@warlock.js/core 5.31.0 → 5.33.0

package/esm/http/build-cors-options.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"build-cors-options.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/build-cors-options.ts"],"sourcesContent":["import type { FastifyCorsOptions } from \"@fastify/cors\";\nimport config from \"@mongez/config\";\n\n/**\n * Framework CORS defaults, applied only where the application has said nothing.\n *\n * `origin: \"*\"` is deliberately NOT paired with `credentials: true` here —\n * browsers reject that combination for credentialed requests, so shipping both\n * would break the legitimate case while appearing permissive.\n */\nconst defaultCorsOptions: FastifyCorsOptions = {\n  origin: \"*\",\n  methods: \"*\",\n};\n\n/**\n * Resolve the CORS options handed to `@fastify/cors`.\n *\n * The application's `http.cors` is spread LAST so a configured allow-list wins.\n * Spreading the framework defaults last instead made `http.cors` unreachable —\n * every app got `origin: \"*\"` no matter what it configured, in every release up\n * to 4.12.0. Keep this order.\n */\nexport function buildCorsOptions(): FastifyCorsOptions {\n  return {\n    ...defaultCorsOptions,\n    ...config.get(\"http.cors\", {}),\n  };\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAM,qBAAyC;CAC7C,QAAQ;CACR,SAAS;AACX;;;;;;;;;AAUA,SAAgB,mBAAuC;CACrD,OAAO;EACL,GAAG;EACH,GAAG,OAAO,IAAI,aAAa,CAAC,CAAC;CAC/B;AACF"}
+{"version":3,"file":"build-cors-options.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/build-cors-options.ts"],"sourcesContent":["import type { FastifyCorsOptions } from \"@fastify/cors\";\nimport config from \"@mongez/config\";\n\n/**\n * Framework CORS defaults, applied only where the application has said nothing.\n *\n * `origin: \"*\"` is deliberately NOT paired with `credentials: true` here —\n * browsers reject that combination for credentialed requests, so shipping both\n * would break the legitimate case while appearing permissive.\n */\nconst defaultCorsOptions: FastifyCorsOptions = {\n  origin: \"*\",\n  methods: \"*\",\n};\n\n/**\n * Resolve the CORS options handed to `@fastify/cors`.\n *\n * The application's `http.cors` is spread LAST so a configured allow-list wins.\n * Spreading the framework defaults last instead made `http.cors` unreachable —\n * every app got `origin: \"*\"` no matter what it configured, in every release up\n * to 4.12.0. Keep this order.\n */\nexport function buildCorsOptions(): FastifyCorsOptions {\n  return {\n    ...defaultCorsOptions,\n    ...config.get(\"http.cors\", {}),\n  };\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAM,qBAAyC;CAC7C,QAAQ;CACR,SAAS;AACX;;;;;;;;;AAUA,SAAgB,mBAAuC;CACrD,OAAO;EACL,GAAG;EACH,GAAGA,WAAO,IAAI,aAAa,CAAC,CAAC;CAC/B;AACF"}

package/esm/http/build-rate-limit-options.d.mts

@@ -1,5 +1,4 @@
 import { RateLimitPluginOptions } from "@fastify/rate-limit";
-
 //#region ../../packages/core/src/http/build-rate-limit-options.d.ts
 /**
  * `@fastify/rate-limit` options that `http.rateLimit` passes straight through.
@@ -8,7 +7,7 @@ declare const passthroughKeys: readonly ["redis", "nameSpace", "keyGenerator", "
 /**
  * Shape of the `http.rateLimit` config.
  */
-type HttpRateLimitConfig = Omit<Pick<RateLimitPluginOptions, (typeof passthroughKeys)[number]>, "ipv6Subnet"> & {
+export type HttpRateLimitConfig = Omit<Pick<RateLimitPluginOptions, (typeof passthroughKeys)[number]>, "ipv6Subnet"> & {
   /**
    * IPv6 subnet size used to group client addresses.
    *
@@ -73,5 +72,5 @@ type HttpRateLimitConfig = Omit<Pick<RateLimitPluginOptions, (typeof passthrough
   store?: "memory" | "cache" | RateLimitPluginOptions["store"];
 };
 //#endregion
-export { HttpRateLimitConfig };
+export {};
 //# sourceMappingURL=build-rate-limit-options.d.mts.map

package/esm/http/build-rate-limit-options.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"build-rate-limit-options.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/build-rate-limit-options.ts"],"mappings":";;;;;AAAkE;cAM5D,eAAA;;;AAeI;KAKE,mBAAA,GAAsB,IAAA,CAChC,IAAA,CAAK,sBAAA,UAAgC,eAAA;EADR;;;;;EAS7B,UAAA,GAAa,sBAAA;EAAA;;;;;EAMb,OAAA;EAdA;;;;;;;;;;;;EA2BA,WAAA;EAqCmD;AAAA;;;;EA/BnD,GAAA;;;;;;EAMA,QAAA;;;;EAIA,UAAA,GAAa,sBAAA;;;;;;;;;;;;;;;;;;;;;EAqBb,KAAA,wBAA6B,sBAAA;AAAA"}
+{"version":3,"file":"build-rate-limit-options.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/build-rate-limit-options.ts"],"mappings":";;;;;cAMM;;;;YAoBM,sBAAsB,KAChC,KAAK,gCAAgC;;;;;;EAQrC,aAAa;;;;;;EAMb;;;;;;;;;;;;;EAaA;;;;;;EAMA;;;;;;EAMA;;;;EAIA,aAAa;;;;;;;;;;;;;;;;;;;;;EAqBb,6BAA6B"}

package/esm/http/build-rate-limit-options.mjs

@@ -29,7 +29,7 @@ function buildRateLimitOptions(config) {
 	if (source.enabled === false) return null;
 	const options = {
 		max: source.max ?? 60,
-		timeWindow: source.timeWindow ?? source.duration ?? 60 * 1e3
+		timeWindow: source.timeWindow ?? source.duration ?? 6e4
 	};
 	for (const key of passthroughKeys) if (source[key] !== void 0) options[key] = source[key];
 	if (source.store === "cache") {

package/esm/http/build-rate-limit-options.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"build-rate-limit-options.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/build-rate-limit-options.ts"],"sourcesContent":["import type { RateLimitPluginOptions } from \"@fastify/rate-limit\";\nimport { CacheRateLimitStore } from \"./rate-limit-cache-store\";\n\n/**\n * `@fastify/rate-limit` options that `http.rateLimit` passes straight through.\n */\nconst passthroughKeys = [\n  \"redis\",\n  \"nameSpace\",\n  \"keyGenerator\",\n  \"ipv6Subnet\",\n  \"skipOnError\",\n  \"allowList\",\n  \"continueExceeding\",\n  \"enableDraftSpec\",\n  \"global\",\n  \"hook\",\n  \"cache\",\n  \"errorResponseBuilder\",\n  \"addHeaders\",\n  \"addHeadersOnExceeding\",\n] as const;\n\n/**\n * Shape of the `http.rateLimit` config.\n */\nexport type HttpRateLimitConfig = Omit<\n  Pick<RateLimitPluginOptions, (typeof passthroughKeys)[number]>,\n  \"ipv6Subnet\"\n> & {\n  /**\n   * IPv6 subnet size used to group client addresses.\n   *\n   * @default 64\n   */\n  ipv6Subnet?: RateLimitPluginOptions[\"ipv6Subnet\"];\n  /**\n   * Set `false` to skip registering the global rate limiter.\n   *\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Count static files against the global limiter: the public folder, every\n   * `router.directory()` mount, `router.file()` routes and the web package's\n   * built assets.\n   *\n   * Off by default, so one page load's asset requests do not spend the\n   * client's quota; pages and API routes stay limited either way. A mount's\n   * own `rateLimit` option (`router.directory(options, { rateLimit })`) wins\n   * over this setting. Built-in health probes follow `http.health.rateLimit`.\n   *\n   * @default false\n   */\n  staticFiles?: boolean;\n  /**\n   * Max requests per time window.\n   *\n   * @default 60\n   */\n  max?: number;\n  /**\n   * Time window in milliseconds. Alias of `timeWindow`.\n   *\n   * @default 60 * 1000\n   */\n  duration?: number;\n  /**\n   * Time window; takes precedence over `duration` when both are set.\n   */\n  timeWindow?: RateLimitPluginOptions[\"timeWindow\"];\n  /**\n   * Where request counts are kept.\n   *\n   * - `\"memory\"` (default): in this process. With N processes behind a load\n   *   balancer every client gets N times `max`.\n   * - `\"cache\"`: in `@warlock.js/cache`, so every process using the same\n   *   shared driver (Redis, database) counts together. Per-route\n   *   `middleware.rateLimit()` follows this setting unless it sets its own\n   *   `store`. Windows are fixed and aligned to the clock. A cache outage\n   *   fails open on both limiters (`skipOnError` defaults to `true` here) and\n   *   is logged at most once a minute. The `null` and `file` cache drivers\n   *   are refused (they cannot count): requests pass and the refusal is\n   *   logged the same way.\n   * - a `@fastify/rate-limit` store class, passed through as is.\n   *\n   * `redis` still works and needs an ioredis client; the `redis` driver of\n   * `@warlock.js/cache` uses node-redis, so share it through `\"cache\"`.\n   *\n   * @default \"memory\"\n   */\n  store?: \"memory\" | \"cache\" | RateLimitPluginOptions[\"store\"];\n};\n\n/**\n * Build the `@fastify/rate-limit` plugin options from `http.rateLimit`.\n * Returns `null` when the limiter is disabled.\n */\nexport function buildRateLimitOptions(\n  config: HttpRateLimitConfig | undefined,\n): RateLimitPluginOptions | null {\n  const source = config ?? {};\n\n  if (source.enabled === false) {\n    return null;\n  }\n\n  const options: Record<string, unknown> = {\n    max: source.max ?? 60,\n    timeWindow: source.timeWindow ?? source.duration ?? 60 * 1000,\n  };\n\n  for (const key of passthroughKeys) {\n    if (source[key] !== undefined) {\n      options[key] = source[key];\n    }\n  }\n\n  if (source.store === \"cache\") {\n    options[\"store\"] = CacheRateLimitStore;\n\n    // `@fastify/rate-limit` defaults to `skipOnError: false`, which turns\n    // every request into a 500 while the cache is down. Fail open instead,\n    // like the per-route middleware; the store logs the outage.\n    if (source.skipOnError === undefined) {\n      options[\"skipOnError\"] = true;\n    }\n  } else if (typeof source.store === \"function\") {\n    options[\"store\"] = source.store;\n  }\n\n  return options as RateLimitPluginOptions;\n}\n"],"mappings":";;;;;;AAMA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AA6EA,SAAgB,sBACd,QAC+B;CAC/B,MAAM,SAAS,UAAU,CAAC;CAE1B,IAAI,OAAO,YAAY,OACrB,OAAO;CAGT,MAAM,UAAmC;EACvC,KAAK,OAAO,OAAO;EACnB,YAAY,OAAO,cAAc,OAAO,YAAY,KAAK;CAC3D;CAEA,KAAK,MAAM,OAAO,iBAChB,IAAI,OAAO,SAAS,QAClB,QAAQ,OAAO,OAAO;CAI1B,IAAI,OAAO,UAAU,SAAS;EAC5B,QAAQ,WAAW;EAKnB,IAAI,OAAO,gBAAgB,QACzB,QAAQ,iBAAiB;CAE7B,OAAO,IAAI,OAAO,OAAO,UAAU,YACjC,QAAQ,WAAW,OAAO;CAG5B,OAAO;AACT"}
+{"version":3,"file":"build-rate-limit-options.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/build-rate-limit-options.ts"],"sourcesContent":["import type { RateLimitPluginOptions } from \"@fastify/rate-limit\";\nimport { CacheRateLimitStore } from \"./rate-limit-cache-store\";\n\n/**\n * `@fastify/rate-limit` options that `http.rateLimit` passes straight through.\n */\nconst passthroughKeys = [\n  \"redis\",\n  \"nameSpace\",\n  \"keyGenerator\",\n  \"ipv6Subnet\",\n  \"skipOnError\",\n  \"allowList\",\n  \"continueExceeding\",\n  \"enableDraftSpec\",\n  \"global\",\n  \"hook\",\n  \"cache\",\n  \"errorResponseBuilder\",\n  \"addHeaders\",\n  \"addHeadersOnExceeding\",\n] as const;\n\n/**\n * Shape of the `http.rateLimit` config.\n */\nexport type HttpRateLimitConfig = Omit<\n  Pick<RateLimitPluginOptions, (typeof passthroughKeys)[number]>,\n  \"ipv6Subnet\"\n> & {\n  /**\n   * IPv6 subnet size used to group client addresses.\n   *\n   * @default 64\n   */\n  ipv6Subnet?: RateLimitPluginOptions[\"ipv6Subnet\"];\n  /**\n   * Set `false` to skip registering the global rate limiter.\n   *\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Count static files against the global limiter: the public folder, every\n   * `router.directory()` mount, `router.file()` routes and the web package's\n   * built assets.\n   *\n   * Off by default, so one page load's asset requests do not spend the\n   * client's quota; pages and API routes stay limited either way. A mount's\n   * own `rateLimit` option (`router.directory(options, { rateLimit })`) wins\n   * over this setting. Built-in health probes follow `http.health.rateLimit`.\n   *\n   * @default false\n   */\n  staticFiles?: boolean;\n  /**\n   * Max requests per time window.\n   *\n   * @default 60\n   */\n  max?: number;\n  /**\n   * Time window in milliseconds. Alias of `timeWindow`.\n   *\n   * @default 60 * 1000\n   */\n  duration?: number;\n  /**\n   * Time window; takes precedence over `duration` when both are set.\n   */\n  timeWindow?: RateLimitPluginOptions[\"timeWindow\"];\n  /**\n   * Where request counts are kept.\n   *\n   * - `\"memory\"` (default): in this process. With N processes behind a load\n   *   balancer every client gets N times `max`.\n   * - `\"cache\"`: in `@warlock.js/cache`, so every process using the same\n   *   shared driver (Redis, database) counts together. Per-route\n   *   `middleware.rateLimit()` follows this setting unless it sets its own\n   *   `store`. Windows are fixed and aligned to the clock. A cache outage\n   *   fails open on both limiters (`skipOnError` defaults to `true` here) and\n   *   is logged at most once a minute. The `null` and `file` cache drivers\n   *   are refused (they cannot count): requests pass and the refusal is\n   *   logged the same way.\n   * - a `@fastify/rate-limit` store class, passed through as is.\n   *\n   * `redis` still works and needs an ioredis client; the `redis` driver of\n   * `@warlock.js/cache` uses node-redis, so share it through `\"cache\"`.\n   *\n   * @default \"memory\"\n   */\n  store?: \"memory\" | \"cache\" | RateLimitPluginOptions[\"store\"];\n};\n\n/**\n * Build the `@fastify/rate-limit` plugin options from `http.rateLimit`.\n * Returns `null` when the limiter is disabled.\n */\nexport function buildRateLimitOptions(\n  config: HttpRateLimitConfig | undefined,\n): RateLimitPluginOptions | null {\n  const source = config ?? {};\n\n  if (source.enabled === false) {\n    return null;\n  }\n\n  const options: Record<string, unknown> = {\n    max: source.max ?? 60,\n    timeWindow: source.timeWindow ?? source.duration ?? 60 * 1000,\n  };\n\n  for (const key of passthroughKeys) {\n    if (source[key] !== undefined) {\n      options[key] = source[key];\n    }\n  }\n\n  if (source.store === \"cache\") {\n    options[\"store\"] = CacheRateLimitStore;\n\n    // `@fastify/rate-limit` defaults to `skipOnError: false`, which turns\n    // every request into a 500 while the cache is down. Fail open instead,\n    // like the per-route middleware; the store logs the outage.\n    if (source.skipOnError === undefined) {\n      options[\"skipOnError\"] = true;\n    }\n  } else if (typeof source.store === \"function\") {\n    options[\"store\"] = source.store;\n  }\n\n  return options as RateLimitPluginOptions;\n}\n"],"mappings":";;;;;;AAMA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AA6EA,SAAgB,sBACd,QAC+B;CAC/B,MAAM,SAAS,UAAU,CAAC;CAE1B,IAAI,OAAO,YAAY,OACrB,OAAO;CAGT,MAAM,UAAmC;EACvC,KAAK,OAAO,OAAO;EACnB,YAAY,OAAO,cAAc,OAAO,YAAY;CACtD;CAEA,KAAK,MAAM,OAAO,iBAChB,IAAI,OAAO,SAAS,QAClB,QAAQ,OAAO,OAAO;CAI1B,IAAI,OAAO,UAAU,SAAS;EAC5B,QAAQ,WAAW;EAKnB,IAAI,OAAO,gBAAgB,QACzB,QAAQ,iBAAiB;CAE7B,OAAO,IAAI,OAAO,OAAO,UAAU,YACjC,QAAQ,WAAW,OAAO;CAG5B,OAAO;AACT"}

package/esm/http/conditional-request.d.mts

@@ -16,7 +16,7 @@
 /**
  * One parsed entity tag. `opaque` keeps its quotes, so `"a"` and `a` differ.
  */
-type EntityTag = {
+export type EntityTag = {
   weak: boolean;
   opaque: string;
 };
@@ -25,37 +25,39 @@ type EntityTag = {
  * opaque tag. A value without quotes is kept as its own opaque tag so an
  * application-supplied unquoted ETag still compares with itself.
  */
-declare function parseEntityTag(value: string): EntityTag | undefined;
+export declare function parseEntityTag(value: string): EntityTag | undefined;
 /**
  * Parse an `If-Match` / `If-None-Match` value: `"*"` or a comma-separated list
  * of entity tags. A comma inside a quoted tag is part of the tag.
  */
-declare function parseEntityTagList(header: unknown): "*" | EntityTag[] | undefined;
+export declare function parseEntityTagList(header: unknown): "*" | EntityTag[] | undefined;
 /**
  * Weak comparison: the opaque tags are identical.
  */
-declare function weakEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
+export declare function weakEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
 /**
  * Strong comparison: neither tag is weak and the opaque tags are identical.
  */
-declare function strongEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
+export declare function strongEntityTagMatch(first: EntityTag, second: EntityTag): boolean;
 /**
  * Whether an `If-None-Match` header matches the current entity tag, with weak
  * comparison. `*` matches any current representation.
  */
-declare function matchesIfNoneMatch(header: unknown, etag: string): boolean;
+export declare function matchesIfNoneMatch(header: unknown, etag: string): boolean;
 /**
  * Whether an `If-Match` header is satisfied by the current entity tag, with
  * strong comparison. `*` is satisfied by any current representation, so it
  * fails only when there is none (`etag` undefined).
  */
-declare function matchesIfMatch(header: unknown, etag: string | undefined): boolean;
+export declare function matchesIfMatch(header: unknown, etag: string | undefined): boolean;
 /**
  * The request headers and current validators a precondition check reads.
  */
-type ConditionalRequestInput = {
-  method: string; /** Current entity tag, quoted, optionally `W/`-prefixed. */
-  etag?: string; /** Current modification time. HTTP dates have second precision. */
+export type ConditionalRequestInput = {
+  method: string;
+  /** Current entity tag, quoted, optionally `W/`-prefixed. */
+  etag?: string;
+  /** Current modification time. HTTP dates have second precision. */
   lastModified?: Date | number;
   ifMatch?: unknown;
   ifNoneMatch?: unknown;
@@ -69,7 +71,7 @@ type ConditionalRequestInput = {
  * - `"not-modified"`: answer a GET or HEAD with 304;
  * - `"precondition-failed"`: answer with 412.
  */
-type ConditionalRequestOutcome = "proceed" | "not-modified" | "precondition-failed";
+export type ConditionalRequestOutcome = "proceed" | "not-modified" | "precondition-failed";
 /**
  * Evaluate the precondition headers in RFC 9110 §13.2.2 order:
  *
@@ -80,7 +82,6 @@ type ConditionalRequestOutcome = "proceed" | "not-modified" | "precondition-fail
  *
  * An invalid date is ignored, as the RFC requires.
  */
-declare function evaluateConditionalRequest(input: ConditionalRequestInput): ConditionalRequestOutcome;
+export declare function evaluateConditionalRequest(input: ConditionalRequestInput): ConditionalRequestOutcome;
 //#endregion
-export { ConditionalRequestInput, ConditionalRequestOutcome, EntityTag, evaluateConditionalRequest, matchesIfMatch, matchesIfNoneMatch, parseEntityTag, parseEntityTagList, strongEntityTagMatch, weakEntityTagMatch };
 //# sourceMappingURL=conditional-request.d.mts.map

package/esm/http/conditional-request.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"conditional-request.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/conditional-request.ts"],"mappings":";;AAkBA;;;;AAEQ;AAQR;;;;AAAwD;AAiBxD;;;;AAAoE;AA+BpE;KA1DY,SAAA;EACV,IAAA;EACA,MAAM;AAAA;;;;;AAwD8D;iBAhDtD,cAAA,CAAe,KAAA,WAAgB,SAAS;;;;;iBAiBxC,kBAAA,CAAmB,MAAA,kBAAwB,SAAS;;;;iBA+BpD,kBAAA,CAAmB,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,SAAS;AAetE;;;AAAA,iBARgB,oBAAA,CAAqB,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,SAAS;AAQR;AAgBhE;;;AAhBgE,iBAAhD,kBAAA,CAAmB,MAAA,WAAiB,IAAY;AAgBQ;AAiBxE;;;;AAjBwE,iBAAxD,cAAA,CAAe,MAAA,WAAiB,IAAwB;;;;KAiB5D,uBAAA;EACV,MAAA,UAOA;EALA,IAAA,WAMiB;EAJjB,YAAA,GAAe,IAAI;EACnB,OAAA;EACA,WAAA;EACA,eAAA;EACA,iBAAA;AAAA;AA0CF;;;;;;;AAAA,KAhCY,yBAAA;AAkCgB;;;;;;;;;;AAAA,iBAFZ,0BAAA,CACd,KAAA,EAAO,uBAAA,GACN,yBAAyB"}
+{"version":3,"file":"conditional-request.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/conditional-request.ts"],"mappings":";;;;;;;;;;;;;;;;;;YAkBY;EACV;EACA;;;;;;;wBAQc,eAAe,gBAAgB;;;;;wBAiB/B,mBAAmB,wBAAwB;;;;wBA+B3C,mBAAmB,OAAO,WAAW,QAAQ;;;;wBAO7C,qBAAqB,OAAO,WAAW,QAAQ;;;;;wBAQ/C,mBAAmB,iBAAiB;;;;;;wBAgBpC,eAAe,iBAAiB;;;;YAiBpC;EACV;;EAEA;;EAEA,eAAe;EACf;EACA;EACA;EACA;;;;;;;;;YAUU;;;;;;;;;;;wBAgCI,2BACd,OAAO,0BACN"}

package/esm/http/config.d.mts

@@ -1,14 +1,12 @@
 import { HttpConfigurations } from "./types.mjs";
-
 //#region ../../packages/core/src/http/config.d.ts
 /**
  * Default http configurations
  */
-declare const defaultHttpConfigurations: HttpConfigurations;
+export declare const defaultHttpConfigurations: HttpConfigurations;
 /**
  * Get http configurations for the given key
  */
-declare function httpConfig(key: string): any;
+export declare function httpConfig(key: string): any;
 //#endregion
-export { defaultHttpConfigurations, httpConfig };
 //# sourceMappingURL=config.d.mts.map

package/esm/http/config.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"mappings":";;;;;AAOA;cAAa,yBAAA,EAA2B,kBAYvC;;;AAAA;iBAKe,UAAA,CAAW,GAAW"}
+{"version":3,"file":"config.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"mappings":";;;;;qBAOa,2BAA2B;;;;wBAiBxB,WAAW"}

package/esm/http/config.mjs

@@ -1,4 +1,4 @@
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { get } from "@mongez/reinforcements";
 
 //#region ../../packages/core/src/http/config.ts
@@ -18,7 +18,7 @@ const defaultHttpConfigurations = {
 * Get http configurations for the given key
 */
 function httpConfig(key) {
-	return config.get(`http.${key}`, get(defaultHttpConfigurations, key));
+	return baseConfig.get(`http.${key}`, get(defaultHttpConfigurations, key));
 }
 
 //#endregion

package/esm/http/config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { get } from \"@mongez/reinforcements\";\nimport type { HttpConfigurations } from \"./types\";\n\n/**\n * Default http configurations\n */\nexport const defaultHttpConfigurations: HttpConfigurations = {\n  port: 3000,\n  host: \"0.0.0.0\",\n  middleware: {\n    all: [],\n    only: {\n      middleware: [],\n    },\n    except: {\n      middleware: [],\n    },\n  },\n};\n\n/**\n * Get http configurations for the given key\n */\nexport function httpConfig(key: string): any {\n  return config.get(`http.${key}`, get(defaultHttpConfigurations, key));\n}\n"],"mappings":";;;;;;;AAOA,MAAa,4BAAgD;CAC3D,MAAM;CACN,MAAM;CACN,YAAY;EACV,KAAK,CAAC;EACN,MAAM,EACJ,YAAY,CAAC,EACf;EACA,QAAQ,EACN,YAAY,CAAC,EACf;CACF;AACF;;;;AAKA,SAAgB,WAAW,KAAkB;CAC3C,OAAO,OAAO,IAAI,QAAQ,OAAO,IAAI,2BAA2B,GAAG,CAAC;AACtE"}
+{"version":3,"file":"config.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/config.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { get } from \"@mongez/reinforcements\";\nimport type { HttpConfigurations } from \"./types\";\n\n/**\n * Default http configurations\n */\nexport const defaultHttpConfigurations: HttpConfigurations = {\n  port: 3000,\n  host: \"0.0.0.0\",\n  middleware: {\n    all: [],\n    only: {\n      middleware: [],\n    },\n    except: {\n      middleware: [],\n    },\n  },\n};\n\n/**\n * Get http configurations for the given key\n */\nexport function httpConfig(key: string): any {\n  return config.get(`http.${key}`, get(defaultHttpConfigurations, key));\n}\n"],"mappings":";;;;;;;AAOA,MAAa,4BAAgD;CAC3D,MAAM;CACN,MAAM;CACN,YAAY;EACV,KAAK,CAAC;EACN,MAAM,EACJ,YAAY,CAAC,EACf;EACA,QAAQ,EACN,YAAY,CAAC,EACf;CACF;AACF;;;;AAKA,SAAgB,WAAW,KAAkB;CAC3C,OAAOA,WAAO,IAAI,QAAQ,OAAO,IAAI,2BAA2B,GAAG,CAAC;AACtE"}

package/esm/http/context/request-context.d.mts

@@ -2,12 +2,11 @@ import { Response } from "../response.mjs";
 import { Request } from "../request.mjs";
 import { Model } from "@warlock.js/cascade";
 import { Context } from "@warlock.js/context";
-
 //#region ../../packages/core/src/http/context/request-context.d.ts
 /**
  * Request Context Store
  */
-type RequestContextStore<User extends Model = Model> = {
+export type RequestContextStore<User extends Model = Model> = {
   request: Request<User>;
   response: Response;
 };
@@ -52,13 +51,13 @@ declare class RequestContext<User extends Model = Model> extends Context<Request
 /**
  * Global request context instance
  */
-declare const requestContext: RequestContext<Model<import("@warlock.js/cascade").ModelSchema>>;
+export declare const requestContext: RequestContext<Model<import("@warlock.js/cascade").ModelSchema>>;
 /**
  * Use request store (for backward compatibility)
  */
-declare function useRequestStore<UserType extends Model = Model>(): RequestContextStore<UserType>;
-declare function useRequest<UserType extends Model = Model>(): Request<UserType>;
-declare function useCurrentUser<UserType extends Model = Model>(): UserType;
+export declare function useRequestStore<UserType extends Model = Model>(): RequestContextStore<UserType>;
+export declare function useRequest<UserType extends Model = Model>(): Request<UserType>;
+export declare function useCurrentUser<UserType extends Model = Model>(): UserType;
 //#endregion
-export { RequestContextStore, requestContext, useCurrentUser, useRequest, useRequestStore };
+export {};
 //# sourceMappingURL=request-context.d.mts.map

package/esm/http/context/request-context.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-context.ts"],"mappings":";;;;;;;;AAQA;KAAY,mBAAA,cAAiC,KAAA,GAAQ,KAAA;EACnD,OAAA,EAAS,OAAA,CAAQ,IAAA;EACjB,QAAA,EAAU,QAAA;AAAA;;;;;;;cASN,cAAA,cAA4B,KAAA,GAAQ,KAAA,UAAe,OAAA,CAAQ,mBAAA,CAAoB,IAAA;EAXhC;;;EAe5C,UAAA,IAAc,OAAA,CAAQ,IAAA;EAb7B;;;EAoBO,WAAA,IAAe,QAAA;EAXlB;;;;;;;;;;;;;;;;;EAgCG,OAAA;EAhCiC;;;EAyCjC,UAAA,CAAW,OAAA,GAAU,MAAA,gBAAsB,mBAAA,CAAoB,IAAA;AAAA;;;;cAW3D,cAAA,EAAc,cAAA,CAAA,KAAA,+BAAA,WAAA;;;;iBAOX,eAAA,kBAAiC,KAAA,GAAQ,KAAA,KACX,mBAAA,CAAoB,QAAA;AAAA,iBAGlD,UAAA,kBAA4B,KAAA,GAAQ,KAAA,KACZ,OAAA,CAAQ,QAAA;AAAA,iBAGhC,cAAA,kBAAgC,KAAA,GAAQ,KAAA,KAOnB,QAAA"}
+{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-context.ts"],"mappings":";;;;;;;;YAQY,oBAAoB,aAAa,QAAQ;EACnD,SAAS,QAAQ;EACjB,UAAU;;;;;;;;cASN,eAAe,aAAa,QAAQ,eAAe,QAAQ,oBAAoB;;;;EAI5E,cAAc,QAAQ;;;;EAOtB,eAAe;;;;;;;;;;;;;;;;;;EAqBf;;;;EASA,WAAW,UAAU,sBAAsB,oBAAoB;;;;;qBAW3D,gBAAc,eAAA,oCAAA;;;;wBAOX,gBAAgB,iBAAiB,QAAQ,UACX,oBAAoB;wBAGlD,WAAW,iBAAiB,QAAQ,UACZ,QAAQ;wBAGhC,eAAe,iBAAiB,QAAQ,UAOnB"}

package/esm/http/context/request-memo.d.mts

@@ -15,7 +15,6 @@
  * leak this helper exists to prevent — so calling it outside a request
  * context throws instead of silently memoizing across requests.
  */
-declare function requestMemo<T>(key: string, fn: () => Promise<T>): Promise<T>;
+export declare function requestMemo<T>(key: string, fn: () => Promise<T>): Promise<T>;
 //#endregion
-export { requestMemo };
 //# sourceMappingURL=request-memo.d.mts.map

package/esm/http/context/request-memo.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-memo.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-memo.ts"],"mappings":";;AA2BA;;;;;;;;;;;;;;;iBAAgB,WAAA,IAAe,GAAA,UAAa,EAAA,QAAU,OAAA,CAAQ,CAAA,IAAK,OAAA,CAAQ,CAAA"}
+{"version":3,"file":"request-memo.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/context/request-memo.ts"],"mappings":";;;;;;;;;;;;;;;;;wBA2BgB,YAAY,GAAG,aAAa,UAAU,QAAQ,KAAK,QAAQ"}

package/esm/http/createHttpApplication.d.mts

@@ -1,6 +1,5 @@
 //#region ../../packages/core/src/http/createHttpApplication.d.ts
-declare function createHttpApplication(): Promise<void>;
-declare function stopHttpApplication(): Promise<void>;
+export declare function createHttpApplication(): Promise<void>;
+export declare function stopHttpApplication(): Promise<void>;
 //#endregion
-export { createHttpApplication, stopHttpApplication };
 //# sourceMappingURL=createHttpApplication.d.mts.map

package/esm/http/createHttpApplication.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"createHttpApplication.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"mappings":";iBASsB,qBAAA,IAAqB,OAAA;AAAA,iBAmCrB,mBAAA,IAAmB,OAAA"}
+{"version":3,"file":"createHttpApplication.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"mappings":";wBASsB,yBAAqB;wBAmCrB,uBAAmB"}

package/esm/http/createHttpApplication.mjs

@@ -5,7 +5,7 @@ import { router } from "../router/router.mjs";
 import "../router/index.mjs";
 import { registerHttpPlugins } from "./plugins.mjs";
 import { getHttpServer, startHttpServer } from "./server.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { log } from "@warlock.js/logger";
 
 //#region ../../packages/core/src/http/createHttpApplication.ts
@@ -21,7 +21,7 @@ async function createHttpApplication() {
 			port,
 			host: httpConfig("host")
 		});
-		const baseUrl = config.get("app.baseUrl");
+		const baseUrl = baseConfig.get("app.baseUrl");
 		setBaseUrl(baseUrl);
 		log.success("http", "server", `Server is listening on ${baseUrl}`);
 	} catch (error) {

package/esm/http/createHttpApplication.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createHttpApplication.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { validateCspConfigAtBoot } from \"./csp\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  // Fail loudly, before the server ever binds a port, when `http.csp` is\n  // enabled with a malformed directive — never silently repair it and never\n  // wait for the first request to discover it.\n  validateCspConfigAtBoot();\n\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,wBAAwB;CAI5C,wBAAwB;CAExB,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAU,OAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}
+{"version":3,"file":"createHttpApplication.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/createHttpApplication.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { router } from \"../router\";\nimport { setBaseUrl } from \"../utils/urls\";\nimport { httpConfig } from \"./config\";\nimport { validateCspConfigAtBoot } from \"./csp\";\nimport { registerHttpPlugins } from \"./plugins\";\nimport { getHttpServer, startHttpServer } from \"./server\";\n\nexport async function createHttpApplication() {\n  // Fail loudly, before the server ever binds a port, when `http.csp` is\n  // enabled with a malformed directive — never silently repair it and never\n  // wait for the first request to discover it.\n  validateCspConfigAtBoot();\n\n  const server = startHttpServer();\n\n  await registerHttpPlugins(server);\n\n  router.scan(server);\n\n  const port = httpConfig(\"port\");\n\n  try {\n    log.info(\"http\", \"server\", \"Connecting to the server\");\n    // 👇🏻 We can use the url of the server\n    await server.listen({\n      port,\n      host: httpConfig(\"host\"),\n    });\n\n    const baseUrl = config.get(\"app.baseUrl\");\n\n    // update base url\n    setBaseUrl(baseUrl);\n\n    log.success(\"http\", \"server\", `Server is listening on ${baseUrl}`);\n  } catch (error) {\n    log.error(\"http\", \"server\", error);\n\n    process.exit(1); // stop the process, exit with error\n  }\n}\n\nexport async function stopHttpApplication() {\n  log.info(\"http\", \"server\", \"Stopping the server\");\n  const server = getHttpServer();\n\n  await server?.close();\n\n  log.success(\"http\", \"server\", \"Server is stopped\");\n}\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,wBAAwB;CAI5C,wBAAwB;CAExB,MAAM,SAAS,gBAAgB;CAE/B,MAAM,oBAAoB,MAAM;CAEhC,OAAO,KAAK,MAAM;CAElB,MAAM,OAAO,WAAW,MAAM;CAE9B,IAAI;EACF,IAAI,KAAK,QAAQ,UAAU,0BAA0B;EAErD,MAAM,OAAO,OAAO;GAClB;GACA,MAAM,WAAW,MAAM;EACzB,CAAC;EAED,MAAM,UAAUA,WAAO,IAAI,aAAa;EAGxC,WAAW,OAAO;EAElB,IAAI,QAAQ,QAAQ,UAAU,0BAA0B,SAAS;CACnE,SAAS,OAAO;EACd,IAAI,MAAM,QAAQ,UAAU,KAAK;EAEjC,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAsB,sBAAsB;CAC1C,IAAI,KAAK,QAAQ,UAAU,qBAAqB;CAGhD,MAFe,cAEJ,CAAC,EAAE,MAAM;CAEpB,IAAI,QAAQ,QAAQ,UAAU,mBAAmB;AACnD"}

package/esm/http/csp.d.mts

@@ -1,6 +1,5 @@
 import { Response } from "./response.mjs";
 import { Request } from "./request.mjs";
-
 //#region ../../packages/core/src/http/csp.d.ts
 /**
  * App-facing `http.csp` configuration shape.
@@ -22,7 +21,7 @@ import { Request } from "./request.mjs";
  * };
  * ```
  */
-type CspConfig = {
+export type CspConfig = {
   /**
    * Turn the header on. Everything else in this type is inert while this is
    * `false`/unset.
@@ -55,7 +54,7 @@ type CspConfig = {
  * sites — and documented here rather than only in the skill, since this is
  * the literal set an app's `directives` entry replaces one key at a time.
  */
-declare const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>>;
+export declare const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>>;
 /**
  * Thrown at boot when `http.csp.directives` contains a value the framework
  * refuses to ship as-is, rather than silently dropping or rewriting it.
@@ -68,7 +67,7 @@ declare const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>
  *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an
  *   unbalanced count means a keyword was truncated or malformed.
  */
-declare class InvalidCspDirectiveError extends Error {
+export declare class InvalidCspDirectiveError extends Error {
   readonly directive: string;
   readonly value: string;
   /** Stable Warlock error code; `warlock explain WL1004` prints the fix. */
@@ -82,11 +81,11 @@ declare class InvalidCspDirectiveError extends Error {
  * Exported so boot code and tests can call it directly, independent of
  * whether `http.csp` happens to be enabled.
  */
-declare function validateCspDirectives(directives: Record<string, string[]> | undefined): void;
+export declare function validateCspDirectives(directives: Record<string, string[]> | undefined): void;
 /**
  * Read the app's `http.csp` config, if any.
  */
-declare function resolveCspConfig(): CspConfig | undefined;
+export declare function resolveCspConfig(): CspConfig | undefined;
 /**
  * Fail the boot loudly when `http.csp` is enabled with invalid directives.
  *
@@ -98,7 +97,7 @@ declare function resolveCspConfig(): CspConfig | undefined;
  *
  * @throws {InvalidCspDirectiveError} when a directive value is malformed.
  */
-declare function validateCspConfigAtBoot(): void;
+export declare function validateCspConfigAtBoot(): void;
 /**
  * Merge the app's directives over the framework defaults and fold in the
  * request's nonce.
@@ -110,17 +109,17 @@ declare function validateCspConfigAtBoot(): void;
  * framework's own inline payload script and hydration module script are
  * never blocked by an app's own policy.
  */
-declare function mergeCspDirectives(appDirectives: Record<string, string[]> | undefined, nonce: string): Record<string, string[]>;
+export declare function mergeCspDirectives(appDirectives: Record<string, string[]> | undefined, nonce: string): Record<string, string[]>;
 /**
  * Serialize a merged directive map into a header value —
  * `"default-src 'self'; script-src 'self' 'nonce-...'; ..."`.
  */
-declare function serializeCspDirectives(directives: Record<string, string[]>): string;
+export declare function serializeCspDirectives(directives: Record<string, string[]>): string;
 /**
  * Build the full `Content-Security-Policy` (or `-Report-Only`) header value
  * for one request, using that request's own nonce.
  */
-declare function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string;
+export declare function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string;
 /**
  * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,
  * `Content-Security-Policy-Report-Only`) header on the response, when the
@@ -135,7 +134,6 @@ declare function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): strin
  * header is the one still available later for the web layer's `<script>`
  * tags to read off `request.nonce`.
  */
-declare function applyCspHeader(request: Request, response: Response): void;
+export declare function applyCspHeader(request: Request, response: Response): void;
 //#endregion
-export { CspConfig, DEFAULT_CSP_DIRECTIVES, InvalidCspDirectiveError, applyCspHeader, buildCspHeaderValue, mergeCspDirectives, resolveCspConfig, serializeCspDirectives, validateCspConfigAtBoot, validateCspDirectives };
 //# sourceMappingURL=csp.d.mts.map

package/esm/http/csp.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csp.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"mappings":";;;;;;AAwBA;;;;;;;;;AAyBqB;AASrB;;;;AAAoD;AAsBpD;;;KAxDY,SAAA;EAwDkC;;;;EAnD5C,OAAA;EAwDkB;;;;AAEF;AAkBlB;;;;EAlEE,UAAA;EA8Fc;;;;AAA6B;AAe7C;;;;EAnGE,UAAA,GAAa,MAAM;AAAA;;;;;;;cASR,sBAAA,EAAwB,QAAQ,CAAC,MAAA;;AAgHrC;AAmCT;;;;AAA2E;AAU3E;;;;;cAvIa,wBAAA,SAAiC,KAAK;EAAA,SAK/B,SAAA;EAAA,SACA,KAAA;EAiImD;EAAA,SArIrD,IAAA;cAGE,SAAA,UACA,KAAA,UAChB,MAAA;AAAA;;;;;;;AAkJ+D;iBAhInD,qBAAA,CAAsB,UAAgD,EAApC,MAAM;;;;iBA4BxC,gBAAA,IAAoB,SAAS;;;;;;;;;;;;iBAe7B,uBAAA;;;;;;;;;;;;iBAmBA,kBAAA,CACd,aAAA,EAAe,MAAA,gCACf,KAAA,WACC,MAAM;;;;;iBAmCO,sBAAA,CAAuB,UAAoC,EAAxB,MAAM;;;;;iBAUzC,mBAAA,CAAoB,SAAA,EAAW,SAAS,EAAE,KAAA;;;;;;;;;;;;;;;iBAkB1C,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,QAAQ"}
+{"version":3,"file":"csp.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;YAwBY;;;;;EAKV;;;;;;;;;;EAUA;;;;;;;;;;EAUA,aAAa;;;;;;;;qBASF,wBAAwB,SAAS;;;;;;;;;;;;;qBAsBjC,iCAAiC;WAK1B;WACA;;WAJF;EAEhB,YACkB,mBACA,eAChB;;;;;;;;;wBAkBY,sBAAsB,YAAY;;;;wBA4BlC,oBAAoB;;;;;;;;;;;;wBAepB;;;;;;;;;;;;wBAmBA,mBACd,eAAe,sCACf,gBACC;;;;;wBAmCa,uBAAuB,YAAY;;;;;wBAUnC,oBAAoB,WAAW,WAAW;;;;;;;;;;;;;;;wBAkB1C,eAAe,SAAS,SAAS,UAAU"}

package/esm/http/csp.mjs

@@ -1,4 +1,4 @@
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 
 //#region ../../packages/core/src/http/csp.ts
 /**
@@ -55,7 +55,7 @@ function validateCspDirectives(directives) {
 * Read the app's `http.csp` config, if any.
 */
 function resolveCspConfig() {
-	return config.get("http.csp");
+	return baseConfig.get("http.csp");
 }
 /**
 * Fail the boot loudly when `http.csp` is enabled with invalid directives.

package/esm/http/csp.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csp.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/**\n * App-facing `http.csp` configuration shape.\n *\n * Disabled by default: an app that never sets `http.csp` (or sets\n * `enabled: false`) gets no `Content-Security-Policy` header at all — zero\n * behaviour change for every existing app. Opting in only swaps `enabled` to\n * `true`; `reportOnly` and `directives` are optional refinements on top.\n *\n * @example\n * ```ts title=\"src/config/http.ts\"\n * const httpConfigurations: HttpConfigurations = {\n *   csp: {\n *     enabled: true,\n *     directives: {\n *       \"img-src\": [\"'self'\", \"data:\", \"https://cdn.example.com\"],\n *     },\n *   },\n * };\n * ```\n */\nexport type CspConfig = {\n  /**\n   * Turn the header on. Everything else in this type is inert while this is\n   * `false`/unset.\n   */\n  enabled: boolean;\n  /**\n   * Emit `Content-Security-Policy-Report-Only` instead of the enforcing\n   * `Content-Security-Policy` header — the browser reports violations\n   * (via `report-to`/`report-uri`, if the app's directives configure one)\n   * without blocking anything. Use this to observe a policy safely before\n   * enforcing it.\n   *\n   * @default false\n   */\n  reportOnly?: boolean;\n  /**\n   * App-supplied directive values. A directive named here REPLACES the\n   * framework's default list for that directive entirely (the two lists are\n   * never merged element-wise) — declare the full value list you want.\n   *\n   * `script-src` is special-cased regardless of whether it is declared here:\n   * the current request's CSP nonce (`'nonce-<value>'`) is always appended to\n   * it, so the framework's own inline/module scripts keep working.\n   */\n  directives?: Record<string, string[]>;\n};\n\n/**\n * The policy every `http.csp`-enabled app starts from. Deliberately\n * conservative — same-origin by default, no plugins, no framing by other\n * sites — and documented here rather than only in the skill, since this is\n * the literal set an app's `directives` entry replaces one key at a time.\n */\nexport const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>> = {\n  \"default-src\": [\"'self'\"],\n  \"script-src\": [\"'self'\"],\n  \"style-src\": [\"'self'\"],\n  \"img-src\": [\"'self'\", \"data:\"],\n  \"object-src\": [\"'none'\"],\n  \"base-uri\": [\"'self'\"],\n  \"frame-ancestors\": [\"'self'\"],\n};\n\n/**\n * Thrown at boot when `http.csp.directives` contains a value the framework\n * refuses to ship as-is, rather than silently dropping or rewriting it.\n *\n * Two shapes are rejected:\n * - a value containing `;` — CSP directives are `;`-delimited, so a `;`\n *   inside one value would prematurely close it and let the remainder be\n *   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.\n * - a value with an odd number of `'` characters — every CSP keyword\n *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an\n *   unbalanced count means a keyword was truncated or malformed.\n */\nexport class InvalidCspDirectiveError extends Error {\n  /** Stable Warlock error code; `warlock explain WL1004` prints the fix. */\n  public readonly code = \"WL1004\";\n\n  public constructor(\n    public readonly directive: string,\n    public readonly value: string,\n    reason: string,\n  ) {\n    super(\n      `Invalid \"http.csp.directives\" entry — directive \"${directive}\" has a value ` +\n        `${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; ` +\n        `the framework will not silently repair it.`,\n    );\n    this.name = \"InvalidCspDirectiveError\";\n  }\n}\n\n/**\n * Validate every directive value an app supplied, throwing\n * {@link InvalidCspDirectiveError} on the first offender.\n *\n * Exported so boot code and tests can call it directly, independent of\n * whether `http.csp` happens to be enabled.\n */\nexport function validateCspDirectives(directives: Record<string, string[]> | undefined): void {\n  if (!directives) return;\n\n  for (const [directive, values] of Object.entries(directives)) {\n    for (const value of values) {\n      if (value.includes(\";\")) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"contains a ';' character, which would truncate the directive.\",\n        );\n      }\n\n      const quoteCount = (value.match(/'/g) ?? []).length;\n      if (quoteCount % 2 !== 0) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"has an unbalanced number of ' characters.\",\n        );\n      }\n    }\n  }\n}\n\n/**\n * Read the app's `http.csp` config, if any.\n */\nexport function resolveCspConfig(): CspConfig | undefined {\n  return config.get(\"http.csp\");\n}\n\n/**\n * Fail the boot loudly when `http.csp` is enabled with invalid directives.\n *\n * Called once, from {@link createHttpApplication} before the server starts\n * listening — never per-request. A per-request validation would let an app\n * boot successfully and only discover the bad config on first traffic;\n * checking once at boot surfaces it immediately, the same way a malformed\n * `warlock.config.ts` would.\n *\n * @throws {InvalidCspDirectiveError} when a directive value is malformed.\n */\nexport function validateCspConfigAtBoot(): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  validateCspDirectives(cspConfig.directives);\n}\n\n/**\n * Merge the app's directives over the framework defaults and fold in the\n * request's nonce.\n *\n * Per-directive replacement, not element-wise merging: a directive the app\n * names wins outright, everything else falls back to\n * {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains\n * `'nonce-<nonce>'` on top, whichever list it started from, so the\n * framework's own inline payload script and hydration module script are\n * never blocked by an app's own policy.\n */\nexport function mergeCspDirectives(\n  appDirectives: Record<string, string[]> | undefined,\n  nonce: string,\n): Record<string, string[]> {\n  const merged: Record<string, string[]> = {};\n\n  for (const [directive, defaultValues] of Object.entries(DEFAULT_CSP_DIRECTIVES)) {\n    merged[directive] = appDirectives?.[directive]\n      ? [...appDirectives[directive]]\n      : [...defaultValues];\n  }\n\n  if (appDirectives) {\n    for (const [directive, values] of Object.entries(appDirectives)) {\n      if (!(directive in merged)) {\n        merged[directive] = [...values];\n      }\n    }\n  }\n\n  // `merged[\"script-src\"]` is always populated by the loop above —\n  // `DEFAULT_CSP_DIRECTIVES` (:59-67) declares a `script-src` entry, and every\n  // one of its keys is copied into `merged` unconditionally — but its type is\n  // `Record<string, string[]>`, so `noUncheckedIndexedAccess` still widens the\n  // read to `string[] | undefined`. Narrowed once, locally, rather than\n  // asserted away.\n  const scriptSrc = merged[\"script-src\"] ?? [];\n  const nonceSource = `'nonce-${nonce}'`;\n\n  merged[\"script-src\"] = scriptSrc.includes(nonceSource) ? scriptSrc : [...scriptSrc, nonceSource];\n\n  return merged;\n}\n\n/**\n * Serialize a merged directive map into a header value —\n * `\"default-src 'self'; script-src 'self' 'nonce-...'; ...\"`.\n */\nexport function serializeCspDirectives(directives: Record<string, string[]>): string {\n  return Object.entries(directives)\n    .map(([directive, values]) => `${directive} ${values.join(\" \")}`)\n    .join(\"; \");\n}\n\n/**\n * Build the full `Content-Security-Policy` (or `-Report-Only`) header value\n * for one request, using that request's own nonce.\n */\nexport function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string {\n  return serializeCspDirectives(mergeCspDirectives(cspConfig.directives, nonce));\n}\n\n/**\n * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,\n * `Content-Security-Policy-Report-Only`) header on the response, when the\n * app opted in via `http.csp.enabled`.\n *\n * A no-op when `http.csp` is absent or `enabled` is falsy — the default,\n * behaviour-preserving state for every app that hasn't opted in.\n *\n * Reads `request.nonce`, which lazily generates and caches the per-request\n * nonce (`request.ts`) — calling this early in the request lifecycle (see\n * `inject-request-context.ts`) means the SAME nonce this stamps into the\n * header is the one still available later for the web layer's `<script>`\n * tags to read off `request.nonce`.\n */\nexport function applyCspHeader(request: Request, response: Response): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  const headerName = cspConfig.reportOnly\n    ? \"Content-Security-Policy-Report-Only\"\n    : \"Content-Security-Policy\";\n\n  response.header(headerName, buildCspHeaderValue(cspConfig, request.nonce));\n}\n"],"mappings":";;;;;;;;;AA0DA,MAAa,yBAAsE;CACjF,eAAe,CAAC,QAAQ;CACxB,cAAc,CAAC,QAAQ;CACvB,aAAa,CAAC,QAAQ;CACtB,WAAW,CAAC,UAAU,OAAO;CAC7B,cAAc,CAAC,QAAQ;CACvB,YAAY,CAAC,QAAQ;CACrB,mBAAmB,CAAC,QAAQ;AAC9B;;;;;;;;;;;;;AAcA,IAAa,2BAAb,cAA8C,MAAM;CAIlD,AAAO,YACL,AAAgB,WAChB,AAAgB,OAChB,QACA;EACA,MACE,oDAAoD,UAAU,gBACzD,KAAK,UAAU,KAAK,EAAE,QAAQ,OAAO,qFAE5C;EARgB;EACA;cAJK;EAYrB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,sBAAsB,YAAwD;CAC5F,IAAI,CAAC,YAAY;CAEjB,KAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,UAAU,GACzD,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,GAAG,GACpB,MAAM,IAAI,yBACR,WACA,OACA,+DACF;EAIF,KADoB,MAAM,MAAM,IAAI,KAAK,CAAC,EAAC,CAAE,SAC5B,MAAM,GACrB,MAAM,IAAI,yBACR,WACA,OACA,2CACF;CAEJ;AAEJ;;;;AAKA,SAAgB,mBAA0C;CACxD,OAAO,OAAO,IAAI,UAAU;AAC9B;;;;;;;;;;;;AAaA,SAAgB,0BAAgC;CAC9C,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,sBAAsB,UAAU,UAAU;AAC5C;;;;;;;;;;;;AAaA,SAAgB,mBACd,eACA,OAC0B;CAC1B,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,WAAW,kBAAkB,OAAO,QAAQ,sBAAsB,GAC5E,OAAO,aAAa,gBAAgB,aAChC,CAAC,GAAG,cAAc,UAAU,IAC5B,CAAC,GAAG,aAAa;CAGvB,IAAI,eACF;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,aAAa,GAC5D,IAAI,EAAE,aAAa,SACjB,OAAO,aAAa,CAAC,GAAG,MAAM;CAElC;CASF,MAAM,YAAY,OAAO,iBAAiB,CAAC;CAC3C,MAAM,cAAc,UAAU,MAAM;CAEpC,OAAO,gBAAgB,UAAU,SAAS,WAAW,IAAI,YAAY,CAAC,GAAG,WAAW,WAAW;CAE/F,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,YAA8C;CACnF,OAAO,OAAO,QAAQ,UAAU,CAAC,CAC9B,KAAK,CAAC,WAAW,YAAY,GAAG,UAAU,GAAG,OAAO,KAAK,GAAG,GAAG,CAAC,CAChE,KAAK,IAAI;AACd;;;;;AAMA,SAAgB,oBAAoB,WAAsB,OAAuB;CAC/E,OAAO,uBAAuB,mBAAmB,UAAU,YAAY,KAAK,CAAC;AAC/E;;;;;;;;;;;;;;;AAgBA,SAAgB,eAAe,SAAkB,UAA0B;CACzE,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,MAAM,aAAa,UAAU,aACzB,wCACA;CAEJ,SAAS,OAAO,YAAY,oBAAoB,WAAW,QAAQ,KAAK,CAAC;AAC3E"}
+{"version":3,"file":"csp.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/csp.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/**\n * App-facing `http.csp` configuration shape.\n *\n * Disabled by default: an app that never sets `http.csp` (or sets\n * `enabled: false`) gets no `Content-Security-Policy` header at all — zero\n * behaviour change for every existing app. Opting in only swaps `enabled` to\n * `true`; `reportOnly` and `directives` are optional refinements on top.\n *\n * @example\n * ```ts title=\"src/config/http.ts\"\n * const httpConfigurations: HttpConfigurations = {\n *   csp: {\n *     enabled: true,\n *     directives: {\n *       \"img-src\": [\"'self'\", \"data:\", \"https://cdn.example.com\"],\n *     },\n *   },\n * };\n * ```\n */\nexport type CspConfig = {\n  /**\n   * Turn the header on. Everything else in this type is inert while this is\n   * `false`/unset.\n   */\n  enabled: boolean;\n  /**\n   * Emit `Content-Security-Policy-Report-Only` instead of the enforcing\n   * `Content-Security-Policy` header — the browser reports violations\n   * (via `report-to`/`report-uri`, if the app's directives configure one)\n   * without blocking anything. Use this to observe a policy safely before\n   * enforcing it.\n   *\n   * @default false\n   */\n  reportOnly?: boolean;\n  /**\n   * App-supplied directive values. A directive named here REPLACES the\n   * framework's default list for that directive entirely (the two lists are\n   * never merged element-wise) — declare the full value list you want.\n   *\n   * `script-src` is special-cased regardless of whether it is declared here:\n   * the current request's CSP nonce (`'nonce-<value>'`) is always appended to\n   * it, so the framework's own inline/module scripts keep working.\n   */\n  directives?: Record<string, string[]>;\n};\n\n/**\n * The policy every `http.csp`-enabled app starts from. Deliberately\n * conservative — same-origin by default, no plugins, no framing by other\n * sites — and documented here rather than only in the skill, since this is\n * the literal set an app's `directives` entry replaces one key at a time.\n */\nexport const DEFAULT_CSP_DIRECTIVES: Readonly<Record<string, readonly string[]>> = {\n  \"default-src\": [\"'self'\"],\n  \"script-src\": [\"'self'\"],\n  \"style-src\": [\"'self'\"],\n  \"img-src\": [\"'self'\", \"data:\"],\n  \"object-src\": [\"'none'\"],\n  \"base-uri\": [\"'self'\"],\n  \"frame-ancestors\": [\"'self'\"],\n};\n\n/**\n * Thrown at boot when `http.csp.directives` contains a value the framework\n * refuses to ship as-is, rather than silently dropping or rewriting it.\n *\n * Two shapes are rejected:\n * - a value containing `;` — CSP directives are `;`-delimited, so a `;`\n *   inside one value would prematurely close it and let the remainder be\n *   parsed as a new, attacker-uncontrolled-but-developer-typo'd directive.\n * - a value with an odd number of `'` characters — every CSP keyword\n *   (`'self'`, `'none'`, a nonce/hash source) is single-quote-wrapped, so an\n *   unbalanced count means a keyword was truncated or malformed.\n */\nexport class InvalidCspDirectiveError extends Error {\n  /** Stable Warlock error code; `warlock explain WL1004` prints the fix. */\n  public readonly code = \"WL1004\";\n\n  public constructor(\n    public readonly directive: string,\n    public readonly value: string,\n    reason: string,\n  ) {\n    super(\n      `Invalid \"http.csp.directives\" entry — directive \"${directive}\" has a value ` +\n        `${JSON.stringify(value)} that ${reason} Fix the value in your app's http config; ` +\n        `the framework will not silently repair it.`,\n    );\n    this.name = \"InvalidCspDirectiveError\";\n  }\n}\n\n/**\n * Validate every directive value an app supplied, throwing\n * {@link InvalidCspDirectiveError} on the first offender.\n *\n * Exported so boot code and tests can call it directly, independent of\n * whether `http.csp` happens to be enabled.\n */\nexport function validateCspDirectives(directives: Record<string, string[]> | undefined): void {\n  if (!directives) return;\n\n  for (const [directive, values] of Object.entries(directives)) {\n    for (const value of values) {\n      if (value.includes(\";\")) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"contains a ';' character, which would truncate the directive.\",\n        );\n      }\n\n      const quoteCount = (value.match(/'/g) ?? []).length;\n      if (quoteCount % 2 !== 0) {\n        throw new InvalidCspDirectiveError(\n          directive,\n          value,\n          \"has an unbalanced number of ' characters.\",\n        );\n      }\n    }\n  }\n}\n\n/**\n * Read the app's `http.csp` config, if any.\n */\nexport function resolveCspConfig(): CspConfig | undefined {\n  return config.get(\"http.csp\");\n}\n\n/**\n * Fail the boot loudly when `http.csp` is enabled with invalid directives.\n *\n * Called once, from {@link createHttpApplication} before the server starts\n * listening — never per-request. A per-request validation would let an app\n * boot successfully and only discover the bad config on first traffic;\n * checking once at boot surfaces it immediately, the same way a malformed\n * `warlock.config.ts` would.\n *\n * @throws {InvalidCspDirectiveError} when a directive value is malformed.\n */\nexport function validateCspConfigAtBoot(): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  validateCspDirectives(cspConfig.directives);\n}\n\n/**\n * Merge the app's directives over the framework defaults and fold in the\n * request's nonce.\n *\n * Per-directive replacement, not element-wise merging: a directive the app\n * names wins outright, everything else falls back to\n * {@link DEFAULT_CSP_DIRECTIVES}. `script-src` always gains\n * `'nonce-<nonce>'` on top, whichever list it started from, so the\n * framework's own inline payload script and hydration module script are\n * never blocked by an app's own policy.\n */\nexport function mergeCspDirectives(\n  appDirectives: Record<string, string[]> | undefined,\n  nonce: string,\n): Record<string, string[]> {\n  const merged: Record<string, string[]> = {};\n\n  for (const [directive, defaultValues] of Object.entries(DEFAULT_CSP_DIRECTIVES)) {\n    merged[directive] = appDirectives?.[directive]\n      ? [...appDirectives[directive]]\n      : [...defaultValues];\n  }\n\n  if (appDirectives) {\n    for (const [directive, values] of Object.entries(appDirectives)) {\n      if (!(directive in merged)) {\n        merged[directive] = [...values];\n      }\n    }\n  }\n\n  // `merged[\"script-src\"]` is always populated by the loop above —\n  // `DEFAULT_CSP_DIRECTIVES` (:59-67) declares a `script-src` entry, and every\n  // one of its keys is copied into `merged` unconditionally — but its type is\n  // `Record<string, string[]>`, so `noUncheckedIndexedAccess` still widens the\n  // read to `string[] | undefined`. Narrowed once, locally, rather than\n  // asserted away.\n  const scriptSrc = merged[\"script-src\"] ?? [];\n  const nonceSource = `'nonce-${nonce}'`;\n\n  merged[\"script-src\"] = scriptSrc.includes(nonceSource) ? scriptSrc : [...scriptSrc, nonceSource];\n\n  return merged;\n}\n\n/**\n * Serialize a merged directive map into a header value —\n * `\"default-src 'self'; script-src 'self' 'nonce-...'; ...\"`.\n */\nexport function serializeCspDirectives(directives: Record<string, string[]>): string {\n  return Object.entries(directives)\n    .map(([directive, values]) => `${directive} ${values.join(\" \")}`)\n    .join(\"; \");\n}\n\n/**\n * Build the full `Content-Security-Policy` (or `-Report-Only`) header value\n * for one request, using that request's own nonce.\n */\nexport function buildCspHeaderValue(cspConfig: CspConfig, nonce: string): string {\n  return serializeCspDirectives(mergeCspDirectives(cspConfig.directives, nonce));\n}\n\n/**\n * Stamp the `Content-Security-Policy` (or, in `reportOnly` mode,\n * `Content-Security-Policy-Report-Only`) header on the response, when the\n * app opted in via `http.csp.enabled`.\n *\n * A no-op when `http.csp` is absent or `enabled` is falsy — the default,\n * behaviour-preserving state for every app that hasn't opted in.\n *\n * Reads `request.nonce`, which lazily generates and caches the per-request\n * nonce (`request.ts`) — calling this early in the request lifecycle (see\n * `inject-request-context.ts`) means the SAME nonce this stamps into the\n * header is the one still available later for the web layer's `<script>`\n * tags to read off `request.nonce`.\n */\nexport function applyCspHeader(request: Request, response: Response): void {\n  const cspConfig = resolveCspConfig();\n\n  if (!cspConfig?.enabled) return;\n\n  const headerName = cspConfig.reportOnly\n    ? \"Content-Security-Policy-Report-Only\"\n    : \"Content-Security-Policy\";\n\n  response.header(headerName, buildCspHeaderValue(cspConfig, request.nonce));\n}\n"],"mappings":";;;;;;;;;AA0DA,MAAa,yBAAsE;CACjF,eAAe,CAAC,QAAQ;CACxB,cAAc,CAAC,QAAQ;CACvB,aAAa,CAAC,QAAQ;CACtB,WAAW,CAAC,UAAU,OAAO;CAC7B,cAAc,CAAC,QAAQ;CACvB,YAAY,CAAC,QAAQ;CACrB,mBAAmB,CAAC,QAAQ;AAC9B;;;;;;;;;;;;;AAcA,IAAa,2BAAb,cAA8C,MAAM;CAIlD,AAAO,YACL,AAAgB,WAChB,AAAgB,OAChB,QACA;EACA,MACE,oDAAoD,UAAU,gBACzD,KAAK,UAAU,KAAK,EAAE,QAAQ,OAAO,qFAE5C;EARgB;EACA;cAJK;EAYrB,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,sBAAsB,YAAwD;CAC5F,IAAI,CAAC,YAAY;CAEjB,KAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,UAAU,GACzD,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,GAAG,GACpB,MAAM,IAAI,yBACR,WACA,OACA,+DACF;EAIF,KADoB,MAAM,MAAM,IAAI,KAAK,CAAC,EAAC,CAAE,SAC5B,MAAM,GACrB,MAAM,IAAI,yBACR,WACA,OACA,2CACF;CAEJ;AAEJ;;;;AAKA,SAAgB,mBAA0C;CACxD,OAAOA,WAAO,IAAI,UAAU;AAC9B;;;;;;;;;;;;AAaA,SAAgB,0BAAgC;CAC9C,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,sBAAsB,UAAU,UAAU;AAC5C;;;;;;;;;;;;AAaA,SAAgB,mBACd,eACA,OAC0B;CAC1B,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,WAAW,kBAAkB,OAAO,QAAQ,sBAAsB,GAC5E,OAAO,aAAa,gBAAgB,aAChC,CAAC,GAAG,cAAc,UAAU,IAC5B,CAAC,GAAG,aAAa;CAGvB,IAAI,eACF;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,aAAa,GAC5D,IAAI,EAAE,aAAa,SACjB,OAAO,aAAa,CAAC,GAAG,MAAM;CAElC;CASF,MAAM,YAAY,OAAO,iBAAiB,CAAC;CAC3C,MAAM,cAAc,UAAU,MAAM;CAEpC,OAAO,gBAAgB,UAAU,SAAS,WAAW,IAAI,YAAY,CAAC,GAAG,WAAW,WAAW;CAE/F,OAAO;AACT;;;;;AAMA,SAAgB,uBAAuB,YAA8C;CACnF,OAAO,OAAO,QAAQ,UAAU,CAAC,CAC9B,KAAK,CAAC,WAAW,YAAY,GAAG,UAAU,GAAG,OAAO,KAAK,GAAG,GAAG,CAAC,CAChE,KAAK,IAAI;AACd;;;;;AAMA,SAAgB,oBAAoB,WAAsB,OAAuB;CAC/E,OAAO,uBAAuB,mBAAmB,UAAU,YAAY,KAAK,CAAC;AAC/E;;;;;;;;;;;;;;;AAgBA,SAAgB,eAAe,SAAkB,UAA0B;CACzE,MAAM,YAAY,iBAAiB;CAEnC,IAAI,CAAC,WAAW,SAAS;CAEzB,MAAM,aAAa,UAAU,aACzB,wCACA;CAEJ,SAAS,OAAO,YAAY,oBAAoB,WAAW,QAAQ,KAAK,CAAC;AAC3E"}

package/esm/http/csrf-default-guard.d.mts

@@ -1,12 +1,11 @@
 import { Response } from "./response.mjs";
 import { Request } from "./request.mjs";
-
 //#region ../../packages/core/src/http/csrf-default-guard.d.ts
 /**
  * Whether the current request is in scope for the default core CSRF-Origin
  * guard at all.
  */
-declare function requiresDefaultCsrfGuard(request: Request): boolean;
+export declare function requiresDefaultCsrfGuard(request: Request): boolean;
 /**
  * Run the default core CSRF-Origin guard for the current request.
  *
@@ -26,7 +25,6 @@ declare function requiresDefaultCsrfGuard(request: Request): boolean;
  * rejected, because a guard rejection short-circuits `runMiddleware()`
  * entirely — so a rejected request is never logged twice.
  */
-declare function runDefaultCsrfGuard(request: Request, response: Response, translate: (key: string) => string, logRejection: (reason: string) => void): Promise<Response | undefined>;
+export declare function runDefaultCsrfGuard(request: Request, response: Response, translate: (key: string) => string, logRejection: (reason: string) => void): Promise<Response | undefined>;
 //#endregion
-export { requiresDefaultCsrfGuard, runDefaultCsrfGuard };
 //# sourceMappingURL=csrf-default-guard.d.mts.map

package/esm/http/csrf-default-guard.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-default-guard.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"mappings":";;;;;;AAyIA;;iBAAgB,wBAAA,CAAyB,OAAgB,EAAP,OAAO;;AAAA;AA2BzD;;;;;;;;;;;;;;;;;iBAAsB,mBAAA,CACpB,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,SAAA,GAAY,GAAA,qBACZ,YAAA,GAAe,MAAA,oBACd,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"csrf-default-guard.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"mappings":";;;;;;;wBAyIgB,yBAAyB,SAAS;;;;;;;;;;;;;;;;;;;;wBA2B5B,oBACpB,SAAS,SACT,UAAU,UACV,YAAY,wBACZ,eAAe,0BACd,QAAQ"}

package/esm/http/csrf-default-guard.mjs

@@ -48,7 +48,7 @@ import { resolveCsrfOriginVerdict } from "./csrf-origin-policy.mjs";
 * at all) never reaches the cookie check above and is entirely unaffected.
 */
 /** HTTP methods the default CSRF guard is scoped to — every unsafe method. */
-const UNSAFE_METHODS = new Set([
+const UNSAFE_METHODS = /* @__PURE__ */ new Set([
 	"POST",
 	"PUT",
 	"PATCH",

package/esm/http/csrf-default-guard.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-default-guard.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"sourcesContent":["/**\n * The DEFAULT core CSRF-Origin guard — SECURITY, card 8a752ab2 (5.17), lead\n * ruling from Aria (`releases/v5.17-web-readiness-audit.md` §3.1, quoted):\n *\n * > \"Scope the default guard to unsafe browser requests carrying a\n * > non-locale credential-looking cookie (fail closed on unknown names), at\n * > an early core/auth HTTP seam before app handlers; give explicit,\n * > narrowly scoped route-level exemptions for third-party callbacks and\n * > machine-to-machine routes, documented as dangerous. Reuse current\n * > same-origin/allowedOrigins policy, trustProxy-aware own origin, and fail\n * > closed on missing Origin/Referer where in scope.\"\n *\n * Before this guard, the CSRF Origin check (`csrf-origin-policy.ts`, moved\n * here from `@warlock.js/auth` in this same change) only ran inside\n * `authMiddleware(\"cookie:*\")` — a cookie-authenticated write reaching any\n * OTHER path (an app-owned optional-auth pattern reading its own `token`\n * cookie without ever calling `authMiddleware`) was never checked at all.\n *\n * This guard closes that gap at the earliest seam common to EVERY request —\n * production (`Router.scan()`) and the dev wildcard dispatcher both funnel\n * into `Router[\"handleRoute\"]` → `request.execute()` →\n * `createRequestStore()` (`./middleware/inject-request-context.ts`), which is\n * where this is wired, BEFORE `request.runMiddleware()` runs the route's own\n * middleware (so it applies with or without `authMiddleware` on the route)\n * and before any app handler. It lives in `@warlock.js/core`, not\n * `@warlock.js/auth`, because `core` — not `auth` — is a dependency of every\n * Warlock app, so this is the only seam that reaches an app that never\n * installs `@warlock.js/auth` at all.\n *\n * Scope (mirrors `web`'s page-cache Cookie-header bypass rule,\n * `web/src/server/page-cache-cookie-bypass.ts`, card ad861076 — same\n * fail-closed strict-parse posture, independently reimplemented here because\n * `core` cannot depend on `web`, the dependency runs the other way):\n * - method is POST/PUT/PATCH/DELETE, AND\n * - the `Cookie` header carries any cookie other than the framework's own\n *   `locale` cookies (legacy plus the browser preference; a header that fails to parse cleanly counts as\n *   carrying one — fail closed), AND\n * - the route is not exempted via `{ csrf: false }` (`RouteOptions.csrf`,\n *   `../router/types.ts`) — a narrow, per-route, explicitly \"dangerous\" opt\n *   out for third-party callbacks and machine-to-machine routes.\n *\n * A header-only API request (`Authorization: Bearer …`, no `Cookie` header\n * at all) never reaches the cookie check above and is entirely unaffected.\n */\nimport { LOCALE_COOKIE_NAME, LOCALE_PREFERENCE_COOKIE_NAME } from \"../config/locale-configuration\";\nimport { HttpErrorCodes } from \"./error-codes\";\nimport { resolveCsrfOriginVerdict } from \"./csrf-origin-policy\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/** HTTP methods the default CSRF guard is scoped to — every unsafe method. */\nconst UNSAFE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Strictly parse a raw `Cookie` request header into a set of cookie names, or\n * `undefined` when the header does not parse cleanly.\n *\n * Deliberately NOT a lenient cookie parser that silently drops malformed\n * pairs and returns whatever it could salvage: a header this function cannot\n * fully account for must read as \"unknown cookies present\", never as \"the\n * pairs we understood, minus the ones we didn't\" — dropping a pair is how a\n * malformed header could otherwise be misread as carrying only the locale\n * cookie (or none) and wrongly skip the guard. Mirrors\n * `web/src/server/page-cache-cookie-bypass.ts`'s `parseCookieHeaderStrict`.\n *\n * Fails (`undefined`) on:\n * - an empty or whitespace-only header;\n * - any empty segment between/around `;`;\n * - any segment with no `=`, or an empty name.\n */\nfunction parseCookieNamesStrict(rawHeader: string): Set<string> | undefined {\n  if (rawHeader.trim() === \"\") return undefined;\n\n  const names = new Set<string>();\n\n  for (const segment of rawHeader.split(\";\")) {\n    const pair = segment.trim();\n\n    if (pair === \"\") return undefined;\n\n    const separatorIndex = pair.indexOf(\"=\");\n\n    if (separatorIndex <= 0) return undefined;\n\n    const name = pair.slice(0, separatorIndex).trim();\n\n    if (name === \"\") return undefined;\n\n    names.add(name);\n  }\n\n  return names;\n}\n\n/**\n * Whether the request carries a `Cookie` header naming anything other than\n * the framework's locale cookies.\n *\n * - No `Cookie` header at all ⇒ `false` — nothing to guard on.\n * - A header that fails to parse cleanly ⇒ `true` — fails CLOSED.\n * - A header whose parsed names are a non-empty set equal to exactly\n *   `{locale}` ⇒ `false` — the one exemption.\n * - Anything else (any other cookie name, alone or alongside `locale`) ⇒ `true`.\n */\nfunction carriesNonLocaleCookie(request: Request): boolean {\n  const rawCookieHeader = request.header(\"cookie\", undefined);\n\n  // Only an ABSENT header is cookie-free. A present header in any other\n  // shape (an array from a duplicated Cookie header) fails closed.\n  if (rawCookieHeader === undefined || rawCookieHeader === null) return false;\n\n  if (typeof rawCookieHeader !== \"string\") return true;\n\n  const names = parseCookieNamesStrict(rawCookieHeader);\n\n  if (names === undefined || names.size === 0) return true;\n\n  for (const name of names) {\n    if (name !== LOCALE_COOKIE_NAME && name !== LOCALE_PREFERENCE_COOKIE_NAME) return true;\n  }\n\n  return false;\n}\n\n/**\n * Whether the matched route opted out of the default CSRF guard via\n * `{ csrf: false }` (`RouteOptions.csrf`). Any other value — including\n * `undefined` — leaves the route in scope.\n */\nfunction isCsrfExempt(request: Request): boolean {\n  return request.route?.csrf === false;\n}\n\n/**\n * Whether the current request is in scope for the default core CSRF-Origin\n * guard at all.\n */\nexport function requiresDefaultCsrfGuard(request: Request): boolean {\n  if (!UNSAFE_METHODS.has(request.method.toUpperCase())) return false;\n\n  if (isCsrfExempt(request)) return false;\n\n  return carriesNonLocaleCookie(request);\n}\n\n/**\n * Run the default core CSRF-Origin guard for the current request.\n *\n * Returns `undefined` when the request is out of scope or passes the\n * Origin/Referer check — the caller continues into route middleware and the\n * handler as normal. Returns the 403 {@link Response} when the guard refuses\n * the request; the caller must return that value immediately, the same\n * short-circuit contract every other middleware in the chain follows.\n *\n * Uses the SAME translated message and client-visible error code\n * `authMiddleware(\"cookie:*\")`'s own CSRF-Origin check uses\n * (`auth.errors.csrfOriginMismatch`, `HttpErrorCodes.CsrfOriginMismatch` /\n * `AuthErrorCodes.CsrfOriginMismatch`, both `\"EC006\"`) — one message, one\n * error code, regardless of which seam caught the request. Logs exactly once\n * per rejection here; a route that also carries `authMiddleware(\"cookie:*\")`\n * never reaches that middleware's own check for a request THIS guard already\n * rejected, because a guard rejection short-circuits `runMiddleware()`\n * entirely — so a rejected request is never logged twice.\n */\nexport async function runDefaultCsrfGuard(\n  request: Request,\n  response: Response,\n  translate: (key: string) => string,\n  logRejection: (reason: string) => void,\n): Promise<Response | undefined> {\n  if (!requiresDefaultCsrfGuard(request)) return undefined;\n\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (verdict.allowed) return undefined;\n\n  logRejection(verdict.reason);\n\n  return response.forbidden({\n    error: translate(\"auth.errors.csrfOriginMismatch\"),\n    errorCode: HttpErrorCodes.CsrfOriginMismatch,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAM,iBAAiB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBjE,SAAS,uBAAuB,WAA4C;CAC1E,IAAI,UAAU,KAAK,MAAM,IAAI,OAAO;CAEpC,MAAM,wBAAQ,IAAI,IAAY;CAE9B,KAAK,MAAM,WAAW,UAAU,MAAM,GAAG,GAAG;EAC1C,MAAM,OAAO,QAAQ,KAAK;EAE1B,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,iBAAiB,KAAK,QAAQ,GAAG;EAEvC,IAAI,kBAAkB,GAAG,OAAO;EAEhC,MAAM,OAAO,KAAK,MAAM,GAAG,cAAc,CAAC,CAAC,KAAK;EAEhD,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,IAAI,IAAI;CAChB;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAS,uBAAuB,SAA2B;CACzD,MAAM,kBAAkB,QAAQ,OAAO,UAAU,MAAS;CAI1D,IAAI,oBAAoB,UAAa,oBAAoB,MAAM,OAAO;CAEtE,IAAI,OAAO,oBAAoB,UAAU,OAAO;CAEhD,MAAM,QAAQ,uBAAuB,eAAe;CAEpD,IAAI,UAAU,UAAa,MAAM,SAAS,GAAG,OAAO;CAEpD,KAAK,MAAM,QAAQ,OACjB,IAAI,qBAA+B,sCAAwC,OAAO;CAGpF,OAAO;AACT;;;;;;AAOA,SAAS,aAAa,SAA2B;CAC/C,OAAO,QAAQ,OAAO,SAAS;AACjC;;;;;AAMA,SAAgB,yBAAyB,SAA2B;CAClE,IAAI,CAAC,eAAe,IAAI,QAAQ,OAAO,YAAY,CAAC,GAAG,OAAO;CAE9D,IAAI,aAAa,OAAO,GAAG,OAAO;CAElC,OAAO,uBAAuB,OAAO;AACvC;;;;;;;;;;;;;;;;;;;;AAqBA,eAAsB,oBACpB,SACA,UACA,WACA,cAC+B;CAC/B,IAAI,CAAC,yBAAyB,OAAO,GAAG,OAAO;CAE/C,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,QAAQ,SAAS,OAAO;CAE5B,aAAa,QAAQ,MAAM;CAE3B,OAAO,SAAS,UAAU;EACxB,OAAO,UAAU,gCAAgC;EACjD;CACF,CAAC;AACH"}
+{"version":3,"file":"csrf-default-guard.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-default-guard.ts"],"sourcesContent":["/**\n * The DEFAULT core CSRF-Origin guard — SECURITY, card 8a752ab2 (5.17), lead\n * ruling from Aria (`releases/v5.17-web-readiness-audit.md` §3.1, quoted):\n *\n * > \"Scope the default guard to unsafe browser requests carrying a\n * > non-locale credential-looking cookie (fail closed on unknown names), at\n * > an early core/auth HTTP seam before app handlers; give explicit,\n * > narrowly scoped route-level exemptions for third-party callbacks and\n * > machine-to-machine routes, documented as dangerous. Reuse current\n * > same-origin/allowedOrigins policy, trustProxy-aware own origin, and fail\n * > closed on missing Origin/Referer where in scope.\"\n *\n * Before this guard, the CSRF Origin check (`csrf-origin-policy.ts`, moved\n * here from `@warlock.js/auth` in this same change) only ran inside\n * `authMiddleware(\"cookie:*\")` — a cookie-authenticated write reaching any\n * OTHER path (an app-owned optional-auth pattern reading its own `token`\n * cookie without ever calling `authMiddleware`) was never checked at all.\n *\n * This guard closes that gap at the earliest seam common to EVERY request —\n * production (`Router.scan()`) and the dev wildcard dispatcher both funnel\n * into `Router[\"handleRoute\"]` → `request.execute()` →\n * `createRequestStore()` (`./middleware/inject-request-context.ts`), which is\n * where this is wired, BEFORE `request.runMiddleware()` runs the route's own\n * middleware (so it applies with or without `authMiddleware` on the route)\n * and before any app handler. It lives in `@warlock.js/core`, not\n * `@warlock.js/auth`, because `core` — not `auth` — is a dependency of every\n * Warlock app, so this is the only seam that reaches an app that never\n * installs `@warlock.js/auth` at all.\n *\n * Scope (mirrors `web`'s page-cache Cookie-header bypass rule,\n * `web/src/server/page-cache-cookie-bypass.ts`, card ad861076 — same\n * fail-closed strict-parse posture, independently reimplemented here because\n * `core` cannot depend on `web`, the dependency runs the other way):\n * - method is POST/PUT/PATCH/DELETE, AND\n * - the `Cookie` header carries any cookie other than the framework's own\n *   `locale` cookies (legacy plus the browser preference; a header that fails to parse cleanly counts as\n *   carrying one — fail closed), AND\n * - the route is not exempted via `{ csrf: false }` (`RouteOptions.csrf`,\n *   `../router/types.ts`) — a narrow, per-route, explicitly \"dangerous\" opt\n *   out for third-party callbacks and machine-to-machine routes.\n *\n * A header-only API request (`Authorization: Bearer …`, no `Cookie` header\n * at all) never reaches the cookie check above and is entirely unaffected.\n */\nimport { LOCALE_COOKIE_NAME, LOCALE_PREFERENCE_COOKIE_NAME } from \"../config/locale-configuration\";\nimport { HttpErrorCodes } from \"./error-codes\";\nimport { resolveCsrfOriginVerdict } from \"./csrf-origin-policy\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\n\n/** HTTP methods the default CSRF guard is scoped to — every unsafe method. */\nconst UNSAFE_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Strictly parse a raw `Cookie` request header into a set of cookie names, or\n * `undefined` when the header does not parse cleanly.\n *\n * Deliberately NOT a lenient cookie parser that silently drops malformed\n * pairs and returns whatever it could salvage: a header this function cannot\n * fully account for must read as \"unknown cookies present\", never as \"the\n * pairs we understood, minus the ones we didn't\" — dropping a pair is how a\n * malformed header could otherwise be misread as carrying only the locale\n * cookie (or none) and wrongly skip the guard. Mirrors\n * `web/src/server/page-cache-cookie-bypass.ts`'s `parseCookieHeaderStrict`.\n *\n * Fails (`undefined`) on:\n * - an empty or whitespace-only header;\n * - any empty segment between/around `;`;\n * - any segment with no `=`, or an empty name.\n */\nfunction parseCookieNamesStrict(rawHeader: string): Set<string> | undefined {\n  if (rawHeader.trim() === \"\") return undefined;\n\n  const names = new Set<string>();\n\n  for (const segment of rawHeader.split(\";\")) {\n    const pair = segment.trim();\n\n    if (pair === \"\") return undefined;\n\n    const separatorIndex = pair.indexOf(\"=\");\n\n    if (separatorIndex <= 0) return undefined;\n\n    const name = pair.slice(0, separatorIndex).trim();\n\n    if (name === \"\") return undefined;\n\n    names.add(name);\n  }\n\n  return names;\n}\n\n/**\n * Whether the request carries a `Cookie` header naming anything other than\n * the framework's locale cookies.\n *\n * - No `Cookie` header at all ⇒ `false` — nothing to guard on.\n * - A header that fails to parse cleanly ⇒ `true` — fails CLOSED.\n * - A header whose parsed names are a non-empty set equal to exactly\n *   `{locale}` ⇒ `false` — the one exemption.\n * - Anything else (any other cookie name, alone or alongside `locale`) ⇒ `true`.\n */\nfunction carriesNonLocaleCookie(request: Request): boolean {\n  const rawCookieHeader = request.header(\"cookie\", undefined);\n\n  // Only an ABSENT header is cookie-free. A present header in any other\n  // shape (an array from a duplicated Cookie header) fails closed.\n  if (rawCookieHeader === undefined || rawCookieHeader === null) return false;\n\n  if (typeof rawCookieHeader !== \"string\") return true;\n\n  const names = parseCookieNamesStrict(rawCookieHeader);\n\n  if (names === undefined || names.size === 0) return true;\n\n  for (const name of names) {\n    if (name !== LOCALE_COOKIE_NAME && name !== LOCALE_PREFERENCE_COOKIE_NAME) return true;\n  }\n\n  return false;\n}\n\n/**\n * Whether the matched route opted out of the default CSRF guard via\n * `{ csrf: false }` (`RouteOptions.csrf`). Any other value — including\n * `undefined` — leaves the route in scope.\n */\nfunction isCsrfExempt(request: Request): boolean {\n  return request.route?.csrf === false;\n}\n\n/**\n * Whether the current request is in scope for the default core CSRF-Origin\n * guard at all.\n */\nexport function requiresDefaultCsrfGuard(request: Request): boolean {\n  if (!UNSAFE_METHODS.has(request.method.toUpperCase())) return false;\n\n  if (isCsrfExempt(request)) return false;\n\n  return carriesNonLocaleCookie(request);\n}\n\n/**\n * Run the default core CSRF-Origin guard for the current request.\n *\n * Returns `undefined` when the request is out of scope or passes the\n * Origin/Referer check — the caller continues into route middleware and the\n * handler as normal. Returns the 403 {@link Response} when the guard refuses\n * the request; the caller must return that value immediately, the same\n * short-circuit contract every other middleware in the chain follows.\n *\n * Uses the SAME translated message and client-visible error code\n * `authMiddleware(\"cookie:*\")`'s own CSRF-Origin check uses\n * (`auth.errors.csrfOriginMismatch`, `HttpErrorCodes.CsrfOriginMismatch` /\n * `AuthErrorCodes.CsrfOriginMismatch`, both `\"EC006\"`) — one message, one\n * error code, regardless of which seam caught the request. Logs exactly once\n * per rejection here; a route that also carries `authMiddleware(\"cookie:*\")`\n * never reaches that middleware's own check for a request THIS guard already\n * rejected, because a guard rejection short-circuits `runMiddleware()`\n * entirely — so a rejected request is never logged twice.\n */\nexport async function runDefaultCsrfGuard(\n  request: Request,\n  response: Response,\n  translate: (key: string) => string,\n  logRejection: (reason: string) => void,\n): Promise<Response | undefined> {\n  if (!requiresDefaultCsrfGuard(request)) return undefined;\n\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (verdict.allowed) return undefined;\n\n  logRejection(verdict.reason);\n\n  return response.forbidden({\n    error: translate(\"auth.errors.csrfOriginMismatch\"),\n    errorCode: HttpErrorCodes.CsrfOriginMismatch,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,MAAM,iCAAiB,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;;;;;;;;;;;;;;;;;AAmBjE,SAAS,uBAAuB,WAA4C;CAC1E,IAAI,UAAU,KAAK,MAAM,IAAI,OAAO;CAEpC,MAAM,wBAAQ,IAAI,IAAY;CAE9B,KAAK,MAAM,WAAW,UAAU,MAAM,GAAG,GAAG;EAC1C,MAAM,OAAO,QAAQ,KAAK;EAE1B,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,iBAAiB,KAAK,QAAQ,GAAG;EAEvC,IAAI,kBAAkB,GAAG,OAAO;EAEhC,MAAM,OAAO,KAAK,MAAM,GAAG,cAAc,CAAC,CAAC,KAAK;EAEhD,IAAI,SAAS,IAAI,OAAO;EAExB,MAAM,IAAI,IAAI;CAChB;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAS,uBAAuB,SAA2B;CACzD,MAAM,kBAAkB,QAAQ,OAAO,UAAU,MAAS;CAI1D,IAAI,oBAAoB,UAAa,oBAAoB,MAAM,OAAO;CAEtE,IAAI,OAAO,oBAAoB,UAAU,OAAO;CAEhD,MAAM,QAAQ,uBAAuB,eAAe;CAEpD,IAAI,UAAU,UAAa,MAAM,SAAS,GAAG,OAAO;CAEpD,KAAK,MAAM,QAAQ,OACjB,IAAI,qBAA+B,sCAAwC,OAAO;CAGpF,OAAO;AACT;;;;;;AAOA,SAAS,aAAa,SAA2B;CAC/C,OAAO,QAAQ,OAAO,SAAS;AACjC;;;;;AAMA,SAAgB,yBAAyB,SAA2B;CAClE,IAAI,CAAC,eAAe,IAAI,QAAQ,OAAO,YAAY,CAAC,GAAG,OAAO;CAE9D,IAAI,aAAa,OAAO,GAAG,OAAO;CAElC,OAAO,uBAAuB,OAAO;AACvC;;;;;;;;;;;;;;;;;;;;AAqBA,eAAsB,oBACpB,SACA,UACA,WACA,cAC+B;CAC/B,IAAI,CAAC,yBAAyB,OAAO,GAAG,OAAO;CAE/C,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,QAAQ,SAAS,OAAO;CAE5B,aAAa,QAAQ,MAAM;CAE3B,OAAO,SAAS,UAAU;EACxB,OAAO,UAAU,gCAAgC;EACjD;CACF,CAAC;AACH"}