@warlock.js/core 5.31.0 → 5.32.0

package/esm/http/rate-limit-cache-store.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit-cache-store.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/rate-limit-cache-store.ts"],"sourcesContent":["import type { FastifyRateLimitOptions, FastifyRateLimitStore } from \"@fastify/rate-limit\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport { createHash } from \"node:crypto\";\n\n/**\n * Rate-limit counting shared through `@warlock.js/cache`, so every process\n * that uses the same cache driver (Redis, Postgres) counts into the same\n * buckets. With a memory driver (`memory`, `lru`, `memoryExtended`) the\n * counts stay in the process, like the in-memory limiter.\n *\n * Windows are fixed and aligned to the clock: a 60 s window resets on the\n * minute, whichever process saw the first request. Each window has its own\n * key, created atomically with a TTL of two windows and incremented with the\n * driver's atomic increment, so a key cannot expire while its window counts.\n *\n * Two drivers are refused, with {@link UnsupportedRateLimitDriverError}:\n *\n * - `null` stores nothing, so every request would count as the first and the\n *   limit would never trip.\n * - `file` has no expiry sweeper, so every past window would stay on disk\n *   forever, and its increment is only serialized within one process, so\n *   workers sharing the directory would lose counts.\n */\n\nconst KEY_PREFIX = \"rate-limit\";\n\n/**\n * Cache drivers that cannot back a shared limiter (see the module comment).\n */\nconst UNSUPPORTED_DRIVERS = new Set([\"null\", \"file\"]);\n\n/**\n * Thrown when `store: \"cache\"` runs on a cache driver that cannot count.\n */\nexport class UnsupportedRateLimitDriverError extends Error {\n  /** Stable Warlock error code; `warlock explain WL1003` prints the fix. */\n  public readonly code = \"WL1003\";\n\n  public constructor(driverName: string) {\n    super(\n      `Rate limiting with store: \"cache\" cannot use the \"${driverName}\" cache driver: ` +\n        (driverName === \"null\"\n          ? \"it stores nothing, so the limit would never trip. \"\n          : \"it never removes expired windows and its increment is not shared between processes. \") +\n        'Use redis or pg (or a memory driver for a single process), or set store: \"memory\".',\n    );\n\n    this.name = \"UnsupportedRateLimitDriverError\";\n  }\n}\n\nfunction assertSupportedDriver(): void {\n  const driverName = cache.currentDriver?.name;\n\n  if (driverName && UNSUPPORTED_DRIVERS.has(driverName)) {\n    throw new UnsupportedRateLimitDriverError(driverName);\n  }\n}\n\n/**\n * Hash used for group keys and route namespaces before they reach the cache.\n */\nfunction shortHash(value: string): string {\n  return createHash(\"sha256\").update(value).digest(\"hex\").slice(0, 32);\n}\n\n/**\n * The group key (an IP, a user id, whatever `keyGenerator` returned) is\n * hashed before it reaches the cache: cache drivers log their keys, and a raw\n * IP or email in a key is personal data in a log line.\n *\n * The namespace (it carries a route path) is hashed as well: flattening\n * `/users/:id` and `/users/id` to one safe string merged their counters, and\n * the file driver would turn `/` into directories. A readable, flattened\n * prefix stays in front of the hash for debugging.\n */\nfunction windowKey(namespace: string, group: string, windowIndex: number): string {\n  const readable = namespace.replace(/[^A-Za-z0-9_-]+/g, \"_\").slice(0, 40);\n\n  return `${KEY_PREFIX}.${readable}-${shortHash(namespace).slice(0, 16)}.${shortHash(group)}.${windowIndex}`;\n}\n\n/**\n * Count one request for `group` in the current window.\n *\n * @returns the count so far in this window and when the window resets (epoch ms)\n * @throws {UnsupportedRateLimitDriverError} on the `null` or `file` driver\n */\nexport async function incrementSharedRateLimit(\n  namespace: string,\n  group: string,\n  windowMs: number,\n  now: number = Date.now(),\n): Promise<{ current: number; resetAt: number }> {\n  assertSupportedDriver();\n\n  const windowIndex = Math.floor(now / windowMs);\n  const key = windowKey(namespace, group, windowIndex);\n  const ttlSeconds = Math.max(1, Math.ceil((2 * windowMs) / 1000));\n\n  await cache.set(key, 0, { ttl: ttlSeconds, onConflict: \"create\" });\n\n  const current = await cache.increment(key, 1, { ttl: ttlSeconds });\n\n  return { current, resetAt: (windowIndex + 1) * windowMs };\n}\n\n/**\n * Read the count for `group` in the current window without counting a request\n */\nexport async function readSharedRateLimit(\n  namespace: string,\n  group: string,\n  windowMs: number,\n  now: number = Date.now(),\n): Promise<{ current: number; resetAt: number }> {\n  assertSupportedDriver();\n\n  const windowIndex = Math.floor(now / windowMs);\n  const value = await cache.get(windowKey(namespace, group, windowIndex));\n\n  return {\n    current: typeof value === \"number\" ? value : 0,\n    resetAt: (windowIndex + 1) * windowMs,\n  };\n}\n\n/**\n * How often a failing shared store is reported. A cache outage fails every\n * request, so logging each one would flood the log.\n */\nconst ERROR_LOG_INTERVAL_MS = 60_000;\n\nlet lastErrorLogAt = 0;\n\n/**\n * Log a shared rate-limit store failure, at most once per minute.\n */\nexport function logSharedRateLimitError(error: unknown, now: number = Date.now()): void {\n  if (now - lastErrorLogAt < ERROR_LOG_INTERVAL_MS) return;\n\n  lastErrorLogAt = now;\n  log.error(\"http\", \"rate-limit\", error);\n}\n\n/**\n * Forget when the last store error was logged (tests).\n */\nexport function resetSharedRateLimitErrorLog(): void {\n  lastErrorLogAt = 0;\n}\n\n/**\n * Route data `@fastify/rate-limit` passes to `child()`: the route's options\n * under `routeInfo` (`fastify.rateLimit()` hooks pass an empty one).\n */\ntype ChildRouteOptions = {\n  routeInfo?: { method?: unknown; url?: string; path?: string };\n};\n\n/**\n * `fastify.rateLimit()` hooks have no route; told apart by creation order,\n * which matches across processes running the same code.\n */\nlet nextHookNamespace = 0;\n\n/**\n * `@fastify/rate-limit` store backed by `@warlock.js/cache`. Selected with\n * `http.rateLimit.store: \"cache\"`; each route with its own `rateLimit` gets\n * its own namespace through `child()`.\n *\n * A failure (cache outage, unsupported driver) is logged at most once a\n * minute and passed to the plugin, which lets the request through because\n * Warlock registers it with `skipOnError: true` for this store.\n */\nexport class CacheRateLimitStore implements FastifyRateLimitStore {\n  public constructor(\n    _options?: FastifyRateLimitOptions,\n    protected readonly namespace: string = \"global\",\n  ) {}\n\n  public incr(\n    key: string,\n    callback: (error: Error | null, result?: { current: number; ttl: number }) => void,\n    timeWindow: number,\n  ): void {\n    incrementSharedRateLimit(this.namespace, key, timeWindow).then(\n      ({ current, resetAt }) => callback(null, { current, ttl: Math.max(0, resetAt - Date.now()) }),\n      (error: unknown) => {\n        logSharedRateLimitError(error);\n        callback(error instanceof Error ? error : new Error(String(error)));\n      },\n    );\n  }\n\n  public read(\n    key: string,\n    callback: (error: Error | null, result?: { current: number; ttl: number }) => void,\n    timeWindow: number,\n  ): void {\n    readSharedRateLimit(this.namespace, key, timeWindow).then(\n      ({ current, resetAt }) =>\n        callback(null, { current, ttl: current === 0 ? 0 : Math.max(0, resetAt - Date.now()) }),\n      (error: unknown) => {\n        logSharedRateLimitError(error);\n        callback(error instanceof Error ? error : new Error(String(error)));\n      },\n    );\n  }\n\n  public child(routeOptions: Parameters<FastifyRateLimitStore[\"child\"]>[0]): FastifyRateLimitStore {\n    // The plugin's declared type names the route options directly, but at\n    // runtime (11.x) it passes them merged under `routeInfo`.\n    const routeInfo = (routeOptions as unknown as ChildRouteOptions).routeInfo ?? {};\n    const method = Array.isArray(routeInfo.method)\n      ? routeInfo.method.join(\",\")\n      : String(routeInfo.method ?? \"\");\n    const url = routeInfo.url ?? routeInfo.path ?? \"\";\n\n    if (!method && !url) {\n      return new CacheRateLimitStore(undefined, `hook.${nextHookNamespace++}`);\n    }\n\n    return new CacheRateLimitStore(undefined, `route.${method} ${url}`);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,aAAa;;;;AAKnB,MAAM,sBAAsB,IAAI,IAAI,CAAC,QAAQ,MAAM,CAAC;;;;AAKpD,IAAa,kCAAb,cAAqD,MAAM;CAIzD,AAAO,YAAY,YAAoB;EACrC,MACE,qDAAqD,WAAW,qBAC7D,eAAe,SACZ,uDACA,0FACJ,sFACJ;cATqB;EAWrB,KAAK,OAAO;CACd;AACF;AAEA,SAAS,wBAA8B;CACrC,MAAM,aAAa,MAAM,eAAe;CAExC,IAAI,cAAc,oBAAoB,IAAI,UAAU,GAClD,MAAM,IAAI,gCAAgC,UAAU;AAExD;;;;AAKA,SAAS,UAAU,OAAuB;CACxC,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;AACrE;;;;;;;;;;;AAYA,SAAS,UAAU,WAAmB,OAAe,aAA6B;CAGhF,OAAO,GAAG,WAAW,GAFJ,UAAU,QAAQ,oBAAoB,GAAG,CAAC,CAAC,MAAM,GAAG,EAEtC,EAAE,GAAG,UAAU,SAAS,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,GAAG,UAAU,KAAK,EAAE,GAAG;AAC/F;;;;;;;AAQA,eAAsB,yBACpB,WACA,OACA,UACA,MAAc,KAAK,IAAI,GACwB;CAC/C,sBAAsB;CAEtB,MAAM,cAAc,KAAK,MAAM,MAAM,QAAQ;CAC7C,MAAM,MAAM,UAAU,WAAW,OAAO,WAAW;CACnD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAM,IAAI,WAAY,GAAI,CAAC;CAE/D,MAAM,MAAM,IAAI,KAAK,GAAG;EAAE,KAAK;EAAY,YAAY;CAAS,CAAC;CAIjE,OAAO;EAAE,eAFa,MAAM,UAAU,KAAK,GAAG,EAAE,KAAK,WAAW,CAAC;EAE/C,UAAU,cAAc,KAAK;CAAS;AAC1D;;;;AAKA,eAAsB,oBACpB,WACA,OACA,UACA,MAAc,KAAK,IAAI,GACwB;CAC/C,sBAAsB;CAEtB,MAAM,cAAc,KAAK,MAAM,MAAM,QAAQ;CAC7C,MAAM,QAAQ,MAAM,MAAM,IAAI,UAAU,WAAW,OAAO,WAAW,CAAC;CAEtE,OAAO;EACL,SAAS,OAAO,UAAU,WAAW,QAAQ;EAC7C,UAAU,cAAc,KAAK;CAC/B;AACF;;;;;AAMA,MAAM,wBAAwB;AAE9B,IAAI,iBAAiB;;;;AAKrB,SAAgB,wBAAwB,OAAgB,MAAc,KAAK,IAAI,GAAS;CACtF,IAAI,MAAM,iBAAiB,uBAAuB;CAElD,iBAAiB;CACjB,IAAI,MAAM,QAAQ,cAAc,KAAK;AACvC;;;;;AAqBA,IAAI,oBAAoB;;;;;;;;;;AAWxB,IAAa,sBAAb,MAAa,oBAAqD;CAChE,AAAO,YACL,UACA,AAAmB,YAAoB,UACvC;EADmB;CAClB;CAEH,AAAO,KACL,KACA,UACA,YACM;EACN,yBAAyB,KAAK,WAAW,KAAK,UAAU,CAAC,CAAC,MACvD,EAAE,SAAS,cAAc,SAAS,MAAM;GAAE;GAAS,KAAK,KAAK,IAAI,GAAG,UAAU,KAAK,IAAI,CAAC;EAAE,CAAC,IAC3F,UAAmB;GAClB,wBAAwB,KAAK;GAC7B,SAAS,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACpE,CACF;CACF;CAEA,AAAO,KACL,KACA,UACA,YACM;EACN,oBAAoB,KAAK,WAAW,KAAK,UAAU,CAAC,CAAC,MAClD,EAAE,SAAS,cACV,SAAS,MAAM;GAAE;GAAS,KAAK,YAAY,IAAI,IAAI,KAAK,IAAI,GAAG,UAAU,KAAK,IAAI,CAAC;EAAE,CAAC,IACvF,UAAmB;GAClB,wBAAwB,KAAK;GAC7B,SAAS,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACpE,CACF;CACF;CAEA,AAAO,MAAM,cAAoF;EAG/F,MAAM,YAAa,aAA8C,aAAa,CAAC;EAC/E,MAAM,SAAS,MAAM,QAAQ,UAAU,MAAM,IACzC,UAAU,OAAO,KAAK,GAAG,IACzB,OAAO,UAAU,UAAU,EAAE;EACjC,MAAM,MAAM,UAAU,OAAO,UAAU,QAAQ;EAE/C,IAAI,CAAC,UAAU,CAAC,KACd,OAAO,IAAI,oBAAoB,QAAW,QAAQ,qBAAqB;EAGzE,OAAO,IAAI,oBAAoB,QAAW,SAAS,OAAO,GAAG,KAAK;CACpE;AACF"}
+{"version":3,"file":"rate-limit-cache-store.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/rate-limit-cache-store.ts"],"sourcesContent":["import type { FastifyRateLimitOptions, FastifyRateLimitStore } from \"@fastify/rate-limit\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport { createHash } from \"node:crypto\";\n\n/**\n * Rate-limit counting shared through `@warlock.js/cache`, so every process\n * that uses the same cache driver (Redis, Postgres) counts into the same\n * buckets. With a memory driver (`memory`, `lru`, `memoryExtended`) the\n * counts stay in the process, like the in-memory limiter.\n *\n * Windows are fixed and aligned to the clock: a 60 s window resets on the\n * minute, whichever process saw the first request. Each window has its own\n * key, created atomically with a TTL of two windows and incremented with the\n * driver's atomic increment, so a key cannot expire while its window counts.\n *\n * Two drivers are refused, with {@link UnsupportedRateLimitDriverError}:\n *\n * - `null` stores nothing, so every request would count as the first and the\n *   limit would never trip.\n * - `file` has no expiry sweeper, so every past window would stay on disk\n *   forever, and its increment is only serialized within one process, so\n *   workers sharing the directory would lose counts.\n */\n\nconst KEY_PREFIX = \"rate-limit\";\n\n/**\n * Cache drivers that cannot back a shared limiter (see the module comment).\n */\nconst UNSUPPORTED_DRIVERS = new Set([\"null\", \"file\"]);\n\n/**\n * Thrown when `store: \"cache\"` runs on a cache driver that cannot count.\n */\nexport class UnsupportedRateLimitDriverError extends Error {\n  /** Stable Warlock error code; `warlock explain WL1003` prints the fix. */\n  public readonly code = \"WL1003\";\n\n  public constructor(driverName: string) {\n    super(\n      `Rate limiting with store: \"cache\" cannot use the \"${driverName}\" cache driver: ` +\n        (driverName === \"null\"\n          ? \"it stores nothing, so the limit would never trip. \"\n          : \"it never removes expired windows and its increment is not shared between processes. \") +\n        'Use redis or pg (or a memory driver for a single process), or set store: \"memory\".',\n    );\n\n    this.name = \"UnsupportedRateLimitDriverError\";\n  }\n}\n\nfunction assertSupportedDriver(): void {\n  const driverName = cache.currentDriver?.name;\n\n  if (driverName && UNSUPPORTED_DRIVERS.has(driverName)) {\n    throw new UnsupportedRateLimitDriverError(driverName);\n  }\n}\n\n/**\n * Hash used for group keys and route namespaces before they reach the cache.\n */\nfunction shortHash(value: string): string {\n  return createHash(\"sha256\").update(value).digest(\"hex\").slice(0, 32);\n}\n\n/**\n * The group key (an IP, a user id, whatever `keyGenerator` returned) is\n * hashed before it reaches the cache: cache drivers log their keys, and a raw\n * IP or email in a key is personal data in a log line.\n *\n * The namespace (it carries a route path) is hashed as well: flattening\n * `/users/:id` and `/users/id` to one safe string merged their counters, and\n * the file driver would turn `/` into directories. A readable, flattened\n * prefix stays in front of the hash for debugging.\n */\nfunction windowKey(namespace: string, group: string, windowIndex: number): string {\n  const readable = namespace.replace(/[^A-Za-z0-9_-]+/g, \"_\").slice(0, 40);\n\n  return `${KEY_PREFIX}.${readable}-${shortHash(namespace).slice(0, 16)}.${shortHash(group)}.${windowIndex}`;\n}\n\n/**\n * Count one request for `group` in the current window.\n *\n * @returns the count so far in this window and when the window resets (epoch ms)\n * @throws {UnsupportedRateLimitDriverError} on the `null` or `file` driver\n */\nexport async function incrementSharedRateLimit(\n  namespace: string,\n  group: string,\n  windowMs: number,\n  now: number = Date.now(),\n): Promise<{ current: number; resetAt: number }> {\n  assertSupportedDriver();\n\n  const windowIndex = Math.floor(now / windowMs);\n  const key = windowKey(namespace, group, windowIndex);\n  const ttlSeconds = Math.max(1, Math.ceil((2 * windowMs) / 1000));\n\n  await cache.set(key, 0, { ttl: ttlSeconds, onConflict: \"create\" });\n\n  const current = await cache.increment(key, 1, { ttl: ttlSeconds });\n\n  return { current, resetAt: (windowIndex + 1) * windowMs };\n}\n\n/**\n * Read the count for `group` in the current window without counting a request\n */\nexport async function readSharedRateLimit(\n  namespace: string,\n  group: string,\n  windowMs: number,\n  now: number = Date.now(),\n): Promise<{ current: number; resetAt: number }> {\n  assertSupportedDriver();\n\n  const windowIndex = Math.floor(now / windowMs);\n  const value = await cache.get(windowKey(namespace, group, windowIndex));\n\n  return {\n    current: typeof value === \"number\" ? value : 0,\n    resetAt: (windowIndex + 1) * windowMs,\n  };\n}\n\n/**\n * How often a failing shared store is reported. A cache outage fails every\n * request, so logging each one would flood the log.\n */\nconst ERROR_LOG_INTERVAL_MS = 60_000;\n\nlet lastErrorLogAt = 0;\n\n/**\n * Log a shared rate-limit store failure, at most once per minute.\n */\nexport function logSharedRateLimitError(error: unknown, now: number = Date.now()): void {\n  if (now - lastErrorLogAt < ERROR_LOG_INTERVAL_MS) return;\n\n  lastErrorLogAt = now;\n  log.error(\"http\", \"rate-limit\", error);\n}\n\n/**\n * Forget when the last store error was logged (tests).\n */\nexport function resetSharedRateLimitErrorLog(): void {\n  lastErrorLogAt = 0;\n}\n\n/**\n * Route data `@fastify/rate-limit` passes to `child()`: the route's options\n * under `routeInfo` (`fastify.rateLimit()` hooks pass an empty one).\n */\ntype ChildRouteOptions = {\n  routeInfo?: { method?: unknown; url?: string; path?: string };\n};\n\n/**\n * `fastify.rateLimit()` hooks have no route; told apart by creation order,\n * which matches across processes running the same code.\n */\nlet nextHookNamespace = 0;\n\n/**\n * `@fastify/rate-limit` store backed by `@warlock.js/cache`. Selected with\n * `http.rateLimit.store: \"cache\"`; each route with its own `rateLimit` gets\n * its own namespace through `child()`.\n *\n * A failure (cache outage, unsupported driver) is logged at most once a\n * minute and passed to the plugin, which lets the request through because\n * Warlock registers it with `skipOnError: true` for this store.\n */\nexport class CacheRateLimitStore implements FastifyRateLimitStore {\n  public constructor(\n    _options?: FastifyRateLimitOptions,\n    protected readonly namespace: string = \"global\",\n  ) {}\n\n  public incr(\n    key: string,\n    callback: (error: Error | null, result?: { current: number; ttl: number }) => void,\n    timeWindow: number,\n  ): void {\n    incrementSharedRateLimit(this.namespace, key, timeWindow).then(\n      ({ current, resetAt }) => callback(null, { current, ttl: Math.max(0, resetAt - Date.now()) }),\n      (error: unknown) => {\n        logSharedRateLimitError(error);\n        callback(error instanceof Error ? error : new Error(String(error)));\n      },\n    );\n  }\n\n  public read(\n    key: string,\n    callback: (error: Error | null, result?: { current: number; ttl: number }) => void,\n    timeWindow: number,\n  ): void {\n    readSharedRateLimit(this.namespace, key, timeWindow).then(\n      ({ current, resetAt }) =>\n        callback(null, { current, ttl: current === 0 ? 0 : Math.max(0, resetAt - Date.now()) }),\n      (error: unknown) => {\n        logSharedRateLimitError(error);\n        callback(error instanceof Error ? error : new Error(String(error)));\n      },\n    );\n  }\n\n  public child(routeOptions: Parameters<FastifyRateLimitStore[\"child\"]>[0]): FastifyRateLimitStore {\n    // The plugin's declared type names the route options directly, but at\n    // runtime (11.x) it passes them merged under `routeInfo`.\n    const routeInfo = (routeOptions as unknown as ChildRouteOptions).routeInfo ?? {};\n    const method = Array.isArray(routeInfo.method)\n      ? routeInfo.method.join(\",\")\n      : String(routeInfo.method ?? \"\");\n    const url = routeInfo.url ?? routeInfo.path ?? \"\";\n\n    if (!method && !url) {\n      return new CacheRateLimitStore(undefined, `hook.${nextHookNamespace++}`);\n    }\n\n    return new CacheRateLimitStore(undefined, `route.${method} ${url}`);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,aAAa;;;;AAKnB,MAAM,sCAAsB,IAAI,IAAI,CAAC,QAAQ,MAAM,CAAC;;;;AAKpD,IAAa,kCAAb,cAAqD,MAAM;CAIzD,AAAO,YAAY,YAAoB;EACrC,MACE,qDAAqD,WAAW,qBAC7D,eAAe,SACZ,uDACA,0FACJ,sFACJ;cATqB;EAWrB,KAAK,OAAO;CACd;AACF;AAEA,SAAS,wBAA8B;CACrC,MAAM,aAAa,MAAM,eAAe;CAExC,IAAI,cAAc,oBAAoB,IAAI,UAAU,GAClD,MAAM,IAAI,gCAAgC,UAAU;AAExD;;;;AAKA,SAAS,UAAU,OAAuB;CACxC,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;AACrE;;;;;;;;;;;AAYA,SAAS,UAAU,WAAmB,OAAe,aAA6B;CAChF,MAAM,WAAW,UAAU,QAAQ,oBAAoB,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;CAEvE,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,SAAS,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,GAAG,UAAU,KAAK,EAAE,GAAG;AAC/F;;;;;;;AAQA,eAAsB,yBACpB,WACA,OACA,UACA,MAAc,KAAK,IAAI,GACwB;CAC/C,sBAAsB;CAEtB,MAAM,cAAc,KAAK,MAAM,MAAM,QAAQ;CAC7C,MAAM,MAAM,UAAU,WAAW,OAAO,WAAW;CACnD,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAM,IAAI,WAAY,GAAI,CAAC;CAE/D,MAAM,MAAM,IAAI,KAAK,GAAG;EAAE,KAAK;EAAY,YAAY;CAAS,CAAC;CAIjE,OAAO;EAAE,eAFa,MAAM,UAAU,KAAK,GAAG,EAAE,KAAK,WAAW,CAAC;EAE/C,UAAU,cAAc,KAAK;CAAS;AAC1D;;;;AAKA,eAAsB,oBACpB,WACA,OACA,UACA,MAAc,KAAK,IAAI,GACwB;CAC/C,sBAAsB;CAEtB,MAAM,cAAc,KAAK,MAAM,MAAM,QAAQ;CAC7C,MAAM,QAAQ,MAAM,MAAM,IAAI,UAAU,WAAW,OAAO,WAAW,CAAC;CAEtE,OAAO;EACL,SAAS,OAAO,UAAU,WAAW,QAAQ;EAC7C,UAAU,cAAc,KAAK;CAC/B;AACF;;;;;AAMA,MAAM,wBAAwB;AAE9B,IAAI,iBAAiB;;;;AAKrB,SAAgB,wBAAwB,OAAgB,MAAc,KAAK,IAAI,GAAS;CACtF,IAAI,MAAM,iBAAiB,uBAAuB;CAElD,iBAAiB;CACjB,IAAI,MAAM,QAAQ,cAAc,KAAK;AACvC;;;;;AAqBA,IAAI,oBAAoB;;;;;;;;;;AAWxB,IAAa,sBAAb,MAAa,oBAAqD;CAChE,AAAO,YACL,UACA,AAAmB,YAAoB,UACvC;EADmB;CAClB;CAEH,AAAO,KACL,KACA,UACA,YACM;EACN,yBAAyB,KAAK,WAAW,KAAK,UAAU,CAAC,CAAC,MACvD,EAAE,SAAS,cAAc,SAAS,MAAM;GAAE;GAAS,KAAK,KAAK,IAAI,GAAG,UAAU,KAAK,IAAI,CAAC;EAAE,CAAC,IAC3F,UAAmB;GAClB,wBAAwB,KAAK;GAC7B,SAAS,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACpE,CACF;CACF;CAEA,AAAO,KACL,KACA,UACA,YACM;EACN,oBAAoB,KAAK,WAAW,KAAK,UAAU,CAAC,CAAC,MAClD,EAAE,SAAS,cACV,SAAS,MAAM;GAAE;GAAS,KAAK,YAAY,IAAI,IAAI,KAAK,IAAI,GAAG,UAAU,KAAK,IAAI,CAAC;EAAE,CAAC,IACvF,UAAmB;GAClB,wBAAwB,KAAK;GAC7B,SAAS,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACpE,CACF;CACF;CAEA,AAAO,MAAM,cAAoF;EAG/F,MAAM,YAAa,aAA8C,aAAa,CAAC;EAC/E,MAAM,SAAS,MAAM,QAAQ,UAAU,MAAM,IACzC,UAAU,OAAO,KAAK,GAAG,IACzB,OAAO,UAAU,UAAU,EAAE;EACjC,MAAM,MAAM,UAAU,OAAO,UAAU,QAAQ;EAE/C,IAAI,CAAC,UAAU,CAAC,KACd,OAAO,IAAI,oBAAoB,QAAW,QAAQ,qBAAqB;EAGzE,OAAO,IAAI,oBAAoB,QAAW,SAAS,OAAO,GAAG,KAAK;CACpE;AACF"}

package/esm/http/ready-report.d.mts

@@ -31,26 +31,31 @@
  * hands its stdout to a supervisor that greps for known lines, so the existing
  * per-fact log lines stay exactly as they are outside development.
  */
-type HttpReadyReport = {
-  /** Exactly what `listen()` returned — the bind, not its presentation. */boundAddress?: string; /** The address spelled for a human; safe to paste into a browser. */
-  url: string; /** Whether the bind covers more than loopback. */
-  wildcardBind: boolean; /** The port actually bound. */
-  port: number; /** Routes on the app router at the moment the server started listening. */
-  routeCount: number; /** `app.baseUrl`, when it is a deployment address rather than a local one. */
+export type HttpReadyReport = {
+  /** Exactly what `listen()` returned — the bind, not its presentation. */
+  boundAddress?: string;
+  /** The address spelled for a human; safe to paste into a browser. */
+  url: string;
+  /** Whether the bind covers more than loopback. */
+  wildcardBind: boolean;
+  /** The port actually bound. */
+  port: number;
+  /** Routes on the app router at the moment the server started listening. */
+  routeCount: number;
+  /** `app.baseUrl`, when it is a deployment address rather than a local one. */
   publicUrl?: string;
 };
 /**
  * @internal Called by `HttpConnector.start()` right after a successful listen.
  */
-declare function setHttpReadyReport(next: HttpReadyReport): void;
+export declare function setHttpReadyReport(next: HttpReadyReport): void;
 /**
  * The last recorded bind, or `undefined` for a process with no HTTP surface —
  * a queue worker still boots, and the ready block must render without an app
  * URL rather than invent one.
  */
-declare function getHttpReadyReport(): HttpReadyReport | undefined;
+export declare function getHttpReadyReport(): HttpReadyReport | undefined;
 /** @internal Test seam — a module-level singleton needs a way back to empty. */
-declare function resetHttpReadyReport(): void;
+export declare function resetHttpReadyReport(): void;
 //#endregion
-export { HttpReadyReport, getHttpReadyReport, resetHttpReadyReport, setHttpReadyReport };
 //# sourceMappingURL=ready-report.d.mts.map

package/esm/http/ready-report.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ready-report.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/ready-report.ts"],"mappings":";;AAiCA;;;;;;;;;;;AAYW;AAQX;;;;AAAwD;AASxD;;;;AAAqD;AAKrD;;;;AAAoC;;;;;KAlCxB,eAAA;2EAEV,YAAA;EAEA,GAAA;EAEA,YAAA;EAEA,IAAA;EAEA,UAAA;EAEA,SAAA;AAAA;;;;iBAQc,kBAAA,CAAmB,IAAqB,EAAf,eAAe;;;;;;iBASxC,kBAAA,IAAsB,eAAe;;iBAKrC,oBAAA"}
+{"version":3,"file":"ready-report.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/ready-report.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAiCY;;EAEV;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;;;wBAQc,mBAAmB,MAAM;;;;;;wBASzB,sBAAsB;;wBAKtB"}

package/esm/http/request-controller.d.mts

@@ -2,14 +2,12 @@ import { Response } from "./response.mjs";
 import { Request } from "./request.mjs";
 import { ReturnedResponse } from "./types.mjs";
 import { RequestControllerContract } from "../router/types.mjs";
-
 //#region ../../packages/core/src/http/request-controller.d.ts
-declare abstract class RequestController implements RequestControllerContract {
+export declare abstract class RequestController implements RequestControllerContract {
   readonly request: Request;
   readonly response: Response;
   constructor(request: Request, response: Response);
   abstract execute(): Promise<ReturnedResponse>;
 }
 //#endregion
-export { RequestController };
 //# sourceMappingURL=request-controller.d.mts.map

package/esm/http/request-controller.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-controller.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/request-controller.ts"],"mappings":";;;;;;uBAKsB,iBAAA,YAA6B,yBAAA;EAAA,SAE/B,OAAA,EAAS,OAAA;EAAA,SACT,QAAA,EAAU,QAAA;cADV,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA;EAAA,SAKZ,OAAA,IAAW,OAAA,CAAQ,gBAAA;AAAA"}
+{"version":3,"file":"request-controller.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/request-controller.ts"],"mappings":";;;;;8BAKsB,6BAA6B;WAE/B,SAAS;WACT,UAAU;EAF5B,YACkB,SAAS,SACT,UAAU;WAKZ,WAAW,QAAQ"}

package/esm/http/request-log-snapshot.d.mts

@@ -10,7 +10,7 @@
  *   logging: { body: false, query: false },
  * });
  */
-type RequestLoggingOptions = {
+export type RequestLoggingOptions = {
   /**
    * Include the request body in log entries.
    *
@@ -30,8 +30,9 @@ type RequestLoggingOptions = {
   query?: boolean;
 };
 /** A URL policy that can only remove input from snapshots, even on unmatched requests. */
-type PrivateRequestLoggingRule = {
-  /** Path prefix at a segment boundary, or a regular expression over the normalized path. */path: string | RegExp;
+export type PrivateRequestLoggingRule = {
+  /** Path prefix at a segment boundary, or a regular expression over the normalized path. */
+  path: string | RegExp;
   body?: false;
   query?: false;
 };
@@ -39,13 +40,14 @@ type PrivateRequestLoggingRule = {
  * `http.logging`: the app-wide defaults for {@link RequestLoggingOptions},
  * plus query parameter names whose values are masked in logged URLs.
  */
-type HttpLoggingConfig = RequestLoggingOptions & {
+export type HttpLoggingConfig = RequestLoggingOptions & {
   /**
    * Extra query parameter names to mask in logged URLs, on top of the
    * logger's default secret-key denylist and {@link URL_CREDENTIAL_PARAMS}.
    * Matched like the logger's keys: case, `-` and `_` are ignored.
    */
-  redactQueryParams?: string[]; /** URL policies applied before route logging; matching rules cannot be overridden by a route. */
+  redactQueryParams?: string[];
+  /** URL policies applied before route logging; matching rules cannot be overridden by a route. */
   private?: PrivateRequestLoggingRule[];
 };
 /**
@@ -53,11 +55,14 @@ type HttpLoggingConfig = RequestLoggingOptions & {
  * place of the `Request`/`Response` instances, whose native request, reply
  * and socket graphs reach every sink otherwise.
  */
-type RequestLogSnapshot = {
+export type RequestLogSnapshot = {
   id: string;
-  method: string; /** Path and query string, with credential-bearing parameter values masked. */
-  url: string; /** The matched route pattern, e.g. `/users/:id`. */
-  route?: string; /** The route name, when it has one. */
+  method: string;
+  /** Path and query string, with credential-bearing parameter values masked. */
+  url: string;
+  /** The matched route pattern, e.g. `/users/:id`. */
+  route?: string;
+  /** The route name, when it has one. */
   name?: string;
   ip?: string;
   userAgent?: string;
@@ -69,7 +74,7 @@ type RequestLogSnapshot = {
  * are too generic for the logger's key denylist: signed-URL signatures,
  * pre-signed cloud credentials and OAuth authorization codes.
  */
-declare const URL_CREDENTIAL_PARAMS: readonly string[];
+export declare const URL_CREDENTIAL_PARAMS: readonly string[];
 /**
  * Mask the values of credential-bearing query parameters in a URL (absolute,
  * or a path with a query string). A parameter is credential-bearing when its
@@ -81,7 +86,7 @@ declare const URL_CREDENTIAL_PARAMS: readonly string[];
  * @example
  * redactUrlCredentials("/hooks?secret=abc&page=2") // "/hooks?secret=[REDACTED]&page=2"
  */
-declare function redactUrlCredentials(url: string, extraParams?: readonly string[]): string;
+export declare function redactUrlCredentials(url: string, extraParams?: readonly string[]): string;
 /**
  * Mask the values of credential-bearing parameters in a parsed query object,
  * with the same names {@link redactUrlCredentials} masks in the URL. Nested
@@ -90,19 +95,19 @@ declare function redactUrlCredentials(url: string, extraParams?: readonly string
  * @example
  * redactQueryCredentials({ code: "abc", page: "2" }) // { code: "[REDACTED]", page: "2" }
  */
-declare function redactQueryCredentials(query: Record<string, unknown>, extraParams?: readonly string[]): Record<string, unknown>;
+export declare function redactQueryCredentials(query: Record<string, unknown>, extraParams?: readonly string[]): Record<string, unknown>;
 /**
  * The effective logging options for a request: `http.logging` overlaid by the
  * route's own `logging` option, then restricted by matching private URL policies.
  */
-declare function resolveRequestLoggingOptions(routeOptions: RequestLoggingOptions | undefined, url?: string, routePath?: string): Required<RequestLoggingOptions> & {
+export declare function resolveRequestLoggingOptions(routeOptions: RequestLoggingOptions | undefined, url?: string, routePath?: string): Required<RequestLoggingOptions> & {
   redactQueryParams: string[];
 };
 /**
  * The fields of a request the snapshot reads. Structural, so the snapshot can
  * be built (and tested) without a live Fastify request.
  */
-type RequestLogSource = {
+export type RequestLogSource = {
   id: string;
   method: string;
   url: string;
@@ -124,7 +129,6 @@ type RequestLogSource = {
  *
  * Uploaded files are summarised (`{ file, mimeType }`) rather than walked.
  */
-declare function buildRequestLogSnapshot(source: RequestLogSource): RequestLogSnapshot;
+export declare function buildRequestLogSnapshot(source: RequestLogSource): RequestLogSnapshot;
 //#endregion
-export { HttpLoggingConfig, PrivateRequestLoggingRule, RequestLogSnapshot, RequestLogSource, RequestLoggingOptions, URL_CREDENTIAL_PARAMS, buildRequestLogSnapshot, redactQueryCredentials, redactUrlCredentials, resolveRequestLoggingOptions };
 //# sourceMappingURL=request-log-snapshot.d.mts.map

package/esm/http/request-log-snapshot.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-log-snapshot.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/request-log-snapshot.ts"],"mappings":";;AAeA;;;;AAiBO;AAIP;;;;;KArBY,qBAAA;EAwBV;;;AACK;AAOP;;;;;EAtBE,IAAA;EA8BA;;;AAAmC;AAQrC;;EA/BE,KAAK;AAAA;;KAIK,yBAAA;EA+BV,2FA7BA,IAAA,WAAe,MAAM;EACrB,IAAA;EACA,KAAA;AAAA;;;;;KAOU,iBAAA,GAAoB,qBAAA;EA4BjB;AAQf;;;;EA9BE,iBAAA,aA0Dc;EAxDd,OAAA,GAAU,yBAAyB;AAAA;;AAwDgD;AA4DrF;;;KA5GY,kBAAA;EACV,EAAA;EACA,MAAA,UA4GA;EA1GA,GAAA,UA2GO;EAzGP,KAAA,WA4Ic;EA1Id,IAAA;EACA,EAAA;EACA,SAAA;EACA,KAAA,GAAQ,MAAA;EACR,IAAA,GAAO,MAAM;AAAA;;;;;;cAQF,qBAAA;;;;AAkI2C;AAuGxD;;;;;;;iBA7MgB,oBAAA,CAAqB,GAAA,UAAa,WAAmC;;;;;;;;;iBA4DrE,sBAAA,CACd,KAAA,EAAO,MAAA,mBACP,WAAA,uBACC,MAAM;;;;;iBAmCO,4BAAA,CACd,YAAA,EAAc,qBAAA,cACd,GAAA,WACA,SAAA,YACC,QAAA,CAAS,qBAAA;EAA2B,iBAAA;AAAA;AA0HvC;;;;AAAA,KAnBY,gBAAA;EACV,EAAA;EACA,MAAA;EACA,GAAA;EACA,EAAA;EACA,SAAA;EACA,KAAA,GAAQ,MAAA;EACR,IAAA,GAAO,MAAA;EACP,KAAA;IAAU,IAAA;IAAe,IAAA;IAAe,OAAA,GAAU,qBAAA;EAAA;AAAA;;;;;;;;;iBAWpC,uBAAA,CAAwB,MAAA,EAAQ,gBAAA,GAAmB,kBAAkB"}
+{"version":3,"file":"request-log-snapshot.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/request-log-snapshot.ts"],"mappings":";;;;;;;;;;;;YAeY;;;;;;;;;;EAUV;;;;;;;EAOA;;;YAIU;;EAEV,eAAe;EACf;EACA;;;;;;YAOU,oBAAoB;;;;;;EAM9B;;EAEA,UAAU;;;;;;;YAQA;EACV;EACA;;EAEA;;EAEA;;EAEA;EACA;EACA;EACA,QAAQ;EACR,OAAO;;;;;;;qBAQI;;;;;;;;;;;;wBA4BG,qBAAqB,aAAa;;;;;;;;;wBA4DlC,uBACd,OAAO,yBACP,kCACC;;;;;wBAmCa,6BACd,cAAc,mCACd,cACA,qBACC,SAAS;EAA2B;;;;;;YAuG3B;EACV;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR,OAAO;EACP;IAAU;IAAe;IAAe,UAAU;;;;;;;;;;;wBAWpC,wBAAwB,QAAQ,mBAAmB"}

package/esm/http/request-log-snapshot.mjs

@@ -1,5 +1,5 @@
 import { UploadedFile } from "./uploaded-file.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { DEFAULT_REDACT_KEY_SET, normalizeRedactKey } from "@warlock.js/logger";
 
 //#region ../../packages/core/src/http/request-log-snapshot.ts
@@ -87,7 +87,7 @@ function redactQueryValue(value, isCredential) {
 * route's own `logging` option, then restricted by matching private URL policies.
 */
 function resolveRequestLoggingOptions(routeOptions, url, routePath) {
-	const global = config.get("http.logging") ?? {};
+	const global = baseConfig.get("http.logging") ?? {};
 	const options = {
 		body: routeOptions?.body ?? global.body ?? true,
 		query: routeOptions?.query ?? global.query ?? true,
@@ -164,7 +164,7 @@ function loggingPathCandidates(url) {
 		const segments = [];
 		for (const segment of decoded.split("/")) if (segment === "..") segments.pop();
 		else if (segment && segment !== ".") segments.push(segment);
-		return [...new Set([
+		return [.../* @__PURE__ */ new Set([
 			raw,
 			decoded,
 			`/${segments.join("/")}`

package/esm/http/request-log-snapshot.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request-log-snapshot.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/request-log-snapshot.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { DEFAULT_REDACT_KEY_SET, normalizeRedactKey } from \"@warlock.js/logger\";\nimport { UploadedFile } from \"./uploaded-file\";\n\n/**\n * What a request's log entries carry of its input. Set globally under\n * `http.logging` and per route with the route's `logging` option; the route\n * wins key by key, unless a private URL policy suppresses that field.\n *\n * @example\n * // never log the body or the query string of this route, not even redacted\n * router.post(\"/accounts/credentials\", controller, {\n *   logging: { body: false, query: false },\n * });\n */\nexport type RequestLoggingOptions = {\n  /**\n   * Include the request body in log entries.\n   *\n   * The body is logged as RECEIVED, before validation, so fields the schema\n   * later rejects are part of it. Turn it off on routes that accept secrets\n   * or arbitrary user text.\n   *\n   * @default true\n   */\n  body?: boolean;\n  /**\n   * Include the parsed query string in log entries. The logged URL keeps its\n   * path either way; with `query: false` its query string is dropped too.\n   *\n   * @default true\n   */\n  query?: boolean;\n};\n\n/** A URL policy that can only remove input from snapshots, even on unmatched requests. */\nexport type PrivateRequestLoggingRule = {\n  /** Path prefix at a segment boundary, or a regular expression over the normalized path. */\n  path: string | RegExp;\n  body?: false;\n  query?: false;\n};\n\n/**\n * `http.logging`: the app-wide defaults for {@link RequestLoggingOptions},\n * plus query parameter names whose values are masked in logged URLs.\n */\nexport type HttpLoggingConfig = RequestLoggingOptions & {\n  /**\n   * Extra query parameter names to mask in logged URLs, on top of the\n   * logger's default secret-key denylist and {@link URL_CREDENTIAL_PARAMS}.\n   * Matched like the logger's keys: case, `-` and `_` are ignored.\n   */\n  redactQueryParams?: string[];\n  /** URL policies applied before route logging; matching rules cannot be overridden by a route. */\n  private?: PrivateRequestLoggingRule[];\n};\n\n/**\n * The bounded, plain-data view of a request that Core puts in log entries in\n * place of the `Request`/`Response` instances, whose native request, reply\n * and socket graphs reach every sink otherwise.\n */\nexport type RequestLogSnapshot = {\n  id: string;\n  method: string;\n  /** Path and query string, with credential-bearing parameter values masked. */\n  url: string;\n  /** The matched route pattern, e.g. `/users/:id`. */\n  route?: string;\n  /** The route name, when it has one. */\n  name?: string;\n  ip?: string;\n  userAgent?: string;\n  query?: Record<string, unknown>;\n  body?: Record<string, unknown>;\n};\n\n/**\n * Query parameters that carry a credential in a URL even though their names\n * are too generic for the logger's key denylist: signed-URL signatures,\n * pre-signed cloud credentials and OAuth authorization codes.\n */\nexport const URL_CREDENTIAL_PARAMS: readonly string[] = [\n  \"signature\",\n  \"sig\",\n  \"code\",\n  \"x-amz-signature\",\n  \"x-amz-credential\",\n  \"x-amz-security-token\",\n  \"x-goog-signature\",\n  \"x-goog-credential\",\n];\n\nconst URL_CREDENTIAL_PARAM_SET: ReadonlySet<string> = new Set(\n  URL_CREDENTIAL_PARAMS.map(normalizeRedactKey),\n);\n\nconst REDACTED = \"[REDACTED]\";\n\n/**\n * Mask the values of credential-bearing query parameters in a URL (absolute,\n * or a path with a query string). A parameter is credential-bearing when its\n * normalized name is in the logger's default secret-key denylist (`secret`,\n * `token`, `apiKey`, …), in {@link URL_CREDENTIAL_PARAMS}, or in `extraParams`.\n *\n * The path and the other parameters are kept as written.\n *\n * @example\n * redactUrlCredentials(\"/hooks?secret=abc&page=2\") // \"/hooks?secret=[REDACTED]&page=2\"\n */\nexport function redactUrlCredentials(url: string, extraParams: readonly string[] = []): string {\n  const queryStart = url.indexOf(\"?\");\n\n  if (queryStart === -1) return url;\n\n  const hashStart = url.indexOf(\"#\", queryStart);\n  const queryEnd = hashStart === -1 ? url.length : hashStart;\n  const isCredential = credentialParamMatcher(extraParams);\n\n  const query = url\n    .slice(queryStart + 1, queryEnd)\n    .split(\"&\")\n    .map((pair) => {\n      const separator = pair.indexOf(\"=\");\n      const rawName = separator === -1 ? pair : pair.slice(0, separator);\n\n      let name = rawName;\n\n      try {\n        name = decodeURIComponent(rawName.replace(/\\+/g, \" \"));\n      } catch {\n        // A malformed escape is logged under its raw name.\n      }\n\n      if (separator !== -1 && isCredential(name)) {\n        return `${rawName}=${REDACTED}`;\n      }\n\n      return pair;\n    })\n    .join(\"&\");\n\n  // A fragment never reaches the server, but a URL handed in by app code may\n  // carry one; it is dropped rather than risk logging a token in it.\n  return `${url.slice(0, queryStart)}?${query}`;\n}\n\n/**\n * A predicate telling whether a query parameter name carries a credential:\n * its normalized name is in the logger's default secret-key denylist, in\n * {@link URL_CREDENTIAL_PARAMS}, or in `extraParams`.\n */\nfunction credentialParamMatcher(extraParams: readonly string[]): (name: string) => boolean {\n  const extra = new Set(extraParams.map(normalizeRedactKey));\n\n  return (name) => {\n    const key = normalizeRedactKey(name);\n\n    return DEFAULT_REDACT_KEY_SET.has(key) || URL_CREDENTIAL_PARAM_SET.has(key) || extra.has(key);\n  };\n}\n\n/**\n * Mask the values of credential-bearing parameters in a parsed query object,\n * with the same names {@link redactUrlCredentials} masks in the URL. Nested\n * objects and arrays (`a[b]=…` parsing) are walked; the input is not mutated.\n *\n * @example\n * redactQueryCredentials({ code: \"abc\", page: \"2\" }) // { code: \"[REDACTED]\", page: \"2\" }\n */\nexport function redactQueryCredentials(\n  query: Record<string, unknown>,\n  extraParams: readonly string[] = [],\n): Record<string, unknown> {\n  return redactQueryObject(query, credentialParamMatcher(extraParams));\n}\n\nfunction redactQueryObject(\n  query: Record<string, unknown>,\n  isCredential: (name: string) => boolean,\n): Record<string, unknown> {\n  const output: Record<string, unknown> = {};\n\n  for (const [name, value] of Object.entries(query)) {\n    output[name] = isCredential(name) ? REDACTED : redactQueryValue(value, isCredential);\n  }\n\n  return output;\n}\n\nfunction redactQueryValue(value: unknown, isCredential: (name: string) => boolean): unknown {\n  if (Array.isArray(value)) return value.map((item) => redactQueryValue(item, isCredential));\n\n  if (\n    value !== null &&\n    typeof value === \"object\" &&\n    Object.getPrototypeOf(value) === Object.prototype\n  ) {\n    return redactQueryObject(value as Record<string, unknown>, isCredential);\n  }\n\n  return value;\n}\n\n/**\n * The effective logging options for a request: `http.logging` overlaid by the\n * route's own `logging` option, then restricted by matching private URL policies.\n */\nexport function resolveRequestLoggingOptions(\n  routeOptions: RequestLoggingOptions | undefined,\n  url?: string,\n  routePath?: string,\n): Required<RequestLoggingOptions> & { redactQueryParams: string[] } {\n  const global = (config.get(\"http.logging\") ?? {}) as HttpLoggingConfig;\n\n  const options = {\n    body: routeOptions?.body ?? global.body ?? true,\n    query: routeOptions?.query ?? global.query ?? true,\n    redactQueryParams: global.redactQueryParams ?? [],\n  };\n  if (!global.private?.length || url === undefined) return options;\n  const candidates = loggingPathCandidates(url);\n  if (candidates === undefined) return { ...options, body: false, query: false };\n  if (routePath) {\n    const routeCandidates = loggingPathCandidates(routePath);\n    if (!routeCandidates) return { ...options, body: false, query: false };\n    candidates.push(...routeCandidates);\n  }\n\n  for (const rule of compiledPrivateRules(global.private)) {\n    let matches: boolean;\n    if (rule.type === \"regex\") {\n      const { regex, needsClone } = rule;\n      matches = candidates.some((candidate) =>\n        (needsClone ? new RegExp(regex.source, regex.flags) : regex).test(candidate),\n      );\n    } else {\n      const { prefixes } = rule;\n      // A malformed configured prefix must never silently disable privacy.\n      matches =\n        prefixes === undefined ||\n        prefixes.some((prefix) =>\n          candidates.some(\n            (candidate) =>\n              prefix === \"/\" || candidate === prefix || candidate.startsWith(`${prefix}/`),\n          ),\n        );\n    }\n    if (!matches) continue;\n    if (rule.body === false) options.body = false;\n    if (rule.query === false) options.query = false;\n  }\n  return options;\n}\n\n/** A private rule with its path matcher prepared once. */\ntype CompiledPrivateRule = Pick<PrivateRequestLoggingRule, \"body\" | \"query\"> &\n  (\n    | { type: \"regex\"; regex: RegExp; needsClone: boolean }\n    // `undefined` prefixes: the configured path does not decode, so it matches every request.\n    | { type: \"prefix\"; prefixes: string[] | undefined }\n  );\n\n/**\n * Compiled rules per configured `http.logging.private` array. Snapshots are\n * built several times per request, so each array's prefixes are normalised\n * once; replacing the array (a new config value) compiles the new one.\n */\nconst compiledRulesCache = new WeakMap<\n  readonly PrivateRequestLoggingRule[],\n  CompiledPrivateRule[]\n>();\n\nfunction compiledPrivateRules(rules: readonly PrivateRequestLoggingRule[]): CompiledPrivateRule[] {\n  let compiled = compiledRulesCache.get(rules);\n  if (compiled) return compiled;\n  compiled = rules.map((rule): CompiledPrivateRule => {\n    const { path, body, query } = rule;\n    if (path instanceof RegExp) {\n      // A global or sticky regex keeps `lastIndex` between tests; use a fresh copy.\n      return { type: \"regex\", regex: path, needsClone: path.global || path.sticky, body, query };\n    }\n    return { type: \"prefix\", prefixes: loggingPathCandidates(path), body, query };\n  });\n  compiledRulesCache.set(rules, compiled);\n  return compiled;\n}\n\n/** Backslashes to slashes, repeated slashes collapsed, no trailing slash. */\nfunction collapseLoggingPath(path: string): string {\n  return path.replace(/\\\\/g, \"/\").replace(/\\/+/g, \"/\").replace(/\\/$/, \"\") || \"/\";\n}\n\nfunction loggingPathCandidates(url: string): string[] | undefined {\n  try {\n    // Preserve raw dot segments in absolute-form requests; URL() would erase them.\n    const pathname = url.replace(/^[a-z][a-z\\d+.-]*:\\/\\/[^/?#]*/i, \"\").split(/[?#]/u)[0] || \"/\";\n    const raw = collapseLoggingPath(pathname);\n    const decoded = collapseLoggingPath(decodeURIComponent(pathname));\n    const segments: string[] = [];\n    for (const segment of decoded.split(\"/\")) {\n      if (segment === \"..\") segments.pop();\n      else if (segment && segment !== \".\") segments.push(segment);\n    }\n    return [...new Set([raw, decoded, `/${segments.join(\"/\")}`])];\n  } catch {\n    // With a private-path policy, undecodable input is withheld rather than guessed.\n    return undefined;\n  }\n}\n\n/**\n * The fields of a request the snapshot reads. Structural, so the snapshot can\n * be built (and tested) without a live Fastify request.\n */\nexport type RequestLogSource = {\n  id: string;\n  method: string;\n  url: string;\n  ip?: string;\n  userAgent?: string;\n  query?: Record<string, unknown>;\n  body?: Record<string, unknown>;\n  route?: { path?: string; name?: string; logging?: RequestLoggingOptions };\n};\n\n/**\n * Build the {@link RequestLogSnapshot} for a request, applying the route's\n * logging policy BEFORE anything reaches a log entry: an omitted body or\n * query is never copied, so no sink, channel or redaction setting can expose it.\n * Credential-bearing query parameters are masked in both `url` and `query`.\n *\n * Uploaded files are summarised (`{ file, mimeType }`) rather than walked.\n */\nexport function buildRequestLogSnapshot(source: RequestLogSource): RequestLogSnapshot {\n  const options = resolveRequestLoggingOptions(\n    source.route?.logging,\n    source.url,\n    source.route?.path,\n  );\n  const url = options.query ? source.url : stripQuery(source.url);\n\n  const snapshot: RequestLogSnapshot = {\n    id: source.id,\n    method: source.method,\n    url: redactUrlCredentials(url ?? \"\", options.redactQueryParams),\n  };\n\n  if (source.route?.path) snapshot.route = source.route.path;\n  if (source.route?.name) snapshot.name = source.route.name;\n  if (source.ip) snapshot.ip = source.ip;\n  if (source.userAgent) snapshot.userAgent = source.userAgent;\n\n  if (options.query && source.query && Object.keys(source.query).length > 0) {\n    snapshot.query = redactQueryCredentials(source.query, options.redactQueryParams);\n  }\n\n  if (options.body && source.body && Object.keys(source.body).length > 0) {\n    snapshot.body = summariseFiles(source.body);\n  }\n\n  return snapshot;\n}\n\nfunction stripQuery(url: string | undefined): string | undefined {\n  if (!url) return url;\n\n  const queryStart = url.indexOf(\"?\");\n\n  return queryStart === -1 ? url : url.slice(0, queryStart);\n}\n\nfunction summariseFiles(body: Record<string, unknown>): Record<string, unknown> {\n  const output: Record<string, unknown> = {};\n\n  for (const [key, value] of Object.entries(body)) {\n    output[key] = Array.isArray(value) ? value.map(summariseFile) : summariseFile(value);\n  }\n\n  return output;\n}\n\nfunction summariseFile(value: unknown): unknown {\n  if (!(value instanceof UploadedFile)) return value;\n\n  return { file: value.name, mimeType: value.mimeType };\n}\n"],"mappings":";;;;;;;;;;AAmFA,MAAa,wBAA2C;CACtD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,2BAAgD,IAAI,IACxD,sBAAsB,IAAI,kBAAkB,CAC9C;AAEA,MAAM,WAAW;;;;;;;;;;;;AAajB,SAAgB,qBAAqB,KAAa,cAAiC,CAAC,GAAW;CAC7F,MAAM,aAAa,IAAI,QAAQ,GAAG;CAElC,IAAI,eAAe,IAAI,OAAO;CAE9B,MAAM,YAAY,IAAI,QAAQ,KAAK,UAAU;CAC7C,MAAM,WAAW,cAAc,KAAK,IAAI,SAAS;CACjD,MAAM,eAAe,uBAAuB,WAAW;CAEvD,MAAM,QAAQ,IACX,MAAM,aAAa,GAAG,QAAQ,CAAC,CAC/B,MAAM,GAAG,CAAC,CACV,KAAK,SAAS;EACb,MAAM,YAAY,KAAK,QAAQ,GAAG;EAClC,MAAM,UAAU,cAAc,KAAK,OAAO,KAAK,MAAM,GAAG,SAAS;EAEjE,IAAI,OAAO;EAEX,IAAI;GACF,OAAO,mBAAmB,QAAQ,QAAQ,OAAO,GAAG,CAAC;EACvD,QAAQ,CAER;EAEA,IAAI,cAAc,MAAM,aAAa,IAAI,GACvC,OAAO,GAAG,QAAQ,GAAG;EAGvB,OAAO;CACT,CAAC,CAAC,CACD,KAAK,GAAG;CAIX,OAAO,GAAG,IAAI,MAAM,GAAG,UAAU,EAAE,GAAG;AACxC;;;;;;AAOA,SAAS,uBAAuB,aAA2D;CACzF,MAAM,QAAQ,IAAI,IAAI,YAAY,IAAI,kBAAkB,CAAC;CAEzD,QAAQ,SAAS;EACf,MAAM,MAAM,mBAAmB,IAAI;EAEnC,OAAO,uBAAuB,IAAI,GAAG,KAAK,yBAAyB,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG;CAC9F;AACF;;;;;;;;;AAUA,SAAgB,uBACd,OACA,cAAiC,CAAC,GACT;CACzB,OAAO,kBAAkB,OAAO,uBAAuB,WAAW,CAAC;AACrE;AAEA,SAAS,kBACP,OACA,cACyB;CACzB,MAAM,SAAkC,CAAC;CAEzC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAC9C,OAAO,QAAQ,aAAa,IAAI,IAAI,WAAW,iBAAiB,OAAO,YAAY;CAGrF,OAAO;AACT;AAEA,SAAS,iBAAiB,OAAgB,cAAkD;CAC1F,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,KAAK,SAAS,iBAAiB,MAAM,YAAY,CAAC;CAEzF,IACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,eAAe,KAAK,MAAM,OAAO,WAExC,OAAO,kBAAkB,OAAkC,YAAY;CAGzE,OAAO;AACT;;;;;AAMA,SAAgB,6BACd,cACA,KACA,WACmE;CACnE,MAAM,SAAU,OAAO,IAAI,cAAc,KAAK,CAAC;CAE/C,MAAM,UAAU;EACd,MAAM,cAAc,QAAQ,OAAO,QAAQ;EAC3C,OAAO,cAAc,SAAS,OAAO,SAAS;EAC9C,mBAAmB,OAAO,qBAAqB,CAAC;CAClD;CACA,IAAI,CAAC,OAAO,SAAS,UAAU,QAAQ,QAAW,OAAO;CACzD,MAAM,aAAa,sBAAsB,GAAG;CAC5C,IAAI,eAAe,QAAW,OAAO;EAAE,GAAG;EAAS,MAAM;EAAO,OAAO;CAAM;CAC7E,IAAI,WAAW;EACb,MAAM,kBAAkB,sBAAsB,SAAS;EACvD,IAAI,CAAC,iBAAiB,OAAO;GAAE,GAAG;GAAS,MAAM;GAAO,OAAO;EAAM;EACrE,WAAW,KAAK,GAAG,eAAe;CACpC;CAEA,KAAK,MAAM,QAAQ,qBAAqB,OAAO,OAAO,GAAG;EACvD,IAAI;EACJ,IAAI,KAAK,SAAS,SAAS;GACzB,MAAM,EAAE,OAAO,eAAe;GAC9B,UAAU,WAAW,MAAM,eACxB,aAAa,IAAI,OAAO,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAK,CAAE,KAAK,SAAS,CAC7E;EACF,OAAO;GACL,MAAM,EAAE,aAAa;GAErB,UACE,aAAa,UACb,SAAS,MAAM,WACb,WAAW,MACR,cACC,WAAW,OAAO,cAAc,UAAU,UAAU,WAAW,GAAG,OAAO,EAAE,CAC/E,CACF;EACJ;EACA,IAAI,CAAC,SAAS;EACd,IAAI,KAAK,SAAS,OAAO,QAAQ,OAAO;EACxC,IAAI,KAAK,UAAU,OAAO,QAAQ,QAAQ;CAC5C;CACA,OAAO;AACT;;;;;;AAeA,MAAM,qCAAqB,IAAI,QAG7B;AAEF,SAAS,qBAAqB,OAAoE;CAChG,IAAI,WAAW,mBAAmB,IAAI,KAAK;CAC3C,IAAI,UAAU,OAAO;CACrB,WAAW,MAAM,KAAK,SAA8B;EAClD,MAAM,EAAE,MAAM,MAAM,UAAU;EAC9B,IAAI,gBAAgB,QAElB,OAAO;GAAE,MAAM;GAAS,OAAO;GAAM,YAAY,KAAK,UAAU,KAAK;GAAQ;GAAM;EAAM;EAE3F,OAAO;GAAE,MAAM;GAAU,UAAU,sBAAsB,IAAI;GAAG;GAAM;EAAM;CAC9E,CAAC;CACD,mBAAmB,IAAI,OAAO,QAAQ;CACtC,OAAO;AACT;;AAGA,SAAS,oBAAoB,MAAsB;CACjD,OAAO,KAAK,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,QAAQ,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE,KAAK;AAC7E;AAEA,SAAS,sBAAsB,KAAmC;CAChE,IAAI;EAEF,MAAM,WAAW,IAAI,QAAQ,kCAAkC,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,MAAM;EACxF,MAAM,MAAM,oBAAoB,QAAQ;EACxC,MAAM,UAAU,oBAAoB,mBAAmB,QAAQ,CAAC;EAChE,MAAM,WAAqB,CAAC;EAC5B,KAAK,MAAM,WAAW,QAAQ,MAAM,GAAG,GACrC,IAAI,YAAY,MAAM,SAAS,IAAI;OAC9B,IAAI,WAAW,YAAY,KAAK,SAAS,KAAK,OAAO;EAE5D,OAAO,CAAC,GAAG,IAAI,IAAI;GAAC;GAAK;GAAS,IAAI,SAAS,KAAK,GAAG;EAAG,CAAC,CAAC;CAC9D,QAAQ;EAEN;CACF;AACF;;;;;;;;;AAyBA,SAAgB,wBAAwB,QAA8C;CACpF,MAAM,UAAU,6BACd,OAAO,OAAO,SACd,OAAO,KACP,OAAO,OAAO,IAChB;CACA,MAAM,MAAM,QAAQ,QAAQ,OAAO,MAAM,WAAW,OAAO,GAAG;CAE9D,MAAM,WAA+B;EACnC,IAAI,OAAO;EACX,QAAQ,OAAO;EACf,KAAK,qBAAqB,OAAO,IAAI,QAAQ,iBAAiB;CAChE;CAEA,IAAI,OAAO,OAAO,MAAM,SAAS,QAAQ,OAAO,MAAM;CACtD,IAAI,OAAO,OAAO,MAAM,SAAS,OAAO,OAAO,MAAM;CACrD,IAAI,OAAO,IAAI,SAAS,KAAK,OAAO;CACpC,IAAI,OAAO,WAAW,SAAS,YAAY,OAAO;CAElD,IAAI,QAAQ,SAAS,OAAO,SAAS,OAAO,KAAK,OAAO,KAAK,CAAC,CAAC,SAAS,GACtE,SAAS,QAAQ,uBAAuB,OAAO,OAAO,QAAQ,iBAAiB;CAGjF,IAAI,QAAQ,QAAQ,OAAO,QAAQ,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,SAAS,GACnE,SAAS,OAAO,eAAe,OAAO,IAAI;CAG5C,OAAO;AACT;AAEA,SAAS,WAAW,KAA6C;CAC/D,IAAI,CAAC,KAAK,OAAO;CAEjB,MAAM,aAAa,IAAI,QAAQ,GAAG;CAElC,OAAO,eAAe,KAAK,MAAM,IAAI,MAAM,GAAG,UAAU;AAC1D;AAEA,SAAS,eAAe,MAAwD;CAC9E,MAAM,SAAkC,CAAC;CAEzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAC5C,OAAO,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,aAAa,IAAI,cAAc,KAAK;CAGrF,OAAO;AACT;AAEA,SAAS,cAAc,OAAyB;CAC9C,IAAI,EAAE,iBAAiB,eAAe,OAAO;CAE7C,OAAO;EAAE,MAAM,MAAM;EAAM,UAAU,MAAM;CAAS;AACtD"}
+{"version":3,"file":"request-log-snapshot.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/request-log-snapshot.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { DEFAULT_REDACT_KEY_SET, normalizeRedactKey } from \"@warlock.js/logger\";\nimport { UploadedFile } from \"./uploaded-file\";\n\n/**\n * What a request's log entries carry of its input. Set globally under\n * `http.logging` and per route with the route's `logging` option; the route\n * wins key by key, unless a private URL policy suppresses that field.\n *\n * @example\n * // never log the body or the query string of this route, not even redacted\n * router.post(\"/accounts/credentials\", controller, {\n *   logging: { body: false, query: false },\n * });\n */\nexport type RequestLoggingOptions = {\n  /**\n   * Include the request body in log entries.\n   *\n   * The body is logged as RECEIVED, before validation, so fields the schema\n   * later rejects are part of it. Turn it off on routes that accept secrets\n   * or arbitrary user text.\n   *\n   * @default true\n   */\n  body?: boolean;\n  /**\n   * Include the parsed query string in log entries. The logged URL keeps its\n   * path either way; with `query: false` its query string is dropped too.\n   *\n   * @default true\n   */\n  query?: boolean;\n};\n\n/** A URL policy that can only remove input from snapshots, even on unmatched requests. */\nexport type PrivateRequestLoggingRule = {\n  /** Path prefix at a segment boundary, or a regular expression over the normalized path. */\n  path: string | RegExp;\n  body?: false;\n  query?: false;\n};\n\n/**\n * `http.logging`: the app-wide defaults for {@link RequestLoggingOptions},\n * plus query parameter names whose values are masked in logged URLs.\n */\nexport type HttpLoggingConfig = RequestLoggingOptions & {\n  /**\n   * Extra query parameter names to mask in logged URLs, on top of the\n   * logger's default secret-key denylist and {@link URL_CREDENTIAL_PARAMS}.\n   * Matched like the logger's keys: case, `-` and `_` are ignored.\n   */\n  redactQueryParams?: string[];\n  /** URL policies applied before route logging; matching rules cannot be overridden by a route. */\n  private?: PrivateRequestLoggingRule[];\n};\n\n/**\n * The bounded, plain-data view of a request that Core puts in log entries in\n * place of the `Request`/`Response` instances, whose native request, reply\n * and socket graphs reach every sink otherwise.\n */\nexport type RequestLogSnapshot = {\n  id: string;\n  method: string;\n  /** Path and query string, with credential-bearing parameter values masked. */\n  url: string;\n  /** The matched route pattern, e.g. `/users/:id`. */\n  route?: string;\n  /** The route name, when it has one. */\n  name?: string;\n  ip?: string;\n  userAgent?: string;\n  query?: Record<string, unknown>;\n  body?: Record<string, unknown>;\n};\n\n/**\n * Query parameters that carry a credential in a URL even though their names\n * are too generic for the logger's key denylist: signed-URL signatures,\n * pre-signed cloud credentials and OAuth authorization codes.\n */\nexport const URL_CREDENTIAL_PARAMS: readonly string[] = [\n  \"signature\",\n  \"sig\",\n  \"code\",\n  \"x-amz-signature\",\n  \"x-amz-credential\",\n  \"x-amz-security-token\",\n  \"x-goog-signature\",\n  \"x-goog-credential\",\n];\n\nconst URL_CREDENTIAL_PARAM_SET: ReadonlySet<string> = new Set(\n  URL_CREDENTIAL_PARAMS.map(normalizeRedactKey),\n);\n\nconst REDACTED = \"[REDACTED]\";\n\n/**\n * Mask the values of credential-bearing query parameters in a URL (absolute,\n * or a path with a query string). A parameter is credential-bearing when its\n * normalized name is in the logger's default secret-key denylist (`secret`,\n * `token`, `apiKey`, …), in {@link URL_CREDENTIAL_PARAMS}, or in `extraParams`.\n *\n * The path and the other parameters are kept as written.\n *\n * @example\n * redactUrlCredentials(\"/hooks?secret=abc&page=2\") // \"/hooks?secret=[REDACTED]&page=2\"\n */\nexport function redactUrlCredentials(url: string, extraParams: readonly string[] = []): string {\n  const queryStart = url.indexOf(\"?\");\n\n  if (queryStart === -1) return url;\n\n  const hashStart = url.indexOf(\"#\", queryStart);\n  const queryEnd = hashStart === -1 ? url.length : hashStart;\n  const isCredential = credentialParamMatcher(extraParams);\n\n  const query = url\n    .slice(queryStart + 1, queryEnd)\n    .split(\"&\")\n    .map((pair) => {\n      const separator = pair.indexOf(\"=\");\n      const rawName = separator === -1 ? pair : pair.slice(0, separator);\n\n      let name = rawName;\n\n      try {\n        name = decodeURIComponent(rawName.replace(/\\+/g, \" \"));\n      } catch {\n        // A malformed escape is logged under its raw name.\n      }\n\n      if (separator !== -1 && isCredential(name)) {\n        return `${rawName}=${REDACTED}`;\n      }\n\n      return pair;\n    })\n    .join(\"&\");\n\n  // A fragment never reaches the server, but a URL handed in by app code may\n  // carry one; it is dropped rather than risk logging a token in it.\n  return `${url.slice(0, queryStart)}?${query}`;\n}\n\n/**\n * A predicate telling whether a query parameter name carries a credential:\n * its normalized name is in the logger's default secret-key denylist, in\n * {@link URL_CREDENTIAL_PARAMS}, or in `extraParams`.\n */\nfunction credentialParamMatcher(extraParams: readonly string[]): (name: string) => boolean {\n  const extra = new Set(extraParams.map(normalizeRedactKey));\n\n  return (name) => {\n    const key = normalizeRedactKey(name);\n\n    return DEFAULT_REDACT_KEY_SET.has(key) || URL_CREDENTIAL_PARAM_SET.has(key) || extra.has(key);\n  };\n}\n\n/**\n * Mask the values of credential-bearing parameters in a parsed query object,\n * with the same names {@link redactUrlCredentials} masks in the URL. Nested\n * objects and arrays (`a[b]=…` parsing) are walked; the input is not mutated.\n *\n * @example\n * redactQueryCredentials({ code: \"abc\", page: \"2\" }) // { code: \"[REDACTED]\", page: \"2\" }\n */\nexport function redactQueryCredentials(\n  query: Record<string, unknown>,\n  extraParams: readonly string[] = [],\n): Record<string, unknown> {\n  return redactQueryObject(query, credentialParamMatcher(extraParams));\n}\n\nfunction redactQueryObject(\n  query: Record<string, unknown>,\n  isCredential: (name: string) => boolean,\n): Record<string, unknown> {\n  const output: Record<string, unknown> = {};\n\n  for (const [name, value] of Object.entries(query)) {\n    output[name] = isCredential(name) ? REDACTED : redactQueryValue(value, isCredential);\n  }\n\n  return output;\n}\n\nfunction redactQueryValue(value: unknown, isCredential: (name: string) => boolean): unknown {\n  if (Array.isArray(value)) return value.map((item) => redactQueryValue(item, isCredential));\n\n  if (\n    value !== null &&\n    typeof value === \"object\" &&\n    Object.getPrototypeOf(value) === Object.prototype\n  ) {\n    return redactQueryObject(value as Record<string, unknown>, isCredential);\n  }\n\n  return value;\n}\n\n/**\n * The effective logging options for a request: `http.logging` overlaid by the\n * route's own `logging` option, then restricted by matching private URL policies.\n */\nexport function resolveRequestLoggingOptions(\n  routeOptions: RequestLoggingOptions | undefined,\n  url?: string,\n  routePath?: string,\n): Required<RequestLoggingOptions> & { redactQueryParams: string[] } {\n  const global = (config.get(\"http.logging\") ?? {}) as HttpLoggingConfig;\n\n  const options = {\n    body: routeOptions?.body ?? global.body ?? true,\n    query: routeOptions?.query ?? global.query ?? true,\n    redactQueryParams: global.redactQueryParams ?? [],\n  };\n  if (!global.private?.length || url === undefined) return options;\n  const candidates = loggingPathCandidates(url);\n  if (candidates === undefined) return { ...options, body: false, query: false };\n  if (routePath) {\n    const routeCandidates = loggingPathCandidates(routePath);\n    if (!routeCandidates) return { ...options, body: false, query: false };\n    candidates.push(...routeCandidates);\n  }\n\n  for (const rule of compiledPrivateRules(global.private)) {\n    let matches: boolean;\n    if (rule.type === \"regex\") {\n      const { regex, needsClone } = rule;\n      matches = candidates.some((candidate) =>\n        (needsClone ? new RegExp(regex.source, regex.flags) : regex).test(candidate),\n      );\n    } else {\n      const { prefixes } = rule;\n      // A malformed configured prefix must never silently disable privacy.\n      matches =\n        prefixes === undefined ||\n        prefixes.some((prefix) =>\n          candidates.some(\n            (candidate) =>\n              prefix === \"/\" || candidate === prefix || candidate.startsWith(`${prefix}/`),\n          ),\n        );\n    }\n    if (!matches) continue;\n    if (rule.body === false) options.body = false;\n    if (rule.query === false) options.query = false;\n  }\n  return options;\n}\n\n/** A private rule with its path matcher prepared once. */\ntype CompiledPrivateRule = Pick<PrivateRequestLoggingRule, \"body\" | \"query\"> &\n  (\n    | { type: \"regex\"; regex: RegExp; needsClone: boolean }\n    // `undefined` prefixes: the configured path does not decode, so it matches every request.\n    | { type: \"prefix\"; prefixes: string[] | undefined }\n  );\n\n/**\n * Compiled rules per configured `http.logging.private` array. Snapshots are\n * built several times per request, so each array's prefixes are normalised\n * once; replacing the array (a new config value) compiles the new one.\n */\nconst compiledRulesCache = new WeakMap<\n  readonly PrivateRequestLoggingRule[],\n  CompiledPrivateRule[]\n>();\n\nfunction compiledPrivateRules(rules: readonly PrivateRequestLoggingRule[]): CompiledPrivateRule[] {\n  let compiled = compiledRulesCache.get(rules);\n  if (compiled) return compiled;\n  compiled = rules.map((rule): CompiledPrivateRule => {\n    const { path, body, query } = rule;\n    if (path instanceof RegExp) {\n      // A global or sticky regex keeps `lastIndex` between tests; use a fresh copy.\n      return { type: \"regex\", regex: path, needsClone: path.global || path.sticky, body, query };\n    }\n    return { type: \"prefix\", prefixes: loggingPathCandidates(path), body, query };\n  });\n  compiledRulesCache.set(rules, compiled);\n  return compiled;\n}\n\n/** Backslashes to slashes, repeated slashes collapsed, no trailing slash. */\nfunction collapseLoggingPath(path: string): string {\n  return path.replace(/\\\\/g, \"/\").replace(/\\/+/g, \"/\").replace(/\\/$/, \"\") || \"/\";\n}\n\nfunction loggingPathCandidates(url: string): string[] | undefined {\n  try {\n    // Preserve raw dot segments in absolute-form requests; URL() would erase them.\n    const pathname = url.replace(/^[a-z][a-z\\d+.-]*:\\/\\/[^/?#]*/i, \"\").split(/[?#]/u)[0] || \"/\";\n    const raw = collapseLoggingPath(pathname);\n    const decoded = collapseLoggingPath(decodeURIComponent(pathname));\n    const segments: string[] = [];\n    for (const segment of decoded.split(\"/\")) {\n      if (segment === \"..\") segments.pop();\n      else if (segment && segment !== \".\") segments.push(segment);\n    }\n    return [...new Set([raw, decoded, `/${segments.join(\"/\")}`])];\n  } catch {\n    // With a private-path policy, undecodable input is withheld rather than guessed.\n    return undefined;\n  }\n}\n\n/**\n * The fields of a request the snapshot reads. Structural, so the snapshot can\n * be built (and tested) without a live Fastify request.\n */\nexport type RequestLogSource = {\n  id: string;\n  method: string;\n  url: string;\n  ip?: string;\n  userAgent?: string;\n  query?: Record<string, unknown>;\n  body?: Record<string, unknown>;\n  route?: { path?: string; name?: string; logging?: RequestLoggingOptions };\n};\n\n/**\n * Build the {@link RequestLogSnapshot} for a request, applying the route's\n * logging policy BEFORE anything reaches a log entry: an omitted body or\n * query is never copied, so no sink, channel or redaction setting can expose it.\n * Credential-bearing query parameters are masked in both `url` and `query`.\n *\n * Uploaded files are summarised (`{ file, mimeType }`) rather than walked.\n */\nexport function buildRequestLogSnapshot(source: RequestLogSource): RequestLogSnapshot {\n  const options = resolveRequestLoggingOptions(\n    source.route?.logging,\n    source.url,\n    source.route?.path,\n  );\n  const url = options.query ? source.url : stripQuery(source.url);\n\n  const snapshot: RequestLogSnapshot = {\n    id: source.id,\n    method: source.method,\n    url: redactUrlCredentials(url ?? \"\", options.redactQueryParams),\n  };\n\n  if (source.route?.path) snapshot.route = source.route.path;\n  if (source.route?.name) snapshot.name = source.route.name;\n  if (source.ip) snapshot.ip = source.ip;\n  if (source.userAgent) snapshot.userAgent = source.userAgent;\n\n  if (options.query && source.query && Object.keys(source.query).length > 0) {\n    snapshot.query = redactQueryCredentials(source.query, options.redactQueryParams);\n  }\n\n  if (options.body && source.body && Object.keys(source.body).length > 0) {\n    snapshot.body = summariseFiles(source.body);\n  }\n\n  return snapshot;\n}\n\nfunction stripQuery(url: string | undefined): string | undefined {\n  if (!url) return url;\n\n  const queryStart = url.indexOf(\"?\");\n\n  return queryStart === -1 ? url : url.slice(0, queryStart);\n}\n\nfunction summariseFiles(body: Record<string, unknown>): Record<string, unknown> {\n  const output: Record<string, unknown> = {};\n\n  for (const [key, value] of Object.entries(body)) {\n    output[key] = Array.isArray(value) ? value.map(summariseFile) : summariseFile(value);\n  }\n\n  return output;\n}\n\nfunction summariseFile(value: unknown): unknown {\n  if (!(value instanceof UploadedFile)) return value;\n\n  return { file: value.name, mimeType: value.mimeType };\n}\n"],"mappings":";;;;;;;;;;AAmFA,MAAa,wBAA2C;CACtD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,2BAAgD,IAAI,IACxD,sBAAsB,IAAI,kBAAkB,CAC9C;AAEA,MAAM,WAAW;;;;;;;;;;;;AAajB,SAAgB,qBAAqB,KAAa,cAAiC,CAAC,GAAW;CAC7F,MAAM,aAAa,IAAI,QAAQ,GAAG;CAElC,IAAI,eAAe,IAAI,OAAO;CAE9B,MAAM,YAAY,IAAI,QAAQ,KAAK,UAAU;CAC7C,MAAM,WAAW,cAAc,KAAK,IAAI,SAAS;CACjD,MAAM,eAAe,uBAAuB,WAAW;CAEvD,MAAM,QAAQ,IACX,MAAM,aAAa,GAAG,QAAQ,CAAC,CAC/B,MAAM,GAAG,CAAC,CACV,KAAK,SAAS;EACb,MAAM,YAAY,KAAK,QAAQ,GAAG;EAClC,MAAM,UAAU,cAAc,KAAK,OAAO,KAAK,MAAM,GAAG,SAAS;EAEjE,IAAI,OAAO;EAEX,IAAI;GACF,OAAO,mBAAmB,QAAQ,QAAQ,OAAO,GAAG,CAAC;EACvD,QAAQ,CAER;EAEA,IAAI,cAAc,MAAM,aAAa,IAAI,GACvC,OAAO,GAAG,QAAQ,GAAG;EAGvB,OAAO;CACT,CAAC,CAAC,CACD,KAAK,GAAG;CAIX,OAAO,GAAG,IAAI,MAAM,GAAG,UAAU,EAAE,GAAG;AACxC;;;;;;AAOA,SAAS,uBAAuB,aAA2D;CACzF,MAAM,QAAQ,IAAI,IAAI,YAAY,IAAI,kBAAkB,CAAC;CAEzD,QAAQ,SAAS;EACf,MAAM,MAAM,mBAAmB,IAAI;EAEnC,OAAO,uBAAuB,IAAI,GAAG,KAAK,yBAAyB,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG;CAC9F;AACF;;;;;;;;;AAUA,SAAgB,uBACd,OACA,cAAiC,CAAC,GACT;CACzB,OAAO,kBAAkB,OAAO,uBAAuB,WAAW,CAAC;AACrE;AAEA,SAAS,kBACP,OACA,cACyB;CACzB,MAAM,SAAkC,CAAC;CAEzC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAC9C,OAAO,QAAQ,aAAa,IAAI,IAAI,WAAW,iBAAiB,OAAO,YAAY;CAGrF,OAAO;AACT;AAEA,SAAS,iBAAiB,OAAgB,cAAkD;CAC1F,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,KAAK,SAAS,iBAAiB,MAAM,YAAY,CAAC;CAEzF,IACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,eAAe,KAAK,MAAM,OAAO,WAExC,OAAO,kBAAkB,OAAkC,YAAY;CAGzE,OAAO;AACT;;;;;AAMA,SAAgB,6BACd,cACA,KACA,WACmE;CACnE,MAAM,SAAUA,WAAO,IAAI,cAAc,KAAK,CAAC;CAE/C,MAAM,UAAU;EACd,MAAM,cAAc,QAAQ,OAAO,QAAQ;EAC3C,OAAO,cAAc,SAAS,OAAO,SAAS;EAC9C,mBAAmB,OAAO,qBAAqB,CAAC;CAClD;CACA,IAAI,CAAC,OAAO,SAAS,UAAU,QAAQ,QAAW,OAAO;CACzD,MAAM,aAAa,sBAAsB,GAAG;CAC5C,IAAI,eAAe,QAAW,OAAO;EAAE,GAAG;EAAS,MAAM;EAAO,OAAO;CAAM;CAC7E,IAAI,WAAW;EACb,MAAM,kBAAkB,sBAAsB,SAAS;EACvD,IAAI,CAAC,iBAAiB,OAAO;GAAE,GAAG;GAAS,MAAM;GAAO,OAAO;EAAM;EACrE,WAAW,KAAK,GAAG,eAAe;CACpC;CAEA,KAAK,MAAM,QAAQ,qBAAqB,OAAO,OAAO,GAAG;EACvD,IAAI;EACJ,IAAI,KAAK,SAAS,SAAS;GACzB,MAAM,EAAE,OAAO,eAAe;GAC9B,UAAU,WAAW,MAAM,eACxB,aAAa,IAAI,OAAO,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAK,CAAE,KAAK,SAAS,CAC7E;EACF,OAAO;GACL,MAAM,EAAE,aAAa;GAErB,UACE,aAAa,UACb,SAAS,MAAM,WACb,WAAW,MACR,cACC,WAAW,OAAO,cAAc,UAAU,UAAU,WAAW,GAAG,OAAO,EAAE,CAC/E,CACF;EACJ;EACA,IAAI,CAAC,SAAS;EACd,IAAI,KAAK,SAAS,OAAO,QAAQ,OAAO;EACxC,IAAI,KAAK,UAAU,OAAO,QAAQ,QAAQ;CAC5C;CACA,OAAO;AACT;;;;;;AAeA,MAAM,qCAAqB,IAAI,QAG7B;AAEF,SAAS,qBAAqB,OAAoE;CAChG,IAAI,WAAW,mBAAmB,IAAI,KAAK;CAC3C,IAAI,UAAU,OAAO;CACrB,WAAW,MAAM,KAAK,SAA8B;EAClD,MAAM,EAAE,MAAM,MAAM,UAAU;EAC9B,IAAI,gBAAgB,QAElB,OAAO;GAAE,MAAM;GAAS,OAAO;GAAM,YAAY,KAAK,UAAU,KAAK;GAAQ;GAAM;EAAM;EAE3F,OAAO;GAAE,MAAM;GAAU,UAAU,sBAAsB,IAAI;GAAG;GAAM;EAAM;CAC9E,CAAC;CACD,mBAAmB,IAAI,OAAO,QAAQ;CACtC,OAAO;AACT;;AAGA,SAAS,oBAAoB,MAAsB;CACjD,OAAO,KAAK,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,QAAQ,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE,KAAK;AAC7E;AAEA,SAAS,sBAAsB,KAAmC;CAChE,IAAI;EAEF,MAAM,WAAW,IAAI,QAAQ,kCAAkC,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,MAAM;EACxF,MAAM,MAAM,oBAAoB,QAAQ;EACxC,MAAM,UAAU,oBAAoB,mBAAmB,QAAQ,CAAC;EAChE,MAAM,WAAqB,CAAC;EAC5B,KAAK,MAAM,WAAW,QAAQ,MAAM,GAAG,GACrC,IAAI,YAAY,MAAM,SAAS,IAAI;OAC9B,IAAI,WAAW,YAAY,KAAK,SAAS,KAAK,OAAO;EAE5D,OAAO,CAAC,mBAAG,IAAI,IAAI;GAAC;GAAK;GAAS,IAAI,SAAS,KAAK,GAAG;EAAG,CAAC,CAAC;CAC9D,QAAQ;EAEN;CACF;AACF;;;;;;;;;AAyBA,SAAgB,wBAAwB,QAA8C;CACpF,MAAM,UAAU,6BACd,OAAO,OAAO,SACd,OAAO,KACP,OAAO,OAAO,IAChB;CACA,MAAM,MAAM,QAAQ,QAAQ,OAAO,MAAM,WAAW,OAAO,GAAG;CAE9D,MAAM,WAA+B;EACnC,IAAI,OAAO;EACX,QAAQ,OAAO;EACf,KAAK,qBAAqB,OAAO,IAAI,QAAQ,iBAAiB;CAChE;CAEA,IAAI,OAAO,OAAO,MAAM,SAAS,QAAQ,OAAO,MAAM;CACtD,IAAI,OAAO,OAAO,MAAM,SAAS,OAAO,OAAO,MAAM;CACrD,IAAI,OAAO,IAAI,SAAS,KAAK,OAAO;CACpC,IAAI,OAAO,WAAW,SAAS,YAAY,OAAO;CAElD,IAAI,QAAQ,SAAS,OAAO,SAAS,OAAO,KAAK,OAAO,KAAK,CAAC,CAAC,SAAS,GACtE,SAAS,QAAQ,uBAAuB,OAAO,OAAO,QAAQ,iBAAiB;CAGjF,IAAI,QAAQ,QAAQ,OAAO,QAAQ,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,SAAS,GACnE,SAAS,OAAO,eAAe,OAAO,IAAI;CAG5C,OAAO;AACT;AAEA,SAAS,WAAW,KAA6C;CAC/D,IAAI,CAAC,KAAK,OAAO;CAEjB,MAAM,aAAa,IAAI,QAAQ,GAAG;CAElC,OAAO,eAAe,KAAK,MAAM,IAAI,MAAM,GAAG,UAAU;AAC1D;AAEA,SAAS,eAAe,MAAwD;CAC9E,MAAM,SAAkC,CAAC;CAEzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAC5C,OAAO,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,aAAa,IAAI,cAAc,KAAK;CAGrF,OAAO;AACT;AAEA,SAAS,cAAc,OAAyB;CAC9C,IAAI,EAAE,iBAAiB,eAAe,OAAO;CAE7C,OAAO;EAAE,MAAM,MAAM;EAAM,UAAU,MAAM;CAAS;AACtD"}

package/esm/http/request.d.mts

@@ -3,17 +3,18 @@ import { Response } from "./response.mjs";
 import { UploadedFile } from "./uploaded-file.mjs";
 import { DecodedAccessToken, RequestEvent, RequestLocals } from "./types.mjs";
 import { Middleware, RequestHandler, Route } from "../router/types.mjs";
+import "../router/index.mjs";
+import "../index.mjs";
 import { BaseValidator } from "@warlock.js/seal";
 import { LogLevel } from "@warlock.js/logger";
 import { FastifyRequest } from "fastify";
 import { IncomingHttpHeaders } from "node:http2";
-
 //#region ../../packages/core/src/http/request.d.ts
-type StandardHeaders = { [K in keyof IncomingHttpHeaders as string extends K ? never : number extends K ? never : K]: IncomingHttpHeaders[K] };
+type StandardHeaders = { [K in keyof IncomingHttpHeaders as string extends K ? never : number extends K ? never : K]: IncomingHttpHeaders[K]; };
 type HeaderKeys = keyof StandardHeaders;
 /** A request-bound translator: keyword in, translated string out. */
-type RequestTranslator = (keyword: string, placeholders?: Record<string, unknown>) => string;
-declare class Request<RequestValidation = any> {
+export type RequestTranslator = (keyword: string, placeholders?: Record<string, unknown>) => string;
+export declare class Request<RequestValidation = any> {
   /**
    * Underlying Fastify request — a public escape hatch to capabilities the
    * framework's high-level helpers don't yet cover.
@@ -424,14 +425,14 @@ declare class Request<RequestValidation = any> {
    * @internal Framework orchestration — do not call from app code. Wired
    * from the Fastify route handler in `router.scan()`.
    */
-  execute(): Promise<any[] | Response | Record<string, any>>;
+  execute(): Promise<any[] | Record<string, any> | Response>;
   /**
    * Iterate the collected middlewares in order; return the first short-circuit
    * value or `undefined` when every middleware passes through.
    *
    * @internal Framework orchestration — do not call from app code.
    */
-  protected executeMiddleware(): Promise<any[] | Response | Record<string, any> | undefined>;
+  protected executeMiddleware(): Promise<any[] | Record<string, any> | Response | undefined>;
   /**
    * Gather the middleware list for the current route — today just the
    * route-level array; future extraction may merge group + app-wide layers.
@@ -633,5 +634,5 @@ declare class Request<RequestValidation = any> {
   setHeader(key: HeaderKeys, value: string): this;
 }
 //#endregion
-export { Request, RequestTranslator };
+export {};
 //# sourceMappingURL=request.d.mts.map

package/esm/http/request.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/request.ts"],"mappings":";;;;;;;;;;;KAkCK,eAAA,iBAIU,mBAAA,mBAAsC,CAAA,0BAA2B,CAAA,WAAY,CAAA,GACvF,mBAAA,CAAoB,CAAA;AAAA,KAGpB,UAAA,SAAmB,eAAe;;KAG3B,iBAAA,IAAqB,OAAA,UAAiB,YAAA,GAAe,MAAM;AAAA,cAE1D,OAAA;EATwC;;;;;;;;;;;;;;;AAC3B;EAyBjB,WAAA,EAAc,cAAA;EAtBR;;;EA2BN,QAAA,EAAW,QAAA;EAxBR;;;EA6BH,KAAA,EAAQ,KAAA;EA7BgB;;;;EAAA,QAmCvB,oBAAA;EAjCG;;;;;;;;;;;;;;;;;;;EAAA,IAsDA,MAAA,IAAU,WAAA;EA4XC;;;EAAA,UAzVZ,OAAA;EAkwBsB;;;EAAA,QA7vBxB,mBAAA;EA02BS;;;;;;;EAAA,IAj2BN,kBAAA,IAAsB,kBAAA;EAAA,IAItB,kBAAA,CAAmB,KAAA,EAAO,kBAAA;EAo4BjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAn2Bb,MAAA,EAAQ,aAAA;EAML;;;;EAAA,UAAA,MAAA;EAyCI;;;;;;;;;;;;;;;;;;;;;;EAAA,IAjBH,KAAA;EAgKW;;;EAAA,OArJR,OAAA,EAAS,OAAA;EA4ML;;;;EAtMX,KAAA,EAAO,iBAAA;EA+NH;;;EA1NJ,CAAA,EAAG,iBAAA;EAiOuC;;;EAAA,UAlNvC,OAAA;EAyNI;;;EAAA,UApNJ,aAAA,GAAgB,iBAAA;EAqNxB;;;EAhNK,EAAA;EAoOC;;;;;EA7ND,OAAA;EA8PI;;;EAzPJ,SAAA;EAkSI;;;EA7RJ,OAAA;EAkVG;;;EA7UH,UAAA,CAAW,OAAA,EAAS,cAAA;EAwWjB;;;;;;;;;EAAA,UA3UA,gBAAA;EA+hBW;;;;;;;EAAA,UArgBX,cAAA;EA8iBH;;;;;EAAA,iBAliBU,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EAyiBxC;;;EA7hBJ,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EAujB9B;;;;;;;;EAAA,UA3iBd,WAAA,CAAY,SAAA;EA8nBL;;;;EAAA,UA1mBP,aAAA;EAknBmC;;;EAAA,IAxlBlC,MAAA;EAqmBkC;;;EAAA,IA5lBlC,MAAA,CAAO,UAAA;EA8mBL;;;EAvmBN,aAAA,CAAc,UAAA;EA2nBL;;;;;EAhnBT,aAAA,CAAc,wBAAA;EA6sBd;;;EAAA,IAtsBI,QAAA;EA6sBE;;;EAtsBA,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA,4BAAA,qBAAA;EA6sBlD;;;EAtsBjB,MAAA,gCAAsC,UAAA,EAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EAktBS;;;EAAA,IA1sBA,OAAA,IAAW,MAAA;EAmtBS;;;;;;;EAAA,QAxsBvB,wBAAA;EA+vBD;;;EAtvBA,MAAA,CAAO,IAAA,UAAc,YAAA;EAgwBf;;;EAjvBN,SAAA,CAAU,IAAA;EAswBD;;;EAAA,IA7vBL,MAAA;EA8wBK;;;EAAA,IAvwBL,QAAA;EAiyBJ;;;EAAA,IA1xBI,MAAA;EAu0BJ;;;EAAA,IAh0BI,YAAA;EAk1BJ;;;EAAA,IA9zBI,kBAAA;EAm1BA;;;;;EAAA,IAl0BA,WAAA;EA61BJ;;;EAAA,IA90BI,aAAA;EAu1BG;;;EAAA,IAh1BH,MAAA;EAw6BA;;;EAqBA;;;;;;;EAAA,UA/6BD,gBAAA,CAAiB,GAAA;EA67BoB;AAAA;;;;EAAA,UAp7BrC,gBAAA,CAAiB,GAAA;;;;;;;;;;YAkBjB,aAAA,CAAc,KAAA,OAAY,UAAA,WAAqB,KAAA,GAAQ,KAAA;EAAA,UAMvD,YAAA;;;;;YAmBA,UAAA;;;;YASA,SAAA,CAAU,IAAA;;;;YAkLV,UAAA,CAAW,IAAA;;;;EAsBd,QAAA,CAAS,KAAA,EAAO,KAAA;;;;EAYhB,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;;;;EAOpC,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA,iCAAa,iBAAA;;;;EAOzC,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;;;;;;;;;;;;;EA0BzB,aAAA,IAAiB,kBAAA;;;;MAkBb,IAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;;;;;;EAYE,aAAA,IAAa,OAAA,CAAA,QAAA;;;;;;EAuCnB,UAAA,IAAU,cAAA,CAAA,OAAA;;;;;EAQV,SAAA,UAAmB,iBAAA,EAAmB,MAAA,UAAgB,MAAA,sBAA4B,MAAA;;;;EAalF,eAAA,IAAmB,MAAA,aAAmB,iBAAA;;;;EAOtC,gBAAA,CAAiB,IAAA,EAAM,iBAAA;;;;;;;;EAWjB,OAAA,IAAO,OAAA,SAAA,QAAA,GAAA,MAAA;;;;;;;YAoBJ,iBAAA,IAAiB,OAAA,SAAA,QAAA,GAAA,MAAA;;;;;;;YA4DvB,kBAAA,IAAsB,UAAA;;;;EAiCzB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,IAAS,IAAA;;;;MASL,IAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA;;;;;;;;;;;EAcJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MAUlB,KAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA;;;;EAOA,eAAA;;;;EAUA,iBAAA;;;;EAmBA,KAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCJ,QAAA;;;;MAoCI,MAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;MAOA,SAAA;;;;MAOA,OAAA,gBAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}
+{"version":3,"file":"request.d.mts","names":["_$_warlock_js_core0.RequestHandler"],"sources":["../../../../../../../../packages/core/src/http/request.ts"],"mappings":";;;;;;;;;;;;KAkCK,qBAID,WAAW,sCAAsC,2BAA2B,YAAY,IACvF,oBAAoB;KAGpB,mBAAmB;;YAGZ,qBAAqB,iBAAiB,eAAe;qBAEpD,QAAQ;;;;;;;;;;;;;;;;;EAiBZ,aAAc;;;;EAKd,UAAW;;;;EAKX,OAAQ;;;;;UAMP;;;;;;;;;;;;;;;;;;;;MAqBG,UAAU;;;;YAmCX;;;;UAKF;;;;;;;;MASG,sBAAsB;MAItB,mBAAmB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiC9B,QAAQ;;;;;YAML;;;;;;;;;;;;;;;;;;;;;;;MAwBC;;;;SAWG,SAAS;;;;;EAMhB,OAAO;;;;EAKP,GAAG;;;;YAeA;;;;YAKA,gBAAgB;;;;EAKnB;;;;;;EAOA;;;;EAKA;;;;EAKA;;;;EAKA,WAAW,SAAS;;;;;;;;;;YA6BjB;;;;;;;;YA0BA;;;;;;mBAYO,iBAAiB,iBAAiB;;;;EAY5C,UAAU,oBAAoB,iBAAiB;;;;;;;;;YAY5C,YAAY;;;;;YAoBZ;;;;MA0BC;;;;MASA,OAAO;;;;EAOX,cAAc;;;;;;EAWd,cAAc;;;;MAOV;;;;EAOE,SAAS,YAAY,eAAe,4BAAyB,mCAAA;;;;EAOnE,OAAO,+BAA+B,YAC3C,MAAM,gBAAgB,YACtB;;;;MAQS,WAAW;;;;;;;;UAWd;;;;EASD,OAAO,cAAc;;;;EAerB,UAAU;;;;MASN;;;;MAOA;;;;MAOA;;;;MAOA;;;;MAoBA;;;;;;MAiBA;;;;MAeA;;;;MAOA;;;;;;;;;;;YAcD,iBAAiB;;;;;;YASjB,iBAAiB;;;;;;;;;;YAkBjB,cAAc,YAAY,qBAAqB,QAAQ;YAMvD;;;;;YAmBA;;;;YASA,UAAU;;;;YAkLV,WAAW;;;;EAsBd,SAAS,OAAO;;;;EAYhB,QAAQ,WAAW,iBAAiB;;;;EAOpC,GAAG,WAAW,cAAc,yCAAa;;;;EAOzC,IAAI,cAAc,QAAO;;;;;;;;;;;;;EA0BzB,iBAAiB;;;;MAkBb;;;;MAOA;;;;MAOA;;;;;;;;;EAYE,iBAAa,QAAA;;;;;;EAuCnB,cAAUA,eAAA;;;;;EAQV,UAAU,SAAS,mBAAmB,gBAAgB,4BAA4B;;;;EAalF,mBAAmB,mBAAmB;;;;EAOtC,iBAAiB,MAAM;;;;;;;;EAWjB,WAAO,gBAAA,sBAAA;;;;;;;YAoBJ,qBAAiB,gBAAA,sBAAA;;;;;;;YA4DvB,sBAAsB;;;;EAiCzB,MAAM,aAAa;;;;EAOnB,MAAM,cAAuB;;;;EAO7B,IAAI,aAAa;;;;EAOjB,IAAI;;;;EAOJ,IAAI,aAAa;;;;EASjB,WAAW,aAAa;;;;EAWxB,SAAS;;;;MASL;;;;EAOJ,QAAQ,aAAa;;;;MASjB;;;;EAmBJ,KAAK,cAAc;;;;;EAUnB,MAAM,eAAe;;;;MAOjB;;;;;;;;;;;EAcJ,SAAS,aAAa;;;;MAUlB;;;;EAOJ,SAAS,aAAa;;;;EAStB;;;;EAOA;;;;EAUA;;;;EAmBA;;;;EAmBA,KAAK;;;;EAOL,MAAM;;;;EAWN,OAAO;;;;EAOP,KAAK,aAAa;;;;EAqBlB,IAAI,aAAa;;;;MAWb;;;;EAOJ,OAAO,aAAa;;;;EASpB,MAAM,aAAa;;;;EASnB,OAAO,aAAa;;;;;;;;;;MAehB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCJ;;;;MAoCI;;;;MAOA;;;;MAOA;;;;MAOA;;;;MAOA,uBAAuB,YAAY;;;;EAOvC,UAAU,KAAK,YAAY"}

package/esm/http/request.mjs

@@ -438,12 +438,13 @@ var Request = class Request {
 					continue;
 				}
 				if (Array.isArray(value)) set(body, key, value.map(this.parseValue.bind(this)));
-				else if (isArrayKey) if (body[key]) body[key].push(this.parseValue(value));
-				else {
-					body[key] = [this.parseValue(value)];
-					continue;
-				}
-				else set(body, key, this.parseValue(value));
+				else if (isArrayKey) {
+					if (body[key]) body[key].push(this.parseValue(value));
+					else {
+						body[key] = [this.parseValue(value)];
+						continue;
+					}
+				} else set(body, key, this.parseValue(value));
 			}
 			for (const key in arrayOfObjectValues) body[key] = arrayOfObjectValues[key];
 			return body;
@@ -661,7 +662,7 @@ var Request = class Request {
 		const global = [...configured?.all || []];
 		if (matchesRoute(configured?.only)) global.push(...configured?.only?.middleware || []);
 		const excluded = matchesRoute(configured?.except) ? configured?.except?.middleware || [] : [];
-		return [...new Set([...global.filter((middleware) => !excluded.includes(middleware)), ...route.middleware || []])];
+		return [.../* @__PURE__ */ new Set([...global.filter((middleware) => !excluded.includes(middleware)), ...route.middleware || []])];
 	}
 	/**
 	* Get request input value from query string, params or body