Discriminant for consumers that cannot use instanceof across realms.

Discriminant for consumers that cannot use instanceof across realms.

Delay before the job becomes available, in milliseconds.

Transport headers to carry with the job, delivered to the processor as IJob.headers.

Maximum attempts before the job is dead-lettered.

The action performed (e.g. "user.delete").

Resource state after the action.

Resource state before the action.

Additional context (IP, request ID, …).

The resource kind acted on (e.g. "user").

The specific resource instance, when applicable.

Whether the action succeeded.

The acting principal's ID.

Wraps the rest of the chain.

Maximum concurrent in-flight executions.

Maximum queued executions once concurrency is saturated. Defaults to 0.

Cancels a timer created by CachedProbeOptions.setTimer (e.g. IRuntimeServices.clearTimeout).

Outcome recorded when the probe times out or rejects.

Monotonic clock in milliseconds (e.g. IRuntimeServices.hrtime()). Injected so the TTL is an interval, not a wall-clock reading.

The reachability probe. Resolving true means the backend is reachable; resolving false or rejecting means it is not.

Timer used to bound each probe (e.g. IRuntimeServices.setTimeout).

Per-probe timeout, in milliseconds. A probe that does not settle within this window resolves CachedProbeOptions.fallback, which is false — unreachable — unless the caller widened it.

How long to cache the last outcome, in milliseconds.

Cooldown in milliseconds before an open breaker moves to half-open.

Failures within the timeout window that trip the breaker open.

Rolling failure window in milliseconds; failures older than this (measured by the monotonic clock) are dropped before the threshold check.

Tokens resolved and passed as constructor arguments, in order.

The class to instantiate.

Domain scope. Omit for a host-only cookie, which is the safer default.

Expires as an absolute date, for clients predating Max-Age.

HttpOnly — hides the cookie from document.cookie.

Max-Age in seconds. 0 expires the cookie immediately (deletion).

Path scope. Conventionally '/' for an application-wide cookie.

SameSite policy. 'none' is invalid without Secure, so serializeCookie emits Secure alongside it rather than producing a cookie browsers discard.

Secure — the cookie is only sent over HTTPS.

The request payload.

Request type name (e.g. "CreateUser"). Used for routing.

The primary-key column values (in key-column order), from the row the cursor was minted against. Used by keysetPredicate as the tiebreaker fallback when a key column is absent from orderBy.

The value of every ordered field (in orderBy declaration order), from the row the cursor was minted against. Index i is the value of the i-th entry of Object.entries(orderBy).

A stable fingerprint of the resolved sort specification: each ordered field paired with its direction, in order. A cursor minted under one sort and presented under another has a different fingerprint, so the caller is refused by name rather than served a silently wrong page.

True when EncodedPayload.data is base64-encoded binary.

The payload as a string.

Default applied when the variable is absent.

Whether the variable must be present.

Expected primitive type (defaults to 'string').

The error value.

Discriminant: false for failure.

The request, when one exists (supplies the Problem Details instance).

The response builder to write the error response to.

Request-scoped state; the responder is published under ERROR_RESPONDER_STATE_KEY.

An optional disclosure, kept verbatim by every format.

Optional structured details (e.g. a validation errors array).

The HTTP status code to answer with.

The framework-default error member. In a formatted response this is the Problem Details detail when no detail is supplied.

Factory invoked to produce the instance.

Additional targeting attributes.

The tenant the flag is evaluated for, when the request resolves one.

The user the flag is evaluated for.

Iterates every [name, value] pair in wire order — the enumeration primitive for reading a form whose field names the reader does not know ahead of time (the hand-rolled new URLSearchParams(body) iteration this accessor replaces).

Returns the FIRST value for a name, or undefined when the name is absent — the web standard's get, with undefined (narrowable) in place of null.

Returns every value for a name in wire order — the web standard's getAll, so a repeated field (multi-select, multi-file) keeps the order the client sent.

The file bytes, synchronously.

The client-provided file name (Content-Disposition filename="…").

MIME type reported by the part's Content-Type, or its default.

The payload sent with connection_init, if any.

Per-connection application state.

The upgrade request headers.

Unique connection identifier.

The negotiated subprotocol, when one was selected.

Query string parameters from the upgrade request.

The execution result (may contain errors).

The HTTP status code to return under application/graphql-response+json negotiation.

The data returned by the execution, or null if an error occurred.

Errors encountered during execution, or undefined if none.

Optional extensions for application-specific error codes.

Optional locations in the query document.

Human-readable error message.

Optional path to the field where the error occurred.

The WebSocket connection info (supplied by the WS path).

The HTTP request context (supplied by the SSE path).

Optional extensions carried with the request.

Operation name for documents with multiple operations.

The GraphQL query string.

Variables as a record of unknown values (passed through verbatim).

Methods keyed by their camelCase local name.

The fully qualified name of the service, e.g. "package.ServiceName".

Brand preventing accidental structural matches.

Optional diagnostic details (response times, versions, …).

The reported health state.

Per-indicator results with optional latency measurements.

Overall health status (worst of all participating indicators).

ISO 8601 timestamp of when the check was performed.

The caller-facing disclosure, served verbatim — required here, where ErrorResponseInit leaves it optional, because a hint that omitted it would fall back to the Error's own message.

The HTTP status to answer with. Must be an integer in 400–599; a hint outside that range is treated as ABSENT and the error takes the ordinary masked-500 path, because a hint says how an ERROR should be answered and a status the platform cannot serve would make the error handler itself throw.

Open a data source for entity bound to THIS transaction.

Delegates a web-standard Request to the registered IHttpAdapter.fetch. This works regardless of whether start() was called (Cloudflare Workers path: setHandler runs at start() time, fetch works without listen).

The global middleware pipeline.

Registers a plugin. Plugins register when the application starts, in dependency order.

The application router.

The application-scoped service registry.

Resolves plugins, builds the pipeline and router, and starts the server.

Stops the server and runs shutdown hooks.

Appends an entry to the audit trail. Entries are immutable once written.

Check if a principal has all of the specified permissions.

Check if a principal has any of the specified roles.

Check if a principal has a specific permission (direct or via role hierarchy).

Check if a principal has a specific role (including inherited roles).

Run configured passive strategies to authenticate a request.

Verify credentials for a login flow (e.g., username/password).

Attempt to authenticate the request.

Strategy name for identification.

Removes every entry (respecting the store's key prefix, if configured).

Removes a cached value.

Reads a cached value.

Reports whether a live entry exists.

Stores a value.

Executes a call through the breaker.

The current circuit state.

Registers a CLI command.

Executes a command.

Registers a handler for a command type.

Executes the command.

Reads a configuration value.

Reads a required configuration value.

Reports whether a key is present.

Creates a child scope. Scoped services resolve to one instance per scope; singletons are shared with the parent.

Reports whether a token is registered.

Registers a provider under a token.

Resolves an instance, constructing it (and its dependencies) as needed.

Increments the counter.

The command bus.

The query bus.

Begin a transaction, returning a handle that can open transaction-scoped data sources as well as commit and roll back.

Open a non-transactional data source for the named entity.

Execute a raw query in the backend's own dialect.

Count entities matching a filter.

Insert a new entity.

Delete an entity by primary key.

Find every entity matching the normalized query.

Find a single entity by its primary key value.

Find a page of entities by cursor pagination.

Update an existing entity by primary key.

Registers a handler for a custom decorator.

Resolves a hostname to IP address literals.

Resolves SRV records for a hostname.

ID of the aggregate that produced the event, when applicable.

The event payload.

Unique event ID.

When the event occurred.

Event type name (e.g. "UserCreated").

Aggregate version, for event-sourced aggregates.

Declares and validates environment variables.

Writes an error response in the configured format.

Publishes an event to every subscriber of its type.

Publishes multiple events, each to its own subscribers.

Subscribes to an event type.

Evaluates a flag.

Evaluates a flag, awaiting the backing provider when it can produce a more accurate answer asynchronously.

Creates a directory.

Reads a file.

Reads a file as a stream, optionally with byte range.

Lists directory entries.

Resolves a path to its canonical absolute form, following symlinks.

Removes a file or directory.

Returns file metadata.

Writes a file, creating it if absent.

Decrements the gauge.

Increments the gauge.

Sets the gauge to a specific value.

Report the number of cached documents.

The endpoint path where GraphQL is served.

Execute a GraphQL request.

Subscribe to a GraphQL operation (query, mutation, or subscription).

Registers a gRPC service definition with an optional implementation.

Whether gRPC dispatch is available.

Whether this service claims a request — that is, whether the request path lies inside the configured basePath.

Handles an incoming RPC request directly.

Whether this service refuses the request outright, decided from its HEADERS alone.

Registers a health indicator.

Performs the health check.

Indicator name, unique per application.

Runs all registered indicators and returns the aggregated report.

Runs only the liveness indicator (the built-in "self" indicator).

Runs all contributed indicators for readiness.

Registers a health indicator.

Upper bounds of the histogram buckets.

Records an observation (sample).

Stops the server gracefully.

The universal web-standard entry point. Accepts a web Request and returns a web Response. May be called without listen (e.g. Cloudflare Workers where export default { fetch: app.fetch } is the deploy path).

Binds the adapter's fetch to a real TCP socket.

Installs the framework request handler. Called once at start() time, after the middleware pipeline compiles and before any fetch or listen.

Installs a gRPC/Connect fetch handler.

Installs a WebSocket upgrade router. The adapter stores the router but does not consult it: since M70a the kernel's terminal handler resolves IWebSocketService and calls routeUpgrade itself, after the middleware pipeline has run without short-circuiting and before route matching — so an application catch-all cannot shadow an upgrade. What the adapter needs from this setter is the bare fact that a router was installed: Node attaches its raw upgrade listener only then.

Wraps the rest of the chain around one work item.

How many times this job has been attempted (1 on first delivery).

The job payload.

Transport headers carried with the job, mirroring MessageMetadata.headers so the two ingresses cannot drift on meaning: {} means the channel was read and carried nothing; absent means there was no channel.

Queue-assigned job ID.

The job name it was enqueued under.

Decodes a token without verifying it. Never trust the result for authorization decisions.

Signs a payload into a JWT.

Verifies a token's signature and validity window.

Runs immediately before the server starts listening.

Runs after shutdown completes.

Runs when an error escapes middleware or a handler.

Runs after all plugins have registered.

Runs during the owning plugin's registration.

Runs at the start of every request.

Runs after every response is produced.

Runs when shutdown begins — close connections, flush buffers here.

Runs at the very start of stop(), before the application begins refusing new requests.

Creates a child logger whose entries always include the bindings.

Logs at debug severity.

Logs at error severity.

Logs at fatal severity.

Logs at info severity.

The minimum level this logger emits.

Logs at trace severity.

Logs at warn severity.

Reports whether the mail transport is REACHABLE right now, distinct from whether the mailer was constructed. Optional: a mailer whose transport exposes no side-effect-free probe omits it, and so does an implementation that does not answer the question at all.

Sends an email.

Renders a named template and sends the result.

Opens the broker connection.

Closes the broker connection.

Reports whether the broker's backend is reachable right now, for the plugin's health indicator.

Publishes a message to a topic.

Sends a request to a topic and awaits a single correlated reply, providing brokered request-reply (RPC) over the message broker.

Registers a responder for a request topic. The handler's resolved value is sent back to the requesting caller, correlated to the originating request.

Subscribes to a topic.

Controller metadata keyed by class.

Route metadata lists keyed by controller class.

Service metadata keyed by class.

Human-readable description.

Metric name (Prometheus naming conventions).

Records an observation.

The metric instrument kind.

Registers a metric.

Gets or creates a counter.

Gets or creates a gauge.

Gets a metric by name.

Gets or creates a histogram.

Gets or creates a summary.

Handles the request.

Adds middleware to the global pipeline.

Return the tenant resolved for this request context, or undefined.

Create a tenant-scoped repository for the given entity type. Throws TenantNotResolvedError if no tenant is resolved.

Create a tenant-scoped repository for the given entity type, scoped to the tenant id GIVEN — no IRequestContext required. This is the entry point for non-HTTP work (an ingress behaviour, a queue processor, a scheduled job), where no request exists to resolve a tenant from; the caller reads the tenant id from the work item's own payload. Modelled on prefixCacheKey — this interface's other ctx-free, id-taking member.

Build a cache key that includes the tenant id, joined by the separator the plugin was configured with (cache.separator, default ':'). The separator is deliberately NOT a per-call argument: this method is the single home for separator resolution, so the middleware's ctx.state prefix and a caller's key can never disagree.

1-based delivery attempt. Present for 'queue' (from IJob.attempts) and 'scheduler' (from ScheduledJob.attempts); ABSENT for 'messaging' and 'websocket'. Absent means "this ingress cannot tell you" — never "first try": brokers redeliver and none tracks a delivery count, so a fabricated 1 would lie on a fifth redelivery.

Transport headers, populated on the 'messaging' arm from MessageMetadata.headers and on the 'queue' arm from IJob.headers. {} means the channel carried none; absent means there was no channel.

Which ingress path produced this work item — the discriminator a behaviour branches on.

The route the work is addressed by: the queue job name, the scheduler job name, the broker topic, or the WebSocket route path.

The native work item: an IJob, a ScheduledJob, the message payload, or the frame data.

Dispatches a notification on every requested channel.

Dispatches a notification on every requested channel and reports the settled outcome of each, without throwing.

Contributes a named schema to the generated OpenAPI document.

Begins a transaction.

Opens the underlying connection (pool).

Closes the underlying connection (pool).

Reports whether the adapter is connected and usable.

Wraps the next handler in the pipeline.

Capability tokens this plugin resolves lazily at runtime via ctx.services.get. Unlike IPlugin.dependencies, these are not required before this plugin registers and impose no ordering; but if no registered plugin provides one, the kernel emits a soft warn-level startup diagnostic (through the logger capability when one is registered), because the deferred lookups would otherwise fail only later, at request time.

Capability tokens that must be provided before this plugin registers.

Unique plugin name, lowercase kebab-case.

Capability tokens used when present, tolerated when absent.

Registration priority within the same dependency level; lower first.

Capability tokens this plugin registers.

Registers the plugin's services, middleware, routes, and hooks.

Plugin semver, matching its deno.json version.

The owning application.

CLI command registration.

Configuration access (from the ConfigPlugin, when registered).

DI container (from the DiPlugin, when registered).

Custom decorator registration.

Environment variable validation.

Health check registration.

Lifecycle hooks.

Logger (from the LoggerPlugin, when registered).

Decorator metadata store (from the DecoratorPlugin, when registered).

Metric registration.

Middleware pipeline.

OpenAPI contributions.

Options the application passed to this plugin's factory.

Route registration.

Runtime services. Non-optional by contract: a runtime provider is mandatory and the kernel registers it first, so every other plugin can rely on it during registration (see ARCHITECTURE.md §7).

Service registration and resolution.

Additional claims from the credential.

Stable subject identifier.

Permission names held by the principal.

Role names held by the principal.

Executes a query.

Registers a handler for a query type.

Executes the query.

Enqueues a job.

Schedules a recurring job.

Registers a processor for a job name.

Closes the underlying transport and drops every handler.

Opens the underlying transport. Idempotent.

Reports whether the transport's backend is reachable right now, for the plugin's health indicator.

This instance's identity, stamped onto every frame it publishes.

Publishes a frame to every other subscribed instance.

Registers a handler for frames arriving from other instances.

Reads the body as raw bytes.

Reads the body as a form, for both application/x-www-form-urlencoded and multipart/form-data requests.

Request headers (web-standard Headers).

Client IP address, when derivable.

Reads and parses the body as JSON.

The HTTP method.

The URL path component (no query string).

The undisturbed web-standard Request, preserved for WebSocket upgrade and gRPC dispatch after the middleware pipeline.

An abort signal that fires when the underlying HTTP connection is severed (client disconnect, timeout). Populated by the HTTP adapter from the native Request.signal; optional because injected / test requests may not carry one.

The resolved tenant, populated by the multi-tenancy middleware. Absent when no tenant could be resolved or multi-tenancy is not enabled.

Reads the body as text.

The full request URL.

The authenticated principal, populated by authentication middleware. Absent when the request is unauthenticated.

Unique request ID (generated or propagated by middleware).

Path parameters extracted by the router (e.g. :id).

Query string parameters.

The undisturbed web-standard Request, preserved for WebSocket upgrade and gRPC dispatch after the middleware pipeline.

The incoming request.

The response builder.

Service resolution (application-scoped plus request-scoped services).

An abort signal that fires when the underlying HTTP connection is severed (client disconnect, timeout). Populated by the kernel's request-context factory from the native Request.signal; falls back to a non-aborting sentinel so handlers always have a live signal to listen on.

High-resolution timestamp captured when the context was created.

Request-scoped state for passing data between middleware and handlers.

Wraps fn with the selected patterns and returns a hardened callable that reuses one shared pattern chain across invocations, so circuit-breaker and bulkhead state persist across calls.

Appends a response header, preserving any existing values for the same name rather than replacing them (unlike IResponse.header, which overwrites). This is the correct way to emit multiple headers of the same name — most notably several Set-Cookie headers (e.g. an access cookie plus a refresh cookie, or deleting several cookies at once).

Sets a response header.

Sends an HTML response.

Sends a JSON response.

Sends a redirect response.

Sends a raw byte response.

Returns a snapshot of the current response state (status, headers, body). Enables middleware to inspect the response after next() returns — required for transparent response caching.

Sets the response status code.

Sends a streaming response body.

Sends a plain-text response.

Registers a DELETE route.

Registers a GET route.

Creates a route group: routes registered inside the callback share the prefix and any group middleware.

Registers a HEAD route.

Returns all registered routes for introspection.

Registers an OPTIONS route.

Registers a PATCH route.

Registers a POST route.

Registers a PUT route.

Cancels a setInterval.

Cancels a setTimeout.

DNS resolution; absent on runtimes with no resolver API (edge platforms).

Environment variables. Always read env through this, never process.env.

Terminates the process.

File system access; absent on runtimes without one (edge platforms).

Returns the host name, when the runtime exposes one.

Returns a high-resolution monotonic timestamp in milliseconds, suitable for measuring durations.

Returns the current wall-clock time in milliseconds since the epoch.

Registers a handler for a process-termination signal, so an application can run app.stop() before the process dies.

Identifies the current runtime.

Generates cryptographically secure random bytes.

Schedules a repeating callback.

Schedules a one-shot callback.

Web Crypto SubtleCrypto for cryptographic operations.

Generates a UUID v4.

Returns the runtime version string.

Worker-thread spawning; absent on runtimes without threads (edge platforms).

Schedule a recurring job using a 5-field cron expression (UTC).

Schedule a one-shot delayed job.

Schedule a recurring job that fires every intervalMs milliseconds.

Return the next scheduled fire time as epoch milliseconds.

Pause a scheduled job without dropping its configuration.

Remove a scheduled job entirely.

Resume a paused job.

Retrieves a secret.

Reports whether a secret exists.

Rotates a secret to a new value.

Chooses one instance, skipping ejected ones.

Reports how a call to an instance went.

Lists every instance discovery knows for a service.

Formats IServiceDiscovery.pick's choice as an absolute URL.

Subscribes to instance-list changes for a service.

Resolves a service by capability token.

Resolves every provider registered for a multi-provider token.

Reports whether a capability is available.

Registers a service instance under a capability token.

Registers a lazy factory: the service is instantiated on first get and cached for subsequent lookups.

Removes a registration. On a multi-provider token this removes EVERY provider registered under it, not just the first.

Removes every key, keeping the session and its id.

Removes a key and marks the session for commit.

Ends the session: clears the data, deletes any stored entry, and instructs the client to drop the cookie.