@morojs/moro 1.7.30 → 1.8.1

package/dist/types/auth.d.ts

@@ -343,21 +343,21 @@ export type SignOutOptions = {
 };
 export interface AuthError extends Error {
     type: string;
-    code?: string;
+    code?: string | undefined;
 }
 export declare class SignInError extends Error implements AuthError {
     type: string;
-    code?: string;
+    code?: string | undefined;
     constructor(message: string, code?: string);
 }
 export declare class CallbackError extends Error implements AuthError {
     type: string;
-    code?: string;
+    code?: string | undefined;
     constructor(message: string, code?: string);
 }
 export declare class SessionError extends Error implements AuthError {
     type: string;
-    code?: string;
+    code?: string | undefined;
     constructor(message: string, code?: string);
 }
 export type { AuthProvider as Provider };

package/dist/types/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/types/auth.ts"],"names":[],"mappings":"AAoZA,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,IAAI,GAAG,aAAa,CAAC;IACrB,IAAI,CAAU;IAEd,YAAY,OAAe,EAAE,IAAa;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,IAAI,GAAG,eAAe,CAAC;IACvB,IAAI,CAAU;IAEd,YAAY,OAAe,EAAE,IAAa;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,IAAI,GAAG,cAAc,CAAC;IACtB,IAAI,CAAU;IAEd,YAAY,OAAe,EAAE,IAAa;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/types/auth.ts"],"names":[],"mappings":"AAoZA,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,IAAI,GAAG,aAAa,CAAC;IACrB,IAAI,CAAsB;IAE1B,YAAY,OAAe,EAAE,IAAa;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,IAAI,GAAG,eAAe,CAAC;IACvB,IAAI,CAAsB;IAE1B,YAAY,OAAe,EAAE,IAAa;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,IAAI,GAAG,cAAc,CAAC;IACtB,IAAI,CAAsB;IAE1B,YAAY,OAAe,EAAE,IAAa;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF","sourcesContent":["// Auth Types for MoroJS (Better Auth Compatible)\nexport interface AuthProvider {\n  id: string;\n  name: string;\n  type: 'oauth' | 'oidc' | 'credentials' | 'email';\n\n  // OAuth/OIDC specific\n  authorization?: string | { url: string; params?: Record<string, any> };\n  token?: string | { url: string; params?: Record<string, any> };\n  userinfo?: string | { url: string; params?: Record<string, any> };\n  issuer?: string;\n  wellKnown?: string;\n\n  // Client configuration\n  clientId?: string;\n  clientSecret?: string;\n\n  // Scope and claims\n  scope?: string;\n  claims?: Record<string, any>;\n\n  // Profile mapping\n  profile?: (profile: any, tokens: any) => Promise<any> | any;\n\n  // Custom authorization parameters\n  authorization_params?: Record<string, any>;\n\n  // Token handling\n  token_endpoint_auth_method?: 'client_secret_post' | 'client_secret_basic';\n\n  // Additional provider-specific options\n  [key: string]: any;\n}\n\nexport interface OAuthProvider extends AuthProvider {\n  type: 'oauth';\n  authorization: string | { url: string; params?: Record<string, any> };\n  token: string | { url: string; params?: Record<string, any> };\n  userinfo?: string | { url: string; params?: Record<string, any> };\n}\n\nexport interface OIDCProvider extends AuthProvider {\n  type: 'oidc';\n  issuer: string;\n  wellKnown?: string;\n}\n\nexport interface CredentialsProvider extends AuthProvider {\n  type: 'credentials';\n  credentials: Record<\n    string,\n    {\n      label?: string;\n      type?: string;\n      placeholder?: string;\n      [key: string]: any;\n    }\n  >;\n  authorize: (credentials: Record<string, any>, req: any) => Promise<any> | any;\n}\n\nexport interface EmailProvider extends AuthProvider {\n  type: 'email';\n  server:\n    | string\n    | {\n        host: string;\n        port: number;\n        auth: {\n          user: string;\n          pass: string;\n        };\n        secure?: boolean;\n        tls?: any;\n      };\n  from: string;\n  sendVerificationRequest?: (params: {\n    identifier: string;\n    url: string;\n    expires: Date;\n    provider: EmailProvider;\n    token: string;\n    theme: any;\n    request: any;\n  }) => Promise<void>;\n}\n\nexport interface AuthUser {\n  id: string;\n  name?: string | null;\n  email?: string | null;\n  image?: string | null;\n  emailVerified?: Date | null;\n  [key: string]: any;\n}\n\nexport interface AuthAccount {\n  userId: string;\n  type: 'oauth' | 'oidc' | 'email' | 'credentials';\n  provider: string;\n  providerAccountId: string;\n  access_token?: string;\n  expires_at?: number;\n  id_token?: string;\n  refresh_token?: string;\n  refresh_token_expires_in?: number;\n  scope?: string;\n  token_type?: string;\n  session_state?: string;\n  [key: string]: any;\n}\n\nexport interface AuthSession {\n  sessionToken: string;\n  userId: string;\n  expires: Date;\n  user: AuthUser;\n  [key: string]: any;\n}\n\nexport interface VerificationToken {\n  identifier: string;\n  token: string;\n  expires: Date;\n}\n\nexport interface AuthJWT {\n  name?: string | null;\n  email?: string | null;\n  picture?: string | null;\n  sub?: string;\n  iat?: number;\n  exp?: number;\n  jti?: string;\n  [key: string]: any;\n}\n\nexport interface AuthCallbacks {\n  signIn?: (params: {\n    user: AuthUser;\n    account: AuthAccount | null;\n    profile?: any;\n    email?: { verificationRequest?: boolean };\n    credentials?: Record<string, any>;\n  }) => Awaitable<boolean | string>;\n\n  redirect?: (params: { url: string; baseUrl: string }) => Awaitable<string>;\n\n  session?: (params: {\n    session: AuthSession;\n    user: AuthUser;\n    token: AuthJWT;\n  }) => Awaitable<AuthSession>;\n\n  jwt?: (params: {\n    token: AuthJWT;\n    user?: AuthUser;\n    account?: AuthAccount;\n    profile?: any;\n    trigger?: 'signIn' | 'signUp' | 'update';\n    isNewUser?: boolean;\n    session?: any;\n  }) => Awaitable<AuthJWT>;\n}\n\nexport interface AuthPages {\n  signIn?: string;\n  signOut?: string;\n  error?: string;\n  verifyRequest?: string;\n  newUser?: string;\n}\n\nexport interface AuthEvents {\n  signIn?: (message: {\n    user: AuthUser;\n    account: AuthAccount | null;\n    profile?: any;\n    isNewUser?: boolean;\n  }) => Awaitable<void>;\n  signOut?: (message: { session: AuthSession; token: AuthJWT }) => Awaitable<void>;\n  createUser?: (message: { user: AuthUser }) => Awaitable<void>;\n  updateUser?: (message: { user: AuthUser }) => Awaitable<void>;\n  linkAccount?: (message: {\n    user: AuthUser;\n    account: AuthAccount;\n    profile: any;\n  }) => Awaitable<void>;\n  session?: (message: { session: AuthSession; token: AuthJWT }) => Awaitable<void>;\n}\n\nexport interface AuthCookies {\n  sessionToken: {\n    name: string;\n    options?: CookieOptions;\n  };\n  callbackUrl: {\n    name: string;\n    options?: CookieOptions;\n  };\n  csrfToken: {\n    name: string;\n    options?: CookieOptions;\n  };\n  pkceCodeVerifier: {\n    name: string;\n    options?: CookieOptions;\n  };\n  state: {\n    name: string;\n    options?: CookieOptions;\n  };\n  nonce: {\n    name: string;\n    options?: CookieOptions;\n  };\n}\n\nexport interface CookieOptions {\n  domain?: string;\n  expires?: Date;\n  httpOnly?: boolean;\n  maxAge?: number;\n  path?: string;\n  sameSite?: 'strict' | 'lax' | 'none';\n  secure?: boolean;\n}\n\nexport interface AuthTheme {\n  colorScheme?: 'light' | 'dark' | 'auto';\n  logo?: string;\n  brandColor?: string;\n  buttonText?: string;\n  [key: string]: any;\n}\n\nexport interface AuthLogger {\n  error: (code: string, metadata?: any) => void;\n  warn: (code: string) => void;\n  debug: (code: string, metadata?: any) => void;\n}\n\nexport interface AuthAdapter {\n  createUser?: (user: Omit<AuthUser, 'id'>) => Awaitable<AuthUser>;\n  getUser?: (id: string) => Awaitable<AuthUser | null>;\n  getUserByEmail?: (email: string) => Awaitable<AuthUser | null>;\n  getUserByAccount?: (\n    providerAccountId: Pick<AuthAccount, 'provider' | 'providerAccountId'>\n  ) => Awaitable<AuthUser | null>;\n  updateUser?: (user: Partial<AuthUser> & Pick<AuthUser, 'id'>) => Awaitable<AuthUser>;\n  deleteUser?: (userId: string) => Awaitable<void>;\n  linkAccount?: (account: AuthAccount) => Awaitable<void>;\n  unlinkAccount?: (\n    providerAccountId: Pick<AuthAccount, 'provider' | 'providerAccountId'>\n  ) => Awaitable<void>;\n  createSession?: (session: {\n    sessionToken: string;\n    userId: string;\n    expires: Date;\n  }) => Awaitable<AuthSession>;\n  getSessionAndUser?: (\n    sessionToken: string\n  ) => Awaitable<{ session: AuthSession; user: AuthUser } | null>;\n  updateSession?: (\n    session: Partial<AuthSession> & Pick<AuthSession, 'sessionToken'>\n  ) => Awaitable<AuthSession | null | undefined>;\n  deleteSession?: (sessionToken: string) => Awaitable<void>;\n  createVerificationToken?: (\n    verificationToken: VerificationToken\n  ) => Awaitable<VerificationToken | null | undefined>;\n  useVerificationToken?: (params: {\n    identifier: string;\n    token: string;\n  }) => Awaitable<VerificationToken | null>;\n}\n\nexport interface AuthOptions {\n  // Core configuration\n  providers: AuthProvider[];\n  secret?: string;\n\n  // Session configuration\n  session?: {\n    strategy?: 'jwt' | 'database';\n    maxAge?: number; // in seconds\n    updateAge?: number; // in seconds\n    generateSessionToken?: () => string;\n  };\n\n  // JWT configuration\n  jwt?: {\n    secret?: string;\n    maxAge?: number;\n    encode?: (params: { token?: AuthJWT; secret: string; maxAge?: number }) => Awaitable<string>;\n    decode?: (params: { token?: string; secret: string }) => Awaitable<AuthJWT | null>;\n  };\n\n  // Callbacks\n  callbacks?: AuthCallbacks;\n\n  // Events\n  events?: AuthEvents;\n\n  // Adapter\n  adapter?: AuthAdapter;\n\n  // Pages\n  pages?: AuthPages;\n\n  // Cookies\n  cookies?: Partial<AuthCookies>;\n\n  // Theme\n  theme?: AuthTheme;\n\n  // Logger\n  logger?: AuthLogger;\n\n  // Configuration\n  debug?: boolean;\n  basePath?: string;\n  useSecureCookies?: boolean;\n  trustHost?: boolean;\n\n  // CSRF\n  skipCSRFCheck?: string[];\n\n  // Experimental features\n  experimental?: {\n    enableWebAuthn?: boolean;\n    [key: string]: any;\n  };\n}\n\nexport interface AuthRequest {\n  user?: AuthUser;\n  session?: AuthSession;\n  token?: string;\n  isAuthenticated: boolean;\n\n  // Auth methods\n  signIn: (\n    provider?: string,\n    options?: {\n      callbackUrl?: string;\n      redirect?: boolean;\n      [key: string]: any;\n    }\n  ) => Promise<any>;\n\n  signOut: (options?: { callbackUrl?: string; redirect?: boolean }) => Promise<any>;\n\n  getSession: () => Promise<AuthSession | null>;\n  getToken: () => Promise<AuthJWT | null>;\n\n  // CSRF protection\n  getCsrfToken: () => Promise<string>;\n\n  // Providers\n  getProviders: () => Promise<Record<string, AuthProvider>>;\n}\n\nexport interface AuthResponse {\n  status: number;\n  headers?: Record<string, string>;\n  body?: any;\n  redirect?: string;\n}\n\nexport interface AuthConfig extends AuthOptions {\n  // Runtime configuration\n  basePath: string;\n  baseUrl: string;\n\n  // Internal state\n  providers: AuthProvider[];\n\n  // Computed values\n  skipCSRFCheck: string[];\n  useSecureCookies: boolean;\n}\n\n// Utility types\nexport type Awaitable<T> = T | Promise<T>;\n\nexport type ProviderType = 'oauth' | 'oidc' | 'credentials' | 'email';\n\nexport type SignInOptions = {\n  callbackUrl?: string;\n  redirect?: boolean;\n  [key: string]: any;\n};\n\nexport type SignOutOptions = {\n  callbackUrl?: string;\n  redirect?: boolean;\n};\n\n// Error types\nexport interface AuthError extends Error {\n  type: string;\n  code?: string | undefined;\n}\n\nexport class SignInError extends Error implements AuthError {\n  type = 'SignInError';\n  code?: string | undefined;\n\n  constructor(message: string, code?: string) {\n    super(message);\n    this.code = code;\n  }\n}\n\nexport class CallbackError extends Error implements AuthError {\n  type = 'CallbackError';\n  code?: string | undefined;\n\n  constructor(message: string, code?: string) {\n    super(message);\n    this.code = code;\n  }\n}\n\nexport class SessionError extends Error implements AuthError {\n  type = 'SessionError';\n  code?: string | undefined;\n\n  constructor(message: string, code?: string) {\n    super(message);\n    this.code = code;\n  }\n}\n\n// Re-export for convenience\nexport type { AuthProvider as Provider };\nexport type { AuthUser as User };\nexport type { AuthSession as Session };\nexport type { AuthAccount as Account };\nexport type { AuthJWT as JWT };\n"]}

package/dist/types/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/types/cache.ts"],"names":[],"mappings":""}
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/types/cache.ts"],"names":[],"mappings":"","sourcesContent":["// Cache Types and Interfaces\nexport interface CacheAdapter {\n  get(key: string): Promise<any>;\n  set(key: string, value: any, ttl?: number): Promise<void>;\n  del(key: string): Promise<void>;\n  clear(): Promise<void>;\n  exists(key: string): Promise<boolean>;\n  ttl(key: string): Promise<number>;\n}\n\nexport interface CacheStrategy {\n  key: (req: any) => string;\n  ttl: number;\n  condition?: (req: any, res: any) => boolean;\n  invalidateOn?: string[];\n}\n\nexport interface CacheOptions {\n  adapter?: string | CacheAdapter;\n  adapterOptions?: any;\n  strategies?: {\n    [pattern: string]: CacheStrategy;\n  };\n  defaultTtl?: number;\n  keyPrefix?: string;\n\n  // HTTP Caching Options\n  httpCaching?: boolean;\n  maxAge?: number;\n  cacheControl?: string;\n  staleWhileRevalidate?: number;\n  vary?: string[];\n  etag?: boolean | 'weak' | 'strong';\n  conditionalRequests?: boolean;\n  generateETag?: (content: string, type?: string) => string;\n}\n\nexport interface CachedResponse {\n  body: any;\n  status: number;\n  headers: Record<string, any>;\n  contentType?: string;\n  timestamp: number;\n}\n"]}

package/dist/types/cdn.js.map

@@ -1 +1 @@
-{"version":3,"file":"cdn.js","sourceRoot":"","sources":["../../src/types/cdn.ts"],"names":[],"mappings":""}
+{"version":3,"file":"cdn.js","sourceRoot":"","sources":["../../src/types/cdn.ts"],"names":[],"mappings":"","sourcesContent":["// CDN Types and Interfaces\nexport interface CDNAdapter {\n  purge(urls: string[]): Promise<void>;\n  prefetch?(urls: string[]): Promise<void>;\n  getStats?(): Promise<any>;\n  setHeaders(response: any): void;\n}\n\nexport interface CDNOptions {\n  adapter?: string | CDNAdapter;\n  adapterOptions?: any;\n  autoInvalidate?: boolean;\n  invalidationPatterns?: string[];\n}\n\nexport interface CDNStats {\n  provider: string;\n  status: string;\n  lastPurge?: Date;\n  hitRate?: string;\n  bandwidth?: string;\n}\n"]}

package/dist/types/config.d.ts

@@ -9,13 +9,88 @@ export type OriginFunction = (origin: string | undefined, req: any) => string |
 export type DeepPartial<T> = T extends object ? T extends Array<infer U> ? Array<DeepPartial<U>> : T extends (...args: any[]) => any ? T : {
     [P in keyof T]?: DeepPartial<T[P]>;
 } : T;
+/** Unified SSL/TLS config (superset of both historical shapes). */
+export interface SSLConfig {
+    /** File-path shape (uWS-style; keyFile/certFile also accepted) */
+    key_file_name?: string;
+    cert_file_name?: string;
+    ca_file_name?: string | string[];
+    keyFile?: string;
+    certFile?: string;
+    caFile?: string | string[];
+    /** Inline-PEM shape (node-style) */
+    key?: string | Buffer;
+    cert?: string | Buffer;
+    ca?: string | Buffer | Array<string | Buffer>;
+    passphrase?: string;
+    minVersion?: 'TLSv1.2' | 'TLSv1.3';
+    requestCert?: boolean;
+    rejectUnauthorized?: boolean;
+}
+/** Per-phase receive timeouts. 0 = use the per-server default / disabled. */
+export interface ServerTimeoutsConfig {
+    /** Full-request receive budget (ms); does NOT reset on activity. */
+    request?: number;
+    /** Socket inactivity timeout (ms). */
+    idle?: number;
+    /** Node keep-alive socket timeout (ms). Default 5000. */
+    keepAlive?: number;
+    /** Node headers-received timeout (ms). Default 6000. */
+    headers?: number;
+}
+export interface MultipartLimitsConfig {
+    maxParts?: number;
+    maxPartHeaderBytes?: number | string;
+    maxFiles?: number;
+    maxFileSize?: number | string;
+}
+/** Fine-grained limits; every value is a documented default, not a hard cap. */
+export interface ServerLimitsConfig {
+    /** Max request head (request line + headers) size. Node maxHeaderSize / engine maxHeadSize. */
+    maxHeaderSize?: number | string;
+    /** Max header count. Node maxHeadersCount / engine maxHeaders. */
+    maxHeaders?: number;
+    multipart?: MultipartLimitsConfig;
+    /** Reassembled WebSocket message cap (engine wsMaxMessageSize). */
+    wsMaxMessageSize?: number | string;
+    /** WebSocket send backpressure cap (engine wsBackpressureLimit). 0 = unlimited. */
+    wsBackpressureLimit?: number | string;
+    /** Write-queue high-water mark (engine writeHighWaterMark). */
+    writeHighWaterMark?: number | string;
+    /** Per-connection not-yet-parsed backlog cap (engine maxPendingBytes). */
+    maxPendingBytes?: number | string;
+}
+export interface Http2SettingsConfig {
+    maxConcurrentStreams?: number;
+    initialWindowSize?: number;
+    maxFrameSize?: number;
+    maxHeaderListSize?: number;
+    headerTableSize?: number;
+    enablePush?: boolean;
+    enableConnectProtocol?: boolean;
+    maxHeaderSize?: number;
+}
 export interface ServerConfig {
     port: number;
     host: string;
     maxConnections: number;
+    /** @deprecated Use timeouts.request. Kept as an alias; still honored. */
     timeout: number;
     bodySizeLimit: string;
     maxUploadSize: string;
+    /** Per-phase receive timeouts (finally applied to every runtime). */
+    timeouts?: ServerTimeoutsConfig;
+    /** Fine-grained size/count limits, passed through to whichever runtime serves. */
+    limits?: ServerLimitsConfig;
+    /** TCP listen backlog. */
+    backlog?: number;
+    /** HTTP/2: true, or an options object. Served natively by the engine when
+     *  it supports h2 (feature-detected), else by the Node http2 server. */
+    http2?: boolean | {
+        allowHTTP1?: boolean;
+        maxSessionMemory?: number;
+        settings?: Http2SettingsConfig;
+    };
     requestTracking: {
         enabled: boolean;
     };
@@ -25,12 +100,20 @@ export interface ServerConfig {
     errorBoundary: {
         enabled: boolean;
     };
+    /**
+     * HTTP engine selection. Default: 'moro'.
+     * - 'moro' (default): Moro's own native engine (@morojs/engine), falling back
+     *   to the Node.js http server if it cannot load on this platform/Node ABI
+     * - 'node': the Node.js http server (no native engine)
+     * - 'uws': opt in to uWebSockets.js, falling back to Node.js if it cannot load
+     * Any chosen engine that cannot load degrades to Node.js and logs why; the app
+     * never fails to boot. Inspect what actually booted via app.engine.
+     */
+    engine?: 'moro' | 'node' | 'uws';
+    /** @deprecated Use engine: 'uws' instead. Enable uWebSockets for both HTTP and WebSocket */
     useUWebSockets?: boolean;
-    ssl?: {
-        key_file_name?: string;
-        cert_file_name?: string;
-        passphrase?: string;
-    };
+    /** Unified SSL/TLS config; flows to whichever runtime serves. */
+    ssl?: SSLConfig;
 }
 export interface ServiceDiscoveryConfig {
     enabled: boolean;
@@ -261,23 +344,23 @@ export interface SecurityConfig {
 }
 export interface ExternalServicesConfig {
     stripe?: {
-        secretKey?: string;
-        publishableKey?: string;
-        webhookSecret?: string;
+        secretKey?: string | undefined;
+        publishableKey?: string | undefined;
+        webhookSecret?: string | undefined;
         apiVersion: string;
     };
     paypal?: {
-        clientId?: string;
-        clientSecret?: string;
-        webhookId?: string;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        webhookId?: string | undefined;
         environment: 'sandbox' | 'production';
     };
     smtp?: {
-        host?: string;
+        host?: string | undefined;
         port: number;
         secure: boolean;
-        username?: string;
-        password?: string;
+        username?: string | undefined;
+        password?: string | undefined;
     };
 }
 export interface PerformanceConfig {
@@ -285,6 +368,8 @@ export interface PerformanceConfig {
         enabled: boolean;
         level: number;
         threshold: number;
+        /** Encoding preference order (default ['br','gzip','deflate']). */
+        encodings?: Array<'br' | 'gzip' | 'deflate'>;
     };
     circuitBreaker: {
         enabled: boolean;
@@ -295,7 +380,7 @@ export interface PerformanceConfig {
     clustering: {
         enabled: boolean;
         workers: number | 'auto';
-        memoryPerWorkerGB?: number;
+        memoryPerWorkerGB?: number | undefined;
     };
 }
 export interface WebSocketConfig {

package/dist/types/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA,0DAA0D"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA,0DAA0D","sourcesContent":["// TypeScript-based Configuration Types for Moro Framework\n\n/**\n * CORS origin function type for dynamic origin validation\n */\nexport type OriginFunction = (\n  origin: string | undefined,\n  req: any\n) => string | string[] | boolean | Promise<string | string[] | boolean>;\n\n/**\n * Deep partial type that makes all properties and nested properties optional\n * Used for user-provided configuration where only partial overrides are needed\n */\nexport type DeepPartial<T> = T extends object\n  ? T extends Array<infer U>\n    ? Array<DeepPartial<U>>\n    : T extends (...args: any[]) => any\n      ? T\n      : { [P in keyof T]?: DeepPartial<T[P]> }\n  : T;\n\n/** Unified SSL/TLS config (superset of both historical shapes). */\nexport interface SSLConfig {\n  /** File-path shape (uWS-style; keyFile/certFile also accepted) */\n  key_file_name?: string;\n  cert_file_name?: string;\n  ca_file_name?: string | string[];\n  keyFile?: string;\n  certFile?: string;\n  caFile?: string | string[];\n  /** Inline-PEM shape (node-style) */\n  key?: string | Buffer;\n  cert?: string | Buffer;\n  ca?: string | Buffer | Array<string | Buffer>;\n  passphrase?: string;\n  minVersion?: 'TLSv1.2' | 'TLSv1.3';\n  requestCert?: boolean;\n  rejectUnauthorized?: boolean;\n}\n\n/** Per-phase receive timeouts. 0 = use the per-server default / disabled. */\nexport interface ServerTimeoutsConfig {\n  /** Full-request receive budget (ms); does NOT reset on activity. */\n  request?: number;\n  /** Socket inactivity timeout (ms). */\n  idle?: number;\n  /** Node keep-alive socket timeout (ms). Default 5000. */\n  keepAlive?: number;\n  /** Node headers-received timeout (ms). Default 6000. */\n  headers?: number;\n}\n\nexport interface MultipartLimitsConfig {\n  maxParts?: number;\n  maxPartHeaderBytes?: number | string;\n  maxFiles?: number;\n  maxFileSize?: number | string;\n}\n\n/** Fine-grained limits; every value is a documented default, not a hard cap. */\nexport interface ServerLimitsConfig {\n  /** Max request head (request line + headers) size. Node maxHeaderSize / engine maxHeadSize. */\n  maxHeaderSize?: number | string;\n  /** Max header count. Node maxHeadersCount / engine maxHeaders. */\n  maxHeaders?: number;\n  multipart?: MultipartLimitsConfig;\n  /** Reassembled WebSocket message cap (engine wsMaxMessageSize). */\n  wsMaxMessageSize?: number | string;\n  /** WebSocket send backpressure cap (engine wsBackpressureLimit). 0 = unlimited. */\n  wsBackpressureLimit?: number | string;\n  /** Write-queue high-water mark (engine writeHighWaterMark). */\n  writeHighWaterMark?: number | string;\n  /** Per-connection not-yet-parsed backlog cap (engine maxPendingBytes). */\n  maxPendingBytes?: number | string;\n}\n\nexport interface Http2SettingsConfig {\n  maxConcurrentStreams?: number;\n  initialWindowSize?: number;\n  maxFrameSize?: number;\n  maxHeaderListSize?: number;\n  headerTableSize?: number;\n  enablePush?: boolean;\n  enableConnectProtocol?: boolean;\n  maxHeaderSize?: number;\n}\n\nexport interface ServerConfig {\n  port: number;\n  host: string;\n  maxConnections: number;\n  /** @deprecated Use timeouts.request. Kept as an alias; still honored. */\n  timeout: number;\n  bodySizeLimit: string;\n  maxUploadSize: string; // Maximum size for file uploads (multipart/form-data)\n  /** Per-phase receive timeouts (finally applied to every runtime). */\n  timeouts?: ServerTimeoutsConfig;\n  /** Fine-grained size/count limits, passed through to whichever runtime serves. */\n  limits?: ServerLimitsConfig;\n  /** TCP listen backlog. */\n  backlog?: number;\n  /** HTTP/2: true, or an options object. Served natively by the engine when\n   *  it supports h2 (feature-detected), else by the Node http2 server. */\n  http2?:\n    | boolean\n    | { allowHTTP1?: boolean; maxSessionMemory?: number; settings?: Http2SettingsConfig };\n  requestTracking: {\n    enabled: boolean;\n  };\n  requestLogging: {\n    enabled: boolean;\n  };\n  errorBoundary: {\n    enabled: boolean;\n  };\n  /**\n   * HTTP engine selection. Default: 'moro'.\n   * - 'moro' (default): Moro's own native engine (@morojs/engine), falling back\n   *   to the Node.js http server if it cannot load on this platform/Node ABI\n   * - 'node': the Node.js http server (no native engine)\n   * - 'uws': opt in to uWebSockets.js, falling back to Node.js if it cannot load\n   * Any chosen engine that cannot load degrades to Node.js and logs why; the app\n   * never fails to boot. Inspect what actually booted via app.engine.\n   */\n  engine?: 'moro' | 'node' | 'uws';\n  /** @deprecated Use engine: 'uws' instead. Enable uWebSockets for both HTTP and WebSocket */\n  useUWebSockets?: boolean;\n  /** Unified SSL/TLS config; flows to whichever runtime serves. */\n  ssl?: SSLConfig;\n}\n\nexport interface ServiceDiscoveryConfig {\n  enabled: boolean;\n  type: 'memory' | 'consul' | 'kubernetes';\n  consulUrl: string;\n  kubernetesNamespace: string;\n  healthCheckInterval: number;\n  retryAttempts: number;\n}\n\nexport interface DatabaseConfig {\n  url?: string;\n  redis?: {\n    url: string;\n    maxRetries: number;\n    retryDelay: number;\n    keyPrefix: string;\n  };\n  mysql?: {\n    host: string;\n    port: number;\n    database?: string;\n    username?: string;\n    password?: string;\n    connectionLimit: number;\n    acquireTimeout: number;\n    timeout: number;\n  };\n  postgresql?: {\n    host: string;\n    port: number;\n    database?: string;\n    user?: string;\n    password?: string;\n    connectionLimit: number;\n    ssl?: boolean;\n  };\n  sqlite?: {\n    filename: string;\n    memory?: boolean;\n    verbose?: boolean;\n  };\n  mongodb?: {\n    url?: string;\n    host?: string;\n    port?: number;\n    database?: string;\n    username?: string;\n    password?: string;\n  };\n}\n\n// Validation error context passed to error handlers\nexport interface ValidationErrorContext {\n  request: {\n    method: string;\n    path: string;\n    url: string;\n    headers: Record<string, any>;\n  };\n  route?: {\n    path: string;\n    method: string;\n  };\n  field: 'body' | 'query' | 'params' | 'headers';\n}\n\n// Validation error detail structure\nexport interface ValidationErrorDetail {\n  field: string;\n  message: string;\n  code?: string;\n  value?: any;\n  path?: (string | number)[];\n}\n\n// Validation error response structure\nexport interface ValidationErrorResponse {\n  status: number;\n  body: any;\n  headers?: Record<string, string>;\n}\n\n// Validation error handler function type\nexport type ValidationErrorHandler = (\n  errors: ValidationErrorDetail[],\n  context: ValidationErrorContext\n) => ValidationErrorResponse;\n\nexport interface ModuleDefaultsConfig {\n  apiPrefix?: string; // Prefix for module routes, defaults to '/api/' - set to empty string '' to disable\n  cache: {\n    enabled: boolean;\n    defaultTtl: number;\n    maxSize: number;\n    strategy: 'lru' | 'lfu' | 'fifo';\n  };\n  rateLimit: {\n    enabled: boolean;\n    defaultRequests: number;\n    defaultWindow: number;\n    skipSuccessfulRequests: boolean;\n    skipFailedRequests: boolean;\n  };\n  validation: {\n    enabled: boolean;\n    stripUnknown: boolean;\n    abortEarly: boolean;\n    allowUnknown?: boolean;\n    onError?: ValidationErrorHandler;\n  };\n  session?: {\n    enabled: boolean;\n    store: 'memory' | 'redis' | 'file';\n    storeOptions?: {\n      host?: string;\n      port?: number;\n      password?: string;\n      keyPrefix?: string;\n      path?: string;\n      max?: number;\n    };\n    secret?: string;\n    name?: string;\n    rolling?: boolean;\n    resave?: boolean;\n    saveUninitialized?: boolean;\n    cookie?: {\n      maxAge?: number;\n      httpOnly?: boolean;\n      secure?: boolean;\n      sameSite?: 'strict' | 'lax' | 'none';\n      domain?: string;\n      path?: string;\n    };\n    proxy?: boolean;\n    unset?: 'destroy' | 'keep';\n  };\n  autoDiscovery: {\n    enabled: boolean;\n    paths: string[];\n    patterns: string[];\n    recursive: boolean;\n    loadingStrategy: 'eager' | 'lazy' | 'conditional';\n    watchForChanges: boolean;\n    ignorePatterns: string[];\n    loadOrder: 'alphabetical' | 'dependency' | 'custom';\n    failOnError: boolean;\n    maxDepth: number;\n  };\n}\n\nexport interface LoggingConfig {\n  level: 'debug' | 'info' | 'warn' | 'error' | 'fatal';\n  format: 'pretty' | 'json' | 'compact';\n  enableColors: boolean;\n  enableTimestamp: boolean;\n  enableContext: boolean;\n  // Opt-in: appends a JSON metadata object (e.g. {\"framework\":\"moro\",...}) to pretty log lines.\n  // Has no effect on 'json' format - structured output always includes metadata.\n  enableMetadata: boolean;\n  // Opt-in: collects and renders per-log performance data such as memory usage (e.g. \"(210MB)\").\n  // Disabling skips the process.memoryUsage() call on every log line.\n  enablePerformance: boolean;\n  outputs: {\n    console: boolean;\n    file: {\n      enabled: boolean;\n      path: string;\n      maxSize: string;\n      maxFiles: number;\n    };\n    webhook: {\n      enabled: boolean;\n      url?: string;\n      headers: Record<string, string>;\n    };\n  };\n}\n\nexport interface SecurityConfig {\n  cors: {\n    enabled: boolean;\n    origin: string | string[] | boolean | OriginFunction;\n    methods: string[];\n    allowedHeaders: string[];\n    exposedHeaders?: string[];\n    credentials: boolean;\n    maxAge?: number;\n    preflightContinue?: boolean;\n  };\n  helmet: {\n    enabled: boolean;\n    // Simplified options (backward compatible)\n    contentSecurityPolicy?: boolean;\n    hsts?: boolean;\n    noSniff?: boolean;\n    frameguard?: boolean;\n    // Detailed options (for advanced configuration)\n    xFrameOptions?: 'DENY' | 'SAMEORIGIN';\n    xContentTypeOptions?: boolean;\n    xXssProtection?: boolean;\n    referrerPolicy?: string;\n    strictTransportSecurity?: { maxAge?: number; includeSubDomains?: boolean };\n    xDownloadOptions?: boolean;\n    xPermittedCrossDomainPolicies?: boolean;\n  };\n  csrf?: {\n    enabled: boolean;\n    secret?: string;\n    tokenLength?: number;\n    cookieName?: string;\n    headerName?: string;\n    ignoreMethods?: string[];\n    sameSite?: boolean;\n  };\n  csp?: {\n    enabled: boolean;\n    directives?: {\n      defaultSrc?: string[];\n      scriptSrc?: string[];\n      styleSrc?: string[];\n      imgSrc?: string[];\n      connectSrc?: string[];\n      fontSrc?: string[];\n      objectSrc?: string[];\n      mediaSrc?: string[];\n      frameSrc?: string[];\n      childSrc?: string[];\n      workerSrc?: string[];\n      formAction?: string[];\n      upgradeInsecureRequests?: boolean;\n      blockAllMixedContent?: boolean;\n    };\n    reportOnly?: boolean;\n    reportUri?: string;\n    nonce?: boolean;\n  };\n  rateLimit: {\n    global: {\n      enabled: boolean;\n      requests: number;\n      window: number;\n    };\n  };\n}\n\nexport interface ExternalServicesConfig {\n  stripe?: {\n    secretKey?: string | undefined;\n    publishableKey?: string | undefined;\n    webhookSecret?: string | undefined;\n    apiVersion: string;\n  };\n  paypal?: {\n    clientId?: string | undefined;\n    clientSecret?: string | undefined;\n    webhookId?: string | undefined;\n    environment: 'sandbox' | 'production';\n  };\n  smtp?: {\n    host?: string | undefined;\n    port: number;\n    secure: boolean;\n    username?: string | undefined;\n    password?: string | undefined;\n  };\n}\n\nexport interface PerformanceConfig {\n  compression: {\n    enabled: boolean;\n    level: number;\n    threshold: number;\n    /** Encoding preference order (default ['br','gzip','deflate']). */\n    encodings?: Array<'br' | 'gzip' | 'deflate'>;\n  };\n  circuitBreaker: {\n    enabled: boolean;\n    failureThreshold: number;\n    resetTimeout: number;\n    monitoringPeriod: number;\n  };\n  clustering: {\n    enabled: boolean;\n    workers: number | 'auto';\n    memoryPerWorkerGB?: number | undefined;\n  };\n}\n\nexport interface WebSocketConfig {\n  enabled: boolean;\n  adapter?: string | 'socket.io' | 'ws' | 'uws';\n  compression?: boolean;\n  customIdGenerator?: () => string;\n  options?: {\n    cors?: {\n      origin?: string | string[];\n      credentials?: boolean;\n    };\n    path?: string;\n    maxPayloadLength?: number;\n    idleTimeout?: number;\n    ssl?: {\n      key_file_name?: string;\n      cert_file_name?: string;\n      passphrase?: string;\n    };\n  };\n}\n\nexport interface JobsConfig {\n  enabled?: boolean;\n  maxConcurrentJobs?: number;\n  gracefulShutdownTimeout?: number;\n  leaderElection?: {\n    enabled?: boolean;\n    strategy?: 'file' | 'redis' | 'none';\n    lockPath?: string;\n    lockTimeout?: number;\n    heartbeatInterval?: number;\n  };\n  executor?: {\n    maxRetries?: number;\n    retryDelay?: number;\n    retryBackoff?: 'linear' | 'exponential';\n    retryBackoffMultiplier?: number;\n    maxRetryDelay?: number;\n    timeout?: number;\n    enableCircuitBreaker?: boolean;\n    circuitBreakerThreshold?: number;\n    circuitBreakerResetTimeout?: number;\n    enableMemoryMonitoring?: boolean;\n    memoryThreshold?: number;\n  };\n  stateManager?: {\n    persistPath?: string;\n    historySize?: number;\n    persistInterval?: number;\n    enableAutoPersist?: boolean;\n    enableRecovery?: boolean;\n  };\n}\n\n// File-based routing configuration. When enabled, route files under the\n// configured directories are imported during startup (after module discovery)\n// so their `getApp().get(...)` registrations execute automatically.\nexport interface RoutingConfig {\n  enabled: boolean;\n  // Directories scanned via loadRoutes(). Defaults to ./src/routes in\n  // development and ./dist/(src/)routes in production when omitted.\n  paths?: string[];\n}\n\n// Main configuration interface\nexport interface AppConfig {\n  server: ServerConfig;\n  serviceDiscovery: ServiceDiscoveryConfig;\n  database: DatabaseConfig;\n  modules: ModuleDefaultsConfig;\n  // Enable file-based auto routing (./src/routes). Defaults to true.\n  routing: boolean | RoutingConfig;\n  logging: LoggingConfig;\n  security: SecurityConfig;\n  external: ExternalServicesConfig;\n  performance: PerformanceConfig;\n  websocket: WebSocketConfig;\n  jobs?: JobsConfig;\n  queue?: QueueConfig;\n}\n\n// Queue Configuration\nexport interface QueueConfig {\n  adapter?: 'bull' | 'rabbitmq' | 'sqs' | 'kafka' | 'memory';\n  connection?: {\n    host?: string;\n    port?: number;\n    username?: string;\n    password?: string;\n    database?: number;\n    brokers?: string[];\n    groupId?: string;\n    region?: string;\n    queueUrl?: string;\n    [key: string]: any;\n  };\n  concurrency?: number;\n  retry?: {\n    maxAttempts: number;\n    backoff: 'fixed' | 'exponential' | 'linear';\n    initialDelay: number;\n    maxDelay?: number;\n  };\n  deadLetterQueue?: {\n    enabled: boolean;\n    maxRetries: number;\n    queueName?: string;\n  };\n  defaultJobOptions?: {\n    removeOnComplete?: boolean | number;\n    removeOnFail?: boolean | number;\n    attempts?: number;\n    backoff?: {\n      type: 'fixed' | 'exponential' | 'linear';\n      delay: number;\n    };\n  };\n  prefix?: string;\n  limiter?: {\n    max: number;\n    duration: number;\n  };\n}\n"]}

package/dist/types/core.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/types/core.ts"],"names":[],"mappings":""}
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/types/core.ts"],"names":[],"mappings":"","sourcesContent":["// Core Framework Types\nimport { RuntimeConfig } from './runtime.js';\nimport { LoggerOptions } from './logger.js';\nimport { AppConfig, ValidationErrorHandler } from './config.js';\n\nexport interface MoroOptions {\n  autoDiscover?:\n    | boolean\n    | {\n        enabled?: boolean;\n        paths?: string[];\n        patterns?: string[];\n        recursive?: boolean;\n        loadingStrategy?: 'eager' | 'lazy' | 'conditional';\n        watchForChanges?: boolean;\n        ignorePatterns?: string[];\n        loadOrder?: 'alphabetical' | 'dependency' | 'custom';\n        failOnError?: boolean;\n        maxDepth?: number;\n      };\n  modulesPath?: string; // Deprecated: use autoDiscover.paths instead\n  middleware?: any[];\n\n  // Runtime configuration\n  runtime?: RuntimeConfig;\n\n  // HTTP/WebSocket options\n  http2?:\n    | boolean\n    | {\n        allowHTTP1?: boolean;\n        maxSessionMemory?: number;\n        settings?: {\n          headerTableSize?: number;\n          enablePush?: boolean;\n          initialWindowSize?: number;\n          maxFrameSize?: number;\n          maxConcurrentStreams?: number;\n          maxHeaderListSize?: number;\n          maxHeaderSize?: number;\n          enableConnectProtocol?: boolean;\n        };\n      };\n  https?: {\n    key: string | Buffer;\n    cert: string | Buffer;\n    ca?: string | Buffer;\n  };\n  websocket?:\n    | {\n        enabled?: boolean;\n        adapter?: any;\n        compression?: boolean;\n        customIdGenerator?: () => string;\n        options?: any;\n      }\n    | false;\n\n  // Simplified config options (these map to the full config)\n  cors?: boolean | object;\n  compression?: boolean | object;\n  helmet?: boolean | object;\n  logger?: LoggerOptions | boolean;\n\n  // Worker threads configuration\n  workers?: {\n    count?: number;\n    maxQueueSize?: number;\n  };\n\n  // Validation configuration (top-level for convenience, maps to modules.validation)\n  validation?: {\n    enabled?: boolean;\n    stripUnknown?: boolean;\n    abortEarly?: boolean;\n    allowUnknown?: boolean;\n    onError?: ValidationErrorHandler;\n  };\n\n  // Direct config overrides (partial)\n  server?: Partial<AppConfig['server']>;\n  database?: Partial<AppConfig['database']>;\n  modules?: Partial<AppConfig['modules']>;\n  logging?: Partial<AppConfig['logging']>;\n  security?: Partial<AppConfig['security']>;\n  external?: Partial<AppConfig['external']>;\n  performance?: Partial<AppConfig['performance']>;\n  jobs?: Partial<AppConfig['jobs']>;\n}\n"]}

package/dist/types/database.js.map

@@ -1 +1 @@
-{"version":3,"file":"database.js","sourceRoot":"","sources":["../../src/types/database.ts"],"names":[],"mappings":""}
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../src/types/database.ts"],"names":[],"mappings":"","sourcesContent":["// src/types/database.ts\nexport interface DatabaseAdapter {\n  connect(): Promise<void>;\n  disconnect(): Promise<void>;\n  query<T = any>(sql: string, params?: any[]): Promise<T[]>;\n  queryOne<T = any>(sql: string, params?: any[]): Promise<T | null>;\n  insert<T = any>(table: string, data: Record<string, any>): Promise<T>;\n  update<T = any>(table: string, data: Record<string, any>, where: Record<string, any>): Promise<T>;\n  delete(table: string, where: Record<string, any>): Promise<number>;\n  transaction<T>(callback: (tx: DatabaseTransaction) => Promise<T>): Promise<T>;\n}\n\nexport interface DatabaseTransaction {\n  query<T = any>(sql: string, params?: any[]): Promise<T[]>;\n  queryOne<T = any>(sql: string, params?: any[]): Promise<T | null>;\n  insert<T = any>(table: string, data: Record<string, any>): Promise<T>;\n  update<T = any>(table: string, data: Record<string, any>, where: Record<string, any>): Promise<T>;\n  delete(table: string, where: Record<string, any>): Promise<number>;\n  commit(): Promise<void>;\n  rollback(): Promise<void>;\n}\n\nexport interface DatabaseConfig {\n  host: string;\n  port: number;\n  user: string;\n  password: string;\n  database: string;\n  connectionLimit?: number;\n  acquireTimeout?: number;\n  timeout?: number;\n}\n"]}

package/dist/types/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/types/discovery.ts"],"names":[],"mappings":""}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/types/discovery.ts"],"names":[],"mappings":"","sourcesContent":["// Auto-Discovery Types\nexport interface DiscoveryOptions {\n  baseDir?: string;\n  pattern?: RegExp;\n  recursive?: boolean;\n  extensions?: string[];\n}\n"]}

package/dist/types/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/types/events.ts"],"names":[],"mappings":"AAAA,gCAAgC"}
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/types/events.ts"],"names":[],"mappings":"AAAA,gCAAgC","sourcesContent":["// Enterprise Event System Types\n\nexport interface EventContext {\n  timestamp: Date;\n  source: string;\n  moduleId?: string;\n  requestId?: string;\n  userId?: string;\n  sessionId?: string;\n  metadata?: Record<string, any>;\n}\n\nexport interface EventPayload<T = any> {\n  context: EventContext;\n  data: T;\n}\n\nexport interface EventBusOptions {\n  maxListeners?: number;\n  enablePersistence?: boolean;\n  enableMetrics?: boolean;\n  isolation?: 'none' | 'module' | 'strict';\n}\n\nexport interface ModuleEventBus {\n  emit<T = any>(event: string, data: T): Promise<boolean>;\n  on<T = any>(event: string, listener: (payload: EventPayload<T>) => void | Promise<void>): this;\n  once<T = any>(event: string, listener: (payload: EventPayload<T>) => void | Promise<void>): this;\n  off(event: string, listener: CallableFunction): this;\n  removeAllListeners(event?: string): this;\n  listenerCount(event: string): number;\n}\n\nexport interface GlobalEventBus extends ModuleEventBus {\n  createModuleBus(moduleId: string): ModuleEventBus;\n  destroyModuleBus(moduleId: string): void;\n  getMetrics(): EventMetrics;\n  enableAuditLog(): void;\n  disableAuditLog(): void;\n}\n\nexport interface EventMetrics {\n  totalEvents: number;\n  eventsByType: Record<string, number>;\n  eventsByModule: Record<string, number>;\n  averageLatency: number;\n  errorRate: number;\n}\n\nexport type SystemEvents = {\n  'framework:initialized': { options: any };\n  'framework:shutdown': { graceful: boolean };\n  'module:loading': { moduleId: string; path?: string };\n  'module:loaded': { moduleId: string; version: string };\n  'module:unloaded': { moduleId: string };\n  'middleware:registered': { name: string; type: string };\n  'middleware:installed': { name: string; options?: any };\n  'database:connected': { adapter: string; config: any };\n  'database:disconnected': { adapter: string };\n  'server:starting': { port: number };\n  'server:started': { port: number; pid: number };\n  'server:stopping': { graceful: boolean };\n  'request:start': { method: string; path: string; requestId: string };\n  'request:end': {\n    method: string;\n    path: string;\n    requestId: string;\n    statusCode: number;\n    duration: number;\n  };\n  'websocket:connected': { namespace: string; socketId: string };\n  'websocket:disconnected': {\n    namespace: string;\n    socketId: string;\n    reason: string;\n  };\n  'error:handled': { error: Error; context: string; requestId?: string };\n  'error:unhandled': { error: Error; context: string };\n};\n\nexport type EventHandler<T = any> = (payload: EventPayload<T>) => void | Promise<void>;\n"]}

package/dist/types/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/types/hooks.ts"],"names":[],"mappings":""}
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/types/hooks.ts"],"names":[],"mappings":"","sourcesContent":["// Hooks and Middleware Types\nimport { HttpRequest, HttpResponse } from '../core/http/index.js';\n\nexport type HookFunction = (...args: any[]) => Promise<any> | any;\n\nexport interface StandardMiddleware {\n  (req: HttpRequest, res: HttpResponse, next: () => Promise<void>): Promise<void> | void;\n}\n\nexport interface HookContext {\n  request?: HttpRequest;\n  response?: HttpResponse;\n  data?: any;\n  metadata?: Record<string, any>;\n}\n\nexport interface MoroMiddleware {\n  name: string;\n  version?: string;\n  install: (hooks: any, options?: any) => Promise<void> | void;\n  uninstall?: (hooks: any) => Promise<void> | void;\n}\n\n// Advanced middleware types\nexport interface MiddlewareMetadata {\n  name: string;\n  version?: string;\n  description?: string;\n  author?: string;\n  dependencies?: string[];\n  tags?: string[];\n}\n\nexport interface MiddlewareContext {\n  app: any;\n  hooks: any; // HookManager\n  config: any;\n  logger?: any;\n}\n\nexport interface MiddlewareInterface extends MoroMiddleware {\n  metadata?: MiddlewareMetadata;\n  dependencies?: string[];\n  configure?: (config: any) => void;\n  beforeInstall?: (context: MiddlewareContext) => Promise<void> | void;\n  afterInstall?: (context: MiddlewareContext) => Promise<void> | void;\n  beforeUninstall?: (context: MiddlewareContext) => Promise<void> | void;\n  afterUninstall?: (context: MiddlewareContext) => Promise<void> | void;\n}\n\nexport type SimpleMiddlewareFunction = (app: any) => Promise<void> | void;\n"]}

package/dist/types/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/types/http.ts"],"names":[],"mappings":""}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/types/http.ts"],"names":[],"mappings":"","sourcesContent":["// HTTP Server Types\nimport { IncomingMessage, ServerResponse } from 'http';\n\nexport interface HttpRequest extends IncomingMessage {\n  params: Record<string, string>;\n  query: Record<string, string>;\n  body: any;\n  path: string;\n  headers: Record<string, string>;\n  ip: string;\n  requestId: string;\n  cookies?: Record<string, string>;\n  files?: Record<string, any>;\n\n  // Per-request typed context (pass data between middlewares without monkey-patching req)\n  context: Record<string, any>;\n\n  // Express-compatible helpers\n  get(name: string): string | undefined;\n  header(name: string): string | undefined;\n  is(type: string): boolean;\n  accepts(types?: string | string[]): string | false;\n  acceptsLanguages(langs?: string | string[]): string | false;\n  hostname: string;\n  protocol: string;\n  secure: boolean;\n  xhr: boolean;\n  originalUrl: string;\n  ips: string[];\n  subdomains: string[];\n\n  [key: string]: any;\n}\n\nexport interface CookieOptions {\n  maxAge?: number;\n  expires?: Date;\n  httpOnly?: boolean;\n  secure?: boolean;\n  sameSite?: 'strict' | 'lax' | 'none';\n  domain?: string;\n  path?: string;\n  // Security options\n  critical?: boolean; // Mark as critical for security (throws on late set)\n  throwOnLateSet?: boolean; // Force throw if headers already sent\n}\n\nexport interface ResponseState {\n  headersSent: boolean;\n  statusCode: number;\n  headers: Record<string, any>;\n  finished: boolean;\n  writable: boolean;\n}\n\nexport interface MoroResponseMethods {\n  json(data: any): void;\n  status(code: number): HttpResponse;\n  send(data: string | Buffer): void;\n  cookie(name: string, value: string, options?: CookieOptions): HttpResponse;\n  clearCookie(name: string, options?: CookieOptions): HttpResponse;\n  redirect(url: string, status?: number): void;\n  sendFile(filePath: string): Promise<void>;\n  render?(template: string, data?: any): Promise<void>;\n\n  // Per-response typed state bag (Express-compatible res.locals)\n  locals: Record<string, any>;\n\n  // Express-compatible response helpers\n  set(\n    field: string | Record<string, string | string[] | number>,\n    value?: string | string[] | number\n  ): HttpResponse;\n  get(field: string): string | number | string[] | undefined;\n  append(field: string, value: string | string[]): HttpResponse;\n  type(contentType: string): HttpResponse;\n  sendStatus(code: number): void;\n  location(url: string): HttpResponse;\n  vary(field: string | string[]): HttpResponse;\n  links(links: Record<string, string>): HttpResponse;\n  attachment(filename?: string): HttpResponse;\n  download(filePath: string, filename?: string): Promise<void>;\n  format(handlers: Record<string, () => any | Promise<any>>): void;\n\n  // Header management utilities\n  hasHeader(name: string): boolean;\n  setBulkHeaders(headers: Record<string, string | number>): HttpResponse;\n  appendHeader(name: string, value: string | string[]): HttpResponse;\n\n  // Response state utilities\n  canSetHeaders(): boolean;\n  getResponseState(): ResponseState;\n\n  // Standardized response helpers\n  success<T = any>(data: T, message?: string): void;\n  error(error: string, code?: string, message?: string): void;\n\n  // Common HTTP error helpers (automatically set status code)\n  unauthorized(message?: string): void;\n  forbidden(message?: string): void;\n  notFound(resource?: string): void;\n  badRequest(message?: string): void;\n  conflict(message: string): void;\n  internalError(message?: string): void;\n  validationError(errors: Array<{ field: string; message: string; code?: string }>): void;\n  rateLimited(retryAfter?: number): void;\n\n  // Common success patterns\n  created<T = any>(data: T, location?: string): void;\n  noContent(): void;\n  paginated<T = any>(\n    data: T[],\n    pagination: {\n      page: number;\n      limit: number;\n      total: number;\n    }\n  ): void;\n}\n\nexport type HttpResponse = ServerResponse & MoroResponseMethods;\n\nexport type HttpHandler = (req: HttpRequest, res: HttpResponse) => Promise<void> | void;\nexport type Middleware = (\n  req: HttpRequest,\n  res: HttpResponse,\n  next: () => void\n) => Promise<void> | void;\nexport type MiddlewareFunction = (\n  req: HttpRequest,\n  res: HttpResponse,\n  next: () => void\n) => void | Promise<void>;\n\n// Internal router types\nexport interface RouteEntry {\n  method: string;\n  path: string;\n  pattern: RegExp;\n  paramNames: string[];\n  handler: HttpHandler;\n  middleware: Middleware[];\n}\n\nexport interface RouteDefinition {\n  method: string;\n  path: string;\n  pattern: RegExp;\n  paramNames: string[];\n  handler: HttpHandler;\n  middleware: Middleware[];\n}\n"]}

package/dist/types/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/types/logger.ts"],"names":[],"mappings":""}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/types/logger.ts"],"names":[],"mappings":"","sourcesContent":["// Enterprise Logger Types\nexport type LogLevel = 'debug' | 'info' | 'warn' | 'error' | 'fatal';\n\nexport interface LogEntry {\n  timestamp: Date;\n  level: LogLevel;\n  message: string;\n  context?: string;\n  metadata?: Record<string, any>;\n  requestId?: string;\n  moduleId?: string;\n  userId?: string;\n  sessionId?: string;\n  performance?: {\n    duration?: number;\n    memory?: number;\n    cpu?: number;\n  };\n  stack?: string;\n}\n\nexport interface LoggerOptions {\n  level?: LogLevel;\n  enableColors?: boolean;\n  enableTimestamp?: boolean;\n  enableContext?: boolean;\n  enableMetadata?: boolean;\n  enablePerformance?: boolean;\n  enableMetrics?: boolean;\n  format?: 'pretty' | 'json' | 'compact';\n  outputs?: LogOutput[];\n  filters?: LogFilter[];\n  maxEntries?: number;\n  maxBufferSize?: number;\n}\n\nexport interface LogOutput {\n  name: string;\n  write: (entry: LogEntry) => Promise<void> | void;\n  level?: LogLevel;\n  format?: 'pretty' | 'json' | 'compact';\n}\n\nexport interface LogFilter {\n  name: string;\n  filter: (entry: LogEntry) => boolean;\n}\n\nexport interface Logger {\n  debug(message: string, context?: string, metadata?: Record<string, any>): void;\n  info(message: string, context?: string, metadata?: Record<string, any>): void;\n  warn(message: string, context?: string, metadata?: Record<string, any>): void;\n  error(message: string | Error, context?: string, metadata?: Record<string, any>): void;\n  fatal(message: string | Error, context?: string, metadata?: Record<string, any>): void;\n\n  // Performance logging\n  time(label: string): void;\n  timeEnd(label: string, context?: string, metadata?: Record<string, any>): void;\n\n  // Structured logging\n  child(context: string, metadata?: Record<string, any>): Logger;\n\n  // Configuration\n  setLevel(level: LogLevel): void;\n  getLevel(): LogLevel;\n  addOutput(output: LogOutput): void;\n  removeOutput(name: string): void;\n  addFilter(filter: LogFilter): void;\n  removeFilter(name: string): void;\n\n  // Cleanup\n  flush(): void;\n  flushBuffer(): void;\n  destroy(): void;\n\n  // Metrics and history\n  getHistory(count?: number): LogEntry[];\n  getMetrics(): LogMetrics;\n  clear(): void;\n}\n\nexport interface LogMetrics {\n  totalLogs: number;\n  logsByLevel: Record<LogLevel, number>;\n  logsByContext: Record<string, number>;\n  averageLogRate: number;\n  errorRate: number;\n  memoryUsage: number;\n  outputErrors?: Record<string, number>;\n}\n\nexport interface ColorScheme {\n  debug: string;\n  info: string;\n  warn: string;\n  error: string;\n  fatal: string;\n  timestamp: string;\n  context: string;\n  metadata: string;\n  performance: string;\n  reset: string;\n}\n"]}

package/dist/types/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../../src/types/module.ts"],"names":[],"mappings":"AAAA,0BAA0B"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../src/types/module.ts"],"names":[],"mappings":"AAAA,0BAA0B","sourcesContent":["// Module Definition Types\n\nimport type { ValidationErrorHandler } from './config.js';\nimport type { CompiledRoute } from '../core/routing/index.js';\n\n// Middleware can be a string name (resolved from built-in) or actual function\nexport type ModuleMiddleware =\n  | string\n  | ((req: any, res: any, next: () => void) => void | Promise<void>);\n\nexport interface ModuleRoute {\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';\n  path: string;\n  handler: (req: any, res: any) => any | Promise<any>;\n  validation?: any;\n  onValidationError?: ValidationErrorHandler;\n  cache?: { ttl: number; key?: string };\n  rateLimit?: { requests: number; window: number };\n  middleware?: ModuleMiddleware[]; // Support both strings and functions\n  auth?: {\n    roles?: string[];\n    permissions?: string[];\n    optional?: boolean;\n  };\n}\n\nexport interface ModuleSocket {\n  event: string;\n  handler: (socket: any, data: any) => any | Promise<any>;\n  validation?: any;\n  rateLimit?: { requests: number; window: number };\n  rooms?: string[];\n  broadcast?: boolean;\n}\n\nexport interface ModuleDefinition {\n  name: string;\n  version: string;\n  config?: {\n    cache?: { ttl: number };\n    rateLimit?: { requests: number; window: number };\n    database?: {\n      path?: string;\n    };\n    [key: string]: any;\n  };\n  routes?: (ModuleRoute | CompiledRoute)[];\n  sockets?: ModuleSocket[];\n  dependencies?: string[];\n  middleware?: ModuleMiddleware[]; // Module-level middleware (applied to all routes)\n}\n\n// Internal Module Configuration (used by framework)\nexport interface ModuleConfig {\n  name: string;\n  version: string;\n  routes?: InternalRouteDefinition[];\n  websockets?: WebSocketDefinition[];\n  sockets?: WebSocketDefinition[];\n  dependencies?: string[];\n  middleware?: any[]; // MiddlewareFunction from http types\n  services?: ServiceDefinition[];\n  config?: any; // Module-specific configuration\n  routeHandlers?: Record<string, CallableFunction>;\n  socketHandlers?: Record<string, CallableFunction>;\n}\n\nexport interface InternalRouteDefinition {\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';\n  path: string;\n  handler: string;\n  middleware?: ModuleMiddleware[]; // Support both strings and functions\n  validation?: any;\n  onValidationError?: ValidationErrorHandler;\n  cache?: CacheConfig;\n  rateLimit?: RateLimitConfig;\n  auth?: {\n    roles?: string[];\n    permissions?: string[];\n    optional?: boolean;\n  };\n  // Allow additional properties for extensibility\n  [key: string]: any;\n}\n\nexport interface WebSocketDefinition {\n  event: string;\n  handler: string;\n  middleware?: string[];\n  validation?: any;\n  rateLimit?: RateLimitConfig;\n  rooms?: string[];\n  broadcast?: boolean;\n}\n\nexport interface ServiceDefinition {\n  name: string;\n  implementation: new (...args: any[]) => any;\n  singleton?: boolean;\n  dependencies?: string[];\n}\n\nexport interface CacheConfig {\n  ttl: number;\n  key?: string;\n}\n\nexport interface RateLimitConfig {\n  requests: number;\n  window: number;\n}\n"]}

package/dist/types/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/types/runtime.ts"],"names":[],"mappings":""}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/types/runtime.ts"],"names":[],"mappings":"","sourcesContent":["// Runtime abstraction types for multi-environment support\nimport { HttpRequest, HttpResponse } from '../core/http/index.js';\n\nexport type RuntimeType = 'node' | 'vercel-edge' | 'aws-lambda' | 'cloudflare-workers';\n\n// Generic runtime request/response interfaces\nexport interface RuntimeRequest {\n  method: string;\n  url: string;\n  headers: Record<string, string>;\n  body?: any;\n  query?: Record<string, string>;\n  params?: Record<string, string>;\n  [key: string]: any;\n}\n\nexport interface RuntimeResponse {\n  status: number;\n  headers: Record<string, string>;\n  body: any;\n}\n\n// Runtime-specific response interface for adapters\nexport interface RuntimeHttpResponse {\n  statusCode: number;\n  headers: Record<string, string>;\n  body: any;\n  headersSent: boolean;\n\n  status(code: number): RuntimeHttpResponse;\n  json(data: any): void;\n  send(data: string | Buffer): void;\n  cookie(name: string, value: string, options?: any): RuntimeHttpResponse;\n  clearCookie(name: string, options?: any): RuntimeHttpResponse;\n  redirect(url: string, status?: number): void;\n  sendFile?(filePath: string): Promise<void>;\n}\n\n// Runtime-specific handler types\nexport type NodeHandler = (req: any, res: any) => Promise<void> | void;\nexport type EdgeHandler = (request: Request) => Promise<Response>;\nexport type LambdaHandler = (event: any, context: any) => Promise<any>;\nexport type WorkerHandler = (request: Request, env: any, ctx: any) => Promise<Response>;\n\n// Runtime adapter interface\nexport interface RuntimeAdapter {\n  readonly type: RuntimeType;\n\n  // Convert runtime-specific request to MoroJS HttpRequest\n  adaptRequest(runtimeRequest: any, ...args: any[]): Promise<HttpRequest>;\n\n  // Convert MoroJS HttpResponse to runtime-specific response\n  adaptResponse(\n    moroResponse: HttpResponse | RuntimeHttpResponse,\n    runtimeRequest: any\n  ): Promise<any>;\n\n  // Create the appropriate server/handler for the runtime\n  createServer(handler: (req: HttpRequest, res: HttpResponse) => Promise<void>): any;\n\n  // Start listening (for runtimes that support it)\n  listen?(server: any, port: number, host?: string, callback?: () => void): void;\n}\n\n// Runtime configuration\nexport interface RuntimeConfig {\n  type: RuntimeType;\n  adapter?: RuntimeAdapter;\n  options?: any;\n}\n\n// Extended MoroOptions to include runtime configuration\nexport interface RuntimeMoroOptions {\n  runtime?: RuntimeConfig;\n  // ... existing options\n}\n"]}

package/dist/types/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/types/session.ts"],"names":[],"mappings":""}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/types/session.ts"],"names":[],"mappings":"","sourcesContent":["// Session Types\nexport interface SessionData {\n  [key: string]: any;\n  cookie?: {\n    originalMaxAge?: number;\n    expires?: Date;\n    secure?: boolean;\n    httpOnly?: boolean;\n    sameSite?: string;\n  };\n}\n\nexport interface SessionInstance {\n  // Session data proxy\n  [key: string]: any;\n\n  // Session methods\n  save(): Promise<void>;\n  destroy(): Promise<void>;\n  regenerate(): Promise<string>;\n  touch(): Promise<void>;\n\n  // Session properties\n  readonly sessionID: string;\n  readonly cookie?: SessionData['cookie'];\n  readonly isNew?: boolean;\n  readonly isModified?: boolean;\n}\n\nexport interface SessionOptions {\n  // Store configuration\n  store?: 'memory' | 'redis' | 'file' | any;\n  storeOptions?: {\n    // Redis options\n    host?: string;\n    port?: number;\n    password?: string;\n    keyPrefix?: string;\n    // File options\n    path?: string;\n    // Memory options\n    max?: number;\n  };\n\n  // Session configuration\n  secret?: string;\n  name?: string; // Session cookie name\n  genid?: () => string; // Session ID generator\n  rolling?: boolean; // Reset expiry on each request\n  resave?: boolean; // Save session even if not modified\n  saveUninitialized?: boolean; // Save new but not modified sessions\n\n  // Cookie configuration\n  cookie?: {\n    maxAge?: number; // Session timeout in ms\n    expires?: Date; // Absolute expiry\n    httpOnly?: boolean; // Prevent XSS access\n    secure?: boolean; // HTTPS only\n    sameSite?: 'strict' | 'lax' | 'none';\n    domain?: string;\n    path?: string;\n  };\n\n  // Security\n  proxy?: boolean; // Trust proxy for secure cookies\n  unset?: 'destroy' | 'keep'; // What to do when session is unset\n}\n\n// Extend the HTTP request type to include session\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      session: SessionInstance;\n    }\n  }\n}\n\n// For non-Express environments\nexport interface RequestWithSession {\n  session: SessionInstance;\n}\n\nexport interface SessionStore {\n  get(key: string): Promise<SessionData | null>;\n  set(key: string, data: SessionData, ttl?: number): Promise<void>;\n  del(key: string): Promise<void>;\n  clear?(): Promise<void>;\n  touch?(key: string): Promise<void>;\n}\n"]}

package/package.json

@@ -1,24 +1,28 @@
 {
   "name": "@morojs/moro",
-  "version": "1.7.30",
-  "description": "High-performance Node.js framework with intelligent routing, automatic middleware ordering, enterprise authentication (Auth.js), type-safe validation, and functional architecture",
+  "version": "1.8.1",
+  "description": "High-performance Node.js framework with intelligent routing, automatic middleware ordering, enterprise authentication (Better Auth), type-safe validation, and functional architecture",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
     ".": {
-      "development": "./src/index.ts",
+      "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
-    }
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
   },
+  "sideEffects": [
+    "**/logger/logger.js"
+  ],
   "scripts": {
     "build": "tsc",
     "dev": "tsx watch src/index.ts",
     "dev:watch": "tsc --watch",
     "clean": "rm -rf dist",
-    "prepare": "husky",
-    "prepublish": "npm run build",
+    "prepare": "husky || true",
+    "prepublishOnly": "npm run clean && npm run build && node scripts/validate-package.mjs",
     "test": "jest --detectOpenHandles",
     "test:watch": "jest --watch",
     "test:coverage": "jest --coverage --detectOpenHandles",
@@ -26,13 +30,14 @@
     "test:integration": "jest --testPathPatterns=integration --detectOpenHandles",
     "test:e2e": "jest --testPathPatterns=e2e --detectOpenHandles --testTimeout=30000",
     "test:debug": "jest --detectOpenHandles --verbose",
-    "test:ci": "jest --coverage --watchAll=false --ci --forceExit",
+    "test:ci": "jest --coverage --watchAll=false --ci",
     "test:force": "jest --forceExit",
     "test:all": "npm run test:unit && npm run test:integration && npm run test:e2e",
     "test:dist": "npm run build && node scripts/validate-dist.mjs",
     "test:package": "npm run build && node scripts/validate-package.mjs",
-    "lint": "eslint src --ext .ts",
+    "lint": "eslint src --ext .ts --max-warnings 0",
     "lint:fix": "eslint src --ext .ts --fix",
+    "typecheck:tests": "tsc -p tsconfig.test.json",
     "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\"",
     "format:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\"",
     "lint-staged": "lint-staged",
@@ -108,7 +113,10 @@
     "url": "https://github.com/Moro-JS/moro/issues"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
+  },
+  "dependencies": {
+    "@morojs/engine": "^1.1.0"
   },
   "peerDependencies": {
     "@aws-sdk/client-ses": ">=3.927.0",
@@ -140,7 +148,8 @@
     "swagger-ui-dist": ">=5.28.1",
     "uWebSockets.js": "github:uNetworking/uWebSockets.js#semver:^v20.52.0",
     "ws": ">=8.18.0",
-    "yup": ">=1.7.1"
+    "yup": ">=1.7.1",
+    "zod": ">=3.22.0"
   },
   "peerDependenciesMeta": {
     "@aws-sdk/client-ses": {
@@ -232,24 +241,27 @@
     },
     "yup": {
       "optional": true
+    },
+    "zod": {
+      "optional": true
     }
   },
   "devDependencies": {
     "@eslint/js": "^9.18.0",
     "@jest/globals": "^30.1.2",
-    "@pothos/core": "^4.10.0",
+    "@pothos/core": "^4.13.1",
     "@types/jest": "^30.0.0",
     "@types/node": "^24.3.1",
     "@types/supertest": "^6.0.2",
     "@types/ws": "^8.18.1",
-    "@typescript-eslint/eslint-plugin": "^8.18.2",
+    "@typescript-eslint/eslint-plugin": "^8.64.0",
     "@typescript-eslint/parser": "^8.18.2",
     "dataloader": "^2.2.3",
     "depcheck": "^1.4.7",
     "eslint": "^9.35.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.2.1",
-    "graphql": "^16.12.0",
+    "graphql": "^17.0.2",
     "graphql-jit": "^0.8.7",
     "http-server": "^14.1.1",
     "husky": "^9.1.7",
@@ -261,16 +273,19 @@
     "ts-jest": "^29.4.1",
     "tsx": "^4.7.0",
     "typedoc": "^0.28.12",
-    "typedoc-github-theme": "^0.3.1",
-    "typedoc-material-theme": "^1.4.0",
+    "typedoc-github-theme": "^0.4.0",
+    "typedoc-material-theme": "^1.4.1",
     "typedoc-plugin-extras": "^4.0.1",
     "typedoc-plugin-markdown": "^4.8.1",
     "typedoc-theme-hierarchy": "^6.0.0",
     "typescript": "^5.9.2",
     "uWebSockets.js": "github:uNetworking/uWebSockets.js#semver:^v20.52.0",
-    "ws": "^8.18.3",
+    "ws": "^8.21.0",
     "zod": "^4.1.8"
   },
+  "overrides": {
+    "fast-uri": "^3.1.3"
+  },
   "files": [
     "dist/**/*",
     "README.md",