@daloyjs/core 0.16.0 → 0.29.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (102) hide show
  1. package/README.md +3 -3
  2. package/dist/adapters/bun.d.ts.map +1 -1
  3. package/dist/adapters/bun.js +38 -7
  4. package/dist/adapters/bun.js.map +1 -1
  5. package/dist/adapters/node.d.ts.map +1 -1
  6. package/dist/adapters/node.js +29 -7
  7. package/dist/adapters/node.js.map +1 -1
  8. package/dist/app.d.ts +412 -3
  9. package/dist/app.d.ts.map +1 -1
  10. package/dist/app.js +895 -29
  11. package/dist/app.js.map +1 -1
  12. package/dist/cli.d.ts +4 -0
  13. package/dist/cli.d.ts.map +1 -1
  14. package/dist/cli.js +218 -1
  15. package/dist/cli.js.map +1 -1
  16. package/dist/combine.d.ts +97 -0
  17. package/dist/combine.d.ts.map +1 -0
  18. package/dist/combine.js +247 -0
  19. package/dist/combine.js.map +1 -0
  20. package/dist/compression.d.ts +127 -0
  21. package/dist/compression.d.ts.map +1 -0
  22. package/dist/compression.js +368 -0
  23. package/dist/compression.js.map +1 -0
  24. package/dist/config.d.ts +97 -0
  25. package/dist/config.d.ts.map +1 -0
  26. package/dist/config.js +132 -0
  27. package/dist/config.js.map +1 -0
  28. package/dist/conn-info.d.ts +121 -0
  29. package/dist/conn-info.d.ts.map +1 -0
  30. package/dist/conn-info.js +145 -0
  31. package/dist/conn-info.js.map +1 -0
  32. package/dist/cookie.d.ts +112 -0
  33. package/dist/cookie.d.ts.map +1 -0
  34. package/dist/cookie.js +185 -0
  35. package/dist/cookie.js.map +1 -0
  36. package/dist/dependency.d.ts +47 -0
  37. package/dist/dependency.d.ts.map +1 -0
  38. package/dist/dependency.js +68 -0
  39. package/dist/dependency.js.map +1 -0
  40. package/dist/etag.d.ts +48 -0
  41. package/dist/etag.d.ts.map +1 -0
  42. package/dist/etag.js +117 -0
  43. package/dist/etag.js.map +1 -0
  44. package/dist/index.d.ts +41 -12
  45. package/dist/index.d.ts.map +1 -1
  46. package/dist/index.js +20 -5
  47. package/dist/index.js.map +1 -1
  48. package/dist/ip-restriction.d.ts +75 -0
  49. package/dist/ip-restriction.d.ts.map +1 -0
  50. package/dist/ip-restriction.js +203 -0
  51. package/dist/ip-restriction.js.map +1 -0
  52. package/dist/jwk.d.ts +82 -0
  53. package/dist/jwk.d.ts.map +1 -0
  54. package/dist/jwk.js +269 -0
  55. package/dist/jwk.js.map +1 -0
  56. package/dist/jwt.d.ts +103 -0
  57. package/dist/jwt.d.ts.map +1 -0
  58. package/dist/jwt.js +437 -0
  59. package/dist/jwt.js.map +1 -0
  60. package/dist/load-shedding.d.ts +73 -0
  61. package/dist/load-shedding.d.ts.map +1 -0
  62. package/dist/load-shedding.js +171 -0
  63. package/dist/load-shedding.js.map +1 -0
  64. package/dist/middleware.d.ts +205 -2
  65. package/dist/middleware.d.ts.map +1 -1
  66. package/dist/middleware.js +399 -78
  67. package/dist/middleware.js.map +1 -1
  68. package/dist/multipart.d.ts +17 -0
  69. package/dist/multipart.d.ts.map +1 -1
  70. package/dist/multipart.js +117 -1
  71. package/dist/multipart.js.map +1 -1
  72. package/dist/openapi.d.ts +8 -0
  73. package/dist/openapi.d.ts.map +1 -1
  74. package/dist/openapi.js +18 -1
  75. package/dist/openapi.js.map +1 -1
  76. package/dist/security-schemes.d.ts +21 -5
  77. package/dist/security-schemes.d.ts.map +1 -1
  78. package/dist/security-schemes.js +32 -5
  79. package/dist/security-schemes.js.map +1 -1
  80. package/dist/security.d.ts +32 -0
  81. package/dist/security.d.ts.map +1 -1
  82. package/dist/security.js +79 -0
  83. package/dist/security.js.map +1 -1
  84. package/dist/session.d.ts +43 -1
  85. package/dist/session.d.ts.map +1 -1
  86. package/dist/session.js +130 -87
  87. package/dist/session.js.map +1 -1
  88. package/dist/subdomains.d.ts +97 -0
  89. package/dist/subdomains.d.ts.map +1 -0
  90. package/dist/subdomains.js +157 -0
  91. package/dist/subdomains.js.map +1 -0
  92. package/dist/time-claims.d.ts +72 -0
  93. package/dist/time-claims.d.ts.map +1 -0
  94. package/dist/time-claims.js +88 -0
  95. package/dist/time-claims.js.map +1 -0
  96. package/dist/types.d.ts +50 -0
  97. package/dist/types.d.ts.map +1 -1
  98. package/dist/websocket.d.ts +51 -34
  99. package/dist/websocket.d.ts.map +1 -1
  100. package/dist/websocket.js +162 -2
  101. package/dist/websocket.js.map +1 -1
  102. package/package.json +31 -3
package/dist/app.d.ts CHANGED
@@ -4,6 +4,12 @@ import type { HttpMethod, Hooks, PathString, RequestSchemas, ResponsesMap, Route
4
4
  import { type OpenAPIInfo, type OpenAPIOptions } from "./openapi.js";
5
5
  import { type DocsContentSecurityPolicyOptions, type ScalarReferenceConfiguration } from "./docs.js";
6
6
  import { type SecureHeadersOptions } from "./middleware.js";
7
+ import { type LoadSheddingOptions } from "./load-shedding.js";
8
+ import { type BehindProxyConfig } from "./conn-info.js";
9
+ /** @internal Test-only helper to reset the latch between tests. */
10
+ export declare function _resetCrashHandlersForTests(): void;
11
+ /** @internal Test-only helper to reset the latch between tests. */
12
+ export declare function _resetInsecureDefaultsLogForTests(): void;
7
13
  /**
8
14
  * Configuration accepted by {@link App}'s constructor. Every field is
9
15
  * optional; sensible production defaults are applied.
@@ -71,6 +77,21 @@ export interface AppOptions {
71
77
  * @since 0.16.0
72
78
  */
73
79
  secureDefaults?: boolean;
80
+ /**
81
+ * Wave 8 master-flag escape hatch acknowledgement. Required when
82
+ * {@link AppOptions.secureDefaults} is `false` AND the resolved
83
+ * environment is production. Setting this to `true` confirms that the
84
+ * caller understands every Wave 1–7 default is being disabled wholesale
85
+ * and accepts the resulting attack surface — refusing-to-construct in
86
+ * production by default prevents the "developer flipped `secureDefaults`
87
+ * off while debugging and shipped to production" class of accidents.
88
+ * Whenever `secureDefaults: false` is set (in any environment), the
89
+ * framework logs a once-per-process `error` naming every default that
90
+ * the flag turned off.
91
+ *
92
+ * @since 0.26.0
93
+ */
94
+ acknowledgeInsecureDefaults?: boolean;
74
95
  /**
75
96
  * Auto-install {@link secureHeaders} as a global hook so every response
76
97
  * carries hardened defaults (HSTS, X-Frame-Options, nosniff, strict
@@ -96,6 +117,104 @@ export interface AppOptions {
96
117
  * @since 0.16.0
97
118
  */
98
119
  corsCrossOriginGuard?: boolean;
120
+ /**
121
+ * Declare whether the application sits behind a trusted reverse proxy
122
+ * that populates `X-Forwarded-*` headers (load balancer, CDN, Vercel,
123
+ * Cloudflare, AWS ALB, etc.). The value is opt-in tri-state for the
124
+ * Wave 3 first-request guard:
125
+ *
126
+ * - `undefined` (default) — *unconfigured*. The framework returns
127
+ * `500 problem+json` on the first request that carries an
128
+ * `X-Forwarded-*` header so a misconfigured proxy chain cannot silently
129
+ * leak spoofed client IPs to the rate limiter, audit logs, or
130
+ * request-id propagation. Disabled when {@link AppOptions.secureDefaults}
131
+ * is `false`.
132
+ * - `true` — *trust*. The framework reads `X-Forwarded-*` without
133
+ * suspicion. Use only when every request passes through a proxy chain
134
+ * you control.
135
+ * - `false` — *explicitly do not trust*. The framework ignores
136
+ * `X-Forwarded-*` even when present and silences the unconfigured-proxy
137
+ * guard. Use when the application is exposed directly to the public
138
+ * internet on purpose.
139
+ *
140
+ * @since 0.17.0
141
+ */
142
+ trustProxy?: boolean;
143
+ /**
144
+ * Declarative reverse-proxy posture (Wave 6 — `0.24.0`). Supersedes the
145
+ * boolean {@link AppOptions.trustProxy} with a structured value that
146
+ * simultaneously configures rate-limit keying, TLS enforcement, request-IP
147
+ * resolution, and the `X-Forwarded-*` accept policy from a single source
148
+ * of truth.
149
+ *
150
+ * - `"none"` — refuse `X-Forwarded-*` entirely.
151
+ * - `"loopback"` — trust only when the immediate peer is `127.0.0.1` / `::1`.
152
+ * - `{ hops: N }` — trust the proxy chain when exactly N hops sit between
153
+ * Daloy and the public internet; reads the (N+1)-from-rightmost IP.
154
+ * - `{ cidrs: [...] }` — trust only when the immediate peer's address
155
+ * falls inside one of the supplied CIDR ranges.
156
+ *
157
+ * When supplied, the legacy {@link AppOptions.trustProxy} guard is
158
+ * considered satisfied (the framework knows what to do with forwarded
159
+ * headers without further input).
160
+ *
161
+ * @since 0.24.0
162
+ */
163
+ behindProxy?: BehindProxyConfig;
164
+ /**
165
+ * Opt-out for the Wave 3 boot guard that refuses to start an App which
166
+ * registers {@link session} and any state-changing route without a
167
+ * matching {@link csrf} hook. Set to `"off"` to acknowledge that you
168
+ * intentionally accept cookie-authenticated POST / PUT / PATCH / DELETE
169
+ * requests without CSRF protection (SPA + bearer-token apps, internal
170
+ * services on a private network, etc.). Leave unset (the default) for
171
+ * any browser-facing API: the boot error includes one-line copy-paste
172
+ * remediation. Disabled when {@link AppOptions.secureDefaults} is `false`.
173
+ *
174
+ * @since 0.17.0
175
+ */
176
+ csrf?: "off";
177
+ /**
178
+ * Install Node-process-level crash handlers for `unhandledRejection` and
179
+ * `uncaughtException` that log the error through the pluggable logger at
180
+ * `fatal` and exit with code `1`. Idempotent across multiple `new App()`
181
+ * calls in the same process — handlers are installed once per process via
182
+ * a module-level latch and re-use the most recently constructed App's
183
+ * logger. Default: `true` in production when
184
+ * {@link AppOptions.secureDefaults} is not `false`. Pass `false` to opt
185
+ * out (long-running CLI processes / test harnesses that intentionally
186
+ * swallow rejections may want this). No-op on runtimes without
187
+ * `process.on` (Cloudflare Workers / Vercel Edge / Fastly).
188
+ *
189
+ * @since 0.18.0
190
+ */
191
+ crashOnUnhandledRejection?: boolean;
192
+ /**
193
+ * HTTP status code used in access logs when a request handler completes
194
+ * but the client has already disconnected (`request.signal.aborted`).
195
+ * Defaults to `499` (nginx convention: "Client Closed Request"). Must be
196
+ * an integer in the inclusive range `[400, 499]`; values outside that
197
+ * range cause the constructor to throw. Set to disable the rewrite by
198
+ * keeping the handler's original status: pass `0`.
199
+ *
200
+ * The client receives no response (the connection is gone); this option
201
+ * only controls how the access log line classifies the request so
202
+ * disconnect storms do not look like 5xx errors in dashboards.
203
+ *
204
+ * @since 0.20.0
205
+ */
206
+ disconnectStatusCode?: number;
207
+ /**
208
+ * Install the {@link loadShedding} pressure monitor as a global hook.
209
+ * `true` uses the defaults (event-loop delay at most 1 s, event-loop
210
+ * utilization at most 0.98, sample interval 1 s). Pass an options object to
211
+ * override individual thresholds.
212
+ *
213
+ * Active when {@link AppOptions.secureDefaults} is not `false`.
214
+ *
215
+ * @since 0.20.0
216
+ */
217
+ loadShedding?: boolean | LoadSheddingOptions;
99
218
  /** Pluggable logger. Default: structured JSON logger at "info" (or noop in test). */
100
219
  logger?: Logger | {
101
220
  level?: "trace" | "debug" | "info" | "warn" | "error" | "fatal";
@@ -204,6 +323,25 @@ export interface PluginInstalledEvent {
204
323
  /** Effective mount prefix after parent/group prefixes are applied. */
205
324
  prefix: string;
206
325
  }
326
+ /**
327
+ * Lifecycle-hook contribution declared by a plugin (Wave 6 item 10).
328
+ * Combined with `before` / `after` ordering hints so security middleware
329
+ * order is deterministic regardless of plugin-registration order.
330
+ *
331
+ * @since 0.24.0
332
+ */
333
+ export interface PluginExtension {
334
+ /** Unique extension name. Referenced by `before` / `after` on siblings. */
335
+ name: string;
336
+ /** Lifecycle event the handler attaches to. */
337
+ event: "onRequest" | "beforeHandle" | "afterHandle" | "onSend" | "onError";
338
+ /** Hook handler. The shape mirrors the matching {@link Hooks} entry. */
339
+ handler: (...args: any[]) => any;
340
+ /** Extension names this one must run before. */
341
+ before?: readonly string[];
342
+ /** Extension names this one must run after. */
343
+ after?: readonly string[];
344
+ }
207
345
  /** Information passed to {@link App.onShutdown} listeners. */
208
346
  export interface ShutdownEvent {
209
347
  /** Optional human-readable reason supplied to `app.shutdown(_, reason)`. */
@@ -211,6 +349,70 @@ export interface ShutdownEvent {
211
349
  /** Drain timeout (ms) the shutdown will use after listeners finish. */
212
350
  timeoutMs: number;
213
351
  }
352
+ /**
353
+ * Configuration accepted by {@link App.healthcheck} and
354
+ * {@link App.readinesscheck}. All fields are optional.
355
+ *
356
+ * @since 0.18.0
357
+ */
358
+ export interface HealthRouteOptions {
359
+ /** Override the default path (`/healthz` or `/readyz`). */
360
+ path?: PathString;
361
+ /**
362
+ * Require `Authorization: Bearer <token>` on the probe request. Compared
363
+ * via {@link timingSafeEqual}. When set in production with
364
+ * `secureDefaults: true`, no further opt-in is required.
365
+ */
366
+ token?: string;
367
+ /**
368
+ * Per-IP fixed-window rate limit. Defaults to `{ limit: 60, windowMs:
369
+ * 60_000 }` (in-memory, per-process). Pass `false` to disable.
370
+ */
371
+ rateLimit?: {
372
+ limit?: number;
373
+ windowMs?: number;
374
+ } | false;
375
+ /**
376
+ * Acknowledge that the probe is intentionally reachable without
377
+ * credentials in production. Required when `secureDefaults` is on and
378
+ * `token` is omitted; otherwise registration throws.
379
+ */
380
+ acknowledgeUnauthenticated?: boolean;
381
+ }
382
+ /**
383
+ * Configuration accepted by {@link App.cspReportRoute}. Every field is
384
+ * optional.
385
+ *
386
+ * @since 0.20.0
387
+ */
388
+ export interface CspReportRouteOptions {
389
+ /** Override the default path (`"/__csp-report"`). */
390
+ path?: PathString;
391
+ /**
392
+ * Per-IP fixed-window rate limit. Defaults to
393
+ * `{ limit: 60, windowMs: 60_000 }` (in-memory, per-process). Pass
394
+ * `false` to disable.
395
+ */
396
+ rateLimit?: {
397
+ limit?: number;
398
+ windowMs?: number;
399
+ } | false;
400
+ /**
401
+ * Maximum accepted request body size, in bytes. Default `8192`. Larger
402
+ * bodies are rejected with `413`.
403
+ */
404
+ maxBodyBytes?: number;
405
+ /**
406
+ * Custom sink for parsed reports. Receives the parsed JSON body plus the
407
+ * source IP (or `null` when unknown). Defaults to logging at `warn`
408
+ * through the pluggable logger so violations show up in standard
409
+ * dashboards without extra wiring.
410
+ */
411
+ onReport?: (report: unknown, ctx: {
412
+ ip: string | null;
413
+ userAgent: string | null;
414
+ }) => void | Promise<void>;
415
+ }
214
416
  /**
215
417
  * Lightweight introspection record produced by {@link App.introspect}. Useful
216
418
  * for tooling (dead-route checks, custom dashboards) that needs to enumerate
@@ -305,15 +507,20 @@ export declare class App {
305
507
  private groupHooks;
306
508
  private groupTags;
307
509
  private groupAuth?;
510
+ /** Effective security markers for each registered route hook chain. */
511
+ private routeSecurityMarkers;
308
512
  /** Decorator bag merged into ctx.state on every request. */
309
513
  private decorations;
310
514
  private installedPlugins;
311
515
  private closeHooks;
312
516
  private closeHooksRun;
517
+ /** Wave 4 idle-connection close hooks (adapter-registered, sync). */
518
+ private idleConnectionCloseHooks;
313
519
  private pluginInstalledListeners;
314
520
  private shutdownListeners;
315
521
  private shutdownListenersRun;
316
522
  private pendingPlugins;
523
+ private pluginBootError;
317
524
  /** In-flight request count for graceful shutdown. */
318
525
  private inflight;
319
526
  private draining;
@@ -324,7 +531,40 @@ export declare class App {
324
531
  * retroactively loosen earlier routes.
325
532
  */
326
533
  private corsOriginAllows;
534
+ /**
535
+ * Whether the Wave 3 once-only boot guard has run (session + CSRF +
536
+ * state-changing-route check). The check is deferred to first request
537
+ * because route registration and `app.use(csrf(...))` can happen in any
538
+ * order after construction; doing it on first `fetch()` is the latest
539
+ * point we still get a 500 before any handler ever runs.
540
+ */
541
+ private wave3BootGuard;
542
+ /**
543
+ * Latched marker stamped after the framework has reported the first
544
+ * unconfigured-proxy request. Logged once at `warn` level so production
545
+ * dashboards see the misconfiguration without flooding on every retry.
546
+ */
547
+ private trustProxyWarned;
327
548
  constructor(options?: AppOptions);
549
+ /**
550
+ * Wave 4 leftover: validate {@link AppOptions.disconnectStatusCode}.
551
+ * Refuses anything outside `[400, 499]` (except `0`, which disables the
552
+ * rewrite). Throws at construction time so the misconfiguration cannot
553
+ * survive past boot.
554
+ */
555
+ private assertDisconnectStatusCode;
556
+ /**
557
+ * Wave 8 — master-flag escape-hatch enforcement. When
558
+ * `secureDefaults: false` is set, the framework:
559
+ * - refuses-to-construct in production unless
560
+ * `acknowledgeInsecureDefaults: true` is also set; closes the
561
+ * "developer flipped the flag off while debugging and shipped to
562
+ * production" footgun.
563
+ * - emits a once-per-process `error` log naming every default the flag
564
+ * disables, so operators see the blast radius even if the option was
565
+ * set deep in shared configuration.
566
+ */
567
+ private assertInsecureDefaultsAcknowledged;
328
568
  /**
329
569
  * Install the Wave 2 secure-by-default global hooks. Currently:
330
570
  * - {@link secureHeaders} as a group-level hook so every response carries
@@ -337,6 +577,17 @@ export declare class App {
337
577
  * `app.use(secureHeaders({...}))` still wins per-header.
338
578
  */
339
579
  private installSecureDefaults;
580
+ /**
581
+ * Wave 4 crash-on-unrecoverable-error guard. Installs Node-process-level
582
+ * listeners for `unhandledRejection` and `uncaughtException` that log
583
+ * through the pluggable logger and call `process.exit(1)`. Idempotent via
584
+ * a module-level latch so multiple `new App()` instantiations in the same
585
+ * process do not double-register; the most recently constructed App's
586
+ * logger is used. No-op on runtimes without `process.on` (Workers / Edge
587
+ * / Fastly), in non-production by default, and when
588
+ * `crashOnUnhandledRejection: false` or `secureDefaults: false`.
589
+ */
590
+ private maybeInstallCrashHandlers;
340
591
  /**
341
592
  * Emit a one-time `warn` when the explicit {@link AppOptions.env} option
342
593
  * disagrees with `process.env.NODE_ENV`. Silent when either signal is
@@ -366,6 +617,45 @@ export declare class App {
366
617
  * are unaffected.
367
618
  */
368
619
  private assertCrossOriginAllowed;
620
+ /**
621
+ * Wave 3 sync boot guard. Inspects a hook layer being installed via
622
+ * {@link App.use} and refuses-to-boot when:
623
+ *
624
+ * - `cors({ origin: "*" })` is registered while resolved environment is
625
+ * `production`;
626
+ * - `session({ secret })` is registered while resolved environment is
627
+ * `production` and any secret fails {@link assertStrongSecret}.
628
+ *
629
+ * Disabled when `secureDefaults: false`. Thrown errors propagate out of
630
+ * `app.use(...)` so the process exits during startup rather than serving
631
+ * a misconfigured surface.
632
+ */
633
+ private assertSecureHookConfig;
634
+ private assertRouteAuthPayloadConfig;
635
+ private resetWave3BootGuardCache;
636
+ /**
637
+ * Wave 3 first-request boot guard. Verifies that the assembled hook
638
+ * chain + route table is internally consistent before any user handler
639
+ * runs. Currently checks: when `session()` is installed and any route
640
+ * accepts a state-changing method (`POST` / `PUT` / `PATCH` / `DELETE`),
641
+ * a `csrf()` hook (or third-party equivalent stamped with
642
+ * {@link CSRF_HOOK_MARKER}) must also be present in that route's effective
643
+ * hook chain. Opt out with `app({ csrf: "off" })` or
644
+ * `app({ secureDefaults: false })`. Runs once per App between registration
645
+ * changes; the result is cached so the fast path is a single boolean check.
646
+ */
647
+ private assertWave3BootGuards;
648
+ /**
649
+ * Wave 3 per-request guard for spoofed proxy headers. When the App was
650
+ * constructed without an explicit {@link AppOptions.trustProxy} value
651
+ * and a request arrives carrying an `X-Forwarded-*` header, refuse to
652
+ * dispatch it: the rate limiter, audit log, and request-id propagation
653
+ * would otherwise honour the attacker-supplied IP. Returns a structured
654
+ * `500 problem+json` so the failure is loud at the network boundary.
655
+ * Disabled when `secureDefaults: false` or when `trustProxy` is set to
656
+ * `true` or `false` explicitly.
657
+ */
658
+ private assertTrustProxyConfigured;
369
659
  /**
370
660
  * Resolve the {@link AppOptions.docs} option and, when enabled, register
371
661
  * the `/openapi.json` + `/docs` routes. Called once during construction so
@@ -408,6 +698,56 @@ export declare class App {
408
698
  * @example `app.ws("/echo", { message(c, d) { c.send(d); } });`
409
699
  */
410
700
  ws<P extends PathString, TData = unknown>(path: P, handler: WebSocketHandler<P, any, TData>): this;
701
+ /**
702
+ * Register a liveness probe route. Returns `200 {"status":"ok"}` while
703
+ * the process is alive, regardless of plugin readiness. Use this for
704
+ * container orchestrator `livenessProbe` configuration — a failing
705
+ * liveness probe restarts the container.
706
+ *
707
+ * Defaults (Wave 4 secure-by-default):
708
+ * - path: `/healthz`
709
+ * - rate-limit: 60 req/min per remote IP, in-memory (per-process)
710
+ * - auth: opt-in via `token`. In production with `secureDefaults: true`,
711
+ * registration refuses to add the route without a `token` unless
712
+ * `acknowledgeUnauthenticated: true` is set, so an unguarded
713
+ * healthcheck cannot ship to production by accident.
714
+ *
715
+ * @example
716
+ * ```ts
717
+ * app.healthcheck({ token: process.env.HEALTH_TOKEN! });
718
+ * ```
719
+ *
720
+ * @since 0.18.0
721
+ */
722
+ healthcheck(opts?: HealthRouteOptions): this;
723
+ /**
724
+ * Register a readiness probe route. Returns `200 {"status":"ready"}`
725
+ * once every async plugin has resolved AND the app is not draining.
726
+ * Returns `503` otherwise. Use this for container orchestrator
727
+ * `readinessProbe` configuration — a failing readiness probe removes
728
+ * the pod from load-balancer rotation without restarting it.
729
+ *
730
+ * Defaults match {@link App.healthcheck} (path defaults to `/readyz`).
731
+ *
732
+ * @since 0.18.0
733
+ */
734
+ readinesscheck(opts?: HealthRouteOptions): this;
735
+ private registerHealthRoute;
736
+ /**
737
+ * Wave 4 leftover: register a built-in receiver for CSP / Reporting API
738
+ * violation reports. Accepts `application/csp-report` and
739
+ * `application/reports+json` payloads, rate-limits per IP (defaults: 60
740
+ * req/min), caps body size (default 8 KiB), and forwards parsed reports
741
+ * to {@link CspReportRouteOptions.onReport} (or the structured logger
742
+ * when omitted). Returns `204 No Content` so browsers stop retrying.
743
+ *
744
+ * Combine with `secureHeaders({ reportingEndpoints, reportTo })` to wire
745
+ * the browser to this endpoint. The route is registered as `internal:
746
+ * false` (i.e. publicly reachable); that is required for the browser
747
+ * Reporting API to send to it.
748
+ *
749
+ */
750
+ cspReportRoute(opts?: CspReportRouteOptions): this;
411
751
  /**
412
752
  * Mount a group of routes under a shared prefix with shared tags, hooks,
413
753
  * and authentication. The `register` callback receives an encapsulated
@@ -479,7 +819,17 @@ export declare class App {
479
819
  * @param value - Value bound to that property on every request.
480
820
  * @returns This `App` instance for chaining.
481
821
  */
482
- decorate<K extends string, V>(key: K, value: V): this;
822
+ /**
823
+ * Apply an ordered list of plugin extensions (Wave 6 item 10) to the
824
+ * group-level hook chain. Each extension's `handler` is wrapped into a
825
+ * single-event {@link Hooks} bundle so subsequent route registrations
826
+ * pick it up via the normal hook composition path.
827
+ * @internal
828
+ */
829
+ private applyExtensions;
830
+ decorate<K extends string, V>(key: K, value: V, opts?: {
831
+ override?: boolean;
832
+ }): this;
483
833
  /**
484
834
  * Register a callback to run once during graceful shutdown, **after** all
485
835
  * in-flight requests have drained. Use this to close database pools, flush
@@ -507,17 +857,39 @@ export declare class App {
507
857
  */
508
858
  onShutdown(listener: (info: ShutdownEvent) => void | Promise<void>): this;
509
859
  /**
510
- * Encapsulated plugin registration (Fastify-style). Receives a child App; routes/hooks are scoped.
860
+ * Encapsulated plugin registration (Fastify-style). Receives a child App;
861
+ * routes/hooks declared on the child are scoped to the plugin by default
862
+ * (Wave 6 item 15 \u2014 encapsulation default `local`).
863
+ *
864
+ * Wave 6 (`0.24.0`) additions on the plugin descriptor object:
865
+ *
866
+ * - `dependencies: string[]` \u2014 prerequisite plugin names; the framework
867
+ * refuses-to-boot at registration time when any declared dependency has
868
+ * not been installed first (item 8).
869
+ * - `seed: string` \u2014 differentiator for parameterized instances of the
870
+ * same plugin (item 16). Dedup key becomes `${name}#${seed}`.
871
+ * - `stateful: boolean` \u2014 when `true` AND `name` is absent AND the app is
872
+ * in production with `secureDefaults` on, registration refuses-to-boot
873
+ * so silent double-installs of global-state-mutating plugins are caught
874
+ * loud (item 16).
875
+ * - `extensions: [{ event, handler, before?, after? }]` \u2014 declarative
876
+ * lifecycle-hook ordering with topological-sort + cycle detection
877
+ * (item 10). Refuses-at-registration on cycles.
511
878
  */
512
879
  register(plugin: {
513
880
  name?: string;
514
- register: (app: App) => void | Promise<void>;
881
+ seed?: string;
882
+ stateful?: boolean;
883
+ dependencies?: readonly string[];
884
+ extensions?: ReadonlyArray<PluginExtension>;
885
+ register?: (app: App) => void | Promise<void>;
515
886
  } | ((app: App) => void | Promise<void>), config?: {
516
887
  prefix?: PathString;
517
888
  tags?: string[];
518
889
  hooks?: Hooks;
519
890
  auth?: RouteDefinition["auth"];
520
891
  }): this;
892
+ private trackPendingPlugin;
521
893
  private firePluginInstalled;
522
894
  /**
523
895
  * Wait until every async plugin registered with {@link App.register} has
@@ -557,6 +929,17 @@ export declare class App {
557
929
  * to RFC 9457 `application/problem+json` automatically.
558
930
  */
559
931
  fetch: (request: Request) => Promise<Response>;
932
+ /**
933
+ * In-process entry point that bypasses the public `404` shield for
934
+ * routes declared with `internal: true`. Use it for cron jobs, admin
935
+ * scripts, and integration tests that need to exercise privileged
936
+ * handlers without exposing them to the network. All other security
937
+ * middleware (CORS, CSRF, rate limit, etc.) still runs normally.
938
+ *
939
+ * @since 0.19.0
940
+ */
941
+ inject: (request: Request) => Promise<Response>;
942
+ private dispatch;
560
943
  /**
561
944
  * In-process test client. Accepts the same arguments as the global `fetch`
562
945
  * but routes them through `this.fetch` without a network hop. Relative URLs
@@ -599,7 +982,33 @@ export declare class App {
599
982
  * @returns Resolves once draining + cleanups complete (or the timeout elapses).
600
983
  */
601
984
  shutdown(timeoutMs?: number, reason?: string): Promise<void>;
985
+ /**
986
+ * Alias for {@link App.shutdown}. Matches the Node `Server.close()` shape
987
+ * and reads more naturally from adapters that want a single "stop"
988
+ * method.
989
+ *
990
+ * @since 0.18.0
991
+ */
992
+ close(timeoutMs?: number, reason?: string): Promise<void>;
993
+ /**
994
+ * Adapter-private hook to register a callback that runs synchronously
995
+ * when {@link App.shutdown} begins draining. The Node adapter uses this
996
+ * to invoke `server.closeIdleConnections()` so keep-alive sockets without
997
+ * an in-flight request are killed immediately instead of being held open
998
+ * until the OS / load balancer notices.
999
+ *
1000
+ * Not part of the documented public API surface: subject to change.
1001
+ *
1002
+ * @internal
1003
+ */
1004
+ _registerIdleConnectionCloseHook(hook: () => void): void;
602
1005
  }
1006
+ /**
1007
+ * Topological sort of plugin extensions (Wave 6 item 10). Refuses-at-call
1008
+ * on cyclic ordering with a structured error naming the cycle.
1009
+ * @internal
1010
+ */
1011
+ export declare function topoSortExtensions(exts: ReadonlyArray<PluginExtension>): PluginExtension[];
603
1012
  /**
604
1013
  * Factory alias for `new App(options)`. Lets callers who prefer a
605
1014
  * functional style (or who avoid `new`) write:
package/dist/app.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAe1E,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAEV,UAAU,EACV,KAAK,EACL,UAAU,EACV,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAIL,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,EAClC,MAAM,WAAW,CAAC;AACnB,OAAO,EAML,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAC;AAMzB;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mGAAmG;IACnG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,mEAAmE;QACnE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,yEAAyE;QACzE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,yEAAyE;QACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAEF,+FAA+F;IAC/F,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,MAAM,CAAC;IAE5C;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC;IAE7C;;;;;;;;;;;OAWG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qFAAqF;IACrF,MAAM,CAAC,EACH,MAAM,GACN;QAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;KAAE,GACnE,KAAK,CAAC;IAEV;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,KAAK,CAAC;IAEd;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAE5B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,gBAAgB,CAAC;CAC5C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5B,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACpC,eAAe,CAAC,EAAE,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACpD,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,gFAAgF;IAChF,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;IACrC,oFAAoF;IACpF,EAAE,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC1B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,4BAA4B,CAAC;IACtC,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,GAAG,CAAC,EAAE,gCAAgC,CAAC;CACxC;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7C;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,YAAY,EAAE,SAAS,CAAC;CACvC;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,qBAAa,GAAG;IACd,QAAQ,CAAC,OAAO,EAAE,QAAQ,CACxB,IAAI,CACF,UAAU,EACV,mBAAmB,GAAG,gBAAgB,GAAG,kBAAkB,CAC5D,CACF,GACC,UAAU,CAAC;IACb,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAM;IAE5D,OAAO,CAAC,MAAM,CAA+B;IAC7C,4FAA4F;IAC5F,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAA2B;IACtE,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,SAAS,CAAC,CAA0B;IAC5C,4DAA4D;IAC5D,OAAO,CAAC,WAAW,CAA+B;IAClD,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,wBAAwB,CAEzB;IACP,OAAO,CAAC,iBAAiB,CAElB;IACP,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,QAAQ,CAAS;IACzB;;;;;OAKG;IACD,OAAO,CAAC,gBAAgB,CAAyB;gBAEvC,OAAO,GAAE,UAAe;IAqBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAc7B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,wBAAwB;IAoChC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAqBtB,OAAO,CAAC,SAAS;IAoHjB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CACH,CAAC,SAAS,UAAU,EACpB,CAAC,SAAS,UAAU,EACpB,GAAG,SAAS,cAAc,GAAG,SAAS,EACtC,GAAG,SAAS,YAAY,EACxB,GAAG,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI;IAqB7C;;;;;;OAMG;IACH,EAAE,CAAC,CAAC,SAAS,UAAU,EAAE,KAAK,GAAG,OAAO,EACtC,IAAI,EAAE,CAAC,EACP,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GACvC,IAAI;IAUP;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CACH,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAAC,IAAI,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;KAAE,EAC1E,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAC3B,IAAI;IA6BP;;;;;;;;;;;;;;;;OAgBG;IACH,GAAG,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI;IAuBvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAKrD;;;;;;;;;;OAUG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAK/C;;;;;OAKG;IACH,iBAAiB,CACf,QAAQ,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAC7D,IAAI;IAKP;;;;;OAKG;IACH,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAKzE;;OAEG;IACH,QAAQ,CACN,MAAM,EACF;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,GAC/D,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EACxC,MAAM,GAAE;QACN,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;KAC3B,GACL,IAAI;IAiCP,OAAO,CAAC,mBAAmB;IA8B3B;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAKtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,GAAU,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAkLjD;IAEF;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CACL,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAC7B,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,QAAQ,CAAC;IASpB;;;;;;OAMG;IACH,UAAU,IAAI,iBAAiB,EAAE;IAsBjC;;;;;;;;;;;;;;;OAeG;IACG,QAAQ,CAAC,SAAS,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAyBnE;AAyWD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,OAAO,GAAE,UAAe,GAAG,GAAG,CAEvD;AAoGD;;;;;GAKG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAErD"}
1
+ {"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EAEjB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAiBxB,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAEV,UAAU,EACV,KAAK,EACL,UAAU,EACV,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAIL,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,EAClC,MAAM,WAAW,CAAC;AACnB,OAAO,EAUL,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAA0C,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEtG,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiB3E,mEAAmE;AACnE,wBAAgB,2BAA2B,IAAI,IAAI,CAGlD;AASD,mEAAmE;AACnE,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAkBD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mGAAmG;IACnG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,mEAAmE;QACnE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,yEAAyE;QACzE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,yEAAyE;QACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAEF,+FAA+F;IAC/F,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,MAAM,CAAC;IAE5C;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;;;;;;OAaG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC;IAE7C;;;;;;;;;;;OAWG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE,KAAK,CAAC;IAEb;;;;;;;;;;;;;OAaG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAEpC;;;;;;;;;;;;;OAaG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC;IAE7C,qFAAqF;IACrF,MAAM,CAAC,EACH,MAAM,GACN;QAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;KAAE,GACnE,KAAK,CAAC;IAEV;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,KAAK,CAAC;IAEd;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAE5B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,gBAAgB,CAAC;CAC5C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5B,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACpC,eAAe,CAAC,EAAE,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACpD,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,gFAAgF;IAChF,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;IACrC,oFAAoF;IACpF,EAAE,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC1B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,4BAA4B,CAAC;IACtC,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,GAAG,CAAC,EAAE,gCAAgC,CAAC;CACxC;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,KAAK,EAAE,WAAW,GAAG,cAAc,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3E,wEAAwE;IACxE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;IACjC,gDAAgD;IAChD,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,+CAA+C;IAC/C,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAC1D;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACtC;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,qDAAqD;IACrD,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAC1D;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CACT,MAAM,EAAE,OAAO,EACf,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KACjD,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7C;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,YAAY,EAAE,SAAS,CAAC;CACvC;AA2BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,qBAAa,GAAG;IACd,QAAQ,CAAC,OAAO,EAAE,QAAQ,CACxB,IAAI,CACF,UAAU,EACV,mBAAmB,GAAG,gBAAgB,GAAG,kBAAkB,CAC5D,CACF,GACC,UAAU,CAAC;IACb,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAM;IAE5D,OAAO,CAAC,MAAM,CAA+B;IAC7C,4FAA4F;IAC5F,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAA2B;IACtE,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,SAAS,CAAC,CAA0B;IAC5C,uEAAuE;IACvE,OAAO,CAAC,oBAAoB,CAA8B;IAC1D,4DAA4D;IAC5D,OAAO,CAAC,WAAW,CAA+B;IAClD,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,aAAa,CAAS;IAC9B,qEAAqE;IACrE,OAAO,CAAC,wBAAwB,CAAyB;IACzD,OAAO,CAAC,wBAAwB,CAEzB;IACP,OAAO,CAAC,iBAAiB,CAElB;IACP,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,eAAe,CAGrB;IACF,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,QAAQ,CAAS;IACzB;;;;;OAKG;IACD,OAAO,CAAC,gBAAgB,CAAyB;IAEnD;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAA2C;IAEjE;;;;OAIG;IACH,OAAO,CAAC,gBAAgB,CAAS;gBAErB,OAAO,GAAE,UAAe;IA0BpC;;;;;OAKG;IACH,OAAO,CAAC,0BAA0B;IAUlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IA8B1C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAsB7B;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAwCjC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,wBAAwB;IAoChC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,sBAAsB;IAqB9B,OAAO,CAAC,4BAA4B;IAcpC,OAAO,CAAC,wBAAwB;IAKhC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IA6B7B;;;;;;;;;OASG;IACH,OAAO,CAAC,0BAA0B;IAyClC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAqBtB,OAAO,CAAC,SAAS;IAoHjB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CACH,CAAC,SAAS,UAAU,EACpB,CAAC,SAAS,UAAU,EACpB,GAAG,SAAS,cAAc,GAAG,SAAS,EACtC,GAAG,SAAS,YAAY,EACxB,GAAG,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI;IAiC7C;;;;;;OAMG;IACH,EAAE,CAAC,CAAC,SAAS,UAAU,EAAE,KAAK,GAAG,OAAO,EACtC,IAAI,EAAE,CAAC,EACP,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GACvC,IAAI;IAeP;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW,CAAC,IAAI,GAAE,kBAAuB,GAAG,IAAI;IAQhD;;;;;;;;;;OAUG;IACH,cAAc,CAAC,IAAI,GAAE,kBAAuB,GAAG,IAAI;IAqBnD,OAAO,CAAC,mBAAmB;IA4F3B;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,IAAI;IA4FtD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CACH,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAAC,IAAI,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;KAAE,EAC1E,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAC3B,IAAI;IAkCP;;;;;;;;;;;;;;;;OAgBG;IACH,GAAG,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI;IA8BvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAOvB,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAC1B,GAAG,EAAE,CAAC,EACN,KAAK,EAAE,CAAC,EACR,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO,GAChC,IAAI;IAuBP;;;;;;;;;;OAUG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAK/C;;;;;OAKG;IACH,iBAAiB,CACf,QAAQ,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAC7D,IAAI;IAKP;;;;;OAKG;IACH,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAKzE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CACN,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;QAC5C,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC/C,GACD,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EACxC,MAAM,GAAE;QACN,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;KAC3B,GACL,IAAI;IA0DP,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,mBAAmB;IA8B3B;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,GAAU,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CASjD;IAEF;;;;;;;;OAQG;IACH,MAAM,GAAU,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAElD;IAEF,OAAO,CAAC,QAAQ,CA8Od;IAEF;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CACL,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAC7B,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,QAAQ,CAAC;IASpB;;;;;;OAMG;IACH,UAAU,IAAI,iBAAiB,EAAE;IAsBjC;;;;;;;;;;;;;;;OAeG;IACG,QAAQ,CAAC,SAAS,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoClE;;;;;;OAMG;IACG,KAAK,CAAC,SAAS,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/D;;;;;;;;;;OAUG;IACH,gCAAgC,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,IAAI;CAGzD;AAyCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,CAAC,eAAe,CAAC,GACnC,eAAe,EAAE,CA8CnB;AAiZD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,OAAO,GAAE,UAAe,GAAG,GAAG,CAEvD;AAoGD;;;;;GAKG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAErD"}