theokit 0.19.2 → 0.19.3

package/dist/chunk-34YQOXGM.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/scan/agent-scan.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks `<projectRoot>/agents/` derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { existsSync, statSync } from 'node:fs'\nimport { extname, join, relative } from 'node:path'\n\nimport { walkSourceFiles } from '../_internal/scan-walker.js'\n\nconst AGENT_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\n// Convention § 5: a co-located test file is not an agent.\nconst TEST_FILE = /\\.(test|spec)$/\n\n/**\n * A discovered agent file. `name` is the client-facing key; `agentPath` is the mounted\n * SSE route (M0/M1 `UIMessageStream`).\n */\nexport interface AgentNode {\n  filePath: string\n  agentPath: string\n  name: string\n}\n\n/**\n * M2 — scan the TOP-LEVEL `agents/` convention (sibling of `server/`, per the LOCKED naming\n * decision). Mirrors `scanWebSocketRoutes`: one file → one endpoint, `index` stripped.\n */\nexport function scanAgents(projectRoot: string): AgentNode[] {\n  const agentsDir = join(projectRoot, 'agents')\n  if (!existsSync(agentsDir) || !statSync(agentsDir).isDirectory()) {\n    return []\n  }\n\n  const results: AgentNode[] = []\n  walkSourceFiles(agentsDir, { extensions: AGENT_EXTENSIONS }, (absPath) => {\n    let rel = relative(agentsDir, absPath)\n    rel = rel.replace(/\\\\/g, '/')\n    rel = rel.slice(0, -extname(rel).length)\n    if (TEST_FILE.test(rel)) return\n    // Unlike routes/ws, an agent needs an explicit name — a bare `agents/index.ts`\n    // (name `''` → `/api/agents/`) is nonsensical for a typed `useAgent(name)` binding.\n    // `agents/foo/index.ts` still collapses to `foo` (a named nested agent).\n    if (rel.endsWith('/index')) rel = rel.slice(0, -6)\n    if (rel === 'index' || rel === '') return\n    results.push({\n      filePath: absPath,\n      agentPath: `/api/agents/${rel}`,\n      name: rel,\n    })\n  })\n  return results\n}\n"],"mappings":";;;;;;;AAIA,SAAS,YAAY,gBAAgB;AACrC,SAAS,SAAS,MAAM,gBAAgB;AAIxC,IAAM,mBAAmB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAE/D,IAAM,YAAY;AAgBX,SAAS,WAAW,aAAkC;AAC3D,QAAM,YAAY,KAAK,aAAa,QAAQ;AAC5C,MAAI,CAAC,WAAW,SAAS,KAAK,CAAC,SAAS,SAAS,EAAE,YAAY,GAAG;AAChE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAuB,CAAC;AAC9B,kBAAgB,WAAW,EAAE,YAAY,iBAAiB,GAAG,CAAC,YAAY;AACxE,QAAI,MAAM,SAAS,WAAW,OAAO;AACrC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM;AACvC,QAAI,UAAU,KAAK,GAAG,EAAG;AAIzB,QAAI,IAAI,SAAS,QAAQ,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AACjD,QAAI,QAAQ,WAAW,QAAQ,GAAI;AACnC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,WAAW,eAAe,GAAG;AAAA,MAC7B,MAAM;AAAA,IACR,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;","names":[]}

package/dist/chunk-AKTGTUU5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/scan/action-scan.ts","../src/server/scan/agent-scan.ts","../src/server/scan/match.ts","../src/server/scan/scan.ts","../src/server/scan/detect-http-methods.ts","../src/server/scan/errors.ts","../src/server/scan/ws-scan.ts","../src/server/scan/manifest.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks `serverDir/actions/` derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { existsSync, readFileSync, statSync } from 'node:fs'\nimport { extname, join, relative } from 'node:path'\n\nimport { walkSourceFiles } from '../_internal/scan-walker.js'\n\nexport interface ActionNode {\n  filePath: string\n  actionPath: string\n}\n\n/**\n * Enriched manifest entry per plan g3-server-actions-and-useaction v1.2\n * § Phase 1 / T1.4 + ADR D4. Consumed by virtual module `@theo/actions`\n * (T3.1) and G4 devtools \"Actions\" tab (T5.1).\n */\nexport interface ActionManifestEntry {\n  name: string\n  filePath: string\n  urlPath: string\n  accept: 'form' | 'json'\n  hasInput: boolean\n  /**\n   * P#4 plugin-forms shared-schema convention (per plan p4-plugin-forms v1.1 T1.1).\n   * When present, points to an isomorphic schema file at\n   * `<serverDir>/actions/schemas/<basename>.ts` exporting `export const schema = z.object(...)`.\n   * Virtual module emits `import {schema} from '<schemaFilePath>'` + attaches as\n   * `actions.X.__zodSchema` so client-side <TheoForm> can drive zodResolver.\n   * Undefined when convention not followed (graceful degrade — TheoForm still\n   * works via explicit `schema={...}` prop escape hatch).\n   */\n  schemaFilePath?: string\n}\n\n/**\n * EC-2: structured error for scan-time defects (name collision, reserved\n * identifier, etc.). Throw at scan time to fail loud — silent shadowing is\n * a security/correctness footgun.\n */\nexport class ActionScanError extends Error {\n  readonly code: 'NAME_COLLISION' | 'RESERVED_NAME'\n  readonly conflictingPaths: readonly string[]\n\n  constructor(\n    code: 'NAME_COLLISION' | 'RESERVED_NAME',\n    message: string,\n    conflictingPaths: readonly string[],\n  ) {\n    super(message)\n    // T4.1 fix: identify class by name so serverErrorToEnvelope boundary\n    // translator can route via class-name lookup (without this, runtime\n    // `err.name` defaults to 'Error' and the meta.name diagnostic is wrong).\n    this.name = 'ActionScanError'\n    this.code = code\n    this.conflictingPaths = conflictingPaths\n  }\n}\n\nconst ACTION_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\nconst TEST_FILE_RE = /\\.(test|spec)\\.(ts|tsx|js|jsx)$/\nconst RESERVED_NAMES = new Set(['index', 'constructor', '__proto__', 'prototype', 'hasOwnProperty'])\n\n/**\n * Backward-compatible: original simple-shape scanner used by existing\n * consumers. Preserved verbatim; new consumers should call\n * `scanServerActionsEnriched`.\n */\nexport function scanServerActions(serverDir: string): ActionNode[] {\n  const actionsDir = join(serverDir, 'actions')\n  if (!existsSync(actionsDir) || !statSync(actionsDir).isDirectory()) {\n    return []\n  }\n\n  const results: ActionNode[] = []\n  walkSourceFiles(actionsDir, { extensions: ACTION_EXTENSIONS }, (absPath) => {\n    if (TEST_FILE_RE.test(absPath)) return\n    let rel = relative(actionsDir, absPath)\n    rel = rel.replace(/\\\\/g, '/')\n    rel = rel.slice(0, -extname(rel).length)\n    results.push({\n      filePath: absPath,\n      actionPath: rel,\n    })\n  })\n  return results\n}\n\n/**\n * Enriched scan: light AST detection of `accept: 'form'|'json'` + `input:`\n * presence via regex-after-comment-stripping (EC-9). Throws ActionScanError\n * on file/dir name collision (EC-2) or reserved JS identifier names.\n *\n * Output `ActionManifestEntry[]` is sorted by `name` for deterministic\n * `.theokit/actions-manifest.json` emission.\n */\nexport function scanServerActionsEnriched(serverDir: string): ActionManifestEntry[] {\n  const actionsDir = join(serverDir, 'actions')\n  if (!existsSync(actionsDir) || !statSync(actionsDir).isDirectory()) {\n    return []\n  }\n\n  const seenNames = new Set<string>()\n  const entries: ActionManifestEntry[] = []\n\n  // Collect first; collision-check after the full walk.\n  walkSourceFiles(actionsDir, { extensions: ACTION_EXTENSIONS }, (absPath) => {\n    if (TEST_FILE_RE.test(absPath)) return\n    const rel = relative(actionsDir, absPath).replace(/\\\\/g, '/')\n    // P#4 plugin-forms — `schemas/` subdir holds isomorphic zod schemas\n    // for the shared-schema convention (T1.1). NOT executable actions; skip.\n    if (rel.startsWith('schemas/')) return\n    const name = rel.slice(0, -extname(rel).length)\n\n    const basename = name.includes('/') ? (name.split('/').pop() ?? name) : name\n    if (RESERVED_NAMES.has(basename)) {\n      throw new ActionScanError(\n        'RESERVED_NAME',\n        `Reserved JS identifier \"${basename}\" cannot be an action name (${absPath})`,\n        [absPath],\n      )\n    }\n    // File-level collision (one file appearing twice) is impossible via the\n    // walker; per-export collision check happens inside the export loop below.\n    const source = readFileSync(absPath, 'utf8')\n    const stripped = stripComments(source)\n    const accept = /\\baccept\\s*:\\s*['\"]form['\"]/.test(stripped) ? 'form' : 'json'\n    const hasInput = /\\binput\\s*:\\s*z\\./.test(stripped) || /\\binput\\s*:\\s*\\w+\\(/.test(stripped)\n\n    // T7.1 wire fix — extract exports so the urlPath includes the second\n    // segment required by action-middleware (`/api/__actions/<file>/<export>`).\n    // Each named action export becomes its own manifest entry.\n    // Proxy key on the EXPORT name (so consumers write `actions.saveMemory(input)`).\n    // URL keeps the runtime 2-segment shape `/api/__actions/<file>/<export>`\n    // expected by action-middleware. Cross-file export collisions become a\n    // scan error to surface the ambiguity early.\n    const exportNames = extractActionExportNames(stripped)\n    // P#4 plugin-forms shared-schema convention: check for\n    // `<actionsDir>/schemas/<basename>.ts` (or .tsx/.js/.jsx).\n    // Skip when actions live in subdirs (`schemas/` is flat by convention).\n    const schemaFilePath = name.includes('/') ? undefined : detectSchemaFile(actionsDir, basename)\n    for (const exportName of exportNames) {\n      const proxyKey = exportName === 'default' ? name : exportName\n      if (seenNames.has(proxyKey)) {\n        throw new ActionScanError(\n          'NAME_COLLISION',\n          `Duplicate action proxy key \"${proxyKey}\" (two files export the same name)`,\n          [absPath],\n        )\n      }\n      seenNames.add(proxyKey)\n      const entry: ActionManifestEntry = {\n        name: proxyKey,\n        filePath: absPath,\n        urlPath: `/api/__actions/${name}/${exportName}`,\n        accept,\n        hasInput,\n      }\n      if (schemaFilePath !== undefined) {\n        entry.schemaFilePath = schemaFilePath\n      }\n      entries.push(entry)\n    }\n  })\n\n  // EC-2: detect file vs dir collisions (e.g., foo.ts AND foo/bar.ts).\n  // After walk completes, any name that has children prefixed `name/` triggers collision.\n  for (const entry of entries) {\n    const childPrefix = `${entry.name}/`\n    const conflictingChild = entries.find((other) => other.name.startsWith(childPrefix))\n    if (conflictingChild) {\n      throw new ActionScanError(\n        'NAME_COLLISION',\n        `Action \"${entry.name}\" conflicts with directory of same name containing \"${conflictingChild.name}\"`,\n        [entry.filePath, conflictingChild.filePath],\n      )\n    }\n  }\n\n  entries.sort((a, b) => {\n    if (a.name < b.name) return -1\n    if (a.name > b.name) return 1\n    return 0\n  })\n  return entries\n}\n\n/**\n * Strip JavaScript line + block comments from source. Simple state machine\n * (does not parse strings — false positives if a comment marker appears\n * inside a string literal, but that's an acceptable trade-off for v1 vs\n * full AST parse).\n */\n/**\n * Extract action export names via regex over comment-stripped source.\n * Matches `export const <name> = defineAction(...)`, `export default\n * defineAction(...)`, and `export function <name>(...)` forms. Returns\n * `['default']` when no named action exports are found (best-effort fallback\n * for default-export shapes the regex misses).\n */\nfunction extractActionExportNames(stripped: string): string[] {\n  const names = new Set<string>()\n  const namedRe = /\\bexport\\s+(?:const|let|var|function\\*?)\\s+([a-zA-Z_$][\\w$]*)\\s*[=(]/g\n  let m: RegExpExecArray | null\n  while ((m = namedRe.exec(stripped)) !== null) {\n    const name = m[1]\n    if (typeof name === 'string' && name.length > 0) names.add(name)\n  }\n  if (/\\bexport\\s+default\\s+defineAction\\b/.test(stripped)) {\n    names.add('default')\n  }\n  if (names.size === 0) names.add('default')\n  return [...names]\n}\n\n/**\n * P#4 plugin-forms shared-schema convention helper (per plan p4-plugin-forms v1.1 T1.1).\n * Returns the resolved path to `<actionsDir>/schemas/<basename>.<ext>` if it exists.\n * Tries `.ts`, `.tsx`, `.js`, `.jsx` in that order. Returns undefined when no match.\n */\nfunction detectSchemaFile(actionsDir: string, basename: string): string | undefined {\n  const schemasDir = join(actionsDir, 'schemas')\n  if (!existsSync(schemasDir)) return undefined\n  for (const ext of ['.ts', '.tsx', '.js', '.jsx']) {\n    const candidate = join(schemasDir, `${basename}${ext}`)\n    if (existsSync(candidate)) return candidate\n  }\n  return undefined\n}\n\nfunction stripComments(source: string): string {\n  let out = ''\n  let i = 0\n  while (i < source.length) {\n    const ch = source[i]\n    const next = source[i + 1]\n    if (ch === '/' && next === '/') {\n      // Line comment: skip until newline\n      while (i < source.length && source[i] !== '\\n') i++\n      continue\n    }\n    if (ch === '/' && next === '*') {\n      // Block comment: skip until */\n      i += 2\n      while (i < source.length - 1 && !(source[i] === '*' && source[i + 1] === '/')) i++\n      i += 2\n      continue\n    }\n    out += ch\n    i++\n  }\n  return out\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks `<projectRoot>/agents/` derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { existsSync, statSync } from 'node:fs'\nimport { extname, join, relative } from 'node:path'\n\nimport { walkSourceFiles } from '../_internal/scan-walker.js'\n\nconst AGENT_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\n// Convention § 5: a co-located test file is not an agent.\nconst TEST_FILE = /\\.(test|spec)$/\n\n/**\n * A discovered agent file. `name` is the client-facing key; `agentPath` is the mounted\n * SSE route (M0/M1 `UIMessageStream`).\n */\nexport interface AgentNode {\n  filePath: string\n  agentPath: string\n  name: string\n}\n\n/**\n * M2 — scan the TOP-LEVEL `agents/` convention (sibling of `server/`, per the LOCKED naming\n * decision). Mirrors `scanWebSocketRoutes`: one file → one endpoint, `index` stripped.\n */\nexport function scanAgents(projectRoot: string): AgentNode[] {\n  const agentsDir = join(projectRoot, 'agents')\n  if (!existsSync(agentsDir) || !statSync(agentsDir).isDirectory()) {\n    return []\n  }\n\n  const results: AgentNode[] = []\n  walkSourceFiles(agentsDir, { extensions: AGENT_EXTENSIONS }, (absPath) => {\n    let rel = relative(agentsDir, absPath)\n    rel = rel.replace(/\\\\/g, '/')\n    rel = rel.slice(0, -extname(rel).length)\n    if (TEST_FILE.test(rel)) return\n    // Unlike routes/ws, an agent needs an explicit name — a bare `agents/index.ts`\n    // (name `''` → `/api/agents/`) is nonsensical for a typed `useAgent(name)` binding.\n    // `agents/foo/index.ts` still collapses to `foo` (a named nested agent).\n    if (rel.endsWith('/index')) rel = rel.slice(0, -6)\n    if (rel === 'index' || rel === '') return\n    results.push({\n      filePath: absPath,\n      agentPath: `/api/agents/${rel}`,\n      name: rel,\n    })\n  })\n  return results\n}\n","export interface ServerRouteNode {\n  filePath: string\n  routePath: string\n  paramNames: string[]\n  pattern: RegExp\n  /** HTTP methods (uppercase) the route file exports. Optional for backward\n   * compatibility with manifests generated before G1. Empty array means the\n   * file has no HTTP exports (util-only); undefined means \"not detected\". */\n  methods?: string[]\n}\n\nexport function compilePattern(routePath: string): {\n  pattern: RegExp\n  paramNames: string[]\n} {\n  const paramNames: string[] = []\n  // Single pass: handle both catch-all (:...name) and regular (:name) params\n  const regexStr = routePath.replace(/:(?:\\.\\.\\.)?([^/]+)/g, (match: string, name: string) => {\n    paramNames.push(name)\n    // Catch-all matches across slashes, regular matches single segment\n    return match.startsWith(':...') ? '(.+)' : '([^/]+)'\n  })\n  // `regexStr` is derived from a developer-authored route path (build-time\n  // input, not HTTP-controlled). The `security/detect-non-literal-regexp`\n  // rule cannot see this constraint — disable narrowly.\n  // eslint-disable-next-line security/detect-non-literal-regexp -- route pattern from build-time scan, never HTTP input\n  return { pattern: new RegExp(`^${regexStr}$`), paramNames }\n}\n\nexport function matchRoute(\n  url: string,\n  routes: ServerRouteNode[],\n): { route: ServerRouteNode; params: Record<string, string> } | null {\n  // Strip query string and trailing slash\n  let path = url.split('?')[0]\n  if (path.length > 1 && path.endsWith('/')) {\n    path = path.slice(0, -1)\n  }\n\n  for (const route of routes) {\n    const match = route.pattern.exec(path)\n    if (match) {\n      const params: Record<string, string> = {}\n      route.paramNames.forEach((name, i) => {\n        params[name] = match[i + 1]\n      })\n      return { route, params }\n    }\n  }\n  return null\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks `serverDir/routes/` derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { existsSync, statSync } from 'node:fs'\nimport { basename, extname, join, relative } from 'node:path'\n\nimport { walkSourceFiles } from '../_internal/scan-walker.js'\n\nimport { detectExportedHttpMethods } from './detect-http-methods.js'\nimport { RouterConventionError } from './errors.js'\nimport { compilePattern, type ServerRouteNode } from './match.js'\n\nconst ROUTE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\n\n// EC-4: Co-located unit/spec tests must be silently skipped by the scanner,\n// BEFORE the dotted-basename check fires. Matches `*.test.ts|tsx|js|jsx`\n// and `*.spec.ts|tsx|js|jsx`.\nconst TEST_OR_SPEC_RE = /\\.(test|spec)\\.[jt]sx?$/\n\nfunction isTestOrSpecFile(filePath: string): boolean {\n  return TEST_OR_SPEC_RE.test(basename(filePath))\n}\n\nfunction hasDotOutsideBrackets(segment: string): boolean {\n  let depth = 0\n  for (const ch of segment) {\n    if (ch === '[') depth++\n    else if (ch === ']') depth--\n    else if (ch === '.' && depth === 0) return true\n  }\n  return false\n}\n\nfunction splitDottedSegmentOutsideBrackets(segment: string): string[] {\n  const parts: string[] = []\n  let current = ''\n  let depth = 0\n  for (const ch of segment) {\n    if (ch === '[') {\n      depth++\n      current += ch\n    } else if (ch === ']') {\n      depth--\n      current += ch\n    } else if (ch === '.' && depth === 0) {\n      if (current) parts.push(current)\n      current = ''\n    } else {\n      current += ch\n    }\n  }\n  if (current) parts.push(current)\n  return parts\n}\n\nfunction buildDirectoryNestedSuggestion(filePath: string, routesDir: string): string {\n  const rel = relative(routesDir, filePath).replace(/\\\\/g, '/')\n  const ext = extname(rel)\n  const withoutExt = rel.slice(0, -ext.length)\n  const segments = withoutExt.split('/').flatMap(splitDottedSegmentOutsideBrackets)\n  return `routes/${segments.join('/')}${ext}`\n}\n\nfunction assertNoDottedSegment(filePath: string, routesDir: string): void {\n  const rel = relative(routesDir, filePath).replace(/\\\\/g, '/')\n  const ext = extname(rel)\n  const withoutExt = rel.slice(0, -ext.length)\n  const segments = withoutExt.split('/')\n  for (const seg of segments) {\n    if (hasDotOutsideBrackets(seg)) {\n      throw new RouterConventionError({\n        file: filePath,\n        suggestion: buildDirectoryNestedSuggestion(filePath, routesDir),\n      })\n    }\n  }\n}\n\nfunction fileToRoutePath(filePath: string, routesDir: string): string {\n  let rel = relative(routesDir, filePath)\n  // Strip extension\n  const ext = extname(rel)\n  rel = rel.slice(0, -ext.length)\n  // Normalize separators\n  rel = rel.replace(/\\\\/g, '/')\n  // Strip index suffix\n  if (rel.endsWith('/index')) {\n    rel = rel.slice(0, -6)\n  } else if (rel === 'index') {\n    rel = ''\n  }\n  // Replace [...param] with :...param (catch-all, before regular params).\n  // Replace [param] with :param. Inputs are file paths bounded by the\n  // OS filename limit; the bracket capture is bounded by `]`.\n  rel = rel.replace(/\\[\\.\\.\\.([^\\]]+)\\]/g, ':...$1')\n  // eslint-disable-next-line sonarjs/slow-regex -- bounded by `]`; input is a single filename\n  rel = rel.replace(/\\[([^\\]]+)\\]/g, ':$1')\n  return `/api/${rel}`\n}\n\nexport function scanServerRoutes(serverDir: string): ServerRouteNode[] {\n  const routesDir = join(serverDir, 'routes')\n  if (!existsSync(routesDir) || !statSync(routesDir).isDirectory()) {\n    return []\n  }\n\n  const results: ServerRouteNode[] = []\n  walkSourceFiles(routesDir, { extensions: ROUTE_EXTENSIONS }, (absPath) => {\n    // EC-4: skip co-located test/spec files BEFORE the dotted-basename check\n    if (isTestOrSpecFile(absPath)) return\n\n    // G6 T1.1: reject dotted basenames (legacy convention that produced wrong\n    // paramNames due to greedy `:(?:\\.\\.\\.)?([^/]+)` regex in compilePattern).\n    assertNoDottedSegment(absPath, routesDir)\n\n    const routePath = fileToRoutePath(absPath, routesDir)\n    const { pattern, paramNames } = compilePattern(routePath)\n    const methods = detectExportedHttpMethods(absPath)\n    results.push({\n      filePath: absPath,\n      routePath,\n      paramNames,\n      pattern,\n      methods,\n    })\n  })\n\n  // T1.4 / EC-2 — refuse to scan if a user route collides with the reserved\n  // batch endpoint path. User must rename or disable batching.\n  const conflicting = results.find((r) => r.routePath === '/api/__theo_batch__')\n  if (conflicting) {\n    throw new Error(\n      `Server route ${conflicting.filePath} resolves to '/api/__theo_batch__' which is reserved for the batch endpoint. Rename the route or disable batching in theo.config.ts.`,\n    )\n  }\n\n  // Sort: static first, then dynamic, then catch-all last\n  const isCatchAll = (route: ServerRouteNode) => route.routePath.includes(':...')\n  results.sort((a, b) => {\n    const aStatic = a.paramNames.length === 0\n    const bStatic = b.paramNames.length === 0\n    const aCatchAll = isCatchAll(a)\n    const bCatchAll = isCatchAll(b)\n\n    // Static routes first\n    if (aStatic && !bStatic) return -1\n    if (!aStatic && bStatic) return 1\n    // Catch-all routes last\n    if (aCatchAll && !bCatchAll) return 1\n    if (!aCatchAll && bCatchAll) return -1\n    return a.routePath.localeCompare(b.routePath)\n  })\n\n  return results\n}\n","/**\n * Detect which HTTP-method named exports a route file declares.\n *\n * Uses the TypeScript compiler API (not regex) per G1 edge-case review EC-4:\n * regex over file content emits false positives for `// export const GET = ...`\n * in comments and `` `export const GET = ...` `` in template literals. AST\n * walking avoids both classes of bug.\n *\n * `typescript` ships as CommonJS with internal dynamic `require('fs')`.\n * When loaded via ESM `import`, the dynamic requires fail at module-bootstrap.\n * We use `createRequire(import.meta.url)` to keep the package on its native\n * CJS path. The type-only namespace import gives us the AST helpers shape.\n *\n * Returns the set of HTTP methods (uppercase) the file exports. Empty array\n * means the file has no HTTP exports (the route file is util-only).\n */\n\nimport { readFileSync } from 'node:fs'\nimport { createRequire } from 'node:module'\n\nimport type * as TS from 'typescript'\n\nimport { HTTP_METHODS, type HttpMethod } from '../../core/contracts/http-methods.js'\n\nconst require_ = createRequire(import.meta.url)\n// eslint-disable-next-line @typescript-eslint/no-require-imports\nconst ts = require_('typescript') as typeof TS\n\nconst HTTP_METHOD_NAMES = new Set<string>(HTTP_METHODS)\n\nfunction hasExportModifier(modifiers: readonly TS.Modifier[] | undefined): boolean {\n  if (!modifiers) return false\n  for (const m of modifiers) {\n    if (m.kind === ts.SyntaxKind.ExportKeyword) return true\n  }\n  return false\n}\n\nfunction collectFromStatement(stmt: TS.Statement, found: Set<HttpMethod>): void {\n  // `export const GET = ...` / `export function GET ...` / `export async function GET ...`\n  if (ts.isVariableStatement(stmt) && hasExportModifier(ts.getModifiers(stmt))) {\n    for (const decl of stmt.declarationList.declarations) {\n      if (ts.isIdentifier(decl.name) && HTTP_METHOD_NAMES.has(decl.name.text)) {\n        found.add(decl.name.text as HttpMethod)\n      }\n    }\n    return\n  }\n\n  if (\n    (ts.isFunctionDeclaration(stmt) || ts.isClassDeclaration(stmt)) &&\n    hasExportModifier(ts.getModifiers(stmt))\n  ) {\n    if (stmt.name && HTTP_METHOD_NAMES.has(stmt.name.text)) {\n      found.add(stmt.name.text as HttpMethod)\n    }\n    return\n  }\n\n  // `export { GET }` / `export { handler as GET } from './shared'` (EC-5)\n  if (ts.isExportDeclaration(stmt) && stmt.exportClause && ts.isNamedExports(stmt.exportClause)) {\n    for (const spec of stmt.exportClause.elements) {\n      // spec.name is the exported (re-)name; spec.propertyName is the original (when renamed)\n      if (HTTP_METHOD_NAMES.has(spec.name.text)) {\n        found.add(spec.name.text as HttpMethod)\n      }\n    }\n  }\n}\n\nexport function detectExportedHttpMethods(filePath: string, content?: string): HttpMethod[] {\n  const src = content ?? readFileSync(filePath, 'utf-8')\n  const sourceFile = ts.createSourceFile(\n    filePath,\n    src,\n    ts.ScriptTarget.Latest,\n    /* setParentNodes */ false,\n    ts.ScriptKind.TS,\n  )\n  const found = new Set<HttpMethod>()\n  for (const stmt of sourceFile.statements) {\n    collectFromStatement(stmt, found)\n  }\n  return [...found].sort()\n}\n","/**\n * Router-convention errors thrown by the server-route scanner.\n *\n * Plan: .claude/knowledge-base/plans/g6-router-convention-plan.md v1.1\n *\n * theokit 0.4.0+ enforces directory-nested file-system routing\n * (`auth/[provider]/login.ts`) and REJECTS dotted-basename routes\n * (`auth.[provider].login.ts`) because the legacy regex extracted the\n * dotted basename incorrectly — `params.provider` was undefined at request\n * time. Decision recorded in the plan above (`g6-router-convention-plan.md`) and CHANGELOG 0.4.0\n * (no standalone ADR was cut for this router-convention change).\n */\n\n/**\n * Canonical migration guide URL. T4.2 establishes this as the authoritative\n * landing page. EC-3: error message uses this constant so the URL never\n * drifts from the doc location.\n */\nexport const ROUTER_MIGRATION_GUIDE_URL = 'https://theokit.dev/migration/0.3-to-0.4-router'\n\nexport interface RouterConventionErrorOptions {\n  /** Absolute path of the offending route file. */\n  file: string\n  /** Suggested directory-nested replacement path (relative, e.g. `routes/auth/[provider]/login.ts`). */\n  suggestion: string\n  /** Migration guide URL (defaults to `ROUTER_MIGRATION_GUIDE_URL`). */\n  migrationUrl?: string\n}\n\n/**\n * Thrown by `scanServerRoutes` when a route file uses the legacy\n * dotted-basename convention (`auth.[provider].login.ts`).\n *\n * The error is FAIL-FAST by design — running with a route that has wrong\n * `paramNames` produces silent 404s at request time, which is strictly\n * worse than a build-time error.\n */\nexport class RouterConventionError extends Error {\n  override readonly name = 'RouterConventionError'\n  readonly file: string\n  readonly suggestion: string\n  readonly migrationUrl: string\n\n  constructor(opts: RouterConventionErrorOptions) {\n    const migrationUrl = opts.migrationUrl ?? ROUTER_MIGRATION_GUIDE_URL\n    const message = [\n      `Router convention violation: dotted route basename is not supported in theokit 0.4+.`,\n      ``,\n      `  File: ${opts.file}`,\n      `  Use directory-nested form: ${opts.suggestion}`,\n      ``,\n      `Migration guide: ${migrationUrl}`,\n      `Run \\`theokit migrate router\\` to convert all dotted basenames automatically.`,\n    ].join('\\n')\n    super(message)\n    this.file = opts.file\n    this.suggestion = opts.suggestion\n    this.migrationUrl = migrationUrl\n  }\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks `serverDir/ws/` derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { existsSync, statSync } from 'node:fs'\nimport { extname, join, relative } from 'node:path'\n\nimport { walkSourceFiles } from '../_internal/scan-walker.js'\n\nconst WS_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\n\nexport interface WebSocketRouteNode {\n  filePath: string\n  wsPath: string\n}\n\nexport function scanWebSocketRoutes(serverDir: string): WebSocketRouteNode[] {\n  const wsDir = join(serverDir, 'ws')\n  if (!existsSync(wsDir) || !statSync(wsDir).isDirectory()) {\n    return []\n  }\n\n  const results: WebSocketRouteNode[] = []\n  walkSourceFiles(wsDir, { extensions: WS_EXTENSIONS }, (absPath) => {\n    let rel = relative(wsDir, absPath)\n    rel = rel.replace(/\\\\/g, '/')\n    rel = rel.slice(0, -extname(rel).length)\n    if (rel.endsWith('/index')) rel = rel.slice(0, -6)\n    else if (rel === 'index') rel = ''\n    results.push({\n      filePath: absPath,\n      wsPath: `/ws/${rel}`,\n    })\n  })\n  return results\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time manifest emitter / loader. All paths derived from `distDir`\n * + `serverDir`, themselves resolved from `process.cwd()`. No HTTP input.\n */\nimport { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs'\nimport { join, resolve, relative, dirname } from 'node:path'\n\nimport { scanServerActions } from './action-scan.js'\nimport type { ActionNode } from './action-scan.js'\nimport { scanAgents } from './agent-scan.js'\nimport type { AgentNode } from './agent-scan.js'\nimport { compilePattern } from './match.js'\nimport type { ServerRouteNode } from './match.js'\nimport { scanServerRoutes } from './scan.js'\nimport { scanWebSocketRoutes } from './ws-scan.js'\nimport type { WebSocketRouteNode } from './ws-scan.js'\n\n// --- Manifest Types ---\n\nexport interface ManifestRoute {\n  filePath: string\n  routePath: string\n  paramNames: string[]\n  /** HTTP methods (uppercase) the route file exports. Optional — manifests\n   * generated before G1 omit this; loaders treat absence as \"unknown\". */\n  methods?: string[]\n}\n\nexport interface ManifestAction {\n  filePath: string\n  actionPath: string\n}\n\nexport interface ManifestWebSocket {\n  filePath: string\n  wsPath: string\n}\n\n/** M2 — a top-level `agents/*.ts` convention entry. `filePath` is relative to the\n * project root (agents live OUTSIDE `serverDir`), unlike routes/actions/ws. */\nexport interface ManifestAgent {\n  filePath: string\n  agentPath: string\n  name: string\n}\n\nexport interface TheoManifest {\n  version: 1\n  generatedAt: string\n  routes: ManifestRoute[]\n  actions: ManifestAction[]\n  websockets: ManifestWebSocket[]\n  /** M2 — optional for backward compat: manifests generated before M2 omit it. */\n  agents?: ManifestAgent[]\n}\n\nexport interface LoadedManifest {\n  routes: ServerRouteNode[]\n  actions: ActionNode[]\n  websockets: WebSocketRouteNode[]\n  agents: AgentNode[]\n}\n\n// --- Generate ---\n\nexport function generateManifest(\n  serverDir: string,\n  // Agents live at `<projectRoot>/agents`, a sibling of `serverDir` (LOCKED naming).\n  // Defaults to the server dir's parent; overridable for tests / non-standard layouts.\n  projectRoot: string = dirname(serverDir),\n): TheoManifest {\n  const routes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const websockets = scanWebSocketRoutes(serverDir)\n  const agents = scanAgents(projectRoot)\n\n  return {\n    version: 1,\n    generatedAt: new Date().toISOString(),\n    routes: routes.map((r) => ({\n      filePath: relative(serverDir, r.filePath),\n      routePath: r.routePath,\n      paramNames: r.paramNames,\n      ...(r.methods !== undefined ? { methods: r.methods } : {}),\n    })),\n    actions: actions.map((a) => ({\n      filePath: relative(serverDir, a.filePath),\n      actionPath: a.actionPath,\n    })),\n    websockets: websockets.map((w) => ({\n      filePath: relative(serverDir, w.filePath),\n      wsPath: w.wsPath,\n    })),\n    agents: agents.map((a) => ({\n      // Relative to projectRoot (agents/ is outside serverDir).\n      filePath: relative(projectRoot, a.filePath),\n      agentPath: a.agentPath,\n      name: a.name,\n    })),\n  }\n}\n\n// --- Write ---\n\nexport function writeManifest(manifest: TheoManifest, outputDir: string): void {\n  mkdirSync(outputDir, { recursive: true })\n  const manifestPath = join(outputDir, 'manifest.json')\n  writeFileSync(manifestPath, JSON.stringify(manifest, null, 2))\n}\n\n// --- Load ---\n\nexport function loadManifest(distDir: string, serverDir: string): LoadedManifest {\n  const manifestPath = join(distDir, 'manifest.json')\n\n  if (!existsSync(manifestPath)) {\n    throw new Error(`No manifest found at ${manifestPath}. Run \"theo build\" first.`)\n  }\n\n  const raw = JSON.parse(readFileSync(manifestPath, 'utf-8')) as TheoManifest\n\n  const routes: ServerRouteNode[] = raw.routes.map((r) => {\n    const { pattern, paramNames } = compilePattern(r.routePath)\n    return {\n      filePath: resolve(serverDir, r.filePath),\n      routePath: r.routePath,\n      paramNames,\n      pattern,\n      ...(r.methods !== undefined ? { methods: r.methods } : {}),\n    }\n  })\n\n  const actions: ActionNode[] = raw.actions.map((a) => ({\n    filePath: resolve(serverDir, a.filePath),\n    actionPath: a.actionPath,\n  }))\n\n  const websockets: WebSocketRouteNode[] = raw.websockets.map((w) => ({\n    filePath: resolve(serverDir, w.filePath),\n    wsPath: w.wsPath,\n  }))\n\n  // M2 — agents resolve relative to the project root (sibling of serverDir).\n  // `?? []` keeps pre-M2 manifests (no `agents` field) loadable (fail-safe).\n  const projectRoot = dirname(serverDir)\n  const agents: AgentNode[] = (raw.agents ?? []).map((a) => ({\n    filePath: resolve(projectRoot, a.filePath),\n    agentPath: a.agentPath,\n    name: a.name,\n  }))\n\n  return { routes, actions, websockets, agents }\n}\n"],"mappings":";;;;;;;;AAIA,SAAS,YAAY,cAAc,gBAAgB;AACnD,SAAS,SAAS,MAAM,gBAAgB;AAqCjC,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAChC;AAAA,EACA;AAAA,EAET,YACE,MACA,SACA,kBACA;AACA,UAAM,OAAO;AAIb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,mBAAmB;AAAA,EAC1B;AACF;AAEA,IAAM,oBAAoB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAChE,IAAM,eAAe;AACrB,IAAM,iBAAiB,oBAAI,IAAI,CAAC,SAAS,eAAe,aAAa,aAAa,gBAAgB,CAAC;AAO5F,SAAS,kBAAkB,WAAiC;AACjE,QAAM,aAAa,KAAK,WAAW,SAAS;AAC5C,MAAI,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,UAAU,EAAE,YAAY,GAAG;AAClE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAwB,CAAC;AAC/B,kBAAgB,YAAY,EAAE,YAAY,kBAAkB,GAAG,CAAC,YAAY;AAC1E,QAAI,aAAa,KAAK,OAAO,EAAG;AAChC,QAAI,MAAM,SAAS,YAAY,OAAO;AACtC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM;AACvC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,YAAY;AAAA,IACd,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;AAUO,SAAS,0BAA0B,WAA0C;AAClF,QAAM,aAAa,KAAK,WAAW,SAAS;AAC5C,MAAI,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,UAAU,EAAE,YAAY,GAAG;AAClE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,YAAY,oBAAI,IAAY;AAClC,QAAM,UAAiC,CAAC;AAGxC,kBAAgB,YAAY,EAAE,YAAY,kBAAkB,GAAG,CAAC,YAAY;AAC1E,QAAI,aAAa,KAAK,OAAO,EAAG;AAChC,UAAM,MAAM,SAAS,YAAY,OAAO,EAAE,QAAQ,OAAO,GAAG;AAG5D,QAAI,IAAI,WAAW,UAAU,EAAG;AAChC,UAAM,OAAO,IAAI,MAAM,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM;AAE9C,UAAMA,YAAW,KAAK,SAAS,GAAG,IAAK,KAAK,MAAM,GAAG,EAAE,IAAI,KAAK,OAAQ;AACxE,QAAI,eAAe,IAAIA,SAAQ,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,2BAA2BA,SAAQ,+BAA+B,OAAO;AAAA,QACzE,CAAC,OAAO;AAAA,MACV;AAAA,IACF;AAGA,UAAM,SAAS,aAAa,SAAS,MAAM;AAC3C,UAAM,WAAW,cAAc,MAAM;AACrC,UAAM,SAAS,8BAA8B,KAAK,QAAQ,IAAI,SAAS;AACvE,UAAM,WAAW,oBAAoB,KAAK,QAAQ,KAAK,sBAAsB,KAAK,QAAQ;AAS1F,UAAM,cAAc,yBAAyB,QAAQ;AAIrD,UAAM,iBAAiB,KAAK,SAAS,GAAG,IAAI,SAAY,iBAAiB,YAAYA,SAAQ;AAC7F,eAAW,cAAc,aAAa;AACpC,YAAM,WAAW,eAAe,YAAY,OAAO;AACnD,UAAI,UAAU,IAAI,QAAQ,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,+BAA+B,QAAQ;AAAA,UACvC,CAAC,OAAO;AAAA,QACV;AAAA,MACF;AACA,gBAAU,IAAI,QAAQ;AACtB,YAAM,QAA6B;AAAA,QACjC,MAAM;AAAA,QACN,UAAU;AAAA,QACV,SAAS,kBAAkB,IAAI,IAAI,UAAU;AAAA,QAC7C;AAAA,QACA;AAAA,MACF;AACA,UAAI,mBAAmB,QAAW;AAChC,cAAM,iBAAiB;AAAA,MACzB;AACA,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF,CAAC;AAID,aAAW,SAAS,SAAS;AAC3B,UAAM,cAAc,GAAG,MAAM,IAAI;AACjC,UAAM,mBAAmB,QAAQ,KAAK,CAAC,UAAU,MAAM,KAAK,WAAW,WAAW,CAAC;AACnF,QAAI,kBAAkB;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,WAAW,MAAM,IAAI,uDAAuD,iBAAiB,IAAI;AAAA,QACjG,CAAC,MAAM,UAAU,iBAAiB,QAAQ;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AACT;AAeA,SAAS,yBAAyB,UAA4B;AAC5D,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,UAAU;AAChB,MAAI;AACJ,UAAQ,IAAI,QAAQ,KAAK,QAAQ,OAAO,MAAM;AAC5C,UAAM,OAAO,EAAE,CAAC;AAChB,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,EAAG,OAAM,IAAI,IAAI;AAAA,EACjE;AACA,MAAI,sCAAsC,KAAK,QAAQ,GAAG;AACxD,UAAM,IAAI,SAAS;AAAA,EACrB;AACA,MAAI,MAAM,SAAS,EAAG,OAAM,IAAI,SAAS;AACzC,SAAO,CAAC,GAAG,KAAK;AAClB;AAOA,SAAS,iBAAiB,YAAoBA,WAAsC;AAClF,QAAM,aAAa,KAAK,YAAY,SAAS;AAC7C,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,aAAW,OAAO,CAAC,OAAO,QAAQ,OAAO,MAAM,GAAG;AAChD,UAAM,YAAY,KAAK,YAAY,GAAGA,SAAQ,GAAG,GAAG,EAAE;AACtD,QAAI,WAAW,SAAS,EAAG,QAAO;AAAA,EACpC;AACA,SAAO;AACT;AAEA,SAAS,cAAc,QAAwB;AAC7C,MAAI,MAAM;AACV,MAAI,IAAI;AACR,SAAO,IAAI,OAAO,QAAQ;AACxB,UAAM,KAAK,OAAO,CAAC;AACnB,UAAM,OAAO,OAAO,IAAI,CAAC;AACzB,QAAI,OAAO,OAAO,SAAS,KAAK;AAE9B,aAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,KAAM;AAChD;AAAA,IACF;AACA,QAAI,OAAO,OAAO,SAAS,KAAK;AAE9B,WAAK;AACL,aAAO,IAAI,OAAO,SAAS,KAAK,EAAE,OAAO,CAAC,MAAM,OAAO,OAAO,IAAI,CAAC,MAAM,KAAM;AAC/E,WAAK;AACL;AAAA,IACF;AACA,WAAO;AACP;AAAA,EACF;AACA,SAAO;AACT;;;AC1PA,SAAS,cAAAC,aAAY,YAAAC,iBAAgB;AACrC,SAAS,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;AAIxC,IAAM,mBAAmB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAE/D,IAAM,YAAY;AAgBX,SAAS,WAAW,aAAkC;AAC3D,QAAM,YAAYC,MAAK,aAAa,QAAQ;AAC5C,MAAI,CAACC,YAAW,SAAS,KAAK,CAACC,UAAS,SAAS,EAAE,YAAY,GAAG;AAChE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAuB,CAAC;AAC9B,kBAAgB,WAAW,EAAE,YAAY,iBAAiB,GAAG,CAAC,YAAY;AACxE,QAAI,MAAMC,UAAS,WAAW,OAAO;AACrC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAACC,SAAQ,GAAG,EAAE,MAAM;AACvC,QAAI,UAAU,KAAK,GAAG,EAAG;AAIzB,QAAI,IAAI,SAAS,QAAQ,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AACjD,QAAI,QAAQ,WAAW,QAAQ,GAAI;AACnC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,WAAW,eAAe,GAAG;AAAA,MAC7B,MAAM;AAAA,IACR,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;;;ACxCO,SAAS,eAAe,WAG7B;AACA,QAAM,aAAuB,CAAC;AAE9B,QAAM,WAAW,UAAU,QAAQ,wBAAwB,CAAC,OAAe,SAAiB;AAC1F,eAAW,KAAK,IAAI;AAEpB,WAAO,MAAM,WAAW,MAAM,IAAI,SAAS;AAAA,EAC7C,CAAC;AAKD,SAAO,EAAE,SAAS,IAAI,OAAO,IAAI,QAAQ,GAAG,GAAG,WAAW;AAC5D;AAEO,SAAS,WACd,KACA,QACmE;AAEnE,MAAI,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC;AAC3B,MAAI,KAAK,SAAS,KAAK,KAAK,SAAS,GAAG,GAAG;AACzC,WAAO,KAAK,MAAM,GAAG,EAAE;AAAA,EACzB;AAEA,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI;AACrC,QAAI,OAAO;AACT,YAAM,SAAiC,CAAC;AACxC,YAAM,WAAW,QAAQ,CAAC,MAAM,MAAM;AACpC,eAAO,IAAI,IAAI,MAAM,IAAI,CAAC;AAAA,MAC5B,CAAC;AACD,aAAO,EAAE,OAAO,OAAO;AAAA,IACzB;AAAA,EACF;AACA,SAAO;AACT;;;AC9CA,SAAS,cAAAC,aAAY,YAAAC,iBAAgB;AACrC,SAAS,UAAU,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;;;ACYlD,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,qBAAqB;AAM9B,IAAM,WAAW,cAAc,YAAY,GAAG;AAE9C,IAAM,KAAK,SAAS,YAAY;AAEhC,IAAM,oBAAoB,IAAI,IAAY,YAAY;AAEtD,SAAS,kBAAkB,WAAwD;AACjF,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,KAAK,WAAW;AACzB,QAAI,EAAE,SAAS,GAAG,WAAW,cAAe,QAAO;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,MAAoB,OAA8B;AAE9E,MAAI,GAAG,oBAAoB,IAAI,KAAK,kBAAkB,GAAG,aAAa,IAAI,CAAC,GAAG;AAC5E,eAAW,QAAQ,KAAK,gBAAgB,cAAc;AACpD,UAAI,GAAG,aAAa,KAAK,IAAI,KAAK,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACvE,cAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,MACxC;AAAA,IACF;AACA;AAAA,EACF;AAEA,OACG,GAAG,sBAAsB,IAAI,KAAK,GAAG,mBAAmB,IAAI,MAC7D,kBAAkB,GAAG,aAAa,IAAI,CAAC,GACvC;AACA,QAAI,KAAK,QAAQ,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACtD,YAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,IACxC;AACA;AAAA,EACF;AAGA,MAAI,GAAG,oBAAoB,IAAI,KAAK,KAAK,gBAAgB,GAAG,eAAe,KAAK,YAAY,GAAG;AAC7F,eAAW,QAAQ,KAAK,aAAa,UAAU;AAE7C,UAAI,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACzC,cAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,0BAA0B,UAAkB,SAAgC;AAC1F,QAAM,MAAM,WAAWC,cAAa,UAAU,OAAO;AACrD,QAAM,aAAa,GAAG;AAAA,IACpB;AAAA,IACA;AAAA,IACA,GAAG,aAAa;AAAA;AAAA,IACK;AAAA,IACrB,GAAG,WAAW;AAAA,EAChB;AACA,QAAM,QAAQ,oBAAI,IAAgB;AAClC,aAAW,QAAQ,WAAW,YAAY;AACxC,yBAAqB,MAAM,KAAK;AAAA,EAClC;AACA,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK;AACzB;;;AClEO,IAAM,6BAA6B;AAmBnC,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC7B,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAoC;AAC9C,UAAM,eAAe,KAAK,gBAAgB;AAC1C,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,gCAAgC,KAAK,UAAU;AAAA,MAC/C;AAAA,MACA,oBAAoB,YAAY;AAAA,MAChC;AAAA,IACF,EAAE,KAAK,IAAI;AACX,UAAM,OAAO;AACb,SAAK,OAAO,KAAK;AACjB,SAAK,aAAa,KAAK;AACvB,SAAK,eAAe;AAAA,EACtB;AACF;;;AF9CA,IAAM,mBAAmB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAK/D,IAAM,kBAAkB;AAExB,SAAS,iBAAiB,UAA2B;AACnD,SAAO,gBAAgB,KAAK,SAAS,QAAQ,CAAC;AAChD;AAEA,SAAS,sBAAsB,SAA0B;AACvD,MAAI,QAAQ;AACZ,aAAW,MAAM,SAAS;AACxB,QAAI,OAAO,IAAK;AAAA,aACP,OAAO,IAAK;AAAA,aACZ,OAAO,OAAO,UAAU,EAAG,QAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,kCAAkC,SAA2B;AACpE,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI,QAAQ;AACZ,aAAW,MAAM,SAAS;AACxB,QAAI,OAAO,KAAK;AACd;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,KAAK;AACrB;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,OAAO,UAAU,GAAG;AACpC,UAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,gBAAU;AAAA,IACZ,OAAO;AACL,iBAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,SAAO;AACT;AAEA,SAAS,+BAA+B,UAAkB,WAA2B;AACnF,QAAM,MAAMC,UAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,aAAa,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAC3C,QAAM,WAAW,WAAW,MAAM,GAAG,EAAE,QAAQ,iCAAiC;AAChF,SAAO,UAAU,SAAS,KAAK,GAAG,CAAC,GAAG,GAAG;AAC3C;AAEA,SAAS,sBAAsB,UAAkB,WAAyB;AACxE,QAAM,MAAMD,UAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,aAAa,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAC3C,QAAM,WAAW,WAAW,MAAM,GAAG;AACrC,aAAW,OAAO,UAAU;AAC1B,QAAI,sBAAsB,GAAG,GAAG;AAC9B,YAAM,IAAI,sBAAsB;AAAA,QAC9B,MAAM;AAAA,QACN,YAAY,+BAA+B,UAAU,SAAS;AAAA,MAChE,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,UAAkB,WAA2B;AACpE,MAAI,MAAMD,UAAS,WAAW,QAAQ;AAEtC,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAE9B,QAAM,IAAI,QAAQ,OAAO,GAAG;AAE5B,MAAI,IAAI,SAAS,QAAQ,GAAG;AAC1B,UAAM,IAAI,MAAM,GAAG,EAAE;AAAA,EACvB,WAAW,QAAQ,SAAS;AAC1B,UAAM;AAAA,EACR;AAIA,QAAM,IAAI,QAAQ,uBAAuB,QAAQ;AAEjD,QAAM,IAAI,QAAQ,iBAAiB,KAAK;AACxC,SAAO,QAAQ,GAAG;AACpB;AAEO,SAAS,iBAAiB,WAAsC;AACrE,QAAM,YAAYC,MAAK,WAAW,QAAQ;AAC1C,MAAI,CAACC,YAAW,SAAS,KAAK,CAACC,UAAS,SAAS,EAAE,YAAY,GAAG;AAChE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAA6B,CAAC;AACpC,kBAAgB,WAAW,EAAE,YAAY,iBAAiB,GAAG,CAAC,YAAY;AAExE,QAAI,iBAAiB,OAAO,EAAG;AAI/B,0BAAsB,SAAS,SAAS;AAExC,UAAM,YAAY,gBAAgB,SAAS,SAAS;AACpD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,SAAS;AACxD,UAAM,UAAU,0BAA0B,OAAO;AACjD,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAID,QAAM,cAAc,QAAQ,KAAK,CAAC,MAAM,EAAE,cAAc,qBAAqB;AAC7E,MAAI,aAAa;AACf,UAAM,IAAI;AAAA,MACR,gBAAgB,YAAY,QAAQ;AAAA,IACtC;AAAA,EACF;AAGA,QAAM,aAAa,CAAC,UAA2B,MAAM,UAAU,SAAS,MAAM;AAC9E,UAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,UAAM,UAAU,EAAE,WAAW,WAAW;AACxC,UAAM,UAAU,EAAE,WAAW,WAAW;AACxC,UAAM,YAAY,WAAW,CAAC;AAC9B,UAAM,YAAY,WAAW,CAAC;AAG9B,QAAI,WAAW,CAAC,QAAS,QAAO;AAChC,QAAI,CAAC,WAAW,QAAS,QAAO;AAEhC,QAAI,aAAa,CAAC,UAAW,QAAO;AACpC,QAAI,CAAC,aAAa,UAAW,QAAO;AACpC,WAAO,EAAE,UAAU,cAAc,EAAE,SAAS;AAAA,EAC9C,CAAC;AAED,SAAO;AACT;;;AGvJA,SAAS,cAAAC,aAAY,YAAAC,iBAAgB;AACrC,SAAS,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;AAIxC,IAAM,gBAAgB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAOrD,SAAS,oBAAoB,WAAyC;AAC3E,QAAM,QAAQC,MAAK,WAAW,IAAI;AAClC,MAAI,CAACC,YAAW,KAAK,KAAK,CAACC,UAAS,KAAK,EAAE,YAAY,GAAG;AACxD,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAgC,CAAC;AACvC,kBAAgB,OAAO,EAAE,YAAY,cAAc,GAAG,CAAC,YAAY;AACjE,QAAI,MAAMC,UAAS,OAAO,OAAO;AACjC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAACC,SAAQ,GAAG,EAAE,MAAM;AACvC,QAAI,IAAI,SAAS,QAAQ,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AAAA,aACxC,QAAQ,QAAS,OAAM;AAChC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,QAAQ,OAAO,GAAG;AAAA,IACpB,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;;;AC/BA,SAAS,cAAAC,aAAY,gBAAAC,eAAc,eAAe,iBAAiB;AACnE,SAAS,QAAAC,OAAM,SAAS,YAAAC,WAAU,eAAe;AA4D1C,SAAS,iBACd,WAGA,cAAsB,QAAQ,SAAS,GACzB;AACd,QAAM,SAAS,iBAAiB,SAAS;AACzC,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,aAAa,oBAAoB,SAAS;AAChD,QAAM,SAAS,WAAW,WAAW;AAErC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,MACzB,UAAUC,UAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,WAAW,EAAE;AAAA,MACb,YAAY,EAAE;AAAA,MACd,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1D,EAAE;AAAA,IACF,SAAS,QAAQ,IAAI,CAAC,OAAO;AAAA,MAC3B,UAAUA,UAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,YAAY,EAAE;AAAA,IAChB,EAAE;AAAA,IACF,YAAY,WAAW,IAAI,CAAC,OAAO;AAAA,MACjC,UAAUA,UAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,QAAQ,EAAE;AAAA,IACZ,EAAE;AAAA,IACF,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA;AAAA,MAEzB,UAAUA,UAAS,aAAa,EAAE,QAAQ;AAAA,MAC1C,WAAW,EAAE;AAAA,MACb,MAAM,EAAE;AAAA,IACV,EAAE;AAAA,EACJ;AACF;AAIO,SAAS,cAAc,UAAwB,WAAyB;AAC7E,YAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AACxC,QAAM,eAAeC,MAAK,WAAW,eAAe;AACpD,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC/D;AAIO,SAAS,aAAa,SAAiB,WAAmC;AAC/E,QAAM,eAAeA,MAAK,SAAS,eAAe;AAElD,MAAI,CAACC,YAAW,YAAY,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB,YAAY,2BAA2B;AAAA,EACjF;AAEA,QAAM,MAAM,KAAK,MAAMC,cAAa,cAAc,OAAO,CAAC;AAE1D,QAAM,SAA4B,IAAI,OAAO,IAAI,CAAC,MAAM;AACtD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,EAAE,SAAS;AAC1D,WAAO;AAAA,MACL,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,MACvC,WAAW,EAAE;AAAA,MACb;AAAA,MACA;AAAA,MACA,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AAED,QAAM,UAAwB,IAAI,QAAQ,IAAI,CAAC,OAAO;AAAA,IACpD,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,YAAY,EAAE;AAAA,EAChB,EAAE;AAEF,QAAM,aAAmC,IAAI,WAAW,IAAI,CAAC,OAAO;AAAA,IAClE,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,QAAQ,EAAE;AAAA,EACZ,EAAE;AAIF,QAAM,cAAc,QAAQ,SAAS;AACrC,QAAM,UAAuB,IAAI,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,IACzD,UAAU,QAAQ,aAAa,EAAE,QAAQ;AAAA,IACzC,WAAW,EAAE;AAAA,IACb,MAAM,EAAE;AAAA,EACV,EAAE;AAEF,SAAO,EAAE,QAAQ,SAAS,YAAY,OAAO;AAC/C;","names":["basename","existsSync","statSync","extname","join","relative","join","existsSync","statSync","relative","extname","existsSync","statSync","extname","join","relative","readFileSync","readFileSync","relative","extname","join","existsSync","statSync","existsSync","statSync","extname","join","relative","join","existsSync","statSync","relative","extname","existsSync","readFileSync","join","relative","relative","join","existsSync","readFileSync"]}

package/dist/chunk-TIZBKEDV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/scan/manifest.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time manifest emitter / loader. All paths derived from `distDir`\n * + `serverDir`, themselves resolved from `process.cwd()`. No HTTP input.\n */\nimport { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs'\nimport { join, resolve, relative, dirname } from 'node:path'\n\nimport { scanServerActions } from './action-scan.js'\nimport type { ActionNode } from './action-scan.js'\nimport { scanAgents } from './agent-scan.js'\nimport type { AgentNode } from './agent-scan.js'\nimport { compilePattern } from './match.js'\nimport type { ServerRouteNode } from './match.js'\nimport { scanServerRoutes } from './scan.js'\nimport { scanWebSocketRoutes } from './ws-scan.js'\nimport type { WebSocketRouteNode } from './ws-scan.js'\n\n// --- Manifest Types ---\n\nexport interface ManifestRoute {\n  filePath: string\n  routePath: string\n  paramNames: string[]\n  /** HTTP methods (uppercase) the route file exports. Optional — manifests\n   * generated before G1 omit this; loaders treat absence as \"unknown\". */\n  methods?: string[]\n}\n\nexport interface ManifestAction {\n  filePath: string\n  actionPath: string\n}\n\nexport interface ManifestWebSocket {\n  filePath: string\n  wsPath: string\n}\n\n/** M2 — a top-level `agents/*.ts` convention entry. `filePath` is relative to the\n * project root (agents live OUTSIDE `serverDir`), unlike routes/actions/ws. */\nexport interface ManifestAgent {\n  filePath: string\n  agentPath: string\n  name: string\n}\n\nexport interface TheoManifest {\n  version: 1\n  generatedAt: string\n  routes: ManifestRoute[]\n  actions: ManifestAction[]\n  websockets: ManifestWebSocket[]\n  /** M2 — optional for backward compat: manifests generated before M2 omit it. */\n  agents?: ManifestAgent[]\n}\n\nexport interface LoadedManifest {\n  routes: ServerRouteNode[]\n  actions: ActionNode[]\n  websockets: WebSocketRouteNode[]\n  agents: AgentNode[]\n}\n\n// --- Generate ---\n\nexport function generateManifest(\n  serverDir: string,\n  // Agents live at `<projectRoot>/agents`, a sibling of `serverDir` (LOCKED naming).\n  // Defaults to the server dir's parent; overridable for tests / non-standard layouts.\n  projectRoot: string = dirname(serverDir),\n): TheoManifest {\n  const routes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const websockets = scanWebSocketRoutes(serverDir)\n  const agents = scanAgents(projectRoot)\n\n  return {\n    version: 1,\n    generatedAt: new Date().toISOString(),\n    routes: routes.map((r) => ({\n      filePath: relative(serverDir, r.filePath),\n      routePath: r.routePath,\n      paramNames: r.paramNames,\n      ...(r.methods !== undefined ? { methods: r.methods } : {}),\n    })),\n    actions: actions.map((a) => ({\n      filePath: relative(serverDir, a.filePath),\n      actionPath: a.actionPath,\n    })),\n    websockets: websockets.map((w) => ({\n      filePath: relative(serverDir, w.filePath),\n      wsPath: w.wsPath,\n    })),\n    agents: agents.map((a) => ({\n      // Relative to projectRoot (agents/ is outside serverDir).\n      filePath: relative(projectRoot, a.filePath),\n      agentPath: a.agentPath,\n      name: a.name,\n    })),\n  }\n}\n\n// --- Write ---\n\nexport function writeManifest(manifest: TheoManifest, outputDir: string): void {\n  mkdirSync(outputDir, { recursive: true })\n  const manifestPath = join(outputDir, 'manifest.json')\n  writeFileSync(manifestPath, JSON.stringify(manifest, null, 2))\n}\n\n// --- Load ---\n\nexport function loadManifest(distDir: string, serverDir: string): LoadedManifest {\n  const manifestPath = join(distDir, 'manifest.json')\n\n  if (!existsSync(manifestPath)) {\n    throw new Error(`No manifest found at ${manifestPath}. Run \"theo build\" first.`)\n  }\n\n  const raw = JSON.parse(readFileSync(manifestPath, 'utf-8')) as TheoManifest\n\n  const routes: ServerRouteNode[] = raw.routes.map((r) => {\n    const { pattern, paramNames } = compilePattern(r.routePath)\n    return {\n      filePath: resolve(serverDir, r.filePath),\n      routePath: r.routePath,\n      paramNames,\n      pattern,\n      ...(r.methods !== undefined ? { methods: r.methods } : {}),\n    }\n  })\n\n  const actions: ActionNode[] = raw.actions.map((a) => ({\n    filePath: resolve(serverDir, a.filePath),\n    actionPath: a.actionPath,\n  }))\n\n  const websockets: WebSocketRouteNode[] = raw.websockets.map((w) => ({\n    filePath: resolve(serverDir, w.filePath),\n    wsPath: w.wsPath,\n  }))\n\n  // M2 — agents resolve relative to the project root (sibling of serverDir).\n  // `?? []` keeps pre-M2 manifests (no `agents` field) loadable (fail-safe).\n  const projectRoot = dirname(serverDir)\n  const agents: AgentNode[] = (raw.agents ?? []).map((a) => ({\n    filePath: resolve(projectRoot, a.filePath),\n    agentPath: a.agentPath,\n    name: a.name,\n  }))\n\n  return { routes, actions, websockets, agents }\n}\n"],"mappings":";;;;;;;;;;;;;AAIA,SAAS,YAAY,cAAc,eAAe,iBAAiB;AACnE,SAAS,MAAM,SAAS,UAAU,eAAe;AA4D1C,SAAS,iBACd,WAGA,cAAsB,QAAQ,SAAS,GACzB;AACd,QAAM,SAAS,iBAAiB,SAAS;AACzC,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,aAAa,oBAAoB,SAAS;AAChD,QAAM,SAAS,WAAW,WAAW;AAErC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,MACzB,UAAU,SAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,WAAW,EAAE;AAAA,MACb,YAAY,EAAE;AAAA,MACd,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1D,EAAE;AAAA,IACF,SAAS,QAAQ,IAAI,CAAC,OAAO;AAAA,MAC3B,UAAU,SAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,YAAY,EAAE;AAAA,IAChB,EAAE;AAAA,IACF,YAAY,WAAW,IAAI,CAAC,OAAO;AAAA,MACjC,UAAU,SAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,QAAQ,EAAE;AAAA,IACZ,EAAE;AAAA,IACF,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA;AAAA,MAEzB,UAAU,SAAS,aAAa,EAAE,QAAQ;AAAA,MAC1C,WAAW,EAAE;AAAA,MACb,MAAM,EAAE;AAAA,IACV,EAAE;AAAA,EACJ;AACF;AAIO,SAAS,cAAc,UAAwB,WAAyB;AAC7E,YAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AACxC,QAAM,eAAe,KAAK,WAAW,eAAe;AACpD,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC/D;AAIO,SAAS,aAAa,SAAiB,WAAmC;AAC/E,QAAM,eAAe,KAAK,SAAS,eAAe;AAElD,MAAI,CAAC,WAAW,YAAY,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB,YAAY,2BAA2B;AAAA,EACjF;AAEA,QAAM,MAAM,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAE1D,QAAM,SAA4B,IAAI,OAAO,IAAI,CAAC,MAAM;AACtD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,EAAE,SAAS;AAC1D,WAAO;AAAA,MACL,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,MACvC,WAAW,EAAE;AAAA,MACb;AAAA,MACA;AAAA,MACA,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AAED,QAAM,UAAwB,IAAI,QAAQ,IAAI,CAAC,OAAO;AAAA,IACpD,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,YAAY,EAAE;AAAA,EAChB,EAAE;AAEF,QAAM,aAAmC,IAAI,WAAW,IAAI,CAAC,OAAO;AAAA,IAClE,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,QAAQ,EAAE;AAAA,EACZ,EAAE;AAIF,QAAM,cAAc,QAAQ,SAAS;AACrC,QAAM,UAAuB,IAAI,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,IACzD,UAAU,QAAQ,aAAa,EAAE,QAAQ;AAAA,IACzC,WAAW,EAAE;AAAA,IACb,MAAM,EAAE;AAAA,EACV,EAAE;AAEF,SAAO,EAAE,QAAQ,SAAS,YAAY,OAAO;AAC/C;","names":[]}

package/dist/chunk-YJAUJXZS.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/config/schema.ts","../src/config/schemas/header-safe.ts","../src/config/schemas/rate-limit.ts","../src/config/schemas/upload.ts","../src/config/schemas/logging.ts","../src/config/schemas/cache.ts","../src/config/schemas/security.ts","../src/config/schemas/storage.ts"],"sourcesContent":["import { z } from 'zod'\n\nimport { servicesConfigSchema } from '../services/index.js'\n\nimport {\n  cacheSchema,\n  loggingSchema,\n  rateLimitSchema,\n  securitySchema,\n  storageSchema,\n  uploadSchema,\n  type FormatErrorContext,\n  type FormatErrorHook,\n} from './schemas/index.js'\n\n// Re-export per-concern schemas + types so downstream consumers\n// (`adapters/*`, vite-plugin, generators, tests) keep their existing\n// imports valid. Per plan T2.3 — pure structural split; zero behavior\n// change at the call site.\nexport {\n  cacheSchema,\n  corsSchema,\n  disallowedConfigSchema,\n  headerSafeString,\n  loggingSchema,\n  rateLimitSchema,\n  securityHeadersSchema,\n  securitySchema,\n  storageSchema,\n  uploadSchema,\n} from './schemas/index.js'\n\nexport type { FormatErrorContext, FormatErrorHook, StorageConfig } from './schemas/index.js'\n\n/**\n * Root `theo.config.ts` schema — composer assembled from the per-concern\n * primitives re-exported above.\n *\n * Embedded blocks that exist ONLY as part of the root config (`agents`,\n * `ui`, `devtools`, `jobs`, `openapi`) stay inline below. They have no\n * external consumers; splitting them would create lonely files (M5\n * smell) without comprehension benefit.\n */\nexport const theoConfigSchema = z\n  .object({\n    /**\n     * Plan v1.2 T2.1 — project identifier propagated into\n     * `.theokit/services.json` v2 `project` field. DNS-1123 compatible (drives\n     * Gitea repo + ArgoCD App naming on TheoCloud). When omitted, the build\n     * emits services.json v1 with the legacy `services-bundle` fallback\n     * (ADR D10) and logs a deprecation warning.\n     */\n    name: z\n      .string()\n      .max(63)\n      .refine(\n        // DNS-1123 equivalent expressed as explicit single-char anchors so\n        // security/detect-unsafe-regex stays clean (no backtracking).\n        (value) =>\n          value.length > 0 &&\n          /^[a-z0-9-]+$/u.test(value) &&\n          !value.startsWith('-') &&\n          !value.endsWith('-'),\n        'name must match DNS-1123 (lowercase alphanumeric+hyphens, 1-63 chars, no leading/trailing hyphen)',\n      )\n      .optional(),\n    appDir: z.string().default('app'),\n    serverDir: z.string().default('server'),\n    /**\n     * T2.2 / EC-4 — Build output directory. Must be a relative path inside\n     * the project root. Refused absolute or parent-relative paths to prevent\n     * `cleanOutDir` from wiping arbitrary locations (defense-in-depth on\n     * top of cleanOutDir's runtime EC-3 guard).\n     */\n    distDir: z\n      .string()\n      .default('.theokit')\n      .refine(\n        (d) => !/^([A-Za-z]:)?[/\\\\]/.test(d) && !d.startsWith('..'),\n        'distDir must be a relative path inside the project root (e.g., \".theokit\")',\n      ),\n    /**\n     * Agent runtime configuration.\n     *\n     * - `maxRegistries` (T2.3, legacy): dev-mode cleanup of stale\n     *   `.theokit/agents/<id>/` dirs by mtime. Now superseded by SDK's\n     *   native registry GC but kept for backward-compat.\n     * - `registry` (Phase 6, Production-Readiness #2): forwarded to\n     *   `Agent.registry.configure()` lazily on first request.\n     *   * `maxAgents` — LRU cap. MUST be ≥ max-concurrent-active-conversations\n     *     (EC-17 DOCUMENT): with maxAgents:1 and 2 concurrent chats, LRU evicts\n     *     mid-stream → SDK aborts with code:'aborted'. Default 100 covers\n     *     indie/small-team; tune up for high-traffic.\n     *   * `idleTimeoutMs` — auto-evict idle agents (default 30 min). 0 disables\n     *     idle eviction (LRU only).\n     */\n    agents: z\n      .object({\n        maxRegistries: z.number().int().positive().default(100),\n        registry: z\n          .object({\n            /** LRU cap — MUST be ≥ max-concurrent-active-conversations. */\n            maxAgents: z.number().int().positive().max(10_000).default(100),\n            /** Idle eviction window in ms. 0 disables idle eviction (LRU only). */\n            idleTimeoutMs: z\n              .number()\n              .int()\n              .nonnegative()\n              .default(30 * 60_000),\n          })\n          .optional(),\n      })\n      .optional(),\n    port: z.number().int().min(1).max(65535).default(3000),\n    /** Listen on all addresses (0.0.0.0) for LAN/mobile testing. */\n    host: z.union([z.string(), z.boolean()]).default('localhost'),\n    /** Automatically open browser on `theokit dev`. */\n    open: z.union([z.boolean(), z.string()]).default(false),\n    /** Exit if port is already in use instead of trying next available. */\n    strictPort: z.boolean().default(false),\n    /** Forward browser console/errors to terminal — useful for AI agent dev. */\n    forwardConsole: z\n      .union([\n        z.boolean(),\n        z.object({\n          unhandledErrors: z.boolean().optional(),\n          logLevels: z.array(z.enum(['error', 'warn', 'info', 'log', 'debug'])).optional(),\n        }),\n      ])\n      .default(false),\n    /** Pre-transform files on startup for faster first page load. */\n    warmup: z\n      .object({\n        clientFiles: z.array(z.string()).optional(),\n        ssrFiles: z.array(z.string()).optional(),\n      })\n      .optional(),\n    ssr: z.boolean().default(false),\n    /** When true (and ssr === true), use renderToPipeableStream with progressive\n     * shell flush instead of single-shot renderToString. Opt-in for streaming\n     * SSR; default false preserves the current behavior. */\n    ssrStreaming: z.boolean().default(false),\n    rateLimit: rateLimitSchema.optional(),\n    upload: uploadSchema.optional(),\n    logging: loggingSchema.optional(),\n    security: securitySchema.optional(),\n    serialization: z.enum(['json', 'superjson']).default('json'),\n    // Plugins are validated structurally at runtime by createPluginRunnerFromConfig.\n    // Zod only checks the shape minimally (must be array). Type-level safety is\n    // provided through defineConfig at the user surface.\n    plugins: z.array(z.unknown()).optional(),\n    /** Enable client-side batching of theoFetch calls and the\n     * /api/__theo_batch__ server endpoint. */\n    batching: z\n      .union([z.boolean(), z.object({ max: z.number().int().positive().optional() })])\n      .optional(),\n    /** T4.1 — Audit log. When `logger` is provided, framework events\n     * (csrf.warn, rate-limit.exceeded, session.rotated, csp.violation) are\n     * emitted to it. Default: noop. */\n    audit: z\n      .object({\n        logger: z.unknown().optional(),\n      })\n      .optional(),\n    /** TheoUI auto-wire (T2.1). `false` = opt-out; object = explicit theme/fonts;\n     * undefined = enabled when @theokit/ui is detected in node_modules. */\n    ui: z\n      .union([\n        z.literal(false),\n        z.object({\n          theme: z.enum(['violet-forge', 'noir', 'paper']).optional(),\n          fonts: z.enum(['bundled', 'cdn']).optional(),\n        }),\n      ])\n      .optional(),\n    /**\n     * Cache subsystem (caching-and-revalidation-plan).\n     * Default `undefined` keeps caching disabled (backward compatible).\n     * Pass `cache: {}` to opt in with defaults.\n     */\n    cache: cacheSchema.optional(),\n    /**\n     * Devtools overlay (Phase 0.4.0+ — see docs/plans/devtools-plan.md).\n     *\n     * - `undefined` (default): devtools auto-injects in `pnpm dev`, NEVER in `vite build`.\n     * - `false`: devtools disabled entirely (Vite plugin skips injection even in dev).\n     * - `{ ... }`: devtools enabled with explicit defaults (position, theme).\n     *\n     * Tree-shaken to noop in prod via the dual-export pattern in\n     * `packages/theo/src/devtools/index.ts` (EC-17 positive prod check).\n     */\n    devtools: z\n      .union([\n        z.literal(false),\n        z.object({\n          position: z.enum(['top-left', 'top-right', 'bottom-left', 'bottom-right']).optional(),\n          theme: z.enum(['light', 'dark', 'system']).optional(),\n        }),\n      ])\n      .optional(),\n    /**\n     * Informative list of deploy adapters the app supports. Does NOT\n     * trigger per-build translations — only the `--target` CLI flag does\n     * (EC-201 / ADR D2). If `config.adapters` includes a target NOT\n     * matching `--target`, `theokit build` emits a cross-reference note.\n     */\n    adapters: z.array(z.string()).optional(),\n    /**\n     * Extra package names to pre-bundle via Vite's `optimizeDeps.include`.\n     *\n     * Framework auto-includes `@theokit/ui` and `lucide-react` when present.\n     * Apps adding plugin peer-deps that rely on a runtime `import('<pkg>')`\n     * (dynamic specifier) — e.g. `@theokit/plugin-canvas` consumers\n     * installing `mermaid` for Mermaid SVG rendering — must declare those\n     * here so Vite can resolve the literal in dev mode without\n     * \"Failed to resolve module specifier\" errors. Production builds use\n     * tsup/esbuild bundling and are not affected.\n     *\n     * Example:\n     *   viteOptimizeDeps: ['mermaid']\n     */\n    viteOptimizeDeps: z.array(z.string()).optional(),\n    /**\n     * Jobs backend (ADR D3 + T2.1). When configured, every request gets\n     * `ctx.queue.enqueue` auto-wired via the outbox lifecycle. Pass a\n     * `JobBackend` instance (InMemoryJobBackend, PostgresJobBackend, etc.).\n     */\n    jobs: z\n      .object({\n        backend: z.custom<unknown>((v) => typeof v === 'object' && v !== null),\n      })\n      .optional(),\n    /**\n     * StorageManager configuration (T1.1 / ADR-0007).\n     *\n     * Declares Postgres servers + databases + Redis servers. Consumed by\n     * `getStorageManager().configure()` at boot via `start.ts`.\n     *\n     * Default `undefined` means manager exists but is not configured — adapters\n     * relying on the manager (PostgresJobBackend.fromStorageManager, etc.) will\n     * throw with an actionable error on first use.\n     */\n    storage: storageSchema.optional(),\n    /**\n     * Wave 2 — Polyglot services orchestration (T1.1 / ADR-0012/0013/0014/0015).\n     *\n     * Declarative external sidecar processes (Python FastAPI / Node Hono)\n     * that boot alongside the TheoKit TS app. Empty `services: {}` is the\n     * default and preserves Wave 1 behavior.\n     */\n    services: servicesConfigSchema,\n    /**\n     * G2 — OpenAPI emit (build-time only).\n     *\n     * When present, `theokit build` writes a generated `openapi.json` from\n     * every `defineRoute()` body/query/params Zod schema. `undefined` keeps\n     * the framework backward-compatible (no emit). Pass `openapi: {}` to\n     * opt in with defaults.\n     *\n     * Defaults: spec 3.1.0 · servers `http://localhost:3000` · title\n     * \"TheoKit App\" · version \"0.0.0\" · outDir \".theokit\" (next to dist).\n     *\n     * The env var `THEOKIT_OPENAPI_SERVERS` (CSV of URLs) overrides\n     * `servers[].url` at emit time without rebuilding the config.\n     */\n    openapi: z\n      .object({\n        servers: z\n          .array(\n            z.object({\n              url: z.url(),\n              description: z.string().optional(),\n            }),\n          )\n          .default([{ url: 'http://localhost:3000', description: 'Local development' }]),\n        specVersion: z.enum(['3.1.0', '3.0.3']).default('3.1.0'),\n        title: z.string().default('TheoKit App'),\n        version: z.string().default('0.0.0'),\n        outDir: z.string().default('.theokit'),\n      })\n      .optional(),\n    /**\n     * G5 T1.3 — error envelope transformer hook (blueprint ADR D3).\n     *\n     * When present, runs at framework error-boundary time to enrich the\n     * envelope with consumer-defined extensions (`hint`, custom telemetry\n     * tags, etc.) BEFORE the envelope is serialized to the client. The\n     * function signature is preserved via the explicit `FormatErrorHook`\n     * type — TS inference flows from `theo.config.ts` into `@theo/client`\n     * codegen and `@theokit/ui` AgentErrorCard consumers.\n     *\n     * Use `z.custom<FormatErrorHook>(...)` because Zod's built-in\n     * `z.function()` discards its TS signature after parse; `z.custom`\n     * with a function-typed runtime guard preserves the call-site type\n     * without trading off Zod runtime validation.\n     */\n    formatError: z\n      .custom<FormatErrorHook>((val) => typeof val === 'function', {\n        message: 'formatError must be a function',\n      })\n      .optional(),\n  })\n  // EC-2 fix: cross-config refine — no service may share TheoKit's web port.\n  .refine((cfg) => !Object.values(cfg.services).some((s) => s.port === cfg.port), {\n    message: 'service.port collides with TheoKit web port — change one of them',\n    path: ['services'],\n  })\n\nexport type TheoConfig = z.infer<typeof theoConfigSchema>\n\nexport type OpenApiConfig = NonNullable<TheoConfig['openapi']>\n\n// Silence unused-import warnings for type-only re-exports — TS strips at compile,\n// but exports above re-introduce them for downstream consumers.\nexport type _FormatErrorContext = FormatErrorContext\n","import { z } from 'zod'\n\n/**\n * EC-3 — CWE-113 HTTP Response Splitting mitigation.\n *\n * Every string that becomes a header value must reject CR/LF. Apps that\n * derive header values from untrusted input (feature flags, tenant config,\n * URL params) would otherwise let attackers inject Set-Cookie / Location\n * headers via `\\r\\n`. Apply this refinement to every header-bound string\n * field: permissionsPolicy, csp, hsts, referrerPolicy, CORS allow/expose.\n */\nexport const headerSafeString = z\n  .string()\n  .refine((s) => !/[\\r\\n]/.test(s), { message: 'Header value must not contain CR/LF' })\n","import { z } from 'zod'\n\n/**\n * Base bucket config — legacy shape preserved for backwards compatibility.\n */\nconst baseRateLimitSchema = z.object({\n  windowMs: z.number().min(1),\n  max: z.number().int().min(1),\n})\n\n/**\n * T2.2 — Per-route + per-user rate limit. The new shape adds `routes`\n * (path map), `keyBy`, and `cookieName`. The legacy flat shape is still\n * accepted via the union — see `createRouteRateLimiter` for normalization.\n */\nexport const rateLimitSchema = z.union([\n  baseRateLimitSchema,\n  z.object({\n    default: baseRateLimitSchema.optional(),\n    routes: z.record(z.string(), baseRateLimitSchema).optional(),\n    keyBy: z\n      .union([\n        z.enum(['ip', 'session', 'user']),\n        z.function({ input: z.tuple([z.unknown()]), output: z.string() }),\n      ])\n      .optional(),\n    cookieName: z.string().min(1).optional(),\n  }),\n])\n","import { z } from 'zod'\n\nexport const uploadSchema = z.object({\n  maxFileSize: z\n    .number()\n    .min(1)\n    .default(10 * 1024 * 1024), // 10MB\n  maxFiles: z.number().int().min(1).default(10),\n  maxFieldSize: z\n    .number()\n    .min(1)\n    .default(1 * 1024 * 1024), // 1MB\n})\n","import { z } from 'zod'\n\nexport const loggingSchema = z.object({\n  level: z.enum(['debug', 'info', 'warn', 'error', 'silent']).default('info'),\n})\n","import { z } from 'zod'\n\n/**\n * Cache subsystem config (caching-and-revalidation-plan).\n * Default `cache: undefined` keeps the framework backward-compatible\n * (no engine initialized → no cache primitives available).\n *\n * Setting `cache: {}` opts in with all defaults.\n */\nconst routeRuleSchema = z.object({\n  maxAge: z.number().nonnegative().finite().optional(),\n  swr: z.number().nonnegative().finite().optional(),\n  tags: z.array(z.string()).optional(),\n})\n\nexport const cacheSchema = z.object({\n  enabled: z.boolean().default(true),\n  /** 'memory' uses InMemoryCacheAdapter; otherwise pass a custom adapter instance. */\n  storage: z.union([z.literal('memory'), z.custom<unknown>()]).default('memory'),\n  maxEntries: z.number().int().positive().default(1000),\n  defaults: z\n    .object({\n      maxAge: z.number().nonnegative().finite().default(1),\n      swr: z.number().nonnegative().finite().optional(),\n      cacheErrors: z.boolean().default(false),\n    })\n    .default({ maxAge: 1, cacheErrors: false }),\n  keyDerivation: z\n    .object({\n      excludeQuery: z.array(z.string()).optional(),\n      sortQuery: z.boolean().default(true),\n      lowercaseHost: z.boolean().default(true),\n    })\n    .default({ sortQuery: true, lowercaseHost: true }),\n  routeRules: z.record(z.string(), routeRuleSchema).optional(),\n})\n","import { z } from 'zod'\n\nimport { headerSafeString } from './header-safe.js'\n\n/**\n * Phase 5 — CSRF warn-first (EC-1).\n *\n * 0.2.0 default: `warn`. Existing apps keep working but get structured\n * warnings about every state-mutating request that does not carry the\n * `X-Theo-Action: 1` header. 0.3.0 will flip the default to `strict`.\n *\n * Set explicitly to `strict` to opt into the future default early,\n * or `off` to disable CSRF entirely (only valid when you have another\n * defense — bearer auth, no session cookies, etc).\n */\n\n/**\n * Phase 6 — Default security headers (D4 / EC-2).\n *\n * 0.2.0 defaults:\n *   - CSP in `report-only` mode (EC-2: don't break existing apps)\n *   - X-Frame-Options: DENY · X-Content-Type-Options: nosniff\n *   - Referrer-Policy: strict-origin-when-cross-origin\n *   - HSTS in production only (no TLS on localhost)\n *\n * Users override individual headers, swap CSP to `enforce`, or disable\n * CSP entirely (`csp: false` / `cspMode: 'off'`).\n */\nexport const securityHeadersSchema = z.object({\n  csp: z.union([headerSafeString, z.literal(false)]).optional(),\n  // T6.1 — default flipped from 'report-only' to 'enforce' for 0.3.0.\n  // Users who want the old behaviour set `cspMode: 'report-only'`\n  // explicitly. See docs/migrating/0.2-to-0.3.md.\n  cspMode: z.enum(['enforce', 'report-only', 'off']).default('enforce'),\n  hsts: z.union([headerSafeString, z.literal(false)]).optional(),\n  frameOptions: z.enum(['DENY', 'SAMEORIGIN']).default('DENY'),\n  contentTypeOptions: z.literal('nosniff').default('nosniff'),\n  referrerPolicy: headerSafeString.default('strict-origin-when-cross-origin'),\n  /**\n   * T1.1 — Permissions-Policy directive string. EC-3-refined: rejects CR/LF.\n   * Pass `false` to suppress the header.\n   */\n  permissionsPolicy: z.union([headerSafeString, z.literal(false)]).optional(),\n})\n\n/**\n * T5.1 — Disallowed-routes escalation pattern (Rails-inspired).\n *\n * `routes` accepts string (exact match — trailing slash matters) or\n * RegExp entries. Matched routes that would otherwise emit `csrf.warn`\n * dispatch through `disallowedBehavior` instead:\n *   - `'warn'`  : no-op vs the default warn-mode behavior\n *   - `'raise'` : escalate to 403, even when global `csrf` mode is 'warn'\n *\n * Use to roll out strict mode per-route (e.g., flip /api/auth/* first)\n * without committing the entire surface to strict at once.\n */\nexport const disallowedConfigSchema = z.object({\n  routes: z.array(z.union([z.string(), z.instanceof(RegExp)])),\n  behavior: z.enum(['warn', 'raise']).default('raise'),\n})\n\n/**\n * T1.2 — CORS configuration.\n *\n * `origins` accepts a single value (`'*'`, string, RegExp, callback) OR an\n * array of (string | RegExp). The spec-violating `origins: '*'` +\n * `credentials: true` combination is rejected at parse time (browsers\n * ignore wildcards when credentials are sent).\n *\n * EC-3 — `allowedHeaders` and `exposedHeaders` entries go through the\n * header-safe refinement (CR/LF rejected — CWE-113 mitigation).\n */\nexport const corsSchema = z\n  .object({\n    origins: z.union([\n      z.literal('*'),\n      headerSafeString,\n      z.instanceof(RegExp),\n      z.array(z.union([headerSafeString, z.instanceof(RegExp)])),\n      z.function({ input: z.tuple([z.string()]), output: z.boolean() }),\n    ]),\n    methods: z\n      .array(z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'HEAD']))\n      .optional(),\n    allowedHeaders: z.array(headerSafeString).optional(),\n    exposedHeaders: z.array(headerSafeString).optional(),\n    credentials: z.boolean().default(false),\n    maxAge: z.number().int().min(0).max(86400).default(600),\n  })\n  .refine((c) => !(c.origins === '*' && c.credentials), {\n    message: 'CORS spec forbids origins:\"*\" with credentials:true — browsers ignore the wildcard',\n  })\n\nexport const securitySchema = z.object({\n  // T6.1 — default flipped from 'warn' to 'strict' for 0.3.0. Apps that\n  // grep their warn-mode logs from 0.2.x already know which endpoints\n  // break; opt back into 'warn' globally OR use disallowedRoutes for\n  // surgical migration. See docs/migrating/0.2-to-0.3.md.\n  csrf: z.enum(['off', 'warn', 'strict']).default('strict'),\n  headers: securityHeadersSchema.optional(),\n  /** T5.1 — per-route escalation (Rails disallowed_warnings pattern). */\n  disallowed: disallowedConfigSchema.optional(),\n  /** T1.2 — Cross-Origin Resource Sharing. Single global config; runs first in pipeline. */\n  cors: corsSchema.optional(),\n})\n","import { z } from 'zod'\n\n/**\n * StorageManager schemas (T1.1 / ADR-0007 D4).\n *\n * `theo.config.ts > storage` declares Postgres servers (credentials), the\n * databases on each server (TheoCloud / managed PG / self-host), and Redis\n * servers. The runtime `StorageManager` consumes this block; adapters\n * (PostgresJobBackend, PostgresConversationStorage, etc.) request pools by\n * database name and never see raw credentials at the call site.\n *\n * EC-1 (DOCUMENT in concept doc T4.1): Zod default strip-unknown mode\n * silently drops typo keys (`databasees` instead of `databases`). The\n * concept doc warns users to use exact names; runtime errors are still\n * actionable (`Database \"X\" not configured`).\n *\n * EC-2 (DEFERRED to use-time): `databases.X.server` references a key in\n * `servers`. Cross-field validation is intentionally NOT enforced at parse\n * time — `StorageManager.usePostgres()` throws an actionable error on the\n * first call with the dangling reference, matching Rails / Nitro behavior.\n */\nconst tlsConfigSchema = z.object({\n  rejectUnauthorized: z.boolean().optional(),\n  caCert: z.string().optional(),\n  clientCert: z.string().optional(),\n  clientKey: z.string().optional(),\n})\n\nconst serverConfigSchema = z.object({\n  host: z.string().min(1),\n  port: z.number().int().positive().max(65535).optional(),\n  user: z.string().min(1),\n  /** Password may be the empty string (some providers permit it). */\n  password: z.string(),\n  tls: tlsConfigSchema.optional(),\n})\n\nconst postgresPoolConfigSchema = z.object({\n  min: z.number().int().nonnegative().optional(),\n  max: z.number().int().positive().optional(),\n  connectionTimeoutMillis: z.number().int().positive().optional(),\n  idleTimeoutMillis: z.number().int().nonnegative().optional(),\n})\n\nconst postgresDatabaseConfigSchema = z.object({\n  /** References a key in `storage.servers`. Resolved at `usePostgres()` call time. */\n  server: z.string().min(1),\n  database: z.string().min(1),\n  pool: postgresPoolConfigSchema.optional(),\n})\n\nconst redisServerConfigSchema = serverConfigSchema.extend({\n  db: z.number().int().nonnegative().optional(),\n  maxRetriesPerRequest: z.number().int().nonnegative().optional(),\n})\n\nexport const storageSchema = z.object({\n  servers: z.record(z.string(), serverConfigSchema).optional(),\n  databases: z.record(z.string(), postgresDatabaseConfigSchema).optional(),\n  redis: z.record(z.string(), redisServerConfigSchema).optional(),\n})\n\nexport type StorageConfig = z.infer<typeof storageSchema>\n"],"mappings":";;;;;;;AAAA,SAAS,KAAAA,UAAS;;;ACAlB,SAAS,SAAS;AAWX,IAAM,mBAAmB,EAC7B,OAAO,EACP,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,GAAG,EAAE,SAAS,sCAAsC,CAAC;;;ACbtF,SAAS,KAAAC,UAAS;AAKlB,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EACnC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAC7B,CAAC;AAOM,IAAM,kBAAkBA,GAAE,MAAM;AAAA,EACrC;AAAA,EACAA,GAAE,OAAO;AAAA,IACP,SAAS,oBAAoB,SAAS;AAAA,IACtC,QAAQA,GAAE,OAAOA,GAAE,OAAO,GAAG,mBAAmB,EAAE,SAAS;AAAA,IAC3D,OAAOA,GACJ,MAAM;AAAA,MACLA,GAAE,KAAK,CAAC,MAAM,WAAW,MAAM,CAAC;AAAA,MAChCA,GAAE,SAAS,EAAE,OAAOA,GAAE,MAAM,CAACA,GAAE,QAAQ,CAAC,CAAC,GAAG,QAAQA,GAAE,OAAO,EAAE,CAAC;AAAA,IAClE,CAAC,EACA,SAAS;AAAA,IACZ,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,CAAC;AACH,CAAC;;;AC5BD,SAAS,KAAAC,UAAS;AAEX,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,aAAaA,GACV,OAAO,EACP,IAAI,CAAC,EACL,QAAQ,KAAK,OAAO,IAAI;AAAA;AAAA,EAC3B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE;AAAA,EAC5C,cAAcA,GACX,OAAO,EACP,IAAI,CAAC,EACL,QAAQ,IAAI,OAAO,IAAI;AAAA;AAC5B,CAAC;;;ACZD,SAAS,KAAAC,UAAS;AAEX,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,OAAOA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,SAAS,QAAQ,CAAC,EAAE,QAAQ,MAAM;AAC5E,CAAC;;;ACJD,SAAS,KAAAC,UAAS;AASlB,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EAC/B,QAAQA,GAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EACnD,KAAKA,GAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChD,MAAMA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AACrC,CAAC;AAEM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,SAASA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEjC,SAASA,GAAE,MAAM,CAACA,GAAE,QAAQ,QAAQ,GAAGA,GAAE,OAAgB,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC7E,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACpD,UAAUA,GACP,OAAO;AAAA,IACN,QAAQA,GAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC;AAAA,IACnD,KAAKA,GAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChD,aAAaA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,CAAC,EACA,QAAQ,EAAE,QAAQ,GAAG,aAAa,MAAM,CAAC;AAAA,EAC5C,eAAeA,GACZ,OAAO;AAAA,IACN,cAAcA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IAC3C,WAAWA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,IACnC,eAAeA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EACzC,CAAC,EACA,QAAQ,EAAE,WAAW,MAAM,eAAe,KAAK,CAAC;AAAA,EACnD,YAAYA,GAAE,OAAOA,GAAE,OAAO,GAAG,eAAe,EAAE,SAAS;AAC7D,CAAC;;;ACnCD,SAAS,KAAAC,UAAS;AA4BX,IAAM,wBAAwBC,GAAE,OAAO;AAAA,EAC5C,KAAKA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5D,SAASA,GAAE,KAAK,CAAC,WAAW,eAAe,KAAK,CAAC,EAAE,QAAQ,SAAS;AAAA,EACpE,MAAMA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7D,cAAcA,GAAE,KAAK,CAAC,QAAQ,YAAY,CAAC,EAAE,QAAQ,MAAM;AAAA,EAC3D,oBAAoBA,GAAE,QAAQ,SAAS,EAAE,QAAQ,SAAS;AAAA,EAC1D,gBAAgB,iBAAiB,QAAQ,iCAAiC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1E,mBAAmBA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAC5E,CAAC;AAcM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,QAAQA,GAAE,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,EAC3D,UAAUA,GAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,QAAQ,OAAO;AACrD,CAAC;AAaM,IAAM,aAAaA,GACvB,OAAO;AAAA,EACN,SAASA,GAAE,MAAM;AAAA,IACfA,GAAE,QAAQ,GAAG;AAAA,IACb;AAAA,IACAA,GAAE,WAAW,MAAM;AAAA,IACnBA,GAAE,MAAMA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,IACzDA,GAAE,SAAS,EAAE,OAAOA,GAAE,MAAM,CAACA,GAAE,OAAO,CAAC,CAAC,GAAG,QAAQA,GAAE,QAAQ,EAAE,CAAC;AAAA,EAClE,CAAC;AAAA,EACD,SAASA,GACN,MAAMA,GAAE,KAAK,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,WAAW,MAAM,CAAC,CAAC,EAC1E,SAAS;AAAA,EACZ,gBAAgBA,GAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,EACnD,gBAAgBA,GAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,EACnD,aAAaA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAG;AACxD,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,EAAE,YAAY,OAAO,EAAE,cAAc;AAAA,EACpD,SAAS;AACX,CAAC;AAEI,IAAM,iBAAiBA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,MAAMA,GAAE,KAAK,CAAC,OAAO,QAAQ,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACxD,SAAS,sBAAsB,SAAS;AAAA;AAAA,EAExC,YAAY,uBAAuB,SAAS;AAAA;AAAA,EAE5C,MAAM,WAAW,SAAS;AAC5B,CAAC;;;ACzGD,SAAS,KAAAC,UAAS;AAqBlB,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EAC/B,oBAAoBA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACzC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EAClC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,EACtD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,UAAUA,GAAE,OAAO;AAAA,EACnB,KAAK,gBAAgB,SAAS;AAChC,CAAC;AAED,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EACxC,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC7C,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,yBAAyBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9D,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAC7D,CAAC;AAED,IAAM,+BAA+BA,GAAE,OAAO;AAAA;AAAA,EAE5C,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,yBAAyB,SAAS;AAC1C,CAAC;AAED,IAAM,0BAA0B,mBAAmB,OAAO;AAAA,EACxD,IAAIA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC5C,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAChE,CAAC;AAEM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAG,kBAAkB,EAAE,SAAS;AAAA,EAC3D,WAAWA,GAAE,OAAOA,GAAE,OAAO,GAAG,4BAA4B,EAAE,SAAS;AAAA,EACvE,OAAOA,GAAE,OAAOA,GAAE,OAAO,GAAG,uBAAuB,EAAE,SAAS;AAChE,CAAC;;;APjBM,IAAM,mBAAmBC,GAC7B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQN,MAAMA,GACH,OAAO,EACP,IAAI,EAAE,EACN;AAAA;AAAA;AAAA,IAGC,CAAC,UACC,MAAM,SAAS,KACf,gBAAgB,KAAK,KAAK,KAC1B,CAAC,MAAM,WAAW,GAAG,KACrB,CAAC,MAAM,SAAS,GAAG;AAAA,IACrB;AAAA,EACF,EACC,SAAS;AAAA,EACZ,QAAQA,GAAE,OAAO,EAAE,QAAQ,KAAK;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtC,SAASA,GACN,OAAO,EACP,QAAQ,UAAU,EAClB;AAAA,IACC,CAAC,MAAM,CAAC,qBAAqB,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,IAAI;AAAA,IAC1D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBF,QAAQA,GACL,OAAO;AAAA,IACN,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,IACtD,UAAUA,GACP,OAAO;AAAA;AAAA,MAEN,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAG;AAAA;AAAA,MAE9D,eAAeA,GACZ,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,QAAQ,KAAK,GAAM;AAAA,IACxB,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AAAA,EACZ,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAI;AAAA;AAAA,EAErD,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,WAAW;AAAA;AAAA,EAE5D,MAAMA,GAAE,MAAM,CAACA,GAAE,QAAQ,GAAGA,GAAE,OAAO,CAAC,CAAC,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEtD,YAAYA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAErC,gBAAgBA,GACb,MAAM;AAAA,IACLA,GAAE,QAAQ;AAAA,IACVA,GAAE,OAAO;AAAA,MACP,iBAAiBA,GAAE,QAAQ,EAAE,SAAS;AAAA,MACtC,WAAWA,GAAE,MAAMA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,OAAO,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,IACjF,CAAC;AAAA,EACH,CAAC,EACA,QAAQ,KAAK;AAAA;AAAA,EAEhB,QAAQA,GACL,OAAO;AAAA,IACN,aAAaA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IAC1C,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACzC,CAAC,EACA,SAAS;AAAA,EACZ,KAAKA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI9B,cAAcA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACvC,WAAW,gBAAgB,SAAS;AAAA,EACpC,QAAQ,aAAa,SAAS;AAAA,EAC9B,SAAS,cAAc,SAAS;AAAA,EAChC,UAAU,eAAe,SAAS;AAAA,EAClC,eAAeA,GAAE,KAAK,CAAC,QAAQ,WAAW,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA,EAI3D,SAASA,GAAE,MAAMA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,UAAUA,GACP,MAAM,CAACA,GAAE,QAAQ,GAAGA,GAAE,OAAO,EAAE,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAC9E,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,OAAOA,GACJ,OAAO;AAAA,IACN,QAAQA,GAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,CAAC,EACA,SAAS;AAAA;AAAA;AAAA,EAGZ,IAAIA,GACD,MAAM;AAAA,IACLA,GAAE,QAAQ,KAAK;AAAA,IACfA,GAAE,OAAO;AAAA,MACP,OAAOA,GAAE,KAAK,CAAC,gBAAgB,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,MAC1D,OAAOA,GAAE,KAAK,CAAC,WAAW,KAAK,CAAC,EAAE,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMZ,OAAO,YAAY,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW5B,UAAUA,GACP,MAAM;AAAA,IACLA,GAAE,QAAQ,KAAK;AAAA,IACfA,GAAE,OAAO;AAAA,MACP,UAAUA,GAAE,KAAK,CAAC,YAAY,aAAa,eAAe,cAAc,CAAC,EAAE,SAAS;AAAA,MACpF,OAAOA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,CAAC,EAAE,SAAS;AAAA,IACtD,CAAC;AAAA,EACH,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOZ,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAevC,kBAAkBA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,MAAMA,GACH,OAAO;AAAA,IACN,SAASA,GAAE,OAAgB,CAAC,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI;AAAA,EACvE,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWZ,SAAS,cAAc,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeV,SAASA,GACN,OAAO;AAAA,IACN,SAASA,GACN;AAAA,MACCA,GAAE,OAAO;AAAA,QACP,KAAKA,GAAE,IAAI;AAAA,QACX,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,MACnC,CAAC;AAAA,IACH,EACC,QAAQ,CAAC,EAAE,KAAK,yBAAyB,aAAa,oBAAoB,CAAC,CAAC;AAAA,IAC/E,aAAaA,GAAE,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,QAAQ,OAAO;AAAA,IACvD,OAAOA,GAAE,OAAO,EAAE,QAAQ,aAAa;AAAA,IACvC,SAASA,GAAE,OAAO,EAAE,QAAQ,OAAO;AAAA,IACnC,QAAQA,GAAE,OAAO,EAAE,QAAQ,UAAU;AAAA,EACvC,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBZ,aAAaA,GACV,OAAwB,CAAC,QAAQ,OAAO,QAAQ,YAAY;AAAA,IAC3D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AACd,CAAC,EAEA,OAAO,CAAC,QAAQ,CAAC,OAAO,OAAO,IAAI,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,GAAG;AAAA,EAC9E,SAAS;AAAA,EACT,MAAM,CAAC,UAAU;AACnB,CAAC;","names":["z","z","z","z","z","z","z","z","z"]}

package/dist/dev-RQLE5W72.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/commands/dev.ts"],"sourcesContent":["import react from '@vitejs/plugin-react'\nimport { createServer, type Plugin, type ViteDevServer } from 'vite'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { loadEnv } from '../../config/load-env.js'\nimport { validateProjectStructure } from '../../config/validate-structure.js'\nimport { orchestrateDev } from '../../services/index.js'\nimport { theoPluginAsync } from '../../vite-plugin/index.js'\nimport { preflightNodeAndBindings } from '../preflight-node-version.js'\n\ninterface DevOptions {\n  port?: number\n}\n\nexport async function startDevServer(cwd: string, options?: DevOptions): Promise<ViteDevServer> {\n  // Preflight (FIRST — BEFORE anything that touches native bindings):\n  // verifies Node version + native binding ABI match. Emits actionable\n  // error referencing `nvm use` + `pnpm rebuild` when the dev server\n  // was spawned under the wrong Node (common gotcha with `nohup env ...`\n  // stripping the nvm PATH prefix).\n  preflightNodeAndBindings(cwd)\n\n  // Phase 1 (T1.2) — Load .env files into process.env BEFORE any module\n  // reads them. Must run before loadConfig() so theo.config.ts functions\n  // referencing process.env.* resolve correctly.\n  loadEnv({ cwd, mode: 'development' })\n\n  const config = await loadConfig(cwd)\n  validateProjectStructure(cwd)\n\n  // Wave 2 (T1.1) — spawn polyglot services BEFORE Vite. Healthcheck gates\n  // readiness. Empty `services: {}` → early return (Wave 1 BC preserved).\n  const orchestration = await orchestrateDev({\n    cwd,\n    services: config.services,\n  })\n  if (!orchestration.allHealthy) {\n    await orchestration.stop()\n    throw new Error(\n      `[services] services failed healthcheck: ${orchestration.unhealthy.join(', ')}. ` +\n        `Check that each declared service binds its port and responds 200 on its ` +\n        `healthcheck path within 30s.`,\n    )\n  }\n\n  // Phase 7 — legacy fs-mtime sweep removed: SDK's Agent.registry handles\n  // LRU + idle eviction natively (configurable via theo.config.ts >\n  // agents.registry; lazy-configured on first request).\n\n  const port = options?.port ?? config.port\n  // Narrow the rateLimit union: only the legacy flat shape (windowMs+max)\n  // flows into the theoPlugin's RateLimitConfig parameter. The per-route\n  // variant is consumed inside the api-middleware via the loaded user\n  // config separately.\n  const flatRateLimit =\n    config.rateLimit && 'windowMs' in config.rateLimit && 'max' in config.rateLimit\n      ? config.rateLimit\n      : undefined\n  // theoPluginAsync auto-chains @theokit/ui + @tailwindcss/vite via\n  // top-level Plugin[] return (sync `theoPlugin()` factory's config()\n  // hook returning {plugins:[...]} is silently dropped by Vite — see\n  // commit history). Spread the result so Vite flattens them.\n  let server: ViteDevServer\n  try {\n    const theoPlugins = await theoPluginAsync({\n      root: cwd,\n      rateLimit: flatRateLimit,\n      ssr: config.ssr,\n      // #95 — honor config `serverDir` (default \"server\") so route/action discovery scans it.\n      serverDir: config.serverDir,\n      // Wave 2 (T3.1) — wire typed-client plugin when services declared.\n      services: config.services,\n      // T4.1 (canvas-ecosystem-refactor / ADR D6) — passthrough peer-deps\n      // that plugins import dynamically (e.g., mermaid via plugin-canvas).\n      viteOptimizeDeps: config.viteOptimizeDeps,\n    })\n    server = await createServer({\n      root: cwd,\n      plugins: [react(), ...theoPlugins] as Plugin[],\n      server: {\n        port,\n        host: config.host,\n        open: config.open,\n        strictPort: config.strictPort,\n        warmup: config.warmup ?? {\n          clientFiles: ['./app/**/*.tsx', './app/**/*.ts'],\n        },\n      },\n      logLevel: options?.port === 0 ? 'silent' : undefined,\n    })\n\n    await server.listen()\n  } catch (err) {\n    // EC-1 / try-finally pattern: if Vite create/listen fails AFTER services\n    // started, stop them so we don't leak child processes.\n    await orchestration.stop()\n    throw err\n  }\n\n  // EC-1 fix: attach orchestration.stop() to the underlying HTTP server's\n  // close event via Node-native API. We do NOT mutate `server.close`\n  // (fragile across Vite upgrades). httpServer is `http.Server | null`.\n  server.httpServer?.on('close', () => {\n    void orchestration.stop()\n  })\n\n  return server\n}\n\nexport async function devCommand(options: DevOptions): Promise<void> {\n  try {\n    const cwd = process.cwd()\n    const server = await startDevServer(cwd, options)\n    server.printUrls()\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err)\n    console.error(`\\n  ✗ ${msg}\\n`)\n    process.exit(1)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,WAAW;AAClB,SAAS,oBAAqD;AAa9D,eAAsB,eAAe,KAAa,SAA8C;AAM9F,2BAAyB,GAAG;AAK5B,UAAQ,EAAE,KAAK,MAAM,cAAc,CAAC;AAEpC,QAAM,SAAS,MAAM,WAAW,GAAG;AACnC,2BAAyB,GAAG;AAI5B,QAAM,gBAAgB,MAAM,eAAe;AAAA,IACzC;AAAA,IACA,UAAU,OAAO;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,cAAc,YAAY;AAC7B,UAAM,cAAc,KAAK;AACzB,UAAM,IAAI;AAAA,MACR,2CAA2C,cAAc,UAAU,KAAK,IAAI,CAAC;AAAA,IAG/E;AAAA,EACF;AAMA,QAAM,OAAO,SAAS,QAAQ,OAAO;AAKrC,QAAM,gBACJ,OAAO,aAAa,cAAc,OAAO,aAAa,SAAS,OAAO,YAClE,OAAO,YACP;AAKN,MAAI;AACJ,MAAI;AACF,UAAM,cAAc,MAAM,gBAAgB;AAAA,MACxC,MAAM;AAAA,MACN,WAAW;AAAA,MACX,KAAK,OAAO;AAAA;AAAA,MAEZ,WAAW,OAAO;AAAA;AAAA,MAElB,UAAU,OAAO;AAAA;AAAA;AAAA,MAGjB,kBAAkB,OAAO;AAAA,IAC3B,CAAC;AACD,aAAS,MAAM,aAAa;AAAA,MAC1B,MAAM;AAAA,MACN,SAAS,CAAC,MAAM,GAAG,GAAG,WAAW;AAAA,MACjC,QAAQ;AAAA,QACN;AAAA,QACA,MAAM,OAAO;AAAA,QACb,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO,UAAU;AAAA,UACvB,aAAa,CAAC,kBAAkB,eAAe;AAAA,QACjD;AAAA,MACF;AAAA,MACA,UAAU,SAAS,SAAS,IAAI,WAAW;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,OAAO;AAAA,EACtB,SAAS,KAAK;AAGZ,UAAM,cAAc,KAAK;AACzB,UAAM;AAAA,EACR;AAKA,SAAO,YAAY,GAAG,SAAS,MAAM;AACnC,SAAK,cAAc,KAAK;AAAA,EAC1B,CAAC;AAED,SAAO;AACT;AAEA,eAAsB,WAAW,SAAoC;AACnE,MAAI;AACF,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,SAAS,MAAM,eAAe,KAAK,OAAO;AAChD,WAAO,UAAU;AAAA,EACnB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":[]}

package/dist/mcp-H5GWOGD7.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/commands/mcp.ts","../src/server/agent/mcp-stdio.ts"],"sourcesContent":["/**\n * `theokit mcp <agent>` — expose a scanned agent as an MCP server over stdio.\n *\n * The stdio sibling of the M16 HTTP route (`POST /api/agents/<name>/mcp`): a desktop MCP client\n * (e.g. Claude Desktop) spawns this command and speaks newline-delimited JSON-RPC over the pipe.\n * It reuses the framework's OWN `serveMcpStdio` / `handleMcpJsonRpc` (no LLM call, no runtime — a\n * TRANSPORT, like the HTTP route). `deps` is injectable so the routing is tested without Vite/stdin.\n */\nimport { createInterface } from 'node:readline'\n\nimport { extractAppResources } from '../../server/agent/mcp-app-resources.js'\nimport { type StdioStreams, serveMcpStdio } from '../../server/agent/mcp-stdio.js'\nimport { scanAgents } from '../../server/scan/agent-scan.js'\n\nimport { createAgentSsrLoader } from './agent.js'\n\nexport interface McpCommandDeps {\n  projectRoot?: string\n  /** Load a TS agent module; defaults to the framework's Vite SSR loader (same transpile as dev). */\n  loadModule?: (filePath: string) => Promise<Record<string, unknown>>\n  /** stdio streams; defaults to `readline(process.stdin)` + `process.stdout`. Injected in tests. */\n  streams?: StdioStreams\n}\n\nexport async function mcpCommand(name: string, deps: McpCommandDeps = {}): Promise<void> {\n  const projectRoot = deps.projectRoot ?? process.cwd()\n  const agent = scanAgents(projectRoot).find((a) => a.name === name)\n  if (!agent) {\n    const names = scanAgents(projectRoot)\n      .map((a) => a.name)\n      .join(', ')\n    throw new Error(\n      `theokit mcp: agent '${name}' not found. Available: ${names || '(none in agents/)'}`,\n    )\n  }\n\n  let loadModule = deps.loadModule\n  let dispose: (() => Promise<void>) | undefined\n  if (!loadModule) {\n    const loader = await createAgentSsrLoader(projectRoot)\n    loadModule = loader.load\n    dispose = loader.dispose\n  }\n\n  const streams =\n    deps.streams ??\n    ({\n      lines: createInterface({ input: process.stdin }),\n      write: (line: string) => process.stdout.write(line),\n    } satisfies StdioStreams)\n\n  try {\n    const mod = await loadModule(agent.filePath)\n    await serveMcpStdio(mod, agent.name, extractAppResources(mod), streams)\n  } finally {\n    if (dispose) await dispose()\n  }\n}\n","/**\n * MCP stdio transport (M16 follow-up) — expose a TheoKit agent as an MCP server over stdin/stdout,\n * the sibling of the M16 HTTP route (`POST /api/agents/<name>/mcp`). A desktop MCP client (e.g.\n * Claude Desktop) spawns `theokit mcp <agent>` and speaks newline-delimited JSON-RPC over the pipe.\n *\n * This is a TRANSPORT over the framework's OWN {@link handleMcpJsonRpc} — it reuses the exact handler\n * the HTTP route uses; it calls no LLM, spawns no MCP client, and reimplements no runtime (G2 /\n * sdk-runtime.md). Distinct from the SDK's MCP CLIENT stdio (which spawns external MCP servers via\n * `mcpServers` command/args) — that stays SDK-side. Here TheoKit is the SERVER. The framework-side\n * placement of this server-exposure transport is recorded in ADR-0042 (refining ADR-0040's M16 note).\n */\nimport type { AppResource } from './mcp-app-resources.js'\nimport { handleMcpJsonRpc } from './mcp-handler.js'\n\n/**\n * Handle one newline-delimited JSON-RPC line. Returns the response line to write to stdout, or\n * `null` for a blank line (nothing to emit). A malformed JSON line yields a `-32700` (Parse error)\n * envelope — never throws, so the stdio loop never dies on bad input.\n */\nexport async function handleMcpStdioLine(\n  line: string,\n  mod: unknown,\n  name: string,\n  appResources: readonly AppResource[] = [],\n): Promise<string | null> {\n  const trimmed = line.trim()\n  if (trimmed.length === 0) return null\n  let body: unknown\n  try {\n    body = JSON.parse(trimmed)\n  } catch {\n    return JSON.stringify({\n      jsonrpc: '2.0',\n      id: null,\n      error: { code: -32700, message: 'Parse error' },\n    })\n  }\n  const response = handleMcpJsonRpc(mod, name, body, appResources)\n  const payload: unknown = await response.json()\n  return JSON.stringify(payload)\n}\n\n/** A minimal readable line source (an async iterable of lines) + a writable sink. */\nexport interface StdioStreams {\n  /** Async iterable of newline-delimited input lines (e.g. `readline.createInterface({ input })`). */\n  lines: AsyncIterable<string>\n  /** Write a response line (the caller appends no newline). */\n  write: (line: string) => void\n}\n\n/**\n * Drive the MCP stdio server loop: for each input line, dispatch via {@link handleMcpStdioLine} and\n * write the response line (with a trailing `\\n`). Returns when the input stream ends (EOF).\n */\nexport async function serveMcpStdio(\n  mod: unknown,\n  name: string,\n  appResources: readonly AppResource[],\n  streams: StdioStreams,\n): Promise<void> {\n  for await (const line of streams.lines) {\n    const out = await handleMcpStdioLine(line, mod, name, appResources)\n    if (out !== null) streams.write(`${out}\\n`)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAQA,SAAS,uBAAuB;;;ACWhC,eAAsB,mBACpB,MACA,KACA,MACA,eAAuC,CAAC,GAChB;AACxB,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO,KAAK,UAAU;AAAA,MACpB,SAAS;AAAA,MACT,IAAI;AAAA,MACJ,OAAO,EAAE,MAAM,QAAQ,SAAS,cAAc;AAAA,IAChD,CAAC;AAAA,EACH;AACA,QAAM,WAAW,iBAAiB,KAAK,MAAM,MAAM,YAAY;AAC/D,QAAM,UAAmB,MAAM,SAAS,KAAK;AAC7C,SAAO,KAAK,UAAU,OAAO;AAC/B;AAcA,eAAsB,cACpB,KACA,MACA,cACA,SACe;AACf,mBAAiB,QAAQ,QAAQ,OAAO;AACtC,UAAM,MAAM,MAAM,mBAAmB,MAAM,KAAK,MAAM,YAAY;AAClE,QAAI,QAAQ,KAAM,SAAQ,MAAM,GAAG,GAAG;AAAA,CAAI;AAAA,EAC5C;AACF;;;ADxCA,eAAsB,WAAW,MAAc,OAAuB,CAAC,GAAkB;AACvF,QAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AACpD,QAAM,QAAQ,WAAW,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AACjE,MAAI,CAAC,OAAO;AACV,UAAM,QAAQ,WAAW,WAAW,EACjC,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,KAAK,IAAI;AACZ,UAAM,IAAI;AAAA,MACR,uBAAuB,IAAI,2BAA2B,SAAS,mBAAmB;AAAA,IACpF;AAAA,EACF;AAEA,MAAI,aAAa,KAAK;AACtB,MAAI;AACJ,MAAI,CAAC,YAAY;AACf,UAAM,SAAS,MAAM,qBAAqB,WAAW;AACrD,iBAAa,OAAO;AACpB,cAAU,OAAO;AAAA,EACnB;AAEA,QAAM,UACJ,KAAK,WACJ;AAAA,IACC,OAAO,gBAAgB,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,IAC/C,OAAO,CAAC,SAAiB,QAAQ,OAAO,MAAM,IAAI;AAAA,EACpD;AAEF,MAAI;AACF,UAAM,MAAM,MAAM,WAAW,MAAM,QAAQ;AAC3C,UAAM,cAAc,KAAK,MAAM,MAAM,oBAAoB,GAAG,GAAG,OAAO;AAAA,EACxE,UAAE;AACA,QAAI,QAAS,OAAM,QAAQ;AAAA,EAC7B;AACF;","names":[]}

package/dist/start-TGNHQ7NZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/commands/start/index.ts","../src/server/define/health-route.ts","../src/cli/commands/start/bootstrap-stages.ts","../src/cli/commands/start/graceful-shutdown.ts","../src/cli/commands/start/manifest-loader.ts","../src/cli/commands/start/request-handler.ts","../src/cli/commands/start/handlers.ts","../src/server/http/static.ts","../src/cli/commands/start/ssr-setup.ts","../src/cli/commands/start/websocket-handler.ts"],"sourcesContent":["/**\n * theokit start — production server orchestration spine.\n *\n * T4.2 (architecture-cleanup, ADR-0017): stages extracted to sibling modules.\n *   - start-bootstrap-stages.ts   — config/registry/storage bootstrap + resolveSsrEntry\n *   - start-manifest-loader.ts    — manifest.json or scan fallback\n *   - start-ssr-setup.ts          — SSR entry-server + HTML template split\n *   - start-handlers.ts           — branch handlers (action/route/static/404)\n *   - start-request-handler.ts    — request lifecycle wiring\n *   - start-websocket-handler.ts  — WS upgrade (opt-in)\n *   - start-graceful-shutdown.ts  — SIGTERM/SIGINT drain\n */\n\nimport { existsSync, readFileSync } from 'node:fs'\nimport { createServer } from 'node:http'\nimport { join, resolve } from 'node:path'\n\nimport { loadConfig } from '../../../config/load-config.js'\nimport { loadEnv } from '../../../config/load-env.js'\nimport { defineHealthRoute } from '../../../server/define/health-route.js'\nimport { createPluginRunnerFromConfig } from '../../../server/plugins/load-plugins.js'\nimport { createRateLimiter } from '../../../server/rate-limit/rate-limit.js'\nimport { createProductionLoader } from '../../../server/scan/module-loader.js'\nimport { resolveTransformer } from '../../../server/transformer.js'\nimport { preflightNodeAndBindings } from '../../preflight-node-version.js'\n\nimport {\n  configureAgentRegistryFromConfig,\n  configureStorageManagerFromConfig,\n} from './bootstrap-stages.js'\nimport { installGracefulShutdown } from './graceful-shutdown.js'\nimport type { RequestHandlerCtx } from './handlers.js'\nimport { loadRoutesAndActions } from './manifest-loader.js'\nimport { createRequestHandler } from './request-handler.js'\nimport { setupSsr } from './ssr-setup.js'\nimport { attachWebSocketHandler } from './websocket-handler.js'\n\n// Backwards-compat: external test fixtures may import resolveSsrEntry from here.\nexport { resolveSsrEntry } from './bootstrap-stages.js'\n\ninterface StartOptions {\n  port?: number\n}\n\nexport async function startCommand(options: StartOptions): Promise<void> {\n  const cwd = process.cwd()\n  // Preflight (FIRST — BEFORE anything that touches native bindings).\n  preflightNodeAndBindings(cwd)\n  loadEnv({ cwd, mode: 'production' })\n  const config = await loadConfig(cwd)\n\n  await configureAgentRegistryFromConfig(config.agents?.registry)\n  await configureStorageManagerFromConfig(config.storage)\n\n  const distDir = resolve(cwd, '.theokit')\n  const clientDir = resolve(distDir, 'client')\n  // #95 — honor config `serverDir` (default \"server\") in production start, matching dev.\n  const serverDir = resolve(cwd, config.serverDir)\n\n  if (!existsSync(clientDir)) {\n    throw new Error('No build found. Run `theo build` first.')\n  }\n\n  const indexHtml = readFileSync(join(clientDir, 'index.html'), 'utf-8')\n  const loadModule = createProductionLoader()\n  const port = options.port ?? config.port\n  const pluginRunner = await createPluginRunnerFromConfig(config.plugins)\n  const transformer = resolveTransformer(config.serialization)\n\n  const custom404Path = join(clientDir, '404.html')\n  const custom500Path = join(clientDir, '500.html')\n  const custom404Html = existsSync(custom404Path) ? readFileSync(custom404Path, 'utf-8') : null\n  const custom500Html = existsSync(custom500Path) ? readFileSync(custom500Path, 'utf-8') : null\n\n  const {\n    routes: cachedRoutes,\n    actions: cachedActions,\n    wsRoutes: cachedWsRoutes,\n    agents: cachedAgents,\n  } = loadRoutesAndActions(distDir, serverDir)\n\n  // Rate limiter (legacy flat form only — per-route variant is handled in\n  // api-middleware integration path, not this fallback).\n  const flatRateLimit =\n    config.rateLimit && 'windowMs' in config.rateLimit && 'max' in config.rateLimit\n      ? config.rateLimit\n      : undefined\n  const rateLimiter = flatRateLimit ? createRateLimiter(flatRateLimit) : null\n\n  const ssr = await setupSsr({\n    distDir,\n    indexHtml,\n    ssrConfigEnabled: config.ssr,\n    ssrStreamingConfig: config.ssrStreaming,\n  })\n\n  const server = createServer(\n    createRequestHandler({\n      buildCtx: (req, res, requestId, startTime): RequestHandlerCtx => ({\n        req,\n        res,\n        url: req.url ?? '/',\n        requestId,\n        startTime,\n        clientDir,\n        custom404Html,\n        cachedRoutes,\n        cachedActions,\n        cachedAgents,\n        loadModule,\n        serverDir,\n        pluginRunner,\n        transformer,\n        csrfMode: config.security?.csrf ?? 'strict',\n        disallowed: config.security?.disallowed,\n        rateLimiter,\n      }),\n      securityHeadersConfig: config.security?.headers ?? {},\n      ssrRender: ssr.render,\n      ssrRenderStreaming: ssr.renderStreaming,\n      ssrStreamingEnabled: ssr.streamingEnabled,\n      htmlHead: ssr.htmlHead,\n      htmlTail: ssr.htmlTail,\n      indexHtml,\n      custom500Html,\n      // M7-2: serve a built-in liveness route on the Node listener. Readiness\n      // probe wiring from theo.config.ts is a documented follow-up (see the M7\n      // implementation summary § Scope note).\n      reservedRoutes: { health: defineHealthRoute() },\n    }),\n  )\n\n  await attachWebSocketHandler(server, cachedWsRoutes, loadModule)\n\n  server.listen(port, () => {\n    console.log(`\\n  Theo production server`)\n    console.log(`  → http://localhost:${String(port)}\\n`)\n  })\n\n  installGracefulShutdown(server)\n}\n","/**\n * M7-2 — health/ready reserved routes for the convention/filesystem-route\n * server. Liveness (`/__theo/health`, always 200) and readiness\n * (`/__theo/ready`, 200/503 from a probe) are registered on a reserved\n * namespace BEFORE the user-route catch-all + 404 branch — mirroring nitro's\n * `/_nitro/*` reserved-namespace pattern (knowledge-base/references/nitro/src/\n * runtime/internal/routes/dev-tasks.ts). Liveness and readiness are kept\n * separate by design: liveness says \"the process is up\", readiness says\n * \"dependencies are up\".\n *\n * @public\n */\n\n/** Reserved path for the liveness endpoint. */\nexport const HEALTH_PATH = '/__theo/health'\n/** Reserved path for the readiness endpoint. */\nexport const READY_PATH = '/__theo/ready'\n\n/** Config produced by {@link defineHealthRoute}. */\nexport interface HealthRouteConfig {\n  readonly kind: 'health'\n  /** Returns the liveness body (auto-serialized to JSON). Default: `{ status: 'ok' }`. */\n  readonly handler: () => unknown\n}\n\n/** Config produced by {@link defineReadyRoute}. */\nexport interface ReadyRouteConfig {\n  readonly kind: 'ready'\n  /** Resolves `true` when dependencies are ready. A throw/reject is treated as not-ready (503). */\n  readonly probe: () => boolean | Promise<boolean>\n}\n\n/** The reserved-route registry consulted by {@link serveReservedRoute}. */\nexport interface ReservedRoutes {\n  readonly health?: HealthRouteConfig\n  readonly ready?: ReadyRouteConfig\n}\n\n/** A reserved-route response: an HTTP status + a JSON-serializable body. */\nexport interface ReservedResponse {\n  readonly status: number\n  readonly body: unknown\n}\n\n/**\n * Define the liveness route. The default handler returns `{ status: 'ok' }`.\n * Liveness is always 200 — it asserts the process is up, not that dependencies are.\n */\nexport function defineHealthRoute(\n  handler: () => unknown = () => ({ status: 'ok' }),\n): HealthRouteConfig {\n  return { kind: 'health', handler }\n}\n\n/**\n * Define the readiness route. The `probe` decides 200 (ready) vs 503 (not-ready).\n * A probe that throws/rejects is treated as not-ready (503) — never a 500 crash.\n */\nexport function defineReadyRoute(probe: () => boolean | Promise<boolean>): ReadyRouteConfig {\n  return { kind: 'ready', probe }\n}\n\n/**\n * Pure dispatcher: map a request pathname to a reserved-route response, or\n * `null` when the path is not reserved (so the user catch-all + 404 take over).\n * Liveness defaults to 200 `{status:'ok'}`; readiness without a probe is\n * trivially ready (200). Registered BEFORE the user catch-all by the caller.\n */\nexport async function serveReservedRoute(\n  pathname: string,\n  routes: ReservedRoutes = {},\n): Promise<ReservedResponse | null> {\n  if (pathname === HEALTH_PATH) {\n    const handler = routes.health?.handler ?? (() => ({ status: 'ok' }))\n    return { status: 200, body: handler() }\n  }\n  if (pathname === READY_PATH) {\n    const probe = routes.ready?.probe\n    if (probe === undefined) {\n      return { status: 200, body: { status: 'ready' } }\n    }\n    try {\n      const ready = await probe()\n      return ready\n        ? { status: 200, body: { status: 'ready' } }\n        : { status: 503, body: { status: 'not-ready' } }\n    } catch (err) {\n      // 503 (the dependency is not ready) but NEVER swallow the cause — a\n      // readiness probe failing silently is invisible to ops (project rule:\n      // \"NUNCA engula exceções\"). Log the cause, keep the 503 contract.\n      console.error('[theo] readiness probe threw — treating as not-ready', err)\n      return { status: 503, body: { status: 'not-ready' } }\n    }\n  }\n  return null\n}\n","/**\n * Bootstrap stages extracted from `start.ts` per T4.2 (architecture-cleanup, ADR-0017).\n *\n * The full goal of T4.2 is a ≤30-LOC `startCommand` spine + 6-8 stage files. This\n * file ships the first batch: the configure-from-config bootstrap helpers + the\n * SSR entry resolver. They are stand-alone, side-effect-free at module load, and\n * already individually testable.\n *\n * Remaining stages (request-handler extraction, graceful-shutdown extraction,\n * signal-handlers extraction) are deferred to a follow-up sprint — see plan\n * `docs/plans/architecture-cleanup-plan.md` T4.2 Deferred sub-tasks.\n */\n\nimport { existsSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport { warnOnce } from '../../../server/observability/logger.js'\n\ninterface SdkAgentRegistry {\n  configure?: (opts: { maxAgents?: number; idleTimeoutMs?: number }) => void\n}\ninterface SdkModule {\n  Agent?: { registry?: SdkAgentRegistry }\n}\n\n/**\n * Configure SDK's Agent.registry from `theo.config.ts > agents.registry`.\n * Lazy at boot; EC-3 sync flag flip prevents race under concurrent boot.\n * Silent no-op when registry config is absent or SDK is uninstalled.\n */\nexport async function configureAgentRegistryFromConfig(\n  registryConfig: { maxAgents: number; idleTimeoutMs: number } | undefined,\n): Promise<void> {\n  if (registryConfig === undefined) return\n  try {\n    const sdk = (await import('@theokit/sdk').catch(() => null)) as SdkModule | null\n    const sdkConfigure = sdk?.Agent?.registry?.configure\n    if (sdkConfigure === undefined) return\n    const { configureAgentRegistryOnce } =\n      await import('../../../server/agent/configure-agent-registry.js')\n    configureAgentRegistryOnce(\n      {\n        configure: (opts) => {\n          sdkConfigure(opts)\n        },\n      },\n      registryConfig,\n    )\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err)\n    warnOnce('bootstrap.agent_registry_skip', {\n      event: 'bootstrap.agent_registry_skip',\n      message: msg,\n    })\n  }\n}\n\n/**\n * Configure the StorageManager from `theo.config.ts > storage` (ADR-0007).\n * Manager enforces configure-once internally (D3); this helper bridges the\n * config to the singleton with actionable error handling.\n */\nexport async function configureStorageManagerFromConfig(storageConfig: unknown): Promise<void> {\n  if (storageConfig === undefined || storageConfig === null) return\n  try {\n    const { getStorageManager } = await import('../../../server/storage/storage-manager.js')\n    const { storageSchema } = await import('../../../config/schema.js')\n    // Re-validate at boot so a malformed config from a non-Zod source\n    // (test fixtures, dynamic configs) surfaces a clear error early.\n    const parsed = storageSchema.parse(storageConfig)\n    getStorageManager().configure(parsed)\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err)\n    warnOnce('bootstrap.storage_skip', {\n      event: 'bootstrap.storage_skip',\n      message: msg,\n    })\n  }\n}\n\nconst SSR_EXTENSIONS = ['.mjs', '.js'] as const\n\n/**\n * Resolve the SSR entry-server module path. tsup may emit `.mjs` or `.js`\n * depending on output format. Try `.mjs` first (modern default) then fall\n * back to `.js`. Returns null when neither exists — SSR stays disabled.\n *\n * Exported so unit tests can pin the resolution order without booting the\n * full CLI.\n */\nexport function resolveSsrEntry(distDir: string): string | null {\n  for (const ext of SSR_EXTENSIONS) {\n    const path = resolve(distDir, `server/entry-server${ext}`)\n    // eslint-disable-next-line security/detect-non-literal-fs-filename -- distDir is from `theokit start`'s own caller-controlled config; the suffix is from a const literal array\n    if (existsSync(path)) return path\n  }\n  return null\n}\n","/**\n * Graceful shutdown stage for `theokit start` (T4.2 architecture-cleanup,\n * ADR-0007 D6 — SIGTERM evicts agents + drains StorageManager).\n *\n * EC-13: SIGTERM evicts agents IMMEDIATELY (no per-request drain). In-flight\n * requests get aborted mid-stream — acceptable because the platform LB\n * removed this pod from rotation BEFORE sending SIGTERM (K8s preStop hook +\n * terminationGracePeriodSeconds; same on Vercel/CF/Render).\n *\n * Re-entry guard: multiple SIGTERMs in quick succession run shutdown ONCE.\n */\n\nimport type { Server as HttpServer } from 'node:http'\n\nimport { warnOnce } from '../../../server/observability/logger.js'\n\nexport function installGracefulShutdown(server: HttpServer): void {\n  let shuttingDown = false\n  const shutdown = (signal: NodeJS.Signals): void => {\n    if (shuttingDown) return\n    shuttingDown = true\n    console.log(`\\n  [theokit] ${signal} received — evicting agents`)\n    void (async () => {\n      // Lazy-import SDK only at shutdown time to avoid forcing the dep on\n      // apps that don't use agents at all.\n      try {\n        const sdk = (await import('@theokit/sdk').catch(() => null)) as {\n          Agent?: { registry?: { evictAll?: () => Promise<void> } }\n        } | null\n        if (sdk?.Agent?.registry?.evictAll !== undefined) {\n          await sdk.Agent.registry.evictAll()\n        }\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err)\n        warnOnce('shutdown.evict_error', {\n          event: 'shutdown.evict_error',\n          message: msg,\n        })\n      }\n      // T3.1 — drain the StorageManager AFTER agent eviction. Order matters:\n      // agents may still hold open pool refs while evicting; closing pools\n      // first would break in-flight queries.\n      try {\n        const { getStorageManager } = await import('../../../server/storage/storage-manager.js')\n        const manager = getStorageManager()\n        await manager.dispose()\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err)\n        warnOnce('shutdown.dispose_error', {\n          event: 'shutdown.dispose_error',\n          message: msg,\n        })\n      }\n      console.log(`  [theokit] shutdown complete`)\n      server.close(() => {\n        process.exit(0)\n      })\n      setTimeout(() => {\n        warnOnce('shutdown.forced_exit', {\n          event: 'shutdown.forced_exit',\n          message: 'forced exit after 25s timeout',\n        })\n        process.exit(0)\n      }, 25_000).unref()\n    })()\n  }\n  process.on('SIGTERM', () => {\n    shutdown('SIGTERM')\n  })\n  process.on('SIGINT', () => {\n    shutdown('SIGINT')\n  })\n}\n","/**\n * Manifest loading stage for `theokit start` (T4.2 architecture-cleanup).\n *\n * Loads pre-built manifest from `.theokit/manifest.json` if present; otherwise\n * scans server/ for routes/actions/ws at startup with a structured warn.\n */\n\nimport { existsSync } from 'node:fs'\nimport { join } from 'node:path'\nimport { dirname } from 'node:path'\n\nimport { warnOnce } from '../../../server/observability/logger.js'\nimport type { ActionNode } from '../../../server/scan/action-scan.js'\nimport { scanServerActions } from '../../../server/scan/action-scan.js'\nimport type { AgentNode } from '../../../server/scan/agent-scan.js'\nimport { scanAgents } from '../../../server/scan/agent-scan.js'\nimport { loadManifest } from '../../../server/scan/manifest.js'\nimport type { ServerRouteNode } from '../../../server/scan/match.js'\nimport { scanServerRoutes } from '../../../server/scan/scan.js'\nimport type { WebSocketRouteNode } from '../../../server/scan/ws-scan.js'\nimport { scanWebSocketRoutes } from '../../../server/scan/ws-scan.js'\n\nexport interface LoadedRoutes {\n  routes: ServerRouteNode[]\n  actions: ActionNode[]\n  wsRoutes: WebSocketRouteNode[]\n  agents: AgentNode[]\n}\n\nexport function loadRoutesAndActions(distDir: string, serverDir: string): LoadedRoutes {\n  const manifestPath = join(distDir, 'manifest.json')\n\n  if (existsSync(manifestPath)) {\n    const manifest = loadManifest(distDir, serverDir)\n    return {\n      routes: manifest.routes,\n      actions: manifest.actions,\n      wsRoutes: manifest.websockets,\n      agents: manifest.agents,\n    }\n  }\n  warnOnce('bootstrap.manifest_not_found', {\n    event: 'bootstrap.manifest_not_found',\n    message:\n      'No manifest found, scanning routes at startup. Run \"theo build\" to generate manifest.',\n    serverDir,\n  })\n  return {\n    routes: scanServerRoutes(serverDir),\n    actions: scanServerActions(serverDir),\n    wsRoutes: scanWebSocketRoutes(serverDir),\n    // Agents live at <projectRoot>/agents, a sibling of serverDir (LOCKED naming).\n    agents: scanAgents(dirname(serverDir)),\n  }\n}\n","/**\n * Inline request handler for `theokit start` (T4.2 architecture-cleanup).\n *\n * Wires the per-request flow: security headers → action/route/static branches\n * → SSR fallback → CSR fallback → 500 page.\n *\n * Refactored: CC reduced from 33 to ≤10 per function\n * (architecture-remediation T2.1, 2026-06-12).\n */\n\nimport { randomUUID } from 'node:crypto'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\n\nimport { generateNonce } from '../../../server/auth/nonce.js'\nimport { type ReservedRoutes, serveReservedRoute } from '../../../server/define/health-route.js'\nimport { sendError } from '../../../server/http/send-response.js'\nimport { buildSecurityHeaders } from '../../../server/security/security-headers.js'\n\nimport {\n  tryServeAction,\n  tryServeAgent,\n  tryServeAgentAux,\n  tryServeApiRoute,\n  tryServeCustom404,\n  tryServeStatic,\n  type RequestHandlerCtx,\n} from './handlers.js'\nimport {\n  isSsrRenderResult,\n  type SsrRender,\n  type SsrRenderResult,\n  type SsrRenderStreaming,\n} from './ssr-setup.js'\n\nexport interface RequestHandlerContext {\n  buildCtx: (\n    req: IncomingMessage,\n    res: ServerResponse,\n    requestId: string,\n    startTime: number,\n  ) => RequestHandlerCtx\n  securityHeadersConfig: Parameters<typeof buildSecurityHeaders>[0]\n  ssrRender: SsrRender | null\n  ssrRenderStreaming: SsrRenderStreaming | null\n  ssrStreamingEnabled: boolean\n  htmlHead: string\n  htmlTail: string\n  indexHtml: string\n  custom500Html: string | null\n  /** M7-2: reserved health/ready routes served before the user catch-all. */\n  reservedRoutes?: ReservedRoutes\n}\n\n/**\n * M7-2: serve a reserved `/__theo/*` route (health/ready) before any user\n * branch. Returns true when the request was handled.\n */\nasync function tryServeReserved(\n  ctx: RequestHandlerContext,\n  url: string,\n  res: ServerResponse,\n): Promise<boolean> {\n  const pathname = new URL(url, 'http://localhost').pathname\n  const reserved = await serveReservedRoute(pathname, ctx.reservedRoutes ?? {})\n  if (reserved === null) return false\n  const payload = JSON.stringify(reserved.body)\n  res.writeHead(reserved.status, {\n    'Content-Type': 'application/json',\n    'Content-Length': Buffer.byteLength(payload),\n  })\n  res.end(payload)\n  return true\n}\n\nfunction asSsrRenderResult(value: SsrRenderResult): SsrRenderResult {\n  return value\n}\n\nfunction isRedirectResult(result: unknown): result is { redirect: Response } {\n  return result !== null && typeof result === 'object' && 'redirect' in result\n}\n\nfunction sendRedirect(res: ServerResponse, result: { redirect: Response }): void {\n  res.writeHead(302, { Location: result.redirect.headers.get('location') ?? '/' })\n  res.end()\n}\n\nfunction send500(res: ServerResponse, custom500Html: string | null): void {\n  if (!res.headersSent) {\n    res.writeHead(500, { 'Content-Type': 'text/html' })\n  }\n  if (!res.writableEnded) {\n    res.end(custom500Html ?? '<h1>500 — Server Error</h1>')\n  }\n}\n\nfunction buildSsrHtml(\n  ctx: RequestHandlerContext,\n  result: string | SsrRenderResult,\n  nonce: string,\n): string {\n  if (typeof result === 'string') {\n    return ctx.htmlHead + result + ctx.htmlTail\n  }\n  if (isSsrRenderResult(result)) {\n    const rendered = asSsrRenderResult(result)\n    const dataJson = JSON.stringify(rendered.hydrationData).replace(/</g, '\\\\u003c')\n    const hydrationScript = `<script${\n      nonce ? ` nonce=\"${nonce}\"` : ''\n    }>window.__staticRouterHydrationData=${dataJson}</script>`\n    return ctx.htmlHead + rendered.html + hydrationScript + ctx.htmlTail\n  }\n  return ctx.htmlHead + ctx.htmlTail\n}\n\nasync function handleSsrStreaming(\n  ctx: RequestHandlerContext,\n  req: IncomingMessage,\n  res: ServerResponse,\n  url: string,\n  nonce: string,\n): Promise<boolean> {\n  if (!ctx.ssrStreamingEnabled || !ctx.ssrRenderStreaming) return false\n\n  const controller = new AbortController()\n  const onClose = (): void => {\n    controller.abort()\n  }\n  req.on('close', onClose)\n  try {\n    const result = await ctx.ssrRenderStreaming(url, res, {\n      signal: controller.signal,\n      nonce,\n    })\n    if (isRedirectResult(result)) sendRedirect(res, result)\n    return true\n  } catch (streamErr) {\n    console.error('[SSR Stream Error]', (streamErr as Error).message)\n    send500(res, ctx.custom500Html)\n    return true\n  } finally {\n    req.removeListener('close', onClose)\n  }\n}\n\nasync function handleSsrSync(\n  ctx: RequestHandlerContext,\n  res: ServerResponse,\n  url: string,\n  nonce: string,\n): Promise<boolean> {\n  if (!ctx.ssrRender) return false\n\n  try {\n    const result = await ctx.ssrRender(url, { nonce })\n    if (isRedirectResult(result)) {\n      sendRedirect(res, result)\n      return true\n    }\n    res.writeHead(200, { 'Content-Type': 'text/html' })\n    res.end(buildSsrHtml(ctx, result, nonce))\n    return true\n  } catch (ssrErr) {\n    console.error('[SSR Error] Falling back to CSR:', (ssrErr as Error).message)\n    return false\n  }\n}\n\nfunction handleFatalError(ctx: RequestHandlerContext, res: ServerResponse, err: unknown): void {\n  if (ctx.custom500Html && !res.headersSent) {\n    res.writeHead(500, { 'Content-Type': 'text/html' })\n    res.end(ctx.custom500Html)\n  } else if (!res.headersSent) {\n    sendError(res, 'INTERNAL_ERROR', (err as Error).message, 500)\n  } else {\n    res.end()\n  }\n}\n\nexport function createRequestHandler(\n  ctx: RequestHandlerContext,\n): (req: IncomingMessage, res: ServerResponse) => void {\n  return (req: IncomingMessage, res: ServerResponse) => {\n    void (async () => {\n      const url = req.url ?? '/'\n      const requestId = randomUUID()\n      const start = Date.now()\n\n      const nonce = generateNonce()\n      const securityHeaders = buildSecurityHeaders(\n        ctx.securityHeadersConfig,\n        { production: true },\n        { nonce },\n      )\n      for (const [k, v] of Object.entries(securityHeaders)) {\n        res.setHeader(k, v)\n      }\n\n      const handlerCtx = ctx.buildCtx(req, res, requestId, start)\n\n      try {\n        if (await tryServeReserved(ctx, url, res)) return\n        if (await tryServeAction(handlerCtx)) return\n        if (await tryServeAgentAux(handlerCtx)) return\n        if (await tryServeAgent(handlerCtx)) return\n        if (await tryServeApiRoute(handlerCtx)) return\n        if (tryServeStatic(handlerCtx)) return\n        if (tryServeCustom404(handlerCtx)) return\n\n        if (await handleSsrStreaming(ctx, req, res, url, nonce)) return\n        if (await handleSsrSync(ctx, res, url, nonce)) return\n\n        // CSR fallback\n        res.writeHead(200, { 'Content-Type': 'text/html' })\n        res.end(ctx.indexHtml)\n      } catch (err) {\n        handleFatalError(ctx, res, err)\n      }\n    })()\n  }\n}\n","import type { IncomingMessage, ServerResponse } from 'node:http'\nimport { extname } from 'node:path'\n\nimport { getApprovalRegistry } from '../../../server/agent/approval-registry.js'\nimport { handleAgentApproval, isApprovalPath } from '../../../server/agent/approve-agent.js'\nimport { mountAgent } from '../../../server/agent/mount-agent.js'\nimport { resolveProvider } from '../../../server/agent/provider-resolver.js'\nimport { serveAgentAuxRoute } from '../../../server/agent/serve-aux-routes.js'\nimport { executeAction } from '../../../server/http/action-execute.js'\nimport { executeRoute } from '../../../server/http/execute.js'\nimport {\n  incomingMessageToWebRequest,\n  writeWebResponseToServerResponse,\n} from '../../../server/http/node-web-adapter.js'\nimport { sendError } from '../../../server/http/send-response.js'\nimport { serveStaticFile } from '../../../server/http/static.js'\nimport { logRequest } from '../../../server/observability/logger.js'\nimport { findSuggestion } from '../../../server/observability/suggest.js'\nimport type { PluginRunner } from '../../../server/plugins/plugin-runner.js'\nimport type { ActionNode } from '../../../server/scan/action-scan.js'\nimport type { AgentNode } from '../../../server/scan/agent-scan.js'\nimport { matchRoute } from '../../../server/scan/match.js'\nimport type { ServerRouteNode } from '../../../server/scan/match.js'\nimport type { LoadModule } from '../../../server/scan/module-loader.js'\nimport type { CsrfMode, DisallowedConfig } from '../../../server/security/csrf.js'\nimport type { TheoTransformer } from '../../../server/transformer.js'\n\n/** Response header carrying the per-request correlation id. */\nconst X_REQUEST_ID = 'x-request-id'\n\n/**\n * T6.1 (PV-7 SRP): start.ts request orchestrator decomposed into 5 focused\n * per-branch handlers. Each handler returns `true` if it handled the\n * request (response sent) so the orchestrator can stop iterating.\n *\n * The original 455-LOC monolith closed over 14+ locals; the shared shape\n * `RequestHandlerCtx` makes the dependencies explicit + reviewable.\n */\nexport interface RequestHandlerCtx {\n  req: IncomingMessage\n  res: ServerResponse\n  url: string\n  requestId: string\n  startTime: number\n  // Pre-loaded build artifacts\n  clientDir: string\n  custom404Html: string | null\n  // Manifest-resolved tables\n  cachedRoutes: ServerRouteNode[]\n  cachedActions: ActionNode[]\n  cachedAgents: AgentNode[]\n  // Runtime infra\n  loadModule: LoadModule\n  serverDir: string\n  pluginRunner: PluginRunner | undefined\n  transformer: TheoTransformer | undefined\n  csrfMode: CsrfMode\n  disallowed: DisallowedConfig | undefined\n  rateLimiter:\n    | ((req: IncomingMessage) => { limited: boolean; headers: Record<string, string> })\n    | null\n}\n\n/** Apply rate limit; return true if request was limited (response sent). */\nfunction applyRateLimit(c: RequestHandlerCtx, method: string): boolean {\n  if (!c.rateLimiter) return false\n  const check = c.rateLimiter(c.req)\n  for (const [k, v] of Object.entries(check.headers)) c.res.setHeader(k, v)\n  if (check.limited) {\n    sendError(c.res, 'RATE_LIMITED', 'Too many requests', 429, undefined, c.requestId)\n    logRequest({\n      method,\n      url: c.url,\n      status: 429,\n      duration: Date.now() - c.startTime,\n      requestId: c.requestId,\n    })\n    return true\n  }\n  return false\n}\n\n/** Branch 1: action routes (`/api/__actions/{file}/{exportName}`). */\nexport async function tryServeAction(c: RequestHandlerCtx): Promise<boolean> {\n  if (!c.url.startsWith('/api/__actions/')) return false\n  c.res.setHeader(X_REQUEST_ID, c.requestId)\n\n  if (applyRateLimit(c, c.req.method ?? 'POST')) return true\n\n  const pathAfterPrefix = c.url.slice('/api/__actions/'.length).split('?')[0]\n  const segments = pathAfterPrefix.split('/').filter(Boolean)\n  if (segments.length < 2) {\n    sendError(\n      c.res,\n      'BAD_REQUEST',\n      'Action URL must be /api/__actions/{file}/{exportName}',\n      400,\n      undefined,\n      c.requestId,\n    )\n    logRequest({\n      method: c.req.method ?? 'POST',\n      url: c.url,\n      status: 400,\n      duration: Date.now() - c.startTime,\n      requestId: c.requestId,\n    })\n    return true\n  }\n  const exportName = segments[segments.length - 1]\n  const actionPath = segments.slice(0, -1).join('/')\n  const action = c.cachedActions.find((a) => a.actionPath === actionPath)\n  if (!action) {\n    const actionPaths = c.cachedActions.map((a) => a.actionPath)\n    const suggestion = findSuggestion(actionPath, actionPaths)\n    const msg = suggestion\n      ? `Action \"${actionPath}\" not found. Did you mean: ${suggestion}?`\n      : `Action \"${actionPath}\" not found`\n    sendError(c.res, 'NOT_FOUND', msg, 404, undefined, c.requestId)\n    logRequest({\n      method: c.req.method ?? 'POST',\n      url: c.url,\n      status: 404,\n      duration: Date.now() - c.startTime,\n      requestId: c.requestId,\n    })\n    return true\n  }\n  await executeAction(\n    action.filePath,\n    exportName,\n    c.req,\n    c.res,\n    c.loadModule,\n    c.serverDir,\n    c.requestId,\n    c.pluginRunner,\n    c.csrfMode,\n    c.disallowed,\n  )\n  logRequest({\n    method: c.req.method ?? 'POST',\n    url: c.url,\n    status: c.res.statusCode,\n    duration: Date.now() - c.startTime,\n    requestId: c.requestId,\n  })\n  return true\n}\n\n/**\n * Branch 1.4: agent AUXILIARY routes served identically in dev + prod (M15/M16 follow-up) —\n * agent cards (`/.well-known/<name>/agent-card.json`), MCP (`/api/agents/<name>/mcp`), and the\n * pending-approvals listing (`/api/agents/<name>/approvals`). Before this, they were dev-only, so a\n * built/deployed app 404'd them. Delegates to the shared `serveAgentAuxRoute` dispatcher (DRY).\n */\nexport async function tryServeAgentAux(c: RequestHandlerCtx): Promise<boolean> {\n  const urlPath = c.url.split('?')[0]\n  const baseUrl = `http://${c.req.headers.host ?? 'localhost'}`\n  const request = incomingMessageToWebRequest(c.req)\n  const response = await serveAgentAuxRoute(request, urlPath, {\n    agents: c.cachedAgents,\n    loadModule: c.loadModule,\n    baseUrl,\n  })\n  if (response === null) return false\n  c.res.setHeader(X_REQUEST_ID, c.requestId)\n  await writeWebResponseToServerResponse(response, c.res)\n  logRequest({\n    method: (c.req.method ?? 'GET').toUpperCase(),\n    url: c.url,\n    status: c.res.statusCode,\n    duration: Date.now() - c.startTime,\n    requestId: c.requestId,\n  })\n  return true\n}\n\n/**\n * Branch 1.5: agent convention routes (`/api/agents/<name>`, M2). Runs BEFORE the generic `/api/*`\n * branch so a scanned `agents/<name>.ts` owns its path (parity with dev). Loads the module, resolves\n * the provider apiKey (fail-fast), and streams the M0/M1 UIMessageStream via `mountAgent`.\n */\nexport async function tryServeAgent(c: RequestHandlerCtx): Promise<boolean> {\n  if (!c.url.startsWith('/api/agents/')) return false\n  const urlPath = c.url.split('?')[0]\n\n  // HITL approve route (`/api/agents/<name>/approve/<id>`, M4) — resolve the pending approval.\n  // Handled BEFORE the agent-path exact match (the approve path never equals an `agentPath`).\n  if (isApprovalPath(urlPath)) {\n    c.res.setHeader(X_REQUEST_ID, c.requestId)\n    if (applyRateLimit(c, c.req.method ?? 'POST')) return true\n    const method = (c.req.method ?? 'POST').toUpperCase()\n    if (method !== 'POST') {\n      sendError(\n        c.res,\n        'METHOD_NOT_ALLOWED',\n        'Approve endpoints accept POST',\n        405,\n        undefined,\n        c.requestId,\n      )\n      logRequest({\n        method,\n        url: c.url,\n        status: 405,\n        duration: Date.now() - c.startTime,\n        requestId: c.requestId,\n      })\n      return true\n    }\n    try {\n      const request = incomingMessageToWebRequest(c.req)\n      const response = await handleAgentApproval(\n        request,\n        urlPath,\n        getApprovalRegistry(),\n        c.csrfMode,\n      )\n      await writeWebResponseToServerResponse(response, c.res)\n    } catch (err) {\n      sendError(\n        c.res,\n        'INTERNAL',\n        err instanceof Error ? err.message : 'Approve handler failed',\n        500,\n        undefined,\n        c.requestId,\n      )\n    }\n    logRequest({\n      method,\n      url: c.url,\n      status: c.res.statusCode,\n      duration: Date.now() - c.startTime,\n      requestId: c.requestId,\n    })\n    return true\n  }\n\n  const agent = c.cachedAgents.find((a) => a.agentPath === urlPath)\n  if (!agent) return false // fall through to the generic /api/* branch (may 404 there)\n\n  c.res.setHeader(X_REQUEST_ID, c.requestId)\n  if (applyRateLimit(c, c.req.method ?? 'POST')) return true\n\n  const method = (c.req.method ?? 'POST').toUpperCase()\n  if (method !== 'POST') {\n    sendError(\n      c.res,\n      'METHOD_NOT_ALLOWED',\n      'Agent endpoints accept POST',\n      405,\n      undefined,\n      c.requestId,\n    )\n    logRequest({\n      method,\n      url: c.url,\n      status: 405,\n      duration: Date.now() - c.startTime,\n      requestId: c.requestId,\n    })\n    return true\n  }\n\n  try {\n    const mod = await c.loadModule(agent.filePath)\n    const apiKey = resolveProvider().apiKey\n    const request = incomingMessageToWebRequest(c.req)\n    const response = await mountAgent(mod, request, apiKey, agent.filePath, c.csrfMode)\n    await writeWebResponseToServerResponse(response, c.res)\n  } catch (err) {\n    sendError(\n      c.res,\n      'INTERNAL',\n      err instanceof Error ? err.message : 'Agent handler failed',\n      500,\n      undefined,\n      c.requestId,\n    )\n  }\n  logRequest({\n    method,\n    url: c.url,\n    status: c.res.statusCode,\n    duration: Date.now() - c.startTime,\n    requestId: c.requestId,\n  })\n  return true\n}\n\n/** Branch 2: API routes (`/api/*` excluding actions). */\nexport async function tryServeApiRoute(c: RequestHandlerCtx): Promise<boolean> {\n  if (!c.url.startsWith('/api/')) return false\n  c.res.setHeader(X_REQUEST_ID, c.requestId)\n\n  if (applyRateLimit(c, c.req.method ?? 'GET')) return true\n\n  const match = matchRoute(c.url, c.cachedRoutes)\n  if (!match) {\n    const urlPath = c.url.split('?')[0]\n    const routePaths = c.cachedRoutes.map((r) => r.routePath)\n    const suggestion = findSuggestion(urlPath, routePaths)\n    const msg = suggestion\n      ? `API route not found: ${urlPath}. Did you mean: ${suggestion}?`\n      : 'API route not found'\n    sendError(c.res, 'NOT_FOUND', msg, 404, undefined, c.requestId)\n    logRequest({\n      method: c.req.method ?? 'GET',\n      url: c.url,\n      status: 404,\n      duration: Date.now() - c.startTime,\n      requestId: c.requestId,\n    })\n    return true\n  }\n  const method = (c.req.method ?? 'GET').toUpperCase()\n  // T3.1 (ADR-0016) — context object replaces 12 positional args\n  await executeRoute({\n    route: match.route,\n    method,\n    params: match.params,\n    req: c.req,\n    res: c.res,\n    loadModule: c.loadModule,\n    serverDir: c.serverDir,\n    requestId: c.requestId,\n    pluginRunner: c.pluginRunner,\n    transformer: c.transformer,\n    csrfMode: c.csrfMode,\n    disallowed: c.disallowed,\n  })\n  logRequest({\n    method,\n    url: c.url,\n    status: c.res.statusCode,\n    duration: Date.now() - c.startTime,\n    requestId: c.requestId,\n  })\n  return true\n}\n\n/** Branch 3: static files (returns true if a static asset was served). */\nexport function tryServeStatic(c: RequestHandlerCtx): boolean {\n  return serveStaticFile(c.req, c.res, c.clientDir)\n}\n\n/** Branch 4: custom 404 for URLs that look like missing assets. */\nexport function tryServeCustom404(c: RequestHandlerCtx): boolean {\n  const urlPath = c.url.split('?')[0]\n  if (c.custom404Html && extname(urlPath)) {\n    c.res.writeHead(404, { 'Content-Type': 'text/html' })\n    c.res.end(c.custom404Html)\n    return true\n  }\n  return false\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Static-file server. The URL path IS user-controlled, BUT before any fs\n * call we resolve to absolute and reject with 403 if the resolved path\n * escapes `clientDir` (see EC-1 guard at line below). The guard is\n * authoritative; the rule cannot see it.\n */\nimport { existsSync, readFileSync, statSync } from 'node:fs'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport { resolve, extname } from 'node:path'\n\nconst MIME_TYPES: Record<string, string> = {\n  '.html': 'text/html',\n  '.js': 'application/javascript',\n  '.mjs': 'application/javascript',\n  '.css': 'text/css',\n  '.json': 'application/json',\n  '.png': 'image/png',\n  '.jpg': 'image/jpeg',\n  '.jpeg': 'image/jpeg',\n  '.gif': 'image/gif',\n  '.svg': 'image/svg+xml',\n  '.ico': 'image/x-icon',\n  '.woff': 'font/woff',\n  '.woff2': 'font/woff2',\n  '.ttf': 'font/ttf',\n  '.txt': 'text/plain',\n  '.map': 'application/json',\n}\n\nexport function serveStaticFile(\n  req: IncomingMessage,\n  res: ServerResponse,\n  clientDir: string,\n): boolean {\n  const urlPath = (req.url ?? '/').split('?')[0]\n\n  // Path traversal prevention (EC-1)\n  const filePath = resolve(clientDir, '.' + urlPath)\n  if (!filePath.startsWith(clientDir)) {\n    res.writeHead(403)\n    res.end('Forbidden')\n    return true\n  }\n\n  if (!existsSync(filePath)) return false\n\n  const stat = statSync(filePath)\n  if (!stat.isFile()) return false\n\n  const ext = extname(filePath)\n  const contentType = MIME_TYPES[ext] ?? 'application/octet-stream'\n  const content = readFileSync(filePath)\n\n  res.writeHead(200, {\n    'Content-Type': contentType,\n    'Content-Length': content.length,\n  })\n  res.end(content)\n  return true\n}\n","/**\n * SSR setup stage for `theokit start` (T4.2 architecture-cleanup).\n *\n * Loads the SSR entry-server module if configured + builds template split\n * around the React root div. Returns null renderers when SSR is disabled.\n */\n\nimport type { ServerResponse } from 'node:http'\n\nimport { resolveSsrEntry } from './bootstrap-stages.js'\n\nexport interface SsrRenderResult {\n  html: string\n  hydrationData: {\n    loaderData?: unknown\n    actionData?: unknown\n    errors?: unknown\n  }\n}\n\nexport type RenderStreamingResult = { redirect: Response } | { streaming: true } | undefined\n\nexport type SsrRender = (\n  url: string,\n  options?: { nonce?: string },\n) => Promise<SsrRenderResult | { redirect: Response } | string>\n\nexport type SsrRenderStreaming = (\n  url: string,\n  response: ServerResponse,\n  options?: { signal?: AbortSignal; nonce?: string },\n) => Promise<RenderStreamingResult>\n\nexport interface SsrSetupResult {\n  enabled: boolean\n  streamingEnabled: boolean\n  render: SsrRender | null\n  renderStreaming: SsrRenderStreaming | null\n  htmlHead: string\n  htmlTail: string\n}\n\nexport function isSsrRenderResult(value: unknown): value is SsrRenderResult {\n  if (typeof value !== 'object' || value === null) return false\n  if (!('html' in value)) return false\n  const html = (value as Record<string, unknown>).html\n  if (typeof html !== 'string') return false\n  return true\n}\n\ninterface SsrEntryServer {\n  render: SsrRender\n  renderStreaming?: SsrRenderStreaming\n}\n\nexport async function setupSsr(opts: {\n  distDir: string\n  indexHtml: string\n  ssrConfigEnabled: boolean\n  ssrStreamingConfig: boolean | undefined\n}): Promise<SsrSetupResult> {\n  const ssrServerPath: string | null = opts.ssrConfigEnabled ? resolveSsrEntry(opts.distDir) : null\n  const enabled = ssrServerPath !== null\n  const streamingEnabled = enabled && Boolean(opts.ssrStreamingConfig)\n\n  if (ssrServerPath === null) {\n    return {\n      enabled: false,\n      streamingEnabled: false,\n      render: null,\n      renderStreaming: null,\n      htmlHead: '',\n      htmlTail: '',\n    }\n  }\n\n  const mod = (await import(ssrServerPath)) as SsrEntryServer\n  const render = mod.render\n  const renderStreaming = typeof mod.renderStreaming === 'function' ? mod.renderStreaming : null\n\n  // Split HTML template on root div\n  let htmlHead = ''\n  let htmlTail = ''\n  const rootDivMatch = /<div id=[\"']root[\"'][^>]*>/.exec(opts.indexHtml)\n  if (rootDivMatch) {\n    const splitIdx = opts.indexHtml.indexOf(rootDivMatch[0]) + rootDivMatch[0].length\n    htmlHead = opts.indexHtml.slice(0, splitIdx)\n    htmlTail = opts.indexHtml.slice(splitIdx)\n  }\n\n  return { enabled, streamingEnabled, render, renderStreaming, htmlHead, htmlTail }\n}\n","/**\n * WebSocket upgrade handler for `theokit start` (T4.2 architecture-cleanup).\n *\n * Wires `server.on('upgrade')` for declared WS routes. Opt-in: only attached\n * when `wsRoutes.length > 0`. Lazy-imports `ws` package — throws an actionable\n * error when wsRoutes declared but `ws` not installed.\n */\n\nimport type { Server as HttpServer } from 'node:http'\n\nimport type * as WsLib from 'ws'\n\nimport type { WebSocketHandler } from '../../../server/define/define-websocket.js'\nimport type { LoadModule } from '../../../server/scan/module-loader.js'\nimport type { WebSocketRouteNode } from '../../../server/scan/ws-scan.js'\n\nexport async function attachWebSocketHandler(\n  server: HttpServer,\n  wsRoutes: WebSocketRouteNode[],\n  loadModule: LoadModule,\n): Promise<void> {\n  if (wsRoutes.length === 0) return\n\n  let WebSocketServerCtor: typeof WsLib.WebSocketServer\n  try {\n    const wsModule = await import('ws')\n    WebSocketServerCtor = wsModule.WebSocketServer\n  } catch {\n    throw new Error('WebSocket routes found but \"ws\" package is not installed. Run: npm install ws')\n  }\n\n  const wss = new WebSocketServerCtor({ noServer: true })\n\n  server.on('upgrade', (request, socket, head) => {\n    void (async () => {\n      const url = request.url ?? '/'\n      if (!url.startsWith('/ws/')) {\n        socket.destroy()\n        return\n      }\n\n      const wsPath = url.split('?')[0]\n      const match = wsRoutes.find((r) => r.wsPath === wsPath)\n      if (!match) {\n        socket.destroy()\n        return\n      }\n\n      try {\n        const mod = await loadModule(match.filePath)\n        const handler = ((mod as { default?: unknown }).default ?? mod) as WebSocketHandler\n\n        wss.handleUpgrade(request, socket, head, (ws) => {\n          handler.onOpen?.(ws, request)\n          ws.on('message', (data: Buffer) => {\n            handler.onMessage?.(ws, data.toString())\n          })\n          ws.on('close', (code: number, reason: Buffer) => {\n            handler.onClose?.(ws, code, reason)\n          })\n          ws.on('error', (err: Error) => {\n            handler.onError?.(ws, err)\n          })\n        })\n      } catch {\n        socket.destroy()\n      }\n    })()\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaA,SAAS,cAAAA,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,oBAAoB;AAC7B,SAAS,QAAAC,OAAM,WAAAC,gBAAe;;;ACDvB,IAAM,cAAc;AAEpB,IAAM,aAAa;AAgCnB,SAAS,kBACd,UAAyB,OAAO,EAAE,QAAQ,KAAK,IAC5B;AACnB,SAAO,EAAE,MAAM,UAAU,QAAQ;AACnC;AAgBA,eAAsB,mBACpB,UACA,SAAyB,CAAC,GACQ;AAClC,MAAI,aAAa,aAAa;AAC5B,UAAM,UAAU,OAAO,QAAQ,YAAY,OAAO,EAAE,QAAQ,KAAK;AACjE,WAAO,EAAE,QAAQ,KAAK,MAAM,QAAQ,EAAE;AAAA,EACxC;AACA,MAAI,aAAa,YAAY;AAC3B,UAAM,QAAQ,OAAO,OAAO;AAC5B,QAAI,UAAU,QAAW;AACvB,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAAA,IAClD;AACA,QAAI;AACF,YAAM,QAAQ,MAAM,MAAM;AAC1B,aAAO,QACH,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,QAAQ,EAAE,IACzC,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,YAAY,EAAE;AAAA,IACnD,SAAS,KAAK;AAIZ,cAAQ,MAAM,6DAAwD,GAAG;AACzE,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,YAAY,EAAE;AAAA,IACtD;AAAA,EACF;AACA,SAAO;AACT;;;AClFA,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AAgBxB,eAAsB,iCACpB,gBACe;AACf,MAAI,mBAAmB,OAAW;AAClC,MAAI;AACF,UAAM,MAAO,MAAM,OAAO,cAAc,EAAE,MAAM,MAAM,IAAI;AAC1D,UAAM,eAAe,KAAK,OAAO,UAAU;AAC3C,QAAI,iBAAiB,OAAW;AAChC,UAAM,EAAE,2BAA2B,IACjC,MAAM,OAAO,wCAAmD;AAClE;AAAA,MACE;AAAA,QACE,WAAW,CAAC,SAAS;AACnB,uBAAa,IAAI;AAAA,QACnB;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,aAAS,iCAAiC;AAAA,MACxC,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAOA,eAAsB,kCAAkC,eAAuC;AAC7F,MAAI,kBAAkB,UAAa,kBAAkB,KAAM;AAC3D,MAAI;AACF,UAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,+BAA4C;AACvF,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,sBAA2B;AAGlE,UAAM,SAAS,cAAc,MAAM,aAAa;AAChD,sBAAkB,EAAE,UAAU,MAAM;AAAA,EACtC,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,aAAS,0BAA0B;AAAA,MACjC,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEA,IAAM,iBAAiB,CAAC,QAAQ,KAAK;AAU9B,SAAS,gBAAgB,SAAgC;AAC9D,aAAW,OAAO,gBAAgB;AAChC,UAAM,OAAO,QAAQ,SAAS,sBAAsB,GAAG,EAAE;AAEzD,QAAI,WAAW,IAAI,EAAG,QAAO;AAAA,EAC/B;AACA,SAAO;AACT;;;ACjFO,SAAS,wBAAwB,QAA0B;AAChE,MAAI,eAAe;AACnB,QAAM,WAAW,CAAC,WAAiC;AACjD,QAAI,aAAc;AAClB,mBAAe;AACf,YAAQ,IAAI;AAAA,cAAiB,MAAM,kCAA6B;AAChE,UAAM,YAAY;AAGhB,UAAI;AACF,cAAM,MAAO,MAAM,OAAO,cAAc,EAAE,MAAM,MAAM,IAAI;AAG1D,YAAI,KAAK,OAAO,UAAU,aAAa,QAAW;AAChD,gBAAM,IAAI,MAAM,SAAS,SAAS;AAAA,QACpC;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,iBAAS,wBAAwB;AAAA,UAC/B,OAAO;AAAA,UACP,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAIA,UAAI;AACF,cAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,+BAA4C;AACvF,cAAM,UAAU,kBAAkB;AAClC,cAAM,QAAQ,QAAQ;AAAA,MACxB,SAAS,KAAK;AACZ,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,iBAAS,0BAA0B;AAAA,UACjC,OAAO;AAAA,UACP,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,cAAQ,IAAI,+BAA+B;AAC3C,aAAO,MAAM,MAAM;AACjB,gBAAQ,KAAK,CAAC;AAAA,MAChB,CAAC;AACD,iBAAW,MAAM;AACf,iBAAS,wBAAwB;AAAA,UAC/B,OAAO;AAAA,UACP,SAAS;AAAA,QACX,CAAC;AACD,gBAAQ,KAAK,CAAC;AAAA,MAChB,GAAG,IAAM,EAAE,MAAM;AAAA,IACnB,GAAG;AAAA,EACL;AACA,UAAQ,GAAG,WAAW,MAAM;AAC1B,aAAS,SAAS;AAAA,EACpB,CAAC;AACD,UAAQ,GAAG,UAAU,MAAM;AACzB,aAAS,QAAQ;AAAA,EACnB,CAAC;AACH;;;ACjEA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,YAAY;AACrB,SAAS,eAAe;AAoBjB,SAAS,qBAAqB,SAAiB,WAAiC;AACrF,QAAM,eAAe,KAAK,SAAS,eAAe;AAElD,MAAIC,YAAW,YAAY,GAAG;AAC5B,UAAM,WAAW,aAAa,SAAS,SAAS;AAChD,WAAO;AAAA,MACL,QAAQ,SAAS;AAAA,MACjB,SAAS,SAAS;AAAA,MAClB,UAAU,SAAS;AAAA,MACnB,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AACA,WAAS,gCAAgC;AAAA,IACvC,OAAO;AAAA,IACP,SACE;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL,QAAQ,iBAAiB,SAAS;AAAA,IAClC,SAAS,kBAAkB,SAAS;AAAA,IACpC,UAAU,oBAAoB,SAAS;AAAA;AAAA,IAEvC,QAAQ,WAAW,QAAQ,SAAS,CAAC;AAAA,EACvC;AACF;;;AC5CA,SAAS,kBAAkB;;;ACT3B,SAAS,WAAAC,gBAAe;;;ACKxB,SAAS,cAAAC,aAAY,cAAc,gBAAgB;AAEnD,SAAS,WAAAC,UAAS,eAAe;AAEjC,IAAM,aAAqC;AAAA,EACzC,SAAS;AAAA,EACT,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,SAAS,gBACd,KACA,KACA,WACS;AACT,QAAM,WAAW,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAG7C,QAAM,WAAWA,SAAQ,WAAW,MAAM,OAAO;AACjD,MAAI,CAAC,SAAS,WAAW,SAAS,GAAG;AACnC,QAAI,UAAU,GAAG;AACjB,QAAI,IAAI,WAAW;AACnB,WAAO;AAAA,EACT;AAEA,MAAI,CAACD,YAAW,QAAQ,EAAG,QAAO;AAElC,QAAM,OAAO,SAAS,QAAQ;AAC9B,MAAI,CAAC,KAAK,OAAO,EAAG,QAAO;AAE3B,QAAM,MAAM,QAAQ,QAAQ;AAC5B,QAAM,cAAc,WAAW,GAAG,KAAK;AACvC,QAAM,UAAU,aAAa,QAAQ;AAErC,MAAI,UAAU,KAAK;AAAA,IACjB,gBAAgB;AAAA,IAChB,kBAAkB,QAAQ;AAAA,EAC5B,CAAC;AACD,MAAI,IAAI,OAAO;AACf,SAAO;AACT;;;AD/BA,IAAM,eAAe;AAoCrB,SAAS,eAAe,GAAsB,QAAyB;AACrE,MAAI,CAAC,EAAE,YAAa,QAAO;AAC3B,QAAM,QAAQ,EAAE,YAAY,EAAE,GAAG;AACjC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,OAAO,EAAG,GAAE,IAAI,UAAU,GAAG,CAAC;AACxE,MAAI,MAAM,SAAS;AACjB,cAAU,EAAE,KAAK,gBAAgB,qBAAqB,KAAK,QAAW,EAAE,SAAS;AACjF,eAAW;AAAA,MACT;AAAA,MACA,KAAK,EAAE;AAAA,MACP,QAAQ;AAAA,MACR,UAAU,KAAK,IAAI,IAAI,EAAE;AAAA,MACzB,WAAW,EAAE;AAAA,IACf,CAAC;AACD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGA,eAAsB,eAAe,GAAwC;AAC3E,MAAI,CAAC,EAAE,IAAI,WAAW,iBAAiB,EAAG,QAAO;AACjD,IAAE,IAAI,UAAU,cAAc,EAAE,SAAS;AAEzC,MAAI,eAAe,GAAG,EAAE,IAAI,UAAU,MAAM,EAAG,QAAO;AAEtD,QAAM,kBAAkB,EAAE,IAAI,MAAM,kBAAkB,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC;AAC1E,QAAM,WAAW,gBAAgB,MAAM,GAAG,EAAE,OAAO,OAAO;AAC1D,MAAI,SAAS,SAAS,GAAG;AACvB;AAAA,MACE,EAAE;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE;AAAA,IACJ;AACA,eAAW;AAAA,MACT,QAAQ,EAAE,IAAI,UAAU;AAAA,MACxB,KAAK,EAAE;AAAA,MACP,QAAQ;AAAA,MACR,UAAU,KAAK,IAAI,IAAI,EAAE;AAAA,MACzB,WAAW,EAAE;AAAA,IACf,CAAC;AACD,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,SAAS,SAAS,CAAC;AAC/C,QAAM,aAAa,SAAS,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AACjD,QAAM,SAAS,EAAE,cAAc,KAAK,CAAC,MAAM,EAAE,eAAe,UAAU;AACtE,MAAI,CAAC,QAAQ;AACX,UAAM,cAAc,EAAE,cAAc,IAAI,CAAC,MAAM,EAAE,UAAU;AAC3D,UAAM,aAAa,eAAe,YAAY,WAAW;AACzD,UAAM,MAAM,aACR,WAAW,UAAU,8BAA8B,UAAU,MAC7D,WAAW,UAAU;AACzB,cAAU,EAAE,KAAK,aAAa,KAAK,KAAK,QAAW,EAAE,SAAS;AAC9D,eAAW;AAAA,MACT,QAAQ,EAAE,IAAI,UAAU;AAAA,MACxB,KAAK,EAAE;AAAA,MACP,QAAQ;AAAA,MACR,UAAU,KAAK,IAAI,IAAI,EAAE;AAAA,MACzB,WAAW,EAAE;AAAA,IACf,CAAC;AACD,WAAO;AAAA,EACT;AACA,QAAM;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,IACA,EAAE;AAAA,IACF,EAAE;AAAA,IACF,EAAE;AAAA,IACF,EAAE;AAAA,IACF,EAAE;AAAA,IACF,EAAE;AAAA,IACF,EAAE;AAAA,IACF,EAAE;AAAA,EACJ;AACA,aAAW;AAAA,IACT,QAAQ,EAAE,IAAI,UAAU;AAAA,IACxB,KAAK,EAAE;AAAA,IACP,QAAQ,EAAE,IAAI;AAAA,IACd,UAAU,KAAK,IAAI,IAAI,EAAE;AAAA,IACzB,WAAW,EAAE;AAAA,EACf,CAAC;AACD,SAAO;AACT;AAQA,eAAsB,iBAAiB,GAAwC;AAC7E,QAAM,UAAU,EAAE,IAAI,MAAM,GAAG,EAAE,CAAC;AAClC,QAAM,UAAU,UAAU,EAAE,IAAI,QAAQ,QAAQ,WAAW;AAC3D,QAAM,UAAU,4BAA4B,EAAE,GAAG;AACjD,QAAM,WAAW,MAAM,mBAAmB,SAAS,SAAS;AAAA,IAC1D,QAAQ,EAAE;AAAA,IACV,YAAY,EAAE;AAAA,IACd;AAAA,EACF,CAAC;AACD,MAAI,aAAa,KAAM,QAAO;AAC9B,IAAE,IAAI,UAAU,cAAc,EAAE,SAAS;AACzC,QAAM,iCAAiC,UAAU,EAAE,GAAG;AACtD,aAAW;AAAA,IACT,SAAS,EAAE,IAAI,UAAU,OAAO,YAAY;AAAA,IAC5C,KAAK,EAAE;AAAA,IACP,QAAQ,EAAE,IAAI;AAAA,IACd,UAAU,KAAK,IAAI,IAAI,EAAE;AAAA,IACzB,WAAW,EAAE;AAAA,EACf,CAAC;AACD,SAAO;AACT;AAOA,eAAsB,cAAc,GAAwC;AAC1E,MAAI,CAAC,EAAE,IAAI,WAAW,cAAc,EAAG,QAAO;AAC9C,QAAM,UAAU,EAAE,IAAI,MAAM,GAAG,EAAE,CAAC;AAIlC,MAAI,eAAe,OAAO,GAAG;AAC3B,MAAE,IAAI,UAAU,cAAc,EAAE,SAAS;AACzC,QAAI,eAAe,GAAG,EAAE,IAAI,UAAU,MAAM,EAAG,QAAO;AACtD,UAAME,WAAU,EAAE,IAAI,UAAU,QAAQ,YAAY;AACpD,QAAIA,YAAW,QAAQ;AACrB;AAAA,QACE,EAAE;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE;AAAA,MACJ;AACA,iBAAW;AAAA,QACT,QAAAA;AAAA,QACA,KAAK,EAAE;AAAA,QACP,QAAQ;AAAA,QACR,UAAU,KAAK,IAAI,IAAI,EAAE;AAAA,QACzB,WAAW,EAAE;AAAA,MACf,CAAC;AACD,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,UAAU,4BAA4B,EAAE,GAAG;AACjD,YAAM,WAAW,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA,oBAAoB;AAAA,QACpB,EAAE;AAAA,MACJ;AACA,YAAM,iCAAiC,UAAU,EAAE,GAAG;AAAA,IACxD,SAAS,KAAK;AACZ;AAAA,QACE,EAAE;AAAA,QACF;AAAA,QACA,eAAe,QAAQ,IAAI,UAAU;AAAA,QACrC;AAAA,QACA;AAAA,QACA,EAAE;AAAA,MACJ;AAAA,IACF;AACA,eAAW;AAAA,MACT,QAAAA;AAAA,MACA,KAAK,EAAE;AAAA,MACP,QAAQ,EAAE,IAAI;AAAA,MACd,UAAU,KAAK,IAAI,IAAI,EAAE;AAAA,MACzB,WAAW,EAAE;AAAA,IACf,CAAC;AACD,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,EAAE,aAAa,KAAK,CAAC,MAAM,EAAE,cAAc,OAAO;AAChE,MAAI,CAAC,MAAO,QAAO;AAEnB,IAAE,IAAI,UAAU,cAAc,EAAE,SAAS;AACzC,MAAI,eAAe,GAAG,EAAE,IAAI,UAAU,MAAM,EAAG,QAAO;AAEtD,QAAM,UAAU,EAAE,IAAI,UAAU,QAAQ,YAAY;AACpD,MAAI,WAAW,QAAQ;AACrB;AAAA,MACE,EAAE;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE;AAAA,IACJ;AACA,eAAW;AAAA,MACT;AAAA,MACA,KAAK,EAAE;AAAA,MACP,QAAQ;AAAA,MACR,UAAU,KAAK,IAAI,IAAI,EAAE;AAAA,MACzB,WAAW,EAAE;AAAA,IACf,CAAC;AACD,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,EAAE,WAAW,MAAM,QAAQ;AAC7C,UAAM,SAAS,gBAAgB,EAAE;AACjC,UAAM,UAAU,4BAA4B,EAAE,GAAG;AACjD,UAAM,WAAW,MAAM,WAAW,KAAK,SAAS,QAAQ,MAAM,UAAU,EAAE,QAAQ;AAClF,UAAM,iCAAiC,UAAU,EAAE,GAAG;AAAA,EACxD,SAAS,KAAK;AACZ;AAAA,MACE,EAAE;AAAA,MACF;AAAA,MACA,eAAe,QAAQ,IAAI,UAAU;AAAA,MACrC;AAAA,MACA;AAAA,MACA,EAAE;AAAA,IACJ;AAAA,EACF;AACA,aAAW;AAAA,IACT;AAAA,IACA,KAAK,EAAE;AAAA,IACP,QAAQ,EAAE,IAAI;AAAA,IACd,UAAU,KAAK,IAAI,IAAI,EAAE;AAAA,IACzB,WAAW,EAAE;AAAA,EACf,CAAC;AACD,SAAO;AACT;AAGA,eAAsB,iBAAiB,GAAwC;AAC7E,MAAI,CAAC,EAAE,IAAI,WAAW,OAAO,EAAG,QAAO;AACvC,IAAE,IAAI,UAAU,cAAc,EAAE,SAAS;AAEzC,MAAI,eAAe,GAAG,EAAE,IAAI,UAAU,KAAK,EAAG,QAAO;AAErD,QAAM,QAAQ,WAAW,EAAE,KAAK,EAAE,YAAY;AAC9C,MAAI,CAAC,OAAO;AACV,UAAM,UAAU,EAAE,IAAI,MAAM,GAAG,EAAE,CAAC;AAClC,UAAM,aAAa,EAAE,aAAa,IAAI,CAAC,MAAM,EAAE,SAAS;AACxD,UAAM,aAAa,eAAe,SAAS,UAAU;AACrD,UAAM,MAAM,aACR,wBAAwB,OAAO,mBAAmB,UAAU,MAC5D;AACJ,cAAU,EAAE,KAAK,aAAa,KAAK,KAAK,QAAW,EAAE,SAAS;AAC9D,eAAW;AAAA,MACT,QAAQ,EAAE,IAAI,UAAU;AAAA,MACxB,KAAK,EAAE;AAAA,MACP,QAAQ;AAAA,MACR,UAAU,KAAK,IAAI,IAAI,EAAE;AAAA,MACzB,WAAW,EAAE;AAAA,IACf,CAAC;AACD,WAAO;AAAA,EACT;AACA,QAAM,UAAU,EAAE,IAAI,UAAU,OAAO,YAAY;AAEnD,QAAM,aAAa;AAAA,IACjB,OAAO,MAAM;AAAA,IACb;AAAA,IACA,QAAQ,MAAM;AAAA,IACd,KAAK,EAAE;AAAA,IACP,KAAK,EAAE;AAAA,IACP,YAAY,EAAE;AAAA,IACd,WAAW,EAAE;AAAA,IACb,WAAW,EAAE;AAAA,IACb,cAAc,EAAE;AAAA,IAChB,aAAa,EAAE;AAAA,IACf,UAAU,EAAE;AAAA,IACZ,YAAY,EAAE;AAAA,EAChB,CAAC;AACD,aAAW;AAAA,IACT;AAAA,IACA,KAAK,EAAE;AAAA,IACP,QAAQ,EAAE,IAAI;AAAA,IACd,UAAU,KAAK,IAAI,IAAI,EAAE;AAAA,IACzB,WAAW,EAAE;AAAA,EACf,CAAC;AACD,SAAO;AACT;AAGO,SAAS,eAAe,GAA+B;AAC5D,SAAO,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS;AAClD;AAGO,SAAS,kBAAkB,GAA+B;AAC/D,QAAM,UAAU,EAAE,IAAI,MAAM,GAAG,EAAE,CAAC;AAClC,MAAI,EAAE,iBAAiBC,SAAQ,OAAO,GAAG;AACvC,MAAE,IAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;AACpD,MAAE,IAAI,IAAI,EAAE,aAAa;AACzB,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;AE3TO,SAAS,kBAAkB,OAA0C;AAC1E,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,MAAI,EAAE,UAAU,OAAQ,QAAO;AAC/B,QAAM,OAAQ,MAAkC;AAChD,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,SAAO;AACT;AAOA,eAAsB,SAAS,MAKH;AAC1B,QAAM,gBAA+B,KAAK,mBAAmB,gBAAgB,KAAK,OAAO,IAAI;AAC7F,QAAM,UAAU,kBAAkB;AAClC,QAAM,mBAAmB,WAAW,QAAQ,KAAK,kBAAkB;AAEnE,MAAI,kBAAkB,MAAM;AAC1B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,kBAAkB;AAAA,MAClB,QAAQ;AAAA,MACR,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,UAAU;AAAA,IACZ;AAAA,EACF;AAEA,QAAM,MAAO,MAAM,OAAO;AAC1B,QAAM,SAAS,IAAI;AACnB,QAAM,kBAAkB,OAAO,IAAI,oBAAoB,aAAa,IAAI,kBAAkB;AAG1F,MAAI,WAAW;AACf,MAAI,WAAW;AACf,QAAM,eAAe,6BAA6B,KAAK,KAAK,SAAS;AACrE,MAAI,cAAc;AAChB,UAAM,WAAW,KAAK,UAAU,QAAQ,aAAa,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE;AAC3E,eAAW,KAAK,UAAU,MAAM,GAAG,QAAQ;AAC3C,eAAW,KAAK,UAAU,MAAM,QAAQ;AAAA,EAC1C;AAEA,SAAO,EAAE,SAAS,kBAAkB,QAAQ,iBAAiB,UAAU,SAAS;AAClF;;;AHlCA,eAAe,iBACb,KACA,KACA,KACkB;AAClB,QAAM,WAAW,IAAI,IAAI,KAAK,kBAAkB,EAAE;AAClD,QAAM,WAAW,MAAM,mBAAmB,UAAU,IAAI,kBAAkB,CAAC,CAAC;AAC5E,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,UAAU,KAAK,UAAU,SAAS,IAAI;AAC5C,MAAI,UAAU,SAAS,QAAQ;AAAA,IAC7B,gBAAgB;AAAA,IAChB,kBAAkB,OAAO,WAAW,OAAO;AAAA,EAC7C,CAAC;AACD,MAAI,IAAI,OAAO;AACf,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAyC;AAClE,SAAO;AACT;AAEA,SAAS,iBAAiB,QAAmD;AAC3E,SAAO,WAAW,QAAQ,OAAO,WAAW,YAAY,cAAc;AACxE;AAEA,SAAS,aAAa,KAAqB,QAAsC;AAC/E,MAAI,UAAU,KAAK,EAAE,UAAU,OAAO,SAAS,QAAQ,IAAI,UAAU,KAAK,IAAI,CAAC;AAC/E,MAAI,IAAI;AACV;AAEA,SAAS,QAAQ,KAAqB,eAAoC;AACxE,MAAI,CAAC,IAAI,aAAa;AACpB,QAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;AAAA,EACpD;AACA,MAAI,CAAC,IAAI,eAAe;AACtB,QAAI,IAAI,iBAAiB,kCAA6B;AAAA,EACxD;AACF;AAEA,SAAS,aACP,KACA,QACA,OACQ;AACR,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,IAAI,WAAW,SAAS,IAAI;AAAA,EACrC;AACA,MAAI,kBAAkB,MAAM,GAAG;AAC7B,UAAM,WAAW,kBAAkB,MAAM;AACzC,UAAM,WAAW,KAAK,UAAU,SAAS,aAAa,EAAE,QAAQ,MAAM,SAAS;AAC/E,UAAM,kBAAkB,UACtB,QAAQ,WAAW,KAAK,MAAM,EAChC,uCAAuC,QAAQ;AAC/C,WAAO,IAAI,WAAW,SAAS,OAAO,kBAAkB,IAAI;AAAA,EAC9D;AACA,SAAO,IAAI,WAAW,IAAI;AAC5B;AAEA,eAAe,mBACb,KACA,KACA,KACA,KACA,OACkB;AAClB,MAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,mBAAoB,QAAO;AAEhE,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU,MAAY;AAC1B,eAAW,MAAM;AAAA,EACnB;AACA,MAAI,GAAG,SAAS,OAAO;AACvB,MAAI;AACF,UAAM,SAAS,MAAM,IAAI,mBAAmB,KAAK,KAAK;AAAA,MACpD,QAAQ,WAAW;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,iBAAiB,MAAM,EAAG,cAAa,KAAK,MAAM;AACtD,WAAO;AAAA,EACT,SAAS,WAAW;AAClB,YAAQ,MAAM,sBAAuB,UAAoB,OAAO;AAChE,YAAQ,KAAK,IAAI,aAAa;AAC9B,WAAO;AAAA,EACT,UAAE;AACA,QAAI,eAAe,SAAS,OAAO;AAAA,EACrC;AACF;AAEA,eAAe,cACb,KACA,KACA,KACA,OACkB;AAClB,MAAI,CAAC,IAAI,UAAW,QAAO;AAE3B,MAAI;AACF,UAAM,SAAS,MAAM,IAAI,UAAU,KAAK,EAAE,MAAM,CAAC;AACjD,QAAI,iBAAiB,MAAM,GAAG;AAC5B,mBAAa,KAAK,MAAM;AACxB,aAAO;AAAA,IACT;AACA,QAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;AAClD,QAAI,IAAI,aAAa,KAAK,QAAQ,KAAK,CAAC;AACxC,WAAO;AAAA,EACT,SAAS,QAAQ;AACf,YAAQ,MAAM,oCAAqC,OAAiB,OAAO;AAC3E,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,KAA4B,KAAqB,KAAoB;AAC7F,MAAI,IAAI,iBAAiB,CAAC,IAAI,aAAa;AACzC,QAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;AAClD,QAAI,IAAI,IAAI,aAAa;AAAA,EAC3B,WAAW,CAAC,IAAI,aAAa;AAC3B,cAAU,KAAK,kBAAmB,IAAc,SAAS,GAAG;AAAA,EAC9D,OAAO;AACL,QAAI,IAAI;AAAA,EACV;AACF;AAEO,SAAS,qBACd,KACqD;AACrD,SAAO,CAAC,KAAsB,QAAwB;AACpD,UAAM,YAAY;AAChB,YAAM,MAAM,IAAI,OAAO;AACvB,YAAM,YAAY,WAAW;AAC7B,YAAM,QAAQ,KAAK,IAAI;AAEvB,YAAM,QAAQ,cAAc;AAC5B,YAAM,kBAAkB;AAAA,QACtB,IAAI;AAAA,QACJ,EAAE,YAAY,KAAK;AAAA,QACnB,EAAE,MAAM;AAAA,MACV;AACA,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AACpD,YAAI,UAAU,GAAG,CAAC;AAAA,MACpB;AAEA,YAAM,aAAa,IAAI,SAAS,KAAK,KAAK,WAAW,KAAK;AAE1D,UAAI;AACF,YAAI,MAAM,iBAAiB,KAAK,KAAK,GAAG,EAAG;AAC3C,YAAI,MAAM,eAAe,UAAU,EAAG;AACtC,YAAI,MAAM,iBAAiB,UAAU,EAAG;AACxC,YAAI,MAAM,cAAc,UAAU,EAAG;AACrC,YAAI,MAAM,iBAAiB,UAAU,EAAG;AACxC,YAAI,eAAe,UAAU,EAAG;AAChC,YAAI,kBAAkB,UAAU,EAAG;AAEnC,YAAI,MAAM,mBAAmB,KAAK,KAAK,KAAK,KAAK,KAAK,EAAG;AACzD,YAAI,MAAM,cAAc,KAAK,KAAK,KAAK,KAAK,EAAG;AAG/C,YAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;AAClD,YAAI,IAAI,IAAI,SAAS;AAAA,MACvB,SAAS,KAAK;AACZ,yBAAiB,KAAK,KAAK,GAAG;AAAA,MAChC;AAAA,IACF,GAAG;AAAA,EACL;AACF;;;AI5MA,eAAsB,uBACpB,QACA,UACA,YACe;AACf,MAAI,SAAS,WAAW,EAAG;AAE3B,MAAI;AACJ,MAAI;AACF,UAAM,WAAW,MAAM,OAAO,IAAI;AAClC,0BAAsB,SAAS;AAAA,EACjC,QAAQ;AACN,UAAM,IAAI,MAAM,+EAA+E;AAAA,EACjG;AAEA,QAAM,MAAM,IAAI,oBAAoB,EAAE,UAAU,KAAK,CAAC;AAEtD,SAAO,GAAG,WAAW,CAAC,SAAS,QAAQ,SAAS;AAC9C,UAAM,YAAY;AAChB,YAAM,MAAM,QAAQ,OAAO;AAC3B,UAAI,CAAC,IAAI,WAAW,MAAM,GAAG;AAC3B,eAAO,QAAQ;AACf;AAAA,MACF;AAEA,YAAM,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC;AAC/B,YAAM,QAAQ,SAAS,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM;AACtD,UAAI,CAAC,OAAO;AACV,eAAO,QAAQ;AACf;AAAA,MACF;AAEA,UAAI;AACF,cAAM,MAAM,MAAM,WAAW,MAAM,QAAQ;AAC3C,cAAM,UAAY,IAA8B,WAAW;AAE3D,YAAI,cAAc,SAAS,QAAQ,MAAM,CAAC,OAAO;AAC/C,kBAAQ,SAAS,IAAI,OAAO;AAC5B,aAAG,GAAG,WAAW,CAAC,SAAiB;AACjC,oBAAQ,YAAY,IAAI,KAAK,SAAS,CAAC;AAAA,UACzC,CAAC;AACD,aAAG,GAAG,SAAS,CAAC,MAAc,WAAmB;AAC/C,oBAAQ,UAAU,IAAI,MAAM,MAAM;AAAA,UACpC,CAAC;AACD,aAAG,GAAG,SAAS,CAAC,QAAe;AAC7B,oBAAQ,UAAU,IAAI,GAAG;AAAA,UAC3B,CAAC;AAAA,QACH,CAAC;AAAA,MACH,QAAQ;AACN,eAAO,QAAQ;AAAA,MACjB;AAAA,IACF,GAAG;AAAA,EACL,CAAC;AACH;;;ATzBA,eAAsB,aAAa,SAAsC;AACvE,QAAM,MAAM,QAAQ,IAAI;AAExB,2BAAyB,GAAG;AAC5B,UAAQ,EAAE,KAAK,MAAM,aAAa,CAAC;AACnC,QAAM,SAAS,MAAM,WAAW,GAAG;AAEnC,QAAM,iCAAiC,OAAO,QAAQ,QAAQ;AAC9D,QAAM,kCAAkC,OAAO,OAAO;AAEtD,QAAM,UAAUC,SAAQ,KAAK,UAAU;AACvC,QAAM,YAAYA,SAAQ,SAAS,QAAQ;AAE3C,QAAM,YAAYA,SAAQ,KAAK,OAAO,SAAS;AAE/C,MAAI,CAACC,YAAW,SAAS,GAAG;AAC1B,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAEA,QAAM,YAAYC,cAAaC,MAAK,WAAW,YAAY,GAAG,OAAO;AACrE,QAAM,aAAa,uBAAuB;AAC1C,QAAM,OAAO,QAAQ,QAAQ,OAAO;AACpC,QAAM,eAAe,MAAM,6BAA6B,OAAO,OAAO;AACtE,QAAM,cAAc,mBAAmB,OAAO,aAAa;AAE3D,QAAM,gBAAgBA,MAAK,WAAW,UAAU;AAChD,QAAM,gBAAgBA,MAAK,WAAW,UAAU;AAChD,QAAM,gBAAgBF,YAAW,aAAa,IAAIC,cAAa,eAAe,OAAO,IAAI;AACzF,QAAM,gBAAgBD,YAAW,aAAa,IAAIC,cAAa,eAAe,OAAO,IAAI;AAEzF,QAAM;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,QAAQ;AAAA,EACV,IAAI,qBAAqB,SAAS,SAAS;AAI3C,QAAM,gBACJ,OAAO,aAAa,cAAc,OAAO,aAAa,SAAS,OAAO,YAClE,OAAO,YACP;AACN,QAAM,cAAc,gBAAgB,kBAAkB,aAAa,IAAI;AAEvE,QAAM,MAAM,MAAM,SAAS;AAAA,IACzB;AAAA,IACA;AAAA,IACA,kBAAkB,OAAO;AAAA,IACzB,oBAAoB,OAAO;AAAA,EAC7B,CAAC;AAED,QAAM,SAAS;AAAA,IACb,qBAAqB;AAAA,MACnB,UAAU,CAAC,KAAK,KAAK,WAAW,eAAkC;AAAA,QAChE;AAAA,QACA;AAAA,QACA,KAAK,IAAI,OAAO;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,UAAU,OAAO,UAAU,QAAQ;AAAA,QACnC,YAAY,OAAO,UAAU;AAAA,QAC7B;AAAA,MACF;AAAA,MACA,uBAAuB,OAAO,UAAU,WAAW,CAAC;AAAA,MACpD,WAAW,IAAI;AAAA,MACf,oBAAoB,IAAI;AAAA,MACxB,qBAAqB,IAAI;AAAA,MACzB,UAAU,IAAI;AAAA,MACd,UAAU,IAAI;AAAA,MACd;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,MAIA,gBAAgB,EAAE,QAAQ,kBAAkB,EAAE;AAAA,IAChD,CAAC;AAAA,EACH;AAEA,QAAM,uBAAuB,QAAQ,gBAAgB,UAAU;AAE/D,SAAO,OAAO,MAAM,MAAM;AACxB,YAAQ,IAAI;AAAA,yBAA4B;AACxC,YAAQ,IAAI,6BAAwB,OAAO,IAAI,CAAC;AAAA,CAAI;AAAA,EACtD,CAAC;AAED,0BAAwB,MAAM;AAChC;","names":["existsSync","readFileSync","join","resolve","existsSync","existsSync","extname","existsSync","resolve","method","extname","resolve","existsSync","readFileSync","join"]}