tsoa

node_modules/@hapi/accept/LICENSE.md

@@ -0,0 +1,12 @@
+Copyright (c) 2014-2022, Project contributors
+Copyright (c) 2014-2020, Sideway Inc
+Copyright (c) 2015-2016, Mark Bradshaw
+Copyright (c) 2014, Walmart.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS OFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/accept/README.md

@@ -0,0 +1,17 @@
+<a href="https://hapi.dev"><img src="https://raw.githubusercontent.com/hapijs/assets/master/images/family.png" width="180px" align="right" /></a>
+
+# @hapi/accept
+
+#### HTTP Accept-* headers parsing.
+
+**accept** is part of the **hapi** ecosystem and was designed to work seamlessly with the [hapi web framework](https://hapi.dev) and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out [hapi](https://hapi.dev) – they work even better together.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/family/accept/)
+- [Version status](https://hapi.dev/resources/status/#accept) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/family/accept/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Free and commercial support options](https://hapi.dev/support/)

node_modules/@hapi/accept/lib/header.js

@@ -0,0 +1,232 @@
+'use strict';
+
+const Hoek = require('@hapi/hoek');
+const Boom = require('@hapi/boom');
+
+
+const internals = {};
+
+
+exports.selection = function (header, preferences, options) {
+
+    const selections = exports.selections(header, preferences, options);
+    return selections.length ? selections[0] : '';
+};
+
+
+exports.selections = function (header, preferences, options) {
+
+    Hoek.assert(!preferences || Array.isArray(preferences), 'Preferences must be an array');
+
+    return internals.parse(header || '', preferences, options);
+};
+
+
+//      RFC 7231 Section 5.3.3 (https://tools.ietf.org/html/rfc7231#section-5.3.3)
+//
+//      Accept-Charset  = *( "," OWS ) ( ( charset / "*" ) [ weight ] ) *( OWS "," [ OWS ( ( charset / "*" ) [ weight ] ) ] )
+//      charset         = token
+//
+//      Accept-Charset: iso-8859-5, unicode-1-1;q=0.8
+
+
+//      RFC 7231 Section 5.3.4 (https://tools.ietf.org/html/rfc7231#section-5.3.4)
+//
+//      Accept-Encoding = [ ( "," / ( codings [ weight ] ) ) *( OWS "," [ OWS ( codings [ weight ] ) ] ) ]
+//      codings         = content-coding / "identity" / "*"
+//      content-coding  = token
+//
+//      Accept-Encoding: compress, gzip
+//      Accept-Encoding:
+//      Accept-Encoding: *
+//      Accept-Encoding: compress;q=0.5, gzip;q=1.0
+//      Accept-Encoding: gzip;q=1.0, identity; q=0.5, *;q=0
+
+
+//      RFC 7231 Section 5.3.5 (https://tools.ietf.org/html/rfc7231#section-5.3.5)
+//
+//      Accept-Language = *( "," OWS ) ( language-range [ weight ] ) *( OWS "," [ OWS ( language-range [ weight ] ) ] )
+//      language-range  = ( 1*8ALPHA *( "-" 1*8alphanum ) ) / "*"   ; [RFC4647], Section 2.1
+//      alphanum        = ALPHA / DIGIT
+//
+//       Accept-Language: da, en-gb;q=0.8, en;q=0.7
+
+
+//      token           = 1*tchar
+//      tchar           = "!" / "#" / "$" / "%" / "&" / "'" / "*"
+//                        / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~"
+//                        / DIGIT / ALPHA
+//                        ; any VCHAR, except delimiters
+//      OWS             = *( SP / HTAB )
+
+
+//      RFC 7231 Section 5.3.1 (https://tools.ietf.org/html/rfc7231#section-5.3.1)
+//
+//      The weight is normalized to a real number in the range 0 through 1,
+//      where 0.001 is the least preferred and 1 is the most preferred; a
+//      value of 0 means "not acceptable".  If no "q" parameter is present,
+//      the default weight is 1.
+//
+//       weight = OWS ";" OWS "q=" qvalue
+//       qvalue = ( "0" [ "." 0*3DIGIT ] ) / ( "1" [ "." 0*3("0") ] )
+
+
+internals.parse = function (raw, preferences, options) {
+
+    // Normalize header (remove spaces and tabs)
+
+    const header = raw.replace(/[ \t]/g, '');
+
+    // Normalize preferences
+
+    const lowers = new Map();
+    if (preferences) {
+        let pos = 0;
+        for (const preference of preferences) {
+            const lower = preference.toLowerCase();
+            lowers.set(lower, { orig: preference, pos: pos++ });
+
+            if (options.prefixMatch) {
+                const parts = lower.split('-');
+                while (parts.pop(), parts.length > 0) {
+                    const joined = parts.join('-');
+                    if (!lowers.has(joined)) {
+                        lowers.set(joined, { orig: preference, pos: pos++ });
+                    }
+                }
+            }
+        }
+    }
+
+    // Parse selections
+
+    const parts = header.split(',');
+    const selections = [];
+    const map = new Set();
+
+    for (let i = 0; i < parts.length; ++i) {
+        const part = parts[i];
+        if (!part) {                            // Ignore empty parts or leading commas
+            continue;
+        }
+
+        // Parse parameters
+
+        const params = part.split(';');
+        if (params.length > 2) {
+            throw Boom.badRequest(`Invalid ${options.type} header`);
+        }
+
+        let token = params[0].toLowerCase();
+        if (!token) {
+            throw Boom.badRequest(`Invalid ${options.type} header`);
+        }
+
+        if (options.equivalents?.has(token)) {
+            token = options.equivalents.get(token);
+        }
+
+        const selection = {
+            token,
+            pos: i,
+            q: 1
+        };
+
+        if (preferences &&
+            lowers.has(token)) {
+
+            selection.pref = lowers.get(token).pos;
+        }
+
+        map.add(selection.token);
+
+        // Parse q=value
+
+        if (params.length === 2) {
+            const q = params[1];
+            const [key, value] = q.split('=');
+
+            if (!value ||
+                key !== 'q' && key !== 'Q') {
+
+                throw Boom.badRequest(`Invalid ${options.type} header`);
+            }
+
+            const score = parseFloat(value);
+            if (score === 0) {
+                continue;
+            }
+
+            if (Number.isFinite(score) &&
+                score <= 1 &&
+                score >= 0.001) {
+
+                selection.q = score;
+            }
+        }
+
+        selections.push(selection);             // Only add allowed selections (q !== 0)
+    }
+
+    // Sort selection based on q and then position in header
+
+    selections.sort(internals.sort);
+
+    // Extract tokens
+
+    const values = selections.map((selection) => selection.token);
+
+    if (options.default &&
+        !map.has(options.default)) {
+
+        values.push(options.default);
+    }
+
+    if (!preferences?.length) {
+        return values;
+    }
+
+    const preferred = [];
+    for (const selection of values) {
+        if (selection === '*') {
+            for (const [preference, value] of lowers) {
+                if (!map.has(preference)) {
+                    preferred.push(value.orig);
+                }
+            }
+        }
+        else {
+            const lower = selection.toLowerCase();
+            if (lowers.has(lower)) {
+                preferred.push(lowers.get(lower).orig);
+            }
+        }
+    }
+
+    return preferred;
+};
+
+
+internals.sort = function (a, b) {
+
+    const aFirst = -1;
+    const bFirst = 1;
+
+    if (b.q !== a.q) {
+        return b.q - a.q;
+    }
+
+    if (b.pref !== a.pref) {
+        if (a.pref === undefined) {
+            return bFirst;
+        }
+
+        if (b.pref === undefined) {
+            return aFirst;
+        }
+
+        return a.pref - b.pref;
+    }
+
+    return a.pos - b.pos;
+};

node_modules/@hapi/accept/lib/index.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Identifies the best character-set for an HTTP response based on the HTTP request Accept-Charset header.
+ * 
+ * @param header - the HTTP Accept-Charset header content.
+ * @param preferences - an optional array of character-set strings in order of server preference.
+ * 
+ * @return a string with the preferred accepted character-set.
+ */
+export function charset(header?: string, preferences?: readonly string[]): string;
+
+
+/**
+ * Sorts the character-sets in the HTTP request Accept-Charset header based on client preference from most to least desired.
+ *
+ * @param header - the HTTP Accept-Charset header content.
+ *
+ * @return an array of strings of character-sets sorted from the most to the least desired.
+ */
+export function charsets(header?: string): string[];
+
+
+/**
+ * Identifies the best encoding for an HTTP response based on the HTTP request Accept-Encoding header.
+ *
+ * @param header - the HTTP Accept-Encoding header content.
+ * @param preferences - an optional array of encoding strings in order of server preference.
+ *
+ * @return a string with the preferred accepted encoding.
+ */
+export function encoding(header?: string, preferences?: readonly string[]): string;
+
+
+/**
+ * Sorts the encodings in the HTTP request Accept-Encoding header based on client preference from most to least desired.
+ *
+ * @param header - the HTTP Accept-Encoding header content.
+ *
+ * @return an array of strings of encodings sorted from the most to the least desired.
+ */
+export function encodings(header?: string): string[];
+
+
+/**
+ * Identifies the best language for an HTTP response based on the HTTP request Accept-Language header.
+ *
+ * @param header - the HTTP Accept-Language header content.
+ * @param preferences - an optional array of language strings in order of server preference.
+ *
+ * @return a string with the preferred accepted language.
+ */
+export function language(header?: string, preferences?: readonly string[]): string;
+
+
+/**
+ * Sorts the languages in the HTTP request Accept-Language header based on client preference from most to least desired.
+ *
+ * @param header - the HTTP Accept-Language header content.
+ *
+ * @return an array of strings of languages sorted from the most to the least desired.
+ */
+export function languages(header?: string): string[];
+
+
+/**
+ * Identifies the best media-type for an HTTP response based on the HTTP request Accept header.
+ *
+ * @param header - the HTTP Accept header content.
+ * @param preferences - an optional array of media-type strings in order of server preference.
+ *
+ * @return a string with the preferred accepted media-type.
+ */
+export function mediaType(header?: string, preferences?: readonly string[]): string;
+
+
+/**
+ * Sorts the media-types in the HTTP request Accept header based on client preference from most to least desired.
+ *
+ * @param header - the HTTP Accept header content.
+ * @param preferences - an optional array of media-type strings in order of server preference.
+ *
+ * @return an array of strings of media-types sorted from the most to the least desired.
+ */
+export function mediaTypes(header?: string, preferences?: readonly string[]): string[];
+
+
+/**
+ * Parses the Accept-* headers of an HTTP request and returns an array of client preferences for each header.
+ * 
+ * @param headers - the HTTP request headers object.
+ * 
+ * @return an object with a key for each accept header result.
+ */
+export function parseAll(headers: parseAll.Headers): parseAll.Result;
+
+export namespace parseAll {
+
+    interface Headers {
+
+        readonly 'accept-charset'?: string;
+        readonly 'accept-encoding'?: string;
+        readonly 'accept-language'?: string;
+        readonly accept?: string;
+
+        readonly [header: string]: any;
+    }
+
+    interface Result {
+
+        charsets: string[];
+        encodings: string[];
+        languages: string[];
+        mediaTypes: string[];
+    }
+}

node_modules/@hapi/accept/lib/index.js

@@ -0,0 +1,48 @@
+'use strict';
+
+const Header = require('./header');
+const Media = require('./media');
+
+
+const internals = {
+    options: {
+        charset: {
+            type: 'accept-charset'
+        },
+        encoding: {
+            type: 'accept-encoding',
+            default: 'identity',
+            equivalents: new Map([
+                ['x-compress', 'compress'],
+                ['x-gzip', 'gzip']
+            ])
+        },
+        language: {
+            type: 'accept-language',
+            prefixMatch: true
+        }
+    }
+};
+
+
+for (const type in internals.options) {
+    exports[type] = (header, preferences) => Header.selection(header, preferences, internals.options[type]);
+
+    exports[`${type}s`] = (header, preferences) => Header.selections(header, preferences, internals.options[type]);
+}
+
+
+exports.mediaType = (header, preferences) => Media.selection(header, preferences);
+
+exports.mediaTypes = (header, preferences) => Media.selections(header, preferences);
+
+
+exports.parseAll = function (requestHeaders) {
+
+    return {
+        charsets: exports.charsets(requestHeaders['accept-charset']),
+        encodings: exports.encodings(requestHeaders['accept-encoding']),
+        languages: exports.languages(requestHeaders['accept-language']),
+        mediaTypes: exports.mediaTypes(requestHeaders.accept)
+    };
+};

node_modules/@hapi/accept/lib/media.js

@@ -0,0 +1,322 @@
+'use strict';
+
+const Hoek = require('@hapi/hoek');
+const Boom = require('@hapi/boom');
+
+
+const internals = {};
+
+
+exports.selection = function (header, preferences) {
+
+    const selections = exports.selections(header, preferences);
+    return selections.length ? selections[0] : '';
+};
+
+
+exports.selections = function (header, preferences) {
+
+    Hoek.assert(!preferences || Array.isArray(preferences), 'Preferences must be an array');
+
+    return internals.parse(header, preferences);
+};
+
+
+//      RFC 7231 Section 5.3.2 (https://tools.ietf.org/html/rfc7231#section-5.3.2)
+//
+//      Accept          = [ ( "," / ( media-range [ accept-params ] ) ) *( OWS "," [ OWS ( media-range [ accept-params ] ) ] ) ]
+//      media-range     = ( "*/*" / ( type "/*" ) / ( type "/" subtype ) ) *( OWS ";" OWS parameter )
+//      accept-params   = weight *accept-ext
+//      accept-ext      = OWS ";" OWS token [ "=" ( token / quoted-string ) ]
+//      type            = token
+//      subtype         = token
+//      parameter       = token "=" ( token / quoted-string )
+//
+//      quoted-string   = DQUOTE *( qdtext / quoted-pair ) DQUOTE
+//      qdtext          = HTAB / SP /%x21 / %x23-5B / %x5D-7E / obs-text
+//      obs-text        = %x80-FF
+//      quoted-pair     = "\" ( HTAB / SP / VCHAR / obs-text )
+//      VCHAR           = %x21-7E                                ; visible (printing) characters
+//      token           = 1*tchar
+//      tchar           = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA
+//      OWS             = *( SP / HTAB )
+//
+//      Accept: audio/*; q=0.2, audio/basic
+//      Accept: text/plain; q=0.5, text/html, text/x-dvi; q=0.8, text/x-c
+//      Accept: text/plain, application/json;q=0.5, text/html, */*; q = 0.1
+//      Accept: text/plain, application/json;q=0.5, text/html, text/drop;q=0
+//      Accept: text/*, text/plain, text/plain;format=flowed, */*
+//      Accept: text/*;q=0.3, text/html;q=0.7, text/html;level=1, text/html;level=2;q=0.4, */*;q=0.5
+
+
+//      RFC 7231 Section 5.3.1 (https://tools.ietf.org/html/rfc7231#section-5.3.1)
+//
+//      The weight is normalized to a real number in the range 0 through 1,
+//      where 0.001 is the least preferred and 1 is the most preferred; a
+//      value of 0 means "not acceptable".  If no "q" parameter is present,
+//      the default weight is 1.
+//
+//       weight = OWS ";" OWS "q=" qvalue
+//       qvalue = ( "0" [ "." 0*3DIGIT ] ) / ( "1" [ "." 0*3("0") ] )
+
+
+//                         */*        type/*                              type/subtype
+internals.validMediaRx = /^(?:\*\/\*)|(?:[\w\!#\$%&'\*\+\-\.\^`\|~]+\/\*)|(?:[\w\!#\$%&'\*\+\-\.\^`\|~]+\/[\w\!#\$%&'\*\+\-\.\^`\|~]+)$/;
+
+
+internals.parse = function (raw, preferences) {
+
+    // Normalize header (remove spaces and temporary remove quoted strings)
+
+    const { header, quoted } = internals.normalize(raw);
+
+    // Parse selections
+
+    const parts = header.split(',');
+    const selections = [];
+    const map = {};
+
+    for (let i = 0; i < parts.length; ++i) {
+        const part = parts[i];
+        if (!part) {                                    // Ignore empty parts or leading commas
+            continue;
+        }
+
+        // Parse parameters
+
+        const pairs = part.split(';');
+        const token = pairs.shift().toLowerCase();
+
+        if (!internals.validMediaRx.test(token)) {       // Ignore invalid types
+            continue;
+        }
+
+        const selection = {
+            token,
+            params: {},
+            exts: {},
+            pos: i
+        };
+
+        // Parse key=value
+
+        let target = 'params';
+        for (const pair of pairs) {
+            const kv = pair.split('=');
+            if (kv.length !== 2 ||
+                !kv[1]) {
+
+                throw Boom.badRequest(`Invalid accept header`);
+            }
+
+            const key = kv[0];
+            let value = kv[1];
+
+            if (key === 'q' ||
+                key === 'Q') {
+
+                target = 'exts';
+
+                value = parseFloat(value);
+                if (!Number.isFinite(value) ||
+                    value > 1 ||
+                    (value < 0.001 && value !== 0)) {
+
+                    value = 1;
+                }
+
+                selection.q = value;
+            }
+            else {
+                if (value[0] === '"') {
+                    value = `"${quoted[value]}"`;
+                }
+
+                selection[target][kv[0]] = value;
+            }
+        }
+
+        const params = Object.keys(selection.params);
+        selection.original = [''].concat(params.map((key) => `${key}=${selection.params[key]}`)).join(';');
+        selection.specificity = params.length;
+
+        if (selection.q === undefined) {     // Default no preference to q=1 (top preference)
+            selection.q = 1;
+        }
+
+        const tparts = selection.token.split('/');
+        selection.type = tparts[0];
+        selection.subtype = tparts[1];
+
+        map[selection.token] = selection;
+
+        if (selection.q) {                   // Skip denied selections (q=0)
+            selections.push(selection);
+        }
+    }
+
+    // Sort selection based on q and then position in header
+
+    selections.sort(internals.sort);
+
+    return internals.preferences(map, selections, preferences);
+};
+
+
+internals.normalize = function (raw) {
+
+    raw = raw || '*/*';
+
+    const normalized = {
+        header: raw,
+        quoted: {}
+    };
+
+    if (raw.includes('"')) {
+        let i = 0;
+        normalized.header = raw.replace(/="([^"]*)"/g, ($0, $1) => {
+
+            const key = '"' + ++i;
+            normalized.quoted[key] = $1;
+            return '=' + key;
+        });
+    }
+
+    normalized.header = normalized.header.replace(/[ \t]/g, '');
+    return normalized;
+};
+
+
+internals.sort = function (a, b) {
+
+    // Sort by quality score
+
+    if (b.q !== a.q) {
+        return b.q - a.q;
+    }
+
+    // Sort by type
+
+    if (a.type !== b.type) {
+        return internals.innerSort(a, b, 'type');
+    }
+
+    // Sort by subtype
+
+    if (a.subtype !== b.subtype) {
+        return internals.innerSort(a, b, 'subtype');
+    }
+
+    // Sort by specificity
+
+    if (a.specificity !== b.specificity) {
+        return b.specificity - a.specificity;
+    }
+
+    return a.pos - b.pos;
+};
+
+
+internals.innerSort = function (a, b, key) {
+
+    const aFirst = -1;
+    const bFirst = 1;
+
+    if (a[key] === '*') {
+        return bFirst;
+    }
+
+    if (b[key] === '*') {
+        return aFirst;
+    }
+
+    return a[key] < b[key] ? aFirst : bFirst;       // Group alphabetically
+};
+
+
+internals.preferences = function (map, selections, preferences) {
+
+    // Return selections if no preferences
+
+    if (!preferences?.length) {
+        return selections.map((selection) => selection.token + selection.original);
+    }
+
+    // Map wildcards and filter selections to preferences
+
+    const lowers = Object.create(null);
+    const flat = Object.create(null);
+    let any = false;
+
+    for (const preference of preferences) {
+        const lower = preference.toLowerCase();
+        flat[lower] = preference;
+        const parts = lower.split('/');
+        const type = parts[0];
+        const subtype = parts[1];
+
+        if (type === '*') {
+            Hoek.assert(subtype === '*', 'Invalid media type preference contains wildcard type with a subtype');
+            any = true;
+            continue;
+        }
+
+        lowers[type] = lowers[type] ?? Object.create(null);
+        lowers[type][subtype] = preference;
+    }
+
+    const preferred = [];
+    for (const selection of selections) {
+        const token = selection.token;
+        const { type, subtype } = map[token];
+        const subtypes = lowers[type];
+
+        // */*
+
+        if (type === '*') {
+            for (const preference of Object.keys(flat)) {
+                if (!map[preference]) {
+                    preferred.push(flat[preference]);
+                }
+            }
+
+            if (any) {
+                preferred.push('*/*');
+            }
+
+            continue;
+        }
+
+        // any
+
+        if (any) {
+            preferred.push((flat[token] || token) + selection.original);
+            continue;
+        }
+
+        // type/subtype
+
+        if (subtype !== '*') {
+            const pref = flat[token];
+            if (pref ||
+                (subtypes && subtypes['*'])) {
+
+                preferred.push((pref || token) + selection.original);
+            }
+
+            continue;
+        }
+
+        // type/*
+
+        if (subtypes) {
+            for (const psub of Object.keys(subtypes)) {
+                if (!map[`${type}/${psub}`]) {
+                    preferred.push(subtypes[psub]);
+                }
+            }
+        }
+    }
+
+    return preferred;
+};

node_modules/@hapi/accept/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@hapi/accept",
+  "description": "HTTP Accept-* headers parsing",
+  "version": "6.0.3",
+  "repository": "git://github.com/hapijs/accept",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib"
+  ],
+  "keywords": [
+    "HTTP",
+    "header",
+    "accept",
+    "accept-encoding"
+  ],
+  "eslintConfig": {
+    "extends": [
+      "plugin:@hapi/module"
+    ]
+  },
+  "dependencies": {
+    "@hapi/boom": "^10.0.1",
+    "@hapi/hoek": "^11.0.2"
+  },
+  "devDependencies": {
+    "@hapi/code": "^9.0.3",
+    "@hapi/eslint-plugin": "*",
+    "@hapi/lab": "^25.1.2",
+    "@types/node": "^17.0.31",
+    "typescript": "~4.6.4"
+  },
+  "scripts": {
+    "test": "lab -a @hapi/code -t 100 -L -Y",
+    "test-cov-html": "lab -a @hapi/code -r html -o coverage.html"
+  },
+  "license": "BSD-3-Clause"
+}

node_modules/@hapi/ammo/LICENSE.md

@@ -0,0 +1,11 @@
+Copyright (c) 2014-2022, Project contributors
+Copyright (c) 2014-2020, Sideway Inc
+Copyright (c) 2014, Walmart.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS OFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/ammo/README.md

@@ -0,0 +1,18 @@
+<a href="https://hapi.dev"><img src="https://raw.githubusercontent.com/hapijs/assets/master/images/family.png" width="180px" align="right" /></a>
+
+# @hapi/ammo
+
+#### HTTP Range processing utilities.
+
+**ammo** is part of the **hapi** ecosystem and was designed to work seamlessly with the [hapi web framework](https://hapi.dev) and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out [hapi](https://hapi.dev) – they work even better together.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/family/ammo/)
+- [Versions status](https://hapi.dev/resources/status/#ammo) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/family/ammo/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Free and commercial support options](https://hapi.dev/support/)
+

node_modules/@hapi/ammo/lib/index.d.ts

@@ -0,0 +1,41 @@
+/// <reference types="node" />
+
+import * as Stream from 'stream';
+
+
+/**
+ * Parses an HTTP Range header.
+ * 
+ * @param header - the HTTP Range header.
+ * @param length - the payload length.
+ * 
+ * @returns an array of range objects.
+ */
+export function header(header: string, length: number): null | Range[];
+
+
+/**
+ * A transform stream taking full payload and returning the requested range.
+ */
+export class Clip extends Stream.Transform {
+
+    /**
+     * Constructs a new transform steam.
+     * 
+     * @param range - the requested range.
+     */
+    constructor(range: Range);
+}
+
+
+export interface Range {
+    /**
+     * The range start position (inclusive).
+     */
+    readonly from: number;
+
+    /**
+     * The range end position (inclusive).
+     */
+    readonly to: number;
+}

node_modules/@hapi/ammo/lib/index.js

@@ -0,0 +1,185 @@
+'use strict';
+
+const Stream = require('stream');
+
+const Hoek = require('@hapi/hoek');
+
+
+const internals = {};
+
+
+// RFC 7233 (https://tools.ietf.org/html/rfc7233#appendix-D)
+//
+// Range = "bytes" "=" byte-range-set
+// byte-range-set = *( "," OWS ) byte-range-spec *( OWS "," [ OWS byte-range-spec ] )
+// byte-range-spec = ( 1*DIGIT "-" [ 1*DIGIT ] ) / ( "-" 1*DIGIT )
+
+
+//                                12  3          3 4       425         6  7          7 8       865 1
+internals.headerRx = /^bytes=[\s,]*((?:(?:\d+\-\d*)|(?:\-\d+))(?:\s*,\s*(?:(?:\d+\-\d*)|(?:\-\d+)))*)$/i;
+
+
+exports.header = function (header, length) {
+
+    // Parse header
+
+    const parts = internals.headerRx.exec(header);
+    if (!parts) {
+        return null;
+    }
+
+    const lastPos = length - 1;
+
+    const result = [];
+    const ranges = parts[1].match(/\d*\-\d*/g);
+
+    // Handle headers with multiple ranges
+
+    for (let range of ranges) {
+        let from;
+        let to;
+        range = range.split('-');
+        if (range[0]) {
+            from = parseInt(range[0], 10);
+        }
+
+        if (range[1]) {
+            to = parseInt(range[1], 10);
+            if (from !== undefined) {      // Can be 0
+                // From-To
+                if (to > lastPos) {
+                    to = lastPos;
+                }
+            }
+            else {
+                // -To
+                from = length - to;
+                to = lastPos;
+            }
+        }
+        else {
+            // From-
+            to = lastPos;
+        }
+
+        if (from > to) {
+            return null;
+        }
+
+        result.push(new internals.Range(from, to));
+    }
+
+    if (result.length === 1) {
+        return result;
+    }
+
+    // Sort and consolidate ranges
+
+    result.sort((a, b) => a.from - b.from);
+
+    const consolidated = [];
+    for (let i = result.length - 1; i > 0; --i) {
+        const current = result[i];
+        const before = result[i - 1];
+        if (current.from <= before.to + 1) {
+            before.to = current.to;
+        }
+        else {
+            consolidated.unshift(current);
+        }
+    }
+
+    consolidated.unshift(result[0]);
+
+    return consolidated;
+};
+
+
+internals.Range = class {
+
+    constructor(from, to) {
+
+        this.from = from;
+        this.to = to;
+    }
+};
+
+
+exports.Clip = class extends Stream.Transform {
+
+    constructor(range) {
+
+        if (!(range instanceof internals.Range)) {
+            Hoek.assert(typeof range === 'object', 'Expected "range" object');
+
+            const from = range.from ?? 0;
+            Hoek.assert(typeof from === 'number', '"range.from" must be a number');
+            Hoek.assert(from === parseInt(from, 10) && from >= 0, '"range.from" must be a positive integer');
+
+            const to = range.to ?? 0;
+            Hoek.assert(typeof to === 'number', '"range.to" must be a number');
+            Hoek.assert(to === parseInt(to, 10) && to >= 0, '"range.to" must be a positive integer');
+
+            Hoek.assert(to >= from, '"range.to" must be greater than or equal to "range.from"');
+
+            range = new internals.Range(from, to);
+        }
+
+        super();
+
+        this._range = range;
+        this._next = 0;
+
+        this._pipes = new Set();
+        this.on('pipe', (pipe) => this._pipes.add(pipe));
+        this.on('unpipe', (pipe) => this._pipes.delete(pipe));
+    }
+
+    _transform(chunk, encoding, done) {
+
+        try {
+            internals.processChunk(this, chunk);
+        }
+        catch (err) {
+            return done(err);
+        }
+
+        return done();
+    }
+
+    _flush(done) {
+
+        this._pipes.clear();
+        done();
+    }
+};
+
+
+internals.processChunk = function (stream, chunk) {
+
+    // Read desired range from a stream
+
+    const pos = stream._next;
+    stream._next = stream._next + chunk.length;
+
+    if (stream._next <= stream._range.from) {           // Before range
+        return;
+    }
+
+    if (pos > stream._range.to) {                       // After range
+        for (const pipe of stream._pipes) {
+            pipe.unpipe(stream);
+        }
+
+        stream._pipes.clear();
+        stream.end();
+        return;
+    }
+
+    // Calculate bounds of chunk to read
+
+    const from = Math.max(0, stream._range.from - pos);
+    const to = Math.min(chunk.length, stream._range.to - pos + 1);
+
+    stream.push(chunk.slice(from, to));
+};

node_modules/@hapi/ammo/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@hapi/ammo",
+  "description": "HTTP Range processing utilities",
+  "version": "6.0.1",
+  "repository": "git://github.com/hapijs/ammo",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "keywords": [
+    "http",
+    "range",
+    "utilities"
+  ],
+  "files": [
+    "lib"
+  ],
+  "eslintConfig": {
+    "extends": [
+      "plugin:@hapi/module"
+    ]
+  },
+  "dependencies": {
+    "@hapi/hoek": "^11.0.2"
+  },
+  "devDependencies": {
+    "@hapi/code": "^9.0.3",
+    "@hapi/eslint-plugin": "*",
+    "@hapi/lab": "^25.1.2",
+    "@hapi/wreck": "^18.0.1",
+    "@types/node": "^17.0.31",
+    "typescript": "~4.6.4"
+  },
+  "scripts": {
+    "test": "lab -a @hapi/code -t 100 -L -Y",
+    "test-cov-html": "lab -a @hapi/code -r html -o coverage.html"
+  },
+  "license": "BSD-3-Clause"
+}

node_modules/@hapi/b64/LICENSE.md

@@ -0,0 +1,11 @@
+Copyright (c) 2014-2022, Project contributors
+Copyright (c) 2014-2020, Sideway Inc
+Copyright (c) 2014, Walmart.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS OFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/b64/README.md

@@ -0,0 +1,17 @@
+<a href="https://hapi.dev"><img src="https://raw.githubusercontent.com/hapijs/assets/master/images/family.png" width="180px" align="right" /></a>
+
+# @hapi/b64
+
+#### Base64 streaming encoder and decoder.
+
+**b64** is part of the **hapi** ecosystem and was designed to work seamlessly with the [hapi web framework](https://hapi.dev) and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out [hapi](https://hapi.dev) – they work even better together.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/family/b64/)
+- [Versions status](https://hapi.dev/resources/status/#b64) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/family/b64/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Free and commercial support options](https://hapi.dev/support/)

node_modules/@hapi/b64/lib/decoder.js

@@ -0,0 +1,126 @@
+'use strict';
+
+/*
+    Decode functions adapted from:
+    Version 1.0 12/25/99 Copyright (C) 1999 Masanao Izumo <iz@onicos.co.jp>
+    http://www.onicos.com/staff/iz/amuse/javascript/expert/base64.txt
+*/
+
+const Stream = require('stream');
+
+
+const internals = {
+    decodeChars: [
+        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+        -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,
+        52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1,
+        -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
+        15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1,
+        -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
+        41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1
+    ]
+};
+
+
+exports.decode = function (buffer) {
+
+    const decodeChars = internals.decodeChars;
+    const len = buffer.length;
+    const allocated = Math.ceil(len / 4) * 3;
+    const result = Buffer.alloc(allocated);
+
+    let c1;
+    let c2;
+    let c3;
+    let c4;
+    let j = 0;
+
+    for (let i = 0; i < len; ) {
+        do {
+            c1 = decodeChars[buffer[i++] & 0xff];
+        }
+        while (i < len && c1 === -1);
+
+        if (c1 === -1) {
+            break;
+        }
+
+        do {
+            c2 = decodeChars[buffer[i++] & 0xff];
+        }
+        while (i < len && c2 === -1);
+
+        if (c2 === -1) {
+            break;
+        }
+
+        result[j++] = (c1 << 2) | ((c2 & 0x30) >> 4);
+
+        do {
+            c3 = buffer[i++] & 0xff;
+            if (c3 === 61) {                        // =
+                return result.slice(0, j);
+            }
+
+            c3 = decodeChars[c3];
+        }
+        while (i < len && c3 === -1);
+
+        if (c3 === -1) {
+            break;
+        }
+
+        result[j++] = ((c2 & 0x0f) << 4) | ((c3 & 0x3c) >> 2);
+
+        do {
+            c4 = buffer[i++] & 0xff;
+            if (c4 === 61) {                        // =
+                return result.slice(0, j);
+            }
+
+            c4 = decodeChars[c4];
+        }
+        while (i < len && c4 === -1);
+
+        if (c4 !== -1) {
+            result[j++] = ((c3 & 0x03) << 6) | c4;
+        }
+    }
+
+    return (j === allocated ? result : result.slice(0, j));
+};
+
+
+exports.Decoder = class Decoder extends Stream.Transform {
+    constructor() {
+
+        super();
+        this._reminder = null;
+    }
+
+    _transform(chunk, encoding, callback) {
+
+        let part = this._reminder ? Buffer.concat([this._reminder, chunk]) : chunk;
+        const remaining = part.length % 4;
+        if (remaining) {
+            this._reminder = part.slice(part.length - remaining);
+            part = part.slice(0, part.length - remaining);
+        }
+        else {
+            this._reminder = null;
+        }
+
+        this.push(exports.decode(part));
+        return callback();
+    }
+
+    _flush(callback) {
+
+        if (this._reminder) {
+            this.push(exports.decode(this._reminder));
+        }
+
+        return callback();
+    }
+};

node_modules/@hapi/b64/lib/encoder.js

@@ -0,0 +1,52 @@
+'use strict';
+
+/*
+    Encode functions adapted from:
+    Version 1.0 12/25/99 Copyright (C) 1999 Masanao Izumo <iz@onicos.co.jp>
+    http://www.onicos.com/staff/iz/amuse/javascript/expert/base64.txt
+*/
+
+const Stream = require('stream');
+
+
+const internals = {};
+
+
+exports.encode = function (buffer) {
+
+    return Buffer.from(buffer.toString('base64'));
+};
+
+
+exports.Encoder = class Encoder extends Stream.Transform {
+    constructor() {
+
+        super();
+        this._reminder = null;
+    }
+
+    _transform(chunk, encoding, callback) {
+
+        let part = this._reminder ? Buffer.concat([this._reminder, chunk]) : chunk;
+        const remaining = part.length % 3;
+        if (remaining) {
+            this._reminder = part.slice(part.length - remaining);
+            part = part.slice(0, part.length - remaining);
+        }
+        else {
+            this._reminder = null;
+        }
+
+        this.push(exports.encode(part));
+        return callback();
+    }
+
+    _flush(callback) {
+
+        if (this._reminder) {
+            this.push(exports.encode(this._reminder));
+        }
+
+        return callback();
+    }
+};

node_modules/@hapi/b64/lib/index.js

@@ -0,0 +1,44 @@
+'use strict';
+
+const Hoek = require('@hapi/hoek');
+
+const Decoder = require('./decoder');
+const Encoder = require('./encoder');
+
+
+exports.decode = Decoder.decode;
+
+exports.encode = Encoder.encode;
+
+exports.Decoder = Decoder.Decoder;
+
+exports.Encoder = Encoder.Encoder;
+
+
+// Base64url (RFC 4648) encode
+
+exports.base64urlEncode = function (value, encoding) {
+
+    Hoek.assert(typeof value === 'string' || Buffer.isBuffer(value), 'value must be string or buffer');
+    const buf = (Buffer.isBuffer(value) ? value : Buffer.from(value, encoding || 'binary'));
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/\=/g, '');
+};
+
+
+// Base64url (RFC 4648) decode
+
+exports.base64urlDecode = function (value, encoding) {
+
+    if (typeof value !== 'string') {
+
+        throw new Error('Value not a string');
+    }
+
+    if (!/^[\w\-]*$/.test(value)) {
+
+        throw new Error('Invalid character');
+    }
+
+    const buf = Buffer.from(value, 'base64');
+    return (encoding === 'buffer' ? buf : buf.toString(encoding || 'binary'));
+};

node_modules/@hapi/b64/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@hapi/b64",
+  "description": "Base64 streaming encoder and decoder",
+  "version": "6.0.1",
+  "repository": "git://github.com/hapijs/b64",
+  "main": "lib/index.js",
+  "files": [
+    "lib"
+  ],
+  "keywords": [
+    "buffer",
+    "base64",
+    "decode",
+    "encode",
+    "stream"
+  ],
+  "eslintConfig": {
+    "extends": [
+      "plugin:@hapi/module"
+    ]
+  },
+  "dependencies": {
+    "@hapi/hoek": "^11.0.2"
+  },
+  "devDependencies": {
+    "@hapi/code": "^9.0.0",
+    "@hapi/eslint-plugin": "*",
+    "@hapi/lab": "^25.0.1",
+    "@hapi/wreck": "^18.0.0"
+  },
+  "scripts": {
+    "test": "lab -a @hapi/code -t 100 -L",
+    "test-cov-html": "lab -a @hapi/code -r html -o coverage.html"
+  },
+  "license": "BSD-3-Clause"
+}

node_modules/@hapi/boom/LICENSE.md

@@ -0,0 +1,11 @@
+Copyright (c) 2012-2022, Project contributors
+Copyright (c) 2012-2020, Sideway Inc
+Copyright (c) 2012-2014, Walmart.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS OFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/boom/README.md

@@ -0,0 +1,17 @@
+<a href="https://hapi.dev"><img src="https://raw.githubusercontent.com/hapijs/assets/master/images/family.png" width="180px" align="right" /></a>
+
+# @hapi/boom
+
+#### HTTP-friendly error objects.
+
+**boom** is part of the **hapi** ecosystem and was designed to work seamlessly with the [hapi web framework](https://hapi.dev) and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out [hapi](https://hapi.dev) – they work even better together.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/family/boom/)
+- [Version status](https://hapi.dev/resources/status/#boom) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/family/boom/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Free and commercial support options](https://hapi.dev/support/)

node_modules/@hapi/boom/lib/index.d.ts

@@ -0,0 +1,549 @@
+/**
+ * An Error object used to return an HTTP response error (4xx, 5xx)
+ */
+export class Boom<Data = any> extends Error {
+
+    /**
+     * Creates a new Boom object using the provided message or Error
+     */
+    constructor(message?: string | Error, options?: Options<Data>);
+
+    /**
+     * Custom error data with additional information specific to the error type
+     */
+    data?: Data;
+
+    /**
+     * isBoom - if true, indicates this is a Boom object instance.
+     */
+    isBoom: boolean;
+
+    /**
+     * Convenience boolean indicating status code >= 500
+     */
+    isServer: boolean;
+
+    /**
+     * The error message
+     */
+    message: string;
+
+    /**
+     * The formatted response
+     */
+    output: Output;
+
+    /**
+     * The constructor used to create the error
+     */
+    typeof: Function;
+
+    /**
+     * Specifies if an error object is a valid boom object
+     *
+     * @param debug - A boolean that, when true, does not hide the original 500 error message. Defaults to false.
+     */
+    reformat(debug?: boolean): string;
+}
+
+
+export interface Options<Data> {
+    /**
+     * The HTTP status code
+     *
+     * @default 500
+     */
+    statusCode?: number;
+
+    /**
+     * Additional error information
+     */
+    data?: Data;
+
+    /**
+     * Constructor reference used to crop the exception call stack output
+     */
+    ctor?: Function;
+
+    /**
+     * Error message string
+     *
+     * @default none
+     */
+    message?: string;
+
+    /**
+     * If false, the err provided is a Boom object, and a statusCode or message are provided, the values are ignored
+     *
+     * @default true
+     */
+    override?: boolean;
+}
+
+
+export interface Decorate<Decoration> {
+
+    /**
+     * An option with extra properties to set on the error object
+     */
+    decorate?: Decoration;
+}
+
+
+export interface Payload {
+    /**
+     * The HTTP status code derived from error.output.statusCode
+     */
+    statusCode: number;
+
+    /**
+     * The HTTP status message derived from statusCode
+     */
+    error: string;
+
+    /**
+     * The error message derived from error.message
+     */
+    message: string;
+
+    /**
+     * Custom properties
+     */
+    [key: string]: unknown;
+}
+
+
+export interface Output {
+    /**
+     * The HTTP status code
+     */
+    statusCode: number;
+
+    /**
+     * An object containing any HTTP headers where each key is a header name and value is the header content
+     */
+    headers: { [header: string]: string | string[] | number | undefined };
+
+    /**
+     * The formatted object used as the response payload (stringified)
+     */
+    payload: Payload;
+}
+
+
+/**
+* Specifies if an object is a valid boom object
+*
+* @param obj - The object to assess
+* @param statusCode - Optional status code
+*
+* @returns Returns a boolean stating if the error object is a valid boom object and it has the provided statusCode (if present)
+*/
+export function isBoom(obj: unknown, statusCode?: number): obj is Boom;
+
+
+/**
+* Specifies if an error object is a valid boom object
+*
+* @param err - The error object to decorate
+* @param options - Options object
+*
+* @returns A decorated boom object
+*/
+export function boomify<Data, Decoration>(err: Error, options?: Options<Data> & Decorate<Decoration>): Boom<Data> & Decoration;
+
+
+// 4xx Errors
+
+/**
+* Returns a 400 Bad Request error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 400 bad request error
+*/
+export function badRequest<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 401 Unauthorized error
+*
+* @param messageOrError - Optional message or Error
+*
+* @returns A 401 Unauthorized error
+*/
+export function unauthorized<Data>(messageOrError?: string | Error | null): Boom<Data>;
+
+
+/**
+* Returns a 401 Unauthorized error
+*
+* @param message - Optional message
+* @param scheme - the authentication scheme name
+* @param attributes - an object of values used to construct the 'WWW-Authenticate' header
+*
+* @returns A 401 Unauthorized error
+*/
+export function unauthorized<Data>(message: '' | null, scheme: string, attributes?: string | unauthorized.Attributes): Boom<Data> & unauthorized.MissingAuth;
+export function unauthorized<Data>(message: string | null, scheme: string, attributes?: string | unauthorized.Attributes): Boom<Data>;
+
+
+export namespace unauthorized {
+
+    interface Attributes {
+        [index: string]: number | string | null | undefined;
+    }
+
+    interface MissingAuth {
+
+        /**
+         * Indicate whether the 401 unauthorized error is due to missing credentials (vs. invalid)
+         */
+        isMissing: boolean;
+    }
+}
+
+
+/**
+* Returns a 401 Unauthorized error
+*
+* @param message - Optional message
+* @param wwwAuthenticate - array of string values used to construct the wwwAuthenticate header
+*
+* @returns A 401 Unauthorized error
+*/
+export function unauthorized<Data>(message: string | null, wwwAuthenticate: string[]): Boom<Data>;
+
+
+/**
+* Returns a 402 Payment Required error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 402 Payment Required error
+*/
+export function paymentRequired<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 403 Forbidden error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 403 Forbidden error
+*/
+export function forbidden<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 404 Not Found error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 404 Not Found error
+*/
+export function notFound<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 405 Method Not Allowed error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+* @param allow - Optional string or array of strings which is used to set the 'Allow' header
+*
+* @returns A 405 Method Not Allowed error
+*/
+export function methodNotAllowed<Data>(messageOrError?: string | Error, data?: Data, allow?: string | string[]): Boom<Data>;
+
+
+/**
+* Returns a 406 Not Acceptable error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 406 Not Acceptable error
+*/
+export function notAcceptable<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 407 Proxy Authentication error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 407 Proxy Authentication error
+*/
+export function proxyAuthRequired<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 408 Request Time-out error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 408 Request Time-out error
+*/
+export function clientTimeout<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 409 Conflict error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 409 Conflict error
+*/
+export function conflict<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 410 Gone error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 410 gone error
+*/
+export function resourceGone<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 411 Length Required error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 411 Length Required error
+*/
+export function lengthRequired<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 412 Precondition Failed error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 412 Precondition Failed error
+*/
+export function preconditionFailed<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 413 Request Entity Too Large error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 413 Request Entity Too Large error
+*/
+export function entityTooLarge<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 414 Request-URI Too Large error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 414 Request-URI Too Large error
+*/
+export function uriTooLong<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 415 Unsupported Media Type error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 415 Unsupported Media Type error
+*/
+export function unsupportedMediaType<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 416 Request Range Not Satisfiable error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 416 Request Range Not Satisfiable error
+*/
+export function rangeNotSatisfiable<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 417 Expectation Failed error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 417 Expectation Failed error
+*/
+export function expectationFailed<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 418 I'm a Teapot error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 418 I'm a Teapot error
+*/
+export function teapot<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 422 Unprocessable Entity error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 422 Unprocessable Entity error
+*/
+export function badData<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 423 Locked error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 423 Locked error
+*/
+export function locked<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 424 Failed Dependency error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 424 Failed Dependency error
+*/
+export function failedDependency<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+/**
+* Returns a 425 Too Early error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 425 Too Early error
+*/
+export function tooEarly<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 428 Precondition Required error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 428 Precondition Required error
+*/
+export function preconditionRequired<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 429 Too Many Requests error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 429 Too Many Requests error
+*/
+export function tooManyRequests<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 451 Unavailable For Legal Reasons error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 451 Unavailable for Legal Reasons error
+*/
+export function illegal<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+// 5xx Errors
+
+/**
+* Returns a internal error (defaults to 500)
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+* @param statusCode - Optional status code override. Defaults to 500.
+*
+* @returns A 500 Internal Server error
+*/
+export function internal<Data>(messageOrError?: string | Error, data?: Data, statusCode?: number): Boom<Data>;
+
+
+/**
+* Returns a 500 Internal Server Error error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 500 Internal Server error
+*/
+export function badImplementation<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 501 Not Implemented error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 501 Not Implemented error
+*/
+export function notImplemented<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 502 Bad Gateway error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 502 Bad Gateway error
+*/
+export function badGateway<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 503 Service Unavailable error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 503 Service Unavailable error
+*/
+export function serverUnavailable<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;
+
+
+/**
+* Returns a 504 Gateway Time-out error
+*
+* @param messageOrError - Optional message or Error
+* @param data - Optional additional error data
+*
+* @returns A 504 Gateway Time-out error
+*/
+export function gatewayTimeout<Data>(messageOrError?: string | Error, data?: Data): Boom<Data>;

node_modules/@hapi/boom/lib/index.js

@@ -0,0 +1,464 @@
+'use strict';
+
+const Hoek = require('@hapi/hoek');
+
+
+const internals = {
+    codes: new Map([
+        [100, 'Continue'],
+        [101, 'Switching Protocols'],
+        [102, 'Processing'],
+        [200, 'OK'],
+        [201, 'Created'],
+        [202, 'Accepted'],
+        [203, 'Non-Authoritative Information'],
+        [204, 'No Content'],
+        [205, 'Reset Content'],
+        [206, 'Partial Content'],
+        [207, 'Multi-Status'],
+        [300, 'Multiple Choices'],
+        [301, 'Moved Permanently'],
+        [302, 'Moved Temporarily'],
+        [303, 'See Other'],
+        [304, 'Not Modified'],
+        [305, 'Use Proxy'],
+        [307, 'Temporary Redirect'],
+        [400, 'Bad Request'],
+        [401, 'Unauthorized'],
+        [402, 'Payment Required'],
+        [403, 'Forbidden'],
+        [404, 'Not Found'],
+        [405, 'Method Not Allowed'],
+        [406, 'Not Acceptable'],
+        [407, 'Proxy Authentication Required'],
+        [408, 'Request Time-out'],
+        [409, 'Conflict'],
+        [410, 'Gone'],
+        [411, 'Length Required'],
+        [412, 'Precondition Failed'],
+        [413, 'Request Entity Too Large'],
+        [414, 'Request-URI Too Large'],
+        [415, 'Unsupported Media Type'],
+        [416, 'Requested Range Not Satisfiable'],
+        [417, 'Expectation Failed'],
+        [418, 'I\'m a teapot'],
+        [422, 'Unprocessable Entity'],
+        [423, 'Locked'],
+        [424, 'Failed Dependency'],
+        [425, 'Too Early'],
+        [426, 'Upgrade Required'],
+        [428, 'Precondition Required'],
+        [429, 'Too Many Requests'],
+        [431, 'Request Header Fields Too Large'],
+        [451, 'Unavailable For Legal Reasons'],
+        [500, 'Internal Server Error'],
+        [501, 'Not Implemented'],
+        [502, 'Bad Gateway'],
+        [503, 'Service Unavailable'],
+        [504, 'Gateway Time-out'],
+        [505, 'HTTP Version Not Supported'],
+        [506, 'Variant Also Negotiates'],
+        [507, 'Insufficient Storage'],
+        [509, 'Bandwidth Limit Exceeded'],
+        [510, 'Not Extended'],
+        [511, 'Network Authentication Required']
+    ])
+};
+
+
+exports.Boom = class extends Error {
+
+    constructor(messageOrError, options = {}) {
+
+        if (messageOrError instanceof Error) {
+            return exports.boomify(Hoek.clone(messageOrError), options);
+        }
+
+        const { statusCode = 500, data = null, ctor = exports.Boom } = options;
+        const error = new Error(messageOrError ? messageOrError : undefined);         // Avoids settings null message
+        Error.captureStackTrace(error, ctor);                           // Filter the stack to our external API
+        error.data = data;
+        const boom = internals.initialize(error, statusCode);
+
+        Object.defineProperty(boom, 'typeof', { value: ctor });
+
+        if (options.decorate) {
+            Object.assign(boom, options.decorate);
+        }
+
+        return boom;
+    }
+
+    static [Symbol.hasInstance](instance) {
+
+        if (this === exports.Boom) {
+            return exports.isBoom(instance);
+        }
+
+        // Cannot use 'instanceof' as it creates infinite recursion
+
+        return this.prototype.isPrototypeOf(instance);
+    }
+};
+
+
+exports.isBoom = function (err, statusCode) {
+
+    return err instanceof Error && !!err.isBoom && (!statusCode || err.output.statusCode === statusCode);
+};
+
+
+exports.boomify = function (err, options) {
+
+    Hoek.assert(err instanceof Error, 'Cannot wrap non-Error object');
+
+    options = options || {};
+
+    if (options.data !== undefined) {
+        err.data = options.data;
+    }
+
+    if (options.decorate) {
+        Object.assign(err, options.decorate);
+    }
+
+    if (!err.isBoom) {
+        return internals.initialize(err, options.statusCode ?? 500, options.message);
+    }
+
+    if (options.override === false ||                           // Defaults to true
+        !options.statusCode && !options.message) {
+
+        return err;
+    }
+
+    return internals.initialize(err, options.statusCode ?? err.output.statusCode, options.message);
+};
+
+
+// 4xx Client Errors
+
+exports.badRequest = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 400, data, ctor: exports.badRequest });
+};
+
+
+exports.unauthorized = function (message, scheme, attributes) {          // Or (message, wwwAuthenticate[])
+
+    const err = new exports.Boom(message, { statusCode: 401, ctor: exports.unauthorized });
+
+    // function (message)
+
+    if (!scheme) {
+        return err;
+    }
+
+    // function (message, wwwAuthenticate[])
+
+    if (typeof scheme !== 'string') {
+        err.output.headers['WWW-Authenticate'] = scheme.join(', ');
+        return err;
+    }
+
+    // function (message, scheme, attributes)
+
+    let wwwAuthenticate = `${scheme}`;
+
+    if (attributes ||
+        message) {
+
+        err.output.payload.attributes = {};
+    }
+
+    if (attributes) {
+        if (typeof attributes === 'string') {
+            wwwAuthenticate += ' ' + Hoek.escapeHeaderAttribute(attributes);
+            err.output.payload.attributes = attributes;
+        }
+        else {
+            wwwAuthenticate += ' ' + Object.keys(attributes).map((name) => {
+
+                const value = attributes[name] ?? '';
+
+                err.output.payload.attributes[name] = value;
+                return `${name}="${Hoek.escapeHeaderAttribute(value.toString())}"`;
+            })
+                .join(', ');
+        }
+    }
+
+    if (message) {
+        if (attributes) {
+            wwwAuthenticate += ',';
+        }
+
+        wwwAuthenticate += ` error="${Hoek.escapeHeaderAttribute(message)}"`;
+        err.output.payload.attributes.error = message;
+    }
+    else {
+        err.isMissing = true;
+    }
+
+    err.output.headers['WWW-Authenticate'] = wwwAuthenticate;
+    return err;
+};
+
+
+exports.paymentRequired = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 402, data, ctor: exports.paymentRequired });
+};
+
+
+exports.forbidden = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 403, data, ctor: exports.forbidden });
+};
+
+
+exports.notFound = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 404, data, ctor: exports.notFound });
+};
+
+
+exports.methodNotAllowed = function (messageOrError, data, allow) {
+
+    const err = new exports.Boom(messageOrError, { statusCode: 405, data, ctor: exports.methodNotAllowed });
+
+    if (typeof allow === 'string') {
+        allow = [allow];
+    }
+
+    if (Array.isArray(allow)) {
+        err.output.headers.Allow = allow.join(', ');
+    }
+
+    return err;
+};
+
+
+exports.notAcceptable = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 406, data, ctor: exports.notAcceptable });
+};
+
+
+exports.proxyAuthRequired = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 407, data, ctor: exports.proxyAuthRequired });
+};
+
+
+exports.clientTimeout = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 408, data, ctor: exports.clientTimeout });
+};
+
+
+exports.conflict = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 409, data, ctor: exports.conflict });
+};
+
+
+exports.resourceGone = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 410, data, ctor: exports.resourceGone });
+};
+
+
+exports.lengthRequired = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 411, data, ctor: exports.lengthRequired });
+};
+
+
+exports.preconditionFailed = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 412, data, ctor: exports.preconditionFailed });
+};
+
+
+exports.entityTooLarge = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 413, data, ctor: exports.entityTooLarge });
+};
+
+
+exports.uriTooLong = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 414, data, ctor: exports.uriTooLong });
+};
+
+
+exports.unsupportedMediaType = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 415, data, ctor: exports.unsupportedMediaType });
+};
+
+
+exports.rangeNotSatisfiable = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 416, data, ctor: exports.rangeNotSatisfiable });
+};
+
+
+exports.expectationFailed = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 417, data, ctor: exports.expectationFailed });
+};
+
+
+exports.teapot = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 418, data, ctor: exports.teapot });
+};
+
+
+exports.badData = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 422, data, ctor: exports.badData });
+};
+
+
+exports.locked = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 423, data, ctor: exports.locked });
+};
+
+
+exports.failedDependency = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 424, data, ctor: exports.failedDependency });
+};
+
+exports.tooEarly = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 425, data, ctor: exports.tooEarly });
+};
+
+
+exports.preconditionRequired = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 428, data, ctor: exports.preconditionRequired });
+};
+
+
+exports.tooManyRequests = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 429, data, ctor: exports.tooManyRequests });
+};
+
+
+exports.illegal = function (messageOrError, data) {
+
+    return new exports.Boom(messageOrError, { statusCode: 451, data, ctor: exports.illegal });
+};
+
+
+// 5xx Server Errors
+
+exports.internal = function (message, data, statusCode = 500) {
+
+    return internals.serverError(message, data, statusCode, exports.internal);
+};
+
+
+exports.notImplemented = function (message, data) {
+
+    return internals.serverError(message, data, 501, exports.notImplemented);
+};
+
+
+exports.badGateway = function (message, data) {
+
+    return internals.serverError(message, data, 502, exports.badGateway);
+};
+
+
+exports.serverUnavailable = function (message, data) {
+
+    return internals.serverError(message, data, 503, exports.serverUnavailable);
+};
+
+
+exports.gatewayTimeout = function (message, data) {
+
+    return internals.serverError(message, data, 504, exports.gatewayTimeout);
+};
+
+
+exports.badImplementation = function (message, data) {
+
+    const err = internals.serverError(message, data, 500, exports.badImplementation);
+    err.isDeveloperError = true;
+    return err;
+};
+
+
+internals.initialize = function (err, statusCode, message) {
+
+    const numberCode = parseInt(statusCode, 10);
+    Hoek.assert(!isNaN(numberCode) && numberCode >= 400, 'First argument must be a number (400+):', statusCode);
+
+    err.isBoom = true;
+    err.isServer = numberCode >= 500;
+
+    if (!err.hasOwnProperty('data')) {
+        err.data = null;
+    }
+
+    err.output = {
+        statusCode: numberCode,
+        payload: {},
+        headers: {}
+    };
+
+    Object.defineProperty(err, 'reformat', { value: internals.reformat, configurable: true });
+
+    if (!message &&
+        !err.message) {
+
+        err.reformat();
+        message = err.output.payload.error;
+    }
+
+    if (message) {
+        const props = Object.getOwnPropertyDescriptor(err, 'message') || Object.getOwnPropertyDescriptor(Object.getPrototypeOf(err), 'message');
+        Hoek.assert(!props || props.configurable && !props.get, 'The error is not compatible with boom');
+
+        err.message = message + (err.message ? ': ' + err.message : '');
+        err.output.payload.message = err.message;
+    }
+
+    err.reformat();
+    return err;
+};
+
+
+internals.reformat = function (debug = false) {
+
+    this.output.payload.statusCode = this.output.statusCode;
+    this.output.payload.error = internals.codes.get(this.output.statusCode) || 'Unknown';
+
+    if (this.output.statusCode === 500 && debug !== true) {
+        this.output.payload.message = 'An internal server error occurred';              // Hide actual error from user
+    }
+    else if (this.message) {
+        this.output.payload.message = this.message;
+    }
+};
+
+
+internals.serverError = function (messageOrError, data, statusCode, ctor) {
+
+    if (data instanceof Error &&
+        !data.isBoom) {
+
+        return exports.boomify(data, { statusCode, message: messageOrError });
+    }
+
+    return new exports.Boom(messageOrError, { statusCode, data, ctor });
+};

node_modules/@hapi/boom/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@hapi/boom",
+  "description": "HTTP-friendly error objects",
+  "version": "10.0.1",
+  "repository": "git://github.com/hapijs/boom",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "keywords": [
+    "error",
+    "http"
+  ],
+  "files": [
+    "lib"
+  ],
+  "eslintConfig": {
+    "extends": [
+      "plugin:@hapi/module"
+    ]
+  },
+  "dependencies": {
+    "@hapi/hoek": "^11.0.2"
+  },
+  "devDependencies": {
+    "@hapi/code": "9.x.x",
+    "@hapi/eslint-plugin": "*",
+    "@hapi/lab": "^25.1.0",
+    "@types/node": "^17.0.31",
+    "typescript": "~4.6.4"
+  },
+  "scripts": {
+    "test": "lab -a @hapi/code -t 100 -L -Y",
+    "test-cov-html": "lab -a @hapi/code -t 100 -L -r html -o coverage.html"
+  },
+  "license": "BSD-3-Clause"
+}

node_modules/@hapi/bounce/LICENSE.md

@@ -0,0 +1,10 @@
+Copyright (c) 2017-2022, Project contributors
+Copyright (c) 2017-2020, Sideway Inc
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS OFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/bounce/README.md

@@ -0,0 +1,17 @@
+<a href="https://hapi.dev"><img src="https://raw.githubusercontent.com/hapijs/assets/master/images/family.png" width="180px" align="right" /></a>
+
+# @hapi/bounce
+
+#### Selective error catching and rewrite rules.
+
+**bounce** is part of the **hapi** ecosystem and was designed to work seamlessly with the [hapi web framework](https://hapi.dev) and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out [hapi](https://hapi.dev) – they work even better together.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/family/bounce/)
+- [Versions status](https://hapi.dev/resources/status/#bounce) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/family/bounce/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Free and commercial support options](https://hapi.dev/support/)

node_modules/@hapi/bounce/lib/index.js

@@ -0,0 +1,148 @@
+'use strict';
+
+const Assert = require('assert');
+
+const Boom = require('@hapi/boom');
+const Hoek = require('@hapi/hoek');
+
+
+const internals = {
+    system: [
+
+        // JavaScript
+
+        EvalError,
+        RangeError,
+        ReferenceError,
+        SyntaxError,
+        TypeError,
+        URIError,
+
+        // Node
+
+        Assert.AssertionError,
+
+        // Hoek
+
+        Hoek.AssertError
+    ]
+};
+
+
+exports.rethrow = function (err, types, options = {}) {
+
+    return internals.catch(err, types, options, true);
+};
+
+
+exports.ignore = function (err, types, options = {}) {
+
+    return internals.catch(err, types, options, false);
+};
+
+
+internals.catch = function (err, types, options, match) {
+
+    if (internals.match(err, types) !== match) {
+        return;
+    }
+
+    // Error replacement
+
+    if (options.override) {
+        err = options.override;
+    }
+
+    // Error decorations
+
+    if (options.decorate) {
+        Object.assign(err, options.decorate);
+    }
+
+    if (options.return) {
+        return err;
+    }
+
+    throw err;
+};
+
+
+exports.background = async function (operation, action = 'rethrow', types = 'system', options = {}) {
+
+    try {
+        if (typeof operation === 'function') {
+            await operation();
+        }
+        else {
+            await operation;
+        }
+    }
+    catch (err) {
+        return exports[action](err, types, options);
+    }
+};
+
+
+exports.isBoom = function (err) {
+
+    return Boom.isBoom(err);
+};
+
+
+exports.isError = function (err) {
+
+    return err instanceof Error;
+};
+
+
+exports.isSystem = function (err) {
+
+    if (!err) {
+        return false;
+    }
+
+    if (err.isBoom) {
+        return false;
+    }
+
+    for (const system of internals.system) {
+        if (err instanceof system) {
+            return true;
+        }
+    }
+
+    return false;
+};
+
+
+internals.rules = {
+    system: exports.isSystem,
+    boom: exports.isBoom
+};
+
+
+internals.match = function (err, types) {
+
+    if (!types) {
+        return true;
+    }
+
+    types = Array.isArray(types) ? types : [types];
+    for (const type of types) {
+        if (typeof type === 'string') {
+            if (internals.rules[type](err)) {
+                return true;
+            }
+        }
+        else if (typeof type === 'object') {
+            if (Hoek.contain(err, type, { deep: true, part: true })) {
+                return true;
+            }
+        }
+        else if (err instanceof type) {
+            return true;
+        }
+    }
+
+    return false;
+};

node_modules/@hapi/bounce/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@hapi/bounce",
+  "description": "Selective error catching and rewrite rules",
+  "version": "3.0.2",
+  "repository": "git://github.com/hapijs/bounce",
+  "main": "lib/index.js",
+  "files": [
+    "lib"
+  ],
+  "keywords": [
+    "error",
+    "catch"
+  ],
+  "eslintConfig": {
+    "extends": [
+      "plugin:@hapi/module"
+    ]
+  },
+  "dependencies": {
+    "@hapi/boom": "^10.0.1",
+    "@hapi/hoek": "^11.0.2"
+  },
+  "devDependencies": {
+    "@hapi/code": "^9.0.0",
+    "@hapi/eslint-plugin": "^6.0.0",
+    "@hapi/lab": "^25.1.0"
+  },
+  "scripts": {
+    "test": "lab -a @hapi/code -t 100 -L",
+    "test-cov-html": "lab -a @hapi/code -r html -o coverage.html -L"
+  },
+  "license": "BSD-3-Clause"
+}

node_modules/@hapi/bourne/LICENSE.md

@@ -0,0 +1,10 @@
+Copyright (c) 2019-2022, Project contributors
+Copyright (c) 2019-2020, Sideway Inc
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS OFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/bourne/README.md

@@ -0,0 +1,17 @@
+<a href="https://hapi.dev"><img src="https://raw.githubusercontent.com/hapijs/assets/master/images/family.png" width="180px" align="right" /></a>
+
+# @hapi/bourne
+
+#### JSON.parse() drop-in replacement with prototype poisoning protection.
+
+**bourne** is part of the **hapi** ecosystem and was designed to work seamlessly with the [hapi web framework](https://hapi.dev) and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out [hapi](https://hapi.dev) – they work even better together.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/family/bourne/)
+- [Version status](https://hapi.dev/resources/status/#bourne) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/family/bourne/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Free and commercial support options](https://hapi.dev/support/)

node_modules/@hapi/bourne/lib/index.d.ts

@@ -0,0 +1,62 @@
+interface Reviver {
+  (this: any, key: string, value: any): any;
+}
+
+interface ParseOptions {
+  /**
+   * - `'error'` - throw a `SyntaxError` when a `__proto__` key is found. This is the default value.
+   * - `'remove'` - deletes any `__proto__` keys from the result object.
+   * - `'ignore'` - skips all validation (same as calling `JSON.parse()` directly).
+   */
+  protoAction?: 'error' | 'remove' | 'ignore';
+}
+
+/**
+ * Parses a given JSON-formatted text into an object.
+ * @param text the JSON text string.
+ */
+export function parse(text: string): any;
+
+/**
+ * Parses a given JSON-formatted text into an object.
+ * @param text the JSON text string.
+ * @param reviver the `JSON.parse()` optional `reviver` argument.
+ */
+export function parse(text: string, reviver: Reviver): any;
+
+/**
+ * Parses a given JSON-formatted text into an object.
+ * @param text the JSON text string.
+ * @param options optional configuration object.
+ */
+export function parse(text: string, options: ParseOptions): any;
+
+/**
+ * Parses a given JSON-formatted text into an object.
+ * @param text the JSON text string.
+ * @param reviver the `JSON.parse()` optional `reviver` argument.
+ * @param options optional configuration object.
+ */
+export function parse(text: string, reviver: Reviver, options: ParseOptions): any;
+
+interface ScanOptions {
+  /**
+   * - `'error'` - throw a `SyntaxError` when a `__proto__` key is found. This is the default value.
+   * - `'remove'` - deletes any `__proto__` keys from the input `obj`.
+   */
+  protoAction?: 'error' | 'remove';
+}
+
+/**
+ * Scans a given object for prototype properties.
+ * @param obj the object being scanned.
+ * @param options optional configuration object.
+ */
+export function scan(obj: any, options?: ScanOptions): void;
+
+/**
+ * Parses a given JSON-formatted text into an object or `null` if an error is found.
+ * @param text the JSON text string.
+ * @param reviver the `JSON.parse()` optional `reviver` argument.
+ */
+export function safeParse(text: string, reviver?: Reviver) : any | null;

node_modules/@hapi/bourne/lib/index.js

@@ -0,0 +1,87 @@
+'use strict';
+
+
+const internals = {
+    suspectRx: /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*\:/
+};
+
+
+exports.parse = function (text, ...args) {
+
+    // Normalize arguments
+
+    const firstOptions = typeof args[0] === 'object' && args[0];
+    const reviver = args.length > 1 || !firstOptions ? args[0] : undefined;
+    const options = (args.length > 1 && args[1]) || firstOptions || {};
+
+    // Parse normally, allowing exceptions
+
+    const obj = JSON.parse(text, reviver);
+
+    // options.protoAction: 'error' (default) / 'remove' / 'ignore'
+
+    if (options.protoAction === 'ignore') {
+        return obj;
+    }
+
+    // Ignore null and non-objects
+
+    if (!obj ||
+        typeof obj !== 'object') {
+
+        return obj;
+    }
+
+    // Check original string for potential exploit
+
+    if (!text.match(internals.suspectRx)) {
+        return obj;
+    }
+
+    // Scan result for proto keys
+
+    exports.scan(obj, options);
+
+    return obj;
+};
+
+
+exports.scan = function (obj, options = {}) {
+
+    let next = [obj];
+
+    while (next.length) {
+        const nodes = next;
+        next = [];
+
+        for (const node of nodes) {
+            if (Object.prototype.hasOwnProperty.call(node, '__proto__')) {      // Avoid calling node.hasOwnProperty directly
+                if (options.protoAction !== 'remove') {
+                    throw new SyntaxError('Object contains forbidden prototype property');
+                }
+
+                delete node.__proto__;
+            }
+
+            for (const key in node) {
+                const value = node[key];
+                if (value &&
+                    typeof value === 'object') {
+
+                    next.push(node[key]);
+                }
+            }
+        }
+    }
+};
+
+
+exports.safeParse = function (text, reviver) {
+
+    try {
+        return exports.parse(text, reviver);
+    }
+    catch (ignoreError) {
+        return null;
+    }
+};

node_modules/@hapi/bourne/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@hapi/bourne",
+  "description": "JSON parse with prototype poisoning protection",
+  "version": "3.0.0",
+  "repository": "git://github.com/hapijs/bourne",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib"
+  ],
+  "keywords": [
+    "JSON",
+    "parse",
+    "safe",
+    "prototype"
+  ],
+  "eslintConfig": {
+    "extends": [
+      "plugin:@hapi/module"
+    ]
+  },
+  "devDependencies": {
+    "@hapi/code": "^9.0.0",
+    "@hapi/eslint-plugin": "*",
+    "@hapi/lab": "25.0.0-beta.1",
+    "@types/node": "^17.0.31",
+    "benchmark": "2.x.x",
+    "typescript": "^4.6.3"
+  },
+  "scripts": {
+    "test": "lab -a @hapi/code -t 100 -L -Y",
+    "test-cov-html": "lab -a @hapi/code -r html -o coverage.html"
+  },
+  "license": "BSD-3-Clause"
+}

node_modules/@hapi/call/LICENSE.md

@@ -0,0 +1,11 @@
+Copyright (c) 2014-2022, Project contributors
+Copyright (c) 2014-2020, Sideway Inc
+Copyright (c) 2014, Walmart.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS OFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/call/README.md

@@ -0,0 +1,17 @@
+<a href="https://hapi.dev"><img src="https://raw.githubusercontent.com/hapijs/assets/master/images/family.png" width="180px" align="right" /></a>
+
+# @hapi/call
+
+#### Simple HTTP Router.
+
+**call** is part of the **hapi** ecosystem and was designed to work seamlessly with the [hapi web framework](https://hapi.dev) and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out [hapi](https://hapi.dev) – they work even better together.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/family/call/)
+- [Version status](https://hapi.dev/resources/status/#call) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/family/call/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Free and commercial support options](https://hapi.dev/support/)

node_modules/@hapi/call/lib/decode.js

@@ -0,0 +1,120 @@
+'use strict';
+
+// Adapted from:
+// Copyright (c) 2017-2019 Justin Ridgewell, MIT Licensed, https://github.com/jridgewell/safe-decode-string-component
+// Copyright (c) 2008-2009 Bjoern Hoehrmann <bjoern@hoehrmann.de>, MIT Licensed, http://bjoern.hoehrmann.de/utf-8/decoder/dfa/
+
+
+const internals = {};
+
+
+exports.decode = function (string) {
+
+    let percentPos = string.indexOf('%');
+    if (percentPos === -1) {
+        return string;
+    }
+
+    let decoded = '';
+    let last = 0;
+    let codepoint = 0;
+    let startOfOctets = percentPos;
+    let state = internals.utf8.accept;
+
+    while (percentPos > -1 &&
+        percentPos < string.length) {
+
+        const high = internals.resolveHex(string[percentPos + 1], 4);
+        const low = internals.resolveHex(string[percentPos + 2], 0);
+        const byte = high | low;
+        const type = internals.utf8.data[byte];
+        state = internals.utf8.data[256 + state + type];
+        codepoint = (codepoint << 6) | (byte & internals.utf8.data[364 + type]);
+
+        if (state === internals.utf8.accept) {
+            decoded += string.slice(last, startOfOctets);
+            decoded += codepoint <= 0xFFFF
+                ? String.fromCharCode(codepoint)
+                : String.fromCharCode(0xD7C0 + (codepoint >> 10), 0xDC00 + (codepoint & 0x3FF));
+
+            codepoint = 0;
+            last = percentPos + 3;
+            percentPos = string.indexOf('%', last);
+            startOfOctets = percentPos;
+            continue;
+        }
+
+        if (state === internals.utf8.reject) {
+            return null;
+        }
+
+        percentPos += 3;
+
+        if (percentPos >= string.length ||
+            string[percentPos] !== '%') {
+
+            return null;
+        }
+    }
+
+    return decoded + string.slice(last);
+};
+
+
+internals.resolveHex = function (char, shift) {
+
+    const i = internals.hex[char];
+    return i === undefined ? 255 : i << shift;
+};
+
+
+internals.hex = {
+    '0': 0, '1': 1, '2': 2, '3': 3, '4': 4,
+    '5': 5, '6': 6, '7': 7, '8': 8, '9': 9,
+    'a': 10, 'A': 10, 'b': 11, 'B': 11, 'c': 12,
+    'C': 12, 'd': 13, 'D': 13, 'e': 14, 'E': 14,
+    'f': 15, 'F': 15
+};
+
+
+internals.utf8 = {
+    accept: 12,
+    reject: 0,
+    data: [
+
+        // Maps bytes to character to a transition
+
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
+        2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
+        3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3,
+        3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3,
+        4, 4, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5,
+        5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5,
+        6, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 8, 7, 7,
+        10, 9, 9, 9, 11, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4,
+
+        // Maps a state to a new state when adding a transition
+
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        12, 0, 0, 0, 0, 24, 36, 48, 60, 72, 84, 96,
+        0, 12, 12, 12, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 24, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 24, 24, 24, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 24, 24, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 48, 48, 48, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 48, 48, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 48, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+
+        // Maps the current transition to a mask that needs to apply to the byte
+
+        0x7F, 0x3F, 0x3F, 0x3F, 0x00, 0x1F, 0x0F, 0x0F, 0x0F, 0x07, 0x07, 0x07
+    ]
+};

node_modules/@hapi/call/lib/index.js

@@ -0,0 +1,385 @@
+'use strict';
+
+const Boom = require('@hapi/boom');
+const Hoek = require('@hapi/hoek');
+
+const Decode = require('./decode');
+const Regex = require('./regex');
+const Segment = require('./segment');
+
+
+const internals = {
+    pathRegex: Regex.generate(),
+    defaults: {
+        isCaseSensitive: true
+    }
+};
+
+
+exports.Router = internals.Router = function (options) {
+
+    this.settings = Hoek.applyToDefaults(internals.defaults, options || {});
+
+    this.routes = new Map();                        // Key: HTTP method or * for catch-all, value: sorted array of routes
+    this.ids = new Map();                           // Key: route id, value: record
+    this.vhosts = null;                             // Map where Key: hostname, value: see this.routes
+
+    this.specials = {
+        badRequest: null,
+        notFound: null,
+        options: null
+    };
+};
+
+
+internals.Router.prototype.add = function (config, route) {
+
+    const method = config.method.toLowerCase();
+
+    const vhost = config.vhost || '*';
+    if (vhost !== '*') {
+        this.vhosts = this.vhosts ?? new Map();
+        if (!this.vhosts.has(vhost)) {
+            this.vhosts.set(vhost, new Map());
+        }
+    }
+
+    const table = vhost === '*' ? this.routes : this.vhosts.get(vhost);
+    if (!table.has(method)) {
+        table.set(method, { routes: [], router: new Segment() });
+    }
+
+    const analysis = config.analysis ?? this.analyze(config.path);
+    const record = {
+        path: config.path,
+        route: route || config.path,
+        segments: analysis.segments,
+        params: analysis.params,
+        fingerprint: analysis.fingerprint,
+        settings: this.settings
+    };
+
+    // Add route
+
+    const map = table.get(method);
+    map.router.add(analysis.segments, record);
+    map.routes.push(record);
+    map.routes.sort(internals.sort);
+
+    const last = record.segments[record.segments.length - 1];
+    if (last.empty) {
+        map.router.add(analysis.segments.slice(0, -1), record);
+    }
+
+    if (config.id) {
+        Hoek.assert(!this.ids.has(config.id), 'Route id', config.id, 'for path', config.path, 'conflicts with existing path', this.ids.has(config.id) && this.ids.get(config.id).path);
+        this.ids.set(config.id, record);
+    }
+
+    return record;
+};
+
+
+internals.Router.prototype.special = function (type, route) {
+
+    Hoek.assert(Object.keys(this.specials).indexOf(type) !== -1, 'Unknown special route type:', type);
+
+    this.specials[type] = { route };
+};
+
+
+internals.Router.prototype.route = function (method, path, hostname) {
+
+    const segments = path.length === 1 ? [''] : path.split('/').slice(1);
+
+    const vhost = this.vhosts && hostname && this.vhosts.get(hostname);
+    const route = vhost && this._lookup(path, segments, vhost, method) ||
+        this._lookup(path, segments, this.routes, method) ||
+        method === 'head' && vhost && this._lookup(path, segments, vhost, 'get') ||
+        method === 'head' && this._lookup(path, segments, this.routes, 'get') ||
+        method === 'options' && this.specials.options ||
+        vhost && this._lookup(path, segments, vhost, '*') ||
+        this._lookup(path, segments, this.routes, '*') ||
+        this.specials.notFound || Boom.notFound();
+
+    return route;
+};
+
+
+internals.Router.prototype._lookup = function (path, segments, table, method) {
+
+    const set = table.get(method);
+    if (!set) {
+        return null;
+    }
+
+    const match = set.router.lookup(path, segments, this.settings);
+    if (!match) {
+        return null;
+    }
+
+    const assignments = {};
+    const array = [];
+    for (let i = 0; i < match.array.length; ++i) {
+        const name = match.record.params[i];
+        const value = Decode.decode(match.array[i]);
+        if (value === null) {
+            return this.specials.badRequest ?? Boom.badRequest('Invalid request path');
+        }
+
+        if (assignments[name] !== undefined) {
+            assignments[name] = assignments[name] + '/' + value;
+        }
+        else {
+            assignments[name] = value;
+        }
+
+        if (i + 1 === match.array.length ||                 // Only include the last segment of a multi-segment param
+            name !== match.record.params[i + 1]) {
+
+            array.push(assignments[name]);
+        }
+    }
+
+    return { params: assignments, paramsArray: array, route: match.record.route };
+};
+
+
+internals.Router.prototype.normalize = function (path) {
+
+    if (path &&
+        path.indexOf('%') !== -1) {
+
+        // Uppercase %encoded values
+
+        const uppercase = path.replace(/%[0-9a-fA-F][0-9a-fA-F]/g, (encoded) => encoded.toUpperCase());
+
+        // Decode non-reserved path characters: a-z A-Z 0-9 _!$&'()*+,;=:@-.~
+        // ! (%21) $ (%24) & (%26) ' (%27) ( (%28) ) (%29) * (%2A) + (%2B) , (%2C) - (%2D) . (%2E)
+        // 0-9 (%30-39) : (%3A) ; (%3B) = (%3D)
+        // @ (%40) A-Z (%41-5A) _ (%5F) a-z (%61-7A) ~ (%7E)
+
+        const decoded = uppercase.replace(/%(?:2[146-9A-E]|3[\dABD]|4[\dA-F]|5[\dAF]|6[1-9A-F]|7[\dAE])/g, (encoded) => String.fromCharCode(parseInt(encoded.substring(1), 16)));
+
+        path = decoded;
+    }
+
+    // Normalize path segments
+
+    if (path &&
+        (path.indexOf('/.') !== -1 || path[0] === '.')) {
+
+        const hasLeadingSlash = path[0] === '/';
+        const segments = path.split('/');
+        const normalized = [];
+        let segment;
+
+        for (let i = 0; i < segments.length; ++i) {
+            segment = segments[i];
+            if (segment === '..') {
+                normalized.pop();
+            }
+            else if (segment !== '.') {
+                normalized.push(segment);
+            }
+        }
+
+        if (segment === '.' ||
+            segment === '..') {         // Add trailing slash when needed
+
+            normalized.push('');
+        }
+
+        path = normalized.join('/');
+
+        if (path[0] !== '/' &&
+            hasLeadingSlash) {
+
+            path = '/' + path;
+        }
+    }
+
+    return path;
+};
+
+
+internals.Router.prototype.analyze = function (path) {
+
+    Hoek.assert(internals.pathRegex.validatePath.test(path), 'Invalid path:', path);
+    Hoek.assert(!internals.pathRegex.validatePathEncoded.test(path), 'Path cannot contain encoded non-reserved path characters:', path);
+
+    const pathParts = path.split('/');
+    const segments = [];
+    const params = [];
+    const fingers = [];
+
+    for (let i = 1; i < pathParts.length; ++i) {                            // Skip first empty segment
+        let segment = pathParts[i];
+
+        // Literal
+
+        if (segment.indexOf('{') === -1) {
+            segment = this.settings.isCaseSensitive ? segment : segment.toLowerCase();
+            fingers.push(segment);
+            segments.push({ literal: segment });
+            continue;
+        }
+
+        // Parameter
+
+        const parts = internals.parseParams(segment);
+        if (parts.length === 1) {
+
+            // Simple parameter
+
+            const item = parts[0];
+            Hoek.assert(params.indexOf(item.name) === -1, 'Cannot repeat the same parameter name:', item.name, 'in:', path);
+            params.push(item.name);
+
+            if (item.wildcard) {
+                if (item.count) {
+                    for (let j = 0; j < item.count; ++j) {
+                        fingers.push('?');
+                        segments.push({});
+                        if (j) {
+                            params.push(item.name);
+                        }
+                    }
+                }
+                else {
+                    fingers.push('#');
+                    segments.push({ wildcard: true });
+                }
+            }
+            else {
+                fingers.push('?');
+                segments.push({ empty: item.empty });
+            }
+        }
+        else {
+
+            // Mixed parameter
+
+            const seg = {
+                length: parts.length,
+                first: typeof parts[0] !== 'string',
+                segments: []
+            };
+
+            let finger = '';
+            let regex = '^';
+            for (let j = 0; j < parts.length; ++j) {
+                const part = parts[j];
+                if (typeof part === 'string') {
+                    finger = finger + part;
+                    regex = regex + Hoek.escapeRegex(part);
+                    seg.segments.push(part);
+                }
+                else {
+                    Hoek.assert(params.indexOf(part.name) === -1, 'Cannot repeat the same parameter name:', part.name, 'in:', path);
+                    params.push(part.name);
+
+                    finger = finger + '?';
+                    regex = regex + '(.' + (part.empty ? '*' : '+') + ')';
+                }
+            }
+
+            seg.mixed = new RegExp(regex + '$', !this.settings.isCaseSensitive ? 'i' : '');
+            fingers.push(finger);
+            segments.push(seg);
+        }
+    }
+
+    return {
+        segments,
+        fingerprint: '/' + fingers.join('/'),
+        params
+    };
+};
+
+
+internals.parseParams = function (segment) {
+
+    const parts = [];
+    segment.replace(internals.pathRegex.parseParam, ($0, literal, name, wildcard, count, empty) => {
+
+        if (literal) {
+            parts.push(literal);
+        }
+        else {
+            parts.push({
+                name,
+                wildcard: !!wildcard,
+                count: count && parseInt(count, 10),
+                empty: !!empty
+            });
+        }
+
+        return '';
+    });
+
+    return parts;
+};
+
+
+internals.Router.prototype.table = function (host) {
+
+    const result = [];
+    const collect = (table) => {
+
+        if (!table) {
+            return;
+        }
+
+        for (const map of table.values()) {
+            for (const record of map.routes) {
+                result.push(record.route);
+            }
+        }
+    };
+
+    if (this.vhosts) {
+        const vhosts = host ? [].concat(host) : [...this.vhosts.keys()];
+        for (const vhost of vhosts) {
+            collect(this.vhosts.get(vhost));
+        }
+    }
+
+    collect(this.routes);
+
+    return result;
+};
+
+
+internals.sort = function (a, b) {
+
+    const aFirst = -1;
+    const bFirst = 1;
+
+    const as = a.segments;
+    const bs = b.segments;
+
+    if (as.length !== bs.length) {
+        return as.length > bs.length ? bFirst : aFirst;
+    }
+
+    for (let i = 0; ; ++i) {
+        if (as[i].literal) {
+            if (bs[i].literal) {
+                if (as[i].literal === bs[i].literal) {
+                    continue;
+                }
+
+                return as[i].literal > bs[i].literal ? bFirst : aFirst;
+            }
+
+            return aFirst;
+        }
+
+        if (bs[i].literal) {
+            return bFirst;
+        }
+
+        return as[i].wildcard ? bFirst : aFirst;
+    }
+};

node_modules/@hapi/call/lib/regex.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const internals = {};
+
+
+exports.generate = function () {
+
+    /*
+        /path/{param}/path/{param?}
+        /path/{param*2}/path
+        /path/{param*2}
+        /path/x{param}x
+        /{param*}
+    */
+
+    const empty = '(?:^\\/$)';
+
+    const legalChars = '[\\w\\!\\$&\'\\(\\)\\*\\+\\,;\\=\\:@\\-\\.~]';
+    const encoded = '%[A-F0-9]{2}';
+
+    const literalChar = '(?:' + legalChars + '|' + encoded + ')';
+    const literal = literalChar + '+';
+    const literalOptional = literalChar + '*';
+
+    const midParam = '(?:\\{\\w+(?:\\*[1-9]\\d*)?\\})';                               // {p}, {p*2}
+    const endParam = '(?:\\/(?:\\{\\w+(?:(?:\\*(?:[1-9]\\d*)?)|(?:\\?))?\\})?)?';     // {p}, {p*2}, {p*}, {p?}
+
+    const partialParam = '(?:\\{\\w+\\??\\})';                                        // {p}, {p?}
+    const mixedParam = '(?:(?:' + literal + partialParam + ')+' + literalOptional + ')|(?:' + partialParam + '(?:' + literal + partialParam + ')+' + literalOptional + ')|(?:' + partialParam + literal + ')';
+
+    const segmentContent = '(?:' + literal + '|' + midParam + '|' + mixedParam + ')';
+    const segment = '\\/' + segmentContent;
+    const segments = '(?:' + segment + ')*';
+
+    const path = '(?:^' + segments + endParam + '$)';
+
+    //                1:literal               2:name   3:*  4:count  5:?
+    const parseParam = '(' + literal + ')|(?:\\{(\\w+)(?:(\\*)(\\d+)?)?(\\?)?\\})';
+
+    const expressions = {
+        parseParam: new RegExp(parseParam, 'g'),
+        validatePath: new RegExp(empty + '|' + path),
+        validatePathEncoded: /%(?:2[146-9A-E]|3[\dABD]|4[\dA-F]|5[\dAF]|6[1-9A-F]|7[\dAE])/g
+    };
+
+    return expressions;
+};

node_modules/@hapi/call/lib/segment.js

@@ -0,0 +1,246 @@
+'use strict';
+
+const Hoek = require('@hapi/hoek');
+
+
+const internals = {};
+
+
+exports = module.exports = internals.Segment = function () {
+
+    this._edge = null;              // { segment, record }
+    this._fulls = null;             // { path: { segment, record }
+    this._literals = null;          // { literal: { segment, <node> } }
+    this._param = null;             // <node>
+    this._mixed = null;             // [{ segment, <node> }]
+    this._wildcard = null;          // { segment, record }
+};
+
+
+internals.Segment.prototype.add = function (segments, record) {
+
+    /*
+        { literal: 'x' }        -> x
+        { empty: false }        -> {p}
+        { wildcard: true }      -> {p*}
+        { mixed: /regex/ }      -> a{p}b
+    */
+
+    const current = segments[0];
+    const remaining = segments.slice(1);
+    const isEdge = !remaining.length;
+
+    const literals = [];
+    let isLiteral = true;
+    for (let i = 0; i < segments.length && isLiteral; ++i) {
+        isLiteral = segments[i].literal !== undefined;
+        literals.push(segments[i].literal);
+    }
+
+    if (isLiteral) {
+        this._fulls = this._fulls ?? new Map();
+        let literal = '/' + literals.join('/');
+        if (!record.settings.isCaseSensitive) {
+            literal = literal.toLowerCase();
+        }
+
+        Hoek.assert(!this._fulls.has(literal), 'New route', record.path, 'conflicts with existing', this._fulls.get(literal)?.record.path);
+        this._fulls.set(literal, { segment: current, record });
+    }
+    else if (current.literal !== undefined) {               // Can be empty string
+
+        // Literal
+
+        this._literals = this._literals ?? new Map();
+        const currentLiteral = record.settings.isCaseSensitive ? current.literal : current.literal.toLowerCase();
+        if (!this._literals.has(currentLiteral)) {
+            this._literals.set(currentLiteral, new internals.Segment());
+        }
+
+        this._literals.get(currentLiteral).add(remaining, record);
+    }
+    else if (current.wildcard) {
+
+        // Wildcard
+
+        Hoek.assert(!this._wildcard, 'New route', record.path, 'conflicts with existing', this._wildcard?.record.path);
+        Hoek.assert(!this._param || !this._param._wildcard, 'New route', record.path, 'conflicts with existing', this._param?._wildcard?.record.path);
+        this._wildcard = { segment: current, record };
+    }
+    else if (current.mixed) {
+
+        // Mixed
+
+        this._mixed = this._mixed ?? [];
+
+        let mixed = this._mixedLookup(current);
+        if (!mixed) {
+            mixed = { segment: current, node: new internals.Segment() };
+            this._mixed.push(mixed);
+            this._mixed.sort(internals.mixed);
+        }
+
+        if (isEdge) {
+            Hoek.assert(!mixed.node._edge, 'New route', record.path, 'conflicts with existing', mixed.node._edge?.record.path);
+            mixed.node._edge = { segment: current, record };
+        }
+        else {
+            mixed.node.add(remaining, record);
+        }
+    }
+    else {
+
+        // Parameter
+
+        this._param = this._param ?? new internals.Segment();
+
+        if (isEdge) {
+            Hoek.assert(!this._param._edge, 'New route', record.path, 'conflicts with existing', this._param._edge?.record.path);
+            this._param._edge = { segment: current, record };
+        }
+        else {
+            Hoek.assert(!this._wildcard || !remaining[0].wildcard, 'New route', record.path, 'conflicts with existing', this._wildcard?.record.path);
+            this._param.add(remaining, record);
+        }
+    }
+};
+
+
+internals.Segment.prototype._mixedLookup = function (segment) {
+
+    for (let i = 0; i < this._mixed.length; ++i) {
+        if (internals.mixed({ segment }, this._mixed[i]) === 0) {
+            return this._mixed[i];
+        }
+    }
+
+    return null;
+};
+
+
+internals.mixed = function (a, b) {
+
+    const aFirst = -1;
+    const bFirst = 1;
+
+    const as = a.segment;
+    const bs = b.segment;
+
+    if (as.length !== bs.length) {
+        return as.length > bs.length ? aFirst : bFirst;
+    }
+
+    if (as.first !== bs.first) {
+        return as.first ? bFirst : aFirst;
+    }
+
+    for (let i = 0; i < as.segments.length; ++i) {
+        const am = as.segments[i];
+        const bm = bs.segments[i];
+
+        if (am === bm) {
+            continue;
+        }
+
+        if (am.length === bm.length) {
+            return am > bm ? bFirst : aFirst;
+        }
+
+        return am.length < bm.length ? bFirst : aFirst;
+    }
+
+    return 0;
+};
+
+
+internals.Segment.prototype.lookup = function (path, segments, options) {
+
+    let match = null;
+
+    // Literal edge
+
+    if (this._fulls) {
+        match = this._fulls.get(options.isCaseSensitive ? path : path.toLowerCase());
+        if (match) {
+            return { record: match.record, array: [] };
+        }
+    }
+
+    // Literal node
+
+    const current = segments[0];
+    const nextPath = path.slice(current.length + 1);
+    const remainder = segments.length > 1 ? segments.slice(1) : null;
+
+    if (this._literals) {
+        const literal = options.isCaseSensitive ? current : current.toLowerCase();
+        match = this._literals.get(literal);
+        if (match) {
+            const record = internals.deeper(match, nextPath, remainder, [], options);
+            if (record) {
+                return record;
+            }
+        }
+    }
+
+    // Mixed
+
+    if (this._mixed) {
+        for (let i = 0; i < this._mixed.length; ++i) {
+            match = this._mixed[i];
+            const params = current.match(match.segment.mixed);
+            if (params) {
+                const array = [];
+                for (let j = 1; j < params.length; ++j) {
+                    array.push(params[j]);
+                }
+
+                const record = internals.deeper(match.node, nextPath, remainder, array, options);
+                if (record) {
+                    return record;
+                }
+            }
+        }
+    }
+
+    // Param
+
+    if (this._param) {
+        if (current || this._param._edge?.segment.empty) {
+            const record = internals.deeper(this._param, nextPath, remainder, [current], options);
+            if (record) {
+                return record;
+            }
+        }
+    }
+
+    // Wildcard
+
+    if (this._wildcard) {
+        return { record: this._wildcard.record, array: [path.slice(1)] };
+    }
+
+    return null;
+};
+
+
+internals.deeper = function (match, path, segments, array, options) {
+
+    if (!segments) {
+        if (match._edge) {
+            return { record: match._edge.record, array };
+        }
+
+        if (match._wildcard) {
+            return { record: match._wildcard.record, array };
+        }
+    }
+    else {
+        const result = match.lookup(path, segments, options);
+        if (result) {
+            return { record: result.record, array: array.concat(result.array) };
+        }
+    }
+
+    return null;
+};

node_modules/@hapi/call/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@hapi/call",
+  "description": "HTTP Router",
+  "version": "9.0.1",
+  "repository": "git://github.com/hapijs/call",
+  "main": "lib/index.js",
+  "files": [
+    "lib"
+  ],
+  "keywords": [
+    "HTTP",
+    "router"
+  ],
+  "eslintConfig": {
+    "extends": [
+      "plugin:@hapi/module"
+    ]
+  },
+  "dependencies": {
+    "@hapi/boom": "^10.0.1",
+    "@hapi/hoek": "^11.0.2"
+  },
+  "devDependencies": {
+    "@hapi/code": "^9.0.3",
+    "@hapi/eslint-plugin": "*",
+    "@hapi/lab": "^25.1.2"
+  },
+  "scripts": {
+    "test": "lab -a @hapi/code -t 100 -L",
+    "test-cov-html": "lab -a @hapi/code -r html -o coverage.html"
+  },
+  "license": "BSD-3-Clause"
+}

node_modules/@hapi/catbox-memory/LICENSE.md

@@ -0,0 +1,11 @@
+Copyright (c) 2012-2022, Project contributors
+Copyright (c) 2012-2020, Sideway Inc
+Copyright (c) 2012-2014, Walmart.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS OFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/catbox-memory/README.md

@@ -0,0 +1,17 @@
+<a href="https://hapi.dev"><img src="https://raw.githubusercontent.com/hapijs/assets/master/images/family.png" width="180px" align="right" /></a>
+
+# @hapi/catbox-memory
+
+#### Memory adaptor for [catbox](https://github.com/hapijs/catbox).
+
+**catbox-memory** is part of the **hapi** ecosystem and was designed to work seamlessly with the [hapi web framework](https://hapi.dev) and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out [hapi](https://hapi.dev) – they work even better together.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/family/catbox-memory/)
+- [Versions status](https://hapi.dev/resources/status/#catbox-memory) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/family/catbox-memory/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Free and commercial support options](https://hapi.dev/support/)

node_modules/@hapi/catbox-memory/lib/index.d.ts

@@ -0,0 +1,33 @@
+import { ClientApi, ClientOptions } from '@hapi/catbox';
+
+interface Engine<T> extends ClientApi<T> {}
+
+declare class Engine<T> implements ClientApi<T> {
+    constructor(options?: Engine.Options);
+}
+
+declare namespace Engine {
+    interface Options extends ClientOptions {
+        /**
+         * Sets an upper limit on the number of bytes that can be stored in the cache.
+         * Once this limit is reached no additional items will be added to the cache until some expire.
+         * The utilized memory calculation is a rough approximation and must not be relied on.
+         * @default 104857600 (100MB).
+         */
+        maxByteSize?: number;
+        /**
+         * The minimum number of milliseconds in between each cache cleanup.
+         * @default 1000 (1 second)
+         */
+        minCleanupIntervalMsec?: number;
+        /**
+         * by default, buffers stored in the cache with allowMixedContent set to true are copied when they are set but not when they are retrieved.
+         * This means a change to the buffer returned by a get() will change the value in the cache. To prevent this,
+         * set cloneBuffersOnGet to true to always return a copy of the cached buffer.
+         * @default false
+         */
+        cloneBuffersOnGet?: boolean;
+    }
+}
+
+export { Engine };

node_modules/@hapi/catbox-memory/lib/index.js

@@ -0,0 +1,230 @@
+'use strict';
+
+const Boom = require('@hapi/boom');
+const Hoek = require('@hapi/hoek');
+
+
+const internals = {
+    maxTimer: 2147483647,   // 2 ^ 31 - 1
+    entrySize: 144          // Approximate cache entry size without value: 144 bytes
+};
+
+
+internals.defaults = {
+    maxByteSize: 100 * 1024 * 1024,          // 100MB
+    minCleanupIntervalMsec: 1000,
+    cloneBuffersOnGet: false
+};
+
+
+exports.Engine = class CatboxMemoryEngine {
+
+    constructor(options = {}) {
+
+        Hoek.assert(options.maxByteSize === undefined || options.maxByteSize >= 0, 'Invalid cache maxByteSize value');
+        Hoek.assert(options.allowMixedContent === undefined, 'allowMixedContent no longer supported');
+        Hoek.assert(options.minCleanupIntervalMsec === undefined || options.minCleanupIntervalMsec < internals.maxTimer, 'Invalid cache minCleanupIntervalMsec value');
+        Hoek.assert(options.cloneBuffersOnGet === undefined || typeof options.cloneBuffersOnGet === 'boolean', 'Invalid cloneBuffersOnGet value');
+
+        this.settings = Hoek.applyToDefaults(internals.defaults, options);
+        this.cache = null;
+
+        this._timer = null;
+        this._timerDue = null;
+    }
+
+    start() {
+
+        if (!this.cache) {
+            this.cache = new Map();
+            this.byteSize = 0;
+        }
+    }
+
+    _scheduleCleanup(msec) {
+
+        const cleanup = () => {
+
+            this._timer = null;
+            this._timerDue = null;
+
+            const now = Date.now();
+            let next = Infinity;
+            for (const [, segment] of this.cache) {
+                for (const [id, envelope] of segment) {
+                    const ttl = envelope.stored + envelope.ttl - now;
+                    if (ttl <= 0) {
+                        segment.delete(id);
+                        this.byteSize -= envelope.byteSize;
+                    }
+                    else {
+                        next = Math.min(next, ttl);
+                    }
+                }
+            }
+
+            if (next !== Infinity) {
+                this._scheduleCleanup(next);
+            }
+        };
+
+        const now = Date.now();
+        const timeout = Math.min(Math.max(this.settings.minCleanupIntervalMsec, msec), internals.maxTimer);
+        if (this._timer) {
+            if (this._timerDue - now < msec) {
+                return;
+            }
+
+            clearTimeout(this._timer);
+        }
+
+        this._timerDue = now + timeout;
+        this._timer = setTimeout(cleanup, timeout);
+    }
+
+    stop() {
+
+        clearTimeout(this._timer);
+        this._timer = null;
+        this._timerDue = null;
+
+        this.cache = null;
+        this.byteSize = 0;
+    }
+
+    isReady() {
+
+        return !!this.cache;
+    }
+
+    validateSegmentName(name) {
+
+        if (!name) {
+            throw new Boom.Boom('Empty string');
+        }
+
+        if (name.indexOf('\u0000') !== -1) {
+            throw new Boom.Boom('Includes null character');
+        }
+
+        return null;
+    }
+
+    get(key) {
+
+        if (!this.cache) {
+            throw new Boom.Boom('Connection not started');
+        }
+
+        const segment = this.cache.get(key.segment);
+        if (!segment) {
+            return null;
+        }
+
+        const envelope = segment.get(key.id);
+        if (!envelope) {
+            return null;
+        }
+
+        if (envelope.stored + envelope.ttl < Date.now()) {
+            this.drop(key);
+            return null;
+        }
+
+        let item = null;
+        if (Buffer.isBuffer(envelope.item)) {
+            item = envelope.item;
+            if (this.settings.cloneBuffersOnGet) {
+                const copy = Buffer.alloc(item.length);
+                item.copy(copy);
+                item = copy;
+            }
+        }
+        else {
+            try {
+                item = JSON.parse(envelope.item);
+            }
+            catch (err) {
+                throw new Boom.Boom('Bad value content');
+            }
+        }
+
+        const result = {
+            item,
+            stored: envelope.stored,
+            ttl: envelope.ttl
+        };
+
+        return result;
+    }
+
+    set(key, value, ttl) {
+
+        if (!this.cache) {
+            throw new Boom.Boom('Connection not started');
+        }
+
+        const envelope = new internals.MemoryCacheEntry(key, value, ttl);
+
+        let segment = this.cache.get(key.segment);
+        if (!segment) {
+            segment = new Map();
+            this.cache.set(key.segment, segment);
+        }
+
+        const cachedItem = segment.get(key.id);
+        if (cachedItem) {
+            this.byteSize -= cachedItem.byteSize;       // If the item existed, decrement the byteSize as the value could be different
+        }
+
+        if (this.settings.maxByteSize &&
+            (this.byteSize + envelope.byteSize > this.settings.maxByteSize)) {
+
+            throw new Boom.Boom('Cache size limit reached');
+        }
+
+        this._scheduleCleanup(ttl);
+        segment.set(key.id, envelope);
+        this.byteSize += envelope.byteSize;
+    }
+
+    drop(key) {
+
+        if (!this.cache) {
+            throw new Boom.Boom('Connection not started');
+        }
+
+        const segment = this.cache.get(key.segment);
+        if (segment) {
+            const item = segment.get(key.id);
+            if (item) {
+                this.byteSize -= item.byteSize;
+                segment.delete(key.id);
+            }
+        }
+    }
+};
+
+
+internals.MemoryCacheEntry = class {
+
+    constructor(key, value, ttl) {
+
+        let valueByteSize = 0;
+
+        if (Buffer.isBuffer(value)) {
+            this.item = Buffer.alloc(value.length);
+            value.copy(this.item);                                  // Copy buffer to prevent value from changing while in the cache
+            valueByteSize = this.item.length;
+        }
+        else {
+            this.item = JSON.stringify(value);                      // stringify() to prevent value from changing while in the cache
+            valueByteSize = Buffer.byteLength(this.item);
+        }
+
+        this.stored = Date.now();
+        this.ttl = ttl;
+        this.byteSize = internals.entrySize + valueByteSize + Buffer.byteLength(key.segment) + Buffer.byteLength(key.id);
+        this.timeoutId = null;
+    }
+};

node_modules/@hapi/catbox-memory/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@hapi/catbox-memory",
+  "description": "Memory adapter for catbox",
+  "version": "6.0.2",
+  "repository": "git://github.com/hapijs/catbox-memory",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib"
+  ],
+  "keywords": [
+    "cache",
+    "catbox",
+    "memory"
+  ],
+  "eslintConfig": {
+    "extends": [
+      "plugin:@hapi/module"
+    ]
+  },
+  "dependencies": {
+    "@hapi/boom": "^10.0.1",
+    "@hapi/hoek": "^11.0.2"
+  },
+  "devDependencies": {
+    "@hapi/catbox": "^12.1.1",
+    "@hapi/code": "^9.0.3",
+    "@hapi/eslint-plugin": "*",
+    "@hapi/lab": "^25.1.2",
+    "@types/node": "^16.18.98",
+    "typescript": "^5.4.5"
+  },
+  "scripts": {
+    "test": "lab -a @hapi/code -L -t 100 -Y",
+    "test-cov-html": "lab -a @hapi/code -r html -o coverage.html"
+  },
+  "license": "BSD-3-Clause"
+}

node_modules/@hapi/catbox/LICENSE.md

@@ -0,0 +1,11 @@
+Copyright (c) 2012-2022, Project contributors
+Copyright (c) 2012-2020, Sideway Inc
+Copyright (c) 2012-2014, Walmart.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS OFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/catbox/README.md

@@ -0,0 +1,17 @@
+<a href="https://hapi.dev"><img src="https://raw.githubusercontent.com/hapijs/assets/master/images/family.png" width="180px" align="right" /></a>
+
+# @hapi/catbox
+
+#### Multi-strategy object caching service.
+
+**catbox** is part of the **hapi** ecosystem and was designed to work seamlessly with the [hapi web framework](https://hapi.dev) and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out [hapi](https://hapi.dev) – they work even better together.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/family/catbox/)
+- [Versions status](https://hapi.dev/resources/status/#catbox) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/family/catbox/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Free and commercial support options](https://hapi.dev/support/)

node_modules/@hapi/catbox/lib/client.js

@@ -0,0 +1,114 @@
+'use strict';
+
+const Hoek = require('@hapi/hoek');
+const Boom = require('@hapi/boom');
+
+
+const internals = {
+    validate: Symbol('validate')
+};
+
+
+internals.defaults = {
+    partition: 'catbox'
+};
+
+
+module.exports = class {
+
+    constructor(engine, options) {
+
+        Hoek.assert(engine, 'Missing catbox client engine');
+        Hoek.assert((typeof engine === 'object' && typeof engine.start === 'function') || typeof engine === 'function', 'engine must be an engine object or engine prototype (function)');
+        Hoek.assert(typeof engine === 'function' || !options, 'Can only specify options with function engine config');
+
+        const settings = Object.assign({}, internals.defaults, options);
+        Hoek.assert(settings.partition.match(/^[\w\-]+$/), 'Invalid partition name:' + settings.partition);
+
+        this.connection = (typeof engine === 'object' ? engine : new engine(settings));
+    }
+
+    async start() {
+
+        await this.connection.start();
+    }
+
+    async stop() {
+
+        await this.connection.stop();
+    }
+
+    isReady() {
+
+        return this.connection.isReady();
+    }
+
+    validateSegmentName(name) {
+
+        return this.connection.validateSegmentName(name);
+    }
+
+    async get(key) {
+
+        this[internals.validate](key, null);
+
+        if (key === null) {
+            return null;
+        }
+
+        const result = await this.connection.get(key);
+        if (!result ||
+            result.item === undefined ||
+            result.item === null) {
+
+            return null;                                                        // Not found
+        }
+
+        const now = Date.now();
+        const expires = result.stored + result.ttl;
+        const ttl = expires - now;
+        if (ttl <= 0) {
+            return null;                                                        // Expired
+        }
+
+        const cached = {
+            item: result.item,
+            stored: result.stored,
+            ttl
+        };
+
+        return cached;                                                          // Valid
+    }
+
+    async set(key, value, ttl) {
+
+        this[internals.validate](key);
+
+        if (ttl <= 0) {
+            return;                                                             // Not cachable (or bad rules)
+        }
+
+        await this.connection.set(key, value, ttl);
+    }
+
+    async drop(key) {
+
+        this[internals.validate](key);
+
+        await this.connection.drop(key);                                       // Always drop, regardless of caching rules
+    }
+
+    [internals.validate](key, allow = {}) {
+
+        if (!this.isReady()) {
+            throw Boom.internal('Disconnected');                                // Disconnected
+        }
+
+        const isValidKey = (key && typeof key.id === 'string' &&
+                            key.segment && typeof key.segment === 'string');
+
+        if (!isValidKey && key !== allow) {
+            throw Boom.internal('Invalid key');
+        }
+    }
+};

node_modules/@hapi/catbox/lib/index.d.ts

@@ -0,0 +1,299 @@
+// TypeScript Version: 4.9
+
+/// <reference types="node" />
+
+import { Podium } from "@hapi/podium";
+
+/**
+ * Client
+ * The Client object provides a low-level cache abstraction. The object is constructed using new Client(engine, options) where:
+ * engine - is an object or a prototype function implementing the cache strategy:
+ *  * function - a prototype function with the signature function(options). catbox will call new func(options).
+ *  * object - a pre instantiated client implementation object. Does not support passing options.
+ * options - the strategy configuration object. Each strategy defines its own configuration options with the following common options:
+ *  * partition - the partition name used to isolate the cached results across multiple clients. The partition name is used as the MongoDB database name,
+ *    the Riak bucket, or as a key prefix in Redis and Memcached. To share the cache across multiple clients, use the same partition name.
+ * @see {@link https://github.com/hapijs/catbox#client}
+ */
+export class Client<T> implements ClientApi<T> {
+    constructor(engine: ClientApi<any>);
+    constructor(engine: EnginePrototype<any>, options?: ClientOptions);
+
+    /** start() - creates a connection to the cache server. Must be called before any other method is available. */
+    start(): Promise<void>;
+    /** stop() - terminates the connection to the cache server. */
+    stop(): Promise<void>;
+    /**
+     * get(key, callback) - retrieve an item from the cache engine if found where:
+     *  * key - a cache key object (see [ICacheKey]).
+     */
+    get(key: CacheKey): Promise<null | CachedObject<T>>;
+    /**
+     * set(key, value, ttl, callback) - store an item in the cache for a specified length of time, where:
+     *  * key - a cache key object (see [ICacheKey]).
+     *  * value - the string or object value to be stored.
+     *  * ttl - a time-to-live value in milliseconds after which the item is automatically removed from the cache (or is marked invalid).
+     */
+    set(key: CacheKey, value: T, ttl: number): Promise<void>;
+    /**
+     * drop(key, callback) - remove an item from cache where:
+     *  * key - a cache key object (see [ICacheKey]).
+     */
+    drop(key: CacheKey): Promise<void>;
+    /** isReady() - returns true if cache engine determines itself as ready, false if it is not ready. */
+    isReady(): boolean;
+    /** validateSegmentName(segment) - returns null if the segment name is valid (see below), otherwise should return an instance of Error with an appropriate message. */
+    validateSegmentName(segment: string): null | Error;
+}
+
+/**
+ * A prototype CatBox engine function
+ */
+export interface EnginePrototype<T> {
+    new(settings: ClientOptions): ClientApi<T>;
+}
+
+/**
+ * Client API
+ * The Client object provides the following methods:
+ * @see {@link https://github.com/hapijs/catbox#api}
+ */
+export interface ClientApi<T> {
+    /** start() - creates a connection to the cache server. Must be called before any other method is available. */
+    start(): Promise<void>;
+    /** stop() - terminates the connection to the cache server. */
+    stop(): void;
+    /**
+     * get(key, callback) - retrieve an item from the cache engine if found where:
+     *  * key - a cache key object (see [ICacheKey]).
+     */
+    get(key: CacheKey): Promise<null | CachedObject<T>>;
+    /**
+     * set(key, value, ttl) - store an item in the cache for a specified length of time, where:
+     *  * key - a cache key object (see [ICacheKey]).
+     *  * value - the string or object value to be stored.
+     *  * ttl - a time-to-live value in milliseconds after which the item is automatically removed from the cache (or is marked invalid).
+     */
+    set(key: CacheKey, value: T, ttl: number): Promise<void>;
+    /**
+     * drop(key) - remove an item from cache where:
+     *  * key - a cache key object (see [ICacheKey]).
+     */
+    drop(key: CacheKey): Promise<void>;
+    /** isReady() - returns true if cache engine determines itself as ready, false if it is not ready. */
+    isReady(): boolean;
+    /** validateSegmentName(segment) - returns null if the segment name is valid (see below), otherwise should return an instance of Error with an appropriate message. */
+    validateSegmentName(segment: string): null | Error;
+}
+
+/**
+ * Any method with a key argument takes an object with the following required properties:
+ */
+export interface CacheKey {
+    /** segment - a caching segment name string. Enables using a single cache server for storing different sets of items with overlapping ids. */
+    segment: string;
+    /** id - a unique item identifier string (per segment). Can be an empty string. */
+    id: string;
+}
+
+/** Cached object contains the following: */
+export interface CachedObject<T> {
+    /** item - the value stored in the cache using set(). */
+    item: T;
+    /** stored - the timestamp when the item was stored in the cache (in milliseconds). */
+    stored: number;
+    /** ttl - the remaining time-to-live (not the original value used when storing the object). */
+    ttl: number;
+}
+
+export interface ClientOptions {
+    /**
+     * this will store items under keys that start with this value.
+     */
+    partition?: string | undefined;
+}
+
+export type PolicyOptionVariants<T> = PolicyOptions<T> | DecoratedPolicyOptions<T>;
+
+export type Id = string | { id: string };
+
+/**
+ * The Policy object provides a convenient cache interface by setting a
+ * global policy which is automatically applied to every storage action.
+ * The object is constructed using new Policy(options, [cache, segment]) where:
+ *  * options - an object with the IPolicyOptions structure
+ *  * cache - a Client instance (which has already been started).
+ *  * segment - required when cache is provided. The segment name used to
+ * isolate cached items within the cache partition.
+ * @see {@link https://github.com/hapijs/catbox#policy}
+ */
+export class Policy<T, O extends PolicyOptionVariants<T>> {
+    constructor(options: O, cache: Client<T>, segment: string);
+    /**
+     *  retrieve an item from the cache. If the item is not
+     * found and the generateFunc method was provided,
+     * a new value is generated, stored in the cache, and returned.
+     * Multiple concurrent requests are queued and processed once. The method arguments are:
+     * @param id the unique item identifier (within the policy segment).
+     * Can be a string or an object with the required 'id' key.
+     */
+    get(id: Id): Promise<O extends DecoratedPolicyOptions<T> ? DecoratedResult<T> : T | null>;
+
+    /**
+     * store an item in the cache where:
+     * @param id - the unique item identifier (within the policy segment).
+     * @param value - the string or object value to be stored.
+     * @param ttl - a time-to-live override value in milliseconds after which the item is automatically
+     * removed from the cache (or is marked invalid).
+     *    This should be set to 0 in order to use the caching rules configured when creating the Policy object.
+     */
+    set(id: Id, value: T, ttl?: number): Promise<void>;
+    /**
+     * remove the item from cache where:
+     * @param id the unique item identifier (within the policy segment).
+     */
+    drop(id: Id): Promise<void>;
+    /**
+     * given a created timestamp in milliseconds, returns the time-to-live left
+     * based on the configured rules.
+     */
+    ttl(created: number): number;
+    /** changes the policy rules after construction (note that items already stored will not be affected) */
+    rules(options: PolicyOptions<T>): void;
+    /**
+     * returns true if cache engine determines itself as ready, false if it is not ready or if
+     * here is no cache engine set.
+     */
+    isReady(): boolean;
+    /** an object with cache statistics */
+    stats: CacheStatisticsObject;
+    /**
+     * a podium event emitter, emitting 'error' events under the 'persist' (emits any cache errors
+     * thrown during the generation of new values as a result of a get() request) and 'generate'
+     * (emits any new value generation errors thrown as a result of a get() request) channels.
+    */
+    events: Podium;
+    /**
+     * a reference to the cache client if set.
+     */
+    client: Client<T>;
+}
+
+export interface DecoratedResult<T> {
+    value: T;
+    cached: PolicyGetCachedOptions<T>;
+    report: PolicyGetReportLog;
+}
+
+export interface PolicyGetCachedOptions<T> {
+    /** item - the cached value. */
+    item: T;
+    /** stored - the timestamp when the item was stored in the cache. */
+    stored: number;
+    /** ttl - the cache ttl value for the record. */
+    ttl: number;
+    /** isStale - true if the item is stale. */
+    isStale: boolean;
+}
+
+/**
+ * @see {@link https://github.com/hapijs/catbox#policy}
+ */
+export interface PolicyOptions<T> {
+    /** expiresIn - relative expiration expressed in the number of milliseconds since the item was saved in the cache. Cannot be used together with expiresAt. */
+    expiresIn?: number | undefined;
+    /** expiresAt - time of day expressed in 24h notation using the 'HH:MM' format, at which point all cache records for the route expire. Uses local time. Cannot be used together with expiresIn. */
+    expiresAt?: string | undefined;
+    /** generateFunc - a function used to generate a new cache item if one is not found in the cache when calling get(). The method's signature is function(id, next) where: */
+    generateFunc?: GenerateFunc<T> | undefined;
+    /**
+     * staleIn - number of milliseconds to mark an item stored in cache as stale and attempt to regenerate it when generateFunc is provided.
+     * Must be less than expiresIn. Alternatively function that returns staleIn value in milliseconds. The function signature is function(stored, ttl) where:
+     *  * stored - the timestamp when the item was stored in the cache (in milliseconds).
+     *  * ttl - the remaining time-to-live (not the original value used when storing the object).
+     */
+    staleIn?: number | ((stored: number, ttl: number) => number) | undefined;
+    /** staleTimeout - number of milliseconds to wait before returning a stale value while generateFunc is generating a fresh value. */
+    staleTimeout?: number | undefined;
+    /**
+     * generateTimeout - number of milliseconds to wait before returning a timeout error when the generateFunc function takes too long to return a value.
+     * When the value is eventually returned, it is stored in the cache for future requests. Required if generateFunc is present.
+     * Set to false to disable timeouts which may cause all get() requests to get stuck forever.
+     */
+    generateTimeout?: number | false | undefined;
+    /** dropOnError - if true, an error or timeout in the generateFunc causes the stale value to be evicted from the cache. Defaults to true. */
+    dropOnError?: boolean | undefined;
+    /** generateOnReadError - if false, an upstream cache read error will stop the get() method from calling the generate function and will instead pass back the cache error. Defaults to true. */
+    generateOnReadError?: boolean | undefined;
+    /** generateIgnoreWriteError - if false, an upstream cache write error will be passed back with the generated value when calling the get() method. Defaults to true. */
+    generateIgnoreWriteError?: boolean | undefined;
+    /**
+     * pendingGenerateTimeout - number of milliseconds while generateFunc call is in progress for a given id, before a subsequent generateFunc call is allowed.
+     * @default 0, no blocking of concurrent generateFunc calls beyond staleTimeout.
+     */
+    pendingGenerateTimeout?: number | undefined;
+}
+
+export interface DecoratedPolicyOptions<T> extends PolicyOptions<T> {
+    /**
+     * @default false
+     */
+    getDecoratedValue: boolean | undefined;
+}
+
+export interface GenerateFuncFlags {
+    ttl: number;
+}
+
+/**
+ * generateFunc
+ * Is used in PolicyOptions
+ * A function used to generate a new cache item if one is not found in the cache when calling get(). The method's signature is function(id)
+ * @param id - the id string or object provided to the get() method.
+ * @param next - the method called when the new item is returned with the signature function(err, value, ttl) where:
+ *      * err - an error condition.
+ *      * value - the new value generated.
+ *      * ttl - the cache ttl value in milliseconds. Set to 0 to skip storing in the cache. Defaults to the cache global policy.
+ * @see {@link https://github.com/hapijs/catbox#policy}
+ */
+export type GenerateFunc<T> = (id: Id, flags: GenerateFuncFlags) => Promise<T>;
+
+/**
+ * An object with logging information about the generation operation containing the following keys (as relevant):
+ */
+export interface PolicyGetReportLog {
+    /** msec - the cache lookup time in milliseconds. */
+    msec: number;
+    /** stored - the timestamp when the item was stored in the cache. */
+    stored: number;
+    /** isStale - true if the item is stale. */
+    isStale: boolean;
+    /** ttl - the cache ttl value for the record. */
+    ttl: number;
+    /** error - lookup error. */
+    error?: Error | undefined;
+}
+
+/**
+ * an object with cache statistics where:
+ */
+export interface CacheStatisticsObject {
+    /** sets - number of cache writes. */
+    sets: number;
+    /** gets - number of cache get() requests. */
+    gets: number;
+    /** hits - number of cache get() requests in which the requested id was found in the cache (can be stale). */
+    hits: number;
+    /** stales - number of cache reads with stale requests (only counts the first request in a queued get() operation). */
+    stales: number;
+    /** generates - number of calls to the generate function. */
+    generates: number;
+    /** errors - cache operations errors. TODO check this */
+    errors: number;
+}
+
+// Definitions adapted from DefinitelyTyped, originally created by:
+// Jason Swearingen <https://github.com/jasonswearingen>
+// AJP <https://github.com/AJamesPhillips>
+// Rodrigo Saboya <https://github.com/saboya>
+// Silas Rech <https://github.com/lenovouser>

node_modules/@hapi/catbox/lib/index.js

@@ -0,0 +1,13 @@
+'use strict';
+
+const Client = require('./client');
+const Policy = require('./policy');
+
+
+const internals = {};
+
+
+exports.Client = Client;
+
+
+exports.Policy = exports.policy = Policy;

node_modules/@hapi/catbox/lib/pending.js

@@ -0,0 +1,61 @@
+'use strict';
+
+const internals = {};
+
+
+exports = module.exports = class {
+
+    id = null;
+    timeout = null;
+    count = 1;
+    rule = null;
+    resolve = null;
+    reject = null;
+
+    constructor(id, rule) {
+
+        this.id = id;
+        this.rule = rule;
+
+        this.promise = new Promise((resolve, reject) => {
+
+            this.resolve = resolve;
+            this.reject = reject;
+        });
+    }
+
+    join() {
+
+        ++this.count;
+        return this.promise;
+    }
+
+    send(err, value, cached, report) {
+
+        clearTimeout(this.timeout);
+
+        if (err &&
+            !cached) {
+
+            this.reject(err);
+            return;
+        }
+
+        if (!this.rule.getDecoratedValue) {
+            this.resolve(value);
+            return;
+        }
+
+        if (err) {
+            report.error = err;
+        }
+
+        this.resolve({ value, cached, report });
+    }
+
+    setTimeout(fn, timeoutMs) {
+
+        clearTimeout(this.timeout);
+        this.timeout = setTimeout(fn, timeoutMs);
+    }
+};

node_modules/@hapi/catbox/lib/policy.js

@@ -0,0 +1,478 @@
+'use strict';
+
+const Boom = require('@hapi/boom');
+const Hoek = require('@hapi/hoek');
+const Podium = require('@hapi/podium');
+const Validate = require('@hapi/validate');
+
+const Pending = require('./pending');
+
+
+const internals = {
+    day: 24 * 60 * 60 * 1000,
+    events: Podium.validate([
+        { name: 'error', channels: ['generate', 'persist'] }
+    ])
+};
+
+
+internals.schema = Validate.object({
+    expiresIn: Validate.number().integer().min(1),
+    expiresAt: Validate.string().regex(/^\d\d?\:\d\d$/),
+    staleIn: [
+        Validate.number().integer().min(1).when('expiresAt', { is: Validate.required(), then: Validate.number().max(86400000 - 1) }),       // One day - 1 (max is inclusive)
+        Validate.func()
+    ],
+    staleTimeout: Validate.number().integer().min(1),
+    generateFunc: Validate.func(),
+    generateTimeout: Validate.number().integer().min(1).allow(false),
+    generateOnReadError: Validate.boolean(),
+    generateIgnoreWriteError: Validate.boolean(),
+    dropOnError: Validate.boolean(),
+    pendingGenerateTimeout: Validate.number().integer().min(1),
+    getDecoratedValue: Validate.boolean().default(false),
+
+    // Ignored external keys (hapi)
+
+    privacy: Validate.any(),
+    cache: Validate.any(),
+    segment: Validate.any(),
+    shared: Validate.any()
+})
+    .without('expiresIn', 'expiresAt')
+    .with('staleIn', 'generateFunc')
+    .with('generateOnReadError', 'generateFunc')
+    .with('generateIgnoreWriteError', 'generateFunc')
+    .with('dropOnError', 'generateFunc')
+    .and('generateFunc', 'generateTimeout')
+    .and('staleIn', 'staleTimeout');
+
+
+exports = module.exports = internals.Policy = class {
+
+    rule = null;
+    stats = {
+        sets: 0,
+        gets: 0,
+        hits: 0,
+        stales: 0,
+        generates: 0,
+        errors: 0
+    };
+
+    _events = null;
+    _cache = null;
+    _segment = null;
+    _pendings = new Map();                       // id -> Pending
+    _pendingGenerateCall = new Map();            // id -> timer
+
+    constructor(options, cache, segment) {
+
+        this._cache = cache;
+        this.rules(options);
+
+        if (cache) {
+            const nameErr = cache.validateSegmentName(segment);
+            Hoek.assert(nameErr === null, 'Invalid segment name: ' + segment + (nameErr ? ' (' + nameErr.message + ')' : ''));
+
+            this._segment = segment;
+        }
+    }
+
+    get client() {
+
+        return this._cache;
+    }
+
+    get events() {
+
+        if (!this._events) {
+            this._events = new Podium.Podium(internals.events, { validate: false });
+        }
+
+        return this._events;
+    }
+
+    _error(source, error) {
+
+        if (!this._events) {
+            return;
+        }
+
+        this._events.emit({ name: 'error', channel: source }, { source, error });
+    }
+
+    rules(options) {
+
+        this.rule = internals.Policy.compile(options, !!this._cache);
+    }
+
+    async get(key) {     // key: string or { id: 'id' }
+
+        ++this.stats.gets;
+
+        // Check if request is already pending
+
+        if (!key ||
+            typeof key === 'string') {
+
+            key = { id: key, string: true };
+        }
+
+        let pending = this._pendings.get(key.id);
+        if (pending !== undefined) {
+            return pending.join();
+        }
+
+        pending = new Pending(key.id, this.rule);
+        this._pendings.set(key.id, pending);
+
+        try {
+            await this._get(pending, key);
+        }
+        catch (err) {
+            this._send(key, err);                    // Safeguard to ensure that the pending rejects on any processing errors
+        }
+
+        return pending.promise;
+    }
+
+    async _get(pending, key) {
+
+        // Prepare report
+
+        const report = {};
+
+        // Lookup in cache
+
+        const timer = new Hoek.Bench();
+
+        if (this._cache) {
+            try {
+                var cached = await this._cache.get({ segment: this._segment, id: key.id });
+            }
+            catch (err) {
+                report.error = err;
+                ++this.stats.errors;
+                this._error('persist', err);
+            }
+        }
+
+        report.msec = timer.elapsed();
+
+        if (cached) {
+            report.stored = cached.stored;
+            report.ttl = cached.ttl;
+            const staleIn = typeof this.rule.staleIn === 'function' ? this.rule.staleIn(cached.stored, cached.ttl) : this.rule.staleIn;
+            cached.isStale = staleIn ? Date.now() - cached.stored >= staleIn : false;
+            report.isStale = cached.isStale;
+
+            if (cached.isStale) {
+                ++this.stats.stales;
+            }
+        }
+
+        // No generate method
+
+        if (!this.rule.generateFunc ||
+            report.error && !this.rule.generateOnReadError) {
+
+            this._send(key, report.error, cached ? cached.item : null, cached, report);
+            return;
+        }
+
+        // Check if found and fresh
+
+        if (cached &&
+            !cached.isStale) {
+
+            this._send(key, null, cached.item, cached, report);
+            return;
+        }
+
+        // Wait until generated or otherwise resolved
+
+        return Promise.race([
+            pending.promise,
+            this._generate(pending, key, cached, report)
+        ]);
+    }
+
+    _generate(pending, key, cached, report) {
+
+        if (cached) {                                               // Must be stale
+
+            // Set stale timeout
+
+            cached.ttl = cached.ttl - this.rule.staleTimeout;       // Adjust TTL for when the timeout is invoked (staleTimeout must be valid if isStale is true)
+        }
+
+        if (cached &&
+            cached.ttl > 0) {
+
+            pending.setTimeout(() => this._send(key, null, cached.item, cached, report), this.rule.staleTimeout);
+        }
+        else if (this.rule.generateTimeout) {
+
+            // Set item generation timeout (when not in cache)
+
+            pending.setTimeout(() => this._send(key, Boom.serverUnavailable(), null, null, report), this.rule.generateTimeout);
+        }
+
+        // Check if a generate call is already in progress
+
+        if (this._pendingGenerateCall.has(key.id)) {
+            return;
+        }
+
+        // Generate new value
+
+        ++this.stats.generates;                                     // Record generation before call in case it times out
+
+        if (this.rule.pendingGenerateTimeout) {
+            const timeout = setTimeout(() => this._pendingGenerateCall.delete(key.id), this.rule.pendingGenerateTimeout);
+            this._pendingGenerateCall.set(key.id, timeout);
+        }
+
+        return this._callGenerateFunc(key, cached, report);
+    }
+
+    async _callGenerateFunc(key, cached, report) {
+
+        const flags = {};
+
+        try {
+            var value = await this.rule.generateFunc(key.string ? key.id : key, flags);
+        }
+        catch (err) {
+            var generateError = err;
+            this._error('generate', err);
+        }
+
+        const pendingTimeout = this._pendingGenerateCall.get(key.id);
+        if (pendingTimeout) {
+            clearTimeout(pendingTimeout);
+            this._pendingGenerateCall.delete(key.id);
+        }
+
+        // Error (if dropOnError is not set to false) or not cached
+
+        try {
+            if (flags.ttl === 0 ||                                                  // null or undefined means use policy
+                generateError && this.rule.dropOnError) {
+
+                await this.drop(key.id);                                            // Invalidate cache
+            }
+            else if (!generateError) {
+                await this.set(key.id, value, flags.ttl);                           // Replace stale cache copy with late-coming fresh copy
+            }
+        }
+        catch (err) {
+            var persistError = err;
+            this._error('persist', err);
+        }
+
+        const error = generateError || (this.rule.generateIgnoreWriteError ? null : persistError);
+        if (cached &&
+            error &&
+            !this.rule.dropOnError) {
+
+            this._send(key, error, cached.item, cached, report);
+            return;
+        }
+
+        this._send(key, error, value, null, report);                             // Ignored if stale value already returned
+    }
+
+    _send(key, err, value, cached, report) {
+
+        const pending = this._pendings.get(key.id);
+        if (!pending) {
+            return;
+        }
+
+        this._pendings.delete(key.id);
+        pending.send(err, value, cached, report);
+
+        if (report?.isStale !== undefined) {
+            this.stats.hits = this.stats.hits + pending.count;
+        }
+    }
+
+    async set(key, value, ttl) {
+
+        ++this.stats.sets;
+
+        if (!this._cache) {
+            return;
+        }
+
+        try {
+            await this._cache.set({ segment: this._segment, id: internals.id(key) }, value, ttl || internals.Policy.ttl(this.rule));
+        }
+        catch (err) {
+            ++this.stats.errors;
+            throw err;
+        }
+    }
+
+    async drop(key) {
+
+        if (!this._cache) {
+            return;
+        }
+
+        try {
+            await this._cache.drop({ segment: this._segment, id: internals.id(key) });
+            return;
+        }
+        catch (err) {
+            ++this.stats.errors;
+            throw err;
+        }
+    }
+
+    ttl(created) {
+
+        return internals.Policy.ttl(this.rule, created);
+    }
+
+    isReady() {
+
+        if (!this._cache) {
+            return false;
+        }
+
+        return this._cache.connection.isReady();
+    }
+
+    static compile(options, serverSide) {
+
+        /*
+            {
+                expiresIn: 30000,
+                expiresAt: '13:00',
+                generateFunc: (id, flags) => { throw err; } / { return result; } / { flags.ttl = ttl; return result; }
+                generateTimeout: 500,
+                generateOnReadError: true,
+                generateIgnoreWriteError: true,
+                staleIn: 20000,
+                staleTimeout: 500,
+                dropOnError: true,
+                getDecoratedValue: false
+            }
+         */
+
+        const rule = {};
+
+        if (!options ||
+            !Object.keys(options).length) {
+
+            return rule;
+        }
+
+        // Validate rule
+
+        options = Validate.attempt(options, internals.schema, 'Invalid cache policy configuration');
+
+        const hasExpiresIn = options.expiresIn !== undefined && options.expiresIn !== null;
+        const hasExpiresAt = options.expiresAt !== undefined && options.expiresAt !== null;
+
+        Hoek.assert(!hasExpiresIn || !options.staleIn || typeof options.staleIn === 'function' || options.staleIn < options.expiresIn, 'staleIn must be less than expiresIn');
+        Hoek.assert(!options.staleIn || serverSide, 'Cannot use stale options without server-side caching');
+        Hoek.assert(!options.staleTimeout || !hasExpiresIn || options.staleTimeout < options.expiresIn, 'staleTimeout must be less than expiresIn');
+        Hoek.assert(!options.staleTimeout || !hasExpiresIn || typeof options.staleIn === 'function' || options.staleTimeout < options.expiresIn - options.staleIn, 'staleTimeout must be less than the delta between expiresIn and staleIn');
+        Hoek.assert(!options.staleTimeout || !options.pendingGenerateTimeout || options.staleTimeout < options.pendingGenerateTimeout, 'pendingGenerateTimeout must be greater than staleTimeout if specified');
+
+        // Expiration
+
+        if (hasExpiresAt) {
+
+            // expiresAt
+
+            const time = /^(\d\d?):(\d\d)$/.exec(options.expiresAt);
+            rule.expiresAt = {
+                hours: parseInt(time[1], 10),
+                minutes: parseInt(time[2], 10)
+            };
+        }
+        else {
+
+            // expiresIn
+
+            rule.expiresIn = options.expiresIn ?? 0;
+        }
+
+        // generateTimeout
+
+        if (options.generateFunc) {
+            rule.generateFunc = options.generateFunc;
+            rule.generateTimeout = options.generateTimeout;
+
+            // Stale
+
+            if (options.staleIn) {
+                rule.staleIn = options.staleIn;
+                rule.staleTimeout = options.staleTimeout;
+            }
+
+            rule.dropOnError = options.dropOnError !== undefined ? options.dropOnError : true;                                          // Defaults to true
+            rule.pendingGenerateTimeout = options.pendingGenerateTimeout !== undefined ? options.pendingGenerateTimeout : 0;            // Defaults to zero
+        }
+
+        rule.generateOnReadError = options.generateOnReadError !== undefined ? options.generateOnReadError : true;                      // Defaults to true
+        rule.generateIgnoreWriteError = options.generateIgnoreWriteError !== undefined ? options.generateIgnoreWriteError : true;       // Defaults to true
+
+        // Decorations
+
+        rule.getDecoratedValue = options.getDecoratedValue;
+
+        return rule;
+    }
+
+    static ttl(rule, created, now) {
+
+        now = now ?? Date.now();
+        created = created ?? now;
+        const age = now - created;
+
+        if (age < 0) {
+            return 0;                                                                   // Created in the future, assume expired/bad
+        }
+
+        if (rule.expiresIn) {
+            return Math.max(rule.expiresIn - age, 0);
+        }
+
+        if (rule.expiresAt) {
+            if (age > internals.day) {                                                  // If the item was created more than a 24 hours ago
+                return 0;
+            }
+
+            const expiresAt = new Date(created);                                        // Compare expiration time on the same day
+            expiresAt.setHours(rule.expiresAt.hours);
+            expiresAt.setMinutes(rule.expiresAt.minutes);
+            expiresAt.setSeconds(0);
+            expiresAt.setMilliseconds(0);
+            let expires = expiresAt.getTime();
+
+            if (expires <= created) {
+                expires = expires + internals.day;                                     // Move to tomorrow
+            }
+
+            if (now >= expires) {                                                      // Expired
+                return 0;
+            }
+
+            return expires - now;
+        }
+
+        return 0;                                                                       // No rule
+    }
+};
+
+
+internals.id = function (key) {
+
+    return key && typeof key === 'object' ? key.id : key;
+};

node_modules/@hapi/catbox/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@hapi/catbox",
+  "description": "Multi-strategy object caching service",
+  "version": "12.1.1",
+  "repository": "git://github.com/hapijs/catbox",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib"
+  ],
+  "keywords": [
+    "cache",
+    "generic",
+    "adapter"
+  ],
+  "eslintConfig": {
+    "extends": [
+      "plugin:@hapi/module"
+    ]
+  },
+  "dependencies": {
+    "@hapi/boom": "^10.0.1",
+    "@hapi/hoek": "^11.0.2",
+    "@hapi/podium": "^5.0.0",
+    "@hapi/validate": "^2.0.1"
+  },
+  "devDependencies": {
+    "@hapi/code": "^9.0.3",
+    "@hapi/eslint-plugin": "*",
+    "@hapi/lab": "^25.1.2",
+    "@types/node": "^18.11.9",
+    "typescript": "^4.9.3"
+  },
+  "scripts": {
+    "test": "lab -a @hapi/code -t 100 -L -m 5000 -Y",
+    "test-cov-html": "lab -a @hapi/code -r html -o coverage.html"
+  },
+  "license": "BSD-3-Clause"
+}

node_modules/@hapi/content/LICENSE.md

@@ -0,0 +1,11 @@
+Copyright (c) 2014-2022, Project contributors
+Copyright (c) 2014-2020, Sideway Inc
+Copyright (c) 2014, Walmart.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS OFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/content/README.md

@@ -0,0 +1,17 @@
+<a href="https://hapi.dev"><img src="https://raw.githubusercontent.com/hapijs/assets/master/images/family.png" width="180px" align="right" /></a>
+
+# @hapi/content
+
+#### HTTP Content-* headers parsing.
+
+**content** is part of the **hapi** ecosystem and was designed to work seamlessly with the [hapi web framework](https://hapi.dev) and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out [hapi](https://hapi.dev) – they work even better together.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/family/content/)
+- [Versions status](https://hapi.dev/resources/status/#content) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/family/content/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Free and commercial support options](https://hapi.dev/support/)

node_modules/@hapi/content/lib/index.js

@@ -0,0 +1,145 @@
+'use strict';
+
+const Boom = require('@hapi/boom');
+
+
+const internals = {};
+
+
+/*
+    RFC 7231 Section 3.1.1.1
+
+    media-type = type "/" subtype *( OWS ";" OWS parameter )
+    type       = token
+    subtype    = token
+    parameter  = token "=" ( token / quoted-string )
+*/
+
+//                             1: type/subtype    2: params
+internals.contentTypeRegex = /^([^\/\s]+\/[^\s;]+)(.*)?$/;
+
+//                                             1: "b"   2: b
+internals.charsetParamRegex = /;\s*charset=(?:"([^"]+)"|([^;"\s]+))/i;
+
+//                                               1: "b"   2: b
+internals.boundaryParamRegex = /;\s*boundary=(?:"([^"]+)"|([^;"\s]+))/i;
+
+
+exports.type = function (header) {
+
+    if (!header) {
+        throw Boom.badRequest('Invalid content-type header');
+    }
+
+    const match = header.match(internals.contentTypeRegex);
+    if (!match) {
+        throw Boom.badRequest('Invalid content-type header');
+    }
+
+    const result = {
+        mime: match[1].toLowerCase()
+    };
+
+    const params = match[2];
+    if (params) {
+        const param = params.match(internals.charsetParamRegex);
+        if (param) {
+            result.charset = (param[1] || param[2]).toLowerCase();
+        }
+    }
+
+    if (result.mime.indexOf('multipart/') === 0) {
+        if (params) {
+            const param = params.match(internals.boundaryParamRegex);
+            if (param) {
+                result.boundary = param[1] || param[2];
+            }
+        }
+
+        if (!result.boundary) {
+            throw Boom.badRequest('Invalid content-type header: multipart missing boundary');
+        }
+    }
+
+    return result;
+};
+
+
+/*
+    RFC 6266 Section 4.1 (http://tools.ietf.org/html/rfc6266#section-4.1)
+
+    content-disposition = "Content-Disposition" ":" disposition-type *( ";" disposition-parm )
+    disposition-type    = "inline" | "attachment" | token                                           ; case-insensitive
+    disposition-parm    = filename-parm | token [ "*" ] "=" ( token | quoted-string | ext-value)    ; ext-value defined in [RFC5987], Section 3.2
+
+    Content-Disposition header field values with multiple instances of the same parameter name are invalid.
+
+    Note that due to the rules for implied linear whitespace (Section 2.1 of [RFC2616]), OPTIONAL whitespace
+    can appear between words (token or quoted-string) and separator characters.
+
+    Furthermore, note that the format used for ext-value allows specifying a natural language (e.g., "en"); this is of limited use
+    for filenames and is likely to be ignored by recipients.
+*/
+
+
+internals.contentDispositionRegex = /^\s*form-data\s*(?:;\s*(.+))?$/i;
+
+//                                        1: name     2: *            3: ext-value                      4: quoted  5: token
+internals.contentDispositionParamRegex = /([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;'"\s]+\'[\w-]*\'[^;\s]+)|(?:\"([^"]*)\")|([^;\s]*))(?:\s*(?:;\s*)|$)/g;
+
+exports.disposition = function (header) {
+
+    if (!header) {
+        throw Boom.badRequest('Missing content-disposition header');
+    }
+
+    const match = header.match(internals.contentDispositionRegex);
+    if (!match) {
+        throw Boom.badRequest('Invalid content-disposition header format');
+    }
+
+    const parameters = match[1];
+    if (!parameters) {
+        throw Boom.badRequest('Invalid content-disposition header missing parameters');
+    }
+
+    const result = {};
+    parameters.replace(internals.contentDispositionParamRegex, ($0, $1, $2, $3, $4, $5) => {
+
+        if ($1 === '__proto__') {
+            throw Boom.badRequest('Invalid content-disposition header format includes invalid parameters');
+        }
+
+        let value;
+
+        if ($2) {
+            if (!$3) {
+                throw Boom.badRequest('Invalid content-disposition header format includes invalid parameters');
+            }
+
+            try {
+                value = decodeURIComponent($3.split('\'')[2]);
+            }
+            catch (err) {
+                throw Boom.badRequest('Invalid content-disposition header format includes invalid parameters');
+            }
+        }
+        else {
+            value = $4 || $5 || '';
+        }
+
+        if ($1 === 'name' &&
+            value === '__proto__') {
+
+            throw Boom.badRequest('Invalid content-disposition header format includes invalid parameters');
+        }
+
+        result[$1] = value;
+    });
+
+    if (!result.name) {
+        throw Boom.badRequest('Invalid content-disposition header missing name parameter');
+    }
+
+    return result;
+};

node_modules/@hapi/content/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@hapi/content",
+  "description": "HTTP Content-* headers parsing",
+  "version": "6.0.0",
+  "repository": "git://github.com/hapijs/content",
+  "main": "lib/index.js",
+  "files": [
+    "lib"
+  ],
+  "keywords": [
+    "HTTP",
+    "header",
+    "content",
+    "content-type",
+    "content-disposition"
+  ],
+  "eslintConfig": {
+    "extends": [
+      "plugin:@hapi/module"
+    ]
+  },
+  "dependencies": {
+    "@hapi/boom": "^10.0.0"
+  },
+  "devDependencies": {
+    "@hapi/code": "^9.0.0",
+    "@hapi/eslint-plugin": "*",
+    "@hapi/lab": "^25.0.1"
+  },
+  "scripts": {
+    "test": "lab -a @hapi/code -t 100 -L",
+    "test-cov-html": "lab -a @hapi/code -r html -o coverage.html"
+  },
+  "license": "BSD-3-Clause"
+}

node_modules/@hapi/cryptiles/LICENSE.md

@@ -0,0 +1,10 @@
+Copyright (c) 2014-2022, Project contributors
+Copyright (c) 2014-2020, Sideway Inc
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS OFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/cryptiles/README.md

@@ -0,0 +1,17 @@
+<a href="https://hapi.dev"><img src="https://raw.githubusercontent.com/hapijs/assets/master/images/family.png" width="180px" align="right" /></a>
+
+# @hapi/cryptiles
+
+#### General purpose crypto utilities.
+
+**cryptiles** is part of the **hapi** ecosystem and was designed to work seamlessly with the [hapi web framework](https://hapi.dev) and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out [hapi](https://hapi.dev) – they work even better together.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/family/cryptiles/)
+- [Versions status](https://hapi.dev/resources/status/#cryptiles) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/family/cryptiles/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Free and commercial support options](https://hapi.dev/support/)

node_modules/@hapi/cryptiles/lib/index.d.ts

@@ -0,0 +1,54 @@
+/**
+Generate a cryptographically strong pseudo-random data
+
+@param size - Size of the string
+
+@returns A cryptographically strong pseudo-random data
+*/
+
+export function randomString(size: number): string;
+
+
+/**
+Generate a cryptographically strong pseudo-random alphanumeric data
+
+@param size - Size of the string
+
+@returns A cryptographically strong pseudo-random alphanumeric data
+*/
+
+export function randomAlphanumString(size: number): string;
+
+
+/**
+Return a random string of digits
+
+@param size - Size of the digits
+
+@returns A random string of digits
+*/
+
+export function randomDigits(size: number): string;
+
+
+/**
+Generate a buffer of random bits
+
+@param bits - Number of bits
+
+@returns A buffer of random bits
+*/
+
+export function randomBits(bits: number): Buffer;
+
+
+/**
+Generate a buffer of random bits
+
+@param a - Data to compare
+@param b - Data to compare
+
+@returns A boolean comparing a and b
+*/
+
+export function fixedTimeComparison(a: string | Array<any>, b: string | Array<any>): boolean;

node_modules/@hapi/cryptiles/lib/index.js

@@ -0,0 +1,96 @@
+'use strict';
+
+const Crypto = require('crypto');
+
+const Boom = require('@hapi/boom');
+
+
+const internals = {};
+
+
+// Generate a cryptographically strong pseudo-random data
+
+exports.randomString = function (size) {
+
+    const buffer = exports.randomBits((size + 1) * 6);
+    const string = buffer.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/\=/g, '');
+    return string.slice(0, size);
+};
+
+
+// Generate a cryptographically strong pseudo-random alphanum data
+
+exports.randomAlphanumString = function (size) {
+
+    let result = '';
+
+    while (result.length < size) {
+        const buffer = exports.randomBits((size + 1) * 6);
+        result += buffer.toString('base64').replace(/[^a-zA-Z0-9]/g, '');
+    }
+
+    return result.slice(0, size);
+};
+
+
+// Return a random string of digits
+
+exports.randomDigits = function (size) {
+
+    const digits = [];
+
+    let buffer = internals.random(size * 2);            // Provision twice the amount of bytes needed to increase chance of single pass
+    let pos = 0;
+
+    while (digits.length < size) {
+        if (pos >= buffer.length) {
+            buffer = internals.random(size * 2);
+            pos = 0;
+        }
+
+        if (buffer[pos] < 250) {
+            digits.push(buffer[pos] % 10);
+        }
+
+        ++pos;
+    }
+
+    return digits.join('');
+};
+
+
+// Generate a buffer of random bits
+
+exports.randomBits = function (bits) {
+
+    if (!bits ||
+        bits < 0) {
+
+        throw Boom.internal('Invalid random bits count');
+    }
+
+    const bytes = Math.ceil(bits / 8);
+    return internals.random(bytes);
+};
+
+
+exports.fixedTimeComparison = function (a, b) {
+
+    try {
+        return Crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+    }
+    catch (err) {
+        return false;
+    }
+};
+
+
+internals.random = function (bytes) {
+
+    try {
+        return Crypto.randomBytes(bytes);
+    }
+    catch (err) {
+        throw Boom.internal('Failed generating random bits: ' + err.message);
+    }
+};

node_modules/@hapi/cryptiles/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@hapi/cryptiles",
+  "description": "General purpose crypto utilities",
+  "version": "6.0.3",
+  "repository": "git://github.com/hapijs/cryptiles",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "engines": {
+    "node": ">=14.0.0"
+  },
+  "files": [
+    "lib"
+  ],
+  "keywords": [
+    "cryptography",
+    "security",
+    "utilites"
+  ],
+  "eslintConfig": {
+    "extends": [
+      "plugin:@hapi/module"
+    ]
+  },
+  "dependencies": {
+    "@hapi/boom": "^10.0.1"
+  },
+  "devDependencies": {
+    "@hapi/code": "^9.0.3",
+    "@hapi/eslint-plugin": "^6.0.0",
+    "@hapi/lab": "^25.1.2",
+    "@types/node": "^17.0.31",
+    "typescript": "~4.6.4"
+  },
+  "scripts": {
+    "test": "lab -a @hapi/code -t 100 -L -Y",
+    "test-cov-html": "lab -a @hapi/code -t 100 -L -r html -o coverage.html"
+  },
+  "license": "BSD-3-Clause"
+}

node_modules/@hapi/file/LICENSE.md

@@ -0,0 +1,9 @@
+Copyright (c) 2019-2022, Project contributors
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+ * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+ * The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/file/README.md

@@ -0,0 +1,17 @@
+<a href="https://hapi.dev"><img src="https://raw.githubusercontent.com/hapijs/assets/master/images/family.png" width="180px" align="right" /></a>
+
+# @hapi/file
+
+#### General purpose file utilities.
+
+**file** is part of the **hapi** ecosystem and was designed to work seamlessly with the [hapi web framework](https://hapi.dev) and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out [hapi](https://hapi.dev) – they work even better together.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/family/file/)
+- [Versions status](https://hapi.dev/resources/status/#file) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/family/file/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Free and commercial support options](https://hapi.dev/support/)

node_modules/@hapi/file/lib/index.d.ts

@@ -0,0 +1,9 @@
+/**
+Generate a random file name within a given path and optional extension.
+
+@param path - The file path within to generate a temporary file.
+@param extension - File extension.
+
+@return The generarted filename.
+*/
+export function uniqueFilename(path: string, extension?: string): string;

node_modules/@hapi/file/lib/index.js

@@ -0,0 +1,22 @@
+'use strict';
+
+const Crypto = require('crypto');
+const Path = require('path');
+
+
+const internals = {};
+
+
+exports.uniqueFilename = function (path, extension) {
+
+    if (extension) {
+        extension = extension[0] !== '.' ? '.' + extension : extension;
+    }
+    else {
+        extension = '';
+    }
+
+    path = Path.resolve(path);
+    const name = [Date.now(), process.pid, Crypto.randomBytes(8).toString('hex')].join('-') + extension;
+    return Path.join(path, name);
+};

node_modules/@hapi/file/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@hapi/file",
+  "description": "General purpose file utilities",
+  "version": "3.0.0",
+  "repository": "git://github.com/hapijs/file",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib"
+  ],
+  "keywords": [
+    "utilities",
+    "file"
+  ],
+  "eslintConfig": {
+    "extends": [
+      "plugin:@hapi/module"
+    ]
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@hapi/code": "^9.0.0",
+    "@hapi/eslint-plugin": "*",
+    "@hapi/lab": "^25.0.1",
+    "@types/node": "^17.0.36",
+    "typescript": "~4.7.2"
+  },
+  "scripts": {
+    "test": "lab -a @hapi/code -t 100 -L -Y",
+    "test-cov-html": "lab -a @hapi/code -t 100 -L -r html -o coverage.html"
+  },
+  "license": "BSD-3-Clause"
+}

node_modules/@hapi/hapi/LICENSE.md

@@ -0,0 +1,13 @@
+Copyright (c) 2011-2022, Project contributors
+Copyright (c) 2011-2020, Sideway Inc
+Copyright (c) 2011-2014, Walmart  
+Copyright (c) 2011, Yahoo Inc.  
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+- Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+- Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+- The names of any contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS OFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/@hapi/hapi/README.md

@@ -0,0 +1,26 @@
+<img src="https://raw.githubusercontent.com/hapijs/assets/master/images/hapi.png" width="400px" />
+
+# @hapi/hapi
+
+#### The Simple, Secure Framework Developers Trust
+
+Build powerful, scalable applications, with minimal overhead and full out-of-the-box functionality - your code, your way.
+
+### Visit the [hapi.dev](https://hapi.dev) Developer Portal for tutorials, documentation, and support
+
+## Useful resources
+
+- [Documentation and API](https://hapi.dev/)
+- [Version status](https://hapi.dev/resources/status/#hapi) (builds, dependencies, node versions, licenses, eol)
+- [Changelog](https://hapi.dev/resources/changelog/)
+- [Project policies](https://hapi.dev/policies/)
+- [Support](https://hapi.dev/support/)
+
+## Technical Steering Committee (TSC) Members
+
+ - Devin Ivy ([@devinivy](https://github.com/devinivy))
+ - Lloyd Benson ([@lloydbenson](https://github.com/lloydbenson))
+ - Nathan LaFreniere ([@nlf](https://github.com/nlf))
+ - Wyatt Lyon Preul ([@geek](https://github.com/geek))
+ - Nicolas Morel ([@marsup](https://github.com/marsup))
+ - Jonathan Samines ([@jonathansamines](https://github.com/jonathansamines))

node_modules/@hapi/hapi/lib/auth.js

@@ -0,0 +1,571 @@
+'use strict';
+
+const Boom = require('@hapi/boom');
+const Bounce = require('@hapi/bounce');
+const Hoek = require('@hapi/hoek');
+
+const Config = require('./config');
+const Request = require('./request');
+
+
+const internals = {
+    missing: Symbol('missing')
+};
+
+
+exports = module.exports = internals.Auth = class {
+
+    #core = null;
+    #schemes = {};
+    #strategies = {};
+
+    api = {};                   // Do not reassign api or settings, as they are referenced in public()
+    settings = {
+        default: null           // Strategy used as default if route has no auth settings
+    };
+
+    constructor(core) {
+
+        this.#core = core;
+    }
+
+    public(server) {
+
+        return {
+            api: this.api,
+            settings: this.settings,
+            scheme: this.scheme.bind(this),
+            strategy: this._strategy.bind(this, server),
+            default: this.default.bind(this),
+            test: this.test.bind(this),
+            verify: this.verify.bind(this),
+            lookup: this.lookup.bind(this)
+        };
+    }
+
+    scheme(name, scheme) {
+
+        Hoek.assert(name, 'Authentication scheme must have a name');
+        Hoek.assert(!this.#schemes[name], 'Authentication scheme name already exists:', name);
+        Hoek.assert(typeof scheme === 'function', 'scheme must be a function:', name);
+
+        this.#schemes[name] = scheme;
+    }
+
+    _strategy(server, name, scheme, options = {}) {
+
+        Hoek.assert(name, 'Authentication strategy must have a name');
+        Hoek.assert(typeof options === 'object', 'options must be an object');
+        Hoek.assert(!this.#strategies[name], 'Authentication strategy name already exists');
+        Hoek.assert(scheme, 'Authentication strategy', name, 'missing scheme');
+        Hoek.assert(this.#schemes[scheme], 'Authentication strategy', name, 'uses unknown scheme:', scheme);
+
+        server = server._clone();
+        const strategy = this.#schemes[scheme](server, options);
+
+        Hoek.assert(strategy.authenticate, 'Invalid scheme:', name, 'missing authenticate() method');
+        Hoek.assert(typeof strategy.authenticate === 'function', 'Invalid scheme:', name, 'invalid authenticate() method');
+        Hoek.assert(!strategy.payload || typeof strategy.payload === 'function', 'Invalid scheme:', name, 'invalid payload() method');
+        Hoek.assert(!strategy.response || typeof strategy.response === 'function', 'Invalid scheme:', name, 'invalid response() method');
+        strategy.options = strategy.options ?? {};
+        Hoek.assert(strategy.payload || !strategy.options.payload, 'Cannot require payload validation without a payload method');
+
+        this.#strategies[name] = {
+            methods: strategy,
+            realm: server.realm
+        };
+
+        if (strategy.api) {
+            this.api[name] = strategy.api;
+        }
+    }
+
+    default(options) {
+
+        Hoek.assert(!this.settings.default, 'Cannot set default strategy more than once');
+        options = Config.apply('auth', options, 'default strategy');
+
+        this.settings.default = this._setupRoute(Hoek.clone(options));      // Prevent changes to options
+
+        const routes = this.#core.router.table();
+        for (const route of routes) {
+            route.rebuild();
+        }
+    }
+
+    async test(name, request) {
+
+        Hoek.assert(name, 'Missing authentication strategy name');
+        const strategy = this.#strategies[name];
+        Hoek.assert(strategy, 'Unknown authentication strategy:', name);
+
+        const bind = strategy.methods;
+        const realm = strategy.realm;
+        const response = await request._core.toolkit.execute(strategy.methods.authenticate, request, { bind, realm, auth: true });
+
+        if (!response.isAuth) {
+            throw response;
+        }
+
+        if (response.error) {
+            throw response.error;
+        }
+
+        return response.data;
+    }
+
+    async verify(request) {
+
+        const auth = request.auth;
+
+        if (auth.error) {
+            throw auth.error;
+        }
+
+        if (!auth.isAuthenticated) {
+            return;
+        }
+
+        const strategy = this.#strategies[auth.strategy];
+        Hoek.assert(strategy, 'Unknown authentication strategy:', auth.strategy);
+
+        if (!strategy.methods.verify) {
+            return;
+        }
+
+        const bind = strategy.methods;
+        await strategy.methods.verify.call(bind, auth);
+    }
+
+    static testAccess(request, route) {
+
+        const auth = request._core.auth;
+
+        try {
+            return auth._access(request, route);
+        }
+        catch (err) {
+            Bounce.rethrow(err, 'system');
+            return false;
+        }
+    }
+
+    _setupRoute(options, path) {
+
+        if (!options) {
+            return options;         // Preserve the difference between undefined and false
+        }
+
+        if (typeof options === 'string') {
+            options = { strategies: [options] };
+        }
+        else if (options.strategy) {
+            options.strategies = [options.strategy];
+            delete options.strategy;
+        }
+
+        if (path &&
+            !options.strategies) {
+
+            Hoek.assert(this.settings.default, 'Route missing authentication strategy and no default defined:', path);
+            options = Hoek.applyToDefaults(this.settings.default, options);
+        }
+
+        path = path ?? 'default strategy';
+        Hoek.assert(options.strategies?.length, 'Missing authentication strategy:', path);
+
+        options.mode = options.mode ?? 'required';
+
+        if (options.entity !== undefined ||                                             // Backwards compatibility with <= 11.x.x
+            options.scope !== undefined) {
+
+            options.access = [{ entity: options.entity, scope: options.scope }];
+            delete options.entity;
+            delete options.scope;
+        }
+
+        if (options.access) {
+            for (const access of options.access) {
+                access.scope = internals.setupScope(access);
+            }
+        }
+
+        if (options.payload === true) {
+            options.payload = 'required';
+        }
+
+        let hasAuthenticatePayload = false;
+        for (const name of options.strategies) {
+            const strategy = this.#strategies[name];
+            Hoek.assert(strategy, 'Unknown authentication strategy', name, 'in', path);
+
+            Hoek.assert(strategy.methods.payload || options.payload !== 'required', 'Payload validation can only be required when all strategies support it in', path);
+            hasAuthenticatePayload = hasAuthenticatePayload || strategy.methods.payload;
+            Hoek.assert(!strategy.methods.options.payload || options.payload === undefined || options.payload === 'required', 'Cannot set authentication payload to', options.payload, 'when a strategy requires payload validation in', path);
+        }
+
+        Hoek.assert(!options.payload || hasAuthenticatePayload, 'Payload authentication requires at least one strategy with payload support in', path);
+
+        return options;
+    }
+
+    lookup(route) {
+
+        if (route.settings.auth === false) {
+            return false;
+        }
+
+        return route.settings.auth || this.settings.default;
+    }
+
+    _enabled(route, type) {
+
+        const config = this.lookup(route);
+        if (!config) {
+            return false;
+        }
+
+        if (type === 'authenticate') {
+            return true;
+        }
+
+        if (type === 'access') {
+            return !!config.access;
+        }
+
+        for (const name of config.strategies) {
+            const strategy = this.#strategies[name];
+            if (strategy.methods[type]) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    static authenticate(request) {
+
+        const auth = request._core.auth;
+        return auth._authenticate(request);
+    }
+
+    async _authenticate(request) {
+
+        const config = this.lookup(request.route);
+
+        const errors = [];
+        request.auth.mode = config.mode;
+
+        // Injection bypass
+
+        if (request.auth.credentials) {
+            internals.validate(null, { credentials: request.auth.credentials, artifacts: request.auth.artifacts }, request.auth.strategy, config, request, errors);
+            return;
+        }
+
+        // Try each strategy
+
+        for (const name of config.strategies) {
+            const strategy = this.#strategies[name];
+
+            const bind = strategy.methods;
+            const realm = strategy.realm;
+            const response = await request._core.toolkit.execute(strategy.methods.authenticate, request, { bind, realm, auth: true });
+
+            const message = (response.isAuth ? internals.validate(response.error, response.data, name, config, request, errors) : internals.validate(response, null, name, config, request, errors));
+            if (!message) {
+                return;
+            }
+
+            if (message !== internals.missing) {
+                return message;
+            }
+        }
+
+        // No more strategies
+
+        const err = Boom.unauthorized('Missing authentication', errors);
+        if (config.mode === 'required') {
+            throw err;
+        }
+
+        request.auth.isAuthenticated = false;
+        request.auth.credentials = null;
+        request.auth.error = err;
+        request._log(['auth', 'unauthenticated']);
+    }
+
+    static access(request) {
+
+        const auth = request._core.auth;
+        request.auth.isAuthorized = auth._access(request);
+    }
+
+    _access(request, route) {
+
+        const config = this.lookup(route || request.route);
+        if (!config?.access) {
+            return true;
+        }
+
+        const credentials = request.auth.credentials;
+        if (!credentials) {
+            if (config.mode !== 'required') {
+                return false;
+            }
+
+            throw Boom.forbidden('Request is unauthenticated');
+        }
+
+        const requestEntity = (credentials.user ? 'user' : 'app');
+
+        const scopeErrors = [];
+        for (const access of config.access) {
+
+            // Check entity
+
+            const entity = access.entity;
+            if (entity &&
+                entity !== 'any' &&
+                entity !== requestEntity) {
+
+                continue;
+            }
+
+            // Check scope
+
+            let scope = access.scope;
+            if (scope) {
+                if (!credentials.scope) {
+                    scopeErrors.push(scope);
+                    continue;
+                }
+
+                scope = internals.expandScope(request, scope);
+                if (!internals.validateScope(credentials, scope, 'required') ||
+                    !internals.validateScope(credentials, scope, 'selection') ||
+                    !internals.validateScope(credentials, scope, 'forbidden')) {
+
+                    scopeErrors.push(scope);
+                    continue;
+                }
+            }
+
+            return true;
+        }
+
+        // Scope error
+
+        if (scopeErrors.length) {
+            request._log(['auth', 'scope', 'error']);
+            throw Boom.forbidden('Insufficient scope', { got: credentials.scope, need: scopeErrors });
+        }
+
+        // Entity error
+
+        if (requestEntity === 'app') {
+            request._log(['auth', 'entity', 'user', 'error']);
+            throw Boom.forbidden('Application credentials cannot be used on a user endpoint');
+        }
+
+        request._log(['auth', 'entity', 'app', 'error']);
+        throw Boom.forbidden('User credentials cannot be used on an application endpoint');
+    }
+
+    static async payload(request) {
+
+        if (!request.auth.isAuthenticated || !request.auth[Request.symbols.authPayload]) {
+            return;
+        }
+
+        const auth = request._core.auth;
+        const strategy = auth.#strategies[request.auth.strategy];
+        Hoek.assert(strategy, 'Unknown authentication strategy:', request.auth.strategy);
+
+        if (!strategy.methods.payload) {
+            return;
+        }
+
+        const config = auth.lookup(request.route);
+        const setting = config.payload ?? (strategy.methods.options.payload ? 'required' : false);
+        if (!setting) {
+            return;
+        }
+
+        const bind = strategy.methods;
+        const realm = strategy.realm;
+        const response = await request._core.toolkit.execute(strategy.methods.payload, request, { bind, realm });
+
+        if (response.isBoom &&
+            response.isMissing) {
+
+            return setting === 'optional' ? undefined : Boom.unauthorized('Missing payload authentication');
+        }
+
+        return response;
+    }
+
+    static async response(response) {
+
+        const request = response.request;
+        const auth = request._core.auth;
+        if (!request.auth.isAuthenticated) {
+            return;
+        }
+
+        const strategy = auth.#strategies[request.auth.strategy];
+        Hoek.assert(strategy, 'Unknown authentication strategy:', request.auth.strategy);
+
+        if (!strategy.methods.response) {
+            return;
+        }
+
+        const bind = strategy.methods;
+        const realm = strategy.realm;
+        const error = await request._core.toolkit.execute(strategy.methods.response, request, { bind, realm, continue: 'undefined' });
+        if (error) {
+            throw error;
+        }
+    }
+};
+
+
+internals.setupScope = function (access) {
+
+    // No scopes
+
+    if (!access.scope) {
+        return false;
+    }
+
+    // Already setup
+
+    if (!Array.isArray(access.scope)) {
+        return access.scope;
+    }
+
+    const scope = {};
+    for (const value of access.scope) {
+        const prefix = value[0];
+        const type = prefix === '+' ? 'required' : (prefix === '!' ? 'forbidden' : 'selection');
+        const clean = type === 'selection' ? value : value.slice(1);
+        scope[type] = scope[type] ?? [];
+        scope[type].push(clean);
+
+        if ((!scope._hasParameters?.[type]) &&
+            /{([^}]+)}/.test(clean)) {
+
+            scope._hasParameters = scope._hasParameters ?? {};
+            scope._hasParameters[type] = true;
+        }
+    }
+
+    return scope;
+};
+
+
+internals.validate = function (err, result, name, config, request, errors) {                 // err can be Boom, Error, or a valid response object
+
+    result = result ?? {};
+    request.auth.isAuthenticated = !err;
+
+    if (err) {
+
+        // Non-error response
+
+        if (err instanceof Error === false) {
+            request._log(['auth', 'unauthenticated', 'response', name], { statusCode: err.statusCode });
+            return err;
+        }
+
+        // Missing authenticated
+
+        if (err.isMissing) {
+            request._log(['auth', 'unauthenticated', 'missing', name], err);
+            errors.push(err.output.headers['WWW-Authenticate']);
+            return internals.missing;
+        }
+    }
+
+    request.auth.strategy = name;
+    request.auth.credentials = result.credentials;
+    request.auth.artifacts = result.artifacts;
+
+    // Authenticated
+
+    if (!err) {
+        return;
+    }
+
+    // Unauthenticated
+
+    request.auth.error = err;
+
+    if (config.mode === 'try') {
+        request._log(['auth', 'unauthenticated', 'try', name], err);
+        return;
+    }
+
+    request._log(['auth', 'unauthenticated', 'error', name], err);
+    throw err;
+};
+
+
+internals.expandScope = function (request, scope) {
+
+    if (!scope._hasParameters) {
+        return scope;
+    }
+
+    const expanded = {
+        required: internals.expandScopeType(request, scope, 'required'),
+        selection: internals.expandScopeType(request, scope, 'selection'),
+        forbidden: internals.expandScopeType(request, scope, 'forbidden')
+    };
+
+    return expanded;
+};
+
+
+internals.expandScopeType = function (request, scope, type) {
+
+    if (!scope._hasParameters[type]) {
+        return scope[type];
+    }
+
+    const expanded = [];
+    const context = {
+        params: request.params,
+        query: request.query,
+        payload: request.payload,
+        credentials: request.auth.credentials
+    };
+
+    for (const template of scope[type]) {
+        expanded.push(Hoek.reachTemplate(context, template));
+    }
+
+    return expanded;
+};
+
+
+internals.validateScope = function (credentials, scope, type) {
+
+    if (!scope[type]) {
+        return true;
+    }
+
+    const count = typeof credentials.scope === 'string' ?
+        scope[type].indexOf(credentials.scope) !== -1 ? 1 : 0 :
+        Hoek.intersect(scope[type], credentials.scope).length;
+
+    if (type === 'forbidden') {
+        return count === 0;
+    }
+
+    if (type === 'required') {
+        return count === scope.required.length;
+    }
+
+    return !!count;
+};

node_modules/@hapi/hapi/lib/compression.js

@@ -0,0 +1,119 @@
+'use strict';
+
+const Zlib = require('zlib');
+
+const Accept = require('@hapi/accept');
+const Bounce = require('@hapi/bounce');
+const Hoek = require('@hapi/hoek');
+
+
+const internals = {
+    common: ['gzip, deflate', 'deflate, gzip', 'gzip', 'deflate', 'gzip, deflate, br']
+};
+
+
+exports = module.exports = internals.Compression = class {
+
+    decoders = {
+        gzip: (options) => Zlib.createGunzip(options),
+        deflate: (options) => Zlib.createInflate(options)
+    };
+
+    encodings = ['identity', 'gzip', 'deflate'];
+
+    encoders = {
+        identity: null,
+        gzip: (options) => Zlib.createGzip(options),
+        deflate: (options) => Zlib.createDeflate(options)
+    };
+
+    #common = null;
+
+    constructor() {
+
+        this._updateCommons();
+    }
+
+    _updateCommons() {
+
+        this.#common = new Map();
+
+        for (const header of internals.common) {
+            this.#common.set(header, Accept.encoding(header, this.encodings));
+        }
+    }
+
+    addEncoder(encoding, encoder) {
+
+        Hoek.assert(this.encoders[encoding] === undefined, `Cannot override existing encoder for ${encoding}`);
+        Hoek.assert(typeof encoder === 'function', `Invalid encoder function for ${encoding}`);
+        this.encoders[encoding] = encoder;
+        this.encodings.unshift(encoding);
+        this._updateCommons();
+    }
+
+    addDecoder(encoding, decoder) {
+
+        Hoek.assert(this.decoders[encoding] === undefined, `Cannot override existing decoder for ${encoding}`);
+        Hoek.assert(typeof decoder === 'function', `Invalid decoder function for ${encoding}`);
+        this.decoders[encoding] = decoder;
+    }
+
+    accept(request) {
+
+        const header = request.headers['accept-encoding'];
+        if (!header) {
+            return 'identity';
+        }
+
+        const common = this.#common.get(header);
+        if (common) {
+            return common;
+        }
+
+        try {
+            return Accept.encoding(header, this.encodings);
+        }
+        catch (err) {
+            Bounce.rethrow(err, 'system');
+            err.header = header;
+            request._log(['accept-encoding', 'error'], err);
+            return 'identity';
+        }
+    }
+
+    encoding(response, length) {
+
+        if (response.settings.compressed) {
+            response.headers['content-encoding'] = response.settings.compressed;
+            return null;
+        }
+
+        const request = response.request;
+        if (!request._core.settings.compression ||
+            length !== null && length < request._core.settings.compression.minBytes) {
+
+            return null;
+        }
+
+        const mime = request._core.mime.type(response.headers['content-type'] || 'application/octet-stream');
+        if (!mime.compressible) {
+            return null;
+        }
+
+        response.vary('accept-encoding');
+
+        if (response.headers['content-encoding']) {
+            return null;
+        }
+
+        return request.info.acceptEncoding === 'identity' ? null : request.info.acceptEncoding;
+    }
+
+    encoder(request, encoding) {
+
+        const encoder = this.encoders[encoding];
+        Hoek.assert(encoder !== undefined, `Unknown encoding ${encoding}`);
+        return encoder(request.route.settings.compression[encoding]);
+    }
+};

node_modules/@hapi/hapi/lib/config.js

@@ -0,0 +1,446 @@
+'use strict';
+
+const Os = require('os');
+
+const Somever = require('@hapi/somever');
+const Validate = require('@hapi/validate');
+
+
+const internals = {};
+
+
+exports.symbol = Symbol('hapi-response');
+
+
+exports.apply = function (type, options, ...message) {
+
+    const result = internals[type].validate(options);
+
+    if (result.error) {
+        throw new Error(`Invalid ${type} options ${message.length ? '(' + message.join(' ') + ')' : ''} ${result.error.annotate()}`);
+    }
+
+    return result.value;
+};
+
+
+exports.enable = function (options) {
+
+    const settings = options ? Object.assign({}, options) : {};         // Shallow cloned
+
+    if (settings.security === true) {
+        settings.security = {};
+    }
+
+    if (settings.cors === true) {
+        settings.cors = {};
+    }
+
+    return settings;
+};
+
+exports.versionMatch = (version, range) => Somever.match(version, range, { includePrerelease: true });
+
+internals.access = Validate.object({
+    entity: Validate.valid('user', 'app', 'any'),
+    scope: [false, Validate.array().items(Validate.string()).single().min(1)]
+});
+
+
+internals.auth = Validate.alternatives([
+    Validate.string(),
+    internals.access.keys({
+        mode: Validate.valid('required', 'optional', 'try'),
+        strategy: Validate.string(),
+        strategies: Validate.array().items(Validate.string()).min(1),
+        access: Validate.array().items(internals.access.min(1)).single().min(1),
+        payload: [
+            Validate.valid('required', 'optional'),
+            Validate.boolean()
+        ]
+    })
+        .without('strategy', 'strategies')
+        .without('access', ['scope', 'entity'])
+]);
+
+
+internals.event = Validate.object({
+    method: Validate.array().items(Validate.function()).single(),
+    options: Validate.object({
+        before: Validate.array().items(Validate.string()).single(),
+        after: Validate.array().items(Validate.string()).single(),
+        bind: Validate.any(),
+        sandbox: Validate.valid('server', 'plugin'),
+        timeout: Validate.number().integer().min(1)
+    })
+        .default({})
+});
+
+
+internals.exts = Validate.array()
+    .items(internals.event.keys({ type: Validate.string().required() })).single();
+
+
+internals.failAction = Validate.alternatives([
+    Validate.valid('error', 'log', 'ignore'),
+    Validate.function()
+])
+    .default('error');
+
+
+internals.routeBase = Validate.object({
+    app: Validate.object().allow(null),
+    auth: internals.auth.allow(false),
+    bind: Validate.object().allow(null),
+    cache: Validate.object({
+        expiresIn: Validate.number(),
+        expiresAt: Validate.string(),
+        privacy: Validate.valid('default', 'public', 'private'),
+        statuses: Validate.array().items(Validate.number().integer().min(200)).min(1).single().default([200, 204]),
+        otherwise: Validate.string().default('no-cache')
+    })
+        .allow(false)
+        .default(),
+    compression: Validate.object()
+        .pattern(/.+/, Validate.object())
+        .default(),
+    cors: Validate.object({
+        origin: Validate.array().min(1).allow('ignore').default(['*']),
+        maxAge: Validate.number().default(86400),
+        headers: Validate.array().items(Validate.string()).default(['Accept', 'Authorization', 'Content-Type', 'If-None-Match']),
+        additionalHeaders: Validate.array().items(Validate.string()).default([]),
+        exposedHeaders: Validate.array().items(Validate.string()).default(['WWW-Authenticate', 'Server-Authorization']),
+        additionalExposedHeaders: Validate.array().items(Validate.string()).default([]),
+        credentials: Validate.boolean().when('origin', { is: 'ignore', then: false }).default(false),
+        preflightStatusCode: Validate.valid(200, 204).default(200)
+    })
+        .allow(false, true)
+        .default(false),
+    ext: Validate.object({
+        onPreAuth: Validate.array().items(internals.event).single(),
+        onCredentials: Validate.array().items(internals.event).single(),
+        onPostAuth: Validate.array().items(internals.event).single(),
+        onPreHandler: Validate.array().items(internals.event).single(),
+        onPostHandler: Validate.array().items(internals.event).single(),
+        onPreResponse: Validate.array().items(internals.event).single(),
+        onPostResponse: Validate.array().items(internals.event).single()
+    })
+        .default({}),
+    files: Validate.object({
+        relativeTo: Validate.string().pattern(/^([\/\.])|([A-Za-z]:\\)|(\\\\)/).default('.')
+    })
+        .default(),
+    json: Validate.object({
+        replacer: Validate.alternatives(Validate.function(), Validate.array()).allow(null).default(null),
+        space: Validate.number().allow(null).default(null),
+        suffix: Validate.string().allow(null).default(null),
+        escape: Validate.boolean().default(false)
+    })
+        .default(),
+    log: Validate.object({
+        collect: Validate.boolean().default(false)
+    })
+        .default(),
+    payload: Validate.object({
+        output: Validate.valid('data', 'stream', 'file').default('data'),
+        parse: Validate.boolean().allow('gunzip').default(true),
+        multipart: Validate.object({
+            output: Validate.valid('data', 'stream', 'file', 'annotated').required()
+        })
+            .default(false)
+            .allow(true, false),
+        allow: Validate.array().items(Validate.string()).single(),
+        override: Validate.string(),
+        protoAction: Validate.valid('error', 'remove', 'ignore').default('error'),
+        maxBytes: Validate.number().integer().positive().default(1024 * 1024),
+        maxParts: Validate.number().integer().positive().default(1000),
+        uploads: Validate.string().default(Os.tmpdir()),
+        failAction: internals.failAction,
+        timeout: Validate.number().integer().positive().allow(false).default(10 * 1000),
+        defaultContentType: Validate.string().default('application/json'),
+        compression: Validate.object()
+            .pattern(/.+/, Validate.object())
+            .default()
+    })
+        .default(),
+    plugins: Validate.object(),
+    response: Validate.object({
+        disconnectStatusCode: Validate.number().integer().min(400).default(499),
+        emptyStatusCode: Validate.valid(200, 204).default(204),
+        failAction: internals.failAction,
+        modify: Validate.boolean(),
+        options: Validate.object(),
+        ranges: Validate.boolean().default(true),
+        sample: Validate.number().min(0).max(100).when('modify', { then: Validate.forbidden() }),
+        schema: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(true, false),
+        status: Validate.object().pattern(/\d\d\d/, Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(true, false))
+    })
+        .default(),
+    security: Validate.object({
+        hsts: Validate.alternatives([
+            Validate.object({
+                maxAge: Validate.number(),
+                includeSubdomains: Validate.boolean(),
+                includeSubDomains: Validate.boolean(),
+                preload: Validate.boolean()
+            }),
+            Validate.boolean(),
+            Validate.number()
+        ])
+            .default(15768000),
+        xframe: Validate.alternatives([
+            Validate.boolean(),
+            Validate.valid('sameorigin', 'deny'),
+            Validate.object({
+                rule: Validate.valid('sameorigin', 'deny', 'allow-from'),
+                source: Validate.string()
+            })
+        ])
+            .default('deny'),
+        xss: Validate.valid('enabled', 'disabled', false).default('disabled'),
+        noOpen: Validate.boolean().default(true),
+        noSniff: Validate.boolean().default(true),
+        referrer: Validate.alternatives([
+            Validate.boolean().valid(false),
+            Validate.valid('', 'no-referrer', 'no-referrer-when-downgrade',
+                'unsafe-url', 'same-origin', 'origin', 'strict-origin',
+                'origin-when-cross-origin', 'strict-origin-when-cross-origin')
+        ])
+            .default(false)
+    })
+        .allow(null, false, true)
+        .default(false),
+    state: Validate.object({
+        parse: Validate.boolean().default(true),
+        failAction: internals.failAction
+    })
+        .default(),
+    timeout: Validate.object({
+        socket: Validate.number().integer().positive().allow(false),
+        server: Validate.number().integer().positive().allow(false).default(false)
+    })
+        .default(),
+    validate: Validate.object({
+        headers: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, true),
+        params: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, true),
+        query: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, false, true),
+        payload: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, false, true),
+        state: Validate.alternatives(Validate.object(), Validate.array(), Validate.function()).allow(null, false, true),
+        failAction: internals.failAction,
+        errorFields: Validate.object(),
+        options: Validate.object().default(),
+        validator: Validate.object()
+    })
+        .default()
+});
+
+
+internals.server = Validate.object({
+    address: Validate.string().hostname(),
+    app: Validate.object().allow(null),
+    autoListen: Validate.boolean(),
+    cache: Validate.allow(null),                                 // Validated elsewhere
+    compression: Validate.object({
+        minBytes: Validate.number().min(1).integer().default(1024)
+    })
+        .allow(false)
+        .default(),
+    debug: Validate.object({
+        request: Validate.array().items(Validate.string()).single().allow(false).default(['implementation']),
+        log: Validate.array().items(Validate.string()).single().allow(false)
+    })
+        .allow(false)
+        .default(),
+    host: Validate.string().hostname().allow(null),
+    info: Validate.object({
+        remote: Validate.boolean().default(false)
+    })
+        .default({}),
+    listener: Validate.any(),
+    load: Validate.object({
+        sampleInterval: Validate.number().integer().min(0).default(0)
+    })
+        .unknown()
+        .default(),
+    mime: Validate.object().empty(null).default(),
+    operations: Validate.object({
+        cleanStop: Validate.boolean().default(true)
+    })
+        .default(),
+    plugins: Validate.object(),
+    port: Validate.alternatives([
+        Validate.number().integer().min(0),          // TCP port
+        Validate.string().pattern(/\//),               // Unix domain socket
+        Validate.string().pattern(/^\\\\\.\\pipe\\/)   // Windows named pipe
+    ])
+        .allow(null),
+    query: Validate.object({
+        parser: Validate.function()
+    })
+        .default(),
+    router: Validate.object({
+        isCaseSensitive: Validate.boolean().default(true),
+        stripTrailingSlash: Validate.boolean().default(false)
+    })
+        .default(),
+    routes: internals.routeBase.default(),
+    state: Validate.object(),                                    // Cookie defaults
+    tls: Validate.alternatives([
+        Validate.object().allow(null),
+        Validate.boolean()
+    ]),
+    uri: Validate.string().pattern(/[^/]$/)
+});
+
+
+internals.vhost = Validate.alternatives([
+    Validate.string().hostname(),
+    Validate.array().items(Validate.string().hostname()).min(1)
+]);
+
+
+internals.handler = Validate.alternatives([
+    Validate.function(),
+    Validate.object().length(1)
+]);
+
+
+internals.route = Validate.object({
+    method: Validate.string().pattern(/^[a-zA-Z0-9!#\$%&'\*\+\-\.^_`\|~]+$/).required(),
+    path: Validate.string().required(),
+    rules: Validate.object(),
+    vhost: internals.vhost,
+
+    // Validated in route construction
+
+    handler: Validate.any(),
+    options: Validate.any(),
+    config: Validate.any()               // Backwards compatibility
+})
+    .without('config', 'options');
+
+
+internals.pre = [
+    Validate.function(),
+    Validate.object({
+        method: Validate.alternatives(Validate.string(), Validate.function()).required(),
+        assign: Validate.string(),
+        mode: Validate.valid('serial', 'parallel'),
+        failAction: internals.failAction
+    })
+];
+
+
+internals.routeConfig = internals.routeBase.keys({
+    description: Validate.string(),
+    id: Validate.string(),
+    isInternal: Validate.boolean(),
+    notes: [
+        Validate.string(),
+        Validate.array().items(Validate.string())
+    ],
+    pre: Validate.array().items(...internals.pre.concat(Validate.array().items(...internals.pre).min(1))),
+    tags: [
+        Validate.string(),
+        Validate.array().items(Validate.string())
+    ]
+});
+
+
+internals.cacheConfig = Validate.alternatives([
+    Validate.function(),
+    Validate.object({
+        name: Validate.string().invalid('_default'),
+        shared: Validate.boolean(),
+        provider: [
+            Validate.function(),
+            {
+                constructor: Validate.function().required(),
+                options: Validate.object({
+                    partition: Validate.string().default('hapi-cache')
+                })
+                    .unknown()      // Catbox client validates other keys
+                    .default({})
+            }
+        ],
+        engine: Validate.object()
+    })
+        .xor('provider', 'engine')
+]);
+
+
+internals.cache = Validate.array().items(internals.cacheConfig).min(1).single();
+
+
+internals.cachePolicy = Validate.object({
+    cache: Validate.string().allow(null).allow(''),
+    segment: Validate.string(),
+    shared: Validate.boolean()
+})
+    .unknown();                     // Catbox policy validates other keys
+
+
+internals.method = Validate.object({
+    bind: Validate.object().allow(null),
+    generateKey: Validate.function(),
+    cache: internals.cachePolicy
+});
+
+
+internals.methodObject = Validate.object({
+    name: Validate.string().required(),
+    method: Validate.function().required(),
+    options: Validate.object()
+});
+
+
+internals.register = Validate.object({
+    once: true,
+    routes: Validate.object({
+        prefix: Validate.string().pattern(/^\/.+/),
+        vhost: internals.vhost
+    })
+        .default({})
+});
+
+
+internals.semver = Validate.string();
+
+
+internals.plugin = internals.register.keys({
+    options: Validate.any(),
+    plugin: Validate.object({
+        register: Validate.function().required(),
+        name: Validate.string().when('pkg.name', { is: Validate.exist(), otherwise: Validate.required() }),
+        version: Validate.string(),
+        multiple: Validate.boolean().default(false),
+        dependencies: [
+            Validate.array().items(Validate.string()).single(),
+            Validate.object().pattern(/.+/, internals.semver)
+        ],
+        once: true,
+        requirements: Validate.object({
+            hapi: Validate.string(),
+            node: Validate.string()
+        })
+            .default(),
+        pkg: Validate.object({
+            name: Validate.string(),
+            version: Validate.string().default('0.0.0')
+        })
+            .unknown()
+            .default({})
+    })
+        .unknown()
+})
+    .without('once', 'options')
+    .unknown();
+
+
+internals.rules = Validate.object({
+    validate: Validate.object({
+        schema: Validate.alternatives(Validate.object(), Validate.array()).required(),
+        options: Validate.object()
+            .default({ allowUnknown: true })
+    })
+});

node_modules/@hapi/hapi/lib/core.js

@@ -0,0 +1,718 @@
+'use strict';
+
+const Http = require('http');
+const Https = require('https');
+const Os = require('os');
+const Path = require('path');
+
+const Boom = require('@hapi/boom');
+const Bounce = require('@hapi/bounce');
+const Call = require('@hapi/call');
+const Catbox = require('@hapi/catbox');
+const { Engine: CatboxMemory } = require('@hapi/catbox-memory');
+const { Heavy } = require('@hapi/heavy');
+const Hoek = require('@hapi/hoek');
+const { Mimos } = require('@hapi/mimos');
+const Podium = require('@hapi/podium');
+const Statehood = require('@hapi/statehood');
+
+const Auth = require('./auth');
+const Compression = require('./compression');
+const Config = require('./config');
+const Cors = require('./cors');
+const Ext = require('./ext');
+const Methods = require('./methods');
+const Request = require('./request');
+const Response = require('./response');
+const Route = require('./route');
+const Toolkit = require('./toolkit');
+const Validation = require('./validation');
+
+
+const internals = {
+    counter: {
+        min: 10000,
+        max: 99999
+    },
+    events: [
+        { name: 'cachePolicy', spread: true },
+        { name: 'log', channels: ['app', 'internal'], tags: true },
+        { name: 'request', channels: ['app', 'internal', 'error'], tags: true, spread: true },
+        'response',
+        'route',
+        'start',
+        'closing',
+        'stop'
+    ],
+    badRequestResponse: Buffer.from('HTTP/1.1 400 Bad Request\r\n\r\n', 'ascii')
+};
+
+
+exports = module.exports = internals.Core = class {
+
+    actives = new WeakMap();                                                   // Active requests being processed
+    app = {};
+    auth = new Auth(this);
+    caches = new Map();                                                        // Cache clients
+    compression = new Compression();
+    controlled = null;                                                         // Other servers linked to the phases of this server
+    dependencies = [];                                                         // Plugin dependencies
+    events = new Podium.Podium(internals.events);
+    heavy = null;
+    info = null;
+    instances = new Set();
+    listener = null;
+    methods = new Methods(this);                                               // Server methods
+    mime = null;
+    onConnection = null;                                                       // Used to remove event listener on stop
+    phase = 'stopped';                                                         // 'stopped', 'initializing', 'initialized', 'starting', 'started', 'stopping', 'invalid'
+    plugins = {};                                                              // Exposed plugin properties by name
+    registrations = {};                                                        // Tracks plugin for dependency validation { name -> { version } }
+    registring = 0;                                                            // > 0 while register() is waiting for plugin callbacks
+    Request = class extends Request { };
+    Response = class extends Response { };
+    requestCounter = { value: internals.counter.min, min: internals.counter.min, max: internals.counter.max };
+    root = null;
+    router = null;
+    settings = null;
+    sockets = null;                                                            // Track open sockets for graceful shutdown
+    started = false;
+    states = null;
+    toolkit = new Toolkit.Manager();
+    type = null;
+    validator = null;
+
+    extensionsSeq = 0;                                                         // Used to keep absolute order of extensions based on the order added across locations
+    extensions = {
+        server: {
+            onPreStart: new Ext('onPreStart', this),
+            onPostStart: new Ext('onPostStart', this),
+            onPreStop: new Ext('onPreStop', this),
+            onPostStop: new Ext('onPostStop', this)
+        },
+        route: {
+            onRequest: new Ext('onRequest', this),
+            onPreAuth: new Ext('onPreAuth', this),
+            onCredentials: new Ext('onCredentials', this),
+            onPostAuth: new Ext('onPostAuth', this),
+            onPreHandler: new Ext('onPreHandler', this),
+            onPostHandler: new Ext('onPostHandler', this),
+            onPreResponse: new Ext('onPreResponse', this),
+            onPostResponse: new Ext('onPostResponse', this)
+        }
+    };
+
+    decorations = {
+        handler: new Map(),
+        request: new Map(),
+        response: new Map(),
+        server: new Map(),
+        toolkit: new Map(),
+        requestApply: null,
+        public: { handler: [], request: [], response: [], server: [], toolkit: [] }
+    };
+
+    constructor(options) {
+
+        const { settings, type } = internals.setup(options);
+
+        this.settings = settings;
+        this.type = type;
+
+        this.heavy = new Heavy(this.settings.load);
+        this.mime = new Mimos(this.settings.mime);
+        this.router = new Call.Router(this.settings.router);
+        this.states = new Statehood.Definitions(this.settings.state);
+
+        this._debug();
+        this._initializeCache();
+
+        if (this.settings.routes.validate.validator) {
+            this.validator = Validation.validator(this.settings.routes.validate.validator);
+        }
+
+        this.listener = this._createListener();
+        this._initializeListener();
+        this.info = this._info();
+    }
+
+    _debug() {
+
+        const debug = this.settings.debug;
+        if (!debug) {
+            return;
+        }
+
+        // Subscribe to server log events
+
+        const method = (event) => {
+
+            const data = event.error ?? event.data;
+            console.error('Debug:', event.tags.join(', '), data ? '\n    ' + (data.stack ?? (typeof data === 'object' ? Hoek.stringify(data) : data)) : '');
+        };
+
+        if (debug.log) {
+            const filter = debug.log.some((tag) => tag === '*') ? undefined : debug.log;
+            this.events.on({ name: 'log', filter }, method);
+        }
+
+        if (debug.request) {
+            const filter = debug.request.some((tag) => tag === '*') ? undefined : debug.request;
+            this.events.on({ name: 'request', filter }, (request, event) => method(event));
+        }
+    }
+
+    _initializeCache() {
+
+        if (this.settings.cache) {
+            this._createCache(this.settings.cache);
+        }
+
+        if (!this.caches.has('_default')) {
+            this._createCache([{ provider: CatboxMemory }]);        // Defaults to memory-based
+        }
+    }
+
+    _info() {
+
+        const now = Date.now();
+        const protocol = this.type === 'tcp' ? (this.settings.tls ? 'https' : 'http') : this.type;
+        const host = this.settings.host || Os.hostname() || 'localhost';
+        const port = this.settings.port;
+
+        const info = {
+            created: now,
+            started: 0,
+            host,
+            port,
+            protocol,
+            id: Os.hostname() + ':' + process.pid + ':' + now.toString(36),
+            uri: this.settings.uri ?? (protocol + ':' + (this.type === 'tcp' ? '//' + host + (port ? ':' + port : '') : port))
+        };
+
+        return info;
+    }
+
+    _counter() {
+
+        const next = ++this.requestCounter.value;
+
+        if (this.requestCounter.value > this.requestCounter.max) {
+            this.requestCounter.value = this.requestCounter.min;
+        }
+
+        return next - 1;
+    }
+
+    _createCache(configs) {
+
+        Hoek.assert(this.phase !== 'initializing', 'Cannot provision server cache while server is initializing');
+
+        configs = Config.apply('cache', configs);
+
+        const added = [];
+        for (let config of configs) {
+
+            // <function>
+            // { provider: <function> }
+            // { provider: { constructor: <function>, options } }
+            // { engine }
+
+            if (typeof config === 'function') {
+                config = { provider: { constructor: config } };
+            }
+
+            const name = config.name ?? '_default';
+            Hoek.assert(!this.caches.has(name), 'Cannot configure the same cache more than once: ', name === '_default' ? 'default cache' : name);
+
+            let client = null;
+
+            if (config.provider) {
+                let provider = config.provider;
+                if (typeof provider === 'function') {
+                    provider = { constructor: provider };
+                }
+
+                client = new Catbox.Client(provider.constructor, provider.options ?? { partition: 'hapi-cache' });
+            }
+            else {
+                client = new Catbox.Client(config.engine);
+            }
+
+            this.caches.set(name, { client, segments: {}, shared: config.shared ?? false });
+            added.push(client);
+        }
+
+        return added;
+    }
+
+    registerServer(server) {
+
+        if (!this.root) {
+            this.root = server;
+            this._defaultRoutes();
+        }
+
+        this.instances.add(server);
+    }
+
+    async _start() {
+
+        if (this.phase === 'initialized' ||
+            this.phase === 'started') {
+
+            this._validateDeps();
+        }
+
+        if (this.phase === 'started') {
+            return;
+        }
+
+        if (this.phase !== 'stopped' &&
+            this.phase !== 'initialized') {
+
+            throw new Error('Cannot start server while it is in ' + this.phase + ' phase');
+        }
+
+        if (this.phase !== 'initialized') {
+            await this._initialize();
+        }
+
+        this.phase = 'starting';
+        this.started = true;
+        this.info.started = Date.now();
+
+        try {
+            await this._listen();
+        }
+        catch (err) {
+            this.started = false;
+            this.phase = 'invalid';
+            throw err;
+        }
+
+        this.phase = 'started';
+        this.events.emit('start');
+
+        try {
+            if (this.controlled) {
+                await Promise.all(this.controlled.map((control) => control.start()));
+            }
+
+            await this._invoke('onPostStart');
+        }
+        catch (err) {
+            this.phase = 'invalid';
+            throw err;
+        }
+    }
+
+    _listen() {
+
+        return new Promise((resolve, reject) => {
+
+            if (!this.settings.autoListen) {
+                resolve();
+                return;
+            }
+
+            const onError = (err) => {
+
+                reject(err);
+                return;
+            };
+
+            this.listener.once('error', onError);
+
+            const finalize = () => {
+
+                this.listener.removeListener('error', onError);
+                resolve();
+                return;
+            };
+
+            if (this.type !== 'tcp') {
+                this.listener.listen(this.settings.port, finalize);
+            }
+            else {
+                // Default is the unspecified address, :: if IPv6 is available or otherwise the IPv4 address 0.0.0.0
+                const address = this.settings.address || this.settings.host || null;
+                this.listener.listen(this.settings.port, address, finalize);
+            }
+        });
+    }
+
+    async _initialize() {
+
+        if (this.registring) {
+            throw new Error('Cannot start server before plugins finished registration');
+        }
+
+        if (this.phase === 'initialized') {
+            return;
+        }
+
+        if (this.phase !== 'stopped') {
+            throw new Error('Cannot initialize server while it is in ' + this.phase + ' phase');
+        }
+
+        this._validateDeps();
+        this.phase = 'initializing';
+
+        // Start cache
+
+        try {
+            const caches = [];
+            this.caches.forEach((cache) => caches.push(cache.client.start()));
+            await Promise.all(caches);
+            await this._invoke('onPreStart');
+            this.heavy.start();
+            this.phase = 'initialized';
+
+            if (this.controlled) {
+                await Promise.all(this.controlled.map((control) => control.initialize()));
+            }
+        }
+        catch (err) {
+            this.phase = 'invalid';
+            throw err;
+        }
+    }
+
+    _validateDeps() {
+
+        for (const { deps, plugin } of this.dependencies) {
+            for (const dep in deps) {
+                const version = deps[dep];
+                Hoek.assert(this.registrations[dep], 'Plugin', plugin, 'missing dependency', dep);
+                Hoek.assert(version === '*' || Config.versionMatch(this.registrations[dep].version, version), 'Plugin', plugin, 'requires', dep, 'version', version, 'but found', this.registrations[dep].version);
+            }
+        }
+    }
+
+    async _stop(options = {}) {
+
+        options.timeout = options.timeout ?? 5000;          // Default timeout to 5 seconds
+
+        if (['stopped', 'initialized', 'started', 'invalid'].indexOf(this.phase) === -1) {
+            throw new Error('Cannot stop server while in ' + this.phase + ' phase');
+        }
+
+        this.phase = 'stopping';
+
+        try {
+            await this._invoke('onPreStop');
+
+            if (this.started) {
+                this.started = false;
+                this.info.started = 0;
+
+                await this._unlisten(options.timeout);
+            }
+
+            const caches = [];
+            this.caches.forEach((cache) => caches.push(cache.client.stop()));
+            await Promise.all(caches);
+
+            this.events.emit('stop');
+            this.heavy.stop();
+
+            if (this.controlled) {
+                await Promise.all(this.controlled.map((control) => control.stop(options)));
+            }
+
+            await this._invoke('onPostStop');
+            this.phase = 'stopped';
+        }
+        catch (err) {
+            this.phase = 'invalid';
+            throw err;
+        }
+    }
+
+    _unlisten(timeout) {
+
+        let timeoutId = null;
+        if (this.settings.operations.cleanStop) {
+
+            // Set connections timeout
+
+            const destroy = () => {
+
+                for (const connection of this.sockets) {
+                    connection.destroy();
+                }
+
+                this.sockets.clear();
+            };
+
+            timeoutId = setTimeout(destroy, timeout);
+
+            // Tell idle keep-alive connections to close
+
+            for (const connection of this.sockets) {
+                if (!this.actives.has(connection)) {
+                    connection.end();
+                }
+            }
+        }
+
+        // Close connection
+
+        return new Promise((resolve) => {
+
+            this.listener.close(() => {
+
+                if (this.settings.operations.cleanStop) {
+                    this.listener.removeListener(this.settings.tls ? 'secureConnection' : 'connection', this.onConnection);
+                    clearTimeout(timeoutId);
+                }
+
+                this._initializeListener();
+                resolve();
+            });
+
+            this.events.emit('closing');
+        });
+    }
+
+    async _invoke(type) {
+
+        const exts = this.extensions.server[type];
+        if (!exts.nodes) {
+            return;
+        }
+
+        // Execute extensions
+
+        for (const ext of exts.nodes) {
+            const bind = ext.bind ?? ext.realm.settings.bind;
+            const operation = ext.func.call(bind, ext.server, bind);
+            await Toolkit.timed(operation, { timeout: ext.timeout, name: type });
+        }
+    }
+
+    _defaultRoutes() {
+
+        this.router.special('notFound', new Route({ method: '_special', path: '/{p*}', handler: internals.notFound }, this.root, { special: true }));
+        this.router.special('badRequest', new Route({ method: '_special', path: '/{p*}', handler: internals.badRequest }, this.root, { special: true }));
+
+        if (this.settings.routes.cors) {
+            Cors.handler(this.root);
+        }
+    }
+
+    _dispatch(options = {}) {
+
+        return (req, res) => {
+
+            // Create request
+
+            const request = Request.generate(this.root, req, res, options);
+
+            // Track socket request processing state
+
+            if (this.settings.operations.cleanStop &&
+                req.socket) {
+
+                this.actives.set(req.socket, request);
+                const env = { core: this, req };
+                res.on('finish', internals.onFinish.bind(res, env));
+            }
+
+            // Check load
+
+            if (this.settings.load.sampleInterval) {
+                try {
+                    this.heavy.check();
+                }
+                catch (err) {
+                    Bounce.rethrow(err, 'system');
+                    this._log(['load'], this.heavy.load);
+                    request._reply(err);
+                    return;
+                }
+            }
+
+            request._execute();
+        };
+    }
+
+    _createListener() {
+
+        const listener = this.settings.listener ?? (this.settings.tls ? Https.createServer(this.settings.tls) : Http.createServer());
+        listener.on('request', this._dispatch());
+        listener.on('checkContinue', this._dispatch({ expectContinue: true }));
+
+        listener.on('clientError', (err, socket) => {
+
+            this._log(['connection', 'client', 'error'], err);
+
+            if (socket.readable) {
+                const request = this.settings.operations.cleanStop && this.actives.get(socket);
+                if (request) {
+
+                    // If a request is available, it means that the connection and parsing has progressed far enough to have created the request.
+
+                    if (err.code === 'HPE_INVALID_METHOD') {
+
+                        // This parser error is for a pipelined request. Schedule destroy once current request is done.
+
+                        request.raw.res.once('close', () => {
+
+                            if (socket.readable) {
+                                socket.end(internals.badRequestResponse);
+                            }
+                            else {
+                                socket.destroy(err);
+                            }
+                        });
+                        return;
+                    }
+
+                    const error = Boom.badRequest();
+                    error.output.headers = { connection: 'close' };
+                    request._reply(error);
+                }
+                else {
+                    socket.end(internals.badRequestResponse);
+                }
+            }
+            else {
+                socket.destroy(err);
+            }
+        });
+
+        return listener;
+    }
+
+    _initializeListener() {
+
+        this.listener.once('listening', () => {
+
+            // Update the address, port, and uri with active values
+
+            if (this.type === 'tcp') {
+                const address = this.listener.address();
+                this.info.address = address.address;
+                this.info.port = address.port;
+                this.info.uri = this.settings.uri ?? this.info.protocol + '://' + this.info.host + ':' + this.info.port;
+            }
+
+            if (this.settings.operations.cleanStop) {
+                this.sockets = new Set();
+
+                const self = this;
+                const onClose = function () {           // 'this' is bound to the emitter
+
+                    self.sockets.delete(this);
+                };
+
+                this.onConnection = (connection) => {
+
+                    this.sockets.add(connection);
+                    connection.on('close', onClose);
+                };
+
+                this.listener.on(this.settings.tls ? 'secureConnection' : 'connection', this.onConnection);
+            }
+        });
+    }
+
+    _cachePolicy(options, _segment, realm) {
+
+        options = Config.apply('cachePolicy', options);
+
+        const plugin = realm?.plugin;
+        const segment = options.segment ?? _segment ?? (plugin ? `!${plugin}` : '');
+        Hoek.assert(segment, 'Missing cache segment name');
+
+        const cacheName = options.cache ?? '_default';
+        const cache = this.caches.get(cacheName);
+        Hoek.assert(cache, 'Unknown cache', cacheName);
+        Hoek.assert(!cache.segments[segment] || cache.shared || options.shared, 'Cannot provision the same cache segment more than once');
+        cache.segments[segment] = true;
+
+        const policy = new Catbox.Policy(options, cache.client, segment);
+        this.events.emit('cachePolicy', [policy, options.cache, segment]);
+
+        return policy;
+    }
+
+    log(tags, data) {
+
+        return this._log(tags, data, 'app');
+    }
+
+    _log(tags, data, channel = 'internal') {
+
+        if (!this.events.hasListeners('log')) {
+            return;
+        }
+
+        if (!Array.isArray(tags)) {
+            tags = [tags];
+        }
+
+        const timestamp = Date.now();
+        const field = data instanceof Error ? 'error' : 'data';
+
+        let event = { timestamp, tags, [field]: data, channel };
+
+        if (typeof data === 'function') {
+            event = () => ({ timestamp, tags, data: data(), channel });
+        }
+
+        this.events.emit({ name: 'log', tags, channel }, event);
+    }
+};
+
+
+internals.setup = function (options = {}) {
+
+    let settings = Hoek.clone(options, { shallow: ['cache', 'listener', 'routes.bind'] });
+    settings.app = settings.app ?? {};
+    settings.routes = Config.enable(settings.routes);
+    settings = Config.apply('server', settings);
+
+    if (settings.port === undefined) {
+        settings.port = 0;
+    }
+
+    const type = (typeof settings.port === 'string' ? 'socket' : 'tcp');
+    if (type === 'socket') {
+        settings.port = (settings.port.indexOf('/') !== -1 ? Path.resolve(settings.port) : settings.port.toLowerCase());
+    }
+
+    if (settings.autoListen === undefined) {
+        settings.autoListen = true;
+    }
+
+    Hoek.assert(settings.autoListen || !settings.port, 'Cannot specify port when autoListen is false');
+    Hoek.assert(settings.autoListen || !settings.address, 'Cannot specify address when autoListen is false');
+
+    return { settings, type };
+};
+
+
+internals.notFound = function () {
+
+    throw Boom.notFound();
+};
+
+
+internals.badRequest = function () {
+
+    throw Boom.badRequest();
+};
+
+
+internals.onFinish = function (env) {
+
+    const { core, req } = env;
+
+    core.actives.delete(req.socket);
+    if (!core.started) {
+        req.socket.end();
+    }
+};

node_modules/@hapi/hapi/lib/cors.js

@@ -0,0 +1,208 @@
+'use strict';
+
+const Boom = require('@hapi/boom');
+const Hoek = require('@hapi/hoek');
+
+let Route = null;                           // Delayed load due to circular dependency
+
+
+const internals = {};
+
+
+exports.route = function (options) {
+
+    if (!options) {
+        return false;
+    }
+
+    const settings = Hoek.clone(options);
+    settings._headers = settings.headers.concat(settings.additionalHeaders);
+    settings._headersString = settings._headers.join(',');
+    for (let i = 0; i < settings._headers.length; ++i) {
+        settings._headers[i] = settings._headers[i].toLowerCase();
+    }
+
+    if (settings._headers.indexOf('origin') === -1) {
+        settings._headers.push('origin');
+    }
+
+    settings._exposedHeaders = settings.exposedHeaders.concat(settings.additionalExposedHeaders).join(',');
+
+    if (settings.origin === 'ignore') {
+        settings._origin = false;
+    }
+    else if (settings.origin.indexOf('*') !== -1) {
+        Hoek.assert(settings.origin.length === 1, 'Cannot specify cors.origin * together with other values');
+        settings._origin = true;
+    }
+    else {
+        settings._origin = {
+            qualified: [],
+            wildcards: []
+        };
+
+        for (const origin of settings.origin) {
+            if (origin.indexOf('*') !== -1) {
+                settings._origin.wildcards.push(new RegExp('^' + Hoek.escapeRegex(origin).replace(/\\\*/g, '.*').replace(/\\\?/g, '.') + '$'));
+            }
+            else {
+                settings._origin.qualified.push(origin);
+            }
+        }
+    }
+
+    return settings;
+};
+
+
+exports.options = function (route, server) {
+
+    if (route.method === 'options' ||
+        !route.settings.cors) {
+
+        return;
+    }
+
+    exports.handler(server);
+};
+
+
+exports.handler = function (server) {
+
+    Route = Route || require('./route');
+
+    if (server._core.router.specials.options) {
+        return;
+    }
+
+    const definition = {
+        method: '_special',
+        path: '/{p*}',
+        handler: internals.handler,
+        options: {
+            cors: false
+        }
+    };
+
+    const route = new Route(definition, server, { special: true });
+    server._core.router.special('options', route);
+};
+
+
+internals.handler = function (request, h) {
+
+    // Validate CORS preflight request
+
+    const method = request.headers['access-control-request-method'];
+    if (!method) {
+        throw Boom.notFound('CORS error: Missing Access-Control-Request-Method header');
+    }
+
+    // Lookup route
+
+    const route = request.server.match(method, request.path, request.info.hostname);
+    if (!route) {
+        throw Boom.notFound();
+    }
+
+    const settings = route.settings.cors;
+    if (!settings) {
+        return { message: 'CORS is disabled for this route' };
+    }
+
+    // Validate Origin header
+
+    const origin = request.headers.origin;
+
+    if (!origin &&
+        settings._origin !== false) {
+
+        throw Boom.notFound('CORS error: Missing Origin header');
+    }
+
+    if (!exports.matchOrigin(origin, settings)) {
+        return { message: 'CORS error: Origin not allowed' };
+    }
+
+    // Validate allowed headers
+
+    let headers = request.headers['access-control-request-headers'];
+    if (headers) {
+        headers = headers.toLowerCase().split(/\s*,\s*/);
+        if (Hoek.intersect(headers, settings._headers).length !== headers.length) {
+            return { message: 'CORS error: Some headers are not allowed' };
+        }
+    }
+
+    // Reply with the route CORS headers
+
+    const response = h.response();
+    response.code(settings.preflightStatusCode);
+    response._header('access-control-allow-origin', settings._origin ? origin : '*');
+    response._header('access-control-allow-methods', method);
+    response._header('access-control-allow-headers', settings._headersString);
+    response._header('access-control-max-age', settings.maxAge);
+
+    if (settings.credentials) {
+        response._header('access-control-allow-credentials', 'true');
+    }
+
+    if (settings._exposedHeaders) {
+        response._header('access-control-expose-headers', settings._exposedHeaders);
+    }
+
+    return response;
+};
+
+
+exports.headers = function (response) {
+
+    const request = response.request;
+    const settings = request.route.settings.cors;
+
+    if (settings._origin !== false) {
+        response.vary('origin');
+    }
+
+    if ((request.info.cors && !request.info.cors.isOriginMatch) ||                          // After route lookup
+        !exports.matchOrigin(request.headers.origin, request.route.settings.cors)) {        // Response from onRequest
+
+        return;
+    }
+
+    response._header('access-control-allow-origin', settings._origin ? request.headers.origin : '*');
+
+    if (settings.credentials) {
+        response._header('access-control-allow-credentials', 'true');
+    }
+
+    if (settings._exposedHeaders) {
+        response._header('access-control-expose-headers', settings._exposedHeaders, { append: true });
+    }
+};
+
+
+exports.matchOrigin = function (origin, settings) {
+
+    if (settings._origin === true ||
+        settings._origin === false) {
+
+        return true;
+    }
+
+    if (!origin) {
+        return false;
+    }
+
+    if (settings._origin.qualified.indexOf(origin) !== -1) {
+        return true;
+    }
+
+    for (const wildcard of settings._origin.wildcards) {
+        if (origin.match(wildcard)) {
+            return true;
+        }
+    }
+
+    return false;
+};

node_modules/@hapi/hapi/lib/ext.js

@@ -0,0 +1,96 @@
+'use strict';
+
+const Hoek = require('@hapi/hoek');
+const Topo = require('@hapi/topo');
+
+
+const internals = {};
+
+
+exports = module.exports = internals.Ext = class {
+
+    type = null;
+    nodes = null;
+
+    #core = null;
+    #routes = [];
+    #topo = new Topo.Sorter();
+
+    constructor(type, core) {
+
+        this.#core = core;
+        this.type = type;
+    }
+
+    add(event) {
+
+        const methods = [].concat(event.method);
+        for (const method of methods) {
+            const settings = {
+                before: event.options.before,
+                after: event.options.after,
+                group: event.realm.plugin,
+                sort: this.#core.extensionsSeq++
+            };
+
+            const node = {
+                func: method,                       // Request: function (request, h), Server: function (server)
+                bind: event.options.bind,
+                server: event.server,               // Server event
+                realm: event.realm,
+                timeout: event.options.timeout
+            };
+
+            this.#topo.add(node, settings);
+        }
+
+        this.nodes = this.#topo.nodes;
+
+        // Notify routes
+
+        for (const route of this.#routes) {
+            route.rebuild(event);
+        }
+    }
+
+    merge(others) {
+
+        const merge = [];
+        for (const other of others) {
+            merge.push(other.#topo);
+        }
+
+        this.#topo.merge(merge);
+        this.nodes = this.#topo.nodes.length ? this.#topo.nodes : null;
+    }
+
+    subscribe(route) {
+
+        this.#routes.push(route);
+    }
+
+    static combine(route, type) {
+
+        const ext = new internals.Ext(type, route._core);
+
+        const events = route.settings.ext[type];
+        if (events) {
+            for (let event of events) {
+                event = Object.assign({}, event);       // Shallow cloned
+                Hoek.assert(!event.options.sandbox, 'Cannot specify sandbox option for route extension');
+                event.realm = route.realm;
+                ext.add(event);
+            }
+        }
+
+        const server = route._core.extensions.route[type];
+        const realm = route.realm._extensions[type];
+
+        ext.merge([server, realm]);
+
+        server.subscribe(route);
+        realm.subscribe(route);
+
+        return ext;
+    }
+};

node_modules/@hapi/hapi/lib/handler.js

@@ -0,0 +1,165 @@
+'use strict';
+
+const Hoek = require('@hapi/hoek');
+
+
+const internals = {};
+
+
+exports.execute = async function (request) {
+
+    // Prerequisites
+
+    if (request._route._prerequisites) {
+        for (const set of request._route._prerequisites) {      // Serial execution of each set
+            const pres = [];
+            for (const item of set) {
+                pres.push(internals.handler(request, item.method, item));
+            }
+
+            const responses = await Promise.all(pres);                          // Parallel execution within sets
+            for (const response of responses) {
+                if (response !== undefined) {
+                    return response;
+                }
+            }
+        }
+    }
+
+    // Handler
+
+    const result = await internals.handler(request, request.route.settings.handler);
+    if (result._takeover ||
+        typeof result === 'symbol') {
+
+        return result;
+    }
+
+    request._setResponse(result);
+};
+
+
+internals.handler = async function (request, method, pre) {
+
+    const bind = request.route.settings.bind;
+    const realm = request.route.realm;
+    let response = await request._core.toolkit.execute(method, request, { bind, realm, continue: 'null' });
+
+    // Handler
+
+    if (!pre) {
+        if (response.isBoom) {
+            request._log(['handler', 'error'], response);
+            throw response;
+        }
+
+        return response;
+    }
+
+    // Pre
+
+    if (response.isBoom) {
+        response.assign = pre.assign;
+        response = await request._core.toolkit.failAction(request, pre.failAction, response, { tags: ['pre', 'error'], retain: true });
+    }
+
+    if (typeof response === 'symbol') {
+        return response;
+    }
+
+    if (pre.assign) {
+        request.pre[pre.assign] = (response.isBoom ? response : response.source);
+        request.preResponses[pre.assign] = response;
+    }
+
+    if (response._takeover) {
+        return response;
+    }
+};
+
+
+exports.defaults = function (method, handler, core) {
+
+    let defaults = null;
+
+    if (typeof handler === 'object') {
+        const type = Object.keys(handler)[0];
+        const serverHandler = core.decorations.handler.get(type);
+
+        Hoek.assert(serverHandler, 'Unknown handler:', type);
+
+        if (serverHandler.defaults) {
+            defaults = (typeof serverHandler.defaults === 'function' ? serverHandler.defaults(method) : serverHandler.defaults);
+        }
+    }
+
+    return defaults ?? {};
+};
+
+
+exports.configure = function (handler, route) {
+
+    if (typeof handler === 'object') {
+        const type = Object.keys(handler)[0];
+        const serverHandler = route._core.decorations.handler.get(type);
+
+        Hoek.assert(serverHandler, 'Unknown handler:', type);
+
+        return serverHandler(route.public, handler[type]);
+    }
+
+    return handler;
+};
+
+
+exports.prerequisitesConfig = function (config) {
+
+    if (!config) {
+        return null;
+    }
+
+    /*
+        [
+            [
+                function (request, h) { },
+                {
+                    method: function (request, h) { }
+                    assign: key1
+                },
+                {
+                    method: function (request, h) { },
+                    assign: key2
+                }
+            ],
+            {
+                method: function (request, h) { },
+                assign: key3
+            }
+        ]
+    */
+
+    const prerequisites = [];
+
+    for (let pres of config) {
+        pres = [].concat(pres);
+
+        const set = [];
+        for (let pre of pres) {
+            if (typeof pre !== 'object') {
+                pre = { method: pre };
+            }
+
+            const item = {
+                method: pre.method,
+                assign: pre.assign,
+                failAction: pre.failAction ?? 'error'
+            };
+
+            set.push(item);
+        }
+
+        prerequisites.push(set);
+    }
+
+    return prerequisites.length ? prerequisites : null;
+};

node_modules/@hapi/hapi/lib/headers.js

@@ -0,0 +1,177 @@
+'use strict';
+
+
+const Stream = require('stream');
+
+const Boom = require('@hapi/boom');
+
+
+const internals = {};
+
+
+exports.cache = function (response) {
+
+    const request = response.request;
+    if (response.headers['cache-control']) {
+        return;
+    }
+
+    const settings = request.route.settings.cache;
+    const policy = settings && request._route._cache && (settings._statuses.has(response.statusCode) || (response.statusCode === 304 && settings._statuses.has(200)));
+
+    if (policy ||
+        response.settings.ttl) {
+
+        const ttl = response.settings.ttl !== null ? response.settings.ttl : request._route._cache.ttl();
+        const privacy = request.auth.isAuthenticated || response.headers['set-cookie'] ? 'private' : settings.privacy ?? 'default';
+        response._header('cache-control', 'max-age=' + Math.floor(ttl / 1000) + ', must-revalidate' + (privacy !== 'default' ? ', ' + privacy : ''));
+    }
+    else if (settings) {
+        response._header('cache-control', settings.otherwise);
+    }
+};
+
+
+exports.content = async function (response) {
+
+    const request = response.request;
+    if (response._isPayloadSupported() ||
+        request.method === 'head') {
+
+        await response._marshal();
+
+        if (typeof response._payload.size === 'function') {
+            response._header('content-length', response._payload.size(), { override: false });
+        }
+
+        if (!response._isPayloadSupported()) {
+            response._close();                              // Close unused file streams
+            response._payload = new internals.Empty();      // Set empty stream
+        }
+
+        exports.type(response);
+    }
+    else {
+
+        // Set empty stream
+
+        response._close();                                  // Close unused file streams
+        response._payload = new internals.Empty();
+        delete response.headers['content-length'];
+    }
+};
+
+
+exports.state = async function (response) {
+
+    const request = response.request;
+    const states = [];
+
+    for (const stateName in request._states) {
+        states.push(request._states[stateName]);
+    }
+
+    try {
+        for (const name in request._core.states.cookies) {
+            const autoValue = request._core.states.cookies[name].autoValue;
+            if (!autoValue || name in request._states || name in request.state) {
+                continue;
+            }
+
+            if (typeof autoValue !== 'function') {
+                states.push({ name, value: autoValue });
+                continue;
+            }
+
+            const value = await autoValue(request);
+            states.push({ name, value });
+        }
+
+        if (!states.length) {
+            return;
+        }
+
+        let header = await request._core.states.format(states, request);
+        const existing = response.headers['set-cookie'];
+        if (existing) {
+            header = (Array.isArray(existing) ? existing : [existing]).concat(header);
+        }
+
+        response._header('set-cookie', header);
+    }
+    catch (err) {
+        const error = Boom.boomify(err);
+        request._log(['state', 'response', 'error'], error);
+        request._states = {};                                           // Clear broken state
+        throw error;
+    }
+};
+
+
+exports.type = function (response) {
+
+    const type = response.contentType;
+    if (type !== null && type !== response.headers['content-type']) {
+        response.type(type);
+    }
+};
+
+
+exports.entity = function (response) {
+
+    const request = response.request;
+
+    if (!request._entity) {
+        return;
+    }
+
+    if (request._entity.etag &&
+        !response.headers.etag) {
+
+        response.etag(request._entity.etag, { vary: request._entity.vary });
+    }
+
+    if (request._entity.modified &&
+        !response.headers['last-modified']) {
+
+        response.header('last-modified', request._entity.modified);
+    }
+};
+
+
+exports.unmodified = function (response) {
+
+    const request = response.request;
+    if (response.statusCode === 304) {
+        return;
+    }
+
+    const entity = {
+        etag: response.headers.etag,
+        vary: response.settings.varyEtag,
+        modified: response.headers['last-modified']
+    };
+
+    const etag = request._core.Response.unmodified(request, entity);
+    if (etag) {
+        response.code(304);
+
+        if (etag !== true) {                                // Override etag with incoming weak match
+            response.headers.etag = etag;
+        }
+    }
+};
+
+
+internals.Empty = class extends Stream.Readable {
+
+    _read(/* size */) {
+
+        this.push(null);
+    }
+
+    writeToStream(stream) {
+
+        stream.end();
+    }
+};

node_modules/@hapi/hapi/lib/index.d.ts

@@ -0,0 +1 @@
+export * from './types';

node_modules/@hapi/hapi/lib/index.js

@@ -0,0 +1,11 @@
+'use strict';
+
+const Server = require('./server');
+
+
+const internals = {};
+
+
+exports.Server = Server;
+
+exports.server = Server;

node_modules/@hapi/hapi/lib/methods.js

@@ -0,0 +1,126 @@
+'use strict';
+
+const Boom = require('@hapi/boom');
+const Hoek = require('@hapi/hoek');
+
+const Config = require('./config');
+
+
+const internals = {
+    methodNameRx: /^[_$a-zA-Z][$\w]*(?:\.[_$a-zA-Z][$\w]*)*$/
+};
+
+
+exports = module.exports = internals.Methods = class {
+
+    methods = {};
+
+    #core = null;
+
+    constructor(core) {
+
+        this.#core = core;
+    }
+
+    add(name, method, options, realm) {
+
+        if (typeof name !== 'object') {
+            return this._add(name, method, options, realm);
+        }
+
+        // {} or [{}, {}]
+
+        const items = [].concat(name);
+        for (let item of items) {
+            item = Config.apply('methodObject', item);
+            this._add(item.name, item.method, item.options ?? {}, realm);
+        }
+    }
+
+    _add(name, method, options, realm) {
+
+        Hoek.assert(typeof method === 'function', 'method must be a function');
+        Hoek.assert(typeof name === 'string', 'name must be a string');
+        Hoek.assert(name.match(internals.methodNameRx), 'Invalid name:', name);
+        Hoek.assert(!Hoek.reach(this.methods, name, { functions: false }), 'Server method function name already exists:', name);
+
+        options = Config.apply('method', options, name);
+
+        const settings = Hoek.clone(options, { shallow: ['bind'] });
+        settings.generateKey = settings.generateKey ?? internals.generateKey;
+
+        const bind = settings.bind ?? realm.settings.bind ?? null;
+        const bound = !bind ? method : (...args) => method.apply(bind, args);
+
+        // Not cached
+
+        if (!settings.cache) {
+            return this._assign(name, bound);
+        }
+
+        // Cached
+
+        Hoek.assert(!settings.cache.generateFunc, 'Cannot set generateFunc with method caching:', name);
+        Hoek.assert(settings.cache.generateTimeout !== undefined, 'Method caching requires a timeout value in generateTimeout:', name);
+
+        settings.cache.generateFunc = (id, flags) => bound(...id.args, flags);
+        const cache = this.#core._cachePolicy(settings.cache, '#' + name);
+
+        const func = function (...args) {
+
+            const key = settings.generateKey.apply(bind, args);
+            if (typeof key !== 'string') {
+                return Promise.reject(Boom.badImplementation('Invalid method key when invoking: ' + name, { name, args }));
+            }
+
+            return cache.get({ id: key, args });
+        };
+
+        func.cache = {
+            drop: function (...args) {
+
+                const key = settings.generateKey.apply(bind, args);
+                if (typeof key !== 'string') {
+                    return Promise.reject(Boom.badImplementation('Invalid method key when invoking: ' + name, { name, args }));
+                }
+
+                return cache.drop(key);
+            },
+            stats: cache.stats
+        };
+
+        this._assign(name, func, func);
+    }
+
+    _assign(name, method) {
+
+        const path = name.split('.');
+        let ref = this.methods;
+        for (let i = 0; i < path.length; ++i) {
+            if (!ref[path[i]]) {
+                ref[path[i]] = (i + 1 === path.length ? method : {});
+            }
+
+            ref = ref[path[i]];
+        }
+    }
+};
+
+
+internals.supportedArgs = ['string', 'number', 'boolean'];
+
+
+internals.generateKey = function (...args) {
+
+    let key = '';
+    for (let i = 0; i < args.length; ++i) {
+        const arg = args[i];
+        if (!internals.supportedArgs.includes(typeof arg)) {
+            return null;
+        }
+
+        key = key + (i ? ':' : '') + encodeURIComponent(arg.toString());
+    }
+
+    return key;
+};

node_modules/@hapi/hapi/lib/request.js

@@ -0,0 +1,754 @@
+'use strict';
+
+const Querystring = require('querystring');
+const Url = require('url');
+
+const Boom = require('@hapi/boom');
+const Bounce = require('@hapi/bounce');
+const Hoek = require('@hapi/hoek');
+const Podium = require('@hapi/podium');
+
+const Cors = require('./cors');
+const Toolkit = require('./toolkit');
+const Transmit = require('./transmit');
+
+
+const internals = {
+    events: Podium.validate(['finish', { name: 'peek', spread: true }, 'disconnect']),
+    reserved: ['server', 'url', 'query', 'path', 'method', 'mime', 'setUrl', 'setMethod', 'headers', 'id', 'app', 'plugins', 'route', 'auth', 'pre', 'preResponses', 'info', 'isInjected', 'orig', 'params', 'paramsArray', 'payload', 'state', 'response', 'raw', 'domain', 'log', 'logs', 'generateResponse']
+};
+
+
+exports = module.exports = internals.Request = class {
+
+    constructor(server, req, res, options) {
+
+        this._allowInternals = !!options.allowInternals;
+        this._closed = false;                                                                               // true once the response has closed (esp. early) and will not emit any more events
+        this._core = server._core;
+        this._entity = null;                                                                                // Entity information set via h.entity()
+        this._eventContext = { request: this };
+        this._events = null;                                                                                // Assigned an emitter when request.events is accessed
+        this._expectContinue = !!options.expectContinue;
+        this._isInjected = !!options.isInjected;
+        this._isPayloadPending = !!(req.headers['content-length'] || req.headers['transfer-encoding']);     // Changes to false when incoming payload fully processed
+        this._isReplied = false;                                                                            // true when response processing started
+        this._route = this._core.router.specials.notFound.route;                                            // Used prior to routing (only settings are used, not the handler)
+        this._serverTimeoutId = null;
+        this._states = {};
+        this._url = null;
+        this._urlError = null;
+
+        this.app = options.app ? Object.assign({}, options.app) : {};                                       // Place for application-specific state without conflicts with hapi, should not be used by plugins (shallow cloned)
+        this.headers = req.headers;
+        this.logs = [];
+        this.method = req.method.toLowerCase();
+        this.mime = null;
+        this.orig = {};
+        this.params = null;
+        this.paramsArray = null;                                                                            // Array of path parameters in path order
+        this.path = null;
+        this.payload = undefined;
+        this.plugins = options.plugins ? Object.assign({}, options.plugins) : {};                           // Place for plugins to store state without conflicts with hapi, should be namespaced using plugin name (shallow cloned)
+        this.pre = {};                                                                                      // Pre raw values
+        this.preResponses = {};                                                                             // Pre response values
+        this.raw = { req, res };
+        this.response = null;
+        this.route = this._route.public;
+        this.query = null;
+        this.server = server;
+        this.state = null;
+
+        this.info = new internals.Info(this);
+
+        this.auth = {
+            isAuthenticated: false,
+            isAuthorized: false,
+            isInjected: options.auth ? true : false,
+            [internals.Request.symbols.authPayload]: options.auth?.payload ?? true,
+            credentials: options.auth?.credentials ?? null,                                    // Special keys: 'app', 'user', 'scope'
+            artifacts: options.auth?.artifacts ?? null,                                      // Scheme-specific artifacts
+            strategy: options.auth?.strategy ?? null,
+            mode: null,
+            error: null
+        };
+
+        // Parse request url
+
+        this._initializeUrl();
+    }
+
+    static generate(server, req, res, options) {
+
+        const request = new server._core.Request(server, req, res, options);
+
+        // Decorate
+
+        if (server._core.decorations.requestApply) {
+            for (const [property, assignment] of server._core.decorations.requestApply.entries()) {
+                request[property] = assignment(request);
+            }
+        }
+
+        request._listen();
+        return request;
+    }
+
+    get events() {
+
+        if (!this._events) {
+            this._events = new Podium.Podium(internals.events);
+        }
+
+        return this._events;
+    }
+
+    get isInjected() {
+
+        return this._isInjected;
+    }
+
+    get url() {
+
+        if (this._urlError) {
+            return null;
+        }
+
+        if (this._url) {
+            return this._url;
+        }
+
+        return this._parseUrl(this.raw.req.url, this._core.settings.router);
+    }
+
+    _initializeUrl() {
+
+        try {
+            this._setUrl(this.raw.req.url, this._core.settings.router.stripTrailingSlash, { fast: true });
+        }
+        catch (err) {
+            this.path = this.raw.req.url;
+            this.query = {};
+
+            this._urlError = Boom.boomify(err, { statusCode: 400, override: false });
+        }
+    }
+
+    setUrl(url, stripTrailingSlash) {
+
+        Hoek.assert(this.params === null, 'Cannot change request URL after routing');
+
+        if (url instanceof Url.URL) {
+            url = url.href;
+        }
+
+        Hoek.assert(typeof url === 'string', 'Url must be a string or URL object');
+
+        this._setUrl(url, stripTrailingSlash, { fast: false });
+    }
+
+    _setUrl(source, stripTrailingSlash, { fast }) {
+
+        const url = this._parseUrl(source, { stripTrailingSlash, _fast: fast });
+        this.query = this._parseQuery(url.searchParams);
+        this.path = url.pathname;
+    }
+
+    _parseUrl(source, options) {
+
+        if (source[0] === '/') {
+
+            // Relative URL
+
+            if (options._fast) {
+                const url = {
+                    pathname: source,
+                    searchParams: ''
+                };
+
+                const q = source.indexOf('?');
+                const h = source.indexOf('#');
+
+                if (q !== -1 &&
+                    (h === -1 || q < h)) {
+
+                    url.pathname = source.slice(0, q);
+                    const query = h === -1 ? source.slice(q + 1) : source.slice(q + 1, h);
+                    url.searchParams = Querystring.parse(query);
+                }
+                else {
+                    url.pathname = h === -1 ? source : source.slice(0, h);
+                }
+
+                this._normalizePath(url, options);
+                return url;
+            }
+
+            this._url = new Url.URL(`${this._core.info.protocol}://${this.info.host || `${this._core.info.host}:${this._core.info.port}`}${source}`);
+        }
+        else {
+
+            // Absolute URI (proxied)
+
+            this._url = new Url.URL(source);
+            this.info.hostname = this._url.hostname;
+            this.info.host = this._url.host;
+        }
+
+        this._normalizePath(this._url, options);
+        this._urlError = null;
+
+        return this._url;
+    }
+
+    _normalizePath(url, options) {
+
+        let path = this._core.router.normalize(url.pathname);
+
+        if (options.stripTrailingSlash &&
+            path.length > 1 &&
+            path[path.length - 1] === '/') {
+
+            path = path.slice(0, -1);
+        }
+
+        url.pathname = path;
+    }
+
+    _parseQuery(searchParams) {
+
+        let query = Object.create(null);
+
+        // Flatten map
+
+        if (searchParams instanceof Url.URLSearchParams) {
+            for (let [key, value] of searchParams) {
+                const entry = query[key];
+                if (entry !== undefined) {
+                    value = [].concat(entry, value);
+                }
+
+                query[key] = value;
+            }
+        }
+        else {
+            query = Object.assign(query, searchParams);
+        }
+
+        // Custom parser
+
+        const parser = this._core.settings.query.parser;
+        if (parser) {
+            query = parser(query);
+            if (!query ||
+                typeof query !== 'object') {
+
+                throw Boom.badImplementation('Parsed query must be an object');
+            }
+        }
+
+        return query;
+    }
+
+    setMethod(method) {
+
+        Hoek.assert(this.params === null, 'Cannot change request method after routing');
+        Hoek.assert(method && typeof method === 'string', 'Missing method');
+
+        this.method = method.toLowerCase();
+    }
+
+    active() {
+
+        return !!this._eventContext.request;
+    }
+
+    async _execute() {
+
+        this.info.acceptEncoding = this._core.compression.accept(this);
+
+        try {
+            await this._onRequest();
+        }
+        catch (err) {
+            Bounce.rethrow(err, 'system');
+            return this._reply(err);
+        }
+
+        this._lookup();
+        this._setTimeouts();
+        await this._lifecycle();
+        this._reply();
+    }
+
+    async _onRequest() {
+
+        // onRequest (can change request method and url)
+
+        if (this._core.extensions.route.onRequest.nodes) {
+            const response = await this._invoke(this._core.extensions.route.onRequest);
+            if (response) {
+                if (!internals.skip(response)) {
+                    throw Boom.badImplementation('onRequest extension methods must return an error, a takeover response, or a continue signal');
+                }
+
+                throw response;
+            }
+        }
+
+        // Validate path
+
+        if (this._urlError) {
+            throw this._urlError;
+        }
+    }
+
+    _listen() {
+
+        if (this._isPayloadPending) {
+            this.raw.req.on('end', internals.event.bind(this.raw.req, this._eventContext, 'end'));
+        }
+
+        this.raw.res.on('close', internals.event.bind(this.raw.res, this._eventContext, 'close'));
+        this.raw.req.on('error', internals.event.bind(this.raw.req, this._eventContext, 'error'));
+        this.raw.req.on('aborted', internals.event.bind(this.raw.req, this._eventContext, 'abort'));
+        this.raw.res.once('close', internals.closed.bind(this.raw.res, this));
+    }
+
+    _lookup() {
+
+        const match = this._core.router.route(this.method, this.path, this.info.hostname);
+        if (!match.route.settings.isInternal ||
+            this._allowInternals) {
+
+            this._route = match.route;
+            this.route = this._route.public;
+        }
+
+        this.params = match.params ?? {};
+        this.paramsArray = match.paramsArray ?? [];
+
+        if (this.route.settings.cors) {
+            this.info.cors = {
+                isOriginMatch: Cors.matchOrigin(this.headers.origin, this.route.settings.cors)
+            };
+        }
+    }
+
+    _setTimeouts() {
+
+        if (this.raw.req.socket &&
+            this.route.settings.timeout.socket !== undefined) {
+
+            this.raw.req.socket.setTimeout(this.route.settings.timeout.socket || 0);    // Value can be false or positive
+        }
+
+        let serverTimeout = this.route.settings.timeout.server;
+        if (!serverTimeout) {
+            return;
+        }
+
+        const elapsed = Date.now() - this.info.received;
+        serverTimeout = Math.floor(serverTimeout - elapsed);            // Calculate the timeout from when the request was constructed
+
+        if (serverTimeout <= 0) {
+            internals.timeoutReply(this, serverTimeout);
+            return;
+        }
+
+        this._serverTimeoutId = setTimeout(internals.timeoutReply, serverTimeout, this, serverTimeout);
+    }
+
+    async _lifecycle() {
+
+        for (const func of this._route._cycle) {
+            if (this._isReplied) {
+                return;
+            }
+
+            try {
+                var response = await (typeof func === 'function' ? func(this) : this._invoke(func));
+            }
+            catch (err) {
+                Bounce.rethrow(err, 'system');
+                response = this._core.Response.wrap(err, this);
+            }
+
+            if (!response ||
+                response === Toolkit.symbols.continue) {                // Continue
+
+                continue;
+            }
+
+            if (!internals.skip(response)) {
+                response = Boom.badImplementation('Lifecycle methods called before the handler can only return an error, a takeover response, or a continue signal');
+            }
+
+            this._setResponse(response);
+            return;
+        }
+    }
+
+    async _invoke(event, options = {}) {
+
+        for (const ext of event.nodes) {
+            const realm = ext.realm;
+            const bind = ext.bind ?? realm.settings.bind;
+            const response = await this._core.toolkit.execute(ext.func, this, { bind, realm, timeout: ext.timeout, name: event.type, ignoreResponse: options.ignoreResponse });
+
+            if (options.ignoreResponse) {
+                if (Boom.isBoom(response)) {
+                    this._log(['ext', 'error'], response);
+                }
+
+                continue;
+            }
+
+            if (response === Toolkit.symbols.continue) {
+                continue;
+            }
+
+            if (internals.skip(response) ||
+                this.response === null) {
+
+                return response;
+            }
+
+            this._setResponse(response);
+        }
+    }
+
+    async _reply(exit) {
+
+        if (this._isReplied) {                                          // Prevent any future responses to this request
+            return;
+        }
+
+        this._isReplied = true;
+
+        if (this._serverTimeoutId) {
+            clearTimeout(this._serverTimeoutId);
+        }
+
+        if (exit) {                                                     // Can be a valid response or error (if returned from an ext, already handled because this.response is also set)
+            this._setResponse(this._core.Response.wrap(exit, this));    // Wrap to ensure any object thrown is always a valid Boom or Response object
+        }
+
+        if (!this._eventContext.request) {
+            this._finalize();
+            return;
+        }
+
+        if (typeof this.response === 'symbol') {                        // close or abandon
+            this._abort();
+            return;
+        }
+
+        await this._postCycle();
+
+        if (!this._eventContext.request ||
+            typeof this.response === 'symbol') {                        // close or abandon
+
+            this._abort();
+            return;
+        }
+
+        await Transmit.send(this);
+        this._finalize();
+    }
+
+    async _postCycle() {
+
+        for (const func of this._route._postCycle) {
+            if (!this._eventContext.request) {
+                return;
+            }
+
+            try {
+                var response = await (typeof func === 'function' ? func(this) : this._invoke(func));
+            }
+            catch (err) {
+                Bounce.rethrow(err, 'system');
+                response = this._core.Response.wrap(err, this);
+            }
+
+            if (response &&
+                response !== Toolkit.symbols.continue) {            // Continue
+
+                this._setResponse(response);
+            }
+        }
+    }
+
+    _abort() {
+
+        if (this.response === Toolkit.symbols.close) {
+            this.raw.res.end();                                     // End the response in case it wasn't already closed
+        }
+
+        this._finalize();
+    }
+
+    _finalize() {
+
+        this._eventContext.request = null;              // Disable req events
+
+        if (this.response._close) {
+            if (this.response.statusCode === 500 &&
+                this.response._error) {
+
+                const tags = this.response._error.isDeveloperError ? ['internal', 'implementation', 'error'] : ['internal', 'error'];
+                this._log(tags, this.response._error, 'error');
+            }
+
+            this.response._close();
+        }
+
+        this.info.completed = Date.now();
+
+        this._core.events.emit('response', this);
+
+        if (this._route._extensions.onPostResponse.nodes) {
+            this._invoke(this._route._extensions.onPostResponse, { ignoreResponse: true });
+        }
+    }
+
+    _setResponse(response) {
+
+        if (this.response &&
+            !this.response.isBoom &&
+            this.response !== response &&
+            this.response.source !== response.source) {
+
+            this.response._close?.();
+        }
+
+        if (this.info.completed) {
+            response._close?.();
+
+            return;
+        }
+
+        this.response = response;
+    }
+
+    _setState(name, value, options) {
+
+        const state = { name, value };
+        if (options) {
+            Hoek.assert(!options.autoValue, 'Cannot set autoValue directly in a response');
+            state.options = Hoek.clone(options);
+        }
+
+        this._states[name] = state;
+    }
+
+    _clearState(name, options = {}) {
+
+        const state = { name };
+
+        state.options = Hoek.clone(options);
+        state.options.ttl = 0;
+
+        this._states[name] = state;
+    }
+
+    _tap() {
+
+        if (!this._events) {
+            return null;
+        }
+
+        if (this._events.hasListeners('peek') ||
+            this._events.hasListeners('finish')) {
+
+            return new this._core.Response.Peek(this._events);
+        }
+
+        return null;
+    }
+
+    log(tags, data) {
+
+        return this._log(tags, data, 'app');
+    }
+
+    _log(tags, data, channel = 'internal') {
+
+        if (!this._core.events.hasListeners('request') &&
+            !this.route.settings.log.collect) {
+
+            return;
+        }
+
+        if (!Array.isArray(tags)) {
+            tags = [tags];
+        }
+
+        const timestamp = Date.now();
+        const field = data instanceof Error ? 'error' : 'data';
+
+        let event = [this, { request: this.info.id, timestamp, tags, [field]: data, channel }];
+        if (typeof data === 'function') {
+            event = () => [this, { request: this.info.id, timestamp, tags, data: data(), channel }];
+        }
+
+        if (this.route.settings.log.collect) {
+            if (typeof data === 'function') {
+                event = event();
+            }
+
+            this.logs.push(event[1]);
+        }
+
+        this._core.events.emit({ name: 'request', channel, tags }, event);
+    }
+
+    generateResponse(source, options) {
+
+        return new this._core.Response(source, this, options);
+    }
+};
+
+
+internals.Request.reserved = internals.reserved;
+
+internals.Request.symbols = {
+    authPayload: Symbol('auth.payload')
+};
+
+internals.Info = class {
+
+    constructor(request) {
+
+        this._request = request;
+
+        const req = request.raw.req;
+        const host = req.headers.host ? req.headers.host.trim() : '';
+        const received = Date.now();
+
+        this.received = received;
+        this.referrer = req.headers.referrer || req.headers.referer || '';
+        this.host = host;
+        this.hostname = /^(.*?)(?::\d+)?$/.exec(host)[1];
+        this.id = `${received}:${request._core.info.id}:${request._core._counter()}`;
+
+        this._remoteAddress = null;
+        this._remotePort = null;
+
+        // Assigned later
+
+        this.acceptEncoding = null;
+        this.cors = null;
+        this.responded = 0;
+        this.completed = 0;
+
+        if (request._core.settings.info.remote) {
+            this.remoteAddress;
+            this.remotePort;
+        }
+    }
+
+    get remoteAddress() {
+
+        if (!this._remoteAddress) {
+            const ipv6Prefix = '::ffff:';
+            const socketAddress = this._request.raw.req.socket.remoteAddress;
+            if (socketAddress && socketAddress.startsWith(ipv6Prefix) && socketAddress.includes('.', ipv6Prefix.length)) {
+                // Normalize IPv4-mapped IPv6 address, e.g. ::ffff:127.0.0.1 -> 127.0.0.1
+                this._remoteAddress = socketAddress.slice(ipv6Prefix.length);
+            }
+            else {
+                this._remoteAddress = socketAddress;
+            }
+        }
+
+        return this._remoteAddress;
+    }
+
+    get remotePort() {
+
+        if (this._remotePort === null) {
+            this._remotePort = this._request.raw.req.socket.remotePort || '';
+        }
+
+        return this._remotePort;
+    }
+
+    toJSON() {
+
+        return {
+            acceptEncoding: this.acceptEncoding,
+            completed: this.completed,
+            cors: this.cors,
+            host: this.host,
+            hostname: this.hostname,
+            id: this.id,
+            received: this.received,
+            referrer: this.referrer,
+            remoteAddress: this.remoteAddress,
+            remotePort: this.remotePort,
+            responded: this.responded
+        };
+    }
+};
+
+
+internals.closed = function (request) {
+
+    request._closed = true;
+};
+
+internals.event = function ({ request }, event, err) {
+
+    if (!request) {
+        return;
+    }
+
+    request._isPayloadPending = false;
+
+    if (event === 'close' &&
+        request.raw.res.writableEnded) {
+
+        return;
+    }
+
+    if (event === 'end') {
+        return;
+    }
+
+    request._log(err ? ['request', 'error'] : ['request', 'error', event], err);
+
+    if (event === 'error') {
+        return;
+    }
+
+    request._eventContext.request = null;
+
+    if (event === 'abort') {
+
+        // Calling _reply() means that the abort is applied immediately, unless the response has already
+        // called _reply(), in which case this call is ignored and the transmit logic is responsible for
+        // handling the abort.
+
+        request._reply(new Boom.Boom('Request aborted', { statusCode: request.route.settings.response.disconnectStatusCode, data: request.response }));
+
+        if (request._events) {
+            request._events.emit('disconnect');
+        }
+    }
+};
+
+
+internals.timeoutReply = function (request, timeout) {
+
+    const elapsed = Date.now() - request.info.received;
+    request._log(['request', 'server', 'timeout', 'error'], { timeout, elapsed });
+    request._reply(Boom.serverUnavailable());
+};
+
+
+internals.skip = function (response) {
+
+    return response.isBoom || response._takeover || typeof response === 'symbol';
+};

node_modules/@hapi/hapi/lib/response.js

@@ -0,0 +1,751 @@
+'use strict';
+
+const Stream = require('stream');
+
+const Boom = require('@hapi/boom');
+const Bounce = require('@hapi/bounce');
+const Hoek = require('@hapi/hoek');
+const Podium = require('@hapi/podium');
+
+const Streams = require('./streams');
+
+
+const internals = {
+    events: Podium.validate(['finish', { name: 'peek', spread: true }]),
+    hopByHop: {
+        connection: true,
+        'keep-alive': true,
+        'proxy-authenticate': true,
+        'proxy-authorization': true,
+        'te': true,
+        'trailer': true,
+        'transfer-encoding': true,
+        'upgrade': true
+    },
+    reserved: ['app', 'headers', 'plugins', 'request', 'source', 'statusCode', 'variety',
+        'settings', 'events', 'code', 'message', 'header', 'vary', 'etag', 'type', 'contentType',
+        'bytes', 'location', 'created', 'compressed', 'replacer', 'space', 'suffix', 'escape',
+        'passThrough', 'redirect', 'temporary', 'permanent', 'rewritable', 'encoding', 'charset',
+        'ttl', 'state', 'unstate', 'takeover']
+};
+
+
+exports = module.exports = internals.Response = class {
+
+    constructor(source, request, options = {}) {
+
+        this.app = {};
+        this.headers = {};                          // Incomplete as some headers are stored in flags
+        this.plugins = {};
+        this.request = request;
+        this.source = null;
+        this.statusCode = null;
+        this.variety = null;
+
+        this.settings = {
+            charset: 'utf-8',                       // '-' required by IANA
+            compressed: null,
+            encoding: 'utf8',
+            message: null,
+            passThrough: true,
+            stringify: null,                        // JSON.stringify options
+            ttl: null,
+            varyEtag: false
+        };
+
+        this._events = null;
+        this._payload = null;                       // Readable stream
+        this._error = options.error ?? null;        // The boom object when created from an error (used for logging)
+        this._contentType = null;                   // Used if no explicit content-type is set and type is known
+        this._takeover = false;
+        this._statusCode = false;                   // true when code() called
+        this._state = this._error ? 'prepare' : 'init'; // One of 'init', 'prepare', 'marshall', 'close'
+
+        this._processors = {
+            marshal: options.marshal,
+            prepare: options.prepare,
+            close: options.close
+        };
+
+        this._setSource(source, options.variety);
+    }
+
+    static wrap(result, request) {
+
+        if (result instanceof request._core.Response ||
+            typeof result === 'symbol') {
+
+            return result;
+        }
+
+        if (result instanceof Error) {
+            return Boom.boomify(result);
+        }
+
+        return new request._core.Response(result, request);
+    }
+
+    _setSource(source, variety) {
+
+        // Method must not set any headers or other properties as source can change later
+
+        this.variety = variety ?? 'plain';
+
+        if (source === null ||
+            source === undefined) {
+
+            source = null;
+        }
+        else if (Buffer.isBuffer(source)) {
+            this.variety = 'buffer';
+            this._contentType = 'application/octet-stream';
+        }
+        else if (Streams.isStream(source)) {
+            this.variety = 'stream';
+            this._contentType = 'application/octet-stream';
+        }
+
+        this.source = source;
+
+        if (this.variety === 'plain' &&
+            this.source !== null) {
+
+            this._contentType = typeof this.source === 'string' ? 'text/html' : 'application/json';
+        }
+    }
+
+    get events() {
+
+        if (!this._events) {
+            this._events = new Podium.Podium(internals.events);
+        }
+
+        return this._events;
+    }
+
+    code(statusCode) {
+
+        Hoek.assert(Number.isSafeInteger(statusCode), 'Status code must be an integer');
+
+        this.statusCode = statusCode;
+        this._statusCode = true;
+
+        return this;
+    }
+
+    message(httpMessage) {
+
+        this.settings.message = httpMessage;
+        return this;
+    }
+
+    header(key, value, options) {
+
+        key = key.toLowerCase();
+        if (key === 'vary') {
+            return this.vary(value);
+        }
+
+        return this._header(key, value, options);
+    }
+
+    _header(key, value, options = {}) {
+
+        const append = options.append ?? false;
+        const separator = options.separator || ',';
+        const override = options.override !== false;
+        const duplicate = options.duplicate !== false;
+
+        if (!append && override ||
+            !this.headers[key]) {
+
+            this.headers[key] = value;
+        }
+        else if (override) {
+            if (key === 'set-cookie') {
+                this.headers[key] = [].concat(this.headers[key], value);
+            }
+            else {
+                const existing = this.headers[key];
+                if (!duplicate) {
+                    const values = existing.split(separator);
+                    for (const v of values) {
+                        if (v === value) {
+                            return this;
+                        }
+                    }
+                }
+
+                this.headers[key] = existing + separator + value;
+            }
+        }
+
+        return this;
+    }
+
+    vary(value) {
+
+        if (value === '*') {
+            this.headers.vary = '*';
+        }
+        else if (!this.headers.vary) {
+            this.headers.vary = value;
+        }
+        else if (this.headers.vary !== '*') {
+            this._header('vary', value, { append: true, duplicate: false });
+        }
+
+        return this;
+    }
+
+    etag(tag, options) {
+
+        const entity = this.request._core.Response.entity(tag, options);
+        this._header('etag', entity.etag);
+        this.settings.varyEtag = entity.vary;
+        return this;
+    }
+
+    static entity(tag, options = {}) {
+
+        Hoek.assert(tag !== '*', 'ETag cannot be *');
+
+        return {
+            etag: (options.weak ? 'W/' : '') + '"' + tag + '"',
+            vary: options.vary !== false && !options.weak,                      // vary defaults to true
+            modified: options.modified
+        };
+    }
+
+    static unmodified(request, entity) {
+
+        if (request.method !== 'get' &&
+            request.method !== 'head') {
+
+            return false;
+        }
+
+        // Strong verifier
+
+        if (entity.etag &&
+            request.headers['if-none-match']) {
+
+            const ifNoneMatch = request.headers['if-none-match'].split(/\s*,\s*/);
+            for (const etag of ifNoneMatch) {
+
+                // Compare tags (https://tools.ietf.org/html/rfc7232#section-2.3.2)
+
+                if (etag === entity.etag) {             // Strong comparison
+                    return true;
+                }
+
+                if (!entity.vary) {
+                    continue;
+                }
+
+                if (etag === `W/${entity.etag}`) {      // Weak comparison
+                    return etag;
+                }
+
+                const etagBase = entity.etag.slice(0, -1);
+                const encoders = request._core.compression.encodings;
+                for (const encoder of encoders) {
+                    if (etag === etagBase + `-${encoder}"`) {
+                        return true;
+                    }
+                }
+            }
+
+            return false;
+        }
+
+        // Weak verifier
+
+        if (!entity.modified) {
+            return false;
+        }
+
+        const ifModifiedSinceHeader = request.headers['if-modified-since'];
+        if (!ifModifiedSinceHeader) {
+            return false;
+        }
+
+        const ifModifiedSince = internals.parseDate(ifModifiedSinceHeader);
+        if (!ifModifiedSince) {
+            return false;
+        }
+
+        const lastModified = internals.parseDate(entity.modified);
+        if (!lastModified) {
+            return false;
+        }
+
+        return ifModifiedSince >= lastModified;
+    }
+
+    type(type) {
+
+        this._header('content-type', type);
+        return this;
+    }
+
+    get contentType() {
+
+        let type = this.headers['content-type'];
+        if (type) {
+            type = type.trim();
+            if (this.settings.charset &&
+                type.match(/^(?:text\/)|(?:application\/(?:json)|(?:javascript))/) &&
+                !type.match(/; *charset=/)) {
+
+                const semi = type[type.length - 1] === ';';
+                return type + (semi ? ' ' : '; ') + 'charset=' + this.settings.charset;
+            }
+
+            return type;
+        }
+
+        if (this._contentType) {
+            const charset = this.settings.charset && this._contentType !== 'application/octet-stream' ? '; charset=' + this.settings.charset : '';
+            return this._contentType + charset;
+        }
+
+        return null;
+    }
+
+    bytes(bytes) {
+
+        this._header('content-length', bytes);
+        return this;
+    }
+
+    location(uri) {
+
+        this._header('location', uri);
+        return this;
+    }
+
+    created(location) {
+
+        Hoek.assert(this.request.method === 'post' ||
+            this.request.method === 'put' ||
+            this.request.method === 'patch', 'Cannot return 201 status codes for ' + this.request.method.toUpperCase());
+
+        this.statusCode = 201;
+        this.location(location);
+        return this;
+    }
+
+    compressed(encoding) {
+
+        Hoek.assert(encoding && typeof encoding === 'string', 'Invalid content-encoding');
+        this.settings.compressed = encoding;
+        return this;
+    }
+
+    replacer(method) {
+
+        this.settings.stringify = this.settings.stringify ?? {};
+        this.settings.stringify.replacer = method;
+        return this;
+    }
+
+    spaces(count) {
+
+        this.settings.stringify = this.settings.stringify ?? {};
+        this.settings.stringify.space = count;
+        return this;
+    }
+
+    suffix(suffix) {
+
+        this.settings.stringify = this.settings.stringify ?? {};
+        this.settings.stringify.suffix = suffix;
+        return this;
+    }
+
+    escape(escape) {
+
+        this.settings.stringify = this.settings.stringify ?? {};
+        this.settings.stringify.escape = escape;
+        return this;
+    }
+
+    passThrough(enabled) {
+
+        this.settings.passThrough = enabled !== false;      // Defaults to true
+        return this;
+    }
+
+    redirect(location) {
+
+        this.statusCode = 302;
+        this.location(location);
+        return this;
+    }
+
+    temporary(isTemporary) {
+
+        Hoek.assert(this.headers.location, 'Cannot set redirection mode without first setting a location');
+
+        this._setTemporary(isTemporary !== false);           // Defaults to true
+        return this;
+    }
+
+    permanent(isPermanent) {
+
+        Hoek.assert(this.headers.location, 'Cannot set redirection mode without first setting a location');
+
+        this._setTemporary(isPermanent === false);           // Defaults to true
+        return this;
+    }
+
+    rewritable(isRewritable) {
+
+        Hoek.assert(this.headers.location, 'Cannot set redirection mode without first setting a location');
+
+        this._setRewritable(isRewritable !== false);         // Defaults to true
+        return this;
+    }
+
+    _isTemporary() {
+
+        return this.statusCode === 302 || this.statusCode === 307;
+    }
+
+    _isRewritable() {
+
+        return this.statusCode === 301 || this.statusCode === 302;
+    }
+
+    _setTemporary(isTemporary) {
+
+        if (isTemporary) {
+            if (this._isRewritable()) {
+                this.statusCode = 302;
+            }
+            else {
+                this.statusCode = 307;
+            }
+        }
+        else {
+            if (this._isRewritable()) {
+                this.statusCode = 301;
+            }
+            else {
+                this.statusCode = 308;
+            }
+        }
+    }
+
+    _setRewritable(isRewritable) {
+
+        if (isRewritable) {
+            if (this._isTemporary()) {
+                this.statusCode = 302;
+            }
+            else {
+                this.statusCode = 301;
+            }
+        }
+        else {
+            if (this._isTemporary()) {
+                this.statusCode = 307;
+            }
+            else {
+                this.statusCode = 308;
+            }
+        }
+    }
+
+    encoding(encoding) {
+
+        this.settings.encoding = encoding;
+        return this;
+    }
+
+    charset(charset) {
+
+        this.settings.charset = charset ?? null;
+        return this;
+    }
+
+    ttl(ttl) {
+
+        this.settings.ttl = ttl;
+        return this;
+    }
+
+    state(name, value, options) {
+
+        this.request._setState(name, value, options);
+        return this;
+    }
+
+    unstate(name, options) {
+
+        this.request._clearState(name, options);
+        return this;
+    }
+
+    takeover() {
+
+        this._takeover = true;
+        return this;
+    }
+
+    _prepare() {
+
+        Hoek.assert(this._state === 'init');
+
+        this._state = 'prepare';
+
+        this._passThrough();
+
+        if (!this._processors.prepare) {
+            return this;
+        }
+
+        try {
+            return this._processors.prepare(this);
+        }
+        catch (err) {
+            throw Boom.boomify(err);
+        }
+    }
+
+    _passThrough() {
+
+        if (this.variety === 'stream' &&
+            this.settings.passThrough) {
+
+            if (this.source.statusCode &&
+                !this.statusCode) {
+
+                this.statusCode = this.source.statusCode;                        // Stream is an HTTP response
+            }
+
+            if (this.source.headers) {
+                let headerKeys = Object.keys(this.source.headers);
+
+                if (headerKeys.length) {
+                    const localHeaders = this.headers;
+                    this.headers = {};
+
+                    const connection = this.source.headers.connection;
+                    const byHop = {};
+                    if (connection) {
+                        connection.split(/\s*,\s*/).forEach((header) => {
+
+                            byHop[header] = true;
+                        });
+                    }
+
+                    for (const key of headerKeys) {
+                        const lower = key.toLowerCase();
+                        if (!internals.hopByHop[lower] &&
+                            !byHop[lower]) {
+
+                            this.header(lower, Hoek.clone(this.source.headers[key]));     // Clone arrays
+                        }
+                    }
+
+                    headerKeys = Object.keys(localHeaders);
+                    for (const key of headerKeys) {
+                        this.header(key, localHeaders[key], { append: key === 'set-cookie' });
+                    }
+                }
+            }
+        }
+
+        this.statusCode = this.statusCode ?? 200;
+    }
+
+    async _marshal() {
+
+        Hoek.assert(this._state === 'prepare');
+
+        this._state = 'marshall';
+
+        // Processor marshal
+
+        let source = this.source;
+
+        if (this._processors.marshal) {
+            try {
+                source = await this._processors.marshal(this);
+            }
+            catch (err) {
+                throw Boom.boomify(err);
+            }
+        }
+
+        // Stream source
+
+        if (Streams.isStream(source)) {
+            this._payload = source;
+            return;
+        }
+
+        // Plain source (non string or null)
+
+        const jsonify = this.variety === 'plain' && source !== null && typeof source !== 'string';
+
+        if (!jsonify &&
+            this.settings.stringify) {
+
+            throw Boom.badImplementation('Cannot set formatting options on non object response');
+        }
+
+        let payload = source;
+
+        if (jsonify) {
+            const options = this.settings.stringify ?? {};
+            const space = options.space ?? this.request.route.settings.json.space;
+            const replacer = options.replacer ?? this.request.route.settings.json.replacer;
+            const suffix = options.suffix ?? this.request.route.settings.json.suffix ?? '';
+            const escape = this.request.route.settings.json.escape;
+
+            try {
+                if (replacer || space) {
+                    payload = JSON.stringify(payload, replacer, space);
+                }
+                else {
+                    payload = JSON.stringify(payload);
+                }
+            }
+            catch (err) {
+                throw Boom.boomify(err);
+            }
+
+            if (suffix) {
+                payload = payload + suffix;
+            }
+
+            if (escape) {
+                payload = Hoek.escapeJson(payload);
+            }
+        }
+
+        this._payload = new internals.Response.Payload(payload, this.settings);
+    }
+
+    _tap() {
+
+        if (!this._events) {
+            return null;
+        }
+
+        if (this._events.hasListeners('peek') ||
+            this._events.hasListeners('finish')) {
+
+            return new internals.Response.Peek(this._events);
+        }
+
+        return null;
+    }
+
+    _close() {
+
+        if (this._state === 'close') {
+            return;
+        }
+
+        this._state = 'close';
+
+        if (this._processors.close) {
+            try {
+                this._processors.close(this);
+            }
+            catch (err) {
+                Bounce.rethrow(err, 'system');
+                this.request._log(['response', 'cleanup', 'error'], err);
+            }
+        }
+
+        const stream = this._payload || this.source;
+        if (Streams.isStream(stream)) {
+            internals.Response.drain(stream);
+        }
+    }
+
+    _isPayloadSupported() {
+
+        return this.request.method !== 'head' && this.statusCode !== 304 && this.statusCode !== 204;
+    }
+
+    static drain(stream) {
+
+        stream.destroy();
+    }
+};
+
+
+internals.Response.reserved = internals.reserved;
+
+
+internals.parseDate = function (string) {
+
+    try {
+        return Date.parse(string);
+    }
+    catch (errIgnore) { }
+};
+
+
+internals.Response.Payload = class extends Stream.Readable {
+
+    constructor(payload, options) {
+
+        super();
+
+        this._data = payload;
+        this._encoding = options.encoding;
+    }
+
+    _read(size) {
+
+        if (this._data) {
+            this.push(this._data, this._encoding);
+        }
+
+        this.push(null);
+    }
+
+    size() {
+
+        if (!this._data) {
+            return 0;
+        }
+
+        return Buffer.isBuffer(this._data) ? this._data.length : Buffer.byteLength(this._data, this._encoding);
+    }
+
+    writeToStream(stream) {
+
+        if (this._data) {
+            stream.write(this._data, this._encoding);
+        }
+
+        stream.end();
+    }
+};
+
+
+internals.Response.Peek = class extends Stream.Transform {
+
+    constructor(podium) {
+
+        super();
+
+        this._podium = podium;
+        this.on('finish', () => podium.emit('finish'));
+    }
+
+    _transform(chunk, encoding, callback) {
+
+        this._podium.emit('peek', [chunk, encoding]);
+        this.push(chunk, encoding);
+        callback();
+    }
+};

node_modules/@hapi/hapi/lib/route.js

@@ -0,0 +1,489 @@
+'use strict';
+
+const Assert = require('assert');
+
+const Bounce = require('@hapi/bounce');
+const Catbox = require('@hapi/catbox');
+const Hoek = require('@hapi/hoek');
+const Subtext = require('@hapi/subtext');
+const Validate = require('@hapi/validate');
+
+const Auth = require('./auth');
+const Config = require('./config');
+const Cors = require('./cors');
+const Ext = require('./ext');
+const Handler = require('./handler');
+const Headers = require('./headers');
+const Security = require('./security');
+const Streams = require('./streams');
+const Validation = require('./validation');
+
+
+const internals = {};
+
+
+exports = module.exports = internals.Route = class {
+
+    constructor(route, server, options = {}) {
+
+        const core = server._core;
+        const realm = server.realm;
+
+        // Routing information
+
+        Config.apply('route', route, route.method, route.path);
+
+        const method = route.method.toLowerCase();
+        Hoek.assert(method !== 'head', 'Cannot set HEAD route:', route.path);
+
+        const path = realm.modifiers.route.prefix ? realm.modifiers.route.prefix + (route.path !== '/' ? route.path : '') : route.path;
+        Hoek.assert(path === '/' || path[path.length - 1] !== '/' || !core.settings.router.stripTrailingSlash, 'Path cannot end with a trailing slash when configured to strip:', route.method, route.path);
+
+        const vhost = realm.modifiers.route.vhost ?? route.vhost;
+
+        // Set identifying members (assert)
+
+        this.method = method;
+        this.path = path;
+
+        // Prepare configuration
+
+        let config = route.options ?? route.config ?? {};
+        if (typeof config === 'function') {
+            config = config.call(realm.settings.bind, server);
+        }
+
+        config = Config.enable(config);     // Shallow clone
+
+        // Verify route level config (as opposed to the merged settings)
+
+        this._assert(method !== 'get' || !config.payload, 'Cannot set payload settings on HEAD or GET request');
+        this._assert(method !== 'get' || !config.validate?.payload, 'Cannot validate HEAD or GET request payload');
+
+        // Rules
+
+        this._assert(!route.rules || !config.rules, 'Route rules can only appear once');                    // XOR
+        const rules = route.rules ?? config.rules;
+        const rulesConfig = internals.rules(rules, { method, path, vhost }, server);
+        delete config.rules;
+
+        // Handler
+
+        this._assert(route.handler || config.handler, 'Missing or undefined handler');
+        this._assert(!!route.handler ^ !!config.handler, 'Handler must only appear once');                  // XOR
+
+        const handler = Config.apply('handler', route.handler ?? config.handler);
+        delete config.handler;
+
+        const handlerDefaults = Handler.defaults(method, handler, core);
+
+        // Apply settings in order: server <- handler <- realm <- route
+
+        const settings = internals.config([core.settings.routes, handlerDefaults, realm.settings, rulesConfig, config]);
+        this.settings = Config.apply('routeConfig', settings, method, path);
+
+
+        // Route members
+
+        this._core = core;
+        this.realm = realm;
+
+        this.settings.vhost = vhost;
+        this.settings.plugins = this.settings.plugins ?? {};            // Route-specific plugins settings, namespaced using plugin name
+        this.settings.app = this.settings.app ?? {};                    // Route-specific application settings
+
+        // Path parsing
+
+        this._special = !!options.special;
+        this._analysis = this._core.router.analyze(this.path);
+        this.params = this._analysis.params;
+        this.fingerprint = this._analysis.fingerprint;
+
+        this.public = {
+            method: this.method,
+            path: this.path,
+            vhost,
+            realm,
+            settings: this.settings,
+            fingerprint: this.fingerprint,
+            auth: {
+                access: (request) => Auth.testAccess(request, this.public)
+            }
+        };
+
+        // Validation
+
+        this._setupValidation();
+
+        // Payload parsing
+
+        if (this.method === 'get') {
+            this.settings.payload = null;
+        }
+        else {
+            this.settings.payload.decoders = this._core.compression.decoders;       // Reference the shared object to keep up to date
+        }
+
+        this._assert(!this.settings.validate.payload || this.settings.payload.parse, 'Route payload must be set to \'parse\' when payload validation enabled');
+        this._assert(!this.settings.validate.state || this.settings.state.parse, 'Route state must be set to \'parse\' when state validation enabled');
+
+        // Authentication configuration
+
+        this.settings.auth = this._special ? false : this._core.auth._setupRoute(this.settings.auth, path);
+
+        // Cache
+
+        if (this.method === 'get' &&
+            typeof this.settings.cache === 'object' &&
+            (this.settings.cache.expiresIn || this.settings.cache.expiresAt)) {
+
+            this.settings.cache._statuses = new Set(this.settings.cache.statuses);
+            this._cache = new Catbox.Policy({ expiresIn: this.settings.cache.expiresIn, expiresAt: this.settings.cache.expiresAt });
+        }
+
+        // CORS
+
+        this.settings.cors = Cors.route(this.settings.cors);
+
+        // Security
+
+        this.settings.security = Security.route(this.settings.security);
+
+        // Handler
+
+        this.settings.handler = Handler.configure(handler, this);
+        this._prerequisites = Handler.prerequisitesConfig(this.settings.pre);
+
+        // Route lifecycle
+
+        this._extensions = {
+            onPreResponse: Ext.combine(this, 'onPreResponse'),
+            onPostResponse: Ext.combine(this, 'onPostResponse')
+        };
+
+        if (this._special) {
+            this._cycle = [internals.drain, Handler.execute];
+            this.rebuild();
+            return;
+        }
+
+        this._extensions.onPreAuth = Ext.combine(this, 'onPreAuth');
+        this._extensions.onCredentials = Ext.combine(this, 'onCredentials');
+        this._extensions.onPostAuth = Ext.combine(this, 'onPostAuth');
+        this._extensions.onPreHandler = Ext.combine(this, 'onPreHandler');
+        this._extensions.onPostHandler = Ext.combine(this, 'onPostHandler');
+
+        this.rebuild();
+    }
+
+    _setupValidation() {
+
+        const validation = this.settings.validate;
+        if (this.method === 'get') {
+            validation.payload = null;
+        }
+
+        this._assert(!validation.params || this.params.length, 'Cannot set path parameters validations without path parameters');
+
+        for (const type of ['headers', 'params', 'query', 'payload', 'state']) {
+            validation[type] = Validation.compile(validation[type], this.settings.validate.validator, this.realm, this._core);
+        }
+
+        if (this.settings.response.schema !== undefined ||
+            this.settings.response.status) {
+
+            this.settings.response._validate = true;
+
+            const rule = this.settings.response.schema;
+            this.settings.response.status = this.settings.response.status ?? {};
+            const statuses = Object.keys(this.settings.response.status);
+
+            if (rule === true &&
+                !statuses.length) {
+
+                this.settings.response._validate = false;
+            }
+            else {
+                this.settings.response.schema = Validation.compile(rule, this.settings.validate.validator, this.realm, this._core);
+                for (const code of statuses) {
+                    this.settings.response.status[code] = Validation.compile(this.settings.response.status[code], this.settings.validate.validator, this.realm, this._core);
+                }
+            }
+        }
+    }
+
+    rebuild(event) {
+
+        if (event) {
+            this._extensions[event.type].add(event);
+        }
+
+        if (this._special) {
+            this._postCycle = this._extensions.onPreResponse.nodes ? [this._extensions.onPreResponse] : [];
+            this._buildMarshalCycle();
+            return;
+        }
+
+        // Build lifecycle array
+
+        this._cycle = [];
+
+        // 'onRequest'
+
+        if (this.settings.state.parse) {
+            this._cycle.push(internals.state);
+        }
+
+        if (this._extensions.onPreAuth.nodes) {
+            this._cycle.push(this._extensions.onPreAuth);
+        }
+
+        if (this._core.auth._enabled(this, 'authenticate')) {
+            this._cycle.push(Auth.authenticate);
+        }
+
+        if (this.method !== 'get') {
+            this._cycle.push(internals.payload);
+
+            if (this._core.auth._enabled(this, 'payload')) {
+                this._cycle.push(Auth.payload);
+            }
+        }
+
+        if (this._core.auth._enabled(this, 'authenticate') &&
+            this._extensions.onCredentials.nodes) {
+
+            this._cycle.push(this._extensions.onCredentials);
+        }
+
+        if (this._core.auth._enabled(this, 'access')) {
+            this._cycle.push(Auth.access);
+        }
+
+        if (this._extensions.onPostAuth.nodes) {
+            this._cycle.push(this._extensions.onPostAuth);
+        }
+
+        if (this.settings.validate.headers) {
+            this._cycle.push(Validation.headers);
+        }
+
+        if (this.settings.validate.params) {
+            this._cycle.push(Validation.params);
+        }
+
+        if (this.settings.validate.query) {
+            this._cycle.push(Validation.query);
+        }
+
+        if (this.settings.validate.payload) {
+            this._cycle.push(Validation.payload);
+        }
+
+        if (this.settings.validate.state) {
+            this._cycle.push(Validation.state);
+        }
+
+        if (this._extensions.onPreHandler.nodes) {
+            this._cycle.push(this._extensions.onPreHandler);
+        }
+
+        this._cycle.push(Handler.execute);
+
+        if (this._extensions.onPostHandler.nodes) {
+            this._cycle.push(this._extensions.onPostHandler);
+        }
+
+        this._postCycle = [];
+
+        if (this.settings.response._validate &&
+            this.settings.response.sample !== 0) {
+
+            this._postCycle.push(Validation.response);
+        }
+
+        if (this._extensions.onPreResponse.nodes) {
+            this._postCycle.push(this._extensions.onPreResponse);
+        }
+
+        this._buildMarshalCycle();
+
+        // onPostResponse
+    }
+
+    _buildMarshalCycle() {
+
+        this._marshalCycle = [Headers.type];
+
+        if (this.settings.cors) {
+            this._marshalCycle.push(Cors.headers);
+        }
+
+        if (this.settings.security) {
+            this._marshalCycle.push(Security.headers);
+        }
+
+        this._marshalCycle.push(Headers.entity);
+
+        if (this.method === 'get' ||
+            this.method === '*') {
+
+            this._marshalCycle.push(Headers.unmodified);
+        }
+
+        this._marshalCycle.push(Headers.cache);
+        this._marshalCycle.push(Headers.state);
+        this._marshalCycle.push(Headers.content);
+
+        if (this._core.auth._enabled(this, 'response')) {
+            this._marshalCycle.push(Auth.response);                            // Must be last in case requires access to headers
+        }
+    }
+
+    _assert(condition, message) {
+
+        if (condition) {
+            return;
+        }
+
+        if (this.method[0] !== '_') {
+            message = `${message}: ${this.method.toUpperCase()} ${this.path}`;
+        }
+
+        throw new Assert.AssertionError({
+            message,
+            actual: false,
+            expected: true,
+            operator: '==',
+            stackStartFunction: this._assert
+        });
+    }
+};
+
+
+internals.state = async function (request) {
+
+    request.state = {};
+
+    const req = request.raw.req;
+    const cookies = req.headers.cookie;
+    if (!cookies) {
+        return;
+    }
+
+    try {
+        var result = await request._core.states.parse(cookies);
+    }
+    catch (err) {
+        Bounce.rethrow(err, 'system');
+        var parseError = err;
+    }
+
+    const { states, failed = [] } = result ?? parseError;
+    request.state = states ?? {};
+
+    // Clear cookies
+
+    for (const item of failed) {
+        if (item.settings.clearInvalid) {
+            request._clearState(item.name);
+        }
+    }
+
+    if (!parseError) {
+        return;
+    }
+
+    parseError.header = cookies;
+
+    return request._core.toolkit.failAction(request, request.route.settings.state.failAction, parseError, { tags: ['state', 'error'] });
+};
+
+
+internals.payload = async function (request) {
+
+    if (request.method === 'get' ||
+        request.method === 'head') {            // When route.method is '*'
+
+        return;
+    }
+
+    if (request.payload !== undefined) {
+        return internals.drain(request);
+    }
+
+    if (request._expectContinue) {
+        request._expectContinue = false;
+        request.raw.res.writeContinue();
+    }
+
+    try {
+        const { payload, mime } = await Subtext.parse(request.raw.req, request._tap(), request.route.settings.payload);
+
+        request._isPayloadPending = !!payload?._readableState;
+        request.mime = mime;
+        request.payload = payload;
+    }
+    catch (err) {
+        Bounce.rethrow(err, 'system');
+
+        await internals.drain(request);
+
+        request.mime = err.mime;
+        request.payload = null;
+
+        return request._core.toolkit.failAction(request, request.route.settings.payload.failAction, err, { tags: ['payload', 'error'] });
+    }
+};
+
+
+internals.drain = async function (request) {
+
+    // Flush out any pending request payload not consumed due to errors
+
+    if (request._expectContinue) {
+        request._isPayloadPending = false;        // If we don't continue, client should not send a payload
+        request._expectContinue = false;
+    }
+
+    if (request._isPayloadPending) {
+        await Streams.drain(request.raw.req);
+        request._isPayloadPending = false;
+    }
+};
+
+
+internals.config = function (chain) {
+
+    if (!chain.length) {
+        return {};
+    }
+
+    let config = chain[0];
+    for (const item of chain) {
+        config = Hoek.applyToDefaults(config, item, { shallow: ['bind', 'validate.headers', 'validate.payload', 'validate.params', 'validate.query', 'validate.state'] });
+    }
+
+    return config;
+};
+
+
+internals.rules = function (rules, info, server) {
+
+    const configs = [];
+
+    let realm = server.realm;
+    while (realm) {
+        if (realm._rules) {
+            const source = !realm._rules.settings.validate ? rules : Validate.attempt(rules, realm._rules.settings.validate.schema, realm._rules.settings.validate.options);
+            const config = realm._rules.processor(source, info);
+            if (config) {
+                configs.unshift(config);
+            }
+        }
+
+        realm = realm.parent;
+    }
+
+    return internals.config(configs);
+};

node_modules/@hapi/hapi/lib/security.js

@@ -0,0 +1,86 @@
+'use strict';
+
+const internals = {};
+
+
+exports.route = function (settings) {
+
+    if (!settings) {
+        return null;
+    }
+
+    const security = settings;
+    if (security.hsts) {
+        if (security.hsts === true) {
+            security._hsts = 'max-age=15768000';
+        }
+        else if (typeof security.hsts === 'number') {
+            security._hsts = 'max-age=' + security.hsts;
+        }
+        else {
+            security._hsts = 'max-age=' + (security.hsts.maxAge ?? 15768000);
+            if (security.hsts.includeSubdomains || security.hsts.includeSubDomains) {
+                security._hsts = security._hsts + '; includeSubDomains';
+            }
+
+            if (security.hsts.preload) {
+                security._hsts = security._hsts + '; preload';
+            }
+        }
+    }
+
+    if (security.xframe) {
+        if (security.xframe === true) {
+            security._xframe = 'DENY';
+        }
+        else if (typeof security.xframe === 'string') {
+            security._xframe = security.xframe.toUpperCase();
+        }
+        else if (security.xframe.rule === 'allow-from') {
+            if (!security.xframe.source) {
+                security._xframe = 'SAMEORIGIN';
+            }
+            else {
+                security._xframe = 'ALLOW-FROM ' + security.xframe.source;
+            }
+        }
+        else {
+            security._xframe = security.xframe.rule.toUpperCase();
+        }
+    }
+
+    return security;
+};
+
+
+exports.headers = function (response) {
+
+    const security = response.request.route.settings.security;
+
+    if (security._hsts) {
+        response._header('strict-transport-security', security._hsts, { override: false });
+    }
+
+    if (security._xframe) {
+        response._header('x-frame-options', security._xframe, { override: false });
+    }
+
+    if (security.xss === 'enabled') {
+        response._header('x-xss-protection', '1; mode=block', { override: false });
+    }
+    else if (security.xss === 'disabled') {
+        response._header('x-xss-protection', '0', { override: false });
+    }
+
+    if (security.noOpen) {
+        response._header('x-download-options', 'noopen', { override: false });
+    }
+
+    if (security.noSniff) {
+        response._header('x-content-type-options', 'nosniff', { override: false });
+    }
+
+    if (security.referrer !== false) {
+        response._header('referrer-policy', security.referrer, { override: false });
+    }
+};

node_modules/@hapi/hapi/lib/server.js

@@ -0,0 +1,604 @@
+'use strict';
+
+const Hoek = require('@hapi/hoek');
+const Shot = require('@hapi/shot');
+const Teamwork = require('@hapi/teamwork');
+
+const Config = require('./config');
+const Core = require('./core');
+const Cors = require('./cors');
+const Ext = require('./ext');
+const Package = require('../package.json');
+const Route = require('./route');
+const Toolkit = require('./toolkit');
+const Validation = require('./validation');
+
+
+const internals = {};
+
+
+exports = module.exports = function (options) {
+
+    const core = new Core(options);
+    return new internals.Server(core);
+};
+
+
+internals.Server = class {
+
+    constructor(core, name, parent) {
+
+        this._core = core;
+
+        // Public interface
+
+        this.app = core.app;
+        this.auth = core.auth.public(this);
+        this.decorations = core.decorations.public;
+        this.cache = internals.cache(this);
+        this.events = core.events;
+        this.info = core.info;
+        this.listener = core.listener;
+        this.load = core.heavy.load;
+        this.methods = core.methods.methods;
+        this.mime = core.mime;
+        this.plugins = core.plugins;
+        this.registrations = core.registrations;
+        this.settings = core.settings;
+        this.states = core.states;
+        this.type = core.type;
+        this.version = Package.version;
+
+        this.realm = {
+            _extensions: {
+                onPreAuth: new Ext('onPreAuth', core),
+                onCredentials: new Ext('onCredentials', core),
+                onPostAuth: new Ext('onPostAuth', core),
+                onPreHandler: new Ext('onPreHandler', core),
+                onPostHandler: new Ext('onPostHandler', core),
+                onPreResponse: new Ext('onPreResponse', core),
+                onPostResponse: new Ext('onPostResponse', core)
+            },
+            modifiers: {
+                route: {}
+            },
+            parent: parent ? parent.realm : null,
+            plugin: name,
+            pluginOptions: {},
+            plugins: {},
+            _rules: null,
+            settings: {
+                bind: undefined,
+                files: {
+                    relativeTo: undefined
+                }
+            },
+            validator: null
+        };
+
+        // Decorations
+
+        for (const [property, method] of core.decorations.server.entries()) {
+            this[property] = method;
+        }
+
+        core.registerServer(this);
+    }
+
+    _clone(name) {
+
+        return new internals.Server(this._core, name, this);
+    }
+
+    bind(context) {
+
+        Hoek.assert(typeof context === 'object', 'bind must be an object');
+        this.realm.settings.bind = context;
+    }
+
+    control(server) {
+
+        Hoek.assert(server instanceof internals.Server, 'Can only control Server objects');
+
+        this._core.controlled = this._core.controlled ?? [];
+        this._core.controlled.push(server);
+    }
+
+    decoder(encoding, decoder) {
+
+        return this._core.compression.addDecoder(encoding, decoder);
+    }
+
+    decorate(type, property, method, options = {}) {
+
+        Hoek.assert(this._core.decorations.public[type], 'Unknown decoration type:', type);
+        Hoek.assert(property, 'Missing decoration property name');
+        Hoek.assert(typeof property === 'string' || typeof property === 'symbol', 'Decoration property must be a string or a symbol');
+
+        const propertyName = property.toString();
+        Hoek.assert(propertyName[0] !== '_', 'Property name cannot begin with an underscore:', propertyName);
+
+        const existing = this._core.decorations[type].get(property);
+        if (options.extend) {
+            Hoek.assert(type !== 'handler', 'Cannot extend handler decoration:', propertyName);
+            Hoek.assert(existing, `Cannot extend missing ${type} decoration: ${propertyName}`);
+            Hoek.assert(typeof method === 'function', `Extended ${type} decoration method must be a function: ${propertyName}`);
+
+            method = method(existing);
+        }
+        else {
+            Hoek.assert(existing === undefined, `${type[0].toUpperCase() + type.slice(1)} decoration already defined: ${propertyName}`);
+        }
+
+        if (type === 'handler') {
+
+            // Handler
+
+            Hoek.assert(typeof method === 'function', 'Handler must be a function:', propertyName);
+            Hoek.assert(!method.defaults || typeof method.defaults === 'object' || typeof method.defaults === 'function', 'Handler defaults property must be an object or function');
+            Hoek.assert(!options.extend, 'Cannot extend handler decoration:', propertyName);
+        }
+        else if (type === 'request') {
+
+            // Request
+
+            Hoek.assert(!this._core.Request.reserved.includes(property), 'Cannot override the built-in request interface decoration:', propertyName);
+
+            if (options.apply) {
+                this._core.decorations.requestApply = this._core.decorations.requestApply ?? new Map();
+                this._core.decorations.requestApply.set(property, method);
+            }
+            else {
+                this._core.Request.prototype[property] = method;
+            }
+        }
+        else if (type === 'response') {
+
+            // Response
+
+            Hoek.assert(!this._core.Response.reserved.includes(property), 'Cannot override the built-in response interface decoration:', propertyName);
+            this._core.Response.prototype[property] = method;
+        }
+        else if (type === 'toolkit') {
+
+            // Toolkit
+
+            Hoek.assert(!Toolkit.reserved.includes(property), 'Cannot override the built-in toolkit decoration:', propertyName);
+            this._core.toolkit.decorate(property, method);
+        }
+        else {
+
+            // Server
+
+            if (typeof property === 'string') {
+                Hoek.assert(!Object.getOwnPropertyNames(internals.Server.prototype).includes(property), 'Cannot override the built-in server interface method:', propertyName);
+            }
+            else {
+                Hoek.assert(!Object.getOwnPropertySymbols(internals.Server.prototype).includes(property), 'Cannot override the built-in server interface method:', propertyName);
+            }
+
+            this._core.instances.forEach((server) => {
+
+                server[property] = method;
+            });
+        }
+
+        this._core.decorations[type].set(property, method);
+        this._core.decorations.public[type].push(property);
+    }
+
+    dependency(dependencies, after) {
+
+        Hoek.assert(this.realm.plugin, 'Cannot call dependency() outside of a plugin');
+        Hoek.assert(!after || typeof after === 'function', 'Invalid after method');
+
+        // Normalize to { plugin: version }
+
+        if (typeof dependencies === 'string') {
+            dependencies = { [dependencies]: '*' };
+        }
+        else if (Array.isArray(dependencies)) {
+            const map = {};
+            for (const dependency of dependencies) {
+                map[dependency] = '*';
+            }
+
+            dependencies = map;
+        }
+
+        this._core.dependencies.push({ plugin: this.realm.plugin, deps: dependencies });
+
+        if (after) {
+            this.ext('onPreStart', after, { after: Object.keys(dependencies) });
+        }
+    }
+
+    encoder(encoding, encoder) {
+
+        return this._core.compression.addEncoder(encoding, encoder);
+    }
+
+    event(event) {
+
+        this._core.events.registerEvent(event);
+    }
+
+    expose(key, value, options = {}) {
+
+        Hoek.assert(this.realm.plugin, 'Cannot call expose() outside of a plugin');
+
+        let plugin = this.realm.plugin;
+        if (plugin[0] === '@' &&
+            options.scope !== true) {
+
+            plugin = plugin.replace(/^@([^/]+)\//, ($0, $1) => {
+
+                return !options.scope ? '' : `${$1}__`;
+            });
+        }
+
+        this._core.plugins[plugin] = this._core.plugins[plugin] ?? {};
+
+        if (typeof key === 'string') {
+            this._core.plugins[plugin][key] = value;
+        }
+        else {
+            Hoek.merge(this._core.plugins[plugin], key);
+        }
+    }
+
+    ext(events, method, options) {        // (event, method, options) -OR- (events)
+
+        let promise;
+        if (typeof events === 'string') {
+            if (!method) {
+                const team = new Teamwork.Team();
+                method = (request, h) => {
+
+                    team.attend(request);
+                    return h.continue;
+                };
+
+                promise = team.work;
+            }
+
+            events = { type: events, method, options };
+        }
+
+        events = Config.apply('exts', events);
+        for (const event of events) {
+            this._ext(event);
+        }
+
+        return promise;
+    }
+
+    _ext(event) {
+
+        event = Object.assign({}, event);       // Shallow cloned
+        event.realm = this.realm;
+        const type = event.type;
+
+        if (!this._core.extensions.server[type]) {
+
+            // Realm route extensions
+
+            if (event.options.sandbox === 'plugin') {
+                Hoek.assert(this.realm._extensions[type], 'Unknown event type', type);
+                return this.realm._extensions[type].add(event);
+            }
+
+            // Connection route extensions
+
+            Hoek.assert(this._core.extensions.route[type], 'Unknown event type', type);
+            return this._core.extensions.route[type].add(event);
+        }
+
+        // Server extensions
+
+        Hoek.assert(!event.options.sandbox, 'Cannot specify sandbox option for server extension');
+        Hoek.assert(type !== 'onPreStart' || this._core.phase === 'stopped', 'Cannot add onPreStart (after) extension after the server was initialized');
+
+        event.server = this;
+        this._core.extensions.server[type].add(event);
+    }
+
+    async inject(options) {
+
+        let settings = options;
+        if (typeof settings === 'string') {
+            settings = { url: settings };
+        }
+
+        if (!settings.authority ||
+            settings.auth ||
+            settings.app ||
+            settings.plugins ||
+            settings.allowInternals !== undefined) {        // Can be false
+
+            settings = Object.assign({}, settings);         // options can be reused (shallow cloned)
+            delete settings.auth;
+            delete settings.app;
+            delete settings.plugins;
+            delete settings.allowInternals;
+
+            settings.authority = settings.authority ?? this._core.info.host + ':' + this._core.info.port;
+        }
+
+        Hoek.assert(!options.credentials, 'options.credentials no longer supported (use options.auth)');
+
+        if (options.auth) {
+            Hoek.assert(typeof options.auth === 'object', 'options.auth must be an object');
+            Hoek.assert(options.auth.credentials, 'options.auth.credentials is missing');
+            Hoek.assert(options.auth.strategy, 'options.auth.strategy is missing');
+        }
+
+        const needle = this._core._dispatch({
+            auth: options.auth,
+            allowInternals: options.allowInternals,
+            app: options.app,
+            plugins: options.plugins,
+            isInjected: true
+        });
+
+        const res = await Shot.inject(needle, settings);
+        const custom = res.raw.res[Config.symbol];
+        if (custom) {
+            delete res.raw.res[Config.symbol];
+
+            res.request = custom.request;
+
+            if (custom.error) {
+                throw custom.error;
+            }
+
+            if (custom.result !== undefined) {
+                res.result = custom.result;
+            }
+        }
+
+        if (res.result === undefined) {
+            res.result = res.payload;
+        }
+
+        return res;
+    }
+
+    log(tags, data) {
+
+        return this._core.log(tags, data);
+    }
+
+    lookup(id) {
+
+        Hoek.assert(id && typeof id === 'string', 'Invalid route id:', id);
+
+        const record = this._core.router.ids.get(id);
+        if (!record) {
+            return null;
+        }
+
+        return record.route.public;
+    }
+
+    match(method, path, host) {
+
+        Hoek.assert(method && typeof method === 'string', 'Invalid method:', method);
+        Hoek.assert(path && typeof path === 'string' && path[0] === '/', 'Invalid path:', path);
+        Hoek.assert(!host || typeof host === 'string', 'Invalid host:', host);
+
+        const match = this._core.router.route(method.toLowerCase(), path, host);
+        Hoek.assert(match !== this._core.router.specials.badRequest, 'Invalid path:', path);
+        if (match === this._core.router.specials.notFound) {
+            return null;
+        }
+
+        return match.route.public;
+    }
+
+    method(name, method, options = {}) {
+
+        return this._core.methods.add(name, method, options, this.realm);
+    }
+
+    path(relativeTo) {
+
+        Hoek.assert(relativeTo && typeof relativeTo === 'string', 'relativeTo must be a non-empty string');
+        this.realm.settings.files.relativeTo = relativeTo;
+    }
+
+    async register(plugins, options = {}) {
+
+        if (this.realm.modifiers.route.prefix ||
+            this.realm.modifiers.route.vhost) {
+
+            options = Hoek.clone(options);
+            options.routes = options.routes ?? {};
+
+            options.routes.prefix = (this.realm.modifiers.route.prefix ?? '') + (options.routes.prefix ?? '') || undefined;
+            options.routes.vhost = this.realm.modifiers.route.vhost ?? options.routes.vhost;
+        }
+
+        options = Config.apply('register', options);
+
+        ++this._core.registring;
+
+        try {
+            const items = [].concat(plugins);
+            for (let item of items) {
+
+                /*
+                    { register, ...attributes }
+                    { plugin: { register, ...attributes }, options, once, routes }
+                    { plugin: { plugin: { register, ...attributes } }, options, once, routes }      // Required module
+                */
+
+                if (!item.plugin) {
+                    item = {
+                        plugin: item
+                    };
+                }
+                else if (!item.plugin.register) {
+                    item = {
+                        options: item.options,
+                        once: item.once,
+                        routes: item.routes,
+                        plugin: item.plugin.plugin
+                    };
+                }
+                else if (typeof item === 'function') {
+                    item = Object.assign({}, item);         // Shallow cloned
+                }
+
+                item = Config.apply('plugin', item);
+
+                const name = item.plugin.name ?? item.plugin.pkg.name;
+                const clone = this._clone(name);
+
+                clone.realm.modifiers.route.prefix = item.routes.prefix ?? options.routes.prefix;
+                clone.realm.modifiers.route.vhost = item.routes.vhost ?? options.routes.vhost;
+                clone.realm.pluginOptions = item.options ?? {};
+
+                // Validate requirements
+
+                const requirements = item.plugin.requirements;
+                Hoek.assert(!requirements.node || Config.versionMatch(process.version, requirements.node), 'Plugin', name, 'requires node version', requirements.node, 'but found', process.version);
+                Hoek.assert(!requirements.hapi || Config.versionMatch(this.version, requirements.hapi), 'Plugin', name, 'requires hapi version', requirements.hapi, 'but found', this.version);
+
+                // Protect against multiple registrations
+
+                if (this._core.registrations[name]) {
+                    if (item.plugin.once ||
+                        item.once ||
+                        options.once) {
+
+                        continue;
+                    }
+
+                    Hoek.assert(item.plugin.multiple, 'Plugin', name, 'already registered');
+                }
+                else {
+                    this._core.registrations[name] = {
+                        version: item.plugin.version ?? item.plugin.pkg.version,
+                        name,
+                        options: item.options
+                    };
+                }
+
+                if (item.plugin.dependencies) {
+                    clone.dependency(item.plugin.dependencies);
+                }
+
+                // Register
+
+                await item.plugin.register(clone, item.options ?? {});
+            }
+        }
+        finally {
+            --this._core.registring;
+        }
+
+        return this;
+    }
+
+    route(options) {
+
+        Hoek.assert(typeof options === 'object', 'Invalid route options');
+
+        options = [].concat(options);
+        for (const config of options) {
+            if (Array.isArray(config.method)) {
+                for (const method of config.method) {
+                    const settings = Object.assign({}, config);     // Shallow cloned
+                    settings.method = method;
+                    this._addRoute(settings, this);
+                }
+            }
+            else {
+                this._addRoute(config, this);
+            }
+        }
+    }
+
+    _addRoute(config, server) {
+
+        const route = new Route(config, server);                        // Do no use config beyond this point, use route members
+        const vhosts = [].concat(route.settings.vhost ?? '*');
+
+        for (const vhost of vhosts) {
+            const record = this._core.router.add({ method: route.method, path: route.path, vhost, analysis: route._analysis, id: route.settings.id }, route);
+            route.fingerprint = record.fingerprint;
+            route.params = record.params;
+        }
+
+        this.events.emit('route', route.public);
+        Cors.options(route.public, server);
+    }
+
+    rules(processor, options = {}) {
+
+        Hoek.assert(!this.realm._rules, 'Server realm rules already defined');
+
+        const settings = Config.apply('rules', options);
+        if (settings.validate) {
+            const schema = settings.validate.schema;
+            settings.validate.schema = Validation.compile(schema, null, this.realm, this._core);
+        }
+
+        this.realm._rules = { processor, settings };
+    }
+
+    state(name, options) {
+
+        this.states.add(name, options);
+    }
+
+    table(host) {
+
+        return this._core.router.table(host);
+    }
+
+    validator(validator) {
+
+        Hoek.assert(!this.realm.validator, 'Validator already set');
+
+        this.realm.validator = Validation.validator(validator);
+    }
+
+    start() {
+
+        return this._core._start();
+    }
+
+    initialize() {
+
+        return this._core._initialize();
+    }
+
+    stop(options) {
+
+        return this._core._stop(options);
+    }
+};
+
+
+internals.cache = (plugin) => {
+
+    const policy = function (options, _segment) {
+
+        return this._core._cachePolicy(options, _segment, plugin.realm);
+    };
+
+    policy.provision = async (opts) => {
+
+        const clients = plugin._core._createCache(opts);
+
+        // Start cache
+
+        if (['initialized', 'starting', 'started'].includes(plugin._core.phase)) {
+            await Promise.all(clients.map((client) => client.start()));
+        }
+    };
+
+    return policy;
+};

node_modules/@hapi/hapi/lib/streams.js

@@ -0,0 +1,62 @@
+'use strict';
+
+const Stream = require('stream');
+
+const Boom = require('@hapi/boom');
+const Teamwork = require('@hapi/teamwork');
+
+const internals = {
+    team: Symbol('team')
+};
+
+
+exports.isStream = function (stream) {
+
+    const isReadableStream = stream instanceof Stream.Readable;
+
+    if (!isReadableStream &&
+        typeof stream?.pipe === 'function') {
+        throw Boom.badImplementation('Cannot reply with a stream-like object that is not an instance of Stream.Readable');
+    }
+
+    if (!isReadableStream) {
+        return false;
+    }
+
+    if (stream.readableObjectMode) {
+        throw Boom.badImplementation('Cannot reply with stream in object mode');
+    }
+
+    return true;
+};
+
+
+exports.drain = function (stream) {
+
+    const team = new Teamwork.Team();
+    stream[internals.team] = team;
+
+    stream.on('readable', internals.read);
+    stream.on('error', internals.end);
+    stream.on('end', internals.end);
+    stream.on('close', internals.end);
+
+    return team.work;
+};
+
+
+internals.read = function () {
+
+    while (this.read()) { }
+};
+
+
+internals.end = function () {
+
+    this.removeListener('readable', internals.read);
+    this.removeListener('error', internals.end);
+    this.removeListener('end', internals.end);
+    this.removeListener('close', internals.end);
+
+    this[internals.team].attend();
+};

node_modules/@hapi/hapi/lib/toolkit.js

@@ -0,0 +1,258 @@
+'use strict';
+
+const Boom = require('@hapi/boom');
+const Bounce = require('@hapi/bounce');
+const Hoek = require('@hapi/hoek');
+
+
+const internals = {};
+
+
+exports.reserved = [
+    'abandon',
+    'authenticated',
+    'close',
+    'context',
+    'continue',
+    'entity',
+    'redirect',
+    'realm',
+    'request',
+    'response',
+    'state',
+    'unauthenticated',
+    'unstate'
+];
+
+
+exports.symbols = {
+    abandon: Symbol('abandon'),
+    close: Symbol('close'),
+    continue: Symbol('continue')
+};
+
+
+exports.Manager = class {
+
+    constructor() {
+
+        this._toolkit = internals.toolkit();
+    }
+
+    async execute(method, request, options) {
+
+        const h = new this._toolkit(request, options);
+        const bind = options.bind ?? null;
+
+        try {
+            let operation;
+
+            if (bind) {
+                operation = method.call(bind, request, h);
+            }
+            else if (options.args) {
+                operation = method(request, h, ...options.args);
+            }
+            else {
+                operation = method(request, h);
+            }
+
+            var response = await exports.timed(operation, options);
+        }
+        catch (err) {
+            if (Bounce.isSystem(err)) {
+                response = Boom.badImplementation(err);
+            }
+            else if (!Bounce.isError(err)) {
+                response = Boom.badImplementation('Cannot throw non-error object', err);
+            }
+            else {
+                response = Boom.boomify(err);
+            }
+        }
+
+        // Process response
+
+        if (options.ignoreResponse) {
+            return response;
+        }
+
+        if (response === undefined) {
+            response = Boom.badImplementation(`${method.name} method did not return a value, a promise, or throw an error`);
+        }
+
+        if (options.continue &&
+            response === exports.symbols.continue) {
+
+            if (options.continue === 'undefined') {
+                return;
+            }
+
+            // 'null'
+
+            response = null;
+        }
+
+        if (options.auth &&
+            response instanceof internals.Auth) {
+
+            return response;
+        }
+
+        if (typeof response !== 'symbol') {
+            response = request._core.Response.wrap(response, request);
+            if (!response.isBoom && response._state === 'init') {
+                await response._prepare();
+            }
+        }
+
+        return response;
+    }
+
+    decorate(name, method) {
+
+        this._toolkit.prototype[name] = method;
+    }
+
+    async failAction(request, failAction, err, options) {
+
+        const retain = options.retain ? err : undefined;
+        if (failAction === 'ignore') {
+            return retain;
+        }
+
+        if (failAction === 'log') {
+            request._log(options.tags, err);
+            return retain;
+        }
+
+        if (failAction === 'error') {
+            throw err;
+        }
+
+        return await this.execute(failAction, request, { realm: request.route.realm, args: [options.details ?? err] });
+    }
+};
+
+
+exports.timed = async function (method, options) {
+
+    if (!options.timeout) {
+        return method;
+    }
+
+    const timer = new Promise((resolve, reject) => {
+
+        const handler = () => {
+
+            reject(Boom.internal(`${options.name} timed out`));
+        };
+
+        setTimeout(handler, options.timeout);
+    });
+
+    return await Promise.race([timer, method]);
+};
+
+
+/*
+    const handler = function (request, h) {
+
+        result / h.response(result)         -> result                           // Not allowed before handler
+        h.response(result).takeover()       -> result (respond)
+        h.continue                          -> null                             // Defaults to null only in handler and pre, not allowed in auth
+
+        throw error / h.response(error)     -> error (respond)                  // failAction override in pre
+        <undefined>                         -> badImplementation (respond)
+
+        // Auth only (scheme.payload and scheme.response use the same interface as pre-handler extension methods)
+
+        h.unauthenticated(error, data)      -> error (respond) + data
+        h.authenticated(data )              -> (continue) + data
+    };
+*/
+
+internals.toolkit = function () {
+
+    const Toolkit = class {
+
+        constructor(request, options) {
+
+            this.context = options.bind;
+            this.realm = options.realm;
+            this.request = request;
+
+            this._auth = options.auth;
+        }
+
+        response(result) {
+
+            Hoek.assert(!result || typeof result !== 'object' || typeof result.then !== 'function', 'Cannot wrap a promise');
+            Hoek.assert(result instanceof Error === false, 'Cannot wrap an error');
+            Hoek.assert(typeof result !== 'symbol', 'Cannot wrap a symbol');
+
+            return this.request._core.Response.wrap(result, this.request);
+        }
+
+        redirect(location) {
+
+            return this.response('').redirect(location);
+        }
+
+        entity(options) {
+
+            Hoek.assert(options, 'Entity method missing required options');
+            Hoek.assert(options.etag || options.modified, 'Entity methods missing required options key');
+
+            this.request._entity = options;
+
+            const entity = this.request._core.Response.entity(options.etag, options);
+            if (this.request._core.Response.unmodified(this.request, entity)) {
+                return this.response().code(304).takeover();
+            }
+        }
+
+        state(name, value, options) {
+
+            this.request._setState(name, value, options);
+        }
+
+        unstate(name, options) {
+
+            this.request._clearState(name, options);
+        }
+
+        authenticated(data) {
+
+            Hoek.assert(this._auth, 'Method not supported outside of authentication');
+            Hoek.assert(data?.credentials, 'Authentication data missing credentials information');
+
+            return new internals.Auth(null, data);
+        }
+
+        unauthenticated(error, data) {
+
+            Hoek.assert(this._auth, 'Method not supported outside of authentication');
+            Hoek.assert(!data || data.credentials, 'Authentication data missing credentials information');
+
+            return new internals.Auth(error, data);
+        }
+    };
+
+    Toolkit.prototype.abandon = exports.symbols.abandon;
+    Toolkit.prototype.close = exports.symbols.close;
+    Toolkit.prototype.continue = exports.symbols.continue;
+
+    return Toolkit;
+};
+
+
+internals.Auth = class {
+
+    constructor(error, data) {
+
+        this.isAuth = true;
+        this.error = error;
+        this.data = data;
+    }
+};

node_modules/@hapi/hapi/lib/transmit.js

@@ -0,0 +1,388 @@
+'use strict';
+
+const Http = require('http');
+
+const Ammo = require('@hapi/ammo');
+const Boom = require('@hapi/boom');
+const Bounce = require('@hapi/bounce');
+const Hoek = require('@hapi/hoek');
+const Teamwork = require('@hapi/teamwork');
+
+const Config = require('./config');
+
+
+const internals = {};
+
+
+exports.send = async function (request) {
+
+    const response = request.response;
+
+    try {
+        if (response.isBoom) {
+            await internals.fail(request, response);
+            return;
+        }
+
+        await internals.marshal(response);
+        await internals.transmit(response);
+    }
+    catch (err) {
+        Bounce.rethrow(err, 'system');
+        request._setResponse(err);
+        return internals.fail(request, err);
+    }
+};
+
+
+internals.marshal = async function (response) {
+
+    for (const func of response.request._route._marshalCycle) {
+        await func(response);
+    }
+};
+
+
+internals.fail = async function (request, boom) {
+
+    const response = internals.error(request, boom);
+    request.response = response;                                // Not using request._setResponse() to avoid double log
+
+    try {
+        await internals.marshal(response);
+    }
+    catch (err) {
+        Bounce.rethrow(err, 'system');
+
+        // Failed to marshal an error - replace with minimal representation of original error
+
+        const minimal = {
+            statusCode: response.statusCode,
+            error: Http.STATUS_CODES[response.statusCode],
+            message: boom.message
+        };
+
+        response._payload = new request._core.Response.Payload(JSON.stringify(minimal), {});
+    }
+
+    return internals.transmit(response);
+};
+
+
+internals.error = function (request, boom) {
+
+    const error = boom.output;
+    const response = new request._core.Response(error.payload, request, { error: boom });
+    response.code(error.statusCode);
+    response.headers = Hoek.clone(error.headers);               // Prevent source from being modified
+    return response;
+};
+
+
+internals.transmit = function (response) {
+
+    const request = response.request;
+    const length = internals.length(response);
+
+    // Pipes
+
+    const encoding = request._core.compression.encoding(response, length);
+    const ranger = encoding ? null : internals.range(response, length);
+    const compressor = internals.encoding(response, encoding);
+
+    // Connection: close
+
+    const isInjection = request.isInjected;
+    if (!(isInjection || request._core.started) ||
+        request._isPayloadPending && !request.raw.req._readableState.ended) {
+
+        response._header('connection', 'close');
+    }
+
+    // Write headers
+
+    internals.writeHead(response);
+
+    // Injection
+
+    if (isInjection) {
+        request.raw.res[Config.symbol] = { request };
+
+        if (response.variety === 'plain') {
+            request.raw.res[Config.symbol].result = response._isPayloadSupported() ? response.source : null;
+        }
+    }
+
+    // Finalize response stream
+
+    const stream = internals.chain([response._payload, response._tap(), compressor, ranger]);
+    return internals.pipe(request, stream);
+};
+
+
+internals.length = function (response) {
+
+    const request = response.request;
+
+    const header = response.headers['content-length'];
+    if (header === undefined) {
+        return null;
+    }
+
+    let length = header;
+    if (typeof length === 'string') {
+        length = parseInt(header, 10);
+        if (!isFinite(length)) {
+            delete response.headers['content-length'];
+            return null;
+        }
+    }
+
+    // Empty response
+
+    if (length === 0 &&
+        !response._statusCode &&
+        response.statusCode === 200 &&
+        request.route.settings.response.emptyStatusCode !== 200) {
+
+        response.code(204);
+        delete response.headers['content-length'];
+    }
+
+    return length;
+};
+
+
+internals.range = function (response, length) {
+
+    const request = response.request;
+
+    if (!length ||
+        !request.route.settings.response.ranges ||
+        request.method !== 'get' ||
+        response.statusCode !== 200) {
+
+        return null;
+    }
+
+    response._header('accept-ranges', 'bytes');
+
+    if (!request.headers.range) {
+        return null;
+    }
+
+    // Check If-Range
+
+    if (request.headers['if-range'] &&
+        request.headers['if-range'] !== response.headers.etag) {            // Ignoring last-modified date (weak)
+
+        return null;
+    }
+
+    // Parse header
+
+    const ranges = Ammo.header(request.headers.range, length);
+    if (!ranges) {
+        const error = Boom.rangeNotSatisfiable();
+        error.output.headers['content-range'] = 'bytes */' + length;
+        throw error;
+    }
+
+    // Prepare transform
+
+    if (ranges.length !== 1) {                                              // Ignore requests for multiple ranges
+        return null;
+    }
+
+    const range = ranges[0];
+    response.code(206);
+    response.bytes(range.to - range.from + 1);
+    response._header('content-range', 'bytes ' + range.from + '-' + range.to + '/' + length);
+
+    return new Ammo.Clip(range);
+};
+
+
+internals.encoding = function (response, encoding) {
+
+    const request = response.request;
+
+    const header = response.headers['content-encoding'] || encoding;
+    if (header &&
+        response.headers.etag &&
+        response.settings.varyEtag) {
+
+        response.headers.etag = response.headers.etag.slice(0, -1) + '-' + header + '"';
+    }
+
+    if (!encoding ||
+        response.statusCode === 206 ||
+        !response._isPayloadSupported()) {
+
+        return null;
+    }
+
+    delete response.headers['content-length'];
+    response._header('content-encoding', encoding);
+    const compressor = request._core.compression.encoder(request, encoding);
+    if (response.variety === 'stream' &&
+        typeof response._payload.setCompressor === 'function') {
+
+        response._payload.setCompressor(compressor);
+    }
+
+    return compressor;
+};
+
+
+internals.pipe = function (request, stream) {
+
+    const team = new Teamwork.Team();
+
+    // Write payload
+
+    const env = { stream, request, team };
+
+    if (request._closed) {
+
+        // The request has already been aborted - no need to wait or attempt to write.
+
+        internals.end(env, 'aborted');
+        return team.work;
+    }
+
+    const aborted = internals.end.bind(null, env, 'aborted');
+    const close = internals.end.bind(null, env, 'close');
+    const end = internals.end.bind(null, env, null);
+
+    request.raw.req.on('aborted', aborted);
+
+    request.raw.res.on('close', close);
+    request.raw.res.on('error', end);
+    request.raw.res.on('finish', end);
+
+    if (stream.writeToStream) {
+        stream.writeToStream(request.raw.res);
+    }
+    else {
+        stream.on('error', end);
+        stream.on('close', aborted);
+        stream.pipe(request.raw.res);
+    }
+
+    return team.work;
+};
+
+
+internals.end = function (env, event, err) {
+
+    const { request, stream, team } = env;
+
+    if (!team) {                                                        // Used instead of cleaning up emitter listeners
+        return;
+    }
+
+    env.team = null;
+
+    if (request.raw.res.writableEnded) {
+        request.info.responded = Date.now();
+
+        team.attend();
+        return;
+    }
+
+    if (err) {
+        request.raw.res.destroy();
+        request._core.Response.drain(stream);
+    }
+
+    // Update reported response to reflect the error condition
+
+    const origResponse = request.response;
+    const error = err ? Boom.boomify(err) :
+        new Boom.Boom(`Request ${event}`, { statusCode: request.route.settings.response.disconnectStatusCode, data: origResponse });
+
+    request._setResponse(error);
+
+    // Make inject throw a disconnect error
+
+    if (request.raw.res[Config.symbol]) {
+        request.raw.res[Config.symbol].error = event ? error :
+            new Boom.Boom(`Response error`, { statusCode: request.route.settings.response.disconnectStatusCode, data: origResponse });
+    }
+
+    if (event) {
+        request._log(['response', 'error', event]);
+    }
+    else {
+        request._log(['response', 'error'], err);
+    }
+
+    request.raw.res.end();                                          // Triggers injection promise resolve
+    team.attend();
+};
+
+
+internals.writeHead = function (response) {
+
+    const res = response.request.raw.res;
+    const headers = Object.keys(response.headers);
+    let i = 0;
+
+    try {
+        for (; i < headers.length; ++i) {
+            const header = headers[i];
+            const value = response.headers[header];
+            if (value !== undefined) {
+                res.setHeader(header, value);
+            }
+        }
+    }
+    catch (err) {
+        for (--i; i >= 0; --i) {
+            res.removeHeader(headers[i]);       // Undo headers
+        }
+
+        throw Boom.boomify(err);
+    }
+
+    if (response.settings.message) {
+        res.statusMessage = response.settings.message;
+    }
+
+    try {
+        res.writeHead(response.statusCode);
+    }
+    catch (err) {
+        throw Boom.boomify(err);
+    }
+};
+
+
+internals.chain = function (sources) {
+
+    let from = sources[0];
+    for (let i = 1; i < sources.length; ++i) {
+        const to = sources[i];
+        if (to) {
+            from.on('close', internals.destroyPipe.bind(from, to));
+            from.on('error', internals.errorPipe.bind(from, to));
+            from = from.pipe(to);
+        }
+    }
+
+    return from;
+};
+
+
+internals.destroyPipe = function (to) {
+
+    if (!this.readableEnded && !this.errored) {
+        to.destroy();
+    }
+};
+
+internals.errorPipe = function (to, err) {
+
+    to.emit('error', err);
+};

node_modules/@hapi/hapi/lib/types/index.d.ts

@@ -0,0 +1,21 @@
+// Definitions adapted from DefinitelyTyped, originally created by:
+// Rafael Souza Fijalkowski <https://github.com/rafaelsouzaf>
+// Justin Simms <https://github.com/jhsimms>
+// Simon Schick <https://github.com/SimonSchick>
+// Rodrigo Saboya <https://github.com/saboya>
+// Silas Rech <https://github.com/lenovouser>
+
+export * from './plugin';
+export * from './response';
+export * from './request';
+export * from './route';
+export * from './server';
+export * from './utils';
+
+// Kept for backwards compatibility only (remove in next major)
+
+export namespace Utils {
+    interface Dictionary<T> {
+        [key: string]: T;
+    }
+}

node_modules/@hapi/hapi/lib/types/plugin.d.ts

@@ -0,0 +1,266 @@
+import { RequestRoute } from './request';
+import { RouteOptions } from './route';
+import { Server } from './server';
+import { Lifecycle } from './utils';
+
+/**
+ * one of
+ * a single plugin name string.
+ * an array of plugin name strings.
+ * an object where each key is a plugin name and each matching value is a
+ * {@link https://www.npmjs.com/package/semver version range string} which must match the registered
+ *  plugin version.
+ */
+export type Dependencies = string | string[] | Record<string, string>;
+
+/**
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverregistrations)
+ */
+export interface PluginsListRegistered {
+}
+
+/**
+ * An object of the currently registered plugins where each key is a registered plugin name and the value is an
+ * object containing:
+ * * version - the plugin version.
+ * * name - the plugin name.
+ * * options - (optional) options passed to the plugin during registration.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverregistrations)
+ */
+export interface PluginRegistered {
+    /**
+     * the plugin version.
+     */
+    version: string;
+
+    /**
+     * the plugin name.
+     */
+    name: string;
+
+    /**
+     * options used to register the plugin.
+     */
+    options: object;
+}
+
+export interface PluginsStates {
+}
+
+export interface PluginSpecificConfiguration {
+}
+
+export interface PluginNameVersion {
+    /**
+     * (required) the plugin name string. The name is used as a unique key. Published plugins (e.g. published in the npm
+     * registry) should use the same name as the name field in their 'package.json' file. Names must be
+     * unique within each application.
+     */
+    name: string;
+
+    /**
+     * optional plugin version. The version is only used informatively to enable other plugins to find out the versions loaded. The version should be the same as the one specified in the plugin's
+     * 'package.json' file.
+     */
+    version?: string | undefined;
+}
+
+export interface PluginPackage {
+    /**
+     * Alternatively, the name and version can be included via the pkg property containing the 'package.json' file for the module which already has the name and version included
+     */
+    pkg: PluginNameVersion;
+}
+
+export interface PluginBase<T, D> {
+    /**
+     * (required) the registration function with the signature async function(server, options) where:
+     * * server - the server object with a plugin-specific server.realm.
+     * * options - any options passed to the plugin during registration via server.register().
+     */
+    register: (server: Server, options: T) => void | Promise<void>;
+
+    /** (optional) if true, allows the plugin to be registered multiple times with the same server. Defaults to false. */
+    multiple?: boolean | undefined;
+
+    /** (optional) a string or an array of strings indicating a plugin dependency. Same as setting dependencies via server.dependency(). */
+    dependencies?: Dependencies | undefined;
+
+    /**
+     * Allows defining semver requirements for node and hapi.
+     * @default Allows all.
+     */
+    requirements?: {
+        node?: string | undefined;
+        hapi?: string | undefined;
+    } | undefined;
+
+    /** once - (optional) if true, will only register the plugin once per server. If set, overrides the once option passed to server.register(). Defaults to no override. */
+    once?: boolean | undefined;
+
+    /**
+    * We need to use D within the PluginBase type to be able to infer it later on,
+    * but this property has no concrete existence in the code.
+    *
+    * See https://github.com/Microsoft/TypeScript/wiki/FAQ#why-doesnt-type-inference-work-on-this-interface-interface-foot-- for details.
+    */
+    ___$type_of_plugin_decorations$___?: D;
+}
+
+/**
+ * A plugin that is registered by name and version.
+ */
+export interface NamedPlugin<T, D = void> extends PluginBase<T, D>, PluginNameVersion {}
+
+/**
+ * A plugin that is registered by its package.json file.
+ */
+export interface PackagedPlugin<T, D = void> extends PluginBase<T, D>, PluginPackage {}
+
+
+/**
+ * Plugins provide a way to organize application code by splitting the server logic into smaller components. Each
+ * plugin can manipulate the server through the standard server interface, but with the added ability to sandbox
+ * certain properties. For example, setting a file path in one plugin doesn't affect the file path set
+ * in another plugin.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#plugins)
+ *
+ * The type T is the type of the plugin options.
+ */
+export type Plugin<T, D = void> = NamedPlugin<T, D> | PackagedPlugin<T, D>;
+
+/**
+ * The realm object contains sandboxed server settings specific to each plugin or authentication strategy. When registering a plugin or an authentication scheme, a server object reference is provided
+ * with a new server.realm container specific to that registration. It allows each plugin to maintain its own settings without leaking and affecting other plugins. For example, a plugin can set a
+ * default file path for local resources without breaking other plugins' configured paths. When calling server.bind(), the active realm's settings.bind property is set which is then used by routes
+ * and extensions added at the same level (server root or plugin).
+ *
+ * https://github.com/hapijs/hapi/blob/master/API.md#server.realm
+ */
+export interface ServerRealm {
+    /** when the server object is provided as an argument to the plugin register() method, modifiers provides the registration preferences passed the server.register() method and includes: */
+    modifiers: {
+        /** routes preferences: */
+        route: {
+            /**
+             * the route path prefix used by any calls to server.route() from the server. Note that if a prefix is used and the route path is set to '/', the resulting path will not include
+             * the trailing slash.
+             */
+            prefix: string;
+            /** the route virtual host settings used by any calls to server.route() from the server. */
+            vhost: string;
+        }
+    };
+    /** the realm of the parent server object, or null for the root server. */
+    parent: ServerRealm | null;
+    /** the active plugin name (empty string if at the server root). */
+    plugin: string;
+    /** the plugin options object passed at registration. */
+    pluginOptions: object;
+    /** plugin-specific state to be shared only among activities sharing the same active state. plugins is an object where each key is a plugin name and the value is the plugin state. */
+    plugins: PluginsStates;
+    /** settings overrides */
+    settings: {
+        files: {
+            relativeTo: string;
+        };
+        bind: object;
+    };
+}
+
+/**
+ * Registration options (different from the options passed to the registration function):
+ * * once - if true, subsequent registrations of the same plugin are skipped without error. Cannot be used with plugin options. Defaults to false. If not set to true, an error will be thrown the
+ * second time a plugin is registered on the server.
+ * * routes - modifiers applied to each route added by the plugin:
+ * * * prefix - string added as prefix to any route path (must begin with '/'). If a plugin registers a child plugin the prefix is passed on to the child or is added in front of the child-specific
+ * prefix.
+ * * * vhost - virtual host string (or array of strings) applied to every route. The outer-most vhost overrides the any nested configuration.
+ * For reference [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-await-serverregisterplugins-options)
+ */
+export interface ServerRegisterOptions {
+    /**
+     * if true, subsequent registrations of the same plugin are skipped without error. Cannot be used with plugin options. Defaults to false. If not set to true, an error will be thrown the second
+     * time a plugin is registered on the server.
+     */
+    once?: boolean | undefined;
+    /**
+     * modifiers applied to each route added by the plugin:
+     */
+    routes?: {
+        /**
+         * string added as prefix to any route path (must begin with '/'). If a plugin registers a child plugin the prefix is passed on to the child or is added in front of the child-specific prefix.
+         */
+        prefix: string;
+        /**
+         * virtual host string (or array of strings) applied to every route. The outer-most vhost overrides the any nested configuration.
+         */
+        vhost?: string | string[] | undefined;
+    } | undefined;
+}
+
+export interface ServerRegisterPluginObjectDirect<T, D> extends ServerRegisterOptions {
+    /**
+     * a plugin object.
+     */
+    plugin: Plugin<T, D>;
+    /**
+     * options passed to the plugin during registration.
+     */
+    options?: T | undefined;
+}
+
+export interface ServerRegisterPluginObjectWrapped<T, D> extends ServerRegisterOptions {
+    /**
+     * a plugin object.
+     */
+    plugin: { plugin: Plugin<T, D> };
+    /**
+     * options passed to the plugin during registration.
+     */
+    options?: T | undefined;
+}
+
+/**
+ * An object with the following:
+ * * plugin - a plugin object or a wrapped plugin loaded module.
+ * * options - (optional) options passed to the plugin during registration.
+ * * once - if true, subsequent registrations of the same plugin are skipped without error. Cannot be used with plugin options. Defaults to false. If not set to true, an error will be thrown the
+ * second time a plugin is registered on the server.
+ * * routes - modifiers applied to each route added by the plugin:
+ * * * prefix - string added as prefix to any route path (must begin with '/'). If a plugin registers a child plugin the prefix is passed on to the child or is added in front of the child-specific
+ * prefix.
+ * * * vhost - virtual host string (or array of strings) applied to every route. The outer-most vhost overrides the any nested configuration.
+ * For reference [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-await-serverregisterplugins-options)
+ *
+ * The type parameter T is the type of the plugin configuration options.
+ */
+export type ServerRegisterPluginObject<T, D = void> =
+    ServerRegisterPluginObjectDirect<T, D> |
+    ServerRegisterPluginObjectWrapped<T, D>;
+
+export type ServerRegisterPluginObjectArray<T, U, V, W, X, Y, Z> = (
+    ServerRegisterPluginObject<T> |
+    ServerRegisterPluginObject<U> |
+    ServerRegisterPluginObject<V> |
+    ServerRegisterPluginObject<W> |
+    ServerRegisterPluginObject<X> |
+    ServerRegisterPluginObject<Y> |
+    ServerRegisterPluginObject<Z>
+)[];
+
+/**
+ * The method function can have a defaults object or function property. If the property is set to an object, that object is used as the default route config for routes using this handler.
+ * If the property is set to a function, the function uses the signature function(method) and returns the route default configuration.
+ */
+export interface HandlerDecorationMethod {
+    (route: RequestRoute, options: any): Lifecycle.Method;
+    defaults?: RouteOptions | ((method: any) => RouteOptions) | undefined;
+}
+
+/**
+ * An empty interface to allow typings of custom plugin properties.
+ */
+
+export interface PluginProperties {
+}

node_modules/@hapi/hapi/lib/types/request.d.ts

@@ -0,0 +1,531 @@
+import * as http from 'http';
+import * as stream from 'stream';
+import * as url from 'url';
+
+import { Boom } from '@hapi/boom';
+import { Podium } from '@hapi/podium';
+
+import { PluginsStates, ServerRealm } from './plugin';
+import { ResponseValue, ResponseObject } from "./response";
+import { RouteRules, RouteSettings } from './route';
+import { Server, ServerAuthSchemeObjectApi } from './server';
+import { HTTP_METHODS, PeekListener } from './utils';
+
+/**
+ * User extensible types user credentials.
+ */
+export interface UserCredentials {
+}
+
+/**
+ * User extensible types app credentials.
+ */
+export interface AppCredentials {
+}
+
+/**
+ * User-extensible type for request.auth credentials.
+ */
+export interface AuthCredentials<
+    AuthUser = UserCredentials,
+    AuthApp = AppCredentials
+> {
+    /**
+     * The application scopes to be granted.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsauthaccessscope)
+     */
+    scope?: string[] | undefined;
+
+    /**
+     * If set, will only work with routes that set `access.entity` to `user`.
+     */
+    user?: AuthUser
+
+    /**
+     * If set, will only work with routes that set `access.entity` to `app`.
+     */
+    app?: AuthApp;
+}
+
+export interface AuthArtifacts {
+    [key: string]: unknown;
+}
+
+export type AuthMode = 'required' | 'optional' | 'try';
+
+/**
+ * Authentication information:
+ * * artifacts - an artifact object received from the authentication strategy and used in authentication-related actions.
+ * * credentials - the credential object received during the authentication process. The presence of an object does not mean successful authentication.
+ * * error - the authentication error is failed and mode set to 'try'.
+ * * isAuthenticated - true if the request has been successfully authenticated, otherwise false.
+ * * isAuthorized - true is the request has been successfully authorized against the route authentication access configuration. If the route has not access rules defined or if the request failed
+ * authorization, set to false.
+ * * mode - the route authentication mode.
+ * * strategy - the name of the strategy used.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestauth)
+ */
+export interface RequestAuth<
+    AuthUser = UserCredentials,
+    AuthApp = AppCredentials,
+    CredentialsExtra = Record<string, unknown>,
+    ArtifactsExtra = Record<string, unknown>
+> {
+    /** an artifact object received from the authentication strategy and used in authentication-related actions. */
+    artifacts: ArtifactsExtra;
+    /** the credential object received during the authentication process. The presence of an object does not mean successful authentication. */
+    credentials: (
+
+        AuthCredentials<AuthUser, AuthApp> &
+        CredentialsExtra
+    );
+
+    /** the authentication error is failed and mode set to 'try'. */
+    error: Error;
+    /** true if the request has been successfully authenticated, otherwise false. */
+    isAuthenticated: boolean;
+    /**
+     * true is the request has been successfully authorized against the route authentication access configuration. If the route has not access rules defined or if the request failed authorization,
+     * set to false.
+     */
+    isAuthorized: boolean;
+    /** true if the request has been authenticated via the `server.inject()` `auth` option, otherwise `undefined`. */
+    isInjected?: boolean | undefined;
+    /** the route authentication mode. */
+    mode: AuthMode;
+    /** the name of the strategy used. */
+    strategy: string;
+}
+
+
+/**
+ * 'peek' - emitted for each chunk of payload data read from the client connection. The event method signature is function(chunk, encoding).
+ * 'finish' - emitted when the request payload finished reading. The event method signature is function ().
+ * 'disconnect' - emitted when a request errors or aborts unexpectedly.
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestevents)
+ */
+export type RequestEventType = 'peek' | 'finish' | 'disconnect';
+
+/**
+ * Access: read only and the public podium interface.
+ * The request.events supports the following events:
+ * * 'peek' - emitted for each chunk of payload data read from the client connection. The event method signature is function(chunk, encoding).
+ * * 'finish' - emitted when the request payload finished reading. The event method signature is function ().
+ * * 'disconnect' - emitted when a request errors or aborts unexpectedly.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestevents)
+ */
+export interface RequestEvents extends Podium {
+    /**
+     * Access: read only and the public podium interface.
+     * The request.events supports the following events:
+     * * 'peek' - emitted for each chunk of payload data read from the client connection. The event method signature is function(chunk, encoding).
+     * * 'finish' - emitted when the request payload finished reading. The event method signature is function ().
+     * * 'disconnect' - emitted when a request errors or aborts unexpectedly.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestevents)
+     */
+    on(criteria: 'peek', listener: PeekListener): this;
+
+    on(criteria: 'finish' | 'disconnect', listener: (data: undefined) => void): this;
+
+    /**
+     * Access: read only and the public podium interface.
+     * The request.events supports the following events:
+     * * 'peek' - emitted for each chunk of payload data read from the client connection. The event method signature is function(chunk, encoding).
+     * * 'finish' - emitted when the request payload finished reading. The event method signature is function ().
+     * * 'disconnect' - emitted when a request errors or aborts unexpectedly.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestevents)
+     */
+    once(criteria: 'peek', listener: PeekListener): this;
+    once(criteria: 'peek'): Promise<Parameters<PeekListener>>;
+
+    once(criteria: 'finish' | 'disconnect', listener: (data: undefined) => void): this;
+}
+
+/**
+ * Request information:
+ * * acceptEncoding - the request preferred encoding.
+ * * cors - if CORS is enabled for the route, contains the following:
+ * * isOriginMatch - true if the request 'Origin' header matches the configured CORS restrictions. Set to false if no 'Origin' header is found or if it does not match. Note that this is only
+ * available after the 'onRequest' extension point as CORS is configured per-route and no routing decisions are made at that point in the request lifecycle.
+ * * host - content of the HTTP 'Host' header (e.g. 'example.com:8080').
+ * * hostname - the hostname part of the 'Host' header (e.g. 'example.com').
+ * * id - a unique request identifier (using the format '{now}:{connection.info.id}:{5 digits counter}').
+ * * received - request reception timestamp.
+ * * referrer - content of the HTTP 'Referrer' (or 'Referer') header.
+ * * remoteAddress - remote client IP address.
+ * * remotePort - remote client port.
+ * * responded - request response timestamp (0 is not responded yet).
+ * Note that the request.info object is not meant to be modified.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestinfo)
+ */
+export interface RequestInfo {
+    /** the request preferred encoding. */
+    acceptEncoding: string;
+    /** if CORS is enabled for the route, contains the following: */
+    cors: {
+        /**
+         * true if the request 'Origin' header matches the configured CORS restrictions. Set to false if no 'Origin' header is found or if it does not match. Note that this is only available after
+         * the 'onRequest' extension point as CORS is configured per-route and no routing decisions are made at that point in the request lifecycle.
+         */
+        isOriginMatch?: boolean | undefined;
+    };
+    /** content of the HTTP 'Host' header (e.g. 'example.com:8080'). */
+    host: string;
+    /** the hostname part of the 'Host' header (e.g. 'example.com'). */
+    hostname: string;
+    /** a unique request identifier (using the format '{now}:{connection.info.id}:{5 digits counter}') */
+    id: string;
+    /** request reception timestamp. */
+    received: number;
+    /** content of the HTTP 'Referrer' (or 'Referer') header. */
+    referrer: string;
+    /** remote client IP address. */
+    remoteAddress: string;
+    /** remote client port. */
+    remotePort: string;
+    /** request response timestamp (0 is not responded yet). */
+    responded: number;
+    /** request processing completion timestamp (0 is still processing). */
+    completed: number;
+}
+
+/**
+ * The request route information object, where:
+ * * method - the route HTTP method.
+ * * path - the route path.
+ * * vhost - the route vhost option if configured.
+ * * realm - the active realm associated with the route.
+ * * settings - the route options object with all defaults applied.
+ * * fingerprint - the route internal normalized string representing the normalized path.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestroute)
+ */
+export interface RequestRoute<Refs extends ReqRef = ReqRefDefaults> {
+    /** the route HTTP method. */
+    method: Exclude<Lowercase<HTTP_METHODS>, 'head'> | '*';
+
+    /** the route path. */
+    path: string;
+
+    /** the route vhost option if configured. */
+    vhost?: string | string[] | undefined;
+
+    /** the active realm associated with the route. */
+    realm: ServerRealm;
+
+    /** the route options object with all defaults applied. */
+    settings: RouteSettings<Refs>;
+
+    /** the route internal normalized string representing the normalized path. */
+    fingerprint: string;
+
+    auth: {
+        /**
+         * Validates a request against the route's authentication access configuration, where:
+         * @param request - the request object.
+         * @return Return value: true if the request would have passed the route's access requirements.
+         * Note that the route's authentication mode and strategies are ignored. The only match is made between the request.auth.credentials scope and entity information and the route access
+         *     configuration. If the route uses dynamic scopes, the scopes are constructed against the request.query, request.params, request.payload, and request.auth.credentials which may or may
+         *     not match between the route and the request's route. If this method is called using a request that has not been authenticated (yet or not at all), it will return false if the route
+         *     requires any authentication.
+         * [See docs](https://hapijs.com/api/17.0.1#-requestrouteauthaccessrequest)
+         */
+        access(request: Request): boolean;
+    };
+}
+
+/**
+ * An object containing the values of params, query, and payload before any validation modifications made. Only set when input validation is performed.
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestorig)
+ */
+export interface RequestOrig {
+    params: object;
+    query: object;
+    payload: object;
+}
+
+export interface RequestLog {
+    request: string;
+    timestamp: number;
+    tags: string[];
+    data: string | object;
+    channel: string;
+}
+
+export interface RequestQuery {
+    [key: string]: string | string[] | undefined;
+}
+
+/**
+ * Empty interface to allow for user-defined augmentations.
+ */
+export interface RouteOptionsApp {}
+
+/**
+ *  User-extensible type for application specific state on requests (`request.app`).
+ */
+export interface RequestApplicationState {
+}
+
+export interface InternalRequestDefaults {
+    Server: Server;
+
+    Payload: stream.Readable | Buffer | string | object;
+    Query: RequestQuery;
+    Params: Record<string, string>;
+    Pres: Record<string, any>;
+    Headers: Record<string, string | string[] | undefined>;
+    RequestApp: RequestApplicationState;
+
+    AuthUser: UserCredentials;
+    AuthApp: AppCredentials;
+    AuthApi: ServerAuthSchemeObjectApi;
+    AuthCredentialsExtra: Record<string, unknown>;
+    AuthArtifactsExtra: Record<string, unknown>;
+
+    Rules: RouteRules;
+    Bind: object | null;
+    RouteApp: RouteOptionsApp;
+}
+
+/**
+ * Default request references. Used to give typing to requests,
+ * route handlers, lifecycle methods, auth credentials, etc.
+ * This can be overwritten to whatever is suitable and universal
+ * in your specific app, but whatever references you pass to
+ * server route generic, or lifecycle methods will take precedence
+ * over these.
+ */
+export interface ReqRefDefaults extends InternalRequestDefaults {}
+
+/**
+ * Route request overrides
+ */
+export type ReqRef = Partial<Record<keyof ReqRefDefaults, unknown>>;
+
+/**
+ * Utilities for merging request refs and other things
+ */
+export type MergeType<T, U> = Omit<T, keyof U> & U;
+
+export type MergeRefs<T extends ReqRef> = MergeType<ReqRefDefaults, T>;
+
+/**
+ * The request object is created internally for each incoming request. It is not the same object received from the node
+ * HTTP server callback (which is available via [request.raw.req](https://github.com/hapijs/hapi/blob/master/API.md#request.raw)). The request properties change throughout
+ * the request [lifecycle](https://github.com/hapijs/hapi/blob/master/API.md#request-lifecycle).
+ */
+export interface Request<Refs extends ReqRef = ReqRefDefaults> extends Podium {
+    /**
+     * Application-specific state. Provides a safe place to store application data without potential conflicts with the framework. Should not be used by plugins which should use plugins[name].
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestapp)
+     */
+    app: MergeRefs<Refs>['RequestApp'];
+
+    /**
+     * Authentication information:
+     * * artifacts - an artifact object received from the authentication strategy and used in authentication-related actions.
+     * * credentials - the credential object received during the authentication process. The presence of an object does not mean successful authentication.
+     * * error - the authentication error is failed and mode set to 'try'.
+     * * isAuthenticated - true if the request has been successfully authenticated, otherwise false.
+     * * isAuthorized - true is the request has been successfully authorized against the route authentication access configuration. If the route has not access rules defined or if the request failed
+     * authorization, set to false.
+     * * mode - the route authentication mode.
+     * * strategy - the name of the strategy used.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestauth)
+     */
+    readonly auth: RequestAuth<
+        MergeRefs<Refs>['AuthUser'],
+        MergeRefs<Refs>['AuthApp'],
+        MergeRefs<Refs>['AuthCredentialsExtra'],
+        MergeRefs<Refs>['AuthArtifactsExtra']
+    >;
+
+    /**
+     * Access: read only and the public podium interface.
+     * The request.events supports the following events:
+     * * 'peek' - emitted for each chunk of payload data read from the client connection. The event method signature is function(chunk, encoding).
+     * * 'finish' - emitted when the request payload finished reading. The event method signature is function ().
+     * * 'disconnect' - emitted when a request errors or aborts unexpectedly.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestevents)
+     */
+    events: RequestEvents;
+
+    /**
+     * The raw request headers (references request.raw.req.headers).
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestheaders)
+     */
+    readonly headers: MergeRefs<Refs>['Headers'];
+
+    /**
+     * Request information:
+     * * acceptEncoding - the request preferred encoding.
+     * * cors - if CORS is enabled for the route, contains the following:
+     * * isOriginMatch - true if the request 'Origin' header matches the configured CORS restrictions. Set to false if no 'Origin' header is found or if it does not match. Note that this is only
+     * available after the 'onRequest' extension point as CORS is configured per-route and no routing decisions are made at that point in the request lifecycle.
+     * * host - content of the HTTP 'Host' header (e.g. 'example.com:8080').
+     * * hostname - the hostname part of the 'Host' header (e.g. 'example.com').
+     * * id - a unique request identifier (using the format '{now}:{connection.info.id}:{5 digits counter}').
+     * * received - request reception timestamp.
+     * * referrer - content of the HTTP 'Referrer' (or 'Referer') header.
+     * * remoteAddress - remote client IP address.
+     * * remotePort - remote client port.
+     * * responded - request response timestamp (0 is not responded yet).
+     * Note that the request.info object is not meant to be modified.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestinfo)
+     */
+    readonly info: RequestInfo;
+
+    /**
+     * An array containing the logged request events.
+     * Note that this array will be empty if route log.collect is set to false.
+     */
+    readonly logs: RequestLog[];
+
+    /**
+     * The request method in lower case (e.g. 'get', 'post').
+     */
+    readonly method: Lowercase<HTTP_METHODS>;
+
+    /**
+     * The parsed content-type header. Only available when payload parsing enabled and no payload error occurred.
+     */
+    readonly mime: string;
+
+    /**
+     * An object containing the values of params, query, and payload before any validation modifications made. Only set when input validation is performed.
+     */
+    readonly orig: RequestOrig;
+
+    /**
+     * An object where each key is a path parameter name with matching value as described in [Path parameters](https://github.com/hapijs/hapi/blob/master/API.md#path-parameters).
+     */
+    readonly params: MergeRefs<Refs>['Params'];
+
+    /**
+     * An array containing all the path params values in the order they appeared in the path.
+     */
+    readonly paramsArray: keyof MergeRefs<Refs>['Params'] | string[];
+
+    /**
+     * The request URI's pathname component.
+     */
+    readonly path: string;
+
+    /**
+     * The request payload based on the route payload.output and payload.parse settings.
+     * TODO check this typing and add references / links.
+     */
+    readonly payload: MergeRefs<Refs>['Payload'];
+
+    /**
+     * Plugin-specific state. Provides a place to store and pass request-level plugin data. The plugins is an object where each key is a plugin name and the value is the state.
+     */
+    plugins: PluginsStates;
+
+    /**
+     * An object where each key is the name assigned by a route pre-handler methods function. The values are the raw values provided to the continuation function as argument. For the wrapped response
+     * object, use responses.
+     */
+    readonly pre: MergeRefs<Refs>['Pres'];
+
+    /**
+     * Access: read / write (see limitations below).
+     * The response object when set. The object can be modified but must not be assigned another object. To replace the response with another from within an extension point, use reply(response) to
+     * override with a different response.
+     * In case of an aborted request the status code will be set to `disconnectStatusCode`.
+     */
+    response: ResponseObject | Boom;
+
+    /**
+     * Same as pre but represented as the response object created by the pre method.
+     */
+    readonly preResponses: Record<string, unknown>;
+
+    /**
+     * By default the object outputted from node's URL parse() method.
+     */
+    readonly query: MergeRefs<Refs>['Query'];
+
+    /**
+     * An object containing the Node HTTP server objects. Direct interaction with these raw objects is not recommended.
+     * * req - the node request object.
+     * * res - the node response object.
+     */
+    readonly raw: {
+        req: http.IncomingMessage;
+        res: http.ServerResponse;
+    };
+
+    /**
+     * The request route information object and method
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestroute)
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestrouteauthaccessrequest)
+     */
+    readonly route: RequestRoute<Refs>;
+
+    /**
+     * Access: read only and the public server interface.
+     * The server object.
+     */
+    readonly server: MergeRefs<Refs>['Server'];
+
+    /**
+     * An object containing parsed HTTP state information (cookies) where each key is the cookie name and value is the matching cookie content after processing using any registered cookie definition.
+     */
+    readonly state: Record<string, unknown>;
+
+    /**
+     * The parsed request URI.
+     */
+    readonly url: url.URL;
+
+    /**
+     * Returns `true` when the request is active and processing should continue and `false` when the
+     *  request terminated early or completed its lifecycle. Useful when request processing is a
+     * resource-intensive operation and should be terminated early if the request is no longer active
+     * (e.g. client disconnected or aborted early).
+     */
+    active(): boolean;
+
+    /**
+     * Returns a response which you can pass into the reply interface where:
+     * @param source - the value to set as the source of the reply interface, optional.
+     * @param options - options for the method, optional.
+     * @return ResponseObject
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestgenerateresponsesource-options)
+     */
+    /* tslint:disable-next-line:max-line-length */
+    generateResponse(source: string | object | null, options?: { variety?: string | undefined; prepare?: ((response: ResponseObject) => Promise<ResponseObject>) | undefined; marshal?: ((response: ResponseObject) => Promise<ResponseValue>) | undefined; close?: ((response: ResponseObject) => void) | undefined; } | undefined): ResponseObject;
+
+    /**
+     * Logs request-specific events. When called, the server emits a 'request' event which can be used by other listeners or plugins. The arguments are:
+     * @param tags - a string or an array of strings (e.g. ['error', 'database', 'read']) used to identify the event. Tags are used instead of log levels and provide a much more expressive mechanism
+     *     for describing and filtering events.
+     * @param data - (optional) an message string or object with the application data being logged. If data is a function, the function signature is function() and it called once to generate (return
+     *     value) the actual data emitted to the listeners. Any logs generated by the server internally will be emitted only on the 'request-internal' channel and will include the event.internal flag
+     *     set to true.
+     * @return void
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-requestlogtags-data)
+     */
+    log(tags: string | string[], data?: string | object | (() => string | object) | undefined): void;
+
+    /**
+     * Changes the request method before the router begins processing the request where:
+     * @param method - is the request HTTP method (e.g. 'GET').
+     * @return void
+     * Can only be called from an 'onRequest' extension method.
+     * [See docs](https://hapijs.com/api/17.0.1#-requestsetmethodmethod)
+     */
+    setMethod(method: HTTP_METHODS | Lowercase<HTTP_METHODS>): void;
+
+    /**
+     * Changes the request URI before the router begins processing the request where:
+     * Can only be called from an 'onRequest' extension method.
+     * @param url - the new request URI. If url is a string, it is parsed with node's URL parse() method with parseQueryString set to true. url can also be set to an object compatible with node's URL
+     *     parse() method output.
+     * @param stripTrailingSlash - if true, strip the trailing slash from the path. Defaults to false.
+     * @return void
+     * [See docs](https://hapijs.com/api/17.0.1#-requestseturlurl-striptrailingslash)
+     */
+    setUrl(url: string | url.URL, stripTrailingSlash?: boolean | undefined): void;
+}

node_modules/@hapi/hapi/lib/types/response.d.ts

@@ -0,0 +1,568 @@
+
+import { Podium } from '@hapi/podium';
+
+import { PluginsStates, ServerRealm } from './plugin';
+import {
+    UserCredentials,
+    AppCredentials,
+    AuthArtifacts,
+    AuthCredentials,
+    ReqRef,
+    ReqRefDefaults,
+    MergeRefs,
+    Request
+} from './request';
+import { PeekListener, Lifecycle, Json } from './utils';
+import { ServerStateCookieOptions } from './server';
+
+/**
+ *  User-extensible type for application specific state on responses (`response.app`).
+ */
+export interface ResponseApplicationState {
+}
+
+/**
+ * Access: read only and the public podium interface.
+ * The response.events object supports the following events:
+ * * 'peek' - emitted for each chunk of data written back to the client connection. The event method signature is function(chunk, encoding).
+ * * 'finish' - emitted when the response finished writing but before the client response connection is ended. The event method signature is function ().
+ * [See docs](https://hapijs.com/api/17.0.1#-responseevents)
+ */
+export interface ResponseEvents extends Podium {
+    /**
+     * 'peek' - emitted for each chunk of data written back to the client connection. The event method signature is function(chunk, encoding).
+     * 'finish' - emitted when the response finished writing but before the client response connection is ended. The event method signature is function ().
+     */
+    on(criteria: 'peek', listener: PeekListener): this;
+
+    on(criteria: 'finish', listener: (data: undefined) => void): this;
+
+    /**
+     * 'peek' - emitted for each chunk of data written back to the client connection. The event method signature is function(chunk, encoding).
+     * 'finish' - emitted when the response finished writing but before the client response connection is ended. The event method signature is function ().
+     */
+    once(criteria: 'peek', listener: PeekListener): this;
+    once(criteria: 'peek'): Promise<Parameters<PeekListener>>;
+
+    once(criteria: 'finish', listener: (data: undefined) => void): this;
+}
+
+/**
+ * Object where:
+ *  * append - if true, the value is appended to any existing header value using separator. Defaults to false.
+ *  * separator - string used as separator when appending to an existing value. Defaults to ','.
+ *  * override - if false, the header value is not set if an existing value present. Defaults to true.
+ *  * duplicate - if false, the header value is not modified if the provided value is already included. Does not apply when append is false or if the name is 'set-cookie'. Defaults to true.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responseheadername-value-options)
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#response-object)
+ */
+export interface ResponseObjectHeaderOptions {
+    append?: boolean | undefined;
+    separator?: string | undefined;
+    override?: boolean | undefined;
+    duplicate?: boolean | undefined;
+}
+
+/**
+ * The response object contains the request response value along with various HTTP headers and flags. When a lifecycle
+ * method returns a value, the value is wrapped in a response object along with some default flags (e.g. 200 status
+ * code). In order to customize a response before it is returned, the h.response() method is provided.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#response-object)
+ * TODO, check extending from Podium is correct.  Extending because of "The response object supports the following events" [See docs](https://hapijs.com/api/17.0.1#-responseevents)
+ */
+export interface ResponseObject extends Podium {
+    /**
+     * @default {}.
+     * Application-specific state. Provides a safe place to store application data without potential conflicts with the framework. Should not be used by plugins which should use plugins[name].
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responseapp)
+     */
+    app: ResponseApplicationState;
+
+    /**
+     * Access: read only and the public podium interface.
+     * The response.events object supports the following events:
+     * * 'peek' - emitted for each chunk of data written back to the client connection. The event method signature is function(chunk, encoding).
+     * * 'finish' - emitted when the response finished writing but before the client response connection is ended. The event method signature is function ().
+     * [See docs](https://hapijs.com/api/17.0.1#-responseevents)
+     */
+    readonly events: ResponseEvents;
+
+    /**
+     * @default {}.
+     * An object containing the response headers where each key is a header field name and the value is the string header value or array of string.
+     * Note that this is an incomplete list of headers to be included with the response. Additional headers will be added once the response is prepared for transmission.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responseheaders)
+     */
+    readonly headers: Record<string, string | string[]>;
+
+    /**
+     * @default {}.
+     * Plugin-specific state. Provides a place to store and pass request-level plugin data. plugins is an object where each key is a plugin name and the value is the state.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responseplugins)
+     */
+    plugins: PluginsStates;
+
+    /**
+     * Object containing the response handling flags.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsesettings)
+     */
+    readonly settings: ResponseSettings;
+
+    /**
+     * The raw value returned by the lifecycle method.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsesource)
+     */
+    readonly source: Lifecycle.ReturnValue;
+
+    /**
+     * @default 200.
+     * The HTTP response status code.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsestatuscode)
+     */
+    readonly statusCode: number;
+
+    /**
+     * A string indicating the type of source with available values:
+     * * 'plain' - a plain response such as string, number, null, or simple object.
+     * * 'buffer' - a Buffer.
+     * * 'stream' - a Stream.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsevariety)
+     */
+    readonly variety: 'plain' | 'buffer' | 'stream';
+
+    /**
+     * Sets the HTTP 'Content-Length' header (to avoid chunked transfer encoding) where:
+     * @param length - the header value. Must match the actual payload size.
+     * @return Return value: the current response object.
+     * [See docs](https://hapijs.com/api/17.0.1#-responsebyteslength)
+     */
+    bytes(length: number): ResponseObject;
+
+    /**
+     * Controls the 'Content-Type' HTTP header 'charset' property of the response.
+     *  * When invoked without any parameter, will prevent hapi from applying its default charset normalization to 'utf-8'
+     *  * When 'charset' parameter is provided, will set the 'Content-Type' HTTP header 'charset' property where:
+     * @param charset - the charset property value.
+     * @return Return value: the current response object.
+     * [See docs](https://hapijs.com/api/17.0.1#-responsecharsetcharset)
+     */
+    charset(charset?: string): ResponseObject | undefined;
+
+    /**
+     * Sets the HTTP status code where:
+     * @param statusCode - the HTTP status code (e.g. 200).
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsecodestatuscode)
+     */
+    code(statusCode: number): ResponseObject;
+
+    /**
+     * Sets the HTTP status message where:
+     * @param httpMessage - the HTTP status message (e.g. 'Ok' for status code 200).
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsemessagehttpmessage)
+     */
+    message(httpMessage: string): ResponseObject;
+
+    /**
+     * Sets the HTTP 'content-encoding' header where:
+     * @param encoding - the header value string.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsecompressedencoding)
+     */
+    compressed(encoding: string): ResponseObject;
+
+    /**
+     * Sets the HTTP status code to Created (201) and the HTTP 'Location' header where:
+     * @param uri - an absolute or relative URI used as the 'Location' header value.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsecreateduri)
+     */
+    created(uri: string): ResponseObject;
+
+    /**
+     * Sets the string encoding scheme used to serial data into the HTTP payload where:
+     * @param encoding  the encoding property value (see node Buffer encoding [See docs](https://nodejs.org/api/buffer.html#buffer_buffers_and_character_encodings)).
+     *  * 'ascii' - for 7-bit ASCII data only. This encoding is fast and will strip the high bit if set.
+     *  * 'utf8' - Multibyte encoded Unicode characters. Many web pages and other document formats use UTF-8.
+     *  * 'utf16le' - 2 or 4 bytes, little-endian encoded Unicode characters. Surrogate pairs (U+10000 to U+10FFFF) are supported.
+     *  * 'ucs2' - Alias of 'utf16le'.
+     *  * 'base64' - Base64 encoding. When creating a Buffer from a string, this encoding will also correctly accept "URL and Filename Safe Alphabet" as specified in RFC4648, Section 5.
+     *  * 'latin1' - A way of encoding the Buffer into a one-byte encoded string (as defined by the IANA in RFC1345, page 63, to be the Latin-1 supplement block and C0/C1 control codes).
+     *  * 'binary' - Alias for 'latin1'.
+     *  * 'hex' - Encode each byte as two hexadecimal characters.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responseencodingencoding)
+     */
+    encoding(encoding: 'ascii' | 'utf8' | 'utf16le' | 'ucs2' | 'base64' | 'latin1' | 'binary' | 'hex'): ResponseObject;
+
+    /**
+     * Sets the representation entity tag where:
+     * @param tag - the entity tag string without the double-quote.
+     * @param options - (optional) settings where:
+     *  * weak - if true, the tag will be prefixed with the 'W/' weak signifier. Weak tags will fail to match identical tags for the purpose of determining 304 response status. Defaults to false.
+     *  * vary - if true and content encoding is set or applied to the response (e.g 'gzip' or 'deflate'), the encoding name will be automatically added to the tag at transmission time (separated by
+     *     a '-' character). Ignored when weak is true. Defaults to true.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responseetagtag-options)
+     */
+    etag(tag: string, options?: {weak: boolean, vary: boolean} | undefined): ResponseObject;
+
+    /**
+     * Sets an HTTP header where:
+     * @param name - the header name.
+     * @param value - the header value.
+     * @param options - (optional) object where:
+     *  * append - if true, the value is appended to any existing header value using separator. Defaults to false.
+     *  * separator - string used as separator when appending to an existing value. Defaults to ','.
+     *  * override - if false, the header value is not set if an existing value present. Defaults to true.
+     *  * duplicate - if false, the header value is not modified if the provided value is already included. Does not apply when append is false or if the name is 'set-cookie'. Defaults to true.
+     *  @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responseheadername-value-options)
+     */
+    header(name: string, value: string, options?: ResponseObjectHeaderOptions | undefined): ResponseObject;
+
+    /**
+     * Sets the HTTP 'Location' header where:
+     * @param uri - an absolute or relative URI used as the 'Location' header value.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responselocationuri)
+     */
+    location(uri: string): ResponseObject;
+
+    /**
+     * Sets an HTTP redirection response (302) and decorates the response with additional methods, where:
+     * @param uri - an absolute or relative URI used to redirect the client to another resource.
+     * @return Return value: the current response object.
+     * Decorates the response object with the response.temporary(), response.permanent(), and response.rewritable() methods to easily change the default redirection code (302).
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responseredirecturi)
+     */
+    redirect(uri: string): ResponseObject;
+
+    /**
+     * Sets the JSON.stringify() replacer argument where:
+     * @param method - the replacer function or array. Defaults to none.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsereplacermethod)
+     */
+    replacer(method: Json.StringifyReplacer): ResponseObject;
+
+    /**
+     * Sets the JSON.stringify() space argument where:
+     * @param count - the number of spaces to indent nested object keys. Defaults to no indentation.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsespacescount)
+     */
+    spaces(count: number): ResponseObject;
+
+    /**
+     * Sets an HTTP cookie where:
+     * @param name - the cookie name.
+     * @param value - the cookie value. If no options.encoding is defined, must be a string. See server.state() for supported encoding values.
+     * @param options - (optional) configuration. If the state was previously registered with the server using server.state(), the specified keys in options are merged with the default server
+     *     definition.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsestatename-value-options)
+     */
+    state(name: string, value: object | string, options?: ServerStateCookieOptions | undefined): ResponseObject;
+
+    /**
+     * Sets a string suffix when the response is process via JSON.stringify() where:
+     * @param suffix - the string suffix.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsesuffixsuffix)
+     */
+    suffix(suffix: string): ResponseObject;
+
+    /**
+     * Overrides the default route cache expiration rule for this response instance where:
+     * @param msec - the time-to-live value in milliseconds.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsettlmsec)
+     */
+    ttl(msec: number): ResponseObject;
+
+    /**
+     * Sets the HTTP 'Content-Type' header where:
+     * @param mimeType - is the mime type.
+     * @return Return value: the current response object.
+     * Should only be used to override the built-in default for each response type.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsetypemimetype)
+     */
+    type(mimeType: string): ResponseObject;
+
+    /**
+     * Clears the HTTP cookie by setting an expired value where:
+     * @param name - the cookie name.
+     * @param options - (optional) configuration for expiring cookie. If the state was previously registered with the server using server.state(), the specified options are merged with the server
+     *     definition.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responseunstatename-options)
+     */
+    unstate(name: string, options?: ServerStateCookieOptions | undefined): ResponseObject;
+
+    /**
+     * Adds the provided header to the list of inputs affected the response generation via the HTTP 'Vary' header where:
+     * @param header - the HTTP request header name.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsevaryheader)
+     */
+    vary(header: string): ResponseObject;
+
+    /**
+     * Marks the response object as a takeover response.
+     * @return Return value: the current response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsetakeover)
+     */
+    takeover(): ResponseObject;
+
+    /**
+     * Sets the status code to 302 or 307 (based on the response.rewritable() setting) where:
+     * @param isTemporary - if false, sets status to permanent. Defaults to true.
+     * @return Return value: the current response object.
+     * Only available after calling the response.redirect() method.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsetemporaryistemporary)
+     */
+    temporary(isTemporary?: boolean): ResponseObject;
+
+    /**
+     * Sets the status code to 301 or 308 (based on the response.rewritable() setting) where:
+     * @param isPermanent - if false, sets status to temporary. Defaults to true.
+     * @return Return value: the current response object.
+     * Only available after calling the response.redirect() method.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsepermanentispermanent)
+     */
+    permanent(isPermanent?: boolean): ResponseObject;
+
+    /**
+     * Sets the status code to 301/302 for rewritable (allows changing the request method from 'POST' to 'GET') or 307/308 for non-rewritable (does not allow changing the request method from 'POST'
+     * to 'GET'). Exact code based on the response.temporary() or response.permanent() setting. Arguments:
+     * @param isRewritable - if false, sets to non-rewritable. Defaults to true.
+     * @return Return value: the current response object.
+     * Only available after calling the response.redirect() method.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responserewritableisrewritable)
+     */
+    rewritable(isRewritable?: boolean): ResponseObject;
+}
+
+/**
+ * Object containing the response handling flags.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-responsesettings)
+ */
+export interface ResponseSettings {
+    /**
+     * Defaults value: true.
+     * If true and source is a Stream, copies the statusCode and headers properties of the stream object to the outbound response.
+     */
+    readonly passThrough: boolean;
+
+    /**
+     * @default null (use route defaults).
+     * Override the route json options used when source value requires stringification.
+     */
+    readonly stringify: Json.StringifyArguments;
+
+    /**
+     * @default null (use route defaults).
+     * If set, overrides the route cache with an expiration value in milliseconds.
+     */
+    readonly ttl: number;
+
+    /**
+     * @default false.
+     * If true, a suffix will be automatically added to the 'ETag' header at transmission time (separated by a '-' character) when the HTTP 'Vary' header is present.
+     */
+    varyEtag: boolean;
+}
+
+/**
+ * See more about Lifecycle
+ * https://github.com/hapijs/hapi/blob/master/API.md#request-lifecycle
+ *
+ */
+
+export type ResponseValue = string | object;
+
+export interface AuthenticationData<
+
+    AuthUser = UserCredentials,
+    AuthApp = AppCredentials,
+    CredentialsExtra = Record<string, unknown>,
+    ArtifactsExtra = AuthArtifacts
+> {
+    credentials: AuthCredentials<AuthUser, AuthApp> & CredentialsExtra;
+    artifacts?: ArtifactsExtra | undefined;
+}
+
+export interface Auth<
+    AuthUser = UserCredentials,
+    AuthApp = AppCredentials,
+    CredentialsExtra = Record<string, unknown>,
+    ArtifactsExtra = AuthArtifacts
+> {
+    readonly isAuth: true;
+    readonly error?: Error | null | undefined;
+    readonly data?: AuthenticationData<AuthUser, AuthApp, CredentialsExtra, ArtifactsExtra> | undefined;
+}
+
+/**
+ * The response toolkit is a collection of properties and utilities passed to every [lifecycle method](https://github.com/hapijs/hapi/blob/master/API.md#lifecycle-methods)
+ * It is somewhat hard to define as it provides both utilities for manipulating responses as well as other information. Since the
+ * toolkit is passed as a function argument, developers can name it whatever they want. For the purpose of this
+ * document the h notation is used. It is named in the spirit of the RethinkDB r method, with h for hapi.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#response-toolkit)
+ */
+export interface ResponseToolkit<Refs extends ReqRef = ReqRefDefaults> {
+    /**
+     * A response symbol. When returned by a lifecycle method, the request lifecycle skips to the finalizing step
+     * without further interaction with the node response stream. It is the developer's responsibility to write
+     * and end the response directly via [request.raw.res](https://github.com/hapijs/hapi/blob/master/API.md#request.raw).
+     */
+    readonly abandon: symbol;
+
+    /**
+     * A response symbol. When returned by a lifecycle method, the request lifecycle skips to the finalizing step after
+     * calling request.raw.res.end()) to close the the node response stream.
+     */
+    readonly close: symbol;
+
+    /**
+     * A response symbol. Provides access to the route or server context set via the route [bind](https://github.com/hapijs/hapi/blob/master/API.md#route.options.bind)
+     * option or [server.bind()](https://github.com/hapijs/hapi/blob/master/API.md#server.bind()).
+     */
+    readonly context: any;
+
+    /**
+     * A response symbol. When returned by a lifecycle method, the request lifecycle continues without changing the response.
+     */
+    readonly continue: symbol;
+
+    /**
+     * The [server realm](https://github.com/hapijs/hapi/blob/master/API.md#server.realm) associated with the matching
+     * route. Defaults to the root server realm in the onRequest step.
+     */
+    readonly realm: ServerRealm;
+
+    /**
+     * Access: read only and public request interface.
+     * The [request] object. This is a duplication of the request lifecycle method argument used by
+     * [toolkit decorations](https://github.com/hapijs/hapi/blob/master/API.md#server.decorate()) to access the current request.
+     */
+    readonly request: Readonly<Request<Refs>>;
+
+    /**
+     * Used by the [authentication] method to pass back valid credentials where:
+     * @param data - an object with:
+     * * credentials - (required) object representing the authenticated entity.
+     * * artifacts - (optional) authentication artifacts object specific to the authentication scheme.
+     * @return Return value: an internal authentication object.
+     */
+    authenticated <
+        AuthUser = MergeRefs<Refs>['AuthUser'],
+        AuthApp  = MergeRefs<Refs>['AuthApp'],
+        CredentialsExtra = MergeRefs<Refs>['AuthCredentialsExtra'],
+        ArtifactsExtra = MergeRefs<Refs>['AuthArtifactsExtra']
+    >(
+        data: (
+            AuthenticationData<
+                AuthUser,
+                AuthApp,
+                CredentialsExtra,
+                ArtifactsExtra
+            >
+        )
+    ): Auth<
+        AuthUser,
+        AuthApp,
+        CredentialsExtra,
+        ArtifactsExtra
+    >;
+
+    /**
+     * Sets the response 'ETag' and 'Last-Modified' headers and checks for any conditional request headers to decide if
+     * the response is going to qualify for an HTTP 304 (Not Modified). If the entity values match the request
+     * conditions, h.entity() returns a response object for the lifecycle method to return as its value which will
+     * set a 304 response. Otherwise, it sets the provided entity headers and returns undefined.
+     * The method arguments are:
+     * @param options - a required configuration object with:
+     * * etag - the ETag string. Required if modified is not present. Defaults to no header.
+     * * modified - the Last-Modified header value. Required if etag is not present. Defaults to no header.
+     * * vary - same as the response.etag() option. Defaults to true.
+     * @return Return value: - a response object if the response is unmodified. - undefined if the response has changed.
+     * If undefined is returned, the developer must return a valid lifecycle method value. If a response is returned,
+     * it should be used as the return value (but may be customize using the response methods).
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-hentityoptions)
+     */
+    entity(options?: {etag?: string | undefined, modified?: string | undefined, vary?: boolean | undefined} | undefined): ResponseObject;
+
+    /**
+     * Redirects the client to the specified uri. Same as calling h.response().redirect(uri).
+     * @param url
+     * @return Returns a response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-hredirecturi)
+     */
+    redirect(uri?: string | undefined): ResponseObject;
+
+    /**
+     * Wraps the provided value and returns a response object which allows customizing the response
+     * (e.g. setting the HTTP status code, custom headers, etc.), where:
+     * @param value - (optional) return value. Defaults to null.
+     * @return Returns a response object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-hresponsevalue)
+     */
+    response(value?: ResponseValue | undefined): ResponseObject;
+
+    /**
+     * Sets a response cookie using the same arguments as response.state().
+     * @param name of the cookie
+     * @param value of the cookie
+     * @param (optional) ServerStateCookieOptions object.
+     * @return Return value: none.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-hstatename-value-options)
+     */
+    state(name: string, value: string | object, options?: ServerStateCookieOptions | undefined): void;
+
+    /**
+     * Used by the [authentication] method to indicate authentication failed and pass back the credentials received where:
+     * @param error - (required) the authentication error.
+     * @param data - (optional) an object with:
+     * * credentials - (required) object representing the authenticated entity.
+     * * artifacts - (optional) authentication artifacts object specific to the authentication scheme.
+     * @return void.
+     * The method is used to pass both the authentication error and the credentials. For example, if a request included
+     * expired credentials, it allows the method to pass back the user information (combined with a 'try'
+     * authentication mode) for error customization.
+     * There is no difference between throwing the error or passing it with the h.unauthenticated() method is no credentials are passed, but it might still be helpful for code clarity.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-hunauthenticatederror-data)
+     */
+    unauthenticated <
+        AuthUser = MergeRefs<Refs>['AuthUser'],
+        AuthApp = MergeRefs<Refs>['AuthApp'],
+        CredentialsExtra = MergeRefs<Refs>['AuthCredentialsExtra'],
+        ArtifactsExtra = MergeRefs<Refs>['AuthArtifactsExtra']
+    >(
+        error: Error,
+        data?: (
+            AuthenticationData<
+                AuthUser,
+                AuthApp,
+                CredentialsExtra,
+                ArtifactsExtra
+            >
+        ) | undefined
+    ): Auth<
+        AuthUser,
+        AuthApp,
+        CredentialsExtra,
+        ArtifactsExtra
+    >;
+
+    /**
+     * Clears a response cookie using the same arguments as
+     * @param name of the cookie
+     * @param options (optional) ServerStateCookieOptions object.
+     * @return void.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-hunstatename-options)
+     */
+    unstate(name: string, options?: ServerStateCookieOptions | undefined): void;
+}

node_modules/@hapi/hapi/lib/types/route.d.ts

@@ -0,0 +1,982 @@
+
+import { ObjectSchema, ValidationOptions, SchemaMap, Schema } from 'joi';
+
+import { PluginSpecificConfiguration} from './plugin';
+import { MergeType, ReqRef, ReqRefDefaults, MergeRefs, AuthMode } from './request';
+import { ContentDecoders, ContentEncoders, RouteRequestExtType, RouteExtObject, Server } from './server';
+import { Lifecycle, Json, HTTP_METHODS } from './utils';
+
+/**
+ * Overrides for `InternalRouteOptionType`. Extend this to have
+ * typings for route.options.auth['strategy' || 'scope']
+ *
+ * @example
+ *
+ * interface RoutOptionTypes {
+ *      Strategy: 'jwt' | 'basic' | 'myCustom'
+ *      Scope: 'user' | 'admin' | 'manager-users'
+ * }
+ */
+export interface RouteOptionTypes {
+}
+
+export interface InternalRouteOptionType {
+    Strategy: string;
+    Scope: RouteOptionsAccessScope;
+}
+
+export type RouteOptionsAccessScope = false | string | string[];
+
+export type AccessEntity = 'any' | 'user' | 'app';
+
+export interface RouteOptionsAccessScopeObject {
+    scope: RouteOptionsAccessScope;
+}
+
+export interface RouteOptionsAccessEntityObject {
+    entity: AccessEntity;
+}
+
+export type RouteOptionsAccessObject =
+    RouteOptionsAccessScopeObject
+    | RouteOptionsAccessEntityObject
+    | (RouteOptionsAccessScopeObject & RouteOptionsAccessEntityObject);
+
+/**
+ * Route Authentication Options
+ */
+export interface RouteOptionsAccess {
+    /**
+     * @default none.
+     * An object or array of objects specifying the route access rules. Each rule is evaluated against an incoming request and access is granted if at least one of the rules matches. Each rule object
+     * must include at least one of scope or entity.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsauthaccess)
+     */
+    access?: RouteOptionsAccessObject | RouteOptionsAccessObject[] | undefined;
+
+    /**
+     * @default false (no scope requirements).
+     * The application scope required to access the route. Value can be a scope string or an array of scope strings. When authenticated, the credentials object scope property must contain at least
+     * one of the scopes defined to access the route. If a scope string begins with a + character, that scope is required. If a scope string begins with a ! character, that scope is forbidden. For
+     * example, the scope ['!a', '+b', 'c', 'd'] means the incoming request credentials' scope must not include 'a', must include 'b', and must include one of 'c' or 'd'. You may also access
+     * properties on the request object (query, params, payload, and credentials) to populate a dynamic scope by using the '{' and '}' characters around the property name, such as 'user-{params.id}'.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsauthaccessscope)
+     */
+    scope?: MergeType<InternalRouteOptionType, RouteOptionTypes>['Scope'] | undefined;
+
+    /**
+     * @default 'any'.
+     * The required authenticated entity type. If set, must match the entity value of the request authenticated credentials. Available values:
+     * * 'any' - the authentication can be on behalf of a user or application.
+     * * 'user' - the authentication must be on behalf of a user which is identified by the presence of a 'user' attribute in the credentials object returned by the authentication strategy.
+     * * 'app' - the authentication must be on behalf of an application which is identified by the lack of presence of a user attribute in the credentials object returned by the authentication
+     * strategy.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsauthaccessentity)
+     */
+    entity?: AccessEntity | undefined;
+
+    /**
+     * @default 'required'.
+     * The authentication mode. Available values:
+     * * 'required' - authentication is required.
+     * * 'optional' - authentication is optional - the request must include valid credentials or no credentials at all.
+     * * 'try' - similar to 'optional', any request credentials are attempted authentication, but if the credentials are invalid, the request proceeds regardless of the authentication error.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsauthmode)
+     */
+    mode?: AuthMode | undefined;
+
+    /**
+     * @default false, unless the scheme requires payload authentication.
+     * If set, the incoming request payload is authenticated after it is processed. Requires a strategy with payload authentication support (e.g. Hawk). Cannot be set to a value other than 'required'
+     * when the scheme sets the authentication options.payload to true. Available values:
+     * * false - no payload authentication.
+     * * 'required' - payload authentication required.
+     * * 'optional' - payload authentication performed only when the client includes payload authentication information (e.g. hash attribute in Hawk).
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsauthpayload)
+     */
+    payload?: false | 'required' | 'optional' | undefined;
+
+    /**
+     * @default the default strategy set via server.auth.default().
+     * An array of string strategy names in the order they should be attempted. Cannot be used together with strategy.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsauthstrategies)
+     */
+    strategies?: (MergeType<InternalRouteOptionType, RouteOptionTypes>['Strategy'])[] | undefined;
+
+    /**
+     * @default the default strategy set via server.auth.default().
+     * A string strategy names. Cannot be used together with strategies.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsauthstrategy)
+     */
+    strategy?: MergeType<InternalRouteOptionType, RouteOptionTypes>['Strategy'] | undefined;
+}
+
+/**
+ * Values are:
+ * * * 'default' - no privacy flag.
+ * * * 'public' - mark the response as suitable for public caching.
+ * * * 'private' - mark the response as suitable only for private caching.
+ * * expiresIn - relative expiration expressed in the number of milliseconds since the item was saved in the cache. Cannot be used together with expiresAt.
+ * * expiresAt - time of day expressed in 24h notation using the 'HH:MM' format, at which point all cache records for the route expire. Cannot be used together with expiresIn.
+ * * statuses - an array of HTTP response status code numbers (e.g. 200) which are allowed to include a valid caching directive.
+ * * otherwise - a string with the value of the 'Cache-Control' header when caching is disabled.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionscache)
+ */
+export type RouteOptionsCache = {
+    privacy?: 'default' | 'public' | 'private' | undefined;
+    statuses?: number[] | undefined;
+    otherwise?: string | undefined;
+} & (
+    {
+        expiresIn?: number | undefined;
+        expiresAt?: undefined;
+    } | {
+    expiresIn?: undefined;
+    expiresAt?: string | undefined;
+} | {
+    expiresIn?: undefined;
+    expiresAt?: undefined;
+}
+    );
+
+/**
+ * @default false (no CORS headers).
+ * The Cross-Origin Resource Sharing protocol allows browsers to make cross-origin API calls. CORS is required by web applications running inside a browser which are loaded from a different domain
+ * than the API server. To enable, set cors to true, or to an object with the following options:
+ * * origin - an array of allowed origin servers strings ('Access-Control-Allow-Origin'). The array can contain any combination of fully qualified origins along with origin strings containing a
+ * wildcard '*' character, or a single '*' origin string. If set to 'ignore', any incoming Origin header is ignored (present or not) and the 'Access-Control-Allow-Origin' header is set to '*'.
+ * Defaults to any origin ['*'].
+ * * maxAge - number of seconds the browser should cache the CORS response ('Access-Control-Max-Age'). The greater the value, the longer it will take before the browser checks for changes in policy.
+ * Defaults to 86400 (one day).
+ * * headers - a strings array of allowed headers ('Access-Control-Allow-Headers'). Defaults to ['Accept', 'Authorization', 'Content-Type', 'If-None-Match'].
+ * * additionalHeaders - a strings array of additional headers to headers. Use this to keep the default headers in place.
+ * * exposedHeaders - a strings array of exposed headers ('Access-Control-Expose-Headers'). Defaults to ['WWW-Authenticate', 'Server-Authorization'].
+ * * additionalExposedHeaders - a strings array of additional headers to exposedHeaders. Use this to keep the default headers in place.
+ * * credentials - if true, allows user credentials to be sent ('Access-Control-Allow-Credentials'). Defaults to false.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionscors)
+ */
+export interface RouteOptionsCors {
+    /**
+     * an array of allowed origin servers strings ('Access-Control-Allow-Origin'). The array can contain any combination of fully qualified origins along with origin strings containing a wildcard '*'
+     * character, or a single '*' origin string. If set to 'ignore', any incoming Origin header is ignored (present or not) and the 'Access-Control-Allow-Origin' header is set to '*'. Defaults to any
+     * origin ['*'].
+     */
+    origin?: string[] | '*' | 'ignore' | undefined;
+    /**
+     * number of seconds the browser should cache the CORS response ('Access-Control-Max-Age'). The greater the value, the longer it will take before the browser checks for changes in policy.
+     * Defaults to 86400 (one day).
+     */
+    maxAge?: number | undefined;
+    /**
+     * a strings array of allowed headers ('Access-Control-Allow-Headers'). Defaults to ['Accept', 'Authorization', 'Content-Type', 'If-None-Match'].
+     */
+    headers?: string[] | undefined;
+    /**
+     * a strings array of additional headers to headers. Use this to keep the default headers in place.
+     */
+    additionalHeaders?: string[] | undefined;
+    /**
+     * a strings array of exposed headers ('Access-Control-Expose-Headers'). Defaults to ['WWW-Authenticate', 'Server-Authorization'].
+     */
+    exposedHeaders?: string[] | undefined;
+    /**
+     * a strings array of additional headers to exposedHeaders. Use this to keep the default headers in place.
+     */
+    additionalExposedHeaders?: string[] | undefined;
+    /**
+     * if true, allows user credentials to be sent ('Access-Control-Allow-Credentials'). Defaults to false.
+     */
+    credentials?: boolean | undefined;
+    /**
+     * the status code used for CORS preflight responses, either 200 or 204. Defaults to 200.
+     */
+    preflightStatusCode?: 200 | 204;
+}
+
+/**
+ * The value must be one of:
+ * * 'data' - the incoming payload is read fully into memory. If parse is true, the payload is parsed (JSON, form-decoded, multipart) based on the 'Content-Type' header. If parse is false, a raw
+ * Buffer is returned.
+ * * 'stream' - the incoming payload is made available via a Stream.Readable interface. If the payload is 'multipart/form-data' and parse is true, field values are presented as text while files are
+ * provided as streams. File streams from a 'multipart/form-data' upload will also have a hapi property containing the filename and headers properties. Note that payload streams for multipart
+ * payloads are a synthetic interface created on top of the entire multipart content loaded into memory. To avoid loading large multipart payloads into memory, set parse to false and handle the
+ * multipart payload in the handler using a streaming parser (e.g. pez).
+ * * 'file' - the incoming payload is written to temporary file in the directory specified by the uploads settings. If the payload is 'multipart/form-data' and parse is true, field values are
+ * presented as text while files are saved to disk. Note that it is the sole responsibility of the application to clean up the files generated by the framework. This can be done by keeping track of
+ * which files are used (e.g. using the request.app object), and listening to the server 'response' event to perform cleanup. For context [See
+ * docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloadoutput)
+ */
+export type PayloadOutput = 'data' | 'stream' | 'file';
+
+/**
+ * Determines how the request payload is processed.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayload)
+ */
+export interface RouteOptionsPayload {
+    /**
+     * @default allows parsing of the following mime types:
+     * * application/json
+     * * application/*+json
+     * * application/octet-stream
+     * * application/x-www-form-urlencoded
+     * * multipart/form-data
+     * * text/*
+     * A string or an array of strings with the allowed mime types for the endpoint. Use this settings to limit the set of allowed mime types. Note that allowing additional mime types not listed
+     * above will not enable them to be parsed, and if parse is true, the request will result in an error response.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloadallow)
+     */
+    allow?: string | string[] | undefined;
+
+    /**
+     * @default none.
+     * An object where each key is a content-encoding name and each value is an object with the desired decoder settings. Note that encoder settings are set in compression.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloadcompression)
+     */
+    compression?: { [P in keyof ContentDecoders]?: Parameters<ContentDecoders[P]>[0] } | undefined;
+
+    /**
+     * @default 'application/json'.
+     * The default content type if the 'Content-Type' request header is missing.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloaddefaultcontenttype)
+     */
+    defaultContentType?: string | undefined;
+
+    /**
+     * @default 'error' (return a Bad Request (400) error response).
+     * A failAction value which determines how to handle payload parsing errors.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloadfailaction)
+     */
+    failAction?: Lifecycle.FailAction | undefined;
+
+    /**
+     * @default 1048576 (1MB).
+     * Limits the size of incoming payloads to the specified byte count. Allowing very large payloads may cause the server to run out of memory.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloadmaxbytes)
+     */
+    maxBytes?: number | undefined;
+
+    /**
+     * @default 1000
+     * Limits the number of parts allowed in multipart payloads.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloadmaxparts)
+     */
+    maxParts?: number;
+
+    /**
+     * @default none.
+     * Overrides payload processing for multipart requests. Value can be one of:
+     * * false - disable multipart processing.
+     * an object with the following required options:
+     * * output - same as the output option with an additional value option:
+     * * * annotated - wraps each multipart part in an object with the following keys: // TODO type this?
+     * * * * headers - the part headers.
+     * * * * filename - the part file name.
+     * * * * payload - the processed part payload.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloadmultipart)
+     */
+    multipart?: boolean | { output: PayloadOutput | 'annotated' };
+
+    /**
+     * @default 'data'.
+     * The processed payload format. The value must be one of:
+     * * 'data' - the incoming payload is read fully into memory. If parse is true, the payload is parsed (JSON, form-decoded, multipart) based on the 'Content-Type' header. If parse is false, a raw
+     * Buffer is returned.
+     * * 'stream' - the incoming payload is made available via a Stream.Readable interface. If the payload is 'multipart/form-data' and parse is true, field values are presented as text while files
+     * are provided as streams. File streams from a 'multipart/form-data' upload will also have a hapi property containing the filename and headers properties. Note that payload streams for multipart
+     * payloads are a synthetic interface created on top of the entire multipart content loaded into memory. To avoid loading large multipart payloads into memory, set parse to false and handle the
+     * multipart payload in the handler using a streaming parser (e.g. pez).
+     * * 'file' - the incoming payload is written to temporary file in the directory specified by the uploads settings. If the payload is 'multipart/form-data' and parse is true, field values are
+     * presented as text while files are saved to disk. Note that it is the sole responsibility of the application to clean up the files generated by the framework. This can be done by keeping track
+     * of which files are used (e.g. using the request.app object), and listening to the server 'response' event to perform cleanup.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloadoutput)
+     */
+    output?: PayloadOutput | undefined;
+
+    /**
+     * @default none.
+     * A mime type string overriding the 'Content-Type' header value received.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloadoverride)
+     */
+    override?: string | undefined;
+
+    /**
+     * @default true.
+     * Determines if the incoming payload is processed or presented raw. Available values:
+     * * true - if the request 'Content-Type' matches the allowed mime types set by allow (for the whole payload as well as parts), the payload is converted into an object when possible. If the
+     * format is unknown, a Bad Request (400) error response is sent. Any known content encoding is decoded.
+     * * false - the raw payload is returned unmodified.
+     * * 'gunzip' - the raw payload is returned unmodified after any known content encoding is decoded.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloadparse)
+     */
+    parse?: boolean | 'gunzip' | undefined;
+
+    /**
+     * @default to 'error'.
+     * Sets handling of incoming payload that may contain a prototype poisoning security attack.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloadprotoaction)
+     */
+    protoAction?: 'error' | 'remove' | 'ignore';
+
+    /**
+     * @default to 10000 (10 seconds).
+     * Payload reception timeout in milliseconds. Sets the maximum time allowed for the client to transmit the request payload (body) before giving up and responding with a Request Timeout (408)
+     * error response. Set to false to disable.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloadtimeout)
+     */
+    timeout?: false | number | undefined;
+
+    /**
+     * @default os.tmpdir().
+     * The directory used for writing file uploads.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayloaduploads)
+     */
+    uploads?: string | undefined;
+}
+
+/**
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspre)
+ */
+export type RouteOptionsPreArray<Refs extends ReqRef = ReqRefDefaults> = RouteOptionsPreAllOptions<Refs>[];
+
+/**
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspre)
+ */
+export type RouteOptionsPreAllOptions<Refs extends ReqRef = ReqRefDefaults> = RouteOptionsPreObject<Refs> | RouteOptionsPreObject<Refs>[] | Lifecycle.Method<Refs>;
+
+/**
+ * An object with:
+ * * method - a lifecycle method.
+ * * assign - key name used to assign the response of the method to in request.pre and request.preResponses.
+ * * failAction - A failAction value which determine what to do when a pre-handler method throws an error. If assign is specified and the failAction setting is not 'error', the error will be assigned.
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspre)
+ */
+export interface RouteOptionsPreObject<Refs extends ReqRef = ReqRefDefaults> {
+    /**
+     * a lifecycle method.
+     */
+    method: Lifecycle.Method<Refs>;
+    /**
+     * key name used to assign the response of the method to in request.pre and request.preResponses.
+     */
+    assign?: keyof MergeRefs<Refs>['Pres'] | undefined;
+    /**
+     * A failAction value which determine what to do when a pre-handler method throws an error. If assign is specified and the failAction setting is not 'error', the error will be assigned.
+     */
+    failAction?: Lifecycle.FailAction | undefined;
+}
+
+export type ValidationObject = SchemaMap;
+
+/**
+ * * true - any query parameter value allowed (no validation performed). false - no parameter value allowed.
+ * * a joi validation object.
+ * * a validation function using the signature async function(value, options) where:
+ * * * value - the request.* object containing the request parameters.
+ * * * options - options.
+ */
+export type RouteOptionsResponseSchema =
+    boolean
+    | ValidationObject
+    | Schema
+    | ((value: object | Buffer | string, options: ValidationOptions) => Promise<any>);
+
+/**
+ * Processing rules for the outgoing response.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsresponse)
+ */
+export interface RouteOptionsResponse {
+    /**
+     * @default 204.
+     * The default HTTP status code when the payload is considered empty. Value can be 200 or 204. Note that a 200 status code is converted to a 204 only at the time of response transmission (the
+     * response status code will remain 200 throughout the request lifecycle unless manually set).
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsresponseemptystatuscode)
+     */
+    emptyStatusCode?: 200 | 204 | undefined;
+
+    /**
+     * @default 'error' (return an Internal Server Error (500) error response).
+     * A failAction value which defines what to do when a response fails payload validation.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsresponsefailaction)
+     */
+    failAction?: Lifecycle.FailAction | undefined;
+
+    /**
+     * @default false.
+     * If true, applies the validation rule changes to the response payload.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsresponsemodify)
+     */
+    modify?: boolean | undefined;
+
+    /**
+     * @default none.
+     * [joi](https://github.com/hapijs/joi) options object pass to the validation function. Useful to set global options such as stripUnknown or abortEarly (the complete list is available here). If a
+     * custom validation function is defined via schema or status then options can an arbitrary object that will be passed to this function as the second argument.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsresponseoptions)
+     */
+    options?: ValidationOptions | undefined; // TODO needs validation
+
+    /**
+     * @default true.
+     * If false, payload range support is disabled.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsresponseranges)
+     */
+    ranges?: boolean | undefined;
+
+    /**
+     * @default 100 (all responses).
+     * The percent of response payloads validated (0 - 100). Set to 0 to disable all validation.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsresponsesample)
+     */
+    sample?: number | undefined;
+
+    /**
+     * @default true (no validation).
+     * The default response payload validation rules (for all non-error responses) expressed as one of:
+     * * true - any payload allowed (no validation).
+     * * false - no payload allowed.
+     * * a joi validation object. The options along with the request context ({ headers, params, query, payload, app, auth }) are passed to the validation function.
+     * * a validation function using the signature async function(value, options) where:
+     * * * value - the pending response payload.
+     * * * options - The options along with the request context ({ headers, params, query, payload, app, auth }).
+     * * * if the function returns a value and modify is true, the value is used as the new response. If the original response is an error, the return value is used to override the original error
+     * output.payload. If an error is thrown, the error is processed according to failAction.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsresponseschema)
+     */
+    schema?: RouteOptionsResponseSchema | undefined;
+
+    /**
+     * @default none.
+     * Validation schemas for specific HTTP status codes. Responses (excluding errors) not matching the listed status codes are validated using the default schema.
+     * status is set to an object where each key is a 3 digit HTTP status code and the value has the same definition as schema.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsresponsestatus)
+     */
+    status?: Record<string, RouteOptionsResponseSchema> | undefined;
+
+    /**
+     * The default HTTP status code used to set a response error when the request is closed or aborted before the
+     * response is fully transmitted.
+     * Value can be any integer greater or equal to 400.
+     * The default value 499 is based on the non-standard nginx "CLIENT CLOSED REQUEST" error.
+     * The value is only used for logging as the request has already ended.
+     * @default 499
+     */
+    disconnectStatusCode?: number | undefined;
+}
+
+/**
+ * @see https://www.w3.org/TR/referrer-policy/
+ */
+export type ReferrerPolicy = '' | 'no-referrer' | 'no-referrer-when-downgrade' | 'unsafe-url' |
+    'same-origin' | 'origin' |  'strict-origin' | 'origin-when-cross-origin' | 'strict-origin-when-cross-origin';
+
+/**
+ * @default false (security headers disabled).
+ * Sets common security headers. To enable, set security to true or to an object with the following options:
+ * * hsts - controls the 'Strict-Transport-Security' header, where:
+ * * * true - the header will be set to max-age=15768000. This is the default value.
+ * * * a number - the maxAge parameter will be set to the provided value.
+ * * * an object with the following fields:
+ * * * * maxAge - the max-age portion of the header, as a number. Default is 15768000.
+ * * * * includeSubDomains - a boolean specifying whether to add the includeSubDomains flag to the header.
+ * * * * preload - a boolean specifying whether to add the 'preload' flag (used to submit domains inclusion in Chrome's HTTP Strict Transport Security (HSTS) preload list) to the header.
+ * * xframe - controls the 'X-Frame-Options' header, where:
+ * * * true - the header will be set to 'DENY'. This is the default value.
+ * * * 'deny' - the headers will be set to 'DENY'.
+ * * * 'sameorigin' - the headers will be set to 'SAMEORIGIN'.
+ * * * an object for specifying the 'allow-from' rule, where:
+ * * * * rule - one of:
+ * * * * * 'deny'
+ * * * * * 'sameorigin'
+ * * * * * 'allow-from'
+ * * * * source - when rule is 'allow-from' this is used to form the rest of the header, otherwise this field is ignored. If rule is 'allow-from' but source is unset, the rule will be automatically
+ * changed to 'sameorigin'.
+ * * xss - controls the 'X-XSS-Protection' header, where:
+ * * * 'disabled' - the header will be set to '0'. This is the default value.
+ * * * 'enabled' - the header will be set to '1; mode=block'.
+ * * * false - the header will be omitted
+ * * noOpen - boolean controlling the 'X-Download-Options' header for Internet Explorer, preventing downloads from executing in your context. Defaults to true setting the header to 'noopen'.
+ * * noSniff - boolean controlling the 'X-Content-Type-Options' header. Defaults to true setting the header to its only and default option, 'nosniff'.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionssecurity)
+ */
+export interface RouteOptionsSecureObject {
+    /**
+     * hsts - controls the 'Strict-Transport-Security' header
+     */
+    hsts?: boolean | number | {
+        /**
+         * the max-age portion of the header, as a number. Default is 15768000.
+         */
+        maxAge?: number;
+        /**
+         * a boolean specifying whether to add the includeSubDomains flag to the header.
+         */
+        includeSubDomains?: boolean;
+        /**
+         * a boolean specifying whether to add the 'preload' flag (used to submit domains inclusion in Chrome's HTTP Strict Transport Security (HSTS) preload list) to the header.
+         */
+        preload?: boolean;
+    } | undefined;
+    /**
+     * controls the 'X-Frame-Options' header
+     */
+    xframe?: true | 'deny' | 'sameorigin' | {
+        /**
+         * an object for specifying the 'allow-from' rule,
+         */
+        rule: 'deny' | 'sameorigin' | 'allow-from';
+        /**
+         * when rule is 'allow-from' this is used to form the rest of the header, otherwise this field is ignored. If rule is 'allow-from' but source is unset, the rule will be automatically changed
+         * to 'sameorigin'.
+         */
+        source: string;
+    } | undefined;
+    /**
+     * controls the 'X-XSS-Protection' header, where:
+     * * 'disabled' - the header will be set to '0'. This is the default value.
+     * * 'enabled' - the header will be set to '1; mode=block'.
+     * * false - the header will be omitted
+     */
+    xss?: 'disabled' | 'enabled' | false | undefined;
+    /**
+     * boolean controlling the 'X-Download-Options' header for Internet Explorer, preventing downloads from executing in your context. Defaults to true setting the header to 'noopen'.
+     */
+    noOpen?: boolean | undefined;
+    /**
+     * boolean controlling the 'X-Content-Type-Options' header. Defaults to true setting the header to its only and default option, 'nosniff'.
+     */
+    noSniff?: boolean | undefined;
+
+    /**
+     * Controls the `Referrer-Policy` header, which has the following possible values.
+     * @default false Header will not be send.
+     */
+    referrer?: false | ReferrerPolicy | undefined;
+}
+
+export type RouteOptionsSecure = boolean | RouteOptionsSecureObject;
+
+/**
+ * @default { headers: true, params: true, query: true, payload: true, failAction: 'error' }.
+ * Request input validation rules for various request components.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsvalidate)
+ */
+export interface RouteOptionsValidate {
+    /**
+     * @default none.
+     * An optional object with error fields copied into every validation error response.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsvalidateerrorfields)
+     */
+    errorFields?: object | undefined;
+
+    /**
+     * @default 'error' (return a Bad Request (400) error response).
+     * A failAction value which determines how to handle failed validations. When set to a function, the err argument includes the type of validation error under err.output.payload.validation.source.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsvalidatefailaction)
+     */
+    failAction?: Lifecycle.FailAction | undefined;
+
+    /**
+     * Validation rules for incoming request headers:
+     * * If a value is returned, the value is used as the new request.headers value and the original value is stored in request.orig.headers. Otherwise, the headers are left unchanged. If an error
+     * is thrown, the error is handled according to failAction. Note that all header field names must be in lowercase to match the headers normalized by node.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsvalidateheaders)
+     * @default true
+     */
+    headers?: RouteOptionsResponseSchema | undefined;
+
+    /**
+     * An options object passed to the joi rules or the custom validation methods. Used for setting global options such as stripUnknown or abortEarly (the complete list is available here).
+     * If a custom validation function (see headers, params, query, or payload above) is defined then options can an arbitrary object that will be passed to this function as the second parameter.
+     * The values of the other inputs (i.e. headers, query, params, payload, app, and auth) are added to the options object under the validation context (accessible in rules as
+     * Joi.ref('$query.key')).
+     * Note that validation is performed in order (i.e. headers, params, query, and payload) and if type casting is used (e.g. converting a string to a number), the value of inputs not yet validated
+     * will reflect the raw, unvalidated and unmodified values. If the validation rules for headers, params, query, and payload are defined at both the server routes level and at the route level, the
+     * individual route settings override the routes defaults (the rules are not merged).
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsvalidateparams)
+     * @default true
+     */
+    options?: ValidationOptions | object | undefined;
+
+    /**
+     * Validation rules for incoming request path parameters, after matching the path against the route, extracting any parameters, and storing them in request.params, where:
+     * * true - any path parameter value allowed (no validation performed).
+     * * a joi validation object.
+     * * a validation function using the signature async function(value, options) where:
+     * * * value - the request.params object containing the request path parameters.
+     * * * options - options.
+     * if a value is returned, the value is used as the new request.params value and the original value is stored in request.orig.params. Otherwise, the path parameters are left unchanged. If an
+     * error is thrown, the error is handled according to failAction. Note that failing to match the validation rules to the route path parameters definition will cause all requests to fail.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsvalidateparams)
+     * @default true
+     */
+    params?: RouteOptionsResponseSchema | undefined;
+
+    /**
+     * Validation rules for incoming request payload (request body), where:
+     * * If a value is returned, the value is used as the new request.payload value and the original value is stored in request.orig.payload. Otherwise, the payload is left unchanged. If an error is
+     * thrown, the error is handled according to failAction. Note that validating large payloads and modifying them will cause memory duplication of the payload (since the original is kept), as well
+     * as the significant performance cost of validating large amounts of data.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsvalidatepayload)
+     * @default true
+     */
+    payload?: RouteOptionsResponseSchema | undefined;
+
+    /**
+     * Validation rules for incoming request URI query component (the key-value part of the URI between '?' and '#'). The query is parsed into its individual key-value pairs, decoded, and stored in
+     * request.query prior to validation. Where:
+     * * If a value is returned, the value is used as the new request.query value and the original value is stored in request.orig.query. Otherwise, the query parameters are left unchanged.
+     * If an error
+     * is thrown, the error is handled according to failAction. Note that changes to the query parameters will not be reflected in request.url.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsvalidatequery)
+     * @default true
+     */
+    query?: RouteOptionsResponseSchema | undefined;
+
+    /**
+     * Validation rules for incoming cookies.
+     * The cookie header is parsed and decoded into the request.state prior to validation.
+     * @default true
+     */
+    state?: RouteOptionsResponseSchema | undefined;
+}
+
+export interface CommonRouteProperties<Refs extends ReqRef = ReqRefDefaults> {
+    /**
+     * Application-specific route configuration state. Should not be used by plugins which should use options.plugins[name] instead.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsapp)
+     */
+    app?:  MergeRefs<Refs>['RouteApp'] | undefined;
+
+    /**
+     * @default null.
+     * An object passed back to the provided handler (via this) when called. Ignored if the method is an arrow function.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsbind)
+     */
+    bind?: MergeRefs<Refs>['Bind'] | undefined;
+
+    /**
+     * @default { privacy: 'default', statuses: [200], otherwise: 'no-cache' }.
+     * If the route method is 'GET', the route can be configured to include HTTP caching directives in the response. Caching can be customized using an object with the following options:
+     * privacy - determines the privacy flag included in client-side caching using the 'Cache-Control' header. Values are:
+     * * * 'default' - no privacy flag.
+     * * * 'public' - mark the response as suitable for public caching.
+     * * * 'private' - mark the response as suitable only for private caching.
+     * * expiresIn - relative expiration expressed in the number of milliseconds since the item was saved in the cache. Cannot be used together with expiresAt.
+     * * expiresAt - time of day expressed in 24h notation using the 'HH:MM' format, at which point all cache records for the route expire. Cannot be used together with expiresIn.
+     * * statuses - an array of HTTP response status code numbers (e.g. 200) which are allowed to include a valid caching directive.
+     * * otherwise - a string with the value of the 'Cache-Control' header when caching is disabled.
+     * The default Cache-Control: no-cache header can be disabled by setting cache to false.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionscache)
+     */
+    cache?: false | RouteOptionsCache | undefined;
+
+    /**
+     * An object where each key is a content-encoding name and each value is an object with the desired encoder settings. Note that decoder settings are set in compression.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionscompression)
+     */
+    compression?: { [P in keyof ContentEncoders]?: Parameters<ContentEncoders[P]>[0] } | undefined;
+
+    /**
+     * @default false (no CORS headers).
+     * The Cross-Origin Resource Sharing protocol allows browsers to make cross-origin API calls. CORS is required by web applications running inside a browser which are loaded from a different
+     * domain than the API server. To enable, set cors to true, or to an object with the following options:
+     * * origin - an array of allowed origin servers strings ('Access-Control-Allow-Origin'). The array can contain any combination of fully qualified origins along with origin strings containing a
+     * wildcard '*' character, or a single '*' origin string. If set to 'ignore', any incoming Origin header is ignored (present or not) and the 'Access-Control-Allow-Origin' header is set to '*'.
+     * Defaults to any origin ['*'].
+     * * maxAge - number of seconds the browser should cache the CORS response ('Access-Control-Max-Age'). The greater the value, the longer it will take before the browser checks for changes in
+     * policy. Defaults to 86400 (one day).
+     * * headers - a strings array of allowed headers ('Access-Control-Allow-Headers'). Defaults to ['Accept', 'Authorization', 'Content-Type', 'If-None-Match'].
+     * * additionalHeaders - a strings array of additional headers to headers. Use this to keep the default headers in place.
+     * * exposedHeaders - a strings array of exposed headers ('Access-Control-Expose-Headers'). Defaults to ['WWW-Authenticate', 'Server-Authorization'].
+     * * additionalExposedHeaders - a strings array of additional headers to exposedHeaders. Use this to keep the default headers in place.
+     * * credentials - if true, allows user credentials to be sent ('Access-Control-Allow-Credentials'). Defaults to false.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionscors)
+     */
+    cors?: boolean | RouteOptionsCors | undefined;
+
+    /**
+     * @default none.
+     * Route description used for generating documentation (string).
+     * This setting is not available when setting server route defaults using server.options.routes.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsdescription)
+     */
+    description?: string | undefined;
+
+    /**
+     * @default none.
+     * Route-level request extension points by setting the option to an object with a key for each of the desired extension points ('onRequest' is not allowed), and the value is the same as the
+     * server.ext(events) event argument.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsext)
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#request-lifecycle)
+     */
+    ext?: {
+        [key in RouteRequestExtType]?: RouteExtObject | RouteExtObject[] | undefined;
+    } | undefined;
+
+    /**
+     * @default { relativeTo: '.' }.
+     * Defines the behavior for accessing files:
+     * * relativeTo - determines the folder relative paths are resolved against.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsfiles)
+     */
+    files?: {
+        relativeTo: string;
+    } | undefined;
+
+    /**
+     * @default none.
+     * The route handler function performs the main business logic of the route and sets the response. handler can be assigned:
+     * * a lifecycle method.
+     * * an object with a single property using the name of a handler type registered with the server.handler() method. The matching property value is passed as options to the registered handler
+     * generator. Note: handlers using a fat arrow style function cannot be bound to any bind property. Instead, the bound context is available under h.context.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionshandler)
+     */
+    handler?: Lifecycle.Method<Refs> | object | undefined;
+
+    /**
+     * @default none.
+     * An optional unique identifier used to look up the route using server.lookup(). Cannot be assigned to routes added with an array of methods.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsid)
+     */
+    id?: string | undefined;
+
+    /**
+     * @default false.
+     * If true, the route cannot be accessed through the HTTP listener but only through the server.inject() interface with the allowInternals option set to true. Used for internal routes that should
+     * not be accessible to the outside world.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsisinternal)
+     */
+    isInternal?: boolean | undefined;
+
+    /**
+     * @default none.
+     * Optional arguments passed to JSON.stringify() when converting an object or error response to a string payload or escaping it after stringification. Supports the following:
+     * * replacer - the replacer function or array. Defaults to no action.
+     * * space - number of spaces to indent nested object keys. Defaults to no indentation.
+     * * suffix - string suffix added after conversion to JSON string. Defaults to no suffix.
+     * * escape - calls Hoek.jsonEscape() after conversion to JSON string. Defaults to false.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsjson)
+     */
+    json?: Json.StringifyArguments | undefined;
+
+    /**
+     * @default { collect: false }.
+     * Request logging options:
+     * collect - if true, request-level logs (both internal and application) are collected and accessible via request.logs.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionslog)
+     */
+    log?: {
+        collect: boolean;
+    } | undefined;
+
+    /**
+     * @default none.
+     * Route notes used for generating documentation (string or array of strings).
+     * This setting is not available when setting server route defaults using server.options.routes.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsnotes)
+     */
+    notes?: string | string[] | undefined;
+
+    /**
+     * Determines how the request payload is processed.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspayload)
+     */
+    payload?: RouteOptionsPayload | undefined;
+
+    /**
+     * @default {}.
+     * Plugin-specific configuration. plugins is an object where each key is a plugin name and the value is the plugin configuration.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsplugins)
+     */
+    plugins?: PluginSpecificConfiguration | undefined;
+
+    /**
+     * @default none.
+     * The pre option allows defining methods for performing actions before the handler is called. These methods allow breaking the handler logic into smaller, reusable components that can be shared
+     * across routes, as well as provide a cleaner error handling of prerequisite operations (e.g. load required reference data from a database). pre is assigned an ordered array of methods which
+     * are called serially in order. If the pre array contains another array of methods as one of its elements, those methods are called in parallel. Note that during parallel execution, if any of
+     * the methods error, return a takeover response, or abort signal, the other parallel methods will continue to execute but will be ignored once completed. pre can be assigned a mixed array of:
+     * * an array containing the elements listed below, which are executed in parallel.
+     * * an object with:
+     * * * method - a lifecycle method.
+     * * * assign - key name used to assign the response of the method to in request.pre and request.preResponses.
+     * * * failAction - A failAction value which determine what to do when a pre-handler method throws an error. If assign is specified and the failAction setting is not 'error', the error will be
+     * assigned.
+     * * a method function - same as including an object with a single method key.
+     * Note that pre-handler methods do not behave the same way other lifecycle methods do when a value is returned. Instead of the return value becoming the new response payload, the value is used
+     * to assign the corresponding request.pre and request.preResponses properties. Otherwise, the handling of errors, takeover response response, or abort signal behave the same as any other
+     * lifecycle methods.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionspre)
+     */
+    pre?: RouteOptionsPreArray<Refs> | undefined;
+
+    /**
+     * Processing rules for the outgoing response.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsresponse)
+     */
+    response?: RouteOptionsResponse | undefined;
+
+    /**
+     * @default false (security headers disabled).
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionssecurity)
+     */
+    security?: RouteOptionsSecure | undefined;
+
+    /**
+     * @default { parse: true, failAction: 'error' }.
+     * HTTP state management (cookies) allows the server to store information on the client which is sent back to the server with every request (as defined in RFC 6265). state supports the following
+     * options: parse - determines if incoming 'Cookie' headers are parsed and stored in the request.state object. failAction - A failAction value which determines how to handle cookie parsing
+     * errors. Defaults to 'error' (return a Bad Request (400) error response).
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsstate)
+     */
+    state?: {
+        parse?: boolean | undefined;
+        failAction?: Lifecycle.FailAction | undefined;
+    } | undefined;
+
+    /**
+     * @default none.
+     * Route tags used for generating documentation (array of strings).
+     * This setting is not available when setting server route defaults using server.options.routes.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionstags)
+     */
+    tags?: string[] | undefined;
+
+    /**
+     * @default { server: false }.
+     * Timeouts for processing durations.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionstimeout)
+     */
+    timeout?: {
+        /**
+         * Response timeout in milliseconds. Sets the maximum time allowed for the server to respond to an incoming request before giving up and responding with a Service Unavailable (503) error
+         * response.
+         */
+        server?: boolean | number | undefined;
+
+        /**
+         * @default none (use node default of 2 minutes).
+         * By default, node sockets automatically timeout after 2 minutes. Use this option to override this behavior. Set to false to disable socket timeouts.
+         */
+        socket?: boolean | number | undefined;
+    } | undefined;
+
+    /**
+     * @default { headers: true, params: true, query: true, payload: true, failAction: 'error' }.
+     * Request input validation rules for various request components.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsvalidate)
+     */
+    validate?: RouteOptionsValidate | undefined;
+}
+
+export interface AccessScopes {
+    forbidden?: string[] | undefined;
+    required?: string[] | undefined;
+    selection?: string[] | undefined;
+}
+
+export interface AccessSetting {
+    entity?: AccessEntity | undefined;
+    scope: AccessScopes | false;
+}
+
+export interface AuthSettings {
+    strategies: string[];
+    mode: AuthMode;
+    access?: AccessSetting[] | undefined;
+}
+
+export interface RouteSettings<Refs extends ReqRef = ReqRefDefaults> extends CommonRouteProperties<Refs> {
+    auth?: AuthSettings | undefined;
+}
+
+/**
+ * Each route can be customized to change the default behavior of the request lifecycle.
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#route-options)
+ */
+export interface RouteOptions<Refs extends ReqRef = ReqRefDefaults> extends CommonRouteProperties<Refs> {
+    /**
+     * Route authentication configuration. Value can be:
+     * false to disable authentication if a default strategy is set.
+     * a string with the name of an authentication strategy registered with server.auth.strategy(). The strategy will be set to 'required' mode.
+     * an authentication configuration object.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-routeoptionsapp)
+     */
+    auth?: false | string | RouteOptionsAccess | undefined;
+}
+
+export interface HandlerDecorations {}
+
+export interface RouteRules {}
+
+export interface RulesInfo {
+    method: string;
+    path: string;
+    vhost: string;
+}
+
+export interface RulesOptions<Refs extends ReqRef = ReqRefDefaults> {
+    validate: {
+        schema?: ObjectSchema<MergeRefs<Refs>['Rules']> | Record<keyof MergeRefs<Refs>['Rules'], Schema> | undefined;
+        options?: ValidationOptions | undefined;
+    };
+}
+
+export interface RulesProcessor<Refs extends ReqRef = ReqRefDefaults> {
+    (rules: MergeRefs<Refs>['Rules'] | null, info: RulesInfo): Partial<RouteOptions<Refs>> | null;
+}
+
+type RouteDefMethods = Exclude<HTTP_METHODS | Lowercase<HTTP_METHODS>, 'HEAD' | 'head'>;
+
+/**
+ * A route configuration object or an array of configuration objects where each object contains:
+ * * path - (required) the absolute path used to match incoming requests (must begin with '/'). Incoming requests are compared to the configured paths based on the server's router configuration. The
+ * path can include named parameters enclosed in {} which will be matched against literal values in the request as described in Path parameters.
+ * * method - (required) the HTTP method. Typically one of 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', or 'OPTIONS'. Any HTTP method is allowed, except for 'HEAD'. Use '*' to match against any HTTP
+ * method (only when an exact match was not found, and any match with a specific method will be given a higher priority over a wildcard match). Can be assigned an array of methods which has the same
+ * result as adding the same route with different methods manually.
+ * * vhost - (optional) a domain string or an array of domain strings for limiting the route to only requests with a matching host header field. Matching is done against the hostname part of the
+ * header only (excluding the port). Defaults to all hosts.
+ * * handler - (required when handler is not set) the route handler function called to generate the response after successful authentication and validation.
+ * * options - additional route options. The options value can be an object or a function that returns an object using the signature function(server) where server is the server the route is being
+ * added to and this is bound to the current realm's bind option.
+ * * rules - route custom rules object. The object is passed to each rules processor registered with server.rules(). Cannot be used if route.options.rules is defined.
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverrouteroute)
+ */
+export interface ServerRoute<Refs extends ReqRef = ReqRefDefaults> {
+    /**
+     * (required) the absolute path used to match incoming requests (must begin with '/'). Incoming requests are compared to the configured paths based on the server's router configuration. The path
+     * can include named parameters enclosed in {} which will be matched against literal values in the request as described in Path parameters. For context [See
+     * docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverrouteroute) For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#path-parameters)
+     */
+    path: string;
+
+    /**
+     * (required) the HTTP method. Typically one of 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', or 'OPTIONS'. Any HTTP method is allowed, except for 'HEAD'. Use '*' to match against any HTTP method
+     * (only when an exact match was not found, and any match with a specific method will be given a higher priority over a wildcard match). Can be assigned an array of methods which has the same
+     * result as adding the same route with different methods manually.
+     */
+    method: RouteDefMethods | RouteDefMethods[] | '*';
+
+    /**
+     * (optional) a domain string or an array of domain strings for limiting the route to only requests with a matching host header field. Matching is done against the hostname part of the header
+     * only (excluding the port). Defaults to all hosts.
+     */
+    vhost?: string | string[] | undefined;
+
+    /**
+     * (required when handler is not set) the route handler function called to generate the response after successful authentication and validation.
+     */
+    handler?: Lifecycle.Method<Refs> | HandlerDecorations | undefined;
+
+    /**
+     * additional route options. The options value can be an object or a function that returns an object using the signature function(server) where server is the server the route is being added to
+     * and this is bound to the current realm's bind option.
+     */
+    options?: RouteOptions<Refs> | ((server: Server) => RouteOptions<Refs>) | undefined;
+
+    /**
+     * route custom rules object. The object is passed to each rules processor registered with server.rules(). Cannot be used if route.options.rules is defined.
+     */
+    rules?: MergeRefs<Refs>['Rules'] | undefined;
+}

node_modules/@hapi/hapi/lib/types/server/auth.d.ts

@@ -0,0 +1,201 @@
+import { Server } from './server';
+import {
+    MergeType,
+    ReqRef,
+    ReqRefDefaults,
+    MergeRefs,
+    Request,
+    RequestAuth} from '../request';
+import { ResponseToolkit, AuthenticationData } from '../response';
+import { RouteOptionsAccess, InternalRouteOptionType, RouteOptionTypes} from '../route';
+import { Lifecycle } from '../utils';
+
+/**
+ * The scheme options argument passed to server.auth.strategy() when instantiation a strategy.
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverauthschemename-scheme)
+ */
+export type ServerAuthSchemeOptions = object;
+
+/**
+ * the method implementing the scheme with signature function(server, options) where:
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverauthschemename-scheme)
+ * @param server - a reference to the server object the scheme is added to.
+ * @param options - (optional) the scheme options argument passed to server.auth.strategy() when instantiation a strategy.
+ */
+export type ServerAuthScheme<
+    // tslint:disable-next-line no-unnecessary-generics
+    Options extends ServerAuthSchemeOptions = ServerAuthSchemeOptions,
+    // tslint:disable-next-line no-unnecessary-generics
+    Refs extends ReqRef = ReqRefDefaults
+> = (server: Server, options?: Options) => ServerAuthSchemeObject<Refs>;
+
+export interface ServerAuthSchemeObjectApi {}
+
+/**
+ * The scheme method must return an object with the following
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#authentication-scheme)
+ */
+
+export interface ServerAuthSchemeObject<Refs extends ReqRef = ReqRefDefaults> {
+    /**
+     * optional object which is exposed via the [server.auth.api](https://github.com/hapijs/hapi/blob/master/API.md#server.auth.api) object.
+     */
+    api?: MergeRefs<Refs>['AuthApi'] | undefined;
+
+    /**
+     * A lifecycle method function called for each incoming request configured with the authentication scheme. The
+     * method is provided with two special toolkit methods for returning an authenticated or an unauthenticated result:
+     * * h.authenticated() - indicate request authenticated successfully.
+     * * h.unauthenticated() - indicate request failed to authenticate.
+     * @param request the request object.
+     * @param h the ResponseToolkit
+     * @return the Lifecycle.ReturnValue
+     */
+    authenticate(request: Request<Refs>, h: ResponseToolkit<Refs>): Lifecycle.ReturnValue<Refs>;
+
+    /**
+     * A lifecycle method to authenticate the request payload.
+     * When the scheme payload() method returns an error with a message, it means payload validation failed due to bad
+     * payload. If the error has no message but includes a scheme name (e.g. Boom.unauthorized(null, 'Custom')),
+     * authentication may still be successful if the route auth.payload configuration is set to 'optional'.
+     * @param request the request object.
+     * @param h the ResponseToolkit
+     * @return the Lifecycle.ReturnValue
+     */
+    payload?(request: Request<Refs>, h: ResponseToolkit<Refs>): Lifecycle.ReturnValue<Refs>;
+
+    /**
+     * A lifecycle method to decorate the response with authentication headers before the response headers or payload is written.
+     * @param request the request object.
+     * @param h the ResponseToolkit
+     * @return the Lifecycle.ReturnValue
+     */
+    response?(request: Request<Refs>, h: ResponseToolkit<Refs>): Lifecycle.ReturnValue<Refs>;
+
+    /**
+     * a method used to verify the authentication credentials provided
+     * are still valid (e.g. not expired or revoked after the initial authentication).
+     * the method throws an `Error` when the credentials passed are no longer valid (e.g. expired or
+     * revoked). Note that the method does not have access to the original request, only to the
+     * credentials and artifacts produced by the `authenticate()` method.
+     */
+    verify?(
+        auth: RequestAuth<
+            MergeRefs<Refs>['AuthUser'],
+            MergeRefs<Refs>['AuthApp'],
+            MergeRefs<Refs>['AuthCredentialsExtra'],
+            MergeRefs<Refs>['AuthArtifactsExtra']
+        >
+    ): Promise<void>;
+
+    /**
+     * An object with the following keys:
+     * * payload
+     */
+    options?: {
+        /**
+         * if true, requires payload validation as part of the scheme and forbids routes from disabling payload auth validation. Defaults to false.
+         */
+        payload?: boolean | undefined;
+    } | undefined;
+}
+
+/**
+ * An authentication configuration object using the same format as the route auth handler options.
+ * For reference [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverauthdefaultoptions)
+ */
+
+export interface ServerAuthConfig extends RouteOptionsAccess {
+}
+
+export interface ServerAuth {
+    /**
+     * An object where each key is an authentication strategy name and the value is the exposed strategy API.
+     * Available only when the authentication scheme exposes an API by returning an api key in the object
+     * returned from its implementation function.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverauthapi)
+     */
+    api: Record<string, ServerAuthSchemeObjectApi>;
+
+    /**
+     * Contains the default authentication configuration is a default strategy was set via
+     * [server.auth.default()](https://github.com/hapijs/hapi/blob/master/API.md#server.auth.default()).
+     */
+    readonly settings: {
+        default: ServerAuthConfig;
+    };
+
+    /**
+     * Sets a default strategy which is applied to every route where:
+     * @param options - one of:
+     * * a string with the default strategy name
+     * * an authentication configuration object using the same format as the route auth handler options.
+     * @return void.
+     * The default does not apply when a route config specifies auth as false, or has an authentication strategy
+     * configured (contains the strategy or strategies authentication settings). Otherwise, the route authentication
+     * config is applied to the defaults.
+     * Note that if the route has authentication configured, the default only applies at the time of adding the route,
+     * not at runtime. This means that calling server.auth.default() after adding a route with some authentication
+     * config will have no impact on the routes added prior. However, the default will apply to routes added
+     * before server.auth.default() is called if those routes lack any authentication config.
+     * The default auth strategy configuration can be accessed via server.auth.settings.default. To obtain the active
+     * authentication configuration of a route, use server.auth.lookup(request.route).
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverauthdefaultoptions)
+     */
+    default(options: string | ServerAuthConfig): void;
+
+    /**
+     * Registers an authentication scheme where:
+     * @param name the scheme name.
+     * @param scheme - the method implementing the scheme with signature function(server, options) where:
+     * * server - a reference to the server object the scheme is added to.
+     * * options - (optional) the scheme options argument passed to server.auth.strategy() when instantiation a strategy.
+     * @return void.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverauthschemename-scheme)
+     */
+
+    scheme <
+        Refs extends ReqRef = ReqRefDefaults,
+        Options extends object = {}
+    // tslint:disable-next-line no-unnecessary-generics
+    >(name: string, scheme: ServerAuthScheme<Options, Refs>): void;
+
+    /**
+     * Registers an authentication strategy where:
+     * @param name - the strategy name.
+     * @param scheme - the scheme name (must be previously registered using server.auth.scheme()).
+     * @param options - scheme options based on the scheme requirements.
+     * @return Return value: none.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverauthstrategyname-scheme-options)
+     */
+    strategy(
+        name: MergeType<InternalRouteOptionType, RouteOptionTypes>['Strategy'],
+        scheme: string,
+        options?: object
+    ): void;
+
+    /**
+     * Tests a request against an authentication strategy where:
+     * @param strategy - the strategy name registered with server.auth.strategy().
+     * @param request - the request object.
+     * @return an object containing the authentication credentials and artifacts if authentication was successful, otherwise throws an error.
+     * Note that the test() method does not take into account the route authentication configuration. It also does not
+     * perform payload authentication. It is limited to the basic strategy authentication execution. It does not
+     * include verifying scope, entity, or other route properties.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-await-serverauthteststrategy-request)
+     */
+    test(strategy: string, request: Request): Promise<AuthenticationData>;
+
+    /**
+     * Verify a request's authentication credentials against an authentication strategy.
+     * Returns nothing if verification was successful, otherwise throws an error.
+     *
+     * Note that the `verify()` method does not take into account the route authentication configuration
+     * or any other information from the request other than the `request.auth` object. It also does not
+     * perform payload authentication. It is limited to verifying that the previously valid credentials
+     * are still valid (e.g. have not been revoked or expired). It does not include verifying scope,
+     * entity, or other route properties.
+     */
+    // tslint:disable-next-line no-unnecessary-generics
+    verify <Refs extends ReqRef = ReqRefDefaults>(request: Request<Refs>): Promise<void>;
+}

node_modules/@hapi/hapi/lib/types/server/cache.d.ts

@@ -0,0 +1,85 @@
+import { PolicyOptionVariants, Policy, ClientApi, ClientOptions, EnginePrototype, PolicyOptions } from '@hapi/catbox';
+
+export type CachePolicyOptions<T> = PolicyOptionVariants<T> & {
+    /**
+     * @default '_default'
+     */
+    cache?: string | undefined;
+    segment?: string | undefined;
+};
+
+/**
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-servercacheoptions)
+ */
+export interface ServerCache {
+    /**
+     * Provisions a cache segment within the server cache facility where:
+     * @param options - [catbox policy](https://github.com/hapijs/catbox#policy) configuration where:
+     * * expiresIn - relative expiration expressed in the number of milliseconds since the item was saved in the cache. Cannot be used together with expiresAt.
+     * * expiresAt - time of day expressed in 24h notation using the 'HH:MM' format, at which point all cache records expire. Uses local time. Cannot be used together with expiresIn.
+     * * generateFunc - a function used to generate a new cache item if one is not found in the cache when calling get(). The method's signature is async function(id, flags) where:
+     * - `id` - the `id` string or object provided to the `get()` method.
+     * - `flags` - an object used to pass back additional flags to the cache where:
+     * - `ttl` - the cache ttl value in milliseconds. Set to `0` to skip storing in the cache. Defaults to the cache global policy.
+     * * staleIn - number of milliseconds to mark an item stored in cache as stale and attempt to regenerate it when generateFunc is provided. Must be less than expiresIn.
+     * * staleTimeout - number of milliseconds to wait before checking if an item is stale.
+     * * generateTimeout - number of milliseconds to wait before returning a timeout error when the generateFunc function takes too long to return a value. When the value is eventually returned, it
+     *     is stored in the cache for future requests. Required if generateFunc is present. Set to false to disable timeouts which may cause all get() requests to get stuck forever.
+     * * generateOnReadError - if false, an upstream cache read error will stop the cache.get() method from calling the generate function and will instead pass back the cache error. Defaults to true.
+     * * generateIgnoreWriteError - if false, an upstream cache write error when calling cache.get() will be passed back with the generated value when calling. Defaults to true.
+     * * dropOnError - if true, an error or timeout in the generateFunc causes the stale value to be evicted from the cache. Defaults to true.
+     * * pendingGenerateTimeout - number of milliseconds while generateFunc call is in progress for a given id, before a subsequent generateFunc call is allowed. Defaults to 0 (no blocking of
+     *     concurrent generateFunc calls beyond staleTimeout).
+     * * cache - the cache name configured in server.cache. Defaults to the default cache.
+     * * segment - string segment name, used to isolate cached items within the cache partition. When called within a plugin, defaults to '!name' where 'name' is the plugin name. When called within a
+     *     server method, defaults to '#name' where 'name' is the server method name. Required when called outside of a plugin.
+     * * shared - if true, allows multiple cache provisions to share the same segment. Default to false.
+     * @return Catbox Policy.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-servercacheoptions)
+     */
+    <T, O extends CachePolicyOptions<T> = CachePolicyOptions<T>>(options: O): Policy<T, O>;
+
+    /**
+     * Provisions a server cache as described in server.cache where:
+     * @param options - same as the server cache configuration options.
+     * @return Return value: none.
+     * Note that if the server has been initialized or started, the cache will be automatically started to match the state of any other provisioned server cache.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-await-servercacheprovisionoptions)
+     */
+    provision(options: ServerOptionsCache): Promise<void>;
+}
+
+export type CacheProvider<T extends ClientOptions = ClientOptions> = EnginePrototype<any> | {
+    constructor: EnginePrototype<any>;
+    options?: T | undefined;
+};
+
+/**
+ * hapi uses catbox for its cache implementation which includes support for common storage solutions (e.g. Redis,
+ * MongoDB, Memcached, Riak, among others). Caching is only utilized if methods and plugins explicitly store their state in the cache.
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-cache)
+ */
+export interface ServerOptionsCache extends PolicyOptions<any> {
+    /** catbox engine object. */
+    engine?: ClientApi<any> | undefined;
+
+    /**
+     * a class or a prototype function
+     */
+    provider?: CacheProvider | undefined;
+
+    /**
+     * an identifier used later when provisioning or configuring caching for server methods or plugins. Each cache name must be unique. A single item may omit the name option which defines
+     * the default cache. If every cache includes a name, a default memory cache is provisioned as well.
+     */
+    name?: string | undefined;
+
+    /** if true, allows multiple cache users to share the same segment (e.g. multiple methods using the same cache storage container). Default to false. */
+    shared?: boolean | undefined;
+
+    /** (optional) string used to isolate cached data. Defaults to 'hapi-cache'. */
+    partition?: string | undefined;
+
+    /** other options passed to the catbox strategy used. Other options are only passed to catbox when engine above is a class or function and ignored if engine is a catbox engine object). */
+    [s: string]: any;
+}

node_modules/@hapi/hapi/lib/types/server/encoders.d.ts

@@ -0,0 +1,19 @@
+import { createDeflate, createGunzip, createGzip, createInflate } from 'zlib';
+
+/**
+ * Available [content encoders](https://github.com/hapijs/hapi/blob/master/API.md#-serverencoderencoding-encoder).
+ */
+export interface ContentEncoders {
+
+    deflate: typeof createDeflate;
+    gzip: typeof createGzip;
+}
+
+/**
+ * Available [content decoders](https://github.com/hapijs/hapi/blob/master/API.md#-serverdecoderencoding-decoder).
+ */
+export interface ContentDecoders {
+
+    deflate: typeof createInflate;
+    gzip: typeof createGunzip;
+}

node_modules/@hapi/hapi/lib/types/server/events.d.ts

@@ -0,0 +1,217 @@
+import { Podium } from '@hapi/podium';
+
+import { Request, RequestRoute } from '../request';
+
+/**
+ * an event name string.
+ * an event options object.
+ * a podium emitter object.
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-servereventevents)
+ */
+export type ServerEventsApplication = string | ServerEventsApplicationObject | Podium;
+
+/**
+ * Object that it will be used in Event
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-servereventevents)
+ */
+export interface ServerEventsApplicationObject {
+    /** the event name string (required). */
+    name: string;
+    /** a string or array of strings specifying the event channels available. Defaults to no channel restrictions (event updates can specify a channel or not). */
+    channels?: string | string[] | undefined;
+    /**
+     * if true, the data object passed to server.events.emit() is cloned before it is passed to the listeners (unless an override specified by each listener). Defaults to false (data is passed as-is).
+     */
+    clone?: boolean | undefined;
+    /**
+     * if true, the data object passed to server.event.emit() must be an array and the listener method is called with each array element passed as a separate argument (unless an override specified
+     * by each listener). This should only be used when the emitted data structure is known and predictable. Defaults to false (data is emitted as a single argument regardless of its type).
+     */
+    spread?: boolean | undefined;
+    /**
+     * if true and the criteria object passed to server.event.emit() includes tags, the tags are mapped to an object (where each tag string is the key and the value is true) which is appended to
+     * the arguments list at the end. A configuration override can be set by each listener. Defaults to false.
+     */
+    tags?: boolean | undefined;
+    /**
+     * if true, the same event name can be registered multiple times where the second registration is ignored. Note that if the registration config is changed between registrations, only the first
+     * configuration is used. Defaults to false (a duplicate registration will throw an error).
+     */
+    shared?: boolean | undefined;
+}
+
+/**
+ * A criteria object with the following optional keys (unless noted otherwise):
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-servereventsoncriteria-listener)
+ *
+ * The type parameter T is the type of the name of the event.
+ */
+export interface ServerEventCriteria<T> {
+    /** (required) the event name string. */
+    name: T;
+    /**
+     * a string or array of strings specifying the event channels to subscribe to. If the event registration specified a list of allowed channels, the channels array must match the allowed
+     * channels. If channels are specified, event updates without any channel designation will not be included in the subscription. Defaults to no channels filter.
+     */
+    channels?: string | string[] | undefined;
+    /** if true, the data object passed to server.event.emit() is cloned before it is passed to the listener method. Defaults to the event registration option (which defaults to false). */
+    clone?: boolean | undefined;
+    /**
+     * a positive integer indicating the number of times the listener can be called after which the subscription is automatically removed. A count of 1 is the same as calling server.events.once().
+     * Defaults to no limit.
+     */
+    count?: number | undefined;
+    /**
+     * filter - the event tags (if present) to subscribe to which can be one of:
+     * * a tag string.
+     * * an array of tag strings.
+     * * an object with the following:
+     * * * tags - a tag string or array of tag strings.
+     * * * all - if true, all tags must be present for the event update to match the subscription. Defaults to false (at least one matching tag).
+     */
+    filter?: string | string[] | { tags: string | string[] | undefined, all?: boolean | undefined } | undefined;
+    /**
+     * if true, and the data object passed to server.event.emit() is an array, the listener method is called with each array element passed as a separate argument. This should only be used
+     * when the emitted data structure is known and predictable. Defaults to the event registration option (which defaults to false).
+     */
+    spread?: boolean | undefined;
+    /**
+     * if true and the criteria object passed to server.event.emit() includes tags, the tags are mapped to an object (where each tag string is the key and the value is true) which is appended
+     * to the arguments list at the end. Defaults to the event registration option (which defaults to false).
+     */
+    tags?: boolean | undefined;
+}
+
+export interface LogEvent<T = object | string> {
+    /** the event timestamp. */
+    timestamp: string;
+    /** an array of tags identifying the event (e.g. ['error', 'http']) */
+    tags: string[];
+    /** set to 'internal' for internally generated events, otherwise 'app' for events generated by server.log() */
+    channel: 'internal' | 'app';
+    /** the request identifier. */
+    request: string;
+    /** event-specific information. Available when event data was provided and is not an error. Errors are passed via error. */
+    data: T;
+    /** the error object related to the event if applicable. Cannot appear together with data */
+    error: object;
+}
+
+export interface RequestEvent {
+    /** the event timestamp. */
+    timestamp: string;
+    /** an array of tags identifying the event (e.g. ['error', 'http']) */
+    tags: string[];
+    /** set to 'internal' for internally generated events, otherwise 'app' for events generated by server.log() */
+    channel: 'internal' | 'app' | 'error';
+    /** event-specific information. Available when event data was provided and is not an error. Errors are passed via error. */
+    data: object | string;
+    /** the error object related to the event if applicable. Cannot appear together with data */
+    error: object;
+}
+
+export type LogEventHandler = (event: LogEvent, tags: { [key: string]: true }) => void;
+export type RequestEventHandler = (request: Request, event: RequestEvent, tags: { [key: string]: true }) => void;
+export type ResponseEventHandler = (request: Request) => void;
+export type RouteEventHandler = (route: RequestRoute) => void;
+export type StartEventHandler = () => void;
+export type StopEventHandler = () => void;
+
+export interface PodiumEvent<K extends string, T> {
+    emit(criteria: K, listener: (value: T) => void): void;
+
+    on(criteria: K, listener: (value: T) => void): void;
+
+    once(criteria: K, listener: (value: T) => void): void;
+
+    once(criteria: K): Promise<T>;
+
+    removeListener(criteria: K, listener: Podium.Listener): this;
+
+    removeAllListeners(criteria: K): this;
+
+    hasListeners(criteria: K): this;
+}
+
+/**
+ * Access: podium public interface.
+ * The server events emitter. Utilizes the podium with support for event criteria validation, channels, and filters.
+ * Use the following methods to interact with server.events:
+ * [server.event(events)](https://github.com/hapijs/hapi/blob/master/API.md#server.event()) - register application events.
+ * [server.events.emit(criteria, data)](https://github.com/hapijs/hapi/blob/master/API.md#server.events.emit()) - emit server events.
+ * [server.events.on(criteria, listener)](https://github.com/hapijs/hapi/blob/master/API.md#server.events.on()) - subscribe to all events.
+ * [server.events.once(criteria, listener)](https://github.com/hapijs/hapi/blob/master/API.md#server.events.once()) - subscribe to
+ * Other methods include: server.events.removeListener(name, listener), server.events.removeAllListeners(name), and server.events.hasListeners(name).
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverevents)
+ */
+export interface ServerEvents extends Podium {
+    /**
+     * Subscribe to an event where:
+     * @param criteria - the subscription criteria which must be one of:
+     * * event name string which can be any of the built-in server events
+     * * a custom application event registered with server.event().
+     * * a criteria object
+     * @param listener - the handler method set to receive event updates. The function signature depends on the event argument, and the spread and tags options.
+     * @return Return value: none.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-servereventsoncriteria-listener)
+     * See ['log' event](https://github.com/hapijs/hapi/blob/master/API.md#-log-event)
+     * See ['request' event](https://github.com/hapijs/hapi/blob/master/API.md#-request-event)
+     * See ['response' event](https://github.com/hapijs/hapi/blob/master/API.md#-response-event)
+     * See ['route' event](https://github.com/hapijs/hapi/blob/master/API.md#-route-event)
+     * See ['start' event](https://github.com/hapijs/hapi/blob/master/API.md#-start-event)
+     * See ['stop' event](https://github.com/hapijs/hapi/blob/master/API.md#-stop-event)
+     */
+    on(criteria: 'log' | ServerEventCriteria<'log'>, listener: LogEventHandler): this;
+    on(criteria: 'request' | ServerEventCriteria<'request'>, listener: RequestEventHandler): this;
+    on(criteria: 'response' | ServerEventCriteria<'response'>, listener: ResponseEventHandler): this;
+    on(criteria: 'route' | ServerEventCriteria<'route'>, listener: RouteEventHandler): this;
+    on(criteria: 'start' | ServerEventCriteria<'start'>, listener: StartEventHandler): this;
+    on(criteria: 'stop' | ServerEventCriteria<'stop'>, listener: StopEventHandler): this;
+    on(criteria: string | ServerEventCriteria<string>, listener: (value: any) => void): this;
+
+    /**
+     * Same as calling [server.events.on()](https://github.com/hapijs/hapi/blob/master/API.md#server.events.on()) with the count option set to 1.
+     * @param criteria - the subscription criteria which must be one of:
+     * * event name string which can be any of the built-in server events
+     * * a custom application event registered with server.event().
+     * * a criteria object
+     * @param listener - the handler method set to receive event updates. The function signature depends on the event argument, and the spread and tags options.
+     * @return Return value: none.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-servereventsoncecriteria-listener)
+     */
+    once(criteria: 'log' | ServerEventCriteria<'log'>, listener: LogEventHandler): this;
+    once(criteria: 'request' | ServerEventCriteria<'request'>, listener: RequestEventHandler): this;
+    once(criteria: 'response' | ServerEventCriteria<'response'>, listener: ResponseEventHandler): this;
+    once(criteria: 'route' | ServerEventCriteria<'route'>, listener: RouteEventHandler): this;
+    once(criteria: 'start' | ServerEventCriteria<'start'>, listener: StartEventHandler): this;
+    once(criteria: 'stop' | ServerEventCriteria<'stop'>, listener: StopEventHandler): this;
+
+    /**
+     * Same as calling server.events.on() with the count option set to 1.
+     * @param criteria - the subscription criteria which must be one of:
+     * * event name string which can be any of the built-in server events
+     * * a custom application event registered with server.event().
+     * * a criteria object
+     * @return Return value: a promise that resolves when the event is emitted.
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-await-servereventsoncecriteria)
+     */
+    once(criteria: string | ServerEventCriteria<string>): Promise<any>;
+
+    /**
+     * The follow method is only mentioned in Hapi API. The doc about that method can be found [here](https://github.com/hapijs/podium/blob/master/API.md#podiumremovelistenername-listener)
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverevents)
+     */
+    removeListener(name: string, listener: Podium.Listener): this;
+
+    /**
+     * The follow method is only mentioned in Hapi API. The doc about that method can be found [here](https://github.com/hapijs/podium/blob/master/API.md#podiumremovealllistenersname)
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverevents)
+     */
+    removeAllListeners(name: string): this;
+
+    /**
+     * The follow method is only mentioned in Hapi API. The doc about that method can be found [here](https://github.com/hapijs/podium/blob/master/API.md#podiumhaslistenersname)
+     * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverevents)
+     */
+    hasListeners(name: string): boolean;
+}

node_modules/@hapi/hapi/lib/types/server/ext.d.ts

@@ -0,0 +1,152 @@
+import { Server, ServerApplicationState } from './server';
+import { ReqRef, ReqRefDefaults } from '../request';
+import { Lifecycle } from '../utils';
+
+/**
+ * The extension point event name. The available extension points include the request extension points as well as the following server extension points:
+ * 'onPreStart' - called before the connection listeners are started.
+ * 'onPostStart' - called after the connection listeners are started.
+ * 'onPreStop' - called before the connection listeners are stopped.
+ * 'onPostStop' - called after the connection listeners are stopped.
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverextevents)
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#request-lifecycle)
+ */
+export type ServerExtType = 'onPreStart' | 'onPostStart' | 'onPreStop' | 'onPostStop';
+export type RouteRequestExtType = 'onPreAuth'
+    | 'onCredentials'
+    | 'onPostAuth'
+    | 'onPreHandler'
+    | 'onPostHandler'
+    | 'onPreResponse'
+    | 'onPostResponse';
+
+export type ServerRequestExtType =
+    RouteRequestExtType
+    | 'onRequest';
+
+/**
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverextevents)
+ * Registers an extension function in one of the request lifecycle extension points where:
+ * @param events - an object or array of objects with the following:
+ * * type - (required) the extension point event name. The available extension points include the request extension points as well as the following server extension points:
+ * * * 'onPreStart' - called before the connection listeners are started.
+ * * * 'onPostStart' - called after the connection listeners are started.
+ * * * 'onPreStop' - called before the connection listeners are stopped.
+ * * * 'onPostStop' - called after the connection listeners are stopped.
+ * * method - (required) a function or an array of functions to be executed at a specified point during request processing. The required extension function signature is:
+ * * * server extension points: async function(server) where:
+ * * * * server - the server object.
+ * * * * this - the object provided via options.bind or the current active context set with server.bind().
+ * * * request extension points: a lifecycle method.
+ * * options - (optional) an object with the following:
+ * * * before - a string or array of strings of plugin names this method must execute before (on the same event). Otherwise, extension methods are executed in the order added.
+ * * * after - a string or array of strings of plugin names this method must execute after (on the same event). Otherwise, extension methods are executed in the order added.
+ * * * bind - a context object passed back to the provided method (via this) when called. Ignored if the method is an arrow function.
+ * * * sandbox - if set to 'plugin' when adding a request extension points the extension is only added to routes defined by the current plugin. Not allowed when configuring route-level extensions, or
+ *     when adding server extensions. Defaults to 'server' which applies to any route added to the server the extension is added to.
+ * @return void
+ */
+export interface ServerExtEventsObject<A = ServerApplicationState> {
+    /**
+     * (required) the extension point event name. The available extension points include the request extension points as well as the following server extension points:
+     * * 'onPreStart' - called before the connection listeners are started.
+     * * 'onPostStart' - called after the connection listeners are started.
+     * * 'onPreStop' - called before the connection listeners are stopped.
+     */
+    type: ServerExtType;
+    /**
+     * (required) a function or an array of functions to be executed at a specified point during request processing. The required extension function signature is:
+     * * server extension points: async function(server) where:
+     * * * server - the server object.
+     * * * this - the object provided via options.bind or the current active context set with server.bind().
+     * * request extension points: a lifecycle method.
+     */
+    method: ServerExtPointFunction<A> | ServerExtPointFunction<A>[];
+    options?: ServerExtOptions | undefined;
+}
+
+export interface RouteExtObject<Refs extends ReqRef = ReqRefDefaults> {
+    method: Lifecycle.Method<Refs>;
+    options?: ServerExtOptions | undefined;
+}
+
+/**
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverextevents)
+ * Registers an extension function in one of the request lifecycle extension points where:
+ * @param events - an object or array of objects with the following:
+ * * type - (required) the extension point event name. The available extension points include the request extension points as well as the following server extension points:
+ * * * 'onPreStart' - called before the connection listeners are started.
+ * * * 'onPostStart' - called after the connection listeners are started.
+ * * * 'onPreStop' - called before the connection listeners are stopped.
+ * * * 'onPostStop' - called after the connection listeners are stopped.
+ * * method - (required) a function or an array of functions to be executed at a specified point during request processing. The required extension function signature is:
+ * * * server extension points: async function(server) where:
+ * * * * server - the server object.
+ * * * * this - the object provided via options.bind or the current active context set with server.bind().
+ * * * request extension points: a lifecycle method.
+ * * options - (optional) an object with the following:
+ * * * before - a string or array of strings of plugin names this method must execute before (on the same event). Otherwise, extension methods are executed in the order added.
+ * * * after - a string or array of strings of plugin names this method must execute after (on the same event). Otherwise, extension methods are executed in the order added.
+ * * * bind - a context object passed back to the provided method (via this) when called. Ignored if the method is an arrow function.
+ * * * sandbox - if set to 'plugin' when adding a request extension points the extension is only added to routes defined by the current plugin. Not allowed when configuring route-level extensions, or
+ *     when adding server extensions. Defaults to 'server' which applies to any route added to the server the extension is added to.
+ * @return void
+ */
+export interface ServerExtEventsRequestObject {
+    /**
+     * (required) the extension point event name. The available extension points include the request extension points as well as the following server extension points:
+     * * 'onPreStart' - called before the connection listeners are started.
+     * * 'onPostStart' - called after the connection listeners are started.
+     * * 'onPreStop' - called before the connection listeners are stopped.
+     * * 'onPostStop' - called after the connection listeners are stopped.
+     */
+    type: ServerRequestExtType;
+    /**
+     * (required) a function or an array of functions to be executed at a specified point during request processing. The required extension function signature is:
+     * * server extension points: async function(server) where:
+     * * * server - the server object.
+     * * * this - the object provided via options.bind or the current active context set with server.bind().
+     * * request extension points: a lifecycle method.
+     */
+    method: Lifecycle.Method | Lifecycle.Method[];
+    /**
+     * (optional) an object with the following:
+     * * before - a string or array of strings of plugin names this method must execute before (on the same event). Otherwise, extension methods are executed in the order added.
+     * * after - a string or array of strings of plugin names this method must execute after (on the same event). Otherwise, extension methods are executed in the order added.
+     * * bind - a context object passed back to the provided method (via this) when called. Ignored if the method is an arrow function.
+     * * sandbox - if set to 'plugin' when adding a request extension points the extension is only added to routes defined by the current plugin. Not allowed when configuring route-level extensions,
+     * or when adding server extensions. Defaults to 'server' which applies to any route added to the server the extension is added to.
+     */
+    options?: ServerExtOptions | undefined;
+}
+
+export type ServerExtPointFunction<A = ServerApplicationState> = (server: Server<A>) => void;
+
+/**
+ * An object with the following:
+ * * before - a string or array of strings of plugin names this method must execute before (on the same event). Otherwise, extension methods are executed in the order added.
+ * * after - a string or array of strings of plugin names this method must execute after (on the same event). Otherwise, extension methods are executed in the order added.
+ * * bind - a context object passed back to the provided method (via this) when called. Ignored if the method is an arrow function.
+ * * sandbox - if set to 'plugin' when adding a request extension points the extension is only added to routes defined by the current plugin. Not allowed when configuring route-level extensions, or
+ * when adding server extensions. Defaults to 'server' which applies to any route added to the server the extension is added to. For context [See
+ * docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverextevents)
+ */
+export interface ServerExtOptions {
+    /**
+     * a string or array of strings of plugin names this method must execute before (on the same event). Otherwise, extension methods are executed in the order added.
+     */
+    before?: string | string[] | undefined;
+    /**
+     * a string or array of strings of plugin names this method must execute after (on the same event). Otherwise, extension methods are executed in the order added.
+     */
+    after?: string | string[] | undefined;
+    /**
+     * a context object passed back to the provided method (via this) when called. Ignored if the method is an arrow function.
+     */
+    bind?: object | undefined;
+    /**
+     * if set to 'plugin' when adding a request extension points the extension is only added to routes defined by the current plugin. Not allowed when configuring route-level extensions, or when
+     * adding server extensions. Defaults to 'server' which applies to any route added to the server the extension is added to.
+     */
+    sandbox?: 'server' | 'plugin' | undefined;
+}

node_modules/@hapi/hapi/lib/types/server/index.d.ts

@@ -0,0 +1,11 @@
+export * from './auth';
+export * from './cache';
+export * from './encoders';
+export * from './events';
+export * from './ext';
+export * from './info';
+export * from './inject';
+export * from './methods';
+export * from './options';
+export * from './server';
+export * from './state';

node_modules/@hapi/hapi/lib/types/server/info.d.ts

@@ -0,0 +1,53 @@
+/**
+ * [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-serverinfo)
+ * An object containing information about the server where:
+ */
+export interface ServerInfo {
+    /**
+     * a unique server identifier (using the format '{hostname}:{pid}:{now base36}').
+     */
+    id: string;
+
+    /**
+     * server creation timestamp.
+     */
+    created: number;
+
+    /**
+     * server start timestamp (0 when stopped).
+     */
+    started: number;
+
+    /**
+     * the connection [port](https://github.com/hapijs/hapi/blob/master/API.md#server.options.port) based on the following rules:
+     *  * before the server has been started: the configured port value.
+     *  * after the server has been started: the actual port assigned when no port is configured or was set to 0.
+     */
+    port: number | string;
+
+    /**
+     * The [host](https://github.com/hapijs/hapi/blob/master/API.md#server.options.host) configuration value.
+     */
+    host: string;
+
+    /**
+     * the active IP address the connection was bound to after starting. Set to undefined until the server has been
+     * started or when using a non TCP port (e.g. UNIX domain socket).
+     */
+    address: undefined | string;
+
+    /**
+     *  the protocol used:
+     * * 'http' - HTTP.
+     * * 'https' - HTTPS.
+     * * 'socket' - UNIX domain socket or Windows named pipe.
+     */
+    protocol: 'http' | 'https' | 'socket';
+
+    /**
+     * a string representing the connection (e.g. 'http://example.com:8080' or 'socket:/unix/domain/socket/path'). Contains
+     * the uri value if set, otherwise constructed from the available settings. If no port is configured or is set
+     * to 0, the uri will not include a port component until the server is started.
+     */
+    uri: string;
+}

node_modules/@hapi/hapi/lib/types/server/inject.d.ts

@@ -0,0 +1,89 @@
+import { RequestOptions as ShotRequestOptions, ResponseObject as ShotResponseObject } from '@hapi/shot';
+import { PluginsStates } from '../plugin';
+import { AuthArtifacts, AuthCredentials, Request, RequestApplicationState } from '../request';
+
+/**
+ * An object with:
+ * * method - (optional) the request HTTP method (e.g. 'POST'). Defaults to 'GET'.
+ * * url - (required) the request URL. If the URI includes an authority (e.g. 'example.com:8080'), it is used to automatically set an HTTP 'Host' header, unless one was specified in headers.
+ * * headers - (optional) an object with optional request headers where each key is the header name and the value is the header content. Defaults to no additions to the default shot headers.
+ * * payload - (optional) an string, buffer or object containing the request payload. In case of an object it will be converted to a string for you. Defaults to no payload. Note that payload
+ * processing defaults to 'application/json' if no 'Content-Type' header provided.
+ * * credentials - (optional) an credentials object containing authentication information. The credentials are used to bypass the default authentication strategies, and are validated directly as if
+ * they were received via an authentication scheme. Defaults to no credentials.
+ * * artifacts - (optional) an artifacts object containing authentication artifact information. The artifacts are used to bypass the default authentication strategies, and are validated directly as
+ * if they were received via an authentication scheme. Ignored if set without credentials. Defaults to no artifacts.
+ * * app - (optional) sets the initial value of request.app, defaults to {}.
+ * * plugins - (optional) sets the initial value of request.plugins, defaults to {}.
+ * * allowInternals - (optional) allows access to routes with config.isInternal set to true. Defaults to false.
+ * * remoteAddress - (optional) sets the remote address for the incoming connection.
+ * * simulate - (optional) an object with options used to simulate client request stream conditions for testing:
+ * * error - if true, emits an 'error' event after payload transmission (if any). Defaults to false.
+ * * close - if true, emits a 'close' event after payload transmission (if any). Defaults to false.
+ * * end - if false, does not end the stream. Defaults to true.
+ * * split - indicates whether the request payload will be split into chunks. Defaults to undefined, meaning payload will not be chunked.
+ * * validate - (optional) if false, the options inputs are not validated. This is recommended for run-time usage of inject() to make it perform faster where input validation can be tested
+ * separately.
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-await-serverinjectoptions)
+ * For context [Shot module](https://github.com/hapijs/shot)
+ */
+export interface ServerInjectOptions extends ShotRequestOptions {
+    /**
+     * Authentication bypass options.
+     */
+    auth?: {
+        /**
+         * The authentication strategy name matching the provided credentials.
+         */
+        strategy: string;
+        /**
+         * The credentials are used to bypass the default authentication strategies,
+         * and are validated directly as if they were received via an authentication scheme.
+         */
+        credentials: AuthCredentials;
+        /**
+         * The artifacts are used to bypass the default authentication strategies,
+         * and are validated directly as if they were received via an authentication scheme. Defaults to no artifacts.
+         */
+        artifacts?: AuthArtifacts | undefined;
+    } | undefined;
+    /**
+     * sets the initial value of request.app, defaults to {}.
+     */
+    app?: RequestApplicationState | undefined;
+    /**
+     * sets the initial value of request.plugins, defaults to {}.
+     */
+    plugins?: PluginsStates | undefined;
+    /**
+     * allows access to routes with config.isInternal set to true. Defaults to false.
+     */
+    allowInternals?: boolean | undefined;
+}
+
+/**
+ * A response object with the following properties:
+ * * statusCode - the HTTP status code.
+ * * headers - an object containing the headers set.
+ * * payload - the response payload string.
+ * * rawPayload - the raw response payload buffer.
+ * * raw - an object with the injection request and response objects:
+ * * req - the simulated node request object.
+ * * res - the simulated node response object.
+ * * result - the raw handler response (e.g. when not a stream or a view) before it is serialized for transmission. If not available, the value is set to payload. Useful for inspection and reuse of
+ * the internal objects returned (instead of parsing the response string).
+ * * request - the request object.
+ * For context [See docs](https://github.com/hapijs/hapi/blob/master/API.md#-await-serverinjectoptions)
+ * For context [Shot module](https://github.com/hapijs/shot)
+ */
+export interface ServerInjectResponse<Result = object> extends ShotResponseObject {
+    /**
+     * the raw handler response (e.g. when not a stream or a view) before it is serialized for transmission. If not available, the value is set to payload. Useful for inspection and reuse of the
+     * internal objects returned (instead of parsing the response string).
+     */
+    result: Result | undefined;
+    /**
+     * the request object.
+     */
+    request: Request;
+}