@demiurgejs/core 0.2.0-beta.4 → 0.2.0-beta.6

package/dist/redis/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../src/redis/store.ts","../../src/redis/rate-limit-store.ts","../../src/redis/session-store.ts"],"sourcesContent":["import type { Redis } from \"ioredis\";\nimport type { CacheStore, CacheStoreEntry } from \"../data/cache\";\n\nexport type RedisCacheStoreOptions = {\n  // Every consumer of one Redis database shares one keyspace. This prefix\n  // scopes the store's entry, tag, and lease keys away from an application's\n  // other Redis use. Two Demiurge deployments that share a database still\n  // need distinct prefixes, the same way they need distinct cache namespaces.\n  keyPrefix?: string;\n  // The store issues commands on a client the application already\n  // constructed and connected. Connection options, TLS, Sentinel, and retry\n  // policy are the application's decision, not this store's.\n  client: Redis;\n};\n\nconst defaultKeyPrefix = \"demiurge:cache:\";\n\n// Tag sets hold the raw, unprefixed cache key as each member, never the\n// prefixed entry key. invalidateTags() only knows a tag's members. It\n// rebuilds both the entry key and the lease key by applying their prefixes.\n// Every script below adds and removes the same raw-key member, so the two\n// stay in agreement.\n\n// KEYS[1] entry key, KEYS[2] lease key.\n// ARGV[1] entry JSON, ARGV[2] staleUntil epoch ms or \"\".\n// ARGV[3] tag key prefix, ARGV[4] raw key.\nconst setScript = `\nlocal old = redis.call(\"GET\", KEYS[1])\nif old then\n  local oldTags = cjson.decode(old).tags\n  for i = 1, #oldTags do\n    redis.call(\"SREM\", ARGV[3] .. oldTags[i], ARGV[4])\n  end\nend\nredis.call(\"SET\", KEYS[1], ARGV[1])\nif ARGV[2] ~= \"\" then\n  redis.call(\"PEXPIREAT\", KEYS[1], ARGV[2])\nend\nlocal newTags = cjson.decode(ARGV[1]).tags\nfor i = 1, #newTags do\n  redis.call(\"SADD\", ARGV[3] .. newTags[i], ARGV[4])\nend\nredis.call(\"DEL\", KEYS[2])\nreturn 1\n`;\n\n// KEYS[1] entry key, KEYS[2] lease key.\n// ARGV[1] tag key prefix, ARGV[2] raw key.\nconst deleteScript = `\nlocal old = redis.call(\"GET\", KEYS[1])\nredis.call(\"DEL\", KEYS[2])\nif not old then\n  return 0\nend\nlocal oldTags = cjson.decode(old).tags\nfor i = 1, #oldTags do\n  redis.call(\"SREM\", ARGV[1] .. oldTags[i], ARGV[2])\nend\nredis.call(\"DEL\", KEYS[1])\nreturn 1\n`;\n\n// No declared KEYS. Tags name a variable number of sets, so the script reads\n// their redis keys from ARGV instead.\n// ARGV[1] tags JSON array, ARGV[2] tag key prefix, ARGV[3] entry key prefix,\n// ARGV[4] lease key prefix\nconst invalidateTagsScript = `\nlocal tags = cjson.decode(ARGV[1])\nlocal seen = {}\nlocal deleted = 0\nfor i = 1, #tags do\n  local tagSetKey = ARGV[2] .. tags[i]\n  local members = redis.call(\"SMEMBERS\", tagSetKey)\n  for j = 1, #members do\n    local rawKey = members[j]\n    if not seen[rawKey] then\n      seen[rawKey] = true\n      local entryKey = ARGV[3] .. rawKey\n      local old = redis.call(\"GET\", entryKey)\n      if old then\n        local oldTags = cjson.decode(old).tags\n        for t = 1, #oldTags do\n          redis.call(\"SREM\", ARGV[2] .. oldTags[t], rawKey)\n        end\n        redis.call(\"DEL\", entryKey)\n        redis.call(\"DEL\", ARGV[4] .. rawKey)\n        deleted = deleted + 1\n      else\n        redis.call(\"SREM\", tagSetKey, rawKey)\n      end\n    end\n  end\n  redis.call(\"DEL\", tagSetKey)\nend\nreturn deleted\n`;\n\n// KEYS[1] entry key, KEYS[2] lease key.\n// ARGV[1] token, ARGV[2] entry JSON, ARGV[3] staleUntil epoch ms or \"\".\n// ARGV[4] tag key prefix, ARGV[5] raw key.\nconst publishRefreshScript = `\nlocal owner = redis.call(\"GET\", KEYS[2])\nif not owner or owner ~= ARGV[1] then\n  return 0\nend\nlocal old = redis.call(\"GET\", KEYS[1])\nif old then\n  local oldTags = cjson.decode(old).tags\n  for i = 1, #oldTags do\n    redis.call(\"SREM\", ARGV[4] .. oldTags[i], ARGV[5])\n  end\nend\nredis.call(\"SET\", KEYS[1], ARGV[2])\nif ARGV[3] ~= \"\" then\n  redis.call(\"PEXPIREAT\", KEYS[1], ARGV[3])\nend\nlocal newTags = cjson.decode(ARGV[2]).tags\nfor i = 1, #newTags do\n  redis.call(\"SADD\", ARGV[4] .. newTags[i], ARGV[5])\nend\nredis.call(\"DEL\", KEYS[2])\nreturn 1\n`;\n\n// KEYS[1] lease key, ARGV[1] token\nconst releaseRefreshLeaseScript = `\nlocal owner = redis.call(\"GET\", KEYS[1])\nif owner == ARGV[1] then\n  redis.call(\"DEL\", KEYS[1])\nend\nreturn 0\n`;\n\ntype RedisCacheCommands = {\n  demiurgeCacheSet: (\n    entryKey: string,\n    leaseKey: string,\n    entryJson: string,\n    staleUntil: string,\n    tagPrefix: string,\n    rawKey: string,\n  ) => Promise<number>;\n  demiurgeCacheDelete: (\n    entryKey: string,\n    leaseKey: string,\n    tagPrefix: string,\n    rawKey: string,\n  ) => Promise<number>;\n  demiurgeCacheInvalidateTags: (\n    tagsJson: string,\n    tagPrefix: string,\n    entryPrefix: string,\n    leasePrefix: string,\n  ) => Promise<number>;\n  demiurgeCachePublishRefresh: (\n    entryKey: string,\n    leaseKey: string,\n    token: string,\n    entryJson: string,\n    staleUntil: string,\n    tagPrefix: string,\n    rawKey: string,\n  ) => Promise<number>;\n  demiurgeCacheReleaseRefreshLease: (\n    leaseKey: string,\n    token: string,\n  ) => Promise<number>;\n};\n\n// The application already owns one ioredis client. Attaching the store's\n// commands is idempotent, so building several stores on the same client, or\n// rebuilding one after a reconnect, never redefines a command twice.\nfunction commands(client: Redis): Redis & RedisCacheCommands {\n  // TYPE-EVIDENCE: the cast adds the optional custom command methods before the runtime checks install them.\n  const withCommands = client as Redis & Partial<RedisCacheCommands>;\n\n  if (!withCommands.demiurgeCacheSet) {\n    client.defineCommand(\"demiurgeCacheSet\", { lua: setScript, numberOfKeys: 2 });\n  }\n\n  if (!withCommands.demiurgeCacheDelete) {\n    client.defineCommand(\"demiurgeCacheDelete\", {\n      lua: deleteScript,\n      numberOfKeys: 2,\n    });\n  }\n\n  if (!withCommands.demiurgeCacheInvalidateTags) {\n    client.defineCommand(\"demiurgeCacheInvalidateTags\", {\n      lua: invalidateTagsScript,\n      numberOfKeys: 0,\n    });\n  }\n\n  if (!withCommands.demiurgeCachePublishRefresh) {\n    client.defineCommand(\"demiurgeCachePublishRefresh\", {\n      lua: publishRefreshScript,\n      numberOfKeys: 2,\n    });\n  }\n\n  if (!withCommands.demiurgeCacheReleaseRefreshLease) {\n    client.defineCommand(\"demiurgeCacheReleaseRefreshLease\", {\n      lua: releaseRefreshLeaseScript,\n      numberOfKeys: 1,\n    });\n  }\n\n  // TYPE-EVIDENCE: the defineCommand calls above install each custom command. The cast reflects that the methods now exist.\n  return withCommands as Redis & RedisCacheCommands;\n}\n\n// Redis holds the entry, its tag memberships, and its refresh lease as\n// independent keys. Every process talking to the same database must see\n// these three stay coordinated. Each write path therefore runs as one Lua\n// script rather than several round trips a concurrent writer could\n// interleave with.\nexport function createRedisCacheStore(\n  options: RedisCacheStoreOptions,\n): CacheStore {\n  if (!options.client || typeof options.client.defineCommand !== \"function\") {\n    throw new Error(\n      \"Demiurge Redis cache store requires an ioredis client. Pass a connected ioredis Redis instance as `client`.\",\n    );\n  }\n\n  const client = commands(options.client);\n  const prefix = options.keyPrefix ?? defaultKeyPrefix;\n  const entryPrefix = `${prefix}entry:`;\n  const tagPrefix = `${prefix}tag:`;\n  const leasePrefix = `${prefix}lease:`;\n\n  return {\n    async acquireRefreshLease(key, token, expiresAt) {\n      // ioredis's typed SET overloads do not cover every flag order the\n      // Redis SET command accepts, so this issues the raw command instead.\n      const result = await client.call(\n        \"SET\",\n        leasePrefix + key,\n        token,\n        \"NX\",\n        \"PXAT\",\n        String(expiresAt),\n      );\n\n      return result === \"OK\";\n    },\n    async delete(key) {\n      const deleted = await client.demiurgeCacheDelete(\n        entryPrefix + key,\n        leasePrefix + key,\n        tagPrefix,\n        key,\n      );\n\n      return deleted === 1;\n    },\n    async get(key) {\n      const raw = await client.get(entryPrefix + key);\n      // TYPE-EVIDENCE: the stored raw value is JSON that the store serialized from a cache entry. The cast restores that shape.\n      return raw ? (JSON.parse(raw) as CacheStoreEntry) : undefined;\n    },\n    async invalidateTags(tags) {\n      if (tags.length === 0) {\n        return 0;\n      }\n\n      return await client.demiurgeCacheInvalidateTags(\n        JSON.stringify(tags),\n        tagPrefix,\n        entryPrefix,\n        leasePrefix,\n      );\n    },\n    async publishRefresh(key, token, entry) {\n      const result = await client.demiurgeCachePublishRefresh(\n        entryPrefix + key,\n        leasePrefix + key,\n        token,\n        JSON.stringify(entry),\n        entry.staleUntil === null ? \"\" : String(entry.staleUntil),\n        tagPrefix,\n        key,\n      );\n\n      return result === 1;\n    },\n    async releaseRefreshLease(key, token) {\n      await client.demiurgeCacheReleaseRefreshLease(leasePrefix + key, token);\n    },\n    async set(key, entry) {\n      await client.demiurgeCacheSet(\n        entryPrefix + key,\n        leasePrefix + key,\n        JSON.stringify(entry),\n        entry.staleUntil === null ? \"\" : String(entry.staleUntil),\n        tagPrefix,\n        key,\n      );\n    },\n  };\n}\n","import type { Redis } from \"ioredis\";\nimport type { RateLimitResult, RateLimitStore } from \"../security/types\";\n\nexport type RedisRateLimitStoreOptions = {\n  // Every consumer of one Redis database shares one keyspace. This prefix\n  // scopes the store's counter keys away from an application's other Redis\n  // use, the same way RedisCacheStoreOptions.keyPrefix does for the cache\n  // store. Two Demiurge deployments that share a database still need\n  // distinct prefixes.\n  keyPrefix?: string;\n  // The store issues commands on a client the application already\n  // constructed and connected. Connection options, TLS, Sentinel, and retry\n  // policy are the application's decision, not this store's.\n  client: Redis;\n};\n\nconst defaultKeyPrefix = \"demiurge:ratelimit:\";\n\n// KEYS[1] counter key. ARGV[1] window in ms.\n//\n// INCR and PEXPIRE run inside one script. Redis executes the whole script\n// as a single atomic step, so two instances racing to increment the same\n// key never both observe count 1. The window's reset time comes from\n// Redis's own clock (TIME), not the caller-supplied `now`. The counter's\n// TTL is authoritative once several processes share it, and a\n// client-supplied timestamp could disagree with the server that expires the\n// key. TIME is deterministic across replication because Redis rewrites the\n// script's effects rather than replaying non-deterministic commands.\nconst incrementScript = `\nlocal count = redis.call(\"INCR\", KEYS[1])\nif count == 1 then\n  redis.call(\"PEXPIRE\", KEYS[1], ARGV[1])\nend\nlocal ttl = redis.call(\"PTTL\", KEYS[1])\nif ttl < 0 then\n  redis.call(\"PEXPIRE\", KEYS[1], ARGV[1])\n  ttl = tonumber(ARGV[1])\nend\nlocal time = redis.call(\"TIME\")\nlocal nowMs = math.floor(tonumber(time[1]) * 1000 + tonumber(time[2]) / 1000)\nreturn { count, nowMs + ttl }\n`;\n\ntype RedisRateLimitCommands = {\n  demiurgeRateLimitIncrement: (\n    counterKey: string,\n    windowMs: string,\n  ) => Promise<[number, number]>;\n};\n\n// The application already owns one ioredis client. Attaching the store's\n// command is idempotent, so building several stores on the same client, or\n// rebuilding one after a reconnect, never redefines the command twice.\nfunction commands(client: Redis): Redis & RedisRateLimitCommands {\n  // TYPE-EVIDENCE: the cast adds the optional custom command methods before the runtime check installs them.\n  const withCommands = client as Redis & Partial<RedisRateLimitCommands>;\n\n  if (!withCommands.demiurgeRateLimitIncrement) {\n    client.defineCommand(\"demiurgeRateLimitIncrement\", {\n      lua: incrementScript,\n      numberOfKeys: 1,\n    });\n  }\n\n  // TYPE-EVIDENCE: the defineCommand call above installs the custom command. The cast reflects that the method now exists.\n  return withCommands as Redis & RedisRateLimitCommands;\n}\n\nexport function createRedisRateLimitStore(\n  options: RedisRateLimitStoreOptions,\n): RateLimitStore {\n  if (!options.client || typeof options.client.defineCommand !== \"function\") {\n    throw new Error(\n      \"Demiurge Redis rate limit store requires an ioredis client. Pass a connected ioredis Redis instance as `client`.\",\n    );\n  }\n\n  const client = commands(options.client);\n  const prefix = options.keyPrefix ?? defaultKeyPrefix;\n\n  return {\n    async increment(key, windowMs): Promise<RateLimitResult> {\n      const [count, resetAt] = await client.demiurgeRateLimitIncrement(\n        prefix + key,\n        String(windowMs),\n      );\n\n      return { count, resetAt };\n    },\n  };\n}\n","import type { Redis } from \"ioredis\";\nimport {\n  parseSessionRecord,\n  serializeSessionNamespace,\n  type SessionData,\n  type SessionNamespace,\n  type SessionRecord,\n  type SessionStore,\n  type SessionStoreCandidate,\n} from \"../security/session-store\";\n\nexport type RedisSessionStoreOptions = {\n  client: Redis;\n  keyPrefix?: string;\n  namespace: SessionNamespace;\n};\n\nconst defaultKeyPrefix = \"demiurge:session:\";\n\nconst createScript = `\nif redis.call(\"EXISTS\", KEYS[1]) == 1 then\n  return 0\nend\nredis.call(\"SET\", KEYS[1], ARGV[1], \"PXAT\", ARGV[2])\nreturn 1\n`;\n\nconst updateScript = `\nlocal current = redis.call(\"GET\", KEYS[1])\nif not current or cjson.decode(current).version ~= tonumber(ARGV[1]) then\n  return 0\nend\nredis.call(\"SET\", KEYS[1], ARGV[2], \"PXAT\", ARGV[3])\nreturn 1\n`;\n\nconst rotateScript = `\nlocal current = redis.call(\"GET\", KEYS[1])\nif not current or cjson.decode(current).version ~= tonumber(ARGV[1]) then\n  return 0\nend\nif KEYS[1] ~= KEYS[2] and redis.call(\"EXISTS\", KEYS[2]) == 1 then\n  return 0\nend\nredis.call(\"DEL\", KEYS[1])\nredis.call(\"SET\", KEYS[2], ARGV[2], \"PXAT\", ARGV[3])\nreturn 1\n`;\n\ntype RedisSessionCommands = {\n  demiurgeSessionCreate: (\n    key: string,\n    record: string,\n    expiresAt: string,\n  ) => Promise<number>;\n  demiurgeSessionRotate: (\n    currentKey: string,\n    nextKey: string,\n    expectedVersion: string,\n    record: string,\n    expiresAt: string,\n  ) => Promise<number>;\n  demiurgeSessionUpdate: (\n    key: string,\n    expectedVersion: string,\n    record: string,\n    expiresAt: string,\n  ) => Promise<number>;\n};\n\nfunction commands(client: Redis): Redis & RedisSessionCommands {\n  // TYPE-EVIDENCE: the cast adds optional custom commands before the runtime checks install them.\n  const withCommands = client as Redis & Partial<RedisSessionCommands>;\n\n  if (!withCommands.demiurgeSessionCreate) {\n    client.defineCommand(\"demiurgeSessionCreate\", {\n      lua: createScript,\n      numberOfKeys: 1,\n    });\n  }\n\n  if (!withCommands.demiurgeSessionUpdate) {\n    client.defineCommand(\"demiurgeSessionUpdate\", {\n      lua: updateScript,\n      numberOfKeys: 1,\n    });\n  }\n\n  if (!withCommands.demiurgeSessionRotate) {\n    client.defineCommand(\"demiurgeSessionRotate\", {\n      lua: rotateScript,\n      numberOfKeys: 2,\n    });\n  }\n\n  // TYPE-EVIDENCE: the defineCommand calls install each command. The cast reflects the resulting client shape.\n  return withCommands as Redis & RedisSessionCommands;\n}\n\nexport function createRedisSessionStore<\n  TData extends SessionData = SessionData,\n>(options: RedisSessionStoreOptions): SessionStore<TData> {\n  if (!options.client || typeof options.client.defineCommand !== \"function\") {\n    throw new Error(\n      \"Demiurge Redis session store requires an ioredis client. Pass a connected ioredis Redis instance as `client`.\",\n    );\n  }\n\n  const client = commands(options.client);\n  const namespace = serializeSessionNamespace(options.namespace);\n  const prefix = `${options.keyPrefix ?? defaultKeyPrefix}${namespace}:`;\n  const key = (id: string) => prefix + id;\n\n  return {\n    async create(candidate) {\n      const record = toRecord(candidate, 0);\n\n      try {\n        const stored = await client.demiurgeSessionCreate(\n          key(record.id),\n          JSON.stringify(record),\n          String(storeExpiration(record)),\n        );\n        return stored === 1\n          ? { record, status: \"stored\" }\n          : { status: \"conflict\" };\n      } catch {\n        return { status: \"unavailable\" };\n      }\n    },\n    async destroy(id) {\n      return await client.del(key(id)) === 1;\n    },\n    async read(id, now) {\n      const raw = await client.get(key(id));\n\n      if (!raw) {\n        return undefined;\n      }\n\n      const record = parseRecord<TData>(raw);\n\n      if (!record) {\n        return undefined;\n      }\n\n      if (storeExpiration(record) <= now) {\n        await client.del(key(id));\n        return undefined;\n      }\n\n      return record;\n    },\n    async rotate(currentId, candidate, expectedVersion) {\n      const record = toRecord(candidate, expectedVersion + 1);\n\n      try {\n        const stored = await client.demiurgeSessionRotate(\n          key(currentId),\n          key(record.id),\n          String(expectedVersion),\n          JSON.stringify(record),\n          String(storeExpiration(record)),\n        );\n        return stored === 1\n          ? { record, status: \"stored\" }\n          : { status: \"conflict\" };\n      } catch {\n        return { status: \"unavailable\" };\n      }\n    },\n    async update(candidate, expectedVersion) {\n      const record = toRecord(candidate, expectedVersion + 1);\n\n      try {\n        const stored = await client.demiurgeSessionUpdate(\n          key(record.id),\n          String(expectedVersion),\n          JSON.stringify(record),\n          String(storeExpiration(record)),\n        );\n        return stored === 1\n          ? { record, status: \"stored\" }\n          : { status: \"conflict\" };\n      } catch {\n        return { status: \"unavailable\" };\n      }\n    },\n  };\n}\n\nfunction parseRecord<TData extends SessionData>(\n  raw: string,\n): SessionRecord<TData> | undefined {\n  try {\n    return parseSessionRecord<TData>(JSON.parse(raw));\n  } catch {\n    return undefined;\n  }\n}\n\nfunction toRecord<TData extends SessionData>(\n  candidate: SessionStoreCandidate<TData>,\n  version: number,\n): SessionRecord<TData> {\n  return structuredClone({ ...candidate, version });\n}\n\nfunction storeExpiration(record: SessionRecord) {\n  return Math.min(record.expiresAt, record.idleExpiresAt ?? record.expiresAt);\n}\n"],"names":["defaultKeyPrefix","setScript","deleteScript","invalidateTagsScript","publishRefreshScript","releaseRefreshLeaseScript","commands","client","withCommands","createRedisCacheStore","options","prefix","entryPrefix","tagPrefix","leasePrefix","key","token","expiresAt","raw","tags","entry","incrementScript","createRedisRateLimitStore","windowMs","count","resetAt","createScript","updateScript","rotateScript","createRedisSessionStore","namespace","serializeSessionNamespace","id","candidate","record","toRecord","storeExpiration","now","parseRecord","currentId","expectedVersion","parseSessionRecord","version"],"mappings":";AAeA,MAAMA,IAAmB,mBAWnBC,IAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAsBZC,IAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAkBfC,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAkCvBC,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAyBvBC,IAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+ClC,SAASC,EAASC,GAA2C;AAE3D,QAAMC,IAAeD;AAErB,SAAKC,EAAa,oBAChBD,EAAO,cAAc,oBAAoB,EAAE,KAAKN,GAAW,cAAc,GAAG,GAGzEO,EAAa,uBAChBD,EAAO,cAAc,uBAAuB;AAAA,IAC1C,KAAKL;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAGEM,EAAa,+BAChBD,EAAO,cAAc,+BAA+B;AAAA,IAClD,KAAKJ;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAGEK,EAAa,+BAChBD,EAAO,cAAc,+BAA+B;AAAA,IAClD,KAAKH;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAGEI,EAAa,oCAChBD,EAAO,cAAc,oCAAoC;AAAA,IACvD,KAAKF;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAIIG;AACT;AAOO,SAASC,EACdC,GACY;AACZ,MAAI,CAACA,EAAQ,UAAU,OAAOA,EAAQ,OAAO,iBAAkB;AAC7D,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAIJ,QAAMH,IAASD,EAASI,EAAQ,MAAM,GAChCC,IAASD,EAAQ,aAAaV,GAC9BY,IAAc,GAAGD,CAAM,UACvBE,IAAY,GAAGF,CAAM,QACrBG,IAAc,GAAGH,CAAM;AAE7B,SAAO;AAAA,IACL,MAAM,oBAAoBI,GAAKC,GAAOC,GAAW;AAY/C,aATe,MAAMV,EAAO;AAAA,QAC1B;AAAA,QACAO,IAAcC;AAAA,QACdC;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAOC,CAAS;AAAA,MAAA,MAGA;AAAA,IACpB;AAAA,IACA,MAAM,OAAOF,GAAK;AAQhB,aAPgB,MAAMR,EAAO;AAAA,QAC3BK,IAAcG;AAAA,QACdD,IAAcC;AAAA,QACdF;AAAA,QACAE;AAAA,MAAA,MAGiB;AAAA,IACrB;AAAA,IACA,MAAM,IAAIA,GAAK;AACb,YAAMG,IAAM,MAAMX,EAAO,IAAIK,IAAcG,CAAG;AAE9C,aAAOG,IAAO,KAAK,MAAMA,CAAG,IAAwB;AAAA,IACtD;AAAA,IACA,MAAM,eAAeC,GAAM;AACzB,aAAIA,EAAK,WAAW,IACX,IAGF,MAAMZ,EAAO;AAAA,QAClB,KAAK,UAAUY,CAAI;AAAA,QACnBN;AAAA,QACAD;AAAA,QACAE;AAAA,MAAA;AAAA,IAEJ;AAAA,IACA,MAAM,eAAeC,GAAKC,GAAOI,GAAO;AAWtC,aAVe,MAAMb,EAAO;AAAA,QAC1BK,IAAcG;AAAA,QACdD,IAAcC;AAAA,QACdC;AAAA,QACA,KAAK,UAAUI,CAAK;AAAA,QACpBA,EAAM,eAAe,OAAO,KAAK,OAAOA,EAAM,UAAU;AAAA,QACxDP;AAAA,QACAE;AAAA,MAAA,MAGgB;AAAA,IACpB;AAAA,IACA,MAAM,oBAAoBA,GAAKC,GAAO;AACpC,YAAMT,EAAO,iCAAiCO,IAAcC,GAAKC,CAAK;AAAA,IACxE;AAAA,IACA,MAAM,IAAID,GAAKK,GAAO;AACpB,YAAMb,EAAO;AAAA,QACXK,IAAcG;AAAA,QACdD,IAAcC;AAAA,QACd,KAAK,UAAUK,CAAK;AAAA,QACpBA,EAAM,eAAe,OAAO,KAAK,OAAOA,EAAM,UAAU;AAAA,QACxDP;AAAA,QACAE;AAAA,MAAA;AAAA,IAEJ;AAAA,EAAA;AAEJ;AC7RA,MAAMf,IAAmB,uBAYnBqB,IAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAyBxB,SAASf,EAASC,GAA+C;AAE/D,QAAMC,IAAeD;AAErB,SAAKC,EAAa,8BAChBD,EAAO,cAAc,8BAA8B;AAAA,IACjD,KAAKc;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAIIb;AACT;AAEO,SAASc,EACdZ,GACgB;AAChB,MAAI,CAACA,EAAQ,UAAU,OAAOA,EAAQ,OAAO,iBAAkB;AAC7D,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAIJ,QAAMH,IAASD,EAASI,EAAQ,MAAM,GAChCC,IAASD,EAAQ,aAAaV;AAEpC,SAAO;AAAA,IACL,MAAM,UAAUe,GAAKQ,GAAoC;AACvD,YAAM,CAACC,GAAOC,CAAO,IAAI,MAAMlB,EAAO;AAAA,QACpCI,IAASI;AAAA,QACT,OAAOQ,CAAQ;AAAA,MAAA;AAGjB,aAAO,EAAE,OAAAC,GAAO,SAAAC,EAAA;AAAA,IAClB;AAAA,EAAA;AAEJ;ACzEA,MAAMzB,IAAmB,qBAEnB0B,IAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAQfC,IAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GASfC,IAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCrB,SAAStB,EAASC,GAA6C;AAE7D,QAAMC,IAAeD;AAErB,SAAKC,EAAa,yBAChBD,EAAO,cAAc,yBAAyB;AAAA,IAC5C,KAAKmB;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAGElB,EAAa,yBAChBD,EAAO,cAAc,yBAAyB;AAAA,IAC5C,KAAKoB;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAGEnB,EAAa,yBAChBD,EAAO,cAAc,yBAAyB;AAAA,IAC5C,KAAKqB;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAIIpB;AACT;AAEO,SAASqB,EAEdnB,GAAwD;AACxD,MAAI,CAACA,EAAQ,UAAU,OAAOA,EAAQ,OAAO,iBAAkB;AAC7D,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAIJ,QAAMH,IAASD,EAASI,EAAQ,MAAM,GAChCoB,IAAYC,EAA0BrB,EAAQ,SAAS,GACvDC,IAAS,GAAGD,EAAQ,aAAaV,CAAgB,GAAG8B,CAAS,KAC7Df,IAAM,CAACiB,MAAerB,IAASqB;AAErC,SAAO;AAAA,IACL,MAAM,OAAOC,GAAW;AACtB,YAAMC,IAASC,EAASF,GAAW,CAAC;AAEpC,UAAI;AAMF,eALe,MAAM1B,EAAO;AAAA,UAC1BQ,EAAImB,EAAO,EAAE;AAAA,UACb,KAAK,UAAUA,CAAM;AAAA,UACrB,OAAOE,EAAgBF,CAAM,CAAC;AAAA,QAAA,MAEd,IACd,EAAE,QAAAA,GAAQ,QAAQ,SAAA,IAClB,EAAE,QAAQ,WAAA;AAAA,MAChB,QAAQ;AACN,eAAO,EAAE,QAAQ,cAAA;AAAA,MACnB;AAAA,IACF;AAAA,IACA,MAAM,QAAQF,GAAI;AAChB,aAAO,MAAMzB,EAAO,IAAIQ,EAAIiB,CAAE,CAAC,MAAM;AAAA,IACvC;AAAA,IACA,MAAM,KAAKA,GAAIK,GAAK;AAClB,YAAMnB,IAAM,MAAMX,EAAO,IAAIQ,EAAIiB,CAAE,CAAC;AAEpC,UAAI,CAACd;AACH;AAGF,YAAMgB,IAASI,EAAmBpB,CAAG;AAErC,UAAKgB,GAIL;AAAA,YAAIE,EAAgBF,CAAM,KAAKG,GAAK;AAClC,gBAAM9B,EAAO,IAAIQ,EAAIiB,CAAE,CAAC;AACxB;AAAA,QACF;AAEA,eAAOE;AAAA;AAAA,IACT;AAAA,IACA,MAAM,OAAOK,GAAWN,GAAWO,GAAiB;AAClD,YAAMN,IAASC,EAASF,GAAWO,IAAkB,CAAC;AAEtD,UAAI;AAQF,eAPe,MAAMjC,EAAO;AAAA,UAC1BQ,EAAIwB,CAAS;AAAA,UACbxB,EAAImB,EAAO,EAAE;AAAA,UACb,OAAOM,CAAe;AAAA,UACtB,KAAK,UAAUN,CAAM;AAAA,UACrB,OAAOE,EAAgBF,CAAM,CAAC;AAAA,QAAA,MAEd,IACd,EAAE,QAAAA,GAAQ,QAAQ,SAAA,IAClB,EAAE,QAAQ,WAAA;AAAA,MAChB,QAAQ;AACN,eAAO,EAAE,QAAQ,cAAA;AAAA,MACnB;AAAA,IACF;AAAA,IACA,MAAM,OAAOD,GAAWO,GAAiB;AACvC,YAAMN,IAASC,EAASF,GAAWO,IAAkB,CAAC;AAEtD,UAAI;AAOF,eANe,MAAMjC,EAAO;AAAA,UAC1BQ,EAAImB,EAAO,EAAE;AAAA,UACb,OAAOM,CAAe;AAAA,UACtB,KAAK,UAAUN,CAAM;AAAA,UACrB,OAAOE,EAAgBF,CAAM,CAAC;AAAA,QAAA,MAEd,IACd,EAAE,QAAAA,GAAQ,QAAQ,SAAA,IAClB,EAAE,QAAQ,WAAA;AAAA,MAChB,QAAQ;AACN,eAAO,EAAE,QAAQ,cAAA;AAAA,MACnB;AAAA,IACF;AAAA,EAAA;AAEJ;AAEA,SAASI,EACPpB,GACkC;AAClC,MAAI;AACF,WAAOuB,EAA0B,KAAK,MAAMvB,CAAG,CAAC;AAAA,EAClD,QAAQ;AACN;AAAA,EACF;AACF;AAEA,SAASiB,EACPF,GACAS,GACsB;AACtB,SAAO,gBAAgB,EAAE,GAAGT,GAAW,SAAAS,GAAS;AAClD;AAEA,SAASN,EAAgBF,GAAuB;AAC9C,SAAO,KAAK,IAAIA,EAAO,WAAWA,EAAO,iBAAiBA,EAAO,SAAS;AAC5E;"}
+{"version":3,"file":"index.js","sources":["../../src/redis/store.ts","../../src/redis/rate-limit-store.ts","../../src/redis/session-store.ts"],"sourcesContent":["import type { Redis } from \"ioredis\";\nimport type { CacheStore, CacheStoreEntry } from \"../data/cache\";\n\nexport type RedisCacheStoreOptions = {\n  // Every consumer of one Redis database shares one keyspace. This prefix\n  // scopes the store's entry, tag, and lease keys away from an application's\n  // other Redis use. Two Demiurge deployments that share a database still\n  // need distinct prefixes, the same way they need distinct cache namespaces.\n  keyPrefix?: string;\n  // The store issues commands on a client the application already\n  // constructed and connected. Connection options, TLS, Sentinel, and retry\n  // policy are the application's decision, not this store's.\n  client: Redis;\n};\n\nconst defaultKeyPrefix = \"demiurge:cache:\";\n\n// Tag sets hold the raw, unprefixed cache key as each member, never the\n// prefixed entry key. invalidateTags() only knows a tag's members. It\n// rebuilds both the entry key and the lease key by applying their prefixes.\n// Every script below adds and removes the same raw-key member, so the two\n// stay in agreement.\n\n// KEYS[1] entry key, KEYS[2] lease key.\n// ARGV[1] entry JSON, ARGV[2] staleUntil epoch ms or \"\".\n// ARGV[3] tag key prefix, ARGV[4] raw key.\nconst setScript = `\nlocal old = redis.call(\"GET\", KEYS[1])\nif old then\n  local oldTags = cjson.decode(old).tags\n  for i = 1, #oldTags do\n    redis.call(\"SREM\", ARGV[3] .. oldTags[i], ARGV[4])\n  end\nend\nredis.call(\"SET\", KEYS[1], ARGV[1])\nif ARGV[2] ~= \"\" then\n  redis.call(\"PEXPIREAT\", KEYS[1], ARGV[2])\nend\nlocal newTags = cjson.decode(ARGV[1]).tags\nfor i = 1, #newTags do\n  redis.call(\"SADD\", ARGV[3] .. newTags[i], ARGV[4])\nend\nredis.call(\"DEL\", KEYS[2])\nreturn 1\n`;\n\n// KEYS[1] entry key, KEYS[2] lease key.\n// ARGV[1] tag key prefix, ARGV[2] raw key.\nconst deleteScript = `\nlocal old = redis.call(\"GET\", KEYS[1])\nredis.call(\"DEL\", KEYS[2])\nif not old then\n  return 0\nend\nlocal oldTags = cjson.decode(old).tags\nfor i = 1, #oldTags do\n  redis.call(\"SREM\", ARGV[1] .. oldTags[i], ARGV[2])\nend\nredis.call(\"DEL\", KEYS[1])\nreturn 1\n`;\n\n// No declared KEYS. Tags name a variable number of sets, so the script reads\n// their redis keys from ARGV instead.\n// ARGV[1] tags JSON array, ARGV[2] tag key prefix, ARGV[3] entry key prefix,\n// ARGV[4] lease key prefix\nconst invalidateTagsScript = `\nlocal tags = cjson.decode(ARGV[1])\nlocal seen = {}\nlocal deleted = 0\nfor i = 1, #tags do\n  local tagSetKey = ARGV[2] .. tags[i]\n  local members = redis.call(\"SMEMBERS\", tagSetKey)\n  for j = 1, #members do\n    local rawKey = members[j]\n    if not seen[rawKey] then\n      seen[rawKey] = true\n      local entryKey = ARGV[3] .. rawKey\n      local old = redis.call(\"GET\", entryKey)\n      if old then\n        local oldTags = cjson.decode(old).tags\n        for t = 1, #oldTags do\n          redis.call(\"SREM\", ARGV[2] .. oldTags[t], rawKey)\n        end\n        redis.call(\"DEL\", entryKey)\n        redis.call(\"DEL\", ARGV[4] .. rawKey)\n        deleted = deleted + 1\n      else\n        redis.call(\"SREM\", tagSetKey, rawKey)\n      end\n    end\n  end\n  redis.call(\"DEL\", tagSetKey)\nend\nreturn deleted\n`;\n\n// KEYS[1] entry key, KEYS[2] lease key.\n// ARGV[1] token, ARGV[2] entry JSON, ARGV[3] staleUntil epoch ms or \"\".\n// ARGV[4] tag key prefix, ARGV[5] raw key.\nconst publishRefreshScript = `\nlocal owner = redis.call(\"GET\", KEYS[2])\nif not owner or owner ~= ARGV[1] then\n  return 0\nend\nlocal old = redis.call(\"GET\", KEYS[1])\nif old then\n  local oldTags = cjson.decode(old).tags\n  for i = 1, #oldTags do\n    redis.call(\"SREM\", ARGV[4] .. oldTags[i], ARGV[5])\n  end\nend\nredis.call(\"SET\", KEYS[1], ARGV[2])\nif ARGV[3] ~= \"\" then\n  redis.call(\"PEXPIREAT\", KEYS[1], ARGV[3])\nend\nlocal newTags = cjson.decode(ARGV[2]).tags\nfor i = 1, #newTags do\n  redis.call(\"SADD\", ARGV[4] .. newTags[i], ARGV[5])\nend\nredis.call(\"DEL\", KEYS[2])\nreturn 1\n`;\n\n// KEYS[1] lease key, ARGV[1] token\nconst releaseRefreshLeaseScript = `\nlocal owner = redis.call(\"GET\", KEYS[1])\nif owner == ARGV[1] then\n  redis.call(\"DEL\", KEYS[1])\nend\nreturn 0\n`;\n\ntype RedisCacheCommands = {\n  demiurgeCacheSet: (\n    entryKey: string,\n    leaseKey: string,\n    entryJson: string,\n    staleUntil: string,\n    tagPrefix: string,\n    rawKey: string,\n  ) => Promise<number>;\n  demiurgeCacheDelete: (\n    entryKey: string,\n    leaseKey: string,\n    tagPrefix: string,\n    rawKey: string,\n  ) => Promise<number>;\n  demiurgeCacheInvalidateTags: (\n    tagsJson: string,\n    tagPrefix: string,\n    entryPrefix: string,\n    leasePrefix: string,\n  ) => Promise<number>;\n  demiurgeCachePublishRefresh: (\n    entryKey: string,\n    leaseKey: string,\n    token: string,\n    entryJson: string,\n    staleUntil: string,\n    tagPrefix: string,\n    rawKey: string,\n  ) => Promise<number>;\n  demiurgeCacheReleaseRefreshLease: (\n    leaseKey: string,\n    token: string,\n  ) => Promise<number>;\n};\n\n// The application already owns one ioredis client. Attaching the store's\n// commands is idempotent, so building several stores on the same client, or\n// rebuilding one after a reconnect, never redefines a command twice.\nfunction commands(client: Redis): Redis & RedisCacheCommands {\n  // TYPE-EVIDENCE: the cast adds the optional custom command methods before the runtime checks install them.\n  const withCommands = client as Redis & Partial<RedisCacheCommands>;\n\n  if (!withCommands.demiurgeCacheSet) {\n    client.defineCommand(\"demiurgeCacheSet\", { lua: setScript, numberOfKeys: 2 });\n  }\n\n  if (!withCommands.demiurgeCacheDelete) {\n    client.defineCommand(\"demiurgeCacheDelete\", {\n      lua: deleteScript,\n      numberOfKeys: 2,\n    });\n  }\n\n  if (!withCommands.demiurgeCacheInvalidateTags) {\n    client.defineCommand(\"demiurgeCacheInvalidateTags\", {\n      lua: invalidateTagsScript,\n      numberOfKeys: 0,\n    });\n  }\n\n  if (!withCommands.demiurgeCachePublishRefresh) {\n    client.defineCommand(\"demiurgeCachePublishRefresh\", {\n      lua: publishRefreshScript,\n      numberOfKeys: 2,\n    });\n  }\n\n  if (!withCommands.demiurgeCacheReleaseRefreshLease) {\n    client.defineCommand(\"demiurgeCacheReleaseRefreshLease\", {\n      lua: releaseRefreshLeaseScript,\n      numberOfKeys: 1,\n    });\n  }\n\n  // TYPE-EVIDENCE: the defineCommand calls above install each custom command. The cast reflects that the methods now exist.\n  return withCommands as Redis & RedisCacheCommands;\n}\n\n// Redis holds the entry, its tag memberships, and its refresh lease as\n// independent keys. Every process talking to the same database must see\n// these three stay coordinated. Each write path therefore runs as one Lua\n// script rather than several round trips a concurrent writer could\n// interleave with.\nexport function createRedisCacheStore(\n  options: RedisCacheStoreOptions,\n): CacheStore {\n  if (!options.client || typeof options.client.defineCommand !== \"function\") {\n    throw new Error(\n      \"Demiurge Redis cache store requires an ioredis client. Pass a connected ioredis Redis instance as `client`.\",\n    );\n  }\n\n  const client = commands(options.client);\n  const prefix = options.keyPrefix ?? defaultKeyPrefix;\n  const entryPrefix = `${prefix}entry:`;\n  const tagPrefix = `${prefix}tag:`;\n  const leasePrefix = `${prefix}lease:`;\n\n  return {\n    capabilities: { atomicity: \"strong\" },\n    async acquireRefreshLease(key, token, expiresAt) {\n      // ioredis's typed SET overloads do not cover every flag order the\n      // Redis SET command accepts, so this issues the raw command instead.\n      const result = await client.call(\n        \"SET\",\n        leasePrefix + key,\n        token,\n        \"NX\",\n        \"PXAT\",\n        String(expiresAt),\n      );\n\n      return result === \"OK\";\n    },\n    async delete(key) {\n      const deleted = await client.demiurgeCacheDelete(\n        entryPrefix + key,\n        leasePrefix + key,\n        tagPrefix,\n        key,\n      );\n\n      return deleted === 1;\n    },\n    async get(key) {\n      const raw = await client.get(entryPrefix + key);\n      // TYPE-EVIDENCE: the stored raw value is JSON that the store serialized from a cache entry. The cast restores that shape.\n      return raw ? (JSON.parse(raw) as CacheStoreEntry) : undefined;\n    },\n    async invalidateTags(tags) {\n      if (tags.length === 0) {\n        return 0;\n      }\n\n      return await client.demiurgeCacheInvalidateTags(\n        JSON.stringify(tags),\n        tagPrefix,\n        entryPrefix,\n        leasePrefix,\n      );\n    },\n    async publishRefresh(key, token, entry) {\n      const result = await client.demiurgeCachePublishRefresh(\n        entryPrefix + key,\n        leasePrefix + key,\n        token,\n        JSON.stringify(entry),\n        entry.staleUntil === null ? \"\" : String(entry.staleUntil),\n        tagPrefix,\n        key,\n      );\n\n      return result === 1;\n    },\n    async releaseRefreshLease(key, token) {\n      await client.demiurgeCacheReleaseRefreshLease(leasePrefix + key, token);\n    },\n    async set(key, entry) {\n      await client.demiurgeCacheSet(\n        entryPrefix + key,\n        leasePrefix + key,\n        JSON.stringify(entry),\n        entry.staleUntil === null ? \"\" : String(entry.staleUntil),\n        tagPrefix,\n        key,\n      );\n    },\n  };\n}\n","import type { Redis } from \"ioredis\";\nimport type { RateLimitResult, RateLimitStore } from \"../security/types\";\n\nexport type RedisRateLimitStoreOptions = {\n  // Every consumer of one Redis database shares one keyspace. This prefix\n  // scopes the store's counter keys away from an application's other Redis\n  // use, the same way RedisCacheStoreOptions.keyPrefix does for the cache\n  // store. Two Demiurge deployments that share a database still need\n  // distinct prefixes.\n  keyPrefix?: string;\n  // The store issues commands on a client the application already\n  // constructed and connected. Connection options, TLS, Sentinel, and retry\n  // policy are the application's decision, not this store's.\n  client: Redis;\n};\n\nconst defaultKeyPrefix = \"demiurge:ratelimit:\";\n\n// KEYS[1] counter key. ARGV[1] window in ms.\n//\n// INCR and PEXPIRE run inside one script. Redis executes the whole script\n// as a single atomic step, so two instances racing to increment the same\n// key never both observe count 1. The window's reset time comes from\n// Redis's own clock (TIME), not the caller-supplied `now`. The counter's\n// TTL is authoritative once several processes share it, and a\n// client-supplied timestamp could disagree with the server that expires the\n// key. TIME is deterministic across replication because Redis rewrites the\n// script's effects rather than replaying non-deterministic commands.\nconst incrementScript = `\nlocal count = redis.call(\"INCR\", KEYS[1])\nif count == 1 then\n  redis.call(\"PEXPIRE\", KEYS[1], ARGV[1])\nend\nlocal ttl = redis.call(\"PTTL\", KEYS[1])\nif ttl < 0 then\n  redis.call(\"PEXPIRE\", KEYS[1], ARGV[1])\n  ttl = tonumber(ARGV[1])\nend\nlocal time = redis.call(\"TIME\")\nlocal nowMs = math.floor(tonumber(time[1]) * 1000 + tonumber(time[2]) / 1000)\nreturn { count, nowMs + ttl }\n`;\n\ntype RedisRateLimitCommands = {\n  demiurgeRateLimitIncrement: (\n    counterKey: string,\n    windowMs: string,\n  ) => Promise<[number, number]>;\n};\n\n// The application already owns one ioredis client. Attaching the store's\n// command is idempotent, so building several stores on the same client, or\n// rebuilding one after a reconnect, never redefines the command twice.\nfunction commands(client: Redis): Redis & RedisRateLimitCommands {\n  // TYPE-EVIDENCE: the cast adds the optional custom command methods before the runtime check installs them.\n  const withCommands = client as Redis & Partial<RedisRateLimitCommands>;\n\n  if (!withCommands.demiurgeRateLimitIncrement) {\n    client.defineCommand(\"demiurgeRateLimitIncrement\", {\n      lua: incrementScript,\n      numberOfKeys: 1,\n    });\n  }\n\n  // TYPE-EVIDENCE: the defineCommand call above installs the custom command. The cast reflects that the method now exists.\n  return withCommands as Redis & RedisRateLimitCommands;\n}\n\nexport function createRedisRateLimitStore(\n  options: RedisRateLimitStoreOptions,\n): RateLimitStore {\n  if (!options.client || typeof options.client.defineCommand !== \"function\") {\n    throw new Error(\n      \"Demiurge Redis rate limit store requires an ioredis client. Pass a connected ioredis Redis instance as `client`.\",\n    );\n  }\n\n  const client = commands(options.client);\n  const prefix = options.keyPrefix ?? defaultKeyPrefix;\n\n  return {\n    async increment(key, windowMs): Promise<RateLimitResult> {\n      const [count, resetAt] = await client.demiurgeRateLimitIncrement(\n        prefix + key,\n        String(windowMs),\n      );\n\n      return { count, resetAt };\n    },\n  };\n}\n","import type { Redis } from \"ioredis\";\nimport {\n  parseSessionRecord,\n  serializeSessionNamespace,\n  type SessionData,\n  type SessionNamespace,\n  type SessionRecord,\n  type SessionStore,\n  type SessionStoreCandidate,\n} from \"../security/session-store\";\n\nexport type RedisSessionStoreOptions = {\n  client: Redis;\n  keyPrefix?: string;\n  namespace: SessionNamespace;\n};\n\nconst defaultKeyPrefix = \"demiurge:session:\";\n\nconst createScript = `\nif redis.call(\"EXISTS\", KEYS[1]) == 1 then\n  return 0\nend\nredis.call(\"SET\", KEYS[1], ARGV[1], \"PXAT\", ARGV[2])\nreturn 1\n`;\n\nconst updateScript = `\nlocal current = redis.call(\"GET\", KEYS[1])\nif not current or cjson.decode(current).version ~= tonumber(ARGV[1]) then\n  return 0\nend\nredis.call(\"SET\", KEYS[1], ARGV[2], \"PXAT\", ARGV[3])\nreturn 1\n`;\n\nconst rotateScript = `\nlocal current = redis.call(\"GET\", KEYS[1])\nif not current or cjson.decode(current).version ~= tonumber(ARGV[1]) then\n  return 0\nend\nif KEYS[1] ~= KEYS[2] and redis.call(\"EXISTS\", KEYS[2]) == 1 then\n  return 0\nend\nredis.call(\"DEL\", KEYS[1])\nredis.call(\"SET\", KEYS[2], ARGV[2], \"PXAT\", ARGV[3])\nreturn 1\n`;\n\ntype RedisSessionCommands = {\n  demiurgeSessionCreate: (\n    key: string,\n    record: string,\n    expiresAt: string,\n  ) => Promise<number>;\n  demiurgeSessionRotate: (\n    currentKey: string,\n    nextKey: string,\n    expectedVersion: string,\n    record: string,\n    expiresAt: string,\n  ) => Promise<number>;\n  demiurgeSessionUpdate: (\n    key: string,\n    expectedVersion: string,\n    record: string,\n    expiresAt: string,\n  ) => Promise<number>;\n};\n\nfunction commands(client: Redis): Redis & RedisSessionCommands {\n  // TYPE-EVIDENCE: the cast adds optional custom commands before the runtime checks install them.\n  const withCommands = client as Redis & Partial<RedisSessionCommands>;\n\n  if (!withCommands.demiurgeSessionCreate) {\n    client.defineCommand(\"demiurgeSessionCreate\", {\n      lua: createScript,\n      numberOfKeys: 1,\n    });\n  }\n\n  if (!withCommands.demiurgeSessionUpdate) {\n    client.defineCommand(\"demiurgeSessionUpdate\", {\n      lua: updateScript,\n      numberOfKeys: 1,\n    });\n  }\n\n  if (!withCommands.demiurgeSessionRotate) {\n    client.defineCommand(\"demiurgeSessionRotate\", {\n      lua: rotateScript,\n      numberOfKeys: 2,\n    });\n  }\n\n  // TYPE-EVIDENCE: the defineCommand calls install each command. The cast reflects the resulting client shape.\n  return withCommands as Redis & RedisSessionCommands;\n}\n\nexport function createRedisSessionStore<\n  TData extends SessionData = SessionData,\n>(options: RedisSessionStoreOptions): SessionStore<TData> {\n  if (!options.client || typeof options.client.defineCommand !== \"function\") {\n    throw new Error(\n      \"Demiurge Redis session store requires an ioredis client. Pass a connected ioredis Redis instance as `client`.\",\n    );\n  }\n\n  const client = commands(options.client);\n  const namespace = serializeSessionNamespace(options.namespace);\n  const prefix = `${options.keyPrefix ?? defaultKeyPrefix}${namespace}:`;\n  const key = (id: string) => prefix + id;\n\n  return {\n    async create(candidate) {\n      const record = toRecord(candidate, 0);\n\n      try {\n        const stored = await client.demiurgeSessionCreate(\n          key(record.id),\n          JSON.stringify(record),\n          String(storeExpiration(record)),\n        );\n        return stored === 1\n          ? { record, status: \"stored\" }\n          : { status: \"conflict\" };\n      } catch {\n        return { status: \"unavailable\" };\n      }\n    },\n    async destroy(id) {\n      return await client.del(key(id)) === 1;\n    },\n    async read(id, now) {\n      const raw = await client.get(key(id));\n\n      if (!raw) {\n        return undefined;\n      }\n\n      const record = parseRecord<TData>(raw);\n\n      if (!record) {\n        return undefined;\n      }\n\n      if (storeExpiration(record) <= now) {\n        await client.del(key(id));\n        return undefined;\n      }\n\n      return record;\n    },\n    async rotate(currentId, candidate, expectedVersion) {\n      const record = toRecord(candidate, expectedVersion + 1);\n\n      try {\n        const stored = await client.demiurgeSessionRotate(\n          key(currentId),\n          key(record.id),\n          String(expectedVersion),\n          JSON.stringify(record),\n          String(storeExpiration(record)),\n        );\n        return stored === 1\n          ? { record, status: \"stored\" }\n          : { status: \"conflict\" };\n      } catch {\n        return { status: \"unavailable\" };\n      }\n    },\n    async update(candidate, expectedVersion) {\n      const record = toRecord(candidate, expectedVersion + 1);\n\n      try {\n        const stored = await client.demiurgeSessionUpdate(\n          key(record.id),\n          String(expectedVersion),\n          JSON.stringify(record),\n          String(storeExpiration(record)),\n        );\n        return stored === 1\n          ? { record, status: \"stored\" }\n          : { status: \"conflict\" };\n      } catch {\n        return { status: \"unavailable\" };\n      }\n    },\n  };\n}\n\nfunction parseRecord<TData extends SessionData>(\n  raw: string,\n): SessionRecord<TData> | undefined {\n  try {\n    return parseSessionRecord<TData>(JSON.parse(raw));\n  } catch {\n    return undefined;\n  }\n}\n\nfunction toRecord<TData extends SessionData>(\n  candidate: SessionStoreCandidate<TData>,\n  version: number,\n): SessionRecord<TData> {\n  return structuredClone({ ...candidate, version });\n}\n\nfunction storeExpiration(record: SessionRecord) {\n  return Math.min(record.expiresAt, record.idleExpiresAt ?? record.expiresAt);\n}\n"],"names":["defaultKeyPrefix","setScript","deleteScript","invalidateTagsScript","publishRefreshScript","releaseRefreshLeaseScript","commands","client","withCommands","createRedisCacheStore","options","prefix","entryPrefix","tagPrefix","leasePrefix","key","token","expiresAt","raw","tags","entry","incrementScript","createRedisRateLimitStore","windowMs","count","resetAt","createScript","updateScript","rotateScript","createRedisSessionStore","namespace","serializeSessionNamespace","id","candidate","record","toRecord","storeExpiration","now","parseRecord","currentId","expectedVersion","parseSessionRecord","version"],"mappings":";AAeA,MAAMA,IAAmB,mBAWnBC,IAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAsBZC,IAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAkBfC,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAkCvBC,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAyBvBC,IAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+ClC,SAASC,EAASC,GAA2C;AAE3D,QAAMC,IAAeD;AAErB,SAAKC,EAAa,oBAChBD,EAAO,cAAc,oBAAoB,EAAE,KAAKN,GAAW,cAAc,GAAG,GAGzEO,EAAa,uBAChBD,EAAO,cAAc,uBAAuB;AAAA,IAC1C,KAAKL;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAGEM,EAAa,+BAChBD,EAAO,cAAc,+BAA+B;AAAA,IAClD,KAAKJ;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAGEK,EAAa,+BAChBD,EAAO,cAAc,+BAA+B;AAAA,IAClD,KAAKH;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAGEI,EAAa,oCAChBD,EAAO,cAAc,oCAAoC;AAAA,IACvD,KAAKF;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAIIG;AACT;AAOO,SAASC,EACdC,GACY;AACZ,MAAI,CAACA,EAAQ,UAAU,OAAOA,EAAQ,OAAO,iBAAkB;AAC7D,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAIJ,QAAMH,IAASD,EAASI,EAAQ,MAAM,GAChCC,IAASD,EAAQ,aAAaV,GAC9BY,IAAc,GAAGD,CAAM,UACvBE,IAAY,GAAGF,CAAM,QACrBG,IAAc,GAAGH,CAAM;AAE7B,SAAO;AAAA,IACL,cAAc,EAAE,WAAW,SAAA;AAAA,IAC3B,MAAM,oBAAoBI,GAAKC,GAAOC,GAAW;AAY/C,aATe,MAAMV,EAAO;AAAA,QAC1B;AAAA,QACAO,IAAcC;AAAA,QACdC;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAOC,CAAS;AAAA,MAAA,MAGA;AAAA,IACpB;AAAA,IACA,MAAM,OAAOF,GAAK;AAQhB,aAPgB,MAAMR,EAAO;AAAA,QAC3BK,IAAcG;AAAA,QACdD,IAAcC;AAAA,QACdF;AAAA,QACAE;AAAA,MAAA,MAGiB;AAAA,IACrB;AAAA,IACA,MAAM,IAAIA,GAAK;AACb,YAAMG,IAAM,MAAMX,EAAO,IAAIK,IAAcG,CAAG;AAE9C,aAAOG,IAAO,KAAK,MAAMA,CAAG,IAAwB;AAAA,IACtD;AAAA,IACA,MAAM,eAAeC,GAAM;AACzB,aAAIA,EAAK,WAAW,IACX,IAGF,MAAMZ,EAAO;AAAA,QAClB,KAAK,UAAUY,CAAI;AAAA,QACnBN;AAAA,QACAD;AAAA,QACAE;AAAA,MAAA;AAAA,IAEJ;AAAA,IACA,MAAM,eAAeC,GAAKC,GAAOI,GAAO;AAWtC,aAVe,MAAMb,EAAO;AAAA,QAC1BK,IAAcG;AAAA,QACdD,IAAcC;AAAA,QACdC;AAAA,QACA,KAAK,UAAUI,CAAK;AAAA,QACpBA,EAAM,eAAe,OAAO,KAAK,OAAOA,EAAM,UAAU;AAAA,QACxDP;AAAA,QACAE;AAAA,MAAA,MAGgB;AAAA,IACpB;AAAA,IACA,MAAM,oBAAoBA,GAAKC,GAAO;AACpC,YAAMT,EAAO,iCAAiCO,IAAcC,GAAKC,CAAK;AAAA,IACxE;AAAA,IACA,MAAM,IAAID,GAAKK,GAAO;AACpB,YAAMb,EAAO;AAAA,QACXK,IAAcG;AAAA,QACdD,IAAcC;AAAA,QACd,KAAK,UAAUK,CAAK;AAAA,QACpBA,EAAM,eAAe,OAAO,KAAK,OAAOA,EAAM,UAAU;AAAA,QACxDP;AAAA,QACAE;AAAA,MAAA;AAAA,IAEJ;AAAA,EAAA;AAEJ;AC9RA,MAAMf,IAAmB,uBAYnBqB,IAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAyBxB,SAASf,EAASC,GAA+C;AAE/D,QAAMC,IAAeD;AAErB,SAAKC,EAAa,8BAChBD,EAAO,cAAc,8BAA8B;AAAA,IACjD,KAAKc;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAIIb;AACT;AAEO,SAASc,EACdZ,GACgB;AAChB,MAAI,CAACA,EAAQ,UAAU,OAAOA,EAAQ,OAAO,iBAAkB;AAC7D,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAIJ,QAAMH,IAASD,EAASI,EAAQ,MAAM,GAChCC,IAASD,EAAQ,aAAaV;AAEpC,SAAO;AAAA,IACL,MAAM,UAAUe,GAAKQ,GAAoC;AACvD,YAAM,CAACC,GAAOC,CAAO,IAAI,MAAMlB,EAAO;AAAA,QACpCI,IAASI;AAAA,QACT,OAAOQ,CAAQ;AAAA,MAAA;AAGjB,aAAO,EAAE,OAAAC,GAAO,SAAAC,EAAA;AAAA,IAClB;AAAA,EAAA;AAEJ;ACzEA,MAAMzB,IAAmB,qBAEnB0B,IAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAQfC,IAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GASfC,IAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCrB,SAAStB,EAASC,GAA6C;AAE7D,QAAMC,IAAeD;AAErB,SAAKC,EAAa,yBAChBD,EAAO,cAAc,yBAAyB;AAAA,IAC5C,KAAKmB;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAGElB,EAAa,yBAChBD,EAAO,cAAc,yBAAyB;AAAA,IAC5C,KAAKoB;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAGEnB,EAAa,yBAChBD,EAAO,cAAc,yBAAyB;AAAA,IAC5C,KAAKqB;AAAA,IACL,cAAc;AAAA,EAAA,CACf,GAIIpB;AACT;AAEO,SAASqB,EAEdnB,GAAwD;AACxD,MAAI,CAACA,EAAQ,UAAU,OAAOA,EAAQ,OAAO,iBAAkB;AAC7D,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAIJ,QAAMH,IAASD,EAASI,EAAQ,MAAM,GAChCoB,IAAYC,EAA0BrB,EAAQ,SAAS,GACvDC,IAAS,GAAGD,EAAQ,aAAaV,CAAgB,GAAG8B,CAAS,KAC7Df,IAAM,CAACiB,MAAerB,IAASqB;AAErC,SAAO;AAAA,IACL,MAAM,OAAOC,GAAW;AACtB,YAAMC,IAASC,EAASF,GAAW,CAAC;AAEpC,UAAI;AAMF,eALe,MAAM1B,EAAO;AAAA,UAC1BQ,EAAImB,EAAO,EAAE;AAAA,UACb,KAAK,UAAUA,CAAM;AAAA,UACrB,OAAOE,EAAgBF,CAAM,CAAC;AAAA,QAAA,MAEd,IACd,EAAE,QAAAA,GAAQ,QAAQ,SAAA,IAClB,EAAE,QAAQ,WAAA;AAAA,MAChB,QAAQ;AACN,eAAO,EAAE,QAAQ,cAAA;AAAA,MACnB;AAAA,IACF;AAAA,IACA,MAAM,QAAQF,GAAI;AAChB,aAAO,MAAMzB,EAAO,IAAIQ,EAAIiB,CAAE,CAAC,MAAM;AAAA,IACvC;AAAA,IACA,MAAM,KAAKA,GAAIK,GAAK;AAClB,YAAMnB,IAAM,MAAMX,EAAO,IAAIQ,EAAIiB,CAAE,CAAC;AAEpC,UAAI,CAACd;AACH;AAGF,YAAMgB,IAASI,EAAmBpB,CAAG;AAErC,UAAKgB,GAIL;AAAA,YAAIE,EAAgBF,CAAM,KAAKG,GAAK;AAClC,gBAAM9B,EAAO,IAAIQ,EAAIiB,CAAE,CAAC;AACxB;AAAA,QACF;AAEA,eAAOE;AAAA;AAAA,IACT;AAAA,IACA,MAAM,OAAOK,GAAWN,GAAWO,GAAiB;AAClD,YAAMN,IAASC,EAASF,GAAWO,IAAkB,CAAC;AAEtD,UAAI;AAQF,eAPe,MAAMjC,EAAO;AAAA,UAC1BQ,EAAIwB,CAAS;AAAA,UACbxB,EAAImB,EAAO,EAAE;AAAA,UACb,OAAOM,CAAe;AAAA,UACtB,KAAK,UAAUN,CAAM;AAAA,UACrB,OAAOE,EAAgBF,CAAM,CAAC;AAAA,QAAA,MAEd,IACd,EAAE,QAAAA,GAAQ,QAAQ,SAAA,IAClB,EAAE,QAAQ,WAAA;AAAA,MAChB,QAAQ;AACN,eAAO,EAAE,QAAQ,cAAA;AAAA,MACnB;AAAA,IACF;AAAA,IACA,MAAM,OAAOD,GAAWO,GAAiB;AACvC,YAAMN,IAASC,EAASF,GAAWO,IAAkB,CAAC;AAEtD,UAAI;AAOF,eANe,MAAMjC,EAAO;AAAA,UAC1BQ,EAAImB,EAAO,EAAE;AAAA,UACb,OAAOM,CAAe;AAAA,UACtB,KAAK,UAAUN,CAAM;AAAA,UACrB,OAAOE,EAAgBF,CAAM,CAAC;AAAA,QAAA,MAEd,IACd,EAAE,QAAAA,GAAQ,QAAQ,SAAA,IAClB,EAAE,QAAQ,WAAA;AAAA,MAChB,QAAQ;AACN,eAAO,EAAE,QAAQ,cAAA;AAAA,MACnB;AAAA,IACF;AAAA,EAAA;AAEJ;AAEA,SAASI,EACPpB,GACkC;AAClC,MAAI;AACF,WAAOuB,EAA0B,KAAK,MAAMvB,CAAG,CAAC;AAAA,EAClD,QAAQ;AACN;AAAA,EACF;AACF;AAEA,SAASiB,EACPF,GACAS,GACsB;AACtB,SAAO,gBAAgB,EAAE,GAAGT,GAAW,SAAAS,GAAS;AAClD;AAEA,SAASN,EAAgBF,GAAuB;AAC9C,SAAO,KAAK,IAAIA,EAAO,WAAWA,EAAO,iBAAiBA,EAAO,SAAS;AAC5E;"}

package/dist/redis/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/redis/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,EAAmB,MAAM,eAAe,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG;IAKnC,SAAS,CAAC,EAAE,MAAM,CAAC;IAInB,MAAM,EAAE,KAAK,CAAC;CACf,CAAC;AA4MF,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,UAAU,CAkFZ"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/redis/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,EAAmB,MAAM,eAAe,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG;IAKnC,SAAS,CAAC,EAAE,MAAM,CAAC;IAInB,MAAM,EAAE,KAAK,CAAC;CACf,CAAC;AA4MF,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,UAAU,CAmFZ"}

package/dist/route/index.d.ts

@@ -1,6 +1,7 @@
 export { mutation, mutationInput, MutationValidationError, MUTATION_REQUEST_HEADER, MUTATION_REQUEST_VALUE, MUTATION_RESPONSE_MEDIA_TYPE, } from "./mutation";
 export { page } from "./page";
 export { defineMiddleware } from "./middleware";
+export { assertSerializableValue, RouteSerializationError, } from "./serialization";
 export { HTTP_ERROR_STATUSES, HttpError, httpError, isHttpError, } from "./http-error";
 export { html, json, jsonl, notFound, redirect, response, serverTiming, sse, stream, text, toResponse, } from "./response";
 export { webhook } from "./webhook";

package/dist/route/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/route/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,SAAS,EACT,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,GAAG,EACH,MAAM,EACN,IAAI,EACJ,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,+BAA+B,EAC/B,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,WAAW,EACX,UAAU,EACV,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,0BAA0B,EAC1B,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/route/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,SAAS,EACT,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,GAAG,EACH,MAAM,EACN,IAAI,EACJ,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,+BAA+B,EAC/B,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,WAAW,EACX,UAAU,EACV,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,0BAA0B,EAC1B,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,SAAS,CAAC"}

package/dist/route/mutation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mutation.d.ts","sourceRoot":"","sources":["../../src/route/mutation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,gBAAgB,EACjB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EACV,UAAU,EACV,mBAAmB,EACpB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,CAAC,MAAM,mBAAmB,EAAE,OAAO,MAAM,CAAC;AAEjD,MAAM,MAAM,aAAa,CACvB,MAAM,EACN,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IACpD;IACF,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;CACnE,CAAC;AAEF,KAAK,kBAAkB,CACrB,MAAM,EACN,KAAK,SAAS,MAAM,EACpB,OAAO,SAAS,MAAM,EACtB,MAAM,SAAS,MAAM,IACnB,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG;IAC1C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAClE,CAAC;AAEF,KAAK,kBAAkB,CAAC,OAAO,IAAI,OAAO,SAAS;IACjD,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,MAAM,CAAA;KAAE,CAAC;CACzD,GAAG,MAAM,GAAG,KAAK,CAAC;AAEnB,KAAK,kBAAkB,CAAC,OAAO,IAAI,OAAO,SAAS;IACjD,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,MAAM,SAAS,MAAM,CAAA;KAAE,CAAC;CACxE,GAAG,MAAM,GAAG,KAAK,CAAC;AAEnB,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,sBAAsB,aAAa,CAAC;AACjD,eAAO,MAAM,4BAA4B,+CAA+C,CAAC;AAEzF,OAAO,CAAC,MAAM,kBAAkB,EAAE,OAAO,MAAM,CAAC;AAEhD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEjE,MAAM,MAAM,kBAAkB,CAC5B,OAAO,GAAG,OAAO,EACjB,MAAM,SAAS,MAAM,GAAG,MAAM,EAC9B,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IACpD,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG;IAC1C,QAAQ,EAAE,IAAI,CAAC;IACf,QAAQ,CAAC,CAAC,kBAAkB,CAAC,EAAE;QAC7B,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,OAAO,IAAI;KACtC,OAAO,IAAI,MAAM,OAAO,IACvB,OAAO,SAAS,cAAc,GAC1B,OAAO,CAAC,OAAO,CAAC,SAAS,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAC7D,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,kBAAkB,CAAC,MAAM,OAAO,CAAC,GAChE,OAAO,CAAC,OAAO,CAAC,SAAS,kBAAkB,CAAC,OAAO,EAAE,MAAM,MAAM,CAAC,GAChE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACjC,KAAK,GACP,KAAK;CACd,CAAC;AAEF,KAAK,oBAAoB,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,SACnD,cAAc,CAAC,MAAM,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,GAAG,OAAO,CAAC;AAEhE,MAAM,MAAM,uBAAuB,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM,IAAI;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,kBAAkB,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM,IAAI;IAC/D,MAAM,EAAE,SAAS,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;CACpD,CAAC;AAEF,qBAAa,uBAAuB,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM,CACjE,SAAQ,KAAK;IACb,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBAEpC,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC;CAUnD;AAED,MAAM,MAAM,eAAe,CACzB,MAAM,EACN,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IACpD,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG;IACrC,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAC7B,MAAM,EACN,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IACpD;IACF,GAAG,EAAE,QAAQ,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACjF,KAAK,EAAE,gBAAgB,CAAC;IACxB,GAAG,CAAC,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,oBAAoB,CAC9B,MAAM,EACN,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAEpD,+BAA+B,GAC/B,CAAC,CACD,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAC7C,YAAY,CAAC,+BAA+B,CAAC,CAAC,CAAC;AAEtD,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC3B,IAAI,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,4BAA4B,+BAA+B,CAAC;AAEzE,MAAM,MAAM,eAAe,CACzB,MAAM,EACN,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,EACtD,OAAO,SAAS,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,GAC3D,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,IAC7C;IACF,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,CACP,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KACtD,YAAY,CAAC,OAAO,CAAC,CAAC;IAC3B,WAAW,CAAC,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnE,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,UAAU,CAAC,EAAE,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnE,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B,CAAC;AAEF,wBAAgB,QAAQ,CACtB,OAAO,SAAS,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EACnE,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,EACtD,OAAO,SAAS,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,GAC3D,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,EAE/C,OAAO,EAAE,IAAI,CAAC,eAAe,CAC3B,kBAAkB,CAAC,OAAO,CAAC,EAC3B,KAAK,EACL,OAAO,EACP,OAAO,CACR,EAAE,OAAO,CAAC,GAAG;IACZ,KAAK,EAAE,OAAO,CAAC;CAChB,GACA,kBAAkB,CACnB,oBAAoB,CAAC,OAAO,CAAC,EAC7B,kBAAkB,CAAC,OAAO,CAAC,EAC3B,KAAK,EACL,OAAO,CACR,CAAC;AAEF,wBAAgB,QAAQ,CACtB,MAAM,EACN,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,EACtD,OAAO,SAAS,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,GAC3D,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,EAE/C,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG;IAC1D,KAAK,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;CAC9C,GACA,kBAAkB,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAE7E,wBAAgB,QAAQ,CACtB,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,EACtD,OAAO,SAAS,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,GAC3D,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,EAE/C,OAAO,EAAE,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG;IAC7D,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,GACA,kBAAkB,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAkQ7E,eAAO,MAAM,aAAa;WAEtB,MAAM,SAAS,MAAM,WACrB,MAAM,YACN,KAAK,SAAS,MAAM,WACpB,OAAO,SAAS,MAAM,yCAEf,CACL,OAAO,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,KACtC,YAAY,CAAC,MAAM,CAAC,GACxB,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;SAKnD,OAAO,SAAS,gBAAgB,EAChC,KAAK,SAAS,MAAM,WACpB,OAAO,SAAS,MAAM,0CAEd,OAAO,OACV,CACH,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,KACtC,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GACtD,kBAAkB,CACnB,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,EACrC,KAAK,EACL,OAAO,EACP,OAAO,CAAC,MAAM,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAC7D;0BAwB2B,gBAAgB;sBAGpB,gBAAgB;sBAIhB,gBAAgB;CAGzC,CAAC"}
+{"version":3,"file":"mutation.d.ts","sourceRoot":"","sources":["../../src/route/mutation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,gBAAgB,EACjB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EACV,UAAU,EACV,mBAAmB,EACpB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAI9D,OAAO,CAAC,MAAM,mBAAmB,EAAE,OAAO,MAAM,CAAC;AAEjD,MAAM,MAAM,aAAa,CACvB,MAAM,EACN,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IACpD;IACF,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;CACnE,CAAC;AAEF,KAAK,kBAAkB,CACrB,MAAM,EACN,KAAK,SAAS,MAAM,EACpB,OAAO,SAAS,MAAM,EACtB,MAAM,SAAS,MAAM,IACnB,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG;IAC1C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAClE,CAAC;AAEF,KAAK,kBAAkB,CAAC,OAAO,IAAI,OAAO,SAAS;IACjD,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,MAAM,CAAA;KAAE,CAAC;CACzD,GAAG,MAAM,GAAG,KAAK,CAAC;AAEnB,KAAK,kBAAkB,CAAC,OAAO,IAAI,OAAO,SAAS;IACjD,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,MAAM,SAAS,MAAM,CAAA;KAAE,CAAC;CACxE,GAAG,MAAM,GAAG,KAAK,CAAC;AAEnB,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,sBAAsB,aAAa,CAAC;AACjD,eAAO,MAAM,4BAA4B,+CAA+C,CAAC;AAEzF,OAAO,CAAC,MAAM,kBAAkB,EAAE,OAAO,MAAM,CAAC;AAEhD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEjE,MAAM,MAAM,kBAAkB,CAC5B,OAAO,GAAG,OAAO,EACjB,MAAM,SAAS,MAAM,GAAG,MAAM,EAC9B,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IACpD,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG;IAC1C,QAAQ,EAAE,IAAI,CAAC;IACf,QAAQ,CAAC,CAAC,kBAAkB,CAAC,EAAE;QAC7B,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,OAAO,IAAI;KACtC,OAAO,IAAI,MAAM,OAAO,IACvB,OAAO,SAAS,cAAc,GAC1B,OAAO,CAAC,OAAO,CAAC,SAAS,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAC7D,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,kBAAkB,CAAC,MAAM,OAAO,CAAC,GAChE,OAAO,CAAC,OAAO,CAAC,SAAS,kBAAkB,CAAC,OAAO,EAAE,MAAM,MAAM,CAAC,GAChE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACjC,KAAK,GACP,KAAK;CACd,CAAC;AAEF,KAAK,oBAAoB,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,SACnD,cAAc,CAAC,MAAM,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,GAAG,OAAO,CAAC;AAEhE,MAAM,MAAM,uBAAuB,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM,IAAI;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,kBAAkB,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM,IAAI;IAC/D,MAAM,EAAE,SAAS,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;CACpD,CAAC;AAEF,qBAAa,uBAAuB,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM,CACjE,SAAQ,KAAK;IACb,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBAEpC,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC;CAUnD;AAED,MAAM,MAAM,eAAe,CACzB,MAAM,EACN,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IACpD,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG;IACrC,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAC7B,MAAM,EACN,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IACpD;IACF,GAAG,EAAE,QAAQ,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACjF,KAAK,EAAE,gBAAgB,CAAC;IACxB,GAAG,CAAC,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,oBAAoB,CAC9B,MAAM,EACN,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAEpD,+BAA+B,GAC/B,CAAC,CACD,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAC7C,YAAY,CAAC,+BAA+B,CAAC,CAAC,CAAC;AAEtD,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC3B,IAAI,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,4BAA4B,+BAA+B,CAAC;AAEzE,MAAM,MAAM,eAAe,CACzB,MAAM,EACN,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,EACtD,OAAO,SAAS,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,GAC3D,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,IAC7C;IACF,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,CACP,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KACtD,YAAY,CAAC,OAAO,CAAC,CAAC;IAC3B,WAAW,CAAC,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnE,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,UAAU,CAAC,EAAE,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnE,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B,CAAC;AAEF,wBAAgB,QAAQ,CACtB,OAAO,SAAS,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EACnE,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,EACtD,OAAO,SAAS,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,GAC3D,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,EAE/C,OAAO,EAAE,IAAI,CAAC,eAAe,CAC3B,kBAAkB,CAAC,OAAO,CAAC,EAC3B,KAAK,EACL,OAAO,EACP,OAAO,CACR,EAAE,OAAO,CAAC,GAAG;IACZ,KAAK,EAAE,OAAO,CAAC;CAChB,GACA,kBAAkB,CACnB,oBAAoB,CAAC,OAAO,CAAC,EAC7B,kBAAkB,CAAC,OAAO,CAAC,EAC3B,KAAK,EACL,OAAO,CACR,CAAC;AAEF,wBAAgB,QAAQ,CACtB,MAAM,EACN,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,EACtD,OAAO,SAAS,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,GAC3D,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,EAE/C,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG;IAC1D,KAAK,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;CAC9C,GACA,kBAAkB,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAE7E,wBAAgB,QAAQ,CACtB,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,EACtD,OAAO,SAAS,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,GAC3D,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,EAE/C,OAAO,EAAE,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG;IAC7D,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,GACA,kBAAkB,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AA0S7E,eAAO,MAAM,aAAa;WAEtB,MAAM,SAAS,MAAM,WACrB,MAAM,YACN,KAAK,SAAS,MAAM,WACpB,OAAO,SAAS,MAAM,yCAEf,CACL,OAAO,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,KACtC,YAAY,CAAC,MAAM,CAAC,GACxB,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;SAKnD,OAAO,SAAS,gBAAgB,EAChC,KAAK,SAAS,MAAM,WACpB,OAAO,SAAS,MAAM,0CAEd,OAAO,OACV,CACH,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,KACtC,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GACtD,kBAAkB,CACnB,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,EACrC,KAAK,EACL,OAAO,EACP,OAAO,CAAC,MAAM,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAC7D;0BAwB2B,gBAAgB;sBAGpB,gBAAgB;sBAIhB,gBAAgB;CAGzC,CAAC"}

package/dist/route/serialization.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The error that the framework reports for a browser payload that it cannot
+ * serialize.
+ *
+ * The message names the route and the field path. The message does not
+ * contain the value.
+ */
+export declare class RouteSerializationError extends Error {
+    readonly field?: string;
+    readonly route: string;
+    constructor(message: string, route: string, field?: string);
+}
+/**
+ * Proves that the framework can serialize a page route browser payload.
+ *
+ * The return value of a page `data` function is the browser payload. This
+ * check names the value that `JSON.stringify` cannot represent. It checks a
+ * `toJSON` result, a circular reference, and a `bigint` value. It does not
+ * add a check for a value that
+ * `JSON.stringify` already accepts or silently drops, such as `undefined`,
+ * a function, a symbol key, or a non-finite number.
+ */
+export declare function assertSerializableValue(value: unknown, route: string, path?: readonly string[], seen?: Set<object>, applyToJSON?: boolean): void;
+//# sourceMappingURL=serialization.d.ts.map

package/dist/route/serialization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialization.d.ts","sourceRoot":"","sources":["../../src/route/serialization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM;CAM3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,IAAI,cAAoB,EACxB,WAAW,UAAO,GACjB,IAAI,CA8DN"}

package/dist/route/webhook.d.ts

@@ -18,7 +18,12 @@ export declare const webhook: {
         kind: "response";
         response: (context: HttpRouteContext<string, Record<never, never>>) => Promise<Response>;
         security: {
-            csrf: false;
+            csrf: {
+                origin: "framework";
+                reason: string;
+                source: string;
+                value: false;
+            };
         };
     };
 };

package/dist/route/webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/route/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EAEb,MAAM,SAAS,CAAC;AAEjB,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,KAAK,CAAC;AACnD,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAErE,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG;IAClD,OAAO,EAAE,UAAU,CAAC;IACpB,IAAI,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,OAAO,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,OAAO;kBACJ,kBAAkB;;;;;;;CAgCjC,CAAC"}
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/route/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EAEb,MAAM,SAAS,CAAC;AAEjB,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,KAAK,CAAC;AACnD,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAErE,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG;IAClD,OAAO,EAAE,UAAU,CAAC;IACpB,IAAI,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,OAAO,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,OAAO;kBACJ,kBAAkB;;;;;;;;;;;;CAyCjC,CAAC"}

package/dist/router/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/router/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,EAAqB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,QAAQ,EACR,eAAe,EAEf,aAAa,EAEb,UAAU,EACX,MAAM,UAAU,CAAC;AAElB,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE;QACT,KAAK,EAAE,aAAa,EAAE,CAAC;QACvB,OAAO,EAAE,aAAa,EAAE,CAAC;QACzB,QAAQ,EAAE,aAAa,EAAE,CAAC;KAC3B,CAAC;IACF,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,QAAQ,EAAE,WAAW,EAAE,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACvC,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,SAAS,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IACE,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IAAE,OAAO,CAAC,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC9C,CAAC,mBAAmB,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,GAC/C;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEjD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,iBAiHxE;AAqFD,wBAAsB,aAAa,CACjC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,UAAkD,EACzD,WAAW,CAAC,EAAE,gBAAgB,EAC9B,KAAK,GAAE,KAA2B,EAClC,OAAO,GAAE;IACP,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,GACL,OAAO,CAAC,iBAAiB,CAAC,CA8F5B;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE;IACP,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACZ,GACL,OAAO,CAAC,eAAe,EAAE,CAAC,CAiE5B;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,sCAWjB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,uDAqBjB;AAwBD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IACP,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACZ,GACL,OAAO,CAAC,mBAAmB,CAAC,CA2D9B;AAWD,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,iBAYjB;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,iBASjB;AA4ED,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM;;;SAYrE;AAED,eAAO,MAAM,SAAS,sBAAgB,CAAC;AACvC,eAAO,MAAM,aAAa,uBAAiB,CAAC;AAE5C,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,EAAE,EACvB,gBAAgB,EAAE,MAAM,EAAE,mBA4B3B;AAED,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,WAI/E;AAED,wBAAgB,sBAAsB,CACpC,oBAAoB,EAAE,MAAM,EAAE,EAC9B,iBAAiB,EAAE,MAAM,EAAE,WAK5B;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,YAoBrD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,WAElD;AAED,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,UAMrD;AAqFD,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAYhD;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,YAc7C;AAED,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAQrD"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/router/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,EAAqB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,QAAQ,EACR,eAAe,EAEf,aAAa,EAEb,UAAU,EACX,MAAM,UAAU,CAAC;AAGlB,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE;QACT,KAAK,EAAE,aAAa,EAAE,CAAC;QACvB,OAAO,EAAE,aAAa,EAAE,CAAC;QACzB,QAAQ,EAAE,aAAa,EAAE,CAAC;KAC3B,CAAC;IACF,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,QAAQ,EAAE,WAAW,EAAE,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACvC,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,SAAS,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IACE,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IAAE,OAAO,CAAC,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC9C,CAAC,mBAAmB,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,GAC/C;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEjD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,iBAiHxE;AAqFD,wBAAsB,aAAa,CACjC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,UAAkD,EACzD,WAAW,CAAC,EAAE,gBAAgB,EAC9B,KAAK,GAAE,KAA2B,EAClC,OAAO,GAAE;IACP,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,GACL,OAAO,CAAC,iBAAiB,CAAC,CAyG5B;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE;IACP,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACZ,GACL,OAAO,CAAC,eAAe,EAAE,CAAC,CAiE5B;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,sCAWjB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,uDAqBjB;AAwBD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IACP,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACZ,GACL,OAAO,CAAC,mBAAmB,CAAC,CA2D9B;AAWD,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,iBAYjB;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,MAAM,iBASjB;AA4ED,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM;;;SAYrE;AAED,eAAO,MAAM,SAAS,sBAAgB,CAAC;AACvC,eAAO,MAAM,aAAa,uBAAiB,CAAC;AAE5C,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,EAAE,EACvB,gBAAgB,EAAE,MAAM,EAAE,mBA4B3B;AAED,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,WAI/E;AAED,wBAAgB,sBAAsB,CACpC,oBAAoB,EAAE,MAAM,EAAE,EAC9B,iBAAiB,EAAE,MAAM,EAAE,WAK5B;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,YAoBrD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,WAElD;AAED,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,UAMrD;AAqFD,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAYhD;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,YAc7C;AAED,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAQrD"}

package/dist/security/audit.d.ts

@@ -1,12 +1,13 @@
 import type { HttpMethod } from "../route/types";
 import type { ScriptTag } from "../document/scripts";
-import type { CorsPolicy, RouteSecurityPolicy, ScriptDependencyAuditOptions, SecurityAuditFinding, SecurityAuditOptions } from "./types";
+import type { CorsPolicy, ResolvedRouteAccess, RouteSecurityPolicy, ScriptDependencyAuditOptions, SecurityAuditFinding, SecurityAuditOptions } from "./types";
 export declare function createSecurityAudit(options?: SecurityAuditOptions): {
     findings: SecurityAuditFinding[];
     headers: {
         [k: string]: string;
     };
     route: {
+        access: ResolvedRouteAccess | undefined;
         cors: CorsPolicy | undefined;
         method: HttpMethod;
         security: RouteSecurityPolicy | undefined;

package/dist/security/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/security/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,KAAK,EAEV,UAAU,EAEV,mBAAmB,EACnB,4BAA4B,EAE5B,oBAAoB,EACpB,oBAAoB,EAGrB,MAAM,SAAS,CAAC;AAIjB,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,oBAAyB;;;;;;;;;;EAqCrE;AA2BD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,SAAS,SAAS,EAAE,EAC7B,OAAO,GAAE,4BAAiC,0BAkD3C"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/security/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAWrD,OAAO,KAAK,EAGV,UAAU,EAEV,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAE5B,oBAAoB,EACpB,oBAAoB,EAGrB,MAAM,SAAS,CAAC;AAIjB,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,oBAAyB;;;;;;;;;;;EAsCrE;AA2ED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,SAAS,SAAS,EAAE,EAC7B,OAAO,GAAE,4BAAiC,0BAkD3C"}

package/dist/security/authorization.d.ts

@@ -0,0 +1,36 @@
+import type { HttpRouteContext, MaybePromise } from "../route/types";
+import type { AuthorizationDecision, ResolvedRouteAccess, RouteAccessPolicy, RouteAccessSource, RouteAuthorizationHook } from "./types";
+/**
+ * Declares an authorization hook with the request context values that
+ * inherited middleware supplies.
+ */
+export declare function defineAuthorization<TValues extends object = Record<never, never>>(hook: (context: HttpRouteContext<string, TValues>) => MaybePromise<AuthorizationDecision>): RouteAuthorizationHook;
+/**
+ * Reads the access declarations of one cascade, from the root of the route
+ * tree to the route file.
+ *
+ * A declaration adds a restriction. The framework keeps each inherited hook,
+ * because a child must not weaken an ancestor. Only an explicit exception
+ * removes the inherited hooks.
+ */
+export declare function resolveRouteAccess(sources: readonly RouteAccessSource[]): ResolvedRouteAccess;
+/**
+ * Merges the access declarations that `mergeRoutePolicies` receives.
+ */
+export declare function mergeRouteAccess(policies: readonly (RouteAccessPolicy | undefined)[]): ResolvedRouteAccess;
+/**
+ * Runs each inherited authorization hook, from the root of the subtree to the
+ * route. The function returns a denial response. It returns `null` when every
+ * hook permits the request.
+ *
+ * The framework runs this check before a protected data loader, before a read
+ * of a protected cache entry, before a render, and before the effect of a
+ * mutation.
+ */
+export declare function authorizeRoute(access: ResolvedRouteAccess, context: HttpRouteContext<string, object>): Promise<Response | null>;
+/**
+ * Reports if one decision permits the request. Each value other than `true`
+ * and `{ allow: true }` denies the request.
+ */
+export declare function permitsRequest(decision: unknown): boolean;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/security/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/security/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAErE,OAAO,KAAK,EACV,qBAAqB,EAErB,mBAAmB,EAEnB,iBAAiB,EACjB,iBAAiB,EAEjB,sBAAsB,EACvB,MAAM,SAAS,CAAC;AAIjB;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,SAAS,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAE7C,IAAI,EAAE,CACJ,OAAO,EAAE,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,KACvC,YAAY,CAAC,qBAAqB,CAAC,GACvC,sBAAsB,CAGxB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GACpC,mBAAmB,CAyCrB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,SAAS,CAAC,iBAAiB,GAAG,SAAS,CAAC,EAAE,GACnD,mBAAmB,CAErB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,mBAAmB,EAC3B,OAAO,EAAE,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA2B1B;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,WAM/C"}

package/dist/security/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/security/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAK1C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAgB,eAAe,WAQ9B;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,iBAAsB,UAuBhC;AAED,wBAAgB,cAAc,CAAC,OAAO,GAAE,iBAAsB,GAAG,eAAe,CAO/E;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,OAAO,EAAE,OAAO,4BAyCjB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,uBAuBtD"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/security/csrf.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAqB,MAAM,SAAS,CAAC;AAK7D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAgB,eAAe,WAQ9B;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,iBAAsB,UAuBhC;AAED,wBAAgB,cAAc,CAAC,OAAO,GAAE,iBAAsB,GAAG,eAAe,CAO/E;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,OAAO,EAAE,OAAO,4BA2CjB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,uBAuBtD"}

package/dist/security/env-startup.d.ts

@@ -1,11 +1,9 @@
 import { type EnvSchema, type EnvSchemaDescriptor, type EnvSource, type InferEnvSchema } from "./env";
 export type EnvStartupOptions = {
     source?: EnvSource;
-    warn?: (message: string) => void;
 };
 export type EnvStartupResult = {
     values: Record<string, unknown>;
-    warnings: string[];
 };
 export declare function serializeEnvSchema(schema: EnvSchema): EnvSchemaDescriptor;
 export declare function deserializeEnvSchema(descriptor: EnvSchemaDescriptor): EnvSchema;

package/dist/security/env-startup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-startup.d.ts","sourceRoot":"","sources":["../../src/security/env-startup.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,SAAS,EAId,KAAK,cAAc,EACpB,MAAM,OAAO,CAAC;AAEf,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAOF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,CAWzE;AAED,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,mBAAmB,GAC9B,SAAS,CAOX;AAID,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,GAAG,mBAAmB,EACvC,OAAO,GAAE,iBAAsB,GAC9B,gBAAgB,CA0ClB;AAID,wBAAgB,OAAO,CAAC,MAAM,SAAS,SAAS,EAC9C,MAAM,EAAE,MAAM,GACb,cAAc,CAAC,MAAM,CAAC,CAcxB;AAED,wBAAgB,gBAAgB,SAE/B"}
+{"version":3,"file":"env-startup.d.ts","sourceRoot":"","sources":["../../src/security/env-startup.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,SAAS,EAId,KAAK,cAAc,EACpB,MAAM,OAAO,CAAC;AAEf,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,CAAC,EAAE,SAAS,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAsCF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,CAWzE;AAED,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,mBAAmB,GAC9B,SAAS,CAOX;AAMD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,GAAG,mBAAmB,EACvC,OAAO,GAAE,iBAAsB,GAC9B,gBAAgB,CA4ClB;AAKD,wBAAgB,OAAO,CAAC,MAAM,SAAS,SAAS,EAC9C,MAAM,EAAE,MAAM,GACb,cAAc,CAAC,MAAM,CAAC,CAmBxB;AAED,wBAAgB,gBAAgB,SAG/B"}

package/dist/security/env.d.ts

@@ -11,7 +11,7 @@ export declare class EnvValidationError extends Error {
 export type EnvVariableKind = "boolean" | "enum" | "integer" | "secret" | "string" | "url";
 export type EnvVariableDescriptor = {
     client: boolean;
-    critical: boolean;
+    deferred: boolean;
     kind: EnvVariableKind;
     optional: boolean;
     options: Record<string, unknown>;
@@ -28,32 +28,47 @@ export type InferEnvSchema<Schema extends EnvSchema> = {
 };
 type SharedEnvVariableOptions = {
     client?: boolean;
-    critical?: boolean;
 };
 type RequiredEnvVariableOptions = SharedEnvVariableOptions & {
+    deferred?: false;
     optional?: false;
 };
 type OptionalEnvVariableOptions = SharedEnvVariableOptions & {
+    deferred?: false;
     optional: true;
 };
+type DeferredEnvVariableOptions = {
+    client?: never;
+    deferred: true;
+    optional?: false;
+};
 type RequiredStringEnvOptions = RequiredEnvVariableOptions & {
     minLength?: number;
 };
 type OptionalStringEnvOptions = OptionalEnvVariableOptions & {
     minLength?: number;
 };
+type DeferredStringEnvOptions = DeferredEnvVariableOptions & {
+    minLength?: number;
+};
 type RequiredSecretEnvOptions = RequiredStringEnvOptions & {
     client?: never;
 };
 type OptionalSecretEnvOptions = OptionalStringEnvOptions & {
     client?: never;
 };
+type DeferredSecretEnvOptions = DeferredStringEnvOptions & {
+    client?: never;
+};
 type RequiredUrlEnvOptions = RequiredEnvVariableOptions & {
     protocols?: readonly string[];
 };
 type OptionalUrlEnvOptions = OptionalEnvVariableOptions & {
     protocols?: readonly string[];
 };
+type DeferredUrlEnvOptions = DeferredEnvVariableOptions & {
+    protocols?: readonly string[];
+};
 type RequiredIntegerEnvOptions = RequiredEnvVariableOptions & {
     max?: number;
     min?: number;
@@ -62,20 +77,24 @@ type OptionalIntegerEnvOptions = OptionalEnvVariableOptions & {
     max?: number;
     min?: number;
 };
+type DeferredIntegerEnvOptions = DeferredEnvVariableOptions & {
+    max?: number;
+    min?: number;
+};
 export declare function defineEnvSchema<Schema extends EnvSchema>(schema: Schema): Schema;
 export declare function validateEnv<Schema extends EnvSchema>(schema: Schema, source: EnvSource): InferEnvSchema<Schema>;
 declare function booleanEnv(options: OptionalEnvVariableOptions): EnvVariable<boolean, true>;
-declare function booleanEnv(options?: RequiredEnvVariableOptions): EnvVariable<boolean, false>;
+declare function booleanEnv(options?: RequiredEnvVariableOptions | DeferredEnvVariableOptions): EnvVariable<boolean, false>;
 declare function enumEnv<const Values extends readonly [string, ...string[]]>(values: Values, options: OptionalEnvVariableOptions): EnvVariable<Values[number], true>;
-declare function enumEnv<const Values extends readonly [string, ...string[]]>(values: Values, options?: RequiredEnvVariableOptions): EnvVariable<Values[number], false>;
+declare function enumEnv<const Values extends readonly [string, ...string[]]>(values: Values, options?: RequiredEnvVariableOptions | DeferredEnvVariableOptions): EnvVariable<Values[number], false>;
 declare function integerEnv(options: OptionalIntegerEnvOptions): EnvVariable<number, true>;
-declare function integerEnv(options?: RequiredIntegerEnvOptions): EnvVariable<number, false>;
+declare function integerEnv(options?: RequiredIntegerEnvOptions | DeferredIntegerEnvOptions): EnvVariable<number, false>;
 declare function secretEnv(options: OptionalSecretEnvOptions): EnvVariable<string, true>;
-declare function secretEnv(options?: RequiredSecretEnvOptions): EnvVariable<string, false>;
+declare function secretEnv(options?: RequiredSecretEnvOptions | DeferredSecretEnvOptions): EnvVariable<string, false>;
 declare function stringEnv(options: OptionalStringEnvOptions): EnvVariable<string, true>;
-declare function stringEnv(options?: RequiredStringEnvOptions): EnvVariable<string, false>;
+declare function stringEnv(options?: RequiredStringEnvOptions | DeferredStringEnvOptions): EnvVariable<string, false>;
 declare function urlEnv(options: OptionalUrlEnvOptions): EnvVariable<URL, true>;
-declare function urlEnv(options?: RequiredUrlEnvOptions): EnvVariable<URL, false>;
+declare function urlEnv(options?: RequiredUrlEnvOptions | DeferredUrlEnvOptions): EnvVariable<URL, false>;
 export declare const env: {
     boolean: typeof booleanEnv;
     enum: typeof enumEnv;

package/dist/security/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/security/env.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE3D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBAEjB,MAAM,EAAE,kBAAkB,EAAE;CAKzC;AAED,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,MAAM,GACN,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,KAAK,CAAC;AAKV,MAAM,MAAM,qBAAqB,GAAG;IAGlC,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAExE,MAAM,MAAM,WAAW,CAAC,CAAC,EAAE,QAAQ,SAAS,OAAO,GAAG,KAAK,IACvD,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,GACvC;IACA,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,CAAC;CAC1C,CAAC;AAEJ,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtE,MAAM,MAAM,cAAc,CAAC,MAAM,SAAS,SAAS,IAAI;KACpD,GAAG,IAAI,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,MAAM,KAAK,EAAE,MAAM,QAAQ,CAAC,GAC/E,QAAQ,SAAS,IAAI,GACnB,KAAK,GAAG,SAAS,GACjB,KAAK,GACP,KAAK;CACV,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAG9B,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,KAAK,0BAA0B,GAAG,wBAAwB,GAAG;IAC3D,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB,CAAC;AAEF,KAAK,0BAA0B,GAAG,wBAAwB,GAAG;IAC3D,QAAQ,EAAE,IAAI,CAAC;CAChB,CAAC;AAIF,KAAK,wBAAwB,GAAG,0BAA0B,GAAG;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,KAAK,wBAAwB,GAAG,0BAA0B,GAAG;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAMF,KAAK,wBAAwB,GAAG,wBAAwB,GAAG;IAAE,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAE9E,KAAK,wBAAwB,GAAG,wBAAwB,GAAG;IAAE,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAI9E,KAAK,qBAAqB,GAAG,0BAA0B,GAAG;IACxD,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,KAAK,qBAAqB,GAAG,0BAA0B,GAAG;IACxD,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAIF,KAAK,yBAAyB,GAAG,0BAA0B,GAAG;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,KAAK,yBAAyB,GAAG,0BAA0B,GAAG;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAIF,wBAAgB,eAAe,CAAC,MAAM,SAAS,SAAS,EAAE,MAAM,EAAE,MAAM,UAEvE;AAED,wBAAgB,WAAW,CAAC,MAAM,SAAS,SAAS,EAClD,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,GAChB,cAAc,CAAC,MAAM,CAAC,CA0CxB;AAED,iBAAS,UAAU,CAAC,OAAO,EAAE,0BAA0B,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACrF,iBAAS,UAAU,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAevF,iBAAS,OAAO,CAAC,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,EAClE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,0BAA0B,GAClC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AACrC,iBAAS,OAAO,CAAC,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,EAClE,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,0BAA0B,GACnC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;AAgBtC,iBAAS,UAAU,CAAC,OAAO,EAAE,yBAAyB,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACnF,iBAAS,UAAU,CAAC,OAAO,CAAC,EAAE,yBAAyB,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AA6BrF,iBAAS,SAAS,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACjF,iBAAS,SAAS,CAAC,OAAO,CAAC,EAAE,wBAAwB,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAUnF,iBAAS,SAAS,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACjF,iBAAS,SAAS,CAAC,OAAO,CAAC,EAAE,wBAAwB,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAUnF,iBAAS,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxE,iBAAS,MAAM,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAwB1E,eAAO,MAAM,GAAG;;;;;;;CAOf,CAAC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/security/env.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE3D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBAEjB,MAAM,EAAE,kBAAkB,EAAE;CAKzC;AAED,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,MAAM,GACN,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,KAAK,CAAC;AAKV,MAAM,MAAM,qBAAqB,GAAG;IAGlC,MAAM,EAAE,OAAO,CAAC;IAIhB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAExE,MAAM,MAAM,WAAW,CAAC,CAAC,EAAE,QAAQ,SAAS,OAAO,GAAG,KAAK,IACvD,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,GACvC;IACA,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,CAAC;CAC1C,CAAC;AAEJ,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtE,MAAM,MAAM,cAAc,CAAC,MAAM,SAAS,SAAS,IAAI;KACpD,GAAG,IAAI,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,MAAM,KAAK,EAAE,MAAM,QAAQ,CAAC,GAC/E,QAAQ,SAAS,IAAI,GACnB,KAAK,GAAG,SAAS,GACjB,KAAK,GACP,KAAK;CACV,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAG9B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAIF,KAAK,0BAA0B,GAAG,wBAAwB,GAAG;IAC3D,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB,CAAC;AAIF,KAAK,0BAA0B,GAAG,wBAAwB,GAAG;IAC3D,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,QAAQ,EAAE,IAAI,CAAC;CAChB,CAAC;AAKF,KAAK,0BAA0B,GAAG;IAChC,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,QAAQ,EAAE,IAAI,CAAC;IACf,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB,CAAC;AAOF,KAAK,wBAAwB,GAAG,0BAA0B,GAAG;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,KAAK,wBAAwB,GAAG,0BAA0B,GAAG;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,KAAK,wBAAwB,GAAG,0BAA0B,GAAG;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AASF,KAAK,wBAAwB,GAAG,wBAAwB,GAAG;IAAE,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAE9E,KAAK,wBAAwB,GAAG,wBAAwB,GAAG;IAAE,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAE9E,KAAK,wBAAwB,GAAG,wBAAwB,GAAG;IAAE,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAO9E,KAAK,qBAAqB,GAAG,0BAA0B,GAAG;IACxD,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,KAAK,qBAAqB,GAAG,0BAA0B,GAAG;IACxD,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,KAAK,qBAAqB,GAAG,0BAA0B,GAAG;IACxD,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAOF,KAAK,yBAAyB,GAAG,0BAA0B,GAAG;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,KAAK,yBAAyB,GAAG,0BAA0B,GAAG;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,KAAK,yBAAyB,GAAG,0BAA0B,GAAG;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAOF,wBAAgB,eAAe,CAAC,MAAM,SAAS,SAAS,EAAE,MAAM,EAAE,MAAM,UAEvE;AAED,wBAAgB,WAAW,CAAC,MAAM,SAAS,SAAS,EAClD,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,GAChB,cAAc,CAAC,MAAM,CAAC,CA0CxB;AAED,iBAAS,UAAU,CAAC,OAAO,EAAE,0BAA0B,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACrF,iBAAS,UAAU,CACjB,OAAO,CAAC,EAAE,0BAA0B,GAAG,0BAA0B,GAChE,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAe/B,iBAAS,OAAO,CAAC,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,EAClE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,0BAA0B,GAClC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AACrC,iBAAS,OAAO,CAAC,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,EAClE,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,0BAA0B,GAAG,0BAA0B,GAChE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;AAgBtC,iBAAS,UAAU,CAAC,OAAO,EAAE,yBAAyB,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACnF,iBAAS,UAAU,CACjB,OAAO,CAAC,EAAE,yBAAyB,GAAG,yBAAyB,GAC9D,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AA6B9B,iBAAS,SAAS,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACjF,iBAAS,SAAS,CAChB,OAAO,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,GAC5D,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAU9B,iBAAS,SAAS,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACjF,iBAAS,SAAS,CAChB,OAAO,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,GAC5D,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAU9B,iBAAS,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxE,iBAAS,MAAM,CACb,OAAO,CAAC,EAAE,qBAAqB,GAAG,qBAAqB,GACtD,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAwB3B,eAAO,MAAM,GAAG;;;;;;;CAOf,CAAC"}

package/dist/security/exceptions.d.ts

@@ -0,0 +1,29 @@
+import type { BodySizeException, BodySizeValue, ContentSecurityPolicy, CspException, CsrfException, CsrfPolicy, CsrfPolicyOptions, RequestSecurityPolicy, RoutePolicy, SecurityException, SecurityPolicy } from "./types";
+/**
+ * Reports if a declaration is a typed security exception.
+ *
+ * An exception carries a `reason` and a `value`. No policy object of the
+ * framework uses both names, so the two fields identify the shape.
+ */
+export declare function isSecurityException(value: unknown): value is SecurityException<unknown>;
+/** Returns the Content-Security-Policy that a document declaration selects. */
+export declare function resolveCsp(csp: SecurityPolicy["csp"]): ContentSecurityPolicy | false | undefined;
+/** Returns the exception of a document declaration, or `undefined`. */
+export declare function getCspException(csp: SecurityPolicy["csp"]): CspException | undefined;
+/** Returns the CSRF policy that a route declaration selects. */
+export declare function resolveCsrf(csrf: CsrfPolicy | undefined): true | false | CsrfPolicyOptions | undefined;
+/** Returns the exception of a CSRF declaration, or `undefined`. */
+export declare function getCsrfException(csrf: CsrfPolicy | undefined): CsrfException | undefined;
+/** Returns the request body limit that a route declaration selects. */
+export declare function resolveMaxBodySize(maxBodySize: RequestSecurityPolicy["maxBodySize"]): BodySizeValue | undefined;
+/** Returns the exception of a body limit declaration, or `undefined`. */
+export declare function getBodySizeException(maxBodySize: RequestSecurityPolicy["maxBodySize"]): BodySizeException | undefined;
+/**
+ * Adds the declaring file to each exception of one policy file.
+ *
+ * The framework merges the policy cascade into one policy, and the merge
+ * keeps no file name. This function stamps the file before the merge, so the
+ * audit can report the source of each exception.
+ */
+export declare function attachExceptionSource(policy: RoutePolicy | undefined, source: string | undefined): RoutePolicy | undefined;
+//# sourceMappingURL=exceptions.d.ts.map

package/dist/security/exceptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/security/exceptions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACf,MAAM,SAAS,CAAC;AAEjB;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAMrC;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CACxB,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,GACzB,qBAAqB,GAAG,KAAK,GAAG,SAAS,CAM3C;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAC7B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,GACzB,YAAY,GAAG,SAAS,CAG1B;AAED,gEAAgE;AAChE,wBAAgB,WAAW,CACzB,IAAI,EAAE,UAAU,GAAG,SAAS,GAC3B,IAAI,GAAG,KAAK,GAAG,iBAAiB,GAAG,SAAS,CAM9C;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,UAAU,GAAG,SAAS,GAC3B,aAAa,GAAG,SAAS,CAG3B;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,qBAAqB,CAAC,aAAa,CAAC,GAChD,aAAa,GAAG,SAAS,CAO3B;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,qBAAqB,CAAC,aAAa,CAAC,GAChD,iBAAiB,GAAG,SAAS,CAK/B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,WAAW,GAAG,SAAS,CAazB"}

package/dist/security/finding-codes.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The diagnostic code vocabulary of Demiurge.
+ *
+ * ADR 0018 gives the build verifier and the runtime audit one vocabulary. A
+ * code names one condition. The build verifier reports a subset of the codes,
+ * because the build cannot read a value that only a request supplies.
+ */
+export type SecurityFindingCode = 
+/** The route inherits no access declaration. */
+"access-declaration-missing"
+/** The route runs each inherited authorization hook. */
+ | "access-authorized"
+/** An access exception removed each inherited authorization hook. */
+ | "access-exception"
+/** The route declares public access. */
+ | "access-public"
+/** The CORS policy is invalid. */
+ | "cors-invalid"
+/** The CORS policy names a method that the route does not serve. */
+ | "cors-method-unavailable"
+/** The document accepts no Content-Security-Policy. */
+ | "csp-disabled"
+/** A document script needs a nonce for the effective script-src policy. */
+ | "csp-script-missing-nonce"
+/** The effective script-src policy blocks a document script. */
+ | "csp-script-src-blocked"
+/** The route accepts no CSRF check for an unsafe method. */
+ | "csrf-disabled"
+/** The route inherits no document policy. */
+ | "document-policy-missing"
+/** The rate limit policy is invalid. */
+ | "rate-limit-invalid"
+/** The unsafe route declares no rate limit. */
+ | "rate-limit-missing"
+/** Trusted Types report-only mode has no deliverable target. */
+ | "report-only-target-missing"
+/** The route raises the inherited request body limit. */
+ | "request-body-limit-raised"
+/** Google Tag Manager is a wide trust boundary. */
+ | "script-gtm-wide-trust-boundary"
+/** A third-party script declares no integrity hash. */
+ | "script-integrity-missing"
+/** A third-party script declares no purpose. */
+ | "script-purpose-missing"
+/** A third-party script runs before the application is interactive. */
+ | "script-third-party-before-interactive"
+/** A security exception states no reason. */
+ | "security-exception-reason-missing"
+/** The security headers failed to render. */
+ | "security-header-render-failed";
+/**
+ * The codes that the build verifier reports. Each code is a member of
+ * `SecurityFindingCode`.
+ */
+export type StaticPolicyFindingCode = Extract<SecurityFindingCode, "access-declaration-missing" | "cors-invalid" | "cors-method-unavailable" | "document-policy-missing" | "rate-limit-invalid" | "security-exception-reason-missing" | "security-header-render-failed">;
+//# sourceMappingURL=finding-codes.d.ts.map

package/dist/security/finding-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-codes.d.ts","sourceRoot":"","sources":["../../src/security/finding-codes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB;AAC7B,gDAAgD;AAC9C,4BAA4B;AAC9B,wDAAwD;GACtD,mBAAmB;AACrB,qEAAqE;GACnE,kBAAkB;AACpB,wCAAwC;GACtC,eAAe;AACjB,kCAAkC;GAChC,cAAc;AAChB,oEAAoE;GAClE,yBAAyB;AAC3B,uDAAuD;GACrD,cAAc;AAChB,2EAA2E;GACzE,0BAA0B;AAC5B,gEAAgE;GAC9D,wBAAwB;AAC1B,4DAA4D;GAC1D,eAAe;AACjB,6CAA6C;GAC3C,yBAAyB;AAC3B,wCAAwC;GACtC,oBAAoB;AACtB,+CAA+C;GAC7C,oBAAoB;AACtB,gEAAgE;GAC9D,4BAA4B;AAC9B,yDAAyD;GACvD,2BAA2B;AAC7B,mDAAmD;GACjD,gCAAgC;AAClC,uDAAuD;GACrD,0BAA0B;AAC5B,gDAAgD;GAC9C,wBAAwB;AAC1B,uEAAuE;GACrE,uCAAuC;AACzC,6CAA6C;GAC3C,mCAAmC;AACrC,6CAA6C;GAC3C,+BAA+B,CAAC;AAEpC;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAC3C,mBAAmB,EACjB,4BAA4B,GAC5B,cAAc,GACd,yBAAyB,GACzB,yBAAyB,GACzB,oBAAoB,GACpB,mCAAmC,GACnC,+BAA+B,CAClC,CAAC"}

package/dist/security/index.d.ts

@@ -1,4 +1,5 @@
 export { auditScriptDependencies, createSecurityAudit, } from "./audit";
+export { authorizeRoute, defineAuthorization, mergeRouteAccess, permitsRequest, resolveRouteAccess, } from "./authorization";
 export { applyCorsHeaders, createCorsHeaders, createCorsPreflightResponse, validateCorsPolicy, } from "./cors";
 export { createSecureCookie, readSecureCookie, secureCookieName, validateSecureCookie, } from "./cookies";
 export type { CookieIssue, CookieIssueCode, CookieSameSite, CookieScope, SecureCookieDeclaration, SecureCookieDefinition, } from "./cookies";
@@ -18,12 +19,14 @@ export { createSessionManager, SessionStoreConflictError, SessionStoreUnavailabl
 export type { ServerSession, SessionManager, SessionManagerOptions, } from "./session-manager";
 export type { MemorySessionStoreOptions, SessionData, SessionNamespace, SessionPrimitive, SessionRecord, SessionStore, SessionStoreCandidate, SessionStoreWriteResult, } from "./session-store";
 export { createSecurityReportHandler, } from "./report";
-export { enforceAllowedMethods, enforceRequestSecurity, parseBodySize, } from "./request";
+export { DEFAULT_MAX_BODY_SIZE, enforceAllowedMethods, enforceRequestSecurity, parseBodySize, } from "./request";
 export { validateUploads, } from "./upload";
 export { validateRouteModules } from "./verification";
 export type { RouteModuleVerificationOptions } from "./verification";
 export { checkWebSocketOrigin, enforceWebSocketOrigin, } from "./websocket";
-export type { ContentSecurityPolicy, CorsPolicy, CorsRequestContext, CorsResponseOptions, CsrfPolicy, CspHashAlgorithm, CspDirectiveValue, CspDirectiveReplacement, CspSource, CspSourceDirective, FetchMetadataCheck, FetchMetadataDestination, FetchMetadataPolicy, FetchMetadataPolicyOptions, FetchMetadataReason, MemoryRateLimitStoreOptions, RateLimitKey, RateLimitPolicy, RateLimitResult, RateLimitStore, ReferrerPolicy, ReportingEndpointUrl, ReportingEndpoints, SecurityAudit, SecurityAuditFinding, SecurityAuditOptions, ScriptDependencyAuditOptions, RequestSecurityPolicy, RoutePolicy, RouteSecurityNeeds, RouteSecurityPolicy, SecurityHeadersOptions, SecurityHeaderPolicy, SecurityPolicy, SecurityPreset, StrictTransportSecurityPolicy, TrustedTypesPolicy, } from "./types";
+export type { AuthorizationDecision, AuthorizationDenial, AuthorizationDenialStatus, ContentSecurityPolicy, CorsPolicy, CorsRequestContext, CorsResponseOptions, CsrfPolicy, CspHashAlgorithm, CspDirectiveValue, CspDirectiveReplacement, CspSource, CspSourceDirective, FetchMetadataCheck, FetchMetadataDestination, FetchMetadataPolicy, FetchMetadataPolicyOptions, FetchMetadataReason, BodySizeException, BodySizeValue, CspException, CsrfException, CsrfPolicyOptions, MemoryRateLimitStoreOptions, RateLimitKey, RateLimitPolicy, RateLimitResult, RateLimitStore, ReferrerPolicy, ReportingEndpointUrl, ReportingEndpoints, SecurityAudit, SecurityAuditFinding, SecurityException, SecurityExceptionOrigin, SecurityAuditOptions, ScriptDependencyAuditOptions, MergedRoutePolicy, RequestSecurityPolicy, ResolvedRouteAccess, RouteAccessException, RouteAccessPolicy, RouteAccessSource, RouteAuthorizationEntry, RouteAuthorizationHook, RoutePolicy, RouteSecurityNeeds, RouteSecurityPolicy, SecurityHeadersOptions, SecurityHeaderPolicy, SecurityPolicy, SecurityPreset, StrictTransportSecurityPolicy, TrustedTypesPolicy, } from "./types";
+export type { SecurityFindingCode, StaticPolicyFindingCode, } from "./finding-codes";
+export { attachExceptionSource, getBodySizeException, getCspException, getCsrfException, isSecurityException, resolveCsp, resolveCsrf, resolveMaxBodySize, } from "./exceptions";
 export type { UploadFilePolicy, UploadPolicy, UploadValidationIssue, UploadValidationResult, } from "./upload";
 export type { EnvSchema, EnvSchemaDescriptor, EnvSource, EnvValidationIssue, EnvVariable, EnvVariableDescriptor, EnvVariableKind, InferEnvSchema, } from "./env";
 export type { SecurityReportContext, SecurityReportHandlerOptions, SecurityReportPayload, } from "./report";