\n      }\n    }\n  }\n}\n\n/**\n * Read the app's `http.csp` config, if any.\n */\nexport function resolveCspConfig(): CspConfig | undefined {\n  return config.get(\"http.csp\");\n}\n\n/**\n * Fail the boot loudly when `http.csp` is enabled with invalid directives.\n *\n * Called once, from {@link createHttpApplication} before the server starts\n * listening — never per-request. A per-request validation would let an app\n * boot successfully and only discover the bad config on first traffic;\n * checking once at boot surfaces it immediately, the same way a malformed\n * `warlock.config.ts` would.\n *\n * @throws {InvalidCspDirectiveError} when a directive value is malformed.\n */\nexport function validateCspConfigAtBoot(): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  validateCspDirectives(cspConfig.directives);\n}\n\n/**\n * Merge the app's directives over the framework defaults and fold in the\n * request's nonce.\n *\n * Per-directive replacement, not element-wise merging: a directive the app\n * names wins outright, everything else falls back to\n * {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains\n * `'nonce-<nonce>'` on top, whichever list it started from, so the\n * framework's own inline payload script and hydration module script are\n * never blocked by an app's own policy.\n */\nexport function mergeCspDirectives(\n  appDirectives: Record<string, string[]> | undefined,\n  nonce: string,\n): Record<string, string[]> {\n  const merged: Record<string, string[]> = {};\n\n  for (const [directive, defaultValues] of Object.entries(DEFAULT_CSP_DIRECTIVES)) {\n    merged[directive] = appDirectives?.[directive]\n      ? [...appDirectives[directive]]\n      : [...defaultValues];\n  }\n\n  if (appDirectives) {\n    for (const [directive, values] of Object.entries(appDirectives)) {\n      if (!(directive in merged)) {\n        merged[directive] = [...values];\n      }\n    }\n  }\n\n  // `merged[\"script-src\"]` is always populated by the loop above —\n  // `DEFAULT_CSP_DIRECTIVES` (:59-67) declares a `script-src` entry, and every\n  // one of its keys is copied into `merged` unconditionally — but its type is\n  // `Record<string, string[]>`, so `noUncheckedIndexedAccess` still widens the\n  // read to `string[] | undefined`. Narrowed once, locally, rather than\n  // asserted away.\n  const scriptSrc = merged[\"script-src\"] ?? [];\n  const nonceSource = `'nonce-${nonce}'`;\n\n  merged[\"script-src\"] = scriptSrc.includes(nonceSource) ? scriptSrc : [...scriptSrc, nonceSource];\n\n  return merged;\n}\n\n/**\n * Serialize a merged directive map into a header value —\n * `\"default-src 'self'; script-src 'self' 'nonce-...'; ...\"`.\n */\nexport function serializeCspDirectives(directives: Record<string, string[]>): string {\n  return Object.entries(directives)\n    .map(([directive, values]) => `${directive} ${values.join(\" \")}`)\n    .join(\"; \");\n}\n\n/**\n * Build the full `Content-Security-Policy` (or `-Report-Only`) header value\n * for one request, using that request's own nonce.\n */\nexport function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string {\n  return serializeCspDirectives(mergeCspDirectives(cspConfig.directives, nonce));\n}\n\n/**\n * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,\n * `Content-Security-Policy-Report-Only`) header on the response, when the\n * app opted in via `http.csp.enabled`.\n *\n * A no-op when `http.csp` is absent or `enabled` is falsy — the default,\n * behaviour-preserving state for every app that hasn't opted in.\n *\n * Reads `request.nonce`, which lazily generates and caches the per-request\n * nonce (`request.ts`) — calling this early in the request lifecycle (see\n * `inject-request-context.ts`) means the SAME nonce this stamps into the\n * header is the one still available later for the web layer's `<script>`\n * tags to read off `request.nonce`.\n */\nexport function applyCspHeader(request: Request, response: Response): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  const headerName = cspConfig.reportOnly\n    ? \"Content-Security-Policy-Report-Only\"\n    : \"Content-Security-Policy\";\n\n  response.header(headerName, buildCspHeaderValue(cspConfig, request.nonce));\n}\n"],"mappings":";;;;;;;;;AA0DA,MAAa,yBAAsE;CACjF,eAAe,CAAC,QAAQ;CACxB,cAAc,CAAC,QAAQ;CACvB,aAAa,CAAC,QAAQ;CACtB,WAAW,CAAC,UAAU,OAAO;CAC7B,cAAc,CAAC,QAAQ;CACvB,YAAY,CAAC,QAAQ;CACrB,mBAAmB,CAAC,QAAQ;AAC9B;;;;;;;;;;;;;AAcA,IAAa,2BAAb,cAA8C,MAAM;CAIlD,AAAO,YACL,AAAgB,WAChB,AAAgB,OAChB,QACA;EACA,MACE,oDAAoD,UAAU,gBACzD,KAAK,UAAU,KAAK,EAAE,QAAQ,OAAO,qFAE5C;EARgB;EACA;cAJK;EAYrB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,sBAAsB,YAAwD;CAC5F,IAAI,CAAC,YAAY;CAEjB,KAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,UAAU,GACzD,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,GAAG,GACpB,MAAM,IAAI,yBACR,WACA,OACA,+DACF;EAIF,KADoB,MAAM,MAAM,IAAI,KAAK,CAAC,EAAC,CAAE,SAC5B,MAAM,GACrB,MAAM,IAAI,yBACR,WACA,OACA,2CACF;CAEJ;AAEJ;;;;AAKA,SAAgB,mBAA0C;CACxD,OAAO,OAAO,IAAI,UAAU;AAC9B;;;;;;;;;;;;AAaA,SAAgB,0BAAgC;CAC9C,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,sBAAsB,UAAU,UAAU;AAC5C;;;;;;;;;;;;AAaA,SAAgB,mBACd,eACA,OAC0B;CAC1B,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,WAAW,kBAAkB,OAAO,QAAQ,sBAAsB,GAC5E,OAAO,aAAa,gBAAgB,aAChC,CAAC,GAAG,cAAc,UAAU,IAC5B,CAAC,GAAG,aAAa;CAGvB,IAAI,eACF;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,aAAa,GAC5D,IAAI,EAAE,aAAa,SACjB,OAAO,aAAa,CAAC,GAAG,MAAM;CAElC;CASF,MAAM,YAAY,OAAO,iBAAiB,CAAC;CAC3C,MAAM,cAAc,UAAU,MAAM;CAEpC,OAAO,gBAAgB,UAAU,SAAS,WAAW,IAAI,YAAY,CAAC,GAAG,WAAW,WAAW;CAE/F,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,YAA8C;CACnF,OAAO,OAAO,QAAQ,UAAU,CAAC,CAC9B,KAAK,CAAC,WAAW,YAAY,GAAG,UAAU,GAAG,OAAO,KAAK,GAAG,GAAG,CAAC,CAChE,KAAK,IAAI;AACd;;;;;AAMA,SAAgB,oBAAoB,WAAsB,OAAuB;CAC/E,OAAO,uBAAuB,mBAAmB,UAAU,YAAY,KAAK,CAAC;AAC/E;;;;;;;;;;;;;;;AAgBA,SAAgB,eAAe,SAAkB,UAA0B;CACzE,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,MAAM,aAAa,UAAU,aACzB,wCACA;CAEJ,SAAS,OAAO,YAAY,oBAAoB,WAAW,QAAQ,KAAK,CAAC;AAC3E"}
+{"version":3,"file":"csp.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/**\n * App-facing `http.csp` configuration shape.\n *\n * Disabled by default: an app that never sets `http.csp` (or sets\n * `enabled: false`) gets no `Content-Security-Policy` header at all — zero\n * behaviour change for every existing app. Opting in only swaps `enabled` to\n * `true`; `reportOnly` and `directives` are optional refinements on top.\n *\n * @example\n * ```ts title=\"src/config/http.ts\"\n * const httpConfigurations: HttpConfigurations = {\n *   csp: {\n *     enabled: true,\n *     directives: {\n *       \"img-src\": [\"'self'\", \"data:\", \"https://cdn.example.com\"],\n *     },\n *   },\n * };\n * ```\n */\nexport type CspConfig = {\n  /**\n   * Turn the header on. Everything else in this type is inert while this is\n   * `false`/unset.\n   */\n  enabled: boolean;\n  /**\n   * Emit `Content-Security-Policy-Report-Only` instead of the enforcing\n   * `Content-Security-Policy` header — the browser reports violations\n   * (via `report-to`/`report-uri`, if the app's directives configure one)\n   * without blocking anything. Use this to observe a policy safely before\n   * enforcing it.\n   *\n   * @default false\n   */\n  reportOnly?: boolean;\n  /**\n   * App-supplied directive values. A directive named here REPLACES the\n   * framework's default list for that directive entirely (the two lists are\n   * never merged element-wise) — declare the full value list you want.\n   *\n   * `script-src` is special-cased regardless of whether it is declared here:\n   * the current request's CSP nonce (`'nonce-<value>'`) is always appended to\n   * it, so the framework's own inline/module scripts keep working.\n   */\n  directives?: Record<string, string[]>;\n};\n\n/**\n * The policy every `http.csp`-enabled app starts from. Deliberately\n * conservative — same-origin by default, no plugins, no framing by other\n * sites — and documented here rather than only in the skill, since this is\n * the literal set an app's `directives` entry replaces one key at a time.\n */\nexport const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>> = {\n  \"default-src\": [\"'self'\"],\n  \"script-src\": [\"'self'\"],\n  \"style-src\": [\"'self'\"],\n  \"img-src\": [\"'self'\", \"data:\"],\n  \"object-src\": [\"'none'\"],\n  \"base-uri\": [\"'self'\"],\n  \"frame-ancestors\": [\"'self'\"],\n};\n\n/**\n * Thrown at boot when `http.csp.directives` contains a value the framework\n * refuses to ship as-is, rather than silently dropping or rewriting it.\n *\n * Two shapes are rejected:\n * - a value containing `;` — CSP directives are `;`-delimited, so a `;`\n *   inside one value would prematurely close it and let the remainder be\n *   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.\n * - a value with an odd number of `'` characters — every CSP keyword\n *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an\n *   unbalanced count means a keyword was truncated or malformed.\n */\nexport class InvalidCspDirectiveError extends Error {\n  /** Stable Warlock error code; `warlock explain WL1004` prints the fix. */\n  public readonly code = \"WL1004\";\n\n  public constructor(\n    public readonly directive: string,\n    public readonly value: string,\n    reason: string,\n  ) {\n    super(\n      `Invalid \"http.csp.directives\" entry — directive \"${directive}\" has a value ` +\n        `${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; ` +\n        `the framework will not silently repair it.`,\n    );\n    this.name = \"InvalidCspDirectiveError\";\n  }\n}\n\n/**\n * Validate every directive value an app supplied, throwing\n * {@link InvalidCspDirectiveError} on the first offender.\n *\n * Exported so boot code and tests can call it directly, independent of\n * whether `http.csp` happens to be enabled.\n */\nexport function validateCspDirectives(directives: Record<string, string[]> | undefined): void {\n  if (!directives) return;\n\n  for (const [directive, values] of Object.entries(directives)) {\n    for (const value of values) {\n      if (value.includes(\";\")) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"contains a ';' character, which would truncate the directive.\",\n        );\n      }\n\n      const quoteCount = (value.match(/'/g) ?? []).length;\n      if (quoteCount % 2 !== 0) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"has an unbalanced number of ' characters.\",\n        );\n      }\n    }\n  }\n}\n\n/**\n * Read the app's `http.csp` config, if any.\n */\nexport function resolveCspConfig(): CspConfig | undefined {\n  return config.get(\"http.csp\");\n}\n\n/**\n * Fail the boot loudly when `http.csp` is enabled with invalid directives.\n *\n * Called once, from {@link createHttpApplication} before the server starts\n * listening — never per-request. A per-request validation would let an app\n * boot successfully and only discover the bad config on first traffic;\n * checking once at boot surfaces it immediately, the same way a malformed\n * `warlock.config.ts` would.\n *\n * @throws {InvalidCspDirectiveError} when a directive value is malformed.\n */\nexport function validateCspConfigAtBoot(): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  validateCspDirectives(cspConfig.directives);\n}\n\n/**\n * Merge the app's directives over the framework defaults and fold in the\n * request's nonce.\n *\n * Per-directive replacement, not element-wise merging: a directive the app\n * names wins outright, everything else falls back to\n * {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains\n * `'nonce-<nonce>'` on top, whichever list it started from, so the\n * framework's own inline payload script and hydration module script are\n * never blocked by an app's own policy.\n */\nexport function mergeCspDirectives(\n  appDirectives: Record<string, string[]> | undefined,\n  nonce: string,\n): Record<string, string[]> {\n  const merged: Record<string, string[]> = {};\n\n  for (const [directive, defaultValues] of Object.entries(DEFAULT_CSP_DIRECTIVES)) {\n    merged[directive] = appDirectives?.[directive]\n      ? [...appDirectives[directive]]\n      : [...defaultValues];\n  }\n\n  if (appDirectives) {\n    for (const [directive, values] of Object.entries(appDirectives)) {\n      if (!(directive in merged)) {\n        merged[directive] = [...values];\n      }\n    }\n  }\n\n  // `merged[\"script-src\"]` is always populated by the loop above —\n  // `DEFAULT_CSP_DIRECTIVES` (:59-67) declares a `script-src` entry, and every\n  // one of its keys is copied into `merged` unconditionally — but its type is\n  // `Record<string, string[]>`, so `noUncheckedIndexedAccess` still widens the\n  // read to `string[] | undefined`. Narrowed once, locally, rather than\n  // asserted away.\n  const scriptSrc = merged[\"script-src\"] ?? [];\n  const nonceSource = `'nonce-${nonce}'`;\n\n  merged[\"script-src\"] = scriptSrc.includes(nonceSource) ? scriptSrc : [...scriptSrc, nonceSource];\n\n  return merged;\n}\n\n/**\n * Serialize a merged directive map into a header value —\n * `\"default-src 'self'; script-src 'self' 'nonce-...'; ...\"`.\n */\nexport function serializeCspDirectives(directives: Record<string, string[]>): string {\n  return Object.entries(directives)\n    .map(([directive, values]) => `${directive} ${values.join(\" \")}`)\n    .join(\"; \");\n}\n\n/**\n * Build the full `Content-Security-Policy` (or `-Report-Only`) header value\n * for one request, using that request's own nonce.\n */\nexport function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string {\n  return serializeCspDirectives(mergeCspDirectives(cspConfig.directives, nonce));\n}\n\n/**\n * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,\n * `Content-Security-Policy-Report-Only`) header on the response, when the\n * app opted in via `http.csp.enabled`.\n *\n * A no-op when `http.csp` is absent or `enabled` is falsy — the default,\n * behaviour-preserving state for every app that hasn't opted in.\n *\n * Reads `request.nonce`, which lazily generates and caches the per-request\n * nonce (`request.ts`) — calling this early in the request lifecycle (see\n * `inject-request-context.ts`) means the SAME nonce this stamps into the\n * header is the one still available later for the web layer's `<script>`\n * tags to read off `request.nonce`.\n */\nexport function applyCspHeader(request: Request, response: Response): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  const headerName = cspConfig.reportOnly\n    ? \"Content-Security-Policy-Report-Only\"\n    : \"Content-Security-Policy\";\n\n  response.header(headerName, buildCspHeaderValue(cspConfig, request.nonce));\n}\n"],"mappings":";;;;;;;;;AA0DA,MAAa,yBAAsE;CACjF,eAAe,CAAC,QAAQ;CACxB,cAAc,CAAC,QAAQ;CACvB,aAAa,CAAC,QAAQ;CACtB,WAAW,CAAC,UAAU,OAAO;CAC7B,cAAc,CAAC,QAAQ;CACvB,YAAY,CAAC,QAAQ;CACrB,mBAAmB,CAAC,QAAQ;AAC9B;;;;;;;;;;;;;AAcA,IAAa,2BAAb,cAA8C,MAAM;CAIlD,AAAO,YACL,AAAgB,WAChB,AAAgB,OAChB,QACA;EACA,MACE,oDAAoD,UAAU,gBACzD,KAAK,UAAU,KAAK,EAAE,QAAQ,OAAO,qFAE5C;EARgB;EACA;cAJK;EAYrB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,sBAAsB,YAAwD;CAC5F,IAAI,CAAC,YAAY;CAEjB,KAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,UAAU,GACzD,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,GAAG,GACpB,MAAM,IAAI,yBACR,WACA,OACA,+DACF;EAIF,KADoB,MAAM,MAAM,IAAI,KAAK,CAAC,EAAC,CAAE,SAC5B,MAAM,GACrB,MAAM,IAAI,yBACR,WACA,OACA,2CACF;CAEJ;AAEJ;;;;AAKA,SAAgB,mBAA0C;CACxD,OAAOA,WAAO,IAAI,UAAU;AAC9B;;;;;;;;;;;;AAaA,SAAgB,0BAAgC;CAC9C,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,sBAAsB,UAAU,UAAU;AAC5C;;;;;;;;;;;;AAaA,SAAgB,mBACd,eACA,OAC0B;CAC1B,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,WAAW,kBAAkB,OAAO,QAAQ,sBAAsB,GAC5E,OAAO,aAAa,gBAAgB,aAChC,CAAC,GAAG,cAAc,UAAU,IAC5B,CAAC,GAAG,aAAa;CAGvB,IAAI,eACF;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,aAAa,GAC5D,IAAI,EAAE,aAAa,SACjB,OAAO,aAAa,CAAC,GAAG,MAAM;CAElC;CASF,MAAM,YAAY,OAAO,iBAAiB,CAAC;CAC3C,MAAM,cAAc,UAAU,MAAM;CAEpC,OAAO,gBAAgB,UAAU,SAAS,WAAW,IAAI,YAAY,CAAC,GAAG,WAAW,WAAW;CAE/F,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,YAA8C;CACnF,OAAO,OAAO,QAAQ,UAAU,CAAC,CAC9B,KAAK,CAAC,WAAW,YAAY,GAAG,UAAU,GAAG,OAAO,KAAK,GAAG,GAAG,CAAC,CAChE,KAAK,IAAI;AACd;;;;;AAMA,SAAgB,oBAAoB,WAAsB,OAAuB;CAC/E,OAAO,uBAAuB,mBAAmB,UAAU,YAAY,KAAK,CAAC;AAC/E;;;;;;;;;;;;;;;AAgBA,SAAgB,eAAe,SAAkB,UAA0B;CACzE,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,MAAM,aAAa,UAAU,aACzB,wCACA;CAEJ,SAAS,OAAO,YAAY,oBAAoB,WAAW,QAAQ,KAAK,CAAC;AAC3E"}

package/esm/http/csrf-default-guard.d.mts

@@ -1,12 +1,11 @@
 import { Response } from "./response.mjs";
 import { Request } from "./request.mjs";
-
 //#region ../../packages/core/src/http/csrf-default-guard.d.ts
 /**
  * Whether the current request is in scope for the default core CSRF-Origin
  * guard at all.
  */
-declare function requiresDefaultCsrfGuard(request: Request): boolean;
+export declare function requiresDefaultCsrfGuard(request: Request): boolean;
 /**
  * Run the default core CSRF-Origin guard for the current request.
  *
@@ -26,7 +25,6 @@ declare function requiresDefaultCsrfGuard(request: Request): boolean;
  * rejected, because a guard rejection short-circuits `runMiddleware()`
  * entirely — so a rejected request is never logged twice.
  */
-declare function runDefaultCsrfGuard(request: Request, response: Response, translate: (key: string) => string, logRejection: (reason: string) => void): Promise<Response | undefined>;
+export declare function runDefaultCsrfGuard(request: Request, response: Response, translate: (key: string) => string, logRejection: (reason: string) => void): Promise<Response | undefined>;
 //#endregion
-export { requiresDefaultCsrfGuard, runDefaultCsrfGuard };
 //# sourceMappingURL=csrf-default-guard.d.mts.map

package/esm/http/csrf-default-guard.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-default-guard.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"mappings":";;;;;;AAyIA;;iBAAgB,wBAAA,CAAyB,OAAgB,EAAP,OAAO;;AAAA;AA2BzD;;;;;;;;;;;;;;;;;iBAAsB,mBAAA,CACpB,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,SAAA,GAAY,GAAA,qBACZ,YAAA,GAAe,MAAA,oBACd,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"csrf-default-guard.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"mappings":";;;;;;;wBAyIgB,yBAAyB,SAAS;;;;;;;;;;;;;;;;;;;;wBA2B5B,oBACpB,SAAS,SACT,UAAU,UACV,YAAY,wBACZ,eAAe,0BACd,QAAQ"}

package/esm/http/csrf-default-guard.mjs

@@ -48,7 +48,7 @@ import { resolveCsrfOriginVerdict } from "./csrf-origin-policy.mjs";
 * at all) never reaches the cookie check above and is entirely unaffected.
 */
 /** HTTP methods the default CSRF guard is scoped to — every unsafe method. */
-const UNSAFE_METHODS = new Set([
+const UNSAFE_METHODS = /* @__PURE__ */ new Set([
 	"POST",
 	"PUT",
 	"PATCH",

package/esm/http/csrf-default-guard.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-default-guard.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"sourcesContent":["/**\n * The DEFAULT core CSRF-Origin guard — SECURITY, card 8a752ab2 (5.17), lead\n * ruling from Aria (`releases/v5.17-web-readiness-audit.md` §3.1, quoted):\n *\n * > \"Scope the default guard to unsafe browser requests carrying a\n * > non-locale credential-looking cookie (fail closed on unknown names), at\n * > an early core/auth HTTP seam before app handlers; give explicit,\n * > narrowly scoped route-level exemptions for third-party callbacks and\n * > machine-to-machine routes, documented as dangerous. Reuse current\n * > same-origin/allowedOrigins policy, trustProxy-aware own origin, and fail\n * > closed on missing Origin/Referer where in scope.\"\n *\n * Before this guard, the CSRF Origin check (`csrf-origin-policy.ts`, moved\n * here from `@warlock.js/auth` in this same change) only ran inside\n * `authMiddleware(\"cookie:*\")` — a cookie-authenticated write reaching any\n * OTHER path (an app-owned optional-auth pattern reading its own `token`\n * cookie without ever calling `authMiddleware`) was never checked at all.\n *\n * This guard closes that gap at the earliest seam common to EVERY request —\n * production (`Router.scan()`) and the dev wildcard dispatcher both funnel\n * into `Router[\"handleRoute\"]` → `request.execute()` →\n * `createRequestStore()` (`./middleware/inject-request-context.ts`), which is\n * where this is wired, BEFORE `request.runMiddleware()` runs the route's own\n * middleware (so it applies with or without `authMiddleware` on the route)\n * and before any app handler. It lives in `@warlock.js/core`, not\n * `@warlock.js/auth`, because `core` — not `auth` — is a dependency of every\n * Warlock app, so this is the only seam that reaches an app that never\n * installs `@warlock.js/auth` at all.\n *\n * Scope (mirrors `web`'s page-cache Cookie-header bypass rule,\n * `web/src/server/page-cache-cookie-bypass.ts`, card ad861076 — same\n * fail-closed strict-parse posture, independently reimplemented here because\n * `core` cannot depend on `web`, the dependency runs the other way):\n * - method is POST/PUT/PATCH/DELETE, AND\n * - the `Cookie` header carries any cookie other than the framework's own\n *   `locale` cookies (legacy plus the browser preference; a header that fails to parse cleanly counts as\n *   carrying one — fail closed), AND\n * - the route is not exempted via `{ csrf: false }` (`RouteOptions.csrf`,\n *   `../router/types.ts`) — a narrow, per-route, explicitly \"dangerous\" opt\n *   out for third-party callbacks and machine-to-machine routes.\n *\n * A header-only API request (`Authorization: Bearer …`, no `Cookie` header\n * at all) never reaches the cookie check above and is entirely unaffected.\n */\nimport { LOCALE_COOKIE_NAME, LOCALE_PREFERENCE_COOKIE_NAME } from \"../config/locale-configuration\";\nimport { HttpErrorCodes } from \"./error-codes\";\nimport { resolveCsrfOriginVerdict } from \"./csrf-origin-policy\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/** HTTP methods the default CSRF guard is scoped to — every unsafe method. */\nconst UNSAFE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Strictly parse a raw `Cookie` request header into a set of cookie names, or\n * `undefined` when the header does not parse cleanly.\n *\n * Deliberately NOT a lenient cookie parser that silently drops malformed\n * pairs and returns whatever it could salvage: a header this function cannot\n * fully account for must read as \"unknown cookies present\", never as \"the\n * pairs we understood, minus the ones we didn't\" — dropping a pair is how a\n * malformed header could otherwise be misread as carrying only the locale\n * cookie (or none) and wrongly skip the guard. Mirrors\n * `web/src/server/page-cache-cookie-bypass.ts`'s `parseCookieHeaderStrict`.\n *\n * Fails (`undefined`) on:\n * - an empty or whitespace-only header;\n * - any empty segment between/around `;`;\n * - any segment with no `=`, or an empty name.\n */\nfunction parseCookieNamesStrict(rawHeader: string): Set<string> | undefined {\n  if (rawHeader.trim() === \"\") return undefined;\n\n  const names = new Set<string>();\n\n  for (const segment of rawHeader.split(\";\")) {\n    const pair = segment.trim();\n\n    if (pair === \"\") return undefined;\n\n    const separatorIndex = pair.indexOf(\"=\");\n\n    if (separatorIndex <= 0) return undefined;\n\n    const name = pair.slice(0, separatorIndex).trim();\n\n    if (name === \"\") return undefined;\n\n    names.add(name);\n  }\n\n  return names;\n}\n\n/**\n * Whether the request carries a `Cookie` header naming anything other than\n * the framework's locale cookies.\n *\n * - No `Cookie` header at all ⇒ `false` — nothing to guard on.\n * - A header that fails to parse cleanly ⇒ `true` — fails CLOSED.\n * - A header whose parsed names are a non-empty set equal to exactly\n *   `{locale}` ⇒ `false` — the one exemption.\n * - Anything else (any other cookie name, alone or alongside `locale`) ⇒ `true`.\n */\nfunction carriesNonLocaleCookie(request: Request): boolean {\n  const rawCookieHeader = request.header(\"cookie\", undefined);\n\n  // Only an ABSENT header is cookie-free. A present header in any other\n  // shape (an array from a duplicated Cookie header) fails closed.\n  if (rawCookieHeader === undefined || rawCookieHeader === null) return false;\n\n  if (typeof rawCookieHeader !== \"string\") return true;\n\n  const names = parseCookieNamesStrict(rawCookieHeader);\n\n  if (names === undefined || names.size === 0) return true;\n\n  for (const name of names) {\n    if (name !== LOCALE_COOKIE_NAME && name !== LOCALE_PREFERENCE_COOKIE_NAME) return true;\n  }\n\n  return false;\n}\n\n/**\n * Whether the matched route opted out of the default CSRF guard via\n * `{ csrf: false }` (`RouteOptions.csrf`). Any other value — including\n * `undefined` — leaves the route in scope.\n */\nfunction isCsrfExempt(request: Request): boolean {\n  return request.route?.csrf === false;\n}\n\n/**\n * Whether the current request is in scope for the default core CSRF-Origin\n * guard at all.\n */\nexport function requiresDefaultCsrfGuard(request: Request): boolean {\n  if (!UNSAFE_METHODS.has(request.method.toUpperCase())) return false;\n\n  if (isCsrfExempt(request)) return false;\n\n  return carriesNonLocaleCookie(request);\n}\n\n/**\n * Run the default core CSRF-Origin guard for the current request.\n *\n * Returns `undefined` when the request is out of scope or passes the\n * Origin/Referer check — the caller continues into route middleware and the\n * handler as normal. Returns the 403 {@link Response} when the guard refuses\n * the request; the caller must return that value immediately, the same\n * short-circuit contract every other middleware in the chain follows.\n *\n * Uses the SAME translated message and client-visible error code\n * `authMiddleware(\"cookie:*\")`'s own CSRF-Origin check uses\n * (`auth.errors.csrfOriginMismatch`, `HttpErrorCodes.CsrfOriginMismatch` /\n * `AuthErrorCodes.CsrfOriginMismatch`, both `\"EC006\"`) — one message, one\n * error code, regardless of which seam caught the request. Logs exactly once\n * per rejection here; a route that also carries `authMiddleware(\"cookie:*\")`\n * never reaches that middleware's own check for a request THIS guard already\n * rejected, because a guard rejection short-circuits `runMiddleware()`\n * entirely — so a rejected request is never logged twice.\n */\nexport async function runDefaultCsrfGuard(\n  request: Request,\n  response: Response,\n  translate: (key: string) => string,\n  logRejection: (reason: string) => void,\n): Promise<Response | undefined> {\n  if (!requiresDefaultCsrfGuard(request)) return undefined;\n\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (verdict.allowed) return undefined;\n\n  logRejection(verdict.reason);\n\n  return response.forbidden({\n    error: translate(\"auth.errors.csrfOriginMismatch\"),\n    errorCode: HttpErrorCodes.CsrfOriginMismatch,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAM,iBAAiB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBjE,SAAS,uBAAuB,WAA4C;CAC1E,IAAI,UAAU,KAAK,MAAM,IAAI,OAAO;CAEpC,MAAM,wBAAQ,IAAI,IAAY;CAE9B,KAAK,MAAM,WAAW,UAAU,MAAM,GAAG,GAAG;EAC1C,MAAM,OAAO,QAAQ,KAAK;EAE1B,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,iBAAiB,KAAK,QAAQ,GAAG;EAEvC,IAAI,kBAAkB,GAAG,OAAO;EAEhC,MAAM,OAAO,KAAK,MAAM,GAAG,cAAc,CAAC,CAAC,KAAK;EAEhD,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,IAAI,IAAI;CAChB;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAS,uBAAuB,SAA2B;CACzD,MAAM,kBAAkB,QAAQ,OAAO,UAAU,MAAS;CAI1D,IAAI,oBAAoB,UAAa,oBAAoB,MAAM,OAAO;CAEtE,IAAI,OAAO,oBAAoB,UAAU,OAAO;CAEhD,MAAM,QAAQ,uBAAuB,eAAe;CAEpD,IAAI,UAAU,UAAa,MAAM,SAAS,GAAG,OAAO;CAEpD,KAAK,MAAM,QAAQ,OACjB,IAAI,qBAA+B,sCAAwC,OAAO;CAGpF,OAAO;AACT;;;;;;AAOA,SAAS,aAAa,SAA2B;CAC/C,OAAO,QAAQ,OAAO,SAAS;AACjC;;;;;AAMA,SAAgB,yBAAyB,SAA2B;CAClE,IAAI,CAAC,eAAe,IAAI,QAAQ,OAAO,YAAY,CAAC,GAAG,OAAO;CAE9D,IAAI,aAAa,OAAO,GAAG,OAAO;CAElC,OAAO,uBAAuB,OAAO;AACvC;;;;;;;;;;;;;;;;;;;;AAqBA,eAAsB,oBACpB,SACA,UACA,WACA,cAC+B;CAC/B,IAAI,CAAC,yBAAyB,OAAO,GAAG,OAAO;CAE/C,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,QAAQ,SAAS,OAAO;CAE5B,aAAa,QAAQ,MAAM;CAE3B,OAAO,SAAS,UAAU;EACxB,OAAO,UAAU,gCAAgC;EACjD;CACF,CAAC;AACH"}
+{"version":3,"file":"csrf-default-guard.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"sourcesContent":["/**\n * The DEFAULT core CSRF-Origin guard — SECURITY, card 8a752ab2 (5.17), lead\n * ruling from Aria (`releases/v5.17-web-readiness-audit.md` §3.1, quoted):\n *\n * > \"Scope the default guard to unsafe browser requests carrying a\n * > non-locale credential-looking cookie (fail closed on unknown names), at\n * > an early core/auth HTTP seam before app handlers; give explicit,\n * > narrowly scoped route-level exemptions for third-party callbacks and\n * > machine-to-machine routes, documented as dangerous. Reuse current\n * > same-origin/allowedOrigins policy, trustProxy-aware own origin, and fail\n * > closed on missing Origin/Referer where in scope.\"\n *\n * Before this guard, the CSRF Origin check (`csrf-origin-policy.ts`, moved\n * here from `@warlock.js/auth` in this same change) only ran inside\n * `authMiddleware(\"cookie:*\")` — a cookie-authenticated write reaching any\n * OTHER path (an app-owned optional-auth pattern reading its own `token`\n * cookie without ever calling `authMiddleware`) was never checked at all.\n *\n * This guard closes that gap at the earliest seam common to EVERY request —\n * production (`Router.scan()`) and the dev wildcard dispatcher both funnel\n * into `Router[\"handleRoute\"]` → `request.execute()` →\n * `createRequestStore()` (`./middleware/inject-request-context.ts`), which is\n * where this is wired, BEFORE `request.runMiddleware()` runs the route's own\n * middleware (so it applies with or without `authMiddleware` on the route)\n * and before any app handler. It lives in `@warlock.js/core`, not\n * `@warlock.js/auth`, because `core` — not `auth` — is a dependency of every\n * Warlock app, so this is the only seam that reaches an app that never\n * installs `@warlock.js/auth` at all.\n *\n * Scope (mirrors `web`'s page-cache Cookie-header bypass rule,\n * `web/src/server/page-cache-cookie-bypass.ts`, card ad861076 — same\n * fail-closed strict-parse posture, independently reimplemented here because\n * `core` cannot depend on `web`, the dependency runs the other way):\n * - method is POST/PUT/PATCH/DELETE, AND\n * - the `Cookie` header carries any cookie other than the framework's own\n *   `locale` cookies (legacy plus the browser preference; a header that fails to parse cleanly counts as\n *   carrying one — fail closed), AND\n * - the route is not exempted via `{ csrf: false }` (`RouteOptions.csrf`,\n *   `../router/types.ts`) — a narrow, per-route, explicitly \"dangerous\" opt\n *   out for third-party callbacks and machine-to-machine routes.\n *\n * A header-only API request (`Authorization: Bearer …`, no `Cookie` header\n * at all) never reaches the cookie check above and is entirely unaffected.\n */\nimport { LOCALE_COOKIE_NAME, LOCALE_PREFERENCE_COOKIE_NAME } from \"../config/locale-configuration\";\nimport { HttpErrorCodes } from \"./error-codes\";\nimport { resolveCsrfOriginVerdict } from \"./csrf-origin-policy\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/** HTTP methods the default CSRF guard is scoped to — every unsafe method. */\nconst UNSAFE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Strictly parse a raw `Cookie` request header into a set of cookie names, or\n * `undefined` when the header does not parse cleanly.\n *\n * Deliberately NOT a lenient cookie parser that silently drops malformed\n * pairs and returns whatever it could salvage: a header this function cannot\n * fully account for must read as \"unknown cookies present\", never as \"the\n * pairs we understood, minus the ones we didn't\" — dropping a pair is how a\n * malformed header could otherwise be misread as carrying only the locale\n * cookie (or none) and wrongly skip the guard. Mirrors\n * `web/src/server/page-cache-cookie-bypass.ts`'s `parseCookieHeaderStrict`.\n *\n * Fails (`undefined`) on:\n * - an empty or whitespace-only header;\n * - any empty segment between/around `;`;\n * - any segment with no `=`, or an empty name.\n */\nfunction parseCookieNamesStrict(rawHeader: string): Set<string> | undefined {\n  if (rawHeader.trim() === \"\") return undefined;\n\n  const names = new Set<string>();\n\n  for (const segment of rawHeader.split(\";\")) {\n    const pair = segment.trim();\n\n    if (pair === \"\") return undefined;\n\n    const separatorIndex = pair.indexOf(\"=\");\n\n    if (separatorIndex <= 0) return undefined;\n\n    const name = pair.slice(0, separatorIndex).trim();\n\n    if (name === \"\") return undefined;\n\n    names.add(name);\n  }\n\n  return names;\n}\n\n/**\n * Whether the request carries a `Cookie` header naming anything other than\n * the framework's locale cookies.\n *\n * - No `Cookie` header at all ⇒ `false` — nothing to guard on.\n * - A header that fails to parse cleanly ⇒ `true` — fails CLOSED.\n * - A header whose parsed names are a non-empty set equal to exactly\n *   `{locale}` ⇒ `false` — the one exemption.\n * - Anything else (any other cookie name, alone or alongside `locale`) ⇒ `true`.\n */\nfunction carriesNonLocaleCookie(request: Request): boolean {\n  const rawCookieHeader = request.header(\"cookie\", undefined);\n\n  // Only an ABSENT header is cookie-free. A present header in any other\n  // shape (an array from a duplicated Cookie header) fails closed.\n  if (rawCookieHeader === undefined || rawCookieHeader === null) return false;\n\n  if (typeof rawCookieHeader !== \"string\") return true;\n\n  const names = parseCookieNamesStrict(rawCookieHeader);\n\n  if (names === undefined || names.size === 0) return true;\n\n  for (const name of names) {\n    if (name !== LOCALE_COOKIE_NAME && name !== LOCALE_PREFERENCE_COOKIE_NAME) return true;\n  }\n\n  return false;\n}\n\n/**\n * Whether the matched route opted out of the default CSRF guard via\n * `{ csrf: false }` (`RouteOptions.csrf`). Any other value — including\n * `undefined` — leaves the route in scope.\n */\nfunction isCsrfExempt(request: Request): boolean {\n  return request.route?.csrf === false;\n}\n\n/**\n * Whether the current request is in scope for the default core CSRF-Origin\n * guard at all.\n */\nexport function requiresDefaultCsrfGuard(request: Request): boolean {\n  if (!UNSAFE_METHODS.has(request.method.toUpperCase())) return false;\n\n  if (isCsrfExempt(request)) return false;\n\n  return carriesNonLocaleCookie(request);\n}\n\n/**\n * Run the default core CSRF-Origin guard for the current request.\n *\n * Returns `undefined` when the request is out of scope or passes the\n * Origin/Referer check — the caller continues into route middleware and the\n * handler as normal. Returns the 403 {@link Response} when the guard refuses\n * the request; the caller must return that value immediately, the same\n * short-circuit contract every other middleware in the chain follows.\n *\n * Uses the SAME translated message and client-visible error code\n * `authMiddleware(\"cookie:*\")`'s own CSRF-Origin check uses\n * (`auth.errors.csrfOriginMismatch`, `HttpErrorCodes.CsrfOriginMismatch` /\n * `AuthErrorCodes.CsrfOriginMismatch`, both `\"EC006\"`) — one message, one\n * error code, regardless of which seam caught the request. Logs exactly once\n * per rejection here; a route that also carries `authMiddleware(\"cookie:*\")`\n * never reaches that middleware's own check for a request THIS guard already\n * rejected, because a guard rejection short-circuits `runMiddleware()`\n * entirely — so a rejected request is never logged twice.\n */\nexport async function runDefaultCsrfGuard(\n  request: Request,\n  response: Response,\n  translate: (key: string) => string,\n  logRejection: (reason: string) => void,\n): Promise<Response | undefined> {\n  if (!requiresDefaultCsrfGuard(request)) return undefined;\n\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (verdict.allowed) return undefined;\n\n  logRejection(verdict.reason);\n\n  return response.forbidden({\n    error: translate(\"auth.errors.csrfOriginMismatch\"),\n    errorCode: HttpErrorCodes.CsrfOriginMismatch,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAM,iCAAiB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBjE,SAAS,uBAAuB,WAA4C;CAC1E,IAAI,UAAU,KAAK,MAAM,IAAI,OAAO;CAEpC,MAAM,wBAAQ,IAAI,IAAY;CAE9B,KAAK,MAAM,WAAW,UAAU,MAAM,GAAG,GAAG;EAC1C,MAAM,OAAO,QAAQ,KAAK;EAE1B,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,iBAAiB,KAAK,QAAQ,GAAG;EAEvC,IAAI,kBAAkB,GAAG,OAAO;EAEhC,MAAM,OAAO,KAAK,MAAM,GAAG,cAAc,CAAC,CAAC,KAAK;EAEhD,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,IAAI,IAAI;CAChB;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAS,uBAAuB,SAA2B;CACzD,MAAM,kBAAkB,QAAQ,OAAO,UAAU,MAAS;CAI1D,IAAI,oBAAoB,UAAa,oBAAoB,MAAM,OAAO;CAEtE,IAAI,OAAO,oBAAoB,UAAU,OAAO;CAEhD,MAAM,QAAQ,uBAAuB,eAAe;CAEpD,IAAI,UAAU,UAAa,MAAM,SAAS,GAAG,OAAO;CAEpD,KAAK,MAAM,QAAQ,OACjB,IAAI,qBAA+B,sCAAwC,OAAO;CAGpF,OAAO;AACT;;;;;;AAOA,SAAS,aAAa,SAA2B;CAC/C,OAAO,QAAQ,OAAO,SAAS;AACjC;;;;;AAMA,SAAgB,yBAAyB,SAA2B;CAClE,IAAI,CAAC,eAAe,IAAI,QAAQ,OAAO,YAAY,CAAC,GAAG,OAAO;CAE9D,IAAI,aAAa,OAAO,GAAG,OAAO;CAElC,OAAO,uBAAuB,OAAO;AACvC;;;;;;;;;;;;;;;;;;;;AAqBA,eAAsB,oBACpB,SACA,UACA,WACA,cAC+B;CAC/B,IAAI,CAAC,yBAAyB,OAAO,GAAG,OAAO;CAE/C,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,QAAQ,SAAS,OAAO;CAE5B,aAAa,QAAQ,MAAM;CAE3B,OAAO,SAAS,UAAU;EACxB,OAAO,UAAU,gCAAgC;EACjD;CACF,CAAC;AACH"}

package/esm/http/csrf-origin-policy.d.mts

@@ -1,10 +1,9 @@
 import { Request } from "./request.mjs";
-
 //#region ../../packages/core/src/http/csrf-origin-policy.d.ts
 /** Why {@link resolveCsrfOriginVerdict} refused a request. */
-type CsrfOriginCheckReason = "origin-mismatch" | "referer-mismatch" | "missing-origin-and-referer";
+export type CsrfOriginCheckReason = "origin-mismatch" | "referer-mismatch" | "missing-origin-and-referer";
 /** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */
-type CsrfOriginVerdict = {
+export type CsrfOriginVerdict = {
   allowed: true;
 } | {
   allowed: false;
@@ -24,18 +23,18 @@ type CsrfOriginVerdict = {
  * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this
  * function does not need its own proxy-trust logic on top of that.
  */
-declare function ownOrigin(request: Request): string;
+export declare function ownOrigin(request: Request): string;
 /** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */
-declare function originOf(rawUrl: string): string | undefined;
+export declare function originOf(rawUrl: string): string | undefined;
 /**
  * Normalize an origin string (`scheme://host[:port]`) so that a default port
  * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin
  * written without a port. Falls back to the raw value if it does not parse
  * as a URL (in which case it will simply fail the exact-match comparison).
  */
-declare function normalizeOrigin(origin: string): string;
+export declare function normalizeOrigin(origin: string): string;
 /** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */
-declare function isAllowedCsrfOrigin(origin: string, request: Request): boolean;
+export declare function isAllowedCsrfOrigin(origin: string, request: Request): boolean;
 /**
  * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):
  * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the
@@ -47,7 +46,6 @@ declare function isAllowedCsrfOrigin(origin: string, request: Request): boolean;
  * exemption) — this function only answers the Origin/Referer question once a
  * caller has already decided the check applies.
  */
-declare function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict;
+export declare function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict;
 //#endregion
-export { CsrfOriginCheckReason, CsrfOriginVerdict, isAllowedCsrfOrigin, normalizeOrigin, originOf, ownOrigin, resolveCsrfOriginVerdict };
 //# sourceMappingURL=csrf-origin-policy.d.mts.map

package/esm/http/csrf-origin-policy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-policy.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"mappings":";;;;KAyBY,qBAAA;AAAZ;AAAA,KAMY,iBAAA;EACN,OAAA;AAAA;EACA,OAAA;EAAgB,MAAA,EAAQ,qBAAqB;AAAA;;;;;;;;AAAA;AAgBnD;;;;AAA0C;AAgB1C;iBAhBgB,SAAA,CAAU,OAAgB,EAAP,OAAO;;iBAgB1B,QAAA,CAAS,MAAc;AAAA;AAgBvC;;;;AAA8C;AAhBP,iBAgBvB,eAAA,CAAgB,MAAc;;iBAc9B,mBAAA,CAAoB,MAAA,UAAgB,OAAA,EAAS,OAAO;;;;;;AAAA;AAqBpE;;;;;iBAAgB,wBAAA,CAAyB,OAAA,EAAS,OAAA,GAAU,iBAAiB"}
+{"version":3,"file":"csrf-origin-policy.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"mappings":";;;YAyBY;;YAMA;EACN;;EACA;EAAgB,QAAQ;;;;;;;;;;;;;;;;wBAgBd,UAAU,SAAS;;wBAgBnB,SAAS;;;;;;;wBAgBT,gBAAgB;;wBAchB,oBAAoB,gBAAgB,SAAS;;;;;;;;;;;;wBAqB7C,yBAAyB,SAAS,UAAU"}

package/esm/http/csrf-origin-policy.mjs

@@ -1,4 +1,4 @@
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 
 //#region ../../packages/core/src/http/csrf-origin-policy.ts
 /**
@@ -69,7 +69,7 @@ function normalizeOrigin(origin) {
 /** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */
 function isAllowedCsrfOrigin(origin, request) {
 	if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;
-	const allowedOrigins = config.get("auth.csrf.allowedOrigins", []);
+	const allowedOrigins = baseConfig.get("auth.csrf.allowedOrigins", []);
 	const normalized = normalizeOrigin(origin);
 	return allowedOrigins.some((allowed) => normalizeOrigin(allowed) === normalized);
 }

package/esm/http/csrf-origin-policy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-policy.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"sourcesContent":["/**\n * The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the\n * one comparison every CSRF-Origin check in the framework must agree on.\n *\n * SECURITY, card 8a752ab2 (5.17). Extracted from\n * `@warlock.js/auth`'s `csrf-origin-check.ts` (the ONLY prior owner of this\n * logic) into `@warlock.js/core` so both call sites — the\n * `authMiddleware(\"cookie:*\")` check in `@warlock.js/auth` and the default\n * core HTTP-seam guard in `./csrf-default-guard.ts` — share ONE\n * implementation instead of drifting copies. `@warlock.js/core` cannot depend\n * on `@warlock.js/auth` (the dependency runs the other way), so the shared\n * logic had to move down into `core`, not up into a new shared package —\n * `auth`'s `csrf-origin-check.ts` now delegates to\n * {@link resolveCsrfOriginVerdict} instead of reimplementing it.\n *\n * Reads `auth.csrf.allowedOrigins` directly via `@mongez/config` (the exact\n * same config key `@warlock.js/auth`'s `authConfig.csrf.allowedOrigins()`\n * reads) rather than importing `@warlock.js/auth`, so an app's one\n * `auth.csrf.allowedOrigins` setting governs both checks without `core`\n * taking a hard dependency on `auth`.\n */\nimport config from \"@mongez/config\";\nimport type { Request } from \"./request\";\n\n/** Why {@link resolveCsrfOriginVerdict} refused a request. */\nexport type CsrfOriginCheckReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */\nexport type CsrfOriginVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: CsrfOriginCheckReason };\n\n/**\n * The request's own origin — what an `Origin`/`Referer` header must match.\n *\n * `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never\n * carries a port. A browser's `Origin` header on a non-default port (e.g. any\n * `warlock dev` session) does, so the port must come from the raw `Host`\n * header instead — core exposes no getter for that, so it is read directly\n * here.\n *\n * Trust-proxy-aware for free: `request.protocol` is Fastify's own\n * `request.protocol`, which already honours `http.trustProxy`\n * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this\n * function does not need its own proxy-trust logic on top of that.\n */\nexport function ownOrigin(request: Request): string {\n  // Fastify's `host` keeps the port and honours `X-Forwarded-Host` under\n  // `trustProxy`, so a proxy that rewrites `Host` does not break the match.\n  const fastifyHost = request.baseRequest?.host;\n  const hostHeader = request.header(\"host\");\n  const host =\n    typeof fastifyHost === \"string\" && fastifyHost\n      ? fastifyHost\n      : typeof hostHeader === \"string\" && hostHeader\n        ? hostHeader\n        : request.hostname;\n\n  return `${request.protocol}://${host}`;\n}\n\n/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */\nexport function originOf(rawUrl: string): string | undefined {\n  try {\n    const url = new URL(rawUrl);\n\n    return `${url.protocol}//${url.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Normalize an origin string (`scheme://host[:port]`) so that a default port\n * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin\n * written without a port. Falls back to the raw value if it does not parse\n * as a URL (in which case it will simply fail the exact-match comparison).\n */\nexport function normalizeOrigin(origin: string): string {\n  try {\n    const url = new URL(origin);\n    const isDefaultPort =\n      (url.protocol === \"http:\" && (url.port === \"\" || url.port === \"80\")) ||\n      (url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\"));\n\n    return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;\n  } catch {\n    return origin;\n  }\n}\n\n/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */\nexport function isAllowedCsrfOrigin(origin: string, request: Request): boolean {\n  if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;\n\n  const allowedOrigins: string[] = config.get(\"auth.csrf.allowedOrigins\", []);\n\n  const normalized = normalizeOrigin(origin);\n\n  return allowedOrigins.some((allowed) => normalizeOrigin(allowed) === normalized);\n}\n\n/**\n * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):\n * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the\n * request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused\n * otherwise, including when BOTH headers are absent (fail closed).\n *\n * Callers decide WHETHER a request is in scope for this check at all (a\n * cookie-sourced credential / a non-locale cookie, an unsafe method, no route\n * exemption) — this function only answers the Origin/Referer question once a\n * caller has already decided the check applies.\n */\nexport function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict {\n  const origin = request.origin;\n\n  if (origin) {\n    return isAllowedCsrfOrigin(origin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"origin-mismatch\" };\n  }\n\n  const referer = request.header(\"referer\");\n  const refererOrigin = typeof referer === \"string\" ? originOf(referer) : undefined;\n\n  if (refererOrigin) {\n    return isAllowedCsrfOrigin(refererOrigin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"referer-mismatch\" };\n  }\n\n  return { allowed: false, reason: \"missing-origin-and-referer\" };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,UAAU,SAA0B;CAGlD,MAAM,cAAc,QAAQ,aAAa;CACzC,MAAM,aAAa,QAAQ,OAAO,MAAM;CACxC,MAAM,OACJ,OAAO,gBAAgB,YAAY,cAC/B,cACA,OAAO,eAAe,YAAY,aAChC,aACA,QAAQ;CAEhB,OAAO,GAAG,QAAQ,SAAS,KAAK;AAClC;;AAGA,SAAgB,SAAS,QAAoC;CAC3D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAE1B,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAwB;CACtD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,MAAM,gBACH,IAAI,aAAa,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,SAC7D,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;EAEjE,OAAO,GAAG,IAAI,SAAS,IAAI,gBAAgB,IAAI,WAAW,IAAI;CAChE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,oBAAoB,QAAgB,SAA2B;CAC7E,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,OAAO;CAE5E,MAAM,iBAA2B,OAAO,IAAI,4BAA4B,CAAC,CAAC;CAE1E,MAAM,aAAa,gBAAgB,MAAM;CAEzC,OAAO,eAAe,MAAM,YAAY,gBAAgB,OAAO,MAAM,UAAU;AACjF;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,SAAqC;CAC5E,MAAM,SAAS,QAAQ;CAEvB,IAAI,QACF,OAAO,oBAAoB,QAAQ,OAAO,IACtC,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAkB;CAGlD,MAAM,UAAU,QAAQ,OAAO,SAAS;CACxC,MAAM,gBAAgB,OAAO,YAAY,WAAW,SAAS,OAAO,IAAI;CAExE,IAAI,eACF,OAAO,oBAAoB,eAAe,OAAO,IAC7C,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAmB;CAGnD,OAAO;EAAE,SAAS;EAAO,QAAQ;CAA6B;AAChE"}
+{"version":3,"file":"csrf-origin-policy.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"sourcesContent":["/**\n * The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the\n * one comparison every CSRF-Origin check in the framework must agree on.\n *\n * SECURITY, card 8a752ab2 (5.17). Extracted from\n * `@warlock.js/auth`'s `csrf-origin-check.ts` (the ONLY prior owner of this\n * logic) into `@warlock.js/core` so both call sites — the\n * `authMiddleware(\"cookie:*\")` check in `@warlock.js/auth` and the default\n * core HTTP-seam guard in `./csrf-default-guard.ts` — share ONE\n * implementation instead of drifting copies. `@warlock.js/core` cannot depend\n * on `@warlock.js/auth` (the dependency runs the other way), so the shared\n * logic had to move down into `core`, not up into a new shared package —\n * `auth`'s `csrf-origin-check.ts` now delegates to\n * {@link resolveCsrfOriginVerdict} instead of reimplementing it.\n *\n * Reads `auth.csrf.allowedOrigins` directly via `@mongez/config` (the exact\n * same config key `@warlock.js/auth`'s `authConfig.csrf.allowedOrigins()`\n * reads) rather than importing `@warlock.js/auth`, so an app's one\n * `auth.csrf.allowedOrigins` setting governs both checks without `core`\n * taking a hard dependency on `auth`.\n */\nimport config from \"@mongez/config\";\nimport type { Request } from \"./request\";\n\n/** Why {@link resolveCsrfOriginVerdict} refused a request. */\nexport type CsrfOriginCheckReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */\nexport type CsrfOriginVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: CsrfOriginCheckReason };\n\n/**\n * The request's own origin — what an `Origin`/`Referer` header must match.\n *\n * `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never\n * carries a port. A browser's `Origin` header on a non-default port (e.g. any\n * `warlock dev` session) does, so the port must come from the raw `Host`\n * header instead — core exposes no getter for that, so it is read directly\n * here.\n *\n * Trust-proxy-aware for free: `request.protocol` is Fastify's own\n * `request.protocol`, which already honours `http.trustProxy`\n * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this\n * function does not need its own proxy-trust logic on top of that.\n */\nexport function ownOrigin(request: Request): string {\n  // Fastify's `host` keeps the port and honours `X-Forwarded-Host` under\n  // `trustProxy`, so a proxy that rewrites `Host` does not break the match.\n  const fastifyHost = request.baseRequest?.host;\n  const hostHeader = request.header(\"host\");\n  const host =\n    typeof fastifyHost === \"string\" && fastifyHost\n      ? fastifyHost\n      : typeof hostHeader === \"string\" && hostHeader\n        ? hostHeader\n        : request.hostname;\n\n  return `${request.protocol}://${host}`;\n}\n\n/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */\nexport function originOf(rawUrl: string): string | undefined {\n  try {\n    const url = new URL(rawUrl);\n\n    return `${url.protocol}//${url.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Normalize an origin string (`scheme://host[:port]`) so that a default port\n * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin\n * written without a port. Falls back to the raw value if it does not parse\n * as a URL (in which case it will simply fail the exact-match comparison).\n */\nexport function normalizeOrigin(origin: string): string {\n  try {\n    const url = new URL(origin);\n    const isDefaultPort =\n      (url.protocol === \"http:\" && (url.port === \"\" || url.port === \"80\")) ||\n      (url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\"));\n\n    return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;\n  } catch {\n    return origin;\n  }\n}\n\n/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */\nexport function isAllowedCsrfOrigin(origin: string, request: Request): boolean {\n  if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;\n\n  const allowedOrigins: string[] = config.get(\"auth.csrf.allowedOrigins\", []);\n\n  const normalized = normalizeOrigin(origin);\n\n  return allowedOrigins.some((allowed) => normalizeOrigin(allowed) === normalized);\n}\n\n/**\n * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):\n * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the\n * request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused\n * otherwise, including when BOTH headers are absent (fail closed).\n *\n * Callers decide WHETHER a request is in scope for this check at all (a\n * cookie-sourced credential / a non-locale cookie, an unsafe method, no route\n * exemption) — this function only answers the Origin/Referer question once a\n * caller has already decided the check applies.\n */\nexport function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict {\n  const origin = request.origin;\n\n  if (origin) {\n    return isAllowedCsrfOrigin(origin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"origin-mismatch\" };\n  }\n\n  const referer = request.header(\"referer\");\n  const refererOrigin = typeof referer === \"string\" ? originOf(referer) : undefined;\n\n  if (refererOrigin) {\n    return isAllowedCsrfOrigin(refererOrigin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"referer-mismatch\" };\n  }\n\n  return { allowed: false, reason: \"missing-origin-and-referer\" };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,UAAU,SAA0B;CAGlD,MAAM,cAAc,QAAQ,aAAa;CACzC,MAAM,aAAa,QAAQ,OAAO,MAAM;CACxC,MAAM,OACJ,OAAO,gBAAgB,YAAY,cAC/B,cACA,OAAO,eAAe,YAAY,aAChC,aACA,QAAQ;CAEhB,OAAO,GAAG,QAAQ,SAAS,KAAK;AAClC;;AAGA,SAAgB,SAAS,QAAoC;CAC3D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAE1B,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAwB;CACtD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,MAAM,gBACH,IAAI,aAAa,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,SAC7D,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;EAEjE,OAAO,GAAG,IAAI,SAAS,IAAI,gBAAgB,IAAI,WAAW,IAAI;CAChE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,oBAAoB,QAAgB,SAA2B;CAC7E,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,OAAO;CAE5E,MAAM,iBAA2BA,WAAO,IAAI,4BAA4B,CAAC,CAAC;CAE1E,MAAM,aAAa,gBAAgB,MAAM;CAEzC,OAAO,eAAe,MAAM,YAAY,gBAAgB,OAAO,MAAM,UAAU;AACjF;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,SAAqC;CAC5E,MAAM,SAAS,QAAQ;CAEvB,IAAI,QACF,OAAO,oBAAoB,QAAQ,OAAO,IACtC,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAkB;CAGlD,MAAM,UAAU,QAAQ,OAAO,SAAS;CACxC,MAAM,gBAAgB,OAAO,YAAY,WAAW,SAAS,OAAO,IAAI;CAExE,IAAI,eACF,OAAO,oBAAoB,eAAe,OAAO,IAC7C,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAmB;CAGnD,OAAO;EAAE,SAAS;EAAO,QAAQ;CAA6B;AAChE"}