@c9up/ream 0.2.26 → 0.2.28

package/dist/profiler/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The profiler, assembled.
+ *
+ * One place that knows which collectors ship, so the Ignitor wires a profiler
+ * rather than a list — and an application that wants its own panel adds a
+ * collector here instead of rebuilding the set.
+ */
+import { type QueryEventSource } from './collectors.js';
+import { Profiler } from './Profiler.js';
+import type { ProfilerCollector } from './types.js';
+export * from './collectors.js';
+export { profilerEndpoint } from './endpoint.js';
+export { MemoryProfileStore } from './MemoryProfileStore.js';
+export { profileRequest } from './middleware.js';
+export { PROFILER_PATH, PROFILER_TOKEN_HEADER, Profiler } from './Profiler.js';
+export { toolbarScript } from './toolbar.js';
+export * from './types.js';
+/**
+ * The profiler a dev server runs with.
+ *
+ * `events` is the application's emitter. The database panel comes from
+ * `db:query` on it, which is how a data layer reports a statement without the
+ * profiler importing one.
+ */
+export declare function createProfiler(events: QueryEventSource, extra?: readonly ProfilerCollector[]): Profiler;
+//# sourceMappingURL=index.d.ts.map

package/dist/profiler/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/profiler/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAOL,KAAK,gBAAgB,EAEtB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEnD,cAAc,iBAAiB,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,cAAc,YAAY,CAAA;AAE1B;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,gBAAgB,EACxB,KAAK,GAAE,SAAS,iBAAiB,EAAO,GACvC,QAAQ,CAeV"}

package/dist/profiler/index.js

@@ -0,0 +1,41 @@
+/**
+ * The profiler, assembled.
+ *
+ * One place that knows which collectors ship, so the Ignitor wires a profiler
+ * rather than a list — and an application that wants its own panel adds a
+ * collector here instead of rebuilding the set.
+ */
+import { databaseCollector, exceptionCollector, logCollector, memoryCollector, requestCollector, } from './collectors.js';
+import { MemoryProfileStore } from './MemoryProfileStore.js';
+import { Profiler } from './Profiler.js';
+export * from './collectors.js';
+export { profilerEndpoint } from './endpoint.js';
+export { MemoryProfileStore } from './MemoryProfileStore.js';
+export { profileRequest } from './middleware.js';
+export { PROFILER_PATH, PROFILER_TOKEN_HEADER, Profiler } from './Profiler.js';
+export { toolbarScript } from './toolbar.js';
+export * from './types.js';
+/**
+ * The profiler a dev server runs with.
+ *
+ * `events` is the application's emitter. The database panel comes from
+ * `db:query` on it, which is how a data layer reports a statement without the
+ * profiler importing one.
+ */
+export function createProfiler(events, extra = []) {
+    // Built before the profiler so the database collector can read the bag of
+    // whichever request is running — the reference is filled in a line later,
+    // and nothing reads it until a request arrives.
+    let profiler;
+    const collectors = [
+        requestCollector(),
+        databaseCollector(events, () => profiler.current('database')),
+        exceptionCollector(),
+        logCollector(events, () => profiler.current('logs')),
+        memoryCollector(),
+        ...extra,
+    ];
+    profiler = new Profiler(collectors, new MemoryProfileStore(collectors));
+    return profiler;
+}
+//# sourceMappingURL=index.js.map

package/dist/profiler/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/profiler/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAElB,YAAY,EACZ,eAAe,EAGf,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAGxC,cAAc,iBAAiB,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,cAAc,YAAY,CAAA;AAE1B;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAwB,EACxB,QAAsC,EAAE;IAExC,0EAA0E;IAC1E,0EAA0E;IAC1E,gDAAgD;IAChD,IAAI,QAAkB,CAAA;IACtB,MAAM,UAAU,GAAwB;QACtC,gBAAgB,EAAE;QAClB,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAW,UAAU,CAAC,CAAC;QACvE,kBAAkB,EAAE;QACpB,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAS,MAAM,CAAC,CAAC;QAC5D,eAAe,EAAE;QACjB,GAAG,KAAK;KACT,CAAA;IACD,QAAQ,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAA;IACvE,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/profiler/middleware.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The middleware that records a request.
+ *
+ * It wraps everything after it, so what it measures is the whole answer — the
+ * application's own middleware included — and it stamps the token on the
+ * response first thing. That header is how a client finds the profile again;
+ * the injected bar carries the same token inline, because a script in a page
+ * cannot read the headers of the navigation that delivered it.
+ *
+ * Registered AFTER the profiler's own endpoint and the hot-reload stream, so
+ * neither ends up in its own history — and so a reload stream, which is open
+ * for as long as the tab is, never sits in the middle of an unfinished profile.
+ */
+import type { MiddlewareFunction } from '../middleware/Pipeline.js';
+import { type Profiler } from './Profiler.js';
+export declare function profileRequest(profiler: Profiler): MiddlewareFunction;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/profiler/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/profiler/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAEnE,OAAO,EAAyB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAA;AAEpE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,kBAAkB,CAqBrE"}

package/dist/profiler/middleware.js

@@ -0,0 +1,79 @@
+/**
+ * The middleware that records a request.
+ *
+ * It wraps everything after it, so what it measures is the whole answer — the
+ * application's own middleware included — and it stamps the token on the
+ * response first thing. That header is how a client finds the profile again;
+ * the injected bar carries the same token inline, because a script in a page
+ * cannot read the headers of the navigation that delivered it.
+ *
+ * Registered AFTER the profiler's own endpoint and the hot-reload stream, so
+ * neither ends up in its own history — and so a reload stream, which is open
+ * for as long as the tab is, never sits in the middle of an unfinished profile.
+ */
+import { PROFILER_TOKEN_HEADER } from './Profiler.js';
+export function profileRequest(profiler) {
+    return async (ctx, next) => {
+        await profiler.profile({ method: ctx.request.method(), url: ctx.request.url() }, async (scope) => {
+            // Before the work, not after: a handler that throws unwinds past this
+            // line, and the request that broke is the one whose profile you most
+            // want to open.
+            ctx.response.header(PROFILER_TOKEN_HEADER, scope.token);
+            try {
+                await next();
+            }
+            finally {
+                // After routing, because this runs ahead of it: the pattern and the
+                // controller are only on the context once a route has matched. In a
+                // `finally`, because a request that threw still matched one.
+                describeRoute(profiler.current('request'), ctx);
+            }
+        }, (error) => ({ status: statusOf(ctx, error) }));
+    };
+}
+/**
+ * The status the response will carry.
+ *
+ * When the work threw, the exception handler has not run yet — the error is
+ * still travelling outwards — so the response still holds whatever it held
+ * before. Read the error the way the handler will instead, and fall back to
+ * 500, which is what an error carrying no status becomes.
+ */
+function statusOf(ctx, error) {
+    if (error === undefined)
+        return ctx.response.getStatus();
+    if (typeof error === 'object' && error !== null) {
+        const status = Reflect.get(error, 'status') ?? Reflect.get(error, 'statusCode');
+        if (typeof status === 'number' && Number.isInteger(status))
+            return status;
+    }
+    return 500;
+}
+/**
+ * What matched, as the request panel shows it.
+ *
+ * Read off the context rather than passed in, and every field optional: a 404
+ * matched nothing, and an inline handler has no controller to name.
+ */
+function describeRoute(bag, ctx) {
+    if (bag === undefined)
+        return;
+    const route = ctx.route;
+    if (route === undefined)
+        return;
+    bag.route = route.name ?? route.pattern;
+    const controller = route.controller;
+    if (controller !== undefined && route.action !== undefined) {
+        // `route.controller` is the PROTOTYPE, not the class — that is what the
+        // decorator-reading middleware needs — so the name is on its constructor.
+        const name = Reflect.get(Reflect.get(controller, 'constructor') ?? {}, 'name');
+        bag.controller = `${typeof name === 'string' ? name : 'Controller'}.${route.action}`;
+    }
+    const user = ctx.auth?.user;
+    if (typeof user === 'object' && user !== null) {
+        const id = Reflect.get(user, 'id');
+        if (typeof id === 'string' || typeof id === 'number')
+            bag.userId = String(id);
+    }
+}
+//# sourceMappingURL=middleware.js.map

package/dist/profiler/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/profiler/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EAAE,qBAAqB,EAAiB,MAAM,eAAe,CAAA;AAEpE,MAAM,UAAU,cAAc,CAAC,QAAkB;IAC/C,OAAO,KAAK,EAAE,GAAgB,EAAE,IAAyB,EAAE,EAAE;QAC3D,MAAM,QAAQ,CAAC,OAAO,CACpB,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EACxD,KAAK,EAAE,KAAK,EAAE,EAAE;YACd,sEAAsE;YACtE,qEAAqE;YACrE,gBAAgB;YAChB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,EAAE,CAAA;YACd,CAAC;oBAAS,CAAC;gBACT,oEAAoE;gBACpE,oEAAoE;gBACpE,6DAA6D;gBAC7D,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAa,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;YAC7D,CAAC;QACH,CAAC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAC9C,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,GAAgB,EAAE,KAAc;IAChD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAA;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;QAC/E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IAC3E,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAA2B,EAAE,GAAgB;IAClE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAM;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;IACvB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAM;IAC/B,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAA;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;IACnC,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3D,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;QAC9E,GAAG,CAAC,UAAU,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,EAAE,CAAA;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAA;IAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;IAC/E,CAAC;AACH,CAAC"}

package/dist/profiler/render.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The profiler's own pages, and the bar injected into yours.
+ *
+ * Plain HTML and one inline stylesheet. A dev tool that needed a build step,
+ * or pulled a framework into the page it is inspecting, would be a worse
+ * neighbour than the problem it reports — and the bar lives in a shadow root
+ * for the same reason: your stylesheet must not reach it, and it must not
+ * reach yours.
+ *
+ * EVERY value that came from a request is escaped. A profiler renders the
+ * URL someone asked for, the SQL a query ran and the message an error carried
+ * — all attacker-reachable in exactly the case you most want to look at, and a
+ * tool that turned a crafted URL into script in your own browser would be a
+ * hole with a friendly face.
+ */
+import type { Profile, ProfileSummary } from './types.js';
+/** `<`, `&` and the quotes. Everything below goes through it. */
+export declare function escapeHtml(value: unknown): string;
+/** The history: what a developer lands on with no token in hand. */
+export declare function renderProfileList(profiles: readonly ProfileSummary[], missing?: string): string;
+/** One request, every panel. */
+export declare function renderProfilePage(profile: Profile, badges: Record<string, string>): string;
+//# sourceMappingURL=render.d.ts.map

package/dist/profiler/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/profiler/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEzD,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOjD;AAkCD,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CA6B/F;AAED,gCAAgC;AAChC,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAkC1F"}

package/dist/profiler/render.js

@@ -0,0 +1,141 @@
+/**
+ * The profiler's own pages, and the bar injected into yours.
+ *
+ * Plain HTML and one inline stylesheet. A dev tool that needed a build step,
+ * or pulled a framework into the page it is inspecting, would be a worse
+ * neighbour than the problem it reports — and the bar lives in a shadow root
+ * for the same reason: your stylesheet must not reach it, and it must not
+ * reach yours.
+ *
+ * EVERY value that came from a request is escaped. A profiler renders the
+ * URL someone asked for, the SQL a query ran and the message an error carried
+ * — all attacker-reachable in exactly the case you most want to look at, and a
+ * tool that turned a crafted URL into script in your own browser would be a
+ * hole with a friendly face.
+ */
+/** `<`, `&` and the quotes. Everything below goes through it. */
+export function escapeHtml(value) {
+    return String(value)
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}
+const STYLE = `
+  :root { color-scheme: dark }
+  body { margin: 0; background: #14161a; color: #e6e6e6;
+         font: 13px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace }
+  a { color: #6cb6ff; text-decoration: none }
+  a:hover { text-decoration: underline }
+  header { padding: 16px 20px; border-bottom: 1px solid #262a31 }
+  h1 { margin: 0; font-size: 15px; font-weight: 600 }
+  .meta { color: #8b949e; margin-top: 4px }
+  main { padding: 20px }
+  section { margin-bottom: 28px }
+  h2 { font-size: 13px; text-transform: uppercase; letter-spacing: .08em;
+       color: #8b949e; margin: 0 0 10px }
+  table { width: 100%; border-collapse: collapse }
+  td, th { text-align: left; padding: 6px 10px; border-bottom: 1px solid #21252c;
+           vertical-align: top }
+  th { color: #8b949e; font-weight: 500 }
+  .num { text-align: right; white-space: nowrap; color: #8b949e }
+  .sql { white-space: pre-wrap; word-break: break-word }
+  .slow { color: #f0883e }
+  .bad { color: #ff7b72 }
+  pre { white-space: pre-wrap; word-break: break-word; margin: 0; color: #c9d1d9 }
+  .pill { display: inline-block; padding: 1px 8px; border-radius: 999px;
+          background: #21262d; color: #8b949e; margin-right: 6px }
+`;
+/** A whole page, so the profiler needs nothing served alongside it. */
+function page(title, body) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<title>${escapeHtml(title)}</title><style>${STYLE}</style></head><body>${body}</body></html>`;
+}
+/** The history: what a developer lands on with no token in hand. */
+export function renderProfileList(profiles, missing) {
+    const warning = missing === undefined
+        ? ''
+        : `<p class="bad">No profile for <code>${escapeHtml(missing)}</code> — it may have aged out.</p>`;
+    const rows = profiles
+        .map((profile) => `<tr>
+      <td><a href="/__ream/profiler/${escapeHtml(profile.token)}">${escapeHtml(profile.token)}</a></td>
+      <td>${escapeHtml(profile.method)}</td>
+      <td class="sql">${escapeHtml(profile.url)}</td>
+      <td class="${profile.status >= 500 ? 'bad' : ''}">${escapeHtml(profile.status)}</td>
+      <td class="num">${escapeHtml(profile.duration.toFixed(1))} ms</td>
+      <td>${Object.values(profile.badges)
+        .map((badge) => `<span class="pill">${escapeHtml(badge)}</span>`)
+        .join('')}</td>
+    </tr>`)
+        .join('');
+    return page('Profiler', `<header><h1>Profiler</h1><div class="meta">${profiles.length} request${profiles.length === 1 ? '' : 's'} kept</div></header><main>${warning}
+     <table><tr><th>Token</th><th>Method</th><th>URL</th><th>Status</th>
+     <th class="num">Time</th><th>Collected</th></tr>${rows}</table></main>`);
+}
+/** One request, every panel. */
+export function renderProfilePage(profile, badges) {
+    const sections = [];
+    const exception = profile.data.exception;
+    if (exception !== undefined && typeof exception.message === 'string') {
+        sections.push(`<section><h2 class="bad">Exception</h2>
+      <p class="bad">${escapeHtml(exception.name ?? 'Error')}: ${escapeHtml(exception.message)}</p>
+      ${typeof exception.stack === 'string' ? `<pre>${escapeHtml(exception.stack)}</pre>` : ''}
+    </section>`);
+    }
+    sections.push(renderQueries(profile));
+    for (const [name, data] of Object.entries(profile.data)) {
+        if (name === 'database' || name === 'exception')
+            continue;
+        if (Object.keys(data).length === 0)
+            continue;
+        sections.push(`<section><h2>${escapeHtml(name)}</h2>
+      <pre>${escapeHtml(JSON.stringify(data, null, 2))}</pre></section>`);
+    }
+    return page(`${profile.method} ${profile.url}`, `<header>
+       <h1>${escapeHtml(profile.method)} ${escapeHtml(profile.url)}</h1>
+       <div class="meta">
+         ${escapeHtml(profile.status)} · ${escapeHtml(profile.duration.toFixed(1))} ms ·
+         ${escapeHtml(new Date(profile.time).toISOString())} ·
+         <a href="/__ream/profiler">all requests</a>
+       </div>
+       <div class="meta">${Object.values(badges)
+        .map((badge) => `<span class="pill">${escapeHtml(badge)}</span>`)
+        .join('')}</div>
+     </header><main>${sections.join('')}</main>`);
+}
+/** The panel the whole thing exists for. */
+function renderQueries(profile) {
+    const database = profile.data.database;
+    if (database === undefined)
+        return '';
+    const queries = Array.isArray(database.queries) ? database.queries : [];
+    const total = typeof database.total === 'number' ? database.total : 0;
+    if (total === 0)
+        return '<section><h2>Database</h2><p class="meta">No query.</p></section>';
+    const rows = queries
+        .map((entry) => {
+        const query = asRecord(entry);
+        const duration = typeof query.duration === 'number' ? query.duration : 0;
+        const bindings = Array.isArray(query.bindings) ? query.bindings : [];
+        return `<tr>
+        <td class="num ${duration >= 50 ? 'slow' : ''}">${escapeHtml(duration.toFixed(2))} ms</td>
+        <td class="sql">${escapeHtml(query.sql)}${bindings.length === 0
+            ? ''
+            : `<div class="meta">${escapeHtml(JSON.stringify(bindings))}</div>`}${typeof query.error === 'string' ? `<div class="bad">${escapeHtml(query.error)}</div>` : ''}</td>
+        <td class="meta">${escapeHtml(query.model ?? '')}${query.inTransaction === true ? ' <span class="pill">tx</span>' : ''}</td>
+      </tr>`;
+    })
+        .join('');
+    const capped = database.capped === true
+        ? `<p class="meta">Listing stopped at ${queries.length}; ${escapeHtml(total)} ran.</p>`
+        : '';
+    return `<section><h2>Database</h2>${capped}
+    <table><tr><th class="num">Time</th><th>Query</th><th>Model</th></tr>${rows}</table></section>`;
+}
+function asRecord(value) {
+    return typeof value === 'object' && value !== null
+        ? Object.fromEntries(Object.entries(value))
+        : {};
+}
+//# sourceMappingURL=render.js.map

package/dist/profiler/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/profiler/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,iEAAiE;AACjE,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,MAAM,CAAC,KAAK,CAAC;SACjB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBb,CAAA;AAED,uEAAuE;AACvE,SAAS,IAAI,CAAC,KAAa,EAAE,IAAY;IACvC,OAAO;SACA,UAAU,CAAC,KAAK,CAAC,kBAAkB,KAAK,wBAAwB,IAAI,gBAAgB,CAAA;AAC7F,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,QAAmC,EAAE,OAAgB;IACrF,MAAM,OAAO,GACX,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,uCAAuC,UAAU,CAAC,OAAO,CAAC,qCAAqC,CAAA;IAErG,MAAM,IAAI,GAAG,QAAQ;SAClB,GAAG,CACF,CAAC,OAAO,EAAE,EAAE,CAAC;sCACmB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;YACjF,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;wBACd,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;mBAC5B,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;wBAC5D,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;SAChE,IAAI,CAAC,EAAE,CAAC;UACP,CACL;SACA,IAAI,CAAC,EAAE,CAAC,CAAA;IAEX,OAAO,IAAI,CACT,UAAU,EACV,8CAA8C,QAAQ,CAAC,MAAM,WAC3D,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC/B,6BAA6B,OAAO;;uDAEe,IAAI,iBAAiB,CACzE,CAAA;AACH,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,MAA8B;IAChF,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAA;IACxC,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC;uBACK,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC;QACtF,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;eAC/E,CAAC,CAAA;IACd,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA;IAErC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,WAAW;YAAE,SAAQ;QACzD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAC5C,QAAQ,CAAC,IAAI,CAAC,gBAAgB,UAAU,CAAC,IAAI,CAAC;aACrC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAA;IACvE,CAAC;IAED,OAAO,IAAI,CACT,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,EAClC;aACS,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;;WAEvD,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;WACvE,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;;;2BAGhC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;SAChE,IAAI,CAAC,EAAE,CAAC;sBACI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAC7C,CAAA;AACH,CAAC;AAED,4CAA4C;AAC5C,SAAS,aAAa,CAAC,OAAgB;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAA;IACtC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAErE,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,mEAAmE,CAAA;IAE3F,MAAM,IAAI,GAAG,OAAO;SACjB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;QACpE,OAAO;yBACY,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;0BAC/D,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,GACrC,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,QAC/D,GACE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAC1F;2BACmB,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,GAC9C,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,EACnE;YACI,CAAA;IACR,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAA;IAEX,MAAM,MAAM,GACV,QAAQ,CAAC,MAAM,KAAK,IAAI;QACtB,CAAC,CAAC,sCAAsC,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,KAAK,CAAC,WAAW;QACvF,CAAC,CAAC,EAAE,CAAA;IAER,OAAO,6BAA6B,MAAM;2EAC+B,IAAI,oBAAoB,CAAA;AACnG,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAChD,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC,CAAC,EAAE,CAAA;AACR,CAAC"}

package/dist/profiler/toolbar.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The bar at the bottom of the page.
+ *
+ * It carries its own token inline rather than reading `X-Debug-Token` off the
+ * response: a script in a page cannot see the headers of the navigation that
+ * delivered it. Symfony injects the token for the same reason.
+ *
+ * Everything lives in a shadow root — your stylesheet must not reach the bar,
+ * and the bar must not reach your page. It fetches its numbers once, on load,
+ * and then does nothing: a dev tool that polls is a dev tool that shows up in
+ * its own history.
+ *
+ * A string rather than a stringified function, as the hot-reload script is:
+ * this package compiles without the DOM library, deliberately — it is a server
+ * — so browser code here is text, and its only inputs are escaped below.
+ *
+ * It styles its nodes through the CSSOM — `node.style.cssText` — rather than
+ * with a `<style>` element. Under a CSP with `style-src 'self'` (or only a
+ * `default-src`, which is the common case) a stylesheet inserted at runtime is
+ * inline style and is dropped, with no error anywhere: the bar renders as a
+ * stack of grey text and nothing says why. Setting properties on an element is
+ * not inline style and is never blocked, which is also how the host below has
+ * always been positioned.
+ */
+/**
+ * The `<script>` to append to an HTML response.
+ *
+ * `token` is generated by the profiler (hex) and `nonce` by the response, so
+ * neither is user input; both are still put through `JSON.stringify` rather
+ * than interpolated raw, because "cannot contain a quote" is an invariant that
+ * holds until someone changes how one of them is made.
+ */
+export declare function toolbarScript(token: string, nonce?: string): string;
+//# sourceMappingURL=toolbar.d.ts.map

package/dist/profiler/toolbar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolbar.d.ts","sourceRoot":"","sources":["../../src/profiler/toolbar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAInE"}

package/dist/profiler/toolbar.js

@@ -0,0 +1,104 @@
+/**
+ * The bar at the bottom of the page.
+ *
+ * It carries its own token inline rather than reading `X-Debug-Token` off the
+ * response: a script in a page cannot see the headers of the navigation that
+ * delivered it. Symfony injects the token for the same reason.
+ *
+ * Everything lives in a shadow root — your stylesheet must not reach the bar,
+ * and the bar must not reach your page. It fetches its numbers once, on load,
+ * and then does nothing: a dev tool that polls is a dev tool that shows up in
+ * its own history.
+ *
+ * A string rather than a stringified function, as the hot-reload script is:
+ * this package compiles without the DOM library, deliberately — it is a server
+ * — so browser code here is text, and its only inputs are escaped below.
+ *
+ * It styles its nodes through the CSSOM — `node.style.cssText` — rather than
+ * with a `<style>` element. Under a CSP with `style-src 'self'` (or only a
+ * `default-src`, which is the common case) a stylesheet inserted at runtime is
+ * inline style and is dropped, with no error anywhere: the bar renders as a
+ * stack of grey text and nothing says why. Setting properties on an element is
+ * not inline style and is never blocked, which is also how the host below has
+ * always been positioned.
+ */
+import { PROFILER_PATH } from './Profiler.js';
+/**
+ * The `<script>` to append to an HTML response.
+ *
+ * `token` is generated by the profiler (hex) and `nonce` by the response, so
+ * neither is user input; both are still put through `JSON.stringify` rather
+ * than interpolated raw, because "cannot contain a quote" is an invariant that
+ * holds until someone changes how one of them is made.
+ */
+export function toolbarScript(token, nonce) {
+    const attribute = nonce === undefined ? '' : ` nonce="${nonce.replace(/"/g, '&quot;')}"`;
+    const config = JSON.stringify({ token, path: PROFILER_PATH });
+    return `<script${attribute}>(${BAR})(${config})</script>`;
+}
+/**
+ * The bar, as it runs in the browser.
+ *
+ * Kept on one indented block so what ships is readable in a page's source —
+ * someone will open the inspector and find this, and a minified blob would
+ * tell them nothing about where it came from.
+ */
+const BAR = `function(c){
+  var host=document.createElement('div');
+  host.style.cssText='position:fixed;left:0;right:0;bottom:0;z-index:2147483000';
+  var root=host.attachShadow({mode:'closed'});
+  document.body.appendChild(host);
+  var bar=document.createElement('div');
+  bar.style.cssText='display:flex;align-items:stretch;background:#14161a;color:#e6e6e6;'
+    +'font:12px/1 ui-monospace,Menlo,monospace;border-top:1px solid #262a31;'
+    +'box-shadow:0 -2px 8px rgba(0,0,0,.4)';
+  root.appendChild(bar);
+  var page=c.path+'/'+c.token;
+  var COLOR={bad:'#ff7b72',warn:'#f0883e',ok:'#7ee787'};
+  function cell(label,value,tone,plain){
+    var node=document.createElement('div');
+    node.style.cssText='padding:7px 11px;white-space:nowrap;'
+      +(plain?'flex:1;overflow:hidden;text-overflow:ellipsis;cursor:default'
+             :'border-right:1px solid #21252c;cursor:pointer');
+    if(label){
+      var tag=document.createElement('span');
+      tag.style.cssText='color:#8b949e;margin-right:6px';
+      tag.textContent=label;
+      node.appendChild(tag);
+    }
+    var text=document.createElement('span');
+    if(tone){text.style.color=COLOR[tone];}
+    text.textContent=value;
+    node.appendChild(text);
+    if(!plain){
+      node.addEventListener('mouseenter',function(){node.style.background='#1b1f25'});
+      node.addEventListener('mouseleave',function(){node.style.background=''});
+      node.addEventListener('click',function(){window.open(page,'_blank')});
+    }
+    bar.appendChild(node);
+  }
+  function panel(data,name){
+    var value=data&&data[name];
+    return (value&&typeof value==='object')?value:null;
+  }
+  fetch(page+'.json',{headers:{accept:'application/json'}})
+    .then(function(r){return r.ok?r.json():null})
+    .then(function(p){
+      if(!p){host.remove();return}
+      var status=Number(p.status||0);
+      cell('',String(status),status>=500?'bad':status>=400?'warn':'ok');
+      cell('time',Number(p.duration||0).toFixed(1)+' ms');
+      var db=panel(p.data,'database');
+      if(db){
+        var total=Number(db.total||0);
+        cell('db',total+' \u00b7 '+Number(db.duration||0).toFixed(1)+' ms',total>=50?'warn':'');
+      }
+      var mem=panel(p.data,'memory');
+      if(mem){cell('mem',Number(mem.usedMb||0).toFixed(1)+' MB');}
+      var err=panel(p.data,'exception');
+      if(err&&typeof err.message==='string'){cell('',err.message,'bad');}
+      cell('',String(p.url||''),'',true);
+    })
+    .catch(function(){host.remove()});
+}`;
+//# sourceMappingURL=toolbar.js.map

package/dist/profiler/toolbar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolbar.js","sourceRoot":"","sources":["../../src/profiler/toolbar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7C;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,KAAc;IACzD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;IAC7D,OAAO,UAAU,SAAS,KAAK,GAAG,KAAK,MAAM,YAAY,CAAA;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,GAAG,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyDV,CAAA"}

package/dist/profiler/types.d.ts

@@ -0,0 +1,70 @@
+/**
+ * What the profiler keeps about one request.
+ *
+ * Shaped after Symfony's profiler rather than Laravel's debugbar, which is a
+ * decision about where the data lives: a token per request, an endpoint that
+ * serves it, and a history. Inlining it in the page is simpler until the
+ * request you need to look at was a POST that redirected — and then the data
+ * is gone, which is exactly when you wanted it.
+ */
+/** One collector's contribution to a profile. Plain data: it crosses a wire. */
+export type CollectedData = Record<string, unknown>;
+/**
+ * Everything kept about one request.
+ *
+ * `token` identifies it. It travels back on `X-Debug-Token`, so a client — the
+ * toolbar, curl, a test — can ask for the profile of a request it just made.
+ */
+export interface Profile {
+    token: string;
+    /** When the request arrived, epoch milliseconds. */
+    time: number;
+    method: string;
+    url: string;
+    status: number;
+    /** Wall-clock milliseconds, first middleware to serialised response. */
+    duration: number;
+    /** Keyed by collector name. */
+    data: Record<string, CollectedData>;
+}
+/** A profile without its data — what a listing shows. */
+export type ProfileSummary = Omit<Profile, 'data'> & {
+    /** The headline each collector wants on the bar: `{ database: '12 queries' }`. */
+    badges: Record<string, string>;
+};
+/**
+ * What a collector is handed while a request runs.
+ *
+ * Deliberately not the HttpContext: a collector observes, and handing it the
+ * context would let it answer the request. What it needs is a place to put
+ * what it saw and the ability to know when the request ends.
+ */
+export interface CollectionScope {
+    token: string;
+    /** Called by the framework when the request is done. */
+    readonly startedAt: number;
+}
+/**
+ * A source of data about a request.
+ *
+ * `start` runs when the request begins and answers a bag the collector will
+ * fill; `finish` turns that bag into what is stored. Two methods rather than
+ * one, because the interesting collectors — queries, logs, events — are fed by
+ * things happening DURING the request, not by looking at it afterwards.
+ */
+export interface ProfilerCollector<Bag = unknown> {
+    /** Unique. It keys the data and names the panel. */
+    readonly name: string;
+    /** Shown on the bar, or nothing when there is nothing worth a badge. */
+    badge?: (data: CollectedData) => string | undefined;
+    start(scope: CollectionScope): Bag;
+    finish(bag: Bag, scope: CollectionScope): CollectedData;
+}
+/** Where profiles are kept. Bounded: a dev session is not an archive. */
+export interface ProfileStore {
+    save(profile: Profile): void;
+    find(token: string): Profile | undefined;
+    recent(limit?: number): ProfileSummary[];
+    clear(): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/profiler/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/profiler/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;CACpC;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG;IACnD,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B,CAAA;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB,CAAC,GAAG,GAAG,OAAO;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,wEAAwE;IACxE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,MAAM,GAAG,SAAS,CAAA;IACnD,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,GAAG,CAAA;IAClC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,GAAG,aAAa,CAAA;CACxD;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;IACxC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE,CAAA;IACxC,KAAK,IAAI,IAAI,CAAA;CACd"}

package/dist/profiler/types.js

@@ -0,0 +1,11 @@
+/**
+ * What the profiler keeps about one request.
+ *
+ * Shaped after Symfony's profiler rather than Laravel's debugbar, which is a
+ * decision about where the data lives: a token per request, an endpoint that
+ * serves it, and a history. Inlining it in the page is simpler until the
+ * request you need to look at was a POST that redirected — and then the data
+ * is gone, which is exactly when you wanted it.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/profiler/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/profiler/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/router/Router.d.ts

@@ -507,6 +507,17 @@ export declare class Router extends Macroable {
      * the server. Powers the aurora client URL helper.
      */
     namedManifest(): Record<string, string>;
+    /**
+     * Every NAMED route with its path pattern AND the HTTP methods it answers,
+     * e.g. `{ 'users.update': { path: '/users/:id', methods: ['PUT'] } }` — what
+     * a client needs to follow a route by name and pick its verb, the way
+     * AdonisJS's Tuyau registry gives `route` + `methods`. `namedManifest()`
+     * stays the lighter name → path map.
+     */
+    namedRoutes(): Record<string, {
+        path: string;
+        methods: string[];
+    }>;
     /**
      * Generate a TypeScript source string typing every named route and its
      * params (AdonisJS `generateTypes`) — a `RouteName` union plus a