@warlock.js/core 5.31.0 → 5.33.0

package/esm/http/csrf-origin-policy.d.mts

@@ -1,10 +1,9 @@
 import { Request } from "./request.mjs";
-
 //#region ../../packages/core/src/http/csrf-origin-policy.d.ts
 /** Why {@link resolveCsrfOriginVerdict} refused a request. */
-type CsrfOriginCheckReason = "origin-mismatch" | "referer-mismatch" | "missing-origin-and-referer";
+export type CsrfOriginCheckReason = "origin-mismatch" | "referer-mismatch" | "missing-origin-and-referer";
 /** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */
-type CsrfOriginVerdict = {
+export type CsrfOriginVerdict = {
   allowed: true;
 } | {
   allowed: false;
@@ -24,18 +23,18 @@ type CsrfOriginVerdict = {
  * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this
  * function does not need its own proxy-trust logic on top of that.
  */
-declare function ownOrigin(request: Request): string;
+export declare function ownOrigin(request: Request): string;
 /** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */
-declare function originOf(rawUrl: string): string | undefined;
+export declare function originOf(rawUrl: string): string | undefined;
 /**
  * Normalize an origin string (`scheme://host[:port]`) so that a default port
  * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin
  * written without a port. Falls back to the raw value if it does not parse
  * as a URL (in which case it will simply fail the exact-match comparison).
  */
-declare function normalizeOrigin(origin: string): string;
+export declare function normalizeOrigin(origin: string): string;
 /** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */
-declare function isAllowedCsrfOrigin(origin: string, request: Request): boolean;
+export declare function isAllowedCsrfOrigin(origin: string, request: Request): boolean;
 /**
  * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):
  * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the
@@ -47,7 +46,6 @@ declare function isAllowedCsrfOrigin(origin: string, request: Request): boolean;
  * exemption) — this function only answers the Origin/Referer question once a
  * caller has already decided the check applies.
  */
-declare function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict;
+export declare function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict;
 //#endregion
-export { CsrfOriginCheckReason, CsrfOriginVerdict, isAllowedCsrfOrigin, normalizeOrigin, originOf, ownOrigin, resolveCsrfOriginVerdict };
 //# sourceMappingURL=csrf-origin-policy.d.mts.map

package/esm/http/csrf-origin-policy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-policy.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"mappings":";;;;KAyBY,qBAAA;AAAZ;AAAA,KAMY,iBAAA;EACN,OAAA;AAAA;EACA,OAAA;EAAgB,MAAA,EAAQ,qBAAqB;AAAA;;;;;;;;AAAA;AAgBnD;;;;AAA0C;AAgB1C;iBAhBgB,SAAA,CAAU,OAAgB,EAAP,OAAO;;iBAgB1B,QAAA,CAAS,MAAc;AAAA;AAgBvC;;;;AAA8C;AAhBP,iBAgBvB,eAAA,CAAgB,MAAc;;iBAc9B,mBAAA,CAAoB,MAAA,UAAgB,OAAA,EAAS,OAAO;;;;;;AAAA;AAqBpE;;;;;iBAAgB,wBAAA,CAAyB,OAAA,EAAS,OAAA,GAAU,iBAAiB"}
+{"version":3,"file":"csrf-origin-policy.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"mappings":";;;YAyBY;;YAMA;EACN;;EACA;EAAgB,QAAQ;;;;;;;;;;;;;;;;wBAgBd,UAAU,SAAS;;wBAgBnB,SAAS;;;;;;;wBAgBT,gBAAgB;;wBAchB,oBAAoB,gBAAgB,SAAS;;;;;;;;;;;;wBAqB7C,yBAAyB,SAAS,UAAU"}

package/esm/http/csrf-origin-policy.mjs

@@ -1,4 +1,4 @@
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 
 //#region ../../packages/core/src/http/csrf-origin-policy.ts
 /**
@@ -69,7 +69,7 @@ function normalizeOrigin(origin) {
 /** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */
 function isAllowedCsrfOrigin(origin, request) {
 	if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;
-	const allowedOrigins = config.get("auth.csrf.allowedOrigins", []);
+	const allowedOrigins = baseConfig.get("auth.csrf.allowedOrigins", []);
 	const normalized = normalizeOrigin(origin);
 	return allowedOrigins.some((allowed) => normalizeOrigin(allowed) === normalized);
 }

package/esm/http/csrf-origin-policy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-policy.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"sourcesContent":["/**\n * The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the\n * one comparison every CSRF-Origin check in the framework must agree on.\n *\n * SECURITY, card 8a752ab2 (5.17). Extracted from\n * `@warlock.js/auth`'s `csrf-origin-check.ts` (the ONLY prior owner of this\n * logic) into `@warlock.js/core` so both call sites — the\n * `authMiddleware(\"cookie:*\")` check in `@warlock.js/auth` and the default\n * core HTTP-seam guard in `./csrf-default-guard.ts` — share ONE\n * implementation instead of drifting copies. `@warlock.js/core` cannot depend\n * on `@warlock.js/auth` (the dependency runs the other way), so the shared\n * logic had to move down into `core`, not up into a new shared package —\n * `auth`'s `csrf-origin-check.ts` now delegates to\n * {@link resolveCsrfOriginVerdict} instead of reimplementing it.\n *\n * Reads `auth.csrf.allowedOrigins` directly via `@mongez/config` (the exact\n * same config key `@warlock.js/auth`'s `authConfig.csrf.allowedOrigins()`\n * reads) rather than importing `@warlock.js/auth`, so an app's one\n * `auth.csrf.allowedOrigins` setting governs both checks without `core`\n * taking a hard dependency on `auth`.\n */\nimport config from \"@mongez/config\";\nimport type { Request } from \"./request\";\n\n/** Why {@link resolveCsrfOriginVerdict} refused a request. */\nexport type CsrfOriginCheckReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */\nexport type CsrfOriginVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: CsrfOriginCheckReason };\n\n/**\n * The request's own origin — what an `Origin`/`Referer` header must match.\n *\n * `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never\n * carries a port. A browser's `Origin` header on a non-default port (e.g. any\n * `warlock dev` session) does, so the port must come from the raw `Host`\n * header instead — core exposes no getter for that, so it is read directly\n * here.\n *\n * Trust-proxy-aware for free: `request.protocol` is Fastify's own\n * `request.protocol`, which already honours `http.trustProxy`\n * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this\n * function does not need its own proxy-trust logic on top of that.\n */\nexport function ownOrigin(request: Request): string {\n  // Fastify's `host` keeps the port and honours `X-Forwarded-Host` under\n  // `trustProxy`, so a proxy that rewrites `Host` does not break the match.\n  const fastifyHost = request.baseRequest?.host;\n  const hostHeader = request.header(\"host\");\n  const host =\n    typeof fastifyHost === \"string\" && fastifyHost\n      ? fastifyHost\n      : typeof hostHeader === \"string\" && hostHeader\n        ? hostHeader\n        : request.hostname;\n\n  return `${request.protocol}://${host}`;\n}\n\n/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */\nexport function originOf(rawUrl: string): string | undefined {\n  try {\n    const url = new URL(rawUrl);\n\n    return `${url.protocol}//${url.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Normalize an origin string (`scheme://host[:port]`) so that a default port\n * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin\n * written without a port. Falls back to the raw value if it does not parse\n * as a URL (in which case it will simply fail the exact-match comparison).\n */\nexport function normalizeOrigin(origin: string): string {\n  try {\n    const url = new URL(origin);\n    const isDefaultPort =\n      (url.protocol === \"http:\" && (url.port === \"\" || url.port === \"80\")) ||\n      (url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\"));\n\n    return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;\n  } catch {\n    return origin;\n  }\n}\n\n/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */\nexport function isAllowedCsrfOrigin(origin: string, request: Request): boolean {\n  if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;\n\n  const allowedOrigins: string[] = config.get(\"auth.csrf.allowedOrigins\", []);\n\n  const normalized = normalizeOrigin(origin);\n\n  return allowedOrigins.some((allowed) => normalizeOrigin(allowed) === normalized);\n}\n\n/**\n * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):\n * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the\n * request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused\n * otherwise, including when BOTH headers are absent (fail closed).\n *\n * Callers decide WHETHER a request is in scope for this check at all (a\n * cookie-sourced credential / a non-locale cookie, an unsafe method, no route\n * exemption) — this function only answers the Origin/Referer question once a\n * caller has already decided the check applies.\n */\nexport function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict {\n  const origin = request.origin;\n\n  if (origin) {\n    return isAllowedCsrfOrigin(origin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"origin-mismatch\" };\n  }\n\n  const referer = request.header(\"referer\");\n  const refererOrigin = typeof referer === \"string\" ? originOf(referer) : undefined;\n\n  if (refererOrigin) {\n    return isAllowedCsrfOrigin(refererOrigin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"referer-mismatch\" };\n  }\n\n  return { allowed: false, reason: \"missing-origin-and-referer\" };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,UAAU,SAA0B;CAGlD,MAAM,cAAc,QAAQ,aAAa;CACzC,MAAM,aAAa,QAAQ,OAAO,MAAM;CACxC,MAAM,OACJ,OAAO,gBAAgB,YAAY,cAC/B,cACA,OAAO,eAAe,YAAY,aAChC,aACA,QAAQ;CAEhB,OAAO,GAAG,QAAQ,SAAS,KAAK;AAClC;;AAGA,SAAgB,SAAS,QAAoC;CAC3D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAE1B,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAwB;CACtD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,MAAM,gBACH,IAAI,aAAa,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,SAC7D,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;EAEjE,OAAO,GAAG,IAAI,SAAS,IAAI,gBAAgB,IAAI,WAAW,IAAI;CAChE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,oBAAoB,QAAgB,SAA2B;CAC7E,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,OAAO;CAE5E,MAAM,iBAA2B,OAAO,IAAI,4BAA4B,CAAC,CAAC;CAE1E,MAAM,aAAa,gBAAgB,MAAM;CAEzC,OAAO,eAAe,MAAM,YAAY,gBAAgB,OAAO,MAAM,UAAU;AACjF;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,SAAqC;CAC5E,MAAM,SAAS,QAAQ;CAEvB,IAAI,QACF,OAAO,oBAAoB,QAAQ,OAAO,IACtC,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAkB;CAGlD,MAAM,UAAU,QAAQ,OAAO,SAAS;CACxC,MAAM,gBAAgB,OAAO,YAAY,WAAW,SAAS,OAAO,IAAI;CAExE,IAAI,eACF,OAAO,oBAAoB,eAAe,OAAO,IAC7C,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAmB;CAGnD,OAAO;EAAE,SAAS;EAAO,QAAQ;CAA6B;AAChE"}
+{"version":3,"file":"csrf-origin-policy.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/csrf-origin-policy.ts"],"sourcesContent":["/**\n * The Origin/Referer same-origin (or `auth.csrf.allowedOrigins`) policy — the\n * one comparison every CSRF-Origin check in the framework must agree on.\n *\n * SECURITY, card 8a752ab2 (5.17). Extracted from\n * `@warlock.js/auth`'s `csrf-origin-check.ts` (the ONLY prior owner of this\n * logic) into `@warlock.js/core` so both call sites — the\n * `authMiddleware(\"cookie:*\")` check in `@warlock.js/auth` and the default\n * core HTTP-seam guard in `./csrf-default-guard.ts` — share ONE\n * implementation instead of drifting copies. `@warlock.js/core` cannot depend\n * on `@warlock.js/auth` (the dependency runs the other way), so the shared\n * logic had to move down into `core`, not up into a new shared package —\n * `auth`'s `csrf-origin-check.ts` now delegates to\n * {@link resolveCsrfOriginVerdict} instead of reimplementing it.\n *\n * Reads `auth.csrf.allowedOrigins` directly via `@mongez/config` (the exact\n * same config key `@warlock.js/auth`'s `authConfig.csrf.allowedOrigins()`\n * reads) rather than importing `@warlock.js/auth`, so an app's one\n * `auth.csrf.allowedOrigins` setting governs both checks without `core`\n * taking a hard dependency on `auth`.\n */\nimport config from \"@mongez/config\";\nimport type { Request } from \"./request\";\n\n/** Why {@link resolveCsrfOriginVerdict} refused a request. */\nexport type CsrfOriginCheckReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/** The verdict {@link resolveCsrfOriginVerdict} reaches for one request. */\nexport type CsrfOriginVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: CsrfOriginCheckReason };\n\n/**\n * The request's own origin — what an `Origin`/`Referer` header must match.\n *\n * `request.hostname` (core's `Request`, backed by Fastify's `hostname`) never\n * carries a port. A browser's `Origin` header on a non-default port (e.g. any\n * `warlock dev` session) does, so the port must come from the raw `Host`\n * header instead — core exposes no getter for that, so it is read directly\n * here.\n *\n * Trust-proxy-aware for free: `request.protocol` is Fastify's own\n * `request.protocol`, which already honours `http.trustProxy`\n * (`X-Forwarded-Proto`) when the app has configured it (`server.ts`) — this\n * function does not need its own proxy-trust logic on top of that.\n */\nexport function ownOrigin(request: Request): string {\n  // Fastify's `host` keeps the port and honours `X-Forwarded-Host` under\n  // `trustProxy`, so a proxy that rewrites `Host` does not break the match.\n  const fastifyHost = request.baseRequest?.host;\n  const hostHeader = request.header(\"host\");\n  const host =\n    typeof fastifyHost === \"string\" && fastifyHost\n      ? fastifyHost\n      : typeof hostHeader === \"string\" && hostHeader\n        ? hostHeader\n        : request.hostname;\n\n  return `${request.protocol}://${host}`;\n}\n\n/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */\nexport function originOf(rawUrl: string): string | undefined {\n  try {\n    const url = new URL(rawUrl);\n\n    return `${url.protocol}//${url.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Normalize an origin string (`scheme://host[:port]`) so that a default port\n * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin\n * written without a port. Falls back to the raw value if it does not parse\n * as a URL (in which case it will simply fail the exact-match comparison).\n */\nexport function normalizeOrigin(origin: string): string {\n  try {\n    const url = new URL(origin);\n    const isDefaultPort =\n      (url.protocol === \"http:\" && (url.port === \"\" || url.port === \"80\")) ||\n      (url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\"));\n\n    return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;\n  } catch {\n    return origin;\n  }\n}\n\n/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */\nexport function isAllowedCsrfOrigin(origin: string, request: Request): boolean {\n  if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;\n\n  const allowedOrigins: string[] = config.get(\"auth.csrf.allowedOrigins\", []);\n\n  const normalized = normalizeOrigin(origin);\n\n  return allowedOrigins.some((allowed) => normalizeOrigin(allowed) === normalized);\n}\n\n/**\n * The shared CSRF Origin/Referer verdict (lead decision, card 8a752ab2 §3.1):\n * allowed when `Origin` — or, when `Origin` is absent, `Referer` — names the\n * request's own origin or an entry in `auth.csrf.allowedOrigins`. Refused\n * otherwise, including when BOTH headers are absent (fail closed).\n *\n * Callers decide WHETHER a request is in scope for this check at all (a\n * cookie-sourced credential / a non-locale cookie, an unsafe method, no route\n * exemption) — this function only answers the Origin/Referer question once a\n * caller has already decided the check applies.\n */\nexport function resolveCsrfOriginVerdict(request: Request): CsrfOriginVerdict {\n  const origin = request.origin;\n\n  if (origin) {\n    return isAllowedCsrfOrigin(origin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"origin-mismatch\" };\n  }\n\n  const referer = request.header(\"referer\");\n  const refererOrigin = typeof referer === \"string\" ? originOf(referer) : undefined;\n\n  if (refererOrigin) {\n    return isAllowedCsrfOrigin(refererOrigin, request)\n      ? { allowed: true }\n      : { allowed: false, reason: \"referer-mismatch\" };\n  }\n\n  return { allowed: false, reason: \"missing-origin-and-referer\" };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,UAAU,SAA0B;CAGlD,MAAM,cAAc,QAAQ,aAAa;CACzC,MAAM,aAAa,QAAQ,OAAO,MAAM;CACxC,MAAM,OACJ,OAAO,gBAAgB,YAAY,cAC/B,cACA,OAAO,eAAe,YAAY,aAChC,aACA,QAAQ;CAEhB,OAAO,GAAG,QAAQ,SAAS,KAAK;AAClC;;AAGA,SAAgB,SAAS,QAAoC;CAC3D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAE1B,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAwB;CACtD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,MAAM,gBACH,IAAI,aAAa,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,SAC7D,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;EAEjE,OAAO,GAAG,IAAI,SAAS,IAAI,gBAAgB,IAAI,WAAW,IAAI;CAChE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,oBAAoB,QAAgB,SAA2B;CAC7E,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,OAAO;CAE5E,MAAM,iBAA2BA,WAAO,IAAI,4BAA4B,CAAC,CAAC;CAE1E,MAAM,aAAa,gBAAgB,MAAM;CAEzC,OAAO,eAAe,MAAM,YAAY,gBAAgB,OAAO,MAAM,UAAU;AACjF;;;;;;;;;;;;AAaA,SAAgB,yBAAyB,SAAqC;CAC5E,MAAM,SAAS,QAAQ;CAEvB,IAAI,QACF,OAAO,oBAAoB,QAAQ,OAAO,IACtC,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAkB;CAGlD,MAAM,UAAU,QAAQ,OAAO,SAAS;CACxC,MAAM,gBAAgB,OAAO,YAAY,WAAW,SAAS,OAAO,IAAI;CAExE,IAAI,eACF,OAAO,oBAAoB,eAAe,OAAO,IAC7C,EAAE,SAAS,KAAK,IAChB;EAAE,SAAS;EAAO,QAAQ;CAAmB;CAGnD,OAAO;EAAE,SAAS;EAAO,QAAQ;CAA6B;AAChE"}

package/esm/http/database/RequestLog.d.mts

@@ -1,6 +1,5 @@
 import { Infer } from "@warlock.js/seal";
 import { Model } from "@warlock.js/cascade";
-
 //#region ../../packages/core/src/http/database/RequestLog.d.ts
 declare const schema: import("@warlock.js/seal").ObjectValidator<{
   statusCode: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
@@ -31,7 +30,7 @@ declare const schema: import("@warlock.js/seal").ObjectValidator<{
   };
 }>;
 type RequestLogSchema = Infer.Output<typeof schema>;
-declare class RequestLog extends Model<RequestLogSchema> {
+export declare class RequestLog extends Model<RequestLogSchema> {
   /**
    * {@inheritdoc}
    */
@@ -69,5 +68,5 @@ declare class RequestLog extends Model<RequestLogSchema> {
   }>;
 }
 //#endregion
-export { RequestLog };
+export {};
 //# sourceMappingURL=RequestLog.d.mts.map

package/esm/http/database/RequestLog.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"RequestLog.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/database/RequestLog.ts"],"mappings":";;;;cAGM,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiBP,gBAAA,GAAmB,KAAA,CAAM,MAAM,QAAQ,MAAA;AAAA,cAE/B,UAAA,SAAmB,KAAA,CAAM,gBAAA;;;;SAItB,KAAA;;;;SAKA,MAAA,6BAAM,eAAA"}
+{"version":3,"file":"RequestLog.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/database/RequestLog.ts"],"mappings":";;;cAGM,mCAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiBP,mBAAmB,MAAM,cAAc;qBAE/B,mBAAmB,MAAM;;;;SAItB;;;;SAKA,mCAAM"}

package/esm/http/error-codes.d.mts

@@ -8,7 +8,7 @@
  * Range `EC100..EC199` is reserved for `@warlock.js/core` HTTP middleware.
  * `EC001..EC099` belongs to `@warlock.js/auth`.
  */
-declare enum HttpErrorCodes {
+export declare enum HttpErrorCodes {
   /**
    * Same idempotency key reused with a different request body.
    * Client likely has a bug — same intent must reuse the same body.
@@ -53,5 +53,4 @@ declare enum HttpErrorCodes {
   CsrfOriginMismatch = "EC006"
 }
 //#endregion
-export { HttpErrorCodes };
 //# sourceMappingURL=error-codes.d.mts.map

package/esm/http/error-codes.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/error-codes.ts"],"mappings":";;AASA;;;;;;;;aAAY,cAAA;EA8BV;;;;EAzBA,sBAAA;;;;EAKA,qBAAA;;;;EAKA,iBAAA;;;;EAKA,uBAAA;;;;EAKA,YAAA;;;;EAKA,WAAA;;;;EAKA,WAAA;;;;;;;;;;;;;EAcA,kBAAA;AAAA"}
+{"version":3,"file":"error-codes.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/error-codes.ts"],"mappings":";;;;;;;;;;oBASY;;;;;EAKV;;;;EAKA;;;;EAKA;;;;EAKA;;;;EAKA;;;;EAKA;;;;EAKA;;;;;;;;;;;;;EAcA"}

package/esm/http/error-mapper.d.mts

@@ -1,11 +1,10 @@
 import { HttpError } from "./errors/errors.mjs";
 import { Request } from "./request.mjs";
-
 //#region ../../packages/core/src/http/error-mapper.d.ts
 /**
  * What an {@link HttpErrorMapper} answers for an error it recognises.
  */
-type HttpErrorMapping = {
+export type HttpErrorMapping = {
   /**
    * The HTTP status to answer with.
    */
@@ -42,7 +41,6 @@ type HttpErrorMapping = {
  * }
  * ```
  */
-type HttpErrorMapper = (error: unknown, request: Request<any>) => HttpErrorMapping | HttpError | null | undefined;
+export type HttpErrorMapper = (error: unknown, request: Request<any>) => HttpErrorMapping | HttpError | null | undefined;
 //#endregion
-export { HttpErrorMapper, HttpErrorMapping };
 //# sourceMappingURL=error-mapper.d.mts.map

package/esm/http/error-mapper.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"error-mapper.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/error-mapper.ts"],"mappings":";;;;;;AAQA;KAAY,gBAAA;;;;EAIV,MAAA;EAUA;;AAAO;AAwBT;;EA5BE,OAAA;EA8BS;;;EA1BT,OAAA;AAAA;;;;;;;AA2B+B;;;;;;;;;;;;;;;KAHrB,eAAA,IACV,KAAA,WACA,OAAA,EAAS,OAAA,UACN,gBAAA,GAAmB,SAAA"}
+{"version":3,"file":"error-mapper.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/error-mapper.ts"],"mappings":";;;;;;YAQY;;;;EAIV;;;;;;EAMA;;;;EAIA;;;;;;;;;;;;;;;;;;;;;;;YAwBU,mBACV,gBACA,SAAS,iBACN,mBAAmB"}

package/esm/http/error-mapper.mjs

@@ -1,5 +1,5 @@
 import { HttpError } from "./errors/errors.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { log } from "@warlock.js/logger";
 
 //#region ../../packages/core/src/http/error-mapper.ts
@@ -17,7 +17,7 @@ const OPAQUE_SERVER_ERROR = "Internal server error.";
 */
 function mapRequestError(error, request) {
 	if (error instanceof HttpError) return error;
-	const mapper = config.get("http.errorMapper");
+	const mapper = baseConfig.get("http.errorMapper");
 	if (typeof mapper !== "function") return error;
 	let mapping;
 	try {

package/esm/http/error-mapper.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error-mapper.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/error-mapper.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { HttpError } from \"./errors\";\nimport type { Request } from \"./request\";\n\n/**\n * What an {@link HttpErrorMapper} answers for an error it recognises.\n */\nexport type HttpErrorMapping = {\n  /**\n   * The HTTP status to answer with.\n   */\n  status: number;\n  /**\n   * The message sent as `{ error }`. Defaults to the original error's message\n   * for a 4xx and to the opaque `\"Internal server error.\"` for a 5xx, so a\n   * mapped server fault never echoes an internal message to the client.\n   */\n  message?: string;\n  /**\n   * Sent as `{ payload }`, like `HttpError.payload`.\n   */\n  payload?: unknown;\n};\n\n/**\n * `http.errorMapper`: turns an error thrown by middleware or a handler into an\n * HTTP answer. Lets domain errors that must also exist outside an HTTP process\n * (a worker, a CLI, a standalone helper) carry a status without extending\n * Core's `HttpError`.\n *\n * Called only for errors that are not already an `HttpError`. Return a\n * mapping (or an `HttpError`) to answer with it, or `undefined` to keep the\n * default handling (a model validation error keeps its configured status,\n * anything else is an opaque 500).\n *\n * @example\n * ```ts\n * errorMapper(error) {\n *   if (error instanceof DomainNotFoundError) return { status: 404 };\n *   if (error instanceof Error && typeof (error as any).status === \"number\") {\n *     return { status: (error as any).status };\n *   }\n * }\n * ```\n */\nexport type HttpErrorMapper = (\n  error: unknown,\n  request: Request<any>,\n) => HttpErrorMapping | HttpError | null | undefined;\n\nconst OPAQUE_SERVER_ERROR = \"Internal server error.\";\n\n/**\n * Run the configured `http.errorMapper` and normalise its answer to an\n * `HttpError`, or return the error unchanged when there is no mapper, the\n * error already is an `HttpError`, or the mapper declines it.\n *\n * The mapped `HttpError` keeps the original error's name and stack (for the\n * request log) and carries it as `cause`. A mapper that throws is a bug in the\n * app's mapper, not in the request: it is logged and the original error is\n * handled as if no mapper were configured.\n * @internal\n */\nexport function mapRequestError(error: unknown, request: Request<any>): unknown {\n  if (error instanceof HttpError) {\n    return error;\n  }\n\n  const mapper = config.get(\"http.errorMapper\") as HttpErrorMapper | undefined;\n\n  if (typeof mapper !== \"function\") {\n    return error;\n  }\n\n  let mapping: ReturnType<HttpErrorMapper>;\n\n  try {\n    mapping = mapper(error, request);\n  } catch (mapperError) {\n    log.error(\"http\", \"error-mapper\", mapperError, { requestId: request.id });\n\n    return error;\n  }\n\n  if (!mapping) {\n    return error;\n  }\n\n  if (mapping instanceof HttpError) {\n    return mapping;\n  }\n\n  if (!Number.isInteger(mapping.status) || mapping.status < 400 || mapping.status > 599) {\n    log.error(\n      \"http\",\n      \"error-mapper\",\n      new Error(`http.errorMapper returned an invalid status: ${String(mapping.status)}`),\n      { requestId: request.id },\n    );\n\n    return error;\n  }\n\n  const original = error instanceof Error ? error : undefined;\n  const message =\n    mapping.message ?? (mapping.status < 500 && original ? original.message : OPAQUE_SERVER_ERROR);\n\n  const mapped = new HttpError(mapping.status, message, mapping.payload);\n\n  if (original) {\n    mapped.name = original.name;\n    mapped.stack = original.stack;\n    mapped.cause = original;\n  }\n\n  return mapped;\n}\n"],"mappings":";;;;;AAmDA,MAAM,sBAAsB;;;;;;;;;;;;AAa5B,SAAgB,gBAAgB,OAAgB,SAAgC;CAC9E,IAAI,iBAAiB,WACnB,OAAO;CAGT,MAAM,SAAS,OAAO,IAAI,kBAAkB;CAE5C,IAAI,OAAO,WAAW,YACpB,OAAO;CAGT,IAAI;CAEJ,IAAI;EACF,UAAU,OAAO,OAAO,OAAO;CACjC,SAAS,aAAa;EACpB,IAAI,MAAM,QAAQ,gBAAgB,aAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;EAExE,OAAO;CACT;CAEA,IAAI,CAAC,SACH,OAAO;CAGT,IAAI,mBAAmB,WACrB,OAAO;CAGT,IAAI,CAAC,OAAO,UAAU,QAAQ,MAAM,KAAK,QAAQ,SAAS,OAAO,QAAQ,SAAS,KAAK;EACrF,IAAI,MACF,QACA,gCACA,IAAI,MAAM,gDAAgD,OAAO,QAAQ,MAAM,GAAG,GAClF,EAAE,WAAW,QAAQ,GAAG,CAC1B;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,iBAAiB,QAAQ,QAAQ;CAClD,MAAM,UACJ,QAAQ,YAAY,QAAQ,SAAS,OAAO,WAAW,SAAS,UAAU;CAE5E,MAAM,SAAS,IAAI,UAAU,QAAQ,QAAQ,SAAS,QAAQ,OAAO;CAErE,IAAI,UAAU;EACZ,OAAO,OAAO,SAAS;EACvB,OAAO,QAAQ,SAAS;EACxB,OAAO,QAAQ;CACjB;CAEA,OAAO;AACT"}
+{"version":3,"file":"error-mapper.mjs","names":["config"],"sources":["../../../../../../../../packages/core/src/http/error-mapper.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { log } from \"@warlock.js/logger\";\nimport { HttpError } from \"./errors\";\nimport type { Request } from \"./request\";\n\n/**\n * What an {@link HttpErrorMapper} answers for an error it recognises.\n */\nexport type HttpErrorMapping = {\n  /**\n   * The HTTP status to answer with.\n   */\n  status: number;\n  /**\n   * The message sent as `{ error }`. Defaults to the original error's message\n   * for a 4xx and to the opaque `\"Internal server error.\"` for a 5xx, so a\n   * mapped server fault never echoes an internal message to the client.\n   */\n  message?: string;\n  /**\n   * Sent as `{ payload }`, like `HttpError.payload`.\n   */\n  payload?: unknown;\n};\n\n/**\n * `http.errorMapper`: turns an error thrown by middleware or a handler into an\n * HTTP answer. Lets domain errors that must also exist outside an HTTP process\n * (a worker, a CLI, a standalone helper) carry a status without extending\n * Core's `HttpError`.\n *\n * Called only for errors that are not already an `HttpError`. Return a\n * mapping (or an `HttpError`) to answer with it, or `undefined` to keep the\n * default handling (a model validation error keeps its configured status,\n * anything else is an opaque 500).\n *\n * @example\n * ```ts\n * errorMapper(error) {\n *   if (error instanceof DomainNotFoundError) return { status: 404 };\n *   if (error instanceof Error && typeof (error as any).status === \"number\") {\n *     return { status: (error as any).status };\n *   }\n * }\n * ```\n */\nexport type HttpErrorMapper = (\n  error: unknown,\n  request: Request<any>,\n) => HttpErrorMapping | HttpError | null | undefined;\n\nconst OPAQUE_SERVER_ERROR = \"Internal server error.\";\n\n/**\n * Run the configured `http.errorMapper` and normalise its answer to an\n * `HttpError`, or return the error unchanged when there is no mapper, the\n * error already is an `HttpError`, or the mapper declines it.\n *\n * The mapped `HttpError` keeps the original error's name and stack (for the\n * request log) and carries it as `cause`. A mapper that throws is a bug in the\n * app's mapper, not in the request: it is logged and the original error is\n * handled as if no mapper were configured.\n * @internal\n */\nexport function mapRequestError(error: unknown, request: Request<any>): unknown {\n  if (error instanceof HttpError) {\n    return error;\n  }\n\n  const mapper = config.get(\"http.errorMapper\") as HttpErrorMapper | undefined;\n\n  if (typeof mapper !== \"function\") {\n    return error;\n  }\n\n  let mapping: ReturnType<HttpErrorMapper>;\n\n  try {\n    mapping = mapper(error, request);\n  } catch (mapperError) {\n    log.error(\"http\", \"error-mapper\", mapperError, { requestId: request.id });\n\n    return error;\n  }\n\n  if (!mapping) {\n    return error;\n  }\n\n  if (mapping instanceof HttpError) {\n    return mapping;\n  }\n\n  if (!Number.isInteger(mapping.status) || mapping.status < 400 || mapping.status > 599) {\n    log.error(\n      \"http\",\n      \"error-mapper\",\n      new Error(`http.errorMapper returned an invalid status: ${String(mapping.status)}`),\n      { requestId: request.id },\n    );\n\n    return error;\n  }\n\n  const original = error instanceof Error ? error : undefined;\n  const message =\n    mapping.message ?? (mapping.status < 500 && original ? original.message : OPAQUE_SERVER_ERROR);\n\n  const mapped = new HttpError(mapping.status, message, mapping.payload);\n\n  if (original) {\n    mapped.name = original.name;\n    mapped.stack = original.stack;\n    mapped.cause = original;\n  }\n\n  return mapped;\n}\n"],"mappings":";;;;;AAmDA,MAAM,sBAAsB;;;;;;;;;;;;AAa5B,SAAgB,gBAAgB,OAAgB,SAAgC;CAC9E,IAAI,iBAAiB,WACnB,OAAO;CAGT,MAAM,SAASA,WAAO,IAAI,kBAAkB;CAE5C,IAAI,OAAO,WAAW,YACpB,OAAO;CAGT,IAAI;CAEJ,IAAI;EACF,UAAU,OAAO,OAAO,OAAO;CACjC,SAAS,aAAa;EACpB,IAAI,MAAM,QAAQ,gBAAgB,aAAa,EAAE,WAAW,QAAQ,GAAG,CAAC;EAExE,OAAO;CACT;CAEA,IAAI,CAAC,SACH,OAAO;CAGT,IAAI,mBAAmB,WACrB,OAAO;CAGT,IAAI,CAAC,OAAO,UAAU,QAAQ,MAAM,KAAK,QAAQ,SAAS,OAAO,QAAQ,SAAS,KAAK;EACrF,IAAI,MACF,QACA,gCACA,IAAI,MAAM,gDAAgD,OAAO,QAAQ,MAAM,GAAG,GAClF,EAAE,WAAW,QAAQ,GAAG,CAC1B;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,iBAAiB,QAAQ,QAAQ;CAClD,MAAM,UACJ,QAAQ,YAAY,QAAQ,SAAS,OAAO,WAAW,SAAS,UAAU;CAE5E,MAAM,SAAS,IAAI,UAAU,QAAQ,QAAQ,SAAS,QAAQ,OAAO;CAErE,IAAI,UAAU;EACZ,OAAO,OAAO,SAAS;EACvB,OAAO,QAAQ,SAAS;EACxB,OAAO,QAAQ;CACjB;CAEA,OAAO;AACT"}

package/esm/http/errors/errors.d.mts

@@ -1,41 +1,41 @@
 //#region ../../packages/core/src/http/errors/errors.d.ts
-declare class HttpError extends Error {
+export declare class HttpError extends Error {
   status: number;
   message: string;
-  payload?: any | undefined;
-  constructor(status: number, message: string, payload?: any | undefined);
+  payload?: any;
+  constructor(status: number, message: string, payload?: any);
 }
-declare class ResourceNotFoundError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class ResourceNotFoundError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class UnAuthorizedError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class UnAuthorizedError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class ForbiddenError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class ForbiddenError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class BadRequestError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class BadRequestError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class ServerError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class ServerError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class ConflictError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class ConflictError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class NotAcceptableError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class NotAcceptableError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
-declare class NotAllowedError extends HttpError {
-  payload?: any | undefined;
-  constructor(message: string, payload?: any | undefined);
+export declare class NotAllowedError extends HttpError {
+  payload?: any;
+  constructor(message: string, payload?: any);
 }
 /**
  * Thrown by `Request.prototype.cookie` / `Request.prototype.hasCookie` when
@@ -49,11 +49,10 @@ declare class NotAllowedError extends HttpError {
  * stays lenient because the framework's own opportunistic reads (e.g.
  * locale resolution) must not throw on a request that simply has no jar.
  */
-declare class CookieJarUnavailableError extends Error {
+export declare class CookieJarUnavailableError extends Error {
   /** Stable Warlock error code; `warlock explain WL5001` prints the fix. */
   readonly code = "WL5001";
   constructor(cookieName: string);
 }
 //#endregion
-export { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError };
 //# sourceMappingURL=errors.d.mts.map

package/esm/http/errors/errors.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/errors/errors.ts"],"mappings":";cAAa,SAAA,SAAkB,KAAK;EAEzB,MAAA;EACA,OAAA;EACA,OAAA;cAFA,MAAA,UACA,OAAA,UACA,OAAA;AAAA;AAAA,cAOE,qBAAA,SAA8B,SAAS;EAGzC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,iBAAA,SAA0B,SAAS;EAGrC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,cAAA,SAAuB,SAAS;EAGlC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,WAAA,SAAoB,SAAS;EAG/B,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,aAAA,SAAsB,SAAS;EAGjC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,kBAAA,SAA2B,SAAS;EAGtC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;AAAA,cAOE,eAAA,SAAwB,SAAS;EAGnC,OAAA;cADP,OAAA,UACO,OAAA;AAAA;;;;;;;;;;AAlDa;AAOxB;;cA8Da,yBAAA,SAAkC,KAAK;EA9DN;EAAA,SAgE5B,IAAA;cAEG,UAAA;AAAA"}
+{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/errors/errors.ts"],"mappings":";qBAAa,kBAAkB;EAEpB;EACA;EACA;EAHT,YACS,gBACA,iBACA;;qBAOE,8BAA8B;EAGhC;EAFT,YACE,iBACO;;qBAOE,0BAA0B;EAG5B;EAFT,YACE,iBACO;;qBAOE,uBAAuB;EAGzB;EAFT,YACE,iBACO;;qBAOE,wBAAwB;EAG1B;EAFT,YACE,iBACO;;qBAOE,oBAAoB;EAGtB;EAFT,YACE,iBACO;;qBAOE,sBAAsB;EAGxB;EAFT,YACE,iBACO;;qBAOE,2BAA2B;EAG7B;EAFT,YACE,iBACO;;qBAOE,wBAAwB;EAG1B;EAFT,YACE,iBACO;;;;;;;;;;;;;;qBAmBE,kCAAkC;;WAE7B;EAEhB,YAAmB"}

package/esm/http/escape-header-value.d.mts

@@ -12,7 +12,6 @@
  * @example
  * response.header("X-Export-Name", escapeHeaderValue(request.input("name")));
  */
-declare function escapeHeaderValue(value: unknown): string;
+export declare function escapeHeaderValue(value: unknown): string;
 //#endregion
-export { escapeHeaderValue };
 //# sourceMappingURL=escape-header-value.d.mts.map

package/esm/http/escape-header-value.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"escape-header-value.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/escape-header-value.ts"],"mappings":";;AAsBA;;;;AAAgD;;;;;;;;iBAAhC,iBAAA,CAAkB,KAAc"}
+{"version":3,"file":"escape-header-value.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/escape-header-value.ts"],"mappings":";;;;;;;;;;;;;;wBAsBgB,kBAAkB"}

package/esm/http/events.d.mts

@@ -1,8 +1,6 @@
 import { Response } from "./response.mjs";
-
 //#region ../../packages/core/src/http/events.d.ts
-declare function logResponse(response: Response): void;
-declare function wrapResponseInDataKey(response: Response): void;
+export declare function logResponse(response: Response): void;
+export declare function wrapResponseInDataKey(response: Response): void;
 //#endregion
-export { logResponse, wrapResponseInDataKey };
 //# sourceMappingURL=events.d.mts.map

package/esm/http/events.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/events.ts"],"mappings":";;;iBAGgB,WAAA,CAAY,QAAkB,EAAR,QAAQ;AAAA,iBAoB9B,qBAAA,CAAsB,QAAkB,EAAR,QAAQ"}
+{"version":3,"file":"events.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/events.ts"],"mappings":";;wBAGgB,YAAY,UAAU;wBAoBtB,sBAAsB,UAAU"}

package/esm/http/health.d.mts

@@ -3,12 +3,12 @@
  * A readiness probe registered via `health.addCheck(...)`. Returns whether its
  * dependency is currently usable; throwing is treated as a failed check.
  */
-type HealthCheck = () => boolean | Promise<boolean>;
+export type HealthCheck = () => boolean | Promise<boolean>;
 /**
  * Result of a liveness/readiness probe. `checks` is present on readiness only,
  * mapping each registered check name to its pass/fail.
  */
-type HealthStatus = {
+export type HealthStatus = {
   status: "ok" | "error";
   checks?: Record<string, boolean>;
 };
@@ -65,7 +65,7 @@ declare class HealthRegistry {
 /**
  * The application's health registry singleton.
  */
-declare const health: HealthRegistry;
+export declare const health: HealthRegistry;
 //#endregion
-export { HealthCheck, HealthStatus, health };
+export {};
 //# sourceMappingURL=health.d.mts.map

package/esm/http/health.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/health.ts"],"mappings":";;AAMA;;;KAAY,WAAA,mBAA8B,OAAO;AAAA;AAMjD;;;AANiD,KAMrC,YAAA;EACV,MAAA;EACA,MAAA,GAAS,MAAM;AAAA;;AAAA;AACf;;;;;cASI,cAAA;EAAA,iBACa,MAAA;EA6BgB;;;EAxB1B,QAAA,CAAS,IAAA,UAAc,KAAA,EAAO,WAAA;EAArB;;;EAOT,WAAA,CAAY,IAAA;EAAA;;;;EAQZ,QAAA,IAAY,YAAA;EASe;;;;;EAArB,SAAA,IAAa,OAAA,CAAQ,YAAA;EA2CZ;AAYxB;;;;AAA0C;;;;;;;;EAtBjC,wBAAA,CAAyB,aAAA,gBAA6B,IAAA;;;;;;;UAU/C,QAAA;AAAA;;;;cAYH,MAAA,EAAM,cAAuB"}
+{"version":3,"file":"health.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/health.ts"],"mappings":";;;;;YAMY,8BAA8B;;;;;YAM9B;EACV;EACA,SAAS;;;;;;;;;cAUL;mBACa;;;;EAKV,SAAS,cAAc,OAAO;;;;EAO9B,YAAY;;;;;EAQZ,YAAY;;;;;;EASN,aAAa,QAAQ;;;;;;;;;;;;;;EAiC3B,yBAAyB,6BAA6B;;;;;;;UAU/C;;;;;qBAYH,QAAM"}

package/esm/http/index.d.mts

@@ -27,6 +27,7 @@ import { ImageVariantsConfigError } from "./uploads/image-variants-config-error.
 import { PurgeImageVariantsOptions, purgeImageVariants } from "./uploads/purge-image-variants.mjs";
 import { ResolveImageVariantInput, ResolvedImageVariant, resolveImageVariant } from "./uploads/resolve-image-variant.mjs";
 import { UploadedFileControllerOptions, createUploadedFileController, uploadedFileController } from "./uploads/uploaded-file.controller.mjs";
+import "./uploads/index.mjs";
 import { CacheMiddlewareOptions } from "./middleware/cache-response-middleware.mjs";
 import { ConcurrencyLimitOptions } from "./middleware/concurrency-limit.middleware.mjs";
 import { IdempotencyOptions } from "./middleware/idempotency.middleware.mjs";
@@ -38,6 +39,7 @@ import { createRequestStore, t } from "./middleware/inject-request-context.mjs";
 import { anyMatch, ipMatches } from "./middleware/utils/cidr-match.mjs";
 import { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from "./middleware/utils/idempotency-key.mjs";
 import { parseSize } from "./middleware/utils/parse-size.mjs";
+import "./middleware/index.mjs";
 import { ClosableServer, FastifyInstance, beginHttpDrain, closeServerWithTimeout, getHttpServer, startHttpServer, trackConnectionsForDrain } from "./server.mjs";
 import { registerHttpPlugins, resolvePublicRoot } from "./plugins.mjs";
 import { assertConfiguredHttpPortIsFree, preflightConfiguredHttpPort, remedyLines, shouldPreflightHttpPort } from "./boot-port-preflight.mjs";
@@ -50,4 +52,5 @@ import { deriveTraceId, parseTraceparentTraceId } from "./tracing/trace-id.mjs";
 import { TracingContextSource, buildTracingContext, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled, registerTracingHooks, resetTracingConfigForTests, resolveTracingConfig } from "./tracing/tracing-dispatcher.mjs";
 import { RequestContextStore, requestContext, useCurrentUser, useRequest, useRequestStore } from "./context/request-context.mjs";
 import { requestMemo } from "./context/request-memo.mjs";
-import { ModelResourceRegistry, Serialized, SerializedWire } from "./serialized.mjs";
+import { ModelResourceRegistry, Serialized, SerializedWire } from "./serialized.mjs";
+export { BadRequestError, type CacheMiddlewareOptions, ClosableServer, type ConcurrencyLimitOptions, ConditionalRequestInput, ConditionalRequestOutcome, ConflictError, CookieJarUnavailableError, CookieOptions, CspConfig, CsrfOriginCheckReason, CsrfOriginVerdict, DEFAULT_CSP_DIRECTIVES, DecodedAccessToken, DetectedImageFormat, EntityTag, FastifyInstance, FileNamingStrategy, FileValidationOptions, ForbiddenError, GenerateImageVariantsOptions, GeneratedImageDescriptor, GeneratedImageVariant, HealthCheck, HealthStatus, HttpConfigurations, HttpError, HttpErrorCodes, type HttpErrorMapper, type HttpErrorMapping, HttpLoggingConfig, HttpReadyReport, HttpServerOptions, HttpServerRebuiltListener, HttpTracingConfig, type IdempotencyOptions, ImageTransformCallback, ImageTransformConfig, ImageVariantDefinition, ImageVariantFit, ImageVariantOutputFormat, ImageVariantsConfigError, InvalidCspDirectiveError, type IpFilterOptions, type MaintenanceOptions, ModelResourceRegistry, NotAcceptableError, NotAllowedError, PartialMiddleware, PipeableReactStream, PortInUseError, PrefixConfig, PrefixOptions, PrivateRequestLoggingRule, PurgeImageVariantsOptions, type RateLimitOptions, Request, RequestContextStore, RequestController, RequestEvent, RequestLocals, RequestLog, RequestLogSnapshot, RequestLogSource, RequestLoggingOptions, RequestTranslator, ResolveImageVariantInput, ResolvedImageVariant, ResolvedImageVariantsConfig, ResourceNotFoundError, Response, ResponseEvent, ResponseSSEController, ResponseSSEMessageOptions, ResponseSSEOptions, ResponseStatus, ResponseStreamController, ResponseStreamOptions, ReturnedResponse, SafeRedirectOptions, SaveAsOptions, SaveOptions, SendBufferOptions, SendFileOptions, Serialized, SerializedWire, ServerError, StreamReactResponseOptions, TracingContext, TracingContextSource, TracingHooks, TracingPhaseInfo, TracingRequestEndInfo, UPLOADS_DEFAULTS, URL_CREDENTIAL_PARAMS, UnAuthorizedError, UploadedFile, UploadedFileControllerOptions, UploadedFileImageOptions, UploadedFileJson, UploadedFileQuery, UploadsConfigurations, UploadsImagesConfigurations, VariantOutputFormat, VariantSourceFormat, XMLable, anyMatch, applyCspHeader, assertConfiguredHttpPortIsFree, assertPortIsAvailable, beginHttpDrain, buildCspHeaderValue, buildIdempotencyCacheKey, buildRequestLogSnapshot, buildTracingContext, closeServerWithTimeout, createHttpApplication, createRequestStore, createUploadedFileController, defaultHttpConfigurations, deriveTraceId, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, escapeHeaderValue, evaluateConditionalRequest, generateImageVariants, getHttpReadyReport, getHttpServer, hashBody, health, httpConfig, ipMatches, isAllowedCsrfOrigin, isPortAvailable, isSafeRedirect, isTracingEnabled, isValidIdempotencyKey, logResponse, matchesIfMatch, matchesIfNoneMatch, mergeCspDirectives, middleware, normalizeOrigin, notifyHttpServerRebuilt, onHttpServerRebuilt, originOf, ownOrigin, parseEntityTag, parseEntityTagList, parseSize, parseTraceparentTraceId, preflightConfiguredHttpPort, purgeImageVariants, redactQueryCredentials, redactUrlCredentials, registerHttpPlugins, registerTracingHooks, remedyLines, requestContext, requestMemo, requiresDefaultCsrfGuard, resetHttpReadyReport, resetTracingConfigForTests, resolveCspConfig, resolveCsrfOriginVerdict, resolveImageVariant, resolvePublicRoot, resolveRequestLoggingOptions, resolveTracingConfig, runDefaultCsrfGuard, safeRedirect, serializeCspDirectives, setHttpReadyReport, shouldPreflightHttpPort, startHttpServer, stopHttpApplication, streamReactResponse, strongEntityTagMatch, t, toSingleLineSseField, trackConnectionsForDrain, uploadedFileController, uploadsConfig, useCurrentUser, useRequest, useRequestStore, validateCspConfigAtBoot, validateCspDirectives, weakEntityTagMatch, wrapResponseInDataKey };

package/esm/http/index.mjs

@@ -42,4 +42,4 @@ import { escapeHeaderValue } from "./escape-header-value.mjs";
 import { isSafeRedirect, safeRedirect } from "./safe-redirect.mjs";
 import { requestMemo } from "./context/request-memo.mjs";
 
-export {  };
+export { BadRequestError, ConflictError, CookieJarUnavailableError, DEFAULT_CSP_DIRECTIVES, ForbiddenError, HttpError, HttpErrorCodes, ImageVariantsConfigError, InvalidCspDirectiveError, NotAcceptableError, NotAllowedError, PortInUseError, Request, RequestController, RequestLog, ResourceNotFoundError, Response, ResponseStatus, ServerError, UPLOADS_DEFAULTS, URL_CREDENTIAL_PARAMS, UnAuthorizedError, UploadedFile, anyMatch, applyCspHeader, assertConfiguredHttpPortIsFree, assertPortIsAvailable, beginHttpDrain, buildCspHeaderValue, buildIdempotencyCacheKey, buildRequestLogSnapshot, buildTracingContext, closeServerWithTimeout, createHttpApplication, createRequestStore, createUploadedFileController, defaultHttpConfigurations, deriveTraceId, dispatchPhase, dispatchRequestEnd, dispatchRequestStart, escapeHeaderValue, evaluateConditionalRequest, generateImageVariants, getHttpReadyReport, getHttpServer, hashBody, health, httpConfig, ipMatches, isAllowedCsrfOrigin, isPortAvailable, isSafeRedirect, isTracingEnabled, isValidIdempotencyKey, logResponse, matchesIfMatch, matchesIfNoneMatch, mergeCspDirectives, middleware, normalizeOrigin, notifyHttpServerRebuilt, onHttpServerRebuilt, originOf, ownOrigin, parseEntityTag, parseEntityTagList, parseSize, parseTraceparentTraceId, preflightConfiguredHttpPort, purgeImageVariants, redactQueryCredentials, redactUrlCredentials, registerHttpPlugins, registerTracingHooks, remedyLines, requestContext, requestMemo, requiresDefaultCsrfGuard, resetHttpReadyReport, resetTracingConfigForTests, resolveCspConfig, resolveCsrfOriginVerdict, resolveImageVariant, resolvePublicRoot, resolveRequestLoggingOptions, resolveTracingConfig, runDefaultCsrfGuard, safeRedirect, serializeCspDirectives, setHttpReadyReport, shouldPreflightHttpPort, startHttpServer, stopHttpApplication, streamReactResponse, strongEntityTagMatch, t, toSingleLineSseField, trackConnectionsForDrain, uploadedFileController, uploadsConfig, useCurrentUser, useRequest, useRequestStore, validateCspConfigAtBoot, validateCspDirectives, weakEntityTagMatch, wrapResponseInDataKey };

package/esm/http/middleware/cache-response-middleware.d.mts

@@ -1,8 +1,7 @@
 import { Request } from "../request.mjs";
 import { Middleware } from "../../router/types.mjs";
-
 //#region ../../packages/core/src/http/middleware/cache-response-middleware.d.ts
-type CacheMiddlewareOptions = {
+export type CacheMiddlewareOptions = {
   /**
    * Cache key
    */
@@ -44,7 +43,6 @@ type CacheMiddlewareOptions = {
    */
   tags?: string[] | ((request: Request) => string[]);
 };
-declare function cacheMiddleware(responseCacheOptions: CacheMiddlewareOptions | string): Middleware;
+export declare function cacheMiddleware(responseCacheOptions: CacheMiddlewareOptions | string): Middleware;
 //#endregion
-export { CacheMiddlewareOptions, cacheMiddleware };
 //# sourceMappingURL=cache-response-middleware.d.mts.map

package/esm/http/middleware/cache-response-middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cache-response-middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/cache-response-middleware.ts"],"mappings":";;;;KAsBY,sBAAA;;AAAZ;;EAIE,QAAA,aAAqB,OAAA,EAAS,OAAA,iBAAwB,OAAA,EAAS,OAAA,KAAY,OAAA;EAA7C;;;;;;EAO9B,UAAA;EAP8B;;;;;EAa9B,IAAA;EAAA;;;EAIA,GAAA;EAmB6B;;;AAAO;AA+DtC;;EA3EE,MAAA;EA2EgG;;;;;AAAA;;;;;;EA/DhG,IAAA,gBAAoB,OAAA,EAAS,OAAA;AAAA;AAAA,iBA+Df,eAAA,CAAgB,oBAAA,EAAsB,sBAAA,YAAkC,UAAU"}
+{"version":3,"file":"cache-response-middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/cache-response-middleware.ts"],"mappings":";;;YAsBY;;;;EAIV,qBAAqB,SAAS,wBAAwB,SAAS,YAAY;;;;;;;EAO3E;;;;;;EAMA;;;;EAIA;;;;;;;EAOA;;;;;;;;;;;;EAYA,oBAAoB,SAAS;;wBA+Df,gBAAgB,sBAAsB,kCAAkC"}

package/esm/http/middleware/concurrency-limit.middleware.d.mts

@@ -1,10 +1,11 @@
 import { Request } from "../request.mjs";
 import { Middleware } from "../../router/types.mjs";
+import "../../router/index.mjs";
 //#region ../../packages/core/src/http/middleware/concurrency-limit.middleware.d.ts
 /**
  * Options for the concurrency limit middleware.
  */
-type ConcurrencyLimitOptions = {
+export type ConcurrencyLimitOptions = {
   /**
    * Group key generator. Defaults to `request.route.path` — i.e. the cap
    * applies across all callers of that route. Override to scope per-user
@@ -47,7 +48,6 @@ type ConcurrencyLimitOptions = {
  *   ],
  * });
  */
-declare function concurrencyLimitMiddleware(max: number, options?: ConcurrencyLimitOptions): Middleware;
+export declare function concurrencyLimitMiddleware(max: number, options?: ConcurrencyLimitOptions): Middleware;
 //#endregion
-export { ConcurrencyLimitOptions, concurrencyLimitMiddleware };
 //# sourceMappingURL=concurrency-limit.middleware.d.mts.map

package/esm/http/middleware/concurrency-limit.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"concurrency-limit.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/concurrency-limit.middleware.ts"],"mappings":";;;;;;KASY,uBAAA;EAAuB;;;;;;;;EASjC,YAAA,IAAgB,OAAA,EAAS,OAAO;EAiDlB;;;EA7Cd,YAAA;AAAA;;;;;AAgDW;;;;;;;;;;;;;;;;;;;;;;;;iBAHG,0BAAA,CACd,GAAA,UACA,OAAA,GAAS,uBAAA,GACR,UAAU"}
+{"version":3,"file":"concurrency-limit.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/concurrency-limit.middleware.ts"],"mappings":";;;;;;;YASY;;;;;;;;;EASV,gBAAgB,SAAS;;;;EAIzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6Cc,2BACd,aACA,UAAS,0BACR"}

package/esm/http/middleware/idempotency.middleware.d.mts

@@ -1,9 +1,10 @@
 import { Middleware } from "../../router/types.mjs";
+import "../../router/index.mjs";
 //#region ../../packages/core/src/http/middleware/idempotency.middleware.d.ts
 /**
  * Options for the idempotency middleware.
  */
-type IdempotencyOptions = {
+export type IdempotencyOptions = {
   /**
    * Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).
    */
@@ -60,7 +61,6 @@ type IdempotencyOptions = {
  *   ],
  * });
  */
-declare function idempotencyMiddleware(options?: IdempotencyOptions): Middleware;
+export declare function idempotencyMiddleware(options?: IdempotencyOptions): Middleware;
 //#endregion
-export { IdempotencyOptions, idempotencyMiddleware };
 //# sourceMappingURL=idempotency.middleware.d.mts.map

package/esm/http/middleware/idempotency.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/idempotency.middleware.ts"],"mappings":";;;;;KAYY,kBAAA;EAAkB;;;EAI5B,GAAA;EAKA;;;;EAAA,cAAA;EAgBM;AA+CR;;;EA1DE,UAAA;EA0D6C;;;;AAAoC;EApDjF,OAAA;;;;;EAKA,MAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Cc,qBAAA,CAAsB,OAAA,GAAS,kBAAA,GAA0B,UAAU"}
+{"version":3,"file":"idempotency.middleware.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/idempotency.middleware.ts"],"mappings":";;;;;;YAYY;;;;EAIV;;;;;EAKA;;;;;EAKA;;;;;;EAMA;;;;;EAKA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA+Cc,sBAAsB,UAAS,qBAA0B"}

package/esm/http/middleware/idempotency.middleware.mjs

@@ -1,7 +1,7 @@
 import { HttpErrorCodes } from "../error-codes.mjs";
 import { t } from "./inject-request-context.mjs";
 import { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from "./utils/idempotency-key.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { log } from "@warlock.js/logger";
 import { cache } from "@warlock.js/cache";
 
@@ -44,11 +44,11 @@ const DEFAULT_METHODS = [
 */
 function idempotencyMiddleware(options = {}) {
 	return async ({ request, response }) => {
-		const headerName = options.headerName || config.get("http.idempotency.headerName", "Idempotency-Key");
-		const methods = options.methods || config.get("http.idempotency.methods", DEFAULT_METHODS);
-		const ttl = options.ttl || config.get("http.idempotency.ttl", 86400);
-		const reservationTtl = options.reservationTtl || config.get("http.idempotency.reservationTtl", 60);
-		const driverName = options.driver || config.get("http.idempotency.driver");
+		const headerName = options.headerName || baseConfig.get("http.idempotency.headerName", "Idempotency-Key");
+		const methods = options.methods || baseConfig.get("http.idempotency.methods", DEFAULT_METHODS);
+		const ttl = options.ttl || baseConfig.get("http.idempotency.ttl", 86400);
+		const reservationTtl = options.reservationTtl || baseConfig.get("http.idempotency.reservationTtl", 60);
+		const driverName = options.driver || baseConfig.get("http.idempotency.driver");
 		if (!methods.includes(request.method.toUpperCase())) return;
 		const idempotencyKey = request.header(headerName.toLowerCase());
 		if (!idempotencyKey) return;

package/esm/http/middleware/idempotency.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.middleware.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/http/middleware/idempotency.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\nimport { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from \"./utils/idempotency-key\";\n\n/**\n * Options for the idempotency middleware.\n */\nexport type IdempotencyOptions = {\n  /**\n   * Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).\n   */\n  ttl?: number;\n  /**\n   * TTL in seconds of the in-flight reservation held while the handler runs.\n   * Falls back to `http.idempotency.reservationTtl`, then `60`.\n   */\n  reservationTtl?: number;\n  /**\n   * Header name carrying the client's key. Falls back to\n   * `http.idempotency.headerName`, then `\"Idempotency-Key\"`.\n   */\n  headerName?: string;\n  /**\n   * HTTP methods eligible for idempotency. Falls back to\n   * `http.idempotency.methods`, then `[\"POST\",\"PUT\",\"PATCH\",\"DELETE\"]`.\n   * Safe methods (GET/HEAD) are skipped regardless.\n   */\n  methods?: string[];\n  /**\n   * Cache driver name. Falls back to `http.idempotency.driver`, then the\n   * default driver of the cache manager.\n   */\n  driver?: string;\n};\n\ntype CachedResponse = {\n  status: number;\n  body: unknown;\n  bodyHash: string;\n  contentType?: string;\n};\n\ntype InFlightReservation = {\n  state: \"in-flight\";\n  startedAt: number;\n};\n\nconst DEFAULT_METHODS = [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"];\n\n/**\n * Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,\n * same body, within TTL → cached replay; same key, different body → 422\n * `IdempotencyKeyConflict`.\n *\n * **Must run after `authMiddleware`** — the cache key is scoped per-user\n * (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.\n * Anonymous requests fall back to IP scope.\n *\n * The replay sets `Idempotent-Replay: true` on the response for easy\n * client-side / observability detection.\n *\n * Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through\n * even with the header set (RFC: safe methods are already idempotent).\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [authMiddleware(\"client\"), middleware.idempotency()],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries\n *   ],\n * });\n */\nexport function idempotencyMiddleware(options: IdempotencyOptions = {}): Middleware {\n  return async ({ request, response }) => {\n    const headerName =\n      options.headerName || config.get(\"http.idempotency.headerName\", \"Idempotency-Key\");\n    const methods = options.methods || config.get(\"http.idempotency.methods\", DEFAULT_METHODS);\n    const ttl = options.ttl || config.get(\"http.idempotency.ttl\", 86400);\n    const reservationTtl =\n      options.reservationTtl || config.get(\"http.idempotency.reservationTtl\", 60);\n    const driverName = options.driver || config.get(\"http.idempotency.driver\");\n\n    if (!methods.includes(request.method.toUpperCase())) return;\n\n    const idempotencyKey = request.header(headerName.toLowerCase());\n\n    if (!idempotencyKey) return;\n\n    if (!isValidIdempotencyKey(idempotencyKey)) {\n      return response.badRequest({\n        error: t(\"http.idempotencyKeyInvalid\"),\n        errorCode: HttpErrorCodes.IdempotencyKeyInvalid,\n      });\n    }\n\n    const cacheDriver = driverName ? await cache.use(driverName) : cache;\n    const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);\n    const bodyHash = hashBody(request.body);\n\n    const respondToExisting = (\n      existing: CachedResponse | InFlightReservation | undefined | null,\n    ) => {\n      if (!existing || (existing as InFlightReservation).state === \"in-flight\") {\n        response.header(\"Retry-After\", \"1\");\n\n        return response.conflict({\n          error: \"A request with this Idempotency-Key is already in progress\",\n          errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n        });\n      }\n\n      const cached = existing as CachedResponse;\n\n      if (cached.bodyHash !== bodyHash) {\n        return response.unprocessableEntity({\n          error: t(\"http.idempotencyKeyConflict\"),\n          errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n        });\n      }\n\n      response.header(\"Idempotent-Replay\", \"true\");\n\n      return response.replay({\n        status: cached.status,\n        body: cached.body,\n        contentType: cached.contentType,\n      });\n    };\n\n    // Fast path: a finished (or in-flight) request is already recorded.\n    let existing: CachedResponse | InFlightReservation | null = null;\n\n    try {\n      existing = (await cacheDriver.get(cacheKey)) as CachedResponse | InFlightReservation | null;\n    } catch (error) {\n      // The cache is an optimisation of idempotency, not a gate on writes:\n      // when it is down, fail open (the handler runs) and log it.\n      log.error(\"idempotency-middleware\", \"get\", error);\n    }\n\n    if (existing) return respondToExisting(existing);\n\n    // Reserve the key atomically before the handler runs, so concurrent\n    // requests with the same key can't both execute it.\n    try {\n      const reservation = (await cacheDriver.set(\n        cacheKey,\n        { state: \"in-flight\", startedAt: Date.now() } satisfies InFlightReservation,\n        { onConflict: \"create\", ttl: reservationTtl },\n      )) as { wasSet?: boolean; existing?: CachedResponse | InFlightReservation } | undefined;\n\n      if (reservation && reservation.wasSet === false) {\n        return respondToExisting(reservation.existing);\n      }\n    } catch (error) {\n      log.error(\"idempotency-middleware\", \"reserve\", error);\n    }\n\n    response.onSent((sentResponse: Response) => {\n      // Don't cache server errors — clients should be able to retry past a 5xx.\n      // 4xx are deterministic outcomes of the request, so caching is fine.\n      // Free the reservation so a retry can run.\n      if (sentResponse.statusCode >= 500) {\n        // Wrapped so a synchronous throw is caught as well as a rejection.\n        Promise.resolve()\n          .then(() => cacheDriver.remove(cacheKey))\n          .catch((error: unknown) => {\n            log.error(\"idempotency-middleware\", \"remove\", error);\n          });\n\n        return;\n      }\n\n      const sentContentType = sentResponse.contentType;\n\n      // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n      // write (e.g. Redis down) would surface as an unhandledRejection.\n      cacheDriver\n        .set(\n          cacheKey,\n          {\n            status: sentResponse.statusCode,\n            body: sentResponse.parsedBody,\n            bodyHash,\n            contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n          },\n          ttl,\n        )\n        .catch((error: unknown) => {\n          log.error(\"idempotency-middleware\", \"set\", error);\n        });\n    });\n  };\n}\n"],"mappings":";;;;;;;;AAoDA,MAAM,kBAAkB;CAAC;CAAQ;CAAO;CAAS;AAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCzD,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,aACJ,QAAQ,cAAc,OAAO,IAAI,+BAA+B,iBAAiB;EACnF,MAAM,UAAU,QAAQ,WAAW,OAAO,IAAI,4BAA4B,eAAe;EACzF,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAI,wBAAwB,KAAK;EACnE,MAAM,iBACJ,QAAQ,kBAAkB,OAAO,IAAI,mCAAmC,EAAE;EAC5E,MAAM,aAAa,QAAQ,UAAU,OAAO,IAAI,yBAAyB;EAEzE,IAAI,CAAC,QAAQ,SAAS,QAAQ,OAAO,YAAY,CAAC,GAAG;EAErD,MAAM,iBAAiB,QAAQ,OAAO,WAAW,YAAY,CAAC;EAE9D,IAAI,CAAC,gBAAgB;EAErB,IAAI,CAAC,sBAAsB,cAAc,GACvC,OAAO,SAAS,WAAW;GACzB,OAAO,EAAE,4BAA4B;GACrC;EACF,CAAC;EAGH,MAAM,cAAc,aAAa,MAAM,MAAM,IAAI,UAAU,IAAI;EAC/D,MAAM,WAAW,yBAAyB,SAAS,cAAc;EACjE,MAAM,WAAW,SAAS,QAAQ,IAAI;EAEtC,MAAM,qBACJ,aACG;GACH,IAAI,CAAC,YAAa,SAAiC,UAAU,aAAa;IACxE,SAAS,OAAO,eAAe,GAAG;IAElC,OAAO,SAAS,SAAS;KACvB,OAAO;KACP;IACF,CAAC;GACH;GAEA,MAAM,SAAS;GAEf,IAAI,OAAO,aAAa,UACtB,OAAO,SAAS,oBAAoB;IAClC,OAAO,EAAE,6BAA6B;IACtC;GACF,CAAC;GAGH,SAAS,OAAO,qBAAqB,MAAM;GAE3C,OAAO,SAAS,OAAO;IACrB,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,aAAa,OAAO;GACtB,CAAC;EACH;EAGA,IAAI,WAAwD;EAE5D,IAAI;GACF,WAAY,MAAM,YAAY,IAAI,QAAQ;EAC5C,SAAS,OAAO;GAGd,IAAI,MAAM,0BAA0B,OAAO,KAAK;EAClD;EAEA,IAAI,UAAU,OAAO,kBAAkB,QAAQ;EAI/C,IAAI;GACF,MAAM,cAAe,MAAM,YAAY,IACrC,UACA;IAAE,OAAO;IAAa,WAAW,KAAK,IAAI;GAAE,GAC5C;IAAE,YAAY;IAAU,KAAK;GAAe,CAC9C;GAEA,IAAI,eAAe,YAAY,WAAW,OACxC,OAAO,kBAAkB,YAAY,QAAQ;EAEjD,SAAS,OAAO;GACd,IAAI,MAAM,0BAA0B,WAAW,KAAK;EACtD;EAEA,SAAS,QAAQ,iBAA2B;GAI1C,IAAI,aAAa,cAAc,KAAK;IAElC,QAAQ,QAAQ,CAAC,CACd,WAAW,YAAY,OAAO,QAAQ,CAAC,CAAC,CACxC,OAAO,UAAmB;KACzB,IAAI,MAAM,0BAA0B,UAAU,KAAK;IACrD,CAAC;IAEH;GACF;GAEA,MAAM,kBAAkB,aAAa;GAIrC,YACG,IACC,UACA;IACE,QAAQ,aAAa;IACrB,MAAM,aAAa;IACnB;IACA,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE,GACA,GACF,CAAC,CACA,OAAO,UAAmB;IACzB,IAAI,MAAM,0BAA0B,OAAO,KAAK;GAClD,CAAC;EACL,CAAC;CACH;AACF"}
+{"version":3,"file":"idempotency.middleware.mjs","names":["config"],"sources":["../../../../../../../../../packages/core/src/http/middleware/idempotency.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { cache } from \"@warlock.js/cache\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport type { Response } from \"../response\";\nimport { t } from \"./inject-request-context\";\nimport { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from \"./utils/idempotency-key\";\n\n/**\n * Options for the idempotency middleware.\n */\nexport type IdempotencyOptions = {\n  /**\n   * Cache TTL in seconds. Falls back to `http.idempotency.ttl`, then `86400` (24h).\n   */\n  ttl?: number;\n  /**\n   * TTL in seconds of the in-flight reservation held while the handler runs.\n   * Falls back to `http.idempotency.reservationTtl`, then `60`.\n   */\n  reservationTtl?: number;\n  /**\n   * Header name carrying the client's key. Falls back to\n   * `http.idempotency.headerName`, then `\"Idempotency-Key\"`.\n   */\n  headerName?: string;\n  /**\n   * HTTP methods eligible for idempotency. Falls back to\n   * `http.idempotency.methods`, then `[\"POST\",\"PUT\",\"PATCH\",\"DELETE\"]`.\n   * Safe methods (GET/HEAD) are skipped regardless.\n   */\n  methods?: string[];\n  /**\n   * Cache driver name. Falls back to `http.idempotency.driver`, then the\n   * default driver of the cache manager.\n   */\n  driver?: string;\n};\n\ntype CachedResponse = {\n  status: number;\n  body: unknown;\n  bodyHash: string;\n  contentType?: string;\n};\n\ntype InFlightReservation = {\n  state: \"in-flight\";\n  startedAt: number;\n};\n\nconst DEFAULT_METHODS = [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"];\n\n/**\n * Dedupe non-idempotent writes by an `Idempotency-Key` header — same key,\n * same body, within TTL → cached replay; same key, different body → 422\n * `IdempotencyKeyConflict`.\n *\n * **Must run after `authMiddleware`** — the cache key is scoped per-user\n * (`idem:{userType}:{userId}:{key}`) so user A can't replay user B's key.\n * Anonymous requests fall back to IP scope.\n *\n * The replay sets `Idempotent-Replay: true` on the response for easy\n * client-side / observability detection.\n *\n * Eligible methods default to POST/PUT/PATCH/DELETE. GET/HEAD pass through\n * even with the header set (RFC: safe methods are already idempotent).\n *\n * @example\n * import { authMiddleware } from \"@warlock.js/auth\";\n * import { middleware } from \"@warlock.js/core\";\n *\n * router.post(\"/orders\", createOrderController, {\n *   middleware: [authMiddleware(\"client\"), middleware.idempotency()],\n * });\n *\n * router.post(\"/ai/summarize\", summarizeController, {\n *   middleware: [\n *     authMiddleware(\"client\"),\n *     middleware.idempotency({ ttl: 60 * 60 }), // 1h is enough for client retries\n *   ],\n * });\n */\nexport function idempotencyMiddleware(options: IdempotencyOptions = {}): Middleware {\n  return async ({ request, response }) => {\n    const headerName =\n      options.headerName || config.get(\"http.idempotency.headerName\", \"Idempotency-Key\");\n    const methods = options.methods || config.get(\"http.idempotency.methods\", DEFAULT_METHODS);\n    const ttl = options.ttl || config.get(\"http.idempotency.ttl\", 86400);\n    const reservationTtl =\n      options.reservationTtl || config.get(\"http.idempotency.reservationTtl\", 60);\n    const driverName = options.driver || config.get(\"http.idempotency.driver\");\n\n    if (!methods.includes(request.method.toUpperCase())) return;\n\n    const idempotencyKey = request.header(headerName.toLowerCase());\n\n    if (!idempotencyKey) return;\n\n    if (!isValidIdempotencyKey(idempotencyKey)) {\n      return response.badRequest({\n        error: t(\"http.idempotencyKeyInvalid\"),\n        errorCode: HttpErrorCodes.IdempotencyKeyInvalid,\n      });\n    }\n\n    const cacheDriver = driverName ? await cache.use(driverName) : cache;\n    const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);\n    const bodyHash = hashBody(request.body);\n\n    const respondToExisting = (\n      existing: CachedResponse | InFlightReservation | undefined | null,\n    ) => {\n      if (!existing || (existing as InFlightReservation).state === \"in-flight\") {\n        response.header(\"Retry-After\", \"1\");\n\n        return response.conflict({\n          error: \"A request with this Idempotency-Key is already in progress\",\n          errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n        });\n      }\n\n      const cached = existing as CachedResponse;\n\n      if (cached.bodyHash !== bodyHash) {\n        return response.unprocessableEntity({\n          error: t(\"http.idempotencyKeyConflict\"),\n          errorCode: HttpErrorCodes.IdempotencyKeyConflict,\n        });\n      }\n\n      response.header(\"Idempotent-Replay\", \"true\");\n\n      return response.replay({\n        status: cached.status,\n        body: cached.body,\n        contentType: cached.contentType,\n      });\n    };\n\n    // Fast path: a finished (or in-flight) request is already recorded.\n    let existing: CachedResponse | InFlightReservation | null = null;\n\n    try {\n      existing = (await cacheDriver.get(cacheKey)) as CachedResponse | InFlightReservation | null;\n    } catch (error) {\n      // The cache is an optimisation of idempotency, not a gate on writes:\n      // when it is down, fail open (the handler runs) and log it.\n      log.error(\"idempotency-middleware\", \"get\", error);\n    }\n\n    if (existing) return respondToExisting(existing);\n\n    // Reserve the key atomically before the handler runs, so concurrent\n    // requests with the same key can't both execute it.\n    try {\n      const reservation = (await cacheDriver.set(\n        cacheKey,\n        { state: \"in-flight\", startedAt: Date.now() } satisfies InFlightReservation,\n        { onConflict: \"create\", ttl: reservationTtl },\n      )) as { wasSet?: boolean; existing?: CachedResponse | InFlightReservation } | undefined;\n\n      if (reservation && reservation.wasSet === false) {\n        return respondToExisting(reservation.existing);\n      }\n    } catch (error) {\n      log.error(\"idempotency-middleware\", \"reserve\", error);\n    }\n\n    response.onSent((sentResponse: Response) => {\n      // Don't cache server errors — clients should be able to retry past a 5xx.\n      // 4xx are deterministic outcomes of the request, so caching is fine.\n      // Free the reservation so a retry can run.\n      if (sentResponse.statusCode >= 500) {\n        // Wrapped so a synchronous throw is caught as well as a rejection.\n        Promise.resolve()\n          .then(() => cacheDriver.remove(cacheKey))\n          .catch((error: unknown) => {\n            log.error(\"idempotency-middleware\", \"remove\", error);\n          });\n\n        return;\n      }\n\n      const sentContentType = sentResponse.contentType;\n\n      // `set` is fire-and-forget inside `onSent`; without a `.catch` a rejected\n      // write (e.g. Redis down) would surface as an unhandledRejection.\n      cacheDriver\n        .set(\n          cacheKey,\n          {\n            status: sentResponse.statusCode,\n            body: sentResponse.parsedBody,\n            bodyHash,\n            contentType: typeof sentContentType === \"string\" ? sentContentType : undefined,\n          },\n          ttl,\n        )\n        .catch((error: unknown) => {\n          log.error(\"idempotency-middleware\", \"set\", error);\n        });\n    });\n  };\n}\n"],"mappings":";;;;;;;;AAoDA,MAAM,kBAAkB;CAAC;CAAQ;CAAO;CAAS;AAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCzD,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,aACJ,QAAQ,cAAcA,WAAO,IAAI,+BAA+B,iBAAiB;EACnF,MAAM,UAAU,QAAQ,WAAWA,WAAO,IAAI,4BAA4B,eAAe;EACzF,MAAM,MAAM,QAAQ,OAAOA,WAAO,IAAI,wBAAwB,KAAK;EACnE,MAAM,iBACJ,QAAQ,kBAAkBA,WAAO,IAAI,mCAAmC,EAAE;EAC5E,MAAM,aAAa,QAAQ,UAAUA,WAAO,IAAI,yBAAyB;EAEzE,IAAI,CAAC,QAAQ,SAAS,QAAQ,OAAO,YAAY,CAAC,GAAG;EAErD,MAAM,iBAAiB,QAAQ,OAAO,WAAW,YAAY,CAAC;EAE9D,IAAI,CAAC,gBAAgB;EAErB,IAAI,CAAC,sBAAsB,cAAc,GACvC,OAAO,SAAS,WAAW;GACzB,OAAO,EAAE,4BAA4B;GACrC;EACF,CAAC;EAGH,MAAM,cAAc,aAAa,MAAM,MAAM,IAAI,UAAU,IAAI;EAC/D,MAAM,WAAW,yBAAyB,SAAS,cAAc;EACjE,MAAM,WAAW,SAAS,QAAQ,IAAI;EAEtC,MAAM,qBACJ,aACG;GACH,IAAI,CAAC,YAAa,SAAiC,UAAU,aAAa;IACxE,SAAS,OAAO,eAAe,GAAG;IAElC,OAAO,SAAS,SAAS;KACvB,OAAO;KACP;IACF,CAAC;GACH;GAEA,MAAM,SAAS;GAEf,IAAI,OAAO,aAAa,UACtB,OAAO,SAAS,oBAAoB;IAClC,OAAO,EAAE,6BAA6B;IACtC;GACF,CAAC;GAGH,SAAS,OAAO,qBAAqB,MAAM;GAE3C,OAAO,SAAS,OAAO;IACrB,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,aAAa,OAAO;GACtB,CAAC;EACH;EAGA,IAAI,WAAwD;EAE5D,IAAI;GACF,WAAY,MAAM,YAAY,IAAI,QAAQ;EAC5C,SAAS,OAAO;GAGd,IAAI,MAAM,0BAA0B,OAAO,KAAK;EAClD;EAEA,IAAI,UAAU,OAAO,kBAAkB,QAAQ;EAI/C,IAAI;GACF,MAAM,cAAe,MAAM,YAAY,IACrC,UACA;IAAE,OAAO;IAAa,WAAW,KAAK,IAAI;GAAE,GAC5C;IAAE,YAAY;IAAU,KAAK;GAAe,CAC9C;GAEA,IAAI,eAAe,YAAY,WAAW,OACxC,OAAO,kBAAkB,YAAY,QAAQ;EAEjD,SAAS,OAAO;GACd,IAAI,MAAM,0BAA0B,WAAW,KAAK;EACtD;EAEA,SAAS,QAAQ,iBAA2B;GAI1C,IAAI,aAAa,cAAc,KAAK;IAElC,QAAQ,QAAQ,CAAC,CACd,WAAW,YAAY,OAAO,QAAQ,CAAC,CAAC,CACxC,OAAO,UAAmB;KACzB,IAAI,MAAM,0BAA0B,UAAU,KAAK;IACrD,CAAC;IAEH;GACF;GAEA,MAAM,kBAAkB,aAAa;GAIrC,YACG,IACC,UACA;IACE,QAAQ,aAAa;IACrB,MAAM,aAAa;IACnB;IACA,aAAa,OAAO,oBAAoB,WAAW,kBAAkB;GACvE,GACA,GACF,CAAC,CACA,OAAO,UAAmB;IACzB,IAAI,MAAM,0BAA0B,OAAO,KAAK;GAClD,CAAC;EACL,CAAC;CACH;AACF"}

package/esm/http/middleware/index.d.mts

@@ -8,4 +8,6 @@ import { middleware } from "./middleware-list.mjs";
 import { createRequestStore, t } from "./inject-request-context.mjs";
 import { anyMatch, ipMatches } from "./utils/cidr-match.mjs";
 import { buildIdempotencyCacheKey, hashBody, isValidIdempotencyKey } from "./utils/idempotency-key.mjs";
-import { parseSize } from "./utils/parse-size.mjs";
+import { parseSize } from "./utils/parse-size.mjs";
+import "./utils/index.mjs";
+export { type CacheMiddlewareOptions, type ConcurrencyLimitOptions, type IdempotencyOptions, type IpFilterOptions, type MaintenanceOptions, type RateLimitOptions, anyMatch, buildIdempotencyCacheKey, createRequestStore, hashBody, ipMatches, isValidIdempotencyKey, middleware, parseSize, t };

package/esm/http/middleware/index.mjs

@@ -4,4 +4,4 @@ import { anyMatch, ipMatches } from "./utils/cidr-match.mjs";
 import { parseSize } from "./utils/parse-size.mjs";
 import { middleware } from "./middleware-list.mjs";
 
-export {  };
+export { anyMatch, buildIdempotencyCacheKey, createRequestStore, hashBody, ipMatches, isValidIdempotencyKey, middleware, parseSize, t };