theokit 0.2.0 → 0.2.1

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/define/define-route.ts","../../src/server/define/define-action.ts","../../src/server/define/define-middleware.ts","../../src/server/define/define-agent-endpoint.ts","../../src/server/define/define-agent-tool.ts","../../src/server/define/define-websocket.ts","../../src/server/define/define-channel.ts","../../src/server/define/define-plugin.ts","../../src/server/http/error-pages.ts","../../src/server/http/static.ts","../../src/server/scan/manifest.ts","../../src/server/agent/stream-agent-run.ts","../../src/server/agent/provider-resolver.ts","../../src/server/agent/create-conversation-history.ts","../../src/server/rate-limit/rate-limit-per-route.ts","../../src/server/realtime/channel-manager.ts","../../src/server/security/csrf-readiness-store.ts","../../src/server/storage/storage-manager.ts","../../src/server/storage/use-unstorage.ts","../../src/server/storage/use-database.ts","../../src/server/webhook/timing-safe-equal.ts","../../src/server/webhook/raw-body.ts","../../src/server/webhook/define-webhook.ts","../../src/cache/constants.ts","../../src/cache/validation.ts","../../src/cache/define-cached-function.ts","../../src/cache/cache-control-header.ts","../../src/cache/key-derivation.ts","../../src/cache/define-cached-route.ts","../../src/cache/cache-engine.ts","../../src/cache/in-memory-adapter.ts","../../src/cache/engine-singleton.ts","../../src/cache/revalidate.ts","../../src/cache/route-rules.ts","../../src/server/serialization.ts","../../src/server/plugin-types.ts"],"sourcesContent":["import type { z } from 'zod'\n\n// T2.2 (architecture-cleanup) — RouteConfig type moved to core/contracts/\n// (canonical home per ADR-0001 v3). Re-export preserves the public path\n// `import { type RouteConfig } from 'theokit/server'`.\nexport type { RouteConfig } from '../../core/contracts/route-config.js'\n\nimport type { RouteConfig } from '../../core/contracts/route-config.js'\n\n/**\n * Define a typed HTTP route.\n * Identity function — provides type inference for route handlers.\n */\nexport function defineRoute<\n  TQuery extends z.ZodType = z.ZodUndefined,\n  TBody extends z.ZodType = z.ZodUndefined,\n  TParams extends z.ZodType = z.ZodUndefined,\n  TCtx = unknown,\n  TResponse = unknown,\n>(\n  config: RouteConfig<TQuery, TBody, TParams, TCtx, TResponse>,\n): RouteConfig<TQuery, TBody, TParams, TCtx, TResponse> {\n  return config\n}\n","import type { z } from 'zod'\n\nexport interface ActionConfig<TInput extends z.ZodType, TCtx = unknown> {\n  input: TInput\n  handler: (ctx: { input: z.infer<TInput>; ctx: TCtx }) => unknown\n}\n\n/**\n * Define a typed server action.\n * Identity function — provides type inference for action handlers.\n */\nexport function defineAction<TInput extends z.ZodType, TCtx = unknown>(\n  config: ActionConfig<TInput, TCtx>,\n): ActionConfig<TInput, TCtx> {\n  return config\n}\n","export type MiddlewareHandler = (\n  request: Request,\n  next: (request: Request) => Promise<Response>,\n) => Response | Promise<Response>\n\n/**\n * Define a middleware handler.\n * Identity function — provides type annotation for middleware.\n */\nexport function defineMiddleware(handler: MiddlewareHandler): MiddlewareHandler {\n  return handler\n}\n","import type { z } from 'zod'\n\nimport type { AgentEvent } from '../agent/agent-types.js'\n\nimport type { RouteConfig } from './define-route.js'\n\n/**\n * T5.1 — defineAgentEndpoint\n *\n * Sugar over defineRoute (ADR D4). Accepts an async generator that yields\n * AgentEvents and produces a RouteConfig whose handler returns a Response\n * streaming Server-Sent Events (SSE).\n *\n * Wire format: `data: <JSON>\\n\\n` per event. Standards-compliant.\n *\n * The generator may throw — the wrapper catches and emits a final\n * `{ type: 'error', message }` event before closing the stream.\n *\n * The wrapper observes `request.signal` (EC-7) — when aborted, the\n * underlying generator is told to `return()` and the stream closes\n * promptly.\n *\n * Note (EC-12, Out of Scope): SSE backpressure (slow consumer) is not\n * handled here. For high-frequency token streaming consider a different\n * transport (WS) or a buffer policy. This MVP enqueues each event\n * immediately.\n */\n\nexport interface AgentEndpointHandlerArgs<TCtx = unknown, TBody = unknown> {\n  query: undefined\n  body: TBody\n  params: undefined\n  request: Request\n  ctx: TCtx\n  /**\n   * Mutable headers bag that the wrapper merges into the SSE response BEFORE\n   * the stream starts. Used by `createConversationHistory` to issue a\n   * conversation-id cookie on first request. Append entries via\n   * `cookieHeaders.append('set-cookie', '<cookie-string>')`.\n   *\n   * Cookies appended AFTER the first yield are NOT applied — the response\n   * headers commit when the wrapper constructs the Response, before the\n   * async generator runs. This is per HTTP semantics, not a wrapper choice.\n   */\n  cookieHeaders: Headers\n  /**\n   * Phase 3 (Production-Readiness #5) — request abort signal.\n   *\n   * Fires when the SSE client disconnects (browser closes tab, abort fetch,\n   * etc.). Thread this to `agent.send(msg, { signal })` so the SDK cancels\n   * the in-flight provider call — STOPS TOKENS FROM CHARGING for output\n   * the user will never receive.\n   *\n   * EC-1 (MUST FIX): the signal is derived via duck-type detection\n   * (`'aborted' in r.signal && typeof r.signal.addEventListener === 'function'`)\n   * to survive cross-realm scenarios (Node 18 polyfills, undici, Edge\n   * runtimes with their own AbortSignal globals). `instanceof AbortSignal`\n   * would fail in those cases.\n   */\n  signal: AbortSignal\n}\n\nexport interface AgentEndpointConfig<TCtx = unknown, TBody = unknown> {\n  handler: (\n    args: AgentEndpointHandlerArgs<TCtx, TBody>,\n  ) => AsyncGenerator<AgentEvent, void, unknown>\n}\n\nconst SSE_HEADERS = {\n  'content-type': 'text/event-stream',\n  'cache-control': 'no-cache, no-transform',\n  connection: 'keep-alive',\n} as const\n\nfunction encodeSSE(event: AgentEvent): Uint8Array {\n  return new TextEncoder().encode(`data: ${JSON.stringify(event)}\\n\\n`)\n}\n\n/**\n * Resolve an AbortSignal from either a Web `Request` (`.signal`) or a\n * Node `IncomingMessage` (`.aborted` flag + `'close'`/'aborted' events).\n *\n * The framework's `executeRoute` passes IncomingMessage to route handlers\n * today, but `defineAgentEndpoint` was designed for the Web Standards\n * `Request` shape. This helper bridges both — preventing a runtime crash\n * (`Cannot read properties of undefined (reading 'aborted')`) that would\n * otherwise abort the SSE stream silently before the first yield.\n */\nfunction resolveAbortSignal(request: unknown): AbortSignal {\n  if (typeof request !== 'object' || request === null) {\n    return new AbortController().signal\n  }\n  const r = request as {\n    signal?: unknown\n    aborted?: boolean\n    on?: (event: string, cb: () => void) => void\n  }\n  if (\n    typeof r.signal === 'object' &&\n    r.signal !== null &&\n    'aborted' in r.signal &&\n    typeof (r.signal as AbortSignal).addEventListener === 'function'\n  ) {\n    return r.signal as AbortSignal\n  }\n\n  const controller = new AbortController()\n  if (r.aborted === true) controller.abort()\n  if (typeof r.on === 'function') {\n    r.on('close', () => {\n      if (!controller.signal.aborted) controller.abort()\n    })\n    r.on('aborted', () => {\n      if (!controller.signal.aborted) controller.abort()\n    })\n  }\n  return controller.signal\n}\n\nexport function defineAgentEndpoint<TBody = unknown, TCtx = unknown>(\n  config: AgentEndpointConfig<TCtx, TBody>,\n): RouteConfig<z.ZodUndefined, z.ZodUndefined, z.ZodUndefined, TCtx, Response> {\n  return {\n    handler: async ({ request, ctx, body, query, params }) => {\n      const cookieHeaders = new Headers()\n      const signal = resolveAbortSignal(request)\n      const generator = config.handler({\n        request,\n        ctx: ctx,\n        body: body as TBody,\n        query: query,\n        params: params,\n        cookieHeaders,\n        signal,\n      })\n\n      // Prime the generator to its first yield. This forces the handler's\n      // synchronous + async setup (including `createConversationHistory` if\n      // used) to run BEFORE the Response headers commit, so any Set-Cookie\n      // lines appended to `cookieHeaders` land in the actual response.\n      //\n      // First-byte latency cost: bounded by the work up to the first yield\n      // (typically 100-500ms for an LLM chat with `agent.send`). Acceptable\n      // for the use case; alternative (heuristic detection of cookie writes)\n      // is brittle.\n      let firstResult: IteratorResult<AgentEvent, void>\n      let primeError: unknown\n      try {\n        firstResult = await generator.next()\n      } catch (err) {\n        primeError = err\n        firstResult = { value: undefined, done: true }\n      }\n\n      // Merge any cookies the handler issued into the response headers.\n      const responseHeaders = new Headers(SSE_HEADERS)\n      for (const value of cookieHeaders.getSetCookie()) {\n        responseHeaders.append('set-cookie', value)\n      }\n\n      const stream = new ReadableStream<Uint8Array>({\n        async start(controller) {\n          const onAbort = () => {\n            void generator.return(undefined)\n          }\n\n          if (signal.aborted) {\n            controller.close()\n            return\n          }\n          signal.addEventListener('abort', onAbort, { once: true })\n\n          try {\n            // If priming threw, yield a final error event and close.\n            if (primeError !== undefined) {\n              let message: string\n              if (primeError instanceof Error) {\n                message = primeError.message\n              } else if (typeof primeError === 'string') {\n                message = primeError\n              } else {\n                message = 'agent handler failed during setup'\n              }\n              controller.enqueue(encodeSSE({ type: 'error', message }))\n              return\n            }\n            // Enqueue the primed first value (if any).\n            if (firstResult.done !== true) {\n              controller.enqueue(encodeSSE(firstResult.value))\n            } else {\n              return\n            }\n            // Continue iterating remaining events.\n            for await (const event of generator) {\n              // `signal.aborted` can flip true asynchronously via the\n              // listener registered above. ESLint's narrowing only sees\n              // the false assertion at line 114; the dynamic abort is\n              // legitimate and the guard prevents enqueue-after-close.\n              // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition\n              if (signal.aborted) break\n              controller.enqueue(encodeSSE(event))\n            }\n          } catch (err) {\n            const message = err instanceof Error ? err.message : String(err)\n            controller.enqueue(encodeSSE({ type: 'error', message }))\n          } finally {\n            signal.removeEventListener('abort', onAbort)\n            controller.close()\n          }\n        },\n        cancel() {\n          void generator.return(undefined)\n        },\n      })\n\n      return new Response(stream, { headers: responseHeaders })\n    },\n  }\n}\n","import type { z } from 'zod'\nimport { zodToJsonSchema } from 'zod-to-json-schema'\n\n/**\n * Item #4 — `defineAgentTool`\n *\n * Sugar over the `@usetheo/sdk` `CustomTool` contract. Takes a Zod 3 schema +\n * handler and produces a structurally-compatible `CustomTool` that\n * `Agent.create({ tools: [...] })` accepts.\n *\n * Why not delegate to SDK's `defineTool`?\n *   SDK's `defineTool` calls `z.toJSONSchema(...)` which only exists on Zod 4\n *   (at root) or `zod/v4` (Zod 3.25+ subpath). TheoKit pins Zod 3 framework-\n *   wide. Bumping to Zod 4 is a major breaking change touching every primitive\n *   — out of scope for this item. Instead, we convert the Zod schema to JSON\n *   Schema 7 with `zod-to-json-schema` (Zod 3 native, MIT, zero transitive\n *   deps, 3M weekly DLs) and build the `CustomTool` object directly. See ADR\n *   D1 in `docs/plans/item-4-define-agent-tool-plan.md`.\n *\n * Handler error propagation:\n *   `defineAgentTool` parses the input via the Zod schema BEFORE calling the\n *   user handler. Invalid input throws a `ZodError`, which the SDK's tool-\n *   dispatcher (or the `streamAgentRun` adapter) sees as a tool failure and\n *   surfaces as an `error` AgentEvent on the SSE wire (ADR D3).\n */\n\n/**\n * Local mirror of the SDK's `CustomTool` interface. We don't `import type`\n * from `@usetheo/sdk` because the SDK is an optional peer (consumers who\n * never call `defineAgentTool` shouldn't need it installed). The shape is\n * the wire contract; any structurally-matching object is accepted by\n * `Agent.create({ tools })`.\n *\n * @public\n */\nexport interface CustomTool {\n  name: string\n  description: string\n  inputSchema: Record<string, unknown>\n  handler: (input: Record<string, unknown>) => string | Promise<string>\n}\n\n/**\n * Spec accepted by {@link defineAgentTool}. `inputSchema` is a Zod 3 schema\n * rooted in `z.object(...)`. The `handler` argument type is inferred via\n * `z.infer<T>`.\n *\n * @public\n */\nexport interface DefineAgentToolSpec<T extends z.ZodType> {\n  /** Tool name surfaced to the LLM. Must match `^[a-zA-Z][a-zA-Z0-9_-]{0,63}$`. */\n  name: string\n  /** Description surfaced to the LLM. Required — drives tool-selection accuracy. */\n  description: string\n  /** Zod schema describing the input. Must be `z.object(...)` at the root. */\n  inputSchema: T\n  /** Handler invoked with the parsed input. */\n  handler: (input: z.infer<T>) => string | Promise<string>\n}\n\nconst TOOL_NAME_REGEX = /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/\n\nfunction isZodObject(schema: z.ZodType): boolean {\n  // Zod 3 stores the typeName at `_def.typeName`. ZodObject has 'ZodObject'.\n  // Refinements (`.refine`), transforms (`.transform`), and defaults wrap the\n  // underlying schema in ZodEffects / ZodDefault / etc. — walk the chain via\n  // `_def.schema` / `_def.innerType` until we hit ZodObject (or give up).\n  // Avoids importing the ZodObject class to keep the runtime import surface\n  // minimal.\n  let current: unknown = schema\n  for (let depth = 0; depth < 10; depth++) {\n    const def = (current as { _def?: { typeName?: string; schema?: unknown; innerType?: unknown } })\n      ._def\n    if (def?.typeName === 'ZodObject') return true\n    if (def?.schema !== undefined) {\n      current = def.schema\n      continue\n    }\n    if (def?.innerType !== undefined) {\n      current = def.innerType\n      continue\n    }\n    return false\n  }\n  return false\n}\n\n/**\n * Build a {@link CustomTool} from a Zod 3 schema + handler.\n *\n * Behavior:\n * - Validates `name` matches the LLM tool-name regex.\n * - Requires `inputSchema` to be a `ZodObject` (Anthropic + SDK contract).\n * - Warns (not throws) if `description` is empty — empty descriptions\n *   degrade LLM tool selection.\n * - Converts the Zod schema to JSON Schema 7 inline (no `$ref`s — LLMs handle\n *   inline schemas more reliably).\n * - Strips the top-level `$schema` field (Anthropic rejects schemas with\n *   `$schema` at root in some provider modes).\n * - Wraps the handler to parse the input via the Zod schema BEFORE invoking\n *   the user code — bad LLM-supplied input throws `ZodError`, which the SDK\n *   converts to `tool_result(isError)`.\n *\n * @public\n */\nexport function defineAgentTool<T extends z.ZodType>(spec: DefineAgentToolSpec<T>): CustomTool {\n  if (!TOOL_NAME_REGEX.test(spec.name)) {\n    throw new Error(\n      `defineAgentTool: name must match ${TOOL_NAME_REGEX.source}. Got: ${JSON.stringify(spec.name)}`,\n    )\n  }\n  if (!isZodObject(spec.inputSchema)) {\n    throw new Error('defineAgentTool: inputSchema must be a ZodObject (z.object({...}))')\n  }\n  if (spec.description.length === 0) {\n    console.warn(\n      `defineAgentTool(${JSON.stringify(spec.name)}): empty description degrades LLM tool selection — provide a one-sentence summary.`,\n    )\n  }\n\n  // `$refStrategy: 'none'` inlines all subschemas. LLMs handle inline schemas\n  // more reliably than $ref-resolved ones. Recursive schemas (z.lazy) are\n  // typically guarded by the consumer with maxDepth / typeName checks.\n  const rawSchema = zodToJsonSchema(spec.inputSchema, {\n    target: 'jsonSchema7',\n    $refStrategy: 'none',\n  }) as Record<string, unknown>\n  // Strip $schema if present at root — Anthropic + some providers reject it.\n  const { $schema: _$schema, ...inputSchema } = rawSchema as Record<string, unknown> & {\n    $schema?: unknown\n  }\n\n  return {\n    name: spec.name,\n    description: spec.description,\n    inputSchema,\n    handler: async (input: Record<string, unknown>): Promise<string> => {\n      const parsed = spec.inputSchema.parse(input) as z.infer<T>\n      return await spec.handler(parsed)\n    },\n  }\n}\n","import type { IncomingMessage } from 'node:http'\n\nexport interface WebSocketLike {\n  send(data: string | Buffer): void\n  close(code?: number, reason?: string): void\n}\n\nexport interface WebSocketHandler {\n  onOpen?: (ws: WebSocketLike, req: IncomingMessage) => void\n  onMessage?: (ws: WebSocketLike, data: string | Buffer) => void\n  onClose?: (ws: WebSocketLike, code: number, reason: Buffer) => void\n  onError?: (ws: WebSocketLike, error: Error) => void\n}\n\n/**\n * Define a WebSocket endpoint handler.\n * Identity function — provides type inference for WebSocket handlers.\n */\nexport function defineWebSocket(handler: WebSocketHandler): WebSocketHandler {\n  return handler\n}\n","import type { IncomingMessage } from 'node:http'\n\nimport type { WebSocketLike } from './define-websocket.js'\n\nexport interface ChannelHandler<TMessage = unknown> {\n  onSubscribe?: (ws: WebSocketLike, room: string, req: IncomingMessage) => void\n  onMessage?: (ws: WebSocketLike, room: string, data: TMessage) => void\n  onUnsubscribe?: (ws: WebSocketLike, room: string) => void\n}\n\n/**\n * Define a channel handler for WebSocket rooms.\n * Identity function — provides type inference for channel handlers.\n */\nexport function defineChannel<TMessage = unknown>(\n  handler: ChannelHandler<TMessage>,\n): ChannelHandler<TMessage> {\n  return handler\n}\n","import type { TheoPlugin } from '../plugin-types.js'\n\n/**\n * Identity function for defining a Theo plugin.\n *\n * **Note:** Prefer `definePlugin` (shorter, canonical name per ADR-0008 D6).\n * Both functions are identical — `defineTheoPlugin` is kept as an alias for\n * existing in-tree consumers without forcing a migration sweep.\n */\nexport function defineTheoPlugin(plugin: TheoPlugin): TheoPlugin {\n  return plugin\n}\n","/**\n * T2.4 — Custom error pages loader.\n *\n * Loads optional `.theo/client/404.html` and `500.html` from disk so adapters\n * (Node, CF, Vercel, Bun, Netlify, AWS Lambda, Deno) can pass them to the\n * shared `sendError` pipeline.\n *\n * EC-9: caps file size at 1MB. Files beyond the limit are skipped with a\n * console.warn and the default JSON error path is used.\n */\n\n/* eslint-disable security/detect-non-literal-fs-filename --\n * Loads `.theo/client/404.html` and `500.html` from a directory `dir` that\n * is always the build output of the current project. The names are fixed\n * literals (`'404.html'` / `'500.html'`) — no HTTP input.\n */\nimport { existsSync, readFileSync, statSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nexport const MAX_ERROR_HTML_BYTES = 1_048_576 // 1MB\n\nexport interface CustomErrorPages {\n  custom404Html?: string\n  custom500Html?: string\n}\n\nfunction loadIfSafe(dir: string, name: string): string | undefined {\n  const path = resolve(dir, name)\n  if (!existsSync(path)) return undefined\n  try {\n    const stat = statSync(path)\n    if (stat.size > MAX_ERROR_HTML_BYTES) {\n      console.warn(\n        `[theokit] Custom error page ${name} is ${stat.size} bytes (max ${MAX_ERROR_HTML_BYTES}); skipping.`,\n      )\n      return undefined\n    }\n    return readFileSync(path, 'utf-8')\n  } catch (err) {\n    console.warn(`[theokit] Failed to read ${name}: ${(err as Error).message}`)\n    return undefined\n  }\n}\n\n/**\n * Load `.theo/client/{404,500}.html` from the given client directory.\n * Returns object with both fields when present; missing pages remain undefined.\n */\nexport function loadCustomErrorPages(clientDir: string): CustomErrorPages {\n  return {\n    custom404Html: loadIfSafe(clientDir, '404.html'),\n    custom500Html: loadIfSafe(clientDir, '500.html'),\n  }\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Static-file server. The URL path IS user-controlled, BUT before any fs\n * call we resolve to absolute and reject with 403 if the resolved path\n * escapes `clientDir` (see EC-1 guard at line below). The guard is\n * authoritative; the rule cannot see it.\n */\nimport { existsSync, readFileSync, statSync } from 'node:fs'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport { resolve, extname } from 'node:path'\n\nconst MIME_TYPES: Record<string, string> = {\n  '.html': 'text/html',\n  '.js': 'application/javascript',\n  '.mjs': 'application/javascript',\n  '.css': 'text/css',\n  '.json': 'application/json',\n  '.png': 'image/png',\n  '.jpg': 'image/jpeg',\n  '.jpeg': 'image/jpeg',\n  '.gif': 'image/gif',\n  '.svg': 'image/svg+xml',\n  '.ico': 'image/x-icon',\n  '.woff': 'font/woff',\n  '.woff2': 'font/woff2',\n  '.ttf': 'font/ttf',\n  '.txt': 'text/plain',\n  '.map': 'application/json',\n}\n\nexport function serveStaticFile(\n  req: IncomingMessage,\n  res: ServerResponse,\n  clientDir: string,\n): boolean {\n  const urlPath = (req.url ?? '/').split('?')[0]\n\n  // Path traversal prevention (EC-1)\n  const filePath = resolve(clientDir, '.' + urlPath)\n  if (!filePath.startsWith(clientDir)) {\n    res.writeHead(403)\n    res.end('Forbidden')\n    return true\n  }\n\n  if (!existsSync(filePath)) return false\n\n  const stat = statSync(filePath)\n  if (!stat.isFile()) return false\n\n  const ext = extname(filePath)\n  const contentType = MIME_TYPES[ext] ?? 'application/octet-stream'\n  const content = readFileSync(filePath)\n\n  res.writeHead(200, {\n    'Content-Type': contentType,\n    'Content-Length': content.length,\n  })\n  res.end(content)\n  return true\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time manifest emitter / loader. All paths derived from `distDir`\n * + `serverDir`, themselves resolved from `process.cwd()`. No HTTP input.\n */\nimport { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs'\nimport { join, resolve, relative } from 'node:path'\n\nimport { scanServerActions } from './action-scan.js'\nimport type { ActionNode } from './action-scan.js'\nimport { compilePattern } from './match.js'\nimport type { ServerRouteNode } from './match.js'\nimport { scanServerRoutes } from './scan.js'\nimport { scanWebSocketRoutes } from './ws-scan.js'\nimport type { WebSocketRouteNode } from './ws-scan.js'\n\n// --- Manifest Types ---\n\nexport interface ManifestRoute {\n  filePath: string\n  routePath: string\n  paramNames: string[]\n}\n\nexport interface ManifestAction {\n  filePath: string\n  actionPath: string\n}\n\nexport interface ManifestWebSocket {\n  filePath: string\n  wsPath: string\n}\n\nexport interface TheoManifest {\n  version: 1\n  generatedAt: string\n  routes: ManifestRoute[]\n  actions: ManifestAction[]\n  websockets: ManifestWebSocket[]\n}\n\nexport interface LoadedManifest {\n  routes: ServerRouteNode[]\n  actions: ActionNode[]\n  websockets: WebSocketRouteNode[]\n}\n\n// --- Generate ---\n\nexport function generateManifest(serverDir: string): TheoManifest {\n  const routes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const websockets = scanWebSocketRoutes(serverDir)\n\n  return {\n    version: 1,\n    generatedAt: new Date().toISOString(),\n    routes: routes.map((r) => ({\n      filePath: relative(serverDir, r.filePath),\n      routePath: r.routePath,\n      paramNames: r.paramNames,\n    })),\n    actions: actions.map((a) => ({\n      filePath: relative(serverDir, a.filePath),\n      actionPath: a.actionPath,\n    })),\n    websockets: websockets.map((w) => ({\n      filePath: relative(serverDir, w.filePath),\n      wsPath: w.wsPath,\n    })),\n  }\n}\n\n// --- Write ---\n\nexport function writeManifest(manifest: TheoManifest, outputDir: string): void {\n  mkdirSync(outputDir, { recursive: true })\n  const manifestPath = join(outputDir, 'manifest.json')\n  writeFileSync(manifestPath, JSON.stringify(manifest, null, 2))\n}\n\n// --- Load ---\n\nexport function loadManifest(distDir: string, serverDir: string): LoadedManifest {\n  const manifestPath = join(distDir, 'manifest.json')\n\n  if (!existsSync(manifestPath)) {\n    throw new Error(`No manifest found at ${manifestPath}. Run \"theo build\" first.`)\n  }\n\n  const raw = JSON.parse(readFileSync(manifestPath, 'utf-8')) as TheoManifest\n\n  const routes: ServerRouteNode[] = raw.routes.map((r) => {\n    const { pattern, paramNames } = compilePattern(r.routePath)\n    return {\n      filePath: resolve(serverDir, r.filePath),\n      routePath: r.routePath,\n      paramNames,\n      pattern,\n    }\n  })\n\n  const actions: ActionNode[] = raw.actions.map((a) => ({\n    filePath: resolve(serverDir, a.filePath),\n    actionPath: a.actionPath,\n  }))\n\n  const websockets: WebSocketRouteNode[] = raw.websockets.map((w) => ({\n    filePath: resolve(serverDir, w.filePath),\n    wsPath: w.wsPath,\n  }))\n\n  return { routes, actions, websockets }\n}\n","import type { AgentEvent, AgentErrorEvent } from './agent-types.js'\n\n/**\n * Item #4 — `streamAgentRun`\n *\n * Adapter that consumes the `@usetheo/sdk` `Run.stream()` async generator\n * (SDKMessage variants) and yields TheoKit `AgentEvent`s suitable for SSE\n * via `defineAgentEndpoint`. One line at the consumer side:\n *\n *   ```ts\n *   const run = await agent.send(message)\n *   yield* streamAgentRun(run)\n *   ```\n *\n * Mapping table (SDK → AgentEvent):\n *\n * | SDK message                          | AgentEvent yielded                     |\n * |---|---|\n * | assistant.content[].type==='text'    | { type: 'message', content }           |\n * | assistant.content[].type==='tool_use'| (none — covered by tool_call below)    |\n * | tool_call(status='running')          | { type: 'tool_call', name, args, id }  |\n * | tool_call(status='completed')        | { type: 'tool_result', name, data, id }|\n * | tool_call(status='error')            | { type: 'error', message, id }         |\n * | run.wait() status==='error'          | { type: 'error', message }             |\n * | run.wait() status==='cancelled'      | (none — cancel ≠ error)                |\n * | system / user / thinking / status /  | (none — internal SDK telemetry)        |\n * |   task / request / object_delta      |                                        |\n *\n * Abort semantics: when the consumer calls `generator.return()` on the\n * outer `defineAgentEndpoint` generator, `streamAgentRun` exits the\n * `for await` loop and does NOT call `run.wait()`. Cleanup of in-flight\n * SDK resources is the SDK consumer's responsibility (`run.cancel()`).\n */\n\n/**\n * Local mirror of the SDK's `Run` interface — only the surfaces we consume.\n * The message contract is minimal (just `{ type: string }`) so the SDK's\n * `SDKMessage` discriminated union IS structurally assignable without any\n * cast at the consumer site (covariant — TS accepts the SDK's typed message\n * as the wider `{ type: string }`). Property access inside `streamAgentRun`\n * narrows via runtime type guards.\n *\n * `import type` from `@usetheo/sdk` would couple TheoKit to the SDK at type-\n * resolution time even for consumers who never use the agent surface.\n */\nexport interface AgentRunLike {\n  stream: () => AsyncIterable<{ type: string }>\n  wait: () => Promise<AgentRunResult>\n}\n\n/**\n * Re-exported as a convenience for test fixtures. Production code typically\n * passes an SDK `Run` directly (structural match via `{ type: string }`).\n */\nexport type AgentRunStreamMessage =\n  | {\n      type: 'assistant'\n      message: { role: 'assistant'; content: { type: string; text?: string }[] }\n    }\n  | {\n      type: 'tool_call'\n      name: string\n      status: 'running' | 'completed' | 'error'\n      args?: unknown\n      result?: unknown\n      call_id: string\n    }\n  | { type: string; [k: string]: unknown }\n\n/** Subset of the SDK `RunResult` we consume. */\nexport interface AgentRunResult {\n  status: 'finished' | 'error' | 'cancelled'\n  error?: { message: string; code?: string; cause?: unknown }\n}\n\n/**\n * EC-1 (edge case review): tool result may be a Date, bigint, circular ref,\n * etc. `JSON.stringify` in `encodeSSE` would throw — uncaught inside the\n * outer generator — and `defineAgentEndpoint` would replace the legitimate\n * `tool_result` with a generic `error`. Coerce here so the wire stays honest.\n */\nfunction safeJsonStringify(value: unknown): string {\n  try {\n    return JSON.stringify(value)\n  } catch {\n    return '[Unserializable]'\n  }\n}\n\n/**\n * EC-3 (edge case review): SDK types `args?: unknown`. A raw `as` cast hides\n * the possibility that `msg.args` is an array, primitive, or `null` (null\n * survives `??`). Type-guard BEFORE narrowing to `Record<string, unknown>`.\n */\nfunction safeArgs(args: unknown): Record<string, unknown> {\n  if (typeof args === 'object' && args !== null && !Array.isArray(args)) {\n    return args as Record<string, unknown>\n  }\n  return {}\n}\n\n/**\n * Yield AgentEvents derived from the SDK Run lifecycle.\n *\n * Consumer pattern:\n *\n *   ```ts\n *   export const POST = defineAgentEndpoint({\n *     async *handler({ body }) {\n *       const agent = await Agent.create({ apiKey, model, tools: [...] })\n *       try {\n *         const run = await agent.send(body.message)\n *         yield* streamAgentRun(run)\n *       } finally {\n *         try { await agent.dispose() } catch (e) { console.warn(e) }\n *       }\n *     },\n *   })\n *   ```\n *\n * @public\n */\ninterface AssistantLike {\n  type: 'assistant'\n  message: { role: 'assistant'; content: { type: string; text?: string }[] }\n}\ninterface ToolCallLike {\n  type: 'tool_call'\n  name: string\n  status: 'running' | 'completed' | 'error'\n  args?: unknown\n  result?: unknown\n  call_id: string\n}\n\nfunction isAssistant(msg: { type: string }): msg is AssistantLike {\n  // Wide cast to `unknown` first so runtime null guard survives ESLint\n  // narrowing complaints — the SDK contract permits `null` even when its\n  // TS type does not.\n  const m = msg as unknown as {\n    type: string\n    message?: { content?: unknown } | null\n  }\n  return (\n    m.type === 'assistant' &&\n    m.message != null &&\n    typeof m.message === 'object' &&\n    Array.isArray(m.message.content)\n  )\n}\nfunction isToolCall(msg: { type: string }): msg is ToolCallLike {\n  const t = msg as unknown as {\n    type: string\n    name?: unknown\n    status?: unknown\n    call_id?: unknown\n  }\n  return (\n    t.type === 'tool_call' &&\n    typeof t.name === 'string' &&\n    typeof t.call_id === 'string' &&\n    (t.status === 'running' || t.status === 'completed' || t.status === 'error')\n  )\n}\n\n/**\n * Phase 4 — Production-Readiness #3: structural mirror of SDK's AgentRunError.\n *\n * EC-6 (SHOULD TEST): we only require `code: string` to discriminate.\n * Provider, retriable, retryAfterMs, requestId are all optional — SDK error\n * paths may omit them (e.g., aborted before request, tool runtime error).\n */\ninterface AgentRunErrorLike {\n  message: string\n  code: string\n  provider?: string\n  retriable?: boolean\n  retryAfterMs?: number\n  requestId?: string\n  /**\n   * EC-15 (DOCUMENT) + invariant: `providerError` is QUARANTINED. We read it\n   * for type-narrowing but NEVER serialize into the AgentEvent — leaking the\n   * raw provider response could leak API keys, internal endpoints, or PII.\n   * Only sanitized fields above flow to the SSE wire. `error.message` is\n   * trusted to not contain secrets (SDK's responsibility per the v1.1.0\n   * release contract).\n   */\n  providerError?: unknown\n}\n\n/**\n * EC-6 (SHOULD TEST): minimal type guard — only requires `code: string`.\n * Does NOT require `'provider' in err` because the SDK throws AgentRunErrors\n * without `provider` in local error paths (timeout, tool runtime error,\n * aborted-before-call).\n */\nfunction isAgentRunError(err: unknown): err is AgentRunErrorLike {\n  if (!(err instanceof Error)) return false\n  const e = err as { code?: unknown }\n  return 'code' in e && typeof e.code === 'string'\n}\n\n/**\n * Map an SDK error to the AgentErrorEvent shape. Pure function — easy to test.\n *\n * Backward compat (D4): non-AgentRunError throws yield only `message` field\n * (legacy shape); discriminated fields stay `undefined`.\n *\n * Return type is the specific `AgentErrorEvent` (not the union) for ergonomic\n * call-site access — `errorToEvent(err).code` works without narrowing.\n */\nexport function errorToEvent(err: unknown, id?: string): AgentErrorEvent {\n  if (isAgentRunError(err)) {\n    const event: AgentErrorEvent = {\n      type: 'error',\n      message: err.message,\n      code: err.code,\n    }\n    if (err.provider !== undefined) event.provider = err.provider\n    if (err.retriable !== undefined) event.retriable = err.retriable\n    if (err.retryAfterMs !== undefined) event.retryAfterMs = err.retryAfterMs\n    if (id !== undefined) event.id = id\n    return event\n  }\n  // Fallback for non-AgentRunError throws (plain Error, string, plain object with message)\n  let message: string\n  if (err instanceof Error) {\n    message = err.message\n  } else if (typeof err === 'string') {\n    message = err\n  } else if (err !== null && typeof err === 'object' && 'message' in err) {\n    const candidate: unknown = (err as Record<string, unknown>).message\n    // Plain object with `message: string` — common for SDK status:error payloads\n    message = typeof candidate === 'string' ? candidate : '[object Object]'\n  } else if (err === null || err === undefined) {\n    message = String(err)\n  } else {\n    message = '[non-stringifiable error]'\n  }\n  const event: AgentErrorEvent = { type: 'error', message }\n  if (id !== undefined) event.id = id\n  return event\n}\n\nfunction yieldFromToolCall(msg: ToolCallLike): AgentEvent {\n  if (msg.status === 'running') {\n    return {\n      type: 'tool_call',\n      name: msg.name,\n      args: safeArgs(msg.args),\n      id: msg.call_id,\n    }\n  }\n  if (msg.status === 'completed') {\n    const data = typeof msg.result === 'string' ? msg.result : safeJsonStringify(msg.result)\n    return {\n      type: 'tool_result',\n      name: msg.name,\n      data,\n      id: msg.call_id,\n    }\n  }\n  // status === 'error' — exhaustive by type\n  const message = typeof msg.result === 'string' ? msg.result : `Tool ${msg.name} failed`\n  return { type: 'error', message, id: msg.call_id }\n}\n\nexport async function* streamAgentRun(\n  run: AgentRunLike,\n): AsyncGenerator<AgentEvent, void, unknown> {\n  for await (const msg of run.stream()) {\n    if (isAssistant(msg)) {\n      for (const block of msg.message.content) {\n        if (block.type === 'text' && typeof block.text === 'string' && block.text.length > 0) {\n          yield { type: 'message', content: block.text }\n        }\n      }\n    } else if (isToolCall(msg)) {\n      yield yieldFromToolCall(msg)\n    }\n    // SDK-internal variants (system, user, thinking, status, task,\n    // request, object_delta) are intentionally not yielded.\n  }\n\n  const result = await run.wait()\n  if (result.status === 'error' && result.error !== undefined) {\n    yield errorToEvent(result.error)\n  }\n}\n","/**\n * Provider Resolver — Strategy + Registry pattern (FAANG-grade).\n *\n * Inspiração: Dapr Conversation Registry (`dapr/pkg/components/conversation/registry.go`)\n * + Encore Manager provider array (`encore/runtimes/go/pubsub/manager_internal.go`).\n *\n * Princípio: provider routing é responsabilidade do FRAMEWORK, não do consumer.\n * Consumer template usa `model: { id: 'gpt-4o-mini' }` puro — sem conditionals.\n *\n * Wire protocol: OpenAI Chat Completions (universal — implementado por todos\n * os providers: OpenRouter, Groq, Mistral, Together, Anthropic via proxy, etc).\n *\n * Resolução por prioridade (FIRST match wins):\n *   1. OPENROUTER_API_KEY → baseUrl=openrouter.ai (gateway multi-modelo)\n *   2. OPENAI_API_KEY     → baseUrl=api.openai.com\n *   3. ANTHROPIC_API_KEY  → direct Anthropic (Messages API, não OpenAI-compat)\n *\n * Escape hatch: `options.apiKey` explícito SOBREPÕE auto-resolution\n * (consumer pode forçar provider específico se quiser).\n */\n\n/**\n * Provider configuration descriptor — Registry entry shape.\n *\n * @public\n */\nexport interface ProviderDescriptor {\n  /** Stable name used internally — não exposto no wire. */\n  name: string\n  /** Environment variable that holds the API key for this provider. */\n  envKey: string\n  /** Base URL for the provider's OpenAI-compatible (or native) API. */\n  baseUrl: string\n  /** Resolution priority (lower = higher priority). FIRST match wins. */\n  priority: number\n}\n\n/**\n * Resolved provider configuration — output of `resolveProvider()`.\n *\n * @public\n */\nexport interface ResolvedProvider {\n  name: string\n  apiKey: string\n  baseUrl: string\n}\n\n/**\n * Default provider registry. Order = priority (first = highest).\n *\n * Adding a new provider:\n *   1. Append entry below (or register via `registerProvider()`).\n *   2. Set `envKey` matching the user's env var convention.\n *   3. Set `baseUrl` to the OpenAI-compat endpoint (or native if not compat).\n *   4. Provider name used in telemetry/logs only — never wire-exposed.\n */\nconst DEFAULT_REGISTRY: ProviderDescriptor[] = [\n  {\n    name: 'openrouter',\n    envKey: 'OPENROUTER_API_KEY',\n    baseUrl: 'https://openrouter.ai/api/v1',\n    priority: 1,\n  },\n  {\n    name: 'openai',\n    envKey: 'OPENAI_API_KEY',\n    baseUrl: 'https://api.openai.com/v1',\n    priority: 2,\n  },\n  {\n    name: 'anthropic',\n    envKey: 'ANTHROPIC_API_KEY',\n    baseUrl: 'https://api.anthropic.com',\n    priority: 3,\n  },\n]\n\n/**\n * Runtime registry — copy of DEFAULT_REGISTRY mutable via registerProvider().\n * Sorted by priority on every resolve (stable, O(n log n) — n <= ~10 providers).\n */\nconst registry: ProviderDescriptor[] = [...DEFAULT_REGISTRY]\n\n/**\n * Register a new provider (Registry pattern — runtime extension point).\n * Useful for self-hosted endpoints or custom providers without touching theokit src.\n *\n * @example\n * registerProvider({\n *   name: 'self-hosted',\n *   envKey: 'SELF_HOSTED_API_KEY',\n *   baseUrl: 'https://llm.internal.acme.com/v1',\n *   priority: 0, // highest priority\n * })\n *\n * @public\n */\nexport function registerProvider(descriptor: ProviderDescriptor): void {\n  // Idempotent — replace existing by name.\n  const idx = registry.findIndex((p) => p.name === descriptor.name)\n  if (idx >= 0) registry[idx] = descriptor\n  else registry.push(descriptor)\n}\n\n/**\n * Reset registry to DEFAULT_REGISTRY (test-only / dev escape hatch).\n *\n * @public\n */\nexport function resetProviderRegistry(): void {\n  registry.length = 0\n  registry.push(...DEFAULT_REGISTRY)\n}\n\n/**\n * Get current registry snapshot (read-only — inspection).\n *\n * @public\n */\nexport function listProviders(): readonly ProviderDescriptor[] {\n  return [...registry].sort((a, b) => a.priority - b.priority)\n}\n\n/**\n * Resolve provider from env vars by priority. FIRST env var found wins.\n *\n * @returns ResolvedProvider with apiKey + baseUrl + name\n * @throws Error if NO provider env var is set (actionable message)\n *\n * @public\n */\nexport function resolveProvider(): ResolvedProvider {\n  const sorted = [...registry].sort((a, b) => a.priority - b.priority)\n  for (const desc of sorted) {\n    const apiKey = process.env[desc.envKey]\n    if (apiKey && apiKey.length > 0) {\n      return {\n        name: desc.name,\n        apiKey,\n        baseUrl: desc.baseUrl,\n      }\n    }\n  }\n  // No env var found — emit actionable error.\n  const envKeys = sorted.map((p) => p.envKey).join(' OR ')\n  throw new Error(\n    `No LLM provider API key found in environment. Set one of: ${envKeys}. ` +\n      `Get a free OpenRouter key at https://openrouter.ai/keys (recommended — one key, many models).`,\n  )\n}\n\n/**\n * Try to resolve — does NOT throw. Returns null if no provider available.\n * Useful for graceful degradation (e.g., mock mode).\n *\n * @public\n */\nexport function tryResolveProvider(): ResolvedProvider | null {\n  try {\n    return resolveProvider()\n  } catch {\n    return null\n  }\n}\n","/**\n * Item #5 — `createConversationHistory`\n *\n * Orchestrator that resolves a stable `agentId` from (explicit → session →\n * cookie → fresh UUID), then returns an `@usetheo/sdk` `Agent` via\n * `Agent.getOrCreate(agentId, options)`. Conversation turns auto-persist in\n * `<cwd>/.theokit/agents/<agentId>/messages.jsonl` — SDK owns the storage\n * (ADR D1). `MemorySettings` (facts recall layer) is opt-in passthrough via\n * `options.memory` (ADR D2).\n *\n * Security: agentId from cookie/explicit is attacker-controlled. The SDK\n * uses it as a filesystem path component AND we serialize it into Set-Cookie.\n * EC-1 enforces a strict regex `^[a-zA-Z0-9_-]{1,128}$` at every entry point;\n * invalid values fall through (treated as \"missing\") rather than throw.\n */\n\nimport { tryResolveProvider } from './provider-resolver.js'\n\n// ──────────────────────────────────────────────────────────────────────────\n// Structural types — mirrors of SDK shapes we don't want to hard-import\n// (the SDK is an OPTIONAL peer per item #4's stance).\n// ──────────────────────────────────────────────────────────────────────────\n\n/**\n * Minimum surface of an SDK Agent that consumers care about post-creation.\n * Structural match — any object with `send` + `dispose` of compatible\n * shape works. `send` returns a `SdkRunLike` (a Run-shaped object) that\n * `streamAgentRun` can consume. Permissive `unknown` for now; consumers\n * who want stricter types can cast to the SDK's own types.\n *\n * **T5.2 (architecture-cleanup) — DP-7 decision: KEEP (Opt B).** The 5 duck-typed\n * mirrors below were flagged as \"over-engineered\" by the 2026-05-27 architecture\n * review. Decision: KEEP them because `@usetheo/sdk` is `devDependency` (not\n * required at runtime for consumers that don't use agent features). Removing\n * the mirrors would force a hard runtime dep on the SDK, breaking consumers\n * who build TheoKit apps without the agent layer.\n *\n * @kept Defensive duck-type. Do NOT replace with direct SDK type imports unless\n *   `@usetheo/sdk` is promoted from devDependency to dependency. If promoting,\n *   ALSO drop the mirrors (Opt A from the architecture-cleanup plan T5.2).\n */\nexport interface SdkRunLike {\n  stream: () => AsyncIterable<{ type: string }>\n  wait: () => Promise<{ status: 'finished' | 'error' | 'cancelled'; error?: { message: string } }>\n}\n\nexport interface SdkAgent {\n  send: (message: string, options?: unknown) => Promise<SdkRunLike>\n  dispose: () => Promise<void>\n}\n\n/**\n * Phase 2 — structural duck-type of `@usetheo/sdk`'s `ConversationStorageAdapter`.\n *\n * D2 (decoupling): we mirror the SDK's shape locally rather than hard-import\n * the SDK type. This lets consumers pass any object matching the structural\n * contract (own implementation, SDK's `FileSystemConversationStorage`,\n * `InMemoryConversationStorage`, or a Postgres/Redis recipe).\n *\n * EC-5 (SHOULD TEST — sync drift detection): the SDK type MUST be assignable\n * to this interface AND vice-versa. A contract test asserts both directions.\n *\n * `unknown` for the message payload avoids coupling to the SDK's `SDKMessage`\n * shape. Real consumers cast at the call site if they need stricter types.\n */\nexport interface ConversationStorageLike {\n  getMessages(conversationId: string): Promise<readonly unknown[]>\n  appendMessage(conversationId: string, message: unknown): Promise<void>\n  deleteConversation(conversationId: string): Promise<void>\n  listConversationIds?(opts?: { limit?: number }): Promise<readonly string[] | undefined>\n  dispose?(): Promise<void>\n}\n\n/**\n * Minimum surface of `AgentOptions` accepted by `Agent.getOrCreate`. Forward-\n * compatible: callers pass whatever the SDK supports (memory, tools, etc.).\n *\n * Phase 2 adds typed `conversationStorage` slot. The index signature still\n * passes everything else opaquely.\n */\nexport interface SdkAgentOptions {\n  apiKey?: string\n  model?: { id: string }\n  tools?: readonly unknown[]\n  memory?: Record<string, unknown>\n  /**\n   * Phase 2 (Production-Readiness #1) — pluggable conversation persistence.\n   * Default (when omitted): SDK falls back to `FileSystemConversationStorage`.\n   * Required for serverless / multi-host deploys.\n   */\n  conversationStorage?: ConversationStorageLike\n  [key: string]: unknown\n}\n\ninterface SdkModule {\n  Agent: {\n    getOrCreate: (agentId: string, options: SdkAgentOptions) => Promise<SdkAgent>\n  }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Public API\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface ConversationHistoryArgs {\n  /** Request — for reading the conversation cookie. */\n  request: Request | { headers?: { cookie?: string } | Headers }\n  /**\n   * Response-like surface that accepts a `Set-Cookie` header. The primitive\n   * appends a Set-Cookie line when issuing a new conversation id. If absent,\n   * the primitive still reads the existing cookie but cannot issue a new\n   * one — useful for read-only contexts.\n   */\n  response?: { headers: Headers }\n  /** Explicit override — wins over session/cookie/uuid (ADR D3 step 1). */\n  agentId?: string\n  /** Auth session containing a `conversationId` field — ADR D3 step 2. */\n  session?: { conversationId?: string } | null\n  /** SDK AgentOptions forwarded to Agent.getOrCreate. apiKey + model required. */\n  options: SdkAgentOptions\n  /** Cookie name override. Default: 'theo_conversation'. */\n  cookieName?: string\n  /** Cookie max-age in seconds. Default + min: 30 days. Non-positive coerced to default (EC-4). */\n  cookieMaxAge?: number\n}\n\nexport interface ConversationHistoryResult {\n  /** The SDK Agent, ready to receive `agent.send(message)`. */\n  agent: SdkAgent\n  /** The resolved conversation id (useful for logging / debugging). */\n  conversationId: string\n  /** True when the id was newly generated (no prior cookie / session). */\n  isNew: boolean\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Test seam — allows unit tests to swap the SDK without dynamic import flake.\n// Underscore-prefixed: NOT part of the public contract.\n// ──────────────────────────────────────────────────────────────────────────\n\nlet sdkOverride: SdkModule | null | undefined = undefined\n\n/** @internal */\nexport function __setSdkForTests(sdk: SdkModule | null): void {\n  sdkOverride = sdk\n}\n\n/** @internal */\nexport function __resetSdkForTests(): void {\n  sdkOverride = undefined\n}\n\nasync function loadSdk(): Promise<SdkModule> {\n  // EC-2 (edge case review — MUST FIX): the SDK is an optional peer; if the\n  // consumer never installed it, `import('@usetheo/sdk')` throws\n  // ERR_MODULE_NOT_FOUND. Re-throw with an actionable message.\n  if (sdkOverride === null) {\n    throw new Error(\n      'createConversationHistory requires @usetheo/sdk. Install: pnpm add @usetheo/sdk',\n    )\n  }\n  if (sdkOverride !== undefined) return sdkOverride\n  try {\n    // Use `createRequire` — Node's CJS-style require resolves against the\n    // process's actual node_modules tree, bypassing Vite's SSR import-\n    // analysis pipeline. The dynamic ESM `import()` path got intercepted\n    // by Vite's `vite:import-analysis` plugin and failed to find the SDK\n    // even when it was installed; createRequire goes straight to Node.\n    //\n    // The SDK ships dual ESM+CJS (per its tsup build), so `require` yields\n    // the same module the ESM `import` would.\n    const { createRequire } = await import('node:module')\n    const requireFn = createRequire(import.meta.url)\n    const spec = '@usetheo/sdk'\n    const mod = requireFn(spec) as unknown as SdkModule\n    return mod\n  } catch (cause) {\n    throw new Error(\n      'createConversationHistory requires @usetheo/sdk. Install: pnpm add @usetheo/sdk',\n      { cause },\n    )\n  }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Implementation\n// ──────────────────────────────────────────────────────────────────────────\n\nconst DEFAULT_COOKIE_NAME = 'theo_conversation'\nconst DEFAULT_COOKIE_MAX_AGE = 60 * 60 * 24 * 30 // 30 days\n\n/**\n * EC-1 (edge case review — MUST FIX): the agentId becomes a filesystem path\n * component (`<cwd>/.theokit/agents/<agentId>/messages.jsonl`) inside the SDK\n * AND is serialized into a Set-Cookie header. The SDK does NOT validate the\n * char set. An attacker setting `Cookie: theo_conversation=../../../etc/passwd`\n * could trigger arbitrary-path writes; an `agentId` with CRLF would inject\n * HTTP headers. The same regex kills both attacks.\n */\nconst AGENT_ID_REGEX = /^[a-zA-Z0-9_-]{1,128}$/\n\nfunction isValidAgentId(s: string | undefined | null): s is string {\n  return typeof s === 'string' && AGENT_ID_REGEX.test(s)\n}\n\n/**\n * Minimal RFC 6265 cookie parser. Returns the FIRST occurrence of `name`\n * (EC-5 — pins first-wins behavior).\n */\nfunction readCookieValue(\n  request: ConversationHistoryArgs['request'],\n  name: string,\n): string | undefined {\n  let raw: string | undefined\n  const h = request.headers\n  if (h === undefined) return undefined\n  if (typeof (h as Headers).get === 'function') {\n    raw = (h as Headers).get('cookie') ?? undefined\n  } else {\n    raw = (h as { cookie?: string }).cookie\n  }\n  if (raw === undefined || raw.length === 0) return undefined\n  const pairs = raw.split(/[;,]/)\n  for (const pair of pairs) {\n    const eq = pair.indexOf('=')\n    if (eq < 0) continue\n    const k = pair.slice(0, eq).trim()\n    if (k === name) return pair.slice(eq + 1).trim()\n  }\n  return undefined\n}\n\ninterface SerializeCookieOptions {\n  httpOnly?: boolean\n  sameSite?: 'lax' | 'strict' | 'none'\n  maxAge?: number\n  path?: string\n}\n\nfunction serializeCookie(name: string, value: string, options: SerializeCookieOptions): string {\n  const parts: string[] = [`${name}=${value}`]\n  if (options.path !== undefined) parts.push(`Path=${options.path}`)\n  if (options.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`)\n  if (options.sameSite !== undefined) {\n    const v = options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1)\n    parts.push(`SameSite=${v}`)\n  }\n  if (options.httpOnly === true) parts.push('HttpOnly')\n  return parts.join('; ')\n}\n\nexport async function createConversationHistory(\n  args: ConversationHistoryArgs,\n): Promise<ConversationHistoryResult> {\n  const cookieName = args.cookieName ?? DEFAULT_COOKIE_NAME\n  // EC-4 (edge case review — SHOULD TEST): coerce non-positive to default.\n  // The `??` operator alone would let `0` through, producing `Max-Age=0`\n  // which means \"delete cookie immediately\" — almost certainly not intent.\n  const rawMaxAge = args.cookieMaxAge\n  const cookieMaxAge =\n    typeof rawMaxAge === 'number' && rawMaxAge > 0 ? rawMaxAge : DEFAULT_COOKIE_MAX_AGE\n\n  // 1. Resolve agentId per ADR D3 — sources are validated; invalid values\n  //    fall through (treated as \"missing\") rather than throw.\n  let conversationId: string | undefined\n  let isNew = false\n  const cookieOnRequest = readCookieValue(args.request, cookieName)\n\n  if (isValidAgentId(args.agentId)) {\n    conversationId = args.agentId\n  } else if (args.session !== null && args.session !== undefined) {\n    const sId = args.session.conversationId\n    if (isValidAgentId(sId)) conversationId = sId\n  }\n  if (conversationId === undefined && isValidAgentId(cookieOnRequest)) {\n    conversationId = cookieOnRequest\n  }\n\n  if (conversationId === undefined) {\n    conversationId = crypto.randomUUID()\n    isNew = true\n  }\n\n  // Issue (or refresh) the cookie when:\n  //   1. The id was newly generated (no source had it), OR\n  //   2. The request's cookie does NOT match the resolved id (explicit\n  //      `agentId` override, session-derived id, etc.). Without this,\n  //      callers that pre-probe the id (e.g. to build agentId-scoped tools)\n  //      and pass it via `agentId` would never get a Set-Cookie even on\n  //      first visit. Net effect: every response with a `response` slot\n  //      ensures the browser ends up with a cookie that matches the\n  //      resolved id.\n  const shouldIssueCookie = isNew || cookieOnRequest !== conversationId\n  if (shouldIssueCookie && args.response !== undefined) {\n    const cookie = serializeCookie(cookieName, conversationId, {\n      httpOnly: true,\n      sameSite: 'lax',\n      maxAge: cookieMaxAge,\n      path: '/',\n    })\n    args.response.headers.append('set-cookie', cookie)\n  }\n\n  // 2. Auto-resolve provider via Strategy pattern (FAANG-grade — zero\n  //    conditionals no consumer). If `options.apiKey` ausente, lê env vars\n  //    priorizadas (OPENROUTER > OPENAI > ANTHROPIC) e injeta apiKey +\n  //    providers.baseUrl. Consumer override: passar `options.apiKey` explícito\n  //    SOBREPÕE o auto-resolve (escape hatch). Ver `provider-resolver.ts` +\n  //    Dapr Conversation Registry pattern (`referencias/dapr/pkg/components/conversation/`).\n  const resolvedOptions = autoResolveProviderIfNeeded(args.options)\n\n  // 3. Resolve the agent via SDK.\n  const sdk = await loadSdk()\n  const agent = await sdk.Agent.getOrCreate(conversationId, resolvedOptions)\n\n  return { agent, conversationId, isNew }\n}\n\n/**\n * Auto-inject provider config (apiKey + baseUrl) via Strategy pattern when\n * consumer didn't pass apiKey explicit. Idempotent — se apiKey já set, noop.\n *\n * Output shape:\n *   {\n *     ...originalOptions,\n *     apiKey: '<from-env>',\n *     providers: { routes: [{ capability: 'chat', provider: '<resolved-name>', ... }] }\n *   }\n */\nfunction autoResolveProviderIfNeeded(options: SdkAgentOptions): SdkAgentOptions {\n  // Escape hatch — consumer override wins.\n  if (typeof options.apiKey === 'string' && options.apiKey.length > 0) {\n    return options\n  }\n  // Auto-resolve via Strategy registry.\n  //\n  // Finding A workaround (sdk-residual-behavior-2026-05-28): SDK silently\n  // returns canned \"Hello! How can I assist you today?\" content when no\n  // apiKey AND no provider env vars are present. Fail-fast HERE with an\n  // actionable error — template's try/catch yields `{type:'error'}` SSE\n  // event so consumer sees what's wrong.\n  const resolved = tryResolveProvider()\n  if (resolved === null) {\n    throw new Error(\n      'No LLM provider API key found in environment. ' +\n        'Set OPENROUTER_API_KEY (recommended — gateway to many models) OR ' +\n        'OPENAI_API_KEY OR ANTHROPIC_API_KEY in your .env. ' +\n        'Get a free OpenRouter key at https://openrouter.ai/keys. ' +\n        '(Pass `options.apiKey` explicitly to bypass auto-resolution.)',\n    )\n  }\n  // Inject apiKey + provider routing. SDK ProviderRoutingSettings shape.\n  // Note: we use `chat` capability since this is the conversation primitive;\n  // SDK may extend to embeddings/etc — those routes are separate concerns.\n  return {\n    ...options,\n    apiKey: resolved.apiKey,\n    providers: {\n      routes: [\n        { capability: 'chat', provider: resolved.name, baseUrl: resolved.baseUrl },\n      ],\n    },\n  } as SdkAgentOptions\n}\n","import { createHash } from 'node:crypto'\nimport type { IncomingMessage } from 'node:http'\n\nimport { parseCookieHeader } from '../http/cookies.js'\n\nimport { InMemoryStore, type RateLimitStore } from './rate-limit-store.js'\nimport type { RateLimitConfig, RateLimitResult } from './rate-limit.js'\n\n/**\n * T2.2 — Per-route + per-user rate limiting.\n *\n * Layered on top of `rate-limit-store.ts`. The route map allows\n * declarative policies (\"strict /api/login, loose everything else\")\n * driven by config, not handler-decorated. `keyBy` selects what\n * identifier the limiter buckets on.\n *\n * ADR D2: per-route via path matching, NOT per-handler decorator.\n * Operators can tune policies without touching route definitions.\n */\n\nexport type KeyByMode = 'ip' | 'session' | 'user' | ((req: IncomingMessage) => string)\n\nexport interface RouteRateLimitConfig {\n  /** Fallback config used when no per-route entry matches. */\n  default?: RateLimitConfig\n  /** Map of path pattern → config. Exact-string keys (RegExp via API). */\n  routes?: Record<string, RateLimitConfig>\n  /** Same as `routes` but each entry is a [pattern, config] tuple, RegExp allowed. */\n  routePatterns?: readonly [string | RegExp, RateLimitConfig][]\n  /** Bucket identifier strategy. Default 'ip'. */\n  keyBy?: KeyByMode\n  /** Cookie name used by keyBy='session'. Defaults to 'theo_session'. */\n  cookieName?: string\n  /** Optional shared store (for multi-route correlation). Default per-limiter InMemoryStore. */\n  store?: RateLimitStore\n}\n\n/**\n * Normalize a path for matching: strip query string, drop trailing slash\n * unless root. EC-5: `/api/login` and `/api/login/` collapse to the same\n * canonical form so attackers can't bypass strict limits.\n */\nfunction normalizePath(input: string): string {\n  const noQuery = input.split('?')[0]\n  if (noQuery.length > 1 && noQuery.endsWith('/')) return noQuery.slice(0, -1)\n  return noQuery\n}\n\n/**\n * Test whether `path` matches `pattern`. String patterns are compared\n * after trailing-slash normalization (EC-5). RegExp uses `.test` after\n * resetting `lastIndex` (defensive against `/g` flag).\n */\nexport function matchRoutePattern(path: string, pattern: string | RegExp): boolean {\n  const canonical = normalizePath(path)\n  if (typeof pattern === 'string') {\n    return canonical === normalizePath(pattern)\n  }\n  pattern.lastIndex = 0\n  return pattern.test(canonical)\n}\n\n/**\n * Hash a string with SHA-256 and return the first 16 base64url chars.\n * Used by `keyBy='session'` so the raw cookie value never lands in a\n * rate-limit key (which may flow into audit logs).\n */\nfunction hashFragment(input: string): string {\n  return createHash('sha256').update(input).digest('base64url').slice(0, 16)\n}\n\n// T3.2 DRY consolidation: cookie parsing moved to ../http/cookies.ts.\n// The canonical `parseCookieHeader` returns a Map for O(1) lookup; this\n// wrapper preserves the original `readCookie(req, name)` signature so the\n// rest of the file stays untouched.\nfunction readCookie(req: IncomingMessage, name: string): string | undefined {\n  return parseCookieHeader(req.headers.cookie ?? undefined).get(name)\n}\n\n/**\n * Build the rate-limit bucket key for the request based on `keyBy`.\n *\n * EC-6: session mode reads the configured `cookieName`. With the wrong\n * cookie name (e.g., default 'theo_session' but app uses 'app_session'),\n * we fall back to IP so anonymous users still get rate-limited rather\n * than sharing an empty bucket.\n */\nexport function deriveKey(req: IncomingMessage, keyBy: KeyByMode, cookieName: string): string {\n  if (typeof keyBy === 'function') return keyBy(req)\n  // `req.socket` is typed as always-present in Node typings, but in test\n  // doubles (object literals without `socket`) it can be missing — the\n  // optional chain keeps the fallback path reachable.\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- defensive for test doubles\n  const ip = req.socket?.remoteAddress ?? 'unknown'\n  switch (keyBy) {\n    case 'session': {\n      const cookie = readCookie(req, cookieName)\n      return cookie ? `session:${hashFragment(cookie)}` : `ip:${ip}`\n    }\n    case 'user': {\n      const userId = (req as unknown as { user?: { id?: string } }).user?.id\n      return userId ? `user:${userId}` : `ip:${ip}`\n    }\n    case 'ip':\n    default:\n      return `ip:${ip}`\n  }\n}\n\n/**\n * Per-route rate limiter factory. Returns a sync checker compatible with\n * the existing api-middleware shape.\n *\n * Backwards-compatibility (ADR D2): a flat `{ windowMs, max }` config is\n * accepted and treated as `default` (no per-route variants).\n */\nexport function createRouteRateLimiter(config: RouteRateLimitConfig | RateLimitConfig) {\n  // Detect legacy flat shape\n  const isFlat =\n    'windowMs' in config && 'max' in config && !('default' in config) && !('routes' in config)\n  const cfg: RouteRateLimitConfig = isFlat ? { default: config } : config\n\n  const store = cfg.store ?? new InMemoryStore()\n  // CR-005: validate store shape ONCE at construction. The previous\n  // implementation ran `instanceof InMemoryStore` on every request and\n  // threw at request-time if a non-InMemoryStore was passed — which\n  // turned a clear config error into a runtime 500 on the first request.\n  if (!(store instanceof InMemoryStore)) {\n    throw new Error(\n      'createRouteRateLimiter: async RateLimitStore implementations require a dedicated async middleware path. ' +\n        'Use the InMemoryStore default for the sync façade.',\n    )\n  }\n  const inMemoryStore = store\n  const keyBy = cfg.keyBy ?? 'ip'\n  const cookieName = cfg.cookieName ?? 'theo_session'\n\n  // Build a pre-compiled list of (pattern, config) tuples for matching.\n  const patternList: [string | RegExp, RateLimitConfig][] = []\n  if (cfg.routes) {\n    for (const [pattern, c] of Object.entries(cfg.routes)) patternList.push([pattern, c])\n  }\n  if (cfg.routePatterns) {\n    for (const tuple of cfg.routePatterns) patternList.push(tuple)\n  }\n\n  return function checkRouteRateLimit(req: IncomingMessage): RateLimitResult {\n    const url = req.url ?? ''\n    let matched: RateLimitConfig | undefined\n    for (const [pattern, c] of patternList) {\n      if (matchRoutePattern(url, pattern)) {\n        matched = c\n        break\n      }\n    }\n    const effective = matched ?? cfg.default\n    if (!effective) {\n      // No route match + no default → not limited.\n      return { limited: false, headers: {} }\n    }\n\n    // Bucket key includes normalized path so /api/login and /api/login/\n    // collapse to the same bucket (EC-5).\n    const bucketSuffix = typeof matched === 'undefined' ? '*default*' : normalizePath(url)\n    const key = `${deriveKey(req, keyBy, cookieName)}|${bucketSuffix}`\n    const state = inMemoryStore.incrSync(key, effective.windowMs)\n\n    if (state.count > effective.max) {\n      const retryAfter = Math.ceil((state.resetAt - Date.now()) / 1000)\n      return {\n        limited: true,\n        headers: {\n          'X-RateLimit-Limit': String(effective.max),\n          'X-RateLimit-Remaining': '0',\n          'Retry-After': String(retryAfter),\n        },\n      }\n    }\n    return {\n      limited: false,\n      headers: {\n        'X-RateLimit-Limit': String(effective.max),\n        'X-RateLimit-Remaining': String(Math.max(0, effective.max - state.count)),\n      },\n    }\n  }\n}\n","import type { WebSocketLike } from '../define/define-websocket.js'\n\nexport class ChannelManager {\n  private rooms = new Map<string, Set<WebSocketLike>>()\n  private wsRooms = new Map<WebSocketLike, Set<string>>()\n\n  subscribe(ws: WebSocketLike, room: string): void {\n    let roomSet = this.rooms.get(room)\n    if (!roomSet) {\n      roomSet = new Set()\n      this.rooms.set(room, roomSet)\n    }\n    roomSet.add(ws)\n\n    let wsSet = this.wsRooms.get(ws)\n    if (!wsSet) {\n      wsSet = new Set()\n      this.wsRooms.set(ws, wsSet)\n    }\n    wsSet.add(room)\n  }\n\n  unsubscribe(ws: WebSocketLike, room: string): void {\n    this.rooms.get(room)?.delete(ws)\n    if (this.rooms.get(room)?.size === 0) this.rooms.delete(room)\n\n    this.wsRooms.get(ws)?.delete(room)\n    if (this.wsRooms.get(ws)?.size === 0) this.wsRooms.delete(ws)\n  }\n\n  broadcast(room: string, data: unknown, exclude?: WebSocketLike): void {\n    const clients = this.rooms.get(room)\n    if (!clients) return\n\n    const msg = JSON.stringify(data)\n    for (const ws of clients) {\n      if (ws !== exclude) ws.send(msg)\n    }\n  }\n\n  broadcastAll(data: unknown): void {\n    const msg = JSON.stringify(data)\n    const seen = new Set<WebSocketLike>()\n    for (const clients of this.rooms.values()) {\n      for (const ws of clients) {\n        if (!seen.has(ws)) {\n          ws.send(msg)\n          seen.add(ws)\n        }\n      }\n    }\n  }\n\n  getRoomSize(room: string): number {\n    return this.rooms.get(room)?.size ?? 0\n  }\n\n  cleanup(ws: WebSocketLike): void {\n    const rooms = this.wsRooms.get(ws)\n    if (rooms) {\n      for (const room of rooms) {\n        this.rooms.get(room)?.delete(ws)\n        if (this.rooms.get(room)?.size === 0) this.rooms.delete(room)\n      }\n    }\n    this.wsRooms.delete(ws)\n  }\n}\n","/**\n * T2.2 — In-memory bounded counter for CSRF warn events.\n *\n * Aggregates `csrf.warn` payloads by `(method, path, reason)` triple.\n * Used by the `/__theo/csrf-readiness` endpoint to expose a summary the\n * developer (or devtools tab) can inspect, so users do NOT need to grep\n * stdout to know which endpoints will break under 0.3.0 strict CSRF.\n *\n * Bounded at 1000 distinct keys (EC-22). Eviction is LRU-by-insertion —\n * when the cap is hit, the oldest key is dropped and a re-record of an\n * evicted key starts fresh (count: 1).\n *\n * Single-threaded by virtue of the JS event loop; Map operations are\n * atomic. NOT shared across processes — each worker has its own store.\n */\n\nexport interface CsrfWarnRecord {\n  method: string\n  path: string\n  reason: string\n}\n\nexport interface CsrfReadinessRouteSummary {\n  method: string\n  path: string\n  reason: string\n  count: number\n  firstSeen: string\n  lastSeen: string\n}\n\nexport interface CsrfReadinessSummary {\n  generatedAt: string\n  totalEvents: number\n  routes: CsrfReadinessRouteSummary[]\n}\n\ninterface StoredEntry {\n  count: number\n  firstSeen: string\n  lastSeen: string\n}\n\nexport class CsrfReadinessStore {\n  static readonly MAX_ENTRIES = 1000\n  private readonly entries = new Map<string, StoredEntry>()\n\n  private keyFor(event: CsrfWarnRecord): string {\n    return `${event.method}\u0000${event.path}\u0000${event.reason}`\n  }\n\n  record(event: CsrfWarnRecord): void {\n    const key = this.keyFor(event)\n    const now = new Date().toISOString()\n    const existing = this.entries.get(key)\n    if (existing) {\n      existing.count++\n      existing.lastSeen = now\n      return\n    }\n    if (this.entries.size >= CsrfReadinessStore.MAX_ENTRIES) {\n      const firstKey = this.entries.keys().next().value\n      if (firstKey !== undefined) this.entries.delete(firstKey)\n    }\n    this.entries.set(key, { count: 1, firstSeen: now, lastSeen: now })\n  }\n\n  summary(): CsrfReadinessSummary {\n    let total = 0\n    const routes: CsrfReadinessRouteSummary[] = []\n    for (const [key, entry] of this.entries) {\n      const [method, path, reason] = key.split('\u0000')\n      routes.push({\n        method,\n        path,\n        reason,\n        count: entry.count,\n        firstSeen: entry.firstSeen,\n        lastSeen: entry.lastSeen,\n      })\n      total += entry.count\n    }\n    return {\n      generatedAt: new Date().toISOString(),\n      totalEvents: total,\n      routes,\n    }\n  }\n\n  reset(): void {\n    this.entries.clear()\n  }\n}\n","/**\n * StorageManager — per-process singleton coordinating pluggable storage\n * adapters (Postgres pools, Redis clients, in-memory adapters).\n *\n * Architectural decisions: see ADR-0007 (docs/adr/0007-storage-manager-singleton.md).\n *\n * Lifecycle:\n *   1. `getStorageManager()` returns the singleton (D1).\n *   2. `configure(storageConfig)` honored once per process (D3). Second call\n *      warns and is ignored.\n *   3. `usePostgres(dbName, factory)` / `useRedis(serverName, factory)`\n *      lazily create + cache (D2). Factory invoked exactly once per name.\n *   4. `register(adapter)` opts the adapter into the SIGTERM drain (D6).\n *   5. `dispose()` drains in parallel — adapters + pools + Redis (D5).\n *      Idempotent. Adapter errors logged + swallowed (do not block shutdown).\n *\n * Test seam: `__resetForTests()` resets state. Test files MUST call it from\n * `beforeEach` to avoid pollution across `it` blocks (EC-3).\n */\n\nimport type {\n  PoolLike,\n  PostgresDatabaseConfig,\n  RedisLike,\n  RedisServerConfig,\n  ServerConfig,\n  StorageAdapter,\n  StorageConfig,\n} from './storage-types.js'\n\nexport type PostgresFactory = (server: ServerConfig, db: PostgresDatabaseConfig) => PoolLike\nexport type RedisFactory = (config: RedisServerConfig) => RedisLike\n\nexport class StorageManager {\n  #config: StorageConfig | undefined\n  readonly #dbPools = new Map<string, PoolLike>()\n  readonly #redisClients = new Map<string, RedisLike>()\n  readonly #genericClients = new Map<string, unknown>()\n  readonly #adapters = new Set<StorageAdapter>()\n  #disposed = false\n\n  /**\n   * Apply the storage config block from `theo.config.ts`. Second call warns\n   * and is ignored (D3). Reset only via `__resetForTests()`.\n   */\n  configure(config: StorageConfig): void {\n    if (this.#config !== undefined) {\n      console.warn('[theokit] StorageManager already configured; ignoring second configure() call')\n      return\n    }\n    this.#config = config\n  }\n\n  /**\n   * Generic cache + factory for ANY client (MySQL, Mongo, Turso, DynamoDB, …).\n   * Returns the cached client OR invokes the factory and caches its return.\n   *\n   * EC-1 FIX: cache-hit check uses `Map.has(name)`, NOT `cached !== undefined`.\n   * Factories returning `null` or `undefined` are valid (lazy connect, stubs);\n   * the `!== undefined` check would re-invoke the factory infinitely for\n   * undefined returns AND silently cache `null` cast as `T`.\n   *\n   * EC-2 (documented type hole): `useStorage<A>('x', fA)` followed by\n   * `useStorage<B>('x', fB)` returns the cached A cast as B. Same trade-off\n   * as `Map<string, unknown>` — caller is responsible for using unique names\n   * per type.\n   *\n   * Lifecycle: generic clients are NOT auto-drained by `dispose()`. Call\n   * `manager.register({ name, dispose })` separately to participate.\n   *\n   * Reserved name prefixes (do NOT use): `__pg:`, `__redis:`, `__unstorage:`,\n   * `__db0:` — these are used internally by the typed helpers.\n   */\n  useStorage<T>(name: string, factory: () => T): T {\n    if (this.#disposed) throw new Error('StorageManager is disposed')\n    if (this.#genericClients.has(name)) return this.#genericClients.get(name) as T\n    const client = factory()\n    this.#genericClients.set(name, client)\n    return client\n  }\n\n  /**\n   * Return a Postgres pool for the named database. Lazy + cached. Factory\n   * invoked exactly once per `dbName` (D2).\n   *\n   * Throws if:\n   *   - manager is disposed\n   *   - `dbName` is not in `config.databases`\n   *   - the referenced server is not in `config.servers` (EC-2: deferred\n   *     cross-field validation surfaces here, not at configure time)\n   */\n  usePostgres(dbName: string, factory: PostgresFactory): PoolLike {\n    if (this.#disposed) throw new Error('StorageManager is disposed')\n    const cached = this.#dbPools.get(dbName)\n    if (cached !== undefined) return cached\n    const dbConfig = this.#config?.databases?.[dbName]\n    if (dbConfig === undefined) {\n      throw new Error(\n        `Database \"${dbName}\" not configured. Add it to theo.config.ts > storage.databases.`,\n      )\n    }\n    const server = this.#config?.servers?.[dbConfig.server]\n    if (server === undefined) {\n      throw new Error(\n        `Server \"${dbConfig.server}\" referenced by database \"${dbName}\" not found in theo.config.ts > storage.servers.`,\n      )\n    }\n    const pool = factory(server, dbConfig)\n    this.#dbPools.set(dbName, pool)\n    return pool\n  }\n\n  /**\n   * Return a Redis client for the named server. Lazy + cached. Factory\n   * invoked exactly once per `serverName`.\n   */\n  useRedis(serverName: string, factory: RedisFactory): RedisLike {\n    if (this.#disposed) throw new Error('StorageManager is disposed')\n    const cached = this.#redisClients.get(serverName)\n    if (cached !== undefined) return cached\n    const serverConfig = this.#config?.redis?.[serverName]\n    if (serverConfig === undefined) {\n      throw new Error(\n        `Redis server \"${serverName}\" not configured. Add it to theo.config.ts > storage.redis.`,\n      )\n    }\n    const client = factory(serverConfig)\n    this.#redisClients.set(serverName, client)\n    return client\n  }\n\n  /**\n   * Register an adapter for graceful shutdown coordination (D6).\n   *\n   * EC-4: throws if the manager is already disposed — prevents silent\n   * leaks in test seams that reset+reuse the manager.\n   */\n  register(adapter: StorageAdapter): void {\n    if (this.#disposed) {\n      throw new Error(\n        'StorageManager is disposed; cannot register new adapter. Call __resetForTests() in test setup.',\n      )\n    }\n    this.#adapters.add(adapter)\n  }\n\n  /**\n   * Drain in parallel — registered adapters, then PG pools, then Redis\n   * clients. Idempotent (D5). Errors per resource are logged and swallowed\n   * — they do NOT prevent shutdown of the remaining resources.\n   *\n   * Caller must wrap in a timeout if a bound is needed (EC-7: documented).\n   * In production, `start.ts` wraps the whole shutdown sequence in a 25 s\n   * force-exit timer.\n   */\n  async dispose(): Promise<void> {\n    if (this.#disposed) return\n    this.#disposed = true\n\n    const adapterDrains = Array.from(this.#adapters).map((a) =>\n      a.dispose().catch((err: unknown) => {\n        const msg = err instanceof Error ? err.message : String(err)\n        console.warn(`[theokit] adapter \"${a.name}\" dispose failed: ${msg}`)\n      }),\n    )\n    await Promise.all(adapterDrains)\n\n    const poolCloses = Array.from(this.#dbPools.values()).map((pool) => {\n      // EC-5: pool without `.end()` is silently skipped (TS already enforces\n      // shape at factory signature; this is the graceful runtime fallback if\n      // user bypasses via `as` cast).\n      if (pool.end === undefined) return Promise.resolve()\n      return pool.end().catch((err: unknown) => {\n        const msg = err instanceof Error ? err.message : String(err)\n        console.warn(`[theokit] PG pool close failed: ${msg}`)\n      })\n    })\n    await Promise.all(poolCloses)\n\n    const redisCloses = Array.from(this.#redisClients.values()).map((c) =>\n      c.quit().catch((err: unknown) => {\n        const msg = err instanceof Error ? err.message : String(err)\n        console.warn(`[theokit] Redis quit failed, falling back to disconnect: ${msg}`)\n        c.disconnect()\n      }),\n    )\n    await Promise.all(redisCloses)\n\n    this.#dbPools.clear()\n    this.#redisClients.clear()\n    this.#genericClients.clear()\n    this.#adapters.clear()\n  }\n\n  /** @internal Testing seam — resets state so a single test file can re-use the singleton across `it` blocks (EC-3). */\n  __resetForTests(): void {\n    this.#config = undefined\n    this.#dbPools.clear()\n    this.#redisClients.clear()\n    this.#genericClients.clear()\n    this.#adapters.clear()\n    this.#disposed = false\n  }\n\n  /** @internal Introspection helper for tests. */\n  __isConfiguredForTests(): boolean {\n    return this.#config !== undefined\n  }\n\n  /** @internal Introspection helper for tests. */\n  __isDisposedForTests(): boolean {\n    return this.#disposed\n  }\n}\n\n// Singleton — one StorageManager per process (D1).\nlet __singleton: StorageManager | undefined\n\nexport function getStorageManager(): StorageManager {\n  __singleton ??= new StorageManager()\n  return __singleton\n}\n\n/** @internal Drops the module-level singleton — used by tests that need a fresh manager. */\nexport function __resetSingletonForTests(): void {\n  __singleton = undefined\n}\n","/**\n * `useUnstorage(name, driver?)` — wraps `unstorage.createStorage({ driver })`\n * via `StorageManager.useStorage<T>` for caching + lifecycle coordination.\n *\n * Architectural decision: see ADR-0009 (`unstorage` adoption for KV drivers).\n *\n * `unstorage` is an OPTIONAL peer dependency. Apps that don't use KV pay zero\n * bundle cost; calling `useUnstorage` without `unstorage` installed throws an\n * actionable error.\n *\n * The returned `Storage<T>` is auto-registered with `manager.dispose()` so\n * SIGTERM drains it. Repeated calls with the same `name` return the cached\n * instance (factory invoked once).\n *\n * @example Memory driver (dev / tests)\n *   const cache = await useUnstorage<string>('cache')\n *   await cache.setItem('k', 'v')\n *\n * @example Redis driver (prod)\n *   import redisDriver from 'unstorage/drivers/redis'\n *   const cache = await useUnstorage<string>('cache', redisDriver({ url: process.env.REDIS_URL }))\n *\n * Reserved cache key prefix: `__unstorage:` — do NOT use this prefix in\n * `manager.useStorage<T>(name)` to avoid collision (EC-8 documented).\n */\nimport { getStorageManager } from './storage-manager.js'\n\ninterface UnstorageModule {\n  createStorage: <T>(options?: { driver?: unknown }) => UnstorageInstance<T>\n}\n\nexport interface UnstorageInstance<T> {\n  getItem(key: string): Promise<T | null>\n  setItem(key: string, value: T): Promise<void>\n  removeItem(key: string): Promise<void>\n  keys(prefix?: string): Promise<string[]>\n  hasItem(key: string): Promise<boolean>\n  clear(prefix?: string): Promise<void>\n  dispose?(): Promise<void>\n}\n\nexport async function useUnstorage<T = unknown>(\n  name: string,\n  driver?: unknown,\n): Promise<UnstorageInstance<T>> {\n  const mod = (await import('unstorage').catch(() => null)) as UnstorageModule | null\n  if (mod === null) {\n    throw new Error(\n      \"useUnstorage requires the 'unstorage' package. Install via: pnpm add unstorage\",\n    )\n  }\n  const manager = getStorageManager()\n  return manager.useStorage<UnstorageInstance<T>>(`__unstorage:${name}`, () => {\n    const storage = mod.createStorage<T>({ driver })\n    manager.register({\n      name: `unstorage:${name}`,\n      dispose: () => storage.dispose?.() ?? Promise.resolve(),\n    })\n    return storage\n  })\n}\n","/**\n * `useDatabase(name, connector)` — wraps `db0.createDatabase(connector)` via\n * `StorageManager.useStorage<T>` for caching.\n *\n * Architectural decision: see ADR-0010 (db0 adoption for SQL non-Postgres).\n *\n * `db0` is an OPTIONAL peer dependency. Apps that don't use db0 pay zero bundle\n * cost; calling `useDatabase` without `db0` installed throws an actionable error.\n *\n * **For Postgres: prefer `usePostgres(dbName, factory)`** — returns `pg.Pool`\n * directly which integrates better with Drizzle / raw SQL.\n *\n * Lifecycle: db0 connectors don't share a unified close API. Users SHOULD\n * register a dispose hook manually if cleanup matters (EC-9 documented):\n *   ```ts\n *   const db = await useDatabase('main', sqlite({...}))\n *   getStorageManager().register({ name: 'db:main', dispose: () => db.exec('...') })\n *   ```\n *\n * Reserved cache key prefix: `__db0:` — do NOT use this prefix in\n * `manager.useStorage<T>(name)` to avoid collision (EC-8 documented).\n *\n * @example libSQL / Turso\n *   import libsql from 'db0/connectors/libsql-core'\n *   const db = await useDatabase('main', libsql({ url: process.env.TURSO_URL }))\n *\n * @example SQLite (better-sqlite3)\n *   import sqlite from 'db0/connectors/better-sqlite3'\n *   const db = await useDatabase('main', sqlite({ name: 'app.db' }))\n */\nimport { getStorageManager } from './storage-manager.js'\n\ninterface Db0Module {\n  createDatabase: (connector: unknown) => Db0Database\n}\n\nexport interface Db0Database {\n  exec: (sql: string) => Promise<unknown>\n  prepare: (sql: string) => unknown\n  sql: (strings: TemplateStringsArray, ...args: unknown[]) => Promise<unknown>\n}\n\n/**\n * EC-5 — heuristic to detect a connector factory that wasn't invoked.\n *\n * `db0` connectors are factories: `sqlite({...})` returns a `Connector`.\n * If the user passes `sqlite` (the factory itself) instead of `sqlite({...})`\n * (the invoked Connector), `db0.createDatabase` fails with a cryptic message.\n *\n * A connector is an object (with methods like `exec`, `prepare`). A factory\n * is a function with declared parameters (arity ≥ 1, since connectors take\n * an options object). We throw an actionable error in the factory case.\n */\nfunction detectUninvokedFactory(connector: unknown): string | null {\n  if (typeof connector === 'function') {\n    const fn = connector as { length?: number; name?: string }\n    if ((fn.length ?? 0) > 0) {\n      const name = fn.name !== undefined && fn.name !== '' ? fn.name : 'connector'\n      return (\n        `useDatabase: connector argument looks like an un-invoked factory (function with ${String(fn.length)} parameter(s)). ` +\n        `Did you forget to call the factory? Pass \\`${name}({...})\\` not \\`${name}\\`. ` +\n        `Example: useDatabase('main', sqlite({ name: ':memory:' }))`\n      )\n    }\n  }\n  return null\n}\n\nexport async function useDatabase(name: string, connector: unknown): Promise<Db0Database> {\n  const factoryError = detectUninvokedFactory(connector)\n  if (factoryError !== null) throw new Error(factoryError)\n\n  const mod = (await import('db0').catch(() => null)) as Db0Module | null\n  if (mod === null) {\n    throw new Error(\"useDatabase requires the 'db0' package. Install via: pnpm add db0\")\n  }\n  const manager = getStorageManager()\n  return manager.useStorage<Db0Database>(`__db0:${name}`, () => mod.createDatabase(connector))\n}\n","/**\n * Constant-time byte comparison.\n *\n * Wraps `node:crypto.timingSafeEqual` when available (Node 6.6+) and falls\n * back to a constant-time XOR loop for runtimes without `node:crypto`\n * (Cloudflare Workers, Deno, Bun edge). Required to defeat timing attacks\n * on webhook signature verification — a naive `===` or `Buffer.equals`\n * would short-circuit on first mismatch byte and leak signature position\n * via wall-clock timing.\n *\n * Web Crypto's `crypto.subtle.verify` would also work, but requires a\n * `CryptoKey` object and is asymmetric (verify a signature against a key).\n * For our case — comparing two pre-computed digests — raw byte equality\n * is the correct primitive.\n *\n * @see https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b\n * @see https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/verify\n */\n\ntype NodeTimingSafeEqual = (a: Uint8Array, b: Uint8Array) => boolean\n\nlet cachedNodeImpl: NodeTimingSafeEqual | null | undefined\n\nfunction resolveNodeImpl(): NodeTimingSafeEqual | null {\n  if (cachedNodeImpl !== undefined) return cachedNodeImpl\n  try {\n    // require() avoids the dynamic-import-of-node-builtin warnings some\n    // bundlers emit; `node:crypto` is always synchronously available.\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const cryptoMod = require('node:crypto') as {\n      timingSafeEqual?: NodeTimingSafeEqual\n    }\n    cachedNodeImpl = cryptoMod.timingSafeEqual ?? null\n  } catch {\n    cachedNodeImpl = null\n  }\n  return cachedNodeImpl\n}\n\n/**\n * Returns true iff `a` and `b` have identical bytes. Takes time\n * proportional to `a.length` regardless of where bytes differ.\n *\n * @throws TypeError if either argument is not a Uint8Array.\n */\nexport function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (!(a instanceof Uint8Array) || !(b instanceof Uint8Array)) {\n    throw new TypeError(\n      `timingSafeEqual expects Uint8Array arguments (got ${typeof a} and ${typeof b})`,\n    )\n  }\n  // Length mismatch is constant-time-safe by construction (no per-byte work).\n  if (a.length !== b.length) return false\n  if (a.length === 0) return true\n\n  // Prefer the Node built-in when present — it's implemented in C and\n  // matches the contract exactly. node:crypto.timingSafeEqual throws on\n  // length mismatch, which we've already filtered above.\n  const nodeImpl = resolveNodeImpl()\n  if (nodeImpl) return nodeImpl(a, b)\n\n  // Fallback: XOR-accumulate every byte into one accumulator. NEVER\n  // short-circuit. The compiler / V8 will not constant-fold this loop\n  // because the inputs are dynamic.\n  let diff = 0\n  for (let i = 0; i < a.length; i++) {\n    diff |= a[i] ^ b[i]\n  }\n  return diff === 0\n}\n","/**\n * Read a Web `Request` body as a raw string EXACTLY ONCE and expose it\n * alongside the original request (which remains readable by downstream\n * code). Enforces a configurable `maxBodyBytes` cap to prevent OOM via\n * pathological POST.\n *\n * MUST be called FIRST in the webhook pipeline, before any other code\n * touches the body (`request.text()`, `request.json()`, parsers). Once\n * the body is consumed, `Request.clone()` throws and this function fails.\n *\n * EC-101: default `maxBodyBytes = 1_000_000` (1 MB) covers Stripe\n * (256 KB max), Slack (4 MB but compressed), and is well below Node\n * memory thresholds. GitHub webhooks up to 25 MB MUST opt in\n * (`maxBodyBytes: 25_000_000`).\n *\n * @see https://docs.stripe.com/webhooks/signatures\n * @see https://docs.github.com/en/webhooks/using-webhooks/best-practices-for-using-webhooks\n */\n\nexport const DEFAULT_MAX_BODY_BYTES = 1_000_000\n\nexport interface ReadRawBodyOptions {\n  /** Maximum bytes to read before throwing `BodyTooLargeError`. Defaults to 1 MB. */\n  maxBodyBytes?: number\n}\n\nexport interface RawBodyResult {\n  /** UTF-8 decoded body (or empty string when no body present). */\n  rawBody: string\n  /** The ORIGINAL request, still readable by downstream code. */\n  bodyClone: Request\n}\n\n/**\n * Thrown when the request body exceeds `maxBodyBytes`. Carries status\n * 413 (Payload Too Large) and stable code `BODY_TOO_LARGE` so callers\n * can map it to an HTTP response without sniffing the message.\n */\nexport class BodyTooLargeError extends Error {\n  readonly status = 413\n  readonly code = 'BODY_TOO_LARGE'\n\n  constructor(\n    public readonly limit: number,\n    public readonly actualSeen: number,\n  ) {\n    super(`Request body exceeds maxBodyBytes: seen ${actualSeen} bytes, limit ${limit} bytes`)\n    this.name = 'BodyTooLargeError'\n  }\n}\n\nexport async function readRawBody(\n  request: Request,\n  options: ReadRawBodyOptions = {},\n): Promise<RawBodyResult> {\n  const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES\n\n  // Clone the request so the original remains readable. `.clone()` throws\n  // synchronously (TypeError) if the body was already consumed — we let\n  // that propagate so callers fail fast with a clear error.\n  const clone = request.clone()\n\n  // No body at all (GET, HEAD, or empty POST). Both clone.body and\n  // clone.text() handle this gracefully but we short-circuit for clarity\n  // and to avoid an unnecessary stream read.\n  if (clone.body === null) {\n    return { rawBody: '', bodyClone: request }\n  }\n\n  const reader = clone.body.getReader()\n  const chunks: Uint8Array[] = []\n  let total = 0\n\n  try {\n    for (;;) {\n      const { value, done } = await reader.read()\n      if (done) break\n      total += value.byteLength\n      if (total > maxBodyBytes) {\n        // Cancel the stream without awaiting (avoids deadlock on some\n        // ReadableStream impls). The finally block releases the lock.\n        void reader.cancel()\n        throw new BodyTooLargeError(maxBodyBytes, total)\n      }\n      chunks.push(value)\n    }\n  } finally {\n    try {\n      reader.releaseLock()\n    } catch {\n      // lock may already be released by cancel()\n    }\n  }\n\n  // Concat all chunks into a single Uint8Array, then UTF-8 decode.\n  const bytes = new Uint8Array(total)\n  let offset = 0\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset)\n    offset += chunk.byteLength\n  }\n  const rawBody = new TextDecoder().decode(bytes)\n\n  return { rawBody, bodyClone: request }\n}\n","import {\n  extractTraceContext,\n  generateNewTraceContext,\n} from '../observability/trace-context-propagation.js'\n\nimport { BodyTooLargeError, readRawBody } from './raw-body.js'\nimport type {\n  DefineWebhookOptions,\n  VerifyResult,\n  WebhookContext,\n  WebhookDefinition,\n} from './webhook-types.js'\n\n/**\n * Declare a webhook handler with first-class signature verification\n * (R0.5.10, ADR-0005). Pure identity helper — returns the definition\n * unchanged for downstream dispatch.\n *\n * @example\n * ```ts\n * // server/webhooks/stripe.ts\n * import { defineWebhook } from 'theokit/server'\n * import { stripe } from 'theokit/server/webhook/providers'\n *\n * export default defineWebhook({\n *   verify: stripe({ secret: process.env.STRIPE_WEBHOOK_SECRET! }),\n *   async handler({ rawBody }) {\n *     const event = JSON.parse(rawBody)\n *     // ...\n *     return new Response('ok')\n *   },\n * })\n * ```\n */\nexport function defineWebhook(opts: DefineWebhookOptions): WebhookDefinition {\n  return {\n    verify: opts.verify,\n    handler: opts.handler,\n    maxBodyBytes: opts.maxBodyBytes,\n    __theokit_kind: 'webhook',\n  }\n}\n\n/**\n * Dispatch a webhook request through the definition's verify → handler\n * pipeline. Returns the handler's `Response` (or a wrapped one), or a\n * 401/413 response when verification or body size guards trip.\n *\n * EC-101: enforces `maxBodyBytes` (default 1MB via readRawBody).\n * EC-103: every throw from `verify` (sync or async) is treated as\n * `{ok: false, reason: 'verify threw: <message>'}`. Handler NEVER\n * invoked on verify failure.\n */\nexport async function dispatchWebhook(def: WebhookDefinition, request: Request): Promise<Response> {\n  let rawBody: string\n  let bodyClone: Request\n  try {\n    const result = await readRawBody(request, { maxBodyBytes: def.maxBodyBytes })\n    rawBody = result.rawBody\n    bodyClone = result.bodyClone\n  } catch (err) {\n    if (err instanceof BodyTooLargeError) {\n      return new Response(JSON.stringify({ error: err.code, message: err.message }), {\n        status: 413,\n        headers: { 'content-type': 'application/json' },\n      })\n    }\n    return new Response(\n      JSON.stringify({\n        error: 'BAD_REQUEST',\n        message: err instanceof Error ? err.message : 'failed to read body',\n      }),\n      { status: 400, headers: { 'content-type': 'application/json' } },\n    )\n  }\n\n  // Resolve traceId — propagate or generate.\n  const incomingTrace = extractTraceContext(request.headers)\n  const traceId = incomingTrace?.trace_id ?? generateNewTraceContext().trace_id\n\n  // EC-103: verify exception MUST close the door, never let handler run.\n  let verifyResult: VerifyResult\n  try {\n    verifyResult = await def.verify(bodyClone)\n  } catch (err) {\n    verifyResult = {\n      ok: false,\n      reason: `verify threw: ${err instanceof Error ? err.message : String(err)}`,\n    }\n  }\n\n  if (!verifyResult.ok) {\n    return new Response(\n      JSON.stringify({ error: 'WEBHOOK_VERIFY_FAILED', message: verifyResult.reason }),\n      { status: 401, headers: { 'content-type': 'application/json' } },\n    )\n  }\n\n  const ctx: WebhookContext = {\n    request: bodyClone,\n    rawBody,\n    traceId,\n    signal: request.signal,\n  }\n\n  const result = await def.handler(ctx)\n  if (result instanceof Response) return result\n  if (result === undefined || result === null) {\n    return new Response(null, { status: 204 })\n  }\n  return new Response(JSON.stringify(result), {\n    status: 200,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n","/**\n * Single source of truth for cache subsystem constants.\n * Limits mirror Next.js (NEXT_CACHE_TAG_MAX_LENGTH / NEXT_CACHE_TAG_MAX_ITEMS)\n * — see reference doc §3.2 and ADR D6 of caching-and-revalidation-plan.md.\n */\n\nexport const CACHE_TAG_MAX_LENGTH = 256\nexport const CACHE_TAG_MAX_ITEMS = 128\nexport const THEO_T_PREFIX = '_THEO_T_'\n\nexport const DEFAULT_MAX_AGE = 1\nexport const DEFAULT_SWR_MULTIPLIER = 60\n","import {\n  CACHE_TAG_MAX_ITEMS,\n  CACHE_TAG_MAX_LENGTH,\n  DEFAULT_MAX_AGE,\n  THEO_T_PREFIX,\n} from './constants.js'\n\nexport interface ValidationResult<T> {\n  valid: T[]\n  dropped: { value: unknown; reason: string }[]\n}\n\n/**\n * Validate an array of cache tags.\n * Drops invalid entries (type / length / reserved-prefix / overflow) with warn log.\n * NEVER throws on runtime input — caller-facing safety.\n *\n * EC-1: defensive guard for non-array input (e.g., undefined from optional chain).\n */\nexport function validateTags(tags: unknown, description: string): ValidationResult<string> {\n  // EC-1 guard\n  if (!Array.isArray(tags)) {\n    const result: ValidationResult<string> = {\n      valid: [],\n      dropped: [{ value: tags, reason: `expected array, got ${typeof tags}` }],\n    }\n    warnDropped(result, description)\n    return result\n  }\n\n  // Array.isArray narrows to `any[]` (TS limitation). Re-type as unknown[]\n  // so each element flows through explicit type guards below.\n  const tagArr: unknown[] = tags as unknown[]\n  const valid: string[] = []\n  const dropped: { value: unknown; reason: string }[] = []\n\n  for (let i = 0; i < tagArr.length; i++) {\n    if (valid.length >= CACHE_TAG_MAX_ITEMS) {\n      for (let j = i; j < tagArr.length; j++) {\n        dropped.push({ value: tagArr[j], reason: 'overflow (max 128 tags)' })\n      }\n      break\n    }\n    const tag: unknown = tagArr[i]\n    if (typeof tag !== 'string') {\n      dropped.push({ value: tag, reason: 'invalid type, must be a string' })\n      continue\n    }\n    if (tag.length > CACHE_TAG_MAX_LENGTH) {\n      dropped.push({\n        value: tag,\n        reason: `exceeded max length of ${CACHE_TAG_MAX_LENGTH}`,\n      })\n      continue\n    }\n    if (tag.startsWith(THEO_T_PREFIX)) {\n      dropped.push({\n        value: tag,\n        reason: `reserved prefix \"${THEO_T_PREFIX}\"`,\n      })\n      continue\n    }\n    valid.push(tag)\n  }\n\n  warnDropped({ valid, dropped }, description)\n  return { valid, dropped }\n}\n\n/**\n * Validate a `maxAge` value in seconds.\n * Throws on invalid input (config-time validation).\n * Returns DEFAULT_MAX_AGE when undefined.\n */\nexport function validateMaxAge(maxAge: unknown, description: string): number {\n  if (maxAge === undefined) return DEFAULT_MAX_AGE\n  if (typeof maxAge === 'number' && Number.isFinite(maxAge) && maxAge >= 0) {\n    return maxAge\n  }\n  throw new Error(\n    `Invalid maxAge \"${JSON.stringify(maxAge)}\" in ${description}, must be a non-negative finite number`,\n  )\n}\n\n/**\n * Validate an `expire` value in seconds, optionally cross-checked against `revalidate`.\n * Throws on invalid input (config-time validation).\n */\nexport function validateExpire(\n  expire: unknown,\n  revalidate: number | undefined,\n  description: string,\n): number | undefined {\n  if (expire === undefined) return undefined\n  if (typeof expire !== 'number' || !Number.isFinite(expire) || expire < 0) {\n    throw new Error(\n      `Invalid expire \"${JSON.stringify(expire)}\" in ${description}, must be a non-negative finite number`,\n    )\n  }\n  if (revalidate !== undefined && expire < revalidate) {\n    throw new Error(\n      `Invalid expire ${expire} in ${description}, must be greater than or equal to revalidate ${revalidate}`,\n    )\n  }\n  return expire\n}\n\nfunction warnDropped(result: ValidationResult<string>, description: string): void {\n  if (result.dropped.length === 0) return\n  console.warn(`[theokit:cache] ${description}: dropped ${result.dropped.length} invalid tag(s):`)\n  for (const { value, reason } of result.dropped) {\n    console.warn(`  - ${JSON.stringify(value)}: ${reason}`)\n  }\n}\n","import type { CacheEngine } from './cache-engine.js'\nimport { validateExpire, validateMaxAge, validateTags } from './validation.js'\n\nexport interface DefineCachedFunctionOptions<TArgs extends unknown[], TReturn> {\n  /** Required cache namespace; appears in keys as \"fn:${name}:...\" */\n  name: string\n  /** seconds; defaults to DEFAULT_MAX_AGE (1) */\n  maxAge?: number\n  /** seconds; stale-while-revalidate window */\n  swr?: number\n  /** Custom key derivation from args. Default: JSON.stringify(args). */\n  getKey?: (...args: TArgs) => string\n  /** Static or dynamic tags. */\n  tags?: string[] | ((...args: TArgs) => string[])\n  /** Version stamp; bump to invalidate all entries under this name. */\n  cacheVersion?: string\n  /** Transform returned value before caching. */\n  transform?: (raw: TReturn) => TReturn\n  /** Skip cache if validate returns false (treats existing entry as miss). */\n  validate?: (raw: TReturn) => boolean\n  /** Called on any error in the cache pipeline. */\n  onError?: (err: unknown, ctx: { args: TArgs }) => void\n}\n\nexport type CachedFunction<TArgs extends unknown[], TReturn> = ((\n  ...args: TArgs\n) => Promise<TReturn>) & {\n  /** Bust the cache entry for these specific args. */\n  invalidate: (...args: TArgs) => Promise<void>\n}\n\n/**\n * Wrap an async function with cache semantics.\n * Returns a callable that memoizes by `(name + args)` and exposes `.invalidate(args)`.\n *\n * The engine is supplied by the caller (avoids module-level singleton coupling\n * during testing; framework wiring provides it in production).\n */\nexport function defineCachedFunction<TArgs extends unknown[], TReturn>(\n  engine: CacheEngine,\n  fn: (...args: TArgs) => TReturn | Promise<TReturn>,\n  opts: DefineCachedFunctionOptions<TArgs, TReturn>,\n): CachedFunction<TArgs, TReturn> {\n  if (typeof opts.name !== 'string' || opts.name.length === 0) {\n    throw new Error('defineCachedFunction: opts.name is required (non-empty string)')\n  }\n  const maxAge = validateMaxAge(opts.maxAge, `defineCachedFunction(${opts.name})`)\n  const swr = validateExpire(opts.swr, maxAge, `defineCachedFunction(${opts.name})`)\n\n  const prefix = `fn:${opts.name}`\n\n  function deriveCacheKey(args: TArgs): string {\n    const tail = opts.getKey ? opts.getKey(...args) : JSON.stringify(args)\n    return `${prefix}:${tail}`\n  }\n\n  function resolveTags(args: TArgs): string[] {\n    const raw = typeof opts.tags === 'function' ? opts.tags(...args) : (opts.tags ?? [])\n    const { valid } = validateTags(raw, `defineCachedFunction(${opts.name})`)\n    return valid\n  }\n\n  const wrapped = (async (...args: TArgs) => {\n    const key = deriveCacheKey(args)\n    const tags = resolveTags(args)\n    try {\n      const { value } = await engine.getOrCompute<TReturn>(key, async () => fn(...args), {\n        maxAge,\n        swr: swr ?? maxAge * 60,\n        tags,\n        cacheVersion: opts.cacheVersion,\n        transform: opts.transform,\n        validate: opts.validate,\n      })\n      return value\n    } catch (err) {\n      opts.onError?.(err, { args })\n      throw err\n    }\n  }) as CachedFunction<TArgs, TReturn>\n\n  wrapped.invalidate = async (...args: TArgs) => {\n    const key = deriveCacheKey(args)\n    await engine.invalidate(key)\n  }\n\n  return wrapped\n}\n","export interface CacheControlInput {\n  /** seconds; 0 forces no-cache */\n  maxAge: number\n  /** stale-while-revalidate window in seconds; 0 or undefined omits directive */\n  swr?: number\n  /** emit `private,` prefix (skips shared CDN caching) */\n  isPrivate?: boolean\n}\n\nconst NO_CACHE_HEADER = 'private, no-cache, no-store, max-age=0, must-revalidate'\n\n/**\n * Build a canonical Cache-Control header value.\n *\n * `maxAge === 0` always yields the strict no-cache directive regardless\n * of `swr` or `isPrivate` — defensive default.\n *\n * EC-13: pure function intentional — caller is responsible for input\n * validation (see validateMaxAge / validateExpire in validation.ts).\n */\nexport function getCacheControlHeader(input: CacheControlInput): string {\n  if (input.maxAge === 0) return NO_CACHE_HEADER\n  const parts: string[] = []\n  if (input.isPrivate) parts.push('private')\n  parts.push(`s-maxage=${input.maxAge}`)\n  if (input.swr !== undefined && input.swr > 0) {\n    parts.push(`stale-while-revalidate=${input.swr}`)\n  }\n  return parts.join(', ')\n}\n","/**\n * Default tracking/analytics query parameters excluded from cache keys.\n * Mirrors Astro's DEFAULT_EXCLUDED_PARAMS list (memory-provider.ts:117).\n * Set as exact-match (not glob) for KISS + zero-dep.\n */\nexport const DEFAULT_EXCLUDED_QUERY_PARAMS = [\n  'utm_source',\n  'utm_medium',\n  'utm_campaign',\n  'utm_term',\n  'utm_content',\n  'fbclid',\n  'gclid',\n  'gbraid',\n  'wbraid',\n  'dclid',\n  'msclkid',\n  'twclid',\n  'li_fat_id',\n  'mc_cid',\n  'mc_eid',\n  '_ga',\n  '_gl',\n  '_hsenc',\n  '_hsmi',\n  '_ke',\n  'oly_anon_id',\n  'oly_enc_id',\n  'rb_clickid',\n  's_cid',\n  'vero_id',\n  'wickedid',\n  'yclid',\n  '__s',\n  'ref',\n]\n\nexport interface KeyDerivationOptions {\n  /** Total override — when provided, bypasses all internal logic. */\n  getKey?: (req: Request) => string | Promise<string>\n  /** Exact-match query param names to drop. Defaults to DEFAULT_EXCLUDED_QUERY_PARAMS. */\n  excludeQuery?: string[]\n  /** Whether to sort query params alphabetically. Defaults to true. */\n  sortQuery?: boolean\n  /** Header names whose values are appended as `\\0name=value` suffix. */\n  varies?: string[]\n  /** Namespace prefix (e.g., route name). */\n  prefix?: string\n}\n\n/**\n * Derive a deterministic cache key from a Request.\n *\n * Default behaviour: `${prefix?}${protocol}//${lower(host)}${path}${?sortedFilteredQuery}` + Vary suffix.\n * `\\0` separator chosen because it cannot appear in URLs or HTTP header values.\n *\n * EC-6: malformed URL on getKey path is caller's responsibility.\n * EC-7: enforces getKey returns string.\n */\nexport async function deriveKey(req: Request, opts: KeyDerivationOptions = {}): Promise<string> {\n  if (opts.getKey) {\n    const k = await opts.getKey(req)\n    if (typeof k !== 'string') {\n      throw new Error(`getKey must return a string, got ${typeof k}`)\n    }\n    return k\n  }\n\n  const url = new URL(req.url)\n  const queryString = buildQueryString(url, opts)\n  const base = `${opts.prefix ? opts.prefix + ':' : ''}${url.protocol}//${url.hostname.toLowerCase()}${url.pathname}${queryString ? '?' + queryString : ''}`\n\n  if (!opts.varies || opts.varies.length === 0) return base\n  const parts: string[] = []\n  for (const header of opts.varies) {\n    parts.push(`${header}=${req.headers.get(header) ?? ''}`)\n  }\n  return base + '\\0' + parts.join('\\0')\n}\n\nfunction buildQueryString(url: URL, opts: KeyDerivationOptions): string {\n  const params = new URLSearchParams(url.searchParams)\n  const exclude = opts.excludeQuery ?? DEFAULT_EXCLUDED_QUERY_PARAMS\n  const excludeSet = new Set(exclude)\n  for (const key of [...params.keys()]) {\n    if (excludeSet.has(key)) params.delete(key)\n  }\n  if (opts.sortQuery !== false) params.sort()\n  return params.toString()\n}\n","import type { z } from 'zod'\n\nimport type { RouteConfig } from '../core/contracts/route-config.js'\n\nimport { getCacheControlHeader } from './cache-control-header.js'\nimport type { CacheEngine, CacheStatus } from './cache-engine.js'\nimport { THEO_T_PREFIX } from './constants.js'\nimport { deriveKey } from './key-derivation.js'\nimport type { CacheEntry } from './storage-adapter.js'\nimport { validateExpire, validateMaxAge, validateTags } from './validation.js'\n\n/** Default 10 MB cap per cached route entry (EC-3). */\nexport const DEFAULT_MAX_ENTRY_SIZE = 10 * 1024 * 1024\nconst VARIES_IGNORED = new Set(['cookie', 'set-cookie'])\n\nexport interface RouteCacheOptions {\n  maxAge?: number\n  swr?: number\n  tags?: string[]\n  varies?: string[]\n  getKey?: (req: Request) => string | Promise<string>\n  bypassWhen?: (req: Request) => boolean | Promise<boolean>\n  cacheVersion?: string\n  cacheErrors?: boolean\n  methods?: string[]\n  cacheable?: (response: Response) => boolean\n  /** Max body bytes (EC-3); default DEFAULT_MAX_ENTRY_SIZE. */\n  maxEntrySize?: number\n}\n\nexport interface CachedRouteConfig<\n  TQuery extends z.ZodType = z.ZodUndefined,\n  TBody extends z.ZodType = z.ZodUndefined,\n  TParams extends z.ZodType = z.ZodUndefined,\n  TCtx = unknown,\n> extends Omit<RouteConfig<TQuery, TBody, TParams, TCtx>, 'handler'> {\n  cache: RouteCacheOptions\n  handler: (ctx: {\n    query: z.infer<TQuery>\n    body: z.infer<TBody>\n    params: z.infer<TParams>\n    request: Request\n    ctx: TCtx\n  }) => unknown\n}\n\ninterface RouteCacheValue {\n  body: string\n  status: number\n  headers: [string, string][]\n}\n\nconst setCookieWarnedRoutes = new WeakSet()\nconst variesCookieWarnedRoutes = new WeakSet()\nconst oversizedWarnedRoutes = new WeakSet()\n\n/**\n * Wrap a `RouteConfig` with cache-aware handler logic.\n *\n * Architecture: wraps the user `handler` so cache lookup happens AT\n * handler-invocation time, AFTER router middleware (auth/csrf/etc) ran.\n * This structurally satisfies EC-4 (cache-after-auth) without modifying\n * the router internals.\n *\n * Algorithm per request:\n * 1. Method check + bypassWhen + maxAge=0 → call handler raw\n * 2. Derive key (path + sortedQuery + varies, prefix by method)\n * 3. Cache lookup → HIT/STALE return cached Response\n * 4. Miss → run handler, check cacheability (Set-Cookie / status / size / SSE / streaming)\n * 5. Cacheable → write entry + return Response with X-Theo-Cache: MISS (dev)\n * 6. Not cacheable → return original Response unchanged\n *\n * Concurrent dedupe is INTENTIONALLY NOT used for routes — Response objects\n * cannot be safely shared across concurrent callers (body is single-use stream).\n * Each request that misses runs the handler independently.\n */\nexport function defineCachedRoute<\n  TQuery extends z.ZodType = z.ZodUndefined,\n  TBody extends z.ZodType = z.ZodUndefined,\n  TParams extends z.ZodType = z.ZodUndefined,\n  TCtx = unknown,\n>(\n  engine: CacheEngine,\n  config: CachedRouteConfig<TQuery, TBody, TParams, TCtx>,\n): RouteConfig<TQuery, TBody, TParams, TCtx, Response> {\n  const { cache, handler, ...rest } = config\n\n  const maxAge = validateMaxAge(cache.maxAge, 'defineCachedRoute')\n  const swr = validateExpire(cache.swr, maxAge, 'defineCachedRoute')\n  if (cache.cacheVersion !== undefined && cache.cacheVersion === '') {\n    throw new Error('defineCachedRoute: cacheVersion must be non-empty if provided')\n  }\n  // EC-19: maxEntrySize validation\n  const maxEntrySize = cache.maxEntrySize ?? DEFAULT_MAX_ENTRY_SIZE\n  if (!Number.isFinite(maxEntrySize) || maxEntrySize < 0) {\n    throw new Error(\n      `Invalid maxEntrySize \"${String(cache.maxEntrySize)}\" in defineCachedRoute, must be a non-negative finite number`,\n    )\n  }\n  const methods = new Set((cache.methods ?? ['GET', 'HEAD']).map((m) => m.toUpperCase()))\n  const baseTags = validateTags(cache.tags ?? [], 'defineCachedRoute').valid\n\n  // EC-2: filter cookie/set-cookie from varies + warn-once per route\n  const variesRaw = cache.varies ?? []\n  const variesLower = variesRaw.map((v) => v.toLowerCase())\n  const hadCookieVary = variesLower.some((v) => VARIES_IGNORED.has(v))\n  const safeVaries = variesLower.filter((v) => !VARIES_IGNORED.has(v))\n  if (hadCookieVary && !variesCookieWarnedRoutes.has(config)) {\n    variesCookieWarnedRoutes.add(config)\n    console.warn(\n      `[theokit:cache] defineCachedRoute: 'cookie'/'set-cookie' removed from varies — they fragment cache to zero hit rate (EC-2)`,\n    )\n  }\n\n  const wrappedHandler = async (ctx: {\n    query: z.infer<TQuery>\n    body: z.infer<TBody>\n    params: z.infer<TParams>\n    request: Request\n    ctx: TCtx\n  }): Promise<Response> => {\n    // TheoKit's dispatcher may pass a Node IncomingMessage (not a Web Request).\n    // Normalize to a Web Request so deriveKey / bypassWhen / URL parsing work uniformly.\n    const webRequest = toWebRequest(ctx.request)\n\n    if (!methods.has(webRequest.method.toUpperCase())) {\n      return invokeHandlerAsResponse(handler, ctx)\n    }\n    if (cache.bypassWhen && (await cache.bypassWhen(webRequest))) {\n      return invokeHandlerAsResponse(handler, ctx)\n    }\n    if (maxAge === 0) {\n      return invokeHandlerAsResponse(handler, ctx)\n    }\n\n    const key = await deriveKey(webRequest, {\n      prefix: 'route:' + webRequest.method.toUpperCase(),\n      varies: safeVaries,\n      getKey: cache.getKey,\n    })\n\n    // ---- Cache lookup (T4.2 DRY — delegates to engine canonical) ----\n    const cached = await engine.tryReadCached<RouteCacheValue>(key, {\n      cacheVersion: cache.cacheVersion,\n    })\n\n    // T4.3 — build options bag once; pass to all helpers (≤ 4 params each).\n    const routeCacheCtx: RouteCacheCtx = {\n      engine,\n      key,\n      cache,\n      routeConfig: config,\n      maxEntrySize,\n      maxAge,\n      swr,\n      baseTags,\n      webRequest,\n    }\n\n    if (cached) {\n      if (cached.status === 'hit') {\n        return buildResponseFromCache(cached.value, 'hit', maxAge, swr)\n      }\n      // Only 'stale' remains (engine never returns 'miss' from tryReadCached).\n      // Stale: schedule background refresh + return stale immediately.\n      scheduleRouteRevalidate(routeCacheCtx, handler, ctx)\n      return buildResponseFromCache(cached.value, 'stale', maxAge, swr)\n    }\n\n    // ---- Miss: run handler ----\n    const response = await invokeHandlerAsResponse(handler, ctx)\n    return persistAndReturn(routeCacheCtx, response)\n  }\n\n  return {\n    ...rest,\n    handler: wrappedHandler,\n  }\n}\n\n// T4.2 (PV-5 DRY): tryReadCacheEntry was removed — duplicated the engine's\n// canonical tryReadCached (staleness check, version check, JSON parse,\n// clock-skew clamp). Route wrapper now delegates to `engine.tryReadCached`.\n\n/**\n * T4.3 options-bag context (PV-6 — Clean Code consensus ≤ 4 params).\n * Collapses 10/11 positional params of `persistAndReturn` and\n * `scheduleRouteRevalidate` to 2 params each (ctx + payload).\n *\n * Some fields are derived from `cache` config (EC-22 documented redundancy) —\n * the trade-off is O(1) construction per request for vastly simpler call\n * sites and safer additions of new fields without reordering args.\n */\ninterface RouteCacheCtx {\n  engine: CacheEngine\n  key: string\n  cache: RouteCacheOptions\n  routeConfig: object\n  maxEntrySize: number\n  maxAge: number\n  swr: number | undefined\n  baseTags: string[]\n  webRequest: Request\n}\n\nfunction buildRouteCacheEntry(value: RouteCacheValue, ctx: RouteCacheCtx): CacheEntry {\n  const pathTag = THEO_T_PREFIX + new URL(ctx.webRequest.url).pathname\n  return {\n    body: JSON.stringify(value),\n    status: 200,\n    headers: [],\n    storedAt: Date.now(),\n    maxAge: ctx.maxAge,\n    swr: ctx.swr ?? ctx.maxAge * 60,\n    tags: [...ctx.baseTags, pathTag],\n    cacheVersion: ctx.cache.cacheVersion,\n  }\n}\n\nasync function persistAndReturn(ctx: RouteCacheCtx, response: Response): Promise<Response> {\n  const cacheableResult = await tryCacheResponse(\n    response,\n    ctx.cache,\n    ctx.routeConfig,\n    ctx.maxEntrySize,\n  )\n  if (!cacheableResult) {\n    // Not cached — return original response unchanged\n    return response\n  }\n  await ctx.engine.set(ctx.key, buildRouteCacheEntry(cacheableResult, ctx))\n  return buildResponseFromCache(cacheableResult, 'miss', ctx.maxAge, ctx.swr)\n}\n\nfunction scheduleRouteRevalidate<THandlerCtx>(\n  ctx: RouteCacheCtx,\n  handler: (handlerCtx: THandlerCtx) => unknown,\n  handlerCtx: THandlerCtx,\n): void {\n  void (async () => {\n    try {\n      const response = await invokeHandlerAsResponse(handler, handlerCtx)\n      const result = await tryCacheResponse(response, ctx.cache, ctx.routeConfig, ctx.maxEntrySize)\n      if (!result) return\n      await ctx.engine.set(ctx.key, buildRouteCacheEntry(result, ctx))\n    } catch {\n      // Stale entry remains; future request retries on its own stale-check\n    }\n  })()\n}\n\n/**\n * Type for Node.js IncomingMessage (subset we read).\n * Avoids a direct `node:http` import which would block edge runtimes.\n */\ninterface NodeLikeRequest {\n  url?: string\n  method?: string\n  headers: Record<string, string | string[] | undefined>\n  socket?: { encrypted?: boolean }\n}\n\n/**\n * Adapt either a Web Request or a Node IncomingMessage to a Web Request.\n * TheoKit's runtime dispatch may pass either depending on the adapter.\n */\n\n// Node IncomingMessage) inside one function so the call sites stay shape-blind.\nfunction toWebRequest(req: Request | NodeLikeRequest): Request {\n  // Web Request fast-path\n  if (typeof (req as Request).clone === 'function' && (req as Request).headers instanceof Headers) {\n    return req as Request\n  }\n  const node = req as NodeLikeRequest\n  const host = (typeof node.headers.host === 'string' ? node.headers.host : null) ?? 'localhost'\n  const protocol = node.socket?.encrypted ? 'https' : 'http'\n  const path = node.url ?? '/'\n  const url = path.startsWith('http') ? path : `${protocol}://${host}${path}`\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(node.headers)) {\n    if (Array.isArray(v)) {\n      for (const item of v) headers.append(k, item)\n    } else if (typeof v === 'string') {\n      headers.set(k, v)\n    }\n  }\n  return new Request(url, {\n    method: (node.method ?? 'GET').toUpperCase(),\n    headers,\n  })\n}\n\nasync function invokeHandlerAsResponse<TCtx>(\n  handler: (ctx: TCtx) => unknown,\n  ctx: TCtx,\n): Promise<Response> {\n  const raw = await handler(ctx)\n  if (raw instanceof Response) return raw\n  return Response.json(raw)\n}\n\n/**\n * Decide whether `response` is cacheable. Returns serialized form on yes; undefined on no.\n * Order matters: cheap checks first, body read last (only for cacheable candidates).\n */\nasync function tryCacheResponse(\n  response: Response,\n  cache: RouteCacheOptions,\n  routeConfig: object,\n  maxEntrySize: number,\n): Promise<RouteCacheValue | undefined> {\n  // D7 / EC-2: Set-Cookie auto-bypass\n  if (response.headers.has('set-cookie')) {\n    if (!setCookieWarnedRoutes.has(routeConfig)) {\n      setCookieWarnedRoutes.add(routeConfig)\n      console.warn('[theokit:cache] response has Set-Cookie — skipping cache write (D7)')\n    }\n    return undefined\n  }\n  // SSE\n  const contentType = response.headers.get('content-type') ?? ''\n  if (contentType.includes('text/event-stream')) return undefined\n  // EC-11: chunked streaming (transfer-encoding: chunked OR no content-length on a\n  // user-constructed Response — i.e., a Response built from a ReadableStream that\n  // wasn't via Response.json/text helpers). We detect via the explicit\n  // transfer-encoding header since Response.json() also uses a ReadableStream\n  // body internally and we don't want to refuse those.\n  if (response.headers.get('transfer-encoding')?.toLowerCase() === 'chunked') {\n    return undefined\n  }\n  // D9: status >= 400 not cached unless opt-in\n  if (response.status >= 400 && !cache.cacheErrors) return undefined\n  // Custom predicate (overrides built-ins)\n  if (cache.cacheable && !cache.cacheable(response)) return undefined\n\n  // Read body (clone to preserve the response for downstream)\n  const text = await response.clone().text()\n\n  // EC-3: oversized bypass\n  if (text.length > maxEntrySize) {\n    if (!oversizedWarnedRoutes.has(routeConfig)) {\n      oversizedWarnedRoutes.add(routeConfig)\n      console.warn(\n        `[theokit:cache] response body ${text.length} bytes exceeds maxEntrySize ${maxEntrySize}; skipping cache (EC-3)`,\n      )\n    }\n    return undefined\n  }\n\n  const headers: [string, string][] = []\n  response.headers.forEach((v, k) => {\n    if (k.toLowerCase() === 'set-cookie') return // defense-in-depth\n    headers.push([k, v])\n  })\n  return { body: text, status: response.status, headers }\n}\n\nfunction buildResponseFromCache(\n  value: RouteCacheValue,\n  status: CacheStatus,\n  maxAge: number,\n  swr: number | undefined,\n): Response {\n  const headers = new Headers(value.headers)\n  if (!headers.has('cache-control')) {\n    headers.set('cache-control', getCacheControlHeader({ maxAge, swr: swr ?? maxAge * 60 }))\n  }\n  if (process.env.NODE_ENV !== 'production') {\n    let cacheStatusHeader: 'HIT' | 'STALE' | 'MISS' = 'MISS'\n    if (status === 'hit') cacheStatusHeader = 'HIT'\n    else if (status === 'stale') cacheStatusHeader = 'STALE'\n    headers.set('X-Theo-Cache', cacheStatusHeader)\n  }\n  return new Response(value.body, { status: value.status, headers })\n}\n","import { THEO_T_PREFIX } from './constants.js'\nimport type { CacheEntry, CacheStorageAdapter } from './storage-adapter.js'\n\nexport type CacheStatus = 'hit' | 'stale' | 'miss'\n\nexport interface CacheEngineOptions {\n  storage: CacheStorageAdapter\n  defaults?: {\n    maxAge?: number\n    swr?: number\n    cacheVersion?: string\n  }\n  onError?: (err: unknown, ctx: { phase: 'get' | 'set' | 'revalidate'; key: string }) => void\n}\n\nexport interface GetOrComputeOptions<T> {\n  maxAge: number\n  swr?: number\n  tags?: string[]\n  cacheVersion?: string\n  transform?: (raw: T) => T\n  validate?: (raw: T) => boolean\n  /**\n   * When `true`, the value is returned but NOT written to cache.\n   * Used by route middleware to bypass cache for uncacheable responses\n   * (Set-Cookie, oversized body, status >= 400 with cacheErrors=false).\n   */\n  skipCacheWhen?: (raw: T) => boolean\n}\n\nexport interface CacheEngine {\n  getOrCompute<T>(\n    key: string,\n    fn: () => Promise<T>,\n    opts: GetOrComputeOptions<T>,\n  ): Promise<{ value: T; status: CacheStatus }>\n\n  /**\n   * Public canonical cache read (T4.2 of architecture-review-remediation-plan,\n   * PV-5 DRY consolidation). Returns the parsed value + status (`hit` | `stale`)\n   * for callers that DON'T want to bind a loader function (e.g., HTTP route\n   * middleware that may want to bypass on miss instead of running a loader).\n   *\n   * Returns undefined when:\n   * - Entry not present in storage\n   * - `opts.cacheVersion` mismatch with entry\n   * - Body is not a JSON string (parse failed)\n   * - `opts.validate` returns false (or throws — caller's onError invoked)\n   * - Entry is fully expired (past maxAge + swr)\n   */\n  tryReadCached<T>(\n    key: string,\n    opts: { cacheVersion?: string; validate?: (v: T) => boolean },\n  ): Promise<{ value: T; status: 'hit' | 'stale' } | undefined>\n\n  set(key: string, entry: CacheEntry): Promise<void>\n  invalidate(key: string): Promise<boolean>\n  invalidateTag(tag: string): Promise<number>\n  revalidatePath(path: string, type?: 'layout' | 'page'): Promise<number>\n\n  /** Storage adapter passthrough (read-only access for diagnostics). */\n  readonly storage: CacheStorageAdapter\n}\n\n/**\n * Build a cache engine wrapping a storage adapter.\n *\n * Implements:\n * - SWR (fresh / stale / expired branching) — Astro `memory-provider.ts:423`-style.\n * - In-flight dedupe via `Map<key, Promise>` — Next.js `pendingRevalidates` pattern.\n * - Tag-based invalidation via adapter's deleteByTag.\n * - Path-as-tag encoding (revalidatePath sugar) — Next.js `revalidate.ts:105`.\n *\n * EC-8: Math.max(0, age) guards clock skew.\n * EC-9: validate callback wrapped in try/catch.\n * EC-10: loader returning undefined skips cache write + warns once.\n *\n * NOTE on max-lines-per-function disable below: createCacheEngine is a factory\n * closure that owns the in-flight/bg/warned maps. Splitting would force the\n * helpers across modules and re-introduce the shared mutable state through\n * parameter lists.\n */\n// eslint-disable-next-line max-lines-per-function\nexport function createCacheEngine(opts: CacheEngineOptions): CacheEngine {\n  const { storage, onError } = opts\n  const inFlight = new Map<string, Promise<unknown>>()\n  const bgInFlight = new Set<string>()\n  const undefinedLoaderWarned = new Set<string>()\n\n  async function getOrCompute<T>(\n    key: string,\n    fn: () => Promise<T>,\n    options: GetOrComputeOptions<T>,\n  ): Promise<{ value: T; status: CacheStatus }> {\n    // Dedupe: concurrent first-miss shares the loader promise\n    const pending = inFlight.get(key)\n    if (pending) {\n      const value = (await pending) as T\n      return { value, status: 'miss' }\n    }\n\n    // maxAge=0 → always miss, never cache\n    if (options.maxAge === 0) {\n      return claimAndRun(key, fn, options, /* skipWrite */ true)\n    }\n\n    // Atomically claim the in-flight slot BEFORE any await (dedupe race fix).\n    return claimAndRun(key, fn, options, false)\n  }\n\n  /**\n   * Claims the in-flight slot synchronously, then performs the get/loader work\n   * inside. Concurrent callers awaiting the same key share this slot.\n   */\n  function claimAndRun<T>(\n    key: string,\n    fn: () => Promise<T>,\n    options: GetOrComputeOptions<T>,\n    skipWrite: boolean,\n  ): Promise<{ value: T; status: CacheStatus }> {\n    let resolveOuter!: (v: T) => void\n    let rejectOuter!: (e: unknown) => void\n    const outerPromise = new Promise<T>((resolve, reject) => {\n      resolveOuter = resolve\n      rejectOuter = reject\n    })\n    // Prevent unhandled-rejection when no concurrent awaiter exists\n    void outerPromise.catch(() => {\n      /* swallow — the leader handles via work promise */\n    })\n    inFlight.set(key, outerPromise)\n\n    const work = (async (): Promise<{ value: T; status: CacheStatus }> => {\n      try {\n        if (!skipWrite) {\n          const cached = await tryReadCached<T>(key, options)\n          if (cached) {\n            // HIT or STALE — value already resolved\n            resolveOuter(cached.value)\n            if (cached.status === 'stale') {\n              scheduleBackgroundRevalidate(key, fn, options)\n            }\n            return cached\n          }\n        }\n        // Miss path: run loader\n        const value = await runLoader(key, fn, options, skipWrite)\n        resolveOuter(value)\n        return { value, status: 'miss' as const }\n      } catch (err) {\n        rejectOuter(err)\n        throw err\n      } finally {\n        inFlight.delete(key)\n      }\n    })()\n\n    return work\n  }\n\n  // One inline staleness machine; each guard (version check, parse, validate,\n  // age, swr window) is one short branch. Extracting per-step would dilute,\n  // not clarify.\n  // eslint-disable-next-line complexity\n  async function tryReadCached<T>(\n    key: string,\n    options: GetOrComputeOptions<T>,\n  ): Promise<{ value: T; status: CacheStatus } | undefined> {\n    let entry: CacheEntry | undefined\n    try {\n      entry = await storage.get(key)\n    } catch (err) {\n      onError?.(err, { phase: 'get', key })\n      return undefined\n    }\n    if (!entry) return undefined\n    if (options.cacheVersion !== undefined && entry.cacheVersion !== options.cacheVersion) {\n      return undefined\n    }\n    if (typeof entry.body !== 'string') return undefined\n    let parsed: T\n    try {\n      parsed = JSON.parse(entry.body) as T\n    } catch (err) {\n      onError?.(err, { phase: 'get', key })\n      return undefined\n    }\n    // EC-9: validate wrapped in try/catch\n    if (options.validate) {\n      try {\n        if (!options.validate(parsed)) return undefined\n      } catch (err) {\n        onError?.(err, { phase: 'get', key })\n        return undefined\n      }\n    }\n    // EC-8: clamp age to non-negative (clock skew)\n    const age = Math.max(0, (Date.now() - entry.storedAt) / 1000)\n    if (age <= entry.maxAge) {\n      const value = options.transform ? options.transform(parsed) : parsed\n      return { value, status: 'hit' }\n    }\n    if (age <= entry.maxAge + entry.swr) {\n      const value = options.transform ? options.transform(parsed) : parsed\n      return { value, status: 'stale' }\n    }\n    return undefined\n  }\n\n  // runLoader always returns `value` by design: loader output is the caller's\n  // contract; every branch short-circuits a *write*, never the return path.\n  // eslint-disable-next-line sonarjs/no-invariant-returns, complexity\n  async function runLoader<T>(\n    key: string,\n    fn: () => Promise<T>,\n    options: GetOrComputeOptions<T>,\n    skipWrite = false,\n  ): Promise<T> {\n    const raw = await fn()\n    const value = options.transform ? options.transform(raw) : raw\n\n    if (skipWrite) return value\n\n    // skipCacheWhen sentinel — caller-controlled skip-write\n    if (options.skipCacheWhen?.(value)) return value\n\n    // EC-9: validate during write\n    if (options.validate) {\n      let isValid = true\n      try {\n        isValid = options.validate(value)\n      } catch (err) {\n        onError?.(err, { phase: 'set', key })\n        return value\n      }\n      if (!isValid) return value\n    }\n\n    // EC-10: undefined return → warn-once + skip cache\n    if (value === undefined) {\n      if (!undefinedLoaderWarned.has(key)) {\n        undefinedLoaderWarned.add(key)\n        console.warn(`[theokit:cache] loader returned undefined for key \"${key}\"; entry not cached`)\n      }\n      return value\n    }\n\n    try {\n      const entry: CacheEntry = {\n        body: JSON.stringify(value),\n        status: 200,\n        headers: [],\n        storedAt: Date.now(),\n        maxAge: options.maxAge,\n        swr: options.swr ?? 0,\n        tags: options.tags ?? [],\n        cacheVersion: options.cacheVersion,\n      }\n      await storage.set(key, entry)\n    } catch (err) {\n      onError?.(err, { phase: 'set', key })\n    }\n    return value\n  }\n\n  function scheduleBackgroundRevalidate<T>(\n    key: string,\n    fn: () => Promise<T>,\n    options: GetOrComputeOptions<T>,\n  ): void {\n    if (bgInFlight.has(key)) return\n    bgInFlight.add(key)\n    void runLoader(key, fn, options)\n      .catch((err: unknown) => {\n        onError?.(err, { phase: 'revalidate', key })\n      })\n      .finally(() => {\n        bgInFlight.delete(key)\n      })\n  }\n\n  return {\n    storage,\n\n    getOrCompute,\n\n    async tryReadCached<T>(\n      key: string,\n      opts: { cacheVersion?: string; validate?: (v: T) => boolean },\n    ): Promise<{ value: T; status: 'hit' | 'stale' } | undefined> {\n      // Delegate to internal impl (which uses the broader GetOrComputeOptions\n      // type). tryReadCached never returns status: 'miss' — that codepath\n      // returns undefined. Narrow the type via assertion.\n      const result = await tryReadCached<T>(key, {\n        ...opts,\n        maxAge: 0, // unused by tryReadCached\n      })\n      if (!result) return undefined\n      return result as { value: T; status: 'hit' | 'stale' }\n    },\n\n    async set(key, entry) {\n      await storage.set(key, entry)\n    },\n\n    async invalidate(key) {\n      // Best-effort: clear in-flight too so next request starts fresh\n      inFlight.delete(key)\n      return storage.delete(key)\n    },\n\n    async invalidateTag(tag) {\n      return storage.deleteByTag(tag)\n    },\n\n    async revalidatePath(path, type) {\n      const tag = THEO_T_PREFIX + path + (type ? '/' + type : '')\n      return storage.deleteByTag(tag)\n    },\n  }\n}\n","import type { CacheEntry, CacheStorageAdapter } from './storage-adapter.js'\n\nexport interface InMemoryCacheAdapterOptions {\n  /** Maximum number of entries before LRU eviction. Default 1000. */\n  maxEntries?: number\n}\n\n/**\n * In-memory cache adapter with LRU eviction + reverse tag index.\n *\n * Uses Map insertion-order for O(1) LRU (Astro LRUMap pattern).\n * Reverse index `tagIndex: Map<tag, Set<key>>` makes deleteByTag O(matched-keys).\n *\n * Invariants:\n * - `entries.size <= maxEntries` post-set.\n * - `tagIndex[tag].has(key)` ↔ `entries.get(key)?.tags.includes(tag)`.\n *\n * eslint-disable @typescript-eslint/require-await — the CacheStorageAdapter\n * interface is intentionally async so Redis/file/external adapters fit. The\n * in-memory variant returns immediately but keeps the async signature to\n * satisfy the contract.\n */\n/* eslint-disable @typescript-eslint/require-await */\nexport class InMemoryCacheAdapter implements CacheStorageAdapter {\n  readonly name = 'memory'\n  readonly #entries = new Map<string, CacheEntry>()\n  readonly #tagIndex = new Map<string, Set<string>>()\n  readonly #maxEntries: number\n\n  constructor(opts: InMemoryCacheAdapterOptions = {}) {\n    this.#maxEntries = opts.maxEntries ?? 1000\n  }\n\n  async get(key: string): Promise<CacheEntry | undefined> {\n    const entry = this.#entries.get(key)\n    if (entry === undefined) return undefined\n    // LRU bump\n    this.#entries.delete(key)\n    this.#entries.set(key, entry)\n    return entry\n  }\n\n  async set(key: string, entry: CacheEntry): Promise<void> {\n    // Overwrite case: clean old tags first\n    const existing = this.#entries.get(key)\n    if (existing) {\n      this.#removeKeyFromTagIndex(key, existing.tags)\n      this.#entries.delete(key)\n    } else if (this.#entries.size >= this.#maxEntries) {\n      // LRU eviction\n      const oldestIter = this.#entries.keys().next()\n      if (!oldestIter.done) {\n        const oldestKey = oldestIter.value\n        const oldestEntry = this.#entries.get(oldestKey)\n        if (oldestEntry) {\n          this.#removeKeyFromTagIndex(oldestKey, oldestEntry.tags)\n        }\n        this.#entries.delete(oldestKey)\n      }\n    }\n    this.#entries.set(key, entry)\n    for (const tag of entry.tags) {\n      let bucket = this.#tagIndex.get(tag)\n      if (!bucket) {\n        bucket = new Set()\n        this.#tagIndex.set(tag, bucket)\n      }\n      bucket.add(key)\n    }\n  }\n\n  async delete(key: string): Promise<boolean> {\n    const entry = this.#entries.get(key)\n    if (!entry) return false\n    this.#removeKeyFromTagIndex(key, entry.tags)\n    this.#entries.delete(key)\n    return true\n  }\n\n  async deleteByTag(tag: string): Promise<number> {\n    const bucket = this.#tagIndex.get(tag)\n    if (!bucket || bucket.size === 0) return 0\n    const keys = [...bucket]\n    for (const key of keys) {\n      const entry = this.#entries.get(key)\n      if (entry) {\n        this.#unindexFromOtherTags(key, entry.tags, tag)\n      }\n      this.#entries.delete(key)\n    }\n    this.#tagIndex.delete(tag)\n    return keys.length\n  }\n\n  async size(): Promise<number> {\n    return this.#entries.size\n  }\n\n  async clear(): Promise<void> {\n    this.#entries.clear()\n    this.#tagIndex.clear()\n  }\n\n  async *keys(prefix?: string): AsyncIterableIterator<string> {\n    for (const key of this.#entries.keys()) {\n      if (prefix && !key.startsWith(prefix)) continue\n      yield key\n    }\n  }\n\n  #removeKeyFromTagIndex(key: string, tags: string[]): void {\n    for (const tag of tags) {\n      const bucket = this.#tagIndex.get(tag)\n      if (!bucket) continue\n      bucket.delete(key)\n      if (bucket.size === 0) this.#tagIndex.delete(tag)\n    }\n  }\n\n  #unindexFromOtherTags(key: string, tags: string[], skipTag: string): void {\n    for (const otherTag of tags) {\n      if (otherTag === skipTag) continue\n      const otherBucket = this.#tagIndex.get(otherTag)\n      if (!otherBucket) continue\n      otherBucket.delete(key)\n      if (otherBucket.size === 0) this.#tagIndex.delete(otherTag)\n    }\n  }\n}\n","import type { CacheEngine, CacheEngineOptions } from './cache-engine.js'\nimport { createCacheEngine } from './cache-engine.js'\nimport { InMemoryCacheAdapter } from './in-memory-adapter.js'\nimport type { CacheStorageAdapter } from './storage-adapter.js'\n\nexport interface NormalizedCacheConfig {\n  enabled: boolean\n  storage: 'memory' | CacheStorageAdapter\n  maxEntries: number\n  defaults: {\n    maxAge: number\n    swr?: number\n    cacheErrors: boolean\n  }\n}\n\nlet _engine: CacheEngine | undefined\n\n/**\n * Initialize the singleton cache engine for this process.\n * Throws if called twice; tests should call `_resetCacheEngine()` between.\n */\nexport function initCacheEngine(\n  config: NormalizedCacheConfig,\n  hooks: Pick<CacheEngineOptions, 'onError'> = {},\n): CacheEngine {\n  if (_engine) {\n    throw new Error(\n      'Cache engine already initialized — call _resetCacheEngine() in tests, or check init order in production.',\n    )\n  }\n  if (!config.enabled) {\n    throw new Error(\n      'initCacheEngine: config.enabled is false. Skip this call entirely when cache is disabled.',\n    )\n  }\n  const adapter =\n    config.storage === 'memory'\n      ? new InMemoryCacheAdapter({ maxEntries: config.maxEntries })\n      : config.storage\n  _engine = createCacheEngine({\n    storage: adapter,\n    defaults: config.defaults,\n    onError: hooks.onError,\n  })\n  return _engine\n}\n\n/**\n * Resolve the singleton cache engine.\n * Throws a clear error if not initialized — usually means the framework\n * bootstrap missed calling initCacheEngine, or cache.enabled is false.\n */\nexport function getCacheEngine(): CacheEngine {\n  if (!_engine) {\n    throw new Error(\n      'Cache engine not initialized. Ensure theo.config.ts has `cache.enabled: true` and the framework bootstrap called initCacheEngine.',\n    )\n  }\n  return _engine\n}\n\n/**\n * Test-only: clear the singleton so the next test can re-init.\n * Production code MUST NOT call this.\n */\nexport function _resetCacheEngine(): void {\n  _engine = undefined\n}\n","import { getCacheEngine } from './engine-singleton.js'\nimport { validateTags } from './validation.js'\n\nexport interface RevalidateResult {\n  deleted: number\n}\n\n/**\n * Invalidate all cache entries carrying the given tag.\n * Safe to call from any context (route handler, action, webhook).\n *\n * `opts.expire` accepted for API compatibility with Next.js; at MVP we delete\n * immediately (no SWR-with-expire semantics). A non-zero value emits one warn.\n */\nexport async function revalidateTag(\n  tag: string,\n  opts?: { expire?: number },\n): Promise<RevalidateResult> {\n  if (opts?.expire !== undefined && opts.expire > 0) {\n    warnOnce(\n      'revalidateTag-expire',\n      '[theokit:cache] revalidateTag opts.expire is accepted but not honored at MVP (entries are deleted immediately).',\n    )\n  }\n  const { valid } = validateTags([tag], 'revalidateTag')\n  if (valid.length === 0) return { deleted: 0 }\n  const engine = getCacheEngine()\n  const deleted = await engine.invalidateTag(valid[0])\n  return { deleted }\n}\n\n/**\n * Immediate invalidation (no SWR), Server-Action-safe.\n * Same semantics as revalidateTag at MVP; kept as separate name for\n * call-site clarity (\"I want fresh data NOW\").\n */\nexport async function updateTag(tag: string): Promise<RevalidateResult> {\n  const { valid } = validateTags([tag], 'updateTag')\n  if (valid.length === 0) return { deleted: 0 }\n  const engine = getCacheEngine()\n  const deleted = await engine.invalidateTag(valid[0])\n  return { deleted }\n}\n\n/**\n * Invalidate cached entries for a route path.\n * Sugar over `revalidateTag('_THEO_T_/${path}/${type?}')`.\n */\nexport async function revalidatePath(\n  path: string,\n  opts?: { type?: 'layout' | 'page'; expire?: number },\n): Promise<RevalidateResult> {\n  if (opts?.expire !== undefined && opts.expire > 0) {\n    warnOnce(\n      'revalidatePath-expire',\n      '[theokit:cache] revalidatePath opts.expire is accepted but not honored at MVP.',\n    )\n  }\n  const engine = getCacheEngine()\n  const deleted = await engine.revalidatePath(path, opts?.type)\n  return { deleted }\n}\n\nconst warnedKeys = new Set<string>()\nfunction warnOnce(key: string, message: string): void {\n  if (warnedKeys.has(key)) return\n  warnedKeys.add(key)\n  console.warn(message)\n}\n","import picomatch from 'picomatch'\n\nexport interface RouteRule {\n  maxAge?: number\n  swr?: number\n  tags?: string[]\n}\n\nexport type RouteRules = Record<string, RouteRule>\n\nexport interface CompiledRouteRule {\n  matcher: (path: string) => boolean\n  rule: RouteRule\n  /** Original glob pattern (for debugging). */\n  pattern: string\n}\n\n/**\n * Compile route-rule glob patterns into matcher functions.\n * First-match-wins semantics (preserves insertion order).\n *\n * EC-5: picomatch is a direct production dependency (see plan T7.2).\n */\nexport function compileRouteRules(rules: RouteRules): CompiledRouteRule[] {\n  return Object.entries(rules).map(([pattern, rule]) => ({\n    matcher: picomatch(pattern, { dot: true }),\n    rule,\n    pattern,\n  }))\n}\n\n/**\n * Resolve the first matching rule for `path`, or `undefined` if none match.\n */\nexport function resolveRouteRule(\n  path: string,\n  compiled: CompiledRouteRule[],\n): RouteRule | undefined {\n  for (const c of compiled) {\n    if (c.matcher(path)) return c.rule\n  }\n  return undefined\n}\n","import superjson from 'superjson'\n\nexport interface SerializedResponse {\n  json: unknown\n  meta?: unknown\n}\n\n/**\n * Serialize data using superjson for rich type support (Date, Map, Set, BigInt, etc.)\n */\nexport function serializeResponse(data: unknown): SerializedResponse {\n  return superjson.serialize(data)\n}\n\n/**\n * Deserialize data that was serialized with superjson.\n */\nexport function deserializeResponse(serialized: SerializedResponse): unknown {\n  return superjson.deserialize(serialized as Parameters<typeof superjson.deserialize>[0])\n}\n","import type { IncomingMessage, ServerResponse } from 'node:http'\n\nexport interface PluginContext {\n  request: IncomingMessage\n  response: ServerResponse\n  ctx: Record<string, unknown>\n  requestId: string\n}\n\nexport interface PluginErrorContext extends PluginContext {\n  error: unknown\n}\n\nexport interface RunHookOptions {\n  inErrorPath?: boolean\n}\n\nexport interface HookResult {\n  shortCircuited: boolean\n}\n\nexport type OnRequestHook = (ctx: PluginContext) => void | Promise<void>\nexport type PreHandlerHook = (ctx: PluginContext) => void | Promise<void>\nexport type OnResponseHook = (ctx: PluginContext) => void | Promise<void>\nexport type OnErrorHook = (ctx: PluginErrorContext) => void | Promise<void>\n\nexport type HookName = 'onRequest' | 'preHandler' | 'onResponse' | 'onError'\n\nexport type HookByName<K extends HookName> = K extends 'onError'\n  ? OnErrorHook\n  : K extends 'onRequest'\n    ? OnRequestHook\n    : K extends 'preHandler'\n      ? PreHandlerHook\n      : K extends 'onResponse'\n        ? OnResponseHook\n        : never\n\nexport interface TheoApp {\n  addHook<K extends HookName>(name: K, fn: HookByName<K>): void\n  // `T` lets plugin authors document the per-key shape of decorations.\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters -- T documents the value type for plugin authors\n  decorateRequest<T>(key: string, value: T): void\n}\n\nexport interface TheoPlugin {\n  name: string\n  register(app: TheoApp): void | Promise<void>\n}\n\n/**\n * Identity function for plugin authors. Provides auto-completion + type\n * inference at the call site (TanStack/Vite/Astro pattern). Pure runtime\n * no-op — returns the input unchanged.\n *\n * @example\n *   import { definePlugin } from 'theokit/server'\n *   export default definePlugin({\n *     name: 'my-plugin',\n *     register(app) {\n *       app.addHook('onRequest', (req) => { ... })\n *     },\n *   })\n *\n * Equivalent to `const p: TheoPlugin = {...}` but more ergonomic. See\n * ADR-0008 (D1 + D6) for the rationale.\n */\nexport function definePlugin(plugin: TheoPlugin): TheoPlugin {\n  return plugin\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaO,SAAS,YAOd,QACsD;AACtD,SAAO;AACT;;;ACZO,SAAS,aACd,QAC4B;AAC5B,SAAO;AACT;;;ACNO,SAAS,iBAAiB,SAA+C;AAC9E,SAAO;AACT;;;ACyDA,IAAM,cAAc;AAAA,EAClB,gBAAgB;AAAA,EAChB,iBAAiB;AAAA,EACjB,YAAY;AACd;AAEA,SAAS,UAAU,OAA+B;AAChD,SAAO,IAAI,YAAY,EAAE,OAAO,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA,CAAM;AACtE;AAYA,SAAS,mBAAmB,SAA+B;AACzD,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAO,IAAI,gBAAgB,EAAE;AAAA,EAC/B;AACA,QAAM,IAAI;AAKV,MACE,OAAO,EAAE,WAAW,YACpB,EAAE,WAAW,QACb,aAAa,EAAE,UACf,OAAQ,EAAE,OAAuB,qBAAqB,YACtD;AACA,WAAO,EAAE;AAAA,EACX;AAEA,QAAM,aAAa,IAAI,gBAAgB;AACvC,MAAI,EAAE,YAAY,KAAM,YAAW,MAAM;AACzC,MAAI,OAAO,EAAE,OAAO,YAAY;AAC9B,MAAE,GAAG,SAAS,MAAM;AAClB,UAAI,CAAC,WAAW,OAAO,QAAS,YAAW,MAAM;AAAA,IACnD,CAAC;AACD,MAAE,GAAG,WAAW,MAAM;AACpB,UAAI,CAAC,WAAW,OAAO,QAAS,YAAW,MAAM;AAAA,IACnD,CAAC;AAAA,EACH;AACA,SAAO,WAAW;AACpB;AAEO,SAAS,oBACd,QAC6E;AAC7E,SAAO;AAAA,IACL,SAAS,OAAO,EAAE,SAAS,KAAK,MAAM,OAAO,OAAO,MAAM;AACxD,YAAM,gBAAgB,IAAI,QAAQ;AAClC,YAAM,SAAS,mBAAmB,OAAO;AACzC,YAAM,YAAY,OAAO,QAAQ;AAAA,QAC/B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAWD,UAAI;AACJ,UAAI;AACJ,UAAI;AACF,sBAAc,MAAM,UAAU,KAAK;AAAA,MACrC,SAAS,KAAK;AACZ,qBAAa;AACb,sBAAc,EAAE,OAAO,QAAW,MAAM,KAAK;AAAA,MAC/C;AAGA,YAAM,kBAAkB,IAAI,QAAQ,WAAW;AAC/C,iBAAW,SAAS,cAAc,aAAa,GAAG;AAChD,wBAAgB,OAAO,cAAc,KAAK;AAAA,MAC5C;AAEA,YAAM,SAAS,IAAI,eAA2B;AAAA,QAC5C,MAAM,MAAM,YAAY;AACtB,gBAAM,UAAU,MAAM;AACpB,iBAAK,UAAU,OAAO,MAAS;AAAA,UACjC;AAEA,cAAI,OAAO,SAAS;AAClB,uBAAW,MAAM;AACjB;AAAA,UACF;AACA,iBAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAExD,cAAI;AAEF,gBAAI,eAAe,QAAW;AAC5B,kBAAI;AACJ,kBAAI,sBAAsB,OAAO;AAC/B,0BAAU,WAAW;AAAA,cACvB,WAAW,OAAO,eAAe,UAAU;AACzC,0BAAU;AAAA,cACZ,OAAO;AACL,0BAAU;AAAA,cACZ;AACA,yBAAW,QAAQ,UAAU,EAAE,MAAM,SAAS,QAAQ,CAAC,CAAC;AACxD;AAAA,YACF;AAEA,gBAAI,YAAY,SAAS,MAAM;AAC7B,yBAAW,QAAQ,UAAU,YAAY,KAAK,CAAC;AAAA,YACjD,OAAO;AACL;AAAA,YACF;AAEA,6BAAiB,SAAS,WAAW;AAMnC,kBAAI,OAAO,QAAS;AACpB,yBAAW,QAAQ,UAAU,KAAK,CAAC;AAAA,YACrC;AAAA,UACF,SAAS,KAAK;AACZ,kBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,uBAAW,QAAQ,UAAU,EAAE,MAAM,SAAS,QAAQ,CAAC,CAAC;AAAA,UAC1D,UAAE;AACA,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,uBAAW,MAAM;AAAA,UACnB;AAAA,QACF;AAAA,QACA,SAAS;AACP,eAAK,UAAU,OAAO,MAAS;AAAA,QACjC;AAAA,MACF,CAAC;AAED,aAAO,IAAI,SAAS,QAAQ,EAAE,SAAS,gBAAgB,CAAC;AAAA,IAC1D;AAAA,EACF;AACF;;;ACzNA,SAAS,uBAAuB;AA2DhC,IAAM,kBAAkB;AAExB,SAAS,YAAY,QAA4B;AAO/C,MAAI,UAAmB;AACvB,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS;AACvC,UAAM,MAAO,QACV;AACH,QAAI,KAAK,aAAa,YAAa,QAAO;AAC1C,QAAI,KAAK,WAAW,QAAW;AAC7B,gBAAU,IAAI;AACd;AAAA,IACF;AACA,QAAI,KAAK,cAAc,QAAW;AAChC,gBAAU,IAAI;AACd;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAoBO,SAAS,gBAAqC,MAA0C;AAC7F,MAAI,CAAC,gBAAgB,KAAK,KAAK,IAAI,GAAG;AACpC,UAAM,IAAI;AAAA,MACR,oCAAoC,gBAAgB,MAAM,UAAU,KAAK,UAAU,KAAK,IAAI,CAAC;AAAA,IAC/F;AAAA,EACF;AACA,MAAI,CAAC,YAAY,KAAK,WAAW,GAAG;AAClC,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,MAAI,KAAK,YAAY,WAAW,GAAG;AACjC,YAAQ;AAAA,MACN,mBAAmB,KAAK,UAAU,KAAK,IAAI,CAAC;AAAA,IAC9C;AAAA,EACF;AAKA,QAAM,YAAY,gBAAgB,KAAK,aAAa;AAAA,IAClD,QAAQ;AAAA,IACR,cAAc;AAAA,EAChB,CAAC;AAED,QAAM,EAAE,SAAS,UAAU,GAAG,YAAY,IAAI;AAI9C,SAAO;AAAA,IACL,MAAM,KAAK;AAAA,IACX,aAAa,KAAK;AAAA,IAClB;AAAA,IACA,SAAS,OAAO,UAAoD;AAClE,YAAM,SAAS,KAAK,YAAY,MAAM,KAAK;AAC3C,aAAO,MAAM,KAAK,QAAQ,MAAM;AAAA,IAClC;AAAA,EACF;AACF;;;AC3HO,SAAS,gBAAgB,SAA6C;AAC3E,SAAO;AACT;;;ACNO,SAAS,cACd,SAC0B;AAC1B,SAAO;AACT;;;ACTO,SAAS,iBAAiB,QAAgC;AAC/D,SAAO;AACT;;;ACKA,SAAS,YAAY,cAAc,gBAAgB;AACnD,SAAS,eAAe;AAEjB,IAAM,uBAAuB;AAOpC,SAAS,WAAW,KAAa,MAAkC;AACjE,QAAM,OAAO,QAAQ,KAAK,IAAI;AAC9B,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,OAAO,SAAS,IAAI;AAC1B,QAAI,KAAK,OAAO,sBAAsB;AACpC,cAAQ;AAAA,QACN,+BAA+B,IAAI,OAAO,KAAK,IAAI,eAAe,oBAAoB;AAAA,MACxF;AACA,aAAO;AAAA,IACT;AACA,WAAO,aAAa,MAAM,OAAO;AAAA,EACnC,SAAS,KAAK;AACZ,YAAQ,KAAK,4BAA4B,IAAI,KAAM,IAAc,OAAO,EAAE;AAC1E,WAAO;AAAA,EACT;AACF;AAMO,SAAS,qBAAqB,WAAqC;AACxE,SAAO;AAAA,IACL,eAAe,WAAW,WAAW,UAAU;AAAA,IAC/C,eAAe,WAAW,WAAW,UAAU;AAAA,EACjD;AACF;;;AC/CA,SAAS,cAAAA,aAAY,gBAAAC,eAAc,YAAAC,iBAAgB;AAEnD,SAAS,WAAAC,UAAS,eAAe;AAEjC,IAAM,aAAqC;AAAA,EACzC,SAAS;AAAA,EACT,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,SAAS,gBACd,KACA,KACA,WACS;AACT,QAAM,WAAW,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAG7C,QAAM,WAAWA,SAAQ,WAAW,MAAM,OAAO;AACjD,MAAI,CAAC,SAAS,WAAW,SAAS,GAAG;AACnC,QAAI,UAAU,GAAG;AACjB,QAAI,IAAI,WAAW;AACnB,WAAO;AAAA,EACT;AAEA,MAAI,CAACH,YAAW,QAAQ,EAAG,QAAO;AAElC,QAAM,OAAOE,UAAS,QAAQ;AAC9B,MAAI,CAAC,KAAK,OAAO,EAAG,QAAO;AAE3B,QAAM,MAAM,QAAQ,QAAQ;AAC5B,QAAM,cAAc,WAAW,GAAG,KAAK;AACvC,QAAM,UAAUD,cAAa,QAAQ;AAErC,MAAI,UAAU,KAAK;AAAA,IACjB,gBAAgB;AAAA,IAChB,kBAAkB,QAAQ;AAAA,EAC5B,CAAC;AACD,MAAI,IAAI,OAAO;AACf,SAAO;AACT;;;ACvDA,SAAS,cAAAG,aAAY,gBAAAC,eAAc,eAAe,iBAAiB;AACnE,SAAS,MAAM,WAAAC,UAAS,gBAAgB;AA4CjC,SAAS,iBAAiB,WAAiC;AAChE,QAAM,SAAS,iBAAiB,SAAS;AACzC,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,aAAa,oBAAoB,SAAS;AAEhD,SAAO;AAAA,IACL,SAAS;AAAA,IACT,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,MACzB,UAAU,SAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,WAAW,EAAE;AAAA,MACb,YAAY,EAAE;AAAA,IAChB,EAAE;AAAA,IACF,SAAS,QAAQ,IAAI,CAAC,OAAO;AAAA,MAC3B,UAAU,SAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,YAAY,EAAE;AAAA,IAChB,EAAE;AAAA,IACF,YAAY,WAAW,IAAI,CAAC,OAAO;AAAA,MACjC,UAAU,SAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,QAAQ,EAAE;AAAA,IACZ,EAAE;AAAA,EACJ;AACF;AAIO,SAAS,cAAc,UAAwB,WAAyB;AAC7E,YAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AACxC,QAAM,eAAe,KAAK,WAAW,eAAe;AACpD,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC/D;AAIO,SAAS,aAAa,SAAiB,WAAmC;AAC/E,QAAM,eAAe,KAAK,SAAS,eAAe;AAElD,MAAI,CAACC,YAAW,YAAY,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB,YAAY,2BAA2B;AAAA,EACjF;AAEA,QAAM,MAAM,KAAK,MAAMC,cAAa,cAAc,OAAO,CAAC;AAE1D,QAAM,SAA4B,IAAI,OAAO,IAAI,CAAC,MAAM;AACtD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,EAAE,SAAS;AAC1D,WAAO;AAAA,MACL,UAAUC,SAAQ,WAAW,EAAE,QAAQ;AAAA,MACvC,WAAW,EAAE;AAAA,MACb;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,UAAwB,IAAI,QAAQ,IAAI,CAAC,OAAO;AAAA,IACpD,UAAUA,SAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,YAAY,EAAE;AAAA,EAChB,EAAE;AAEF,QAAM,aAAmC,IAAI,WAAW,IAAI,CAAC,OAAO;AAAA,IAClE,UAAUA,SAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,QAAQ,EAAE;AAAA,EACZ,EAAE;AAEF,SAAO,EAAE,QAAQ,SAAS,WAAW;AACvC;;;AChCA,SAAS,kBAAkB,OAAwB;AACjD,MAAI;AACF,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,SAAS,SAAS,MAAwC;AACxD,MAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,CAAC,MAAM,QAAQ,IAAI,GAAG;AACrE,WAAO;AAAA,EACT;AACA,SAAO,CAAC;AACV;AAoCA,SAAS,YAAY,KAA6C;AAIhE,QAAM,IAAI;AAIV,SACE,EAAE,SAAS,eACX,EAAE,WAAW,QACb,OAAO,EAAE,YAAY,YACrB,MAAM,QAAQ,EAAE,QAAQ,OAAO;AAEnC;AACA,SAAS,WAAW,KAA4C;AAC9D,QAAM,IAAI;AAMV,SACE,EAAE,SAAS,eACX,OAAO,EAAE,SAAS,YAClB,OAAO,EAAE,YAAY,aACpB,EAAE,WAAW,aAAa,EAAE,WAAW,eAAe,EAAE,WAAW;AAExE;AAiCA,SAAS,gBAAgB,KAAwC;AAC/D,MAAI,EAAE,eAAe,OAAQ,QAAO;AACpC,QAAM,IAAI;AACV,SAAO,UAAU,KAAK,OAAO,EAAE,SAAS;AAC1C;AAWO,SAAS,aAAa,KAAc,IAA8B;AACvE,MAAI,gBAAgB,GAAG,GAAG;AACxB,UAAMC,SAAyB;AAAA,MAC7B,MAAM;AAAA,MACN,SAAS,IAAI;AAAA,MACb,MAAM,IAAI;AAAA,IACZ;AACA,QAAI,IAAI,aAAa,OAAW,CAAAA,OAAM,WAAW,IAAI;AACrD,QAAI,IAAI,cAAc,OAAW,CAAAA,OAAM,YAAY,IAAI;AACvD,QAAI,IAAI,iBAAiB,OAAW,CAAAA,OAAM,eAAe,IAAI;AAC7D,QAAI,OAAO,OAAW,CAAAA,OAAM,KAAK;AACjC,WAAOA;AAAA,EACT;AAEA,MAAI;AACJ,MAAI,eAAe,OAAO;AACxB,cAAU,IAAI;AAAA,EAChB,WAAW,OAAO,QAAQ,UAAU;AAClC,cAAU;AAAA,EACZ,WAAW,QAAQ,QAAQ,OAAO,QAAQ,YAAY,aAAa,KAAK;AACtE,UAAM,YAAsB,IAAgC;AAE5D,cAAU,OAAO,cAAc,WAAW,YAAY;AAAA,EACxD,WAAW,QAAQ,QAAQ,QAAQ,QAAW;AAC5C,cAAU,OAAO,GAAG;AAAA,EACtB,OAAO;AACL,cAAU;AAAA,EACZ;AACA,QAAM,QAAyB,EAAE,MAAM,SAAS,QAAQ;AACxD,MAAI,OAAO,OAAW,OAAM,KAAK;AACjC,SAAO;AACT;AAEA,SAAS,kBAAkB,KAA+B;AACxD,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,MAAM,IAAI;AAAA,MACV,MAAM,SAAS,IAAI,IAAI;AAAA,MACvB,IAAI,IAAI;AAAA,IACV;AAAA,EACF;AACA,MAAI,IAAI,WAAW,aAAa;AAC9B,UAAM,OAAO,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS,kBAAkB,IAAI,MAAM;AACvF,WAAO;AAAA,MACL,MAAM;AAAA,MACN,MAAM,IAAI;AAAA,MACV;AAAA,MACA,IAAI,IAAI;AAAA,IACV;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS,QAAQ,IAAI,IAAI;AAC9E,SAAO,EAAE,MAAM,SAAS,SAAS,IAAI,IAAI,QAAQ;AACnD;AAEA,gBAAuB,eACrB,KAC2C;AAC3C,mBAAiB,OAAO,IAAI,OAAO,GAAG;AACpC,QAAI,YAAY,GAAG,GAAG;AACpB,iBAAW,SAAS,IAAI,QAAQ,SAAS;AACvC,YAAI,MAAM,SAAS,UAAU,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,GAAG;AACpF,gBAAM,EAAE,MAAM,WAAW,SAAS,MAAM,KAAK;AAAA,QAC/C;AAAA,MACF;AAAA,IACF,WAAW,WAAW,GAAG,GAAG;AAC1B,YAAM,kBAAkB,GAAG;AAAA,IAC7B;AAAA,EAGF;AAEA,QAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,MAAI,OAAO,WAAW,WAAW,OAAO,UAAU,QAAW;AAC3D,UAAM,aAAa,OAAO,KAAK;AAAA,EACjC;AACF;;;ACvOA,IAAM,mBAAyC;AAAA,EAC7C;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AACF;AAMA,IAAM,WAAiC,CAAC,GAAG,gBAAgB;AAkDpD,SAAS,kBAAoC;AAClD,QAAM,SAAS,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AACnE,aAAW,QAAQ,QAAQ;AACzB,UAAM,SAAS,QAAQ,IAAI,KAAK,MAAM;AACtC,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,aAAO;AAAA,QACL,MAAM,KAAK;AAAA,QACX;AAAA,QACA,SAAS,KAAK;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,MAAM;AACvD,QAAM,IAAI;AAAA,IACR,6DAA6D,OAAO;AAAA,EAEtE;AACF;AAQO,SAAS,qBAA8C;AAC5D,MAAI;AACF,WAAO,gBAAgB;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACxBA,IAAI,cAA4C;AAGzC,SAAS,iBAAiB,KAA6B;AAC5D,gBAAc;AAChB;AAGO,SAAS,qBAA2B;AACzC,gBAAc;AAChB;AAEA,eAAe,UAA8B;AAI3C,MAAI,gBAAgB,MAAM;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,gBAAgB,OAAW,QAAO;AACtC,MAAI;AASF,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,QAAa;AACpD,UAAM,YAAY,cAAc,YAAY,GAAG;AAC/C,UAAM,OAAO;AACb,UAAM,MAAM,UAAU,IAAI;AAC1B,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,EAAE,MAAM;AAAA,IACV;AAAA,EACF;AACF;AAMA,IAAM,sBAAsB;AAC5B,IAAM,yBAAyB,KAAK,KAAK,KAAK;AAU9C,IAAM,iBAAiB;AAEvB,SAAS,eAAe,GAA2C;AACjE,SAAO,OAAO,MAAM,YAAY,eAAe,KAAK,CAAC;AACvD;AAMA,SAAS,gBACP,SACA,MACoB;AACpB,MAAI;AACJ,QAAM,IAAI,QAAQ;AAClB,MAAI,MAAM,OAAW,QAAO;AAC5B,MAAI,OAAQ,EAAc,QAAQ,YAAY;AAC5C,UAAO,EAAc,IAAI,QAAQ,KAAK;AAAA,EACxC,OAAO;AACL,UAAO,EAA0B;AAAA,EACnC;AACA,MAAI,QAAQ,UAAa,IAAI,WAAW,EAAG,QAAO;AAClD,QAAM,QAAQ,IAAI,MAAM,MAAM;AAC9B,aAAW,QAAQ,OAAO;AACxB,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,KAAK,EAAG;AACZ,UAAM,IAAI,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACjC,QAAI,MAAM,KAAM,QAAO,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,EACjD;AACA,SAAO;AACT;AASA,SAAS,gBAAgB,MAAc,OAAe,SAAyC;AAC7F,QAAM,QAAkB,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE;AAC3C,MAAI,QAAQ,SAAS,OAAW,OAAM,KAAK,QAAQ,QAAQ,IAAI,EAAE;AACjE,MAAI,QAAQ,WAAW,OAAW,OAAM,KAAK,WAAW,QAAQ,MAAM,EAAE;AACxE,MAAI,QAAQ,aAAa,QAAW;AAClC,UAAM,IAAI,QAAQ,SAAS,OAAO,CAAC,EAAE,YAAY,IAAI,QAAQ,SAAS,MAAM,CAAC;AAC7E,UAAM,KAAK,YAAY,CAAC,EAAE;AAAA,EAC5B;AACA,MAAI,QAAQ,aAAa,KAAM,OAAM,KAAK,UAAU;AACpD,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAsB,0BACpB,MACoC;AACpC,QAAM,aAAa,KAAK,cAAc;AAItC,QAAM,YAAY,KAAK;AACvB,QAAM,eACJ,OAAO,cAAc,YAAY,YAAY,IAAI,YAAY;AAI/D,MAAI;AACJ,MAAI,QAAQ;AACZ,QAAM,kBAAkB,gBAAgB,KAAK,SAAS,UAAU;AAEhE,MAAI,eAAe,KAAK,OAAO,GAAG;AAChC,qBAAiB,KAAK;AAAA,EACxB,WAAW,KAAK,YAAY,QAAQ,KAAK,YAAY,QAAW;AAC9D,UAAM,MAAM,KAAK,QAAQ;AACzB,QAAI,eAAe,GAAG,EAAG,kBAAiB;AAAA,EAC5C;AACA,MAAI,mBAAmB,UAAa,eAAe,eAAe,GAAG;AACnE,qBAAiB;AAAA,EACnB;AAEA,MAAI,mBAAmB,QAAW;AAChC,qBAAiB,OAAO,WAAW;AACnC,YAAQ;AAAA,EACV;AAWA,QAAM,oBAAoB,SAAS,oBAAoB;AACvD,MAAI,qBAAqB,KAAK,aAAa,QAAW;AACpD,UAAM,SAAS,gBAAgB,YAAY,gBAAgB;AAAA,MACzD,UAAU;AAAA,MACV,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,SAAK,SAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,EACnD;AAQA,QAAM,kBAAkB,4BAA4B,KAAK,OAAO;AAGhE,QAAM,MAAM,MAAM,QAAQ;AAC1B,QAAM,QAAQ,MAAM,IAAI,MAAM,YAAY,gBAAgB,eAAe;AAEzE,SAAO,EAAE,OAAO,gBAAgB,MAAM;AACxC;AAaA,SAAS,4BAA4B,SAA2C;AAE9E,MAAI,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS,GAAG;AACnE,WAAO;AAAA,EACT;AAQA,QAAM,WAAW,mBAAmB;AACpC,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,IAKF;AAAA,EACF;AAIA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,SAAS;AAAA,IACjB,WAAW;AAAA,MACT,QAAQ;AAAA,QACN,EAAE,YAAY,QAAQ,UAAU,SAAS,MAAM,SAAS,SAAS,QAAQ;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACF;;;AC3WA,SAAS,kBAAkB;AA0C3B,SAAS,cAAc,OAAuB;AAC5C,QAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,MAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAG,EAAG,QAAO,QAAQ,MAAM,GAAG,EAAE;AAC3E,SAAO;AACT;AAOO,SAAS,kBAAkB,MAAc,SAAmC;AACjF,QAAM,YAAY,cAAc,IAAI;AACpC,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO,cAAc,cAAc,OAAO;AAAA,EAC5C;AACA,UAAQ,YAAY;AACpB,SAAO,QAAQ,KAAK,SAAS;AAC/B;AAOA,SAAS,aAAa,OAAuB;AAC3C,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,WAAW,EAAE,MAAM,GAAG,EAAE;AAC3E;AAMA,SAAS,WAAW,KAAsB,MAAkC;AAC1E,SAAO,kBAAkB,IAAI,QAAQ,UAAU,MAAS,EAAE,IAAI,IAAI;AACpE;AAUO,SAAS,UAAU,KAAsB,OAAkB,YAA4B;AAC5F,MAAI,OAAO,UAAU,WAAY,QAAO,MAAM,GAAG;AAKjD,QAAM,KAAK,IAAI,QAAQ,iBAAiB;AACxC,UAAQ,OAAO;AAAA,IACb,KAAK,WAAW;AACd,YAAM,SAAS,WAAW,KAAK,UAAU;AACzC,aAAO,SAAS,WAAW,aAAa,MAAM,CAAC,KAAK,MAAM,EAAE;AAAA,IAC9D;AAAA,IACA,KAAK,QAAQ;AACX,YAAM,SAAU,IAA8C,MAAM;AACpE,aAAO,SAAS,QAAQ,MAAM,KAAK,MAAM,EAAE;AAAA,IAC7C;AAAA,IACA,KAAK;AAAA,IACL;AACE,aAAO,MAAM,EAAE;AAAA,EACnB;AACF;AASO,SAAS,uBAAuB,QAAgD;AAErF,QAAM,SACJ,cAAc,UAAU,SAAS,UAAU,EAAE,aAAa,WAAW,EAAE,YAAY;AACrF,QAAM,MAA4B,SAAS,EAAE,SAAS,OAAO,IAAI;AAEjE,QAAM,QAAQ,IAAI,SAAS,IAAI,cAAc;AAK7C,MAAI,EAAE,iBAAiB,gBAAgB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,gBAAgB;AACtB,QAAM,QAAQ,IAAI,SAAS;AAC3B,QAAM,aAAa,IAAI,cAAc;AAGrC,QAAM,cAAoD,CAAC;AAC3D,MAAI,IAAI,QAAQ;AACd,eAAW,CAAC,SAAS,CAAC,KAAK,OAAO,QAAQ,IAAI,MAAM,EAAG,aAAY,KAAK,CAAC,SAAS,CAAC,CAAC;AAAA,EACtF;AACA,MAAI,IAAI,eAAe;AACrB,eAAW,SAAS,IAAI,cAAe,aAAY,KAAK,KAAK;AAAA,EAC/D;AAEA,SAAO,SAAS,oBAAoB,KAAuC;AACzE,UAAM,MAAM,IAAI,OAAO;AACvB,QAAI;AACJ,eAAW,CAAC,SAAS,CAAC,KAAK,aAAa;AACtC,UAAI,kBAAkB,KAAK,OAAO,GAAG;AACnC,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,WAAW,IAAI;AACjC,QAAI,CAAC,WAAW;AAEd,aAAO,EAAE,SAAS,OAAO,SAAS,CAAC,EAAE;AAAA,IACvC;AAIA,UAAM,eAAe,OAAO,YAAY,cAAc,cAAc,cAAc,GAAG;AACrF,UAAM,MAAM,GAAG,UAAU,KAAK,OAAO,UAAU,CAAC,IAAI,YAAY;AAChE,UAAM,QAAQ,cAAc,SAAS,KAAK,UAAU,QAAQ;AAE5D,QAAI,MAAM,QAAQ,UAAU,KAAK;AAC/B,YAAM,aAAa,KAAK,MAAM,MAAM,UAAU,KAAK,IAAI,KAAK,GAAI;AAChE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,UACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,UACzC,yBAAyB;AAAA,UACzB,eAAe,OAAO,UAAU;AAAA,QAClC;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,QACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,QACzC,yBAAyB,OAAO,KAAK,IAAI,GAAG,UAAU,MAAM,MAAM,KAAK,CAAC;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;;;ACxLO,IAAM,iBAAN,MAAqB;AAAA,EAClB,QAAQ,oBAAI,IAAgC;AAAA,EAC5C,UAAU,oBAAI,IAAgC;AAAA,EAEtD,UAAU,IAAmB,MAAoB;AAC/C,QAAI,UAAU,KAAK,MAAM,IAAI,IAAI;AACjC,QAAI,CAAC,SAAS;AACZ,gBAAU,oBAAI,IAAI;AAClB,WAAK,MAAM,IAAI,MAAM,OAAO;AAAA,IAC9B;AACA,YAAQ,IAAI,EAAE;AAEd,QAAI,QAAQ,KAAK,QAAQ,IAAI,EAAE;AAC/B,QAAI,CAAC,OAAO;AACV,cAAQ,oBAAI,IAAI;AAChB,WAAK,QAAQ,IAAI,IAAI,KAAK;AAAA,IAC5B;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AAAA,EAEA,YAAY,IAAmB,MAAoB;AACjD,SAAK,MAAM,IAAI,IAAI,GAAG,OAAO,EAAE;AAC/B,QAAI,KAAK,MAAM,IAAI,IAAI,GAAG,SAAS,EAAG,MAAK,MAAM,OAAO,IAAI;AAE5D,SAAK,QAAQ,IAAI,EAAE,GAAG,OAAO,IAAI;AACjC,QAAI,KAAK,QAAQ,IAAI,EAAE,GAAG,SAAS,EAAG,MAAK,QAAQ,OAAO,EAAE;AAAA,EAC9D;AAAA,EAEA,UAAU,MAAc,MAAe,SAA+B;AACpE,UAAM,UAAU,KAAK,MAAM,IAAI,IAAI;AACnC,QAAI,CAAC,QAAS;AAEd,UAAM,MAAM,KAAK,UAAU,IAAI;AAC/B,eAAW,MAAM,SAAS;AACxB,UAAI,OAAO,QAAS,IAAG,KAAK,GAAG;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,aAAa,MAAqB;AAChC,UAAM,MAAM,KAAK,UAAU,IAAI;AAC/B,UAAM,OAAO,oBAAI,IAAmB;AACpC,eAAW,WAAW,KAAK,MAAM,OAAO,GAAG;AACzC,iBAAW,MAAM,SAAS;AACxB,YAAI,CAAC,KAAK,IAAI,EAAE,GAAG;AACjB,aAAG,KAAK,GAAG;AACX,eAAK,IAAI,EAAE;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,YAAY,MAAsB;AAChC,WAAO,KAAK,MAAM,IAAI,IAAI,GAAG,QAAQ;AAAA,EACvC;AAAA,EAEA,QAAQ,IAAyB;AAC/B,UAAM,QAAQ,KAAK,QAAQ,IAAI,EAAE;AACjC,QAAI,OAAO;AACT,iBAAW,QAAQ,OAAO;AACxB,aAAK,MAAM,IAAI,IAAI,GAAG,OAAO,EAAE;AAC/B,YAAI,KAAK,MAAM,IAAI,IAAI,GAAG,SAAS,EAAG,MAAK,MAAM,OAAO,IAAI;AAAA,MAC9D;AAAA,IACF;AACA,SAAK,QAAQ,OAAO,EAAE;AAAA,EACxB;AACF;;;ACxBO,IAAM,qBAAN,MAAM,oBAAmB;AAAA,EAC9B,OAAgB,cAAc;AAAA,EACb,UAAU,oBAAI,IAAyB;AAAA,EAEhD,OAAO,OAA+B;AAC5C,WAAO,GAAG,MAAM,MAAM,KAAI,MAAM,IAAI,KAAI,MAAM,MAAM;AAAA,EACtD;AAAA,EAEA,OAAO,OAA6B;AAClC,UAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;AACrC,QAAI,UAAU;AACZ,eAAS;AACT,eAAS,WAAW;AACpB;AAAA,IACF;AACA,QAAI,KAAK,QAAQ,QAAQ,oBAAmB,aAAa;AACvD,YAAM,WAAW,KAAK,QAAQ,KAAK,EAAE,KAAK,EAAE;AAC5C,UAAI,aAAa,OAAW,MAAK,QAAQ,OAAO,QAAQ;AAAA,IAC1D;AACA,SAAK,QAAQ,IAAI,KAAK,EAAE,OAAO,GAAG,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,EACnE;AAAA,EAEA,UAAgC;AAC9B,QAAI,QAAQ;AACZ,UAAM,SAAsC,CAAC;AAC7C,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,SAAS;AACvC,YAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,IAAI,MAAM,IAAG;AAC5C,aAAO,KAAK;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,MAAM;AAAA,QACb,WAAW,MAAM;AAAA,QACjB,UAAU,MAAM;AAAA,MAClB,CAAC;AACD,eAAS,MAAM;AAAA,IACjB;AACA,WAAO;AAAA,MACL,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,aAAa;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,QAAQ,MAAM;AAAA,EACrB;AACF;;;AC3DO,IAAM,iBAAN,MAAqB;AAAA,EAC1B;AAAA,EACS,WAAW,oBAAI,IAAsB;AAAA,EACrC,gBAAgB,oBAAI,IAAuB;AAAA,EAC3C,kBAAkB,oBAAI,IAAqB;AAAA,EAC3C,YAAY,oBAAI,IAAoB;AAAA,EAC7C,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAMZ,UAAU,QAA6B;AACrC,QAAI,KAAK,YAAY,QAAW;AAC9B,cAAQ,KAAK,+EAA+E;AAC5F;AAAA,IACF;AACA,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,WAAc,MAAc,SAAqB;AAC/C,QAAI,KAAK,UAAW,OAAM,IAAI,MAAM,4BAA4B;AAChE,QAAI,KAAK,gBAAgB,IAAI,IAAI,EAAG,QAAO,KAAK,gBAAgB,IAAI,IAAI;AACxE,UAAM,SAAS,QAAQ;AACvB,SAAK,gBAAgB,IAAI,MAAM,MAAM;AACrC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,YAAY,QAAgB,SAAoC;AAC9D,QAAI,KAAK,UAAW,OAAM,IAAI,MAAM,4BAA4B;AAChE,UAAM,SAAS,KAAK,SAAS,IAAI,MAAM;AACvC,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,WAAW,KAAK,SAAS,YAAY,MAAM;AACjD,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI;AAAA,QACR,aAAa,MAAM;AAAA,MACrB;AAAA,IACF;AACA,UAAM,SAAS,KAAK,SAAS,UAAU,SAAS,MAAM;AACtD,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI;AAAA,QACR,WAAW,SAAS,MAAM,6BAA6B,MAAM;AAAA,MAC/D;AAAA,IACF;AACA,UAAM,OAAO,QAAQ,QAAQ,QAAQ;AACrC,SAAK,SAAS,IAAI,QAAQ,IAAI;AAC9B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAS,YAAoB,SAAkC;AAC7D,QAAI,KAAK,UAAW,OAAM,IAAI,MAAM,4BAA4B;AAChE,UAAM,SAAS,KAAK,cAAc,IAAI,UAAU;AAChD,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,eAAe,KAAK,SAAS,QAAQ,UAAU;AACrD,QAAI,iBAAiB,QAAW;AAC9B,YAAM,IAAI;AAAA,QACR,iBAAiB,UAAU;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,YAAY;AACnC,SAAK,cAAc,IAAI,YAAY,MAAM;AACzC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,SAA+B;AACtC,QAAI,KAAK,WAAW;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,UAAU,IAAI,OAAO;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,UAAyB;AAC7B,QAAI,KAAK,UAAW;AACpB,SAAK,YAAY;AAEjB,UAAM,gBAAgB,MAAM,KAAK,KAAK,SAAS,EAAE;AAAA,MAAI,CAAC,MACpD,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAiB;AAClC,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,gBAAQ,KAAK,sBAAsB,EAAE,IAAI,qBAAqB,GAAG,EAAE;AAAA,MACrE,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,IAAI,aAAa;AAE/B,UAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS;AAIlE,UAAI,KAAK,QAAQ,OAAW,QAAO,QAAQ,QAAQ;AACnD,aAAO,KAAK,IAAI,EAAE,MAAM,CAAC,QAAiB;AACxC,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,gBAAQ,KAAK,mCAAmC,GAAG,EAAE;AAAA,MACvD,CAAC;AAAA,IACH,CAAC;AACD,UAAM,QAAQ,IAAI,UAAU;AAE5B,UAAM,cAAc,MAAM,KAAK,KAAK,cAAc,OAAO,CAAC,EAAE;AAAA,MAAI,CAAC,MAC/D,EAAE,KAAK,EAAE,MAAM,CAAC,QAAiB;AAC/B,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,gBAAQ,KAAK,4DAA4D,GAAG,EAAE;AAC9E,UAAE,WAAW;AAAA,MACf,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,IAAI,WAAW;AAE7B,SAAK,SAAS,MAAM;AACpB,SAAK,cAAc,MAAM;AACzB,SAAK,gBAAgB,MAAM;AAC3B,SAAK,UAAU,MAAM;AAAA,EACvB;AAAA;AAAA,EAGA,kBAAwB;AACtB,SAAK,UAAU;AACf,SAAK,SAAS,MAAM;AACpB,SAAK,cAAc,MAAM;AACzB,SAAK,gBAAgB,MAAM;AAC3B,SAAK,UAAU,MAAM;AACrB,SAAK,YAAY;AAAA,EACnB;AAAA;AAAA,EAGA,yBAAkC;AAChC,WAAO,KAAK,YAAY;AAAA,EAC1B;AAAA;AAAA,EAGA,uBAAgC;AAC9B,WAAO,KAAK;AAAA,EACd;AACF;AAGA,IAAI;AAEG,SAAS,oBAAoC;AAClD,kBAAgB,IAAI,eAAe;AACnC,SAAO;AACT;AAGO,SAAS,2BAAiC;AAC/C,gBAAc;AAChB;;;ACzLA,eAAsB,aACpB,MACA,QAC+B;AAC/B,QAAM,MAAO,MAAM,OAAO,WAAW,EAAE,MAAM,MAAM,IAAI;AACvD,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,kBAAkB;AAClC,SAAO,QAAQ,WAAiC,eAAe,IAAI,IAAI,MAAM;AAC3E,UAAM,UAAU,IAAI,cAAiB,EAAE,OAAO,CAAC;AAC/C,YAAQ,SAAS;AAAA,MACf,MAAM,aAAa,IAAI;AAAA,MACvB,SAAS,MAAM,QAAQ,UAAU,KAAK,QAAQ,QAAQ;AAAA,IACxD,CAAC;AACD,WAAO;AAAA,EACT,CAAC;AACH;;;ACPA,SAAS,uBAAuB,WAAmC;AACjE,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,KAAK;AACX,SAAK,GAAG,UAAU,KAAK,GAAG;AACxB,YAAM,OAAO,GAAG,SAAS,UAAa,GAAG,SAAS,KAAK,GAAG,OAAO;AACjE,aACE,mFAAmF,OAAO,GAAG,MAAM,CAAC,8DACtD,IAAI,mBAAmB,IAAI;AAAA,IAG7E;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,YAAY,MAAc,WAA0C;AACxF,QAAM,eAAe,uBAAuB,SAAS;AACrD,MAAI,iBAAiB,KAAM,OAAM,IAAI,MAAM,YAAY;AAEvD,QAAM,MAAO,MAAM,OAAO,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,QAAM,UAAU,kBAAkB;AAClC,SAAO,QAAQ,WAAwB,SAAS,IAAI,IAAI,MAAM,IAAI,eAAe,SAAS,CAAC;AAC7F;;;ACzDA,IAAI;AAEJ,SAAS,kBAA8C;AACrD,MAAI,mBAAmB,OAAW,QAAO;AACzC,MAAI;AAIF,UAAM,YAAY,UAAQ,QAAa;AAGvC,qBAAiB,UAAU,mBAAmB;AAAA,EAChD,QAAQ;AACN,qBAAiB;AAAA,EACnB;AACA,SAAO;AACT;AAQO,SAAS,gBAAgB,GAAe,GAAwB;AACrE,MAAI,EAAE,aAAa,eAAe,EAAE,aAAa,aAAa;AAC5D,UAAM,IAAI;AAAA,MACR,qDAAqD,OAAO,CAAC,QAAQ,OAAO,CAAC;AAAA,IAC/E;AAAA,EACF;AAEA,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,EAAE,WAAW,EAAG,QAAO;AAK3B,QAAM,WAAW,gBAAgB;AACjC,MAAI,SAAU,QAAO,SAAS,GAAG,CAAC;AAKlC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,YAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;AAAA,EACpB;AACA,SAAO,SAAS;AAClB;;;AClDO,IAAM,yBAAyB;AAmB/B,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAI3C,YACkB,OACA,YAChB;AACA,UAAM,2CAA2C,UAAU,iBAAiB,KAAK,QAAQ;AAHzE;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EALkB;AAAA,EACA;AAAA,EALT,SAAS;AAAA,EACT,OAAO;AASlB;AAEA,eAAsB,YACpB,SACA,UAA8B,CAAC,GACP;AACxB,QAAM,eAAe,QAAQ,gBAAgB;AAK7C,QAAM,QAAQ,QAAQ,MAAM;AAK5B,MAAI,MAAM,SAAS,MAAM;AACvB,WAAO,EAAE,SAAS,IAAI,WAAW,QAAQ;AAAA,EAC3C;AAEA,QAAM,SAAS,MAAM,KAAK,UAAU;AACpC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AAEZ,MAAI;AACF,eAAS;AACP,YAAM,EAAE,OAAO,KAAK,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,eAAS,MAAM;AACf,UAAI,QAAQ,cAAc;AAGxB,aAAK,OAAO,OAAO;AACnB,cAAM,IAAI,kBAAkB,cAAc,KAAK;AAAA,MACjD;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,UAAE;AACA,QAAI;AACF,aAAO,YAAY;AAAA,IACrB,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,QAAM,QAAQ,IAAI,WAAW,KAAK;AAClC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,UAAM,IAAI,OAAO,MAAM;AACvB,cAAU,MAAM;AAAA,EAClB;AACA,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK;AAE9C,SAAO,EAAE,SAAS,WAAW,QAAQ;AACvC;;;ACtEO,SAAS,cAAc,MAA+C;AAC3E,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,cAAc,KAAK;AAAA,IACnB,gBAAgB;AAAA,EAClB;AACF;AAYA,eAAsB,gBAAgB,KAAwB,SAAqC;AACjG,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAMC,UAAS,MAAM,YAAY,SAAS,EAAE,cAAc,IAAI,aAAa,CAAC;AAC5E,cAAUA,QAAO;AACjB,gBAAYA,QAAO;AAAA,EACrB,SAAS,KAAK;AACZ,QAAI,eAAe,mBAAmB;AACpC,aAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,IAAI,MAAM,SAAS,IAAI,QAAQ,CAAC,GAAG;AAAA,QAC7E,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAChD,CAAC;AAAA,IACH;AACA,WAAO,IAAI;AAAA,MACT,KAAK,UAAU;AAAA,QACb,OAAO;AAAA,QACP,SAAS,eAAe,QAAQ,IAAI,UAAU;AAAA,MAChD,CAAC;AAAA,MACD,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AAGA,QAAM,gBAAgB,oBAAoB,QAAQ,OAAO;AACzD,QAAM,UAAU,eAAe,YAAY,wBAAwB,EAAE;AAGrE,MAAI;AACJ,MAAI;AACF,mBAAe,MAAM,IAAI,OAAO,SAAS;AAAA,EAC3C,SAAS,KAAK;AACZ,mBAAe;AAAA,MACb,IAAI;AAAA,MACJ,QAAQ,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC3E;AAAA,EACF;AAEA,MAAI,CAAC,aAAa,IAAI;AACpB,WAAO,IAAI;AAAA,MACT,KAAK,UAAU,EAAE,OAAO,yBAAyB,SAAS,aAAa,OAAO,CAAC;AAAA,MAC/E,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AAEA,QAAM,MAAsB;AAAA,IAC1B,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,QAAQ,QAAQ;AAAA,EAClB;AAEA,QAAM,SAAS,MAAM,IAAI,QAAQ,GAAG;AACpC,MAAI,kBAAkB,SAAU,QAAO;AACvC,MAAI,WAAW,UAAa,WAAW,MAAM;AAC3C,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AACA,SAAO,IAAI,SAAS,KAAK,UAAU,MAAM,GAAG;AAAA,IAC1C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;;;AC5GO,IAAM,uBAAuB;AAC7B,IAAM,sBAAsB;AAC5B,IAAM,gBAAgB;AAEtB,IAAM,kBAAkB;AACxB,IAAM,yBAAyB;;;ACQ/B,SAAS,aAAa,MAAe,aAA+C;AAEzF,MAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AACxB,UAAM,SAAmC;AAAA,MACvC,OAAO,CAAC;AAAA,MACR,SAAS,CAAC,EAAE,OAAO,MAAM,QAAQ,uBAAuB,OAAO,IAAI,GAAG,CAAC;AAAA,IACzE;AACA,gBAAY,QAAQ,WAAW;AAC/B,WAAO;AAAA,EACT;AAIA,QAAM,SAAoB;AAC1B,QAAM,QAAkB,CAAC;AACzB,QAAM,UAAgD,CAAC;AAEvD,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,QAAI,MAAM,UAAU,qBAAqB;AACvC,eAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,gBAAQ,KAAK,EAAE,OAAO,OAAO,CAAC,GAAG,QAAQ,0BAA0B,CAAC;AAAA,MACtE;AACA;AAAA,IACF;AACA,UAAM,MAAe,OAAO,CAAC;AAC7B,QAAI,OAAO,QAAQ,UAAU;AAC3B,cAAQ,KAAK,EAAE,OAAO,KAAK,QAAQ,iCAAiC,CAAC;AACrE;AAAA,IACF;AACA,QAAI,IAAI,SAAS,sBAAsB;AACrC,cAAQ,KAAK;AAAA,QACX,OAAO;AAAA,QACP,QAAQ,0BAA0B,oBAAoB;AAAA,MACxD,CAAC;AACD;AAAA,IACF;AACA,QAAI,IAAI,WAAW,aAAa,GAAG;AACjC,cAAQ,KAAK;AAAA,QACX,OAAO;AAAA,QACP,QAAQ,oBAAoB,aAAa;AAAA,MAC3C,CAAC;AACD;AAAA,IACF;AACA,UAAM,KAAK,GAAG;AAAA,EAChB;AAEA,cAAY,EAAE,OAAO,QAAQ,GAAG,WAAW;AAC3C,SAAO,EAAE,OAAO,QAAQ;AAC1B;AAOO,SAAS,eAAe,QAAiB,aAA6B;AAC3E,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,OAAO,WAAW,YAAY,OAAO,SAAS,MAAM,KAAK,UAAU,GAAG;AACxE,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AAAA,IACR,mBAAmB,KAAK,UAAU,MAAM,CAAC,QAAQ,WAAW;AAAA,EAC9D;AACF;AAMO,SAAS,eACd,QACA,YACA,aACoB;AACpB,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,GAAG;AACxE,UAAM,IAAI;AAAA,MACR,mBAAmB,KAAK,UAAU,MAAM,CAAC,QAAQ,WAAW;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,eAAe,UAAa,SAAS,YAAY;AACnD,UAAM,IAAI;AAAA,MACR,kBAAkB,MAAM,OAAO,WAAW,iDAAiD,UAAU;AAAA,IACvG;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,QAAkC,aAA2B;AAChF,MAAI,OAAO,QAAQ,WAAW,EAAG;AACjC,UAAQ,KAAK,mBAAmB,WAAW,aAAa,OAAO,QAAQ,MAAM,kBAAkB;AAC/F,aAAW,EAAE,OAAO,OAAO,KAAK,OAAO,SAAS;AAC9C,YAAQ,KAAK,OAAO,KAAK,UAAU,KAAK,CAAC,KAAK,MAAM,EAAE;AAAA,EACxD;AACF;;;AC3EO,SAAS,qBACd,QACA,IACA,MACgC;AAChC,MAAI,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,WAAW,GAAG;AAC3D,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,QAAM,SAAS,eAAe,KAAK,QAAQ,wBAAwB,KAAK,IAAI,GAAG;AAC/E,QAAM,MAAM,eAAe,KAAK,KAAK,QAAQ,wBAAwB,KAAK,IAAI,GAAG;AAEjF,QAAM,SAAS,MAAM,KAAK,IAAI;AAE9B,WAAS,eAAe,MAAqB;AAC3C,UAAM,OAAO,KAAK,SAAS,KAAK,OAAO,GAAG,IAAI,IAAI,KAAK,UAAU,IAAI;AACrE,WAAO,GAAG,MAAM,IAAI,IAAI;AAAA,EAC1B;AAEA,WAAS,YAAY,MAAuB;AAC1C,UAAM,MAAM,OAAO,KAAK,SAAS,aAAa,KAAK,KAAK,GAAG,IAAI,IAAK,KAAK,QAAQ,CAAC;AAClF,UAAM,EAAE,MAAM,IAAI,aAAa,KAAK,wBAAwB,KAAK,IAAI,GAAG;AACxE,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,UAAU,SAAgB;AACzC,UAAM,MAAM,eAAe,IAAI;AAC/B,UAAM,OAAO,YAAY,IAAI;AAC7B,QAAI;AACF,YAAM,EAAE,MAAM,IAAI,MAAM,OAAO,aAAsB,KAAK,YAAY,GAAG,GAAG,IAAI,GAAG;AAAA,QACjF;AAAA,QACA,KAAK,OAAO,SAAS;AAAA,QACrB;AAAA,QACA,cAAc,KAAK;AAAA,QACnB,WAAW,KAAK;AAAA,QAChB,UAAU,KAAK;AAAA,MACjB,CAAC;AACD,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,WAAK,UAAU,KAAK,EAAE,KAAK,CAAC;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAEA,UAAQ,aAAa,UAAU,SAAgB;AAC7C,UAAM,MAAM,eAAe,IAAI;AAC/B,UAAM,OAAO,WAAW,GAAG;AAAA,EAC7B;AAEA,SAAO;AACT;;;AC9EA,IAAM,kBAAkB;AAWjB,SAAS,sBAAsB,OAAkC;AACtE,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,QAAkB,CAAC;AACzB,MAAI,MAAM,UAAW,OAAM,KAAK,SAAS;AACzC,QAAM,KAAK,YAAY,MAAM,MAAM,EAAE;AACrC,MAAI,MAAM,QAAQ,UAAa,MAAM,MAAM,GAAG;AAC5C,UAAM,KAAK,0BAA0B,MAAM,GAAG,EAAE;AAAA,EAClD;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;;;ACxBO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAwBA,eAAsBC,WAAU,KAAc,OAA6B,CAAC,GAAoB;AAC9F,MAAI,KAAK,QAAQ;AACf,UAAM,IAAI,MAAM,KAAK,OAAO,GAAG;AAC/B,QAAI,OAAO,MAAM,UAAU;AACzB,YAAM,IAAI,MAAM,oCAAoC,OAAO,CAAC,EAAE;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,iBAAiB,KAAK,IAAI;AAC9C,QAAM,OAAO,GAAG,KAAK,SAAS,KAAK,SAAS,MAAM,EAAE,GAAG,IAAI,QAAQ,KAAK,IAAI,SAAS,YAAY,CAAC,GAAG,IAAI,QAAQ,GAAG,cAAc,MAAM,cAAc,EAAE;AAExJ,MAAI,CAAC,KAAK,UAAU,KAAK,OAAO,WAAW,EAAG,QAAO;AACrD,QAAM,QAAkB,CAAC;AACzB,aAAW,UAAU,KAAK,QAAQ;AAChC,UAAM,KAAK,GAAG,MAAM,IAAI,IAAI,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE;AAAA,EACzD;AACA,SAAO,OAAO,OAAO,MAAM,KAAK,IAAI;AACtC;AAEA,SAAS,iBAAiB,KAAU,MAAoC;AACtE,QAAM,SAAS,IAAI,gBAAgB,IAAI,YAAY;AACnD,QAAM,UAAU,KAAK,gBAAgB;AACrC,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG;AACpC,QAAI,WAAW,IAAI,GAAG,EAAG,QAAO,OAAO,GAAG;AAAA,EAC5C;AACA,MAAI,KAAK,cAAc,MAAO,QAAO,KAAK;AAC1C,SAAO,OAAO,SAAS;AACzB;;;AC7EO,IAAM,yBAAyB,KAAK,OAAO;AAClD,IAAM,iBAAiB,oBAAI,IAAI,CAAC,UAAU,YAAY,CAAC;AAuCvD,IAAM,wBAAwB,oBAAI,QAAQ;AAC1C,IAAM,2BAA2B,oBAAI,QAAQ;AAC7C,IAAM,wBAAwB,oBAAI,QAAQ;AAsBnC,SAAS,kBAMd,QACA,QACqD;AACrD,QAAM,EAAE,OAAO,SAAS,GAAG,KAAK,IAAI;AAEpC,QAAM,SAAS,eAAe,MAAM,QAAQ,mBAAmB;AAC/D,QAAM,MAAM,eAAe,MAAM,KAAK,QAAQ,mBAAmB;AACjE,MAAI,MAAM,iBAAiB,UAAa,MAAM,iBAAiB,IAAI;AACjE,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,QAAM,eAAe,MAAM,gBAAgB;AAC3C,MAAI,CAAC,OAAO,SAAS,YAAY,KAAK,eAAe,GAAG;AACtD,UAAM,IAAI;AAAA,MACR,yBAAyB,OAAO,MAAM,YAAY,CAAC;AAAA,IACrD;AAAA,EACF;AACA,QAAM,UAAU,IAAI,KAAK,MAAM,WAAW,CAAC,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACtF,QAAM,WAAW,aAAa,MAAM,QAAQ,CAAC,GAAG,mBAAmB,EAAE;AAGrE,QAAM,YAAY,MAAM,UAAU,CAAC;AACnC,QAAM,cAAc,UAAU,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;AACxD,QAAM,gBAAgB,YAAY,KAAK,CAAC,MAAM,eAAe,IAAI,CAAC,CAAC;AACnE,QAAM,aAAa,YAAY,OAAO,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;AACnE,MAAI,iBAAiB,CAAC,yBAAyB,IAAI,MAAM,GAAG;AAC1D,6BAAyB,IAAI,MAAM;AACnC,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAEA,QAAM,iBAAiB,OAAO,QAML;AAGvB,UAAM,aAAa,aAAa,IAAI,OAAO;AAE3C,QAAI,CAAC,QAAQ,IAAI,WAAW,OAAO,YAAY,CAAC,GAAG;AACjD,aAAO,wBAAwB,SAAS,GAAG;AAAA,IAC7C;AACA,QAAI,MAAM,cAAe,MAAM,MAAM,WAAW,UAAU,GAAI;AAC5D,aAAO,wBAAwB,SAAS,GAAG;AAAA,IAC7C;AACA,QAAI,WAAW,GAAG;AAChB,aAAO,wBAAwB,SAAS,GAAG;AAAA,IAC7C;AAEA,UAAM,MAAM,MAAMC,WAAU,YAAY;AAAA,MACtC,QAAQ,WAAW,WAAW,OAAO,YAAY;AAAA,MACjD,QAAQ;AAAA,MACR,QAAQ,MAAM;AAAA,IAChB,CAAC;AAGD,UAAM,SAAS,MAAM,OAAO,cAA+B,KAAK;AAAA,MAC9D,cAAc,MAAM;AAAA,IACtB,CAAC;AAGD,UAAM,gBAA+B;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,QAAQ;AACV,UAAI,OAAO,WAAW,OAAO;AAC3B,eAAO,uBAAuB,OAAO,OAAO,OAAO,QAAQ,GAAG;AAAA,MAChE;AAGA,8BAAwB,eAAe,SAAS,GAAG;AACnD,aAAO,uBAAuB,OAAO,OAAO,SAAS,QAAQ,GAAG;AAAA,IAClE;AAGA,UAAM,WAAW,MAAM,wBAAwB,SAAS,GAAG;AAC3D,WAAO,iBAAiB,eAAe,QAAQ;AAAA,EACjD;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS;AAAA,EACX;AACF;AA2BA,SAAS,qBAAqB,OAAwB,KAAgC;AACpF,QAAM,UAAU,gBAAgB,IAAI,IAAI,IAAI,WAAW,GAAG,EAAE;AAC5D,SAAO;AAAA,IACL,MAAM,KAAK,UAAU,KAAK;AAAA,IAC1B,QAAQ;AAAA,IACR,SAAS,CAAC;AAAA,IACV,UAAU,KAAK,IAAI;AAAA,IACnB,QAAQ,IAAI;AAAA,IACZ,KAAK,IAAI,OAAO,IAAI,SAAS;AAAA,IAC7B,MAAM,CAAC,GAAG,IAAI,UAAU,OAAO;AAAA,IAC/B,cAAc,IAAI,MAAM;AAAA,EAC1B;AACF;AAEA,eAAe,iBAAiB,KAAoB,UAAuC;AACzF,QAAM,kBAAkB,MAAM;AAAA,IAC5B;AAAA,IACA,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,IAAI;AAAA,EACN;AACA,MAAI,CAAC,iBAAiB;AAEpB,WAAO;AAAA,EACT;AACA,QAAM,IAAI,OAAO,IAAI,IAAI,KAAK,qBAAqB,iBAAiB,GAAG,CAAC;AACxE,SAAO,uBAAuB,iBAAiB,QAAQ,IAAI,QAAQ,IAAI,GAAG;AAC5E;AAEA,SAAS,wBACP,KACA,SACA,YACM;AACN,QAAM,YAAY;AAChB,QAAI;AACF,YAAM,WAAW,MAAM,wBAAwB,SAAS,UAAU;AAClE,YAAM,SAAS,MAAM,iBAAiB,UAAU,IAAI,OAAO,IAAI,aAAa,IAAI,YAAY;AAC5F,UAAI,CAAC,OAAQ;AACb,YAAM,IAAI,OAAO,IAAI,IAAI,KAAK,qBAAqB,QAAQ,GAAG,CAAC;AAAA,IACjE,QAAQ;AAAA,IAER;AAAA,EACF,GAAG;AACL;AAmBA,SAAS,aAAa,KAAyC;AAE7D,MAAI,OAAQ,IAAgB,UAAU,cAAe,IAAgB,mBAAmB,SAAS;AAC/F,WAAO;AAAA,EACT;AACA,QAAM,OAAO;AACb,QAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,WAAW,KAAK,QAAQ,OAAO,SAAS;AACnF,QAAM,WAAW,KAAK,QAAQ,YAAY,UAAU;AACpD,QAAM,OAAO,KAAK,OAAO;AACzB,QAAM,MAAM,KAAK,WAAW,MAAM,IAAI,OAAO,GAAG,QAAQ,MAAM,IAAI,GAAG,IAAI;AACzE,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AACjD,QAAI,MAAM,QAAQ,CAAC,GAAG;AACpB,iBAAW,QAAQ,EAAG,SAAQ,OAAO,GAAG,IAAI;AAAA,IAC9C,WAAW,OAAO,MAAM,UAAU;AAChC,cAAQ,IAAI,GAAG,CAAC;AAAA,IAClB;AAAA,EACF;AACA,SAAO,IAAI,QAAQ,KAAK;AAAA,IACtB,SAAS,KAAK,UAAU,OAAO,YAAY;AAAA,IAC3C;AAAA,EACF,CAAC;AACH;AAEA,eAAe,wBACb,SACA,KACmB;AACnB,QAAM,MAAM,MAAM,QAAQ,GAAG;AAC7B,MAAI,eAAe,SAAU,QAAO;AACpC,SAAO,SAAS,KAAK,GAAG;AAC1B;AAMA,eAAe,iBACb,UACA,OACA,aACA,cACsC;AAEtC,MAAI,SAAS,QAAQ,IAAI,YAAY,GAAG;AACtC,QAAI,CAAC,sBAAsB,IAAI,WAAW,GAAG;AAC3C,4BAAsB,IAAI,WAAW;AACrC,cAAQ,KAAK,0EAAqE;AAAA,IACpF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC5D,MAAI,YAAY,SAAS,mBAAmB,EAAG,QAAO;AAMtD,MAAI,SAAS,QAAQ,IAAI,mBAAmB,GAAG,YAAY,MAAM,WAAW;AAC1E,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,UAAU,OAAO,CAAC,MAAM,YAAa,QAAO;AAEzD,MAAI,MAAM,aAAa,CAAC,MAAM,UAAU,QAAQ,EAAG,QAAO;AAG1D,QAAM,OAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAGzC,MAAI,KAAK,SAAS,cAAc;AAC9B,QAAI,CAAC,sBAAsB,IAAI,WAAW,GAAG;AAC3C,4BAAsB,IAAI,WAAW;AACrC,cAAQ;AAAA,QACN,iCAAiC,KAAK,MAAM,+BAA+B,YAAY;AAAA,MACzF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,UAA8B,CAAC;AACrC,WAAS,QAAQ,QAAQ,CAAC,GAAG,MAAM;AACjC,QAAI,EAAE,YAAY,MAAM,aAAc;AACtC,YAAQ,KAAK,CAAC,GAAG,CAAC,CAAC;AAAA,EACrB,CAAC;AACD,SAAO,EAAE,MAAM,MAAM,QAAQ,SAAS,QAAQ,QAAQ;AACxD;AAEA,SAAS,uBACP,OACA,QACA,QACA,KACU;AACV,QAAM,UAAU,IAAI,QAAQ,MAAM,OAAO;AACzC,MAAI,CAAC,QAAQ,IAAI,eAAe,GAAG;AACjC,YAAQ,IAAI,iBAAiB,sBAAsB,EAAE,QAAQ,KAAK,OAAO,SAAS,GAAG,CAAC,CAAC;AAAA,EACzF;AACA,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,QAAI,oBAA8C;AAClD,QAAI,WAAW,MAAO,qBAAoB;AAAA,aACjC,WAAW,QAAS,qBAAoB;AACjD,YAAQ,IAAI,gBAAgB,iBAAiB;AAAA,EAC/C;AACA,SAAO,IAAI,SAAS,MAAM,MAAM,EAAE,QAAQ,MAAM,QAAQ,QAAQ,CAAC;AACnE;;;ACnSO,SAAS,kBAAkB,MAAuC;AACvE,QAAM,EAAE,SAAS,QAAQ,IAAI;AAC7B,QAAM,WAAW,oBAAI,IAA8B;AACnD,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,wBAAwB,oBAAI,IAAY;AAE9C,iBAAe,aACb,KACA,IACA,SAC4C;AAE5C,UAAM,UAAU,SAAS,IAAI,GAAG;AAChC,QAAI,SAAS;AACX,YAAM,QAAS,MAAM;AACrB,aAAO,EAAE,OAAO,QAAQ,OAAO;AAAA,IACjC;AAGA,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO;AAAA,QAAY;AAAA,QAAK;AAAA,QAAI;AAAA;AAAA,QAAyB;AAAA,MAAI;AAAA,IAC3D;AAGA,WAAO,YAAY,KAAK,IAAI,SAAS,KAAK;AAAA,EAC5C;AAMA,WAAS,YACP,KACA,IACA,SACA,WAC4C;AAC5C,QAAI;AACJ,QAAI;AACJ,UAAM,eAAe,IAAI,QAAW,CAACC,UAAS,WAAW;AACvD,qBAAeA;AACf,oBAAc;AAAA,IAChB,CAAC;AAED,SAAK,aAAa,MAAM,MAAM;AAAA,IAE9B,CAAC;AACD,aAAS,IAAI,KAAK,YAAY;AAE9B,UAAM,QAAQ,YAAwD;AACpE,UAAI;AACF,YAAI,CAAC,WAAW;AACd,gBAAM,SAAS,MAAM,cAAiB,KAAK,OAAO;AAClD,cAAI,QAAQ;AAEV,yBAAa,OAAO,KAAK;AACzB,gBAAI,OAAO,WAAW,SAAS;AAC7B,2CAA6B,KAAK,IAAI,OAAO;AAAA,YAC/C;AACA,mBAAO;AAAA,UACT;AAAA,QACF;AAEA,cAAM,QAAQ,MAAM,UAAU,KAAK,IAAI,SAAS,SAAS;AACzD,qBAAa,KAAK;AAClB,eAAO,EAAE,OAAO,QAAQ,OAAgB;AAAA,MAC1C,SAAS,KAAK;AACZ,oBAAY,GAAG;AACf,cAAM;AAAA,MACR,UAAE;AACA,iBAAS,OAAO,GAAG;AAAA,MACrB;AAAA,IACF,GAAG;AAEH,WAAO;AAAA,EACT;AAMA,iBAAe,cACb,KACA,SACwD;AACxD,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,QAAQ,IAAI,GAAG;AAAA,IAC/B,SAAS,KAAK;AACZ,gBAAU,KAAK,EAAE,OAAO,OAAO,IAAI,CAAC;AACpC,aAAO;AAAA,IACT;AACA,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,QAAQ,iBAAiB,UAAa,MAAM,iBAAiB,QAAQ,cAAc;AACrF,aAAO;AAAA,IACT;AACA,QAAI,OAAO,MAAM,SAAS,SAAU,QAAO;AAC3C,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,MAAM,IAAI;AAAA,IAChC,SAAS,KAAK;AACZ,gBAAU,KAAK,EAAE,OAAO,OAAO,IAAI,CAAC;AACpC,aAAO;AAAA,IACT;AAEA,QAAI,QAAQ,UAAU;AACpB,UAAI;AACF,YAAI,CAAC,QAAQ,SAAS,MAAM,EAAG,QAAO;AAAA,MACxC,SAAS,KAAK;AACZ,kBAAU,KAAK,EAAE,OAAO,OAAO,IAAI,CAAC;AACpC,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,YAAY,GAAI;AAC5D,QAAI,OAAO,MAAM,QAAQ;AACvB,YAAM,QAAQ,QAAQ,YAAY,QAAQ,UAAU,MAAM,IAAI;AAC9D,aAAO,EAAE,OAAO,QAAQ,MAAM;AAAA,IAChC;AACA,QAAI,OAAO,MAAM,SAAS,MAAM,KAAK;AACnC,YAAM,QAAQ,QAAQ,YAAY,QAAQ,UAAU,MAAM,IAAI;AAC9D,aAAO,EAAE,OAAO,QAAQ,QAAQ;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AAKA,iBAAe,UACb,KACA,IACA,SACA,YAAY,OACA;AACZ,UAAM,MAAM,MAAM,GAAG;AACrB,UAAM,QAAQ,QAAQ,YAAY,QAAQ,UAAU,GAAG,IAAI;AAE3D,QAAI,UAAW,QAAO;AAGtB,QAAI,QAAQ,gBAAgB,KAAK,EAAG,QAAO;AAG3C,QAAI,QAAQ,UAAU;AACpB,UAAI,UAAU;AACd,UAAI;AACF,kBAAU,QAAQ,SAAS,KAAK;AAAA,MAClC,SAAS,KAAK;AACZ,kBAAU,KAAK,EAAE,OAAO,OAAO,IAAI,CAAC;AACpC,eAAO;AAAA,MACT;AACA,UAAI,CAAC,QAAS,QAAO;AAAA,IACvB;AAGA,QAAI,UAAU,QAAW;AACvB,UAAI,CAAC,sBAAsB,IAAI,GAAG,GAAG;AACnC,8BAAsB,IAAI,GAAG;AAC7B,gBAAQ,KAAK,sDAAsD,GAAG,qBAAqB;AAAA,MAC7F;AACA,aAAO;AAAA,IACT;AAEA,QAAI;AACF,YAAM,QAAoB;AAAA,QACxB,MAAM,KAAK,UAAU,KAAK;AAAA,QAC1B,QAAQ;AAAA,QACR,SAAS,CAAC;AAAA,QACV,UAAU,KAAK,IAAI;AAAA,QACnB,QAAQ,QAAQ;AAAA,QAChB,KAAK,QAAQ,OAAO;AAAA,QACpB,MAAM,QAAQ,QAAQ,CAAC;AAAA,QACvB,cAAc,QAAQ;AAAA,MACxB;AACA,YAAM,QAAQ,IAAI,KAAK,KAAK;AAAA,IAC9B,SAAS,KAAK;AACZ,gBAAU,KAAK,EAAE,OAAO,OAAO,IAAI,CAAC;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAEA,WAAS,6BACP,KACA,IACA,SACM;AACN,QAAI,WAAW,IAAI,GAAG,EAAG;AACzB,eAAW,IAAI,GAAG;AAClB,SAAK,UAAU,KAAK,IAAI,OAAO,EAC5B,MAAM,CAAC,QAAiB;AACvB,gBAAU,KAAK,EAAE,OAAO,cAAc,IAAI,CAAC;AAAA,IAC7C,CAAC,EACA,QAAQ,MAAM;AACb,iBAAW,OAAO,GAAG;AAAA,IACvB,CAAC;AAAA,EACL;AAEA,SAAO;AAAA,IACL;AAAA,IAEA;AAAA,IAEA,MAAM,cACJ,KACAC,OAC4D;AAI5D,YAAM,SAAS,MAAM,cAAiB,KAAK;AAAA,QACzC,GAAGA;AAAA,QACH,QAAQ;AAAA;AAAA,MACV,CAAC;AACD,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,KAAK,OAAO;AACpB,YAAM,QAAQ,IAAI,KAAK,KAAK;AAAA,IAC9B;AAAA,IAEA,MAAM,WAAW,KAAK;AAEpB,eAAS,OAAO,GAAG;AACnB,aAAO,QAAQ,OAAO,GAAG;AAAA,IAC3B;AAAA,IAEA,MAAM,cAAc,KAAK;AACvB,aAAO,QAAQ,YAAY,GAAG;AAAA,IAChC;AAAA,IAEA,MAAM,eAAe,MAAM,MAAM;AAC/B,YAAM,MAAM,gBAAgB,QAAQ,OAAO,MAAM,OAAO;AACxD,aAAO,QAAQ,YAAY,GAAG;AAAA,IAChC;AAAA,EACF;AACF;;;ACzSO,IAAM,uBAAN,MAA0D;AAAA,EACtD,OAAO;AAAA,EACP,WAAW,oBAAI,IAAwB;AAAA,EACvC,YAAY,oBAAI,IAAyB;AAAA,EACzC;AAAA,EAET,YAAY,OAAoC,CAAC,GAAG;AAClD,SAAK,cAAc,KAAK,cAAc;AAAA,EACxC;AAAA,EAEA,MAAM,IAAI,KAA8C;AACtD,UAAM,QAAQ,KAAK,SAAS,IAAI,GAAG;AACnC,QAAI,UAAU,OAAW,QAAO;AAEhC,SAAK,SAAS,OAAO,GAAG;AACxB,SAAK,SAAS,IAAI,KAAK,KAAK;AAC5B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,IAAI,KAAa,OAAkC;AAEvD,UAAM,WAAW,KAAK,SAAS,IAAI,GAAG;AACtC,QAAI,UAAU;AACZ,WAAK,uBAAuB,KAAK,SAAS,IAAI;AAC9C,WAAK,SAAS,OAAO,GAAG;AAAA,IAC1B,WAAW,KAAK,SAAS,QAAQ,KAAK,aAAa;AAEjD,YAAM,aAAa,KAAK,SAAS,KAAK,EAAE,KAAK;AAC7C,UAAI,CAAC,WAAW,MAAM;AACpB,cAAM,YAAY,WAAW;AAC7B,cAAM,cAAc,KAAK,SAAS,IAAI,SAAS;AAC/C,YAAI,aAAa;AACf,eAAK,uBAAuB,WAAW,YAAY,IAAI;AAAA,QACzD;AACA,aAAK,SAAS,OAAO,SAAS;AAAA,MAChC;AAAA,IACF;AACA,SAAK,SAAS,IAAI,KAAK,KAAK;AAC5B,eAAW,OAAO,MAAM,MAAM;AAC5B,UAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AACnC,UAAI,CAAC,QAAQ;AACX,iBAAS,oBAAI,IAAI;AACjB,aAAK,UAAU,IAAI,KAAK,MAAM;AAAA,MAChC;AACA,aAAO,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,KAA+B;AAC1C,UAAM,QAAQ,KAAK,SAAS,IAAI,GAAG;AACnC,QAAI,CAAC,MAAO,QAAO;AACnB,SAAK,uBAAuB,KAAK,MAAM,IAAI;AAC3C,SAAK,SAAS,OAAO,GAAG;AACxB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,KAA8B;AAC9C,UAAM,SAAS,KAAK,UAAU,IAAI,GAAG;AACrC,QAAI,CAAC,UAAU,OAAO,SAAS,EAAG,QAAO;AACzC,UAAM,OAAO,CAAC,GAAG,MAAM;AACvB,eAAW,OAAO,MAAM;AACtB,YAAM,QAAQ,KAAK,SAAS,IAAI,GAAG;AACnC,UAAI,OAAO;AACT,aAAK,sBAAsB,KAAK,MAAM,MAAM,GAAG;AAAA,MACjD;AACA,WAAK,SAAS,OAAO,GAAG;AAAA,IAC1B;AACA,SAAK,UAAU,OAAO,GAAG;AACzB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,OAAwB;AAC5B,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA,EAEA,MAAM,QAAuB;AAC3B,SAAK,SAAS,MAAM;AACpB,SAAK,UAAU,MAAM;AAAA,EACvB;AAAA,EAEA,OAAO,KAAK,QAAgD;AAC1D,eAAW,OAAO,KAAK,SAAS,KAAK,GAAG;AACtC,UAAI,UAAU,CAAC,IAAI,WAAW,MAAM,EAAG;AACvC,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,uBAAuB,KAAa,MAAsB;AACxD,eAAW,OAAO,MAAM;AACtB,YAAM,SAAS,KAAK,UAAU,IAAI,GAAG;AACrC,UAAI,CAAC,OAAQ;AACb,aAAO,OAAO,GAAG;AACjB,UAAI,OAAO,SAAS,EAAG,MAAK,UAAU,OAAO,GAAG;AAAA,IAClD;AAAA,EACF;AAAA,EAEA,sBAAsB,KAAa,MAAgB,SAAuB;AACxE,eAAW,YAAY,MAAM;AAC3B,UAAI,aAAa,QAAS;AAC1B,YAAM,cAAc,KAAK,UAAU,IAAI,QAAQ;AAC/C,UAAI,CAAC,YAAa;AAClB,kBAAY,OAAO,GAAG;AACtB,UAAI,YAAY,SAAS,EAAG,MAAK,UAAU,OAAO,QAAQ;AAAA,IAC5D;AAAA,EACF;AACF;;;AChHA,IAAI;AAMG,SAAS,gBACd,QACA,QAA6C,CAAC,GACjC;AACb,MAAI,SAAS;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,UACJ,OAAO,YAAY,WACf,IAAI,qBAAqB,EAAE,YAAY,OAAO,WAAW,CAAC,IAC1D,OAAO;AACb,YAAU,kBAAkB;AAAA,IAC1B,SAAS;AAAA,IACT,UAAU,OAAO;AAAA,IACjB,SAAS,MAAM;AAAA,EACjB,CAAC;AACD,SAAO;AACT;AAOO,SAAS,iBAA8B;AAC5C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,oBAA0B;AACxC,YAAU;AACZ;;;ACtDA,eAAsB,cACpB,KACA,MAC2B;AAC3B,MAAI,MAAM,WAAW,UAAa,KAAK,SAAS,GAAG;AACjD,IAAAC;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,EAAE,MAAM,IAAI,aAAa,CAAC,GAAG,GAAG,eAAe;AACrD,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,SAAS,EAAE;AAC5C,QAAM,SAAS,eAAe;AAC9B,QAAM,UAAU,MAAM,OAAO,cAAc,MAAM,CAAC,CAAC;AACnD,SAAO,EAAE,QAAQ;AACnB;AAOA,eAAsB,UAAU,KAAwC;AACtE,QAAM,EAAE,MAAM,IAAI,aAAa,CAAC,GAAG,GAAG,WAAW;AACjD,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,SAAS,EAAE;AAC5C,QAAM,SAAS,eAAe;AAC9B,QAAM,UAAU,MAAM,OAAO,cAAc,MAAM,CAAC,CAAC;AACnD,SAAO,EAAE,QAAQ;AACnB;AAMA,eAAsB,eACpB,MACA,MAC2B;AAC3B,MAAI,MAAM,WAAW,UAAa,KAAK,SAAS,GAAG;AACjD,IAAAA;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,eAAe;AAC9B,QAAM,UAAU,MAAM,OAAO,eAAe,MAAM,MAAM,IAAI;AAC5D,SAAO,EAAE,QAAQ;AACnB;AAEA,IAAM,aAAa,oBAAI,IAAY;AACnC,SAASA,UAAS,KAAa,SAAuB;AACpD,MAAI,WAAW,IAAI,GAAG,EAAG;AACzB,aAAW,IAAI,GAAG;AAClB,UAAQ,KAAK,OAAO;AACtB;;;ACpEA,OAAO,eAAe;AAuBf,SAAS,kBAAkB,OAAwC;AACxE,SAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO;AAAA,IACrD,SAAS,UAAU,SAAS,EAAE,KAAK,KAAK,CAAC;AAAA,IACzC;AAAA,IACA;AAAA,EACF,EAAE;AACJ;AAKO,SAAS,iBACd,MACA,UACuB;AACvB,aAAW,KAAK,UAAU;AACxB,QAAI,EAAE,QAAQ,IAAI,EAAG,QAAO,EAAE;AAAA,EAChC;AACA,SAAO;AACT;;;AC1CA,OAAO,eAAe;AAUf,SAAS,kBAAkB,MAAmC;AACnE,SAAO,UAAU,UAAU,IAAI;AACjC;AAKO,SAAS,oBAAoB,YAAyC;AAC3E,SAAO,UAAU,YAAY,UAAyD;AACxF;;;ACgDO,SAAS,aAAa,QAAgC;AAC3D,SAAO;AACT;","names":["existsSync","readFileSync","statSync","resolve","existsSync","readFileSync","resolve","existsSync","readFileSync","resolve","event","result","deriveKey","deriveKey","resolve","opts","warnOnce"]}
+{"version":3,"sources":["../../src/server/define/define-route.ts","../../src/server/define/define-action.ts","../../src/server/define/define-middleware.ts","../../src/server/define/define-agent-endpoint.ts","../../src/server/define/define-agent-tool.ts","../../src/server/define/define-websocket.ts","../../src/server/define/define-channel.ts","../../src/server/define/define-plugin.ts","../../src/server/http/error-pages.ts","../../src/server/http/static.ts","../../src/server/agent/stream-agent-run.ts","../../src/server/agent/provider-resolver.ts","../../src/server/agent/create-conversation-history.ts","../../src/server/rate-limit/rate-limit-per-route.ts","../../src/server/realtime/channel-manager.ts","../../src/server/storage/storage-manager.ts","../../src/server/storage/use-unstorage.ts","../../src/server/storage/use-database.ts","../../src/server/webhook/timing-safe-equal.ts","../../src/server/webhook/raw-body.ts","../../src/server/webhook/define-webhook.ts","../../src/cache/constants.ts","../../src/cache/validation.ts","../../src/cache/define-cached-function.ts","../../src/cache/cache-control-header.ts","../../src/cache/key-derivation.ts","../../src/cache/define-cached-route.ts","../../src/cache/cache-engine.ts","../../src/cache/in-memory-adapter.ts","../../src/cache/engine-singleton.ts","../../src/cache/revalidate.ts","../../src/cache/route-rules.ts","../../src/server/serialization.ts","../../src/server/plugin-types.ts"],"sourcesContent":["import type { z } from 'zod'\n\n// T2.2 (architecture-cleanup) — RouteConfig type moved to core/contracts/\n// (canonical home per ADR-0001 v3). Re-export preserves the public path\n// `import { type RouteConfig } from 'theokit/server'`.\nexport type { RouteConfig } from '../../core/contracts/route-config.js'\n\nimport type { RouteConfig } from '../../core/contracts/route-config.js'\n\n/**\n * Define a typed HTTP route.\n * Identity function — provides type inference for route handlers.\n */\nexport function defineRoute<\n  TQuery extends z.ZodType = z.ZodUndefined,\n  TBody extends z.ZodType = z.ZodUndefined,\n  TParams extends z.ZodType = z.ZodUndefined,\n  TCtx = unknown,\n  TResponse = unknown,\n>(\n  config: RouteConfig<TQuery, TBody, TParams, TCtx, TResponse>,\n): RouteConfig<TQuery, TBody, TParams, TCtx, TResponse> {\n  return config\n}\n","import type { z } from 'zod'\n\n/**\n * Action wire-protocol accept mode per plan g3-server-actions-and-useaction\n * v1.2 ADR D1. Default behavior (when omitted) is `'json'`. `'form'` opts the\n * action into FormData multipart parsing for progressive-enhancement forms;\n * the runtime in `server/http/action-execute.ts` will coerce FormData entries\n * against the `input` schema via `formDataToObject` (Astro pattern).\n */\nexport type ActionAccept = 'form' | 'json'\n\nexport interface ActionConfig<TInput extends z.ZodType, TCtx = unknown> {\n  /**\n   * Zod input schema. Required: every action declares its input contract via\n   * Zod (architecture rule: zod-is-SSOT). The shape becomes the handler's\n   * typed `input` parameter via `z.infer<TInput>`.\n   */\n  input: TInput\n  /**\n   * Wire-protocol accept mode. Defaults to `'json'` when omitted. Setting\n   * `'form'` switches the runtime to FormData multipart parsing — the input\n   * schema MUST be `z.object(...)` so field-by-field coercion can drive\n   * boolean string / number / array coercion (Astro pattern).\n   */\n  accept?: ActionAccept\n  handler: (ctx: { input: z.infer<TInput>; ctx: TCtx }) => unknown\n}\n\n/**\n * Define a typed server action.\n *\n * Identity function — provides type inference for action handlers. The\n * runtime that consumes the config (validation + invocation + serialization)\n * lives in `server/http/action-execute.ts`.\n *\n * Per plan g3-server-actions-and-useaction v1.2 § Phase 1 / T1.2: the new\n * `accept?: 'form' | 'json'` field is the only contract change vs the\n * pre-G3 identity. Existing callsites (`defineAction({input, handler})`)\n * continue to compile — `accept` is opt-in.\n */\nexport function defineAction<TInput extends z.ZodType, TCtx = unknown>(\n  config: ActionConfig<TInput, TCtx>,\n): ActionConfig<TInput, TCtx> {\n  return config\n}\n","export type MiddlewareHandler = (\n  request: Request,\n  next: (request: Request) => Promise<Response>,\n) => Response | Promise<Response>\n\n/**\n * Define a middleware handler.\n * Identity function — provides type annotation for middleware.\n */\nexport function defineMiddleware(handler: MiddlewareHandler): MiddlewareHandler {\n  return handler\n}\n","import type { z } from 'zod'\n\nimport type { AgentEvent } from '../agent/agent-types.js'\n\nimport type { RouteConfig } from './define-route.js'\n\n/**\n * T5.1 — defineAgentEndpoint\n *\n * Sugar over defineRoute (ADR D4). Accepts an async generator that yields\n * AgentEvents and produces a RouteConfig whose handler returns a Response\n * streaming Server-Sent Events (SSE).\n *\n * Wire format: `data: <JSON>\\n\\n` per event. Standards-compliant.\n *\n * The generator may throw — the wrapper catches and emits a final\n * `{ type: 'error', message }` event before closing the stream.\n *\n * The wrapper observes `request.signal` (EC-7) — when aborted, the\n * underlying generator is told to `return()` and the stream closes\n * promptly.\n *\n * Note (EC-12, Out of Scope): SSE backpressure (slow consumer) is not\n * handled here. For high-frequency token streaming consider a different\n * transport (WS) or a buffer policy. This MVP enqueues each event\n * immediately.\n */\n\nexport interface AgentEndpointHandlerArgs<TCtx = unknown, TBody = unknown> {\n  query: undefined\n  body: TBody\n  params: undefined\n  request: Request\n  ctx: TCtx\n  /**\n   * Mutable headers bag that the wrapper merges into the SSE response BEFORE\n   * the stream starts. Used by `createConversationHistory` to issue a\n   * conversation-id cookie on first request. Append entries via\n   * `cookieHeaders.append('set-cookie', '<cookie-string>')`.\n   *\n   * Cookies appended AFTER the first yield are NOT applied — the response\n   * headers commit when the wrapper constructs the Response, before the\n   * async generator runs. This is per HTTP semantics, not a wrapper choice.\n   */\n  cookieHeaders: Headers\n  /**\n   * Phase 3 (Production-Readiness #5) — request abort signal.\n   *\n   * Fires when the SSE client disconnects (browser closes tab, abort fetch,\n   * etc.). Thread this to `agent.send(msg, { signal })` so the SDK cancels\n   * the in-flight provider call — STOPS TOKENS FROM CHARGING for output\n   * the user will never receive.\n   *\n   * EC-1 (MUST FIX): the signal is derived via duck-type detection\n   * (`'aborted' in r.signal && typeof r.signal.addEventListener === 'function'`)\n   * to survive cross-realm scenarios (Node 18 polyfills, undici, Edge\n   * runtimes with their own AbortSignal globals). `instanceof AbortSignal`\n   * would fail in those cases.\n   */\n  signal: AbortSignal\n}\n\nexport interface AgentEndpointConfig<TCtx = unknown, TBody = unknown> {\n  handler: (\n    args: AgentEndpointHandlerArgs<TCtx, TBody>,\n  ) => AsyncGenerator<AgentEvent, void, unknown>\n}\n\nconst SSE_HEADERS = {\n  'content-type': 'text/event-stream',\n  'cache-control': 'no-cache, no-transform',\n  connection: 'keep-alive',\n} as const\n\nfunction encodeSSE(event: AgentEvent): Uint8Array {\n  return new TextEncoder().encode(`data: ${JSON.stringify(event)}\\n\\n`)\n}\n\n/**\n * Resolve an AbortSignal from either a Web `Request` (`.signal`) or a\n * Node `IncomingMessage` (`.aborted` flag + `'close'`/'aborted' events).\n *\n * The framework's `executeRoute` passes IncomingMessage to route handlers\n * today, but `defineAgentEndpoint` was designed for the Web Standards\n * `Request` shape. This helper bridges both — preventing a runtime crash\n * (`Cannot read properties of undefined (reading 'aborted')`) that would\n * otherwise abort the SSE stream silently before the first yield.\n */\nfunction resolveAbortSignal(request: unknown): AbortSignal {\n  if (typeof request !== 'object' || request === null) {\n    return new AbortController().signal\n  }\n  const r = request as {\n    signal?: unknown\n    aborted?: boolean\n    on?: (event: string, cb: () => void) => void\n  }\n  if (\n    typeof r.signal === 'object' &&\n    r.signal !== null &&\n    'aborted' in r.signal &&\n    typeof (r.signal as AbortSignal).addEventListener === 'function'\n  ) {\n    return r.signal as AbortSignal\n  }\n\n  const controller = new AbortController()\n  if (r.aborted === true) controller.abort()\n  if (typeof r.on === 'function') {\n    r.on('close', () => {\n      if (!controller.signal.aborted) controller.abort()\n    })\n    r.on('aborted', () => {\n      if (!controller.signal.aborted) controller.abort()\n    })\n  }\n  return controller.signal\n}\n\nexport function defineAgentEndpoint<TBody = unknown, TCtx = unknown>(\n  config: AgentEndpointConfig<TCtx, TBody>,\n): RouteConfig<z.ZodUndefined, z.ZodUndefined, z.ZodUndefined, TCtx, Response> {\n  return {\n    handler: async ({ request, ctx, body, query, params }) => {\n      const cookieHeaders = new Headers()\n      const signal = resolveAbortSignal(request)\n      const generator = config.handler({\n        request,\n        ctx: ctx,\n        body: body as TBody,\n        query: query,\n        params: params,\n        cookieHeaders,\n        signal,\n      })\n\n      // Prime the generator to its first yield. This forces the handler's\n      // synchronous + async setup (including `createConversationHistory` if\n      // used) to run BEFORE the Response headers commit, so any Set-Cookie\n      // lines appended to `cookieHeaders` land in the actual response.\n      //\n      // First-byte latency cost: bounded by the work up to the first yield\n      // (typically 100-500ms for an LLM chat with `agent.send`). Acceptable\n      // for the use case; alternative (heuristic detection of cookie writes)\n      // is brittle.\n      let firstResult: IteratorResult<AgentEvent, void>\n      let primeError: unknown\n      try {\n        firstResult = await generator.next()\n      } catch (err) {\n        primeError = err\n        firstResult = { value: undefined, done: true }\n      }\n\n      // Merge any cookies the handler issued into the response headers.\n      const responseHeaders = new Headers(SSE_HEADERS)\n      for (const value of cookieHeaders.getSetCookie()) {\n        responseHeaders.append('set-cookie', value)\n      }\n\n      const stream = new ReadableStream<Uint8Array>({\n        async start(controller) {\n          const onAbort = () => {\n            void generator.return(undefined)\n          }\n\n          if (signal.aborted) {\n            controller.close()\n            return\n          }\n          signal.addEventListener('abort', onAbort, { once: true })\n\n          try {\n            // If priming threw, yield a final error event and close.\n            if (primeError !== undefined) {\n              let message: string\n              if (primeError instanceof Error) {\n                message = primeError.message\n              } else if (typeof primeError === 'string') {\n                message = primeError\n              } else {\n                message = 'agent handler failed during setup'\n              }\n              controller.enqueue(encodeSSE({ type: 'error', message }))\n              return\n            }\n            // Enqueue the primed first value (if any).\n            if (firstResult.done !== true) {\n              controller.enqueue(encodeSSE(firstResult.value))\n            } else {\n              return\n            }\n            // Continue iterating remaining events.\n            for await (const event of generator) {\n              // `signal.aborted` can flip true asynchronously via the\n              // listener registered above. ESLint's narrowing only sees\n              // the false assertion at line 114; the dynamic abort is\n              // legitimate and the guard prevents enqueue-after-close.\n              // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition\n              if (signal.aborted) break\n              controller.enqueue(encodeSSE(event))\n            }\n          } catch (err) {\n            const message = err instanceof Error ? err.message : String(err)\n            controller.enqueue(encodeSSE({ type: 'error', message }))\n          } finally {\n            signal.removeEventListener('abort', onAbort)\n            controller.close()\n          }\n        },\n        cancel() {\n          void generator.return(undefined)\n        },\n      })\n\n      return new Response(stream, { headers: responseHeaders })\n    },\n  }\n}\n","import type { z } from 'zod'\nimport { zodToJsonSchema } from 'zod-to-json-schema'\n\n/**\n * Item #4 — `defineAgentTool`\n *\n * Sugar over the `@usetheo/sdk` `CustomTool` contract. Takes a Zod 3 schema +\n * handler and produces a structurally-compatible `CustomTool` that\n * `Agent.create({ tools: [...] })` accepts.\n *\n * Why not delegate to SDK's `defineTool`?\n *   SDK's `defineTool` calls `z.toJSONSchema(...)` which only exists on Zod 4\n *   (at root) or `zod/v4` (Zod 3.25+ subpath). TheoKit pins Zod 3 framework-\n *   wide. Bumping to Zod 4 is a major breaking change touching every primitive\n *   — out of scope for this item. Instead, we convert the Zod schema to JSON\n *   Schema 7 with `zod-to-json-schema` (Zod 3 native, MIT, zero transitive\n *   deps, 3M weekly DLs) and build the `CustomTool` object directly. See ADR\n *   D1 in `docs/plans/item-4-define-agent-tool-plan.md`.\n *\n * Handler error propagation:\n *   `defineAgentTool` parses the input via the Zod schema BEFORE calling the\n *   user handler. Invalid input throws a `ZodError`, which the SDK's tool-\n *   dispatcher (or the `streamAgentRun` adapter) sees as a tool failure and\n *   surfaces as an `error` AgentEvent on the SSE wire (ADR D3).\n */\n\n/**\n * Local mirror of the SDK's `CustomTool` interface. We don't `import type`\n * from `@usetheo/sdk` because the SDK is an optional peer (consumers who\n * never call `defineAgentTool` shouldn't need it installed). The shape is\n * the wire contract; any structurally-matching object is accepted by\n * `Agent.create({ tools })`.\n *\n * @public\n */\nexport interface CustomTool {\n  name: string\n  description: string\n  inputSchema: Record<string, unknown>\n  handler: (input: Record<string, unknown>) => string | Promise<string>\n}\n\n/**\n * Spec accepted by {@link defineAgentTool}. `inputSchema` is a Zod 3 schema\n * rooted in `z.object(...)`. The `handler` argument type is inferred via\n * `z.infer<T>`.\n *\n * @public\n */\nexport interface DefineAgentToolSpec<T extends z.ZodType> {\n  /** Tool name surfaced to the LLM. Must match `^[a-zA-Z][a-zA-Z0-9_-]{0,63}$`. */\n  name: string\n  /** Description surfaced to the LLM. Required — drives tool-selection accuracy. */\n  description: string\n  /** Zod schema describing the input. Must be `z.object(...)` at the root. */\n  inputSchema: T\n  /** Handler invoked with the parsed input. */\n  handler: (input: z.infer<T>) => string | Promise<string>\n}\n\nconst TOOL_NAME_REGEX = /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/\n\nfunction isZodObject(schema: z.ZodType): boolean {\n  // Zod 3 stores the typeName at `_def.typeName`. ZodObject has 'ZodObject'.\n  // Refinements (`.refine`), transforms (`.transform`), and defaults wrap the\n  // underlying schema in ZodEffects / ZodDefault / etc. — walk the chain via\n  // `_def.schema` / `_def.innerType` until we hit ZodObject (or give up).\n  // Avoids importing the ZodObject class to keep the runtime import surface\n  // minimal.\n  let current: unknown = schema\n  for (let depth = 0; depth < 10; depth++) {\n    const def = (current as { _def?: { typeName?: string; schema?: unknown; innerType?: unknown } })\n      ._def\n    if (def?.typeName === 'ZodObject') return true\n    if (def?.schema !== undefined) {\n      current = def.schema\n      continue\n    }\n    if (def?.innerType !== undefined) {\n      current = def.innerType\n      continue\n    }\n    return false\n  }\n  return false\n}\n\n/**\n * Build a {@link CustomTool} from a Zod 3 schema + handler.\n *\n * Behavior:\n * - Validates `name` matches the LLM tool-name regex.\n * - Requires `inputSchema` to be a `ZodObject` (Anthropic + SDK contract).\n * - Warns (not throws) if `description` is empty — empty descriptions\n *   degrade LLM tool selection.\n * - Converts the Zod schema to JSON Schema 7 inline (no `$ref`s — LLMs handle\n *   inline schemas more reliably).\n * - Strips the top-level `$schema` field (Anthropic rejects schemas with\n *   `$schema` at root in some provider modes).\n * - Wraps the handler to parse the input via the Zod schema BEFORE invoking\n *   the user code — bad LLM-supplied input throws `ZodError`, which the SDK\n *   converts to `tool_result(isError)`.\n *\n * @public\n */\nexport function defineAgentTool<T extends z.ZodType>(spec: DefineAgentToolSpec<T>): CustomTool {\n  if (!TOOL_NAME_REGEX.test(spec.name)) {\n    throw new Error(\n      `defineAgentTool: name must match ${TOOL_NAME_REGEX.source}. Got: ${JSON.stringify(spec.name)}`,\n    )\n  }\n  if (!isZodObject(spec.inputSchema)) {\n    throw new Error('defineAgentTool: inputSchema must be a ZodObject (z.object({...}))')\n  }\n  if (spec.description.length === 0) {\n    console.warn(\n      `defineAgentTool(${JSON.stringify(spec.name)}): empty description degrades LLM tool selection — provide a one-sentence summary.`,\n    )\n  }\n\n  // `$refStrategy: 'none'` inlines all subschemas. LLMs handle inline schemas\n  // more reliably than $ref-resolved ones. Recursive schemas (z.lazy) are\n  // typically guarded by the consumer with maxDepth / typeName checks.\n  const rawSchema = zodToJsonSchema(spec.inputSchema, {\n    target: 'jsonSchema7',\n    $refStrategy: 'none',\n  }) as Record<string, unknown>\n  // Strip $schema if present at root — Anthropic + some providers reject it.\n  const { $schema: _$schema, ...inputSchema } = rawSchema as Record<string, unknown> & {\n    $schema?: unknown\n  }\n\n  return {\n    name: spec.name,\n    description: spec.description,\n    inputSchema,\n    handler: async (input: Record<string, unknown>): Promise<string> => {\n      const parsed = spec.inputSchema.parse(input) as z.infer<T>\n      return await spec.handler(parsed)\n    },\n  }\n}\n","import type { IncomingMessage } from 'node:http'\n\nexport interface WebSocketLike {\n  send(data: string | Buffer): void\n  close(code?: number, reason?: string): void\n}\n\nexport interface WebSocketHandler {\n  onOpen?: (ws: WebSocketLike, req: IncomingMessage) => void\n  onMessage?: (ws: WebSocketLike, data: string | Buffer) => void\n  onClose?: (ws: WebSocketLike, code: number, reason: Buffer) => void\n  onError?: (ws: WebSocketLike, error: Error) => void\n}\n\n/**\n * Define a WebSocket endpoint handler.\n * Identity function — provides type inference for WebSocket handlers.\n */\nexport function defineWebSocket(handler: WebSocketHandler): WebSocketHandler {\n  return handler\n}\n","import type { IncomingMessage } from 'node:http'\n\nimport type { WebSocketLike } from './define-websocket.js'\n\nexport interface ChannelHandler<TMessage = unknown> {\n  onSubscribe?: (ws: WebSocketLike, room: string, req: IncomingMessage) => void\n  onMessage?: (ws: WebSocketLike, room: string, data: TMessage) => void\n  onUnsubscribe?: (ws: WebSocketLike, room: string) => void\n}\n\n/**\n * Define a channel handler for WebSocket rooms.\n * Identity function — provides type inference for channel handlers.\n */\nexport function defineChannel<TMessage = unknown>(\n  handler: ChannelHandler<TMessage>,\n): ChannelHandler<TMessage> {\n  return handler\n}\n","import type { TheoPlugin } from '../plugin-types.js'\n\n/**\n * Identity function for defining a Theo plugin.\n *\n * **Note:** Prefer `definePlugin` (shorter, canonical name per ADR-0008 D6).\n * Both functions are identical — `defineTheoPlugin` is kept as an alias for\n * existing in-tree consumers without forcing a migration sweep.\n */\nexport function defineTheoPlugin(plugin: TheoPlugin): TheoPlugin {\n  return plugin\n}\n","/**\n * T2.4 — Custom error pages loader.\n *\n * Loads optional `.theo/client/404.html` and `500.html` from disk so adapters\n * (Node, CF, Vercel, Bun, Netlify, AWS Lambda, Deno) can pass them to the\n * shared `sendError` pipeline.\n *\n * EC-9: caps file size at 1MB. Files beyond the limit are skipped with a\n * console.warn and the default JSON error path is used.\n */\n\n/* eslint-disable security/detect-non-literal-fs-filename --\n * Loads `.theo/client/404.html` and `500.html` from a directory `dir` that\n * is always the build output of the current project. The names are fixed\n * literals (`'404.html'` / `'500.html'`) — no HTTP input.\n */\nimport { existsSync, readFileSync, statSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nexport const MAX_ERROR_HTML_BYTES = 1_048_576 // 1MB\n\nexport interface CustomErrorPages {\n  custom404Html?: string\n  custom500Html?: string\n}\n\nfunction loadIfSafe(dir: string, name: string): string | undefined {\n  const path = resolve(dir, name)\n  if (!existsSync(path)) return undefined\n  try {\n    const stat = statSync(path)\n    if (stat.size > MAX_ERROR_HTML_BYTES) {\n      console.warn(\n        `[theokit] Custom error page ${name} is ${stat.size} bytes (max ${MAX_ERROR_HTML_BYTES}); skipping.`,\n      )\n      return undefined\n    }\n    return readFileSync(path, 'utf-8')\n  } catch (err) {\n    console.warn(`[theokit] Failed to read ${name}: ${(err as Error).message}`)\n    return undefined\n  }\n}\n\n/**\n * Load `.theo/client/{404,500}.html` from the given client directory.\n * Returns object with both fields when present; missing pages remain undefined.\n */\nexport function loadCustomErrorPages(clientDir: string): CustomErrorPages {\n  return {\n    custom404Html: loadIfSafe(clientDir, '404.html'),\n    custom500Html: loadIfSafe(clientDir, '500.html'),\n  }\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Static-file server. The URL path IS user-controlled, BUT before any fs\n * call we resolve to absolute and reject with 403 if the resolved path\n * escapes `clientDir` (see EC-1 guard at line below). The guard is\n * authoritative; the rule cannot see it.\n */\nimport { existsSync, readFileSync, statSync } from 'node:fs'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport { resolve, extname } from 'node:path'\n\nconst MIME_TYPES: Record<string, string> = {\n  '.html': 'text/html',\n  '.js': 'application/javascript',\n  '.mjs': 'application/javascript',\n  '.css': 'text/css',\n  '.json': 'application/json',\n  '.png': 'image/png',\n  '.jpg': 'image/jpeg',\n  '.jpeg': 'image/jpeg',\n  '.gif': 'image/gif',\n  '.svg': 'image/svg+xml',\n  '.ico': 'image/x-icon',\n  '.woff': 'font/woff',\n  '.woff2': 'font/woff2',\n  '.ttf': 'font/ttf',\n  '.txt': 'text/plain',\n  '.map': 'application/json',\n}\n\nexport function serveStaticFile(\n  req: IncomingMessage,\n  res: ServerResponse,\n  clientDir: string,\n): boolean {\n  const urlPath = (req.url ?? '/').split('?')[0]\n\n  // Path traversal prevention (EC-1)\n  const filePath = resolve(clientDir, '.' + urlPath)\n  if (!filePath.startsWith(clientDir)) {\n    res.writeHead(403)\n    res.end('Forbidden')\n    return true\n  }\n\n  if (!existsSync(filePath)) return false\n\n  const stat = statSync(filePath)\n  if (!stat.isFile()) return false\n\n  const ext = extname(filePath)\n  const contentType = MIME_TYPES[ext] ?? 'application/octet-stream'\n  const content = readFileSync(filePath)\n\n  res.writeHead(200, {\n    'Content-Type': contentType,\n    'Content-Length': content.length,\n  })\n  res.end(content)\n  return true\n}\n","import type { AgentEvent, AgentErrorEvent } from './agent-types.js'\n\n/**\n * Item #4 — `streamAgentRun`\n *\n * Adapter that consumes the `@usetheo/sdk` `Run.stream()` async generator\n * (SDKMessage variants) and yields TheoKit `AgentEvent`s suitable for SSE\n * via `defineAgentEndpoint`. One line at the consumer side:\n *\n *   ```ts\n *   const run = await agent.send(message)\n *   yield* streamAgentRun(run)\n *   ```\n *\n * Mapping table (SDK → AgentEvent):\n *\n * | SDK message                          | AgentEvent yielded                     |\n * |---|---|\n * | assistant.content[].type==='text'    | { type: 'message', content }           |\n * | assistant.content[].type==='tool_use'| (none — covered by tool_call below)    |\n * | tool_call(status='running')          | { type: 'tool_call', name, args, id }  |\n * | tool_call(status='completed')        | { type: 'tool_result', name, data, id }|\n * | tool_call(status='error')            | { type: 'error', message, id }         |\n * | run.wait() status==='error'          | { type: 'error', message }             |\n * | run.wait() status==='cancelled'      | (none — cancel ≠ error)                |\n * | system / user / thinking / status /  | (none — internal SDK telemetry)        |\n * |   task / request / object_delta      |                                        |\n *\n * Abort semantics: when the consumer calls `generator.return()` on the\n * outer `defineAgentEndpoint` generator, `streamAgentRun` exits the\n * `for await` loop and does NOT call `run.wait()`. Cleanup of in-flight\n * SDK resources is the SDK consumer's responsibility (`run.cancel()`).\n */\n\n/**\n * Local mirror of the SDK's `Run` interface — only the surfaces we consume.\n * The message contract is minimal (just `{ type: string }`) so the SDK's\n * `SDKMessage` discriminated union IS structurally assignable without any\n * cast at the consumer site (covariant — TS accepts the SDK's typed message\n * as the wider `{ type: string }`). Property access inside `streamAgentRun`\n * narrows via runtime type guards.\n *\n * `import type` from `@usetheo/sdk` would couple TheoKit to the SDK at type-\n * resolution time even for consumers who never use the agent surface.\n */\nexport interface AgentRunLike {\n  stream: () => AsyncIterable<{ type: string }>\n  wait: () => Promise<AgentRunResult>\n}\n\n/**\n * Re-exported as a convenience for test fixtures. Production code typically\n * passes an SDK `Run` directly (structural match via `{ type: string }`).\n */\nexport type AgentRunStreamMessage =\n  | {\n      type: 'assistant'\n      message: { role: 'assistant'; content: { type: string; text?: string }[] }\n    }\n  | {\n      type: 'tool_call'\n      name: string\n      status: 'running' | 'completed' | 'error'\n      args?: unknown\n      result?: unknown\n      call_id: string\n    }\n  | { type: string; [k: string]: unknown }\n\n/** Subset of the SDK `RunResult` we consume. */\nexport interface AgentRunResult {\n  status: 'finished' | 'error' | 'cancelled'\n  error?: { message: string; code?: string; cause?: unknown }\n}\n\n/**\n * EC-1 (edge case review): tool result may be a Date, bigint, circular ref,\n * etc. `JSON.stringify` in `encodeSSE` would throw — uncaught inside the\n * outer generator — and `defineAgentEndpoint` would replace the legitimate\n * `tool_result` with a generic `error`. Coerce here so the wire stays honest.\n */\nfunction safeJsonStringify(value: unknown): string {\n  try {\n    return JSON.stringify(value)\n  } catch {\n    return '[Unserializable]'\n  }\n}\n\n/**\n * EC-3 (edge case review): SDK types `args?: unknown`. A raw `as` cast hides\n * the possibility that `msg.args` is an array, primitive, or `null` (null\n * survives `??`). Type-guard BEFORE narrowing to `Record<string, unknown>`.\n */\nfunction safeArgs(args: unknown): Record<string, unknown> {\n  if (typeof args === 'object' && args !== null && !Array.isArray(args)) {\n    return args as Record<string, unknown>\n  }\n  return {}\n}\n\n/**\n * Yield AgentEvents derived from the SDK Run lifecycle.\n *\n * Consumer pattern:\n *\n *   ```ts\n *   export const POST = defineAgentEndpoint({\n *     async *handler({ body }) {\n *       const agent = await Agent.create({ apiKey, model, tools: [...] })\n *       try {\n *         const run = await agent.send(body.message)\n *         yield* streamAgentRun(run)\n *       } finally {\n *         try { await agent.dispose() } catch (e) { console.warn(e) }\n *       }\n *     },\n *   })\n *   ```\n *\n * @public\n */\ninterface AssistantLike {\n  type: 'assistant'\n  message: { role: 'assistant'; content: { type: string; text?: string }[] }\n}\ninterface ToolCallLike {\n  type: 'tool_call'\n  name: string\n  status: 'running' | 'completed' | 'error'\n  args?: unknown\n  result?: unknown\n  call_id: string\n}\n\nfunction isAssistant(msg: { type: string }): msg is AssistantLike {\n  // Wide cast to `unknown` first so runtime null guard survives ESLint\n  // narrowing complaints — the SDK contract permits `null` even when its\n  // TS type does not.\n  const m = msg as unknown as {\n    type: string\n    message?: { content?: unknown } | null\n  }\n  return (\n    m.type === 'assistant' &&\n    m.message != null &&\n    typeof m.message === 'object' &&\n    Array.isArray(m.message.content)\n  )\n}\nfunction isToolCall(msg: { type: string }): msg is ToolCallLike {\n  const t = msg as unknown as {\n    type: string\n    name?: unknown\n    status?: unknown\n    call_id?: unknown\n  }\n  return (\n    t.type === 'tool_call' &&\n    typeof t.name === 'string' &&\n    typeof t.call_id === 'string' &&\n    (t.status === 'running' || t.status === 'completed' || t.status === 'error')\n  )\n}\n\n/**\n * Phase 4 — Production-Readiness #3: structural mirror of SDK's AgentRunError.\n *\n * EC-6 (SHOULD TEST): we only require `code: string` to discriminate.\n * Provider, retriable, retryAfterMs, requestId are all optional — SDK error\n * paths may omit them (e.g., aborted before request, tool runtime error).\n */\ninterface AgentRunErrorLike {\n  message: string\n  code: string\n  provider?: string\n  retriable?: boolean\n  retryAfterMs?: number\n  requestId?: string\n  /**\n   * EC-15 (DOCUMENT) + invariant: `providerError` is QUARANTINED. We read it\n   * for type-narrowing but NEVER serialize into the AgentEvent — leaking the\n   * raw provider response could leak API keys, internal endpoints, or PII.\n   * Only sanitized fields above flow to the SSE wire. `error.message` is\n   * trusted to not contain secrets (SDK's responsibility per the v1.1.0\n   * release contract).\n   */\n  providerError?: unknown\n}\n\n/**\n * EC-6 (SHOULD TEST): minimal type guard — only requires `code: string`.\n * Does NOT require `'provider' in err` because the SDK throws AgentRunErrors\n * without `provider` in local error paths (timeout, tool runtime error,\n * aborted-before-call).\n */\nfunction isAgentRunError(err: unknown): err is AgentRunErrorLike {\n  if (!(err instanceof Error)) return false\n  const e = err as { code?: unknown }\n  return 'code' in e && typeof e.code === 'string'\n}\n\n/**\n * Map an SDK error to the AgentErrorEvent shape. Pure function — easy to test.\n *\n * Backward compat (D4): non-AgentRunError throws yield only `message` field\n * (legacy shape); discriminated fields stay `undefined`.\n *\n * Return type is the specific `AgentErrorEvent` (not the union) for ergonomic\n * call-site access — `errorToEvent(err).code` works without narrowing.\n */\nexport function errorToEvent(err: unknown, id?: string): AgentErrorEvent {\n  if (isAgentRunError(err)) {\n    const event: AgentErrorEvent = {\n      type: 'error',\n      message: err.message,\n      code: err.code,\n    }\n    if (err.provider !== undefined) event.provider = err.provider\n    if (err.retriable !== undefined) event.retriable = err.retriable\n    if (err.retryAfterMs !== undefined) event.retryAfterMs = err.retryAfterMs\n    if (id !== undefined) event.id = id\n    return event\n  }\n  // Fallback for non-AgentRunError throws (plain Error, string, plain object with message)\n  let message: string\n  if (err instanceof Error) {\n    message = err.message\n  } else if (typeof err === 'string') {\n    message = err\n  } else if (err !== null && typeof err === 'object' && 'message' in err) {\n    const candidate: unknown = (err as Record<string, unknown>).message\n    // Plain object with `message: string` — common for SDK status:error payloads\n    message = typeof candidate === 'string' ? candidate : '[object Object]'\n  } else if (err === null || err === undefined) {\n    message = String(err)\n  } else {\n    message = '[non-stringifiable error]'\n  }\n  const event: AgentErrorEvent = { type: 'error', message }\n  if (id !== undefined) event.id = id\n  return event\n}\n\nfunction yieldFromToolCall(msg: ToolCallLike): AgentEvent {\n  if (msg.status === 'running') {\n    return {\n      type: 'tool_call',\n      name: msg.name,\n      args: safeArgs(msg.args),\n      id: msg.call_id,\n    }\n  }\n  if (msg.status === 'completed') {\n    const data = typeof msg.result === 'string' ? msg.result : safeJsonStringify(msg.result)\n    return {\n      type: 'tool_result',\n      name: msg.name,\n      data,\n      id: msg.call_id,\n    }\n  }\n  // status === 'error' — exhaustive by type\n  const message = typeof msg.result === 'string' ? msg.result : `Tool ${msg.name} failed`\n  return { type: 'error', message, id: msg.call_id }\n}\n\nexport async function* streamAgentRun(\n  run: AgentRunLike,\n): AsyncGenerator<AgentEvent, void, unknown> {\n  for await (const msg of run.stream()) {\n    if (isAssistant(msg)) {\n      for (const block of msg.message.content) {\n        if (block.type === 'text' && typeof block.text === 'string' && block.text.length > 0) {\n          yield { type: 'message', content: block.text }\n        }\n      }\n    } else if (isToolCall(msg)) {\n      yield yieldFromToolCall(msg)\n    }\n    // SDK-internal variants (system, user, thinking, status, task,\n    // request, object_delta) are intentionally not yielded.\n  }\n\n  const result = await run.wait()\n  if (result.status === 'error' && result.error !== undefined) {\n    yield errorToEvent(result.error)\n  }\n}\n","/**\n * Provider Resolver — Strategy + Registry pattern (FAANG-grade).\n *\n * Inspiração: Dapr Conversation Registry (`dapr/pkg/components/conversation/registry.go`)\n * + Encore Manager provider array (`encore/runtimes/go/pubsub/manager_internal.go`).\n *\n * Princípio: provider routing é responsabilidade do FRAMEWORK, não do consumer.\n * Consumer template usa `model: { id: 'gpt-4o-mini' }` puro — sem conditionals.\n *\n * Wire protocol: OpenAI Chat Completions (universal — implementado por todos\n * os providers: OpenRouter, Groq, Mistral, Together, Anthropic via proxy, etc).\n *\n * Resolução por prioridade (FIRST match wins):\n *   1. OPENROUTER_API_KEY → baseUrl=openrouter.ai (gateway multi-modelo)\n *   2. OPENAI_API_KEY     → baseUrl=api.openai.com\n *   3. ANTHROPIC_API_KEY  → direct Anthropic (Messages API, não OpenAI-compat)\n *\n * Escape hatch: `options.apiKey` explícito SOBREPÕE auto-resolution\n * (consumer pode forçar provider específico se quiser).\n */\n\n/**\n * Provider configuration descriptor — Registry entry shape.\n *\n * @public\n */\nexport interface ProviderDescriptor {\n  /** Stable name used internally — não exposto no wire. */\n  name: string\n  /** Environment variable that holds the API key for this provider. */\n  envKey: string\n  /** Base URL for the provider's OpenAI-compatible (or native) API. */\n  baseUrl: string\n  /** Resolution priority (lower = higher priority). FIRST match wins. */\n  priority: number\n}\n\n/**\n * Resolved provider configuration — output of `resolveProvider()`.\n *\n * @public\n */\nexport interface ResolvedProvider {\n  name: string\n  apiKey: string\n  baseUrl: string\n}\n\n/**\n * Default provider registry. Order = priority (first = highest).\n *\n * Adding a new provider:\n *   1. Append entry below (or register via `registerProvider()`).\n *   2. Set `envKey` matching the user's env var convention.\n *   3. Set `baseUrl` to the OpenAI-compat endpoint (or native if not compat).\n *   4. Provider name used in telemetry/logs only — never wire-exposed.\n */\nconst DEFAULT_REGISTRY: ProviderDescriptor[] = [\n  {\n    name: 'openrouter',\n    envKey: 'OPENROUTER_API_KEY',\n    baseUrl: 'https://openrouter.ai/api/v1',\n    priority: 1,\n  },\n  {\n    name: 'openai',\n    envKey: 'OPENAI_API_KEY',\n    baseUrl: 'https://api.openai.com/v1',\n    priority: 2,\n  },\n  {\n    name: 'anthropic',\n    envKey: 'ANTHROPIC_API_KEY',\n    baseUrl: 'https://api.anthropic.com',\n    priority: 3,\n  },\n]\n\n/**\n * Runtime registry — copy of DEFAULT_REGISTRY mutable via registerProvider().\n * Sorted by priority on every resolve (stable, O(n log n) — n <= ~10 providers).\n */\nconst registry: ProviderDescriptor[] = [...DEFAULT_REGISTRY]\n\n/**\n * Register a new provider (Registry pattern — runtime extension point).\n * Useful for self-hosted endpoints or custom providers without touching theokit src.\n *\n * @example\n * registerProvider({\n *   name: 'self-hosted',\n *   envKey: 'SELF_HOSTED_API_KEY',\n *   baseUrl: 'https://llm.internal.acme.com/v1',\n *   priority: 0, // highest priority\n * })\n *\n * @public\n */\nexport function registerProvider(descriptor: ProviderDescriptor): void {\n  // Idempotent — replace existing by name.\n  const idx = registry.findIndex((p) => p.name === descriptor.name)\n  if (idx >= 0) registry[idx] = descriptor\n  else registry.push(descriptor)\n}\n\n/**\n * Reset registry to DEFAULT_REGISTRY (test-only / dev escape hatch).\n *\n * @public\n */\nexport function resetProviderRegistry(): void {\n  registry.length = 0\n  registry.push(...DEFAULT_REGISTRY)\n}\n\n/**\n * Get current registry snapshot (read-only — inspection).\n *\n * @public\n */\nexport function listProviders(): readonly ProviderDescriptor[] {\n  return [...registry].sort((a, b) => a.priority - b.priority)\n}\n\n/**\n * Resolve provider from env vars by priority. FIRST env var found wins.\n *\n * @returns ResolvedProvider with apiKey + baseUrl + name\n * @throws Error if NO provider env var is set (actionable message)\n *\n * @public\n */\nexport function resolveProvider(): ResolvedProvider {\n  const sorted = [...registry].sort((a, b) => a.priority - b.priority)\n  for (const desc of sorted) {\n    const apiKey = process.env[desc.envKey]\n    if (apiKey && apiKey.length > 0) {\n      return {\n        name: desc.name,\n        apiKey,\n        baseUrl: desc.baseUrl,\n      }\n    }\n  }\n  // No env var found — emit actionable error.\n  const envKeys = sorted.map((p) => p.envKey).join(' OR ')\n  throw new Error(\n    `No LLM provider API key found in environment. Set one of: ${envKeys}. ` +\n      `Get a free OpenRouter key at https://openrouter.ai/keys (recommended — one key, many models).`,\n  )\n}\n\n/**\n * Try to resolve — does NOT throw. Returns null if no provider available.\n * Useful for graceful degradation (e.g., mock mode).\n *\n * @public\n */\nexport function tryResolveProvider(): ResolvedProvider | null {\n  try {\n    return resolveProvider()\n  } catch {\n    return null\n  }\n}\n","/**\n * Item #5 — `createConversationHistory`\n *\n * Orchestrator that resolves a stable `agentId` from (explicit → session →\n * cookie → fresh UUID), then returns an `@usetheo/sdk` `Agent` via\n * `Agent.getOrCreate(agentId, options)`. Conversation turns auto-persist in\n * `<cwd>/.theokit/agents/<agentId>/messages.jsonl` — SDK owns the storage\n * (ADR D1). `MemorySettings` (facts recall layer) is opt-in passthrough via\n * `options.memory` (ADR D2).\n *\n * Security: agentId from cookie/explicit is attacker-controlled. The SDK\n * uses it as a filesystem path component AND we serialize it into Set-Cookie.\n * EC-1 enforces a strict regex `^[a-zA-Z0-9_-]{1,128}$` at every entry point;\n * invalid values fall through (treated as \"missing\") rather than throw.\n */\n\nimport { tryResolveProvider } from './provider-resolver.js'\n\n// ──────────────────────────────────────────────────────────────────────────\n// Structural types — mirrors of SDK shapes we don't want to hard-import\n// (the SDK is an OPTIONAL peer per item #4's stance).\n// ──────────────────────────────────────────────────────────────────────────\n\n/**\n * Minimum surface of an SDK Agent that consumers care about post-creation.\n * Structural match — any object with `send` + `dispose` of compatible\n * shape works. `send` returns a `SdkRunLike` (a Run-shaped object) that\n * `streamAgentRun` can consume. Permissive `unknown` for now; consumers\n * who want stricter types can cast to the SDK's own types.\n *\n * **T5.2 (architecture-cleanup) — DP-7 decision: KEEP (Opt B).** The 5 duck-typed\n * mirrors below were flagged as \"over-engineered\" by the 2026-05-27 architecture\n * review. Decision: KEEP them because `@usetheo/sdk` is `devDependency` (not\n * required at runtime for consumers that don't use agent features). Removing\n * the mirrors would force a hard runtime dep on the SDK, breaking consumers\n * who build TheoKit apps without the agent layer.\n *\n * @kept Defensive duck-type. Do NOT replace with direct SDK type imports unless\n *   `@usetheo/sdk` is promoted from devDependency to dependency. If promoting,\n *   ALSO drop the mirrors (Opt A from the architecture-cleanup plan T5.2).\n */\nexport interface SdkRunLike {\n  stream: () => AsyncIterable<{ type: string }>\n  wait: () => Promise<{ status: 'finished' | 'error' | 'cancelled'; error?: { message: string } }>\n}\n\nexport interface SdkAgent {\n  send: (message: string, options?: unknown) => Promise<SdkRunLike>\n  dispose: () => Promise<void>\n}\n\n/**\n * Phase 2 — structural duck-type of `@usetheo/sdk`'s `ConversationStorageAdapter`.\n *\n * D2 (decoupling): we mirror the SDK's shape locally rather than hard-import\n * the SDK type. This lets consumers pass any object matching the structural\n * contract (own implementation, SDK's `FileSystemConversationStorage`,\n * `InMemoryConversationStorage`, or a Postgres/Redis recipe).\n *\n * EC-5 (SHOULD TEST — sync drift detection): the SDK type MUST be assignable\n * to this interface AND vice-versa. A contract test asserts both directions.\n *\n * `unknown` for the message payload avoids coupling to the SDK's `SDKMessage`\n * shape. Real consumers cast at the call site if they need stricter types.\n */\nexport interface ConversationStorageLike {\n  getMessages(conversationId: string): Promise<readonly unknown[]>\n  appendMessage(conversationId: string, message: unknown): Promise<void>\n  deleteConversation(conversationId: string): Promise<void>\n  listConversationIds?(opts?: { limit?: number }): Promise<readonly string[] | undefined>\n  dispose?(): Promise<void>\n}\n\n/**\n * Minimum surface of `AgentOptions` accepted by `Agent.getOrCreate`. Forward-\n * compatible: callers pass whatever the SDK supports (memory, tools, etc.).\n *\n * Phase 2 adds typed `conversationStorage` slot. The index signature still\n * passes everything else opaquely.\n */\nexport interface SdkAgentOptions {\n  apiKey?: string\n  model?: { id: string }\n  tools?: readonly unknown[]\n  memory?: Record<string, unknown>\n  /**\n   * Phase 2 (Production-Readiness #1) — pluggable conversation persistence.\n   * Default (when omitted): SDK falls back to `FileSystemConversationStorage`.\n   * Required for serverless / multi-host deploys.\n   */\n  conversationStorage?: ConversationStorageLike\n  [key: string]: unknown\n}\n\ninterface SdkModule {\n  Agent: {\n    getOrCreate: (agentId: string, options: SdkAgentOptions) => Promise<SdkAgent>\n  }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Public API\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface ConversationHistoryArgs {\n  /** Request — for reading the conversation cookie. */\n  request: Request | { headers?: { cookie?: string } | Headers }\n  /**\n   * Response-like surface that accepts a `Set-Cookie` header. The primitive\n   * appends a Set-Cookie line when issuing a new conversation id. If absent,\n   * the primitive still reads the existing cookie but cannot issue a new\n   * one — useful for read-only contexts.\n   */\n  response?: { headers: Headers }\n  /** Explicit override — wins over session/cookie/uuid (ADR D3 step 1). */\n  agentId?: string\n  /** Auth session containing a `conversationId` field — ADR D3 step 2. */\n  session?: { conversationId?: string } | null\n  /** SDK AgentOptions forwarded to Agent.getOrCreate. apiKey + model required. */\n  options: SdkAgentOptions\n  /** Cookie name override. Default: 'theo_conversation'. */\n  cookieName?: string\n  /** Cookie max-age in seconds. Default + min: 30 days. Non-positive coerced to default (EC-4). */\n  cookieMaxAge?: number\n}\n\nexport interface ConversationHistoryResult {\n  /** The SDK Agent, ready to receive `agent.send(message)`. */\n  agent: SdkAgent\n  /** The resolved conversation id (useful for logging / debugging). */\n  conversationId: string\n  /** True when the id was newly generated (no prior cookie / session). */\n  isNew: boolean\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Test seam — allows unit tests to swap the SDK without dynamic import flake.\n// Underscore-prefixed: NOT part of the public contract.\n// ──────────────────────────────────────────────────────────────────────────\n\nlet sdkOverride: SdkModule | null | undefined = undefined\n\n/** @internal */\nexport function __setSdkForTests(sdk: SdkModule | null): void {\n  sdkOverride = sdk\n}\n\n/** @internal */\nexport function __resetSdkForTests(): void {\n  sdkOverride = undefined\n}\n\nasync function loadSdk(): Promise<SdkModule> {\n  // EC-2 (edge case review — MUST FIX): the SDK is an optional peer; if the\n  // consumer never installed it, `import('@usetheo/sdk')` throws\n  // ERR_MODULE_NOT_FOUND. Re-throw with an actionable message.\n  if (sdkOverride === null) {\n    throw new Error(\n      'createConversationHistory requires @usetheo/sdk. Install: pnpm add @usetheo/sdk',\n    )\n  }\n  if (sdkOverride !== undefined) return sdkOverride\n  try {\n    // Use `createRequire` — Node's CJS-style require resolves against the\n    // process's actual node_modules tree, bypassing Vite's SSR import-\n    // analysis pipeline. The dynamic ESM `import()` path got intercepted\n    // by Vite's `vite:import-analysis` plugin and failed to find the SDK\n    // even when it was installed; createRequire goes straight to Node.\n    //\n    // The SDK ships dual ESM+CJS (per its tsup build), so `require` yields\n    // the same module the ESM `import` would.\n    const { createRequire } = await import('node:module')\n    const requireFn = createRequire(import.meta.url)\n    const spec = '@usetheo/sdk'\n    const mod = requireFn(spec) as unknown as SdkModule\n    return mod\n  } catch (cause) {\n    throw new Error(\n      'createConversationHistory requires @usetheo/sdk. Install: pnpm add @usetheo/sdk',\n      { cause },\n    )\n  }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Implementation\n// ──────────────────────────────────────────────────────────────────────────\n\nconst DEFAULT_COOKIE_NAME = 'theo_conversation'\nconst DEFAULT_COOKIE_MAX_AGE = 60 * 60 * 24 * 30 // 30 days\n\n/**\n * EC-1 (edge case review — MUST FIX): the agentId becomes a filesystem path\n * component (`<cwd>/.theokit/agents/<agentId>/messages.jsonl`) inside the SDK\n * AND is serialized into a Set-Cookie header. The SDK does NOT validate the\n * char set. An attacker setting `Cookie: theo_conversation=../../../etc/passwd`\n * could trigger arbitrary-path writes; an `agentId` with CRLF would inject\n * HTTP headers. The same regex kills both attacks.\n */\nconst AGENT_ID_REGEX = /^[a-zA-Z0-9_-]{1,128}$/\n\nfunction isValidAgentId(s: string | undefined | null): s is string {\n  return typeof s === 'string' && AGENT_ID_REGEX.test(s)\n}\n\n/**\n * Minimal RFC 6265 cookie parser. Returns the FIRST occurrence of `name`\n * (EC-5 — pins first-wins behavior).\n */\nfunction readCookieValue(\n  request: ConversationHistoryArgs['request'],\n  name: string,\n): string | undefined {\n  let raw: string | undefined\n  const h = request.headers\n  if (h === undefined) return undefined\n  if (typeof (h as Headers).get === 'function') {\n    raw = (h as Headers).get('cookie') ?? undefined\n  } else {\n    raw = (h as { cookie?: string }).cookie\n  }\n  if (raw === undefined || raw.length === 0) return undefined\n  const pairs = raw.split(/[;,]/)\n  for (const pair of pairs) {\n    const eq = pair.indexOf('=')\n    if (eq < 0) continue\n    const k = pair.slice(0, eq).trim()\n    if (k === name) return pair.slice(eq + 1).trim()\n  }\n  return undefined\n}\n\ninterface SerializeCookieOptions {\n  httpOnly?: boolean\n  sameSite?: 'lax' | 'strict' | 'none'\n  maxAge?: number\n  path?: string\n}\n\nfunction serializeCookie(name: string, value: string, options: SerializeCookieOptions): string {\n  const parts: string[] = [`${name}=${value}`]\n  if (options.path !== undefined) parts.push(`Path=${options.path}`)\n  if (options.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`)\n  if (options.sameSite !== undefined) {\n    const v = options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1)\n    parts.push(`SameSite=${v}`)\n  }\n  if (options.httpOnly === true) parts.push('HttpOnly')\n  return parts.join('; ')\n}\n\nexport async function createConversationHistory(\n  args: ConversationHistoryArgs,\n): Promise<ConversationHistoryResult> {\n  const cookieName = args.cookieName ?? DEFAULT_COOKIE_NAME\n  // EC-4 (edge case review — SHOULD TEST): coerce non-positive to default.\n  // The `??` operator alone would let `0` through, producing `Max-Age=0`\n  // which means \"delete cookie immediately\" — almost certainly not intent.\n  const rawMaxAge = args.cookieMaxAge\n  const cookieMaxAge =\n    typeof rawMaxAge === 'number' && rawMaxAge > 0 ? rawMaxAge : DEFAULT_COOKIE_MAX_AGE\n\n  // 1. Resolve agentId per ADR D3 — sources are validated; invalid values\n  //    fall through (treated as \"missing\") rather than throw.\n  let conversationId: string | undefined\n  let isNew = false\n  const cookieOnRequest = readCookieValue(args.request, cookieName)\n\n  if (isValidAgentId(args.agentId)) {\n    conversationId = args.agentId\n  } else if (args.session !== null && args.session !== undefined) {\n    const sId = args.session.conversationId\n    if (isValidAgentId(sId)) conversationId = sId\n  }\n  if (conversationId === undefined && isValidAgentId(cookieOnRequest)) {\n    conversationId = cookieOnRequest\n  }\n\n  if (conversationId === undefined) {\n    conversationId = crypto.randomUUID()\n    isNew = true\n  }\n\n  // Issue (or refresh) the cookie when:\n  //   1. The id was newly generated (no source had it), OR\n  //   2. The request's cookie does NOT match the resolved id (explicit\n  //      `agentId` override, session-derived id, etc.). Without this,\n  //      callers that pre-probe the id (e.g. to build agentId-scoped tools)\n  //      and pass it via `agentId` would never get a Set-Cookie even on\n  //      first visit. Net effect: every response with a `response` slot\n  //      ensures the browser ends up with a cookie that matches the\n  //      resolved id.\n  const shouldIssueCookie = isNew || cookieOnRequest !== conversationId\n  if (shouldIssueCookie && args.response !== undefined) {\n    const cookie = serializeCookie(cookieName, conversationId, {\n      httpOnly: true,\n      sameSite: 'lax',\n      maxAge: cookieMaxAge,\n      path: '/',\n    })\n    args.response.headers.append('set-cookie', cookie)\n  }\n\n  // 2. Auto-resolve provider via Strategy pattern (FAANG-grade — zero\n  //    conditionals no consumer). If `options.apiKey` ausente, lê env vars\n  //    priorizadas (OPENROUTER > OPENAI > ANTHROPIC) e injeta apiKey +\n  //    providers.baseUrl. Consumer override: passar `options.apiKey` explícito\n  //    SOBREPÕE o auto-resolve (escape hatch). Ver `provider-resolver.ts` +\n  //    Dapr Conversation Registry pattern (`referencias/dapr/pkg/components/conversation/`).\n  const resolvedOptions = autoResolveProviderIfNeeded(args.options)\n\n  // 3. Resolve the agent via SDK.\n  const sdk = await loadSdk()\n  const agent = await sdk.Agent.getOrCreate(conversationId, resolvedOptions)\n\n  return { agent, conversationId, isNew }\n}\n\n/**\n * Auto-inject provider config (apiKey + baseUrl) via Strategy pattern when\n * consumer didn't pass apiKey explicit. Idempotent — se apiKey já set, noop.\n *\n * Output shape:\n *   {\n *     ...originalOptions,\n *     apiKey: env,    // resolved from process.env\n *     providers: { routes: [{ capability: 'chat', provider: name, ... }] }\n *   }\n */\nfunction autoResolveProviderIfNeeded(options: SdkAgentOptions): SdkAgentOptions {\n  // Escape hatch — consumer override wins.\n  if (typeof options.apiKey === 'string' && options.apiKey.length > 0) {\n    return options\n  }\n  // Auto-resolve via Strategy registry.\n  //\n  // Finding A workaround (sdk-residual-behavior-2026-05-28): SDK silently\n  // returns canned \"Hello! How can I assist you today?\" content when no\n  // apiKey AND no provider env vars are present. Fail-fast HERE with an\n  // actionable error — template's try/catch yields `{type:'error'}` SSE\n  // event so consumer sees what's wrong.\n  const resolved = tryResolveProvider()\n  if (resolved === null) {\n    throw new Error(\n      'No LLM provider API key found in environment. ' +\n        'Set OPENROUTER_API_KEY (recommended — gateway to many models) OR ' +\n        'OPENAI_API_KEY OR ANTHROPIC_API_KEY in your .env. ' +\n        'Get a free OpenRouter key at https://openrouter.ai/keys. ' +\n        '(Pass `options.apiKey` explicitly to bypass auto-resolution.)',\n    )\n  }\n  // Inject apiKey + provider routing. SDK ProviderRoutingSettings shape.\n  // Note: we use `chat` capability since this is the conversation primitive;\n  // SDK may extend to embeddings/etc — those routes are separate concerns.\n  return {\n    ...options,\n    apiKey: resolved.apiKey,\n    providers: {\n      routes: [{ capability: 'chat', provider: resolved.name, baseUrl: resolved.baseUrl }],\n    },\n  }\n}\n","import { createHash } from 'node:crypto'\nimport type { IncomingMessage } from 'node:http'\n\nimport { parseCookieHeader } from '../http/cookies.js'\n\nimport { InMemoryStore, type RateLimitStore } from './rate-limit-store.js'\nimport type { RateLimitConfig, RateLimitResult } from './rate-limit.js'\n\n/**\n * T2.2 — Per-route + per-user rate limiting.\n *\n * Layered on top of `rate-limit-store.ts`. The route map allows\n * declarative policies (\"strict /api/login, loose everything else\")\n * driven by config, not handler-decorated. `keyBy` selects what\n * identifier the limiter buckets on.\n *\n * ADR D2: per-route via path matching, NOT per-handler decorator.\n * Operators can tune policies without touching route definitions.\n */\n\nexport type KeyByMode = 'ip' | 'session' | 'user' | ((req: IncomingMessage) => string)\n\nexport interface RouteRateLimitConfig {\n  /** Fallback config used when no per-route entry matches. */\n  default?: RateLimitConfig\n  /** Map of path pattern → config. Exact-string keys (RegExp via API). */\n  routes?: Record<string, RateLimitConfig>\n  /** Same as `routes` but each entry is a [pattern, config] tuple, RegExp allowed. */\n  routePatterns?: readonly [string | RegExp, RateLimitConfig][]\n  /** Bucket identifier strategy. Default 'ip'. */\n  keyBy?: KeyByMode\n  /** Cookie name used by keyBy='session'. Defaults to 'theo_session'. */\n  cookieName?: string\n  /** Optional shared store (for multi-route correlation). Default per-limiter InMemoryStore. */\n  store?: RateLimitStore\n}\n\n/**\n * Normalize a path for matching: strip query string, drop trailing slash\n * unless root. EC-5: `/api/login` and `/api/login/` collapse to the same\n * canonical form so attackers can't bypass strict limits.\n */\nfunction normalizePath(input: string): string {\n  const noQuery = input.split('?')[0]\n  if (noQuery.length > 1 && noQuery.endsWith('/')) return noQuery.slice(0, -1)\n  return noQuery\n}\n\n/**\n * Test whether `path` matches `pattern`. String patterns are compared\n * after trailing-slash normalization (EC-5). RegExp uses `.test` after\n * resetting `lastIndex` (defensive against `/g` flag).\n */\nexport function matchRoutePattern(path: string, pattern: string | RegExp): boolean {\n  const canonical = normalizePath(path)\n  if (typeof pattern === 'string') {\n    return canonical === normalizePath(pattern)\n  }\n  pattern.lastIndex = 0\n  return pattern.test(canonical)\n}\n\n/**\n * Hash a string with SHA-256 and return the first 16 base64url chars.\n * Used by `keyBy='session'` so the raw cookie value never lands in a\n * rate-limit key (which may flow into audit logs).\n */\nfunction hashFragment(input: string): string {\n  return createHash('sha256').update(input).digest('base64url').slice(0, 16)\n}\n\n// T3.2 DRY consolidation: cookie parsing moved to ../http/cookies.ts.\n// The canonical `parseCookieHeader` returns a Map for O(1) lookup; this\n// wrapper preserves the original `readCookie(req, name)` signature so the\n// rest of the file stays untouched.\nfunction readCookie(req: IncomingMessage, name: string): string | undefined {\n  return parseCookieHeader(req.headers.cookie ?? undefined).get(name)\n}\n\n/**\n * Build the rate-limit bucket key for the request based on `keyBy`.\n *\n * EC-6: session mode reads the configured `cookieName`. With the wrong\n * cookie name (e.g., default 'theo_session' but app uses 'app_session'),\n * we fall back to IP so anonymous users still get rate-limited rather\n * than sharing an empty bucket.\n */\nexport function deriveKey(req: IncomingMessage, keyBy: KeyByMode, cookieName: string): string {\n  if (typeof keyBy === 'function') return keyBy(req)\n  // `req.socket` is typed as always-present in Node typings, but in test\n  // doubles (object literals without `socket`) it can be missing — the\n  // optional chain keeps the fallback path reachable.\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- defensive for test doubles\n  const ip = req.socket?.remoteAddress ?? 'unknown'\n  switch (keyBy) {\n    case 'session': {\n      const cookie = readCookie(req, cookieName)\n      return cookie ? `session:${hashFragment(cookie)}` : `ip:${ip}`\n    }\n    case 'user': {\n      const userId = (req as unknown as { user?: { id?: string } }).user?.id\n      return userId ? `user:${userId}` : `ip:${ip}`\n    }\n    case 'ip':\n    default:\n      return `ip:${ip}`\n  }\n}\n\n/**\n * Per-route rate limiter factory. Returns a sync checker compatible with\n * the existing api-middleware shape.\n *\n * Backwards-compatibility (ADR D2): a flat `{ windowMs, max }` config is\n * accepted and treated as `default` (no per-route variants).\n */\nexport function createRouteRateLimiter(config: RouteRateLimitConfig | RateLimitConfig) {\n  // Detect legacy flat shape\n  const isFlat =\n    'windowMs' in config && 'max' in config && !('default' in config) && !('routes' in config)\n  const cfg: RouteRateLimitConfig = isFlat ? { default: config } : config\n\n  const store = cfg.store ?? new InMemoryStore()\n  // CR-005: validate store shape ONCE at construction. The previous\n  // implementation ran `instanceof InMemoryStore` on every request and\n  // threw at request-time if a non-InMemoryStore was passed — which\n  // turned a clear config error into a runtime 500 on the first request.\n  if (!(store instanceof InMemoryStore)) {\n    throw new Error(\n      'createRouteRateLimiter: async RateLimitStore implementations require a dedicated async middleware path. ' +\n        'Use the InMemoryStore default for the sync façade.',\n    )\n  }\n  const inMemoryStore = store\n  const keyBy = cfg.keyBy ?? 'ip'\n  const cookieName = cfg.cookieName ?? 'theo_session'\n\n  // Build a pre-compiled list of (pattern, config) tuples for matching.\n  const patternList: [string | RegExp, RateLimitConfig][] = []\n  if (cfg.routes) {\n    for (const [pattern, c] of Object.entries(cfg.routes)) patternList.push([pattern, c])\n  }\n  if (cfg.routePatterns) {\n    for (const tuple of cfg.routePatterns) patternList.push(tuple)\n  }\n\n  return function checkRouteRateLimit(req: IncomingMessage): RateLimitResult {\n    const url = req.url ?? ''\n    let matched: RateLimitConfig | undefined\n    for (const [pattern, c] of patternList) {\n      if (matchRoutePattern(url, pattern)) {\n        matched = c\n        break\n      }\n    }\n    const effective = matched ?? cfg.default\n    if (!effective) {\n      // No route match + no default → not limited.\n      return { limited: false, headers: {} }\n    }\n\n    // Bucket key includes normalized path so /api/login and /api/login/\n    // collapse to the same bucket (EC-5).\n    const bucketSuffix = typeof matched === 'undefined' ? '*default*' : normalizePath(url)\n    const key = `${deriveKey(req, keyBy, cookieName)}|${bucketSuffix}`\n    const state = inMemoryStore.incrSync(key, effective.windowMs)\n\n    if (state.count > effective.max) {\n      const retryAfter = Math.ceil((state.resetAt - Date.now()) / 1000)\n      return {\n        limited: true,\n        headers: {\n          'X-RateLimit-Limit': String(effective.max),\n          'X-RateLimit-Remaining': '0',\n          'Retry-After': String(retryAfter),\n        },\n      }\n    }\n    return {\n      limited: false,\n      headers: {\n        'X-RateLimit-Limit': String(effective.max),\n        'X-RateLimit-Remaining': String(Math.max(0, effective.max - state.count)),\n      },\n    }\n  }\n}\n","import type { WebSocketLike } from '../define/define-websocket.js'\n\nexport class ChannelManager {\n  private rooms = new Map<string, Set<WebSocketLike>>()\n  private wsRooms = new Map<WebSocketLike, Set<string>>()\n\n  subscribe(ws: WebSocketLike, room: string): void {\n    let roomSet = this.rooms.get(room)\n    if (!roomSet) {\n      roomSet = new Set()\n      this.rooms.set(room, roomSet)\n    }\n    roomSet.add(ws)\n\n    let wsSet = this.wsRooms.get(ws)\n    if (!wsSet) {\n      wsSet = new Set()\n      this.wsRooms.set(ws, wsSet)\n    }\n    wsSet.add(room)\n  }\n\n  unsubscribe(ws: WebSocketLike, room: string): void {\n    this.rooms.get(room)?.delete(ws)\n    if (this.rooms.get(room)?.size === 0) this.rooms.delete(room)\n\n    this.wsRooms.get(ws)?.delete(room)\n    if (this.wsRooms.get(ws)?.size === 0) this.wsRooms.delete(ws)\n  }\n\n  broadcast(room: string, data: unknown, exclude?: WebSocketLike): void {\n    const clients = this.rooms.get(room)\n    if (!clients) return\n\n    const msg = JSON.stringify(data)\n    for (const ws of clients) {\n      if (ws !== exclude) ws.send(msg)\n    }\n  }\n\n  broadcastAll(data: unknown): void {\n    const msg = JSON.stringify(data)\n    const seen = new Set<WebSocketLike>()\n    for (const clients of this.rooms.values()) {\n      for (const ws of clients) {\n        if (!seen.has(ws)) {\n          ws.send(msg)\n          seen.add(ws)\n        }\n      }\n    }\n  }\n\n  getRoomSize(room: string): number {\n    return this.rooms.get(room)?.size ?? 0\n  }\n\n  cleanup(ws: WebSocketLike): void {\n    const rooms = this.wsRooms.get(ws)\n    if (rooms) {\n      for (const room of rooms) {\n        this.rooms.get(room)?.delete(ws)\n        if (this.rooms.get(room)?.size === 0) this.rooms.delete(room)\n      }\n    }\n    this.wsRooms.delete(ws)\n  }\n}\n","/**\n * StorageManager — per-process singleton coordinating pluggable storage\n * adapters (Postgres pools, Redis clients, in-memory adapters).\n *\n * Architectural decisions: see ADR-0007 (docs/adr/0007-storage-manager-singleton.md).\n *\n * Lifecycle:\n *   1. `getStorageManager()` returns the singleton (D1).\n *   2. `configure(storageConfig)` honored once per process (D3). Second call\n *      warns and is ignored.\n *   3. `usePostgres(dbName, factory)` / `useRedis(serverName, factory)`\n *      lazily create + cache (D2). Factory invoked exactly once per name.\n *   4. `register(adapter)` opts the adapter into the SIGTERM drain (D6).\n *   5. `dispose()` drains in parallel — adapters + pools + Redis (D5).\n *      Idempotent. Adapter errors logged + swallowed (do not block shutdown).\n *\n * Test seam: `__resetForTests()` resets state. Test files MUST call it from\n * `beforeEach` to avoid pollution across `it` blocks (EC-3).\n */\n\nimport type {\n  PoolLike,\n  PostgresDatabaseConfig,\n  RedisLike,\n  RedisServerConfig,\n  ServerConfig,\n  StorageAdapter,\n  StorageConfig,\n} from './storage-types.js'\n\nexport type PostgresFactory = (server: ServerConfig, db: PostgresDatabaseConfig) => PoolLike\nexport type RedisFactory = (config: RedisServerConfig) => RedisLike\n\nexport class StorageManager {\n  #config: StorageConfig | undefined\n  readonly #dbPools = new Map<string, PoolLike>()\n  readonly #redisClients = new Map<string, RedisLike>()\n  readonly #genericClients = new Map<string, unknown>()\n  readonly #adapters = new Set<StorageAdapter>()\n  #disposed = false\n\n  /**\n   * Apply the storage config block from `theo.config.ts`. Second call warns\n   * and is ignored (D3). Reset only via `__resetForTests()`.\n   */\n  configure(config: StorageConfig): void {\n    if (this.#config !== undefined) {\n      console.warn('[theokit] StorageManager already configured; ignoring second configure() call')\n      return\n    }\n    this.#config = config\n  }\n\n  /**\n   * Generic cache + factory for ANY client (MySQL, Mongo, Turso, DynamoDB, …).\n   * Returns the cached client OR invokes the factory and caches its return.\n   *\n   * EC-1 FIX: cache-hit check uses `Map.has(name)`, NOT `cached !== undefined`.\n   * Factories returning `null` or `undefined` are valid (lazy connect, stubs);\n   * the `!== undefined` check would re-invoke the factory infinitely for\n   * undefined returns AND silently cache `null` cast as `T`.\n   *\n   * EC-2 (documented type hole): `useStorage<A>('x', fA)` followed by\n   * `useStorage<B>('x', fB)` returns the cached A cast as B. Same trade-off\n   * as `Map<string, unknown>` — caller is responsible for using unique names\n   * per type.\n   *\n   * Lifecycle: generic clients are NOT auto-drained by `dispose()`. Call\n   * `manager.register({ name, dispose })` separately to participate.\n   *\n   * Reserved name prefixes (do NOT use): `__pg:`, `__redis:`, `__unstorage:`,\n   * `__db0:` — these are used internally by the typed helpers.\n   */\n  useStorage<T>(name: string, factory: () => T): T {\n    if (this.#disposed) throw new Error('StorageManager is disposed')\n    if (this.#genericClients.has(name)) return this.#genericClients.get(name) as T\n    const client = factory()\n    this.#genericClients.set(name, client)\n    return client\n  }\n\n  /**\n   * Return a Postgres pool for the named database. Lazy + cached. Factory\n   * invoked exactly once per `dbName` (D2).\n   *\n   * Throws if:\n   *   - manager is disposed\n   *   - `dbName` is not in `config.databases`\n   *   - the referenced server is not in `config.servers` (EC-2: deferred\n   *     cross-field validation surfaces here, not at configure time)\n   */\n  usePostgres(dbName: string, factory: PostgresFactory): PoolLike {\n    if (this.#disposed) throw new Error('StorageManager is disposed')\n    const cached = this.#dbPools.get(dbName)\n    if (cached !== undefined) return cached\n    const dbConfig = this.#config?.databases?.[dbName]\n    if (dbConfig === undefined) {\n      throw new Error(\n        `Database \"${dbName}\" not configured. Add it to theo.config.ts > storage.databases.`,\n      )\n    }\n    const server = this.#config?.servers?.[dbConfig.server]\n    if (server === undefined) {\n      throw new Error(\n        `Server \"${dbConfig.server}\" referenced by database \"${dbName}\" not found in theo.config.ts > storage.servers.`,\n      )\n    }\n    const pool = factory(server, dbConfig)\n    this.#dbPools.set(dbName, pool)\n    return pool\n  }\n\n  /**\n   * Return a Redis client for the named server. Lazy + cached. Factory\n   * invoked exactly once per `serverName`.\n   */\n  useRedis(serverName: string, factory: RedisFactory): RedisLike {\n    if (this.#disposed) throw new Error('StorageManager is disposed')\n    const cached = this.#redisClients.get(serverName)\n    if (cached !== undefined) return cached\n    const serverConfig = this.#config?.redis?.[serverName]\n    if (serverConfig === undefined) {\n      throw new Error(\n        `Redis server \"${serverName}\" not configured. Add it to theo.config.ts > storage.redis.`,\n      )\n    }\n    const client = factory(serverConfig)\n    this.#redisClients.set(serverName, client)\n    return client\n  }\n\n  /**\n   * Register an adapter for graceful shutdown coordination (D6).\n   *\n   * EC-4: throws if the manager is already disposed — prevents silent\n   * leaks in test seams that reset+reuse the manager.\n   */\n  register(adapter: StorageAdapter): void {\n    if (this.#disposed) {\n      throw new Error(\n        'StorageManager is disposed; cannot register new adapter. Call __resetForTests() in test setup.',\n      )\n    }\n    this.#adapters.add(adapter)\n  }\n\n  /**\n   * Drain in parallel — registered adapters, then PG pools, then Redis\n   * clients. Idempotent (D5). Errors per resource are logged and swallowed\n   * — they do NOT prevent shutdown of the remaining resources.\n   *\n   * Caller must wrap in a timeout if a bound is needed (EC-7: documented).\n   * In production, `start.ts` wraps the whole shutdown sequence in a 25 s\n   * force-exit timer.\n   */\n  async dispose(): Promise<void> {\n    if (this.#disposed) return\n    this.#disposed = true\n\n    const adapterDrains = Array.from(this.#adapters).map((a) =>\n      a.dispose().catch((err: unknown) => {\n        const msg = err instanceof Error ? err.message : String(err)\n        console.warn(`[theokit] adapter \"${a.name}\" dispose failed: ${msg}`)\n      }),\n    )\n    await Promise.all(adapterDrains)\n\n    const poolCloses = Array.from(this.#dbPools.values()).map((pool) => {\n      // EC-5: pool without `.end()` is silently skipped (TS already enforces\n      // shape at factory signature; this is the graceful runtime fallback if\n      // user bypasses via `as` cast).\n      if (pool.end === undefined) return Promise.resolve()\n      return pool.end().catch((err: unknown) => {\n        const msg = err instanceof Error ? err.message : String(err)\n        console.warn(`[theokit] PG pool close failed: ${msg}`)\n      })\n    })\n    await Promise.all(poolCloses)\n\n    const redisCloses = Array.from(this.#redisClients.values()).map((c) =>\n      c.quit().catch((err: unknown) => {\n        const msg = err instanceof Error ? err.message : String(err)\n        console.warn(`[theokit] Redis quit failed, falling back to disconnect: ${msg}`)\n        c.disconnect()\n      }),\n    )\n    await Promise.all(redisCloses)\n\n    this.#dbPools.clear()\n    this.#redisClients.clear()\n    this.#genericClients.clear()\n    this.#adapters.clear()\n  }\n\n  /** @internal Testing seam — resets state so a single test file can re-use the singleton across `it` blocks (EC-3). */\n  __resetForTests(): void {\n    this.#config = undefined\n    this.#dbPools.clear()\n    this.#redisClients.clear()\n    this.#genericClients.clear()\n    this.#adapters.clear()\n    this.#disposed = false\n  }\n\n  /** @internal Introspection helper for tests. */\n  __isConfiguredForTests(): boolean {\n    return this.#config !== undefined\n  }\n\n  /** @internal Introspection helper for tests. */\n  __isDisposedForTests(): boolean {\n    return this.#disposed\n  }\n}\n\n// Singleton — one StorageManager per process (D1).\nlet __singleton: StorageManager | undefined\n\nexport function getStorageManager(): StorageManager {\n  __singleton ??= new StorageManager()\n  return __singleton\n}\n\n/** @internal Drops the module-level singleton — used by tests that need a fresh manager. */\nexport function __resetSingletonForTests(): void {\n  __singleton = undefined\n}\n","/**\n * `useUnstorage(name, driver?)` — wraps `unstorage.createStorage({ driver })`\n * via `StorageManager.useStorage<T>` for caching + lifecycle coordination.\n *\n * Architectural decision: see ADR-0009 (`unstorage` adoption for KV drivers).\n *\n * `unstorage` is an OPTIONAL peer dependency. Apps that don't use KV pay zero\n * bundle cost; calling `useUnstorage` without `unstorage` installed throws an\n * actionable error.\n *\n * The returned `Storage<T>` is auto-registered with `manager.dispose()` so\n * SIGTERM drains it. Repeated calls with the same `name` return the cached\n * instance (factory invoked once).\n *\n * @example Memory driver (dev / tests)\n *   const cache = await useUnstorage<string>('cache')\n *   await cache.setItem('k', 'v')\n *\n * @example Redis driver (prod)\n *   import redisDriver from 'unstorage/drivers/redis'\n *   const cache = await useUnstorage<string>('cache', redisDriver({ url: process.env.REDIS_URL }))\n *\n * Reserved cache key prefix: `__unstorage:` — do NOT use this prefix in\n * `manager.useStorage<T>(name)` to avoid collision (EC-8 documented).\n */\nimport { getStorageManager } from './storage-manager.js'\n\ninterface UnstorageModule {\n  createStorage: <T>(options?: { driver?: unknown }) => UnstorageInstance<T>\n}\n\nexport interface UnstorageInstance<T> {\n  getItem(key: string): Promise<T | null>\n  setItem(key: string, value: T): Promise<void>\n  removeItem(key: string): Promise<void>\n  keys(prefix?: string): Promise<string[]>\n  hasItem(key: string): Promise<boolean>\n  clear(prefix?: string): Promise<void>\n  dispose?(): Promise<void>\n}\n\nexport async function useUnstorage<T = unknown>(\n  name: string,\n  driver?: unknown,\n): Promise<UnstorageInstance<T>> {\n  const mod = (await import('unstorage').catch(() => null)) as UnstorageModule | null\n  if (mod === null) {\n    throw new Error(\n      \"useUnstorage requires the 'unstorage' package. Install via: pnpm add unstorage\",\n    )\n  }\n  const manager = getStorageManager()\n  return manager.useStorage<UnstorageInstance<T>>(`__unstorage:${name}`, () => {\n    const storage = mod.createStorage<T>({ driver })\n    manager.register({\n      name: `unstorage:${name}`,\n      dispose: () => storage.dispose?.() ?? Promise.resolve(),\n    })\n    return storage\n  })\n}\n","/**\n * `useDatabase(name, connector)` — wraps `db0.createDatabase(connector)` via\n * `StorageManager.useStorage<T>` for caching.\n *\n * Architectural decision: see ADR-0010 (db0 adoption for SQL non-Postgres).\n *\n * `db0` is an OPTIONAL peer dependency. Apps that don't use db0 pay zero bundle\n * cost; calling `useDatabase` without `db0` installed throws an actionable error.\n *\n * **For Postgres: prefer `usePostgres(dbName, factory)`** — returns `pg.Pool`\n * directly which integrates better with Drizzle / raw SQL.\n *\n * Lifecycle: db0 connectors don't share a unified close API. Users SHOULD\n * register a dispose hook manually if cleanup matters (EC-9 documented):\n *   ```ts\n *   const db = await useDatabase('main', sqlite({...}))\n *   getStorageManager().register({ name: 'db:main', dispose: () => db.exec('...') })\n *   ```\n *\n * Reserved cache key prefix: `__db0:` — do NOT use this prefix in\n * `manager.useStorage<T>(name)` to avoid collision (EC-8 documented).\n *\n * @example libSQL / Turso\n *   import libsql from 'db0/connectors/libsql-core'\n *   const db = await useDatabase('main', libsql({ url: process.env.TURSO_URL }))\n *\n * @example SQLite (better-sqlite3)\n *   import sqlite from 'db0/connectors/better-sqlite3'\n *   const db = await useDatabase('main', sqlite({ name: 'app.db' }))\n */\nimport { getStorageManager } from './storage-manager.js'\n\ninterface Db0Module {\n  createDatabase: (connector: unknown) => Db0Database\n}\n\nexport interface Db0Database {\n  exec: (sql: string) => Promise<unknown>\n  prepare: (sql: string) => unknown\n  sql: (strings: TemplateStringsArray, ...args: unknown[]) => Promise<unknown>\n}\n\n/**\n * EC-5 — heuristic to detect a connector factory that wasn't invoked.\n *\n * `db0` connectors are factories: `sqlite({...})` returns a `Connector`.\n * If the user passes `sqlite` (the factory itself) instead of `sqlite({...})`\n * (the invoked Connector), `db0.createDatabase` fails with a cryptic message.\n *\n * A connector is an object (with methods like `exec`, `prepare`). A factory\n * is a function with declared parameters (arity ≥ 1, since connectors take\n * an options object). We throw an actionable error in the factory case.\n */\nfunction detectUninvokedFactory(connector: unknown): string | null {\n  if (typeof connector === 'function') {\n    const fn = connector as { length?: number; name?: string }\n    if ((fn.length ?? 0) > 0) {\n      const name = fn.name !== undefined && fn.name !== '' ? fn.name : 'connector'\n      return (\n        `useDatabase: connector argument looks like an un-invoked factory (function with ${String(fn.length)} parameter(s)). ` +\n        `Did you forget to call the factory? Pass \\`${name}({...})\\` not \\`${name}\\`. ` +\n        `Example: useDatabase('main', sqlite({ name: ':memory:' }))`\n      )\n    }\n  }\n  return null\n}\n\nexport async function useDatabase(name: string, connector: unknown): Promise<Db0Database> {\n  const factoryError = detectUninvokedFactory(connector)\n  if (factoryError !== null) throw new Error(factoryError)\n\n  const mod = (await import('db0').catch(() => null)) as Db0Module | null\n  if (mod === null) {\n    throw new Error(\"useDatabase requires the 'db0' package. Install via: pnpm add db0\")\n  }\n  const manager = getStorageManager()\n  return manager.useStorage<Db0Database>(`__db0:${name}`, () => mod.createDatabase(connector))\n}\n","/**\n * Constant-time byte comparison.\n *\n * Wraps `node:crypto.timingSafeEqual` when available (Node 6.6+) and falls\n * back to a constant-time XOR loop for runtimes without `node:crypto`\n * (Cloudflare Workers, Deno, Bun edge). Required to defeat timing attacks\n * on webhook signature verification — a naive `===` or `Buffer.equals`\n * would short-circuit on first mismatch byte and leak signature position\n * via wall-clock timing.\n *\n * Web Crypto's `crypto.subtle.verify` would also work, but requires a\n * `CryptoKey` object and is asymmetric (verify a signature against a key).\n * For our case — comparing two pre-computed digests — raw byte equality\n * is the correct primitive.\n *\n * @see https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b\n * @see https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/verify\n */\n\ntype NodeTimingSafeEqual = (a: Uint8Array, b: Uint8Array) => boolean\n\nlet cachedNodeImpl: NodeTimingSafeEqual | null | undefined\n\nfunction resolveNodeImpl(): NodeTimingSafeEqual | null {\n  if (cachedNodeImpl !== undefined) return cachedNodeImpl\n  try {\n    // require() avoids the dynamic-import-of-node-builtin warnings some\n    // bundlers emit; `node:crypto` is always synchronously available.\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const cryptoMod = require('node:crypto') as {\n      timingSafeEqual?: NodeTimingSafeEqual\n    }\n    cachedNodeImpl = cryptoMod.timingSafeEqual ?? null\n  } catch {\n    cachedNodeImpl = null\n  }\n  return cachedNodeImpl\n}\n\n/**\n * Returns true iff `a` and `b` have identical bytes. Takes time\n * proportional to `a.length` regardless of where bytes differ.\n *\n * @throws TypeError if either argument is not a Uint8Array.\n */\nexport function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (!(a instanceof Uint8Array) || !(b instanceof Uint8Array)) {\n    throw new TypeError(\n      `timingSafeEqual expects Uint8Array arguments (got ${typeof a} and ${typeof b})`,\n    )\n  }\n  // Length mismatch is constant-time-safe by construction (no per-byte work).\n  if (a.length !== b.length) return false\n  if (a.length === 0) return true\n\n  // Prefer the Node built-in when present — it's implemented in C and\n  // matches the contract exactly. node:crypto.timingSafeEqual throws on\n  // length mismatch, which we've already filtered above.\n  const nodeImpl = resolveNodeImpl()\n  if (nodeImpl) return nodeImpl(a, b)\n\n  // Fallback: XOR-accumulate every byte into one accumulator. NEVER\n  // short-circuit. The compiler / V8 will not constant-fold this loop\n  // because the inputs are dynamic.\n  let diff = 0\n  for (let i = 0; i < a.length; i++) {\n    diff |= a[i] ^ b[i]\n  }\n  return diff === 0\n}\n","/**\n * Read a Web `Request` body as a raw string EXACTLY ONCE and expose it\n * alongside the original request (which remains readable by downstream\n * code). Enforces a configurable `maxBodyBytes` cap to prevent OOM via\n * pathological POST.\n *\n * MUST be called FIRST in the webhook pipeline, before any other code\n * touches the body (`request.text()`, `request.json()`, parsers). Once\n * the body is consumed, `Request.clone()` throws and this function fails.\n *\n * EC-101: default `maxBodyBytes = 1_000_000` (1 MB) covers Stripe\n * (256 KB max), Slack (4 MB but compressed), and is well below Node\n * memory thresholds. GitHub webhooks up to 25 MB MUST opt in\n * (`maxBodyBytes: 25_000_000`).\n *\n * @see https://docs.stripe.com/webhooks/signatures\n * @see https://docs.github.com/en/webhooks/using-webhooks/best-practices-for-using-webhooks\n */\n\nexport const DEFAULT_MAX_BODY_BYTES = 1_000_000\n\nexport interface ReadRawBodyOptions {\n  /** Maximum bytes to read before throwing `BodyTooLargeError`. Defaults to 1 MB. */\n  maxBodyBytes?: number\n}\n\nexport interface RawBodyResult {\n  /** UTF-8 decoded body (or empty string when no body present). */\n  rawBody: string\n  /** The ORIGINAL request, still readable by downstream code. */\n  bodyClone: Request\n}\n\n/**\n * Thrown when the request body exceeds `maxBodyBytes`. Carries status\n * 413 (Payload Too Large) and stable code `BODY_TOO_LARGE` so callers\n * can map it to an HTTP response without sniffing the message.\n */\nexport class BodyTooLargeError extends Error {\n  readonly status = 413\n  readonly code = 'BODY_TOO_LARGE'\n\n  constructor(\n    public readonly limit: number,\n    public readonly actualSeen: number,\n  ) {\n    super(`Request body exceeds maxBodyBytes: seen ${actualSeen} bytes, limit ${limit} bytes`)\n    this.name = 'BodyTooLargeError'\n  }\n}\n\nexport async function readRawBody(\n  request: Request,\n  options: ReadRawBodyOptions = {},\n): Promise<RawBodyResult> {\n  const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES\n\n  // Clone the request so the original remains readable. `.clone()` throws\n  // synchronously (TypeError) if the body was already consumed — we let\n  // that propagate so callers fail fast with a clear error.\n  const clone = request.clone()\n\n  // No body at all (GET, HEAD, or empty POST). Both clone.body and\n  // clone.text() handle this gracefully but we short-circuit for clarity\n  // and to avoid an unnecessary stream read.\n  if (clone.body === null) {\n    return { rawBody: '', bodyClone: request }\n  }\n\n  const reader = clone.body.getReader()\n  const chunks: Uint8Array[] = []\n  let total = 0\n\n  try {\n    for (;;) {\n      const { value, done } = await reader.read()\n      if (done) break\n      total += value.byteLength\n      if (total > maxBodyBytes) {\n        // Cancel the stream without awaiting (avoids deadlock on some\n        // ReadableStream impls). The finally block releases the lock.\n        void reader.cancel()\n        throw new BodyTooLargeError(maxBodyBytes, total)\n      }\n      chunks.push(value)\n    }\n  } finally {\n    try {\n      reader.releaseLock()\n    } catch {\n      // lock may already be released by cancel()\n    }\n  }\n\n  // Concat all chunks into a single Uint8Array, then UTF-8 decode.\n  const bytes = new Uint8Array(total)\n  let offset = 0\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset)\n    offset += chunk.byteLength\n  }\n  const rawBody = new TextDecoder().decode(bytes)\n\n  return { rawBody, bodyClone: request }\n}\n","import {\n  extractTraceContext,\n  generateNewTraceContext,\n} from '../observability/trace-context-propagation.js'\n\nimport { BodyTooLargeError, readRawBody } from './raw-body.js'\nimport type {\n  DefineWebhookOptions,\n  VerifyResult,\n  WebhookContext,\n  WebhookDefinition,\n} from './webhook-types.js'\n\n/**\n * Declare a webhook handler with first-class signature verification\n * (R0.5.10, ADR-0005). Pure identity helper — returns the definition\n * unchanged for downstream dispatch.\n *\n * @example\n * ```ts\n * // server/webhooks/stripe.ts\n * import { defineWebhook } from 'theokit/server'\n * import { stripe } from 'theokit/server/webhook/providers'\n *\n * export default defineWebhook({\n *   verify: stripe({ secret: process.env.STRIPE_WEBHOOK_SECRET! }),\n *   async handler({ rawBody }) {\n *     const event = JSON.parse(rawBody)\n *     // ...\n *     return new Response('ok')\n *   },\n * })\n * ```\n */\nexport function defineWebhook(opts: DefineWebhookOptions): WebhookDefinition {\n  return {\n    verify: opts.verify,\n    handler: opts.handler,\n    maxBodyBytes: opts.maxBodyBytes,\n    __theokit_kind: 'webhook',\n  }\n}\n\n/**\n * Dispatch a webhook request through the definition's verify → handler\n * pipeline. Returns the handler's `Response` (or a wrapped one), or a\n * 401/413 response when verification or body size guards trip.\n *\n * EC-101: enforces `maxBodyBytes` (default 1MB via readRawBody).\n * EC-103: every throw from `verify` (sync or async) is treated as\n * `{ok: false, reason: 'verify threw: <message>'}`. Handler NEVER\n * invoked on verify failure.\n */\nexport async function dispatchWebhook(def: WebhookDefinition, request: Request): Promise<Response> {\n  let rawBody: string\n  let bodyClone: Request\n  try {\n    const result = await readRawBody(request, { maxBodyBytes: def.maxBodyBytes })\n    rawBody = result.rawBody\n    bodyClone = result.bodyClone\n  } catch (err) {\n    if (err instanceof BodyTooLargeError) {\n      return new Response(JSON.stringify({ error: err.code, message: err.message }), {\n        status: 413,\n        headers: { 'content-type': 'application/json' },\n      })\n    }\n    return new Response(\n      JSON.stringify({\n        error: 'BAD_REQUEST',\n        message: err instanceof Error ? err.message : 'failed to read body',\n      }),\n      { status: 400, headers: { 'content-type': 'application/json' } },\n    )\n  }\n\n  // Resolve traceId — propagate or generate.\n  const incomingTrace = extractTraceContext(request.headers)\n  const traceId = incomingTrace?.trace_id ?? generateNewTraceContext().trace_id\n\n  // EC-103: verify exception MUST close the door, never let handler run.\n  let verifyResult: VerifyResult\n  try {\n    verifyResult = await def.verify(bodyClone)\n  } catch (err) {\n    verifyResult = {\n      ok: false,\n      reason: `verify threw: ${err instanceof Error ? err.message : String(err)}`,\n    }\n  }\n\n  if (!verifyResult.ok) {\n    return new Response(\n      JSON.stringify({ error: 'WEBHOOK_VERIFY_FAILED', message: verifyResult.reason }),\n      { status: 401, headers: { 'content-type': 'application/json' } },\n    )\n  }\n\n  const ctx: WebhookContext = {\n    request: bodyClone,\n    rawBody,\n    traceId,\n    signal: request.signal,\n  }\n\n  const result = await def.handler(ctx)\n  if (result instanceof Response) return result\n  if (result === undefined || result === null) {\n    return new Response(null, { status: 204 })\n  }\n  return new Response(JSON.stringify(result), {\n    status: 200,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n","/**\n * Single source of truth for cache subsystem constants.\n * Limits mirror Next.js (NEXT_CACHE_TAG_MAX_LENGTH / NEXT_CACHE_TAG_MAX_ITEMS)\n * — see reference doc §3.2 and ADR D6 of caching-and-revalidation-plan.md.\n */\n\nexport const CACHE_TAG_MAX_LENGTH = 256\nexport const CACHE_TAG_MAX_ITEMS = 128\nexport const THEO_T_PREFIX = '_THEO_T_'\n\nexport const DEFAULT_MAX_AGE = 1\nexport const DEFAULT_SWR_MULTIPLIER = 60\n","import {\n  CACHE_TAG_MAX_ITEMS,\n  CACHE_TAG_MAX_LENGTH,\n  DEFAULT_MAX_AGE,\n  THEO_T_PREFIX,\n} from './constants.js'\n\nexport interface ValidationResult<T> {\n  valid: T[]\n  dropped: { value: unknown; reason: string }[]\n}\n\n/**\n * Validate an array of cache tags.\n * Drops invalid entries (type / length / reserved-prefix / overflow) with warn log.\n * NEVER throws on runtime input — caller-facing safety.\n *\n * EC-1: defensive guard for non-array input (e.g., undefined from optional chain).\n */\nexport function validateTags(tags: unknown, description: string): ValidationResult<string> {\n  // EC-1 guard\n  if (!Array.isArray(tags)) {\n    const result: ValidationResult<string> = {\n      valid: [],\n      dropped: [{ value: tags, reason: `expected array, got ${typeof tags}` }],\n    }\n    warnDropped(result, description)\n    return result\n  }\n\n  // Array.isArray narrows to `any[]` (TS limitation). Re-type as unknown[]\n  // so each element flows through explicit type guards below.\n  const tagArr: unknown[] = tags as unknown[]\n  const valid: string[] = []\n  const dropped: { value: unknown; reason: string }[] = []\n\n  for (let i = 0; i < tagArr.length; i++) {\n    if (valid.length >= CACHE_TAG_MAX_ITEMS) {\n      for (let j = i; j < tagArr.length; j++) {\n        dropped.push({ value: tagArr[j], reason: 'overflow (max 128 tags)' })\n      }\n      break\n    }\n    const tag: unknown = tagArr[i]\n    if (typeof tag !== 'string') {\n      dropped.push({ value: tag, reason: 'invalid type, must be a string' })\n      continue\n    }\n    if (tag.length > CACHE_TAG_MAX_LENGTH) {\n      dropped.push({\n        value: tag,\n        reason: `exceeded max length of ${CACHE_TAG_MAX_LENGTH}`,\n      })\n      continue\n    }\n    if (tag.startsWith(THEO_T_PREFIX)) {\n      dropped.push({\n        value: tag,\n        reason: `reserved prefix \"${THEO_T_PREFIX}\"`,\n      })\n      continue\n    }\n    valid.push(tag)\n  }\n\n  warnDropped({ valid, dropped }, description)\n  return { valid, dropped }\n}\n\n/**\n * Validate a `maxAge` value in seconds.\n * Throws on invalid input (config-time validation).\n * Returns DEFAULT_MAX_AGE when undefined.\n */\nexport function validateMaxAge(maxAge: unknown, description: string): number {\n  if (maxAge === undefined) return DEFAULT_MAX_AGE\n  if (typeof maxAge === 'number' && Number.isFinite(maxAge) && maxAge >= 0) {\n    return maxAge\n  }\n  throw new Error(\n    `Invalid maxAge \"${JSON.stringify(maxAge)}\" in ${description}, must be a non-negative finite number`,\n  )\n}\n\n/**\n * Validate an `expire` value in seconds, optionally cross-checked against `revalidate`.\n * Throws on invalid input (config-time validation).\n */\nexport function validateExpire(\n  expire: unknown,\n  revalidate: number | undefined,\n  description: string,\n): number | undefined {\n  if (expire === undefined) return undefined\n  if (typeof expire !== 'number' || !Number.isFinite(expire) || expire < 0) {\n    throw new Error(\n      `Invalid expire \"${JSON.stringify(expire)}\" in ${description}, must be a non-negative finite number`,\n    )\n  }\n  if (revalidate !== undefined && expire < revalidate) {\n    throw new Error(\n      `Invalid expire ${expire} in ${description}, must be greater than or equal to revalidate ${revalidate}`,\n    )\n  }\n  return expire\n}\n\nfunction warnDropped(result: ValidationResult<string>, description: string): void {\n  if (result.dropped.length === 0) return\n  console.warn(`[theokit:cache] ${description}: dropped ${result.dropped.length} invalid tag(s):`)\n  for (const { value, reason } of result.dropped) {\n    console.warn(`  - ${JSON.stringify(value)}: ${reason}`)\n  }\n}\n","import type { CacheEngine } from './cache-engine.js'\nimport { validateExpire, validateMaxAge, validateTags } from './validation.js'\n\nexport interface DefineCachedFunctionOptions<TArgs extends unknown[], TReturn> {\n  /** Required cache namespace; appears in keys as \"fn:${name}:...\" */\n  name: string\n  /** seconds; defaults to DEFAULT_MAX_AGE (1) */\n  maxAge?: number\n  /** seconds; stale-while-revalidate window */\n  swr?: number\n  /** Custom key derivation from args. Default: JSON.stringify(args). */\n  getKey?: (...args: TArgs) => string\n  /** Static or dynamic tags. */\n  tags?: string[] | ((...args: TArgs) => string[])\n  /** Version stamp; bump to invalidate all entries under this name. */\n  cacheVersion?: string\n  /** Transform returned value before caching. */\n  transform?: (raw: TReturn) => TReturn\n  /** Skip cache if validate returns false (treats existing entry as miss). */\n  validate?: (raw: TReturn) => boolean\n  /** Called on any error in the cache pipeline. */\n  onError?: (err: unknown, ctx: { args: TArgs }) => void\n}\n\nexport type CachedFunction<TArgs extends unknown[], TReturn> = ((\n  ...args: TArgs\n) => Promise<TReturn>) & {\n  /** Bust the cache entry for these specific args. */\n  invalidate: (...args: TArgs) => Promise<void>\n}\n\n/**\n * Wrap an async function with cache semantics.\n * Returns a callable that memoizes by `(name + args)` and exposes `.invalidate(args)`.\n *\n * The engine is supplied by the caller (avoids module-level singleton coupling\n * during testing; framework wiring provides it in production).\n */\nexport function defineCachedFunction<TArgs extends unknown[], TReturn>(\n  engine: CacheEngine,\n  fn: (...args: TArgs) => TReturn | Promise<TReturn>,\n  opts: DefineCachedFunctionOptions<TArgs, TReturn>,\n): CachedFunction<TArgs, TReturn> {\n  if (typeof opts.name !== 'string' || opts.name.length === 0) {\n    throw new Error('defineCachedFunction: opts.name is required (non-empty string)')\n  }\n  const maxAge = validateMaxAge(opts.maxAge, `defineCachedFunction(${opts.name})`)\n  const swr = validateExpire(opts.swr, maxAge, `defineCachedFunction(${opts.name})`)\n\n  const prefix = `fn:${opts.name}`\n\n  function deriveCacheKey(args: TArgs): string {\n    const tail = opts.getKey ? opts.getKey(...args) : JSON.stringify(args)\n    return `${prefix}:${tail}`\n  }\n\n  function resolveTags(args: TArgs): string[] {\n    const raw = typeof opts.tags === 'function' ? opts.tags(...args) : (opts.tags ?? [])\n    const { valid } = validateTags(raw, `defineCachedFunction(${opts.name})`)\n    return valid\n  }\n\n  const wrapped = (async (...args: TArgs) => {\n    const key = deriveCacheKey(args)\n    const tags = resolveTags(args)\n    try {\n      const { value } = await engine.getOrCompute<TReturn>(key, async () => fn(...args), {\n        maxAge,\n        swr: swr ?? maxAge * 60,\n        tags,\n        cacheVersion: opts.cacheVersion,\n        transform: opts.transform,\n        validate: opts.validate,\n      })\n      return value\n    } catch (err) {\n      opts.onError?.(err, { args })\n      throw err\n    }\n  }) as CachedFunction<TArgs, TReturn>\n\n  wrapped.invalidate = async (...args: TArgs) => {\n    const key = deriveCacheKey(args)\n    await engine.invalidate(key)\n  }\n\n  return wrapped\n}\n","export interface CacheControlInput {\n  /** seconds; 0 forces no-cache */\n  maxAge: number\n  /** stale-while-revalidate window in seconds; 0 or undefined omits directive */\n  swr?: number\n  /** emit `private,` prefix (skips shared CDN caching) */\n  isPrivate?: boolean\n}\n\nconst NO_CACHE_HEADER = 'private, no-cache, no-store, max-age=0, must-revalidate'\n\n/**\n * Build a canonical Cache-Control header value.\n *\n * `maxAge === 0` always yields the strict no-cache directive regardless\n * of `swr` or `isPrivate` — defensive default.\n *\n * EC-13: pure function intentional — caller is responsible for input\n * validation (see validateMaxAge / validateExpire in validation.ts).\n */\nexport function getCacheControlHeader(input: CacheControlInput): string {\n  if (input.maxAge === 0) return NO_CACHE_HEADER\n  const parts: string[] = []\n  if (input.isPrivate) parts.push('private')\n  parts.push(`s-maxage=${input.maxAge}`)\n  if (input.swr !== undefined && input.swr > 0) {\n    parts.push(`stale-while-revalidate=${input.swr}`)\n  }\n  return parts.join(', ')\n}\n","/**\n * Default tracking/analytics query parameters excluded from cache keys.\n * Mirrors Astro's DEFAULT_EXCLUDED_PARAMS list (memory-provider.ts:117).\n * Set as exact-match (not glob) for KISS + zero-dep.\n */\nexport const DEFAULT_EXCLUDED_QUERY_PARAMS = [\n  'utm_source',\n  'utm_medium',\n  'utm_campaign',\n  'utm_term',\n  'utm_content',\n  'fbclid',\n  'gclid',\n  'gbraid',\n  'wbraid',\n  'dclid',\n  'msclkid',\n  'twclid',\n  'li_fat_id',\n  'mc_cid',\n  'mc_eid',\n  '_ga',\n  '_gl',\n  '_hsenc',\n  '_hsmi',\n  '_ke',\n  'oly_anon_id',\n  'oly_enc_id',\n  'rb_clickid',\n  's_cid',\n  'vero_id',\n  'wickedid',\n  'yclid',\n  '__s',\n  'ref',\n]\n\nexport interface KeyDerivationOptions {\n  /** Total override — when provided, bypasses all internal logic. */\n  getKey?: (req: Request) => string | Promise<string>\n  /** Exact-match query param names to drop. Defaults to DEFAULT_EXCLUDED_QUERY_PARAMS. */\n  excludeQuery?: string[]\n  /** Whether to sort query params alphabetically. Defaults to true. */\n  sortQuery?: boolean\n  /** Header names whose values are appended as `\\0name=value` suffix. */\n  varies?: string[]\n  /** Namespace prefix (e.g., route name). */\n  prefix?: string\n}\n\n/**\n * Derive a deterministic cache key from a Request.\n *\n * Default behaviour: `${prefix?}${protocol}//${lower(host)}${path}${?sortedFilteredQuery}` + Vary suffix.\n * `\\0` separator chosen because it cannot appear in URLs or HTTP header values.\n *\n * EC-6: malformed URL on getKey path is caller's responsibility.\n * EC-7: enforces getKey returns string.\n */\nexport async function deriveKey(req: Request, opts: KeyDerivationOptions = {}): Promise<string> {\n  if (opts.getKey) {\n    const k = await opts.getKey(req)\n    if (typeof k !== 'string') {\n      throw new Error(`getKey must return a string, got ${typeof k}`)\n    }\n    return k\n  }\n\n  const url = new URL(req.url)\n  const queryString = buildQueryString(url, opts)\n  const base = `${opts.prefix ? opts.prefix + ':' : ''}${url.protocol}//${url.hostname.toLowerCase()}${url.pathname}${queryString ? '?' + queryString : ''}`\n\n  if (!opts.varies || opts.varies.length === 0) return base\n  const parts: string[] = []\n  for (const header of opts.varies) {\n    parts.push(`${header}=${req.headers.get(header) ?? ''}`)\n  }\n  return base + '\\0' + parts.join('\\0')\n}\n\nfunction buildQueryString(url: URL, opts: KeyDerivationOptions): string {\n  const params = new URLSearchParams(url.searchParams)\n  const exclude = opts.excludeQuery ?? DEFAULT_EXCLUDED_QUERY_PARAMS\n  const excludeSet = new Set(exclude)\n  for (const key of [...params.keys()]) {\n    if (excludeSet.has(key)) params.delete(key)\n  }\n  if (opts.sortQuery !== false) params.sort()\n  return params.toString()\n}\n","import type { z } from 'zod'\n\nimport type { RouteConfig } from '../core/contracts/route-config.js'\n\nimport { getCacheControlHeader } from './cache-control-header.js'\nimport type { CacheEngine, CacheStatus } from './cache-engine.js'\nimport { THEO_T_PREFIX } from './constants.js'\nimport { deriveKey } from './key-derivation.js'\nimport type { CacheEntry } from './storage-adapter.js'\nimport { validateExpire, validateMaxAge, validateTags } from './validation.js'\n\n/** Default 10 MB cap per cached route entry (EC-3). */\nexport const DEFAULT_MAX_ENTRY_SIZE = 10 * 1024 * 1024\nconst VARIES_IGNORED = new Set(['cookie', 'set-cookie'])\n\nexport interface RouteCacheOptions {\n  maxAge?: number\n  swr?: number\n  tags?: string[]\n  varies?: string[]\n  getKey?: (req: Request) => string | Promise<string>\n  bypassWhen?: (req: Request) => boolean | Promise<boolean>\n  cacheVersion?: string\n  cacheErrors?: boolean\n  methods?: string[]\n  cacheable?: (response: Response) => boolean\n  /** Max body bytes (EC-3); default DEFAULT_MAX_ENTRY_SIZE. */\n  maxEntrySize?: number\n}\n\nexport interface CachedRouteConfig<\n  TQuery extends z.ZodType = z.ZodUndefined,\n  TBody extends z.ZodType = z.ZodUndefined,\n  TParams extends z.ZodType = z.ZodUndefined,\n  TCtx = unknown,\n> extends Omit<RouteConfig<TQuery, TBody, TParams, TCtx>, 'handler'> {\n  cache: RouteCacheOptions\n  handler: (ctx: {\n    query: z.infer<TQuery>\n    body: z.infer<TBody>\n    params: z.infer<TParams>\n    request: Request\n    ctx: TCtx\n  }) => unknown\n}\n\ninterface RouteCacheValue {\n  body: string\n  status: number\n  headers: [string, string][]\n}\n\nconst setCookieWarnedRoutes = new WeakSet()\nconst variesCookieWarnedRoutes = new WeakSet()\nconst oversizedWarnedRoutes = new WeakSet()\n\n/**\n * Wrap a `RouteConfig` with cache-aware handler logic.\n *\n * Architecture: wraps the user `handler` so cache lookup happens AT\n * handler-invocation time, AFTER router middleware (auth/csrf/etc) ran.\n * This structurally satisfies EC-4 (cache-after-auth) without modifying\n * the router internals.\n *\n * Algorithm per request:\n * 1. Method check + bypassWhen + maxAge=0 → call handler raw\n * 2. Derive key (path + sortedQuery + varies, prefix by method)\n * 3. Cache lookup → HIT/STALE return cached Response\n * 4. Miss → run handler, check cacheability (Set-Cookie / status / size / SSE / streaming)\n * 5. Cacheable → write entry + return Response with X-Theo-Cache: MISS (dev)\n * 6. Not cacheable → return original Response unchanged\n *\n * Concurrent dedupe is INTENTIONALLY NOT used for routes — Response objects\n * cannot be safely shared across concurrent callers (body is single-use stream).\n * Each request that misses runs the handler independently.\n */\nexport function defineCachedRoute<\n  TQuery extends z.ZodType = z.ZodUndefined,\n  TBody extends z.ZodType = z.ZodUndefined,\n  TParams extends z.ZodType = z.ZodUndefined,\n  TCtx = unknown,\n>(\n  engine: CacheEngine,\n  config: CachedRouteConfig<TQuery, TBody, TParams, TCtx>,\n): RouteConfig<TQuery, TBody, TParams, TCtx, Response> {\n  const { cache, handler, ...rest } = config\n\n  const maxAge = validateMaxAge(cache.maxAge, 'defineCachedRoute')\n  const swr = validateExpire(cache.swr, maxAge, 'defineCachedRoute')\n  if (cache.cacheVersion !== undefined && cache.cacheVersion === '') {\n    throw new Error('defineCachedRoute: cacheVersion must be non-empty if provided')\n  }\n  // EC-19: maxEntrySize validation\n  const maxEntrySize = cache.maxEntrySize ?? DEFAULT_MAX_ENTRY_SIZE\n  if (!Number.isFinite(maxEntrySize) || maxEntrySize < 0) {\n    throw new Error(\n      `Invalid maxEntrySize \"${String(cache.maxEntrySize)}\" in defineCachedRoute, must be a non-negative finite number`,\n    )\n  }\n  const methods = new Set((cache.methods ?? ['GET', 'HEAD']).map((m) => m.toUpperCase()))\n  const baseTags = validateTags(cache.tags ?? [], 'defineCachedRoute').valid\n\n  // EC-2: filter cookie/set-cookie from varies + warn-once per route\n  const variesRaw = cache.varies ?? []\n  const variesLower = variesRaw.map((v) => v.toLowerCase())\n  const hadCookieVary = variesLower.some((v) => VARIES_IGNORED.has(v))\n  const safeVaries = variesLower.filter((v) => !VARIES_IGNORED.has(v))\n  if (hadCookieVary && !variesCookieWarnedRoutes.has(config)) {\n    variesCookieWarnedRoutes.add(config)\n    console.warn(\n      `[theokit:cache] defineCachedRoute: 'cookie'/'set-cookie' removed from varies — they fragment cache to zero hit rate (EC-2)`,\n    )\n  }\n\n  const wrappedHandler = async (ctx: {\n    query: z.infer<TQuery>\n    body: z.infer<TBody>\n    params: z.infer<TParams>\n    request: Request\n    ctx: TCtx\n  }): Promise<Response> => {\n    // TheoKit's dispatcher may pass a Node IncomingMessage (not a Web Request).\n    // Normalize to a Web Request so deriveKey / bypassWhen / URL parsing work uniformly.\n    const webRequest = toWebRequest(ctx.request)\n\n    if (!methods.has(webRequest.method.toUpperCase())) {\n      return invokeHandlerAsResponse(handler, ctx)\n    }\n    if (cache.bypassWhen && (await cache.bypassWhen(webRequest))) {\n      return invokeHandlerAsResponse(handler, ctx)\n    }\n    if (maxAge === 0) {\n      return invokeHandlerAsResponse(handler, ctx)\n    }\n\n    const key = await deriveKey(webRequest, {\n      prefix: 'route:' + webRequest.method.toUpperCase(),\n      varies: safeVaries,\n      getKey: cache.getKey,\n    })\n\n    // ---- Cache lookup (T4.2 DRY — delegates to engine canonical) ----\n    const cached = await engine.tryReadCached<RouteCacheValue>(key, {\n      cacheVersion: cache.cacheVersion,\n    })\n\n    // T4.3 — build options bag once; pass to all helpers (≤ 4 params each).\n    const routeCacheCtx: RouteCacheCtx = {\n      engine,\n      key,\n      cache,\n      routeConfig: config,\n      maxEntrySize,\n      maxAge,\n      swr,\n      baseTags,\n      webRequest,\n    }\n\n    if (cached) {\n      if (cached.status === 'hit') {\n        return buildResponseFromCache(cached.value, 'hit', maxAge, swr)\n      }\n      // Only 'stale' remains (engine never returns 'miss' from tryReadCached).\n      // Stale: schedule background refresh + return stale immediately.\n      scheduleRouteRevalidate(routeCacheCtx, handler, ctx)\n      return buildResponseFromCache(cached.value, 'stale', maxAge, swr)\n    }\n\n    // ---- Miss: run handler ----\n    const response = await invokeHandlerAsResponse(handler, ctx)\n    return persistAndReturn(routeCacheCtx, response)\n  }\n\n  return {\n    ...rest,\n    handler: wrappedHandler,\n  }\n}\n\n// T4.2 (PV-5 DRY): tryReadCacheEntry was removed — duplicated the engine's\n// canonical tryReadCached (staleness check, version check, JSON parse,\n// clock-skew clamp). Route wrapper now delegates to `engine.tryReadCached`.\n\n/**\n * T4.3 options-bag context (PV-6 — Clean Code consensus ≤ 4 params).\n * Collapses 10/11 positional params of `persistAndReturn` and\n * `scheduleRouteRevalidate` to 2 params each (ctx + payload).\n *\n * Some fields are derived from `cache` config (EC-22 documented redundancy) —\n * the trade-off is O(1) construction per request for vastly simpler call\n * sites and safer additions of new fields without reordering args.\n */\ninterface RouteCacheCtx {\n  engine: CacheEngine\n  key: string\n  cache: RouteCacheOptions\n  routeConfig: object\n  maxEntrySize: number\n  maxAge: number\n  swr: number | undefined\n  baseTags: string[]\n  webRequest: Request\n}\n\nfunction buildRouteCacheEntry(value: RouteCacheValue, ctx: RouteCacheCtx): CacheEntry {\n  const pathTag = THEO_T_PREFIX + new URL(ctx.webRequest.url).pathname\n  return {\n    body: JSON.stringify(value),\n    status: 200,\n    headers: [],\n    storedAt: Date.now(),\n    maxAge: ctx.maxAge,\n    swr: ctx.swr ?? ctx.maxAge * 60,\n    tags: [...ctx.baseTags, pathTag],\n    cacheVersion: ctx.cache.cacheVersion,\n  }\n}\n\nasync function persistAndReturn(ctx: RouteCacheCtx, response: Response): Promise<Response> {\n  const cacheableResult = await tryCacheResponse(\n    response,\n    ctx.cache,\n    ctx.routeConfig,\n    ctx.maxEntrySize,\n  )\n  if (!cacheableResult) {\n    // Not cached — return original response unchanged\n    return response\n  }\n  await ctx.engine.set(ctx.key, buildRouteCacheEntry(cacheableResult, ctx))\n  return buildResponseFromCache(cacheableResult, 'miss', ctx.maxAge, ctx.swr)\n}\n\nfunction scheduleRouteRevalidate<THandlerCtx>(\n  ctx: RouteCacheCtx,\n  handler: (handlerCtx: THandlerCtx) => unknown,\n  handlerCtx: THandlerCtx,\n): void {\n  void (async () => {\n    try {\n      const response = await invokeHandlerAsResponse(handler, handlerCtx)\n      const result = await tryCacheResponse(response, ctx.cache, ctx.routeConfig, ctx.maxEntrySize)\n      if (!result) return\n      await ctx.engine.set(ctx.key, buildRouteCacheEntry(result, ctx))\n    } catch {\n      // Stale entry remains; future request retries on its own stale-check\n    }\n  })()\n}\n\n/**\n * Type for Node.js IncomingMessage (subset we read).\n * Avoids a direct `node:http` import which would block edge runtimes.\n */\ninterface NodeLikeRequest {\n  url?: string\n  method?: string\n  headers: Record<string, string | string[] | undefined>\n  socket?: { encrypted?: boolean }\n}\n\n/**\n * Adapt either a Web Request or a Node IncomingMessage to a Web Request.\n * TheoKit's runtime dispatch may pass either depending on the adapter.\n */\n\n// Node IncomingMessage) inside one function so the call sites stay shape-blind.\nfunction toWebRequest(req: Request | NodeLikeRequest): Request {\n  // Web Request fast-path\n  if (typeof (req as Request).clone === 'function' && (req as Request).headers instanceof Headers) {\n    return req as Request\n  }\n  const node = req as NodeLikeRequest\n  const host = (typeof node.headers.host === 'string' ? node.headers.host : null) ?? 'localhost'\n  const protocol = node.socket?.encrypted ? 'https' : 'http'\n  const path = node.url ?? '/'\n  const url = path.startsWith('http') ? path : `${protocol}://${host}${path}`\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(node.headers)) {\n    if (Array.isArray(v)) {\n      for (const item of v) headers.append(k, item)\n    } else if (typeof v === 'string') {\n      headers.set(k, v)\n    }\n  }\n  return new Request(url, {\n    method: (node.method ?? 'GET').toUpperCase(),\n    headers,\n  })\n}\n\nasync function invokeHandlerAsResponse<TCtx>(\n  handler: (ctx: TCtx) => unknown,\n  ctx: TCtx,\n): Promise<Response> {\n  const raw = await handler(ctx)\n  if (raw instanceof Response) return raw\n  return Response.json(raw)\n}\n\n/**\n * Decide whether `response` is cacheable. Returns serialized form on yes; undefined on no.\n * Order matters: cheap checks first, body read last (only for cacheable candidates).\n */\nasync function tryCacheResponse(\n  response: Response,\n  cache: RouteCacheOptions,\n  routeConfig: object,\n  maxEntrySize: number,\n): Promise<RouteCacheValue | undefined> {\n  // D7 / EC-2: Set-Cookie auto-bypass\n  if (response.headers.has('set-cookie')) {\n    if (!setCookieWarnedRoutes.has(routeConfig)) {\n      setCookieWarnedRoutes.add(routeConfig)\n      console.warn('[theokit:cache] response has Set-Cookie — skipping cache write (D7)')\n    }\n    return undefined\n  }\n  // SSE\n  const contentType = response.headers.get('content-type') ?? ''\n  if (contentType.includes('text/event-stream')) return undefined\n  // EC-11: chunked streaming (transfer-encoding: chunked OR no content-length on a\n  // user-constructed Response — i.e., a Response built from a ReadableStream that\n  // wasn't via Response.json/text helpers). We detect via the explicit\n  // transfer-encoding header since Response.json() also uses a ReadableStream\n  // body internally and we don't want to refuse those.\n  if (response.headers.get('transfer-encoding')?.toLowerCase() === 'chunked') {\n    return undefined\n  }\n  // D9: status >= 400 not cached unless opt-in\n  if (response.status >= 400 && !cache.cacheErrors) return undefined\n  // Custom predicate (overrides built-ins)\n  if (cache.cacheable && !cache.cacheable(response)) return undefined\n\n  // Read body (clone to preserve the response for downstream)\n  const text = await response.clone().text()\n\n  // EC-3: oversized bypass\n  if (text.length > maxEntrySize) {\n    if (!oversizedWarnedRoutes.has(routeConfig)) {\n      oversizedWarnedRoutes.add(routeConfig)\n      console.warn(\n        `[theokit:cache] response body ${text.length} bytes exceeds maxEntrySize ${maxEntrySize}; skipping cache (EC-3)`,\n      )\n    }\n    return undefined\n  }\n\n  const headers: [string, string][] = []\n  response.headers.forEach((v, k) => {\n    if (k.toLowerCase() === 'set-cookie') return // defense-in-depth\n    headers.push([k, v])\n  })\n  return { body: text, status: response.status, headers }\n}\n\nfunction buildResponseFromCache(\n  value: RouteCacheValue,\n  status: CacheStatus,\n  maxAge: number,\n  swr: number | undefined,\n): Response {\n  const headers = new Headers(value.headers)\n  if (!headers.has('cache-control')) {\n    headers.set('cache-control', getCacheControlHeader({ maxAge, swr: swr ?? maxAge * 60 }))\n  }\n  if (process.env.NODE_ENV !== 'production') {\n    let cacheStatusHeader: 'HIT' | 'STALE' | 'MISS' = 'MISS'\n    if (status === 'hit') cacheStatusHeader = 'HIT'\n    else if (status === 'stale') cacheStatusHeader = 'STALE'\n    headers.set('X-Theo-Cache', cacheStatusHeader)\n  }\n  return new Response(value.body, { status: value.status, headers })\n}\n","import { THEO_T_PREFIX } from './constants.js'\nimport type { CacheEntry, CacheStorageAdapter } from './storage-adapter.js'\n\nexport type CacheStatus = 'hit' | 'stale' | 'miss'\n\nexport interface CacheEngineOptions {\n  storage: CacheStorageAdapter\n  defaults?: {\n    maxAge?: number\n    swr?: number\n    cacheVersion?: string\n  }\n  onError?: (err: unknown, ctx: { phase: 'get' | 'set' | 'revalidate'; key: string }) => void\n}\n\nexport interface GetOrComputeOptions<T> {\n  maxAge: number\n  swr?: number\n  tags?: string[]\n  cacheVersion?: string\n  transform?: (raw: T) => T\n  validate?: (raw: T) => boolean\n  /**\n   * When `true`, the value is returned but NOT written to cache.\n   * Used by route middleware to bypass cache for uncacheable responses\n   * (Set-Cookie, oversized body, status >= 400 with cacheErrors=false).\n   */\n  skipCacheWhen?: (raw: T) => boolean\n}\n\nexport interface CacheEngine {\n  getOrCompute<T>(\n    key: string,\n    fn: () => Promise<T>,\n    opts: GetOrComputeOptions<T>,\n  ): Promise<{ value: T; status: CacheStatus }>\n\n  /**\n   * Public canonical cache read (T4.2 of architecture-review-remediation-plan,\n   * PV-5 DRY consolidation). Returns the parsed value + status (`hit` | `stale`)\n   * for callers that DON'T want to bind a loader function (e.g., HTTP route\n   * middleware that may want to bypass on miss instead of running a loader).\n   *\n   * Returns undefined when:\n   * - Entry not present in storage\n   * - `opts.cacheVersion` mismatch with entry\n   * - Body is not a JSON string (parse failed)\n   * - `opts.validate` returns false (or throws — caller's onError invoked)\n   * - Entry is fully expired (past maxAge + swr)\n   */\n  tryReadCached<T>(\n    key: string,\n    opts: { cacheVersion?: string; validate?: (v: T) => boolean },\n  ): Promise<{ value: T; status: 'hit' | 'stale' } | undefined>\n\n  set(key: string, entry: CacheEntry): Promise<void>\n  invalidate(key: string): Promise<boolean>\n  invalidateTag(tag: string): Promise<number>\n  revalidatePath(path: string, type?: 'layout' | 'page'): Promise<number>\n\n  /** Storage adapter passthrough (read-only access for diagnostics). */\n  readonly storage: CacheStorageAdapter\n}\n\n/**\n * Build a cache engine wrapping a storage adapter.\n *\n * Implements:\n * - SWR (fresh / stale / expired branching) — Astro `memory-provider.ts:423`-style.\n * - In-flight dedupe via `Map<key, Promise>` — Next.js `pendingRevalidates` pattern.\n * - Tag-based invalidation via adapter's deleteByTag.\n * - Path-as-tag encoding (revalidatePath sugar) — Next.js `revalidate.ts:105`.\n *\n * EC-8: Math.max(0, age) guards clock skew.\n * EC-9: validate callback wrapped in try/catch.\n * EC-10: loader returning undefined skips cache write + warns once.\n *\n * NOTE on max-lines-per-function disable below: createCacheEngine is a factory\n * closure that owns the in-flight/bg/warned maps. Splitting would force the\n * helpers across modules and re-introduce the shared mutable state through\n * parameter lists.\n */\n// eslint-disable-next-line max-lines-per-function\nexport function createCacheEngine(opts: CacheEngineOptions): CacheEngine {\n  const { storage, onError } = opts\n  const inFlight = new Map<string, Promise<unknown>>()\n  const bgInFlight = new Set<string>()\n  const undefinedLoaderWarned = new Set<string>()\n\n  async function getOrCompute<T>(\n    key: string,\n    fn: () => Promise<T>,\n    options: GetOrComputeOptions<T>,\n  ): Promise<{ value: T; status: CacheStatus }> {\n    // Dedupe: concurrent first-miss shares the loader promise\n    const pending = inFlight.get(key)\n    if (pending) {\n      const value = (await pending) as T\n      return { value, status: 'miss' }\n    }\n\n    // maxAge=0 → always miss, never cache\n    if (options.maxAge === 0) {\n      return claimAndRun(key, fn, options, /* skipWrite */ true)\n    }\n\n    // Atomically claim the in-flight slot BEFORE any await (dedupe race fix).\n    return claimAndRun(key, fn, options, false)\n  }\n\n  /**\n   * Claims the in-flight slot synchronously, then performs the get/loader work\n   * inside. Concurrent callers awaiting the same key share this slot.\n   */\n  function claimAndRun<T>(\n    key: string,\n    fn: () => Promise<T>,\n    options: GetOrComputeOptions<T>,\n    skipWrite: boolean,\n  ): Promise<{ value: T; status: CacheStatus }> {\n    let resolveOuter!: (v: T) => void\n    let rejectOuter!: (e: unknown) => void\n    const outerPromise = new Promise<T>((resolve, reject) => {\n      resolveOuter = resolve\n      rejectOuter = reject\n    })\n    // Prevent unhandled-rejection when no concurrent awaiter exists\n    void outerPromise.catch(() => {\n      /* swallow — the leader handles via work promise */\n    })\n    inFlight.set(key, outerPromise)\n\n    const work = (async (): Promise<{ value: T; status: CacheStatus }> => {\n      try {\n        if (!skipWrite) {\n          const cached = await tryReadCached<T>(key, options)\n          if (cached) {\n            // HIT or STALE — value already resolved\n            resolveOuter(cached.value)\n            if (cached.status === 'stale') {\n              scheduleBackgroundRevalidate(key, fn, options)\n            }\n            return cached\n          }\n        }\n        // Miss path: run loader\n        const value = await runLoader(key, fn, options, skipWrite)\n        resolveOuter(value)\n        return { value, status: 'miss' as const }\n      } catch (err) {\n        rejectOuter(err)\n        throw err\n      } finally {\n        inFlight.delete(key)\n      }\n    })()\n\n    return work\n  }\n\n  // One inline staleness machine; each guard (version check, parse, validate,\n  // age, swr window) is one short branch. Extracting per-step would dilute,\n  // not clarify.\n  // eslint-disable-next-line complexity\n  async function tryReadCached<T>(\n    key: string,\n    options: GetOrComputeOptions<T>,\n  ): Promise<{ value: T; status: CacheStatus } | undefined> {\n    let entry: CacheEntry | undefined\n    try {\n      entry = await storage.get(key)\n    } catch (err) {\n      onError?.(err, { phase: 'get', key })\n      return undefined\n    }\n    if (!entry) return undefined\n    if (options.cacheVersion !== undefined && entry.cacheVersion !== options.cacheVersion) {\n      return undefined\n    }\n    if (typeof entry.body !== 'string') return undefined\n    let parsed: T\n    try {\n      parsed = JSON.parse(entry.body) as T\n    } catch (err) {\n      onError?.(err, { phase: 'get', key })\n      return undefined\n    }\n    // EC-9: validate wrapped in try/catch\n    if (options.validate) {\n      try {\n        if (!options.validate(parsed)) return undefined\n      } catch (err) {\n        onError?.(err, { phase: 'get', key })\n        return undefined\n      }\n    }\n    // EC-8: clamp age to non-negative (clock skew)\n    const age = Math.max(0, (Date.now() - entry.storedAt) / 1000)\n    if (age <= entry.maxAge) {\n      const value = options.transform ? options.transform(parsed) : parsed\n      return { value, status: 'hit' }\n    }\n    if (age <= entry.maxAge + entry.swr) {\n      const value = options.transform ? options.transform(parsed) : parsed\n      return { value, status: 'stale' }\n    }\n    return undefined\n  }\n\n  // runLoader always returns `value` by design: loader output is the caller's\n  // contract; every branch short-circuits a *write*, never the return path.\n  // eslint-disable-next-line sonarjs/no-invariant-returns, complexity\n  async function runLoader<T>(\n    key: string,\n    fn: () => Promise<T>,\n    options: GetOrComputeOptions<T>,\n    skipWrite = false,\n  ): Promise<T> {\n    const raw = await fn()\n    const value = options.transform ? options.transform(raw) : raw\n\n    if (skipWrite) return value\n\n    // skipCacheWhen sentinel — caller-controlled skip-write\n    if (options.skipCacheWhen?.(value)) return value\n\n    // EC-9: validate during write\n    if (options.validate) {\n      let isValid = true\n      try {\n        isValid = options.validate(value)\n      } catch (err) {\n        onError?.(err, { phase: 'set', key })\n        return value\n      }\n      if (!isValid) return value\n    }\n\n    // EC-10: undefined return → warn-once + skip cache\n    if (value === undefined) {\n      if (!undefinedLoaderWarned.has(key)) {\n        undefinedLoaderWarned.add(key)\n        console.warn(`[theokit:cache] loader returned undefined for key \"${key}\"; entry not cached`)\n      }\n      return value\n    }\n\n    try {\n      const entry: CacheEntry = {\n        body: JSON.stringify(value),\n        status: 200,\n        headers: [],\n        storedAt: Date.now(),\n        maxAge: options.maxAge,\n        swr: options.swr ?? 0,\n        tags: options.tags ?? [],\n        cacheVersion: options.cacheVersion,\n      }\n      await storage.set(key, entry)\n    } catch (err) {\n      onError?.(err, { phase: 'set', key })\n    }\n    return value\n  }\n\n  function scheduleBackgroundRevalidate<T>(\n    key: string,\n    fn: () => Promise<T>,\n    options: GetOrComputeOptions<T>,\n  ): void {\n    if (bgInFlight.has(key)) return\n    bgInFlight.add(key)\n    void runLoader(key, fn, options)\n      .catch((err: unknown) => {\n        onError?.(err, { phase: 'revalidate', key })\n      })\n      .finally(() => {\n        bgInFlight.delete(key)\n      })\n  }\n\n  return {\n    storage,\n\n    getOrCompute,\n\n    async tryReadCached<T>(\n      key: string,\n      opts: { cacheVersion?: string; validate?: (v: T) => boolean },\n    ): Promise<{ value: T; status: 'hit' | 'stale' } | undefined> {\n      // Delegate to internal impl (which uses the broader GetOrComputeOptions\n      // type). tryReadCached never returns status: 'miss' — that codepath\n      // returns undefined. Narrow the type via assertion.\n      const result = await tryReadCached<T>(key, {\n        ...opts,\n        maxAge: 0, // unused by tryReadCached\n      })\n      if (!result) return undefined\n      return result as { value: T; status: 'hit' | 'stale' }\n    },\n\n    async set(key, entry) {\n      await storage.set(key, entry)\n    },\n\n    async invalidate(key) {\n      // Best-effort: clear in-flight too so next request starts fresh\n      inFlight.delete(key)\n      return storage.delete(key)\n    },\n\n    async invalidateTag(tag) {\n      return storage.deleteByTag(tag)\n    },\n\n    async revalidatePath(path, type) {\n      const tag = THEO_T_PREFIX + path + (type ? '/' + type : '')\n      return storage.deleteByTag(tag)\n    },\n  }\n}\n","import type { CacheEntry, CacheStorageAdapter } from './storage-adapter.js'\n\nexport interface InMemoryCacheAdapterOptions {\n  /** Maximum number of entries before LRU eviction. Default 1000. */\n  maxEntries?: number\n}\n\n/**\n * In-memory cache adapter with LRU eviction + reverse tag index.\n *\n * Uses Map insertion-order for O(1) LRU (Astro LRUMap pattern).\n * Reverse index `tagIndex: Map<tag, Set<key>>` makes deleteByTag O(matched-keys).\n *\n * Invariants:\n * - `entries.size <= maxEntries` post-set.\n * - `tagIndex[tag].has(key)` ↔ `entries.get(key)?.tags.includes(tag)`.\n *\n * eslint-disable @typescript-eslint/require-await — the CacheStorageAdapter\n * interface is intentionally async so Redis/file/external adapters fit. The\n * in-memory variant returns immediately but keeps the async signature to\n * satisfy the contract.\n */\n/* eslint-disable @typescript-eslint/require-await */\nexport class InMemoryCacheAdapter implements CacheStorageAdapter {\n  readonly name = 'memory'\n  readonly #entries = new Map<string, CacheEntry>()\n  readonly #tagIndex = new Map<string, Set<string>>()\n  readonly #maxEntries: number\n\n  constructor(opts: InMemoryCacheAdapterOptions = {}) {\n    this.#maxEntries = opts.maxEntries ?? 1000\n  }\n\n  async get(key: string): Promise<CacheEntry | undefined> {\n    const entry = this.#entries.get(key)\n    if (entry === undefined) return undefined\n    // LRU bump\n    this.#entries.delete(key)\n    this.#entries.set(key, entry)\n    return entry\n  }\n\n  async set(key: string, entry: CacheEntry): Promise<void> {\n    // Overwrite case: clean old tags first\n    const existing = this.#entries.get(key)\n    if (existing) {\n      this.#removeKeyFromTagIndex(key, existing.tags)\n      this.#entries.delete(key)\n    } else if (this.#entries.size >= this.#maxEntries) {\n      // LRU eviction\n      const oldestIter = this.#entries.keys().next()\n      if (!oldestIter.done) {\n        const oldestKey = oldestIter.value\n        const oldestEntry = this.#entries.get(oldestKey)\n        if (oldestEntry) {\n          this.#removeKeyFromTagIndex(oldestKey, oldestEntry.tags)\n        }\n        this.#entries.delete(oldestKey)\n      }\n    }\n    this.#entries.set(key, entry)\n    for (const tag of entry.tags) {\n      let bucket = this.#tagIndex.get(tag)\n      if (!bucket) {\n        bucket = new Set()\n        this.#tagIndex.set(tag, bucket)\n      }\n      bucket.add(key)\n    }\n  }\n\n  async delete(key: string): Promise<boolean> {\n    const entry = this.#entries.get(key)\n    if (!entry) return false\n    this.#removeKeyFromTagIndex(key, entry.tags)\n    this.#entries.delete(key)\n    return true\n  }\n\n  async deleteByTag(tag: string): Promise<number> {\n    const bucket = this.#tagIndex.get(tag)\n    if (!bucket || bucket.size === 0) return 0\n    const keys = [...bucket]\n    for (const key of keys) {\n      const entry = this.#entries.get(key)\n      if (entry) {\n        this.#unindexFromOtherTags(key, entry.tags, tag)\n      }\n      this.#entries.delete(key)\n    }\n    this.#tagIndex.delete(tag)\n    return keys.length\n  }\n\n  async size(): Promise<number> {\n    return this.#entries.size\n  }\n\n  async clear(): Promise<void> {\n    this.#entries.clear()\n    this.#tagIndex.clear()\n  }\n\n  async *keys(prefix?: string): AsyncIterableIterator<string> {\n    for (const key of this.#entries.keys()) {\n      if (prefix && !key.startsWith(prefix)) continue\n      yield key\n    }\n  }\n\n  #removeKeyFromTagIndex(key: string, tags: string[]): void {\n    for (const tag of tags) {\n      const bucket = this.#tagIndex.get(tag)\n      if (!bucket) continue\n      bucket.delete(key)\n      if (bucket.size === 0) this.#tagIndex.delete(tag)\n    }\n  }\n\n  #unindexFromOtherTags(key: string, tags: string[], skipTag: string): void {\n    for (const otherTag of tags) {\n      if (otherTag === skipTag) continue\n      const otherBucket = this.#tagIndex.get(otherTag)\n      if (!otherBucket) continue\n      otherBucket.delete(key)\n      if (otherBucket.size === 0) this.#tagIndex.delete(otherTag)\n    }\n  }\n}\n","import type { CacheEngine, CacheEngineOptions } from './cache-engine.js'\nimport { createCacheEngine } from './cache-engine.js'\nimport { InMemoryCacheAdapter } from './in-memory-adapter.js'\nimport type { CacheStorageAdapter } from './storage-adapter.js'\n\nexport interface NormalizedCacheConfig {\n  enabled: boolean\n  storage: 'memory' | CacheStorageAdapter\n  maxEntries: number\n  defaults: {\n    maxAge: number\n    swr?: number\n    cacheErrors: boolean\n  }\n}\n\nlet _engine: CacheEngine | undefined\n\n/**\n * Initialize the singleton cache engine for this process.\n * Throws if called twice; tests should call `_resetCacheEngine()` between.\n */\nexport function initCacheEngine(\n  config: NormalizedCacheConfig,\n  hooks: Pick<CacheEngineOptions, 'onError'> = {},\n): CacheEngine {\n  if (_engine) {\n    throw new Error(\n      'Cache engine already initialized — call _resetCacheEngine() in tests, or check init order in production.',\n    )\n  }\n  if (!config.enabled) {\n    throw new Error(\n      'initCacheEngine: config.enabled is false. Skip this call entirely when cache is disabled.',\n    )\n  }\n  const adapter =\n    config.storage === 'memory'\n      ? new InMemoryCacheAdapter({ maxEntries: config.maxEntries })\n      : config.storage\n  _engine = createCacheEngine({\n    storage: adapter,\n    defaults: config.defaults,\n    onError: hooks.onError,\n  })\n  return _engine\n}\n\n/**\n * Resolve the singleton cache engine.\n * Throws a clear error if not initialized — usually means the framework\n * bootstrap missed calling initCacheEngine, or cache.enabled is false.\n */\nexport function getCacheEngine(): CacheEngine {\n  if (!_engine) {\n    throw new Error(\n      'Cache engine not initialized. Ensure theo.config.ts has `cache.enabled: true` and the framework bootstrap called initCacheEngine.',\n    )\n  }\n  return _engine\n}\n\n/**\n * Test-only: clear the singleton so the next test can re-init.\n * Production code MUST NOT call this.\n */\nexport function _resetCacheEngine(): void {\n  _engine = undefined\n}\n","import { getCacheEngine } from './engine-singleton.js'\nimport { validateTags } from './validation.js'\n\nexport interface RevalidateResult {\n  deleted: number\n}\n\n/**\n * Invalidate all cache entries carrying the given tag.\n * Safe to call from any context (route handler, action, webhook).\n *\n * `opts.expire` accepted for API compatibility with Next.js; at MVP we delete\n * immediately (no SWR-with-expire semantics). A non-zero value emits one warn.\n */\nexport async function revalidateTag(\n  tag: string,\n  opts?: { expire?: number },\n): Promise<RevalidateResult> {\n  if (opts?.expire !== undefined && opts.expire > 0) {\n    warnOnce(\n      'revalidateTag-expire',\n      '[theokit:cache] revalidateTag opts.expire is accepted but not honored at MVP (entries are deleted immediately).',\n    )\n  }\n  const { valid } = validateTags([tag], 'revalidateTag')\n  if (valid.length === 0) return { deleted: 0 }\n  const engine = getCacheEngine()\n  const deleted = await engine.invalidateTag(valid[0])\n  return { deleted }\n}\n\n/**\n * Immediate invalidation (no SWR), Server-Action-safe.\n * Same semantics as revalidateTag at MVP; kept as separate name for\n * call-site clarity (\"I want fresh data NOW\").\n */\nexport async function updateTag(tag: string): Promise<RevalidateResult> {\n  const { valid } = validateTags([tag], 'updateTag')\n  if (valid.length === 0) return { deleted: 0 }\n  const engine = getCacheEngine()\n  const deleted = await engine.invalidateTag(valid[0])\n  return { deleted }\n}\n\n/**\n * Invalidate cached entries for a route path.\n * Sugar over `revalidateTag('_THEO_T_/${path}/${type?}')`.\n */\nexport async function revalidatePath(\n  path: string,\n  opts?: { type?: 'layout' | 'page'; expire?: number },\n): Promise<RevalidateResult> {\n  if (opts?.expire !== undefined && opts.expire > 0) {\n    warnOnce(\n      'revalidatePath-expire',\n      '[theokit:cache] revalidatePath opts.expire is accepted but not honored at MVP.',\n    )\n  }\n  const engine = getCacheEngine()\n  const deleted = await engine.revalidatePath(path, opts?.type)\n  return { deleted }\n}\n\nconst warnedKeys = new Set<string>()\nfunction warnOnce(key: string, message: string): void {\n  if (warnedKeys.has(key)) return\n  warnedKeys.add(key)\n  console.warn(message)\n}\n","import picomatch from 'picomatch'\n\nexport interface RouteRule {\n  maxAge?: number\n  swr?: number\n  tags?: string[]\n}\n\nexport type RouteRules = Record<string, RouteRule>\n\nexport interface CompiledRouteRule {\n  matcher: (path: string) => boolean\n  rule: RouteRule\n  /** Original glob pattern (for debugging). */\n  pattern: string\n}\n\n/**\n * Compile route-rule glob patterns into matcher functions.\n * First-match-wins semantics (preserves insertion order).\n *\n * EC-5: picomatch is a direct production dependency (see plan T7.2).\n */\nexport function compileRouteRules(rules: RouteRules): CompiledRouteRule[] {\n  return Object.entries(rules).map(([pattern, rule]) => ({\n    matcher: picomatch(pattern, { dot: true }),\n    rule,\n    pattern,\n  }))\n}\n\n/**\n * Resolve the first matching rule for `path`, or `undefined` if none match.\n */\nexport function resolveRouteRule(\n  path: string,\n  compiled: CompiledRouteRule[],\n): RouteRule | undefined {\n  for (const c of compiled) {\n    if (c.matcher(path)) return c.rule\n  }\n  return undefined\n}\n","import superjson from 'superjson'\n\nexport interface SerializedResponse {\n  json: unknown\n  meta?: unknown\n}\n\n/**\n * Serialize data using superjson for rich type support (Date, Map, Set, BigInt, etc.)\n */\nexport function serializeResponse(data: unknown): SerializedResponse {\n  return superjson.serialize(data)\n}\n\n/**\n * Deserialize data that was serialized with superjson.\n */\nexport function deserializeResponse(serialized: SerializedResponse): unknown {\n  return superjson.deserialize(serialized as Parameters<typeof superjson.deserialize>[0])\n}\n","import type { IncomingMessage, ServerResponse } from 'node:http'\n\nexport interface PluginContext {\n  request: IncomingMessage\n  response: ServerResponse\n  ctx: Record<string, unknown>\n  requestId: string\n}\n\nexport interface PluginErrorContext extends PluginContext {\n  error: unknown\n}\n\nexport interface RunHookOptions {\n  inErrorPath?: boolean\n}\n\nexport interface HookResult {\n  shortCircuited: boolean\n}\n\nexport type OnRequestHook = (ctx: PluginContext) => void | Promise<void>\nexport type PreHandlerHook = (ctx: PluginContext) => void | Promise<void>\nexport type OnResponseHook = (ctx: PluginContext) => void | Promise<void>\nexport type OnErrorHook = (ctx: PluginErrorContext) => void | Promise<void>\n\nexport type HookName = 'onRequest' | 'preHandler' | 'onResponse' | 'onError'\n\nexport type HookByName<K extends HookName> = K extends 'onError'\n  ? OnErrorHook\n  : K extends 'onRequest'\n    ? OnRequestHook\n    : K extends 'preHandler'\n      ? PreHandlerHook\n      : K extends 'onResponse'\n        ? OnResponseHook\n        : never\n\nexport interface TheoApp {\n  addHook<K extends HookName>(name: K, fn: HookByName<K>): void\n  // `T` lets plugin authors document the per-key shape of decorations.\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters -- T documents the value type for plugin authors\n  decorateRequest<T>(key: string, value: T): void\n}\n\nexport interface TheoPlugin {\n  name: string\n  register(app: TheoApp): void | Promise<void>\n}\n\n/**\n * Identity function for plugin authors. Provides auto-completion + type\n * inference at the call site (TanStack/Vite/Astro pattern). Pure runtime\n * no-op — returns the input unchanged.\n *\n * @example\n *   import { definePlugin } from 'theokit/server'\n *   export default definePlugin({\n *     name: 'my-plugin',\n *     register(app) {\n *       app.addHook('onRequest', (req) => { ... })\n *     },\n *   })\n *\n * Equivalent to `const p: TheoPlugin = {...}` but more ergonomic. See\n * ADR-0008 (D1 + D6) for the rationale.\n */\nexport function definePlugin(plugin: TheoPlugin): TheoPlugin {\n  return plugin\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaO,SAAS,YAOd,QACsD;AACtD,SAAO;AACT;;;ACiBO,SAAS,aACd,QAC4B;AAC5B,SAAO;AACT;;;ACnCO,SAAS,iBAAiB,SAA+C;AAC9E,SAAO;AACT;;;ACyDA,IAAM,cAAc;AAAA,EAClB,gBAAgB;AAAA,EAChB,iBAAiB;AAAA,EACjB,YAAY;AACd;AAEA,SAAS,UAAU,OAA+B;AAChD,SAAO,IAAI,YAAY,EAAE,OAAO,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA,CAAM;AACtE;AAYA,SAAS,mBAAmB,SAA+B;AACzD,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAO,IAAI,gBAAgB,EAAE;AAAA,EAC/B;AACA,QAAM,IAAI;AAKV,MACE,OAAO,EAAE,WAAW,YACpB,EAAE,WAAW,QACb,aAAa,EAAE,UACf,OAAQ,EAAE,OAAuB,qBAAqB,YACtD;AACA,WAAO,EAAE;AAAA,EACX;AAEA,QAAM,aAAa,IAAI,gBAAgB;AACvC,MAAI,EAAE,YAAY,KAAM,YAAW,MAAM;AACzC,MAAI,OAAO,EAAE,OAAO,YAAY;AAC9B,MAAE,GAAG,SAAS,MAAM;AAClB,UAAI,CAAC,WAAW,OAAO,QAAS,YAAW,MAAM;AAAA,IACnD,CAAC;AACD,MAAE,GAAG,WAAW,MAAM;AACpB,UAAI,CAAC,WAAW,OAAO,QAAS,YAAW,MAAM;AAAA,IACnD,CAAC;AAAA,EACH;AACA,SAAO,WAAW;AACpB;AAEO,SAAS,oBACd,QAC6E;AAC7E,SAAO;AAAA,IACL,SAAS,OAAO,EAAE,SAAS,KAAK,MAAM,OAAO,OAAO,MAAM;AACxD,YAAM,gBAAgB,IAAI,QAAQ;AAClC,YAAM,SAAS,mBAAmB,OAAO;AACzC,YAAM,YAAY,OAAO,QAAQ;AAAA,QAC/B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAWD,UAAI;AACJ,UAAI;AACJ,UAAI;AACF,sBAAc,MAAM,UAAU,KAAK;AAAA,MACrC,SAAS,KAAK;AACZ,qBAAa;AACb,sBAAc,EAAE,OAAO,QAAW,MAAM,KAAK;AAAA,MAC/C;AAGA,YAAM,kBAAkB,IAAI,QAAQ,WAAW;AAC/C,iBAAW,SAAS,cAAc,aAAa,GAAG;AAChD,wBAAgB,OAAO,cAAc,KAAK;AAAA,MAC5C;AAEA,YAAM,SAAS,IAAI,eAA2B;AAAA,QAC5C,MAAM,MAAM,YAAY;AACtB,gBAAM,UAAU,MAAM;AACpB,iBAAK,UAAU,OAAO,MAAS;AAAA,UACjC;AAEA,cAAI,OAAO,SAAS;AAClB,uBAAW,MAAM;AACjB;AAAA,UACF;AACA,iBAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAExD,cAAI;AAEF,gBAAI,eAAe,QAAW;AAC5B,kBAAI;AACJ,kBAAI,sBAAsB,OAAO;AAC/B,0BAAU,WAAW;AAAA,cACvB,WAAW,OAAO,eAAe,UAAU;AACzC,0BAAU;AAAA,cACZ,OAAO;AACL,0BAAU;AAAA,cACZ;AACA,yBAAW,QAAQ,UAAU,EAAE,MAAM,SAAS,QAAQ,CAAC,CAAC;AACxD;AAAA,YACF;AAEA,gBAAI,YAAY,SAAS,MAAM;AAC7B,yBAAW,QAAQ,UAAU,YAAY,KAAK,CAAC;AAAA,YACjD,OAAO;AACL;AAAA,YACF;AAEA,6BAAiB,SAAS,WAAW;AAMnC,kBAAI,OAAO,QAAS;AACpB,yBAAW,QAAQ,UAAU,KAAK,CAAC;AAAA,YACrC;AAAA,UACF,SAAS,KAAK;AACZ,kBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,uBAAW,QAAQ,UAAU,EAAE,MAAM,SAAS,QAAQ,CAAC,CAAC;AAAA,UAC1D,UAAE;AACA,mBAAO,oBAAoB,SAAS,OAAO;AAC3C,uBAAW,MAAM;AAAA,UACnB;AAAA,QACF;AAAA,QACA,SAAS;AACP,eAAK,UAAU,OAAO,MAAS;AAAA,QACjC;AAAA,MACF,CAAC;AAED,aAAO,IAAI,SAAS,QAAQ,EAAE,SAAS,gBAAgB,CAAC;AAAA,IAC1D;AAAA,EACF;AACF;;;ACzNA,SAAS,uBAAuB;AA2DhC,IAAM,kBAAkB;AAExB,SAAS,YAAY,QAA4B;AAO/C,MAAI,UAAmB;AACvB,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS;AACvC,UAAM,MAAO,QACV;AACH,QAAI,KAAK,aAAa,YAAa,QAAO;AAC1C,QAAI,KAAK,WAAW,QAAW;AAC7B,gBAAU,IAAI;AACd;AAAA,IACF;AACA,QAAI,KAAK,cAAc,QAAW;AAChC,gBAAU,IAAI;AACd;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAoBO,SAAS,gBAAqC,MAA0C;AAC7F,MAAI,CAAC,gBAAgB,KAAK,KAAK,IAAI,GAAG;AACpC,UAAM,IAAI;AAAA,MACR,oCAAoC,gBAAgB,MAAM,UAAU,KAAK,UAAU,KAAK,IAAI,CAAC;AAAA,IAC/F;AAAA,EACF;AACA,MAAI,CAAC,YAAY,KAAK,WAAW,GAAG;AAClC,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,MAAI,KAAK,YAAY,WAAW,GAAG;AACjC,YAAQ;AAAA,MACN,mBAAmB,KAAK,UAAU,KAAK,IAAI,CAAC;AAAA,IAC9C;AAAA,EACF;AAKA,QAAM,YAAY,gBAAgB,KAAK,aAAa;AAAA,IAClD,QAAQ;AAAA,IACR,cAAc;AAAA,EAChB,CAAC;AAED,QAAM,EAAE,SAAS,UAAU,GAAG,YAAY,IAAI;AAI9C,SAAO;AAAA,IACL,MAAM,KAAK;AAAA,IACX,aAAa,KAAK;AAAA,IAClB;AAAA,IACA,SAAS,OAAO,UAAoD;AAClE,YAAM,SAAS,KAAK,YAAY,MAAM,KAAK;AAC3C,aAAO,MAAM,KAAK,QAAQ,MAAM;AAAA,IAClC;AAAA,EACF;AACF;;;AC3HO,SAAS,gBAAgB,SAA6C;AAC3E,SAAO;AACT;;;ACNO,SAAS,cACd,SAC0B;AAC1B,SAAO;AACT;;;ACTO,SAAS,iBAAiB,QAAgC;AAC/D,SAAO;AACT;;;ACKA,SAAS,YAAY,cAAc,gBAAgB;AACnD,SAAS,eAAe;AAEjB,IAAM,uBAAuB;AAOpC,SAAS,WAAW,KAAa,MAAkC;AACjE,QAAM,OAAO,QAAQ,KAAK,IAAI;AAC9B,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,OAAO,SAAS,IAAI;AAC1B,QAAI,KAAK,OAAO,sBAAsB;AACpC,cAAQ;AAAA,QACN,+BAA+B,IAAI,OAAO,KAAK,IAAI,eAAe,oBAAoB;AAAA,MACxF;AACA,aAAO;AAAA,IACT;AACA,WAAO,aAAa,MAAM,OAAO;AAAA,EACnC,SAAS,KAAK;AACZ,YAAQ,KAAK,4BAA4B,IAAI,KAAM,IAAc,OAAO,EAAE;AAC1E,WAAO;AAAA,EACT;AACF;AAMO,SAAS,qBAAqB,WAAqC;AACxE,SAAO;AAAA,IACL,eAAe,WAAW,WAAW,UAAU;AAAA,IAC/C,eAAe,WAAW,WAAW,UAAU;AAAA,EACjD;AACF;;;AC/CA,SAAS,cAAAA,aAAY,gBAAAC,eAAc,YAAAC,iBAAgB;AAEnD,SAAS,WAAAC,UAAS,eAAe;AAEjC,IAAM,aAAqC;AAAA,EACzC,SAAS;AAAA,EACT,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,SAAS,gBACd,KACA,KACA,WACS;AACT,QAAM,WAAW,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAG7C,QAAM,WAAWA,SAAQ,WAAW,MAAM,OAAO;AACjD,MAAI,CAAC,SAAS,WAAW,SAAS,GAAG;AACnC,QAAI,UAAU,GAAG;AACjB,QAAI,IAAI,WAAW;AACnB,WAAO;AAAA,EACT;AAEA,MAAI,CAACH,YAAW,QAAQ,EAAG,QAAO;AAElC,QAAM,OAAOE,UAAS,QAAQ;AAC9B,MAAI,CAAC,KAAK,OAAO,EAAG,QAAO;AAE3B,QAAM,MAAM,QAAQ,QAAQ;AAC5B,QAAM,cAAc,WAAW,GAAG,KAAK;AACvC,QAAM,UAAUD,cAAa,QAAQ;AAErC,MAAI,UAAU,KAAK;AAAA,IACjB,gBAAgB;AAAA,IAChB,kBAAkB,QAAQ;AAAA,EAC5B,CAAC;AACD,MAAI,IAAI,OAAO;AACf,SAAO;AACT;;;ACsBA,SAAS,kBAAkB,OAAwB;AACjD,MAAI;AACF,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,SAAS,SAAS,MAAwC;AACxD,MAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,CAAC,MAAM,QAAQ,IAAI,GAAG;AACrE,WAAO;AAAA,EACT;AACA,SAAO,CAAC;AACV;AAoCA,SAAS,YAAY,KAA6C;AAIhE,QAAM,IAAI;AAIV,SACE,EAAE,SAAS,eACX,EAAE,WAAW,QACb,OAAO,EAAE,YAAY,YACrB,MAAM,QAAQ,EAAE,QAAQ,OAAO;AAEnC;AACA,SAAS,WAAW,KAA4C;AAC9D,QAAM,IAAI;AAMV,SACE,EAAE,SAAS,eACX,OAAO,EAAE,SAAS,YAClB,OAAO,EAAE,YAAY,aACpB,EAAE,WAAW,aAAa,EAAE,WAAW,eAAe,EAAE,WAAW;AAExE;AAiCA,SAAS,gBAAgB,KAAwC;AAC/D,MAAI,EAAE,eAAe,OAAQ,QAAO;AACpC,QAAM,IAAI;AACV,SAAO,UAAU,KAAK,OAAO,EAAE,SAAS;AAC1C;AAWO,SAAS,aAAa,KAAc,IAA8B;AACvE,MAAI,gBAAgB,GAAG,GAAG;AACxB,UAAMG,SAAyB;AAAA,MAC7B,MAAM;AAAA,MACN,SAAS,IAAI;AAAA,MACb,MAAM,IAAI;AAAA,IACZ;AACA,QAAI,IAAI,aAAa,OAAW,CAAAA,OAAM,WAAW,IAAI;AACrD,QAAI,IAAI,cAAc,OAAW,CAAAA,OAAM,YAAY,IAAI;AACvD,QAAI,IAAI,iBAAiB,OAAW,CAAAA,OAAM,eAAe,IAAI;AAC7D,QAAI,OAAO,OAAW,CAAAA,OAAM,KAAK;AACjC,WAAOA;AAAA,EACT;AAEA,MAAI;AACJ,MAAI,eAAe,OAAO;AACxB,cAAU,IAAI;AAAA,EAChB,WAAW,OAAO,QAAQ,UAAU;AAClC,cAAU;AAAA,EACZ,WAAW,QAAQ,QAAQ,OAAO,QAAQ,YAAY,aAAa,KAAK;AACtE,UAAM,YAAsB,IAAgC;AAE5D,cAAU,OAAO,cAAc,WAAW,YAAY;AAAA,EACxD,WAAW,QAAQ,QAAQ,QAAQ,QAAW;AAC5C,cAAU,OAAO,GAAG;AAAA,EACtB,OAAO;AACL,cAAU;AAAA,EACZ;AACA,QAAM,QAAyB,EAAE,MAAM,SAAS,QAAQ;AACxD,MAAI,OAAO,OAAW,OAAM,KAAK;AACjC,SAAO;AACT;AAEA,SAAS,kBAAkB,KAA+B;AACxD,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,MAAM,IAAI;AAAA,MACV,MAAM,SAAS,IAAI,IAAI;AAAA,MACvB,IAAI,IAAI;AAAA,IACV;AAAA,EACF;AACA,MAAI,IAAI,WAAW,aAAa;AAC9B,UAAM,OAAO,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS,kBAAkB,IAAI,MAAM;AACvF,WAAO;AAAA,MACL,MAAM;AAAA,MACN,MAAM,IAAI;AAAA,MACV;AAAA,MACA,IAAI,IAAI;AAAA,IACV;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS,QAAQ,IAAI,IAAI;AAC9E,SAAO,EAAE,MAAM,SAAS,SAAS,IAAI,IAAI,QAAQ;AACnD;AAEA,gBAAuB,eACrB,KAC2C;AAC3C,mBAAiB,OAAO,IAAI,OAAO,GAAG;AACpC,QAAI,YAAY,GAAG,GAAG;AACpB,iBAAW,SAAS,IAAI,QAAQ,SAAS;AACvC,YAAI,MAAM,SAAS,UAAU,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,GAAG;AACpF,gBAAM,EAAE,MAAM,WAAW,SAAS,MAAM,KAAK;AAAA,QAC/C;AAAA,MACF;AAAA,IACF,WAAW,WAAW,GAAG,GAAG;AAC1B,YAAM,kBAAkB,GAAG;AAAA,IAC7B;AAAA,EAGF;AAEA,QAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,MAAI,OAAO,WAAW,WAAW,OAAO,UAAU,QAAW;AAC3D,UAAM,aAAa,OAAO,KAAK;AAAA,EACjC;AACF;;;ACvOA,IAAM,mBAAyC;AAAA,EAC7C;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AACF;AAMA,IAAM,WAAiC,CAAC,GAAG,gBAAgB;AAkDpD,SAAS,kBAAoC;AAClD,QAAM,SAAS,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AACnE,aAAW,QAAQ,QAAQ;AACzB,UAAM,SAAS,QAAQ,IAAI,KAAK,MAAM;AACtC,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,aAAO;AAAA,QACL,MAAM,KAAK;AAAA,QACX;AAAA,QACA,SAAS,KAAK;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,MAAM;AACvD,QAAM,IAAI;AAAA,IACR,6DAA6D,OAAO;AAAA,EAEtE;AACF;AAQO,SAAS,qBAA8C;AAC5D,MAAI;AACF,WAAO,gBAAgB;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACxBA,IAAI,cAA4C;AAGzC,SAAS,iBAAiB,KAA6B;AAC5D,gBAAc;AAChB;AAGO,SAAS,qBAA2B;AACzC,gBAAc;AAChB;AAEA,eAAe,UAA8B;AAI3C,MAAI,gBAAgB,MAAM;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,gBAAgB,OAAW,QAAO;AACtC,MAAI;AASF,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,QAAa;AACpD,UAAM,YAAY,cAAc,YAAY,GAAG;AAC/C,UAAM,OAAO;AACb,UAAM,MAAM,UAAU,IAAI;AAC1B,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,EAAE,MAAM;AAAA,IACV;AAAA,EACF;AACF;AAMA,IAAM,sBAAsB;AAC5B,IAAM,yBAAyB,KAAK,KAAK,KAAK;AAU9C,IAAM,iBAAiB;AAEvB,SAAS,eAAe,GAA2C;AACjE,SAAO,OAAO,MAAM,YAAY,eAAe,KAAK,CAAC;AACvD;AAMA,SAAS,gBACP,SACA,MACoB;AACpB,MAAI;AACJ,QAAM,IAAI,QAAQ;AAClB,MAAI,MAAM,OAAW,QAAO;AAC5B,MAAI,OAAQ,EAAc,QAAQ,YAAY;AAC5C,UAAO,EAAc,IAAI,QAAQ,KAAK;AAAA,EACxC,OAAO;AACL,UAAO,EAA0B;AAAA,EACnC;AACA,MAAI,QAAQ,UAAa,IAAI,WAAW,EAAG,QAAO;AAClD,QAAM,QAAQ,IAAI,MAAM,MAAM;AAC9B,aAAW,QAAQ,OAAO;AACxB,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,KAAK,EAAG;AACZ,UAAM,IAAI,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACjC,QAAI,MAAM,KAAM,QAAO,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,EACjD;AACA,SAAO;AACT;AASA,SAAS,gBAAgB,MAAc,OAAe,SAAyC;AAC7F,QAAM,QAAkB,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE;AAC3C,MAAI,QAAQ,SAAS,OAAW,OAAM,KAAK,QAAQ,QAAQ,IAAI,EAAE;AACjE,MAAI,QAAQ,WAAW,OAAW,OAAM,KAAK,WAAW,QAAQ,MAAM,EAAE;AACxE,MAAI,QAAQ,aAAa,QAAW;AAClC,UAAM,IAAI,QAAQ,SAAS,OAAO,CAAC,EAAE,YAAY,IAAI,QAAQ,SAAS,MAAM,CAAC;AAC7E,UAAM,KAAK,YAAY,CAAC,EAAE;AAAA,EAC5B;AACA,MAAI,QAAQ,aAAa,KAAM,OAAM,KAAK,UAAU;AACpD,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAsB,0BACpB,MACoC;AACpC,QAAM,aAAa,KAAK,cAAc;AAItC,QAAM,YAAY,KAAK;AACvB,QAAM,eACJ,OAAO,cAAc,YAAY,YAAY,IAAI,YAAY;AAI/D,MAAI;AACJ,MAAI,QAAQ;AACZ,QAAM,kBAAkB,gBAAgB,KAAK,SAAS,UAAU;AAEhE,MAAI,eAAe,KAAK,OAAO,GAAG;AAChC,qBAAiB,KAAK;AAAA,EACxB,WAAW,KAAK,YAAY,QAAQ,KAAK,YAAY,QAAW;AAC9D,UAAM,MAAM,KAAK,QAAQ;AACzB,QAAI,eAAe,GAAG,EAAG,kBAAiB;AAAA,EAC5C;AACA,MAAI,mBAAmB,UAAa,eAAe,eAAe,GAAG;AACnE,qBAAiB;AAAA,EACnB;AAEA,MAAI,mBAAmB,QAAW;AAChC,qBAAiB,OAAO,WAAW;AACnC,YAAQ;AAAA,EACV;AAWA,QAAM,oBAAoB,SAAS,oBAAoB;AACvD,MAAI,qBAAqB,KAAK,aAAa,QAAW;AACpD,UAAM,SAAS,gBAAgB,YAAY,gBAAgB;AAAA,MACzD,UAAU;AAAA,MACV,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,SAAK,SAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,EACnD;AAQA,QAAM,kBAAkB,4BAA4B,KAAK,OAAO;AAGhE,QAAM,MAAM,MAAM,QAAQ;AAC1B,QAAM,QAAQ,MAAM,IAAI,MAAM,YAAY,gBAAgB,eAAe;AAEzE,SAAO,EAAE,OAAO,gBAAgB,MAAM;AACxC;AAaA,SAAS,4BAA4B,SAA2C;AAE9E,MAAI,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS,GAAG;AACnE,WAAO;AAAA,EACT;AAQA,QAAM,WAAW,mBAAmB;AACpC,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,IAKF;AAAA,EACF;AAIA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,SAAS;AAAA,IACjB,WAAW;AAAA,MACT,QAAQ,CAAC,EAAE,YAAY,QAAQ,UAAU,SAAS,MAAM,SAAS,SAAS,QAAQ,CAAC;AAAA,IACrF;AAAA,EACF;AACF;;;ACzWA,SAAS,kBAAkB;AA0C3B,SAAS,cAAc,OAAuB;AAC5C,QAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,MAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAG,EAAG,QAAO,QAAQ,MAAM,GAAG,EAAE;AAC3E,SAAO;AACT;AAOO,SAAS,kBAAkB,MAAc,SAAmC;AACjF,QAAM,YAAY,cAAc,IAAI;AACpC,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO,cAAc,cAAc,OAAO;AAAA,EAC5C;AACA,UAAQ,YAAY;AACpB,SAAO,QAAQ,KAAK,SAAS;AAC/B;AAOA,SAAS,aAAa,OAAuB;AAC3C,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,WAAW,EAAE,MAAM,GAAG,EAAE;AAC3E;AAMA,SAAS,WAAW,KAAsB,MAAkC;AAC1E,SAAO,kBAAkB,IAAI,QAAQ,UAAU,MAAS,EAAE,IAAI,IAAI;AACpE;AAUO,SAAS,UAAU,KAAsB,OAAkB,YAA4B;AAC5F,MAAI,OAAO,UAAU,WAAY,QAAO,MAAM,GAAG;AAKjD,QAAM,KAAK,IAAI,QAAQ,iBAAiB;AACxC,UAAQ,OAAO;AAAA,IACb,KAAK,WAAW;AACd,YAAM,SAAS,WAAW,KAAK,UAAU;AACzC,aAAO,SAAS,WAAW,aAAa,MAAM,CAAC,KAAK,MAAM,EAAE;AAAA,IAC9D;AAAA,IACA,KAAK,QAAQ;AACX,YAAM,SAAU,IAA8C,MAAM;AACpE,aAAO,SAAS,QAAQ,MAAM,KAAK,MAAM,EAAE;AAAA,IAC7C;AAAA,IACA,KAAK;AAAA,IACL;AACE,aAAO,MAAM,EAAE;AAAA,EACnB;AACF;AASO,SAAS,uBAAuB,QAAgD;AAErF,QAAM,SACJ,cAAc,UAAU,SAAS,UAAU,EAAE,aAAa,WAAW,EAAE,YAAY;AACrF,QAAM,MAA4B,SAAS,EAAE,SAAS,OAAO,IAAI;AAEjE,QAAM,QAAQ,IAAI,SAAS,IAAI,cAAc;AAK7C,MAAI,EAAE,iBAAiB,gBAAgB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,gBAAgB;AACtB,QAAM,QAAQ,IAAI,SAAS;AAC3B,QAAM,aAAa,IAAI,cAAc;AAGrC,QAAM,cAAoD,CAAC;AAC3D,MAAI,IAAI,QAAQ;AACd,eAAW,CAAC,SAAS,CAAC,KAAK,OAAO,QAAQ,IAAI,MAAM,EAAG,aAAY,KAAK,CAAC,SAAS,CAAC,CAAC;AAAA,EACtF;AACA,MAAI,IAAI,eAAe;AACrB,eAAW,SAAS,IAAI,cAAe,aAAY,KAAK,KAAK;AAAA,EAC/D;AAEA,SAAO,SAAS,oBAAoB,KAAuC;AACzE,UAAM,MAAM,IAAI,OAAO;AACvB,QAAI;AACJ,eAAW,CAAC,SAAS,CAAC,KAAK,aAAa;AACtC,UAAI,kBAAkB,KAAK,OAAO,GAAG;AACnC,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,WAAW,IAAI;AACjC,QAAI,CAAC,WAAW;AAEd,aAAO,EAAE,SAAS,OAAO,SAAS,CAAC,EAAE;AAAA,IACvC;AAIA,UAAM,eAAe,OAAO,YAAY,cAAc,cAAc,cAAc,GAAG;AACrF,UAAM,MAAM,GAAG,UAAU,KAAK,OAAO,UAAU,CAAC,IAAI,YAAY;AAChE,UAAM,QAAQ,cAAc,SAAS,KAAK,UAAU,QAAQ;AAE5D,QAAI,MAAM,QAAQ,UAAU,KAAK;AAC/B,YAAM,aAAa,KAAK,MAAM,MAAM,UAAU,KAAK,IAAI,KAAK,GAAI;AAChE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,UACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,UACzC,yBAAyB;AAAA,UACzB,eAAe,OAAO,UAAU;AAAA,QAClC;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,QACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,QACzC,yBAAyB,OAAO,KAAK,IAAI,GAAG,UAAU,MAAM,MAAM,KAAK,CAAC;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;;;ACxLO,IAAM,iBAAN,MAAqB;AAAA,EAClB,QAAQ,oBAAI,IAAgC;AAAA,EAC5C,UAAU,oBAAI,IAAgC;AAAA,EAEtD,UAAU,IAAmB,MAAoB;AAC/C,QAAI,UAAU,KAAK,MAAM,IAAI,IAAI;AACjC,QAAI,CAAC,SAAS;AACZ,gBAAU,oBAAI,IAAI;AAClB,WAAK,MAAM,IAAI,MAAM,OAAO;AAAA,IAC9B;AACA,YAAQ,IAAI,EAAE;AAEd,QAAI,QAAQ,KAAK,QAAQ,IAAI,EAAE;AAC/B,QAAI,CAAC,OAAO;AACV,cAAQ,oBAAI,IAAI;AAChB,WAAK,QAAQ,IAAI,IAAI,KAAK;AAAA,IAC5B;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AAAA,EAEA,YAAY,IAAmB,MAAoB;AACjD,SAAK,MAAM,IAAI,IAAI,GAAG,OAAO,EAAE;AAC/B,QAAI,KAAK,MAAM,IAAI,IAAI,GAAG,SAAS,EAAG,MAAK,MAAM,OAAO,IAAI;AAE5D,SAAK,QAAQ,IAAI,EAAE,GAAG,OAAO,IAAI;AACjC,QAAI,KAAK,QAAQ,IAAI,EAAE,GAAG,SAAS,EAAG,MAAK,QAAQ,OAAO,EAAE;AAAA,EAC9D;AAAA,EAEA,UAAU,MAAc,MAAe,SAA+B;AACpE,UAAM,UAAU,KAAK,MAAM,IAAI,IAAI;AACnC,QAAI,CAAC,QAAS;AAEd,UAAM,MAAM,KAAK,UAAU,IAAI;AAC/B,eAAW,MAAM,SAAS;AACxB,UAAI,OAAO,QAAS,IAAG,KAAK,GAAG;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,aAAa,MAAqB;AAChC,UAAM,MAAM,KAAK,UAAU,IAAI;AAC/B,UAAM,OAAO,oBAAI,IAAmB;AACpC,eAAW,WAAW,KAAK,MAAM,OAAO,GAAG;AACzC,iBAAW,MAAM,SAAS;AACxB,YAAI,CAAC,KAAK,IAAI,EAAE,GAAG;AACjB,aAAG,KAAK,GAAG;AACX,eAAK,IAAI,EAAE;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,YAAY,MAAsB;AAChC,WAAO,KAAK,MAAM,IAAI,IAAI,GAAG,QAAQ;AAAA,EACvC;AAAA,EAEA,QAAQ,IAAyB;AAC/B,UAAM,QAAQ,KAAK,QAAQ,IAAI,EAAE;AACjC,QAAI,OAAO;AACT,iBAAW,QAAQ,OAAO;AACxB,aAAK,MAAM,IAAI,IAAI,GAAG,OAAO,EAAE;AAC/B,YAAI,KAAK,MAAM,IAAI,IAAI,GAAG,SAAS,EAAG,MAAK,MAAM,OAAO,IAAI;AAAA,MAC9D;AAAA,IACF;AACA,SAAK,QAAQ,OAAO,EAAE;AAAA,EACxB;AACF;;;AClCO,IAAM,iBAAN,MAAqB;AAAA,EAC1B;AAAA,EACS,WAAW,oBAAI,IAAsB;AAAA,EACrC,gBAAgB,oBAAI,IAAuB;AAAA,EAC3C,kBAAkB,oBAAI,IAAqB;AAAA,EAC3C,YAAY,oBAAI,IAAoB;AAAA,EAC7C,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAMZ,UAAU,QAA6B;AACrC,QAAI,KAAK,YAAY,QAAW;AAC9B,cAAQ,KAAK,+EAA+E;AAC5F;AAAA,IACF;AACA,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,WAAc,MAAc,SAAqB;AAC/C,QAAI,KAAK,UAAW,OAAM,IAAI,MAAM,4BAA4B;AAChE,QAAI,KAAK,gBAAgB,IAAI,IAAI,EAAG,QAAO,KAAK,gBAAgB,IAAI,IAAI;AACxE,UAAM,SAAS,QAAQ;AACvB,SAAK,gBAAgB,IAAI,MAAM,MAAM;AACrC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,YAAY,QAAgB,SAAoC;AAC9D,QAAI,KAAK,UAAW,OAAM,IAAI,MAAM,4BAA4B;AAChE,UAAM,SAAS,KAAK,SAAS,IAAI,MAAM;AACvC,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,WAAW,KAAK,SAAS,YAAY,MAAM;AACjD,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI;AAAA,QACR,aAAa,MAAM;AAAA,MACrB;AAAA,IACF;AACA,UAAM,SAAS,KAAK,SAAS,UAAU,SAAS,MAAM;AACtD,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI;AAAA,QACR,WAAW,SAAS,MAAM,6BAA6B,MAAM;AAAA,MAC/D;AAAA,IACF;AACA,UAAM,OAAO,QAAQ,QAAQ,QAAQ;AACrC,SAAK,SAAS,IAAI,QAAQ,IAAI;AAC9B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAS,YAAoB,SAAkC;AAC7D,QAAI,KAAK,UAAW,OAAM,IAAI,MAAM,4BAA4B;AAChE,UAAM,SAAS,KAAK,cAAc,IAAI,UAAU;AAChD,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,eAAe,KAAK,SAAS,QAAQ,UAAU;AACrD,QAAI,iBAAiB,QAAW;AAC9B,YAAM,IAAI;AAAA,QACR,iBAAiB,UAAU;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,YAAY;AACnC,SAAK,cAAc,IAAI,YAAY,MAAM;AACzC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,SAA+B;AACtC,QAAI,KAAK,WAAW;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,UAAU,IAAI,OAAO;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,UAAyB;AAC7B,QAAI,KAAK,UAAW;AACpB,SAAK,YAAY;AAEjB,UAAM,gBAAgB,MAAM,KAAK,KAAK,SAAS,EAAE;AAAA,MAAI,CAAC,MACpD,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAiB;AAClC,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,gBAAQ,KAAK,sBAAsB,EAAE,IAAI,qBAAqB,GAAG,EAAE;AAAA,MACrE,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,IAAI,aAAa;AAE/B,UAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS;AAIlE,UAAI,KAAK,QAAQ,OAAW,QAAO,QAAQ,QAAQ;AACnD,aAAO,KAAK,IAAI,EAAE,MAAM,CAAC,QAAiB;AACxC,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,gBAAQ,KAAK,mCAAmC,GAAG,EAAE;AAAA,MACvD,CAAC;AAAA,IACH,CAAC;AACD,UAAM,QAAQ,IAAI,UAAU;AAE5B,UAAM,cAAc,MAAM,KAAK,KAAK,cAAc,OAAO,CAAC,EAAE;AAAA,MAAI,CAAC,MAC/D,EAAE,KAAK,EAAE,MAAM,CAAC,QAAiB;AAC/B,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,gBAAQ,KAAK,4DAA4D,GAAG,EAAE;AAC9E,UAAE,WAAW;AAAA,MACf,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,IAAI,WAAW;AAE7B,SAAK,SAAS,MAAM;AACpB,SAAK,cAAc,MAAM;AACzB,SAAK,gBAAgB,MAAM;AAC3B,SAAK,UAAU,MAAM;AAAA,EACvB;AAAA;AAAA,EAGA,kBAAwB;AACtB,SAAK,UAAU;AACf,SAAK,SAAS,MAAM;AACpB,SAAK,cAAc,MAAM;AACzB,SAAK,gBAAgB,MAAM;AAC3B,SAAK,UAAU,MAAM;AACrB,SAAK,YAAY;AAAA,EACnB;AAAA;AAAA,EAGA,yBAAkC;AAChC,WAAO,KAAK,YAAY;AAAA,EAC1B;AAAA;AAAA,EAGA,uBAAgC;AAC9B,WAAO,KAAK;AAAA,EACd;AACF;AAGA,IAAI;AAEG,SAAS,oBAAoC;AAClD,kBAAgB,IAAI,eAAe;AACnC,SAAO;AACT;AAGO,SAAS,2BAAiC;AAC/C,gBAAc;AAChB;;;ACzLA,eAAsB,aACpB,MACA,QAC+B;AAC/B,QAAM,MAAO,MAAM,OAAO,WAAW,EAAE,MAAM,MAAM,IAAI;AACvD,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,kBAAkB;AAClC,SAAO,QAAQ,WAAiC,eAAe,IAAI,IAAI,MAAM;AAC3E,UAAM,UAAU,IAAI,cAAiB,EAAE,OAAO,CAAC;AAC/C,YAAQ,SAAS;AAAA,MACf,MAAM,aAAa,IAAI;AAAA,MACvB,SAAS,MAAM,QAAQ,UAAU,KAAK,QAAQ,QAAQ;AAAA,IACxD,CAAC;AACD,WAAO;AAAA,EACT,CAAC;AACH;;;ACPA,SAAS,uBAAuB,WAAmC;AACjE,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,KAAK;AACX,SAAK,GAAG,UAAU,KAAK,GAAG;AACxB,YAAM,OAAO,GAAG,SAAS,UAAa,GAAG,SAAS,KAAK,GAAG,OAAO;AACjE,aACE,mFAAmF,OAAO,GAAG,MAAM,CAAC,8DACtD,IAAI,mBAAmB,IAAI;AAAA,IAG7E;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,YAAY,MAAc,WAA0C;AACxF,QAAM,eAAe,uBAAuB,SAAS;AACrD,MAAI,iBAAiB,KAAM,OAAM,IAAI,MAAM,YAAY;AAEvD,QAAM,MAAO,MAAM,OAAO,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,QAAM,UAAU,kBAAkB;AAClC,SAAO,QAAQ,WAAwB,SAAS,IAAI,IAAI,MAAM,IAAI,eAAe,SAAS,CAAC;AAC7F;;;ACzDA,IAAI;AAEJ,SAAS,kBAA8C;AACrD,MAAI,mBAAmB,OAAW,QAAO;AACzC,MAAI;AAIF,UAAM,YAAY,UAAQ,QAAa;AAGvC,qBAAiB,UAAU,mBAAmB;AAAA,EAChD,QAAQ;AACN,qBAAiB;AAAA,EACnB;AACA,SAAO;AACT;AAQO,SAAS,gBAAgB,GAAe,GAAwB;AACrE,MAAI,EAAE,aAAa,eAAe,EAAE,aAAa,aAAa;AAC5D,UAAM,IAAI;AAAA,MACR,qDAAqD,OAAO,CAAC,QAAQ,OAAO,CAAC;AAAA,IAC/E;AAAA,EACF;AAEA,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,EAAE,WAAW,EAAG,QAAO;AAK3B,QAAM,WAAW,gBAAgB;AACjC,MAAI,SAAU,QAAO,SAAS,GAAG,CAAC;AAKlC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,YAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;AAAA,EACpB;AACA,SAAO,SAAS;AAClB;;;AClDO,IAAM,yBAAyB;AAmB/B,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAI3C,YACkB,OACA,YAChB;AACA,UAAM,2CAA2C,UAAU,iBAAiB,KAAK,QAAQ;AAHzE;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EALkB;AAAA,EACA;AAAA,EALT,SAAS;AAAA,EACT,OAAO;AASlB;AAEA,eAAsB,YACpB,SACA,UAA8B,CAAC,GACP;AACxB,QAAM,eAAe,QAAQ,gBAAgB;AAK7C,QAAM,QAAQ,QAAQ,MAAM;AAK5B,MAAI,MAAM,SAAS,MAAM;AACvB,WAAO,EAAE,SAAS,IAAI,WAAW,QAAQ;AAAA,EAC3C;AAEA,QAAM,SAAS,MAAM,KAAK,UAAU;AACpC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AAEZ,MAAI;AACF,eAAS;AACP,YAAM,EAAE,OAAO,KAAK,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,eAAS,MAAM;AACf,UAAI,QAAQ,cAAc;AAGxB,aAAK,OAAO,OAAO;AACnB,cAAM,IAAI,kBAAkB,cAAc,KAAK;AAAA,MACjD;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,UAAE;AACA,QAAI;AACF,aAAO,YAAY;AAAA,IACrB,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,QAAM,QAAQ,IAAI,WAAW,KAAK;AAClC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,UAAM,IAAI,OAAO,MAAM;AACvB,cAAU,MAAM;AAAA,EAClB;AACA,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK;AAE9C,SAAO,EAAE,SAAS,WAAW,QAAQ;AACvC;;;ACtEO,SAAS,cAAc,MAA+C;AAC3E,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,cAAc,KAAK;AAAA,IACnB,gBAAgB;AAAA,EAClB;AACF;AAYA,eAAsB,gBAAgB,KAAwB,SAAqC;AACjG,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAMC,UAAS,MAAM,YAAY,SAAS,EAAE,cAAc,IAAI,aAAa,CAAC;AAC5E,cAAUA,QAAO;AACjB,gBAAYA,QAAO;AAAA,EACrB,SAAS,KAAK;AACZ,QAAI,eAAe,mBAAmB;AACpC,aAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,IAAI,MAAM,SAAS,IAAI,QAAQ,CAAC,GAAG;AAAA,QAC7E,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAChD,CAAC;AAAA,IACH;AACA,WAAO,IAAI;AAAA,MACT,KAAK,UAAU;AAAA,QACb,OAAO;AAAA,QACP,SAAS,eAAe,QAAQ,IAAI,UAAU;AAAA,MAChD,CAAC;AAAA,MACD,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AAGA,QAAM,gBAAgB,oBAAoB,QAAQ,OAAO;AACzD,QAAM,UAAU,eAAe,YAAY,wBAAwB,EAAE;AAGrE,MAAI;AACJ,MAAI;AACF,mBAAe,MAAM,IAAI,OAAO,SAAS;AAAA,EAC3C,SAAS,KAAK;AACZ,mBAAe;AAAA,MACb,IAAI;AAAA,MACJ,QAAQ,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC3E;AAAA,EACF;AAEA,MAAI,CAAC,aAAa,IAAI;AACpB,WAAO,IAAI;AAAA,MACT,KAAK,UAAU,EAAE,OAAO,yBAAyB,SAAS,aAAa,OAAO,CAAC;AAAA,MAC/E,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AAEA,QAAM,MAAsB;AAAA,IAC1B,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,QAAQ,QAAQ;AAAA,EAClB;AAEA,QAAM,SAAS,MAAM,IAAI,QAAQ,GAAG;AACpC,MAAI,kBAAkB,SAAU,QAAO;AACvC,MAAI,WAAW,UAAa,WAAW,MAAM;AAC3C,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AACA,SAAO,IAAI,SAAS,KAAK,UAAU,MAAM,GAAG;AAAA,IAC1C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;;;AC5GO,IAAM,uBAAuB;AAC7B,IAAM,sBAAsB;AAC5B,IAAM,gBAAgB;AAEtB,IAAM,kBAAkB;AACxB,IAAM,yBAAyB;;;ACQ/B,SAAS,aAAa,MAAe,aAA+C;AAEzF,MAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AACxB,UAAM,SAAmC;AAAA,MACvC,OAAO,CAAC;AAAA,MACR,SAAS,CAAC,EAAE,OAAO,MAAM,QAAQ,uBAAuB,OAAO,IAAI,GAAG,CAAC;AAAA,IACzE;AACA,gBAAY,QAAQ,WAAW;AAC/B,WAAO;AAAA,EACT;AAIA,QAAM,SAAoB;AAC1B,QAAM,QAAkB,CAAC;AACzB,QAAM,UAAgD,CAAC;AAEvD,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,QAAI,MAAM,UAAU,qBAAqB;AACvC,eAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,gBAAQ,KAAK,EAAE,OAAO,OAAO,CAAC,GAAG,QAAQ,0BAA0B,CAAC;AAAA,MACtE;AACA;AAAA,IACF;AACA,UAAM,MAAe,OAAO,CAAC;AAC7B,QAAI,OAAO,QAAQ,UAAU;AAC3B,cAAQ,KAAK,EAAE,OAAO,KAAK,QAAQ,iCAAiC,CAAC;AACrE;AAAA,IACF;AACA,QAAI,IAAI,SAAS,sBAAsB;AACrC,cAAQ,KAAK;AAAA,QACX,OAAO;AAAA,QACP,QAAQ,0BAA0B,oBAAoB;AAAA,MACxD,CAAC;AACD;AAAA,IACF;AACA,QAAI,IAAI,WAAW,aAAa,GAAG;AACjC,cAAQ,KAAK;AAAA,QACX,OAAO;AAAA,QACP,QAAQ,oBAAoB,aAAa;AAAA,MAC3C,CAAC;AACD;AAAA,IACF;AACA,UAAM,KAAK,GAAG;AAAA,EAChB;AAEA,cAAY,EAAE,OAAO,QAAQ,GAAG,WAAW;AAC3C,SAAO,EAAE,OAAO,QAAQ;AAC1B;AAOO,SAAS,eAAe,QAAiB,aAA6B;AAC3E,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,OAAO,WAAW,YAAY,OAAO,SAAS,MAAM,KAAK,UAAU,GAAG;AACxE,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AAAA,IACR,mBAAmB,KAAK,UAAU,MAAM,CAAC,QAAQ,WAAW;AAAA,EAC9D;AACF;AAMO,SAAS,eACd,QACA,YACA,aACoB;AACpB,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,GAAG;AACxE,UAAM,IAAI;AAAA,MACR,mBAAmB,KAAK,UAAU,MAAM,CAAC,QAAQ,WAAW;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,eAAe,UAAa,SAAS,YAAY;AACnD,UAAM,IAAI;AAAA,MACR,kBAAkB,MAAM,OAAO,WAAW,iDAAiD,UAAU;AAAA,IACvG;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,QAAkC,aAA2B;AAChF,MAAI,OAAO,QAAQ,WAAW,EAAG;AACjC,UAAQ,KAAK,mBAAmB,WAAW,aAAa,OAAO,QAAQ,MAAM,kBAAkB;AAC/F,aAAW,EAAE,OAAO,OAAO,KAAK,OAAO,SAAS;AAC9C,YAAQ,KAAK,OAAO,KAAK,UAAU,KAAK,CAAC,KAAK,MAAM,EAAE;AAAA,EACxD;AACF;;;AC3EO,SAAS,qBACd,QACA,IACA,MACgC;AAChC,MAAI,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,WAAW,GAAG;AAC3D,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,QAAM,SAAS,eAAe,KAAK,QAAQ,wBAAwB,KAAK,IAAI,GAAG;AAC/E,QAAM,MAAM,eAAe,KAAK,KAAK,QAAQ,wBAAwB,KAAK,IAAI,GAAG;AAEjF,QAAM,SAAS,MAAM,KAAK,IAAI;AAE9B,WAAS,eAAe,MAAqB;AAC3C,UAAM,OAAO,KAAK,SAAS,KAAK,OAAO,GAAG,IAAI,IAAI,KAAK,UAAU,IAAI;AACrE,WAAO,GAAG,MAAM,IAAI,IAAI;AAAA,EAC1B;AAEA,WAAS,YAAY,MAAuB;AAC1C,UAAM,MAAM,OAAO,KAAK,SAAS,aAAa,KAAK,KAAK,GAAG,IAAI,IAAK,KAAK,QAAQ,CAAC;AAClF,UAAM,EAAE,MAAM,IAAI,aAAa,KAAK,wBAAwB,KAAK,IAAI,GAAG;AACxE,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,UAAU,SAAgB;AACzC,UAAM,MAAM,eAAe,IAAI;AAC/B,UAAM,OAAO,YAAY,IAAI;AAC7B,QAAI;AACF,YAAM,EAAE,MAAM,IAAI,MAAM,OAAO,aAAsB,KAAK,YAAY,GAAG,GAAG,IAAI,GAAG;AAAA,QACjF;AAAA,QACA,KAAK,OAAO,SAAS;AAAA,QACrB;AAAA,QACA,cAAc,KAAK;AAAA,QACnB,WAAW,KAAK;AAAA,QAChB,UAAU,KAAK;AAAA,MACjB,CAAC;AACD,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,WAAK,UAAU,KAAK,EAAE,KAAK,CAAC;AAC5B,YAAM;AAAA,IACR;AAAA,EACF;AAEA,UAAQ,aAAa,UAAU,SAAgB;AAC7C,UAAM,MAAM,eAAe,IAAI;AAC/B,UAAM,OAAO,WAAW,GAAG;AAAA,EAC7B;AAEA,SAAO;AACT;;;AC9EA,IAAM,kBAAkB;AAWjB,SAAS,sBAAsB,OAAkC;AACtE,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,QAAkB,CAAC;AACzB,MAAI,MAAM,UAAW,OAAM,KAAK,SAAS;AACzC,QAAM,KAAK,YAAY,MAAM,MAAM,EAAE;AACrC,MAAI,MAAM,QAAQ,UAAa,MAAM,MAAM,GAAG;AAC5C,UAAM,KAAK,0BAA0B,MAAM,GAAG,EAAE;AAAA,EAClD;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;;;ACxBO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAwBA,eAAsBC,WAAU,KAAc,OAA6B,CAAC,GAAoB;AAC9F,MAAI,KAAK,QAAQ;AACf,UAAM,IAAI,MAAM,KAAK,OAAO,GAAG;AAC/B,QAAI,OAAO,MAAM,UAAU;AACzB,YAAM,IAAI,MAAM,oCAAoC,OAAO,CAAC,EAAE;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,iBAAiB,KAAK,IAAI;AAC9C,QAAM,OAAO,GAAG,KAAK,SAAS,KAAK,SAAS,MAAM,EAAE,GAAG,IAAI,QAAQ,KAAK,IAAI,SAAS,YAAY,CAAC,GAAG,IAAI,QAAQ,GAAG,cAAc,MAAM,cAAc,EAAE;AAExJ,MAAI,CAAC,KAAK,UAAU,KAAK,OAAO,WAAW,EAAG,QAAO;AACrD,QAAM,QAAkB,CAAC;AACzB,aAAW,UAAU,KAAK,QAAQ;AAChC,UAAM,KAAK,GAAG,MAAM,IAAI,IAAI,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE;AAAA,EACzD;AACA,SAAO,OAAO,OAAO,MAAM,KAAK,IAAI;AACtC;AAEA,SAAS,iBAAiB,KAAU,MAAoC;AACtE,QAAM,SAAS,IAAI,gBAAgB,IAAI,YAAY;AACnD,QAAM,UAAU,KAAK,gBAAgB;AACrC,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,OAAO,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG;AACpC,QAAI,WAAW,IAAI,GAAG,EAAG,QAAO,OAAO,GAAG;AAAA,EAC5C;AACA,MAAI,KAAK,cAAc,MAAO,QAAO,KAAK;AAC1C,SAAO,OAAO,SAAS;AACzB;;;AC7EO,IAAM,yBAAyB,KAAK,OAAO;AAClD,IAAM,iBAAiB,oBAAI,IAAI,CAAC,UAAU,YAAY,CAAC;AAuCvD,IAAM,wBAAwB,oBAAI,QAAQ;AAC1C,IAAM,2BAA2B,oBAAI,QAAQ;AAC7C,IAAM,wBAAwB,oBAAI,QAAQ;AAsBnC,SAAS,kBAMd,QACA,QACqD;AACrD,QAAM,EAAE,OAAO,SAAS,GAAG,KAAK,IAAI;AAEpC,QAAM,SAAS,eAAe,MAAM,QAAQ,mBAAmB;AAC/D,QAAM,MAAM,eAAe,MAAM,KAAK,QAAQ,mBAAmB;AACjE,MAAI,MAAM,iBAAiB,UAAa,MAAM,iBAAiB,IAAI;AACjE,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,QAAM,eAAe,MAAM,gBAAgB;AAC3C,MAAI,CAAC,OAAO,SAAS,YAAY,KAAK,eAAe,GAAG;AACtD,UAAM,IAAI;AAAA,MACR,yBAAyB,OAAO,MAAM,YAAY,CAAC;AAAA,IACrD;AAAA,EACF;AACA,QAAM,UAAU,IAAI,KAAK,MAAM,WAAW,CAAC,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACtF,QAAM,WAAW,aAAa,MAAM,QAAQ,CAAC,GAAG,mBAAmB,EAAE;AAGrE,QAAM,YAAY,MAAM,UAAU,CAAC;AACnC,QAAM,cAAc,UAAU,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;AACxD,QAAM,gBAAgB,YAAY,KAAK,CAAC,MAAM,eAAe,IAAI,CAAC,CAAC;AACnE,QAAM,aAAa,YAAY,OAAO,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;AACnE,MAAI,iBAAiB,CAAC,yBAAyB,IAAI,MAAM,GAAG;AAC1D,6BAAyB,IAAI,MAAM;AACnC,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAEA,QAAM,iBAAiB,OAAO,QAML;AAGvB,UAAM,aAAa,aAAa,IAAI,OAAO;AAE3C,QAAI,CAAC,QAAQ,IAAI,WAAW,OAAO,YAAY,CAAC,GAAG;AACjD,aAAO,wBAAwB,SAAS,GAAG;AAAA,IAC7C;AACA,QAAI,MAAM,cAAe,MAAM,MAAM,WAAW,UAAU,GAAI;AAC5D,aAAO,wBAAwB,SAAS,GAAG;AAAA,IAC7C;AACA,QAAI,WAAW,GAAG;AAChB,aAAO,wBAAwB,SAAS,GAAG;AAAA,IAC7C;AAEA,UAAM,MAAM,MAAMC,WAAU,YAAY;AAAA,MACtC,QAAQ,WAAW,WAAW,OAAO,YAAY;AAAA,MACjD,QAAQ;AAAA,MACR,QAAQ,MAAM;AAAA,IAChB,CAAC;AAGD,UAAM,SAAS,MAAM,OAAO,cAA+B,KAAK;AAAA,MAC9D,cAAc,MAAM;AAAA,IACtB,CAAC;AAGD,UAAM,gBAA+B;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,QAAQ;AACV,UAAI,OAAO,WAAW,OAAO;AAC3B,eAAO,uBAAuB,OAAO,OAAO,OAAO,QAAQ,GAAG;AAAA,MAChE;AAGA,8BAAwB,eAAe,SAAS,GAAG;AACnD,aAAO,uBAAuB,OAAO,OAAO,SAAS,QAAQ,GAAG;AAAA,IAClE;AAGA,UAAM,WAAW,MAAM,wBAAwB,SAAS,GAAG;AAC3D,WAAO,iBAAiB,eAAe,QAAQ;AAAA,EACjD;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS;AAAA,EACX;AACF;AA2BA,SAAS,qBAAqB,OAAwB,KAAgC;AACpF,QAAM,UAAU,gBAAgB,IAAI,IAAI,IAAI,WAAW,GAAG,EAAE;AAC5D,SAAO;AAAA,IACL,MAAM,KAAK,UAAU,KAAK;AAAA,IAC1B,QAAQ;AAAA,IACR,SAAS,CAAC;AAAA,IACV,UAAU,KAAK,IAAI;AAAA,IACnB,QAAQ,IAAI;AAAA,IACZ,KAAK,IAAI,OAAO,IAAI,SAAS;AAAA,IAC7B,MAAM,CAAC,GAAG,IAAI,UAAU,OAAO;AAAA,IAC/B,cAAc,IAAI,MAAM;AAAA,EAC1B;AACF;AAEA,eAAe,iBAAiB,KAAoB,UAAuC;AACzF,QAAM,kBAAkB,MAAM;AAAA,IAC5B;AAAA,IACA,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,IAAI;AAAA,EACN;AACA,MAAI,CAAC,iBAAiB;AAEpB,WAAO;AAAA,EACT;AACA,QAAM,IAAI,OAAO,IAAI,IAAI,KAAK,qBAAqB,iBAAiB,GAAG,CAAC;AACxE,SAAO,uBAAuB,iBAAiB,QAAQ,IAAI,QAAQ,IAAI,GAAG;AAC5E;AAEA,SAAS,wBACP,KACA,SACA,YACM;AACN,QAAM,YAAY;AAChB,QAAI;AACF,YAAM,WAAW,MAAM,wBAAwB,SAAS,UAAU;AAClE,YAAM,SAAS,MAAM,iBAAiB,UAAU,IAAI,OAAO,IAAI,aAAa,IAAI,YAAY;AAC5F,UAAI,CAAC,OAAQ;AACb,YAAM,IAAI,OAAO,IAAI,IAAI,KAAK,qBAAqB,QAAQ,GAAG,CAAC;AAAA,IACjE,QAAQ;AAAA,IAER;AAAA,EACF,GAAG;AACL;AAmBA,SAAS,aAAa,KAAyC;AAE7D,MAAI,OAAQ,IAAgB,UAAU,cAAe,IAAgB,mBAAmB,SAAS;AAC/F,WAAO;AAAA,EACT;AACA,QAAM,OAAO;AACb,QAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,WAAW,KAAK,QAAQ,OAAO,SAAS;AACnF,QAAM,WAAW,KAAK,QAAQ,YAAY,UAAU;AACpD,QAAM,OAAO,KAAK,OAAO;AACzB,QAAM,MAAM,KAAK,WAAW,MAAM,IAAI,OAAO,GAAG,QAAQ,MAAM,IAAI,GAAG,IAAI;AACzE,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AACjD,QAAI,MAAM,QAAQ,CAAC,GAAG;AACpB,iBAAW,QAAQ,EAAG,SAAQ,OAAO,GAAG,IAAI;AAAA,IAC9C,WAAW,OAAO,MAAM,UAAU;AAChC,cAAQ,IAAI,GAAG,CAAC;AAAA,IAClB;AAAA,EACF;AACA,SAAO,IAAI,QAAQ,KAAK;AAAA,IACtB,SAAS,KAAK,UAAU,OAAO,YAAY;AAAA,IAC3C;AAAA,EACF,CAAC;AACH;AAEA,eAAe,wBACb,SACA,KACmB;AACnB,QAAM,MAAM,MAAM,QAAQ,GAAG;AAC7B,MAAI,eAAe,SAAU,QAAO;AACpC,SAAO,SAAS,KAAK,GAAG;AAC1B;AAMA,eAAe,iBACb,UACA,OACA,aACA,cACsC;AAEtC,MAAI,SAAS,QAAQ,IAAI,YAAY,GAAG;AACtC,QAAI,CAAC,sBAAsB,IAAI,WAAW,GAAG;AAC3C,4BAAsB,IAAI,WAAW;AACrC,cAAQ,KAAK,0EAAqE;AAAA,IACpF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC5D,MAAI,YAAY,SAAS,mBAAmB,EAAG,QAAO;AAMtD,MAAI,SAAS,QAAQ,IAAI,mBAAmB,GAAG,YAAY,MAAM,WAAW;AAC1E,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,UAAU,OAAO,CAAC,MAAM,YAAa,QAAO;AAEzD,MAAI,MAAM,aAAa,CAAC,MAAM,UAAU,QAAQ,EAAG,QAAO;AAG1D,QAAM,OAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAGzC,MAAI,KAAK,SAAS,cAAc;AAC9B,QAAI,CAAC,sBAAsB,IAAI,WAAW,GAAG;AAC3C,4BAAsB,IAAI,WAAW;AACrC,cAAQ;AAAA,QACN,iCAAiC,KAAK,MAAM,+BAA+B,YAAY;AAAA,MACzF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,UAA8B,CAAC;AACrC,WAAS,QAAQ,QAAQ,CAAC,GAAG,MAAM;AACjC,QAAI,EAAE,YAAY,MAAM,aAAc;AACtC,YAAQ,KAAK,CAAC,GAAG,CAAC,CAAC;AAAA,EACrB,CAAC;AACD,SAAO,EAAE,MAAM,MAAM,QAAQ,SAAS,QAAQ,QAAQ;AACxD;AAEA,SAAS,uBACP,OACA,QACA,QACA,KACU;AACV,QAAM,UAAU,IAAI,QAAQ,MAAM,OAAO;AACzC,MAAI,CAAC,QAAQ,IAAI,eAAe,GAAG;AACjC,YAAQ,IAAI,iBAAiB,sBAAsB,EAAE,QAAQ,KAAK,OAAO,SAAS,GAAG,CAAC,CAAC;AAAA,EACzF;AACA,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,QAAI,oBAA8C;AAClD,QAAI,WAAW,MAAO,qBAAoB;AAAA,aACjC,WAAW,QAAS,qBAAoB;AACjD,YAAQ,IAAI,gBAAgB,iBAAiB;AAAA,EAC/C;AACA,SAAO,IAAI,SAAS,MAAM,MAAM,EAAE,QAAQ,MAAM,QAAQ,QAAQ,CAAC;AACnE;;;ACnSO,SAAS,kBAAkB,MAAuC;AACvE,QAAM,EAAE,SAAS,QAAQ,IAAI;AAC7B,QAAM,WAAW,oBAAI,IAA8B;AACnD,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,wBAAwB,oBAAI,IAAY;AAE9C,iBAAe,aACb,KACA,IACA,SAC4C;AAE5C,UAAM,UAAU,SAAS,IAAI,GAAG;AAChC,QAAI,SAAS;AACX,YAAM,QAAS,MAAM;AACrB,aAAO,EAAE,OAAO,QAAQ,OAAO;AAAA,IACjC;AAGA,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO;AAAA,QAAY;AAAA,QAAK;AAAA,QAAI;AAAA;AAAA,QAAyB;AAAA,MAAI;AAAA,IAC3D;AAGA,WAAO,YAAY,KAAK,IAAI,SAAS,KAAK;AAAA,EAC5C;AAMA,WAAS,YACP,KACA,IACA,SACA,WAC4C;AAC5C,QAAI;AACJ,QAAI;AACJ,UAAM,eAAe,IAAI,QAAW,CAACC,UAAS,WAAW;AACvD,qBAAeA;AACf,oBAAc;AAAA,IAChB,CAAC;AAED,SAAK,aAAa,MAAM,MAAM;AAAA,IAE9B,CAAC;AACD,aAAS,IAAI,KAAK,YAAY;AAE9B,UAAM,QAAQ,YAAwD;AACpE,UAAI;AACF,YAAI,CAAC,WAAW;AACd,gBAAM,SAAS,MAAM,cAAiB,KAAK,OAAO;AAClD,cAAI,QAAQ;AAEV,yBAAa,OAAO,KAAK;AACzB,gBAAI,OAAO,WAAW,SAAS;AAC7B,2CAA6B,KAAK,IAAI,OAAO;AAAA,YAC/C;AACA,mBAAO;AAAA,UACT;AAAA,QACF;AAEA,cAAM,QAAQ,MAAM,UAAU,KAAK,IAAI,SAAS,SAAS;AACzD,qBAAa,KAAK;AAClB,eAAO,EAAE,OAAO,QAAQ,OAAgB;AAAA,MAC1C,SAAS,KAAK;AACZ,oBAAY,GAAG;AACf,cAAM;AAAA,MACR,UAAE;AACA,iBAAS,OAAO,GAAG;AAAA,MACrB;AAAA,IACF,GAAG;AAEH,WAAO;AAAA,EACT;AAMA,iBAAe,cACb,KACA,SACwD;AACxD,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,QAAQ,IAAI,GAAG;AAAA,IAC/B,SAAS,KAAK;AACZ,gBAAU,KAAK,EAAE,OAAO,OAAO,IAAI,CAAC;AACpC,aAAO;AAAA,IACT;AACA,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,QAAQ,iBAAiB,UAAa,MAAM,iBAAiB,QAAQ,cAAc;AACrF,aAAO;AAAA,IACT;AACA,QAAI,OAAO,MAAM,SAAS,SAAU,QAAO;AAC3C,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,MAAM,IAAI;AAAA,IAChC,SAAS,KAAK;AACZ,gBAAU,KAAK,EAAE,OAAO,OAAO,IAAI,CAAC;AACpC,aAAO;AAAA,IACT;AAEA,QAAI,QAAQ,UAAU;AACpB,UAAI;AACF,YAAI,CAAC,QAAQ,SAAS,MAAM,EAAG,QAAO;AAAA,MACxC,SAAS,KAAK;AACZ,kBAAU,KAAK,EAAE,OAAO,OAAO,IAAI,CAAC;AACpC,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,YAAY,GAAI;AAC5D,QAAI,OAAO,MAAM,QAAQ;AACvB,YAAM,QAAQ,QAAQ,YAAY,QAAQ,UAAU,MAAM,IAAI;AAC9D,aAAO,EAAE,OAAO,QAAQ,MAAM;AAAA,IAChC;AACA,QAAI,OAAO,MAAM,SAAS,MAAM,KAAK;AACnC,YAAM,QAAQ,QAAQ,YAAY,QAAQ,UAAU,MAAM,IAAI;AAC9D,aAAO,EAAE,OAAO,QAAQ,QAAQ;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AAKA,iBAAe,UACb,KACA,IACA,SACA,YAAY,OACA;AACZ,UAAM,MAAM,MAAM,GAAG;AACrB,UAAM,QAAQ,QAAQ,YAAY,QAAQ,UAAU,GAAG,IAAI;AAE3D,QAAI,UAAW,QAAO;AAGtB,QAAI,QAAQ,gBAAgB,KAAK,EAAG,QAAO;AAG3C,QAAI,QAAQ,UAAU;AACpB,UAAI,UAAU;AACd,UAAI;AACF,kBAAU,QAAQ,SAAS,KAAK;AAAA,MAClC,SAAS,KAAK;AACZ,kBAAU,KAAK,EAAE,OAAO,OAAO,IAAI,CAAC;AACpC,eAAO;AAAA,MACT;AACA,UAAI,CAAC,QAAS,QAAO;AAAA,IACvB;AAGA,QAAI,UAAU,QAAW;AACvB,UAAI,CAAC,sBAAsB,IAAI,GAAG,GAAG;AACnC,8BAAsB,IAAI,GAAG;AAC7B,gBAAQ,KAAK,sDAAsD,GAAG,qBAAqB;AAAA,MAC7F;AACA,aAAO;AAAA,IACT;AAEA,QAAI;AACF,YAAM,QAAoB;AAAA,QACxB,MAAM,KAAK,UAAU,KAAK;AAAA,QAC1B,QAAQ;AAAA,QACR,SAAS,CAAC;AAAA,QACV,UAAU,KAAK,IAAI;AAAA,QACnB,QAAQ,QAAQ;AAAA,QAChB,KAAK,QAAQ,OAAO;AAAA,QACpB,MAAM,QAAQ,QAAQ,CAAC;AAAA,QACvB,cAAc,QAAQ;AAAA,MACxB;AACA,YAAM,QAAQ,IAAI,KAAK,KAAK;AAAA,IAC9B,SAAS,KAAK;AACZ,gBAAU,KAAK,EAAE,OAAO,OAAO,IAAI,CAAC;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAEA,WAAS,6BACP,KACA,IACA,SACM;AACN,QAAI,WAAW,IAAI,GAAG,EAAG;AACzB,eAAW,IAAI,GAAG;AAClB,SAAK,UAAU,KAAK,IAAI,OAAO,EAC5B,MAAM,CAAC,QAAiB;AACvB,gBAAU,KAAK,EAAE,OAAO,cAAc,IAAI,CAAC;AAAA,IAC7C,CAAC,EACA,QAAQ,MAAM;AACb,iBAAW,OAAO,GAAG;AAAA,IACvB,CAAC;AAAA,EACL;AAEA,SAAO;AAAA,IACL;AAAA,IAEA;AAAA,IAEA,MAAM,cACJ,KACAC,OAC4D;AAI5D,YAAM,SAAS,MAAM,cAAiB,KAAK;AAAA,QACzC,GAAGA;AAAA,QACH,QAAQ;AAAA;AAAA,MACV,CAAC;AACD,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,KAAK,OAAO;AACpB,YAAM,QAAQ,IAAI,KAAK,KAAK;AAAA,IAC9B;AAAA,IAEA,MAAM,WAAW,KAAK;AAEpB,eAAS,OAAO,GAAG;AACnB,aAAO,QAAQ,OAAO,GAAG;AAAA,IAC3B;AAAA,IAEA,MAAM,cAAc,KAAK;AACvB,aAAO,QAAQ,YAAY,GAAG;AAAA,IAChC;AAAA,IAEA,MAAM,eAAe,MAAM,MAAM;AAC/B,YAAM,MAAM,gBAAgB,QAAQ,OAAO,MAAM,OAAO;AACxD,aAAO,QAAQ,YAAY,GAAG;AAAA,IAChC;AAAA,EACF;AACF;;;ACzSO,IAAM,uBAAN,MAA0D;AAAA,EACtD,OAAO;AAAA,EACP,WAAW,oBAAI,IAAwB;AAAA,EACvC,YAAY,oBAAI,IAAyB;AAAA,EACzC;AAAA,EAET,YAAY,OAAoC,CAAC,GAAG;AAClD,SAAK,cAAc,KAAK,cAAc;AAAA,EACxC;AAAA,EAEA,MAAM,IAAI,KAA8C;AACtD,UAAM,QAAQ,KAAK,SAAS,IAAI,GAAG;AACnC,QAAI,UAAU,OAAW,QAAO;AAEhC,SAAK,SAAS,OAAO,GAAG;AACxB,SAAK,SAAS,IAAI,KAAK,KAAK;AAC5B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,IAAI,KAAa,OAAkC;AAEvD,UAAM,WAAW,KAAK,SAAS,IAAI,GAAG;AACtC,QAAI,UAAU;AACZ,WAAK,uBAAuB,KAAK,SAAS,IAAI;AAC9C,WAAK,SAAS,OAAO,GAAG;AAAA,IAC1B,WAAW,KAAK,SAAS,QAAQ,KAAK,aAAa;AAEjD,YAAM,aAAa,KAAK,SAAS,KAAK,EAAE,KAAK;AAC7C,UAAI,CAAC,WAAW,MAAM;AACpB,cAAM,YAAY,WAAW;AAC7B,cAAM,cAAc,KAAK,SAAS,IAAI,SAAS;AAC/C,YAAI,aAAa;AACf,eAAK,uBAAuB,WAAW,YAAY,IAAI;AAAA,QACzD;AACA,aAAK,SAAS,OAAO,SAAS;AAAA,MAChC;AAAA,IACF;AACA,SAAK,SAAS,IAAI,KAAK,KAAK;AAC5B,eAAW,OAAO,MAAM,MAAM;AAC5B,UAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AACnC,UAAI,CAAC,QAAQ;AACX,iBAAS,oBAAI,IAAI;AACjB,aAAK,UAAU,IAAI,KAAK,MAAM;AAAA,MAChC;AACA,aAAO,IAAI,GAAG;AAAA,IAChB;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,KAA+B;AAC1C,UAAM,QAAQ,KAAK,SAAS,IAAI,GAAG;AACnC,QAAI,CAAC,MAAO,QAAO;AACnB,SAAK,uBAAuB,KAAK,MAAM,IAAI;AAC3C,SAAK,SAAS,OAAO,GAAG;AACxB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,KAA8B;AAC9C,UAAM,SAAS,KAAK,UAAU,IAAI,GAAG;AACrC,QAAI,CAAC,UAAU,OAAO,SAAS,EAAG,QAAO;AACzC,UAAM,OAAO,CAAC,GAAG,MAAM;AACvB,eAAW,OAAO,MAAM;AACtB,YAAM,QAAQ,KAAK,SAAS,IAAI,GAAG;AACnC,UAAI,OAAO;AACT,aAAK,sBAAsB,KAAK,MAAM,MAAM,GAAG;AAAA,MACjD;AACA,WAAK,SAAS,OAAO,GAAG;AAAA,IAC1B;AACA,SAAK,UAAU,OAAO,GAAG;AACzB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,OAAwB;AAC5B,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA,EAEA,MAAM,QAAuB;AAC3B,SAAK,SAAS,MAAM;AACpB,SAAK,UAAU,MAAM;AAAA,EACvB;AAAA,EAEA,OAAO,KAAK,QAAgD;AAC1D,eAAW,OAAO,KAAK,SAAS,KAAK,GAAG;AACtC,UAAI,UAAU,CAAC,IAAI,WAAW,MAAM,EAAG;AACvC,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,uBAAuB,KAAa,MAAsB;AACxD,eAAW,OAAO,MAAM;AACtB,YAAM,SAAS,KAAK,UAAU,IAAI,GAAG;AACrC,UAAI,CAAC,OAAQ;AACb,aAAO,OAAO,GAAG;AACjB,UAAI,OAAO,SAAS,EAAG,MAAK,UAAU,OAAO,GAAG;AAAA,IAClD;AAAA,EACF;AAAA,EAEA,sBAAsB,KAAa,MAAgB,SAAuB;AACxE,eAAW,YAAY,MAAM;AAC3B,UAAI,aAAa,QAAS;AAC1B,YAAM,cAAc,KAAK,UAAU,IAAI,QAAQ;AAC/C,UAAI,CAAC,YAAa;AAClB,kBAAY,OAAO,GAAG;AACtB,UAAI,YAAY,SAAS,EAAG,MAAK,UAAU,OAAO,QAAQ;AAAA,IAC5D;AAAA,EACF;AACF;;;AChHA,IAAI;AAMG,SAAS,gBACd,QACA,QAA6C,CAAC,GACjC;AACb,MAAI,SAAS;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,UACJ,OAAO,YAAY,WACf,IAAI,qBAAqB,EAAE,YAAY,OAAO,WAAW,CAAC,IAC1D,OAAO;AACb,YAAU,kBAAkB;AAAA,IAC1B,SAAS;AAAA,IACT,UAAU,OAAO;AAAA,IACjB,SAAS,MAAM;AAAA,EACjB,CAAC;AACD,SAAO;AACT;AAOO,SAAS,iBAA8B;AAC5C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,oBAA0B;AACxC,YAAU;AACZ;;;ACtDA,eAAsB,cACpB,KACA,MAC2B;AAC3B,MAAI,MAAM,WAAW,UAAa,KAAK,SAAS,GAAG;AACjD,IAAAC;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,EAAE,MAAM,IAAI,aAAa,CAAC,GAAG,GAAG,eAAe;AACrD,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,SAAS,EAAE;AAC5C,QAAM,SAAS,eAAe;AAC9B,QAAM,UAAU,MAAM,OAAO,cAAc,MAAM,CAAC,CAAC;AACnD,SAAO,EAAE,QAAQ;AACnB;AAOA,eAAsB,UAAU,KAAwC;AACtE,QAAM,EAAE,MAAM,IAAI,aAAa,CAAC,GAAG,GAAG,WAAW;AACjD,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,SAAS,EAAE;AAC5C,QAAM,SAAS,eAAe;AAC9B,QAAM,UAAU,MAAM,OAAO,cAAc,MAAM,CAAC,CAAC;AACnD,SAAO,EAAE,QAAQ;AACnB;AAMA,eAAsB,eACpB,MACA,MAC2B;AAC3B,MAAI,MAAM,WAAW,UAAa,KAAK,SAAS,GAAG;AACjD,IAAAA;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,eAAe;AAC9B,QAAM,UAAU,MAAM,OAAO,eAAe,MAAM,MAAM,IAAI;AAC5D,SAAO,EAAE,QAAQ;AACnB;AAEA,IAAM,aAAa,oBAAI,IAAY;AACnC,SAASA,UAAS,KAAa,SAAuB;AACpD,MAAI,WAAW,IAAI,GAAG,EAAG;AACzB,aAAW,IAAI,GAAG;AAClB,UAAQ,KAAK,OAAO;AACtB;;;ACpEA,OAAO,eAAe;AAuBf,SAAS,kBAAkB,OAAwC;AACxE,SAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO;AAAA,IACrD,SAAS,UAAU,SAAS,EAAE,KAAK,KAAK,CAAC;AAAA,IACzC;AAAA,IACA;AAAA,EACF,EAAE;AACJ;AAKO,SAAS,iBACd,MACA,UACuB;AACvB,aAAW,KAAK,UAAU;AACxB,QAAI,EAAE,QAAQ,IAAI,EAAG,QAAO,EAAE;AAAA,EAChC;AACA,SAAO;AACT;;;AC1CA,OAAO,eAAe;AAUf,SAAS,kBAAkB,MAAmC;AACnE,SAAO,UAAU,UAAU,IAAI;AACjC;AAKO,SAAS,oBAAoB,YAAyC;AAC3E,SAAO,UAAU,YAAY,UAAyD;AACxF;;;ACgDO,SAAS,aAAa,QAAgC;AAC3D,SAAO;AACT;","names":["existsSync","readFileSync","statSync","resolve","event","result","deriveKey","deriveKey","resolve","opts","warnOnce"]}