@daloyjs/core 0.16.0 → 0.28.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -3
- package/dist/adapters/bun.d.ts.map +1 -1
- package/dist/adapters/bun.js +38 -7
- package/dist/adapters/bun.js.map +1 -1
- package/dist/adapters/node.d.ts.map +1 -1
- package/dist/adapters/node.js +29 -7
- package/dist/adapters/node.js.map +1 -1
- package/dist/app.d.ts +412 -3
- package/dist/app.d.ts.map +1 -1
- package/dist/app.js +895 -29
- package/dist/app.js.map +1 -1
- package/dist/cli.d.ts +4 -0
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +218 -1
- package/dist/cli.js.map +1 -1
- package/dist/combine.d.ts +97 -0
- package/dist/combine.d.ts.map +1 -0
- package/dist/combine.js +247 -0
- package/dist/combine.js.map +1 -0
- package/dist/compression.d.ts +127 -0
- package/dist/compression.d.ts.map +1 -0
- package/dist/compression.js +368 -0
- package/dist/compression.js.map +1 -0
- package/dist/config.d.ts +97 -0
- package/dist/config.d.ts.map +1 -0
- package/dist/config.js +132 -0
- package/dist/config.js.map +1 -0
- package/dist/conn-info.d.ts +121 -0
- package/dist/conn-info.d.ts.map +1 -0
- package/dist/conn-info.js +145 -0
- package/dist/conn-info.js.map +1 -0
- package/dist/cookie.d.ts +112 -0
- package/dist/cookie.d.ts.map +1 -0
- package/dist/cookie.js +185 -0
- package/dist/cookie.js.map +1 -0
- package/dist/dependency.d.ts +47 -0
- package/dist/dependency.d.ts.map +1 -0
- package/dist/dependency.js +68 -0
- package/dist/dependency.js.map +1 -0
- package/dist/etag.d.ts +48 -0
- package/dist/etag.d.ts.map +1 -0
- package/dist/etag.js +117 -0
- package/dist/etag.js.map +1 -0
- package/dist/index.d.ts +41 -12
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +20 -5
- package/dist/index.js.map +1 -1
- package/dist/ip-restriction.d.ts +75 -0
- package/dist/ip-restriction.d.ts.map +1 -0
- package/dist/ip-restriction.js +203 -0
- package/dist/ip-restriction.js.map +1 -0
- package/dist/jwk.d.ts +82 -0
- package/dist/jwk.d.ts.map +1 -0
- package/dist/jwk.js +269 -0
- package/dist/jwk.js.map +1 -0
- package/dist/jwt.d.ts +103 -0
- package/dist/jwt.d.ts.map +1 -0
- package/dist/jwt.js +437 -0
- package/dist/jwt.js.map +1 -0
- package/dist/load-shedding.d.ts +73 -0
- package/dist/load-shedding.d.ts.map +1 -0
- package/dist/load-shedding.js +171 -0
- package/dist/load-shedding.js.map +1 -0
- package/dist/middleware.d.ts +205 -2
- package/dist/middleware.d.ts.map +1 -1
- package/dist/middleware.js +399 -78
- package/dist/middleware.js.map +1 -1
- package/dist/multipart.d.ts +17 -0
- package/dist/multipart.d.ts.map +1 -1
- package/dist/multipart.js +117 -1
- package/dist/multipart.js.map +1 -1
- package/dist/openapi.d.ts +8 -0
- package/dist/openapi.d.ts.map +1 -1
- package/dist/openapi.js +18 -1
- package/dist/openapi.js.map +1 -1
- package/dist/security-schemes.d.ts +21 -5
- package/dist/security-schemes.d.ts.map +1 -1
- package/dist/security-schemes.js +32 -5
- package/dist/security-schemes.js.map +1 -1
- package/dist/security.d.ts +32 -0
- package/dist/security.d.ts.map +1 -1
- package/dist/security.js +79 -0
- package/dist/security.js.map +1 -1
- package/dist/session.d.ts +43 -1
- package/dist/session.d.ts.map +1 -1
- package/dist/session.js +130 -87
- package/dist/session.js.map +1 -1
- package/dist/subdomains.d.ts +97 -0
- package/dist/subdomains.d.ts.map +1 -0
- package/dist/subdomains.js +157 -0
- package/dist/subdomains.js.map +1 -0
- package/dist/time-claims.d.ts +72 -0
- package/dist/time-claims.d.ts.map +1 -0
- package/dist/time-claims.js +88 -0
- package/dist/time-claims.js.map +1 -0
- package/dist/types.d.ts +50 -0
- package/dist/types.d.ts.map +1 -1
- package/dist/websocket.d.ts +51 -34
- package/dist/websocket.d.ts.map +1 -1
- package/dist/websocket.js +162 -2
- package/dist/websocket.js.map +1 -1
- package/package.json +30 -3
package/dist/app.d.ts
CHANGED
|
@@ -4,6 +4,12 @@ import type { HttpMethod, Hooks, PathString, RequestSchemas, ResponsesMap, Route
|
|
|
4
4
|
import { type OpenAPIInfo, type OpenAPIOptions } from "./openapi.js";
|
|
5
5
|
import { type DocsContentSecurityPolicyOptions, type ScalarReferenceConfiguration } from "./docs.js";
|
|
6
6
|
import { type SecureHeadersOptions } from "./middleware.js";
|
|
7
|
+
import { type LoadSheddingOptions } from "./load-shedding.js";
|
|
8
|
+
import { type BehindProxyConfig } from "./conn-info.js";
|
|
9
|
+
/** @internal Test-only helper to reset the latch between tests. */
|
|
10
|
+
export declare function _resetCrashHandlersForTests(): void;
|
|
11
|
+
/** @internal Test-only helper to reset the latch between tests. */
|
|
12
|
+
export declare function _resetInsecureDefaultsLogForTests(): void;
|
|
7
13
|
/**
|
|
8
14
|
* Configuration accepted by {@link App}'s constructor. Every field is
|
|
9
15
|
* optional; sensible production defaults are applied.
|
|
@@ -71,6 +77,21 @@ export interface AppOptions {
|
|
|
71
77
|
* @since 0.16.0
|
|
72
78
|
*/
|
|
73
79
|
secureDefaults?: boolean;
|
|
80
|
+
/**
|
|
81
|
+
* Wave 8 master-flag escape hatch acknowledgement. Required when
|
|
82
|
+
* {@link AppOptions.secureDefaults} is `false` AND the resolved
|
|
83
|
+
* environment is production. Setting this to `true` confirms that the
|
|
84
|
+
* caller understands every Wave 1–7 default is being disabled wholesale
|
|
85
|
+
* and accepts the resulting attack surface — refusing-to-construct in
|
|
86
|
+
* production by default prevents the "developer flipped `secureDefaults`
|
|
87
|
+
* off while debugging and shipped to production" class of accidents.
|
|
88
|
+
* Whenever `secureDefaults: false` is set (in any environment), the
|
|
89
|
+
* framework logs a once-per-process `error` naming every default that
|
|
90
|
+
* the flag turned off.
|
|
91
|
+
*
|
|
92
|
+
* @since 0.26.0
|
|
93
|
+
*/
|
|
94
|
+
acknowledgeInsecureDefaults?: boolean;
|
|
74
95
|
/**
|
|
75
96
|
* Auto-install {@link secureHeaders} as a global hook so every response
|
|
76
97
|
* carries hardened defaults (HSTS, X-Frame-Options, nosniff, strict
|
|
@@ -96,6 +117,104 @@ export interface AppOptions {
|
|
|
96
117
|
* @since 0.16.0
|
|
97
118
|
*/
|
|
98
119
|
corsCrossOriginGuard?: boolean;
|
|
120
|
+
/**
|
|
121
|
+
* Declare whether the application sits behind a trusted reverse proxy
|
|
122
|
+
* that populates `X-Forwarded-*` headers (load balancer, CDN, Vercel,
|
|
123
|
+
* Cloudflare, AWS ALB, etc.). The value is opt-in tri-state for the
|
|
124
|
+
* Wave 3 first-request guard:
|
|
125
|
+
*
|
|
126
|
+
* - `undefined` (default) — *unconfigured*. The framework returns
|
|
127
|
+
* `500 problem+json` on the first request that carries an
|
|
128
|
+
* `X-Forwarded-*` header so a misconfigured proxy chain cannot silently
|
|
129
|
+
* leak spoofed client IPs to the rate limiter, audit logs, or
|
|
130
|
+
* request-id propagation. Disabled when {@link AppOptions.secureDefaults}
|
|
131
|
+
* is `false`.
|
|
132
|
+
* - `true` — *trust*. The framework reads `X-Forwarded-*` without
|
|
133
|
+
* suspicion. Use only when every request passes through a proxy chain
|
|
134
|
+
* you control.
|
|
135
|
+
* - `false` — *explicitly do not trust*. The framework ignores
|
|
136
|
+
* `X-Forwarded-*` even when present and silences the unconfigured-proxy
|
|
137
|
+
* guard. Use when the application is exposed directly to the public
|
|
138
|
+
* internet on purpose.
|
|
139
|
+
*
|
|
140
|
+
* @since 0.17.0
|
|
141
|
+
*/
|
|
142
|
+
trustProxy?: boolean;
|
|
143
|
+
/**
|
|
144
|
+
* Declarative reverse-proxy posture (Wave 6 — `0.24.0`). Supersedes the
|
|
145
|
+
* boolean {@link AppOptions.trustProxy} with a structured value that
|
|
146
|
+
* simultaneously configures rate-limit keying, TLS enforcement, request-IP
|
|
147
|
+
* resolution, and the `X-Forwarded-*` accept policy from a single source
|
|
148
|
+
* of truth.
|
|
149
|
+
*
|
|
150
|
+
* - `"none"` — refuse `X-Forwarded-*` entirely.
|
|
151
|
+
* - `"loopback"` — trust only when the immediate peer is `127.0.0.1` / `::1`.
|
|
152
|
+
* - `{ hops: N }` — trust the proxy chain when exactly N hops sit between
|
|
153
|
+
* Daloy and the public internet; reads the (N+1)-from-rightmost IP.
|
|
154
|
+
* - `{ cidrs: [...] }` — trust only when the immediate peer's address
|
|
155
|
+
* falls inside one of the supplied CIDR ranges.
|
|
156
|
+
*
|
|
157
|
+
* When supplied, the legacy {@link AppOptions.trustProxy} guard is
|
|
158
|
+
* considered satisfied (the framework knows what to do with forwarded
|
|
159
|
+
* headers without further input).
|
|
160
|
+
*
|
|
161
|
+
* @since 0.24.0
|
|
162
|
+
*/
|
|
163
|
+
behindProxy?: BehindProxyConfig;
|
|
164
|
+
/**
|
|
165
|
+
* Opt-out for the Wave 3 boot guard that refuses to start an App which
|
|
166
|
+
* registers {@link session} and any state-changing route without a
|
|
167
|
+
* matching {@link csrf} hook. Set to `"off"` to acknowledge that you
|
|
168
|
+
* intentionally accept cookie-authenticated POST / PUT / PATCH / DELETE
|
|
169
|
+
* requests without CSRF protection (SPA + bearer-token apps, internal
|
|
170
|
+
* services on a private network, etc.). Leave unset (the default) for
|
|
171
|
+
* any browser-facing API: the boot error includes one-line copy-paste
|
|
172
|
+
* remediation. Disabled when {@link AppOptions.secureDefaults} is `false`.
|
|
173
|
+
*
|
|
174
|
+
* @since 0.17.0
|
|
175
|
+
*/
|
|
176
|
+
csrf?: "off";
|
|
177
|
+
/**
|
|
178
|
+
* Install Node-process-level crash handlers for `unhandledRejection` and
|
|
179
|
+
* `uncaughtException` that log the error through the pluggable logger at
|
|
180
|
+
* `fatal` and exit with code `1`. Idempotent across multiple `new App()`
|
|
181
|
+
* calls in the same process — handlers are installed once per process via
|
|
182
|
+
* a module-level latch and re-use the most recently constructed App's
|
|
183
|
+
* logger. Default: `true` in production when
|
|
184
|
+
* {@link AppOptions.secureDefaults} is not `false`. Pass `false` to opt
|
|
185
|
+
* out (long-running CLI processes / test harnesses that intentionally
|
|
186
|
+
* swallow rejections may want this). No-op on runtimes without
|
|
187
|
+
* `process.on` (Cloudflare Workers / Vercel Edge / Fastly).
|
|
188
|
+
*
|
|
189
|
+
* @since 0.18.0
|
|
190
|
+
*/
|
|
191
|
+
crashOnUnhandledRejection?: boolean;
|
|
192
|
+
/**
|
|
193
|
+
* HTTP status code used in access logs when a request handler completes
|
|
194
|
+
* but the client has already disconnected (`request.signal.aborted`).
|
|
195
|
+
* Defaults to `499` (nginx convention: "Client Closed Request"). Must be
|
|
196
|
+
* an integer in the inclusive range `[400, 499]`; values outside that
|
|
197
|
+
* range cause the constructor to throw. Set to disable the rewrite by
|
|
198
|
+
* keeping the handler's original status: pass `0`.
|
|
199
|
+
*
|
|
200
|
+
* The client receives no response (the connection is gone); this option
|
|
201
|
+
* only controls how the access log line classifies the request so
|
|
202
|
+
* disconnect storms do not look like 5xx errors in dashboards.
|
|
203
|
+
*
|
|
204
|
+
* @since 0.20.0
|
|
205
|
+
*/
|
|
206
|
+
disconnectStatusCode?: number;
|
|
207
|
+
/**
|
|
208
|
+
* Install the {@link loadShedding} pressure monitor as a global hook.
|
|
209
|
+
* `true` uses the defaults (event-loop delay at most 1 s, event-loop
|
|
210
|
+
* utilization at most 0.98, sample interval 1 s). Pass an options object to
|
|
211
|
+
* override individual thresholds.
|
|
212
|
+
*
|
|
213
|
+
* Active when {@link AppOptions.secureDefaults} is not `false`.
|
|
214
|
+
*
|
|
215
|
+
* @since 0.20.0
|
|
216
|
+
*/
|
|
217
|
+
loadShedding?: boolean | LoadSheddingOptions;
|
|
99
218
|
/** Pluggable logger. Default: structured JSON logger at "info" (or noop in test). */
|
|
100
219
|
logger?: Logger | {
|
|
101
220
|
level?: "trace" | "debug" | "info" | "warn" | "error" | "fatal";
|
|
@@ -204,6 +323,25 @@ export interface PluginInstalledEvent {
|
|
|
204
323
|
/** Effective mount prefix after parent/group prefixes are applied. */
|
|
205
324
|
prefix: string;
|
|
206
325
|
}
|
|
326
|
+
/**
|
|
327
|
+
* Lifecycle-hook contribution declared by a plugin (Wave 6 item 10).
|
|
328
|
+
* Combined with `before` / `after` ordering hints so security middleware
|
|
329
|
+
* order is deterministic regardless of plugin-registration order.
|
|
330
|
+
*
|
|
331
|
+
* @since 0.24.0
|
|
332
|
+
*/
|
|
333
|
+
export interface PluginExtension {
|
|
334
|
+
/** Unique extension name. Referenced by `before` / `after` on siblings. */
|
|
335
|
+
name: string;
|
|
336
|
+
/** Lifecycle event the handler attaches to. */
|
|
337
|
+
event: "onRequest" | "beforeHandle" | "afterHandle" | "onSend" | "onError";
|
|
338
|
+
/** Hook handler. The shape mirrors the matching {@link Hooks} entry. */
|
|
339
|
+
handler: (...args: any[]) => any;
|
|
340
|
+
/** Extension names this one must run before. */
|
|
341
|
+
before?: readonly string[];
|
|
342
|
+
/** Extension names this one must run after. */
|
|
343
|
+
after?: readonly string[];
|
|
344
|
+
}
|
|
207
345
|
/** Information passed to {@link App.onShutdown} listeners. */
|
|
208
346
|
export interface ShutdownEvent {
|
|
209
347
|
/** Optional human-readable reason supplied to `app.shutdown(_, reason)`. */
|
|
@@ -211,6 +349,70 @@ export interface ShutdownEvent {
|
|
|
211
349
|
/** Drain timeout (ms) the shutdown will use after listeners finish. */
|
|
212
350
|
timeoutMs: number;
|
|
213
351
|
}
|
|
352
|
+
/**
|
|
353
|
+
* Configuration accepted by {@link App.healthcheck} and
|
|
354
|
+
* {@link App.readinesscheck}. All fields are optional.
|
|
355
|
+
*
|
|
356
|
+
* @since 0.18.0
|
|
357
|
+
*/
|
|
358
|
+
export interface HealthRouteOptions {
|
|
359
|
+
/** Override the default path (`/healthz` or `/readyz`). */
|
|
360
|
+
path?: PathString;
|
|
361
|
+
/**
|
|
362
|
+
* Require `Authorization: Bearer <token>` on the probe request. Compared
|
|
363
|
+
* via {@link timingSafeEqual}. When set in production with
|
|
364
|
+
* `secureDefaults: true`, no further opt-in is required.
|
|
365
|
+
*/
|
|
366
|
+
token?: string;
|
|
367
|
+
/**
|
|
368
|
+
* Per-IP fixed-window rate limit. Defaults to `{ limit: 60, windowMs:
|
|
369
|
+
* 60_000 }` (in-memory, per-process). Pass `false` to disable.
|
|
370
|
+
*/
|
|
371
|
+
rateLimit?: {
|
|
372
|
+
limit?: number;
|
|
373
|
+
windowMs?: number;
|
|
374
|
+
} | false;
|
|
375
|
+
/**
|
|
376
|
+
* Acknowledge that the probe is intentionally reachable without
|
|
377
|
+
* credentials in production. Required when `secureDefaults` is on and
|
|
378
|
+
* `token` is omitted; otherwise registration throws.
|
|
379
|
+
*/
|
|
380
|
+
acknowledgeUnauthenticated?: boolean;
|
|
381
|
+
}
|
|
382
|
+
/**
|
|
383
|
+
* Configuration accepted by {@link App.cspReportRoute}. Every field is
|
|
384
|
+
* optional.
|
|
385
|
+
*
|
|
386
|
+
* @since 0.20.0
|
|
387
|
+
*/
|
|
388
|
+
export interface CspReportRouteOptions {
|
|
389
|
+
/** Override the default path (`"/__csp-report"`). */
|
|
390
|
+
path?: PathString;
|
|
391
|
+
/**
|
|
392
|
+
* Per-IP fixed-window rate limit. Defaults to
|
|
393
|
+
* `{ limit: 60, windowMs: 60_000 }` (in-memory, per-process). Pass
|
|
394
|
+
* `false` to disable.
|
|
395
|
+
*/
|
|
396
|
+
rateLimit?: {
|
|
397
|
+
limit?: number;
|
|
398
|
+
windowMs?: number;
|
|
399
|
+
} | false;
|
|
400
|
+
/**
|
|
401
|
+
* Maximum accepted request body size, in bytes. Default `8192`. Larger
|
|
402
|
+
* bodies are rejected with `413`.
|
|
403
|
+
*/
|
|
404
|
+
maxBodyBytes?: number;
|
|
405
|
+
/**
|
|
406
|
+
* Custom sink for parsed reports. Receives the parsed JSON body plus the
|
|
407
|
+
* source IP (or `null` when unknown). Defaults to logging at `warn`
|
|
408
|
+
* through the pluggable logger so violations show up in standard
|
|
409
|
+
* dashboards without extra wiring.
|
|
410
|
+
*/
|
|
411
|
+
onReport?: (report: unknown, ctx: {
|
|
412
|
+
ip: string | null;
|
|
413
|
+
userAgent: string | null;
|
|
414
|
+
}) => void | Promise<void>;
|
|
415
|
+
}
|
|
214
416
|
/**
|
|
215
417
|
* Lightweight introspection record produced by {@link App.introspect}. Useful
|
|
216
418
|
* for tooling (dead-route checks, custom dashboards) that needs to enumerate
|
|
@@ -305,15 +507,20 @@ export declare class App {
|
|
|
305
507
|
private groupHooks;
|
|
306
508
|
private groupTags;
|
|
307
509
|
private groupAuth?;
|
|
510
|
+
/** Effective security markers for each registered route hook chain. */
|
|
511
|
+
private routeSecurityMarkers;
|
|
308
512
|
/** Decorator bag merged into ctx.state on every request. */
|
|
309
513
|
private decorations;
|
|
310
514
|
private installedPlugins;
|
|
311
515
|
private closeHooks;
|
|
312
516
|
private closeHooksRun;
|
|
517
|
+
/** Wave 4 idle-connection close hooks (adapter-registered, sync). */
|
|
518
|
+
private idleConnectionCloseHooks;
|
|
313
519
|
private pluginInstalledListeners;
|
|
314
520
|
private shutdownListeners;
|
|
315
521
|
private shutdownListenersRun;
|
|
316
522
|
private pendingPlugins;
|
|
523
|
+
private pluginBootError;
|
|
317
524
|
/** In-flight request count for graceful shutdown. */
|
|
318
525
|
private inflight;
|
|
319
526
|
private draining;
|
|
@@ -324,7 +531,40 @@ export declare class App {
|
|
|
324
531
|
* retroactively loosen earlier routes.
|
|
325
532
|
*/
|
|
326
533
|
private corsOriginAllows;
|
|
534
|
+
/**
|
|
535
|
+
* Whether the Wave 3 once-only boot guard has run (session + CSRF +
|
|
536
|
+
* state-changing-route check). The check is deferred to first request
|
|
537
|
+
* because route registration and `app.use(csrf(...))` can happen in any
|
|
538
|
+
* order after construction; doing it on first `fetch()` is the latest
|
|
539
|
+
* point we still get a 500 before any handler ever runs.
|
|
540
|
+
*/
|
|
541
|
+
private wave3BootGuard;
|
|
542
|
+
/**
|
|
543
|
+
* Latched marker stamped after the framework has reported the first
|
|
544
|
+
* unconfigured-proxy request. Logged once at `warn` level so production
|
|
545
|
+
* dashboards see the misconfiguration without flooding on every retry.
|
|
546
|
+
*/
|
|
547
|
+
private trustProxyWarned;
|
|
327
548
|
constructor(options?: AppOptions);
|
|
549
|
+
/**
|
|
550
|
+
* Wave 4 leftover: validate {@link AppOptions.disconnectStatusCode}.
|
|
551
|
+
* Refuses anything outside `[400, 499]` (except `0`, which disables the
|
|
552
|
+
* rewrite). Throws at construction time so the misconfiguration cannot
|
|
553
|
+
* survive past boot.
|
|
554
|
+
*/
|
|
555
|
+
private assertDisconnectStatusCode;
|
|
556
|
+
/**
|
|
557
|
+
* Wave 8 — master-flag escape-hatch enforcement. When
|
|
558
|
+
* `secureDefaults: false` is set, the framework:
|
|
559
|
+
* - refuses-to-construct in production unless
|
|
560
|
+
* `acknowledgeInsecureDefaults: true` is also set; closes the
|
|
561
|
+
* "developer flipped the flag off while debugging and shipped to
|
|
562
|
+
* production" footgun.
|
|
563
|
+
* - emits a once-per-process `error` log naming every default the flag
|
|
564
|
+
* disables, so operators see the blast radius even if the option was
|
|
565
|
+
* set deep in shared configuration.
|
|
566
|
+
*/
|
|
567
|
+
private assertInsecureDefaultsAcknowledged;
|
|
328
568
|
/**
|
|
329
569
|
* Install the Wave 2 secure-by-default global hooks. Currently:
|
|
330
570
|
* - {@link secureHeaders} as a group-level hook so every response carries
|
|
@@ -337,6 +577,17 @@ export declare class App {
|
|
|
337
577
|
* `app.use(secureHeaders({...}))` still wins per-header.
|
|
338
578
|
*/
|
|
339
579
|
private installSecureDefaults;
|
|
580
|
+
/**
|
|
581
|
+
* Wave 4 crash-on-unrecoverable-error guard. Installs Node-process-level
|
|
582
|
+
* listeners for `unhandledRejection` and `uncaughtException` that log
|
|
583
|
+
* through the pluggable logger and call `process.exit(1)`. Idempotent via
|
|
584
|
+
* a module-level latch so multiple `new App()` instantiations in the same
|
|
585
|
+
* process do not double-register; the most recently constructed App's
|
|
586
|
+
* logger is used. No-op on runtimes without `process.on` (Workers / Edge
|
|
587
|
+
* / Fastly), in non-production by default, and when
|
|
588
|
+
* `crashOnUnhandledRejection: false` or `secureDefaults: false`.
|
|
589
|
+
*/
|
|
590
|
+
private maybeInstallCrashHandlers;
|
|
340
591
|
/**
|
|
341
592
|
* Emit a one-time `warn` when the explicit {@link AppOptions.env} option
|
|
342
593
|
* disagrees with `process.env.NODE_ENV`. Silent when either signal is
|
|
@@ -366,6 +617,45 @@ export declare class App {
|
|
|
366
617
|
* are unaffected.
|
|
367
618
|
*/
|
|
368
619
|
private assertCrossOriginAllowed;
|
|
620
|
+
/**
|
|
621
|
+
* Wave 3 sync boot guard. Inspects a hook layer being installed via
|
|
622
|
+
* {@link App.use} and refuses-to-boot when:
|
|
623
|
+
*
|
|
624
|
+
* - `cors({ origin: "*" })` is registered while resolved environment is
|
|
625
|
+
* `production`;
|
|
626
|
+
* - `session({ secret })` is registered while resolved environment is
|
|
627
|
+
* `production` and any secret fails {@link assertStrongSecret}.
|
|
628
|
+
*
|
|
629
|
+
* Disabled when `secureDefaults: false`. Thrown errors propagate out of
|
|
630
|
+
* `app.use(...)` so the process exits during startup rather than serving
|
|
631
|
+
* a misconfigured surface.
|
|
632
|
+
*/
|
|
633
|
+
private assertSecureHookConfig;
|
|
634
|
+
private assertRouteAuthPayloadConfig;
|
|
635
|
+
private resetWave3BootGuardCache;
|
|
636
|
+
/**
|
|
637
|
+
* Wave 3 first-request boot guard. Verifies that the assembled hook
|
|
638
|
+
* chain + route table is internally consistent before any user handler
|
|
639
|
+
* runs. Currently checks: when `session()` is installed and any route
|
|
640
|
+
* accepts a state-changing method (`POST` / `PUT` / `PATCH` / `DELETE`),
|
|
641
|
+
* a `csrf()` hook (or third-party equivalent stamped with
|
|
642
|
+
* {@link CSRF_HOOK_MARKER}) must also be present in that route's effective
|
|
643
|
+
* hook chain. Opt out with `app({ csrf: "off" })` or
|
|
644
|
+
* `app({ secureDefaults: false })`. Runs once per App between registration
|
|
645
|
+
* changes; the result is cached so the fast path is a single boolean check.
|
|
646
|
+
*/
|
|
647
|
+
private assertWave3BootGuards;
|
|
648
|
+
/**
|
|
649
|
+
* Wave 3 per-request guard for spoofed proxy headers. When the App was
|
|
650
|
+
* constructed without an explicit {@link AppOptions.trustProxy} value
|
|
651
|
+
* and a request arrives carrying an `X-Forwarded-*` header, refuse to
|
|
652
|
+
* dispatch it: the rate limiter, audit log, and request-id propagation
|
|
653
|
+
* would otherwise honour the attacker-supplied IP. Returns a structured
|
|
654
|
+
* `500 problem+json` so the failure is loud at the network boundary.
|
|
655
|
+
* Disabled when `secureDefaults: false` or when `trustProxy` is set to
|
|
656
|
+
* `true` or `false` explicitly.
|
|
657
|
+
*/
|
|
658
|
+
private assertTrustProxyConfigured;
|
|
369
659
|
/**
|
|
370
660
|
* Resolve the {@link AppOptions.docs} option and, when enabled, register
|
|
371
661
|
* the `/openapi.json` + `/docs` routes. Called once during construction so
|
|
@@ -408,6 +698,56 @@ export declare class App {
|
|
|
408
698
|
* @example `app.ws("/echo", { message(c, d) { c.send(d); } });`
|
|
409
699
|
*/
|
|
410
700
|
ws<P extends PathString, TData = unknown>(path: P, handler: WebSocketHandler<P, any, TData>): this;
|
|
701
|
+
/**
|
|
702
|
+
* Register a liveness probe route. Returns `200 {"status":"ok"}` while
|
|
703
|
+
* the process is alive, regardless of plugin readiness. Use this for
|
|
704
|
+
* container orchestrator `livenessProbe` configuration — a failing
|
|
705
|
+
* liveness probe restarts the container.
|
|
706
|
+
*
|
|
707
|
+
* Defaults (Wave 4 secure-by-default):
|
|
708
|
+
* - path: `/healthz`
|
|
709
|
+
* - rate-limit: 60 req/min per remote IP, in-memory (per-process)
|
|
710
|
+
* - auth: opt-in via `token`. In production with `secureDefaults: true`,
|
|
711
|
+
* registration refuses to add the route without a `token` unless
|
|
712
|
+
* `acknowledgeUnauthenticated: true` is set, so an unguarded
|
|
713
|
+
* healthcheck cannot ship to production by accident.
|
|
714
|
+
*
|
|
715
|
+
* @example
|
|
716
|
+
* ```ts
|
|
717
|
+
* app.healthcheck({ token: process.env.HEALTH_TOKEN! });
|
|
718
|
+
* ```
|
|
719
|
+
*
|
|
720
|
+
* @since 0.18.0
|
|
721
|
+
*/
|
|
722
|
+
healthcheck(opts?: HealthRouteOptions): this;
|
|
723
|
+
/**
|
|
724
|
+
* Register a readiness probe route. Returns `200 {"status":"ready"}`
|
|
725
|
+
* once every async plugin has resolved AND the app is not draining.
|
|
726
|
+
* Returns `503` otherwise. Use this for container orchestrator
|
|
727
|
+
* `readinessProbe` configuration — a failing readiness probe removes
|
|
728
|
+
* the pod from load-balancer rotation without restarting it.
|
|
729
|
+
*
|
|
730
|
+
* Defaults match {@link App.healthcheck} (path defaults to `/readyz`).
|
|
731
|
+
*
|
|
732
|
+
* @since 0.18.0
|
|
733
|
+
*/
|
|
734
|
+
readinesscheck(opts?: HealthRouteOptions): this;
|
|
735
|
+
private registerHealthRoute;
|
|
736
|
+
/**
|
|
737
|
+
* Wave 4 leftover: register a built-in receiver for CSP / Reporting API
|
|
738
|
+
* violation reports. Accepts `application/csp-report` and
|
|
739
|
+
* `application/reports+json` payloads, rate-limits per IP (defaults: 60
|
|
740
|
+
* req/min), caps body size (default 8 KiB), and forwards parsed reports
|
|
741
|
+
* to {@link CspReportRouteOptions.onReport} (or the structured logger
|
|
742
|
+
* when omitted). Returns `204 No Content` so browsers stop retrying.
|
|
743
|
+
*
|
|
744
|
+
* Combine with `secureHeaders({ reportingEndpoints, reportTo })` to wire
|
|
745
|
+
* the browser to this endpoint. The route is registered as `internal:
|
|
746
|
+
* false` (i.e. publicly reachable); that is required for the browser
|
|
747
|
+
* Reporting API to send to it.
|
|
748
|
+
*
|
|
749
|
+
*/
|
|
750
|
+
cspReportRoute(opts?: CspReportRouteOptions): this;
|
|
411
751
|
/**
|
|
412
752
|
* Mount a group of routes under a shared prefix with shared tags, hooks,
|
|
413
753
|
* and authentication. The `register` callback receives an encapsulated
|
|
@@ -479,7 +819,17 @@ export declare class App {
|
|
|
479
819
|
* @param value - Value bound to that property on every request.
|
|
480
820
|
* @returns This `App` instance for chaining.
|
|
481
821
|
*/
|
|
482
|
-
|
|
822
|
+
/**
|
|
823
|
+
* Apply an ordered list of plugin extensions (Wave 6 item 10) to the
|
|
824
|
+
* group-level hook chain. Each extension's `handler` is wrapped into a
|
|
825
|
+
* single-event {@link Hooks} bundle so subsequent route registrations
|
|
826
|
+
* pick it up via the normal hook composition path.
|
|
827
|
+
* @internal
|
|
828
|
+
*/
|
|
829
|
+
private applyExtensions;
|
|
830
|
+
decorate<K extends string, V>(key: K, value: V, opts?: {
|
|
831
|
+
override?: boolean;
|
|
832
|
+
}): this;
|
|
483
833
|
/**
|
|
484
834
|
* Register a callback to run once during graceful shutdown, **after** all
|
|
485
835
|
* in-flight requests have drained. Use this to close database pools, flush
|
|
@@ -507,17 +857,39 @@ export declare class App {
|
|
|
507
857
|
*/
|
|
508
858
|
onShutdown(listener: (info: ShutdownEvent) => void | Promise<void>): this;
|
|
509
859
|
/**
|
|
510
|
-
* Encapsulated plugin registration (Fastify-style). Receives a child App;
|
|
860
|
+
* Encapsulated plugin registration (Fastify-style). Receives a child App;
|
|
861
|
+
* routes/hooks declared on the child are scoped to the plugin by default
|
|
862
|
+
* (Wave 6 item 15 \u2014 encapsulation default `local`).
|
|
863
|
+
*
|
|
864
|
+
* Wave 6 (`0.24.0`) additions on the plugin descriptor object:
|
|
865
|
+
*
|
|
866
|
+
* - `dependencies: string[]` \u2014 prerequisite plugin names; the framework
|
|
867
|
+
* refuses-to-boot at registration time when any declared dependency has
|
|
868
|
+
* not been installed first (item 8).
|
|
869
|
+
* - `seed: string` \u2014 differentiator for parameterized instances of the
|
|
870
|
+
* same plugin (item 16). Dedup key becomes `${name}#${seed}`.
|
|
871
|
+
* - `stateful: boolean` \u2014 when `true` AND `name` is absent AND the app is
|
|
872
|
+
* in production with `secureDefaults` on, registration refuses-to-boot
|
|
873
|
+
* so silent double-installs of global-state-mutating plugins are caught
|
|
874
|
+
* loud (item 16).
|
|
875
|
+
* - `extensions: [{ event, handler, before?, after? }]` \u2014 declarative
|
|
876
|
+
* lifecycle-hook ordering with topological-sort + cycle detection
|
|
877
|
+
* (item 10). Refuses-at-registration on cycles.
|
|
511
878
|
*/
|
|
512
879
|
register(plugin: {
|
|
513
880
|
name?: string;
|
|
514
|
-
|
|
881
|
+
seed?: string;
|
|
882
|
+
stateful?: boolean;
|
|
883
|
+
dependencies?: readonly string[];
|
|
884
|
+
extensions?: ReadonlyArray<PluginExtension>;
|
|
885
|
+
register?: (app: App) => void | Promise<void>;
|
|
515
886
|
} | ((app: App) => void | Promise<void>), config?: {
|
|
516
887
|
prefix?: PathString;
|
|
517
888
|
tags?: string[];
|
|
518
889
|
hooks?: Hooks;
|
|
519
890
|
auth?: RouteDefinition["auth"];
|
|
520
891
|
}): this;
|
|
892
|
+
private trackPendingPlugin;
|
|
521
893
|
private firePluginInstalled;
|
|
522
894
|
/**
|
|
523
895
|
* Wait until every async plugin registered with {@link App.register} has
|
|
@@ -557,6 +929,17 @@ export declare class App {
|
|
|
557
929
|
* to RFC 9457 `application/problem+json` automatically.
|
|
558
930
|
*/
|
|
559
931
|
fetch: (request: Request) => Promise<Response>;
|
|
932
|
+
/**
|
|
933
|
+
* In-process entry point that bypasses the public `404` shield for
|
|
934
|
+
* routes declared with `internal: true`. Use it for cron jobs, admin
|
|
935
|
+
* scripts, and integration tests that need to exercise privileged
|
|
936
|
+
* handlers without exposing them to the network. All other security
|
|
937
|
+
* middleware (CORS, CSRF, rate limit, etc.) still runs normally.
|
|
938
|
+
*
|
|
939
|
+
* @since 0.19.0
|
|
940
|
+
*/
|
|
941
|
+
inject: (request: Request) => Promise<Response>;
|
|
942
|
+
private dispatch;
|
|
560
943
|
/**
|
|
561
944
|
* In-process test client. Accepts the same arguments as the global `fetch`
|
|
562
945
|
* but routes them through `this.fetch` without a network hop. Relative URLs
|
|
@@ -599,7 +982,33 @@ export declare class App {
|
|
|
599
982
|
* @returns Resolves once draining + cleanups complete (or the timeout elapses).
|
|
600
983
|
*/
|
|
601
984
|
shutdown(timeoutMs?: number, reason?: string): Promise<void>;
|
|
985
|
+
/**
|
|
986
|
+
* Alias for {@link App.shutdown}. Matches the Node `Server.close()` shape
|
|
987
|
+
* and reads more naturally from adapters that want a single "stop"
|
|
988
|
+
* method.
|
|
989
|
+
*
|
|
990
|
+
* @since 0.18.0
|
|
991
|
+
*/
|
|
992
|
+
close(timeoutMs?: number, reason?: string): Promise<void>;
|
|
993
|
+
/**
|
|
994
|
+
* Adapter-private hook to register a callback that runs synchronously
|
|
995
|
+
* when {@link App.shutdown} begins draining. The Node adapter uses this
|
|
996
|
+
* to invoke `server.closeIdleConnections()` so keep-alive sockets without
|
|
997
|
+
* an in-flight request are killed immediately instead of being held open
|
|
998
|
+
* until the OS / load balancer notices.
|
|
999
|
+
*
|
|
1000
|
+
* Not part of the documented public API surface: subject to change.
|
|
1001
|
+
*
|
|
1002
|
+
* @internal
|
|
1003
|
+
*/
|
|
1004
|
+
_registerIdleConnectionCloseHook(hook: () => void): void;
|
|
602
1005
|
}
|
|
1006
|
+
/**
|
|
1007
|
+
* Topological sort of plugin extensions (Wave 6 item 10). Refuses-at-call
|
|
1008
|
+
* on cyclic ordering with a structured error naming the cycle.
|
|
1009
|
+
* @internal
|
|
1010
|
+
*/
|
|
1011
|
+
export declare function topoSortExtensions(exts: ReadonlyArray<PluginExtension>): PluginExtension[];
|
|
603
1012
|
/**
|
|
604
1013
|
* Factory alias for `new App(options)`. Lets callers who prefer a
|
|
605
1014
|
* functional style (or who avoid `new`) write:
|
package/dist/app.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,
|
|
1
|
+
{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EAEjB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAiBxB,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAEV,UAAU,EACV,KAAK,EACL,UAAU,EACV,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAIL,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,EAClC,MAAM,WAAW,CAAC;AACnB,OAAO,EAUL,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAA0C,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEtG,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiB3E,mEAAmE;AACnE,wBAAgB,2BAA2B,IAAI,IAAI,CAGlD;AASD,mEAAmE;AACnE,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAkBD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mGAAmG;IACnG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,mEAAmE;QACnE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,yEAAyE;QACzE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,yEAAyE;QACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAEF,+FAA+F;IAC/F,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,MAAM,CAAC;IAE5C;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;;;;;;OAaG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC;IAE7C;;;;;;;;;;;OAWG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE,KAAK,CAAC;IAEb;;;;;;;;;;;;;OAaG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAEpC;;;;;;;;;;;;;OAaG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC;IAE7C,qFAAqF;IACrF,MAAM,CAAC,EACH,MAAM,GACN;QAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;KAAE,GACnE,KAAK,CAAC;IAEV;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,KAAK,CAAC;IAEd;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAE5B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,gBAAgB,CAAC;CAC5C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5B,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACpC,eAAe,CAAC,EAAE,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACpD,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,gFAAgF;IAChF,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;IACrC,oFAAoF;IACpF,EAAE,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC1B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,4BAA4B,CAAC;IACtC,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,GAAG,CAAC,EAAE,gCAAgC,CAAC;CACxC;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,KAAK,EAAE,WAAW,GAAG,cAAc,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3E,wEAAwE;IACxE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;IACjC,gDAAgD;IAChD,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,+CAA+C;IAC/C,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAC1D;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACtC;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,qDAAqD;IACrD,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAC1D;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CACT,MAAM,EAAE,OAAO,EACf,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KACjD,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7C;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,YAAY,EAAE,SAAS,CAAC;CACvC;AA2BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,qBAAa,GAAG;IACd,QAAQ,CAAC,OAAO,EAAE,QAAQ,CACxB,IAAI,CACF,UAAU,EACV,mBAAmB,GAAG,gBAAgB,GAAG,kBAAkB,CAC5D,CACF,GACC,UAAU,CAAC;IACb,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAM;IAE5D,OAAO,CAAC,MAAM,CAA+B;IAC7C,4FAA4F;IAC5F,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAA2B;IACtE,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,SAAS,CAAC,CAA0B;IAC5C,uEAAuE;IACvE,OAAO,CAAC,oBAAoB,CAA8B;IAC1D,4DAA4D;IAC5D,OAAO,CAAC,WAAW,CAA+B;IAClD,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,aAAa,CAAS;IAC9B,qEAAqE;IACrE,OAAO,CAAC,wBAAwB,CAAyB;IACzD,OAAO,CAAC,wBAAwB,CAEzB;IACP,OAAO,CAAC,iBAAiB,CAElB;IACP,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,eAAe,CAGrB;IACF,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,QAAQ,CAAS;IACzB;;;;;OAKG;IACD,OAAO,CAAC,gBAAgB,CAAyB;IAEnD;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAA2C;IAEjE;;;;OAIG;IACH,OAAO,CAAC,gBAAgB,CAAS;gBAErB,OAAO,GAAE,UAAe;IA0BpC;;;;;OAKG;IACH,OAAO,CAAC,0BAA0B;IAUlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IA8B1C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAsB7B;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAwCjC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,wBAAwB;IAoChC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,sBAAsB;IAqB9B,OAAO,CAAC,4BAA4B;IAcpC,OAAO,CAAC,wBAAwB;IAKhC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IA6B7B;;;;;;;;;OASG;IACH,OAAO,CAAC,0BAA0B;IAyClC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAqBtB,OAAO,CAAC,SAAS;IAoHjB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CACH,CAAC,SAAS,UAAU,EACpB,CAAC,SAAS,UAAU,EACpB,GAAG,SAAS,cAAc,GAAG,SAAS,EACtC,GAAG,SAAS,YAAY,EACxB,GAAG,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI;IAiC7C;;;;;;OAMG;IACH,EAAE,CAAC,CAAC,SAAS,UAAU,EAAE,KAAK,GAAG,OAAO,EACtC,IAAI,EAAE,CAAC,EACP,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GACvC,IAAI;IAeP;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW,CAAC,IAAI,GAAE,kBAAuB,GAAG,IAAI;IAQhD;;;;;;;;;;OAUG;IACH,cAAc,CAAC,IAAI,GAAE,kBAAuB,GAAG,IAAI;IAqBnD,OAAO,CAAC,mBAAmB;IA4F3B;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,IAAI;IA4FtD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CACH,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAAC,IAAI,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;KAAE,EAC1E,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAC3B,IAAI;IAkCP;;;;;;;;;;;;;;;;OAgBG;IACH,GAAG,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI;IA8BvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAOvB,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAC1B,GAAG,EAAE,CAAC,EACN,KAAK,EAAE,CAAC,EACR,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO,GAChC,IAAI;IAuBP;;;;;;;;;;OAUG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAK/C;;;;;OAKG;IACH,iBAAiB,CACf,QAAQ,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAC7D,IAAI;IAKP;;;;;OAKG;IACH,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAKzE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CACN,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;QAC5C,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC/C,GACD,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EACxC,MAAM,GAAE;QACN,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;KAC3B,GACL,IAAI;IA0DP,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,mBAAmB;IA8B3B;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,GAAU,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CASjD;IAEF;;;;;;;;OAQG;IACH,MAAM,GAAU,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAElD;IAEF,OAAO,CAAC,QAAQ,CA8Od;IAEF;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CACL,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAC7B,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,QAAQ,CAAC;IASpB;;;;;;OAMG;IACH,UAAU,IAAI,iBAAiB,EAAE;IAsBjC;;;;;;;;;;;;;;;OAeG;IACG,QAAQ,CAAC,SAAS,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoClE;;;;;;OAMG;IACG,KAAK,CAAC,SAAS,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/D;;;;;;;;;;OAUG;IACH,gCAAgC,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,IAAI;CAGzD;AAyCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,CAAC,eAAe,CAAC,GACnC,eAAe,EAAE,CA8CnB;AAiZD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,OAAO,GAAE,UAAe,GAAG,GAAG,CAEvD;AAoGD;;;;;GAKG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAErD"}
|