theokit 0.2.4 → 0.4.0

package/dist/chunk-WGHJD6I7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vite-plugin/openapi-emit/emit.ts","../src/vite-plugin/openapi-emit/zod-to-openapi.ts","../src/vite-plugin/openapi-emit/load-routes.ts"],"sourcesContent":["/**\n * In-house `emitOpenApi()` orchestrator (build-time only).\n *\n * Pure transformation: takes a route manifest (already hydrated with Zod\n * schemas extracted from `defineRoute()` config) + the openapi config\n * block, builds an OpenAPI 3.x document, writes `<outDir>/openapi.json`,\n * returns the document for downstream callers (CLI logs, tests).\n *\n * Per G2 plan v1.1 T2.1. Modelled on trpc-openapi's\n * `generateOpenApiDocument` + encore's `Generator.Generate()`.\n *\n * NEVER ship to runtime — devDep-shaped artifact.\n *\n * Path templating: TheoKit's `:param` syntax is converted to OpenAPI's\n * `{param}` per the spec. Env-var override: `THEOKIT_OPENAPI_SERVER_URL`\n * overrides `servers[0].url` without rebuilding the config.\n */\n/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time emit. outDir is a config-controlled relative path. The\n * caller already refused absolute paths via theoConfigSchema.distDir\n * pattern; the openapi.outDir field follows the same convention.\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { join } from 'node:path'\n\nimport type { z } from 'zod'\n\nimport { zodToOpenApiSchema, type ConvertCtx, type OpenApiSchema } from './zod-to-openapi.js'\n\nexport interface OpenApiManifestRoute {\n  /** TheoKit-style path with `:param` placeholders (`/users/:id`). */\n  routePath: string\n  /** Uppercase HTTP methods the route exports (`['GET','POST']`). */\n  methods: string[]\n  /** Optional `defineRoute({body})` schema. */\n  body?: z.ZodType\n  /** Optional `defineRoute({query})` schema. */\n  query?: z.ZodType\n  /** Optional `defineRoute({params})` schema. */\n  params?: z.ZodType\n  /** Optional `defineRoute({response})` schema. */\n  response?: z.ZodType\n}\n\nexport interface OpenApiEmitConfig {\n  servers: { url: string; description?: string }[]\n  specVersion: '3.1.0' | '3.0.3'\n  title: string\n  version: string\n  outDir: string\n}\n\nexport interface OpenApiOperation {\n  operationId?: string\n  parameters?: OpenApiParameter[]\n  requestBody?: {\n    required?: boolean\n    content: Record<string, { schema: OpenApiSchema }>\n  }\n  responses: Record<\n    string,\n    { description: string; content?: Record<string, { schema: OpenApiSchema }> }\n  >\n}\n\nexport interface OpenApiParameter {\n  name: string\n  in: 'path' | 'query' | 'header' | 'cookie'\n  required: boolean\n  schema: OpenApiSchema\n  description?: string\n}\n\nexport type OpenApiPathItem = Partial<\n  Record<'get' | 'post' | 'put' | 'patch' | 'delete' | 'head' | 'options', OpenApiOperation>\n>\n\nexport interface OpenApiDocument {\n  openapi: '3.1.0' | '3.0.3'\n  info: { title: string; version: string }\n  servers: { url: string; description?: string }[]\n  paths: Record<string, OpenApiPathItem>\n  components?: { schemas?: Record<string, OpenApiSchema> }\n}\n\nexport interface EmitOpenApiInput {\n  manifest: OpenApiManifestRoute[]\n  config: OpenApiEmitConfig\n}\n\nexport interface EmitOpenApiResult {\n  document: OpenApiDocument\n  path: string\n}\n\nconst METHOD_TO_KEY: Record<string, keyof OpenApiPathItem> = {\n  GET: 'get',\n  POST: 'post',\n  PUT: 'put',\n  PATCH: 'patch',\n  DELETE: 'delete',\n  HEAD: 'head',\n  OPTIONS: 'options',\n}\n\n/** Convert `/users/:id/posts/:postId?` → `/users/{id}/posts/{postId}`. */\nexport function templatePath(routePath: string): string {\n  // Bounded quantifier (\\w{0,64}) is OSS-safe — TheoKit route param names\n  // never exceed 64 chars in practice; cap prevents super-linear backtracking.\n  return routePath.replace(/:([A-Za-z_]\\w{0,64})\\??/g, '{$1}')\n}\n\nfunction buildParameters(\n  paramsSchema: z.ZodType | undefined,\n  querySchema: z.ZodType | undefined,\n  ctx: ConvertCtx,\n): OpenApiParameter[] {\n  const out: OpenApiParameter[] = []\n  if (paramsSchema !== undefined) {\n    appendObjectAsParameters(paramsSchema, 'path', out, ctx)\n  }\n  if (querySchema !== undefined) {\n    appendObjectAsParameters(querySchema, 'query', out, ctx)\n  }\n  return out\n}\n\nfunction appendObjectAsParameters(\n  schema: z.ZodType,\n  location: 'path' | 'query',\n  out: OpenApiParameter[],\n  ctx: ConvertCtx,\n): void {\n  // We expect an object schema; if it's not, skip silently (caller already\n  // validated upstream when scanning defineRoute()).\n  const shape = (schema as unknown as { shape?: Record<string, z.ZodType> }).shape\n  if (shape === undefined) return\n  for (const [name, child] of Object.entries(shape)) {\n    const childDef = (child as unknown as { _def: { typeName?: string } })._def\n    const optional = childDef.typeName === 'ZodOptional' || childDef.typeName === 'ZodDefault'\n    out.push({\n      name,\n      in: location,\n      required: location === 'path' ? true : !optional,\n      schema: zodToOpenApiSchema(child, { ctx }),\n    })\n  }\n}\n\nfunction buildOperation(\n  route: OpenApiManifestRoute,\n  ctx: ConvertCtx,\n  method: string,\n): OpenApiOperation {\n  // Bounded sanitizer: two single-pass replacements (no nested quantifiers).\n  const sanitized = route.routePath.replace(/[/:\\-{}]/g, '_').replace(/_+/g, '_')\n  const operationId = `${method.toLowerCase()}_${sanitized.replace(/^_|_$/g, '')}`\n  const op: OpenApiOperation = {\n    operationId,\n    responses: {\n      '200': { description: 'OK' },\n    },\n  }\n\n  const parameters = buildParameters(route.params, route.query, ctx)\n  if (parameters.length > 0) op.parameters = parameters\n\n  // Body only meaningful for write methods; we still attach if defined so\n  // the document is honest about the contract.\n  if (route.body !== undefined) {\n    op.requestBody = {\n      required: true,\n      content: {\n        'application/json': { schema: zodToOpenApiSchema(route.body, { ctx }) },\n      },\n    }\n  }\n\n  if (route.response !== undefined) {\n    op.responses['200'] = {\n      description: 'OK',\n      content: {\n        'application/json': { schema: zodToOpenApiSchema(route.response, { ctx }) },\n      },\n    }\n  }\n\n  return op\n}\n\nexport function emitOpenApi(input: EmitOpenApiInput): EmitOpenApiResult {\n  const { manifest, config } = input\n\n  const ctx: ConvertCtx = { seen: new Map(), components: {} }\n\n  const paths: Record<string, OpenApiPathItem> = {}\n  for (const route of manifest) {\n    const templatedPath = templatePath(route.routePath)\n    const item: OpenApiPathItem = paths[templatedPath] ?? {}\n    for (const method of route.methods) {\n      // Defensive: manifest emitter normalizes to uppercase, but if a\n      // future scanner produces a non-HTTP verb the key lookup yields\n      // undefined and we skip silently. TS narrows the indexed type to\n      // keyof OpenApiPathItem; the runtime undefined check is honest.\n      const key = METHOD_TO_KEY[method.toUpperCase()] as keyof OpenApiPathItem | undefined\n      if (key === undefined) continue\n      item[key] = buildOperation(route, ctx, method)\n    }\n    paths[templatedPath] = item\n  }\n\n  const servers = applyServerOverride(config.servers)\n\n  const document: OpenApiDocument = {\n    openapi: config.specVersion,\n    info: { title: config.title, version: config.version },\n    servers,\n    paths,\n  }\n\n  if (Object.keys(ctx.components).length > 0) {\n    document.components = { schemas: ctx.components }\n  }\n\n  mkdirSync(config.outDir, { recursive: true })\n  const outPath = join(config.outDir, 'openapi.json')\n  writeFileSync(outPath, `${JSON.stringify(document, null, 2)}\\n`, 'utf8')\n\n  return { document, path: outPath }\n}\n\nfunction applyServerOverride(\n  servers: { url: string; description?: string }[],\n): { url: string; description?: string }[] {\n  const override = process.env.THEOKIT_OPENAPI_SERVER_URL\n  if (override === undefined || override === '') return servers\n  if (servers.length === 0) return [{ url: override }]\n  const [first, ...rest] = servers\n  return [\n    {\n      url: override,\n      ...(first.description !== undefined ? { description: first.description } : {}),\n    },\n    ...rest,\n  ]\n}\n","/**\n * Zod → OpenAPI 3.0 Schema converter (build-time only).\n *\n * Uses Zod v4's native `z.toJSONSchema()` and post-processes\n * the JSON Schema output into OpenAPI 3.0 format:\n *   - Removes `$schema` (invalid in OpenAPI 3.0)\n *   - Converts `type: [\"string\", \"null\"]` → `{ type: \"string\", nullable: true }`\n *   - Recursively normalizes nested schemas\n *\n * NEVER ship to runtime — devDep-shaped artifact.\n */\nimport { z } from 'zod'\n\nexport interface OpenApiSchema {\n  type?: 'string' | 'number' | 'integer' | 'boolean' | 'array' | 'object' | 'null'\n  format?: string\n  items?: OpenApiSchema\n  properties?: Record<string, OpenApiSchema>\n  required?: string[]\n  additionalProperties?: boolean | OpenApiSchema\n  oneOf?: OpenApiSchema[]\n  anyOf?: OpenApiSchema[]\n  allOf?: OpenApiSchema[]\n  discriminator?: { propertyName: string; mapping?: Record<string, string> }\n  enum?: unknown[]\n  nullable?: boolean\n  description?: string\n  default?: unknown\n  $ref?: string\n}\n\nexport interface ConvertCtx {\n  seen: Map<z.ZodType, string>\n  components: Record<string, OpenApiSchema>\n}\n\nexport interface ConvertOptions {\n  ctx?: ConvertCtx\n  name?: string\n}\n\nexport class ZodToOpenApiError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'ZodToOpenApiError'\n  }\n}\n\nexport function zodToOpenApiSchema(schema: z.ZodType, options: ConvertOptions = {}): OpenApiSchema {\n  const ctx: ConvertCtx = options.ctx ?? { seen: new Map(), components: {} }\n\n  const name = options.name\n  if (name !== undefined) {\n    if (Object.prototype.hasOwnProperty.call(ctx.components, name)) {\n      return { $ref: `#/components/schemas/${name}` }\n    }\n    ctx.seen.set(schema, name)\n    ctx.components[name] = {}\n    const body = convertSchema(schema, ctx)\n    ctx.components[name] = body\n    return { $ref: `#/components/schemas/${name}` }\n  }\n\n  return convertSchema(schema, ctx)\n}\n\nfunction convertSchema(schema: z.ZodType, ctx: ConvertCtx): OpenApiSchema {\n  const existing = ctx.seen.get(schema)\n  if (existing !== undefined) {\n    return { $ref: `#/components/schemas/${existing}` }\n  }\n\n  try {\n    const jsonSchema = z.toJSONSchema(schema) as Record<string, unknown>\n    return toOpenApi3(jsonSchema)\n  } catch {\n    return {}\n  }\n}\n\n/**\n * Post-process JSON Schema (draft-2020-12) → OpenAPI 3.0.\n * Handles:\n *   - $schema removal\n *   - nullable conversion\n *   - Recursive normalization of properties/items/anyOf/oneOf/allOf\n */\nfunction toOpenApi3(js: Record<string, unknown>): OpenApiSchema {\n  const { $schema: _, $defs: _defs, ...rest } = js\n  const out: Record<string, unknown> = {}\n\n  for (const [key, value] of Object.entries(rest)) {\n    if (key === 'type' && Array.isArray(value)) {\n      const types = value as string[]\n      const hasNull = types.includes('null')\n      const nonNull = types.filter((t: string) => t !== 'null')\n      out.type = nonNull.length === 1 ? nonNull[0] : nonNull\n      if (hasNull) out.nullable = true\n    } else if (key === 'properties' && value && typeof value === 'object') {\n      const props: Record<string, OpenApiSchema> = {}\n      for (const [pk, pv] of Object.entries(value as Record<string, unknown>)) {\n        props[pk] = pv && typeof pv === 'object' ? toOpenApi3(pv as Record<string, unknown>) : (pv as OpenApiSchema)\n      }\n      out.properties = props\n    } else if (key === 'items' && value && typeof value === 'object') {\n      out.items = toOpenApi3(value as Record<string, unknown>)\n    } else if ((key === 'anyOf' || key === 'oneOf' || key === 'allOf') && Array.isArray(value)) {\n      out[key] = (value as Record<string, unknown>[]).map((v) => toOpenApi3(v))\n    } else if (key === 'additionalProperties' && value && typeof value === 'object') {\n      out.additionalProperties = toOpenApi3(value as Record<string, unknown>)\n    } else {\n      out[key] = value\n    }\n  }\n\n  return out as OpenApiSchema\n}\n","/**\n * Build-time route loader for OpenAPI emit.\n *\n * Takes the G1 manifest (filePath + routePath + methods) and hydrates each\n * route's Zod schemas by dynamically importing the module. `defineRoute`\n * is an identity function, so the imported config exposes `body/query/\n * params/response` directly without any AST gymnastics.\n *\n * Supports both export shapes:\n *   1. `export const POST = defineRoute({...})` (per-method named exports)\n *   2. `export default defineRoute({...})` (single-export legacy shape)\n *\n * Per G2 plan v1.1 T2.2. Uses Vite's `ssrLoadModule` because route files\n * are TS at build time — Node's native loader doesn't transpile.\n */\nimport { resolve } from 'node:path'\n\nimport type { z } from 'zod'\n\nimport type { ManifestRoute } from '../../server/scan/manifest.js'\n\nimport type { OpenApiManifestRoute } from './emit.js'\n\ninterface RouteConfigShape {\n  body?: z.ZodType\n  query?: z.ZodType\n  params?: z.ZodType\n  response?: z.ZodType\n}\n\ninterface ViteLikeServer {\n  ssrLoadModule: (id: string) => Promise<Record<string, unknown>>\n  close: () => Promise<void>\n}\n\ninterface DefaultLoader {\n  load: (absPath: string) => Promise<Record<string, unknown>>\n  dispose: () => Promise<void>\n}\n\n/** Method names recognized as per-route named exports (UPPERCASE). */\nconst HTTP_METHOD_KEYS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'] as const\n\nexport interface LoadRoutesOptions {\n  serverDir: string\n  routes: ManifestRoute[]\n  /** Injectable for tests; defaults to a fresh Vite SSR dev server. */\n  loadModule?: (absPath: string) => Promise<Record<string, unknown>>\n}\n\n/**\n * Hydrate manifest routes with Zod schemas extracted from their modules.\n *\n * Returns one `OpenApiManifestRoute` per (file × method) tuple. If a route\n * file declares multiple methods (`GET` + `POST`), each method gets its\n * own entry with the schemas from that method's `defineRoute()` call.\n *\n * Routes that fail to load are skipped with a console warning — the emit\n * should be best-effort, not a hard build failure.\n *\n * The default Vite loader is created once per call and disposed in the\n * `finally` block so the underlying server is released even when route\n * loading throws.\n */\nexport async function loadRoutesForOpenApi(\n  options: LoadRoutesOptions,\n): Promise<OpenApiManifestRoute[]> {\n  const { serverDir, routes } = options\n  let loadModule = options.loadModule\n  let dispose: (() => Promise<void>) | undefined\n  if (loadModule === undefined) {\n    const created = await createDefaultLoader(serverDir)\n    loadModule = created.load\n    dispose = created.dispose\n  }\n\n  const out: OpenApiManifestRoute[] = []\n  try {\n    for (const r of routes) {\n      const abs = resolve(serverDir, r.filePath)\n      let mod: Record<string, unknown>\n      try {\n        mod = await loadModule(abs)\n      } catch (err) {\n        console.warn(\n          `[openapi-emit] Skipping ${r.filePath}: load failed (${(err as Error).message})`,\n        )\n        continue\n      }\n\n      const methods = r.methods ?? HTTP_METHOD_KEYS.filter((m) => mod[m] !== undefined)\n      if (methods.length === 0) {\n        // Fall back to default export when no method-named exports detected.\n        const def = mod.default\n        if (def !== undefined && def !== null) {\n          out.push({ routePath: r.routePath, methods: ['GET'], ...extractSchemas(def) })\n        }\n        continue\n      }\n\n      for (const method of methods) {\n        const handler = mod[method] ?? mod.default\n        if (handler === undefined || handler === null) continue\n        out.push({ routePath: r.routePath, methods: [method], ...extractSchemas(handler) })\n      }\n    }\n  } finally {\n    if (dispose !== undefined) {\n      await dispose()\n    }\n  }\n  return out\n}\n\nfunction extractSchemas(handlerExport: unknown): RouteConfigShape {\n  if (typeof handlerExport !== 'object' || handlerExport === null) return {}\n  const cfg = handlerExport as RouteConfigShape\n  const out: RouteConfigShape = {}\n  if (cfg.body !== undefined) out.body = cfg.body\n  if (cfg.query !== undefined) out.query = cfg.query\n  if (cfg.params !== undefined) out.params = cfg.params\n  if (cfg.response !== undefined) out.response = cfg.response\n  return out\n}\n\n/**\n * Default loader: spin up a minimal Vite SSR dev server (no HMR, no\n * middlewares) just to use its `ssrLoadModule`. Vite handles TS, ESM, and\n * import resolution for free.\n *\n * Returns `{load, dispose}` — the caller owns the lifecycle and MUST\n * call `dispose()` (typically in a `finally`) so the server is closed.\n */\nasync function createDefaultLoader(serverDir: string): Promise<DefaultLoader> {\n  // Vite is a peerDep in build flows; import dynamically.\n  const { createServer } = await import('vite')\n  const server = (await createServer({\n    root: serverDir,\n    configFile: false,\n    server: { middlewareMode: true },\n    appType: 'custom',\n    logLevel: 'silent',\n  })) as unknown as ViteLikeServer\n\n  const swallow = (): void => {\n    /* eat close errors — best-effort cleanup */\n  }\n  return {\n    load: async (absPath) => server.ssrLoadModule(absPath),\n    dispose: async () => {\n      await server.close().catch(swallow)\n    },\n  }\n}\n"],"mappings":";;;;AAsBA,SAAS,WAAW,qBAAqB;AACzC,SAAS,YAAY;;;ACZrB,SAAS,SAAS;AAqCX,SAAS,mBAAmB,QAAmB,UAA0B,CAAC,GAAkB;AACjG,QAAM,MAAkB,QAAQ,OAAO,EAAE,MAAM,oBAAI,IAAI,GAAG,YAAY,CAAC,EAAE;AAEzE,QAAM,OAAO,QAAQ;AACrB,MAAI,SAAS,QAAW;AACtB,QAAI,OAAO,UAAU,eAAe,KAAK,IAAI,YAAY,IAAI,GAAG;AAC9D,aAAO,EAAE,MAAM,wBAAwB,IAAI,GAAG;AAAA,IAChD;AACA,QAAI,KAAK,IAAI,QAAQ,IAAI;AACzB,QAAI,WAAW,IAAI,IAAI,CAAC;AACxB,UAAM,OAAO,cAAc,QAAQ,GAAG;AACtC,QAAI,WAAW,IAAI,IAAI;AACvB,WAAO,EAAE,MAAM,wBAAwB,IAAI,GAAG;AAAA,EAChD;AAEA,SAAO,cAAc,QAAQ,GAAG;AAClC;AAEA,SAAS,cAAc,QAAmB,KAAgC;AACxE,QAAM,WAAW,IAAI,KAAK,IAAI,MAAM;AACpC,MAAI,aAAa,QAAW;AAC1B,WAAO,EAAE,MAAM,wBAAwB,QAAQ,GAAG;AAAA,EACpD;AAEA,MAAI;AACF,UAAM,aAAa,EAAE,aAAa,MAAM;AACxC,WAAO,WAAW,UAAU;AAAA,EAC9B,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AASA,SAAS,WAAW,IAA4C;AAC9D,QAAM,EAAE,SAAS,GAAG,OAAO,OAAO,GAAG,KAAK,IAAI;AAC9C,QAAM,MAA+B,CAAC;AAEtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC/C,QAAI,QAAQ,UAAU,MAAM,QAAQ,KAAK,GAAG;AAC1C,YAAM,QAAQ;AACd,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,YAAM,UAAU,MAAM,OAAO,CAAC,MAAc,MAAM,MAAM;AACxD,UAAI,OAAO,QAAQ,WAAW,IAAI,QAAQ,CAAC,IAAI;AAC/C,UAAI,QAAS,KAAI,WAAW;AAAA,IAC9B,WAAW,QAAQ,gBAAgB,SAAS,OAAO,UAAU,UAAU;AACrE,YAAM,QAAuC,CAAC;AAC9C,iBAAW,CAAC,IAAI,EAAE,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACvE,cAAM,EAAE,IAAI,MAAM,OAAO,OAAO,WAAW,WAAW,EAA6B,IAAK;AAAA,MAC1F;AACA,UAAI,aAAa;AAAA,IACnB,WAAW,QAAQ,WAAW,SAAS,OAAO,UAAU,UAAU;AAChE,UAAI,QAAQ,WAAW,KAAgC;AAAA,IACzD,YAAY,QAAQ,WAAW,QAAQ,WAAW,QAAQ,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC1F,UAAI,GAAG,IAAK,MAAoC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC;AAAA,IAC1E,WAAW,QAAQ,0BAA0B,SAAS,OAAO,UAAU,UAAU;AAC/E,UAAI,uBAAuB,WAAW,KAAgC;AAAA,IACxE,OAAO;AACL,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AAEA,SAAO;AACT;;;ADrBA,IAAM,gBAAuD;AAAA,EAC3D,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,SAAS;AACX;AAGO,SAAS,aAAa,WAA2B;AAGtD,SAAO,UAAU,QAAQ,4BAA4B,MAAM;AAC7D;AAEA,SAAS,gBACP,cACA,aACA,KACoB;AACpB,QAAM,MAA0B,CAAC;AACjC,MAAI,iBAAiB,QAAW;AAC9B,6BAAyB,cAAc,QAAQ,KAAK,GAAG;AAAA,EACzD;AACA,MAAI,gBAAgB,QAAW;AAC7B,6BAAyB,aAAa,SAAS,KAAK,GAAG;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,yBACP,QACA,UACA,KACA,KACM;AAGN,QAAM,QAAS,OAA4D;AAC3E,MAAI,UAAU,OAAW;AACzB,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,UAAM,WAAY,MAAqD;AACvE,UAAM,WAAW,SAAS,aAAa,iBAAiB,SAAS,aAAa;AAC9E,QAAI,KAAK;AAAA,MACP;AAAA,MACA,IAAI;AAAA,MACJ,UAAU,aAAa,SAAS,OAAO,CAAC;AAAA,MACxC,QAAQ,mBAAmB,OAAO,EAAE,IAAI,CAAC;AAAA,IAC3C,CAAC;AAAA,EACH;AACF;AAEA,SAAS,eACP,OACA,KACA,QACkB;AAElB,QAAM,YAAY,MAAM,UAAU,QAAQ,aAAa,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC9E,QAAM,cAAc,GAAG,OAAO,YAAY,CAAC,IAAI,UAAU,QAAQ,UAAU,EAAE,CAAC;AAC9E,QAAM,KAAuB;AAAA,IAC3B;AAAA,IACA,WAAW;AAAA,MACT,OAAO,EAAE,aAAa,KAAK;AAAA,IAC7B;AAAA,EACF;AAEA,QAAM,aAAa,gBAAgB,MAAM,QAAQ,MAAM,OAAO,GAAG;AACjE,MAAI,WAAW,SAAS,EAAG,IAAG,aAAa;AAI3C,MAAI,MAAM,SAAS,QAAW;AAC5B,OAAG,cAAc;AAAA,MACf,UAAU;AAAA,MACV,SAAS;AAAA,QACP,oBAAoB,EAAE,QAAQ,mBAAmB,MAAM,MAAM,EAAE,IAAI,CAAC,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,MAAM,aAAa,QAAW;AAChC,OAAG,UAAU,KAAK,IAAI;AAAA,MACpB,aAAa;AAAA,MACb,SAAS;AAAA,QACP,oBAAoB,EAAE,QAAQ,mBAAmB,MAAM,UAAU,EAAE,IAAI,CAAC,EAAE;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,YAAY,OAA4C;AACtE,QAAM,EAAE,UAAU,OAAO,IAAI;AAE7B,QAAM,MAAkB,EAAE,MAAM,oBAAI,IAAI,GAAG,YAAY,CAAC,EAAE;AAE1D,QAAM,QAAyC,CAAC;AAChD,aAAW,SAAS,UAAU;AAC5B,UAAM,gBAAgB,aAAa,MAAM,SAAS;AAClD,UAAM,OAAwB,MAAM,aAAa,KAAK,CAAC;AACvD,eAAW,UAAU,MAAM,SAAS;AAKlC,YAAM,MAAM,cAAc,OAAO,YAAY,CAAC;AAC9C,UAAI,QAAQ,OAAW;AACvB,WAAK,GAAG,IAAI,eAAe,OAAO,KAAK,MAAM;AAAA,IAC/C;AACA,UAAM,aAAa,IAAI;AAAA,EACzB;AAEA,QAAM,UAAU,oBAAoB,OAAO,OAAO;AAElD,QAAM,WAA4B;AAAA,IAChC,SAAS,OAAO;AAAA,IAChB,MAAM,EAAE,OAAO,OAAO,OAAO,SAAS,OAAO,QAAQ;AAAA,IACrD;AAAA,IACA;AAAA,EACF;AAEA,MAAI,OAAO,KAAK,IAAI,UAAU,EAAE,SAAS,GAAG;AAC1C,aAAS,aAAa,EAAE,SAAS,IAAI,WAAW;AAAA,EAClD;AAEA,YAAU,OAAO,QAAQ,EAAE,WAAW,KAAK,CAAC;AAC5C,QAAM,UAAU,KAAK,OAAO,QAAQ,cAAc;AAClD,gBAAc,SAAS,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,GAAM,MAAM;AAEvE,SAAO,EAAE,UAAU,MAAM,QAAQ;AACnC;AAEA,SAAS,oBACP,SACyC;AACzC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,aAAa,UAAa,aAAa,GAAI,QAAO;AACtD,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC,EAAE,KAAK,SAAS,CAAC;AACnD,QAAM,CAAC,OAAO,GAAG,IAAI,IAAI;AACzB,SAAO;AAAA,IACL;AAAA,MACE,KAAK;AAAA,MACL,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,IAC9E;AAAA,IACA,GAAG;AAAA,EACL;AACF;;;AEtOA,SAAS,eAAe;AA0BxB,IAAM,mBAAmB,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,QAAQ,SAAS;AAuBpF,eAAsB,qBACpB,SACiC;AACjC,QAAM,EAAE,WAAW,OAAO,IAAI;AAC9B,MAAI,aAAa,QAAQ;AACzB,MAAI;AACJ,MAAI,eAAe,QAAW;AAC5B,UAAM,UAAU,MAAM,oBAAoB,SAAS;AACnD,iBAAa,QAAQ;AACrB,cAAU,QAAQ;AAAA,EACpB;AAEA,QAAM,MAA8B,CAAC;AACrC,MAAI;AACF,eAAW,KAAK,QAAQ;AACtB,YAAM,MAAM,QAAQ,WAAW,EAAE,QAAQ;AACzC,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,WAAW,GAAG;AAAA,MAC5B,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,2BAA2B,EAAE,QAAQ,kBAAmB,IAAc,OAAO;AAAA,QAC/E;AACA;AAAA,MACF;AAEA,YAAM,UAAU,EAAE,WAAW,iBAAiB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,MAAS;AAChF,UAAI,QAAQ,WAAW,GAAG;AAExB,cAAM,MAAM,IAAI;AAChB,YAAI,QAAQ,UAAa,QAAQ,MAAM;AACrC,cAAI,KAAK,EAAE,WAAW,EAAE,WAAW,SAAS,CAAC,KAAK,GAAG,GAAG,eAAe,GAAG,EAAE,CAAC;AAAA,QAC/E;AACA;AAAA,MACF;AAEA,iBAAW,UAAU,SAAS;AAC5B,cAAM,UAAU,IAAI,MAAM,KAAK,IAAI;AACnC,YAAI,YAAY,UAAa,YAAY,KAAM;AAC/C,YAAI,KAAK,EAAE,WAAW,EAAE,WAAW,SAAS,CAAC,MAAM,GAAG,GAAG,eAAe,OAAO,EAAE,CAAC;AAAA,MACpF;AAAA,IACF;AAAA,EACF,UAAE;AACA,QAAI,YAAY,QAAW;AACzB,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eAAe,eAA0C;AAChE,MAAI,OAAO,kBAAkB,YAAY,kBAAkB,KAAM,QAAO,CAAC;AACzE,QAAM,MAAM;AACZ,QAAM,MAAwB,CAAC;AAC/B,MAAI,IAAI,SAAS,OAAW,KAAI,OAAO,IAAI;AAC3C,MAAI,IAAI,UAAU,OAAW,KAAI,QAAQ,IAAI;AAC7C,MAAI,IAAI,WAAW,OAAW,KAAI,SAAS,IAAI;AAC/C,MAAI,IAAI,aAAa,OAAW,KAAI,WAAW,IAAI;AACnD,SAAO;AACT;AAUA,eAAe,oBAAoB,WAA2C;AAE5E,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,MAAM;AAC5C,QAAM,SAAU,MAAM,aAAa;AAAA,IACjC,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,QAAQ,EAAE,gBAAgB,KAAK;AAAA,IAC/B,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,UAAU,MAAY;AAAA,EAE5B;AACA,SAAO;AAAA,IACL,MAAM,OAAO,YAAY,OAAO,cAAc,OAAO;AAAA,IACrD,SAAS,YAAY;AACnB,YAAM,OAAO,MAAM,EAAE,MAAM,OAAO;AAAA,IACpC;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-Y4H3JNVK.js

@@ -0,0 +1,18 @@
+// src/server/_internal/atomic-write.ts
+import { mkdirSync, renameSync, writeFileSync } from "fs";
+import { dirname } from "path";
+function writeAtomic(path, content) {
+  mkdirSync(dirname(path), { recursive: true });
+  const randBuf = new Uint8Array(4);
+  globalThis.crypto.getRandomValues(randBuf);
+  let suffix = "";
+  for (const b of randBuf) suffix += b.toString(16).padStart(2, "0");
+  const tmp = `${path}.tmp-${process.pid}-${suffix}`;
+  writeFileSync(tmp, content, "utf8");
+  renameSync(tmp, path);
+}
+
+export {
+  writeAtomic
+};
+//# sourceMappingURL=chunk-Y4H3JNVK.js.map

package/dist/chunk-Y4H3JNVK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/_internal/atomic-write.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time atomic write: caller-controlled paths only. No HTTP input\n * reaches these fs calls.\n */\n// T5a.1b — Web Crypto migration. Build-time only; node:fs + node:path stay\n// because this is a manifest-write leaf (e.g. .theo/jobs.json) and per\n// ADR-0028 the runtime-portable boundary is the request handler, not the\n// scanner. Only node:crypto is swapped out — Web Crypto's\n// getRandomValues works in every supported runtime.\nimport { mkdirSync, renameSync, writeFileSync } from 'node:fs'\nimport { dirname } from 'node:path'\n\n/**\n * Write `content` to `path` atomically via the tmp + rename pattern.\n *\n * Two concurrent calls to `writeAtomic(path, ...)` are guaranteed to\n * leave `path` containing valid content from ONE of the calls (never\n * truncated, never interleaved). POSIX rename is atomic on the same\n * filesystem.\n *\n * EC-106 (jobs-crons-webhooks-cost-tracking-plan) — shared helper for\n * `.theo/crons.json` and `.theo/jobs.json` manifest writes so a\n * concurrent dev-server scan + build manifest emit never produces\n * partial JSON.\n *\n * @param path  destination path\n * @param content  bytes (UTF-8 string) to write\n */\nexport function writeAtomic(path: string, content: string): void {\n  mkdirSync(dirname(path), { recursive: true })\n  // Include a random suffix so two concurrent writes don't trample each\n  // other's tmp file. Web Crypto getRandomValues is non-blocking +\n  // collision-safe for the tiny entropy we need (8 hex chars = 32 bits).\n  // Hex-encoded manually to avoid Buffer (runtime-agnostic per ADR-0028).\n  const randBuf = new Uint8Array(4)\n  globalThis.crypto.getRandomValues(randBuf)\n  let suffix = ''\n  for (const b of randBuf) suffix += b.toString(16).padStart(2, '0')\n  const tmp = `${path}.tmp-${process.pid}-${suffix}`\n  writeFileSync(tmp, content, 'utf8')\n  renameSync(tmp, path)\n}\n"],"mappings":";AASA,SAAS,WAAW,YAAY,qBAAqB;AACrD,SAAS,eAAe;AAkBjB,SAAS,YAAY,MAAc,SAAuB;AAC/D,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAK5C,QAAM,UAAU,IAAI,WAAW,CAAC;AAChC,aAAW,OAAO,gBAAgB,OAAO;AACzC,MAAI,SAAS;AACb,aAAW,KAAK,QAAS,WAAU,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACjE,QAAM,MAAM,GAAG,IAAI,QAAQ,QAAQ,GAAG,IAAI,MAAM;AAChD,gBAAc,KAAK,SAAS,MAAM;AAClC,aAAW,KAAK,IAAI;AACtB;","names":[]}

package/dist/chunk-Z5IGLBWE.js

@@ -0,0 +1,329 @@
+// src/server/body-parser.ts
+import { basename } from "path";
+import Busboy from "busboy";
+var METHODS_WITH_BODY = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
+var DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
+var DEFAULT_MAX_FILES = 10;
+var DEFAULT_MAX_FIELD_SIZE = 1 * 1024 * 1024;
+var FileTooLargeError = class extends Error {
+  constructor(message, truncatedFilenames, maxFileSize) {
+    super(message);
+    this.truncatedFilenames = truncatedFilenames;
+    this.maxFileSize = maxFileSize;
+    this.name = "FileTooLargeError";
+  }
+  truncatedFilenames;
+  maxFileSize;
+  code = "FILE_TOO_LARGE";
+  status = 413;
+};
+function stashBodyPreview(req, body) {
+  try {
+    ;
+    req[DEVTOOLS_BODY_PREVIEW] = body;
+  } catch {
+  }
+}
+function parseJsonBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString();
+      if (!raw) {
+        resolve(void 0);
+        return;
+      }
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        reject(new Error("Invalid JSON body"));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+function parseMultipartBody(req, contentType, options) {
+  if (!contentType.includes("boundary=")) {
+    return Promise.reject(new Error("Missing multipart boundary"));
+  }
+  return new Promise((resolve, reject) => {
+    const fields = {};
+    const files = [];
+    const truncatedFilenames = [];
+    let fileCount = 0;
+    const bb = Busboy({
+      headers: req.headers,
+      limits: {
+        fileSize: options.maxFileSize,
+        files: options.maxFiles,
+        fieldSize: options.maxFieldSize
+      }
+    });
+    bb.on("field", (name, value) => {
+      fields[name] = value;
+    });
+    bb.on(
+      "file",
+      (fieldname, stream, info) => {
+        fileCount++;
+        if (fileCount > options.maxFiles) {
+          stream.resume();
+          return;
+        }
+        const safeName = basename(info.filename || "unnamed");
+        const chunks = [];
+        let size = 0;
+        let truncated = false;
+        stream.on("data", (chunk) => {
+          size += chunk.length;
+          if (size > options.maxFileSize) {
+            truncated = true;
+            stream.resume();
+            return;
+          }
+          chunks.push(chunk);
+        });
+        stream.on("end", () => {
+          if (truncated) {
+            truncatedFilenames.push(safeName);
+            return;
+          }
+          const buffer = Buffer.concat(chunks);
+          files.push({
+            fieldname,
+            filename: safeName,
+            encoding: info.encoding,
+            mimeType: info.mimeType,
+            buffer,
+            size: buffer.length
+          });
+        });
+      }
+    );
+    bb.on("filesLimit", () => {
+      reject(new Error(`Too many files. Maximum: ${options.maxFiles}`));
+    });
+    bb.on("error", (err) => {
+      reject(err);
+    });
+    bb.on("close", () => {
+      if (truncatedFilenames.length > 0) {
+        reject(
+          new FileTooLargeError(
+            `File too large (max ${options.maxFileSize} bytes): ${truncatedFilenames.join(", ")}`,
+            truncatedFilenames,
+            options.maxFileSize
+          )
+        );
+        return;
+      }
+      resolve({ fields, files });
+    });
+    req.pipe(bb);
+  });
+}
+var DEVTOOLS_BODY_PREVIEW = /* @__PURE__ */ Symbol("theo:devtools:bodyPreview");
+async function parseRequestBody(req, options) {
+  const method = req.method?.toUpperCase() ?? "GET";
+  if (!METHODS_WITH_BODY.has(method)) {
+    return { fields: {}, files: [], json: void 0 };
+  }
+  const contentType = req.headers["content-type"] ?? "";
+  if (contentType.includes("application/json")) {
+    const json = await parseJsonBody(req);
+    stashBodyPreview(req, json);
+    return { fields: {}, files: [], json };
+  }
+  if (contentType.includes("multipart/form-data")) {
+    const limits = {
+      maxFileSize: options?.maxFileSize ?? DEFAULT_MAX_FILE_SIZE,
+      maxFiles: options?.maxFiles ?? DEFAULT_MAX_FILES,
+      maxFieldSize: options?.maxFieldSize ?? DEFAULT_MAX_FIELD_SIZE
+    };
+    const { fields, files } = await parseMultipartBody(req, contentType, limits);
+    stashBodyPreview(req, {
+      fields,
+      files: files.map((f) => ({
+        fieldname: f.fieldname,
+        filename: f.filename,
+        mimeType: f.mimeType,
+        size: f.size
+      }))
+    });
+    return { fields, files };
+  }
+  if (!contentType) {
+    return { fields: {}, files: [] };
+  }
+  throw new Error(`Unsupported Content-Type: ${contentType}`);
+}
+
+// src/server/observability/request-log.ts
+var defaultLoggerFn = (log) => {
+  console.log(JSON.stringify(log));
+};
+function logRequest(info, customLogger, req) {
+  const log = {
+    level: "info",
+    ...info,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const logger = customLogger ?? defaultLoggerFn;
+  logger(log);
+  broadcastRequestToDevtools(info, req);
+}
+function randomRequestId() {
+  return `req-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function broadcastToDevtoolsCore(info, headers, stashedBody) {
+  void Promise.all([
+    import("./broadcast-4SX7R5XE.js"),
+    import("./build-request-body-preview-EOP2Y4F3.js")
+  ]).then(([{ broadcastRequest }, { buildRequestBodyPreview }]) => {
+    const bodyInfo = buildRequestBodyPreview(stashedBody);
+    broadcastRequest({
+      id: randomRequestId(),
+      traceId: info.requestId,
+      method: info.method,
+      path: info.url,
+      status: info.status,
+      durationMs: info.duration,
+      startedAt: Date.now() - info.duration,
+      ...headers ? { headers } : {},
+      ...bodyInfo ? {
+        bodyPreview: bodyInfo.preview,
+        bodyLength: bodyInfo.length,
+        bodyTruncated: bodyInfo.truncated
+      } : {}
+    });
+  }).catch(() => {
+  });
+}
+function broadcastRequestToDevtools(info, req) {
+  const headers = req?.headers ? Object.fromEntries(
+    Object.entries(req.headers).map(([k, v]) => [
+      k,
+      Array.isArray(v) ? v.join(", ") : v ?? ""
+    ])
+  ) : void 0;
+  const stashedBody = req ? req[DEVTOOLS_BODY_PREVIEW] : void 0;
+  broadcastToDevtoolsCore(info, headers, stashedBody);
+}
+
+// src/server/observability/logger.ts
+var LEVEL_ORDER = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3,
+  silent: 4
+};
+function shouldLog(msgLevel, configLevel) {
+  return LEVEL_ORDER[msgLevel] >= LEVEL_ORDER[configLevel];
+}
+function defaultOutput(log) {
+  console.log(JSON.stringify(log));
+}
+function createLogger(options) {
+  const level = options?.level ?? "info";
+  const output = options?.output ?? defaultOutput;
+  const baseContext = options?.context ?? {};
+  function log(msgLevel, msg, context) {
+    if (!shouldLog(msgLevel, level)) return;
+    const entry = {
+      level: msgLevel,
+      msg,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      ...baseContext,
+      ...context
+    };
+    if (entry.error instanceof Error) {
+      entry.error = entry.error.stack ?? entry.error.message;
+    }
+    output(entry);
+  }
+  return {
+    debug: (msg, ctx) => {
+      log("debug", msg, ctx);
+    },
+    info: (msg, ctx) => {
+      log("info", msg, ctx);
+    },
+    warn: (msg, ctx) => {
+      log("warn", msg, ctx);
+    },
+    error: (msg, ctx) => {
+      log("error", msg, ctx);
+    },
+    child(ctx) {
+      return createLogger({
+        level,
+        output,
+        context: { ...baseContext, ...ctx }
+      });
+    }
+  };
+}
+var _warnOnceSeen = /* @__PURE__ */ new Set();
+var MAX_SEEN = 1024;
+function _resetWarnOnceForTests() {
+  _warnOnceSeen.clear();
+}
+function warnOnce(key, payload) {
+  if (_warnOnceSeen.has(key)) return;
+  if (_warnOnceSeen.size >= MAX_SEEN) {
+    const oldest = _warnOnceSeen.values().next().value;
+    if (oldest !== void 0) _warnOnceSeen.delete(oldest);
+  }
+  _warnOnceSeen.add(key);
+  let line;
+  try {
+    line = JSON.stringify({ ...payload, warnOnce: true });
+  } catch {
+    line = `[warnOnce] ${key} \u2014 (payload could not be serialized)`;
+  }
+  console.warn(line);
+  broadcastWarnOnceToDevtools(key, payload);
+}
+function payloadField(payload, key, fallback = "") {
+  const value = payload[key];
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return fallback;
+}
+function randomDevtoolsId() {
+  return `warn-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function broadcastWarnOnceToDevtools(key, payload) {
+  void import("./broadcast-4SX7R5XE.js").then(({ broadcastCsrfWarn, broadcastError }) => {
+    if (payload.event === "csrf.warn" && typeof payload.code === "string" && typeof payload.docsUrl === "string") {
+      broadcastCsrfWarn({
+        event: "csrf.warn",
+        code: payload.code,
+        docsUrl: payload.docsUrl,
+        method: payloadField(payload, "method"),
+        path: payloadField(payload, "path"),
+        reason: payloadField(payload, "reason")
+      });
+    } else {
+      broadcastError({
+        id: randomDevtoolsId(),
+        type: "console",
+        message: payloadField(payload, "event", key),
+        timestamp: Date.now()
+      });
+    }
+  }).catch(() => {
+  });
+}
+
+export {
+  FileTooLargeError,
+  parseRequestBody,
+  logRequest,
+  createLogger,
+  _resetWarnOnceForTests,
+  warnOnce
+};
+//# sourceMappingURL=chunk-Z5IGLBWE.js.map

package/dist/chunk-Z5IGLBWE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/body-parser.ts","../src/server/observability/request-log.ts","../src/server/observability/logger.ts"],"sourcesContent":["import type { IncomingMessage } from 'node:http'\nimport { basename } from 'node:path'\n\nimport Busboy from 'busboy'\n\n// --- Types ---\n\nexport interface UploadedFile {\n  fieldname: string\n  filename: string\n  encoding: string\n  mimeType: string\n  buffer: Buffer\n  size: number\n}\n\nexport interface ParsedBody {\n  fields: Record<string, string>\n  files: UploadedFile[]\n  json?: unknown\n}\n\nexport interface BodyParserOptions {\n  maxFileSize?: number // bytes, default 10MB\n  maxFiles?: number // default 10\n  maxFieldSize?: number // bytes, default 1MB\n}\n\nconst METHODS_WITH_BODY = new Set(['POST', 'PUT', 'PATCH'])\n\nconst DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024 // 10MB\nconst DEFAULT_MAX_FILES = 10\nconst DEFAULT_MAX_FIELD_SIZE = 1 * 1024 * 1024 // 1MB\n\nexport class FileTooLargeError extends Error {\n  readonly code = 'FILE_TOO_LARGE'\n  readonly status = 413\n  constructor(\n    message: string,\n    readonly truncatedFilenames: string[],\n    readonly maxFileSize: number,\n  ) {\n    super(message)\n    this.name = 'FileTooLargeError'\n  }\n}\n\n// --- JSON parsing ---\n\n/**\n * Stash the parsed body on the IncomingMessage for the devtools forwarder\n * to read at log time. Symbol-keyed so it never leaks into user-visible\n * surfaces. Best-effort — failures (e.g. frozen req) are swallowed.\n */\nfunction stashBodyPreview(req: IncomingMessage, body: unknown): void {\n  try {\n    ;(req as unknown as Record<symbol, unknown>)[DEVTOOLS_BODY_PREVIEW] = body\n  } catch {\n    // best-effort; never break the request\n  }\n}\n\nfunction parseJsonBody(req: IncomingMessage): Promise<unknown> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = []\n    req.on('data', (chunk: Buffer) => chunks.push(chunk))\n    req.on('end', () => {\n      const raw = Buffer.concat(chunks).toString()\n      if (!raw) {\n        resolve(undefined)\n        return\n      }\n      try {\n        resolve(JSON.parse(raw))\n      } catch {\n        reject(new Error('Invalid JSON body'))\n      }\n    })\n    req.on('error', reject)\n  })\n}\n\n// --- Multipart parsing ---\n\nfunction parseMultipartBody(\n  req: IncomingMessage,\n  contentType: string,\n  options: Required<Pick<BodyParserOptions, 'maxFileSize' | 'maxFiles' | 'maxFieldSize'>>,\n): Promise<{ fields: Record<string, string>; files: UploadedFile[] }> {\n  // EC-3: Validate boundary exists.\n  if (!contentType.includes('boundary=')) {\n    return Promise.reject(new Error('Missing multipart boundary'))\n  }\n\n  return new Promise((resolve, reject) => {\n    const fields: Record<string, string> = {}\n    const files: UploadedFile[] = []\n    // CR-010: track filenames that were truncated mid-stream. The previous\n    // implementation skipped truncated files from `files` and relied on\n    // `files.some(f => f.size > maxFileSize)` to detect — but since the\n    // file was never added, the guard never fired. Silent data loss.\n    const truncatedFilenames: string[] = []\n    let fileCount = 0\n\n    const bb = Busboy({\n      headers: req.headers,\n      limits: {\n        fileSize: options.maxFileSize,\n        files: options.maxFiles,\n        fieldSize: options.maxFieldSize,\n      },\n    })\n\n    bb.on('field', (name: string, value: string) => {\n      fields[name] = value\n    })\n\n    bb.on(\n      'file',\n      (\n        fieldname: string,\n        stream: NodeJS.ReadableStream,\n        info: { filename: string; encoding: string; mimeType: string },\n      ) => {\n        fileCount++\n        if (fileCount > options.maxFiles) {\n          stream.resume() // drain\n          return\n        }\n\n        // EC-6: Sanitize filename — basename only, no path traversal.\n        const safeName = basename(info.filename || 'unnamed')\n        const chunks: Buffer[] = []\n        let size = 0\n        let truncated = false\n\n        stream.on('data', (chunk: Buffer) => {\n          size += chunk.length\n          if (size > options.maxFileSize) {\n            truncated = true\n            stream.resume() // drain the rest\n            return\n          }\n          chunks.push(chunk)\n        })\n\n        stream.on('end', () => {\n          if (truncated) {\n            truncatedFilenames.push(safeName)\n            return\n          }\n\n          const buffer = Buffer.concat(chunks)\n          files.push({\n            fieldname,\n            filename: safeName,\n            encoding: info.encoding,\n            mimeType: info.mimeType,\n            buffer,\n            size: buffer.length,\n          })\n        })\n      },\n    )\n\n    bb.on('filesLimit', () => {\n      reject(new Error(`Too many files. Maximum: ${options.maxFiles}`))\n    })\n\n    bb.on('error', (err: Error) => {\n      reject(err)\n    })\n\n    bb.on('close', () => {\n      if (truncatedFilenames.length > 0) {\n        reject(\n          new FileTooLargeError(\n            `File too large (max ${options.maxFileSize} bytes): ${truncatedFilenames.join(', ')}`,\n            truncatedFilenames,\n            options.maxFileSize,\n          ),\n        )\n        return\n      }\n      resolve({ fields, files })\n    })\n\n    req.pipe(bb)\n  })\n}\n\n// --- Main parser ---\n\n/**\n * Symbol-keyed slot on IncomingMessage that the devtools request log\n * forwarder reads to enrich the broadcast payload with a body preview.\n * Symbol-keyed so it can't collide with user-land props and is invisible\n * to JSON.stringify / iteration. Always optional — readers must guard.\n */\nexport const DEVTOOLS_BODY_PREVIEW = Symbol('theo:devtools:bodyPreview')\n\nexport async function parseRequestBody(\n  req: IncomingMessage,\n  options?: BodyParserOptions,\n): Promise<ParsedBody> {\n  const method = req.method?.toUpperCase() ?? 'GET'\n  if (!METHODS_WITH_BODY.has(method)) {\n    return { fields: {}, files: [], json: undefined }\n  }\n\n  const contentType = req.headers['content-type'] ?? ''\n\n  // JSON\n  if (contentType.includes('application/json')) {\n    const json = await parseJsonBody(req)\n    stashBodyPreview(req, json)\n    return { fields: {}, files: [], json }\n  }\n\n  // Multipart\n  if (contentType.includes('multipart/form-data')) {\n    const limits = {\n      maxFileSize: options?.maxFileSize ?? DEFAULT_MAX_FILE_SIZE,\n      maxFiles: options?.maxFiles ?? DEFAULT_MAX_FILES,\n      maxFieldSize: options?.maxFieldSize ?? DEFAULT_MAX_FIELD_SIZE,\n    }\n    const { fields, files } = await parseMultipartBody(req, contentType, limits)\n    stashBodyPreview(req, {\n      fields,\n      files: files.map((f) => ({\n        fieldname: f.fieldname,\n        filename: f.filename,\n        mimeType: f.mimeType,\n        size: f.size,\n      })),\n    })\n    return { fields, files }\n  }\n\n  // No body or empty\n  if (!contentType) {\n    return { fields: {}, files: [] }\n  }\n\n  // Unsupported content type\n  throw new Error(`Unsupported Content-Type: ${contentType}`)\n}\n","/**\n * Request log primitive (T6.2 of architecture-review-remediation-plan).\n *\n * Split out from `logger.ts` per PV-12 (SRP) — the file previously mixed\n * 3 concerns (factory, warnOnce, request log). This module owns ONLY the\n * `logRequest` flow + the devtools broadcast best-effort forwarder.\n *\n * Public API surface is unchanged — `logger.ts` re-exports `logRequest`\n * + `RequestLog` + `LoggerFn` for backward compat.\n */\nimport type { IncomingMessage } from 'node:http'\n\nimport { DEVTOOLS_BODY_PREVIEW } from '../body-parser.js'\n\nexport interface RequestLog {\n  level: string\n  method: string\n  url: string\n  status: number\n  duration: number\n  requestId: string\n  timestamp: string\n}\n\nexport type LoggerFn = (log: RequestLog) => void\n\nconst defaultLoggerFn: LoggerFn = (log) => {\n  // eslint-disable-next-line no-console -- request-log default output IS the contract\n  console.log(JSON.stringify(log))\n}\n\nexport function logRequest(\n  info: Omit<RequestLog, 'level' | 'timestamp'>,\n  customLogger?: LoggerFn,\n  req?: IncomingMessage,\n): void {\n  const log: RequestLog = {\n    level: 'info',\n    ...info,\n    timestamp: new Date().toISOString(),\n  }\n  const logger = customLogger ?? defaultLoggerFn\n  logger(log)\n  // T2.1 — also broadcast to devtools (no-op in prod / when no dev server).\n  // Pass `req` so the devtools forwarder can extract headers + body preview\n  // stashed by body-parser (Symbol-keyed). Without `req`, only metadata\n  // (method/path/status/duration) reaches the devtools UI — the expanded\n  // row view then shows nothing useful.\n  broadcastRequestToDevtools(info, req)\n}\n\n/**\n * T2.1 — Forward a request record to the devtools UI. Lazy import keeps\n * this module dep-free for prod; broadcast.ts internally guards on\n * `globalThis.__theoViteHotServer`.\n */\nfunction randomRequestId(): string {\n  // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id for devtools UI\n  return `req-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`\n}\n\n/**\n * T5a.2 Phase C slice 2/2 — pure devtools broadcast that takes a\n * pre-extracted headers object + optional stashed body, so both\n * IncomingMessage and Web Request paths share the same dispatch logic.\n *\n * Errors here must not propagate — devtools forwarding is best-effort\n * and silenced.\n */\nfunction broadcastToDevtoolsCore(\n  info: Omit<RequestLog, 'level' | 'timestamp'>,\n  headers: Record<string, string> | undefined,\n  stashedBody: unknown,\n): void {\n  void Promise.all([\n    import('../../devtools/server-side/broadcast.js'),\n    import('../../devtools/server-side/build-request-body-preview.js'),\n  ])\n    .then(([{ broadcastRequest }, { buildRequestBodyPreview }]) => {\n      const bodyInfo = buildRequestBodyPreview(stashedBody)\n      broadcastRequest({\n        id: randomRequestId(),\n        traceId: info.requestId,\n        method: info.method,\n        path: info.url,\n        status: info.status,\n        durationMs: info.duration,\n        startedAt: Date.now() - info.duration,\n        ...(headers ? { headers } : {}),\n        ...(bodyInfo\n          ? {\n              bodyPreview: bodyInfo.preview,\n              bodyLength: bodyInfo.length,\n              bodyTruncated: bodyInfo.truncated,\n            }\n          : {}),\n      })\n    })\n    .catch(() => {\n      // No-op: devtools forwarding is best-effort.\n    })\n}\n\nfunction broadcastRequestToDevtools(\n  info: Omit<RequestLog, 'level' | 'timestamp'>,\n  req?: IncomingMessage,\n): void {\n  // T2.1 forwarder. Errors here must not propagate.\n  const headers = req?.headers\n    ? Object.fromEntries(\n        Object.entries(req.headers).map(([k, v]) => [\n          k,\n          Array.isArray(v) ? v.join(', ') : (v ?? ''),\n        ]),\n      )\n    : undefined\n  const stashedBody = req\n    ? (req as unknown as Record<symbol, unknown>)[DEVTOOLS_BODY_PREVIEW]\n    : undefined\n  broadcastToDevtoolsCore(info, headers, stashedBody)\n}\n\n/**\n * T5a.2 Phase C slice 2/2 — Web-Standards request log + devtools\n * forward. Mirror of `logRequest(info, logger?, req?: IncomingMessage)`\n * accepting `request?: Request`.\n *\n * Extracts headers via `request.headers.entries()` (Web `Headers`\n * iterator). Body preview stash is NOT yet supported on the Web path —\n * `body-parser-web.ts` doesn't yet stash like `body-parser.ts` does for\n * the IncomingMessage path. That hookup is Phase E scope (body parsing\n * migration). Until then, the devtools UI shows headers but no body\n * preview for Web-handled requests — same surface as the IncomingMessage\n * path before the stash convention shipped.\n */\nexport function logRequestFromRequest(\n  info: Omit<RequestLog, 'level' | 'timestamp'>,\n  customLogger?: LoggerFn,\n  request?: Request,\n): void {\n  const log: RequestLog = {\n    level: 'info',\n    ...info,\n    timestamp: new Date().toISOString(),\n  }\n  const logger = customLogger ?? defaultLoggerFn\n  logger(log)\n\n  let headers: Record<string, string> | undefined\n  if (request) {\n    headers = {}\n    for (const [k, v] of request.headers.entries()) {\n      headers[k] = v\n    }\n  }\n  // Phase E will add body-preview stash on Web Request; for now no stash.\n  broadcastToDevtoolsCore(info, headers, undefined)\n}\n","// --- Types ---\n\nexport type LogLevel = 'debug' | 'info' | 'warn' | 'error' | 'silent'\n\nexport interface StructuredLog {\n  level: string\n  msg: string\n  timestamp: string\n  [key: string]: unknown\n}\n\nexport interface TheoLogger {\n  debug(msg: string, context?: Record<string, unknown>): void\n  info(msg: string, context?: Record<string, unknown>): void\n  warn(msg: string, context?: Record<string, unknown>): void\n  error(msg: string, context?: Record<string, unknown>): void\n  child(context: Record<string, unknown>): TheoLogger\n}\n\n// --- Level filtering ---\n\nconst LEVEL_ORDER: Record<string, number> = {\n  debug: 0,\n  info: 1,\n  warn: 2,\n  error: 3,\n  silent: 4,\n}\n\nfunction shouldLog(msgLevel: string, configLevel: string): boolean {\n  return LEVEL_ORDER[msgLevel] >= LEVEL_ORDER[configLevel]\n}\n\n// --- Default output ---\n\nfunction defaultOutput(log: StructuredLog): void {\n  // eslint-disable-next-line no-console -- structured logger output IS the contract here\n  console.log(JSON.stringify(log))\n}\n\n// --- Factory ---\n\nexport function createLogger(options?: {\n  level?: LogLevel\n  output?: (log: StructuredLog) => void\n  context?: Record<string, unknown>\n}): TheoLogger {\n  const level = options?.level ?? 'info'\n  const output = options?.output ?? defaultOutput\n  const baseContext = options?.context ?? {}\n\n  function log(msgLevel: string, msg: string, context?: Record<string, unknown>): void {\n    if (!shouldLog(msgLevel, level)) return\n\n    const entry: StructuredLog = {\n      level: msgLevel,\n      msg,\n      timestamp: new Date().toISOString(),\n      ...baseContext,\n      ...context,\n    }\n\n    // Serialize Error objects to stack string\n    if (entry.error instanceof Error) {\n      entry.error = entry.error.stack ?? entry.error.message\n    }\n\n    output(entry)\n  }\n\n  return {\n    debug: (msg, ctx) => {\n      log('debug', msg, ctx)\n    },\n    info: (msg, ctx) => {\n      log('info', msg, ctx)\n    },\n    warn: (msg, ctx) => {\n      log('warn', msg, ctx)\n    },\n    error: (msg, ctx) => {\n      log('error', msg, ctx)\n    },\n    child(ctx) {\n      return createLogger({\n        level,\n        output,\n        context: { ...baseContext, ...ctx },\n      })\n    },\n  }\n}\n\n// --- warnOnce (T2.1) ---\n\n/**\n * Per-key dedup state. Module-scoped — reset per-process at boot.\n *\n * CR-011 fix: previous implementation used an unbounded `Set` which grew\n * forever in long-running prod processes with high-cardinality keys\n * (e.g. dynamic path segments). The bound below uses LRU-by-insertion:\n * when the Set hits `MAX_SEEN`, the OLDEST key is evicted. Subsequent\n * occurrences of that key will warn ONCE more — acceptable in exchange\n * for bounded memory.\n */\nconst _warnOnceSeen = new Set<string>()\nconst MAX_SEEN = 1024\n\n/**\n * Reset internal state. Test-only export — do not call from production.\n */\nexport function _resetWarnOnceForTests(): void {\n  _warnOnceSeen.clear()\n}\n\n/**\n * Emit a structured warning ONCE per key. Subsequent calls with the same\n * key are suppressed. Used for cutover-style warnings (e.g. CSRF warn)\n * that would otherwise flood logs under load.\n *\n * Convention: key is `<event>:<method>:<path>` — see callers in csrf.ts.\n *\n * EC-2: payload may contain circular references. Wrap `JSON.stringify`\n * in try/catch so a malformed payload doesn't crash the request handler.\n */\nexport function warnOnce(key: string, payload: Record<string, unknown>): void {\n  if (_warnOnceSeen.has(key)) return\n  // CR-011: bounded LRU. Evict oldest insertion when at capacity.\n  if (_warnOnceSeen.size >= MAX_SEEN) {\n    const oldest = _warnOnceSeen.values().next().value\n    if (oldest !== undefined) _warnOnceSeen.delete(oldest)\n  }\n  _warnOnceSeen.add(key)\n\n  let line: string\n  try {\n    line = JSON.stringify({ ...payload, warnOnce: true })\n  } catch {\n    // EC-2 fallback — preserve the key for grep-ability even when payload\n    // can't serialize (e.g., circular references, BigInt, etc.).\n    line = `[warnOnce] ${key} — (payload could not be serialized)`\n  }\n  console.warn(line)\n\n  // T2.1 — also broadcast to devtools (no-op in prod / when no dev server).\n  // Imported lazily to keep logger.ts dependency-free for non-dev contexts;\n  // broadcastToDevtools internally guards on globalThis.__theoViteHotServer.\n  broadcastWarnOnceToDevtools(key, payload)\n}\n\n/**\n * T2.1 — Forward a warnOnce payload to the devtools UI. Recognizes the\n * canonical CSRF warn shape and dispatches as 'csrf.warn'; otherwise\n * falls back to a generic 'error' broadcast.\n *\n * No-op when:\n *  - globalThis.__theoViteHotServer is undefined (prod / no dev server)\n *  - any error occurs (default-deny via broadcastToDevtools' try/catch)\n */\nfunction payloadField(payload: Record<string, unknown>, key: string, fallback = ''): string {\n  const value = payload[key]\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  return fallback\n}\n\nfunction randomDevtoolsId(): string {\n  // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id for devtools UI\n  return `warn-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`\n}\n\nfunction broadcastWarnOnceToDevtools(key: string, payload: Record<string, unknown>): void {\n  // CR-021: removed dead `void key` statement.\n  // T2.1 forwarder. Errors here must not propagate (default-deny).\n  void import('../../devtools/server-side/broadcast.js')\n    .then(({ broadcastCsrfWarn, broadcastError }) => {\n      if (\n        payload.event === 'csrf.warn' &&\n        typeof payload.code === 'string' &&\n        typeof payload.docsUrl === 'string'\n      ) {\n        broadcastCsrfWarn({\n          event: 'csrf.warn',\n          code: payload.code,\n          docsUrl: payload.docsUrl,\n          method: payloadField(payload, 'method'),\n          path: payloadField(payload, 'path'),\n          reason: payloadField(payload, 'reason'),\n        })\n      } else {\n        broadcastError({\n          id: randomDevtoolsId(),\n          type: 'console',\n          message: payloadField(payload, 'event', key),\n          timestamp: Date.now(),\n        })\n      }\n    })\n    .catch(() => {\n      // No-op: devtools forwarding is best-effort.\n    })\n}\n\n// --- Backward compat re-exports ---\n//\n// T6.2 (PV-12 SRP): `logRequest` + `RequestLog` + `LoggerFn` moved to a\n// dedicated `request-log.ts`. Re-exported here so consumers importing\n// from `theokit/server` see no change.\n\nexport { logRequest } from './request-log.js'\nexport type { RequestLog, LoggerFn } from './request-log.js'\n"],"mappings":";AACA,SAAS,gBAAgB;AAEzB,OAAO,YAAY;AAyBnB,IAAM,oBAAoB,oBAAI,IAAI,CAAC,QAAQ,OAAO,OAAO,CAAC;AAE1D,IAAM,wBAAwB,KAAK,OAAO;AAC1C,IAAM,oBAAoB;AAC1B,IAAM,yBAAyB,IAAI,OAAO;AAEnC,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAG3C,YACE,SACS,oBACA,aACT;AACA,UAAM,OAAO;AAHJ;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAAA,EACA;AAAA,EALF,OAAO;AAAA,EACP,SAAS;AASpB;AASA,SAAS,iBAAiB,KAAsB,MAAqB;AACnE,MAAI;AACF;AAAC,IAAC,IAA2C,qBAAqB,IAAI;AAAA,EACxE,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,cAAc,KAAwC;AAC7D,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,QAAI,GAAG,OAAO,MAAM;AAClB,YAAM,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS;AAC3C,UAAI,CAAC,KAAK;AACR,gBAAQ,MAAS;AACjB;AAAA,MACF;AACA,UAAI;AACF,gBAAQ,KAAK,MAAM,GAAG,CAAC;AAAA,MACzB,QAAQ;AACN,eAAO,IAAI,MAAM,mBAAmB,CAAC;AAAA,MACvC;AAAA,IACF,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAIA,SAAS,mBACP,KACA,aACA,SACoE;AAEpE,MAAI,CAAC,YAAY,SAAS,WAAW,GAAG;AACtC,WAAO,QAAQ,OAAO,IAAI,MAAM,4BAA4B,CAAC;AAAA,EAC/D;AAEA,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAiC,CAAC;AACxC,UAAM,QAAwB,CAAC;AAK/B,UAAM,qBAA+B,CAAC;AACtC,QAAI,YAAY;AAEhB,UAAM,KAAK,OAAO;AAAA,MAChB,SAAS,IAAI;AAAA,MACb,QAAQ;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,MACrB;AAAA,IACF,CAAC;AAED,OAAG,GAAG,SAAS,CAAC,MAAc,UAAkB;AAC9C,aAAO,IAAI,IAAI;AAAA,IACjB,CAAC;AAED,OAAG;AAAA,MACD;AAAA,MACA,CACE,WACA,QACA,SACG;AACH;AACA,YAAI,YAAY,QAAQ,UAAU;AAChC,iBAAO,OAAO;AACd;AAAA,QACF;AAGA,cAAM,WAAW,SAAS,KAAK,YAAY,SAAS;AACpD,cAAM,SAAmB,CAAC;AAC1B,YAAI,OAAO;AACX,YAAI,YAAY;AAEhB,eAAO,GAAG,QAAQ,CAAC,UAAkB;AACnC,kBAAQ,MAAM;AACd,cAAI,OAAO,QAAQ,aAAa;AAC9B,wBAAY;AACZ,mBAAO,OAAO;AACd;AAAA,UACF;AACA,iBAAO,KAAK,KAAK;AAAA,QACnB,CAAC;AAED,eAAO,GAAG,OAAO,MAAM;AACrB,cAAI,WAAW;AACb,+BAAmB,KAAK,QAAQ;AAChC;AAAA,UACF;AAEA,gBAAM,SAAS,OAAO,OAAO,MAAM;AACnC,gBAAM,KAAK;AAAA,YACT;AAAA,YACA,UAAU;AAAA,YACV,UAAU,KAAK;AAAA,YACf,UAAU,KAAK;AAAA,YACf;AAAA,YACA,MAAM,OAAO;AAAA,UACf,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AAEA,OAAG,GAAG,cAAc,MAAM;AACxB,aAAO,IAAI,MAAM,4BAA4B,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAClE,CAAC;AAED,OAAG,GAAG,SAAS,CAAC,QAAe;AAC7B,aAAO,GAAG;AAAA,IACZ,CAAC;AAED,OAAG,GAAG,SAAS,MAAM;AACnB,UAAI,mBAAmB,SAAS,GAAG;AACjC;AAAA,UACE,IAAI;AAAA,YACF,uBAAuB,QAAQ,WAAW,YAAY,mBAAmB,KAAK,IAAI,CAAC;AAAA,YACnF;AAAA,YACA,QAAQ;AAAA,UACV;AAAA,QACF;AACA;AAAA,MACF;AACA,cAAQ,EAAE,QAAQ,MAAM,CAAC;AAAA,IAC3B,CAAC;AAED,QAAI,KAAK,EAAE;AAAA,EACb,CAAC;AACH;AAUO,IAAM,wBAAwB,uBAAO,2BAA2B;AAEvE,eAAsB,iBACpB,KACA,SACqB;AACrB,QAAM,SAAS,IAAI,QAAQ,YAAY,KAAK;AAC5C,MAAI,CAAC,kBAAkB,IAAI,MAAM,GAAG;AAClC,WAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,GAAG,MAAM,OAAU;AAAA,EAClD;AAEA,QAAM,cAAc,IAAI,QAAQ,cAAc,KAAK;AAGnD,MAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,UAAM,OAAO,MAAM,cAAc,GAAG;AACpC,qBAAiB,KAAK,IAAI;AAC1B,WAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK;AAAA,EACvC;AAGA,MAAI,YAAY,SAAS,qBAAqB,GAAG;AAC/C,UAAM,SAAS;AAAA,MACb,aAAa,SAAS,eAAe;AAAA,MACrC,UAAU,SAAS,YAAY;AAAA,MAC/B,cAAc,SAAS,gBAAgB;AAAA,IACzC;AACA,UAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,mBAAmB,KAAK,aAAa,MAAM;AAC3E,qBAAiB,KAAK;AAAA,MACpB;AAAA,MACA,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,QACvB,WAAW,EAAE;AAAA,QACb,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,MAAM,EAAE;AAAA,MACV,EAAE;AAAA,IACJ,CAAC;AACD,WAAO,EAAE,QAAQ,MAAM;AAAA,EACzB;AAGA,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,EAAE;AAAA,EACjC;AAGA,QAAM,IAAI,MAAM,6BAA6B,WAAW,EAAE;AAC5D;;;AC5NA,IAAM,kBAA4B,CAAC,QAAQ;AAEzC,UAAQ,IAAI,KAAK,UAAU,GAAG,CAAC;AACjC;AAEO,SAAS,WACd,MACA,cACA,KACM;AACN,QAAM,MAAkB;AAAA,IACtB,OAAO;AAAA,IACP,GAAG;AAAA,IACH,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,SAAS,gBAAgB;AAC/B,SAAO,GAAG;AAMV,6BAA2B,MAAM,GAAG;AACtC;AAOA,SAAS,kBAA0B;AAEjC,SAAO,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAC5E;AAUA,SAAS,wBACP,MACA,SACA,aACM;AACN,OAAK,QAAQ,IAAI;AAAA,IACf,OAAO,yBAAyC;AAAA,IAChD,OAAO,0CAA0D;AAAA,EACnE,CAAC,EACE,KAAK,CAAC,CAAC,EAAE,iBAAiB,GAAG,EAAE,wBAAwB,CAAC,MAAM;AAC7D,UAAM,WAAW,wBAAwB,WAAW;AACpD,qBAAiB;AAAA,MACf,IAAI,gBAAgB;AAAA,MACpB,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,MAC7B,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7B,GAAI,WACA;AAAA,QACE,aAAa,SAAS;AAAA,QACtB,YAAY,SAAS;AAAA,QACrB,eAAe,SAAS;AAAA,MAC1B,IACA,CAAC;AAAA,IACP,CAAC;AAAA,EACH,CAAC,EACA,MAAM,MAAM;AAAA,EAEb,CAAC;AACL;AAEA,SAAS,2BACP,MACA,KACM;AAEN,QAAM,UAAU,KAAK,UACjB,OAAO;AAAA,IACL,OAAO,QAAQ,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM;AAAA,MAC1C;AAAA,MACA,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,IAAK,KAAK;AAAA,IAC1C,CAAC;AAAA,EACH,IACA;AACJ,QAAM,cAAc,MACf,IAA2C,qBAAqB,IACjE;AACJ,0BAAwB,MAAM,SAAS,WAAW;AACpD;;;ACnGA,IAAM,cAAsC;AAAA,EAC1C,OAAO;AAAA,EACP,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO;AAAA,EACP,QAAQ;AACV;AAEA,SAAS,UAAU,UAAkB,aAA8B;AACjE,SAAO,YAAY,QAAQ,KAAK,YAAY,WAAW;AACzD;AAIA,SAAS,cAAc,KAA0B;AAE/C,UAAQ,IAAI,KAAK,UAAU,GAAG,CAAC;AACjC;AAIO,SAAS,aAAa,SAId;AACb,QAAM,QAAQ,SAAS,SAAS;AAChC,QAAM,SAAS,SAAS,UAAU;AAClC,QAAM,cAAc,SAAS,WAAW,CAAC;AAEzC,WAAS,IAAI,UAAkB,KAAa,SAAyC;AACnF,QAAI,CAAC,UAAU,UAAU,KAAK,EAAG;AAEjC,UAAM,QAAuB;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,GAAG;AAAA,MACH,GAAG;AAAA,IACL;AAGA,QAAI,MAAM,iBAAiB,OAAO;AAChC,YAAM,QAAQ,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,IACjD;AAEA,WAAO,KAAK;AAAA,EACd;AAEA,SAAO;AAAA,IACL,OAAO,CAAC,KAAK,QAAQ;AACnB,UAAI,SAAS,KAAK,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,CAAC,KAAK,QAAQ;AAClB,UAAI,QAAQ,KAAK,GAAG;AAAA,IACtB;AAAA,IACA,MAAM,CAAC,KAAK,QAAQ;AAClB,UAAI,QAAQ,KAAK,GAAG;AAAA,IACtB;AAAA,IACA,OAAO,CAAC,KAAK,QAAQ;AACnB,UAAI,SAAS,KAAK,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,KAAK;AACT,aAAO,aAAa;AAAA,QAClB;AAAA,QACA;AAAA,QACA,SAAS,EAAE,GAAG,aAAa,GAAG,IAAI;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAcA,IAAM,gBAAgB,oBAAI,IAAY;AACtC,IAAM,WAAW;AAKV,SAAS,yBAA+B;AAC7C,gBAAc,MAAM;AACtB;AAYO,SAAS,SAAS,KAAa,SAAwC;AAC5E,MAAI,cAAc,IAAI,GAAG,EAAG;AAE5B,MAAI,cAAc,QAAQ,UAAU;AAClC,UAAM,SAAS,cAAc,OAAO,EAAE,KAAK,EAAE;AAC7C,QAAI,WAAW,OAAW,eAAc,OAAO,MAAM;AAAA,EACvD;AACA,gBAAc,IAAI,GAAG;AAErB,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,UAAU,EAAE,GAAG,SAAS,UAAU,KAAK,CAAC;AAAA,EACtD,QAAQ;AAGN,WAAO,cAAc,GAAG;AAAA,EAC1B;AACA,UAAQ,KAAK,IAAI;AAKjB,8BAA4B,KAAK,OAAO;AAC1C;AAWA,SAAS,aAAa,SAAkC,KAAa,WAAW,IAAY;AAC1F,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,SAAO;AACT;AAEA,SAAS,mBAA2B;AAElC,SAAO,QAAQ,OAAO,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAC7E;AAEA,SAAS,4BAA4B,KAAa,SAAwC;AAGxF,OAAK,OAAO,yBAAyC,EAClD,KAAK,CAAC,EAAE,mBAAmB,eAAe,MAAM;AAC/C,QACE,QAAQ,UAAU,eAClB,OAAO,QAAQ,SAAS,YACxB,OAAO,QAAQ,YAAY,UAC3B;AACA,wBAAkB;AAAA,QAChB,OAAO;AAAA,QACP,MAAM,QAAQ;AAAA,QACd,SAAS,QAAQ;AAAA,QACjB,QAAQ,aAAa,SAAS,QAAQ;AAAA,QACtC,MAAM,aAAa,SAAS,MAAM;AAAA,QAClC,QAAQ,aAAa,SAAS,QAAQ;AAAA,MACxC,CAAC;AAAA,IACH,OAAO;AACL,qBAAe;AAAA,QACb,IAAI,iBAAiB;AAAA,QACrB,MAAM;AAAA,QACN,SAAS,aAAa,SAAS,SAAS,GAAG;AAAA,QAC3C,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF,CAAC,EACA,MAAM,MAAM;AAAA,EAEb,CAAC;AACL;","names":[]}

package/dist/chunk-ZEGYW52B.js

@@ -0,0 +1,26 @@
+// src/server/scan/middleware-scan.ts
+import { readdirSync, existsSync, statSync } from "fs";
+import { join, extname } from "path";
+var MW_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
+function scanMiddlewares(serverDir) {
+  const mwDir = join(serverDir, "middleware");
+  if (!existsSync(mwDir) || !statSync(mwDir).isDirectory()) {
+    return [];
+  }
+  const entries = readdirSync(mwDir, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    if (entry.name.startsWith("_") || entry.name.startsWith(".")) continue;
+    const ext = extname(entry.name);
+    if (!MW_EXTENSIONS.has(ext)) continue;
+    files.push(join(mwDir, entry.name));
+  }
+  files.sort((a, b) => a.localeCompare(b));
+  return files;
+}
+
+export {
+  scanMiddlewares
+};
+//# sourceMappingURL=chunk-ZEGYW52B.js.map

package/dist/chunk-ZEGYW52B.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/scan/middleware-scan.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks `serverDir/middleware/` derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { readdirSync, existsSync, statSync } from 'node:fs'\nimport { join, extname } from 'node:path'\n\nconst MW_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\n\n/**\n * Scan the server/middleware/ directory for middleware files.\n * Files are returned sorted alphabetically — use numeric prefixes\n * (e.g. 01-cors.ts, 02-auth.ts) to control execution order.\n *\n * Files starting with '_' or '.' are ignored (helpers, hidden files).\n */\nexport function scanMiddlewares(serverDir: string): string[] {\n  const mwDir = join(serverDir, 'middleware')\n  if (!existsSync(mwDir) || !statSync(mwDir).isDirectory()) {\n    return []\n  }\n\n  const entries = readdirSync(mwDir, { withFileTypes: true })\n  const files: string[] = []\n\n  for (const entry of entries) {\n    if (!entry.isFile()) continue\n    if (entry.name.startsWith('_') || entry.name.startsWith('.')) continue\n    const ext = extname(entry.name)\n    if (!MW_EXTENSIONS.has(ext)) continue\n    files.push(join(mwDir, entry.name))\n  }\n\n  // Sort alphabetically — numeric prefix (01-, 02-) guarantees order.\n  // Use `localeCompare` for stable, locale-aware ordering.\n  files.sort((a, b) => a.localeCompare(b))\n  return files\n}\n"],"mappings":";AAIA,SAAS,aAAa,YAAY,gBAAgB;AAClD,SAAS,MAAM,eAAe;AAE9B,IAAM,gBAAgB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AASrD,SAAS,gBAAgB,WAA6B;AAC3D,QAAM,QAAQ,KAAK,WAAW,YAAY;AAC1C,MAAI,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,KAAK,EAAE,YAAY,GAAG;AACxD,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAU,YAAY,OAAO,EAAE,eAAe,KAAK,CAAC;AAC1D,QAAM,QAAkB,CAAC;AAEzB,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,OAAO,EAAG;AACrB,QAAI,MAAM,KAAK,WAAW,GAAG,KAAK,MAAM,KAAK,WAAW,GAAG,EAAG;AAC9D,UAAM,MAAM,QAAQ,MAAM,IAAI;AAC9B,QAAI,CAAC,cAAc,IAAI,GAAG,EAAG;AAC7B,UAAM,KAAK,KAAK,OAAO,MAAM,IAAI,CAAC;AAAA,EACpC;AAIA,QAAM,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACvC,SAAO;AACT;","names":[]}

package/dist/chunk-ZJQ4O76G.js

@@ -0,0 +1,87 @@
+// src/server/http/cookies.ts
+function parseCookieHeader(header) {
+  const map = /* @__PURE__ */ new Map();
+  if (!header) return map;
+  for (const pair of header.split(";")) {
+    const trimmed = pair.trim();
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx === -1) continue;
+    const key = trimmed.slice(0, eqIdx);
+    const rawValue = trimmed.slice(eqIdx + 1);
+    let value;
+    try {
+      value = decodeURIComponent(rawValue);
+    } catch {
+      value = rawValue;
+    }
+    map.set(key, value);
+  }
+  return map;
+}
+function getCookie(req, name) {
+  const cookies = parseCookieHeader(req.headers.cookie);
+  const value = cookies.get(name);
+  if (value === void 0) return void 0;
+  if (/(?:%[^0-9A-Fa-f])|(?:%[0-9A-Fa-f]$)/.test(value)) return void 0;
+  return value;
+}
+function serializeCookie(name, value, options) {
+  const opts = {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    ...options
+  };
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  if (opts.httpOnly) parts.push("HttpOnly");
+  if (opts.secure) parts.push("Secure");
+  const sameSiteCanonical = opts.sameSite.charAt(0).toUpperCase() + opts.sameSite.slice(1);
+  parts.push(`SameSite=${sameSiteCanonical}`);
+  if (opts.maxAge !== void 0) parts.push(`Max-Age=${opts.maxAge}`);
+  if (opts.path) parts.push(`Path=${opts.path}`);
+  if (opts.domain) parts.push(`Domain=${opts.domain}`);
+  return parts.join("; ");
+}
+function setCookie(res, name, value, options) {
+  const serialized = serializeCookie(name, value, options);
+  const existing = res.getHeader("Set-Cookie");
+  let cookies = [];
+  if (Array.isArray(existing)) {
+    cookies = existing.map(String);
+  } else if (existing !== void 0) {
+    cookies = [String(existing)];
+  }
+  cookies.push(serialized);
+  res.setHeader("Set-Cookie", cookies);
+}
+function deleteCookie(res, name, options) {
+  setCookie(res, name, "", { maxAge: 0, path: options?.path ?? "/" });
+}
+function getCookieFromRequest(request, name) {
+  const cookieHeader = request.headers.get("cookie");
+  if (cookieHeader === null) return void 0;
+  const cookies = parseCookieHeader(cookieHeader);
+  const value = cookies.get(name);
+  if (value === void 0) return void 0;
+  if (/(?:%[^0-9A-Fa-f])|(?:%[0-9A-Fa-f]$)/.test(value)) return void 0;
+  return value;
+}
+function appendCookieToHeaders(target, name, value, options) {
+  target.append("Set-Cookie", serializeCookie(name, value, options));
+}
+function appendDeleteCookieToHeaders(target, name, options) {
+  appendCookieToHeaders(target, name, "", { maxAge: 0, path: options?.path ?? "/" });
+}
+
+export {
+  parseCookieHeader,
+  getCookie,
+  serializeCookie,
+  setCookie,
+  deleteCookie,
+  getCookieFromRequest,
+  appendCookieToHeaders,
+  appendDeleteCookieToHeaders
+};
+//# sourceMappingURL=chunk-ZJQ4O76G.js.map

package/dist/chunk-ZJQ4O76G.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/http/cookies.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\n\nexport interface CookieOptions {\n  httpOnly?: boolean\n  secure?: boolean\n  sameSite?: 'strict' | 'lax' | 'none'\n  maxAge?: number\n  path?: string\n  domain?: string\n}\n\n/**\n * Parse a `Cookie` header into a Map (RFC 6265 §5.4).\n * - Empty/missing input → empty Map.\n * - Malformed entries (no `=`) skipped silently (defensive).\n * - Duplicate names → last-wins.\n * - Values URL-decoded if possible; raw on decode failure (CR-009 protection).\n *\n * Canonical helper (T3.2 of architecture-review-remediation-plan; PV-4 DRY).\n * Consumed by `getCookie` here AND by `rate-limit/rate-limit-per-route.ts`.\n */\nexport function parseCookieHeader(header: string | undefined): Map<string, string> {\n  const map = new Map<string, string>()\n  if (!header) return map\n  for (const pair of header.split(';')) {\n    const trimmed = pair.trim()\n    const eqIdx = trimmed.indexOf('=')\n    if (eqIdx === -1) continue\n    const key = trimmed.slice(0, eqIdx)\n    const rawValue = trimmed.slice(eqIdx + 1)\n    let value: string\n    try {\n      value = decodeURIComponent(rawValue)\n    } catch {\n      // Malformed percent-encoding — preserve raw to not lose data,\n      // but the consumer is responsible for treating it as untrusted.\n      value = rawValue\n    }\n    map.set(key, value)\n  }\n  return map\n}\n\nexport function getCookie(req: IncomingMessage, name: string): string | undefined {\n  const cookies = parseCookieHeader(req.headers.cookie)\n  const value = cookies.get(name)\n  // CR-009 fix: malformed percent-encoding returns raw via parseCookieHeader.\n  // If decoding failed in parse, we get the raw value (with %XX intact).\n  // Treat that as \"unreadable\" for the typed getCookie API to preserve the\n  // original \"treat as unauthenticated\" semantics.\n  if (value === undefined) return undefined\n  // Sanity: if rawValue contains lone `%` that didn't decode, parseCookieHeader\n  // returned the raw — return undefined to preserve old getCookie contract.\n  if (/(?:%[^0-9A-Fa-f])|(?:%[0-9A-Fa-f]$)/.test(value)) return undefined\n  return value\n}\n\n/**\n * T5a.2 Phase B slice 6/6 — pure Set-Cookie serializer. Extracted from\n * `setCookie(res, ...)` so the IncomingMessage path AND the Web Headers\n * path can share the cookie attribute composition.\n *\n * Returns the canonical `Set-Cookie` header value string (no surrounding\n * `Set-Cookie:` prefix — caller wraps via `res.setHeader('Set-Cookie', ...)`\n * or `headers.append('Set-Cookie', ...)`).\n *\n * Defaults: `httpOnly: true`, `secure: NODE_ENV === 'production'`,\n * `sameSite: 'lax'`, `path: '/'`.\n */\nexport function serializeCookie(name: string, value: string, options?: CookieOptions): string {\n  const opts: Required<Omit<CookieOptions, 'maxAge' | 'domain'>> &\n    Pick<CookieOptions, 'maxAge' | 'domain'> = {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    ...options,\n  }\n\n  const parts = [`${name}=${encodeURIComponent(value)}`]\n  if (opts.httpOnly) parts.push('HttpOnly')\n  if (opts.secure) parts.push('Secure')\n  const sameSiteCanonical = opts.sameSite.charAt(0).toUpperCase() + opts.sameSite.slice(1)\n  parts.push(`SameSite=${sameSiteCanonical}`)\n  if (opts.maxAge !== undefined) parts.push(`Max-Age=${opts.maxAge}`)\n  if (opts.path) parts.push(`Path=${opts.path}`)\n  if (opts.domain) parts.push(`Domain=${opts.domain}`)\n  return parts.join('; ')\n}\n\nexport function setCookie(\n  res: ServerResponse,\n  name: string,\n  value: string,\n  options?: CookieOptions,\n): void {\n  const serialized = serializeCookie(name, value, options)\n  // Append to existing Set-Cookie headers (EC-1: don't overwrite)\n  const existing = res.getHeader('Set-Cookie')\n  let cookies: string[] = []\n  if (Array.isArray(existing)) {\n    cookies = existing.map(String)\n  } else if (existing !== undefined) {\n    cookies = [String(existing)]\n  }\n  cookies.push(serialized)\n  res.setHeader('Set-Cookie', cookies)\n}\n\nexport function deleteCookie(res: ServerResponse, name: string, options?: { path?: string }): void {\n  setCookie(res, name, '', { maxAge: 0, path: options?.path ?? '/' })\n}\n\n/**\n * T5a.2 Phase B slice 6/6 — Web-Standards cookie getter.\n *\n * Mirror of `getCookie(req: IncomingMessage, name)` for the Web `Request`\n * shape. Consumes `request.headers.get('cookie')` (native `Headers` API)\n * instead of `req.headers.cookie`. Same parse logic + same malformed\n * percent-encoding sanity (returns undefined when raw value contains a\n * lone `%` that didn't decode, preserving the IncomingMessage path's\n * \"treat as unreadable\" CR-009 semantics).\n */\nexport function getCookieFromRequest(request: Request, name: string): string | undefined {\n  const cookieHeader = request.headers.get('cookie')\n  if (cookieHeader === null) return undefined\n  const cookies = parseCookieHeader(cookieHeader)\n  const value = cookies.get(name)\n  if (value === undefined) return undefined\n  if (/(?:%[^0-9A-Fa-f])|(?:%[0-9A-Fa-f]$)/.test(value)) return undefined\n  return value\n}\n\n/**\n * T5a.2 Phase B slice 6/6 — Web-Standards cookie setter.\n *\n * Mirror of `setCookie(res, name, value, options)` for the Web `Headers`\n * shape. Appends a `Set-Cookie` entry to the caller's `Headers` instance\n * via `headers.append('Set-Cookie', ...)`. Multiple appends produce\n * multiple `Set-Cookie` headers per the Web spec; `headers.getSetCookie()`\n * retrieves them as an array (the one multi-value header the Web API\n * exposes natively).\n *\n * Uses the shared `serializeCookie` pure helper — same defaults and\n * attribute composition as the IncomingMessage path.\n */\nexport function appendCookieToHeaders(\n  target: Headers,\n  name: string,\n  value: string,\n  options?: CookieOptions,\n): void {\n  target.append('Set-Cookie', serializeCookie(name, value, options))\n}\n\n/**\n * T5a.2 Phase B slice 6/6 — Web-Standards cookie deleter.\n *\n * Mirror of `deleteCookie(res, name, options)` — emits a Set-Cookie with\n * `Max-Age=0` so the browser drops the cookie immediately.\n */\nexport function appendDeleteCookieToHeaders(\n  target: Headers,\n  name: string,\n  options?: { path?: string },\n): void {\n  appendCookieToHeaders(target, name, '', { maxAge: 0, path: options?.path ?? '/' })\n}\n"],"mappings":";AAqBO,SAAS,kBAAkB,QAAiD;AACjF,QAAM,MAAM,oBAAI,IAAoB;AACpC,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,UAAU,KAAK,KAAK;AAC1B,UAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,QAAI,UAAU,GAAI;AAClB,UAAM,MAAM,QAAQ,MAAM,GAAG,KAAK;AAClC,UAAM,WAAW,QAAQ,MAAM,QAAQ,CAAC;AACxC,QAAI;AACJ,QAAI;AACF,cAAQ,mBAAmB,QAAQ;AAAA,IACrC,QAAQ;AAGN,cAAQ;AAAA,IACV;AACA,QAAI,IAAI,KAAK,KAAK;AAAA,EACpB;AACA,SAAO;AACT;AAEO,SAAS,UAAU,KAAsB,MAAkC;AAChF,QAAM,UAAU,kBAAkB,IAAI,QAAQ,MAAM;AACpD,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAK9B,MAAI,UAAU,OAAW,QAAO;AAGhC,MAAI,sCAAsC,KAAK,KAAK,EAAG,QAAO;AAC9D,SAAO;AACT;AAcO,SAAS,gBAAgB,MAAc,OAAe,SAAiC;AAC5F,QAAM,OACuC;AAAA,IAC3C,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,GAAG;AAAA,EACL;AAEA,QAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,mBAAmB,KAAK,CAAC,EAAE;AACrD,MAAI,KAAK,SAAU,OAAM,KAAK,UAAU;AACxC,MAAI,KAAK,OAAQ,OAAM,KAAK,QAAQ;AACpC,QAAM,oBAAoB,KAAK,SAAS,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,SAAS,MAAM,CAAC;AACvF,QAAM,KAAK,YAAY,iBAAiB,EAAE;AAC1C,MAAI,KAAK,WAAW,OAAW,OAAM,KAAK,WAAW,KAAK,MAAM,EAAE;AAClE,MAAI,KAAK,KAAM,OAAM,KAAK,QAAQ,KAAK,IAAI,EAAE;AAC7C,MAAI,KAAK,OAAQ,OAAM,KAAK,UAAU,KAAK,MAAM,EAAE;AACnD,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,UACd,KACA,MACA,OACA,SACM;AACN,QAAM,aAAa,gBAAgB,MAAM,OAAO,OAAO;AAEvD,QAAM,WAAW,IAAI,UAAU,YAAY;AAC3C,MAAI,UAAoB,CAAC;AACzB,MAAI,MAAM,QAAQ,QAAQ,GAAG;AAC3B,cAAU,SAAS,IAAI,MAAM;AAAA,EAC/B,WAAW,aAAa,QAAW;AACjC,cAAU,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC7B;AACA,UAAQ,KAAK,UAAU;AACvB,MAAI,UAAU,cAAc,OAAO;AACrC;AAEO,SAAS,aAAa,KAAqB,MAAc,SAAmC;AACjG,YAAU,KAAK,MAAM,IAAI,EAAE,QAAQ,GAAG,MAAM,SAAS,QAAQ,IAAI,CAAC;AACpE;AAYO,SAAS,qBAAqB,SAAkB,MAAkC;AACvF,QAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ;AACjD,MAAI,iBAAiB,KAAM,QAAO;AAClC,QAAM,UAAU,kBAAkB,YAAY;AAC9C,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,sCAAsC,KAAK,KAAK,EAAG,QAAO;AAC9D,SAAO;AACT;AAeO,SAAS,sBACd,QACA,MACA,OACA,SACM;AACN,SAAO,OAAO,cAAc,gBAAgB,MAAM,OAAO,OAAO,CAAC;AACnE;AAQO,SAAS,4BACd,QACA,MACA,SACM;AACN,wBAAsB,QAAQ,MAAM,IAAI,EAAE,QAAQ,GAAG,MAAM,SAAS,QAAQ,IAAI,CAAC;AACnF;","names":[]}