@theokit/http 1.0.0 → 1.1.1

package/LICENSE

@@ -137,8 +137,8 @@
 
    6. Trademarks. This License does not grant permission to use the trade
       names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
 
    7. Disclaimer of Warranty. Unless required by applicable law or
       agreed to in writing, Licensor provides the Work (and each

package/README.md

@@ -1,14 +1,20 @@
-# @theokit/http-decorators
+# `@theokit/http`
 
-NestJS-style decorators (`@Controller`, `@Get`, `@Post`, `@Body`, `@UseGuards`) that bridge to TheoKit's `defineRoute` + `defineMiddleware`. Opt-in for teams migrating from NestJS.
+NestJS-style decorators (`@Controller`, `@Get`, `@Post`, `@Body`, `@UseGuards`) over Web Standards —
+`Request` and `Response`, not `node:http`. They compile down to the same route registrations
+[`theokit`](https://www.npmjs.com/package/theokit) serves, so a decorator controller and a
+`route()` builder are two authoring surfaces over one runtime.
+
+> **Renamed.** This package was published as `@theokit/http-decorators` until 0.3.0. That name is
+> frozen at the old surface — install `@theokit/http`.
 
 ## Install
 
 ```bash
-pnpm add @theokit/http-decorators reflect-metadata
+pnpm add @theokit/http reflect-metadata
 ```
 
-Add to your `tsconfig.json`:
+The decorators are the TypeScript legacy kind, so the consuming project needs:
 
 ```json
 {
@@ -19,62 +25,75 @@ Add to your `tsconfig.json`:
 }
 ```
 
+`emitDecoratorMetadata` is only required for the DTO-class form of `@Body` (below). The preferred
+form — `@Body(schema)` — works without it.
+
 ## Quick start
 
 ```typescript
-import { Controller, Get, Post, Body } from '@theokit/http-decorators'
+import { Controller, Get, Post, Body, Param } from '@theokit/http'
 import { z } from 'zod'
 
-const zCreateCat = z.object({ name: z.string(), age: z.number() })
-
-class CreateCatDto {
-  static schema = zCreateCat
-}
-
-@Controller('cats')
+// Convention: @Controller() on CatsController infers the prefix "api/cats".
+// Pass a string to override: @Controller('api/v2/cats').
+@Controller()
 export class CatsController {
   @Get()
-  findAll(): string {
-    return 'This action returns all cats'
+  findAll() {
+    return { cats: [] }
+  }
+
+  @Get(':id')
+  findOne(@Param('id') id: string) {
+    return { id }
   }
 
   @Post()
-  create(@Body() body: CreateCatDto) {
-    return `Added ${(body as z.infer<typeof zCreateCat>).name}`
+  create(@Body(z.object({ name: z.string(), age: z.number().min(0) })) body: unknown) {
+    return { created: body }
   }
 }
 ```
 
-## DTO validation (Pattern D2 — Zod static schema)
+## Validation — Zod is the single source of truth
 
-TheoKit uses Zod as the single source of truth for validation. Attach a `static schema` to your DTO class:
+Pass the schema to `@Body` directly. The bridge validates the request against it and feeds the same
+schema to the OpenAPI emitter and the typed-client codegen:
 
 ```typescript
-const zCreateCat = z.object({
-  name: z.string().min(2).max(50),
-  age: z.number().min(0),
-  breed: z.string(),
-})
+@Post()
+create(@Body(z.object({ name: z.string().min(2), breed: z.string() })) body: unknown) { … }
+```
+
+A DTO class works too, when a shared, named shape reads better. Attach the schema as a static; this
+form needs `emitDecoratorMetadata`, because the bridge finds the class through `design:paramtypes`:
 
+```typescript
 class CreateCatDto {
-  static schema = zCreateCat
+  static schema = z.object({ name: z.string(), age: z.number() })
 }
+
+@Post()
+create(@Body() body: CreateCatDto) { … }
 ```
 
-The bridge reads `CreateCatDto.schema` at metadata-walk time and feeds it to `defineRoute({ body: zCreateCat })`. This preserves TheoKit's OpenAPI generation + type inference pipeline.
+When neither is present the body is passed through raw and the bridge warns — validation is never
+silently skipped.
+
+## Pipeline
 
-## Guards and Interceptors
+`middleware → guards → interceptors → handler`, with filters catching what escapes.
 
 ```typescript
-import { Controller, Get, UseGuards } from '@theokit/http-decorators'
+import { Controller, Get, UseGuards, type CanActivate, type ExecutionContext } from '@theokit/http'
 
-class AuthGuard {
-  canActivate(request: Request): boolean {
-    return request.headers.get('authorization') !== null
+class AuthGuard implements CanActivate {
+  canActivate(ctx: ExecutionContext): boolean {
+    return ctx.getRequest().headers.get('authorization') !== null
   }
 }
 
-@Controller('admin')
+@Controller('api/admin')
 export class AdminController {
   @UseGuards(AuthGuard)
   @Get()
@@ -84,89 +103,116 @@ export class AdminController {
 }
 ```
 
-Guards that return `false` produce a 401 response. `@UseInterceptors` wraps the handler for post-processing (logging, caching).
+A guard returning `false` produces **403 Forbidden** (`ForbiddenException`); throw
+`UnauthorizedException` from the guard when 401 is what you mean. Class-level guards run before
+method-level ones.
 
-## CLI scaffold
+An interceptor is `intercept(request, next)` — Web Standard `Request` in, and `next()` wrapping the
+handler call only (the body is already parsed by then). Not calling `next()` short-circuits the
+handler; calling it twice is memoized to one execution.
 
-```bash
-theokit generate controller cats
-# Creates server/controllers/cats.controller.ts
-```
+An exception filter is `catch(exception, host)` returning a `Response`, where `host.getRequest()` is
+the request that failed.
 
-## registerControllers (low-level API)
+## Serving an agent from a controller
 
-For advanced use cases without the Vite plugin:
+`@Expose` binds an agent built in `agents/<name>.ts` to a controller property, so its route, its
+streaming and its auth are visible in one place:
 
 ```typescript
-import { registerControllers } from '@theokit/http-decorators'
-import { CatsController } from './controllers/cats.controller.js'
+import { Controller, Expose, UseGuards } from '@theokit/http'
 
-const routes = registerControllers([CatsController])
-// Returns RouteRegistration[] with verb, fullPath, walkResult per method
+import supportAgent from '../../agents/support.js'
+
+@Controller('api/agents')
+@UseGuards(AuthGuard)
+export class AgentsController {
+  @Expose(supportAgent)
+  support!: unknown // → POST /api/agents/support, behind AuthGuard
+}
 ```
 
+The request is delegated straight to the one agent runtime. Guards run on that route; interceptors
+do not.
+
 ## Decorators reference
 
 | Decorator | Kind | Purpose |
 |---|---|---|
-| `@Controller(prefix?, opts?)` | Class | Route prefix scope |
-| `@Get(path?)` | Method | GET endpoint |
-| `@Post(path?)` | Method | POST endpoint |
-| `@Put(path?)` | Method | PUT endpoint |
-| `@Patch(path?)` | Method | PATCH endpoint |
-| `@Delete(path?)` | Method | DELETE endpoint |
-| `@Options(path?)` | Method | OPTIONS endpoint |
-| `@Head(path?)` | Method | HEAD endpoint |
-| `@All(path?)` | Method | All HTTP methods |
-| `@Body(key?)` | Parameter | Request body (or body[key]) |
-| `@Param(key?)` | Parameter | Route params (or params[key]) |
-| `@Query(key?)` | Parameter | Query string (or query[key]) |
+| `@Controller(prefix?, opts?)` | Class | Route prefix scope (inferred from the class name when omitted) |
+| `@Get/@Post/@Put/@Patch/@Delete/@Options/@Head/@All(path?)` | Method | HTTP verb endpoints |
+| `@Body(schemaOrKey?)` | Parameter | Request body — Zod schema, DTO class, or `body[key]` |
+| `@Param(key?)` | Parameter | Route params (or `params[key]`) |
+| `@Query(key?)` | Parameter | Query string (or `query[key]`) |
 | `@Headers(name?)` | Parameter | Request headers |
-| `@Req()` | Parameter | Full Request object |
-| `@Res(opts?)` | Parameter | Response object (`passthrough` option) |
-| `@Session()` | Parameter | Session object |
-| `@Ip()` | Parameter | Client IP |
-| `@HostParam(key?)` | Parameter | Host parameters |
-| `@HttpCode(status)` | Method | Override response status code |
-| `@Header(name, value)` | Method | Set response header |
+| `@Req()` / `@Res(opts?)` | Parameter | The raw `Request` / response (`passthrough` option) |
+| `@Session()` / `@Ip()` / `@HostParam(key?)` | Parameter | Session, client IP, host params |
+| `@HttpCode(status)` | Method | Override the response status |
+| `@Header(name, value)` | Method | Set a response header |
 | `@Redirect(url, status?)` | Method | Redirect response |
-| `@UseGuards(...guards)` | Class/Method | Attach guard classes |
-| `@UseInterceptors(...interceptors)` | Class/Method | Attach interceptor classes |
+| `@UseGuards(...)` | Class/Method | Attach guards |
+| `@UseInterceptors(...)` | Class/Method | Attach interceptors |
+| `@UseFilters(...)` / `@Catch(...)` | Class/Method | Exception filters |
+| `@Throttle(opts)` / `@SkipThrottle()` | Class/Method | Rate-limit policy |
+| `@SetMetadata(key, value)` / `createDecorator<T>()` | Class/Method | Custom metadata, read back with `Reflector` |
+| `@Expose(agent, opts?)` | Property | Serve a built agent from this controller |
 
-## Limitations
+Build your own policy decorator with `createDecorator`:
 
-### Singleton-scope controllers only (v0.1.0)
+```typescript
+const Roles = createDecorator<string[]>()
+// @Roles(['admin']) → read it in a guard with reflector.get(Roles, handler)
+```
 
-Controllers are instantiated once per `registerControllers` call. NestJS request-scoped controllers (`@Injectable({ scope: Scope.REQUEST })`) are not supported. Migration path: v0.2.0+ via `@theokit/di` integration.
+`HttpStatus` ships the 30 status codes the framework uses, alongside an exception class per code
+(`BadRequestException`, `ConflictException`, `TooManyRequestsException`, …).
 
-### Interceptor wrap semantics simplified
+## Subpaths
 
-NestJS interceptors can skip calling `next()` (e.g., cache-hit short-circuit). v0.1.0 wraps always call `next()` then post-process. Consumers needing pre-handler short-circuit should use `defineMiddleware` directly.
+| Subpath | What lives there |
+|---|---|
+| `.` | Decorators, metadata, the bridge, exceptions, `TheoApp`, `createTypedClient`, `contract`, static serving |
+| `./theokit-plugin` | The plugin that wires controllers into a TheoKit app |
+| `./app` | App-level composition |
+| `./runtime/node` | The Node runtime adapter |
+| `./action-encryption`, `./server-inserted-html`, `./css-resource` | Opt-in capabilities kept off the main bundle |
 
-### Handler returning Response bypasses decorator-set status/headers
+## `registerControllers` (low-level)
 
-If your handler returns a `Response` object directly, `@HttpCode` and `@Header` decorators are not applied. You own the full response. This matches NestJS behavior with `@Res({ passthrough: false })`.
+For advanced use without the Vite plugin:
 
-## Troubleshooting
+```typescript
+import { registerControllers } from '@theokit/http'
 
-### `HttpDecoratorsConfigError: emitDecoratorMetadata not enabled`
+const routes = registerControllers([CatsController])
+// RouteRegistration[] — verb, fullPath, and the metadata walk per method
+```
 
-Your `tsconfig.json` is missing the `emitDecoratorMetadata: true` flag. Add both flags:
+## Limitations
 
-```json
-{
-  "compilerOptions": {
-    "experimentalDecorators": true,
-    "emitDecoratorMetadata": true
-  }
-}
-```
+- **Singleton-scope controllers only.** A controller is instantiated once, when the handler is
+  built — NestJS request-scoped controllers (`@Injectable({ scope: Scope.REQUEST })`) have no
+  equivalent here. Guards and interceptors are the opposite: a fresh instance per request, unless a
+  DI container resolves them.
+- **No response object before the handler returns.** `ExecutionContext` exposes the request, the URL,
+  the controller class and the handler name — there is nothing to mutate headers on until a
+  `Response` exists. Set them with `@Header`, or return a `Response` yourself.
+- **A handler returning a `Response` owns it.** `@HttpCode` and `@Header` are not applied on that
+  path — the same behaviour as NestJS with `@Res({ passthrough: false })`.
 
-### `HttpDecoratorsConfigError: missing @Controller() decorator`
+## Troubleshooting
+
+**`HttpDecoratorsConfigError: emitDecoratorMetadata not enabled`** — add both compiler flags shown
+under Install, or pass the schema inline as `@Body(schema)`, which does not need them.
 
-You have `@Get`/`@Post` methods on a class that lacks `@Controller()`. Add the decorator to the class.
+**`HttpDecoratorsConfigError: missing @Controller() decorator`** — a class has `@Get`/`@Post`
+methods but no `@Controller()`.
 
 ## Bundle cost
 
-- Opt-in consumers: ~8-13KB gzipped (`reflect-metadata` ~3KB + this package ~5-10KB)
-- Non-opt-in consumers: 0KB
+~8-13KB gzipped for consumers who opt in (`reflect-metadata` ~3KB plus this package); 0KB for those
+who do not.
+
+## Licence
+
+Apache-2.0 — see `LICENSE`.

package/dist/action-encryption.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Action Encryption — AES-GCM-256 via Web Crypto API.
+ *
+ * Inspired by Next.js encryption.ts (app-render/).
+ * Uses crypto.subtle (Web Standard) for action argument encryption.
+ * Random IV per call ensures ciphertext is unique even for identical inputs.
+ *
+ * Output format: base64url(iv || ciphertext)
+ */
+/**
+ * Derive an AES-GCM-256 CryptoKey from a string secret.
+ *
+ * Uses PBKDF2 with a fixed salt derived from the secret itself.
+ * Suitable for action encryption where the secret is a server-side
+ * session secret — not for password hashing.
+ */
+declare function deriveActionKey(secret: string): Promise<CryptoKey>;
+/**
+ * Encrypt a string with AES-GCM-256.
+ *
+ * @returns base64url-encoded string containing IV + ciphertext.
+ */
+declare function encryptActionArgs(key: CryptoKey, data: string): Promise<string>;
+/**
+ * Decrypt a base64url-encoded string produced by encryptActionArgs.
+ *
+ * @returns The original plaintext string.
+ * @throws Error if decryption fails (wrong key, tampered data, etc.).
+ */
+declare function decryptActionArgs(key: CryptoKey, encrypted: string): Promise<string>;
+
+export { decryptActionArgs, deriveActionKey, encryptActionArgs };

package/dist/action-encryption.js

@@ -0,0 +1,69 @@
+import {
+  __name
+} from "./chunk-Z4QWC7IK.js";
+
+// src/action-encryption.ts
+var ALGORITHM = "AES-GCM";
+var IV_LENGTH = 12;
+async function deriveActionKey(secret) {
+  const encoder = new TextEncoder();
+  const keyMaterial = await crypto.subtle.importKey("raw", encoder.encode(secret), "PBKDF2", false, [
+    "deriveKey"
+  ]);
+  const salt = encoder.encode(`theo-action-salt:${secret.slice(0, 8)}`);
+  return crypto.subtle.deriveKey({
+    name: "PBKDF2",
+    salt,
+    iterations: 1e5,
+    hash: "SHA-256"
+  }, keyMaterial, {
+    name: ALGORITHM,
+    length: 256
+  }, false, [
+    "encrypt",
+    "decrypt"
+  ]);
+}
+__name(deriveActionKey, "deriveActionKey");
+async function encryptActionArgs(key, data) {
+  const encoder = new TextEncoder();
+  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+  const ciphertext = await crypto.subtle.encrypt({
+    name: ALGORITHM,
+    iv
+  }, key, encoder.encode(data));
+  const combined = new Uint8Array(IV_LENGTH + ciphertext.byteLength);
+  combined.set(iv, 0);
+  combined.set(new Uint8Array(ciphertext), IV_LENGTH);
+  return toBase64Url(combined);
+}
+__name(encryptActionArgs, "encryptActionArgs");
+async function decryptActionArgs(key, encrypted) {
+  const combined = fromBase64Url(encrypted);
+  const iv = combined.slice(0, IV_LENGTH);
+  const ciphertext = combined.slice(IV_LENGTH);
+  const decrypted = await crypto.subtle.decrypt({
+    name: ALGORITHM,
+    iv
+  }, key, ciphertext);
+  return new TextDecoder().decode(decrypted);
+}
+__name(decryptActionArgs, "decryptActionArgs");
+function toBase64Url(bytes) {
+  const binString = Array.from(bytes, (b) => String.fromCodePoint(b)).join("");
+  return btoa(binString).replace(/\+/g, "-").replace(/\//g, "_").replaceAll("=", "");
+}
+__name(toBase64Url, "toBase64Url");
+function fromBase64Url(str) {
+  const base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+  const binString = atob(padded);
+  return Uint8Array.from(binString, (c) => c.codePointAt(0));
+}
+__name(fromBase64Url, "fromBase64Url");
+export {
+  decryptActionArgs,
+  deriveActionKey,
+  encryptActionArgs
+};
+//# sourceMappingURL=action-encryption.js.map

package/dist/action-encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/action-encryption.ts"],"mappings":";;;;;AAUA,IAAMA,YAAY;AAClB,IAAMC,YAAY;AASlB,eAAsBC,gBAAgBC,QAAc;AAClD,QAAMC,UAAU,IAAIC,YAAAA;AACpB,QAAMC,cAAc,MAAMC,OAAOC,OAAOC,UACtC,OACAL,QAAQM,OAAOP,MAAAA,GACf,UACA,OACA;IAAC;GAAY;AAGf,QAAMQ,OAAOP,QAAQM,OAAO,oBAAoBP,OAAOS,MAAM,GAAG,CAAA,CAAA,EAAI;AAEpE,SAAOL,OAAOC,OAAOK,UACnB;IACEC,MAAM;IACNH;IACAI,YAAY;IACZC,MAAM;EACR,GACAV,aACA;IAAEQ,MAAMd;IAAWiB,QAAQ;EAAI,GAC/B,OACA;IAAC;IAAW;GAAU;AAE1B;AAxBsBf;AA+BtB,eAAsBgB,kBAAkBC,KAAgBC,MAAY;AAClE,QAAMhB,UAAU,IAAIC,YAAAA;AACpB,QAAMgB,KAAKd,OAAOe,gBAAgB,IAAIC,WAAWtB,SAAAA,CAAAA;AAEjD,QAAMuB,aAAa,MAAMjB,OAAOC,OAAOiB,QAAQ;IAAEX,MAAMd;IAAWqB;EAAG,GAAGF,KAAKf,QAAQM,OAAOU,IAAAA,CAAAA;AAG5F,QAAMM,WAAW,IAAIH,WAAWtB,YAAYuB,WAAWG,UAAU;AACjED,WAASE,IAAIP,IAAI,CAAA;AACjBK,WAASE,IAAI,IAAIL,WAAWC,UAAAA,GAAavB,SAAAA;AAEzC,SAAO4B,YAAYH,QAAAA;AACrB;AAZsBR;AAoBtB,eAAsBY,kBAAkBX,KAAgBY,WAAiB;AACvE,QAAML,WAAWM,cAAcD,SAAAA;AAE/B,QAAMV,KAAKK,SAASd,MAAM,GAAGX,SAAAA;AAC7B,QAAMuB,aAAaE,SAASd,MAAMX,SAAAA;AAElC,QAAMgC,YAAY,MAAM1B,OAAOC,OAAO0B,QAAQ;IAAEpB,MAAMd;IAAWqB;EAAG,GAAGF,KAAKK,UAAAA;AAE5E,SAAO,IAAIW,YAAAA,EAAcC,OAAOH,SAAAA;AAClC;AATsBH;AAatB,SAASD,YAAYQ,OAAiB;AACpC,QAAMC,YAAYC,MAAMC,KAAKH,OAAO,CAACI,MAAMC,OAAOC,cAAcF,CAAAA,CAAAA,EAAIG,KAAK,EAAA;AACzE,SAAOC,KAAKP,SAAAA,EAAWQ,QAAQ,OAAO,GAAA,EAAKA,QAAQ,OAAO,GAAA,EAAKC,WAAW,KAAK,EAAA;AACjF;AAHSlB;AAKT,SAASG,cAAcgB,KAAW;AAChC,QAAMC,SAASD,IAAIF,QAAQ,MAAM,GAAA,EAAKA,QAAQ,MAAM,GAAA;AACpD,QAAMI,SAASD,SAAS,IAAIE,QAAQ,IAAKF,OAAOhC,SAAS,KAAM,CAAA;AAC/D,QAAMqB,YAAYc,KAAKF,MAAAA;AACvB,SAAO3B,WAAWiB,KAAKF,WAAW,CAACe,MAAMA,EAAEC,YAAY,CAAA,CAAA;AACzD;AALStB;","names":["ALGORITHM","IV_LENGTH","deriveActionKey","secret","encoder","TextEncoder","keyMaterial","crypto","subtle","importKey","encode","salt","slice","deriveKey","name","iterations","hash","length","encryptActionArgs","key","data","iv","getRandomValues","Uint8Array","ciphertext","encrypt","combined","byteLength","set","toBase64Url","decryptActionArgs","encrypted","fromBase64Url","decrypted","decrypt","TextDecoder","decode","bytes","binString","Array","from","b","String","fromCodePoint","join","btoa","replace","replaceAll","str","base64","padded","repeat","atob","c","codePointAt"]}

package/dist/app.d.ts

@@ -21,7 +21,12 @@ interface AgentAppEntry {
     readonly name: string;
     /** Mount point; routes are generated under it (`<route>/chat`, `<route>/runs/:id`). */
     readonly route: string;
-    /** `CompiledAgentOptions` from `@theokit/agents` (typed `unknown` — optional peer dependency). */
+    /**
+     * `CompiledAgentOptions`, produced by the agent layer and opaque here.
+     *
+     * Typed `unknown` on purpose: naming the type would import it, and this package does not depend
+     * on `@theokit/agents` (G1 — agents depends on http, never the reverse).
+     */
     readonly compiled: unknown;
     /** Guards to run before the agent routes (same shape the controller pipeline uses). */
     readonly guards?: Function[];
@@ -30,6 +35,53 @@ interface AgentAppEntry {
     /** Optional owning class, kept only for guard resolution parity with controllers. */
     readonly agentClass?: Function;
 }
+/** One route produced by the agent runtime, in the shape this app mounts. */
+interface AgentRuntimeRoute {
+    readonly method: string;
+    /** Express-style path; `:param` segments become capture groups when mounted. */
+    readonly path: string;
+    readonly handler: (request: Request) => Promise<Response>;
+}
+/**
+ * The slice of the agent layer this app needs — declared HERE, supplied by the caller.
+ *
+ * This interface is the inversion. `autoWireAgents` used to reach into `@theokit/agents` with a
+ * dynamic `import()`, which put the agent layer on this package's manifest and inverted the
+ * direction `system-design-guardrails.md` § G1 fixes ("`@theokit/http` does NOT import
+ * `@theokit/agents` — agents depends on http, not the reverse").
+ *
+ * "Dynamic" and "optional" were never an escape hatch: they change WHEN the module is needed, never
+ * WHETHER this package depends on it. The manifest still had to declare the peer, pnpm still
+ * auto-installed the **published** copy next to the workspace sibling, and the resulting type cycle
+ * made the build unfixable by manifest edit (`TS5055` on `dist/app.d.ts`).
+ *
+ * Declaring the contract here and letting the caller satisfy it is DIP (`architecture.md` § 2): the
+ * consumer defines the interface, the outer layer implements it, and the wiring happens at the
+ * composition root (§ 1) — which for this monorepo is `theokit`, the one package that legitimately
+ * depends on both.
+ */
+interface AgentRuntime {
+    /** Build the HTTP routes for one compiled agent. `@theokit/agents` exports this by name. */
+    generateAgentRoutes(input: {
+        walkResult: {
+            route: string;
+        };
+        compiledOptions: unknown;
+        createRun: (message: string, sessionId: string) => AsyncIterable<{
+            type: string;
+            [k: string]: unknown;
+        }>;
+    }): AgentRuntimeRoute[];
+    /**
+     * Default stream factory, used when the app has an API key and no `agentStreamFactory` override.
+     *
+     * Optional because an app that always passes `agentStreamFactory` never needs it — requiring it
+     * would force such callers to supply a function they can prove is unreachable.
+     */
+    createSdkAgentStream?(compiled: unknown, tools: unknown[], apiKey: string, overrides?: {
+        model?: string;
+    }): (message: string, sessionId: string) => AsyncIterable<unknown>;
+}
 interface TheoAppOptions {
     /** Controller classes decorated with @Controller. */
     controllers: Function[];
@@ -48,6 +100,13 @@ interface TheoAppOptions {
     llmApiKey?: string;
     /** LLM model override (default: from @Agent({ model }) metadata). */
     llmModel?: string;
+    /**
+     * The agent layer, supplied by the caller. REQUIRED whenever `agents` is non-empty.
+     *
+     * Wire it with the two named exports of `@theokit/agents`:
+     * `agentRuntime: { generateAgentRoutes, createSdkAgentStream }`.
+     */
+    agentRuntime?: AgentRuntime;
     /** Agent stream factory override (for testing or custom SDK wiring). */
     agentStreamFactory?: (
     /** The COMPILED agent options — not the metadata walk (which carries no `model`). */
@@ -105,6 +164,14 @@ declare class TheoApp {
     getServerHandle(): ServerHandle;
     close(): Promise<void>;
     private agentRoutes;
+    /**
+     * Synchronous since B-M67-21: the only `await` here was the dynamic `import('@theokit/agents')`
+     * that the inversion removed, and `AgentRuntime.generateAgentRoutes` returns routes directly.
+     *
+     * The call site dropped its `await` with it. Keeping one "in case a runtime resolves
+     * asynchronously later" would be a promise about a shape nothing has (YAGNI) — and the linter
+     * says so plainly: awaiting a non-thenable is noise that reads like a real suspension point.
+     */
     private autoWireAgents;
     private handleReadinessCheck;
     private createFallbackStream;
@@ -114,4 +181,4 @@ declare class TheoApp {
     private buildArgs;
 }
 
-export { type AgentAppEntry, type ReadinessCheck, TheoApp, type TheoAppOptions };
+export { type AgentAppEntry, type AgentRuntime, type AgentRuntimeRoute, type ReadinessCheck, TheoApp, type TheoAppOptions };

package/dist/app.js

@@ -1,10 +1,10 @@
 import {
   TheoApp
-} from "./chunk-DRCRGDA3.js";
-import "./chunk-JQMJK47T.js";
-import "./chunk-HLW7YKZE.js";
-import "./chunk-KPC7AIVC.js";
-import "./chunk-7QVYU63E.js";
+} from "./chunk-ZMMIH3I2.js";
+import "./chunk-X7Q5HPLK.js";
+import "./chunk-AJOJXZRY.js";
+import "./chunk-BSS3KPGY.js";
+import "./chunk-Z4QWC7IK.js";
 export {
   TheoApp
 };

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"sources":[],"mappings":"","names":[]}

package/dist/{chunk-KPC7AIVC.js → chunk-AJOJXZRY.js}

@@ -1,6 +1,6 @@
 import {
   __name
-} from "./chunk-7QVYU63E.js";
+} from "./chunk-Z4QWC7IK.js";
 
 // src/metadata/keys.ts
 var CONTROLLER_PREFIX = /* @__PURE__ */ Symbol.for("theokit:http-decorators:controller-prefix");
@@ -275,4 +275,4 @@ export {
   TooManyRequestsException,
   HttpStatus
 };
-//# sourceMappingURL=chunk-KPC7AIVC.js.map
+//# sourceMappingURL=chunk-AJOJXZRY.js.map

package/dist/chunk-AJOJXZRY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/metadata/keys.ts","../src/metadata/storage.ts","../src/exceptions/http-exception.ts"],"mappings":";;;;;AAYO,IAAMA,oBAAoBC,uBAAOC,IAAI,2CAAA;AACrC,IAAMC,gBAAgBF,uBAAOC,IAAI,uCAAA;AACjC,IAAME,eAAeH,uBAAOC,IAAI,sCAAA;AAChC,IAAMG,eAAeJ,uBAAOC,IAAI,sCAAA;AAChC,IAAMI,gBAAgBL,uBAAOC,IAAI,uCAAA;AACjC,IAAMK,iBAAiBN,uBAAOC,IAAI,wCAAA;AAClC,IAAMM,aAAaP,uBAAOC,IAAI,oCAAA;AAC9B,IAAMO,mBAAmBR,uBAAOC,IAAI,0CAAA;AACpC,IAAMQ,cAAcT,uBAAOC,IAAI,qCAAA;AAC/B,IAAMS,mBAAmBV,uBAAOC,IAAI,0CAAA;AACpC,IAAMU,eAAeX,uBAAOC,IAAI,sCAAA;;;ACtBvC,OAAO;AAQA,SAASW,QACdC,KACAC,QACAC,OACAC,aAA6B;AAE7B,MAAIA,gBAAgBC,QAAW;AAC7BC,YAAQC,eAAeN,KAAKE,OAAOD,QAAQE,WAAAA;EAC7C,OAAO;AACLE,YAAQC,eAAeN,KAAKE,OAAOD,MAAAA;EACrC;AACF;AAXgBF;AAaT,SAASQ,QACdP,KACAC,QACAE,aAA6B;AAE7B,MAAIA,gBAAgBC,QAAW;AAC7B,WAAOC,QAAQG,YAAYR,KAAKC,QAAQE,WAAAA;EAC1C;AACA,SAAOE,QAAQG,YAAYR,KAAKC,MAAAA;AAClC;AATgBM;;;ACdhB,IAAME,eAAuC;EAC3C,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;AACP;AAOO,IAAMC,gBAAN,cAA4BC,MAAAA;EApCnC,OAoCmCA;;;EACjBC;EACAC;EACAC;EAEhB,YAAYC,SAAiBH,YAAoBI,SAAgC;AAC/E,UAAMD,SAASC,SAASC,QAAQ;MAAEA,OAAOD,QAAQC;IAAM,IAAIC,MAAAA;AAC3D,SAAKC,OAAO,KAAK,YAAYA;AAC7B,SAAKP,aAAaA;AAClB,SAAKC,OAAOJ,aAAaG,UAAAA,KAAe;AACxC,SAAKE,cAAcE,SAASF;EAC9B;EAEAM,SAAS;AACP,WAAO;MACLC,OAAO;QACLR,MAAM,KAAKA;QACXE,SAAS,KAAKA;QACdH,YAAY,KAAKA;QACjB,GAAI,KAAKE,cAAc;UAAEA,aAAa,KAAKA;QAAY,IAAI,CAAC;MAC9D;IACF;EACF;AACF;AAEA,SAASQ,QAAQC,QAAgBC,YAAkB;AACjD,SAAO,cAAcd,cAAAA;IACnB,YAAYK,UAAUS,YAAYR,SAAgC;AAChE,YAAMD,SAASQ,QAAQP,OAAAA;AACvB,WAAKG,OAAO,KAAK,YAAYA;IAC/B;EACF;AACF;AAPSG;AASF,IAAMG,sBAAN,cAAkCH,QAAQ,KAAK,aAAA,EAAA;EAtEtD,OAsEsD;;;AAAgB;AAC/D,IAAMI,wBAAN,cAAoCJ,QAAQ,KAAK,cAAA,EAAA;EAvExD,OAuEwD;;;AAAiB;AAClE,IAAMK,qBAAN,cAAiCL,QAAQ,KAAK,WAAA,EAAA;EAxErD,OAwEqD;;;AAAc;AAC5D,IAAMM,oBAAN,cAAgCN,QAAQ,KAAK,WAAA,EAAA;EAzEpD,OAyEoD;;;AAAc;AAC3D,IAAMO,4BAAN,cAAwCP,QAAQ,KAAK,oBAAA,EAAA;EA1E5D,OA0E4D;;;AAAuB;AAC5E,IAAMQ,yBAAN,cAAqCR,QAAQ,KAAK,gBAAA,EAAA;EA3EzD,OA2EyD;;;AAAmB;AACrE,IAAMS,0BAAN,cAAsCT,QAAQ,KAAK,iBAAA,EAAA;EA5E1D,OA4E0D;;;AAAoB;AACvE,IAAMU,oBAAN,cAAgCV,QAAQ,KAAK,UAAA,EAAA;EA7EpD,OA6EoD;;;AAAa;AAC1D,IAAMW,gBAAN,cAA4BX,QAAQ,KAAK,MAAA,EAAA;EA9EhD,OA8EgD;;;AAAS;AAClD,IAAMY,8BAAN,cAA0CZ,QAAQ,KAAK,qBAAA,EAAA;EA/E9D,OA+E8D;;;AAAwB;AAC/E,IAAMa,2BAAN,cAAuCb,QAAQ,KAAK,mBAAA,EAAA;EAhF3D,OAgF2D;;;AAAsB;AAC1E,IAAMc,gCAAN,cAA4Cd,QAAQ,KAAK,wBAAA,EAAA;EAjFhE,OAiFgE;;;AAA2B;AACpF,IAAMe,qBAAN,cAAiCf,QAAQ,KAAK,cAAA,EAAA;EAlFrD,OAkFqD;;;AAAiB;AAC/D,IAAMgB,+BAAN,cAA2ChB,QAAQ,KAAK,sBAAA,EAAA;EAnF/D,OAmF+D;;;AAAyB;AACjF,IAAMiB,+BAAN,cAA2CjB,QAAQ,KAAK,uBAAA,EAAA;EApF/D,OAoF+D;;;AAA0B;AAClF,IAAMkB,0BAAN,cAAsClB,QAAQ,KAAK,iBAAA,EAAA;EArF1D,OAqF0D;;;AAAoB;AACvE,IAAMmB,sBAAN,cAAkCnB,QAAQ,KAAK,aAAA,EAAA;EAtFtD,OAsFsD;;;AAAgB;AAC/D,IAAMoB,8BAAN,cAA0CpB,QAAQ,KAAK,qBAAA,EAAA;EAvF9D,OAuF8D;;;AAAwB;AAC/E,IAAMqB,0BAAN,cAAsCrB,QAAQ,KAAK,iBAAA,EAAA;EAxF1D,OAwF0D;;;AAAoB;AACvE,IAAMsB,mCAAN,cAA+CtB,QAAQ,KAAK,4BAAA,EAAA;EAzFnE,OAyFmE;;;AAA+B;AAC3F,IAAMuB,2BAAN,cAAuCvB,QAAQ,KAAK,mBAAA,EAAA;EA1F3D,OA0F2D;;;AAAsB;AAgB1E,IAAMwB,aAAa;;EAExBC,IAAI;EACJC,SAAS;EACTC,UAAU;EACVC,YAAY;;EAGZC,mBAAmB;EACnBC,OAAO;EACPC,cAAc;EACdC,oBAAoB;EACpBC,oBAAoB;;EAGpBC,aAAa;EACbC,cAAc;EACdC,kBAAkB;EAClBC,WAAW;EACXC,WAAW;EACXC,oBAAoB;EACpBC,gBAAgB;EAChBC,iBAAiB;EACjBC,UAAU;EACVC,MAAM;EACNC,qBAAqB;EACrBC,mBAAmB;EACnBC,wBAAwB;EACxBC,aAAa;EACbC,sBAAsB;EACtBC,mBAAmB;;EAGnBC,uBAAuB;EACvBC,iBAAiB;EACjBC,aAAa;EACbC,qBAAqB;EACrBC,iBAAiB;AACnB;","names":["CONTROLLER_PREFIX","Symbol","for","ROUTE_METHODS","ROUTE_PARAMS","ROUTE_STATUS","ROUTE_HEADERS","ROUTE_REDIRECT","USE_GUARDS","USE_INTERCEPTORS","USE_FILTERS","CATCH_EXCEPTIONS","EXPOSE_AGENT","setMeta","key","target","value","propertyKey","undefined","Reflect","defineMetadata","getMeta","getMetadata","STATUS_CODES","HttpException","Error","statusCode","code","description","message","options","cause","undefined","name","toJSON","error","factory","status","defaultMsg","BadRequestException","UnauthorizedException","ForbiddenException","NotFoundException","MethodNotAllowedException","NotAcceptableException","RequestTimeoutException","ConflictException","GoneException","PreconditionFailedException","PayloadTooLargeException","UnsupportedMediaTypeException","ImATeapotException","UnprocessableEntityException","InternalServerErrorException","NotImplementedException","BadGatewayException","ServiceUnavailableException","GatewayTimeoutException","HttpVersionNotSupportedException","TooManyRequestsException","HttpStatus","OK","CREATED","ACCEPTED","NO_CONTENT","MOVED_PERMANENTLY","FOUND","NOT_MODIFIED","TEMPORARY_REDIRECT","PERMANENT_REDIRECT","BAD_REQUEST","UNAUTHORIZED","PAYMENT_REQUIRED","FORBIDDEN","NOT_FOUND","METHOD_NOT_ALLOWED","NOT_ACCEPTABLE","REQUEST_TIMEOUT","CONFLICT","GONE","PRECONDITION_FAILED","PAYLOAD_TOO_LARGE","UNSUPPORTED_MEDIA_TYPE","IM_A_TEAPOT","UNPROCESSABLE_ENTITY","TOO_MANY_REQUESTS","INTERNAL_SERVER_ERROR","NOT_IMPLEMENTED","BAD_GATEWAY","SERVICE_UNAVAILABLE","GATEWAY_TIMEOUT"]}

package/dist/{chunk-HLW7YKZE.js → chunk-BSS3KPGY.js}

@@ -1,6 +1,6 @@
 import {
   __name
-} from "./chunk-7QVYU63E.js";
+} from "./chunk-Z4QWC7IK.js";
 
 // src/bridge/runtime/node.ts
 import { createServer } from "http";
@@ -96,4 +96,4 @@ export {
   writeResponseToNode,
   createNodeAdapter
 };
-//# sourceMappingURL=chunk-HLW7YKZE.js.map
+//# sourceMappingURL=chunk-BSS3KPGY.js.map

package/dist/chunk-BSS3KPGY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bridge/runtime/node.ts"],"mappings":";;;;;AAQA,SAASA,oBAA+D;AACxE,SAASC,gBAAgB;AAKlB,SAASC,sBAAsBC,SAAwB;AAC5D,QAAMC,QAAQD,QAAQE,QAAQ,mBAAA,KAAwB;AACtD,QAAMC,OAAOH,QAAQE,QAAQC,QAAQ;AACrC,QAAMC,MAAM,GAAGH,KAAAA,MAAWE,IAAAA,GAAOH,QAAQI,OAAO,GAAA;AAChD,QAAMC,SAASL,QAAQK,UAAU;AAEjC,QAAMH,UAAU,IAAII,QAAAA;AACpB,aAAW,CAACC,KAAKC,KAAAA,KAAUC,OAAOC,QAAQV,QAAQE,OAAO,GAAG;AAC1D,QAAIM,UAAUG,QAAW;AACvB,UAAIC,MAAMC,QAAQL,KAAAA,GAAQ;AACxB,mBAAWM,KAAKN,MAAON,SAAQa,OAAOR,KAAKO,CAAAA;MAC7C,OAAO;AACLZ,gBAAQc,IAAIT,KAAKC,KAAAA;MACnB;IACF;EACF;AAGA,QAAMS,UAAUZ,WAAW,SAASA,WAAW,UAAUA,WAAW;AACpE,QAAMa,OAAOD,UAAWE,SAASC,MAAMpB,OAAAA,IAA8BW;AAErE,SAAO,IAAIU,QAAQjB,KAAK;IACtBC;IACAH;IACAgB;;IAEAI,QAAQL,UAAU,SAASN;EAC7B,CAAA;AACF;AA5BgBZ;AA+BhB,eAAsBwB,oBACpBC,UACAC,SAAuB;AAEvBA,UAAQC,UAAUF,SAASG,QAAQlB,OAAOmB,YAAYJ,SAAStB,QAAQQ,QAAO,CAAA,CAAA;AAE9E,MAAI,CAACc,SAASN,MAAM;AAClBO,YAAQI,IAAG;AACX;EACF;AAEA,QAAMC,SAASN,SAASN,KAAKa,UAAS;AACtC,MAAI;AAEF,WAAO,MAAM;AACX,YAAM,EAAEC,MAAMxB,MAAK,IAAK,MAAMsB,OAAOG,KAAI;AACzC,UAAID,KAAM;AACV,UAAIP,QAAQS,UAAW;AACvBT,cAAQU,MAAM3B,KAAAA;IAChB;EACF,UAAA;AACEsB,WAAOM,YAAW;AAClB,QAAI,CAACX,QAAQS,UAAWT,SAAQI,IAAG;EACrC;AACF;AAxBsBN;AA2Bf,SAASc,oBAAAA;AACd,SAAO;IACLC,aAAaC,SAAO;AAClB,YAAMC,SAASF,aAAa,CAACtC,SAASyB,YAAAA;AACpC,cAAM,YAAA;AACJ,cAAI;AACF,kBAAMgB,UAAU1C,sBAAsBC,OAAAA;AACtC,kBAAMwB,WAAW,MAAMe,QAAQE,OAAAA;AAC/B,kBAAMlB,oBAAoBC,UAAUC,OAAAA;UACtC,SAASiB,KAAK;AACZ,gBAAI,CAACjB,QAAQS,WAAW;AACtBT,sBAAQC,UAAU,KAAK;gBAAE,gBAAgB;cAAmB,CAAA;AAC5DD,sBAAQI,IACNc,KAAKC,UAAU;gBACbC,OAAO;kBACLC,MAAM;kBACNC,SAASL,eAAeM,QAAQN,IAAIK,UAAU;gBAChD;cACF,CAAA,CAAA;YAEJ;UACF;QACF,GAAA;MACF,CAAA;AAEA,aAAO;QACLE,QAAQ,wBAACC,MAAcC,OAAoBX,OAAOS,OAAOC,MAAMC,EAAAA,GAAvD;QACRC,OAAO,wBAACD,OAAoBX,OAAOY,MAAMD,EAAAA,GAAlC;QACPE,SAAS,6BAAA;AACP,gBAAMC,OAAOd,OAAOa,QAAO;AAC3B,cAAI,OAAOC,SAAS,YAAYA,SAAS,KAAM,QAAO;AACtD,iBAAO;YAAEJ,MAAMI,KAAKJ;UAAK;QAC3B,GAJS;MAKX;IACF;EACF;AACF;AApCgBb;","names":["createServer","Readable","nodeIncomingToRequest","nodeReq","proto","headers","host","url","method","Headers","key","value","Object","entries","undefined","Array","isArray","v","append","set","hasBody","body","Readable","toWeb","Request","duplex","writeResponseToNode","response","nodeRes","writeHead","status","fromEntries","end","reader","getReader","done","read","destroyed","write","releaseLock","createNodeAdapter","createServer","handler","server","request","err","JSON","stringify","error","code","message","Error","listen","port","cb","close","address","addr"]}

package/dist/{chunk-OBHHOS6E.js → chunk-DI7KNIMB.js}

@@ -1,12 +1,12 @@
 import {
   HttpDecoratorsConfigError
-} from "./chunk-JQMJK47T.js";
+} from "./chunk-X7Q5HPLK.js";
 import {
   resolveOrNew
-} from "./chunk-MQAJWR3K.js";
+} from "./chunk-JP4J23TV.js";
 import {
   __name
-} from "./chunk-7QVYU63E.js";
+} from "./chunk-Z4QWC7IK.js";
 
 // src/bridge/middleware-consumer.ts
 var MiddlewareConsumerImpl = class {
@@ -254,4 +254,4 @@ export {
   loadControllersFromGlob,
   isControllerClass
 };
-//# sourceMappingURL=chunk-OBHHOS6E.js.map
+//# sourceMappingURL=chunk-DI7KNIMB.js.map

package/dist/chunk-DI7KNIMB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bridge/middleware-consumer.ts","../src/bridge/swc-loader.ts"],"mappings":";;;;;;;;;;;AAqCO,IAAMA,yBAAN,MAAMA;EArCb,OAqCaA;;;EACHC,UAAgC,CAAA;EAChCC;EAER,YAAYA,WAAyB;AACnC,SAAKA,YAAYA;EACnB;EAEAC,SAASC,YAAgE;AACvE,UAAMC,WAAWD,WAAWE,IAAI,CAACC,MAAM,KAAKC,kBAAkBD,CAAAA,CAAAA;AAC9D,UAAME,kBAA4B,CAAA;AAElC,UAAMC,QAA+B;MACnCC,SAAS,2BAAIC,WAAAA;AACX,mBAAWC,KAAKD,OAAQH,iBAAgBK,KAAK,OAAOD,MAAM,WAAWA,IAAIA,EAAEE,IAAI;AAC/E,eAAOL;MACT,GAHS;MAITM,WAAW,2BAAIJ,WAAAA;AACb,cAAMK,gBAAgBL,OAAON,IAAI,CAACO,MAAO,OAAOA,MAAM,WAAWA,IAAIA,EAAEE,IAAI;AAC3E,mBAAWG,WAAWb,UAAU;AAC9B,eAAKJ,QAAQa,KAAK;YAChBI;YACAD,eAAe;iBAAIA;;YACnBR,iBAAiB;iBAAIA;;UACvB,CAAA;QACF;AACA,eAAO;MACT,GAVW;IAWb;AACA,WAAOC;EACT;EAEAS,aAAmC;AACjC,WAAO,KAAKlB;EACd;EAEQO,kBAAkBD,GAA0C;AAClE,QAAI,OAAOA,MAAM,cAAc,CAACA,EAAEa,WAAWC,KAAK;AAChD,aAAOd;IACT;AACA,UAAMe,WAAWC,aAAahB,GAAG,KAAKL,SAAS;AAC/C,WAAO,CAACsB,SAASC,SAASH,SAASD,IAAIG,SAASC,IAAAA;EAClD;AACF;AAEO,SAASC,sBAAsBC,OAA2BC,aAAmB;AAClF,aAAWC,WAAWF,MAAMlB,iBAAiB;AAC3C,QAAIqB,YAAYF,aAAaC,OAAAA,EAAU,QAAO;EAChD;AACA,aAAWA,WAAWF,MAAMV,eAAe;AACzC,QAAIa,YAAYF,aAAaC,OAAAA,EAAU,QAAO;EAChD;AACA,SAAO;AACT;AARgBH;AAUhB,SAASI,YAAYF,aAAqBC,SAAe;AACvD,MAAIA,YAAY,IAAK,QAAO;AAC5B,QAAME,YAAY,MAAMH,aAAaI,QAAQ,QAAQ,GAAA,EAAKA,QAAQ,OAAO,EAAA;AACzE,QAAMC,eAAe,MAAMJ,SAASG,QAAQ,QAAQ,GAAA,EAAKA,QAAQ,OAAO,EAAA;AACxE,SAAOD,aAAaE,eAAeF,SAASG,WAAWD,cAAc,GAAA;AACvE;AALSH;AAUT,eAAsBK,cACpBlC,SACAuB,SACAI,aAAmB;AAEnB,aAAWD,SAAS1B,SAAS;AAC3B,QAAI,CAACyB,sBAAsBC,OAAOC,WAAAA,EAAc;AAChD,UAAMQ,WAAW,MAAMT,MAAMT,QAAQM,SAAS,MAAMa,QAAQC,QAAQ,IAAA,CAAA;AACpE,QAAIF,SAAU,QAAOA;EACvB;AACA,SAAO;AACT;AAXsBD;;;AClFtB,OAAO;AACP,SAASI,cAAcC,eAAeC,YAAYC,mBAAmB;AACrE,SAASC,qBAAqB;AAC9B,SAASC,SAASC,SAASC,MAAMC,gBAAgB;AACjD,SAASC,eAAeC,qBAAqB;AAK7C,SAASC,eAAeC,OAAqC;AAC3D,MAAI,CAACA,MAAO,QAAO;AACnB,QAAMC,MAAMD,MAAMC;AAClB,MAAI,OAAOA,QAAQ,YAAYA,QAAQ,KAAM,QAAO;AACpD,QAAMC,SAAUD,IAAgCC;AAChD,SAAO,OAAOA,WAAW,WAAWA,SAAS;AAC/C;AANSH;AAST,IAAII;AAOJ,SAASC,kBAAkBC,UAAgB;AACzC,MAAIF,uBAAuBG,OAAW,QAAOH;AAE7C,MAAII,MAAMF;AACV,QAAMG,OAAOC,QAAQF,GAAAA;AACrB,SAAOA,QAAQC,MAAM;AACnB,UAAME,YAAYC,KAAKJ,KAAK,QAAA;AAC5B,QAAI;AACF,YAAMK,MAAMC,aAAaH,WAAW,OAAA;AACpC,YAAMI,SAASC,KAAKC,MAAMJ,GAAAA;AAE1B,aAAOE,OAAOG;AACdd,2BAAqBW;AACrB,aAAOA;IACT,QAAQ;IAER;AACA,UAAMI,SAAST,QAAQF,GAAAA;AACvB,QAAIW,WAAWX,IAAK;AACpBA,UAAMW;EACR;AAEAf,uBAAqB;AACrB,SAAO;AACT;AAxBSC;AA+BT,IAAIe;AAYJ,eAAeC,cAAAA;AACb,MAAID,iBAAiBb,OAAW,QAAOa;AAEvC,MAAI;AACFA,mBAAgB,MAAM,OAAO,WAAA;EAC/B,QAAQ;AACN,QAAI;AACF,YAAME,UAAUZ,QAAQa,cAAc,YAAYC,GAAG,CAAA;AACrD,YAAMC,MAAMC,cAAcC,QAAQL,SAAS,UAAA,CAAA;AAC3C,YAAMM,WAAWH,IAAIE,QAAQ,WAAA;AAC7BP,qBAAgB,MAAM,OAAOS,cAAcD,QAAAA,EAAUE;IACvD,QAAQ;AACNV,qBAAe;IACjB;EACF;AACA,SAAOA;AACT;AAhBeC;AA8Bf,eAAsBU,0BACpBC,QACAC,UACAC,UAAyCb,aAAW;AAEpD,QAAMc,MAAM,MAAMD,QAAAA;AAClB,MAAI,CAACC,KAAK;AACR,UAAM,IAAIC,0BACR;;;;sHAG2D;EAE/D;AAEA,QAAMC,gBAAgBhC,kBAAkBK,QAAQuB,QAAAA,CAAAA;AAChD,QAAMK,cACJD,eAAenC,OAAO,OAAOmC,cAAcnC,QAAQ,WAC9CmC,cAAcnC,MACf;AACN,QAAM,EAAEqC,KAAI,IAAKJ,IAAIK,cAAcR,QAAQ;IACzCC;IACA/B,KAAK;MACHuC,QAAQ;QACNC,QAAQ;QACRC,YAAY;QACZ,GAAIL,aAAaG;MACnB;MACAG,WAAW;QACT,GAAIN,aAAaM;;;QAGjBC,iBAAiB;QACjBC,mBAAmB;MACrB;MACA3C,QAAQH,eAAeqC,aAAAA;IACzB;IACAU,QAAQ;MAAEC,MAAM;IAAM;IACtBC,YAAY;EACd,CAAA;AACA,SAAOV;AACT;AAzCsBR;AAsDtB,eAAsBmB,sBACpBC,kBAAwB;AAExB,QAAMnB,SAASlB,aAAaqC,kBAAkB,OAAA;AAC9C,QAAMZ,OAAO,MAAMR,0BAA0BC,QAAQmB,gBAAAA;AAKrD,QAAMC,UAAUD,iBAAiBE,QAAQ,SAAS,oBAAA;AAClDC,gBAAcF,SAASb,MAAM,OAAA;AAC7B,MAAI;AACF,UAAMf,MAAMK,cAAcuB,OAAAA,EAAStB,OAAO,MAAMyB,KAAKC,IAAG,CAAA;AACxD,WAAQ,MAAM,OAAOhC;EACvB,UAAA;AACE,QAAI;AACFiC,iBAAWL,OAAAA;IACb,QAAQ;IAER;EACF;AACF;AArBsBF;AA2BtB,eAAsBQ,wBACpBC,SACAC,SAAe;AAEf,QAAMC,QAAQC,oBAAoBH,SAASC,OAAAA;AAC3C,MAAIC,MAAME,WAAW,GAAG;AACtBC,YAAQC,KACN,uDAAuDL,OAAAA,QAC/CD,OAAAA,kEAAyE;AAEnF,WAAO,CAAA;EACT;AAEA,QAAMO,cAA0B,CAAA;AAChC,aAAWC,QAAQN,OAAO;AACxB,UAAMO,UAAUzC,QAAQgC,SAASQ,IAAAA;AACjC,UAAME,MAAM,MAAMnB,sBAAsBkB,OAAAA;AACxC,eAAWE,YAAYC,OAAOC,OAAOH,GAAAA,GAAM;AACzC,UAAI,OAAOC,aAAa,cAAcG,kBAAkBH,QAAAA,GAAW;AACjEJ,oBAAYQ,KAAKJ,QAAAA;MACnB;IACF;EACF;AAEA,SAAOJ;AACT;AAzBsBR;AAgCf,SAASe,kBAAkBE,IAAY;AAC5C,MAAI;AACF,WAAOC,QAAQC,YAAYC,uBAAOC,IAAI,2CAAA,GAA8CJ,EAAAA;EACtF,QAAQ;AACN,WAAO;EACT;AACF;AANgBF;AAahB,SAASX,oBAAoBH,SAAiBC,SAAe;AAC3D,QAAMoB,QAAQpB,QAAQqB,MAAM,GAAA;AAC5B,QAAMC,WAAqB,CAAA;AAC3B,aAAWC,QAAQH,OAAO;AACxB,QAAIG,KAAKC,SAAS,GAAA,EAAM;AACxBF,aAASR,KAAKS,IAAAA;EAChB;AACA,QAAME,UAAUzE,KAAK+C,SAAAA,GAAYuB,QAAAA;AAGjC,QAAMI,WAAWN,MAAMA,MAAMjB,SAAS,CAAA;AACtC,QAAMwB,SAASD,SAASjC,QAAQ,OAAO,EAAA;AAEvC,QAAMQ,QAAkB,CAAA;AACxB,WAAS2B,KAAKhF,KAAW;AACvB,QAAI;AACF,iBAAWiF,SAASC,YAAYlF,KAAK;QAAEmF,eAAe;MAAK,CAAA,GAAI;AAC7D,cAAMC,OAAOhF,KAAKJ,KAAKiF,MAAMI,IAAI;AACjC,YAAIJ,MAAMK,YAAW,EAAIN,MAAKI,IAAAA;iBACrBH,MAAMI,KAAKE,SAASR,MAAAA,EAAS1B,OAAMa,KAAKsB,SAASrC,SAASiC,IAAAA,CAAAA;MACrE;IACF,QAAQ;IAER;EACF;AAVSJ;AAWTA,OAAKH,OAAAA;AACL,SAAOxB;AACT;AA3BSC;","names":["MiddlewareConsumerImpl","entries","container","apply","middleware","resolved","map","m","resolveMiddleware","excludePatterns","proxy","exclude","routes","r","push","path","forRoutes","routePatterns","handler","getEntries","prototype","use","instance","resolveOrNew","request","next","middlewareMatchesPath","entry","requestPath","pattern","pathMatches","normPath","replace","normPattern","startsWith","runMiddleware","response","Promise","resolve","readFileSync","writeFileSync","unlinkSync","readdirSync","createRequire","resolve","dirname","join","relative","pathToFileURL","fileURLToPath","getSwcrcTarget","swcrc","jsc","target","consumerSwcrcCache","readConsumerSwcrc","startDir","undefined","dir","root","dirname","candidate","join","raw","readFileSync","parsed","JSON","parse","$schema","parent","swcCoreCache","loadSwcCore","thisDir","fileURLToPath","url","req","createRequire","resolve","resolved","pathToFileURL","href","transformControllerSource","source","filename","loadSwc","swc","HttpDecoratorsConfigError","consumerSwcrc","consumerJsc","code","transformSync","parser","syntax","decorators","transform","legacyDecorator","decoratorMetadata","module","type","sourceMaps","loadControllerWithSwc","absoluteFilePath","tmpPath","replace","writeFileSync","Date","now","unlinkSync","loadControllersFromGlob","rootDir","pattern","files","scanControllerFiles","length","console","warn","controllers","file","absPath","mod","exported","Object","values","isControllerClass","push","fn","Reflect","hasMetadata","Symbol","for","parts","split","dirParts","part","includes","baseDir","lastPart","suffix","walk","entry","readdirSync","withFileTypes","full","name","isDirectory","endsWith","relative"]}