theokit 0.2.4 → 0.4.0

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/theo-fetch.ts","../../src/client/batch.ts","../../src/client/batch-transport.ts","../../src/client/app-client.ts","../../src/client/use-agent-stream.ts","../../src/client/agent-stream-core.ts"],"sourcesContent":["import superjson from 'superjson'\nimport type { z } from 'zod'\n\nimport { getGlobalBatcher } from './batch-transport.js'\n\n// --- Transformer (T1.3) ---\n\n/**\n * Module-scoped flag preventing the transformer-mismatch warning from\n * firing more than once per session (EC-6).\n */\nlet mismatchWarned = false\n\n/** Test-only helper to reset the warned flag between assertions. */\nexport function __resetMismatchWarningForTests(): void {\n  mismatchWarned = false\n}\n\n/**\n * Deserialize a fetch response body according to the negotiated transformer.\n *\n * `serverTransformerName` comes from the `x-theo-transformer` response header\n * (null when absent — server is using the default JSON path).\n * `clientTransformerName` is the transformer the client was built with\n * (typically injected via a Vite virtual module; falls back to `'json'`).\n *\n * Mismatch fires a single console.warn and falls back to JSON.parse (EC-5/EC-6).\n */\nexport function deserializeFetchResponse(\n  raw: string,\n  serverTransformerName: string | null,\n  clientTransformerName: string,\n): unknown {\n  // `raw` is typed `string`, but stay defensive: callers pass `await response.text()`\n  // which can be empty.\n  if (raw === '') {\n    return null\n  }\n\n  const serverEffective = serverTransformerName ?? 'json'\n  if (serverEffective !== clientTransformerName && !mismatchWarned) {\n    mismatchWarned = true\n    console.warn(\n      `[theokit] transformer mismatch: server=${serverEffective}, client=${clientTransformerName}. Falling back to JSON.parse.`,\n    )\n  }\n\n  if (serverEffective === 'superjson' && clientTransformerName === 'superjson') {\n    const wrapped = JSON.parse(raw) as Parameters<typeof superjson.deserialize>[0]\n    return superjson.deserialize(wrapped)\n  }\n\n  // Default path (json) or mismatch fallback\n  return JSON.parse(raw)\n}\n\n// --- Utility Types ---\n\n/** Infer the response type from a route's handler return */\nexport type InferResponse<T> = T extends { handler: (...args: never[]) => infer R }\n  ? Awaited<R>\n  : unknown\n\n/** Extract the query Zod schema type, handling optional properties */\ntype ExtractQuery<T> = T extends { query?: infer Q } ? (Q extends z.ZodType ? Q : never) : never\n\n/** Extract the body Zod schema type, handling optional properties */\ntype ExtractBody<T> = T extends { body?: infer B } ? (B extends z.ZodType ? B : never) : never\n\n/** Infer query type from a route's query Zod schema */\nexport type InferQuery<T> = [ExtractQuery<T>] extends [never]\n  ? undefined\n  : ExtractQuery<T> extends z.ZodUndefined\n    ? undefined\n    : z.infer<ExtractQuery<T>>\n\n/** Infer body type from a route's body Zod schema */\nexport type InferBody<T> = [ExtractBody<T>] extends [never]\n  ? undefined\n  : ExtractBody<T> extends z.ZodUndefined\n    ? undefined\n    : z.infer<ExtractBody<T>>\n\n/** Build the options type based on what schemas the route has */\nexport type TheoFetchOptions<T> = Omit<RequestInit, 'body' | 'method'> &\n  (InferQuery<T> extends undefined ? { query?: never } : { query: InferQuery<T> }) &\n  (InferBody<T> extends undefined ? { body?: never } : { body: InferBody<T> })\n\n// --- Error Class ---\n\nexport class TheoFetchError extends Error {\n  status: number\n  code?: string\n  issues?: unknown[]\n\n  constructor(status: number, body?: unknown) {\n    const parsed = body && typeof body === 'object' ? (body as Record<string, unknown>) : null\n    const error = parsed?.error as Record<string, unknown> | undefined\n    const errorMessage = typeof error?.message === 'string' ? error.message : undefined\n    super(errorMessage ?? `HTTP ${String(status)}`)\n    this.name = 'TheoFetchError'\n    this.status = status\n    this.code = typeof error?.code === 'string' ? error.code : undefined\n    this.issues = Array.isArray(error?.issues) ? error.issues : undefined\n  }\n}\n\n/**\n * Serialize a query-param value to a string. Handles primitives, dates,\n * and falls back to JSON for arrays/objects. Avoids the\n * `[object Object]` foot-gun that `no-base-to-string` warns against.\n */\nfunction stringifyQueryValue(value: unknown): string {\n  if (value === null) return 'null'\n  if (value instanceof Date) return value.toISOString()\n  switch (typeof value) {\n    case 'string':\n      return value\n    case 'number':\n    case 'boolean':\n    case 'bigint':\n      return String(value)\n    default:\n      return JSON.stringify(value)\n  }\n}\n\n// --- Main Function ---\n\ninterface TheoFetchInternalOptions {\n  method?: string\n  query?: Record<string, unknown>\n  body?: unknown\n  headers?: HeadersInit\n  signal?: AbortSignal\n}\n\n/**\n * Resolve the request origin per the documented fallback hierarchy. Pure\n * helper extracted to keep `theoFetch` under the complexity ceiling.\n *   1. `globalThis.location.origin` (browser)\n *   2. `globalThis.__THEO_ORIGIN__` (build-time literal)\n *   3. `process.env.THEO_ORIGIN` (escape hatch)\n *   4. `http://localhost` (placeholder for URL parsing — the URL is built\n *      relative so only pathname+search ever flows to the wire)\n */\nfunction resolveRequestOrigin(): string {\n  const g = globalThis as { location?: { origin?: string }; __THEO_ORIGIN__?: string }\n  const fromEnv = typeof process !== 'undefined' ? process.env.THEO_ORIGIN : undefined\n  return g.location?.origin ?? g.__THEO_ORIGIN__ ?? fromEnv ?? 'http://localhost'\n}\n\nfunction buildFetchUrl(path: string, query: Record<string, unknown> | undefined): URL {\n  const fetchUrl = new URL(path, resolveRequestOrigin())\n  if (!query) return fetchUrl\n  for (const [k, v] of Object.entries(query)) {\n    if (v !== undefined) {\n      fetchUrl.searchParams.set(k, stringifyQueryValue(v))\n    }\n  }\n  return fetchUrl\n}\n\n/**\n * Normalize `HeadersInit` (Headers / `[string, string][]` / Record) into a\n * single plain `Record<string, string>`. Plain-object output is required\n * by callers that introspect headers via index access (test fixtures use\n * `(init.headers as Record<string, string>)['Content-Type']`).\n */\nfunction normalizeHeaders(input: HeadersInit | undefined): Record<string, string> {\n  const out: Record<string, string> = {}\n  if (!input) return out\n  if (input instanceof Headers) {\n    input.forEach((value, key) => {\n      out[key] = value\n    })\n    return out\n  }\n  if (Array.isArray(input)) {\n    for (const [key, value] of input) out[key] = value\n    return out\n  }\n  for (const [key, value] of Object.entries(input)) {\n    out[key] = value\n  }\n  return out\n}\n\nfunction buildRequestInit(opts: TheoFetchInternalOptions): RequestInit {\n  const init: RequestInit = {}\n  if (opts.method !== undefined) init.method = opts.method\n  if (opts.signal !== undefined) init.signal = opts.signal\n\n  const headers = normalizeHeaders(opts.headers)\n  init.headers = headers\n\n  if (opts.body !== undefined) {\n    init.body = JSON.stringify(opts.body)\n    headers['Content-Type'] = 'application/json'\n  }\n\n  // Phase 5 — Auto-attach `X-Theo-Action: 1` for state-mutating methods so\n  // the framework's CSRF check passes when servers run in `strict` mode.\n  // Safe methods (GET/HEAD/OPTIONS) skip the header to keep them cacheable.\n  const method = (opts.method ?? 'GET').toUpperCase()\n  if (method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS') {\n    headers['X-Theo-Action'] = '1'\n  }\n  return init\n}\n\nasync function tryBatcher(\n  url: string,\n  options: TheoFetchInternalOptions,\n): Promise<{ matched: true; result: unknown } | { matched: false }> {\n  const batcher = getGlobalBatcher()\n  if (!batcher) return { matched: false }\n  try {\n    const result = await batcher.dispatch({\n      path: url,\n      method: options.method ?? 'GET',\n      query: options.query,\n      body: options.body,\n    })\n    return { matched: true, result }\n  } catch {\n    // Batcher failure: fall through to direct fetch (graceful degrade).\n    return { matched: false }\n  }\n}\n\nexport async function theoFetch<T>(\n  url: string,\n  options?: TheoFetchOptions<T>,\n): Promise<InferResponse<T>> {\n  const internal = (options ?? {}) as unknown as TheoFetchInternalOptions\n\n  // T1.5 — Transparent batching when globalThis.__THEO_BATCHING__ is truthy.\n  const batchAttempt = await tryBatcher(url, internal)\n  if (batchAttempt.matched) {\n    return batchAttempt.result as InferResponse<T>\n  }\n\n  const fetchUrl = buildFetchUrl(url, internal.query)\n  const init = buildRequestInit(internal)\n  const response = await fetch(fetchUrl.toString(), init)\n\n  if (!response.ok) {\n    let errorBody: unknown\n    try {\n      errorBody = await response.json()\n    } catch {\n      // Non-JSON error response\n    }\n    throw new TheoFetchError(response.status, errorBody)\n  }\n\n  // Handle 204 No Content (EC-1)\n  if (response.status === 204) {\n    return null as InferResponse<T>\n  }\n\n  // Check for empty body\n  const contentLength = response.headers.get('content-length')\n  if (contentLength === '0') {\n    return null as InferResponse<T>\n  }\n\n  // T1.3 — transformer-aware deserialization\n  const serverTransformerName = response.headers.get('x-theo-transformer')\n  const clientTransformerName = resolveClientTransformerName()\n  const text = await response.text()\n  return deserializeFetchResponse(\n    text,\n    serverTransformerName,\n    clientTransformerName,\n  ) as InferResponse<T>\n}\n\n/**\n * Read the client-configured transformer name. Default `'json'`.\n *\n * In a Vite build, this is overridden by virtual module\n * `/@theo/runtime-config` which sets `globalThis.__THEO_TRANSFORMER__`.\n * Outside Vite (Node SSR, tests) the default applies.\n */\nfunction resolveClientTransformerName(): string {\n  const g = globalThis as { __THEO_TRANSFORMER__?: string }\n  return g.__THEO_TRANSFORMER__ ?? 'json'\n}\n","/**\n * T5.1 — client-side microtask batching.\n *\n * Collects all `dispatch` calls within the same microtask and sends them as a\n * single HTTP POST to the configured transport. Each caller's promise resolves\n * with its own result; one failed item does not break the others (per-item\n * error isolation).\n *\n * Designed as a transport-agnostic primitive so unit tests do not require\n * network access. The default transport (fetch to `/api/__theo_batch__`)\n * lives alongside this module but is created by the consumer (e.g., theoFetch).\n */\n\nexport interface BatchRequest {\n  path: string\n  method: string\n  query?: Record<string, unknown>\n  body?: unknown\n  headers?: Record<string, string>\n}\n\nexport type BatchResponse =\n  | { index: number; data: unknown }\n  | { index: number; error: { message: string; code?: string } }\n\nexport type BatchTransport = (requests: BatchRequest[]) => Promise<BatchResponse[]>\n\nexport interface BatcherOptions {\n  transport: BatchTransport\n  /** Maximum batch size before flushing into multiple parallel batches. */\n  max?: number\n}\n\nexport interface Batcher {\n  dispatch(req: BatchRequest): Promise<unknown>\n}\n\ninterface PendingCall {\n  req: BatchRequest\n  resolve: (value: unknown) => void\n  reject: (reason: unknown) => void\n}\n\nexport function createBatcher(options: BatcherOptions): Batcher {\n  const max = options.max ?? 32\n  let queue: PendingCall[] = []\n  let flushScheduled = false\n\n  function flush(): void {\n    flushScheduled = false\n    const current = queue\n    queue = []\n    if (current.length === 0) return\n\n    // Split into chunks respecting max\n    const chunks: PendingCall[][] = []\n    for (let i = 0; i < current.length; i += max) {\n      chunks.push(current.slice(i, i + max))\n    }\n\n    for (const chunk of chunks) {\n      const payload: BatchRequest[] = chunk.map((p) => p.req)\n      options\n        .transport(payload)\n        .then((results) => {\n          for (let i = 0; i < chunk.length; i++) {\n            // `results[i]` could be undefined at runtime when the transport\n            // returns fewer entries than the chunk; TypeScript's strict\n            // typing without `noUncheckedIndexedAccess` does not surface\n            // this, so we hand-narrow.\n            const result = results.length > i ? results[i] : undefined\n            if (result === undefined) {\n              chunk[i].reject(new Error(`Batch transport returned no result for index ${i}`))\n              continue\n            }\n            if ('error' in result) {\n              const err = new Error(result.error.message)\n              ;(err as { code?: string }).code = result.error.code\n              chunk[i].reject(err)\n            } else {\n              chunk[i].resolve(result.data)\n            }\n          }\n        })\n        .catch((err: unknown) => {\n          for (const item of chunk) item.reject(err)\n        })\n    }\n  }\n\n  return {\n    dispatch(req: BatchRequest): Promise<unknown> {\n      return new Promise<unknown>((resolve, reject) => {\n        queue.push({ req, resolve, reject })\n        if (!flushScheduled) {\n          flushScheduled = true\n          queueMicrotask(flush)\n        }\n      })\n    },\n  }\n}\n","/**\n * T1.5 — Default HTTP transport for the client batcher.\n *\n * Wraps `fetch` to POST `/api/__theo_batch__` with the collected requests\n * and return the array of per-item results.\n */\n\nimport {\n  createBatcher,\n  type BatchTransport,\n  type Batcher,\n  type BatchRequest,\n  type BatchResponse,\n} from './batch.js'\n\nconst BATCH_ENDPOINT = '/api/__theo_batch__'\n\nexport interface CreateBatchTransportOptions {\n  /** Override fetch (default: globalThis.fetch). Used by tests. */\n  fetchImpl?: typeof fetch\n  /** Override endpoint (default '/api/__theo_batch__'). */\n  endpoint?: string\n}\n\nexport function createBatchTransport(options: CreateBatchTransportOptions = {}): BatchTransport {\n  const fetchImpl = options.fetchImpl ?? fetch\n  const endpoint = options.endpoint ?? BATCH_ENDPOINT\n  return async (requests: BatchRequest[]): Promise<BatchResponse[]> => {\n    const response = await fetchImpl(endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ requests }),\n    })\n    if (!response.ok) {\n      throw new Error(`Batch transport returned ${response.status}`)\n    }\n    const payload = (await response.json()) as { results?: BatchResponse[] }\n    if (!Array.isArray(payload.results)) {\n      throw new Error('Batch response missing results array')\n    }\n    // Map results to indexed BatchResponse shape (server already returns the right form)\n    return payload.results.map((item, index) => {\n      if ('error' in item) {\n        return { index, error: (item as { error: { message: string; code?: string } }).error }\n      }\n      return { index, data: (item as { data: unknown }).data }\n    })\n  }\n}\n\n// --- EC-7: singleton batcher per page, lazy-instantiated ---\n\nlet globalBatcher: Batcher | undefined\n\n/** Test-only — reset the module-scope singleton between assertions. */\nexport function __resetGlobalBatcherForTests(): void {\n  globalBatcher = undefined\n}\n\n/**\n * Returns the global batcher singleton when `globalThis.__THEO_BATCHING__` is\n * truthy; undefined otherwise. Lazy-instantiated on first call.\n */\nexport function getGlobalBatcher(): Batcher | undefined {\n  const g = globalThis as { __THEO_BATCHING__?: boolean }\n  if (!g.__THEO_BATCHING__) return undefined\n  globalBatcher ??= createBatcher({ transport: createBatchTransport() })\n  return globalBatcher\n}\n","/**\n * Phase 3 of G1 (g1-client-codegen-plan.md):\n *\n * `createAppClient(baseUrl?, fetchImpl?)` returns a Proxy that walks property\n * access (`client.posts.id.get(...)`) into a `theoFetch` invocation against\n * `{baseUrl}/posts/{params.id}` with method `GET`.\n *\n * Type safety is delivered by the `.d.ts` file emitted in Phase 2 — this\n * runtime is structurally untyped. Power users may use `theoFetch` directly\n * when they need to escape the Proxy facade.\n *\n * Edge cases absorbed:\n *  - EC-1 (thenable trap): `then` / `catch` / `finally` / `toJSON` / `Symbol.*`\n *    return `undefined` so that accidental `await client.posts` resolves to a\n *    plain Proxy value (it is NOT thenable) instead of looping.\n *  - EC-7 (abort signal): `opts.signal` is spread through to the underlying\n *    fetchImpl unchanged — verified in unit tests.\n *\n * Bundle target: ≤ 2KB gzipped.\n */\n\nimport { theoFetch, TheoFetchError } from './theo-fetch.js'\nimport type { TheoFetchOptions } from './theo-fetch.js'\nimport { HTTP_METHOD_LOWERCASE } from '../core/contracts/http-methods.js'\n\nconst HTTP_METHODS_SET = new Set(HTTP_METHOD_LOWERCASE)\n\n/**\n * Keys that JavaScript runtime / inspectors / Promise resolution probe\n * unconditionally. Returning `undefined` for these keeps the Proxy from\n * pretending to be a thenable / iterable / serializable thing.\n */\nconst NON_INTERCEPT_KEYS = new Set([\n  'then',\n  'catch',\n  'finally',\n  'toJSON',\n  'toString',\n  'valueOf',\n  'constructor',\n  'prototype',\n])\n\ntype FetchImpl = typeof theoFetch\n\ninterface CallOptions {\n  params?: Record<string, string | number>\n  query?: Record<string, unknown>\n  body?: unknown\n  signal?: AbortSignal\n  headers?: HeadersInit\n  // arbitrary RequestInit fields (mode, credentials, cache, etc.)\n  [k: string]: unknown\n}\n\nfunction injectParams(path: string, params?: Record<string, string | number>): string {\n  if (!params) {\n    if (/:(?:\\.\\.\\.)?[A-Za-z_]/.test(path)) {\n      throw new TheoFetchError(0, {\n        error: {\n          code: 'MISSING_PARAM',\n          message: `Route ${path} requires params but none were provided. Pass them via opts.params, e.g. client.posts.get({ params: { id: '123' } }).`,\n        },\n      })\n    }\n    return path\n  }\n  return path.replace(/:(?:\\.\\.\\.)?([A-Za-z_][A-Za-z0-9_]*)/g, (_match, key: string) => {\n    const value = params[key]\n    if (value === undefined || value === null || value === '') {\n      throw new TheoFetchError(0, {\n        error: {\n          code: 'MISSING_PARAM',\n          message: `Param '${key}' is required for path '${path}' but was missing/empty.`,\n        },\n      })\n    }\n    return encodeURIComponent(String(value))\n  })\n}\n\ninterface ProxyContext {\n  segments: string[]\n  baseUrl: string\n  fetchImpl: FetchImpl\n}\n\nfunction makeProxy(ctx: ProxyContext): unknown {\n  const handler: ProxyHandler<() => void> = {\n    get(_target, key) {\n      if (typeof key !== 'string') return undefined\n      if (NON_INTERCEPT_KEYS.has(key)) return undefined\n      if (HTTP_METHODS_SET.has(key)) {\n        return async (opts?: CallOptions) => {\n          if (ctx.segments.length === 0) {\n            throw new TheoFetchError(0, {\n              error: {\n                code: 'INVALID_PATH',\n                message: `client.${key}() called without a route segment. Use client.<resource>.${key}(...) instead.`,\n              },\n            })\n          }\n          let finalPath = `${ctx.baseUrl}/${ctx.segments.join('/')}`\n          if (opts?.params) {\n            // Build a path with `:name` placeholders re-inserted from segments\n            // whose name matches a key in opts.params (treat as dynamic).\n            const segmentsWithDynamic = ctx.segments.map((seg) =>\n              Object.prototype.hasOwnProperty.call(opts.params, seg) ? `:${seg}` : seg,\n            )\n            finalPath = injectParams(\n              `${ctx.baseUrl}/${segmentsWithDynamic.join('/')}`,\n              opts.params,\n            )\n          }\n          const { params: _ignored, ...rest } = opts ?? {}\n          const init = { method: key.toUpperCase(), ...rest } as unknown as TheoFetchOptions<unknown>\n          return ctx.fetchImpl(finalPath, init)\n        }\n      }\n      // Continue traversal — append segment to the path.\n      return makeProxy({ ...ctx, segments: [...ctx.segments, key] })\n    },\n    apply() {\n      return Promise.reject(\n        new TheoFetchError(0, {\n          error: {\n            code: 'INVALID_CALL',\n            message:\n              'client(...) is not callable. Use client.<resource>.<method>(opts?) — e.g. client.posts.get().',\n          },\n        }),\n      )\n    },\n  }\n  return new Proxy(() => undefined, handler)\n}\n\nexport interface CreateAppClientOptions {\n  /** Base URL for the API. Defaults to `/api`. */\n  baseUrl?: string\n  /** Test-only fetch override. Production callers should not pass this. */\n  fetchImpl?: FetchImpl\n}\n\nexport function createAppClient<TAppClient = unknown>(\n  baseUrlOrOptions?: string | CreateAppClientOptions,\n  legacyFetchImpl?: FetchImpl,\n): TAppClient {\n  let baseUrl = '/api'\n  let fetchImpl: FetchImpl = theoFetch\n  if (typeof baseUrlOrOptions === 'string') {\n    baseUrl = baseUrlOrOptions || '/api'\n  } else if (baseUrlOrOptions && typeof baseUrlOrOptions === 'object') {\n    if (baseUrlOrOptions.baseUrl) baseUrl = baseUrlOrOptions.baseUrl\n    if (baseUrlOrOptions.fetchImpl) fetchImpl = baseUrlOrOptions.fetchImpl\n  }\n  // Legacy 2nd-arg fetchImpl overrides regardless of 1st-arg shape (test seam).\n  if (legacyFetchImpl) fetchImpl = legacyFetchImpl\n  // Strip trailing slash for predictable joining.\n  if (baseUrl.length > 1 && baseUrl.endsWith('/')) baseUrl = baseUrl.slice(0, -1)\n  return makeProxy({ segments: [], baseUrl, fetchImpl }) as TAppClient\n}\n","import { useCallback, useEffect, useRef, useState } from 'react'\n\nimport type { AgentEvent } from '../core/contracts/agent-events.js'\n\nimport { consumeAgentStream } from './agent-stream-core.js'\n\n/**\n * T5.2 — useAgentStream\n *\n * React hook to consume an agent endpoint defined with `defineAgentEndpoint`.\n *\n * Transport (ADR D7, EC-3): fetch + ReadableStream — NOT EventSource.\n * EventSource is GET-only; agent endpoints need POST + body.\n *\n * Returns:\n *   events  — array of AgentEvents accumulated so far\n *   send    — call with a payload to (re)open a stream\n *   status  — 'idle' | 'streaming' | 'done' | 'error'\n *   abort   — manually cancel an in-flight stream\n *\n * Cleanup (EC-8): on unmount, the current AbortController fires .abort(),\n * which propagates to the underlying fetch and the ReadableStream reader.\n * Safe under React.StrictMode double-mount.\n */\n\nexport type AgentStreamStatus = 'idle' | 'streaming' | 'done' | 'error'\n\nexport interface UseAgentStreamReturn<TBody = unknown> {\n  events: AgentEvent[]\n  status: AgentStreamStatus\n  send: (body: TBody) => void\n  abort: () => void\n  reset: () => void\n}\n\nexport interface UseAgentStreamOptions {\n  /** Extra headers (e.g., auth). */\n  headers?: Record<string, string>\n  /** Override fetch (rare — primarily for tests). */\n  fetch?: typeof fetch\n}\n\nexport function useAgentStream<TBody = unknown>(\n  path: string,\n  options: UseAgentStreamOptions = {},\n): UseAgentStreamReturn<TBody> {\n  const [events, setEvents] = useState<AgentEvent[]>([])\n  const [status, setStatus] = useState<AgentStreamStatus>('idle')\n  const controllerRef = useRef<AbortController | null>(null)\n\n  const abort = useCallback(() => {\n    if (controllerRef.current) {\n      controllerRef.current.abort()\n      controllerRef.current = null\n    }\n  }, [])\n\n  const reset = useCallback(() => {\n    abort()\n    setEvents([])\n    setStatus('idle')\n  }, [abort])\n\n  const send = useCallback(\n    (body: TBody) => {\n      // Cancel any in-flight stream first.\n      abort()\n      const controller = new AbortController()\n      controllerRef.current = controller\n      setStatus('streaming')\n\n      let sawError = false\n      consumeAgentStream<TBody>(path, {\n        body,\n        fetch: options.fetch,\n        headers: options.headers,\n        signal: controller.signal,\n        onEvent: (event) => {\n          if (event.type === 'error') sawError = true\n          setEvents((prev) => [...prev, event])\n        },\n      })\n        .then(() => {\n          if (controllerRef.current !== controller) return // superseded\n          setStatus(sawError ? 'error' : 'done')\n        })\n        .catch(() => {\n          if (controllerRef.current !== controller) return // superseded / aborted\n          if (controller.signal.aborted) return\n          setStatus('error')\n        })\n    },\n    [abort, path, options.fetch, options.headers],\n  )\n\n  // EC-8: cleanup on unmount aborts in-flight stream.\n  useEffect(() => {\n    return () => {\n      if (controllerRef.current) {\n        controllerRef.current.abort()\n        controllerRef.current = null\n      }\n    }\n  }, [])\n\n  return { events, status, send, abort, reset }\n}\n","import type { AgentEvent } from '../core/contracts/agent-events.js'\n\n/**\n * T5.2 — Pure SSE consumer used by useAgentStream.\n *\n * Split out from the React hook so the wire behavior can be tested\n * without a DOM. The hook is glue: useState + useEffect + this primitive.\n *\n * Transport (ADR D7, EC-3): fetch + ReadableStream — NOT EventSource.\n * EventSource is GET-only and cannot carry a body. Agent endpoints need\n * POST + JSON body, so we use fetch + manual SSE chunk parsing.\n */\n\nexport interface ConsumeOptions<TBody = unknown> {\n  /** Request body — JSON-serialized into the POST. */\n  body: TBody\n  /** Called once per SSE event parsed off the stream. */\n  onEvent: (event: AgentEvent) => void\n  /** Optional fetch override (tests). */\n  fetch?: typeof fetch\n  /** Optional abort signal — passed through to fetch. */\n  signal?: AbortSignal\n  /** Extra headers (e.g., auth). */\n  headers?: Record<string, string>\n}\n\n/**\n * Dispatch SSE events from a list of `\\n\\n`-separated chunk parts.\n * Extracted to keep the streaming loop under the max-depth ceiling.\n */\nfunction dispatchSseParts(parts: string[], onEvent: (event: AgentEvent) => void): void {\n  for (const part of parts) {\n    // A chunk may contain multiple lines; keep only the data: line.\n    for (const line of part.split('\\n')) {\n      const evt = parseSSEChunk(line)\n      if (evt) onEvent(evt)\n    }\n  }\n}\n\n/**\n * Parse a single SSE line of the form `data: <json>`.\n * Returns null for non-data lines, comments, or malformed JSON.\n */\nexport function parseSSEChunk(line: string): AgentEvent | null {\n  if (!line.startsWith('data:')) return null\n  const raw = line.slice(5).trim()\n  if (!raw) return null\n  try {\n    return JSON.parse(raw) as AgentEvent\n  } catch {\n    return null\n  }\n}\n\n/**\n * POSTs to `path` with `body`, reads the SSE response, and invokes\n * `onEvent` for each parsed AgentEvent. Resolves when the server\n * closes the stream or the signal aborts.\n *\n * T1.1 — Attaches `X-Theo-Action: '1'` so 0.3.0 strict CSRF mode accepts\n * the request. The user can override (or suppress) by passing the header\n * in `options.headers` — spread order ensures their value wins.\n */\nexport async function consumeAgentStream<TBody = unknown>(\n  path: string,\n  options: ConsumeOptions<TBody>,\n): Promise<void> {\n  const fetchImpl = options.fetch ?? globalThis.fetch\n  const response = await fetchImpl(path, {\n    method: 'POST',\n    headers: {\n      'content-type': 'application/json',\n      accept: 'text/event-stream',\n      'X-Theo-Action': '1',\n      ...options.headers,\n    },\n    body: JSON.stringify(options.body),\n    signal: options.signal,\n  })\n\n  if (!response.body) return\n\n  const reader = response.body.getReader()\n  const decoder = new TextDecoder()\n  let buf = ''\n\n  try {\n    let done = false\n    while (!done) {\n      const chunk = await reader.read()\n      done = chunk.done\n      if (done) continue\n      buf += decoder.decode(chunk.value, { stream: true })\n\n      // SSE separates events with a blank line: `\\n\\n`.\n      // Split, keep the trailing partial in buf.\n      const parts = buf.split('\\n\\n')\n      buf = parts.pop() ?? ''\n      dispatchSseParts(parts, options.onEvent)\n    }\n  } finally {\n    try {\n      reader.releaseLock()\n    } catch {\n      // ignore — reader may already be released if the stream errored\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;AAAA,OAAO,eAAe;;;AC2Cf,SAAS,cAAc,SAAkC;AAC9D,QAAM,MAAM,QAAQ,OAAO;AAC3B,MAAI,QAAuB,CAAC;AAC5B,MAAI,iBAAiB;AAErB,WAAS,QAAc;AACrB,qBAAiB;AACjB,UAAM,UAAU;AAChB,YAAQ,CAAC;AACT,QAAI,QAAQ,WAAW,EAAG;AAG1B,UAAM,SAA0B,CAAC;AACjC,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,KAAK;AAC5C,aAAO,KAAK,QAAQ,MAAM,GAAG,IAAI,GAAG,CAAC;AAAA,IACvC;AAEA,eAAW,SAAS,QAAQ;AAC1B,YAAM,UAA0B,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG;AACtD,cACG,UAAU,OAAO,EACjB,KAAK,CAAC,YAAY;AACjB,iBAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AAKrC,gBAAM,SAAS,QAAQ,SAAS,IAAI,QAAQ,CAAC,IAAI;AACjD,cAAI,WAAW,QAAW;AACxB,kBAAM,CAAC,EAAE,OAAO,IAAI,MAAM,gDAAgD,CAAC,EAAE,CAAC;AAC9E;AAAA,UACF;AACA,cAAI,WAAW,QAAQ;AACrB,kBAAM,MAAM,IAAI,MAAM,OAAO,MAAM,OAAO;AACzC,YAAC,IAA0B,OAAO,OAAO,MAAM;AAChD,kBAAM,CAAC,EAAE,OAAO,GAAG;AAAA,UACrB,OAAO;AACL,kBAAM,CAAC,EAAE,QAAQ,OAAO,IAAI;AAAA,UAC9B;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,mBAAW,QAAQ,MAAO,MAAK,OAAO,GAAG;AAAA,MAC3C,CAAC;AAAA,IACL;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,KAAqC;AAC5C,aAAO,IAAI,QAAiB,CAAC,SAAS,WAAW;AAC/C,cAAM,KAAK,EAAE,KAAK,SAAS,OAAO,CAAC;AACnC,YAAI,CAAC,gBAAgB;AACnB,2BAAiB;AACjB,yBAAe,KAAK;AAAA,QACtB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACtFA,IAAM,iBAAiB;AAShB,SAAS,qBAAqB,UAAuC,CAAC,GAAmB;AAC9F,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,WAAW,QAAQ,YAAY;AACrC,SAAO,OAAO,aAAuD;AACnE,UAAM,WAAW,MAAM,UAAU,UAAU;AAAA,MACzC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,IACnC,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,4BAA4B,SAAS,MAAM,EAAE;AAAA,IAC/D;AACA,UAAM,UAAW,MAAM,SAAS,KAAK;AACrC,QAAI,CAAC,MAAM,QAAQ,QAAQ,OAAO,GAAG;AACnC,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,WAAO,QAAQ,QAAQ,IAAI,CAAC,MAAM,UAAU;AAC1C,UAAI,WAAW,MAAM;AACnB,eAAO,EAAE,OAAO,OAAQ,KAAuD,MAAM;AAAA,MACvF;AACA,aAAO,EAAE,OAAO,MAAO,KAA2B,KAAK;AAAA,IACzD,CAAC;AAAA,EACH;AACF;AAIA,IAAI;AAWG,SAAS,mBAAwC;AACtD,QAAM,IAAI;AACV,MAAI,CAAC,EAAE,kBAAmB,QAAO;AACjC,oBAAkB,cAAc,EAAE,WAAW,qBAAqB,EAAE,CAAC;AACrE,SAAO;AACT;;;AFzDA,IAAI,iBAAiB;AAiBd,SAAS,yBACd,KACA,uBACA,uBACS;AAGT,MAAI,QAAQ,IAAI;AACd,WAAO;AAAA,EACT;AAEA,QAAM,kBAAkB,yBAAyB;AACjD,MAAI,oBAAoB,yBAAyB,CAAC,gBAAgB;AAChE,qBAAiB;AACjB,YAAQ;AAAA,MACN,0CAA0C,eAAe,YAAY,qBAAqB;AAAA,IAC5F;AAAA,EACF;AAEA,MAAI,oBAAoB,eAAe,0BAA0B,aAAa;AAC5E,UAAM,UAAU,KAAK,MAAM,GAAG;AAC9B,WAAO,UAAU,YAAY,OAAO;AAAA,EACtC;AAGA,SAAO,KAAK,MAAM,GAAG;AACvB;AAoCO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EAEA,YAAY,QAAgB,MAAgB;AAC1C,UAAM,SAAS,QAAQ,OAAO,SAAS,WAAY,OAAmC;AACtF,UAAM,QAAQ,QAAQ;AACtB,UAAM,eAAe,OAAO,OAAO,YAAY,WAAW,MAAM,UAAU;AAC1E,UAAM,gBAAgB,QAAQ,OAAO,MAAM,CAAC,EAAE;AAC9C,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO,OAAO,OAAO,SAAS,WAAW,MAAM,OAAO;AAC3D,SAAK,SAAS,MAAM,QAAQ,OAAO,MAAM,IAAI,MAAM,SAAS;AAAA,EAC9D;AACF;AAOA,SAAS,oBAAoB,OAAwB;AACnD,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO,KAAK;AAAA,IACrB;AACE,aAAO,KAAK,UAAU,KAAK;AAAA,EAC/B;AACF;AAqBA,SAAS,uBAA+B;AACtC,QAAM,IAAI;AACV,QAAM,UAAU,OAAO,YAAY,cAAc,QAAQ,IAAI,cAAc;AAC3E,SAAO,EAAE,UAAU,UAAU,EAAE,mBAAmB,WAAW;AAC/D;AAEA,SAAS,cAAc,MAAc,OAAiD;AACpF,QAAM,WAAW,IAAI,IAAI,MAAM,qBAAqB,CAAC;AACrD,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,QAAI,MAAM,QAAW;AACnB,eAAS,aAAa,IAAI,GAAG,oBAAoB,CAAC,CAAC;AAAA,IACrD;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,iBAAiB,OAAwD;AAChF,QAAM,MAA8B,CAAC;AACrC,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,iBAAiB,SAAS;AAC5B,UAAM,QAAQ,CAAC,OAAO,QAAQ;AAC5B,UAAI,GAAG,IAAI;AAAA,IACb,CAAC;AACD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,CAAC,KAAK,KAAK,KAAK,MAAO,KAAI,GAAG,IAAI;AAC7C,WAAO;AAAA,EACT;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,GAAG,IAAI;AAAA,EACb;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,MAA6C;AACrE,QAAM,OAAoB,CAAC;AAC3B,MAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAClD,MAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAElD,QAAM,UAAU,iBAAiB,KAAK,OAAO;AAC7C,OAAK,UAAU;AAEf,MAAI,KAAK,SAAS,QAAW;AAC3B,SAAK,OAAO,KAAK,UAAU,KAAK,IAAI;AACpC,YAAQ,cAAc,IAAI;AAAA,EAC5B;AAKA,QAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAAW;AACjE,YAAQ,eAAe,IAAI;AAAA,EAC7B;AACA,SAAO;AACT;AAEA,eAAe,WACb,KACA,SACkE;AAClE,QAAM,UAAU,iBAAiB;AACjC,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM;AACtC,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,SAAS;AAAA,MACpC,MAAM;AAAA,MACN,QAAQ,QAAQ,UAAU;AAAA,MAC1B,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,IAChB,CAAC;AACD,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC,QAAQ;AAEN,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACF;AAEA,eAAsB,UACpB,KACA,SAC2B;AAC3B,QAAM,WAAY,WAAW,CAAC;AAG9B,QAAM,eAAe,MAAM,WAAW,KAAK,QAAQ;AACnD,MAAI,aAAa,SAAS;AACxB,WAAO,aAAa;AAAA,EACtB;AAEA,QAAM,WAAW,cAAc,KAAK,SAAS,KAAK;AAClD,QAAM,OAAO,iBAAiB,QAAQ;AACtC,QAAM,WAAW,MAAM,MAAM,SAAS,SAAS,GAAG,IAAI;AAEtD,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,SAAS,KAAK;AAAA,IAClC,QAAQ;AAAA,IAER;AACA,UAAM,IAAI,eAAe,SAAS,QAAQ,SAAS;AAAA,EACrD;AAGA,MAAI,SAAS,WAAW,KAAK;AAC3B,WAAO;AAAA,EACT;AAGA,QAAM,gBAAgB,SAAS,QAAQ,IAAI,gBAAgB;AAC3D,MAAI,kBAAkB,KAAK;AACzB,WAAO;AAAA,EACT;AAGA,QAAM,wBAAwB,SAAS,QAAQ,IAAI,oBAAoB;AACvE,QAAM,wBAAwB,6BAA6B;AAC3D,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AASA,SAAS,+BAAuC;AAC9C,QAAM,IAAI;AACV,SAAO,EAAE,wBAAwB;AACnC;;;AGxQA,IAAM,mBAAmB,IAAI,IAAI,qBAAqB;AAOtD,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcD,SAAS,aAAa,MAAc,QAAkD;AACpF,MAAI,CAAC,QAAQ;AACX,QAAI,wBAAwB,KAAK,IAAI,GAAG;AACtC,YAAM,IAAI,eAAe,GAAG;AAAA,QAC1B,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS,SAAS,IAAI;AAAA,QACxB;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,QAAQ,yCAAyC,CAAC,QAAQ,QAAgB;AACpF,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,IAAI;AACzD,YAAM,IAAI,eAAe,GAAG;AAAA,QAC1B,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS,UAAU,GAAG,2BAA2B,IAAI;AAAA,QACvD;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO,mBAAmB,OAAO,KAAK,CAAC;AAAA,EACzC,CAAC;AACH;AAQA,SAAS,UAAU,KAA4B;AAC7C,QAAM,UAAoC;AAAA,IACxC,IAAI,SAAS,KAAK;AAChB,UAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,UAAI,mBAAmB,IAAI,GAAG,EAAG,QAAO;AACxC,UAAI,iBAAiB,IAAI,GAAG,GAAG;AAC7B,eAAO,OAAO,SAAuB;AACnC,cAAI,IAAI,SAAS,WAAW,GAAG;AAC7B,kBAAM,IAAI,eAAe,GAAG;AAAA,cAC1B,OAAO;AAAA,gBACL,MAAM;AAAA,gBACN,SAAS,UAAU,GAAG,4DAA4D,GAAG;AAAA,cACvF;AAAA,YACF,CAAC;AAAA,UACH;AACA,cAAI,YAAY,GAAG,IAAI,OAAO,IAAI,IAAI,SAAS,KAAK,GAAG,CAAC;AACxD,cAAI,MAAM,QAAQ;AAGhB,kBAAM,sBAAsB,IAAI,SAAS;AAAA,cAAI,CAAC,QAC5C,OAAO,UAAU,eAAe,KAAK,KAAK,QAAQ,GAAG,IAAI,IAAI,GAAG,KAAK;AAAA,YACvE;AACA,wBAAY;AAAA,cACV,GAAG,IAAI,OAAO,IAAI,oBAAoB,KAAK,GAAG,CAAC;AAAA,cAC/C,KAAK;AAAA,YACP;AAAA,UACF;AACA,gBAAM,EAAE,QAAQ,UAAU,GAAG,KAAK,IAAI,QAAQ,CAAC;AAC/C,gBAAM,OAAO,EAAE,QAAQ,IAAI,YAAY,GAAG,GAAG,KAAK;AAClD,iBAAO,IAAI,UAAU,WAAW,IAAI;AAAA,QACtC;AAAA,MACF;AAEA,aAAO,UAAU,EAAE,GAAG,KAAK,UAAU,CAAC,GAAG,IAAI,UAAU,GAAG,EAAE,CAAC;AAAA,IAC/D;AAAA,IACA,QAAQ;AACN,aAAO,QAAQ;AAAA,QACb,IAAI,eAAe,GAAG;AAAA,UACpB,OAAO;AAAA,YACL,MAAM;AAAA,YACN,SACE;AAAA,UACJ;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI,MAAM,MAAM,QAAW,OAAO;AAC3C;AASO,SAAS,gBACd,kBACA,iBACY;AACZ,MAAI,UAAU;AACd,MAAI,YAAuB;AAC3B,MAAI,OAAO,qBAAqB,UAAU;AACxC,cAAU,oBAAoB;AAAA,EAChC,WAAW,oBAAoB,OAAO,qBAAqB,UAAU;AACnE,QAAI,iBAAiB,QAAS,WAAU,iBAAiB;AACzD,QAAI,iBAAiB,UAAW,aAAY,iBAAiB;AAAA,EAC/D;AAEA,MAAI,gBAAiB,aAAY;AAEjC,MAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAG,EAAG,WAAU,QAAQ,MAAM,GAAG,EAAE;AAC9E,SAAO,UAAU,EAAE,UAAU,CAAC,GAAG,SAAS,UAAU,CAAC;AACvD;;;ACjKA,SAAS,aAAa,WAAW,QAAQ,gBAAgB;;;AC8BzD,SAAS,iBAAiB,OAAiB,SAA4C;AACrF,aAAW,QAAQ,OAAO;AAExB,eAAW,QAAQ,KAAK,MAAM,IAAI,GAAG;AACnC,YAAM,MAAM,cAAc,IAAI;AAC9B,UAAI,IAAK,SAAQ,GAAG;AAAA,IACtB;AAAA,EACF;AACF;AAMO,SAAS,cAAc,MAAiC;AAC7D,MAAI,CAAC,KAAK,WAAW,OAAO,EAAG,QAAO;AACtC,QAAM,MAAM,KAAK,MAAM,CAAC,EAAE,KAAK;AAC/B,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,mBACpB,MACA,SACe;AACf,QAAM,YAAY,QAAQ,SAAS,WAAW;AAC9C,QAAM,WAAW,MAAM,UAAU,MAAM;AAAA,IACrC,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,QAAQ;AAAA,MACR,iBAAiB;AAAA,MACjB,GAAG,QAAQ;AAAA,IACb;AAAA,IACA,MAAM,KAAK,UAAU,QAAQ,IAAI;AAAA,IACjC,QAAQ,QAAQ;AAAA,EAClB,CAAC;AAED,MAAI,CAAC,SAAS,KAAM;AAEpB,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,MAAM;AAEV,MAAI;AACF,QAAI,OAAO;AACX,WAAO,CAAC,MAAM;AACZ,YAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,aAAO,MAAM;AACb,UAAI,KAAM;AACV,aAAO,QAAQ,OAAO,MAAM,OAAO,EAAE,QAAQ,KAAK,CAAC;AAInD,YAAM,QAAQ,IAAI,MAAM,MAAM;AAC9B,YAAM,MAAM,IAAI,KAAK;AACrB,uBAAiB,OAAO,QAAQ,OAAO;AAAA,IACzC;AAAA,EACF,UAAE;AACA,QAAI;AACF,aAAO,YAAY;AAAA,IACrB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;;;ADlEO,SAAS,eACd,MACA,UAAiC,CAAC,GACL;AAC7B,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAuB,CAAC,CAAC;AACrD,QAAM,CAAC,QAAQ,SAAS,IAAI,SAA4B,MAAM;AAC9D,QAAM,gBAAgB,OAA+B,IAAI;AAEzD,QAAM,QAAQ,YAAY,MAAM;AAC9B,QAAI,cAAc,SAAS;AACzB,oBAAc,QAAQ,MAAM;AAC5B,oBAAc,UAAU;AAAA,IAC1B;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,QAAQ,YAAY,MAAM;AAC9B,UAAM;AACN,cAAU,CAAC,CAAC;AACZ,cAAU,MAAM;AAAA,EAClB,GAAG,CAAC,KAAK,CAAC;AAEV,QAAM,OAAO;AAAA,IACX,CAAC,SAAgB;AAEf,YAAM;AACN,YAAM,aAAa,IAAI,gBAAgB;AACvC,oBAAc,UAAU;AACxB,gBAAU,WAAW;AAErB,UAAI,WAAW;AACf,yBAA0B,MAAM;AAAA,QAC9B;AAAA,QACA,OAAO,QAAQ;AAAA,QACf,SAAS,QAAQ;AAAA,QACjB,QAAQ,WAAW;AAAA,QACnB,SAAS,CAAC,UAAU;AAClB,cAAI,MAAM,SAAS,QAAS,YAAW;AACvC,oBAAU,CAAC,SAAS,CAAC,GAAG,MAAM,KAAK,CAAC;AAAA,QACtC;AAAA,MACF,CAAC,EACE,KAAK,MAAM;AACV,YAAI,cAAc,YAAY,WAAY;AAC1C,kBAAU,WAAW,UAAU,MAAM;AAAA,MACvC,CAAC,EACA,MAAM,MAAM;AACX,YAAI,cAAc,YAAY,WAAY;AAC1C,YAAI,WAAW,OAAO,QAAS;AAC/B,kBAAU,OAAO;AAAA,MACnB,CAAC;AAAA,IACL;AAAA,IACA,CAAC,OAAO,MAAM,QAAQ,OAAO,QAAQ,OAAO;AAAA,EAC9C;AAGA,YAAU,MAAM;AACd,WAAO,MAAM;AACX,UAAI,cAAc,SAAS;AACzB,sBAAc,QAAQ,MAAM;AAC5B,sBAAc,UAAU;AAAA,MAC1B;AAAA,IACF;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO,EAAE,QAAQ,QAAQ,MAAM,OAAO,MAAM;AAC9C;","names":[]}
+{"version":3,"sources":["../../src/client/theo-fetch.ts","../../src/client/batch.ts","../../src/client/batch-transport.ts","../../src/client/app-client.ts","../../src/client/use-agent-stream.ts","../../src/client/agent-stream-core.ts","../../src/client/link.tsx","../../src/client/metadata.tsx","../../src/client/image.tsx"],"sourcesContent":["import superjson from 'superjson'\nimport type { z } from 'zod'\n\nimport type { TheoErrorCode, TheoErrorEnvelope } from '../core/contracts/error-envelope.js'\n\nimport { getGlobalBatcher } from './batch-transport.js'\n\n// --- Transformer (T1.3) ---\n\n/**\n * Module-scoped flag preventing the transformer-mismatch warning from\n * firing more than once per session (EC-6).\n */\nlet mismatchWarned = false\n\n/** Test-only helper to reset the warned flag between assertions. */\nexport function __resetMismatchWarningForTests(): void {\n  mismatchWarned = false\n}\n\n/**\n * Deserialize a fetch response body according to the negotiated transformer.\n *\n * `serverTransformerName` comes from the `x-theo-transformer` response header\n * (null when absent — server is using the default JSON path).\n * `clientTransformerName` is the transformer the client was built with\n * (typically injected via a Vite virtual module; falls back to `'json'`).\n *\n * Mismatch fires a single console.warn and falls back to JSON.parse (EC-5/EC-6).\n */\nexport function deserializeFetchResponse(\n  raw: string,\n  serverTransformerName: string | null,\n  clientTransformerName: string,\n): unknown {\n  // `raw` is typed `string`, but stay defensive: callers pass `await response.text()`\n  // which can be empty.\n  if (raw === '') {\n    return null\n  }\n\n  const serverEffective = serverTransformerName ?? 'json'\n  if (serverEffective !== clientTransformerName && !mismatchWarned) {\n    mismatchWarned = true\n    console.warn(\n      `[theokit] transformer mismatch: server=${serverEffective}, client=${clientTransformerName}. Falling back to JSON.parse.`,\n    )\n  }\n\n  if (serverEffective === 'superjson' && clientTransformerName === 'superjson') {\n    const wrapped = JSON.parse(raw) as Parameters<typeof superjson.deserialize>[0]\n    return superjson.deserialize(wrapped)\n  }\n\n  // Default path (json) or mismatch fallback\n  return JSON.parse(raw)\n}\n\n// --- Utility Types ---\n\n/** Infer the response type from a route's handler return */\nexport type InferResponse<T> = T extends { handler: (...args: never[]) => infer R }\n  ? Awaited<R>\n  : unknown\n\n/** Extract the query Zod schema type, handling optional properties */\ntype ExtractQuery<T> = T extends { query?: infer Q } ? (Q extends z.ZodType ? Q : never) : never\n\n/** Extract the body Zod schema type, handling optional properties */\ntype ExtractBody<T> = T extends { body?: infer B } ? (B extends z.ZodType ? B : never) : never\n\n/** Infer query type from a route's query Zod schema */\nexport type InferQuery<T> = [ExtractQuery<T>] extends [never]\n  ? undefined\n  : ExtractQuery<T> extends z.ZodUndefined\n    ? undefined\n    : z.infer<ExtractQuery<T>>\n\n/** Infer body type from a route's body Zod schema */\nexport type InferBody<T> = [ExtractBody<T>] extends [never]\n  ? undefined\n  : ExtractBody<T> extends z.ZodUndefined\n    ? undefined\n    : z.infer<ExtractBody<T>>\n\n/** Build the options type based on what schemas the route has */\nexport type TheoFetchOptions<T> = Omit<RequestInit, 'body' | 'method'> &\n  (InferQuery<T> extends undefined ? { query?: never } : { query: InferQuery<T> }) &\n  (InferBody<T> extends undefined ? { body?: never } : { body: InferBody<T> })\n\n// --- Error Class ---\n\n/**\n * G5 T2.1 — extract a TheoErrorEnvelope from a response body. Supports both\n * the new envelope-at-root shape (`{ code, message, ext?, ... }`, blueprint\n * Recommendations § concrete shape) and the legacy nested shape\n * (`{ error: { code, message, issues? } }`, G3 SerializedActionResult).\n *\n * Falls back to `INTERNAL_SERVER_ERROR` with a synthetic message when the\n * body shape is unrecognized. Pure; no I/O.\n */\nfunction extractEnvelope(status: number, body: unknown): TheoErrorEnvelope {\n  if (!body || typeof body !== 'object') {\n    return { code: 'INTERNAL_SERVER_ERROR', message: `HTTP ${String(status)}` }\n  }\n  const obj = body as Record<string, unknown>\n  // New shape — envelope at root\n  if (typeof obj.code === 'string' && typeof obj.message === 'string') {\n    return {\n      code: obj.code as TheoErrorCode,\n      message: obj.message,\n      cause: obj.cause,\n      meta: obj.meta as Record<string, unknown> | undefined,\n      ext: obj.ext,\n    }\n  }\n  // Legacy shape — { error: { code, message, ... } }\n  if (obj.error && typeof obj.error === 'object') {\n    const nested = obj.error as Record<string, unknown>\n    return {\n      code:\n        typeof nested.code === 'string' ? (nested.code as TheoErrorCode) : 'INTERNAL_SERVER_ERROR',\n      message: typeof nested.message === 'string' ? nested.message : `HTTP ${String(status)}`,\n    }\n  }\n  return { code: 'INTERNAL_SERVER_ERROR', message: `HTTP ${String(status)}` }\n}\n\n/**\n * Pull a single string field from an object, returning undefined if missing\n * or non-string. Helper for `extractLegacyFields` to stay under the\n * complexity ceiling.\n */\nfunction strField(obj: Record<string, unknown> | null, key: string): string | undefined {\n  const v = obj?.[key]\n  return typeof v === 'string' ? v : undefined\n}\n\n/**\n * Pull the canonical {message, code, issues} from either an envelope-at-root\n * body or the legacy { error: {...} } body. Pure.\n */\nfunction extractLegacyFields(\n  status: number,\n  body: unknown,\n): { message: string; code?: string; issues?: unknown[] } {\n  if (!body || typeof body !== 'object') {\n    return { message: `HTTP ${String(status)}` }\n  }\n  const obj = body as Record<string, unknown>\n  const nested =\n    obj.error && typeof obj.error === 'object' ? (obj.error as Record<string, unknown>) : null\n  const issues = Array.isArray(nested?.issues) ? nested.issues : undefined\n  return {\n    message: strField(obj, 'message') ?? strField(nested, 'message') ?? `HTTP ${String(status)}`,\n    code: strField(obj, 'code') ?? strField(nested, 'code'),\n    issues,\n  }\n}\n\nexport class TheoFetchError extends Error {\n  status: number\n  code?: string\n  issues?: unknown[]\n  /**\n   * G5 T2.1 — canonical envelope view of the server-side error. Use this in\n   * consumer code that wants to switch on a typed TheoErrorCode instead of\n   * coupling to the legacy `.status` / `.code` flat fields.\n   */\n  readonly envelope: TheoErrorEnvelope\n\n  constructor(status: number, body?: unknown) {\n    const legacy = extractLegacyFields(status, body)\n    super(legacy.message)\n    this.name = 'TheoFetchError'\n    this.status = status\n    this.code = legacy.code\n    this.issues = legacy.issues\n    this.envelope = extractEnvelope(status, body)\n  }\n}\n\n/**\n * Serialize a query-param value to a string. Handles primitives, dates,\n * and falls back to JSON for arrays/objects. Avoids the\n * `[object Object]` foot-gun that `no-base-to-string` warns against.\n */\nfunction stringifyQueryValue(value: unknown): string {\n  if (value === null) return 'null'\n  if (value instanceof Date) return value.toISOString()\n  switch (typeof value) {\n    case 'string':\n      return value\n    case 'number':\n    case 'boolean':\n    case 'bigint':\n      return String(value)\n    default:\n      return JSON.stringify(value)\n  }\n}\n\n// --- Main Function ---\n\ninterface TheoFetchInternalOptions {\n  method?: string\n  query?: Record<string, unknown>\n  body?: unknown\n  headers?: HeadersInit\n  signal?: AbortSignal\n}\n\n/**\n * Resolve the request origin per the documented fallback hierarchy. Pure\n * helper extracted to keep `theoFetch` under the complexity ceiling.\n *   1. `globalThis.location.origin` (browser)\n *   2. `globalThis.__THEO_ORIGIN__` (build-time literal)\n *   3. `process.env.THEO_ORIGIN` (escape hatch)\n *   4. `http://localhost` (placeholder for URL parsing — the URL is built\n *      relative so only pathname+search ever flows to the wire)\n */\nfunction resolveRequestOrigin(): string {\n  const g = globalThis as { location?: { origin?: string }; __THEO_ORIGIN__?: string }\n  const fromEnv = typeof process !== 'undefined' ? process.env.THEO_ORIGIN : undefined\n  return g.location?.origin ?? g.__THEO_ORIGIN__ ?? fromEnv ?? 'http://localhost'\n}\n\nfunction buildFetchUrl(path: string, query: Record<string, unknown> | undefined): URL {\n  const fetchUrl = new URL(path, resolveRequestOrigin())\n  if (!query) return fetchUrl\n  for (const [k, v] of Object.entries(query)) {\n    if (v !== undefined) {\n      fetchUrl.searchParams.set(k, stringifyQueryValue(v))\n    }\n  }\n  return fetchUrl\n}\n\n/**\n * Normalize `HeadersInit` (Headers / `[string, string][]` / Record) into a\n * single plain `Record<string, string>`. Plain-object output is required\n * by callers that introspect headers via index access (test fixtures use\n * `(init.headers as Record<string, string>)['Content-Type']`).\n */\nfunction normalizeHeaders(input: HeadersInit | undefined): Record<string, string> {\n  const out: Record<string, string> = {}\n  if (!input) return out\n  if (input instanceof Headers) {\n    input.forEach((value, key) => {\n      out[key] = value\n    })\n    return out\n  }\n  if (Array.isArray(input)) {\n    for (const [key, value] of input) out[key] = value\n    return out\n  }\n  for (const [key, value] of Object.entries(input)) {\n    out[key] = value\n  }\n  return out\n}\n\nfunction buildRequestInit(opts: TheoFetchInternalOptions): RequestInit {\n  const init: RequestInit = {}\n  if (opts.method !== undefined) init.method = opts.method\n  if (opts.signal !== undefined) init.signal = opts.signal\n\n  const headers = normalizeHeaders(opts.headers)\n  init.headers = headers\n\n  if (opts.body !== undefined) {\n    init.body = JSON.stringify(opts.body)\n    headers['Content-Type'] = 'application/json'\n  }\n\n  // Phase 5 — Auto-attach `X-Theo-Action: 1` for state-mutating methods so\n  // the framework's CSRF check passes when servers run in `strict` mode.\n  // Safe methods (GET/HEAD/OPTIONS) skip the header to keep them cacheable.\n  const method = (opts.method ?? 'GET').toUpperCase()\n  if (method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS') {\n    headers['X-Theo-Action'] = '1'\n  }\n  return init\n}\n\nasync function tryBatcher(\n  url: string,\n  options: TheoFetchInternalOptions,\n): Promise<{ matched: true; result: unknown } | { matched: false }> {\n  const batcher = getGlobalBatcher()\n  if (!batcher) return { matched: false }\n  try {\n    const result = await batcher.dispatch({\n      path: url,\n      method: options.method ?? 'GET',\n      query: options.query,\n      body: options.body,\n    })\n    return { matched: true, result }\n  } catch {\n    // Batcher failure: fall through to direct fetch (graceful degrade).\n    return { matched: false }\n  }\n}\n\nexport async function theoFetch<T>(\n  url: string,\n  options?: TheoFetchOptions<T>,\n): Promise<InferResponse<T>> {\n  const internal = (options ?? {}) as unknown as TheoFetchInternalOptions\n\n  // T1.5 — Transparent batching when globalThis.__THEO_BATCHING__ is truthy.\n  const batchAttempt = await tryBatcher(url, internal)\n  if (batchAttempt.matched) {\n    return batchAttempt.result as InferResponse<T>\n  }\n\n  const fetchUrl = buildFetchUrl(url, internal.query)\n  const init = buildRequestInit(internal)\n  const response = await fetch(fetchUrl.toString(), init)\n\n  if (!response.ok) {\n    let errorBody: unknown\n    try {\n      errorBody = await response.json()\n    } catch {\n      // Non-JSON error response\n    }\n    throw new TheoFetchError(response.status, errorBody)\n  }\n\n  // Handle 204 No Content (EC-1)\n  if (response.status === 204) {\n    return null as InferResponse<T>\n  }\n\n  // Check for empty body\n  const contentLength = response.headers.get('content-length')\n  if (contentLength === '0') {\n    return null as InferResponse<T>\n  }\n\n  // T1.3 — transformer-aware deserialization\n  const serverTransformerName = response.headers.get('x-theo-transformer')\n  const clientTransformerName = resolveClientTransformerName()\n  const text = await response.text()\n  return deserializeFetchResponse(\n    text,\n    serverTransformerName,\n    clientTransformerName,\n  ) as InferResponse<T>\n}\n\n/**\n * Read the client-configured transformer name. Default `'json'`.\n *\n * In a Vite build, this is overridden by virtual module\n * `/@theo/runtime-config` which sets `globalThis.__THEO_TRANSFORMER__`.\n * Outside Vite (Node SSR, tests) the default applies.\n */\nfunction resolveClientTransformerName(): string {\n  const g = globalThis as { __THEO_TRANSFORMER__?: string }\n  return g.__THEO_TRANSFORMER__ ?? 'json'\n}\n","/**\n * T5.1 — client-side microtask batching.\n *\n * Collects all `dispatch` calls within the same microtask and sends them as a\n * single HTTP POST to the configured transport. Each caller's promise resolves\n * with its own result; one failed item does not break the others (per-item\n * error isolation).\n *\n * Designed as a transport-agnostic primitive so unit tests do not require\n * network access. The default transport (fetch to `/api/__theo_batch__`)\n * lives alongside this module but is created by the consumer (e.g., theoFetch).\n */\n\nexport interface BatchRequest {\n  path: string\n  method: string\n  query?: Record<string, unknown>\n  body?: unknown\n  headers?: Record<string, string>\n}\n\nexport type BatchResponse =\n  | { index: number; data: unknown }\n  | { index: number; error: { message: string; code?: string } }\n\nexport type BatchTransport = (requests: BatchRequest[]) => Promise<BatchResponse[]>\n\nexport interface BatcherOptions {\n  transport: BatchTransport\n  /** Maximum batch size before flushing into multiple parallel batches. */\n  max?: number\n}\n\nexport interface Batcher {\n  dispatch(req: BatchRequest): Promise<unknown>\n}\n\ninterface PendingCall {\n  req: BatchRequest\n  resolve: (value: unknown) => void\n  reject: (reason: unknown) => void\n}\n\nexport function createBatcher(options: BatcherOptions): Batcher {\n  const max = options.max ?? 32\n  let queue: PendingCall[] = []\n  let flushScheduled = false\n\n  function flush(): void {\n    flushScheduled = false\n    const current = queue\n    queue = []\n    if (current.length === 0) return\n\n    // Split into chunks respecting max\n    const chunks: PendingCall[][] = []\n    for (let i = 0; i < current.length; i += max) {\n      chunks.push(current.slice(i, i + max))\n    }\n\n    for (const chunk of chunks) {\n      const payload: BatchRequest[] = chunk.map((p) => p.req)\n      options\n        .transport(payload)\n        .then((results) => {\n          for (let i = 0; i < chunk.length; i++) {\n            // `results[i]` could be undefined at runtime when the transport\n            // returns fewer entries than the chunk; TypeScript's strict\n            // typing without `noUncheckedIndexedAccess` does not surface\n            // this, so we hand-narrow.\n            const result = results.length > i ? results[i] : undefined\n            if (result === undefined) {\n              chunk[i].reject(new Error(`Batch transport returned no result for index ${i}`))\n              continue\n            }\n            if ('error' in result) {\n              const err = new Error(result.error.message)\n              ;(err as { code?: string }).code = result.error.code\n              chunk[i].reject(err)\n            } else {\n              chunk[i].resolve(result.data)\n            }\n          }\n        })\n        .catch((err: unknown) => {\n          for (const item of chunk) item.reject(err)\n        })\n    }\n  }\n\n  return {\n    dispatch(req: BatchRequest): Promise<unknown> {\n      return new Promise<unknown>((resolve, reject) => {\n        queue.push({ req, resolve, reject })\n        if (!flushScheduled) {\n          flushScheduled = true\n          queueMicrotask(flush)\n        }\n      })\n    },\n  }\n}\n","/**\n * T1.5 — Default HTTP transport for the client batcher.\n *\n * Wraps `fetch` to POST `/api/__theo_batch__` with the collected requests\n * and return the array of per-item results.\n */\n\nimport {\n  createBatcher,\n  type BatchTransport,\n  type Batcher,\n  type BatchRequest,\n  type BatchResponse,\n} from './batch.js'\n\nconst BATCH_ENDPOINT = '/api/__theo_batch__'\n\nexport interface CreateBatchTransportOptions {\n  /** Override fetch (default: globalThis.fetch). Used by tests. */\n  fetchImpl?: typeof fetch\n  /** Override endpoint (default '/api/__theo_batch__'). */\n  endpoint?: string\n}\n\nexport function createBatchTransport(options: CreateBatchTransportOptions = {}): BatchTransport {\n  const fetchImpl = options.fetchImpl ?? fetch\n  const endpoint = options.endpoint ?? BATCH_ENDPOINT\n  return async (requests: BatchRequest[]): Promise<BatchResponse[]> => {\n    const response = await fetchImpl(endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ requests }),\n    })\n    if (!response.ok) {\n      throw new Error(`Batch transport returned ${response.status}`)\n    }\n    const payload = (await response.json()) as { results?: BatchResponse[] }\n    if (!Array.isArray(payload.results)) {\n      throw new Error('Batch response missing results array')\n    }\n    // Map results to indexed BatchResponse shape (server already returns the right form)\n    return payload.results.map((item, index) => {\n      if ('error' in item) {\n        return { index, error: (item as { error: { message: string; code?: string } }).error }\n      }\n      return { index, data: (item as { data: unknown }).data }\n    })\n  }\n}\n\n// --- EC-7: singleton batcher per page, lazy-instantiated ---\n\nlet globalBatcher: Batcher | undefined\n\n/** Test-only — reset the module-scope singleton between assertions. */\nexport function __resetGlobalBatcherForTests(): void {\n  globalBatcher = undefined\n}\n\n/**\n * Returns the global batcher singleton when `globalThis.__THEO_BATCHING__` is\n * truthy; undefined otherwise. Lazy-instantiated on first call.\n */\nexport function getGlobalBatcher(): Batcher | undefined {\n  const g = globalThis as { __THEO_BATCHING__?: boolean }\n  if (!g.__THEO_BATCHING__) return undefined\n  globalBatcher ??= createBatcher({ transport: createBatchTransport() })\n  return globalBatcher\n}\n","/**\n * Phase 3 of G1 (g1-client-codegen-plan.md):\n *\n * `createAppClient(baseUrl?, fetchImpl?)` returns a Proxy that walks property\n * access (`client.posts.id.get(...)`) into a `theoFetch` invocation against\n * `{baseUrl}/posts/{params.id}` with method `GET`.\n *\n * Type safety is delivered by the `.d.ts` file emitted in Phase 2 — this\n * runtime is structurally untyped. Power users may use `theoFetch` directly\n * when they need to escape the Proxy facade.\n *\n * Edge cases absorbed:\n *  - EC-1 (thenable trap): `then` / `catch` / `finally` / `toJSON` / `Symbol.*`\n *    return `undefined` so that accidental `await client.posts` resolves to a\n *    plain Proxy value (it is NOT thenable) instead of looping.\n *  - EC-7 (abort signal): `opts.signal` is spread through to the underlying\n *    fetchImpl unchanged — verified in unit tests.\n *\n * Bundle target: ≤ 2KB gzipped.\n */\n\nimport { theoFetch, TheoFetchError } from './theo-fetch.js'\nimport type { TheoFetchOptions } from './theo-fetch.js'\nimport { HTTP_METHOD_LOWERCASE } from '../core/contracts/http-methods.js'\n\nconst HTTP_METHODS_SET = new Set(HTTP_METHOD_LOWERCASE)\n\n/**\n * Keys that JavaScript runtime / inspectors / Promise resolution probe\n * unconditionally. Returning `undefined` for these keeps the Proxy from\n * pretending to be a thenable / iterable / serializable thing.\n */\nconst NON_INTERCEPT_KEYS = new Set([\n  'then',\n  'catch',\n  'finally',\n  'toJSON',\n  'toString',\n  'valueOf',\n  'constructor',\n  'prototype',\n])\n\ntype FetchImpl = typeof theoFetch\n\ninterface CallOptions {\n  params?: Record<string, string | number>\n  query?: Record<string, unknown>\n  body?: unknown\n  signal?: AbortSignal\n  headers?: HeadersInit\n  // arbitrary RequestInit fields (mode, credentials, cache, etc.)\n  [k: string]: unknown\n}\n\nfunction injectParams(path: string, params?: Record<string, string | number>): string {\n  if (!params) {\n    if (/:(?:\\.\\.\\.)?[A-Za-z_]/.test(path)) {\n      throw new TheoFetchError(0, {\n        error: {\n          code: 'MISSING_PARAM',\n          message: `Route ${path} requires params but none were provided. Pass them via opts.params, e.g. client.posts.get({ params: { id: '123' } }).`,\n        },\n      })\n    }\n    return path\n  }\n  return path.replace(/:(?:\\.\\.\\.)?([A-Za-z_][A-Za-z0-9_]*)/g, (_match, key: string) => {\n    const value = params[key]\n    if (value === undefined || value === null || value === '') {\n      throw new TheoFetchError(0, {\n        error: {\n          code: 'MISSING_PARAM',\n          message: `Param '${key}' is required for path '${path}' but was missing/empty.`,\n        },\n      })\n    }\n    return encodeURIComponent(String(value))\n  })\n}\n\ninterface ProxyContext {\n  segments: string[]\n  baseUrl: string\n  fetchImpl: FetchImpl\n}\n\nfunction makeProxy(ctx: ProxyContext): unknown {\n  const handler: ProxyHandler<() => void> = {\n    get(_target, key) {\n      if (typeof key !== 'string') return undefined\n      if (NON_INTERCEPT_KEYS.has(key)) return undefined\n      if (HTTP_METHODS_SET.has(key)) {\n        return async (opts?: CallOptions) => {\n          if (ctx.segments.length === 0) {\n            throw new TheoFetchError(0, {\n              error: {\n                code: 'INVALID_PATH',\n                message: `client.${key}() called without a route segment. Use client.<resource>.${key}(...) instead.`,\n              },\n            })\n          }\n          let finalPath = `${ctx.baseUrl}/${ctx.segments.join('/')}`\n          if (opts?.params) {\n            // Build a path with `:name` placeholders re-inserted from segments\n            // whose name matches a key in opts.params (treat as dynamic).\n            const segmentsWithDynamic = ctx.segments.map((seg) =>\n              Object.prototype.hasOwnProperty.call(opts.params, seg) ? `:${seg}` : seg,\n            )\n            finalPath = injectParams(\n              `${ctx.baseUrl}/${segmentsWithDynamic.join('/')}`,\n              opts.params,\n            )\n          }\n          const { params: _ignored, ...rest } = opts ?? {}\n          const init = { method: key.toUpperCase(), ...rest } as unknown as TheoFetchOptions<unknown>\n          return ctx.fetchImpl(finalPath, init)\n        }\n      }\n      // Continue traversal — append segment to the path.\n      return makeProxy({ ...ctx, segments: [...ctx.segments, key] })\n    },\n    apply() {\n      return Promise.reject(\n        new TheoFetchError(0, {\n          error: {\n            code: 'INVALID_CALL',\n            message:\n              'client(...) is not callable. Use client.<resource>.<method>(opts?) — e.g. client.posts.get().',\n          },\n        }),\n      )\n    },\n  }\n  return new Proxy(() => undefined, handler)\n}\n\nexport interface CreateAppClientOptions {\n  /** Base URL for the API. Defaults to `/api`. */\n  baseUrl?: string\n  /** Test-only fetch override. Production callers should not pass this. */\n  fetchImpl?: FetchImpl\n}\n\nexport function createAppClient<TAppClient = unknown>(\n  baseUrlOrOptions?: string | CreateAppClientOptions,\n  legacyFetchImpl?: FetchImpl,\n): TAppClient {\n  let baseUrl = '/api'\n  let fetchImpl: FetchImpl = theoFetch\n  if (typeof baseUrlOrOptions === 'string') {\n    baseUrl = baseUrlOrOptions || '/api'\n  } else if (baseUrlOrOptions && typeof baseUrlOrOptions === 'object') {\n    if (baseUrlOrOptions.baseUrl) baseUrl = baseUrlOrOptions.baseUrl\n    if (baseUrlOrOptions.fetchImpl) fetchImpl = baseUrlOrOptions.fetchImpl\n  }\n  // Legacy 2nd-arg fetchImpl overrides regardless of 1st-arg shape (test seam).\n  if (legacyFetchImpl) fetchImpl = legacyFetchImpl\n  // Strip trailing slash for predictable joining.\n  if (baseUrl.length > 1 && baseUrl.endsWith('/')) baseUrl = baseUrl.slice(0, -1)\n  return makeProxy({ segments: [], baseUrl, fetchImpl }) as TAppClient\n}\n","import { useCallback, useEffect, useRef, useState } from 'react'\n\nimport type { AgentEvent } from '../core/contracts/agent-events.js'\n\nimport { consumeAgentStream } from './agent-stream-core.js'\n\n/**\n * T5.2 — useAgentStream\n *\n * React hook to consume an agent endpoint defined with `defineAgentEndpoint`.\n *\n * Transport (ADR D7, EC-3): fetch + ReadableStream — NOT EventSource.\n * EventSource is GET-only; agent endpoints need POST + body.\n *\n * Returns:\n *   events  — array of AgentEvents accumulated so far\n *   send    — call with a payload to (re)open a stream\n *   status  — 'idle' | 'streaming' | 'done' | 'error'\n *   abort   — manually cancel an in-flight stream\n *\n * Cleanup (EC-8): on unmount, the current AbortController fires .abort(),\n * which propagates to the underlying fetch and the ReadableStream reader.\n * Safe under React.StrictMode double-mount.\n */\n\nexport type AgentStreamStatus = 'idle' | 'streaming' | 'done' | 'error'\n\nexport interface UseAgentStreamReturn<TBody = unknown> {\n  events: AgentEvent[]\n  status: AgentStreamStatus\n  send: (body: TBody) => void\n  abort: () => void\n  reset: () => void\n}\n\nexport interface UseAgentStreamOptions {\n  /** Extra headers (e.g., auth). */\n  headers?: Record<string, string>\n  /** Override fetch (rare — primarily for tests). */\n  fetch?: typeof fetch\n}\n\nexport function useAgentStream<TBody = unknown>(\n  path: string,\n  options: UseAgentStreamOptions = {},\n): UseAgentStreamReturn<TBody> {\n  const [events, setEvents] = useState<AgentEvent[]>([])\n  const [status, setStatus] = useState<AgentStreamStatus>('idle')\n  const controllerRef = useRef<AbortController | null>(null)\n\n  const abort = useCallback(() => {\n    if (controllerRef.current) {\n      controllerRef.current.abort()\n      controllerRef.current = null\n    }\n  }, [])\n\n  const reset = useCallback(() => {\n    abort()\n    setEvents([])\n    setStatus('idle')\n  }, [abort])\n\n  const send = useCallback(\n    (body: TBody) => {\n      // Cancel any in-flight stream first.\n      abort()\n      const controller = new AbortController()\n      controllerRef.current = controller\n      setStatus('streaming')\n\n      let sawError = false\n      consumeAgentStream<TBody>(path, {\n        body,\n        fetch: options.fetch,\n        headers: options.headers,\n        signal: controller.signal,\n        onEvent: (event) => {\n          if (event.type === 'error') sawError = true\n          setEvents((prev) => [...prev, event])\n        },\n      })\n        .then(() => {\n          if (controllerRef.current !== controller) return // superseded\n          setStatus(sawError ? 'error' : 'done')\n        })\n        .catch(() => {\n          if (controllerRef.current !== controller) return // superseded / aborted\n          if (controller.signal.aborted) return\n          setStatus('error')\n        })\n    },\n    [abort, path, options.fetch, options.headers],\n  )\n\n  // EC-8: cleanup on unmount aborts in-flight stream.\n  useEffect(() => {\n    return () => {\n      if (controllerRef.current) {\n        controllerRef.current.abort()\n        controllerRef.current = null\n      }\n    }\n  }, [])\n\n  return { events, status, send, abort, reset }\n}\n","import type { AgentEvent } from '../core/contracts/agent-events.js'\n\n/**\n * T5.2 — Pure SSE consumer used by useAgentStream.\n *\n * Split out from the React hook so the wire behavior can be tested\n * without a DOM. The hook is glue: useState + useEffect + this primitive.\n *\n * Transport (ADR D7, EC-3): fetch + ReadableStream — NOT EventSource.\n * EventSource is GET-only and cannot carry a body. Agent endpoints need\n * POST + JSON body, so we use fetch + manual SSE chunk parsing.\n */\n\nexport interface ConsumeOptions<TBody = unknown> {\n  /** Request body — JSON-serialized into the POST. */\n  body: TBody\n  /** Called once per SSE event parsed off the stream. */\n  onEvent: (event: AgentEvent) => void\n  /** Optional fetch override (tests). */\n  fetch?: typeof fetch\n  /** Optional abort signal — passed through to fetch. */\n  signal?: AbortSignal\n  /** Extra headers (e.g., auth). */\n  headers?: Record<string, string>\n}\n\n/**\n * Dispatch SSE events from a list of `\\n\\n`-separated chunk parts.\n * Extracted to keep the streaming loop under the max-depth ceiling.\n */\nfunction dispatchSseParts(parts: string[], onEvent: (event: AgentEvent) => void): void {\n  for (const part of parts) {\n    // A chunk may contain multiple lines; keep only the data: line.\n    for (const line of part.split('\\n')) {\n      const evt = parseSSEChunk(line)\n      if (evt) onEvent(evt)\n    }\n  }\n}\n\n/**\n * Parse a single SSE line of the form `data: <json>`.\n * Returns null for non-data lines, comments, or malformed JSON.\n */\nexport function parseSSEChunk(line: string): AgentEvent | null {\n  if (!line.startsWith('data:')) return null\n  const raw = line.slice(5).trim()\n  if (!raw) return null\n  try {\n    return JSON.parse(raw) as AgentEvent\n  } catch {\n    return null\n  }\n}\n\n/**\n * POSTs to `path` with `body`, reads the SSE response, and invokes\n * `onEvent` for each parsed AgentEvent. Resolves when the server\n * closes the stream or the signal aborts.\n *\n * T1.1 — Attaches `X-Theo-Action: '1'` so 0.3.0 strict CSRF mode accepts\n * the request. The user can override (or suppress) by passing the header\n * in `options.headers` — spread order ensures their value wins.\n */\nexport async function consumeAgentStream<TBody = unknown>(\n  path: string,\n  options: ConsumeOptions<TBody>,\n): Promise<void> {\n  const fetchImpl = options.fetch ?? globalThis.fetch\n  const response = await fetchImpl(path, {\n    method: 'POST',\n    headers: {\n      'content-type': 'application/json',\n      accept: 'text/event-stream',\n      'X-Theo-Action': '1',\n      ...options.headers,\n    },\n    body: JSON.stringify(options.body),\n    signal: options.signal,\n  })\n\n  if (!response.body) return\n\n  const reader = response.body.getReader()\n  const decoder = new TextDecoder()\n  let buf = ''\n\n  try {\n    let done = false\n    while (!done) {\n      const chunk = await reader.read()\n      done = chunk.done\n      if (done) continue\n      buf += decoder.decode(chunk.value, { stream: true })\n\n      // SSE separates events with a blank line: `\\n\\n`.\n      // Split, keep the trailing partial in buf.\n      const parts = buf.split('\\n\\n')\n      buf = parts.pop() ?? ''\n      dispatchSseParts(parts, options.onEvent)\n    }\n  } finally {\n    try {\n      reader.releaseLock()\n    } catch {\n      // ignore — reader may already be released if the stream errored\n    }\n  }\n}\n","/**\n * <Link> — React Router Link with route prefetching.\n *\n * Wraps react-router's <Link> with prefetch behavior:\n *   - `intent` (default): prefetch on hover + focus (~200ms before click)\n *   - `viewport`: prefetch when visible (IntersectionObserver)\n *   - `none`: no prefetch (same as plain react-router Link)\n *\n * Uses `<link rel=\"prefetch\">` (not modulepreload) because route paths\n * can be prefetched directly — no Vite manifest resolution needed (EC-1).\n */\nimport {\n  Link as RouterLink,\n  type LinkProps as RouterLinkProps,\n} from 'react-router'\nimport { useRef, useCallback, useEffect } from 'react'\n\nexport type PrefetchBehavior = 'none' | 'intent' | 'viewport'\n\nexport interface LinkProps extends RouterLinkProps {\n  /** Prefetch strategy. Default: 'intent' (on hover + focus). */\n  prefetch?: PrefetchBehavior\n}\n\n/** Deduplication — each URL prefetched at most once per session. */\nconst prefetched = new Set<string>()\n\nfunction injectPrefetch(href: string): void {\n  // EC-2: SSR guard — document unavailable on server\n  if (typeof document === 'undefined') return\n  if (prefetched.has(href)) return\n  prefetched.add(href)\n\n  const link = document.createElement('link')\n  link.rel = 'prefetch'\n  link.href = href\n  document.head.appendChild(link)\n}\n\nfunction resolveTo(to: LinkProps['to']): string {\n  if (typeof to === 'string') return to\n  return to?.pathname ?? ''\n}\n\n/**\n * TheoKit Link — drop-in replacement for react-router Link with prefetch.\n *\n * @example\n * ```tsx\n * import { Link } from 'theokit/client'\n *\n * <Link to=\"/contacts\">Contacts</Link>\n * <Link to=\"/dashboard\" prefetch=\"viewport\">Dashboard</Link>\n * <Link to=\"/settings\" prefetch=\"none\">Settings</Link>\n * ```\n */\nexport function Link({ prefetch = 'intent', to, onMouseEnter, onFocus, ...rest }: LinkProps) {\n  const ref = useRef<HTMLAnchorElement>(null)\n\n  const handleIntent = useCallback(\n    (event: React.MouseEvent<HTMLAnchorElement> | React.FocusEvent<HTMLAnchorElement>) => {\n      if (prefetch === 'intent') {\n        injectPrefetch(resolveTo(to))\n      }\n      // Forward original handlers\n      if (event.type === 'mouseenter' && onMouseEnter) {\n        ;(onMouseEnter as React.MouseEventHandler<HTMLAnchorElement>)(event as React.MouseEvent<HTMLAnchorElement>)\n      }\n      if (event.type === 'focus' && onFocus) {\n        ;(onFocus as React.FocusEventHandler<HTMLAnchorElement>)(event as React.FocusEvent<HTMLAnchorElement>)\n      }\n    },\n    [prefetch, to, onMouseEnter, onFocus],\n  )\n\n  // Viewport mode: IntersectionObserver\n  useEffect(() => {\n    if (prefetch !== 'viewport' || !ref.current) return\n    if (typeof IntersectionObserver === 'undefined') return // SSR guard\n\n    const observer = new IntersectionObserver(\n      ([entry]) => {\n        if (entry.isIntersecting) {\n          injectPrefetch(resolveTo(to))\n          observer.disconnect()\n        }\n      },\n      { rootMargin: '200px' }, // prefetch slightly before visible\n    )\n    observer.observe(ref.current)\n    return () => observer.disconnect()\n  }, [prefetch, to])\n\n  return (\n    <RouterLink\n      ref={ref}\n      to={to}\n      onMouseEnter={handleIntent}\n      onFocus={handleIntent}\n      {...rest}\n    />\n  )\n}\n","/**\n * <Metadata> — SEO-ready head tags from a single component.\n *\n * Uses React 19's native <title>/<meta>/<link> hoisting to <head>.\n * No build-time extraction needed — works in SSR and client.\n *\n * @example\n * ```tsx\n * import { Metadata } from 'theokit/client'\n *\n * export default function ContactsPage() {\n *   return (\n *     <>\n *       <Metadata\n *         title=\"Contacts | My CRM\"\n *         description=\"Manage your contacts\"\n *         ogImage=\"/og/contacts.png\"\n *         canonical=\"https://mycrm.com/contacts\"\n *       />\n *       <h1>Contacts</h1>\n *     </>\n *   )\n * }\n * ```\n */\n\nexport interface MetadataProps {\n  title?: string\n  description?: string\n  canonical?: string\n  ogTitle?: string\n  ogDescription?: string\n  ogImage?: string\n  ogType?: string\n  ogUrl?: string\n  twitterCard?: 'summary' | 'summary_large_image'\n  /** Custom meta tags rendered as children */\n  children?: React.ReactNode\n}\n\nexport function Metadata(props: MetadataProps) {\n  const ogTitle = props.ogTitle ?? props.title\n  const ogDesc = props.ogDescription ?? props.description\n\n  return (\n    <>\n      {props.title && <title>{props.title}</title>}\n      {props.description && <meta name=\"description\" content={props.description} />}\n      {props.canonical && <link rel=\"canonical\" href={props.canonical} />}\n      {ogTitle && <meta property=\"og:title\" content={ogTitle} />}\n      {ogDesc && <meta property=\"og:description\" content={ogDesc} />}\n      {props.ogImage && <meta property=\"og:image\" content={props.ogImage} />}\n      {props.ogType && <meta property=\"og:type\" content={props.ogType} />}\n      {props.ogUrl && <meta property=\"og:url\" content={props.ogUrl} />}\n      {props.twitterCard && <meta name=\"twitter:card\" content={props.twitterCard} />}\n      {props.children}\n    </>\n  )\n}\n","/**\n * <Image> — optimized image component with lazy loading.\n *\n * Renders a standard <img> with:\n *   - loading=\"lazy\" by default (eager with priority={true})\n *   - decoding=\"async\" for non-blocking decode\n *   - width/height for CLS prevention\n *   - srcSet/sizes forwarded for responsive images\n *\n * No CDN, no Sharp, no build-time optimization — pure HTML attributes\n * that deliver 80% of the performance value at zero complexity.\n *\n * @example\n * ```tsx\n * import { Image } from 'theokit/client'\n *\n * <Image src=\"/team.jpg\" alt=\"Team photo\" width={800} height={600} />\n * <Image src=\"/hero.jpg\" alt=\"Hero\" priority />\n * <Image\n *   src=\"/product.jpg\"\n *   alt=\"Product\"\n *   width={400}\n *   height={300}\n *   srcSet=\"/product-400.jpg 400w, /product-800.jpg 800w\"\n *   sizes=\"(max-width: 768px) 100vw, 400px\"\n * />\n * ```\n */\n\nexport interface ImageProps extends React.ImgHTMLAttributes<HTMLImageElement> {\n  /** Image source URL (required). */\n  src: string\n  /** Alt text for accessibility (required). */\n  alt: string\n  /** If true, loading=\"eager\" — use for above-the-fold images. */\n  priority?: boolean\n}\n\nexport function Image({ priority, loading, decoding, ...props }: ImageProps) {\n  return (\n    <img\n      loading={loading ?? (priority ? 'eager' : 'lazy')}\n      decoding={decoding ?? 'async'}\n      {...props}\n    />\n  )\n}\n"],"mappings":";;;;;;;;;;AAAA,OAAO,eAAe;;;AC2Cf,SAAS,cAAc,SAAkC;AAC9D,QAAM,MAAM,QAAQ,OAAO;AAC3B,MAAI,QAAuB,CAAC;AAC5B,MAAI,iBAAiB;AAErB,WAAS,QAAc;AACrB,qBAAiB;AACjB,UAAM,UAAU;AAChB,YAAQ,CAAC;AACT,QAAI,QAAQ,WAAW,EAAG;AAG1B,UAAM,SAA0B,CAAC;AACjC,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,KAAK;AAC5C,aAAO,KAAK,QAAQ,MAAM,GAAG,IAAI,GAAG,CAAC;AAAA,IACvC;AAEA,eAAW,SAAS,QAAQ;AAC1B,YAAM,UAA0B,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG;AACtD,cACG,UAAU,OAAO,EACjB,KAAK,CAAC,YAAY;AACjB,iBAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AAKrC,gBAAM,SAAS,QAAQ,SAAS,IAAI,QAAQ,CAAC,IAAI;AACjD,cAAI,WAAW,QAAW;AACxB,kBAAM,CAAC,EAAE,OAAO,IAAI,MAAM,gDAAgD,CAAC,EAAE,CAAC;AAC9E;AAAA,UACF;AACA,cAAI,WAAW,QAAQ;AACrB,kBAAM,MAAM,IAAI,MAAM,OAAO,MAAM,OAAO;AACzC,YAAC,IAA0B,OAAO,OAAO,MAAM;AAChD,kBAAM,CAAC,EAAE,OAAO,GAAG;AAAA,UACrB,OAAO;AACL,kBAAM,CAAC,EAAE,QAAQ,OAAO,IAAI;AAAA,UAC9B;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,mBAAW,QAAQ,MAAO,MAAK,OAAO,GAAG;AAAA,MAC3C,CAAC;AAAA,IACL;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,KAAqC;AAC5C,aAAO,IAAI,QAAiB,CAAC,SAAS,WAAW;AAC/C,cAAM,KAAK,EAAE,KAAK,SAAS,OAAO,CAAC;AACnC,YAAI,CAAC,gBAAgB;AACnB,2BAAiB;AACjB,yBAAe,KAAK;AAAA,QACtB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACtFA,IAAM,iBAAiB;AAShB,SAAS,qBAAqB,UAAuC,CAAC,GAAmB;AAC9F,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,WAAW,QAAQ,YAAY;AACrC,SAAO,OAAO,aAAuD;AACnE,UAAM,WAAW,MAAM,UAAU,UAAU;AAAA,MACzC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,IACnC,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,4BAA4B,SAAS,MAAM,EAAE;AAAA,IAC/D;AACA,UAAM,UAAW,MAAM,SAAS,KAAK;AACrC,QAAI,CAAC,MAAM,QAAQ,QAAQ,OAAO,GAAG;AACnC,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,WAAO,QAAQ,QAAQ,IAAI,CAAC,MAAM,UAAU;AAC1C,UAAI,WAAW,MAAM;AACnB,eAAO,EAAE,OAAO,OAAQ,KAAuD,MAAM;AAAA,MACvF;AACA,aAAO,EAAE,OAAO,MAAO,KAA2B,KAAK;AAAA,IACzD,CAAC;AAAA,EACH;AACF;AAIA,IAAI;AAWG,SAAS,mBAAwC;AACtD,QAAM,IAAI;AACV,MAAI,CAAC,EAAE,kBAAmB,QAAO;AACjC,oBAAkB,cAAc,EAAE,WAAW,qBAAqB,EAAE,CAAC;AACrE,SAAO;AACT;;;AFvDA,IAAI,iBAAiB;AAiBd,SAAS,yBACd,KACA,uBACA,uBACS;AAGT,MAAI,QAAQ,IAAI;AACd,WAAO;AAAA,EACT;AAEA,QAAM,kBAAkB,yBAAyB;AACjD,MAAI,oBAAoB,yBAAyB,CAAC,gBAAgB;AAChE,qBAAiB;AACjB,YAAQ;AAAA,MACN,0CAA0C,eAAe,YAAY,qBAAqB;AAAA,IAC5F;AAAA,EACF;AAEA,MAAI,oBAAoB,eAAe,0BAA0B,aAAa;AAC5E,UAAM,UAAU,KAAK,MAAM,GAAG;AAC9B,WAAO,UAAU,YAAY,OAAO;AAAA,EACtC;AAGA,SAAO,KAAK,MAAM,GAAG;AACvB;AA6CA,SAAS,gBAAgB,QAAgB,MAAkC;AACzE,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO,EAAE,MAAM,yBAAyB,SAAS,QAAQ,OAAO,MAAM,CAAC,GAAG;AAAA,EAC5E;AACA,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,SAAS,YAAY,OAAO,IAAI,YAAY,UAAU;AACnE,WAAO;AAAA,MACL,MAAM,IAAI;AAAA,MACV,SAAS,IAAI;AAAA,MACb,OAAO,IAAI;AAAA,MACX,MAAM,IAAI;AAAA,MACV,KAAK,IAAI;AAAA,IACX;AAAA,EACF;AAEA,MAAI,IAAI,SAAS,OAAO,IAAI,UAAU,UAAU;AAC9C,UAAM,SAAS,IAAI;AACnB,WAAO;AAAA,MACL,MACE,OAAO,OAAO,SAAS,WAAY,OAAO,OAAyB;AAAA,MACrE,SAAS,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU,QAAQ,OAAO,MAAM,CAAC;AAAA,IACvF;AAAA,EACF;AACA,SAAO,EAAE,MAAM,yBAAyB,SAAS,QAAQ,OAAO,MAAM,CAAC,GAAG;AAC5E;AAOA,SAAS,SAAS,KAAqC,KAAiC;AACtF,QAAM,IAAI,MAAM,GAAG;AACnB,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAMA,SAAS,oBACP,QACA,MACwD;AACxD,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO,EAAE,SAAS,QAAQ,OAAO,MAAM,CAAC,GAAG;AAAA,EAC7C;AACA,QAAM,MAAM;AACZ,QAAM,SACJ,IAAI,SAAS,OAAO,IAAI,UAAU,WAAY,IAAI,QAAoC;AACxF,QAAM,SAAS,MAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,SAAS;AAC/D,SAAO;AAAA,IACL,SAAS,SAAS,KAAK,SAAS,KAAK,SAAS,QAAQ,SAAS,KAAK,QAAQ,OAAO,MAAM,CAAC;AAAA,IAC1F,MAAM,SAAS,KAAK,MAAM,KAAK,SAAS,QAAQ,MAAM;AAAA,IACtD;AAAA,EACF;AACF;AAEO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMS;AAAA,EAET,YAAY,QAAgB,MAAgB;AAC1C,UAAM,SAAS,oBAAoB,QAAQ,IAAI;AAC/C,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO;AACrB,SAAK,WAAW,gBAAgB,QAAQ,IAAI;AAAA,EAC9C;AACF;AAOA,SAAS,oBAAoB,OAAwB;AACnD,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO,KAAK;AAAA,IACrB;AACE,aAAO,KAAK,UAAU,KAAK;AAAA,EAC/B;AACF;AAqBA,SAAS,uBAA+B;AACtC,QAAM,IAAI;AACV,QAAM,UAAU,OAAO,YAAY,cAAc,QAAQ,IAAI,cAAc;AAC3E,SAAO,EAAE,UAAU,UAAU,EAAE,mBAAmB,WAAW;AAC/D;AAEA,SAAS,cAAc,MAAc,OAAiD;AACpF,QAAM,WAAW,IAAI,IAAI,MAAM,qBAAqB,CAAC;AACrD,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,QAAI,MAAM,QAAW;AACnB,eAAS,aAAa,IAAI,GAAG,oBAAoB,CAAC,CAAC;AAAA,IACrD;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,iBAAiB,OAAwD;AAChF,QAAM,MAA8B,CAAC;AACrC,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,iBAAiB,SAAS;AAC5B,UAAM,QAAQ,CAAC,OAAO,QAAQ;AAC5B,UAAI,GAAG,IAAI;AAAA,IACb,CAAC;AACD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,CAAC,KAAK,KAAK,KAAK,MAAO,KAAI,GAAG,IAAI;AAC7C,WAAO;AAAA,EACT;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,GAAG,IAAI;AAAA,EACb;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,MAA6C;AACrE,QAAM,OAAoB,CAAC;AAC3B,MAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAClD,MAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAElD,QAAM,UAAU,iBAAiB,KAAK,OAAO;AAC7C,OAAK,UAAU;AAEf,MAAI,KAAK,SAAS,QAAW;AAC3B,SAAK,OAAO,KAAK,UAAU,KAAK,IAAI;AACpC,YAAQ,cAAc,IAAI;AAAA,EAC5B;AAKA,QAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAAW;AACjE,YAAQ,eAAe,IAAI;AAAA,EAC7B;AACA,SAAO;AACT;AAEA,eAAe,WACb,KACA,SACkE;AAClE,QAAM,UAAU,iBAAiB;AACjC,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM;AACtC,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,SAAS;AAAA,MACpC,MAAM;AAAA,MACN,QAAQ,QAAQ,UAAU;AAAA,MAC1B,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,IAChB,CAAC;AACD,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC,QAAQ;AAEN,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACF;AAEA,eAAsB,UACpB,KACA,SAC2B;AAC3B,QAAM,WAAY,WAAW,CAAC;AAG9B,QAAM,eAAe,MAAM,WAAW,KAAK,QAAQ;AACnD,MAAI,aAAa,SAAS;AACxB,WAAO,aAAa;AAAA,EACtB;AAEA,QAAM,WAAW,cAAc,KAAK,SAAS,KAAK;AAClD,QAAM,OAAO,iBAAiB,QAAQ;AACtC,QAAM,WAAW,MAAM,MAAM,SAAS,SAAS,GAAG,IAAI;AAEtD,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,SAAS,KAAK;AAAA,IAClC,QAAQ;AAAA,IAER;AACA,UAAM,IAAI,eAAe,SAAS,QAAQ,SAAS;AAAA,EACrD;AAGA,MAAI,SAAS,WAAW,KAAK;AAC3B,WAAO;AAAA,EACT;AAGA,QAAM,gBAAgB,SAAS,QAAQ,IAAI,gBAAgB;AAC3D,MAAI,kBAAkB,KAAK;AACzB,WAAO;AAAA,EACT;AAGA,QAAM,wBAAwB,SAAS,QAAQ,IAAI,oBAAoB;AACvE,QAAM,wBAAwB,6BAA6B;AAC3D,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AASA,SAAS,+BAAuC;AAC9C,QAAM,IAAI;AACV,SAAO,EAAE,wBAAwB;AACnC;;;AGnVA,IAAM,mBAAmB,IAAI,IAAI,qBAAqB;AAOtD,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcD,SAAS,aAAa,MAAc,QAAkD;AACpF,MAAI,CAAC,QAAQ;AACX,QAAI,wBAAwB,KAAK,IAAI,GAAG;AACtC,YAAM,IAAI,eAAe,GAAG;AAAA,QAC1B,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS,SAAS,IAAI;AAAA,QACxB;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,QAAQ,yCAAyC,CAAC,QAAQ,QAAgB;AACpF,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,IAAI;AACzD,YAAM,IAAI,eAAe,GAAG;AAAA,QAC1B,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS,UAAU,GAAG,2BAA2B,IAAI;AAAA,QACvD;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO,mBAAmB,OAAO,KAAK,CAAC;AAAA,EACzC,CAAC;AACH;AAQA,SAAS,UAAU,KAA4B;AAC7C,QAAM,UAAoC;AAAA,IACxC,IAAI,SAAS,KAAK;AAChB,UAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,UAAI,mBAAmB,IAAI,GAAG,EAAG,QAAO;AACxC,UAAI,iBAAiB,IAAI,GAAG,GAAG;AAC7B,eAAO,OAAO,SAAuB;AACnC,cAAI,IAAI,SAAS,WAAW,GAAG;AAC7B,kBAAM,IAAI,eAAe,GAAG;AAAA,cAC1B,OAAO;AAAA,gBACL,MAAM;AAAA,gBACN,SAAS,UAAU,GAAG,4DAA4D,GAAG;AAAA,cACvF;AAAA,YACF,CAAC;AAAA,UACH;AACA,cAAI,YAAY,GAAG,IAAI,OAAO,IAAI,IAAI,SAAS,KAAK,GAAG,CAAC;AACxD,cAAI,MAAM,QAAQ;AAGhB,kBAAM,sBAAsB,IAAI,SAAS;AAAA,cAAI,CAAC,QAC5C,OAAO,UAAU,eAAe,KAAK,KAAK,QAAQ,GAAG,IAAI,IAAI,GAAG,KAAK;AAAA,YACvE;AACA,wBAAY;AAAA,cACV,GAAG,IAAI,OAAO,IAAI,oBAAoB,KAAK,GAAG,CAAC;AAAA,cAC/C,KAAK;AAAA,YACP;AAAA,UACF;AACA,gBAAM,EAAE,QAAQ,UAAU,GAAG,KAAK,IAAI,QAAQ,CAAC;AAC/C,gBAAM,OAAO,EAAE,QAAQ,IAAI,YAAY,GAAG,GAAG,KAAK;AAClD,iBAAO,IAAI,UAAU,WAAW,IAAI;AAAA,QACtC;AAAA,MACF;AAEA,aAAO,UAAU,EAAE,GAAG,KAAK,UAAU,CAAC,GAAG,IAAI,UAAU,GAAG,EAAE,CAAC;AAAA,IAC/D;AAAA,IACA,QAAQ;AACN,aAAO,QAAQ;AAAA,QACb,IAAI,eAAe,GAAG;AAAA,UACpB,OAAO;AAAA,YACL,MAAM;AAAA,YACN,SACE;AAAA,UACJ;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI,MAAM,MAAM,QAAW,OAAO;AAC3C;AASO,SAAS,gBACd,kBACA,iBACY;AACZ,MAAI,UAAU;AACd,MAAI,YAAuB;AAC3B,MAAI,OAAO,qBAAqB,UAAU;AACxC,cAAU,oBAAoB;AAAA,EAChC,WAAW,oBAAoB,OAAO,qBAAqB,UAAU;AACnE,QAAI,iBAAiB,QAAS,WAAU,iBAAiB;AACzD,QAAI,iBAAiB,UAAW,aAAY,iBAAiB;AAAA,EAC/D;AAEA,MAAI,gBAAiB,aAAY;AAEjC,MAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAG,EAAG,WAAU,QAAQ,MAAM,GAAG,EAAE;AAC9E,SAAO,UAAU,EAAE,UAAU,CAAC,GAAG,SAAS,UAAU,CAAC;AACvD;;;ACjKA,SAAS,aAAa,WAAW,QAAQ,gBAAgB;;;AC8BzD,SAAS,iBAAiB,OAAiB,SAA4C;AACrF,aAAW,QAAQ,OAAO;AAExB,eAAW,QAAQ,KAAK,MAAM,IAAI,GAAG;AACnC,YAAM,MAAM,cAAc,IAAI;AAC9B,UAAI,IAAK,SAAQ,GAAG;AAAA,IACtB;AAAA,EACF;AACF;AAMO,SAAS,cAAc,MAAiC;AAC7D,MAAI,CAAC,KAAK,WAAW,OAAO,EAAG,QAAO;AACtC,QAAM,MAAM,KAAK,MAAM,CAAC,EAAE,KAAK;AAC/B,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,mBACpB,MACA,SACe;AACf,QAAM,YAAY,QAAQ,SAAS,WAAW;AAC9C,QAAM,WAAW,MAAM,UAAU,MAAM;AAAA,IACrC,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,QAAQ;AAAA,MACR,iBAAiB;AAAA,MACjB,GAAG,QAAQ;AAAA,IACb;AAAA,IACA,MAAM,KAAK,UAAU,QAAQ,IAAI;AAAA,IACjC,QAAQ,QAAQ;AAAA,EAClB,CAAC;AAED,MAAI,CAAC,SAAS,KAAM;AAEpB,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,MAAM;AAEV,MAAI;AACF,QAAI,OAAO;AACX,WAAO,CAAC,MAAM;AACZ,YAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,aAAO,MAAM;AACb,UAAI,KAAM;AACV,aAAO,QAAQ,OAAO,MAAM,OAAO,EAAE,QAAQ,KAAK,CAAC;AAInD,YAAM,QAAQ,IAAI,MAAM,MAAM;AAC9B,YAAM,MAAM,IAAI,KAAK;AACrB,uBAAiB,OAAO,QAAQ,OAAO;AAAA,IACzC;AAAA,EACF,UAAE;AACA,QAAI;AACF,aAAO,YAAY;AAAA,IACrB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;;;ADlEO,SAAS,eACd,MACA,UAAiC,CAAC,GACL;AAC7B,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAuB,CAAC,CAAC;AACrD,QAAM,CAAC,QAAQ,SAAS,IAAI,SAA4B,MAAM;AAC9D,QAAM,gBAAgB,OAA+B,IAAI;AAEzD,QAAM,QAAQ,YAAY,MAAM;AAC9B,QAAI,cAAc,SAAS;AACzB,oBAAc,QAAQ,MAAM;AAC5B,oBAAc,UAAU;AAAA,IAC1B;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,QAAQ,YAAY,MAAM;AAC9B,UAAM;AACN,cAAU,CAAC,CAAC;AACZ,cAAU,MAAM;AAAA,EAClB,GAAG,CAAC,KAAK,CAAC;AAEV,QAAM,OAAO;AAAA,IACX,CAAC,SAAgB;AAEf,YAAM;AACN,YAAM,aAAa,IAAI,gBAAgB;AACvC,oBAAc,UAAU;AACxB,gBAAU,WAAW;AAErB,UAAI,WAAW;AACf,yBAA0B,MAAM;AAAA,QAC9B;AAAA,QACA,OAAO,QAAQ;AAAA,QACf,SAAS,QAAQ;AAAA,QACjB,QAAQ,WAAW;AAAA,QACnB,SAAS,CAAC,UAAU;AAClB,cAAI,MAAM,SAAS,QAAS,YAAW;AACvC,oBAAU,CAAC,SAAS,CAAC,GAAG,MAAM,KAAK,CAAC;AAAA,QACtC;AAAA,MACF,CAAC,EACE,KAAK,MAAM;AACV,YAAI,cAAc,YAAY,WAAY;AAC1C,kBAAU,WAAW,UAAU,MAAM;AAAA,MACvC,CAAC,EACA,MAAM,MAAM;AACX,YAAI,cAAc,YAAY,WAAY;AAC1C,YAAI,WAAW,OAAO,QAAS;AAC/B,kBAAU,OAAO;AAAA,MACnB,CAAC;AAAA,IACL;AAAA,IACA,CAAC,OAAO,MAAM,QAAQ,OAAO,QAAQ,OAAO;AAAA,EAC9C;AAGA,YAAU,MAAM;AACd,WAAO,MAAM;AACX,UAAI,cAAc,SAAS;AACzB,sBAAc,QAAQ,MAAM;AAC5B,sBAAc,UAAU;AAAA,MAC1B;AAAA,IACF;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO,EAAE,QAAQ,QAAQ,MAAM,OAAO,MAAM;AAC9C;;;AE/FA;AAAA,EACE,QAAQ;AAAA,OAEH;AACP,SAAS,UAAAA,SAAQ,eAAAC,cAAa,aAAAC,kBAAiB;AA+E3C;AArEJ,IAAM,aAAa,oBAAI,IAAY;AAEnC,SAAS,eAAe,MAAoB;AAE1C,MAAI,OAAO,aAAa,YAAa;AACrC,MAAI,WAAW,IAAI,IAAI,EAAG;AAC1B,aAAW,IAAI,IAAI;AAEnB,QAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,OAAK,MAAM;AACX,OAAK,OAAO;AACZ,WAAS,KAAK,YAAY,IAAI;AAChC;AAEA,SAAS,UAAU,IAA6B;AAC9C,MAAI,OAAO,OAAO,SAAU,QAAO;AACnC,SAAO,IAAI,YAAY;AACzB;AAcO,SAAS,KAAK,EAAE,WAAW,UAAU,IAAI,cAAc,SAAS,GAAG,KAAK,GAAc;AAC3F,QAAM,MAAMF,QAA0B,IAAI;AAE1C,QAAM,eAAeC;AAAA,IACnB,CAAC,UAAqF;AACpF,UAAI,aAAa,UAAU;AACzB,uBAAe,UAAU,EAAE,CAAC;AAAA,MAC9B;AAEA,UAAI,MAAM,SAAS,gBAAgB,cAAc;AAC/C;AAAC,QAAC,aAA4D,KAA4C;AAAA,MAC5G;AACA,UAAI,MAAM,SAAS,WAAW,SAAS;AACrC;AAAC,QAAC,QAAuD,KAA4C;AAAA,MACvG;AAAA,IACF;AAAA,IACA,CAAC,UAAU,IAAI,cAAc,OAAO;AAAA,EACtC;AAGA,EAAAC,WAAU,MAAM;AACd,QAAI,aAAa,cAAc,CAAC,IAAI,QAAS;AAC7C,QAAI,OAAO,yBAAyB,YAAa;AAEjD,UAAM,WAAW,IAAI;AAAA,MACnB,CAAC,CAAC,KAAK,MAAM;AACX,YAAI,MAAM,gBAAgB;AACxB,yBAAe,UAAU,EAAE,CAAC;AAC5B,mBAAS,WAAW;AAAA,QACtB;AAAA,MACF;AAAA,MACA,EAAE,YAAY,QAAQ;AAAA;AAAA,IACxB;AACA,aAAS,QAAQ,IAAI,OAAO;AAC5B,WAAO,MAAM,SAAS,WAAW;AAAA,EACnC,GAAG,CAAC,UAAU,EAAE,CAAC;AAEjB,SACE;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,SAAS;AAAA,MACR,GAAG;AAAA;AAAA,EACN;AAEJ;;;ACzDI,mBACkB,OAAAC,MADlB;AALG,SAAS,SAAS,OAAsB;AAC7C,QAAM,UAAU,MAAM,WAAW,MAAM;AACvC,QAAM,SAAS,MAAM,iBAAiB,MAAM;AAE5C,SACE,iCACG;AAAA,UAAM,SAAS,gBAAAA,KAAC,WAAO,gBAAM,OAAM;AAAA,IACnC,MAAM,eAAe,gBAAAA,KAAC,UAAK,MAAK,eAAc,SAAS,MAAM,aAAa;AAAA,IAC1E,MAAM,aAAa,gBAAAA,KAAC,UAAK,KAAI,aAAY,MAAM,MAAM,WAAW;AAAA,IAChE,WAAW,gBAAAA,KAAC,UAAK,UAAS,YAAW,SAAS,SAAS;AAAA,IACvD,UAAU,gBAAAA,KAAC,UAAK,UAAS,kBAAiB,SAAS,QAAQ;AAAA,IAC3D,MAAM,WAAW,gBAAAA,KAAC,UAAK,UAAS,YAAW,SAAS,MAAM,SAAS;AAAA,IACnE,MAAM,UAAU,gBAAAA,KAAC,UAAK,UAAS,WAAU,SAAS,MAAM,QAAQ;AAAA,IAChE,MAAM,SAAS,gBAAAA,KAAC,UAAK,UAAS,UAAS,SAAS,MAAM,OAAO;AAAA,IAC7D,MAAM,eAAe,gBAAAA,KAAC,UAAK,MAAK,gBAAe,SAAS,MAAM,aAAa;AAAA,IAC3E,MAAM;AAAA,KACT;AAEJ;;;AClBI,gBAAAC,YAAA;AAFG,SAAS,MAAM,EAAE,UAAU,SAAS,UAAU,GAAG,MAAM,GAAe;AAC3E,SACE,gBAAAA;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,YAAY,WAAW,UAAU;AAAA,MAC1C,UAAU,YAAY;AAAA,MACrB,GAAG;AAAA;AAAA,EACN;AAEJ;","names":["useRef","useCallback","useEffect","jsx","jsx"]}

package/dist/{cloudflare-LCAOTRYZ.js → cloudflare-OJGJ7R2D.js}

@@ -2,11 +2,11 @@
 import "tsx/esm";
 import {
   nodeAdapter
-} from "./chunk-ZJW5FFYJ.js";
+} from "./chunk-LC5PYNJP.js";
 import {
   assertServicesUnsupported,
   readManifest
-} from "./chunk-WZ7CPVQB.js";
+} from "./chunk-27LWMYNK.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/adapters/cloudflare.ts
@@ -120,4 +120,4 @@ export {
   renderCloudflareWorkerEntry,
   renderWranglerToml
 };
-//# sourceMappingURL=cloudflare-LCAOTRYZ.js.map
+//# sourceMappingURL=cloudflare-OJGJ7R2D.js.map

package/dist/cookies-MJKMGJ7N.js

@@ -0,0 +1,22 @@
+import {
+  appendCookieToHeaders,
+  appendDeleteCookieToHeaders,
+  deleteCookie,
+  getCookie,
+  getCookieFromRequest,
+  parseCookieHeader,
+  serializeCookie,
+  setCookie
+} from "./chunk-ZJQ4O76G.js";
+import "./chunk-DGUM43GV.js";
+export {
+  appendCookieToHeaders,
+  appendDeleteCookieToHeaders,
+  deleteCookie,
+  getCookie,
+  getCookieFromRequest,
+  parseCookieHeader,
+  serializeCookie,
+  setCookie
+};
+//# sourceMappingURL=cookies-MJKMGJ7N.js.map

package/dist/csrf-BBrEZSBW.d.ts

@@ -0,0 +1,107 @@
+import { IncomingMessage } from 'node:http';
+import { A as AuditLogger } from './audit-log-BQWM5YLG.js';
+
+/**
+ * CSRF enforcement mode.
+ *
+ * - `off`     — skip CSRF entirely. Use only when you have another defense
+ *               (e.g. you don't ship session cookies, all auth is bearer).
+ * - `warn`    — log a structured warning when the check would fail, but
+ *               still serve the request. Default for 0.2.0. Migration mode.
+ * - `strict`  — reject failing requests with 403 + code `CSRF_INVALID`.
+ *               Will become the default in 0.3.0.
+ */
+type CsrfMode = 'off' | 'warn' | 'strict';
+/**
+ * Per-request structured logger surface. Only `warn` is used by enforceCsrf;
+ * we don't require a full Logger here so callers can pass a mock or the
+ * console directly.
+ */
+interface CsrfLogger {
+    warn: (payload: CsrfWarnPayload) => void;
+    /** Optional path the request was destined for — used for log correlation. */
+    path?: string;
+}
+/**
+ * T5.1 — Rails-inspired per-route escalation.
+ *
+ * `routes` accepts string (exact match) or RegExp entries. When a request
+ * path matches AND the request would otherwise emit a warning, the
+ * `behavior` field decides what happens:
+ *
+ *   - `'warn'`  → normal warn dispatch (no-op vs default)
+ *   - `'raise'` → escalate to 403 regardless of global `csrf` mode
+ *
+ * `'raise'` never downgrades: when global mode is `'off'`, validation is
+ * skipped entirely and disallowed dispatch never runs.
+ */
+interface DisallowedConfig {
+    routes: (string | RegExp)[];
+    behavior: 'warn' | 'raise';
+}
+/**
+ * Test whether `path` matches any of the supplied patterns. String
+ * patterns are EXACT (trailing slash matters — use RegExp for tolerance).
+ *
+ * EC-5: when a RegExp carries the `/g` flag, `.test()` mutates
+ * `lastIndex` and the next invocation may miss. We reset `lastIndex`
+ * before each test so the matcher is a pure function.
+ */
+declare function matchDisallowed(path: string, patterns: readonly (string | RegExp)[]): boolean;
+/**
+ * T2.2 — Stable cutover identifier shipped with every csrf.warn payload.
+ *
+ * Convention borrowed from Vite's `deprecations.ts:74` — a `code` plus a
+ * `docsUrl` lets users (a) grep their logs for a single stable identifier
+ * to find every csrf.warn line, and (b) click through directly to the
+ * migration guide. Strings are exported constants so the analyzer (T2.3)
+ * and migration guide can reference the same source of truth.
+ */
+declare const CSRF_WARN_CODE: "CSRF_STRICT_CUTOVER";
+declare const CSRF_WARN_DOCS_URL: "https://theokit.dev/upgrade/csrf-strict-cutover";
+interface CsrfWarnPayload {
+    event: 'csrf.warn';
+    method: string;
+    path: string | undefined;
+    reason: string;
+    /**
+     * Stable identifier for the 0.2 → 0.3 CSRF strict cutover. Always
+     * `'CSRF_STRICT_CUTOVER'`. Grep-able from prod logs.
+     */
+    code: string;
+    /**
+     * Link to the section of the migration guide explaining how to clear
+     * this specific warning class.
+     */
+    docsUrl: string;
+}
+declare function validateCsrf(req: IncomingMessage): {
+    valid: true;
+} | {
+    valid: false;
+    reason: string;
+};
+/**
+ * T5a.2 Phase B (slice 1/6) — Web-Standards-shaped CSRF validator.
+ *
+ * Mirror of `validateCsrf(req: IncomingMessage)` for the Web `Request`
+ * shape. Consumes `request.headers.get(name)` (native Web `Headers` API)
+ * instead of `req.headers[name]` (Node `IncomingMessage` indexer). Same
+ * CSRF policy + same return shape — the difference is only the input
+ * extraction.
+ *
+ * Used by `executeWebRequest` (T5a.2 Phase A) to enforce CSRF on the
+ * Web-Standards request handler entry-point.
+ */
+declare function validateCsrfRequest(request: Request): {
+    valid: true;
+} | {
+    valid: false;
+    reason: string;
+};
+declare function enforceCsrf(req: IncomingMessage, mode: CsrfMode, logger?: CsrfLogger, disallowed?: DisallowedConfig, auditLogger?: AuditLogger): {
+    allow: boolean;
+    reason?: string;
+};
+
+export { CSRF_WARN_CODE as C, type DisallowedConfig as D, CSRF_WARN_DOCS_URL as a, type CsrfLogger as b, type CsrfMode as c, type CsrfWarnPayload as d, enforceCsrf as e, validateCsrfRequest as f, matchDisallowed as m, validateCsrf as v };

package/dist/csrf-readiness-store-CjIoub3U.d.ts

@@ -0,0 +1,43 @@
+/**
+ * T2.2 — In-memory bounded counter for CSRF warn events.
+ *
+ * Aggregates `csrf.warn` payloads by `(method, path, reason)` triple.
+ * Used by the `/__theo/csrf-readiness` endpoint to expose a summary the
+ * developer (or devtools tab) can inspect, so users do NOT need to grep
+ * stdout to know which endpoints will break under 0.3.0 strict CSRF.
+ *
+ * Bounded at 1000 distinct keys (EC-22). Eviction is LRU-by-insertion —
+ * when the cap is hit, the oldest key is dropped and a re-record of an
+ * evicted key starts fresh (count: 1).
+ *
+ * Single-threaded by virtue of the JS event loop; Map operations are
+ * atomic. NOT shared across processes — each worker has its own store.
+ */
+interface CsrfWarnRecord {
+    method: string;
+    path: string;
+    reason: string;
+}
+interface CsrfReadinessRouteSummary {
+    method: string;
+    path: string;
+    reason: string;
+    count: number;
+    firstSeen: string;
+    lastSeen: string;
+}
+interface CsrfReadinessSummary {
+    generatedAt: string;
+    totalEvents: number;
+    routes: CsrfReadinessRouteSummary[];
+}
+declare class CsrfReadinessStore {
+    static readonly MAX_ENTRIES = 1000;
+    private readonly entries;
+    private keyFor;
+    record(event: CsrfWarnRecord): void;
+    summary(): CsrfReadinessSummary;
+    reset(): void;
+}
+
+export { CsrfReadinessStore as C, type CsrfReadinessRouteSummary as a, type CsrfReadinessSummary as b, type CsrfWarnRecord as c };

package/dist/define-websocket-CdK94O-D.d.ts

@@ -0,0 +1,64 @@
+import { IncomingMessage } from 'node:http';
+
+interface WebSocketLike {
+    send(data: string | Buffer): void;
+    close(code?: number, reason?: string): void;
+}
+interface WebSocketHandler {
+    onOpen?: (ws: WebSocketLike, req: IncomingMessage) => void;
+    onMessage?: (ws: WebSocketLike, data: string | Buffer) => void;
+    onClose?: (ws: WebSocketLike, code: number, reason: Buffer) => void;
+    onError?: (ws: WebSocketLike, error: Error) => void;
+}
+/**
+ * Define a WebSocket endpoint handler.
+ * Identity function — provides type inference for WebSocket handlers.
+ */
+declare function defineWebSocket(handler: WebSocketHandler): WebSocketHandler;
+/**
+ * T5a.2 Phase F slice 3/3 — Web-Standards WebSocket endpoint handler.
+ *
+ * Mirror of `WebSocketHandler` for the Web `Request` shape. `onOpen`
+ * receives `request: Request` instead of `req: IncomingMessage`. The
+ * rest of the lifecycle (onMessage, onClose, onError) is shape-agnostic
+ * (`WebSocketLike` is already Web-standards-compatible per the existing
+ * design — `send(string | Buffer)` works on both Node `ws` and Web
+ * `WebSocket` instances; CF Workers / Bun / Deno coerce as needed at
+ * the adapter boundary).
+ *
+ * Per `docs/plans/t5a2-incoming-message-to-request-shape-refactor-plan.md`
+ * v1.0 § Phase F (closes Phase F).
+ *
+ * **Architectural note — WebSocket upgrade semantics differ across runtimes:**
+ *   - Node + `ws`: `WebSocketServer.handleUpgrade(req, socket, head, cb)` —
+ *     `req` is `IncomingMessage`. Use `WebSocketHandler`.
+ *   - CF Workers: `new WebSocketPair()` + `request.headers` (the upgrade
+ *     handshake IS a Web Request). Use `WebSocketHandlerWeb`.
+ *   - Bun: `server.upgrade(request, { data })` — same Web Request shape.
+ *   - Deno: `Deno.upgradeWebSocket(request)` — same Web Request shape.
+ *
+ * Cross-runtime WebSocket endpoints ship BOTH `WebSocketHandler` +
+ * `WebSocketHandlerWeb` exports; the runtime adapter picks the matching
+ * one. This is the canonical Hono / Nitric pattern.
+ */
+interface WebSocketHandlerWeb {
+    onOpen?: (ws: WebSocketLike, request: Request) => void;
+    onMessage?: (ws: WebSocketLike, data: string | Uint8Array) => void;
+    onClose?: (ws: WebSocketLike, code: number, reason: string) => void;
+    onError?: (ws: WebSocketLike, error: Error) => void;
+}
+/**
+ * Web-Standards `defineWebSocket` sibling. Identity function — provides
+ * type inference for Web WebSocket handlers.
+ *
+ * **Type difference note vs Node path:**
+ *   - `onMessage` data is `string | Uint8Array` instead of `string | Buffer`
+ *     (Web standards have no `Buffer`; Node's Buffer is a Uint8Array
+ *     subclass so the Node path's Buffer values flow through unchanged
+ *     when adapters wrap them).
+ *   - `onClose` reason is `string` instead of `Buffer` (Web `CloseEvent`
+ *     exposes the reason as a UTF-8 string natively).
+ */
+declare function defineWebSocketWeb(handler: WebSocketHandlerWeb): WebSocketHandlerWeb;
+
+export { type WebSocketHandler as W, type WebSocketHandlerWeb as a, type WebSocketLike as b, defineWebSocketWeb as c, defineWebSocket as d };

package/dist/{deno-deploy-ZN4RE5HF.js → deno-deploy-BHWKFTOW.js}

@@ -2,11 +2,11 @@
 import "tsx/esm";
 import {
   nodeAdapter
-} from "./chunk-ZJW5FFYJ.js";
+} from "./chunk-LC5PYNJP.js";
 import {
   assertServicesUnsupported,
   readManifest
-} from "./chunk-WZ7CPVQB.js";
+} from "./chunk-27LWMYNK.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/adapters/deno-deploy.ts
@@ -105,4 +105,4 @@ export {
   denoDeployAdapter,
   renderDenoEntry
 };
-//# sourceMappingURL=deno-deploy-ZN4RE5HF.js.map
+//# sourceMappingURL=deno-deploy-BHWKFTOW.js.map

package/dist/{dev-6P2DM33Q.js → dev-MJVSRZGF.js}

@@ -1,27 +1,27 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import {
-  preflightNodeAndBindings
-} from "./chunk-F3TG5FJV.js";
 import {
   validateProjectStructure
 } from "./chunk-XMS5VRIK.js";
+import {
+  preflightNodeAndBindings
+} from "./chunk-IEZCAT2I.js";
 import {
   theoPluginAsync
-} from "./chunk-X2OLD264.js";
-import "./chunk-TPCT3MXV.js";
+} from "./chunk-M2EY7KDR.js";
+import "./chunk-ABVITXFH.js";
 import {
   loadConfig,
   loadEnv
-} from "./chunk-XP7YXRHO.js";
-import "./chunk-X4JAX2U3.js";
-import "./chunk-5ODOE6EF.js";
-import "./chunk-O7335ZGH.js";
+} from "./chunk-U6TPSW4L.js";
+import "./chunk-4S2UCILN.js";
 import {
   orchestrateDev
-} from "./chunk-WZ7CPVQB.js";
-import "./chunk-SNDZQ64K.js";
-import "./chunk-5OFPQK6N.js";
+} from "./chunk-27LWMYNK.js";
+import "./chunk-5ODOE6EF.js";
+import "./chunk-CG563V5M.js";
+import "./chunk-VBZCVFSA.js";
+import "./chunk-COXLEZCN.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/cli/commands/dev.ts
@@ -89,4 +89,4 @@ export {
   devCommand,
   startDevServer
 };
-//# sourceMappingURL=dev-6P2DM33Q.js.map
+//# sourceMappingURL=dev-MJVSRZGF.js.map