@theokit/http 0.5.1 → 0.5.3

package/dist/theokit-plugin.js

@@ -1,31 +1,31 @@
 import {
   MiddlewareConsumerImpl,
   runMiddleware
-} from "./chunk-LWCNTZN6.js";
+} from "./chunk-I2ADDC6C.js";
 import {
   HttpDecoratorsConfigError,
   createExecutionContext,
   walkControllerMetadata
-} from "./chunk-QGB5YC4T.js";
+} from "./chunk-5T6NAG62.js";
 import {
   nodeIncomingToRequest,
   writeResponseToNode
-} from "./chunk-HLW7YKZE.js";
+} from "./chunk-IHUNGY64.js";
 import {
   runInterceptors
-} from "./chunk-U46H4CGF.js";
+} from "./chunk-UVV6THUP.js";
 import {
   runExceptionFilters
-} from "./chunk-34KOKJ5M.js";
+} from "./chunk-474GXFYG.js";
 import {
   ForbiddenException
-} from "./chunk-3PGQVQWG.js";
+} from "./chunk-AVSB6444.js";
 import {
   resolveOrNew
-} from "./chunk-LKNI6QEP.js";
+} from "./chunk-XPFP4PQO.js";
 import {
   __name
-} from "./chunk-7QVYU63E.js";
+} from "./chunk-Z56OUB3Z.js";
 
 // src/theokit-plugin.ts
 import "reflect-metadata";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theokit/http",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "NestJS-style decorators (@Controller, @Get, @Post, @Body, @UseGuards) bridging to TheoKit's defineRoute + defineMiddleware",
   "type": "module",
   "sideEffects": false,

package/dist/chunk-2CI44FAT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/app.ts","../src/static.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-regexp, complexity, sonarjs/cognitive-complexity, max-depth, sonarjs/no-collapsible-if */\nimport 'reflect-metadata'\n\nimport { createExecutionContext, type CanActivate } from './bridge/execution-context.js'\nimport { createNodeAdapter } from './bridge/runtime/node.js'\nimport type { ServerHandle } from './bridge/runtime/types.js'\nimport { walkControllerMetadata, type WalkResult } from './bridge/walk-metadata.js'\nimport type { ParamEntry } from './decorators/params.js'\nimport { ForbiddenException, HttpException } from './exceptions/http-exception.js'\nimport { createStaticHandler } from './static.js'\n\n/**\n * TheoApp — NestJS/Spring Boot-style application bootstrap.\n *\n * Internally uses Web Standard Request/Response pipeline.\n * Node adapter converts at the HTTP server boundary.\n */\n\n/** Readiness check — async function returning health status. */\nexport type ReadinessCheck = () => Promise<{ name: string; healthy: boolean; message?: string }>\n\nexport interface TheoAppOptions {\n  /** Controller classes decorated with @Controller. */\n  controllers: Function[]\n  /** Agent classes decorated with @Agent — auto-wired with routes + SSE + tools. */\n  agents?: Function[]\n  /** @Module class for structured DI. */\n  module?: Function\n  /** Provider/toolbox classes — instantiated and injected into controllers + agents. */\n  providers?: Function[]\n  /** LLM API key for agent execution (reads OPENROUTER_API_KEY env if not set). */\n  llmApiKey?: string\n  /** LLM model override (default: from @Agent({ model }) metadata). */\n  llmModel?: string\n  /** Agent stream factory override (for testing or custom SDK wiring). */\n  agentStreamFactory?: (\n    walk: unknown,\n    tools: unknown[],\n    apiKey: string,\n    model?: string,\n  ) => (message: string, sessionId: string) => AsyncIterable<unknown>\n  /** HTML string to serve at GET / (inline frontend). */\n  html?: string\n  /** Directory for static files (CSS, JS, images, fonts). Default: 'public'. Set false to disable. */\n  staticDir?: string | false\n  /** Readiness checks for GET /__theo/ready (K8s readiness probe). */\n  readinessChecks?: ReadinessCheck[]\n  /** Custom health endpoint path (default: '/__theo/health'). */\n  healthPath?: string\n  /** Custom readiness endpoint path (default: '/__theo/ready'). */\n  readyPath?: string\n}\n\ninterface RouteEntry {\n  walk: WalkResult\n  instance: object\n  /** Pre-compiled regex + param names (Elysia-inspired: compile once at create, not per-request). */\n  compiledPattern?: RegExp\n  compiledParamNames?: string[]\n  /** Whether handler needs body parsing (skip for GET/DELETE without @Body). */\n  needsBody?: boolean\n}\n\nexport class TheoApp {\n  private serverHandle: ServerHandle\n  private readonly routes: RouteEntry[] = []\n  private frontendHtml?: string\n  private staticHandler?: (request: Request) => Promise<Response | null>\n  private readonly startTime = Date.now()\n  private readonly healthPath: string\n  private readonly readyPath: string\n  private readonly readinessChecks: ReadinessCheck[]\n\n  private constructor(opts?: Pick<TheoAppOptions, 'readinessChecks' | 'healthPath' | 'readyPath'>) {\n    const hp = opts?.healthPath ?? '/__theo/health'\n    const rp = opts?.readyPath ?? '/__theo/ready'\n    // Security: prevent health paths from colliding with user API routes\n    if (hp.startsWith('/api/'))\n      throw new Error(\n        `[TheoApp] healthPath \"${hp}\" must not start with /api/ — would collide with user routes`,\n      )\n    if (rp.startsWith('/api/'))\n      throw new Error(\n        `[TheoApp] readyPath \"${rp}\" must not start with /api/ — would collide with user routes`,\n      )\n    this.healthPath = hp\n    this.readyPath = rp\n    this.readinessChecks = opts?.readinessChecks ?? []\n    const adapter = createNodeAdapter()\n    this.serverHandle = adapter.createServer((request) => this.handleRequest(request))\n  }\n\n  /**\n   * Create a TheoKit application with Spring Boot-style DI.\n   *\n   * EC-7: async because Container may resolve async factories (Agent.create).\n   * EC-2: Registration order guaranteed: providers → controllers → agents.\n   */\n  static async create(opts: TheoAppOptions): Promise<TheoApp> {\n    const app = new TheoApp(opts)\n\n    // ── DI Container (replaces manual Map<Function, object>) ──\n    // Uses @theokit/di Container for: scopes, lifecycle, async, typed errors.\n    // Fallback to manual resolution when @theokit/di is not available.\n    const registry = new Map<Function, object>()\n\n    // 1. Module resolution (@Module metadata)\n    if (opts.module) {\n      const moduleMeta = Reflect.getMetadata('usetheo:di:module', opts.module)\n      if (moduleMeta) {\n        const allModules = [opts.module, ...(moduleMeta.imports ?? [])]\n        for (const Mod of allModules) {\n          const meta = Reflect.getMetadata('usetheo:di:module', Mod)\n          if (!meta) continue\n          for (const Prov of (meta.providers ?? []) as Function[]) {\n            if (!registry.has(Prov)) {\n              registry.set(Prov, new (Prov as new () => object)())\n            }\n          }\n        }\n      }\n    }\n\n    // 2. Inline providers (EC-2: BEFORE controllers and agents)\n    if (opts.providers) {\n      for (const Prov of opts.providers) {\n        if (!registry.has(Prov)) {\n          registry.set(Prov, new (Prov as new () => object)())\n        }\n      }\n    }\n\n    // 3. Controllers with DI\n    for (const Controller of opts.controllers) {\n      const paramTypes: Function[] = Reflect.getMetadata('design:paramtypes', Controller) ?? []\n      const args = paramTypes.map((pt: Function) => {\n        const dep = registry.get(pt)\n        if (!dep) {\n          throw new Error(\n            `[TheoApp] Cannot resolve ${pt.name} for ${Controller.name}. ` +\n              `Add ${pt.name} to providers (or to @Module({ providers: [...] })).`,\n          )\n        }\n        return dep\n      })\n      const instance = new (Controller as new (...a: unknown[]) => object)(...args)\n\n      // Lifecycle: call @PostConstruct if present\n      const postConstruct = Reflect.getMetadata('usetheo:di:post-construct', Controller)\n      if (\n        postConstruct &&\n        typeof (instance as Record<string, Function>)[postConstruct] === 'function'\n      ) {\n        const result = (instance as Record<string, Function>)[postConstruct]()\n        if (result instanceof Promise) await result // EC-1: await async PostConstruct\n      }\n\n      const walks = walkControllerMetadata(Controller)\n      for (const w of walks) {\n        app.routes.push({ walk: w, instance })\n      }\n    }\n\n    // Sort: static before parameterized\n    app.routes.sort((a, b) => {\n      const aP = a.walk.fullPath.includes(':')\n      const bP = b.walk.fullPath.includes(':')\n      if (aP !== bP) return aP ? 1 : -1\n      return 0\n    })\n\n    // Pre-compile route patterns (Elysia-inspired: regex built once, not per-request)\n    for (const entry of app.routes) {\n      const paramNames: string[] = []\n      const regexStr = entry.walk.fullPath.replace(/:(\\w+)/g, (_m, name: string) => {\n        paramNames.push(name)\n        return '([^/]+)'\n      })\n      entry.compiledPattern = new RegExp(`^${regexStr}$`)\n      entry.compiledParamNames = paramNames\n      // Determine if handler needs body parsing (skip if no @Body decorator)\n      entry.needsBody = entry.walk.paramEntries.some((p) => p.source === 'body')\n    }\n\n    // Store frontend HTML\n    if (opts.html) app.frontendHtml = opts.html\n\n    // Static file serving from public/ directory\n    if (opts.staticDir !== false) {\n      app.staticHandler = createStaticHandler({ root: opts.staticDir ?? 'public' })\n    }\n\n    // 4. Auto-wire agents (EC-2: AFTER providers and controllers)\n    // The framework handles EVERYTHING — walk, compile, mount, stream.\n    // Consumer writes: agents: [MyAgent] — and that's it.\n    if (opts.agents?.length) {\n      await app.autoWireAgents(opts.agents, registry, opts)\n    }\n\n    return app\n  }\n\n  async listen(port: number): Promise<void> {\n    return new Promise((resolve) => {\n      this.serverHandle.listen(port, () => {\n        console.log(`TheoKit app listening on http://localhost:${port}`)\n        resolve()\n      })\n    })\n  }\n\n  getServerHandle(): ServerHandle {\n    return this.serverHandle\n  }\n\n  async close(): Promise<void> {\n    return new Promise((resolve) => {\n      this.serverHandle.close(() => {\n        resolve()\n      })\n    })\n  }\n\n  // ── Auto-wire agents (the \"SpringApplication.run()\" moment) ──\n\n  private agentRoutes: {\n    method: string\n    pattern: RegExp\n    paramNames: string[]\n    handler: (request: Request) => Promise<Response>\n    guards: Function[]\n    agentClass: Function\n    methodName: string | symbol\n  }[] = []\n\n  private async autoWireAgents(\n    agentClasses: Function[],\n    registry: Map<Function, object>,\n    opts: TheoAppOptions,\n  ) {\n    // Dynamic import — @theokit/agents is optional peer dependency\n    // SECURITY: new Function used for dynamic import of optional peer dep.\n    // Argument is HARDCODED ('@theokit/agents'), never user input. Safe.\n    // eslint-disable-next-line @typescript-eslint/no-implied-eval -- dynamic import avoids compile-time dependency on optional peer\n    const importFn = new Function('specifier', 'return import(specifier)') as (\n      s: string,\n    ) => Promise<Record<string, Function>>\n    let walkAgentMetadata: Function,\n      compileAgent: Function,\n      generateAgentRoutes: Function,\n      getMixins: Function,\n      createSdkAgentStreamFn: Function\n    try {\n      const mod = await importFn('@theokit/agents')\n      walkAgentMetadata = mod.walkAgentMetadata\n      compileAgent = mod.compileAgent\n      generateAgentRoutes = mod.generateAgentRoutes\n      getMixins = mod.getMixins\n      createSdkAgentStreamFn = mod.createSdkAgentStream\n    } catch {\n      throw new Error(\n        '[TheoApp] @theokit/agents is required when agents[] is provided. Install: npm install @theokit/agents',\n      )\n    }\n\n    const apiKey = opts.llmApiKey ?? process.env.OPENROUTER_API_KEY ?? ''\n\n    for (const AgentClass of agentClasses) {\n      // 1. Walk metadata (decorators → structured data)\n      const mixins = getMixins(AgentClass)\n      const allToolboxes = [...mixins]\n\n      // Also check providers for @Toolbox classes\n      for (const [Cls] of registry) {\n        if (Reflect.getMetadata(Symbol.for('theokit:agents:toolbox'), Cls)) {\n          if (!allToolboxes.includes(Cls)) allToolboxes.push(Cls)\n        }\n      }\n\n      const walk = walkAgentMetadata(AgentClass, allToolboxes)\n\n      // 2. Resolve toolbox instances from registry (DI)\n      const toolboxInstances = new Map<Function, object>()\n      for (const tb of walk.toolboxes) {\n        let instance = registry.get(tb.class)\n        if (!instance) {\n          instance = new (tb.class as new () => object)()\n          registry.set(tb.class, instance)\n        }\n        toolboxInstances.set(tb.class, instance)\n      }\n\n      // 3. Compile tools (decorator metadata → defineTool-compatible)\n      const compiled = compileAgent(walk, toolboxInstances)\n\n      // 4. Create SDK agent stream factory\n      let createRun: (message: string, sessionId: string) => AsyncIterable<unknown>\n\n      if (opts.agentStreamFactory) {\n        createRun = opts.agentStreamFactory(walk, compiled.tools, apiKey, opts.llmModel)\n      } else if (apiKey) {\n        // SDK adapter: bridges @theokit/agents decorators → @theokit/sdk runtime\n        createRun = createSdkAgentStreamFn(walk, compiled.tools, apiKey, opts.llmModel) as (\n          m: string,\n          s: string,\n        ) => AsyncIterable<unknown>\n      } else {\n        createRun = this.createFallbackStream(walk.agentConfig.name, apiKey)\n      }\n\n      // 5. Generate routes (POST /chat, GET /runs/:id)\n      const routes = generateAgentRoutes({\n        walkResult: walk,\n        compiledOptions: compiled,\n        createRun: createRun as (\n          message: string,\n          sessionId: string,\n        ) => AsyncIterable<{ type: string; [k: string]: unknown }>,\n      })\n\n      // 6. Mount routes\n      for (const route of routes) {\n        const paramNames: string[] = []\n        const regexStr = route.path.replace(/:(\\w+)/g, (_m: string, name: string) => {\n          paramNames.push(name)\n          return '([^/]+)'\n        })\n        this.agentRoutes.push({\n          method: route.method,\n          pattern: new RegExp(`^${regexStr}$`),\n          paramNames,\n          handler: route.handler,\n          guards: walk.guards ?? [],\n          agentClass: AgentClass,\n          methodName: walk.mainLoop?.propertyKey ?? 'run',\n        })\n      }\n\n      console.log(\n        `  🤖 Agent \"${walk.agentConfig.name}\" mounted at ${walk.route}/chat (${compiled.tools.length} tools)`,\n      )\n    }\n  }\n\n  private async handleReadinessCheck(): Promise<Response> {\n    if (this.readinessChecks.length === 0) {\n      return jsonResponse(200, { status: 'ready', checks: [] })\n    }\n    const results = await Promise.all(\n      this.readinessChecks.map(async (check) => {\n        try {\n          return await Promise.race([\n            check(),\n            new Promise<{ name: string; healthy: boolean; message?: string }>((resolve) =>\n              setTimeout(\n                () =>\n                  resolve({\n                    name: 'unknown',\n                    healthy: false,\n                    message: 'Readiness check timed out (5s)',\n                  }),\n                5000,\n              ),\n            ),\n          ])\n        } catch (err) {\n          return {\n            name: 'unknown',\n            healthy: false,\n            message: err instanceof Error ? err.message : 'Check failed',\n          }\n        }\n      }),\n    )\n    const allHealthy = results.every((r) => r.healthy)\n    return jsonResponse(allHealthy ? 200 : 503, {\n      status: allHealthy ? 'ready' : 'not_ready',\n      checks: results,\n    })\n  }\n\n  private createFallbackStream(agentName: string, apiKey: string) {\n    const msg = !apiKey\n      ? 'Set OPENROUTER_API_KEY environment variable or pass llmApiKey to TheoApp.create()'\n      : 'Pass agentStreamFactory to TheoApp.create() to connect your LLM provider'\n    return (_message: string, _sessionId: string) => {\n      const events = [\n        { type: 'run_started', runId: `run-${Date.now()}`, agentName },\n        { type: 'error', code: 'AGENT_NOT_WIRED', message: msg, retryable: false },\n      ]\n      return {\n        [Symbol.asyncIterator]: () => {\n          let i = 0\n          return {\n            next: () =>\n              Promise.resolve(\n                i < events.length\n                  ? { value: events[i++], done: false as const }\n                  : { value: undefined, done: true as const },\n              ),\n          }\n        },\n      }\n    }\n  }\n\n  // ── Web Standard request handler ──────────────────\n\n  private async handleRequest(request: Request): Promise<Response> {\n    const pathname = new URL(request.url).pathname\n\n    // ── Health & Readiness probes (bypass guards/interceptors) ──\n    if (request.method === 'GET') {\n      if (pathname === this.healthPath) {\n        return jsonResponse(200, {\n          status: 'ok',\n          uptime: (Date.now() - this.startTime) / 1000,\n          timestamp: Date.now(),\n        })\n      }\n      if (pathname === this.readyPath) {\n        return this.handleReadinessCheck()\n      }\n    }\n\n    // Bug #8: Serve frontend HTML at GET /\n    if (request.method === 'GET') {\n      if ((pathname === '/' || pathname === '/index.html') && this.frontendHtml) {\n        return new Response(this.frontendHtml, {\n          status: 200,\n          headers: { 'content-type': 'text/html; charset=utf-8' },\n        })\n      }\n    }\n\n    // Static files from public/ (CSS, JS, images, fonts)\n    if (this.staticHandler && request.method === 'GET') {\n      const staticResponse = await this.staticHandler(request)\n      if (staticResponse) return staticResponse\n    }\n\n    // Agent routes (auto-wired — checked first, with guard enforcement per Bug #4)\n    for (const route of this.agentRoutes) {\n      if (request.method.toUpperCase() === route.method && route.pattern.test(pathname)) {\n        // Bug #4 fix: enforce @UseGuards on agent routes (same pipeline as controllers)\n        if (route.guards.length > 0) {\n          const ctx = createExecutionContext(request, route.agentClass, route.methodName)\n          for (const GuardCtor of route.guards) {\n            const guard = new (GuardCtor as new () => CanActivate)()\n            if (!(await guard.canActivate(ctx))) {\n              const ex = new ForbiddenException('Forbidden resource')\n              return jsonResponse(ex.statusCode, ex.toJSON())\n            }\n          }\n        }\n        return route.handler(request)\n      }\n    }\n\n    const url = new URL(request.url)\n    const method = request.method.toUpperCase()\n\n    const match = this.findRoute(method, url.pathname)\n    if (!match) {\n      return jsonResponse(404, {\n        error: { code: 'NOT_FOUND', message: `No route for ${method} ${url.pathname}` },\n      })\n    }\n\n    const { entry, params } = match\n\n    try {\n      // Guards\n      const ctx = createExecutionContext(\n        request,\n        entry.instance.constructor,\n        entry.walk.propertyKey,\n      )\n      for (const GuardCtor of entry.walk.guards) {\n        const guard = new (GuardCtor as new () => CanActivate)()\n        if (!(await guard.canActivate(ctx))) {\n          const ex = new ForbiddenException('Forbidden resource')\n          return jsonResponse(ex.statusCode, ex.toJSON())\n        }\n      }\n\n      // Body — skip parsing entirely if handler has no @Body decorator (Elysia-inspired lazy parsing)\n      let body: unknown\n      if (entry.needsBody && ['POST', 'PUT', 'PATCH'].includes(method)) {\n        try {\n          const text = await request.text()\n          body = text ? JSON.parse(text) : undefined\n        } catch {\n          body = undefined\n        }\n\n        if (entry.walk.bodySchema && body !== undefined) {\n          const result = entry.walk.bodySchema.safeParse(body)\n          if (!result.success) {\n            return jsonResponse(422, {\n              error: { code: 'VALIDATION_ERROR', issues: result.error.issues },\n            })\n          }\n          body = result.data\n        }\n      }\n\n      // Args\n      const args = this.buildArgs(\n        entry.walk.paramEntries,\n        request,\n        body,\n        params,\n        Object.fromEntries(url.searchParams),\n      )\n\n      // Redirect\n      if (entry.walk.redirect) {\n        return new Response(null, {\n          status: entry.walk.redirect.status,\n          headers: { location: entry.walk.redirect.url },\n        })\n      }\n\n      // Handler — wrapped by interceptor chain (Bug #2 fix)\n      const handlerFn = (entry.instance as Record<string | symbol, Function>)[\n        entry.walk.propertyKey\n      ]\n\n      let result: unknown\n      if (entry.walk.interceptors.length > 0) {\n        // Import runInterceptors dynamically to avoid circular dep\n        const { runInterceptors } = await import('./bridge/interceptor-chain.js')\n        result = await runInterceptors(\n          entry.walk.interceptors,\n          () => handlerFn.apply(entry.instance, args) as Promise<unknown>,\n          request,\n        )\n      } else {\n        result = await handlerFn.apply(entry.instance, args)\n      }\n\n      return buildResponse(result, entry.walk, method)\n    } catch (err) {\n      // Exception filters (Bug #2 fix — filters also wired)\n      if (entry.walk.filters.length > 0) {\n        const { runExceptionFilters } = await import('./bridge/exception-filter-chain.js')\n        return runExceptionFilters(err, entry.walk.filters, request)\n      }\n      // Fallback: HttpException subclasses (Bug #3 fix)\n      if (err instanceof HttpException) {\n        return jsonResponse(err.statusCode, err.toJSON())\n      }\n      // Security: never leak raw error messages to clients\n      console.error('[theokit] Internal error:', err instanceof Error ? err.message : err)\n      return jsonResponse(500, {\n        error: { code: 'INTERNAL_SERVER_ERROR', message: 'Internal Server Error' },\n      })\n    }\n  }\n\n  private findRoute(method: string, pathname: string) {\n    for (const entry of this.routes) {\n      if (entry.walk.verb !== 'ALL' && entry.walk.verb !== method) continue\n      // Use pre-compiled regex (built once at create time, not per-request)\n      const match = entry.compiledPattern!.exec(pathname)\n      if (!match) continue\n      const params: Record<string, string> = {}\n      entry.compiledParamNames!.forEach((name, i) => {\n        params[name] = match[i + 1]\n      })\n      return { entry, params }\n    }\n    return null\n  }\n\n  private buildArgs(\n    entries: ParamEntry[],\n    request: Request,\n    body: unknown,\n    params: Record<string, string>,\n    query: Record<string, string>,\n  ): unknown[] {\n    if (entries.length === 0) return []\n    const max = Math.max(...entries.map((p) => p.index))\n    const args: unknown[] = Array.from({ length: max + 1 }, () => undefined)\n    for (const p of entries) {\n      switch (p.source) {\n        case 'req':\n          args[p.index] = request\n          break\n        case 'body':\n          args[p.index] = p.key ? (body as Record<string, unknown>)[p.key] : body\n          break\n        case 'param':\n          args[p.index] = p.key ? params[p.key] : params\n          break\n        case 'query':\n          args[p.index] = p.key ? query[p.key] : query\n          break\n        case 'headers':\n          args[p.index] = p.key\n            ? request.headers.get(p.key.toLowerCase())\n            : Object.fromEntries(request.headers.entries())\n          break\n        case 'ip':\n          args[p.index] = request.headers.get('x-forwarded-for') ?? '127.0.0.1'\n          break\n        default:\n          args[p.index] = undefined\n      }\n    }\n    return args\n  }\n}\n\nfunction jsonResponse(status: number, body: unknown): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\nfunction buildResponse(result: unknown, walk: WalkResult, method: string): Response {\n  const status = walk.status ?? (method === 'POST' ? 201 : 200)\n  const headers: Record<string, string> = { 'content-type': 'application/json' }\n  for (const [n, v] of walk.headers) headers[n.toLowerCase()] = v\n\n  if (result === undefined || result === null) {\n    return new Response(null, { status: status === 200 ? 204 : status, headers })\n  }\n  if (typeof result === 'string') {\n    headers['content-type'] = 'text/plain'\n    return new Response(result, { status, headers })\n  }\n  return new Response(JSON.stringify(result), { status, headers })\n}\n","/**\n * Static file serving — runtime-agnostic (Node/Bun/Deno).\n *\n * Serves files from a root directory with:\n * - MIME type detection from extension\n * - Path traversal prevention (regex from Hono)\n * - Directory → index.html fallback\n * - Web Standard Response (no node:http)\n */\n\n// ── MIME types (subset from Hono — covers web essentials) ──\n\nconst MIME_TYPES: Record<string, string> = {\n  // Text\n  css: 'text/css; charset=utf-8',\n  html: 'text/html; charset=utf-8',\n  htm: 'text/html; charset=utf-8',\n  js: 'text/javascript; charset=utf-8',\n  mjs: 'text/javascript; charset=utf-8',\n  json: 'application/json; charset=utf-8',\n  txt: 'text/plain; charset=utf-8',\n  xml: 'application/xml; charset=utf-8',\n  csv: 'text/csv; charset=utf-8',\n  md: 'text/markdown; charset=utf-8',\n\n  // Images\n  png: 'image/png',\n  jpg: 'image/jpeg',\n  jpeg: 'image/jpeg',\n  gif: 'image/gif',\n  svg: 'image/svg+xml; charset=utf-8',\n  webp: 'image/webp',\n  avif: 'image/avif',\n  ico: 'image/x-icon',\n  bmp: 'image/bmp',\n\n  // Fonts\n  woff: 'font/woff',\n  woff2: 'font/woff2',\n  ttf: 'font/ttf',\n  otf: 'font/otf',\n  eot: 'application/vnd.ms-fontobject',\n\n  // Media\n  mp3: 'audio/mpeg',\n  mp4: 'video/mp4',\n  webm: 'video/webm',\n  ogg: 'audio/ogg',\n  wav: 'audio/wav',\n\n  // Documents\n  pdf: 'application/pdf',\n  zip: 'application/zip',\n  gz: 'application/gzip',\n  wasm: 'application/wasm',\n\n  // Manifest\n  webmanifest: 'application/manifest+json',\n  map: 'application/json',\n}\n\n/** Detect MIME type from file extension. */\nexport function getMimeType(filename: string): string {\n  const match = filename.match(/\\.([a-zA-Z0-9]+)$/)\n  if (!match) return 'application/octet-stream'\n  return MIME_TYPES[match[1].toLowerCase()] ?? 'application/octet-stream'\n}\n\n/**\n * Path traversal prevention — regex from Hono serve-static.\n * Blocks: ../, \\..\\, //, \\\\, and any directory escape attempt.\n */\nconst TRAVERSAL_REGEX = /(?:^|[/\\\\])\\.{1,2}(?:$|[/\\\\])|[/\\\\]{2,}/\n\n/** Check if a path is safe (no traversal attacks). */\nexport function isSafePath(path: string): boolean {\n  return !TRAVERSAL_REGEX.test(path)\n}\n\n// ── Runtime-agnostic file reading ──\n\ninterface FileResult {\n  content: Uint8Array\n  isDirectory: boolean\n}\n\nasync function readFileUniversal(path: string): Promise<FileResult | null> {\n  const g = globalThis as Record<string, unknown>\n\n  // Bun\n  if (g.Bun) {\n    try {\n      const BunRT = g.Bun as { file: (p: string) => { exists: () => Promise<boolean>; arrayBuffer: () => Promise<ArrayBuffer> } }\n      const file = BunRT.file(path)\n      if (await file.exists()) {\n        const buf = await file.arrayBuffer()\n        return { content: new Uint8Array(buf), isDirectory: false }\n      }\n      return null\n    } catch {\n      return null\n    }\n  }\n\n  // Deno\n  if (g.Deno) {\n    try {\n      const DenoRT = g.Deno as { stat: (p: string) => Promise<{ isDirectory: boolean }>; readFile: (p: string) => Promise<Uint8Array> }\n      const stat = await DenoRT.stat(path)\n      if (stat.isDirectory) return { content: new Uint8Array(), isDirectory: true }\n      const content = await DenoRT.readFile(path)\n      return { content, isDirectory: false }\n    } catch {\n      return null\n    }\n  }\n\n  // Node.js\n  try {\n    const fs = await import('node:fs')\n    const stat = fs.statSync(path)\n    if (stat.isDirectory()) return { content: new Uint8Array(), isDirectory: true }\n    const buf = fs.readFileSync(path)\n    return { content: new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength), isDirectory: false }\n  } catch {\n    return null\n  }\n}\n\n// ── Static file middleware ──\n\nexport interface StaticOptions {\n  /** Root directory for static files. Default: 'public' */\n  root?: string\n  /** Custom MIME types (merged with defaults). */\n  mimes?: Record<string, string>\n  /** Max-age for Cache-Control header in seconds. Default: 0 (no cache in dev). */\n  maxAge?: number\n}\n\n/**\n * Create a static file handler.\n *\n * Returns a function that takes a Request and returns a Response if the\n * file exists in the root directory, or null if not found.\n *\n * Usage in TheoApp:\n * ```ts\n * const servePublic = createStaticHandler({ root: 'public' })\n * // In request handler: const res = await servePublic(request)\n * ```\n */\nexport function createStaticHandler(options: StaticOptions = {}) {\n  const root = options.root ?? 'public'\n  const maxAge = options.maxAge ?? 0\n  const customMimes = options.mimes ?? {}\n\n  return async (request: Request): Promise<Response | null> => {\n    // Only serve GET/HEAD\n    if (request.method !== 'GET' && request.method !== 'HEAD') return null\n\n    const url = new URL(request.url)\n    let pathname = url.pathname\n\n    // Decode URI\n    try {\n      pathname = decodeURIComponent(pathname)\n    } catch {\n      return null\n    }\n\n    // Security: path traversal check\n    if (!isSafePath(pathname)) return null\n\n    // Skip API routes and known framework paths\n    if (pathname.startsWith('/api/') || pathname.startsWith('/@theo/')) return null\n\n    // Build file path: root + pathname\n    const filePath = (root + pathname).replace(/\\/+/g, '/')\n\n    // Try to read file\n    let result = await readFileUniversal(filePath)\n\n    // Directory → try index.html\n    if (result?.isDirectory) {\n      const indexPath = (filePath + '/index.html').replace(/\\/+/g, '/')\n      result = await readFileUniversal(indexPath)\n    }\n\n    if (!result || result.isDirectory) return null\n\n    // Detect MIME type\n    const mimeType = customMimes[pathname.split('.').pop()?.toLowerCase() ?? '']\n      ?? getMimeType(pathname)\n\n    // Build response headers\n    const headers: Record<string, string> = {\n      'Content-Type': mimeType,\n      'Content-Length': String(result.content.byteLength),\n    }\n\n    if (maxAge > 0) {\n      headers['Cache-Control'] = `public, max-age=${maxAge}`\n    }\n\n    // HEAD: headers only\n    if (request.method === 'HEAD') {\n      return new Response(null, { status: 200, headers })\n    }\n\n    return new Response(result.content as unknown as BodyInit, { status: 200, headers })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AACA,OAAO;;;ACWP,IAAMA,aAAqC;;EAEzCC,KAAK;EACLC,MAAM;EACNC,KAAK;EACLC,IAAI;EACJC,KAAK;EACLC,MAAM;EACNC,KAAK;EACLC,KAAK;EACLC,KAAK;EACLC,IAAI;;EAGJC,KAAK;EACLC,KAAK;EACLC,MAAM;EACNC,KAAK;EACLC,KAAK;EACLC,MAAM;EACNC,MAAM;EACNC,KAAK;EACLC,KAAK;;EAGLC,MAAM;EACNC,OAAO;EACPC,KAAK;EACLC,KAAK;EACLC,KAAK;;EAGLC,KAAK;EACLC,KAAK;EACLC,MAAM;EACNC,KAAK;EACLC,KAAK;;EAGLC,KAAK;EACLC,KAAK;EACLC,IAAI;EACJC,MAAM;;EAGNC,aAAa;EACbC,KAAK;AACP;AAGO,SAASC,YAAYC,UAAgB;AAC1C,QAAMC,QAAQD,SAASC,MAAM,mBAAA;AAC7B,MAAI,CAACA,MAAO,QAAO;AACnB,SAAOtC,WAAWsC,MAAM,CAAA,EAAGC,YAAW,CAAA,KAAO;AAC/C;AAJgBH;AAUhB,IAAMI,kBAAkB;AAGjB,SAASC,WAAWC,MAAY;AACrC,SAAO,CAACF,gBAAgBG,KAAKD,IAAAA;AAC/B;AAFgBD;AAWhB,eAAeG,kBAAkBF,MAAY;AAC3C,QAAMG,IAAIC;AAGV,MAAID,EAAEE,KAAK;AACT,QAAI;AACF,YAAMC,QAAQH,EAAEE;AAChB,YAAME,OAAOD,MAAMC,KAAKP,IAAAA;AACxB,UAAI,MAAMO,KAAKC,OAAM,GAAI;AACvB,cAAMC,MAAM,MAAMF,KAAKG,YAAW;AAClC,eAAO;UAAEC,SAAS,IAAIC,WAAWH,GAAAA;UAAMI,aAAa;QAAM;MAC5D;AACA,aAAO;IACT,QAAQ;AACN,aAAO;IACT;EACF;AAGA,MAAIV,EAAEW,MAAM;AACV,QAAI;AACF,YAAMC,SAASZ,EAAEW;AACjB,YAAME,OAAO,MAAMD,OAAOC,KAAKhB,IAAAA;AAC/B,UAAIgB,KAAKH,YAAa,QAAO;QAAEF,SAAS,IAAIC,WAAAA;QAAcC,aAAa;MAAK;AAC5E,YAAMF,UAAU,MAAMI,OAAOE,SAASjB,IAAAA;AACtC,aAAO;QAAEW;QAASE,aAAa;MAAM;IACvC,QAAQ;AACN,aAAO;IACT;EACF;AAGA,MAAI;AACF,UAAMK,KAAK,MAAM,OAAO,IAAA;AACxB,UAAMF,OAAOE,GAAGC,SAASnB,IAAAA;AACzB,QAAIgB,KAAKH,YAAW,EAAI,QAAO;MAAEF,SAAS,IAAIC,WAAAA;MAAcC,aAAa;IAAK;AAC9E,UAAMJ,MAAMS,GAAGE,aAAapB,IAAAA;AAC5B,WAAO;MAAEW,SAAS,IAAIC,WAAWH,IAAIY,QAAQZ,IAAIa,YAAYb,IAAIc,UAAU;MAAGV,aAAa;IAAM;EACnG,QAAQ;AACN,WAAO;EACT;AACF;AAzCeX;AAkER,SAASsB,oBAAoBC,UAAyB,CAAC,GAAC;AAC7D,QAAMC,OAAOD,QAAQC,QAAQ;AAC7B,QAAMC,SAASF,QAAQE,UAAU;AACjC,QAAMC,cAAcH,QAAQI,SAAS,CAAC;AAEtC,SAAO,OAAOC,YAAAA;AAEZ,QAAIA,QAAQC,WAAW,SAASD,QAAQC,WAAW,OAAQ,QAAO;AAElE,UAAMC,MAAM,IAAIC,IAAIH,QAAQE,GAAG;AAC/B,QAAIE,WAAWF,IAAIE;AAGnB,QAAI;AACFA,iBAAWC,mBAAmBD,QAAAA;IAChC,QAAQ;AACN,aAAO;IACT;AAGA,QAAI,CAACnC,WAAWmC,QAAAA,EAAW,QAAO;AAGlC,QAAIA,SAASE,WAAW,OAAA,KAAYF,SAASE,WAAW,SAAA,EAAY,QAAO;AAG3E,UAAMC,YAAYX,OAAOQ,UAAUI,QAAQ,QAAQ,GAAA;AAGnD,QAAIC,SAAS,MAAMrC,kBAAkBmC,QAAAA;AAGrC,QAAIE,QAAQ1B,aAAa;AACvB,YAAM2B,aAAaH,WAAW,eAAeC,QAAQ,QAAQ,GAAA;AAC7DC,eAAS,MAAMrC,kBAAkBsC,SAAAA;IACnC;AAEA,QAAI,CAACD,UAAUA,OAAO1B,YAAa,QAAO;AAG1C,UAAM4B,WAAWb,YAAYM,SAASQ,MAAM,GAAA,EAAKC,IAAG,GAAI9C,YAAAA,KAAiB,EAAA,KACpEH,YAAYwC,QAAAA;AAGjB,UAAMU,UAAkC;MACtC,gBAAgBH;MAChB,kBAAkBI,OAAON,OAAO5B,QAAQY,UAAU;IACpD;AAEA,QAAII,SAAS,GAAG;AACdiB,cAAQ,eAAA,IAAmB,mBAAmBjB,MAAAA;IAChD;AAGA,QAAIG,QAAQC,WAAW,QAAQ;AAC7B,aAAO,IAAIe,SAAS,MAAM;QAAEC,QAAQ;QAAKH;MAAQ,CAAA;IACnD;AAEA,WAAO,IAAIE,SAASP,OAAO5B,SAAgC;MAAEoC,QAAQ;MAAKH;IAAQ,CAAA;EACpF;AACF;AA5DgBpB;;;ADzFT,IAAMwB,UAAN,MAAMA,SAAAA;EA/Db,OA+DaA;;;EACHC;EACSC,SAAuB,CAAA;EAChCC;EACAC;EACSC,YAAYC,KAAKC,IAAG;EACpBC;EACAC;EACAC;EAEjB,YAAoBC,MAA6E;AAC/F,UAAMC,KAAKD,MAAMH,cAAc;AAC/B,UAAMK,KAAKF,MAAMF,aAAa;AAE9B,QAAIG,GAAGE,WAAW,OAAA,EAChB,OAAM,IAAIC,MACR,yBAAyBH,EAAAA,mEAAgE;AAE7F,QAAIC,GAAGC,WAAW,OAAA,EAChB,OAAM,IAAIC,MACR,wBAAwBF,EAAAA,mEAAgE;AAE5F,SAAKL,aAAaI;AAClB,SAAKH,YAAYI;AACjB,SAAKH,kBAAkBC,MAAMD,mBAAmB,CAAA;AAChD,UAAMM,UAAUC,kBAAAA;AAChB,SAAKhB,eAAee,QAAQE,aAAa,CAACC,YAAY,KAAKC,cAAcD,OAAAA,CAAAA;EAC3E;;;;;;;EAQA,aAAaE,OAAOV,MAAwC;AAC1D,UAAMW,MAAM,IAAItB,SAAQW,IAAAA;AAKxB,UAAMY,WAAW,oBAAIC,IAAAA;AAGrB,QAAIb,KAAKc,QAAQ;AACf,YAAMC,aAAaC,QAAQC,YAAY,qBAAqBjB,KAAKc,MAAM;AACvE,UAAIC,YAAY;AACd,cAAMG,aAAa;UAAClB,KAAKc;aAAYC,WAAWI,WAAW,CAAA;;AAC3D,mBAAWC,OAAOF,YAAY;AAC5B,gBAAMG,OAAOL,QAAQC,YAAY,qBAAqBG,GAAAA;AACtD,cAAI,CAACC,KAAM;AACX,qBAAWC,QAASD,KAAKE,aAAa,CAAA,GAAmB;AACvD,gBAAI,CAACX,SAASY,IAAIF,IAAAA,GAAO;AACvBV,uBAASa,IAAIH,MAAM,IAAKA,KAAAA,CAAAA;YAC1B;UACF;QACF;MACF;IACF;AAGA,QAAItB,KAAKuB,WAAW;AAClB,iBAAWD,QAAQtB,KAAKuB,WAAW;AACjC,YAAI,CAACX,SAASY,IAAIF,IAAAA,GAAO;AACvBV,mBAASa,IAAIH,MAAM,IAAKA,KAAAA,CAAAA;QAC1B;MACF;IACF;AAGA,eAAWI,cAAc1B,KAAK2B,aAAa;AACzC,YAAMC,aAAyBZ,QAAQC,YAAY,qBAAqBS,UAAAA,KAAe,CAAA;AACvF,YAAMG,OAAOD,WAAWE,IAAI,CAACC,OAAAA;AAC3B,cAAMC,MAAMpB,SAASqB,IAAIF,EAAAA;AACzB,YAAI,CAACC,KAAK;AACR,gBAAM,IAAI5B,MACR,4BAA4B2B,GAAGG,IAAI,QAAQR,WAAWQ,IAAI,SACjDH,GAAGG,IAAI,sDAAsD;QAE1E;AACA,eAAOF;MACT,CAAA;AACA,YAAMG,WAAW,IAAKT,WAAAA,GAAkDG,IAAAA;AAGxE,YAAMO,gBAAgBpB,QAAQC,YAAY,6BAA6BS,UAAAA;AACvE,UACEU,iBACA,OAAQD,SAAsCC,aAAAA,MAAmB,YACjE;AACA,cAAMC,SAAUF,SAAsCC,aAAAA,EAAc;AACpE,YAAIC,kBAAkBC,QAAS,OAAMD;MACvC;AAEA,YAAME,QAAQC,uBAAuBd,UAAAA;AACrC,iBAAWe,KAAKF,OAAO;AACrB5B,YAAIpB,OAAOmD,KAAK;UAAEC,MAAMF;UAAGN;QAAS,CAAA;MACtC;IACF;AAGAxB,QAAIpB,OAAOqD,KAAK,CAACC,GAAGC,MAAAA;AAClB,YAAMC,KAAKF,EAAEF,KAAKK,SAASC,SAAS,GAAA;AACpC,YAAMC,KAAKJ,EAAEH,KAAKK,SAASC,SAAS,GAAA;AACpC,UAAIF,OAAOG,GAAI,QAAOH,KAAK,IAAI;AAC/B,aAAO;IACT,CAAA;AAGA,eAAWI,SAASxC,IAAIpB,QAAQ;AAC9B,YAAM6D,aAAuB,CAAA;AAC7B,YAAMC,WAAWF,MAAMR,KAAKK,SAASM,QAAQ,WAAW,CAACC,IAAIrB,SAAAA;AAC3DkB,mBAAWV,KAAKR,IAAAA;AAChB,eAAO;MACT,CAAA;AACAiB,YAAMK,kBAAkB,IAAIC,OAAO,IAAIJ,QAAAA,GAAW;AAClDF,YAAMO,qBAAqBN;AAE3BD,YAAMQ,YAAYR,MAAMR,KAAKiB,aAAaC,KAAK,CAACC,MAAMA,EAAEC,WAAW,MAAA;IACrE;AAGA,QAAI/D,KAAKgE,KAAMrD,KAAInB,eAAeQ,KAAKgE;AAGvC,QAAIhE,KAAKiE,cAAc,OAAO;AAC5BtD,UAAIlB,gBAAgByE,oBAAoB;QAAEC,MAAMnE,KAAKiE,aAAa;MAAS,CAAA;IAC7E;AAKA,QAAIjE,KAAKoE,QAAQC,QAAQ;AACvB,YAAM1D,IAAI2D,eAAetE,KAAKoE,QAAQxD,UAAUZ,IAAAA;IAClD;AAEA,WAAOW;EACT;EAEA,MAAM4D,OAAOC,MAA6B;AACxC,WAAO,IAAIlC,QAAQ,CAACmC,YAAAA;AAClB,WAAKnF,aAAaiF,OAAOC,MAAM,MAAA;AAC7BE,gBAAQC,IAAI,6CAA6CH,IAAAA,EAAM;AAC/DC,gBAAAA;MACF,CAAA;IACF,CAAA;EACF;EAEAG,kBAAgC;AAC9B,WAAO,KAAKtF;EACd;EAEA,MAAMuF,QAAuB;AAC3B,WAAO,IAAIvC,QAAQ,CAACmC,YAAAA;AAClB,WAAKnF,aAAauF,MAAM,MAAA;AACtBJ,gBAAAA;MACF,CAAA;IACF,CAAA;EACF;;EAIQK,cAQF,CAAA;EAEN,MAAcR,eACZS,cACAnE,UACAZ,MACA;AAKA,UAAMgF,WAAW,IAAIC,SAAS,aAAa,0BAAA;AAG3C,QAAIC,mBACFC,cACAC,qBACAC,WACAC;AACF,QAAI;AACF,YAAMC,MAAM,MAAMP,SAAS,iBAAA;AAC3BE,0BAAoBK,IAAIL;AACxBC,qBAAeI,IAAIJ;AACnBC,4BAAsBG,IAAIH;AAC1BC,kBAAYE,IAAIF;AAChBC,+BAAyBC,IAAIC;IAC/B,QAAQ;AACN,YAAM,IAAIpF,MACR,uGAAA;IAEJ;AAEA,UAAMqF,SAASzF,KAAK0F,aAAaC,QAAQC,IAAIC,sBAAsB;AAEnE,eAAWC,cAAcf,cAAc;AAErC,YAAMgB,SAASV,UAAUS,UAAAA;AACzB,YAAME,eAAe;WAAID;;AAGzB,iBAAW,CAACE,GAAAA,KAAQrF,UAAU;AAC5B,YAAII,QAAQC,YAAYiF,uBAAOC,IAAI,wBAAA,GAA2BF,GAAAA,GAAM;AAClE,cAAI,CAACD,aAAa/C,SAASgD,GAAAA,EAAMD,cAAatD,KAAKuD,GAAAA;QACrD;MACF;AAEA,YAAMtD,OAAOuC,kBAAkBY,YAAYE,YAAAA;AAG3C,YAAMI,mBAAmB,oBAAIvF,IAAAA;AAC7B,iBAAWwF,MAAM1D,KAAK2D,WAAW;AAC/B,YAAInE,WAAWvB,SAASqB,IAAIoE,GAAGE,KAAK;AACpC,YAAI,CAACpE,UAAU;AACbA,qBAAW,IAAKkE,GAAGE,MAAK;AACxB3F,mBAASa,IAAI4E,GAAGE,OAAOpE,QAAAA;QACzB;AACAiE,yBAAiB3E,IAAI4E,GAAGE,OAAOpE,QAAAA;MACjC;AAGA,YAAMqE,WAAWrB,aAAaxC,MAAMyD,gBAAAA;AAGpC,UAAIK;AAEJ,UAAIzG,KAAK0G,oBAAoB;AAC3BD,oBAAYzG,KAAK0G,mBAAmB/D,MAAM6D,SAASG,OAAOlB,QAAQzF,KAAK4G,QAAQ;MACjF,WAAWnB,QAAQ;AAEjBgB,oBAAYnB,uBAAuB3C,MAAM6D,SAASG,OAAOlB,QAAQzF,KAAK4G,QAAQ;MAIhF,OAAO;AACLH,oBAAY,KAAKI,qBAAqBlE,KAAKmE,YAAY5E,MAAMuD,MAAAA;MAC/D;AAGA,YAAMlG,SAAS6F,oBAAoB;QACjC2B,YAAYpE;QACZqE,iBAAiBR;QACjBC;MAIF,CAAA;AAGA,iBAAWQ,SAAS1H,QAAQ;AAC1B,cAAM6D,aAAuB,CAAA;AAC7B,cAAMC,WAAW4D,MAAMC,KAAK5D,QAAQ,WAAW,CAACC,IAAYrB,SAAAA;AAC1DkB,qBAAWV,KAAKR,IAAAA;AAChB,iBAAO;QACT,CAAA;AACA,aAAK4C,YAAYpC,KAAK;UACpByE,QAAQF,MAAME;UACdC,SAAS,IAAI3D,OAAO,IAAIJ,QAAAA,GAAW;UACnCD;UACAiE,SAASJ,MAAMI;UACfC,QAAQ3E,KAAK2E,UAAU,CAAA;UACvBC,YAAYzB;UACZ0B,YAAY7E,KAAK8E,UAAUC,eAAe;QAC5C,CAAA;MACF;AAEAhD,cAAQC,IACN,sBAAehC,KAAKmE,YAAY5E,IAAI,gBAAgBS,KAAKsE,KAAK,UAAUT,SAASG,MAAMtC,MAAM,SAAS;IAE1G;EACF;EAEA,MAAcsD,uBAA0C;AACtD,QAAI,KAAK5H,gBAAgBsE,WAAW,GAAG;AACrC,aAAOuD,aAAa,KAAK;QAAEC,QAAQ;QAASC,QAAQ,CAAA;MAAG,CAAA;IACzD;AACA,UAAMC,UAAU,MAAMzF,QAAQ0F,IAC5B,KAAKjI,gBAAgB+B,IAAI,OAAOmG,UAAAA;AAC9B,UAAI;AACF,eAAO,MAAM3F,QAAQ4F,KAAK;UACxBD,MAAAA;UACA,IAAI3F,QAA8D,CAACmC,YACjE0D,WACE,MACE1D,QAAQ;YACNvC,MAAM;YACNkG,SAAS;YACTC,SAAS;UACX,CAAA,GACF,GAAA,CAAA;SAGL;MACH,SAASC,KAAK;AACZ,eAAO;UACLpG,MAAM;UACNkG,SAAS;UACTC,SAASC,eAAelI,QAAQkI,IAAID,UAAU;QAChD;MACF;IACF,CAAA,CAAA;AAEF,UAAME,aAAaR,QAAQS,MAAM,CAACC,MAAMA,EAAEL,OAAO;AACjD,WAAOR,aAAaW,aAAa,MAAM,KAAK;MAC1CV,QAAQU,aAAa,UAAU;MAC/BT,QAAQC;IACV,CAAA;EACF;EAEQlB,qBAAqB6B,WAAmBjD,QAAgB;AAC9D,UAAMkD,MAAM,CAAClD,SACT,sFACA;AACJ,WAAO,CAACmD,UAAkBC,eAAAA;AACxB,YAAMC,SAAS;QACb;UAAEC,MAAM;UAAeC,OAAO,OAAOrJ,KAAKC,IAAG,CAAA;UAAM8I;QAAU;QAC7D;UAAEK,MAAM;UAASE,MAAM;UAAmBZ,SAASM;UAAKO,WAAW;QAAM;;AAE3E,aAAO;QACL,CAAChD,OAAOiD,aAAa,GAAG,MAAA;AACtB,cAAIC,IAAI;AACR,iBAAO;YACLC,MAAM,6BACJ/G,QAAQmC,QACN2E,IAAIN,OAAOzE,SACP;cAAEiF,OAAOR,OAAOM,GAAAA;cAAMG,MAAM;YAAe,IAC3C;cAAED,OAAOE;cAAWD,MAAM;YAAc,CAAA,GAJ1C;UAMR;QACF;MACF;IACF;EACF;;EAIA,MAAc9I,cAAcD,SAAqC;AAC/D,UAAMiJ,WAAW,IAAIC,IAAIlJ,QAAQmJ,GAAG,EAAEF;AAGtC,QAAIjJ,QAAQ2G,WAAW,OAAO;AAC5B,UAAIsC,aAAa,KAAK5J,YAAY;AAChC,eAAO+H,aAAa,KAAK;UACvBC,QAAQ;UACR+B,SAASjK,KAAKC,IAAG,IAAK,KAAKF,aAAa;UACxCmK,WAAWlK,KAAKC,IAAG;QACrB,CAAA;MACF;AACA,UAAI6J,aAAa,KAAK3J,WAAW;AAC/B,eAAO,KAAK6H,qBAAoB;MAClC;IACF;AAGA,QAAInH,QAAQ2G,WAAW,OAAO;AAC5B,WAAKsC,aAAa,OAAOA,aAAa,kBAAkB,KAAKjK,cAAc;AACzE,eAAO,IAAIsK,SAAS,KAAKtK,cAAc;UACrCqI,QAAQ;UACRkC,SAAS;YAAE,gBAAgB;UAA2B;QACxD,CAAA;MACF;IACF;AAGA,QAAI,KAAKtK,iBAAiBe,QAAQ2G,WAAW,OAAO;AAClD,YAAM6C,iBAAiB,MAAM,KAAKvK,cAAce,OAAAA;AAChD,UAAIwJ,eAAgB,QAAOA;IAC7B;AAGA,eAAW/C,SAAS,KAAKnC,aAAa;AACpC,UAAItE,QAAQ2G,OAAO8C,YAAW,MAAOhD,MAAME,UAAUF,MAAMG,QAAQ8C,KAAKT,QAAAA,GAAW;AAEjF,YAAIxC,MAAMK,OAAOjD,SAAS,GAAG;AAC3B,gBAAM8F,MAAMC,uBAAuB5J,SAASyG,MAAMM,YAAYN,MAAMO,UAAU;AAC9E,qBAAW6C,aAAapD,MAAMK,QAAQ;AACpC,kBAAMgD,QAAQ,IAAKD,UAAAA;AACnB,gBAAI,CAAE,MAAMC,MAAMC,YAAYJ,GAAAA,GAAO;AACnC,oBAAMK,KAAK,IAAIC,mBAAmB,oBAAA;AAClC,qBAAO7C,aAAa4C,GAAGE,YAAYF,GAAGG,OAAM,CAAA;YAC9C;UACF;QACF;AACA,eAAO1D,MAAMI,QAAQ7G,OAAAA;MACvB;IACF;AAEA,UAAMmJ,MAAM,IAAID,IAAIlJ,QAAQmJ,GAAG;AAC/B,UAAMxC,SAAS3G,QAAQ2G,OAAO8C,YAAW;AAEzC,UAAMW,QAAQ,KAAKC,UAAU1D,QAAQwC,IAAIF,QAAQ;AACjD,QAAI,CAACmB,OAAO;AACV,aAAOhD,aAAa,KAAK;QACvBkD,OAAO;UAAE7B,MAAM;UAAaZ,SAAS,gBAAgBlB,MAAAA,IAAUwC,IAAIF,QAAQ;QAAG;MAChF,CAAA;IACF;AAEA,UAAM,EAAEtG,OAAO4H,OAAM,IAAKH;AAE1B,QAAI;AAEF,YAAMT,MAAMC,uBACV5J,SACA2C,MAAMhB,SAAS,aACfgB,MAAMR,KAAK+E,WAAW;AAExB,iBAAW2C,aAAalH,MAAMR,KAAK2E,QAAQ;AACzC,cAAMgD,QAAQ,IAAKD,UAAAA;AACnB,YAAI,CAAE,MAAMC,MAAMC,YAAYJ,GAAAA,GAAO;AACnC,gBAAMK,KAAK,IAAIC,mBAAmB,oBAAA;AAClC,iBAAO7C,aAAa4C,GAAGE,YAAYF,GAAGG,OAAM,CAAA;QAC9C;MACF;AAGA,UAAIK;AACJ,UAAI7H,MAAMQ,aAAa;QAAC;QAAQ;QAAO;QAASV,SAASkE,MAAAA,GAAS;AAChE,YAAI;AACF,gBAAM8D,OAAO,MAAMzK,QAAQyK,KAAI;AAC/BD,iBAAOC,OAAOC,KAAKC,MAAMF,IAAAA,IAAQzB;QACnC,QAAQ;AACNwB,iBAAOxB;QACT;AAEA,YAAIrG,MAAMR,KAAKyI,cAAcJ,SAASxB,QAAW;AAC/C,gBAAMnH,UAASc,MAAMR,KAAKyI,WAAWC,UAAUL,IAAAA;AAC/C,cAAI,CAAC3I,QAAOiJ,SAAS;AACnB,mBAAO1D,aAAa,KAAK;cACvBkD,OAAO;gBAAE7B,MAAM;gBAAoBsC,QAAQlJ,QAAOyI,MAAMS;cAAO;YACjE,CAAA;UACF;AACAP,iBAAO3I,QAAOmJ;QAChB;MACF;AAGA,YAAM3J,OAAO,KAAK4J,UAChBtI,MAAMR,KAAKiB,cACXpD,SACAwK,MACAD,QACAW,OAAOC,YAAYhC,IAAIiC,YAAY,CAAA;AAIrC,UAAIzI,MAAMR,KAAKkJ,UAAU;AACvB,eAAO,IAAI/B,SAAS,MAAM;UACxBjC,QAAQ1E,MAAMR,KAAKkJ,SAAShE;UAC5BkC,SAAS;YAAE+B,UAAU3I,MAAMR,KAAKkJ,SAASlC;UAAI;QAC/C,CAAA;MACF;AAGA,YAAMoC,YAAa5I,MAAMhB,SACvBgB,MAAMR,KAAK+E,WAAW;AAGxB,UAAIrF;AACJ,UAAIc,MAAMR,KAAKqJ,aAAa3H,SAAS,GAAG;AAEtC,cAAM,EAAE4H,gBAAe,IAAK,MAAM,OAAO,iCAAA;AACzC5J,iBAAS,MAAM4J,gBACb9I,MAAMR,KAAKqJ,cACX,MAAMD,UAAUG,MAAM/I,MAAMhB,UAAUN,IAAAA,GACtCrB,OAAAA;MAEJ,OAAO;AACL6B,iBAAS,MAAM0J,UAAUG,MAAM/I,MAAMhB,UAAUN,IAAAA;MACjD;AAEA,aAAOsK,cAAc9J,QAAQc,MAAMR,MAAMwE,MAAAA;IAC3C,SAASmB,KAAK;AAEZ,UAAInF,MAAMR,KAAKyJ,QAAQ/H,SAAS,GAAG;AACjC,cAAM,EAAEgI,oBAAmB,IAAK,MAAM,OAAO,sCAAA;AAC7C,eAAOA,oBAAoB/D,KAAKnF,MAAMR,KAAKyJ,SAAS5L,OAAAA;MACtD;AAEA,UAAI8H,eAAegE,eAAe;AAChC,eAAO1E,aAAaU,IAAIoC,YAAYpC,IAAIqC,OAAM,CAAA;MAChD;AAEAjG,cAAQoG,MAAM,6BAA6BxC,eAAelI,QAAQkI,IAAID,UAAUC,GAAAA;AAChF,aAAOV,aAAa,KAAK;QACvBkD,OAAO;UAAE7B,MAAM;UAAyBZ,SAAS;QAAwB;MAC3E,CAAA;IACF;EACF;EAEQwC,UAAU1D,QAAgBsC,UAAkB;AAClD,eAAWtG,SAAS,KAAK5D,QAAQ;AAC/B,UAAI4D,MAAMR,KAAK4J,SAAS,SAASpJ,MAAMR,KAAK4J,SAASpF,OAAQ;AAE7D,YAAMyD,QAAQzH,MAAMK,gBAAiBgJ,KAAK/C,QAAAA;AAC1C,UAAI,CAACmB,MAAO;AACZ,YAAMG,SAAiC,CAAC;AACxC5H,YAAMO,mBAAoB+I,QAAQ,CAACvK,MAAMkH,MAAAA;AACvC2B,eAAO7I,IAAAA,IAAQ0I,MAAMxB,IAAI,CAAA;MAC3B,CAAA;AACA,aAAO;QAAEjG;QAAO4H;MAAO;IACzB;AACA,WAAO;EACT;EAEQU,UACNiB,SACAlM,SACAwK,MACAD,QACA4B,OACW;AACX,QAAID,QAAQrI,WAAW,EAAG,QAAO,CAAA;AACjC,UAAMuI,MAAMC,KAAKD,IAAG,GAAIF,QAAQ5K,IAAI,CAACgC,MAAMA,EAAEgJ,KAAK,CAAA;AAClD,UAAMjL,OAAkBkL,MAAMC,KAAK;MAAE3I,QAAQuI,MAAM;IAAE,GAAG,MAAMpD,MAAAA;AAC9D,eAAW1F,KAAK4I,SAAS;AACvB,cAAQ5I,EAAEC,QAAM;QACd,KAAK;AACHlC,eAAKiC,EAAEgJ,KAAK,IAAItM;AAChB;QACF,KAAK;AACHqB,eAAKiC,EAAEgJ,KAAK,IAAIhJ,EAAEmJ,MAAOjC,KAAiClH,EAAEmJ,GAAG,IAAIjC;AACnE;QACF,KAAK;AACHnJ,eAAKiC,EAAEgJ,KAAK,IAAIhJ,EAAEmJ,MAAMlC,OAAOjH,EAAEmJ,GAAG,IAAIlC;AACxC;QACF,KAAK;AACHlJ,eAAKiC,EAAEgJ,KAAK,IAAIhJ,EAAEmJ,MAAMN,MAAM7I,EAAEmJ,GAAG,IAAIN;AACvC;QACF,KAAK;AACH9K,eAAKiC,EAAEgJ,KAAK,IAAIhJ,EAAEmJ,MACdzM,QAAQuJ,QAAQ9H,IAAI6B,EAAEmJ,IAAIC,YAAW,CAAA,IACrCxB,OAAOC,YAAYnL,QAAQuJ,QAAQ2C,QAAO,CAAA;AAC9C;QACF,KAAK;AACH7K,eAAKiC,EAAEgJ,KAAK,IAAItM,QAAQuJ,QAAQ9H,IAAI,iBAAA,KAAsB;AAC1D;QACF;AACEJ,eAAKiC,EAAEgJ,KAAK,IAAItD;MACpB;IACF;AACA,WAAO3H;EACT;AACF;AAEA,SAAS+F,aAAaC,QAAgBmD,MAAa;AACjD,SAAO,IAAIlB,SAASoB,KAAKiC,UAAUnC,IAAAA,GAAO;IACxCnD;IACAkC,SAAS;MAAE,gBAAgB;IAAmB;EAChD,CAAA;AACF;AALSnC;AAOT,SAASuE,cAAc9J,QAAiBM,MAAkBwE,QAAc;AACtE,QAAMU,SAASlF,KAAKkF,WAAWV,WAAW,SAAS,MAAM;AACzD,QAAM4C,UAAkC;IAAE,gBAAgB;EAAmB;AAC7E,aAAW,CAACqD,GAAGC,CAAAA,KAAM1K,KAAKoH,QAASA,SAAQqD,EAAEF,YAAW,CAAA,IAAMG;AAE9D,MAAIhL,WAAWmH,UAAanH,WAAW,MAAM;AAC3C,WAAO,IAAIyH,SAAS,MAAM;MAAEjC,QAAQA,WAAW,MAAM,MAAMA;MAAQkC;IAAQ,CAAA;EAC7E;AACA,MAAI,OAAO1H,WAAW,UAAU;AAC9B0H,YAAQ,cAAA,IAAkB;AAC1B,WAAO,IAAID,SAASzH,QAAQ;MAAEwF;MAAQkC;IAAQ,CAAA;EAChD;AACA,SAAO,IAAID,SAASoB,KAAKiC,UAAU9K,MAAAA,GAAS;IAAEwF;IAAQkC;EAAQ,CAAA;AAChE;AAbSoC;","names":["MIME_TYPES","css","html","htm","js","mjs","json","txt","xml","csv","md","png","jpg","jpeg","gif","svg","webp","avif","ico","bmp","woff","woff2","ttf","otf","eot","mp3","mp4","webm","ogg","wav","pdf","zip","gz","wasm","webmanifest","map","getMimeType","filename","match","toLowerCase","TRAVERSAL_REGEX","isSafePath","path","test","readFileUniversal","g","globalThis","Bun","BunRT","file","exists","buf","arrayBuffer","content","Uint8Array","isDirectory","Deno","DenoRT","stat","readFile","fs","statSync","readFileSync","buffer","byteOffset","byteLength","createStaticHandler","options","root","maxAge","customMimes","mimes","request","method","url","URL","pathname","decodeURIComponent","startsWith","filePath","replace","result","indexPath","mimeType","split","pop","headers","String","Response","status","TheoApp","serverHandle","routes","frontendHtml","staticHandler","startTime","Date","now","healthPath","readyPath","readinessChecks","opts","hp","rp","startsWith","Error","adapter","createNodeAdapter","createServer","request","handleRequest","create","app","registry","Map","module","moduleMeta","Reflect","getMetadata","allModules","imports","Mod","meta","Prov","providers","has","set","Controller","controllers","paramTypes","args","map","pt","dep","get","name","instance","postConstruct","result","Promise","walks","walkControllerMetadata","w","push","walk","sort","a","b","aP","fullPath","includes","bP","entry","paramNames","regexStr","replace","_m","compiledPattern","RegExp","compiledParamNames","needsBody","paramEntries","some","p","source","html","staticDir","createStaticHandler","root","agents","length","autoWireAgents","listen","port","resolve","console","log","getServerHandle","close","agentRoutes","agentClasses","importFn","Function","walkAgentMetadata","compileAgent","generateAgentRoutes","getMixins","createSdkAgentStreamFn","mod","createSdkAgentStream","apiKey","llmApiKey","process","env","OPENROUTER_API_KEY","AgentClass","mixins","allToolboxes","Cls","Symbol","for","toolboxInstances","tb","toolboxes","class","compiled","createRun","agentStreamFactory","tools","llmModel","createFallbackStream","agentConfig","walkResult","compiledOptions","route","path","method","pattern","handler","guards","agentClass","methodName","mainLoop","propertyKey","handleReadinessCheck","jsonResponse","status","checks","results","all","check","race","setTimeout","healthy","message","err","allHealthy","every","r","agentName","msg","_message","_sessionId","events","type","runId","code","retryable","asyncIterator","i","next","value","done","undefined","pathname","URL","url","uptime","timestamp","Response","headers","staticResponse","toUpperCase","test","ctx","createExecutionContext","GuardCtor","guard","canActivate","ex","ForbiddenException","statusCode","toJSON","match","findRoute","error","params","body","text","JSON","parse","bodySchema","safeParse","success","issues","data","buildArgs","Object","fromEntries","searchParams","redirect","location","handlerFn","interceptors","runInterceptors","apply","buildResponse","filters","runExceptionFilters","HttpException","verb","exec","forEach","entries","query","max","Math","index","Array","from","key","toLowerCase","stringify","n","v"]}

package/dist/chunk-7QVYU63E.js

@@ -1,7 +0,0 @@
-var __defProp = Object.defineProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-
-export {
-  __name
-};
-//# sourceMappingURL=chunk-7QVYU63E.js.map

package/dist/exception-filter-chain-BCSQ3MZ2.js

@@ -1,10 +0,0 @@
-import {
-  runExceptionFilters
-} from "./chunk-34KOKJ5M.js";
-import "./chunk-3PGQVQWG.js";
-import "./chunk-LKNI6QEP.js";
-import "./chunk-7QVYU63E.js";
-export {
-  runExceptionFilters
-};
-//# sourceMappingURL=exception-filter-chain-BCSQ3MZ2.js.map

package/dist/interceptor-chain-6S3PUV7J.js

@@ -1,9 +0,0 @@
-import {
-  runInterceptors
-} from "./chunk-U46H4CGF.js";
-import "./chunk-LKNI6QEP.js";
-import "./chunk-7QVYU63E.js";
-export {
-  runInterceptors
-};
-//# sourceMappingURL=interceptor-chain-6S3PUV7J.js.map