@daloyjs/core 0.16.0 → 0.29.0

package/dist/load-shedding.js

@@ -0,0 +1,171 @@
+/**
+ * Wave 4 leftover: `loadShedding()` primitive.
+ *
+ * Lightweight Node-process pressure monitor that returns `Hooks` for
+ * `app.use(...)`. When any of the configured thresholds is exceeded,
+ * every incoming request is short-circuited with `503 Service Unavailable`
+ * carrying a `Retry-After` header. First-party answer to
+ * `@fastify/under-pressure`. Defaults are off for heap/RSS thresholds
+ * (deployment-specific) and conservative for everything else (event-loop
+ * delay at 1 s, event-loop utilization at 0.98). The monitor samples at
+ * `sampleIntervalMs` (default 1 s). Graceful no-op on runtimes without
+ * `node:perf_hooks` (Workers / Edge / Fastly Compute).
+ *
+ * @since 0.20.0
+ */
+import { HttpError } from "./errors.js";
+async function tryLoadPerfHooks() {
+    try {
+        return (await import("node:perf_hooks"));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Build a Hooks bundle that refuses requests with `503` when the configured
+ * process-pressure thresholds are exceeded.
+ *
+ * @example
+ * ```ts
+ * import { App, loadShedding } from "@daloyjs/core";
+ *
+ * const app = new App();
+ * app.use(loadShedding({
+ *   maxEventLoopDelayMs: 500,
+ *   maxHeapUsedBytes: 1.5 * 1024 ** 3,
+ *   retryAfterSeconds: 5,
+ * }));
+ * ```
+ */
+export function loadShedding(opts = {}) {
+    const maxDelay = opts.maxEventLoopDelayMs ?? 1000;
+    const maxHeap = opts.maxHeapUsedBytes;
+    const maxRss = opts.maxRssBytes;
+    const maxELU = opts.maxEventLoopUtilization ?? 0.98;
+    const sampleMs = Math.max(100, opts.sampleIntervalMs ?? 1000);
+    const retryAfter = opts.retryAfterSeconds ?? 10;
+    const healthCheckMs = Math.max(100, opts.healthCheckIntervalMs ?? sampleMs);
+    const snapshot = {
+        eventLoopDelayMs: 0,
+        heapUsedBytes: 0,
+        rssBytes: 0,
+        eventLoopUtilization: 0,
+    };
+    let perf;
+    let histogram;
+    let lastELU;
+    let lastSample = 0;
+    let lastHealth = 0;
+    let perfPromise;
+    let timer;
+    let stopped = false;
+    const procRef = typeof process !== "undefined" ? process : undefined;
+    const ensurePerf = () => {
+        if (perfPromise)
+            return perfPromise;
+        perfPromise = (async () => {
+            perf = await tryLoadPerfHooks();
+            if (perf?.monitorEventLoopDelay && maxDelay > 0) {
+                histogram = perf.monitorEventLoopDelay({ resolution: 20 });
+                histogram.enable();
+                // Make sure the histogram does not pin the event loop alive.
+                const unref = histogram.unref;
+                if (typeof unref === "function")
+                    unref.call(histogram);
+            }
+            if (perf?.performance?.eventLoopUtilization) {
+                lastELU = perf.performance.eventLoopUtilization();
+            }
+        })();
+        return perfPromise;
+    };
+    const refreshSnapshot = () => {
+        if (histogram) {
+            // mean is in nanoseconds; convert to ms.
+            snapshot.eventLoopDelayMs = histogram.mean / 1e6;
+            histogram.reset();
+        }
+        if (perf?.performance?.eventLoopUtilization && lastELU) {
+            const next = perf.performance.eventLoopUtilization(lastELU);
+            snapshot.eventLoopUtilization = next.utilization;
+            lastELU = perf.performance.eventLoopUtilization();
+        }
+        if (procRef?.memoryUsage) {
+            const mem = procRef.memoryUsage();
+            snapshot.heapUsedBytes = mem.heapUsed;
+            snapshot.rssBytes = mem.rss;
+        }
+    };
+    const reasonFor = () => {
+        if (maxDelay > 0 && snapshot.eventLoopDelayMs > maxDelay) {
+            return `event-loop delay ${snapshot.eventLoopDelayMs.toFixed(0)}ms > ${maxDelay}ms`;
+        }
+        if (maxHeap !== undefined && snapshot.heapUsedBytes > maxHeap) {
+            return `heap used ${snapshot.heapUsedBytes} > ${maxHeap}`;
+        }
+        if (maxRss !== undefined && snapshot.rssBytes > maxRss) {
+            return `rss ${snapshot.rssBytes} > ${maxRss}`;
+        }
+        if (maxELU > 0 && snapshot.eventLoopUtilization > maxELU) {
+            return `event-loop utilization ${snapshot.eventLoopUtilization.toFixed(3)} > ${maxELU}`;
+        }
+        if (snapshot.reason)
+            return snapshot.reason;
+        return undefined;
+    };
+    const startTimer = () => {
+        if (timer || stopped)
+            return;
+        if (typeof setInterval !== "function")
+            return;
+        timer = setInterval(() => {
+            refreshSnapshot();
+        }, sampleMs);
+        const unref = timer.unref;
+        if (typeof unref === "function")
+            unref.call(timer);
+    };
+    const maybeSample = async () => {
+        await ensurePerf();
+        const now = Date.now();
+        if (now - lastSample >= sampleMs) {
+            lastSample = now;
+            refreshSnapshot();
+            startTimer();
+        }
+        if (opts.healthCheck && now - lastHealth >= healthCheckMs) {
+            lastHealth = now;
+            try {
+                const reason = await opts.healthCheck();
+                snapshot.reason = reason || undefined;
+            }
+            catch (err) {
+                snapshot.reason =
+                    err instanceof Error ? `healthCheck threw: ${err.message}` : "healthCheck threw";
+            }
+        }
+    };
+    return {
+        async beforeHandle() {
+            await maybeSample();
+            const reason = reasonFor();
+            if (!reason)
+                return undefined;
+            throw new HttpError(503, {
+                type: "https://daloyjs.dev/errors/load-shed",
+                title: "Service Unavailable",
+                detail: `Load shedding: ${reason}`,
+            }, { "retry-after": String(retryAfter) });
+        },
+    };
+}
+/**
+ * Read-only accessor for tests + observability plugins that want to know
+ * what the latest pressure sample looked like. Returns `undefined` if the
+ * given hooks object was not produced by {@link loadShedding}.
+ *
+ * @internal
+ */
+export const LOAD_SHEDDING_MARKER = Symbol.for("daloyjs.loadShedding");
+//# sourceMappingURL=load-shedding.js.map

package/dist/load-shedding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-shedding.js","sourceRoot":"","sources":["../src/load-shedding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAoCxC,KAAK,UAAU,gBAAgB;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAA4B,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B,EAAE;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAChD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,EACH,IAAI,CAAC,qBAAqB,IAAI,QAAQ,CACvC,CAAC;IAEF,MAAM,QAAQ,GAAyB;QACrC,gBAAgB,EAAE,CAAC;QACnB,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,CAAC;QACX,oBAAoB,EAAE,CAAC;KACxB,CAAC;IAEF,IAAI,IAA8B,CAAC;IACnC,IAAI,SAAqF,CAAC;IAC1F,IAAI,OAA0E,CAAC;IAC/E,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,WAAsC,CAAC;IAC3C,IAAI,KAAiD,CAAC;IACtD,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,OAAO,GACX,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAE,OAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3E,MAAM,UAAU,GAAG,GAAkB,EAAE;QACrC,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QACpC,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;YACxB,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YAChC,IAAI,IAAI,EAAE,qBAAqB,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAChD,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC3D,SAAS,CAAC,MAAM,EAAE,CAAC;gBACnB,6DAA6D;gBAC7D,MAAM,KAAK,GAAI,SAA+C,CAAC,KAAK,CAAC;gBACrE,IAAI,OAAO,KAAK,KAAK,UAAU;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,IAAI,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;gBAC5C,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE,CAAC;YACpD,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAS,EAAE;QACjC,IAAI,SAAS,EAAE,CAAC;YACd,yCAAyC;YACzC,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC;YACjD,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,IAAI,EAAE,WAAW,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC5D,QAAQ,CAAC,oBAAoB,GAAG,IAAI,CAAC,WAAW,CAAC;YACjD,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAClC,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC;YACtC,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,GAAuB,EAAE;QACzC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,EAAE,CAAC;YACzD,OAAO,oBAAoB,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,QAAQ,IAAI,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,aAAa,GAAG,OAAO,EAAE,CAAC;YAC9D,OAAO,aAAa,QAAQ,CAAC,aAAa,MAAM,OAAO,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,GAAG,MAAM,EAAE,CAAC;YACvD,OAAO,OAAO,QAAQ,CAAC,QAAQ,MAAM,MAAM,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,oBAAoB,GAAG,MAAM,EAAE,CAAC;YACzD,OAAO,0BAA0B,QAAQ,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,IAAI,KAAK,IAAI,OAAO;YAAE,OAAO;QAC7B,IAAI,OAAO,WAAW,KAAK,UAAU;YAAE,OAAO;QAC9C,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YACvB,eAAe,EAAE,CAAC;QACpB,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,MAAM,KAAK,GAAI,KAA2C,CAAC,KAAK,CAAC;QACjE,IAAI,OAAO,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;QAC5C,MAAM,UAAU,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC;YACjC,UAAU,GAAG,GAAG,CAAC;YACjB,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,IAAI,GAAG,GAAG,UAAU,IAAI,aAAa,EAAE,CAAC;YAC1D,UAAU,GAAG,GAAG,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;gBACxC,QAAQ,CAAC,MAAM,GAAG,MAAM,IAAI,SAAS,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,MAAM;oBACb,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,MAAM,IAAI,SAAS,CACjB,GAAG,EACH;gBACE,IAAI,EAAE,sCAAsC;gBAC5C,KAAK,EAAE,qBAAqB;gBAC5B,MAAM,EAAE,kBAAkB,MAAM,EAAE;aACnC,EACD,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CACtC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkB,MAAM,CAAC,GAAG,CAC3D,sBAAsB,CACvB,CAAC"}

package/dist/middleware.d.ts

@@ -64,6 +64,15 @@ export interface CspDirectivesOptions {
     trustedTypes?: boolean | {
         policies?: string[];
     };
+    /**
+     * When set, append `report-to <group>` to the generated CSP header so
+     * browsers POST violation reports to the named Reporting API endpoint.
+     * Pair with {@link SecureHeadersOptions.reportingEndpoints} (or
+     * {@link App.cspReportRoute}) to register the receiver. Wave 4 leftover.
+     *
+    * @since 0.20.0
+     */
+    reportTo?: string;
 }
 export interface SecureHeadersOptions {
     contentSecurityPolicy?: string | false | CspDirectivesOptions;
@@ -79,6 +88,27 @@ export interface SecureHeadersOptions {
     crossOriginResourcePolicy?: string | false;
     noSniff?: boolean;
     xssProtection?: boolean;
+    /**
+     * Reporting API endpoint declarations rendered as the
+     * `Reporting-Endpoints` response header (modern browsers) plus a
+     * legacy `Report-To` JSON header for older Chromium versions. Keys are
+     * group names; values are absolute URLs that accept POSTed reports.
+     * Pair with {@link CspDirectivesOptions.reportTo} (or pass
+     * `reportTo: "csp-endpoint"` here as a shortcut) to direct CSP
+     * violation reports there. Wave 4 leftover.
+     *
+    * @since 0.20.0
+     */
+    reportingEndpoints?: Record<string, string>;
+    /**
+     * Shortcut: when set and {@link SecureHeadersOptions.contentSecurityPolicy}
+     * is a directives object, append `report-to <reportTo>` to the CSP
+     * header so violation reports land at the matching
+     * `reportingEndpoints` URL.
+     *
+    * @since 0.20.0
+     */
+    reportTo?: string;
 }
 /**
  * Apply a Helmet-equivalent baseline of secure response headers:
@@ -140,6 +170,30 @@ export declare const CORS_HOOK_MARKER: unique symbol;
  * @since 0.16.0
  */
 export declare const CORS_ORIGIN_ALLOW_MARKER: unique symbol;
+/**
+ * Marker stamped on the `Hooks` object returned by {@link cors} when the
+ * configured `origin` permits the wildcard `"*"`. Used by the Wave 3
+ * boot-time refuse-to-boot guard: a wildcard CORS origin in production is
+ * almost always a misconfiguration, so `App` constructed with
+ * `secureDefaults: true` (the 0.16+ default) and resolved to
+ * `production` throws at `app.use(cors({ origin: "*" }))` time rather than
+ * silently exposing every state-changing endpoint cross-origin.
+ *
+ * @since 0.17.0
+ */
+export declare const CORS_WILDCARD_ORIGIN_MARKER: unique symbol;
+/**
+ * Marker stamped on the `Hooks` object returned by {@link csrf}. Used by
+ * the Wave 3 boot-time refuse-to-boot guard: when `session()` is registered
+ * on a `secureDefaults: true` App that also exposes any state-changing
+ * route, the framework requires a matching `csrf()` hook somewhere in the
+ * hook chain so an attacker cannot forge a cross-site request that mutates
+ * the authenticated session. Third-party CSRF helpers can opt into the
+ * guard by stamping the same marker on their returned hooks.
+ *
+ * @since 0.17.0
+ */
+export declare const CSRF_HOOK_MARKER: unique symbol;
 export type CorsOriginAllow = (origin: string) => boolean;
 export interface CorsOptions {
     origin: string | string[] | ((origin: string) => boolean);
@@ -195,7 +249,23 @@ export interface RateLimitOptions {
     trustProxyHeaders?: boolean;
     /** When true, set Retry-After header on 429. Default: true. */
     retryAfter?: boolean;
+    /**
+     * Share a single bucket across every `rateLimit()` call that declares the
+     * same `groupId`. Use this to enforce one combined limit across related
+     * routes (e.g. `/login`, `/login/otp`, and `/password-reset` all spend
+     * from the same per-IP "auth" bucket). Without `groupId`, each
+     * `rateLimit()` call gets its own independent in-memory store.
+     *
+     * Cooperation is only meaningful for the default in-memory store; when
+     * an explicit `store` is supplied the developer is responsible for
+     * keying it. The framework prepends the `groupId` to the derived key so
+     * two groups never collide in a shared store either.
+     *
+     * @since 0.19.0
+     */
+    groupId?: string;
 }
+export declare function _resetSharedRateLimitStoresForTests(): void;
 /**
  * Fixed-window rate limiter. Throws {@link TooManyRequestsError} (mapped to
  * `429`) when a key exceeds `max` requests inside `windowMs`. Adds
@@ -229,6 +299,40 @@ export interface RateLimitOptions {
  * @since 0.1.0
  */
 export declare function rateLimit(opts: RateLimitOptions): Hooks;
+export interface LoginThrottleOptions {
+    /** Fixed-window length in ms. Default: 15 minutes. */
+    windowMs?: number;
+    /** Maximum attempts before returning 429. Default: 5. */
+    max?: number;
+    /** Shared bucket id. Default: `"login"`. */
+    groupId?: string;
+    /** Derive the caller key. Defaults to trusted proxy headers only when enabled. */
+    keyGenerator?: (ctx: BaseContext<any, any>) => string;
+    /** Shared store for the hard limit. Uses rateLimit()'s in-memory group bucket by default. */
+    store?: RateLimitStore;
+    /** Trust x-forwarded-for / x-real-ip when deriving the default key. Default: false. */
+    trustProxyHeaders?: boolean;
+    /** When true, set Retry-After header on 429. Default: true. */
+    retryAfter?: boolean;
+    /** Start slowing responses after this many attempts in the same window. Default: 2. */
+    delayAfter?: number;
+    /** Added delay per attempt beyond delayAfter, in ms. Default: 250. */
+    delayMs?: number;
+    /** Maximum slowdown delay in ms. Default: 2000. */
+    maxDelayMs?: number;
+}
+/**
+ * Login throttle preset for `/login`, `/login/otp`, password reset, and
+ * adjacent credential-entry routes. It combines a shared `rateLimit({ groupId })`
+ * bucket with a small progressive slowdown before the hard 429 kicks in.
+ *
+ * Mount the same `loginThrottle()` instance (or multiple instances with the
+ * same `groupId`) across related routes so an attacker cannot bypass the limit
+ * by rotating between password, OTP, and reset endpoints.
+ *
+ * @since 0.23.0
+ */
+export declare function loginThrottle(opts?: LoginThrottleOptions): Hooks;
 /**
  * Stamp a `Server-Timing` header (or your chosen header) on every response
  * with the handler's wall-clock duration in milliseconds. Browsers display
@@ -270,10 +374,63 @@ export declare function timing(headerName?: string): Hooks;
  * @returns A {@link Hooks} bundle ready for `app.use(...)`.
  * @since 0.1.0
  */
-export declare function bearerAuth(opts: {
+/**
+ * Per-request revalidation hook for {@link bearerAuth}. Runs after `validate`
+ * has accepted the raw token, and is the integration point for
+ * **revocation lists**, **token-version counters** ("user changed password
+ * since this token was issued"), and "this token was issued before the
+ * tenant was disabled" checks. Returning `false` rejects the request with
+ * `403`; returning `true` or `undefined` accepts.
+ *
+ * @since 0.22.0
+ */
+export type BearerAuthVerifyHook<TCredentials = string> = (credentials: TCredentials, ctx: BaseContext<any, any>) => boolean | void | Promise<boolean | void>;
+export interface BearerAuthOptions {
+    /** Cheap, stateless token check (signature / format). */
     validate: (token: string) => boolean | Promise<boolean>;
+    /** WWW-Authenticate realm. Default: `"api"`. */
     realm?: string;
-}): Hooks;
+    /**
+     * Optional per-request revalidation hook (Wave 5). Called after `validate`
+    * accepts the token. Returning `false` rejects the request with `403`;
+    * returning `true` or `undefined` accepts. Use for revocation lists,
+    * token-version counters, etc.
+     *
+     * @since 0.22.0
+     */
+    verify?: BearerAuthVerifyHook<string>;
+}
+/**
+ * Minimal Bearer-token authentication middleware. Rejects requests with no
+ * `Authorization: Bearer ...` header with `401` (and a `WWW-Authenticate`
+ * challenge), and requests whose token fails `validate(token)` (or the
+ * optional per-request `verify(token, ctx)` revalidation hook) with `403`.
+ *
+ * The `validate` callback is the integration point with whatever JWT
+ * verifier, opaque-token introspector, or in-memory test stub you use. The
+ * optional `verify` hook (Wave 5) is the integration point for revocation
+ * lists, token-version counters, and other per-request invalidation checks
+ * that `validate` cannot answer statelessly.
+ *
+ * @example
+ * ```ts
+ * import { bearerAuth } from "@daloyjs/core";
+ * import { jwtVerify } from "jose";
+ *
+ * app.use(bearerAuth({
+ *   realm: "books-api",
+ *   validate: async (token) => {
+ *     try { await jwtVerify(token, jwks); return true; } catch { return false; }
+ *   },
+ *   verify: async (token, _ctx) => !(await revoked.has(hash(token))),
+ * }));
+ * ```
+ *
+ * @param opts - Token validator, optional revalidation hook, and realm.
+ * @returns A {@link Hooks} bundle ready for `app.use(...)`.
+ * @since 0.1.0
+ */
+export declare function bearerAuth(opts: BearerAuthOptions): Hooks;
 /**
  * Cookie attributes for the CSRF token cookie. The token cookie must be
  * **readable by client-side JavaScript** (so the SPA can mirror it into a
@@ -383,6 +540,18 @@ export interface BasicAuthOptions {
      * without invoking `verify`.
      */
     maxCredentialBytes?: number;
+    /**
+     * Typed-context callback fired after `verify` accepts the credentials and
+     * after the framework has stamped `ctx.state.user`. Use this to decorate
+     * `ctx.state` with extra fields (typed via `AppState`) so handlers do not
+     * re-parse the `Authorization` header in every route.
+     *
+     * @since 0.22.0
+     */
+    onAuthSuccess?: (creds: {
+        username: string;
+        password: string;
+    }, ctx: BaseContext<any, any>) => void | Promise<void>;
 }
 /**
  * HTTP Basic Authentication middleware (RFC 7617).
@@ -412,5 +581,39 @@ export interface BasicAuthOptions {
  * @since 0.12.0
  */
 export declare function basicAuth(opts: BasicAuthOptions): Hooks;
+/**
+ * Marker stamped on the per-request `state` bag so multiple `requireScopes()`
+ * hooks in the same chain aggregate their required scopes into one combined
+ * `WWW-Authenticate: Bearer scope="..."` challenge instead of each emitting a
+ * separate `401` with only its own scopes.
+ *
+ * @since 0.21.0
+ */
+export declare const REQUIRE_SCOPES_AGGREGATE_KEY: "__daloyRequiredScopes";
+export declare const REQUIRE_SCOPES_HOOK_MARKER: unique symbol;
+/**
+ * Declarative scope-check middleware for OAuth2-style bearer credentials.
+ * Reads the typed `ctx.state.user.scopes` written by the upstream auth
+ * helper (`bearerAuth`, `jwt`, …) and refuses the request with `401` (no
+ * credentials) or `403` (valid credentials but insufficient scopes).
+ *
+ * Multiple `requireScopes()` hooks in the same chain aggregate their required
+ * scopes into one combined `WWW-Authenticate: Bearer scope="a b c"` challenge
+ * via {@link REQUIRE_SCOPES_AGGREGATE_KEY} on `ctx.state`.
+ *
+ * @example
+ * ```ts
+ * app.route({
+ *   method: "POST",
+ *   path: "/items",
+ *   hooks: { ...bearerAuth({ validate }), ...requireScopes(["items:write"]) },
+ *   responses: { 200: { description: "ok" } },
+ *   handler: () => ({ status: 200 as const, body: { ok: true } }),
+ * });
+ * ```
+ *
+ * @since 0.21.0
+ */
+export declare function requireScopes(scopes: readonly string[]): Hooks;
 export { timingSafeEqual };
 //# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,EAAgC,eAAe,EAAE,MAAM,eAAe,CAAC;AAI9E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,KAAK,CAgB5D;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,qBAAqB,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,oBAAoB,CAAC;IAC9D,IAAI,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,KAAK,CAAC;IACzF,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;IAC7C,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACnC,uBAAuB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzC,yBAAyB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAkDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,MAE1C,CAAC;AAEF,wBAAgB,aAAa,CAAC,IAAI,GAAE,oBAAyB,GAAG,KAAK,CA2DpE;AAKD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,EAAE,OAAO,MAErC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,EAAE,OAAO,MAE7C,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;AAE1D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;IAC1D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,KAAK,CAgE7C;AAID,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,MAAM,CAAC;IACtD,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,KAAK,CA4BvD;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,MAAM,CAAC,UAAU,SAAkB,GAAG,KAAK,CAe1D;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAC/B,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,KAAK,CA0BR;AAID;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,eAAe,GAAG,gBAAgB,GAAG,MAAM,CAAC;IACvD;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;IAC1D;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,yDAAyD;IACzD,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1B;AA4ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,IAAI,CAAC,IAAI,GAAE,WAAgB,GAAG,KAAK,CA8FlD;AAID,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;OAQG;IACH,MAAM,EAAE,CACN,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IACrE,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AA8CD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,KAAK,CA6BvD;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGrD,OAAO,EAAgC,eAAe,EAAE,MAAM,eAAe,CAAC;AAI9E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,KAAK,CAgB5D;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACjD;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,qBAAqB,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,oBAAoB,CAAC;IAC9D,IAAI,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,KAAK,CAAC;IACzF,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;IAC7C,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACnC,uBAAuB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzC,yBAAyB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA+ED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,MAE1C,CAAC;AAEF,wBAAgB,aAAa,CAAC,IAAI,GAAE,oBAAyB,GAAG,KAAK,CA8HpE;AAKD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,EAAE,OAAO,MAErC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,EAAE,OAAO,MAE7C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,MAEhD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,EAAE,OAAO,MAErC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;AAE1D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;IAC1D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,KAAK,CAsE7C;AAID,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,MAAM,CAAC;IACtD,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAcD,wBAAgB,mCAAmC,IAAI,IAAI,CAG1D;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,KAAK,CAyCvD;AAID,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,MAAM,CAAC;IACtD,6FAA6F;IAC7F,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA+BD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,GAAE,oBAAyB,GAAG,KAAK,CAyDpE;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,MAAM,CAAC,UAAU,SAAkB,GAAG,KAAK,CAe1D;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,CAAC,YAAY,GAAG,MAAM,IAAI,CACxD,WAAW,EAAE,YAAY,EACzB,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KACvB,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,KAAK,CAuCzD;AAID;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,eAAe,GAAG,gBAAgB,GAAG,MAAM,CAAC;IACvD;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;IAC1D;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,yDAAyD;IACzD,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1B;AA4BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,IAAI,CAAC,IAAI,GAAE,WAAgB,GAAG,KAAK,CAsGlD;AAID,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;OAQG;IACH,MAAM,EAAE,CACN,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IACrE,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,CACd,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAC7C,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KACvB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,KAAK,CAmCvD;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAAG,uBAAgC,CAAC;AAE7E,eAAO,MAAM,0BAA0B,EAAE,OAAO,MAE/C,CAAC;AAqCF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CA6C9D;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}