@nifrajs/middleware 0.1.0-alpha.1

package/dist/csrf.js

@@ -0,0 +1,68 @@
+import { base64UrlEncode, hmacSha256, jsonError, parseCookies, SAFE_METHODS, secretBytes, timingSafeEqualString, verifyHmacSha256, } from "./_utils.js";
+const TOKEN_PREFIX = "v1";
+function protectedMethod(method, configured) {
+    return configured !== undefined ? configured.has(method) : !SAFE_METHODS.has(method);
+}
+function originAllowed(req, origins) {
+    const allowed = origins ?? new Set([new URL(req.url).origin]);
+    const origin = req.headers.get("origin");
+    if (origin !== null)
+        return allowed.has(origin);
+    const referer = req.headers.get("referer");
+    if (referer === null)
+        return false;
+    try {
+        return allowed.has(new URL(referer).origin);
+    }
+    catch {
+        return false;
+    }
+}
+export async function createCsrfToken(secret, nonce) {
+    const key = secretBytes(secret, "csrf");
+    const tokenNonce = nonce ?? base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+    if (!/^[A-Za-z0-9_-]{22,}$/.test(tokenNonce)) {
+        throw new Error("csrf: nonce must be base64url-like and at least 22 characters");
+    }
+    const payload = `${TOKEN_PREFIX}.${tokenNonce}`;
+    return `${payload}.${await hmacSha256(payload, key)}`;
+}
+export async function verifyCsrfToken(token, secret) {
+    const key = secretBytes(secret, "csrf");
+    const parts = token.split(".");
+    if (parts.length !== 3 || parts[0] !== TOKEN_PREFIX || parts[1] === "" || parts[2] === "") {
+        return false;
+    }
+    const [prefix, nonce, signature] = parts;
+    return verifyHmacSha256(`${prefix}.${nonce}`, signature, key);
+}
+/**
+ * Signed double-submit CSRF protection. A protected request must carry the same signed token in a
+ * cookie and a header, and must come from an allowed Origin/Referer unless `checkOrigin:false` is set.
+ */
+export function csrf(options) {
+    const key = secretBytes(options.secret, "csrf");
+    const cookie = options.cookie ?? "csrf-token";
+    const header = (options.header ?? "x-csrf-token").toLowerCase();
+    const methods = options.methods !== undefined ? new Set(options.methods.map((m) => m.toUpperCase())) : undefined;
+    const origins = options.origins !== undefined ? new Set(options.origins) : undefined;
+    const checkOrigin = options.checkOrigin !== false;
+    return {
+        name: "csrf",
+        async onRequest(req) {
+            if (!protectedMethod(req.method, methods))
+                return undefined;
+            if (checkOrigin && !originAllowed(req, origins))
+                return jsonError(403, "csrf_failed");
+            const cookieToken = parseCookies(req.headers.get("cookie"))[cookie];
+            const headerToken = req.headers.get(header);
+            if (cookieToken === undefined || headerToken === null)
+                return jsonError(403, "csrf_failed");
+            if (!(await timingSafeEqualString(cookieToken, headerToken))) {
+                return jsonError(403, "csrf_failed");
+            }
+            return (await verifyCsrfToken(cookieToken, key)) ? undefined : jsonError(403, "csrf_failed");
+        },
+    };
+}
+//# sourceMappingURL=csrf.js.map

package/dist/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,UAAU,EACV,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,aAAa,CAAA;AAiBpB,MAAM,YAAY,GAAG,IAAI,CAAA;AAEzB,SAAS,eAAe,CAAC,MAAc,EAAE,UAAmC;IAC1E,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;AACtF,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,OAAgC;IACnE,MAAM,OAAO,GAAG,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAE/C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC1C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAClC,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA2B,EAC3B,KAAc;IAEd,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvC,MAAM,UAAU,GAAG,KAAK,IAAI,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACvF,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAA;IAC/C,OAAO,GAAG,OAAO,IAAI,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAA;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,MAA2B;IAE3B,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1F,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,KAAiC,CAAA;IACpE,OAAO,gBAAgB,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,OAAoB;IACvC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAA;IAC7C,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,WAAW,EAAE,CAAA;IAC/D,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClG,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACpF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,KAAK,CAAA;IAEjD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC3D,IAAI,WAAW,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAErF,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;YACnE,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC3C,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAC3F,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;gBAC7D,OAAO,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YACtC,CAAC;YACD,OAAO,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QAC9F,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/etag.d.ts

@@ -0,0 +1,14 @@
+export interface ETagOptions {
+    /** Emit a weak validator (`W/"…"`). Default `true` — it's a content hash, not a byte-for-byte promise. */
+    readonly weak?: boolean;
+    /** Maximum response bytes to hash. Default `1_000_000`; larger responses pass through unchanged. */
+    readonly maxBytes?: number;
+}
+/**
+ * A {@link definePlugin} plugin that adds a content-hash `ETag` to `GET` `200` responses and returns
+ * **`304 Not Modified`** when the client's `If-None-Match` matches — saving bandwidth on unchanged
+ * responses. It reads and rebuilds small bodies only; larger responses pass through unchanged.
+ * Idempotent.
+ */
+export declare function etag(options?: ETagOptions): import("@nifrajs/core").NifraPlugin<import("@nifrajs/core").AnyServer, import("@nifrajs/core").AnyServer>;
+//# sourceMappingURL=etag.d.ts.map

package/dist/etag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"etag.d.ts","sourceRoot":"","sources":["../src/etag.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,WAAW;IAC1B,0GAA0G;IAC1G,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,6GAsB7C"}

package/dist/etag.js

@@ -0,0 +1,95 @@
+import { definePlugin } from "@nifrajs/core";
+/** 32-bit FNV-1a over bytes → hex. A fast, dependency-free content fingerprint for ETags — not crypto. */
+function fnv1a(bytes) {
+    let h = 0x811c9dc5;
+    for (let i = 0; i < bytes.length; i++) {
+        h ^= bytes[i];
+        h = Math.imul(h, 0x01000193);
+    }
+    return (h >>> 0).toString(16);
+}
+/**
+ * A {@link definePlugin} plugin that adds a content-hash `ETag` to `GET` `200` responses and returns
+ * **`304 Not Modified`** when the client's `If-None-Match` matches — saving bandwidth on unchanged
+ * responses. It reads and rebuilds small bodies only; larger responses pass through unchanged.
+ * Idempotent.
+ */
+export function etag(options = {}) {
+    const prefix = (options.weak ?? true) ? "W/" : "";
+    const maxBytes = options.maxBytes ?? 1_000_000;
+    if (!Number.isInteger(maxBytes) || maxBytes < 0) {
+        throw new Error("etag: maxBytes must be a non-negative integer");
+    }
+    return definePlugin("etag", (app) => app.onResponse(async (res, req) => {
+        if (req.method !== "GET" || res.status !== 200 || res.body === null)
+            return res;
+        const declared = parseLength(res.headers.get("content-length"));
+        if (declared !== undefined && declared > maxBytes)
+            return res;
+        const body = await readBytesCapped(res, maxBytes);
+        if (body === null)
+            return res;
+        const tag = `${prefix}"${fnv1a(body)}"`;
+        const headers = new Headers(res.headers);
+        headers.set("ETag", tag);
+        if (matchesIfNoneMatch(req.headers.get("if-none-match"), tag)) {
+            return new Response(null, { status: 304, headers });
+        }
+        return new Response(body, { status: res.status, statusText: res.statusText, headers });
+    }));
+}
+function matchesIfNoneMatch(value, tag) {
+    if (value === null)
+        return false;
+    const normalizedTag = weakComparableTag(tag);
+    for (const part of value.split(",")) {
+        const candidate = part.trim();
+        if (candidate === "*")
+            return true;
+        if (weakComparableTag(candidate) === normalizedTag)
+            return true;
+    }
+    return false;
+}
+function weakComparableTag(tag) {
+    return tag.startsWith("W/") ? tag.slice(2) : tag;
+}
+function parseLength(value) {
+    if (value === null)
+        return undefined;
+    if (!/^(?:0|[1-9]\d*)$/.test(value))
+        return undefined;
+    return Number(value);
+}
+async function readBytesCapped(res, maxBytes) {
+    const body = res.clone().body;
+    if (body === null)
+        return new Uint8Array();
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done) {
+                const out = new Uint8Array(total);
+                let offset = 0;
+                for (const chunk of chunks) {
+                    out.set(chunk, offset);
+                    offset += chunk.byteLength;
+                }
+                return out;
+            }
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                return null;
+            }
+            chunks.push(value);
+        }
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=etag.js.map

package/dist/etag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"etag.js","sourceRoot":"","sources":["../src/etag.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C,0GAA0G;AAC1G,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,CAAC,GAAG,UAAU,CAAA;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAA;QACd,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;AAC/B,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,IAAI,CAAC,UAAuB,EAAE;IAC5C,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAClC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,GAAG,CAAA;QAC/E,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;QAC/D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,QAAQ;YAAE,OAAO,GAAG,CAAA;QAC7D,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,GAAG,CAAA;QAC7B,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAA;QACvC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACxB,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QACrD,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IACxF,CAAC,CAAC,CACH,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAoB,EAAE,GAAW;IAC3D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAChC,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QAClC,IAAI,iBAAiB,CAAC,SAAS,CAAC,KAAK,aAAa;YAAE,OAAO,IAAI,CAAA;IACjE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACrD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAa,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAA;IAC7B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,UAAU,EAAE,CAAA;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;gBACjC,IAAI,MAAM,GAAG,CAAC,CAAA;gBACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;oBACtB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;gBAC5B,CAAC;gBACD,OAAO,GAAG,CAAA;YACZ,CAAC;YACD,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;YACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;gBACrB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/healthcheck.d.ts

@@ -0,0 +1,25 @@
+type MaybePromise<T> = T | Promise<T>;
+export interface HealthcheckOptions {
+    /** Liveness path — always `200` while the process is up. Default `"/health"`. */
+    readonly path?: string;
+    /** Readiness path — runs `checks`; `200` if all pass, `503` otherwise. Default `"/ready"`. */
+    readyPath?: string;
+    /** Readiness checks (DB ping, cache reachable, …). Each returns a boolean or throws; a throw counts
+     * as failing. `/ready` reports each by name and is `200` only when all pass. */
+    readonly checks?: Readonly<Record<string, () => MaybePromise<boolean>>>;
+}
+/**
+ * Register **liveness** (`/health`) and **readiness** (`/ready`) endpoints. Liveness is a flat `200`
+ * (the process is serving). Readiness runs each `check` and returns `200 { status: "ok", checks }`
+ * when all pass, or `503 { status: "error", checks }` when any fail (a thrown check counts as failed).
+ * Both are `Cache-Control: no-store`.
+ *
+ * Apply it **before** auth guards so the endpoints stay public (`beforeHandle` is order-scoped):
+ *
+ * ```ts
+ * app.use(healthcheck({ checks: { db: () => db.ping() } })).use(bearer({ verify }))
+ * ```
+ */
+export declare function healthcheck(options?: HealthcheckOptions): import("@nifrajs/core").NifraPlugin<import("@nifrajs/core").AnyServer, import("@nifrajs/core").AnyServer>;
+export {};
+//# sourceMappingURL=healthcheck.d.ts.map

package/dist/healthcheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"healthcheck.d.ts","sourceRoot":"","sources":["../src/healthcheck.ts"],"names":[],"mappings":"AAEA,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAErC,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;oFACgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;CACxE;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,6GA8B3D"}

package/dist/healthcheck.js

@@ -0,0 +1,41 @@
+import { definePlugin } from "@nifrajs/core";
+const noStore = { "cache-control": "no-store" };
+/**
+ * Register **liveness** (`/health`) and **readiness** (`/ready`) endpoints. Liveness is a flat `200`
+ * (the process is serving). Readiness runs each `check` and returns `200 { status: "ok", checks }`
+ * when all pass, or `503 { status: "error", checks }` when any fail (a thrown check counts as failed).
+ * Both are `Cache-Control: no-store`.
+ *
+ * Apply it **before** auth guards so the endpoints stay public (`beforeHandle` is order-scoped):
+ *
+ * ```ts
+ * app.use(healthcheck({ checks: { db: () => db.ping() } })).use(bearer({ verify }))
+ * ```
+ */
+export function healthcheck(options = {}) {
+    const path = options.path ?? "/health";
+    const readyPath = options.readyPath ?? "/ready";
+    const checks = options.checks ?? {};
+    const checkNames = Object.keys(checks);
+    return definePlugin("healthcheck", (app) => {
+        app.register("GET", path, undefined, () => Response.json({ status: "ok" }, { headers: noStore }));
+        app.register("GET", readyPath, undefined, async () => {
+            const results = {};
+            let ready = true;
+            // Run checks concurrently; a throw (or false) marks that check — and the whole probe — not ready.
+            await Promise.all(checkNames.map(async (name) => {
+                try {
+                    results[name] = (await checks[name]?.()) === true;
+                }
+                catch {
+                    results[name] = false;
+                }
+                if (!results[name])
+                    ready = false;
+            }));
+            return Response.json({ status: ready ? "ok" : "error", checks: results }, { status: ready ? 200 : 503, headers: noStore });
+        });
+        return app;
+    });
+}
+//# sourceMappingURL=healthcheck.js.map

package/dist/healthcheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"healthcheck.js","sourceRoot":"","sources":["../src/healthcheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAc5C,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAW,CAAA;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,UAA8B,EAAE;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAA;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAA;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IACnC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtC,OAAO,YAAY,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE;QACzC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CACtD,CAAA;QACD,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,OAAO,GAA4B,EAAE,CAAA;YAC3C,IAAI,KAAK,GAAG,IAAI,CAAA;YAChB,kGAAkG;YAClG,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC5B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAA;gBACnD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;gBACvB,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;oBAAE,KAAK,GAAG,KAAK,CAAA;YACnC,CAAC,CAAC,CACH,CAAA;YACD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EACnD,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAChD,CAAA;QACH,CAAC,CAAC,CAAA;QACF,OAAO,GAAG,CAAA;IACZ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/idempotency.d.ts

@@ -0,0 +1,83 @@
+import type { Middleware } from "@nifrajs/core";
+/**
+ * Idempotency keys for unsafe requests — a client retrying a `POST` (dropped connection, impatient
+ * tap) with the same `Idempotency-Key` gets the **first** response replayed instead of the side effect
+ * running twice (double-charge, double-publish). Runs in `onRequest` (before the handler), so a replay
+ * or an in-flight collision short-circuits before any mutation.
+ *
+ * Pair it with a DB uniqueness constraint — this stops the *retry*, the constraint is the source of
+ * truth for genuinely-concurrent distinct requests. Production MUST use a shared {@link IdempotencyStore}
+ * (Redis, etc.) so the guarantee holds across instances; {@link MemoryIdempotencyStore} is dev-only.
+ */
+/** A captured response, replayed verbatim on a retry. Body is base64 (binary-safe + JSON-serializable). */
+export interface IdempotencyRecord {
+    readonly status: number;
+    /** Response headers, **excluding `Set-Cookie`** (cookies are session-specific — see {@link idempotency}). */
+    readonly headers: ReadonlyArray<readonly [string, string]>;
+    /** Response body, base64-encoded. */
+    readonly body: string;
+}
+export type IdempotencyClaim = {
+    readonly state: "new";
+} | {
+    readonly state: "in_flight";
+} | {
+    readonly state: "replay";
+    readonly record: IdempotencyRecord;
+};
+/**
+ * Store backing the idempotency guarantee. Production deploys MUST use a shared store so the key holds
+ * across instances; `begin` MUST be **atomic** (e.g. Redis `SET key NX PX lockTtlMs`) or two concurrent
+ * retries can both see `"new"`. {@link MemoryIdempotencyStore} is for dev / single-instance only.
+ */
+export interface IdempotencyStore {
+    /**
+     * Atomically claim `key`: `"replay"` if a completed response is stored, `"in_flight"` if another
+     * request holds the lock, else `"new"` (the caller now owns the lock and must `complete`/`release`).
+     * The in-flight lock expires after `lockTtlMs` so a crashed handler can't wedge the key forever.
+     */
+    begin(key: string, lockTtlMs: number): Promise<IdempotencyClaim>;
+    /** Store the completed response and release the lock (kept for `ttlMs`). */
+    complete(key: string, record: IdempotencyRecord, ttlMs: number): Promise<void>;
+    /** Release the lock without storing (handler errored / response not cacheable). */
+    release(key: string): Promise<void>;
+}
+export interface MemoryIdempotencyStoreOptions {
+    /** Allow the in-memory store in production. Off by default — a per-instance store can't dedupe across instances. */
+    readonly allowInProduction?: boolean;
+}
+/** In-process store. Refuses to run in production unless explicitly allowed (per-instance ⇒ no cross-instance dedupe). */
+export declare class MemoryIdempotencyStore implements IdempotencyStore {
+    private readonly entries;
+    constructor(options?: MemoryIdempotencyStoreOptions);
+    begin(key: string, lockTtlMs: number): Promise<IdempotencyClaim>;
+    complete(key: string, record: IdempotencyRecord, ttlMs: number): Promise<void>;
+    release(key: string): Promise<void>;
+}
+export interface IdempotencyOptions {
+    /** Where claims + cached responses live. `MemoryIdempotencyStore` for dev; a shared store in production. */
+    readonly store: IdempotencyStore;
+    /** Header carrying the key. Default `"idempotency-key"`. */
+    readonly header?: string;
+    /** Methods the guard applies to. Default `["POST", "PUT", "PATCH", "DELETE"]` (unsafe methods). */
+    readonly methods?: readonly string[];
+    /** How long a completed response is replayable, in ms. Default 24h. */
+    readonly ttlMs?: number;
+    /** How long the in-flight lock survives a crashed handler, in ms. Default 60s. */
+    readonly lockTtlMs?: number;
+    /** Max response bytes to cache. A larger response is returned but **not** stored. Default 1 MiB. */
+    readonly maxBytes?: number;
+    /** Whether a response should be cached for replay. Default: status `< 500` (don't replay transient 5xx). */
+    readonly shouldCache?: (response: Response) => boolean;
+}
+/**
+ * Idempotency-key middleware. Apply with `app.use(idempotency({ store }))`.
+ *
+ * **`Set-Cookie` is intentionally not cached or replayed** — a cookie set on the first request is
+ * session-specific, so replaying it to a different caller (key collision or abuse) would leak/fixate a
+ * session. Cache the body + status + the rest of the headers; let auth cookies re-issue per request.
+ *
+ * Caching buffers the response body, so apply this to JSON/API routes, not streaming SSR responses.
+ */
+export declare function idempotency(options: IdempotencyOptions): Middleware;
+//# sourceMappingURL=idempotency.d.ts.map

package/dist/idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../src/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAE/C;;;;;;;;;GASG;AAEH,2GAA2G;AAC3G,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,6GAA6G;IAC7G,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC1D,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAA;AAEpE;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAChE,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9E,mFAAmF;IACnF,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpC;AAED,MAAM,WAAW,6BAA6B;IAC5C,oHAAoH;IACpH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CACrC;AAMD,0HAA0H;AAC1H,qBAAa,sBAAuB,YAAW,gBAAgB;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;gBAEvC,OAAO,GAAE,6BAAkC;IASvD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAehE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9E,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKpC;AAED,MAAM,WAAW,kBAAkB;IACjC,4GAA4G;IAC5G,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,mGAAmG;IACnG,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,4GAA4G;IAC5G,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAA;CACvD;AAuID;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,UAAU,CA2DnE"}

package/dist/idempotency.js

@@ -0,0 +1,217 @@
+/** In-process store. Refuses to run in production unless explicitly allowed (per-instance ⇒ no cross-instance dedupe). */
+export class MemoryIdempotencyStore {
+    entries = new Map();
+    constructor(options = {}) {
+        if (options.allowInProduction !== true && process.env.NODE_ENV === "production") {
+            throw new Error("MemoryIdempotencyStore is per-instance and can't dedupe across instances in production. " +
+                "Use a shared store (e.g. Redis), or pass { allowInProduction: true } for a single-instance deploy.");
+        }
+    }
+    begin(key, lockTtlMs) {
+        const now = Date.now();
+        const entry = this.entries.get(key);
+        if (entry !== undefined && entry.expiresAt > now) {
+            return Promise.resolve(entry.kind === "record"
+                ? { state: "replay", record: entry.record }
+                : { state: "in_flight" });
+        }
+        // Free (or expired): take the lock. Synchronous Map write ⇒ atomic on a single instance.
+        this.entries.set(key, { kind: "lock", expiresAt: now + lockTtlMs });
+        return Promise.resolve({ state: "new" });
+    }
+    complete(key, record, ttlMs) {
+        this.entries.set(key, { kind: "record", record, expiresAt: Date.now() + ttlMs });
+        return Promise.resolve();
+    }
+    release(key) {
+        const entry = this.entries.get(key);
+        if (entry !== undefined && entry.kind === "lock")
+            this.entries.delete(key);
+        return Promise.resolve();
+    }
+}
+const DEFAULT_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
+const DAY_MS = 24 * 60 * 60 * 1000;
+const toBase64 = (bytes) => {
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin);
+};
+const fromBase64 = (value) => {
+    const bin = atob(value);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+};
+// 204/205/304 (and an empty body) must be constructed with a `null` body or the Response ctor throws.
+const bodyFor = (bytes) => (bytes.byteLength === 0 ? null : bytes);
+const concat = (chunks, total) => {
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return out;
+};
+function parseLength(value) {
+    if (value === null)
+        return undefined;
+    if (!/^(?:0|[1-9]\d*)$/.test(value))
+        return undefined;
+    return Number(value);
+}
+function responseWithBody(res, body) {
+    return new Response(body, {
+        status: res.status,
+        statusText: res.statusText,
+        headers: res.headers,
+    });
+}
+function replayBufferedBody(reader, buffered) {
+    let index = 0;
+    let released = false;
+    const release = () => {
+        if (!released) {
+            released = true;
+            reader.releaseLock();
+        }
+    };
+    return new ReadableStream({
+        async pull(controller) {
+            if (index < buffered.length) {
+                controller.enqueue(buffered[index]);
+                index += 1;
+                return;
+            }
+            try {
+                const { done, value } = await reader.read();
+                if (done) {
+                    release();
+                    controller.close();
+                }
+                else {
+                    controller.enqueue(value);
+                }
+            }
+            catch (err) {
+                release();
+                controller.error(err);
+            }
+        },
+        cancel(reason) {
+            return reader.cancel(reason).finally(release);
+        },
+    });
+}
+async function captureBody(res, maxBytes) {
+    const declared = parseLength(res.headers.get("content-length"));
+    if (declared !== undefined && declared > maxBytes)
+        return { response: res };
+    const body = res.body;
+    if (body === null)
+        return { bytes: new Uint8Array(), response: responseWithBody(res, null) };
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done) {
+                reader.releaseLock();
+                const bytes = concat(chunks, total);
+                return { bytes, response: responseWithBody(res, bodyFor(bytes)) };
+            }
+            chunks.push(value);
+            total += value.byteLength;
+            if (total > maxBytes) {
+                return { response: responseWithBody(res, replayBufferedBody(reader, chunks)) };
+            }
+        }
+    }
+    catch (err) {
+        reader.releaseLock();
+        throw err;
+    }
+}
+function replay(record) {
+    const headers = new Headers(record.headers);
+    headers.set("idempotent-replayed", "true");
+    return new Response(bodyFor(fromBase64(record.body)), { status: record.status, headers });
+}
+/**
+ * Idempotency-key middleware. Apply with `app.use(idempotency({ store }))`.
+ *
+ * **`Set-Cookie` is intentionally not cached or replayed** — a cookie set on the first request is
+ * session-specific, so replaying it to a different caller (key collision or abuse) would leak/fixate a
+ * session. Cache the body + status + the rest of the headers; let auth cookies re-issue per request.
+ *
+ * Caching buffers the response body, so apply this to JSON/API routes, not streaming SSR responses.
+ */
+export function idempotency(options) {
+    const { store } = options;
+    const header = (options.header ?? "idempotency-key").toLowerCase();
+    const methods = new Set((options.methods ?? DEFAULT_METHODS).map((m) => m.toUpperCase()));
+    const ttlMs = options.ttlMs ?? DAY_MS;
+    const lockTtlMs = options.lockTtlMs ?? 60_000;
+    const maxBytes = options.maxBytes ?? 1024 * 1024;
+    if (!Number.isInteger(maxBytes) || maxBytes < 0) {
+        throw new Error("idempotency: maxBytes must be a non-negative integer");
+    }
+    const shouldCache = options.shouldCache ?? ((res) => res.status < 500);
+    const claimed = new WeakMap();
+    return {
+        name: "idempotency",
+        async onRequest(req) {
+            if (!methods.has(req.method))
+                return undefined;
+            const key = req.headers.get(header);
+            if (key === null || key === "")
+                return undefined; // opt-in per request — no key ⇒ no dedupe
+            const claim = await store.begin(key, lockTtlMs);
+            if (claim.state === "replay")
+                return replay(claim.record);
+            if (claim.state === "in_flight") {
+                return new Response(JSON.stringify({ ok: false, error: "idempotency_in_progress" }), {
+                    status: 409,
+                    headers: {
+                        "content-type": "application/json",
+                        "retry-after": String(Math.ceil(lockTtlMs / 1000)),
+                    },
+                });
+            }
+            claimed.set(req, key);
+            return undefined;
+        },
+        async onResponse(res, req) {
+            const key = claimed.get(req);
+            if (key === undefined)
+                return res; // not a claimed request (safe method / no key / a replay)
+            claimed.delete(req);
+            if (!shouldCache(res)) {
+                await store.release(key);
+                return res;
+            }
+            // Buffer the body (consumes `res`), so a fresh Response is returned in its place.
+            let captured;
+            try {
+                captured = await captureBody(res, maxBytes);
+            }
+            catch (err) {
+                await store.release(key);
+                throw err;
+            }
+            if (!("bytes" in captured)) {
+                await store.release(key); // too large to store — return it, but don't cache
+                return captured.response;
+            }
+            const bytes = captured.bytes;
+            const headers = [...captured.response.headers].filter(([name]) => name !== "set-cookie");
+            await store.complete(key, { status: res.status, headers, body: toBase64(bytes) }, ttlMs);
+            return captured.response;
+        },
+    };
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../src/idempotency.ts"],"names":[],"mappings":"AAsDA,0HAA0H;AAC1H,MAAM,OAAO,sBAAsB;IAChB,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAA;IAEnD,YAAY,UAAyC,EAAE;QACrD,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CACb,0FAA0F;gBACxF,oGAAoG,CACvG,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,SAAiB;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC,OAAO,CACpB,KAAK,CAAC,IAAI,KAAK,QAAQ;gBACrB,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;gBAC3C,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAC3B,CAAA;QACH,CAAC;QACD,yFAAyF;QACzF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,SAAS,EAAE,CAAC,CAAA;QACnE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,QAAQ,CAAC,GAAW,EAAE,MAAyB,EAAE,KAAa;QAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;QAChF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC1E,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;CACF;AAmBD,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAA;AACnE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAElC,MAAM,QAAQ,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC7C,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACpD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,KAAa,EAAc,EAAE;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC/D,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,sGAAsG;AACtG,MAAM,OAAO,GAAG,CAAC,KAAiB,EAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AAWjG,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAE,KAAa,EAAc,EAAE;IAC1E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,SAAS,WAAW,CAAC,KAAoB;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACrD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAa,EACb,IAAoD;IAEpD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAkB,EAClB,QAA+B;IAE/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,IAAI,CAAA;YACf,MAAM,CAAC,WAAW,EAAE,CAAA;QACtB,CAAC;IACH,CAAC,CAAA;IACD,OAAO,IAAI,cAAc,CAAa;QACpC,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC5B,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAE,CAAC,CAAA;gBACpC,KAAK,IAAI,CAAC,CAAA;gBACV,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBAC3C,IAAI,IAAI,EAAE,CAAC;oBACT,OAAO,EAAE,CAAA;oBACT,UAAU,CAAC,KAAK,EAAE,CAAA;gBACpB,CAAC;qBAAM,CAAC;oBACN,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBAC3B,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CAAA;gBACT,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvB,CAAC;QACH,CAAC;QACD,MAAM,CAAC,MAAM;YACX,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC/C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAa,EACb,QAAgB;IAIhB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAC/D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAA;IAC3E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAA;IAE5F,MAAM,MAAM,GAAe,IAAI,CAAC,SAAS,EAAE,CAAA;IAC3C,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,CAAC,WAAW,EAAE,CAAA;gBACpB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;gBACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;YACnE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;YACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAA;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,WAAW,EAAE,CAAA;QACpB,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAyB;IACvC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,OAAkC,CAAC,CAAA;IACtE,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IAC1C,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,OAA2B;IACrD,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAA;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACzF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAA;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAA;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,GAAG,IAAI,CAAA;IAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,GAAa,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,IAAI,OAAO,EAAmB,CAAA;IAE9C,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACnC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAA,CAAC,0CAA0C;YAC3F,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YAC/C,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACzD,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,EAAE;oBACnF,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;qBACnD;iBACF,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACrB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG;YACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC5B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAA,CAAC,0DAA0D;YAC5F,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACnB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACxB,OAAO,GAAG,CAAA;YACZ,CAAC;YACD,kFAAkF;YAClF,IAAI,QAAiD,CAAA;YACrD,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACxB,MAAM,GAAG,CAAA;YACX,CAAC;YACD,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;gBAC3B,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA,CAAC,kDAAkD;gBAC3E,OAAO,QAAQ,CAAC,QAAQ,CAAA;YAC1B,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;YAC5B,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,YAAY,CAAC,CAAA;YACxF,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YACxF,OAAO,QAAQ,CAAC,QAAQ,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * `@nifrajs/middleware` — composable, dependency-free middleware + plugins applied via `app.use()`.
+ * The hardening set (`cors`, `rateLimit`, `securityHeaders`) returns a `@nifrajs/core` `Middleware`
+ * (a hook bundle, context-agnostic). The seeded plugins (`requestId`, `logger`, `etag`, `bearer`,
+ * `apiKey`) use the `definePlugin` convention — named (idempotent dedupe), and `requestId` threads
+ * `c.requestId` into the handler context.
+ */
+export { type BasicAuthPlugin, type BasicAuthStaticOptions, type BasicAuthVerifyOptions, basicAuth, } from "./basic-auth.js";
+export { type BodyLimitOptions, bodyLimit } from "./body-limit.js";
+export { type CachedResponse, type CacheOptions, cache, MemoryResponseCache, type MemoryResponseCacheOptions, type ResponseCacheStore, responseCache, } from "./cache.js";
+export { type CacheControlOptions, cacheControl } from "./cache-control.js";
+export { type Composable, combine, namedCombine } from "./combine.js";
+export { type CompressionOptions, compression } from "./compression.js";
+export { type CorsOptions, cors } from "./cors.js";
+export { type CsrfOptions, createCsrfToken, csrf, verifyCsrfToken, } from "./csrf.js";
+export { type ETagOptions, etag } from "./etag.js";
+export { type HealthcheckOptions, healthcheck } from "./healthcheck.js";
+export { type IdempotencyClaim, type IdempotencyOptions, type IdempotencyRecord, type IdempotencyStore, idempotency, MemoryIdempotencyStore, type MemoryIdempotencyStoreOptions, } from "./idempotency.js";
+export { type IpMatcher, type IpRestrictionOptions, ipRestriction } from "./ip-restriction.js";
+export { type JwkKey, type JwksOptions, type JwtAlgorithm, type JwtClaims, type JwtHeader, type JwtKeyResolver, type JwtOptions, type JwtPlugin, type JwtVerificationKey, jwk, jwks, jwt, tryVerifyJwt, type VerifiedJwt, type VerifyJwtOptions, type VerifyJwtResult, verifyJwt, } from "./jwt.js";
+export { type LanguageMatch, type LanguageOptions, language, pickLanguage, } from "./language.js";
+export { type LoggerOptions, logger, type RequestLogFields } from "./logger.js";
+export { type MethodOverrideOptions, methodOverride } from "./method-override.js";
+export { buildOpenApiDocument, type OpenApiInfo, type OpenApiOptions, type OpenApiServer, type OpenApiTag, type OpenApiUiOptions, openapi, type RouteLike, type SecurityRequirement, } from "./openapi.js";
+export { type PoweredByOptions, poweredBy } from "./powered-by.js";
+export { type PrettyJsonOptions, prettyJson } from "./pretty-json.js";
+export { MemoryStore, type MemoryStoreOptions, type RateLimitOptions, type RateLimitResult, type RateLimitStore, rateLimit, } from "./rate-limit.js";
+export { type RequestIdOptions, requestId } from "./request-id.js";
+export { type SecurityHeadersOptions, securityHeaders } from "./security-headers.js";
+export { type TimingControls, type TimingMetric, type TimingOptions, timing } from "./timing.js";
+export { type ApiKeyStaticOptions, type ApiKeyVerifyOptions, type AuthPlugin, apiKey, type BearerOptions, bearer, } from "./token-auth.js";
+export { appendTrailingSlash, type TrailingSlashOptions, trimTrailingSlash, } from "./trailing-slash.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,SAAS,GACV,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAClE,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,aAAa,GACd,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,KAAK,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACrE,OAAO,EAAE,KAAK,kBAAkB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACvE,OAAO,EAAE,KAAK,WAAW,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EACL,KAAK,WAAW,EAChB,eAAe,EACf,IAAI,EACJ,eAAe,GAChB,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,KAAK,WAAW,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,KAAK,kBAAkB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACvE,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,WAAW,EACX,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,oBAAoB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EACL,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,GAAG,EACH,IAAI,EACJ,GAAG,EACH,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,SAAS,GACV,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,QAAQ,EACR,YAAY,GACb,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,KAAK,qBAAqB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACjF,OAAO,EACL,oBAAoB,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,OAAO,EACP,KAAK,SAAS,EACd,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAAE,KAAK,iBAAiB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,SAAS,GACV,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAAE,KAAK,sBAAsB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACpF,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAChG,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,MAAM,EACN,KAAK,aAAa,EAClB,MAAM,GACP,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,iBAAiB,GAClB,MAAM,qBAAqB,CAAA"}