theokit 0.39.1 → 0.43.0

package/dist/chunk-2ZX4J4SX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vite-plugin/index.ts","../src/vite-plugin/config-hook.ts","../src/config/load-config.ts","../src/config/errors.ts","../src/config/schema.ts","../src/config/schemas/header-safe.ts","../src/config/schemas/rate-limit.ts","../src/config/schemas/upload.ts","../src/config/schemas/logging.ts","../src/config/schemas/cache.ts","../src/config/schemas/security.ts","../src/config/schemas/storage.ts","../src/vite-plugin/theoui-detect.ts","../src/vite-plugin/config-resolve.ts","../src/vite-plugin/configure-server-hook.ts","../src/devtools/server-side/route-manifest.ts","../src/router/scan.ts","../src/router/types.ts","../src/vite-plugin/action-middleware.ts","../src/vite-plugin/agent-middleware.ts","../src/server/agent/agent-card-handler.ts","../src/server/agent/approve-agent.ts","../src/server/agent/list-approvals-handler.ts","../src/server/agent/handle-agent-run-reconnect.ts","../src/server/agent/thread-dispatcher.ts","../src/server/agent/thread-run-registry.ts","../src/server/agent/handle-thread-routes.ts","../src/server/agent/serve-aux-routes.ts","../src/server/http/node-web-adapter.ts","../src/vite-plugin/api-middleware.ts","../src/vite-plugin/ssr-dev-middleware.ts","../src/vite-plugin/ws-upgrade.ts","../src/vite-plugin/integrate-ui.ts","../src/vite-plugin/auto-detect.ts","../src/vite-plugin/resolve-theo-root.ts","../src/vite-plugin/transform-html-hook.ts","../src/vite-plugin/inject-devtools.ts","../src/vite-plugin/inject-entry-client.ts","../src/vite-plugin/inject-stylesheets.ts","../src/router/entry-server.ts","../src/router/entry.ts","../src/router/generate.ts","../src/vite-plugin/virtual-modules-hook.ts","../src/vite-plugin/integrations.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Vite plugin entry. Reads `package.json` + checks for ts vs js source\n * layout under `theoSrcDir` (build-time literal). No HTTP input.\n */\nimport { existsSync } from 'node:fs'\nimport { resolve, dirname } from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nimport type { Plugin } from 'vite'\n\nimport {\n  type AuditLogger,\n  type CorsConfig,\n  type CsrfReadinessStore,\n  type DisallowedConfig,\n  type PluginRunner,\n  type RateLimitConfig,\n  type SecurityHeadersConfig,\n} from '../server/internal-api.js'\nimport type { TheoTransformer } from '../server/transformer.js'\nimport { type ServicesConfig } from '../services/index.js'\n\n// T2.1-T2.3 (architecture-medium-deferrals) + T2.6 (M6) — sibling extractions.\nimport { runConfigHook } from './config-hook.js'\nimport { resolvePluginConfig, type ResolvedOpenApi } from './config-resolve.js'\nimport { runConfigureServer } from './configure-server-hook.js'\nimport { integrateUseTheoUI } from './integrate-ui.js'\nimport { resolveTheoRootDir } from './resolve-theo-root.js'\nimport type { TheoUiDetectResult } from './theoui-detect.js'\nimport { runTransformIndexHtml } from './transform-html-hook.js'\nimport {\n  loadVirtualModule,\n  resolveVirtualModuleId,\n  type VirtualModuleIds,\n} from './virtual-modules-hook.js'\n\nexport {\n  defineTheoIntegration,\n  createIntegrationRegistry,\n  IntegrationRouteCollisionError,\n  IntegrationVirtualModulePrefixError,\n} from './integrations.js'\nexport type {\n  TheoIntegration,\n  HookName as IntegrationHookName,\n  Hook as IntegrationHook,\n  HookContext as IntegrationHookContext,\n  IntegrationRegistry,\n  IntegrationRegistryOptions,\n  IntegrationRoute,\n  RouteHandler as IntegrationRouteHandler,\n} from './integrations.js'\n\nconst VIRTUAL_ENTRY_ID = '/@theo/entry-client'\nconst RESOLVED_ENTRY_ID = '\\0@theo/entry-client'\nconst VIRTUAL_MANIFEST_ID = '/@theo/route-manifest'\nconst RESOLVED_MANIFEST_ID = '\\0@theo/route-manifest'\nconst VIRTUAL_ENTRY_SERVER_ID = '/@theo/entry-server'\nconst RESOLVED_ENTRY_SERVER_ID = '\\0@theo/entry-server'\nconst VIRTUAL_RUNTIME_CONFIG_ID = '/@theo/runtime-config'\nconst RESOLVED_RUNTIME_CONFIG_ID = '\\0@theo/runtime-config'\n\nexport interface TheoPluginOptions {\n  root?: string\n  rateLimit?: RateLimitConfig\n  ssr?: boolean\n  ssrStreaming?: boolean\n  /**\n   * Wave 2 (T3.1) — polyglot services config. When passed, the\n   * services-typed-client plugin is wired and generates `clients/<name>.ts`\n   * per service with an OpenAPI URL. Empty `{}` → no-op.\n   */\n  services?: ServicesConfig\n  /**\n   * T4.1 (canvas-ecosystem-refactor / ADR D6) — extra package names appended\n   * to Vite `optimizeDeps.include`. Required when an installed plugin\n   * peer-dep is consumed via a literal `import('<pkg>')` (dynamic specifier)\n   * — Vite cannot trace those without a hint, and the browser receives a\n   * `Failed to resolve module specifier '<pkg>'` error.\n   *\n   * Default targets pre-bundled regardless: `@theokit/ui`, `lucide-react`.\n   *\n   * Example:\n   *   viteOptimizeDeps: ['mermaid']\n   */\n  viteOptimizeDeps?: string[]\n  /**\n   * Optional override for the in-memory CSRF readiness store consumed by\n   * the `/__theo/csrf-readiness` endpoint and the devtools CSRF Readiness\n   * tab. When omitted, the plugin auto-instantiates a default in-process\n   * `CsrfReadinessStore` so the tab works out-of-the-box in dev.\n   *\n   * Override with a custom impl when you need cross-worker telemetry\n   * (e.g., Redis-backed store) or want to silence the tab entirely\n   * (pass an inert store that discards writes).\n   */\n  csrfReadinessStore?: CsrfReadinessStore\n  /**\n   * Backend root directory name (config `serverDir`), relative to the project root. Route/action\n   * discovery, the typed-client codegen, and the routes HMR watcher all scan `<serverDir>/routes`,\n   * `<serverDir>/actions`, etc. Defaults to `\"server\"` — apps that keep the canonical layout are\n   * unaffected. Set to e.g. `\"core\"` to organize the backend by domain (issue #95).\n   */\n  serverDir?: string\n  /**\n   * Directory (relative to project root) holding `agents/<name>.ts` definitions (config `agentsDir`).\n   * Scanned by the dev agent-middleware + the typed-agent codegen + the routes manifest. Defaults to\n   * `\"agents\"`. Set to e.g. `\"core/agents\"` to co-locate agents with the domain root (#95 follow-up).\n   */\n  agentsDir?: string\n  /**\n   * Frontend dir (config `appDir`, default \"app\") holding the file-based router (`page.tsx`,\n   * `layout.tsx`, …), relative to the project root. Set to e.g. `\"apps/web\"` to group the web UI\n   * under an `apps/` root alongside other frontends (#95 follow-up).\n   */\n  appDir?: string\n}\n\n/**\n * T3.3 — Find a consumer-side config file (`tailwind.config.*`, `postcss.config.*`)\n * by walking from projectRoot up to 3 levels. Returns the absolute path on the\n * first hit, or `undefined`. Used to defer to consumer's manual config (D3).\n */\nfunction findConsumerConfig(projectRoot: string, basename: string): string | undefined {\n  const extensions = ['.ts', '.js', '.mjs', '.cjs']\n  let dir = projectRoot\n  for (let level = 0; level < 3; level++) {\n    for (const ext of extensions) {\n      const candidate = resolve(dir, `${basename}${ext}`)\n      if (existsSync(candidate)) return candidate\n    }\n    const parent = dirname(dir)\n    if (parent === dir) break\n    dir = parent\n  }\n  return undefined\n}\n\n/**\n * Async factory companion. Returns `[theoPlugin, ...autoChainedPlugins]`.\n *\n * Why this exists alongside the sync `theoPlugin()` factory: Vite does NOT\n * reliably merge plugins returned from a child plugin's `config()` hook\n * (verified empirically 2026-05-23 — plugins were silently dropped from\n * the resolved chain despite being returned correctly). The canonical\n * Vite pattern for plugin-from-plugin is to return `Plugin[]` from the\n * plugin factory itself, which Vite flattens into the consumer's\n * `plugins` array.\n *\n * Consumers should prefer `await theoPluginAsync(...)` over `theoPlugin(...)`\n * when they want @theokit/ui + @tailwindcss/vite auto-chaining. The sync\n * factory remains for backward compatibility and tests.\n */\nexport async function theoPluginAsync(\n  rootOrOptions?: string | TheoPluginOptions,\n): Promise<Plugin[]> {\n  const options =\n    typeof rootOrOptions === 'string' ? { root: rootOrOptions } : (rootOrOptions ?? {})\n  const projectRoot = options.root ?? process.cwd()\n  // Backend root (config `serverDir`, default \"server\"). Route/action discovery, typed-client\n  // codegen, and the routes HMR watcher all scan under this dir (issue #95). Absolute.\n  const serverDirAbs = resolve(projectRoot, options.serverDir ?? 'server')\n  // Agents dir NAME (config `agentsDir`, default \"agents\"), relative to projectRoot — scanAgents\n  // joins it. May be nested (e.g. \"core/agents\"). (#95 follow-up)\n  const agentsDirName = options.agentsDir ?? 'agents'\n\n  const consumerTailwindConfig = findConsumerConfig(projectRoot, 'tailwind.config')\n  const consumerPostcssConfig = findConsumerConfig(projectRoot, 'postcss.config')\n  const uiPlugins = await integrateUseTheoUI(projectRoot, {\n    consumerTailwindConfig,\n    consumerPostcssConfig,\n  })\n\n  // Wave 2 (T3.1) — typed-client plugin wired only when services declared.\n  // Empty `services: {}` (default) → plugin is a no-op (no fetch fired).\n  const servicesPlugins: Plugin[] = []\n  if (options.services && Object.keys(options.services).length > 0) {\n    const { servicesTypedClientPlugin } = await import('./services-typed-client.js')\n    servicesPlugins.push(\n      servicesTypedClientPlugin({\n        cwd: projectRoot,\n        services: options.services,\n      }),\n    )\n  }\n\n  // G1 — app typed client (`@theo/client`). Always wired (route detection is\n  // cheap and the plugin is a no-op when `server/routes/` is absent).\n  const { appTypedClientPlugin } = await import('./app-typed-client.js')\n  const appClientPlugin = appTypedClientPlugin({\n    cwd: projectRoot,\n    serverDir: serverDirAbs,\n    distDir: resolve(projectRoot, '.theokit'),\n  })\n\n  // G3 — actions virtual module (`@theo/actions`). Always wired; the plugin\n  // emits an empty `{}` facade when `server/actions/` is absent so consumers\n  // can still `import { actions } from '@theo/actions'` without breakage.\n  // The `distDir` opt enables `.theokit/actions.d.ts` emit so TS resolves the\n  // virtual module ambient declaration in consumer apps.\n  const { actionsVirtualModule } = await import('./actions-virtual-module.js')\n  const actionsPlugin = actionsVirtualModule({\n    serverDir: serverDirAbs,\n    distDir: resolve(projectRoot, '.theokit'),\n  })\n\n  // M2 — agents typed client (`@theo/agents`). Emits `.theokit/agents.d.ts` mapping each\n  // top-level `agents/<name>.ts` to its `defineAgent({ input })` type, so `useAgent('name')`\n  // is typed end-to-end with zero manual wiring. Watches `agents/*`.\n  const { agentsTypedClientPlugin } = await import('./agents-typed-client.js')\n  const { generateManifest } = await import('../server/internal-api.js')\n  const agentsClientPlugin = agentsTypedClientPlugin({\n    projectRoot,\n    agentsDir: agentsDirName,\n    distDir: resolve(projectRoot, '.theokit'),\n    // Agents live at <projectRoot>/<agentsDir>; generateManifest scans them via the server dir's\n    // parent (projectRoot for the canonical layout) + the agents dir name (#95 follow-up).\n    scanManifest: () => generateManifest(serverDirAbs, projectRoot, agentsDirName),\n  })\n\n  // G6 T1.2 — server-routes HMR. Watches `<serverDir>/routes/**` and\n  // invalidates SSR module cache + sends full-reload on any add/change/unlink\n  // with a 50 ms debounce per EC-6.\n  const { serverRoutesHmrPlugin } = await import('./server-routes-hmr.js')\n  const routesHmrPlugin = serverRoutesHmrPlugin({\n    serverDir: serverDirAbs,\n  })\n\n  // #122 (T1.1) — compile `<serverDir>/controllers/**` through @theokit/http's\n  // swc transform so parameter decorators (@Body/@Param/@Query) emit metadata\n  // esbuild drops. No-op for every non-controller file (ADR-4 — file-based\n  // routes are byte-for-byte unchanged).\n  const { controllerSwcTransformPlugin } = await import('./controller-swc-transform.js')\n  const controllerTransformPlugin = controllerSwcTransformPlugin({\n    serverDir: serverDirAbs,\n  })\n\n  return [\n    theoPlugin(rootOrOptions),\n    ...uiPlugins,\n    ...servicesPlugins,\n    // #122 — swc-compile controllers/** (enforce:'pre'; order-independent).\n    controllerTransformPlugin,\n    appClientPlugin,\n    actionsPlugin,\n    agentsClientPlugin,\n    routesHmrPlugin,\n  ]\n}\n\n/**\n * Build the `optimizeDeps.include` array Vite uses to pre-bundle heavy\n * deps at server startup. Detects `@theokit/ui` and `lucide-react` in\n * the consumer's `node_modules` (auto-include) and appends user-declared\n * peer deps via `viteOptimizeDeps` (e.g., `mermaid` for plugin-canvas\n * — without this hint Vite fails to resolve dynamic `import('mermaid')`\n * inside an installed plugin at dev time). T4.1 of canvas-ecosystem-refactor.\n */\nfunction buildOptimizeDepsInclude(\n  projectRoot: string,\n  viteOptimizeDeps: readonly string[] | undefined,\n): string[] {\n  const include: string[] = []\n  if (existsSync(resolve(projectRoot, 'node_modules', '@theokit', 'ui'))) {\n    include.push('@theokit/ui')\n  }\n  if (existsSync(resolve(projectRoot, 'node_modules', 'lucide-react'))) {\n    include.push('lucide-react')\n  }\n  // T7.1 — devalue is a peer of the @theo/actions virtual module facade.\n  // Without this include hint, Vite import-analysis fails to resolve the\n  // facade's `await import('devalue')` from the consumer context (devalue\n  // lives in theokit's node_modules subtree, not the consumer root).\n  include.push('devalue')\n  if (Array.isArray(viteOptimizeDeps)) {\n    for (const pkg of viteOptimizeDeps) {\n      if (typeof pkg === 'string' && pkg.length > 0 && !include.includes(pkg)) {\n        include.push(pkg)\n      }\n    }\n  }\n  return include\n}\n\nconst VIRTUAL_MODULE_IDS: VirtualModuleIds = {\n  VIRTUAL_ENTRY_ID,\n  RESOLVED_ENTRY_ID,\n  VIRTUAL_MANIFEST_ID,\n  RESOLVED_MANIFEST_ID,\n  VIRTUAL_ENTRY_SERVER_ID,\n  RESOLVED_ENTRY_SERVER_ID,\n  VIRTUAL_RUNTIME_CONFIG_ID,\n  RESOLVED_RUNTIME_CONFIG_ID,\n}\n\nexport function theoPlugin(rootOrOptions?: string | TheoPluginOptions): Plugin {\n  const options =\n    typeof rootOrOptions === 'string' ? { root: rootOrOptions } : (rootOrOptions ?? {})\n  const projectRoot = options.root ?? process.cwd()\n  // Frontend dir (config `appDir`, default \"app\") — the file-based router scan + SSR/client entry (#95).\n  const appDir = resolve(projectRoot, options.appDir ?? 'app')\n  // Backend root (config `serverDir`, default \"server\") — route/action middleware scan under it (#95).\n  const serverDir = resolve(projectRoot, options.serverDir ?? 'server')\n  // Agents dir NAME (config `agentsDir`, default \"agents\") — the agent-middleware scanAgents uses it.\n  const agentsDir = options.agentsDir ?? 'agents'\n  const ssrEnabled = options.ssr ?? false\n\n  // Resolve paths for SSR module loading. Pure helper extracted for T1.3\n  // regression test — see resolve-theo-root.ts for branch documentation.\n  const currentDir = dirname(fileURLToPath(import.meta.url))\n  const theoSrcDir = resolveTheoRootDir(currentDir)\n\n  // EC-1: plugin runner cached in module closure. Instantiated in configResolved\n  // (non-HMR-able). theo.config.ts edits during dev emit a warn but do NOT\n  // re-instantiate — user must restart dev server for plugin changes.\n  let pluginRunner: PluginRunner | undefined\n  let transformer: TheoTransformer | undefined\n  let resolvedBatching: { max?: number } | undefined\n  let theoUi: TheoUiDetectResult | undefined\n  let csrfMode: 'off' | 'warn' | 'strict' = 'strict'\n  let securityHeaders: SecurityHeadersConfig | undefined\n  let disallowed: DisallowedConfig | undefined\n  // T1.2 — CORS config resolved from theo.config.ts; passed to api-middleware.\n  let cors: CorsConfig | undefined\n  // T4.1 — Audit logger from theo.config.ts.audit.logger\n  let auditLogger: AuditLogger | undefined\n  // T1.2 — devtools opt-out. `false` skips injection; anything else enables (dev only).\n  let devtoolsEnabled = true\n  // P#3 T1.1 — OpenAPI dev-emit config. undefined = opt-out (no behavior).\n  let resolvedOpenApi: ResolvedOpenApi | undefined\n  let resolvedDistDir = '.theokit'\n  // Dev mode flag set in configureServer. transformIndexHtml runs in both\n  // dev and build; we only want to inject during dev. Wrapped in a ref\n  // struct so sub-hooks (configure-server-hook, transform-html-hook) can\n  // observe mutations across hook boundaries without losing identity.\n  const isDevModeRef = { value: false }\n  let configLoadedOnce = false\n\n  return {\n    name: 'theo',\n\n    async configResolved() {\n      // T2.1 (architecture-medium-deferrals, ADR D2) — config-load logic\n      // extracted to `config-resolve.ts`. This hook owns only the one-shot\n      // semantic and the closure-variable assignment.\n      if (configLoadedOnce) return\n      configLoadedOnce = true\n      const resolved = await resolvePluginConfig(projectRoot)\n      pluginRunner = resolved.pluginRunner\n      transformer = resolved.transformer\n      resolvedBatching = resolved.resolvedBatching\n      theoUi = resolved.theoUi\n      csrfMode = resolved.csrfMode\n      securityHeaders = resolved.securityHeaders\n      disallowed = resolved.disallowed\n      cors = resolved.cors\n      auditLogger = resolved.auditLogger\n      devtoolsEnabled = resolved.devtoolsEnabled\n      resolvedOpenApi = resolved.openapi\n      resolvedDistDir = resolved.distDir\n    },\n\n    // T2.6 (M6) — config() body extracted to config-hook.ts. The hook\n    // owns optimizeDeps + warmup + services proxy + alias cascade.\n    // The @theokit/ui + @tailwindcss/vite auto-chain lives in\n    // `theoPluginAsync` because Vite drops plugins returned from a\n    // child plugin's config() hook.\n    config() {\n      return runConfigHook({\n        projectRoot,\n        theoSrcDir,\n        services: options.services,\n        optimizeDepsInclude: buildOptimizeDepsInclude(projectRoot, options.viteOptimizeDeps),\n      })\n    },\n\n    // T2.6 (M6) — transformIndexHtml hook extracted to transform-html-hook.ts.\n    // Preserves the canonical 3-step order (entry-client → devtools → styles)\n    // so EC-10 (Vite hook ordering side effects) is honored.\n    transformIndexHtml: {\n      order: 'pre' as const,\n      handler(html: string): string {\n        return runTransformIndexHtml(html, {\n          isDevMode: isDevModeRef,\n          devtoolsEnabled,\n          projectRoot,\n        })\n      },\n    },\n\n    // T2.6 (M6) — virtual-module resolveId + load dispatch extracted to\n    // virtual-modules-hook.ts. Pure structural split; identity branches\n    // preserved.\n    resolveId(id: string) {\n      return resolveVirtualModuleId(id, VIRTUAL_MODULE_IDS)\n    },\n\n    load(id: string) {\n      return loadVirtualModule(id, {\n        ids: VIRTUAL_MODULE_IDS,\n        appDir,\n        ssrEnabled,\n        streamingEnabled: options.ssrStreaming === true,\n        theoUi,\n        transformer,\n      })\n    },\n\n    // T2.6 (M6) — configureServer body extracted to configure-server-hook.ts.\n    // The hook owns middleware order, ws subscriptions, watcher handlers,\n    // OpenAPI re-emit, and WS upgrade. EC-10 honored (every effect preserved\n    // in its original ordering).\n    async configureServer(server) {\n      await runConfigureServer(server, {\n        projectRoot,\n        appDir,\n        serverDir,\n        agentsDir,\n        resolvedDistDir,\n        ssrEnabled,\n        isDevMode: isDevModeRef,\n        pluginRunner,\n        transformer,\n        resolvedBatching,\n        csrfMode,\n        securityHeaders,\n        disallowed,\n        cors,\n        auditLogger,\n        resolvedOpenApi,\n        services: options.services,\n        rateLimit: options.rateLimit,\n        csrfReadinessStoreOverride: options.csrfReadinessStore,\n        virtualEntryServerId: VIRTUAL_ENTRY_SERVER_ID,\n        resolvedManifestId: RESOLVED_MANIFEST_ID,\n      })\n    },\n  }\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * config() hook extraction (T2.6 / M6). Reads `app/<file>` candidates +\n * theoSrcDir composition (build-time literals).\n */\nimport { existsSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport { buildServicesProxyConfig, type ServicesConfig } from '../services/index.js'\n\nexport interface ConfigHookCtx {\n  projectRoot: string\n  theoSrcDir: string\n  services: ServicesConfig | undefined\n  optimizeDepsInclude: string[]\n}\n\n/**\n * Builds the partial Vite config returned from `theoPlugin.config()`.\n * Pure extraction — `optimizeDeps.force: true` (workspace iteration\n * coherence), `server.watch.ignored` (ENOSPC prevention), and the\n * `resolve.alias` cascade with order-matters comment all preserved.\n */\nexport function runConfigHook(ctx: ConfigHookCtx): Record<string, unknown> {\n  // Detect whether we're running from source (.ts) or compiled dist (.js)\n  const ext = existsSync(resolve(ctx.theoSrcDir, 'index.ts')) ? '.ts' : '.js'\n\n  // Perf: warm up the app's critical-path files so Vite transforms them\n  // before the browser asks. Cuts the visible LCP when these files\n  // import heavy barrels (TheoUI).\n  const warmupClientFiles: string[] = []\n  for (const candidate of ['app/layout.tsx', 'app/page.tsx', 'app/page.jsx']) {\n    const full = resolve(ctx.projectRoot, candidate)\n    if (existsSync(full)) warmupClientFiles.push(`./${candidate}`)\n  }\n\n  // Wave 2 completion T1.1 — translate `services: {}` into Vite proxy.\n  // Empty services → empty record → Vite proxy unaffected.\n  const servicesProxy =\n    ctx.services && Object.keys(ctx.services).length > 0\n      ? buildServicesProxyConfig(ctx.services)\n      : undefined\n\n  // T7.1 dogfood fix — workspace-linked packages change frequently as\n  // we iterate. Vite's pre-bundler caches by lockfile hash, NOT source-\n  // content hash; when the workspace dist updates but the lockfile\n  // doesn't, the cache serves stale bundles. Setting `force: true`\n  // always re-optimizes on boot — slower cold-start but cache-coherent\n  // across workspace iter.\n  return {\n    envPrefix: 'THEO_PUBLIC_',\n    optimizeDeps: {\n      ...(ctx.optimizeDepsInclude.length > 0 ? { include: ctx.optimizeDepsInclude } : {}),\n      force: true,\n    },\n    server: {\n      ...(warmupClientFiles.length > 0 ? { warmup: { clientFiles: warmupClientFiles } } : {}),\n      ...(servicesProxy !== undefined ? { proxy: servicesProxy } : {}),\n      // Skip watching gitignored heavy dirs to avoid ENOSPC (inotify watcher\n      // exhaustion), theokit's own generated output, and local SQLite data.\n      // #121: a DB write (`.data/app.db` + `-wal`/`-shm`) on every agent turn /\n      // request must NOT trigger a full page reload — that \"blinks\" the screen\n      // and tears down the in-flight agent stream.\n      watch: {\n        ignored: [\n          '**/referencias/**',\n          '**/.theokit/**',\n          '**/dist/**',\n          '**/node_modules/**',\n          '**/.data/**',\n          '**/*.db',\n          '**/*.db-wal',\n          '**/*.db-shm',\n          '**/*.sqlite',\n          '**/*.sqlite-journal',\n        ],\n      },\n    },\n    resolve: {\n      alias: [\n        // Order matters: most-specific first so `theokit/X` doesn't\n        // get matched by the bare `theokit` alias.\n        { find: 'theokit/server', replacement: resolve(ctx.theoSrcDir, `server/index${ext}`) },\n        { find: 'theokit/client', replacement: resolve(ctx.theoSrcDir, `client/index${ext}`) },\n        {\n          // T2.1 (M5 lonely folders) moved the source from\n          // `react-query/index.ts` into `client/react-query.ts` (sibling of\n          // `client/index.ts`). The package.json export `./react-query`\n          // still points at the build artifact `./dist/react-query/index.{js,d.ts}`,\n          // but the dev-time source alias must follow the new location.\n          find: 'theokit/react-query',\n          replacement: resolve(ctx.theoSrcDir, `client/react-query${ext}`),\n        },\n        {\n          find: 'theokit/vite-plugin',\n          replacement: resolve(ctx.theoSrcDir, `vite-plugin/index${ext}`),\n        },\n        {\n          find: 'theokit/adapters/web-shim',\n          replacement: resolve(ctx.theoSrcDir, `adapters/web-shim${ext}`),\n        },\n        {\n          find: 'theokit/adapters/ws-shim',\n          replacement: resolve(ctx.theoSrcDir, `adapters/ws-shim${ext}`),\n        },\n        // T1.2 — devtools entry (DEV only; tree-shaken in build).\n        // Source layout: src/devtools/dom/entry.tsx (has /dom/ segment)\n        // Dist layout:   dist/devtools/entry.js    (tsup flattens /dom/)\n        {\n          find: 'theokit/devtools/entry',\n          replacement: resolve(\n            ctx.theoSrcDir,\n            ext === '.ts' ? 'devtools/dom/entry.tsx' : 'devtools/entry.js',\n          ),\n        },\n        { find: 'theokit', replacement: resolve(ctx.theoSrcDir, `index${ext}`) },\n      ],\n    },\n  }\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Config loader. Reads `theo.config.{ts,js,mjs}` under the user's `cwd`.\n * Names are a fixed set of literals; `cwd` is a CLI arg resolved to\n * absolute. Build-time tool — no HTTP input.\n */\nimport { existsSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport { TheoConfigError } from './errors.js'\nimport { importUserModule } from './import-user-module.js'\nimport { loadEnv } from './load-env.js'\nimport { theoConfigSchema } from './schema.js'\nimport type { TheoConfig } from './schema.js'\n\nconst CONFIG_FILE = 'theo.config.ts'\n\n/**\n * Deep merges two plain objects. Override values take precedence.\n * Arrays are replaced (not concatenated).\n * Protects against prototype pollution (EC-4).\n */\nexport function deepMerge(\n  base: Record<string, unknown>,\n  override: Record<string, unknown>,\n): Record<string, unknown> {\n  const result = { ...base }\n  for (const key of Object.keys(override)) {\n    // EC-4: Prevent prototype pollution\n    if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue\n\n    const baseVal = base[key]\n    const overVal = override[key]\n\n    if (\n      overVal !== null &&\n      typeof overVal === 'object' &&\n      !Array.isArray(overVal) &&\n      baseVal !== null &&\n      typeof baseVal === 'object' &&\n      !Array.isArray(baseVal)\n    ) {\n      result[key] = deepMerge(\n        baseVal as Record<string, unknown>,\n        overVal as Record<string, unknown>,\n      )\n    } else {\n      result[key] = overVal\n    }\n  }\n  return result\n}\n\nexport async function loadConfig(dir: string): Promise<TheoConfig> {\n  // T1.3 — Load .env BEFORE reading theo.config.ts. Defensive: CLI commands\n  // (dev/build/start) already call loadEnv() first, but programmatic users\n  // who call loadConfig directly (tests, custom scripts) need this too.\n  // Module-level cache makes the second call a Map-lookup (no FS).\n  loadEnv({ cwd: dir })\n\n  const configPath = resolve(dir, CONFIG_FILE)\n\n  if (!existsSync(configPath)) {\n    return theoConfigSchema.parse({})\n  }\n\n  let mod: Record<string, unknown>\n  try {\n    mod = await importUserModule(configPath)\n  } catch (err) {\n    throw new TheoConfigError([{ field: '_file', message: (err as Error).message }], configPath)\n  }\n\n  const userConfig = mod.default\n\n  if (userConfig == null || typeof userConfig !== 'object') {\n    throw new TheoConfigError(\n      [\n        {\n          field: '_export',\n          message: 'theo.config.ts must use export default defineConfig({...})',\n        },\n      ],\n      configPath,\n    )\n  }\n\n  // Merge with per-environment config if NODE_ENV is set\n  let rawConfig = userConfig as Record<string, unknown>\n  const nodeEnv = process.env.NODE_ENV\n\n  if (nodeEnv) {\n    const envFile = `theo.config.${nodeEnv}.ts`\n    const envPath = resolve(dir, envFile)\n\n    if (existsSync(envPath)) {\n      try {\n        const envMod = await importUserModule(envPath)\n        const envConfig = envMod.default\n\n        if (envConfig != null && typeof envConfig === 'object') {\n          rawConfig = deepMerge(rawConfig, envConfig as Record<string, unknown>)\n        }\n      } catch (err) {\n        throw new TheoConfigError([{ field: '_file', message: (err as Error).message }], envPath)\n      }\n    }\n  }\n\n  const result = theoConfigSchema.safeParse(rawConfig)\n\n  if (!result.success) {\n    const issues = result.error.issues.map((i) => ({\n      field: i.path.join('.'),\n      message: i.message,\n    }))\n    throw new TheoConfigError(issues, configPath)\n  }\n\n  return result.data\n}\n","export interface ConfigIssue {\n  field: string\n  message: string\n}\n\nexport class TheoConfigError extends Error {\n  public readonly issues: ConfigIssue[]\n  public readonly configPath: string\n\n  constructor(issues: ConfigIssue[], configPath: string) {\n    const issueLines = issues.map((i) => `  - ${i.field}: ${i.message}`).join('\\n')\n\n    super(\n      `Invalid theo.config.ts\\n\\n` +\n        `  File: ${configPath}\\n\\n` +\n        (issueLines ? `  Issues:\\n${issueLines}\\n` : ''),\n    )\n\n    this.name = 'TheoConfigError'\n    this.issues = issues\n    this.configPath = configPath\n  }\n}\n","import { z } from 'zod'\n\nimport { servicesConfigSchema } from '../services/index.js'\n\nimport {\n  cacheSchema,\n  loggingSchema,\n  rateLimitSchema,\n  securitySchema,\n  storageSchema,\n  uploadSchema,\n  type FormatErrorContext,\n  type FormatErrorHook,\n} from './schemas/index.js'\n\n// Re-export per-concern schemas + types so downstream consumers\n// (`adapters/*`, vite-plugin, generators, tests) keep their existing\n// imports valid. Per plan T2.3 — pure structural split; zero behavior\n// change at the call site.\nexport {\n  cacheSchema,\n  corsSchema,\n  disallowedConfigSchema,\n  headerSafeString,\n  loggingSchema,\n  rateLimitSchema,\n  securityHeadersSchema,\n  securitySchema,\n  storageSchema,\n  uploadSchema,\n} from './schemas/index.js'\n\nexport type { FormatErrorContext, FormatErrorHook, StorageConfig } from './schemas/index.js'\n\n/**\n * Root `theo.config.ts` schema — composer assembled from the per-concern\n * primitives re-exported above.\n *\n * Embedded blocks that exist ONLY as part of the root config (`agents`,\n * `ui`, `devtools`, `jobs`, `openapi`) stay inline below. They have no\n * external consumers; splitting them would create lonely files (M5\n * smell) without comprehension benefit.\n */\nexport const theoConfigSchema = z\n  .object({\n    /**\n     * Plan v1.2 T2.1 — project identifier propagated into\n     * `.theokit/services.json` v2 `project` field. DNS-1123 compatible (drives\n     * Gitea repo + ArgoCD App naming on TheoCloud). When omitted, the build\n     * emits services.json v1 with the legacy `services-bundle` fallback\n     * (ADR D10) and logs a deprecation warning.\n     */\n    name: z\n      .string()\n      .max(63)\n      .refine(\n        // DNS-1123 equivalent expressed as explicit single-char anchors so\n        // security/detect-unsafe-regex stays clean (no backtracking).\n        (value) =>\n          value.length > 0 &&\n          /^[a-z0-9-]+$/u.test(value) &&\n          !value.startsWith('-') &&\n          !value.endsWith('-'),\n        'name must match DNS-1123 (lowercase alphanumeric+hyphens, 1-63 chars, no leading/trailing hyphen)',\n      )\n      .optional(),\n    appDir: z.string().default('app'),\n    serverDir: z.string().default('server'),\n    /**\n     * Directory (relative to the project root) holding `agents/<name>.ts` definitions, scanned by\n     * dev/build/terminal/mcp. Defaults to `\"agents\"` — apps that keep the canonical layout are\n     * unaffected. Set to e.g. `\"core/agents\"` to organize agents under a domain root (#95 follow-up).\n     */\n    agentsDir: z.string().default('agents'),\n    /**\n     * T2.2 / EC-4 — Build output directory. Must be a relative path inside\n     * the project root. Refused absolute or parent-relative paths to prevent\n     * `cleanOutDir` from wiping arbitrary locations (defense-in-depth on\n     * top of cleanOutDir's runtime EC-3 guard).\n     */\n    distDir: z\n      .string()\n      .default('.theokit')\n      .refine(\n        (d) => !/^([A-Za-z]:)?[/\\\\]/.test(d) && !d.startsWith('..'),\n        'distDir must be a relative path inside the project root (e.g., \".theokit\")',\n      ),\n    /**\n     * Agent runtime configuration.\n     *\n     * - `maxRegistries` (T2.3, legacy): dev-mode cleanup of stale\n     *   `.theokit/agents/<id>/` dirs by mtime. Now superseded by SDK's\n     *   native registry GC but kept for backward-compat.\n     * - `registry` (Phase 6, Production-Readiness #2): forwarded to\n     *   `Agent.registry.configure()` lazily on first request.\n     *   * `maxAgents` — LRU cap. MUST be ≥ max-concurrent-active-conversations\n     *     (EC-17 DOCUMENT): with maxAgents:1 and 2 concurrent chats, LRU evicts\n     *     mid-stream → SDK aborts with code:'aborted'. Default 100 covers\n     *     indie/small-team; tune up for high-traffic.\n     *   * `idleTimeoutMs` — auto-evict idle agents (default 30 min). 0 disables\n     *     idle eviction (LRU only).\n     */\n    agents: z\n      .object({\n        maxRegistries: z.number().int().positive().default(100),\n        registry: z\n          .object({\n            /** LRU cap — MUST be ≥ max-concurrent-active-conversations. */\n            maxAgents: z.number().int().positive().max(10_000).default(100),\n            /** Idle eviction window in ms. 0 disables idle eviction (LRU only). */\n            idleTimeoutMs: z\n              .number()\n              .int()\n              .nonnegative()\n              .default(30 * 60_000),\n          })\n          .optional(),\n      })\n      .optional(),\n    port: z.number().int().min(1).max(65535).default(3000),\n    /** Listen on all addresses (0.0.0.0) for LAN/mobile testing. */\n    host: z.union([z.string(), z.boolean()]).default('localhost'),\n    /** Automatically open browser on `theokit dev`. */\n    open: z.union([z.boolean(), z.string()]).default(false),\n    /** Exit if port is already in use instead of trying next available. */\n    strictPort: z.boolean().default(false),\n    /** Forward browser console/errors to terminal — useful for AI agent dev. */\n    forwardConsole: z\n      .union([\n        z.boolean(),\n        z.object({\n          unhandledErrors: z.boolean().optional(),\n          logLevels: z.array(z.enum(['error', 'warn', 'info', 'log', 'debug'])).optional(),\n        }),\n      ])\n      .default(false),\n    /** Pre-transform files on startup for faster first page load. */\n    warmup: z\n      .object({\n        clientFiles: z.array(z.string()).optional(),\n        ssrFiles: z.array(z.string()).optional(),\n      })\n      .optional(),\n    ssr: z.boolean().default(false),\n    /** When true (and ssr === true), use renderToPipeableStream with progressive\n     * shell flush instead of single-shot renderToString. Opt-in for streaming\n     * SSR; default false preserves the current behavior. */\n    ssrStreaming: z.boolean().default(false),\n    rateLimit: rateLimitSchema.optional(),\n    upload: uploadSchema.optional(),\n    logging: loggingSchema.optional(),\n    security: securitySchema.optional(),\n    serialization: z.enum(['json', 'superjson']).default('json'),\n    // Plugins are validated structurally at runtime by createPluginRunnerFromConfig.\n    // Zod only checks the shape minimally (must be array). Type-level safety is\n    // provided through defineConfig at the user surface.\n    plugins: z.array(z.unknown()).optional(),\n    /** Enable client-side batching of theoFetch calls and the\n     * /api/__theo_batch__ server endpoint. */\n    batching: z\n      .union([z.boolean(), z.object({ max: z.number().int().positive().optional() })])\n      .optional(),\n    /** T4.1 — Audit log. When `logger` is provided, framework events\n     * (csrf.warn, rate-limit.exceeded, session.rotated, csp.violation) are\n     * emitted to it. Default: noop. */\n    audit: z\n      .object({\n        logger: z.unknown().optional(),\n      })\n      .optional(),\n    /** TheoUI auto-wire (T2.1). `false` = opt-out; object = explicit theme/fonts;\n     * undefined = enabled when @theokit/ui is detected in node_modules. */\n    ui: z\n      .union([\n        z.literal(false),\n        z.object({\n          theme: z.enum(['violet-forge', 'noir', 'paper']).optional(),\n          fonts: z.enum(['bundled', 'cdn']).optional(),\n        }),\n      ])\n      .optional(),\n    /**\n     * Cache subsystem (caching-and-revalidation-plan).\n     * Default `undefined` keeps caching disabled (backward compatible).\n     * Pass `cache: {}` to opt in with defaults.\n     */\n    cache: cacheSchema.optional(),\n    /**\n     * Devtools overlay (Phase 0.4.0+ — see docs/plans/devtools-plan.md).\n     *\n     * - `undefined` (default): devtools auto-injects in `pnpm dev`, NEVER in `vite build`.\n     * - `false`: devtools disabled entirely (Vite plugin skips injection even in dev).\n     * - `{ ... }`: devtools enabled with explicit defaults (position, theme).\n     *\n     * Tree-shaken to noop in prod via the dual-export pattern in\n     * `packages/theo/src/devtools/index.ts` (EC-17 positive prod check).\n     */\n    devtools: z\n      .union([\n        z.literal(false),\n        z.object({\n          position: z.enum(['top-left', 'top-right', 'bottom-left', 'bottom-right']).optional(),\n          theme: z.enum(['light', 'dark', 'system']).optional(),\n        }),\n      ])\n      .optional(),\n    /**\n     * Informative list of deploy adapters the app supports. Does NOT\n     * trigger per-build translations — only the `--target` CLI flag does\n     * (EC-201 / ADR D2). If `config.adapters` includes a target NOT\n     * matching `--target`, `theokit build` emits a cross-reference note.\n     */\n    adapters: z.array(z.string()).optional(),\n    /**\n     * Extra package names to pre-bundle via Vite's `optimizeDeps.include`.\n     *\n     * Framework auto-includes `@theokit/ui` and `lucide-react` when present.\n     * Apps adding plugin peer-deps that rely on a runtime `import('<pkg>')`\n     * (dynamic specifier) — e.g. `@theokit/plugin-canvas` consumers\n     * installing `mermaid` for Mermaid SVG rendering — must declare those\n     * here so Vite can resolve the literal in dev mode without\n     * \"Failed to resolve module specifier\" errors. Production builds use\n     * tsup/esbuild bundling and are not affected.\n     *\n     * Example:\n     *   viteOptimizeDeps: ['mermaid']\n     */\n    viteOptimizeDeps: z.array(z.string()).optional(),\n    /**\n     * Jobs backend (ADR D3 + T2.1). When configured, every request gets\n     * `ctx.queue.enqueue` auto-wired via the outbox lifecycle. Pass a\n     * `JobBackend` instance (InMemoryJobBackend, PostgresJobBackend, etc.).\n     */\n    jobs: z\n      .object({\n        backend: z.custom<unknown>((v) => typeof v === 'object' && v !== null),\n      })\n      .optional(),\n    /**\n     * StorageManager configuration (T1.1 / ADR-0007).\n     *\n     * Declares Postgres servers + databases + Redis servers. Consumed by\n     * `getStorageManager().configure()` at boot via `start.ts`.\n     *\n     * Default `undefined` means manager exists but is not configured — adapters\n     * relying on the manager (PostgresJobBackend.fromStorageManager, etc.) will\n     * throw with an actionable error on first use.\n     */\n    storage: storageSchema.optional(),\n    /**\n     * Wave 2 — Polyglot services orchestration (T1.1 / ADR-0012/0013/0014/0015).\n     *\n     * Declarative external sidecar processes (Python FastAPI / Node Hono)\n     * that boot alongside the TheoKit TS app. Empty `services: {}` is the\n     * default and preserves Wave 1 behavior.\n     */\n    services: servicesConfigSchema,\n    /**\n     * G2 — OpenAPI emit (build-time only).\n     *\n     * When present, `theokit build` writes a generated `openapi.json` from\n     * every `defineRoute()` body/query/params Zod schema. `undefined` keeps\n     * the framework backward-compatible (no emit). Pass `openapi: {}` to\n     * opt in with defaults.\n     *\n     * Defaults: spec 3.1.0 · servers `http://localhost:3000` · title\n     * \"TheoKit App\" · version \"0.0.0\" · outDir \".theokit\" (next to dist).\n     *\n     * The env var `THEOKIT_OPENAPI_SERVERS` (CSV of URLs) overrides\n     * `servers[].url` at emit time without rebuilding the config.\n     */\n    openapi: z\n      .object({\n        servers: z\n          .array(\n            z.object({\n              url: z.url(),\n              description: z.string().optional(),\n            }),\n          )\n          .default([{ url: 'http://localhost:3000', description: 'Local development' }]),\n        specVersion: z.enum(['3.1.0', '3.0.3']).default('3.1.0'),\n        title: z.string().default('TheoKit App'),\n        version: z.string().default('0.0.0'),\n        outDir: z.string().default('.theokit'),\n      })\n      .optional(),\n    /**\n     * G5 T1.3 — error envelope transformer hook (blueprint ADR D3).\n     *\n     * When present, runs at framework error-boundary time to enrich the\n     * envelope with consumer-defined extensions (`hint`, custom telemetry\n     * tags, etc.) BEFORE the envelope is serialized to the client. The\n     * function signature is preserved via the explicit `FormatErrorHook`\n     * type — TS inference flows from `theo.config.ts` into `@theo/client`\n     * codegen and `@theokit/ui` AgentErrorCard consumers.\n     *\n     * Use `z.custom<FormatErrorHook>(...)` because Zod's built-in\n     * `z.function()` discards its TS signature after parse; `z.custom`\n     * with a function-typed runtime guard preserves the call-site type\n     * without trading off Zod runtime validation.\n     */\n    formatError: z\n      .custom<FormatErrorHook>((val) => typeof val === 'function', {\n        message: 'formatError must be a function',\n      })\n      .optional(),\n  })\n  // EC-2 fix: cross-config refine — no service may share TheoKit's web port.\n  .refine((cfg) => !Object.values(cfg.services).some((s) => s.port === cfg.port), {\n    message: 'service.port collides with TheoKit web port — change one of them',\n    path: ['services'],\n  })\n\nexport type TheoConfig = z.infer<typeof theoConfigSchema>\n\nexport type OpenApiConfig = NonNullable<TheoConfig['openapi']>\n\n// Silence unused-import warnings for type-only re-exports — TS strips at compile,\n// but exports above re-introduce them for downstream consumers.\nexport type _FormatErrorContext = FormatErrorContext\n","import { z } from 'zod'\n\n/**\n * EC-3 — CWE-113 HTTP Response Splitting mitigation.\n *\n * Every string that becomes a header value must reject CR/LF. Apps that\n * derive header values from untrusted input (feature flags, tenant config,\n * URL params) would otherwise let attackers inject Set-Cookie / Location\n * headers via `\\r\\n`. Apply this refinement to every header-bound string\n * field: permissionsPolicy, csp, hsts, referrerPolicy, CORS allow/expose.\n */\nexport const headerSafeString = z\n  .string()\n  .refine((s) => !/[\\r\\n]/.test(s), { message: 'Header value must not contain CR/LF' })\n","import { z } from 'zod'\n\n/**\n * Base bucket config — legacy shape preserved for backwards compatibility.\n */\nconst baseRateLimitSchema = z.object({\n  windowMs: z.number().min(1),\n  max: z.number().int().min(1),\n})\n\n/**\n * T2.2 — Per-route + per-user rate limit. The new shape adds `routes`\n * (path map), `keyBy`, and `cookieName`. The legacy flat shape is still\n * accepted via the union — see `createRouteRateLimiter` for normalization.\n */\nexport const rateLimitSchema = z.union([\n  baseRateLimitSchema,\n  z.object({\n    default: baseRateLimitSchema.optional(),\n    routes: z.record(z.string(), baseRateLimitSchema).optional(),\n    keyBy: z\n      .union([\n        z.enum(['ip', 'session', 'user']),\n        z.function({ input: z.tuple([z.unknown()]), output: z.string() }),\n      ])\n      .optional(),\n    cookieName: z.string().min(1).optional(),\n  }),\n])\n","import { z } from 'zod'\n\nexport const uploadSchema = z.object({\n  maxFileSize: z\n    .number()\n    .min(1)\n    .default(10 * 1024 * 1024), // 10MB\n  maxFiles: z.number().int().min(1).default(10),\n  maxFieldSize: z\n    .number()\n    .min(1)\n    .default(1 * 1024 * 1024), // 1MB\n})\n","import { z } from 'zod'\n\nexport const loggingSchema = z.object({\n  level: z.enum(['debug', 'info', 'warn', 'error', 'silent']).default('info'),\n})\n","import { z } from 'zod'\n\n/**\n * Cache subsystem config (caching-and-revalidation-plan).\n * Default `cache: undefined` keeps the framework backward-compatible\n * (no engine initialized → no cache primitives available).\n *\n * Setting `cache: {}` opts in with all defaults.\n */\nconst routeRuleSchema = z.object({\n  maxAge: z.number().nonnegative().finite().optional(),\n  swr: z.number().nonnegative().finite().optional(),\n  tags: z.array(z.string()).optional(),\n})\n\nexport const cacheSchema = z.object({\n  enabled: z.boolean().default(true),\n  /** 'memory' uses InMemoryCacheAdapter; otherwise pass a custom adapter instance. */\n  storage: z.union([z.literal('memory'), z.custom<unknown>()]).default('memory'),\n  maxEntries: z.number().int().positive().default(1000),\n  defaults: z\n    .object({\n      maxAge: z.number().nonnegative().finite().default(1),\n      swr: z.number().nonnegative().finite().optional(),\n      cacheErrors: z.boolean().default(false),\n    })\n    .default({ maxAge: 1, cacheErrors: false }),\n  keyDerivation: z\n    .object({\n      excludeQuery: z.array(z.string()).optional(),\n      sortQuery: z.boolean().default(true),\n      lowercaseHost: z.boolean().default(true),\n    })\n    .default({ sortQuery: true, lowercaseHost: true }),\n  routeRules: z.record(z.string(), routeRuleSchema).optional(),\n})\n","import { z } from 'zod'\n\nimport { headerSafeString } from './header-safe.js'\n\n/**\n * Phase 5 — CSRF warn-first (EC-1).\n *\n * 0.2.0 default: `warn`. Existing apps keep working but get structured\n * warnings about every state-mutating request that does not carry the\n * `X-Theo-Action: 1` header. 0.3.0 will flip the default to `strict`.\n *\n * Set explicitly to `strict` to opt into the future default early,\n * or `off` to disable CSRF entirely (only valid when you have another\n * defense — bearer auth, no session cookies, etc).\n */\n\n/**\n * Phase 6 — Default security headers (D4 / EC-2).\n *\n * 0.2.0 defaults:\n *   - CSP in `report-only` mode (EC-2: don't break existing apps)\n *   - X-Frame-Options: DENY · X-Content-Type-Options: nosniff\n *   - Referrer-Policy: strict-origin-when-cross-origin\n *   - HSTS in production only (no TLS on localhost)\n *\n * Users override individual headers, swap CSP to `enforce`, or disable\n * CSP entirely (`csp: false` / `cspMode: 'off'`).\n */\nexport const securityHeadersSchema = z.object({\n  csp: z.union([headerSafeString, z.literal(false)]).optional(),\n  // T6.1 — default flipped from 'report-only' to 'enforce' for 0.3.0.\n  // Users who want the old behaviour set `cspMode: 'report-only'`\n  // explicitly. See docs/migrating/0.2-to-0.3.md.\n  cspMode: z.enum(['enforce', 'report-only', 'off']).default('enforce'),\n  hsts: z.union([headerSafeString, z.literal(false)]).optional(),\n  frameOptions: z.enum(['DENY', 'SAMEORIGIN']).default('DENY'),\n  contentTypeOptions: z.literal('nosniff').default('nosniff'),\n  referrerPolicy: headerSafeString.default('strict-origin-when-cross-origin'),\n  /**\n   * T1.1 — Permissions-Policy directive string. EC-3-refined: rejects CR/LF.\n   * Pass `false` to suppress the header.\n   */\n  permissionsPolicy: z.union([headerSafeString, z.literal(false)]).optional(),\n})\n\n/**\n * T5.1 — Disallowed-routes escalation pattern (Rails-inspired).\n *\n * `routes` accepts string (exact match — trailing slash matters) or\n * RegExp entries. Matched routes that would otherwise emit `csrf.warn`\n * dispatch through `disallowedBehavior` instead:\n *   - `'warn'`  : no-op vs the default warn-mode behavior\n *   - `'raise'` : escalate to 403, even when global `csrf` mode is 'warn'\n *\n * Use to roll out strict mode per-route (e.g., flip /api/auth/* first)\n * without committing the entire surface to strict at once.\n */\nexport const disallowedConfigSchema = z.object({\n  routes: z.array(z.union([z.string(), z.instanceof(RegExp)])),\n  behavior: z.enum(['warn', 'raise']).default('raise'),\n})\n\n/**\n * T1.2 — CORS configuration.\n *\n * `origins` accepts a single value (`'*'`, string, RegExp, callback) OR an\n * array of (string | RegExp). The spec-violating `origins: '*'` +\n * `credentials: true` combination is rejected at parse time (browsers\n * ignore wildcards when credentials are sent).\n *\n * EC-3 — `allowedHeaders` and `exposedHeaders` entries go through the\n * header-safe refinement (CR/LF rejected — CWE-113 mitigation).\n */\nexport const corsSchema = z\n  .object({\n    origins: z.union([\n      z.literal('*'),\n      headerSafeString,\n      z.instanceof(RegExp),\n      z.array(z.union([headerSafeString, z.instanceof(RegExp)])),\n      z.function({ input: z.tuple([z.string()]), output: z.boolean() }),\n    ]),\n    methods: z\n      .array(z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'HEAD']))\n      .optional(),\n    allowedHeaders: z.array(headerSafeString).optional(),\n    exposedHeaders: z.array(headerSafeString).optional(),\n    credentials: z.boolean().default(false),\n    maxAge: z.number().int().min(0).max(86400).default(600),\n  })\n  .refine((c) => !(c.origins === '*' && c.credentials), {\n    message: 'CORS spec forbids origins:\"*\" with credentials:true — browsers ignore the wildcard',\n  })\n\nexport const securitySchema = z.object({\n  // T6.1 — default flipped from 'warn' to 'strict' for 0.3.0. Apps that\n  // grep their warn-mode logs from 0.2.x already know which endpoints\n  // break; opt back into 'warn' globally OR use disallowedRoutes for\n  // surgical migration. See docs/migrating/0.2-to-0.3.md.\n  csrf: z.enum(['off', 'warn', 'strict']).default('strict'),\n  headers: securityHeadersSchema.optional(),\n  /** T5.1 — per-route escalation (Rails disallowed_warnings pattern). */\n  disallowed: disallowedConfigSchema.optional(),\n  /** T1.2 — Cross-Origin Resource Sharing. Single global config; runs first in pipeline. */\n  cors: corsSchema.optional(),\n})\n","import { z } from 'zod'\n\n/**\n * StorageManager schemas (T1.1 / ADR-0007 D4).\n *\n * `theo.config.ts > storage` declares Postgres servers (credentials), the\n * databases on each server (TheoCloud / managed PG / self-host), and Redis\n * servers. The runtime `StorageManager` consumes this block; adapters\n * (PostgresJobBackend, PostgresConversationStorage, etc.) request pools by\n * database name and never see raw credentials at the call site.\n *\n * EC-1 (DOCUMENT in concept doc T4.1): Zod default strip-unknown mode\n * silently drops typo keys (`databasees` instead of `databases`). The\n * concept doc warns users to use exact names; runtime errors are still\n * actionable (`Database \"X\" not configured`).\n *\n * EC-2 (DEFERRED to use-time): `databases.X.server` references a key in\n * `servers`. Cross-field validation is intentionally NOT enforced at parse\n * time — `StorageManager.usePostgres()` throws an actionable error on the\n * first call with the dangling reference, matching Rails / Nitro behavior.\n */\nconst tlsConfigSchema = z.object({\n  rejectUnauthorized: z.boolean().optional(),\n  caCert: z.string().optional(),\n  clientCert: z.string().optional(),\n  clientKey: z.string().optional(),\n})\n\nconst serverConfigSchema = z.object({\n  host: z.string().min(1),\n  port: z.number().int().positive().max(65535).optional(),\n  user: z.string().min(1),\n  /** Password may be the empty string (some providers permit it). */\n  password: z.string(),\n  tls: tlsConfigSchema.optional(),\n})\n\nconst postgresPoolConfigSchema = z.object({\n  min: z.number().int().nonnegative().optional(),\n  max: z.number().int().positive().optional(),\n  connectionTimeoutMillis: z.number().int().positive().optional(),\n  idleTimeoutMillis: z.number().int().nonnegative().optional(),\n})\n\nconst postgresDatabaseConfigSchema = z.object({\n  /** References a key in `storage.servers`. Resolved at `usePostgres()` call time. */\n  server: z.string().min(1),\n  database: z.string().min(1),\n  pool: postgresPoolConfigSchema.optional(),\n})\n\nconst redisServerConfigSchema = serverConfigSchema.extend({\n  db: z.number().int().nonnegative().optional(),\n  maxRetriesPerRequest: z.number().int().nonnegative().optional(),\n})\n\nexport const storageSchema = z.object({\n  servers: z.record(z.string(), serverConfigSchema).optional(),\n  databases: z.record(z.string(), postgresDatabaseConfigSchema).optional(),\n  redis: z.record(z.string(), redisServerConfigSchema).optional(),\n})\n\nexport type StorageConfig = z.infer<typeof storageSchema>\n","/**\n * T2.1 — Detect `@theokit/ui` presence in the user's project.\n *\n * Uses `require.resolve` with explicit `paths` instead of `existsSync` so\n * pnpm-hoist layouts (TheoUI at workspace root, app in `apps/<x>/`) still\n * detect correctly. Returns `{ enabled: false }` on any failure — never throws.\n */\n\n/* eslint-disable security/detect-non-literal-fs-filename --\n * Reads `package.json` of `@theokit/ui` via filesystem walk under `node_modules`.\n * Paths come from a controlled CLI/config inputs; this is a build-time tool.\n *\n * D13 invariant (ADR 0021): @theokit/ui is ESM-only by design (`type: \"module\"`,\n * exports['.'] sem `require` condition). Não usar `createRequire(...).resolve()` —\n * `ERR_PACKAGE_PATH_NOT_EXPORTED` em runtime. Usar filesystem walk direto.\n */\nimport { existsSync, readFileSync } from 'node:fs'\nimport { dirname, join } from 'node:path'\n\nexport type TheoUiTheme = 'violet-forge' | 'noir' | 'paper'\nexport type TheoUiFonts = 'bundled' | 'cdn'\n\nexport interface TheoUiConfig {\n  theme: TheoUiTheme\n  fonts: TheoUiFonts\n}\n\nexport interface TheoUiDetectResult {\n  enabled: boolean\n  config: TheoUiConfig\n}\n\n/**\n * Raw user config shape (from theo.config.ts > ui field).\n * `false` = opt-out (force disabled); object = explicit config; undefined = default.\n */\nexport type RawTheoUiConfig = false | undefined | { theme?: TheoUiTheme; fonts?: TheoUiFonts }\n\n/**\n * Resolve the TheoUI config with defaults applied.\n * `false` → returns disabled defaults (caller checks `enabled`).\n */\nexport function resolveTheoUiConfig(\n  raw: { theme?: TheoUiTheme; fonts?: TheoUiFonts } | undefined,\n): TheoUiConfig {\n  return {\n    theme: raw?.theme ?? 'violet-forge',\n    fonts: raw?.fonts ?? 'bundled',\n  }\n}\n\n/**\n * Detect whether `@theokit/ui` is installed under `projectRoot` (or any\n * parent dir via Node module resolution — handles pnpm hoist).\n *\n * EC-1: uses `require.resolve` with `paths: [projectRoot]` not `existsSync`.\n * EC-5: corrupted installs (dir without an importable entry) fall through to disabled.\n * EC-9: theme validation happens in the Zod schema, not here.\n *\n * Note: we resolve a known subpath (`./styles.css`) instead of `./package.json`\n * or the root specifier because (a) `@theokit/ui` declares `exports` with no\n * CJS entry, so `require.resolve('@theokit/ui')` fails inside CJS contexts,\n * and (b) `./package.json` is not listed in `exports`. The `styles.css`\n * subpath IS exported and is exactly what entry-client imports — if it\n * resolves, the package is installed and usable.\n */\n/** Resolver fn — abstracted so tests can stub Node's walk-up behavior. */\nexport type SubpathResolver = (specifier: string, projectRoot: string) => boolean\n\n/**\n * D13 invariant: substituir `require.resolve` por filesystem walk que LÊ exports.\n *\n * Specifier shape: `<pkgScope>/<pkgName>/<subpath>` (e.g. `@theokit/ui/styles.css`)\n * OR `<pkgName>/<subpath>` (e.g. `react/jsx-runtime`).\n *\n * Algoritmo:\n *   1. Walk up node_modules a partir de projectRoot (handle pnpm hoist + workspaces).\n *   2. Em cada candidato, ler package.json + resolver subpath via exports field.\n *   3. Se exports mapeia o subpath, checar existsSync no path mapeado.\n *\n * Mimica resolução ESM Node sem usar createRequire (D13).\n */\nfunction resolveExportSubpath(pkgRoot: string, subpath: string): string | null {\n  const pkgJsonPath = join(pkgRoot, 'package.json')\n  if (!existsSync(pkgJsonPath)) return null\n  try {\n    const pkg = JSON.parse(readFileSync(pkgJsonPath, 'utf-8')) as {\n      exports?: Record<string, unknown>\n    }\n    const exportKey = `./${subpath}`\n    const exp = pkg.exports?.[exportKey]\n    if (!exp) {\n      // Fallback: tentar path direto (dist/<subpath> é convenção comum)\n      const fallback = join(pkgRoot, 'dist', subpath)\n      return existsSync(fallback) ? fallback : null\n    }\n    // exports value: string OR { import, require, default, types, ... }\n    let target: string | undefined\n    if (typeof exp === 'string') target = exp\n    else if (typeof exp === 'object') {\n      const e = exp as { import?: string; default?: string }\n      target = e.import ?? e.default\n    }\n    if (!target) return null\n    const cleaned = target.replace(/^\\.\\//, '')\n    const candidate = join(pkgRoot, cleaned)\n    return existsSync(candidate) ? candidate : null\n  } catch {\n    return null\n  }\n}\n\nconst defaultResolver: SubpathResolver = (specifier, projectRoot) => {\n  const parts = specifier.split('/')\n  const pkgName =\n    parts[0]?.startsWith('@') && parts.length >= 2 ? `${parts[0]}/${parts[1]}` : parts[0]\n  if (!pkgName) return false\n  const subpath = specifier.slice(pkgName.length + 1)\n  if (!subpath) return false\n  // Walk up node_modules (handle pnpm hoist)\n  let dir = projectRoot\n  for (let depth = 0; depth < 10; depth++) {\n    const pkgRoot = join(dir, 'node_modules', ...pkgName.split('/'))\n    if (existsSync(pkgRoot)) {\n      const resolved = resolveExportSubpath(pkgRoot, subpath)\n      if (resolved) return true\n    }\n    const parent = dirname(dir)\n    if (parent === dir) break\n    dir = parent\n  }\n  return false\n}\n\n/** Reads `<projectRoot>/package.json` and returns whether `@theokit/ui`\n *  is declared as a (dev)dependency. Conservative gate: pnpm hoist still\n *  works because pnpm rewrites the consumer's package.json to include the\n *  declared dep, even when the install lives at the workspace root. */\nfunction isDeclaredInPackageJson(projectRoot: string): boolean {\n  try {\n    const raw = readFileSync(join(projectRoot, 'package.json'), 'utf-8')\n    const pkg = JSON.parse(raw) as {\n      dependencies?: Record<string, string>\n      devDependencies?: Record<string, string>\n      peerDependencies?: Record<string, string>\n    }\n    // `||` is intentional — any truthy version string (including '0.0.0')\n    // counts as a declaration. `??` would let '' fall through, but version\n    // strings are never empty.\n    return Boolean(\n      pkg.dependencies?.['@theokit/ui'] ??\n      pkg.devDependencies?.['@theokit/ui'] ??\n      pkg.peerDependencies?.['@theokit/ui'],\n    )\n  } catch {\n    return false\n  }\n}\n\nexport function detectTheoUi(\n  projectRoot: string,\n  rawConfig: RawTheoUiConfig,\n  resolver: SubpathResolver = defaultResolver,\n): TheoUiDetectResult {\n  const config = resolveTheoUiConfig(typeof rawConfig === 'object' ? rawConfig : undefined)\n\n  // Explicit opt-out wins over detection\n  if (rawConfig === false) {\n    return { enabled: false, config }\n  }\n\n  // **Conservative gate** — require the dep to be DECLARED in the user's\n  // package.json. Stops the monorepo workspace from being detected as\n  // having TheoUI inside fixtures that never asked for it (and would\n  // 500 on the import).\n  if (!isDeclaredInPackageJson(projectRoot)) {\n    return { enabled: false, config }\n  }\n\n  // EC-1 + EC-5: prefer a subpath that's guaranteed to be in `exports`.\n  // Try several known subpaths; success on any one means the package is usable.\n  const probes = ['@theokit/ui/styles.css', '@theokit/ui/fonts.css']\n  for (const probe of probes) {\n    if (resolver(probe, projectRoot)) {\n      return { enabled: true, config }\n    }\n  }\n  return { enabled: false, config }\n}\n","/**\n * T2.1 (architecture-medium-deferrals plan, ADR D2) — `configResolved` hook\n * body extracted from `vite-plugin/index.ts` for SRP.\n *\n * `resolvePluginConfig(projectRoot)` reads `theo.config.ts` and returns a\n * `ResolvedPluginConfig` bag with every field the Vite plugin needs at\n * `configResolved` time. The `configLoadedOnce` flag stays in `index.ts`\n * (caller owns the one-shot semantic).\n *\n * Errors during config load are swallowed silently (matches pre-refactor\n * behavior — config errors are surfaced elsewhere via validate-structure).\n */\n\nimport { loadConfig } from '../config/load-config.js'\nimport {\n  createPluginRunnerFromConfig,\n  type AuditLogger,\n  type CorsConfig,\n  type DisallowedConfig,\n  type PluginRunner,\n  type SecurityHeadersConfig,\n} from '../server/internal-api.js'\nimport { resolveTransformer, type TheoTransformer } from '../server/transformer.js'\n\nimport { detectTheoUi, type TheoUiDetectResult } from './theoui-detect.js'\n\nexport interface ResolvedOpenApi {\n  servers: { url: string; description?: string }[]\n  specVersion: '3.1.0' | '3.0.3'\n  title: string\n  version: string\n}\n\nexport interface ResolvedPluginConfig {\n  pluginRunner: PluginRunner | undefined\n  transformer: TheoTransformer | undefined\n  resolvedBatching: { max?: number } | undefined\n  theoUi: TheoUiDetectResult | undefined\n  csrfMode: 'off' | 'warn' | 'strict'\n  securityHeaders: SecurityHeadersConfig | undefined\n  disallowed: DisallowedConfig | undefined\n  cors: CorsConfig | undefined\n  auditLogger: AuditLogger | undefined\n  devtoolsEnabled: boolean\n  // P#3 T1.1 — undefined when config.openapi opt-out; otherwise validated config block\n  openapi: ResolvedOpenApi | undefined\n  // P#3 T1.1 — distDir resolved relative to projectRoot for openapi-emit output\n  distDir: string\n}\n\n/**\n * Default config when load fails — keeps the plugin running with safe defaults.\n */\nconst DEFAULT_RESOLVED: ResolvedPluginConfig = {\n  pluginRunner: undefined,\n  transformer: undefined,\n  resolvedBatching: undefined,\n  theoUi: undefined,\n  csrfMode: 'strict',\n  securityHeaders: undefined,\n  disallowed: undefined,\n  cors: undefined,\n  auditLogger: undefined,\n  devtoolsEnabled: true,\n  openapi: undefined,\n  distDir: '.theokit',\n}\n\nexport async function resolvePluginConfig(projectRoot: string): Promise<ResolvedPluginConfig> {\n  try {\n    const userConfig = await loadConfig(projectRoot)\n    const pluginRunner = await createPluginRunnerFromConfig(userConfig.plugins)\n    const transformer = resolveTransformer(userConfig.serialization)\n\n    // Batching: Zod admits `boolean | { max?: number }`; normalize to object.\n    let resolvedBatching: { max?: number } | undefined\n    if (userConfig.batching === true) {\n      resolvedBatching = {}\n    } else if (typeof userConfig.batching === 'object') {\n      resolvedBatching = userConfig.batching\n    }\n\n    const theoUi = detectTheoUi(projectRoot, userConfig.ui)\n\n    // Audit logger — duck-type validation (consumer may pass any shape with `log()`).\n    let auditLogger: AuditLogger | undefined\n    const maybeLogger = (userConfig as { audit?: { logger?: unknown } }).audit?.logger\n    if (maybeLogger && typeof (maybeLogger as { log?: unknown }).log === 'function') {\n      auditLogger = maybeLogger as AuditLogger\n    }\n\n    return {\n      pluginRunner,\n      transformer,\n      resolvedBatching,\n      theoUi,\n      csrfMode: userConfig.security?.csrf ?? 'strict',\n      securityHeaders: userConfig.security?.headers,\n      disallowed: userConfig.security?.disallowed,\n      cors: userConfig.security?.cors,\n      auditLogger,\n      devtoolsEnabled: userConfig.devtools !== false,\n      openapi: userConfig.openapi,\n      distDir: userConfig.distDir,\n    }\n  } catch {\n    // Config load errors are surfaced elsewhere (validate-structure).\n    // Return safe defaults so middlewares can run without hooks.\n    return DEFAULT_RESOLVED\n  }\n}\n","import { resolve, basename } from 'node:path'\n\nimport type { ViteDevServer } from 'vite'\n\nimport { broadcastRouteManifest } from '../devtools/server-side/route-manifest.js'\nimport { scanRoutes } from '../router/scan.js'\nimport { isRouteFile } from '../router/types.js'\nimport {\n  CsrfReadinessStore,\n  type AuditLogger,\n  type CorsConfig,\n  type DisallowedConfig,\n  type PluginRunner,\n  type RateLimitConfig,\n  type SecurityHeadersConfig,\n} from '../server/internal-api.js'\nimport type { TheoTransformer } from '../server/transformer.js'\nimport type { ServicesConfig } from '../services/index.js'\n\nimport { createActionMiddleware } from './action-middleware.js'\nimport { createAgentMiddleware } from './agent-middleware.js'\nimport { createApiMiddleware } from './api-middleware.js'\nimport type { ResolvedOpenApi } from './config-resolve.js'\nimport { setupSsrDevMiddleware } from './ssr-dev-middleware.js'\nimport { setupWsUpgrade } from './ws-upgrade.js'\n\n/**\n * Inputs assembled by `theoPlugin` from its closure variables + the\n * resolvedOpenApi from `config-resolve.ts`. Kept as a struct so the\n * extraction is a pure pass-through with no behavior change.\n */\nexport interface ConfigureServerCtx {\n  projectRoot: string\n  appDir: string\n  /** Absolute backend root (config `serverDir`, default `<projectRoot>/server`) — route/action scan (#95). */\n  serverDir: string\n  /** Agents dir NAME (config `agentsDir`, default \"agents\") relative to projectRoot — agent-middleware scan. */\n  agentsDir: string\n  resolvedDistDir: string\n  ssrEnabled: boolean\n  isDevMode: { value: boolean }\n  pluginRunner: PluginRunner | undefined\n  transformer: TheoTransformer | undefined\n  resolvedBatching: { max?: number } | undefined\n  csrfMode: 'off' | 'warn' | 'strict'\n  securityHeaders: SecurityHeadersConfig | undefined\n  disallowed: DisallowedConfig | undefined\n  cors: CorsConfig | undefined\n  auditLogger: AuditLogger | undefined\n  resolvedOpenApi: ResolvedOpenApi | undefined\n  services: ServicesConfig | undefined\n  rateLimit: RateLimitConfig | undefined\n  csrfReadinessStoreOverride: CsrfReadinessStore | undefined\n  virtualEntryServerId: string\n  resolvedManifestId: string\n}\n\n/**\n * Runs the body of Vite's `configureServer` hook. Pure extraction —\n * preserves invocation order of every server.watcher event, middleware\n * registration, and ws hook so EC-10 (Vite hook ordering side effects)\n * is honored.\n */\n\nexport async function runConfigureServer(\n  server: ViteDevServer,\n  ctx: ConfigureServerCtx,\n): Promise<void> {\n  // T1.2 — mark dev mode so transformIndexHtml injects devtools script\n  // and resolveId/load serve the virtual module. Build mode never calls\n  // configureServer, so isDevMode stays false and injection is skipped.\n  ctx.isDevMode.value = true\n\n  // T2.4 — expose dev server WS to server-side broadcast helper\n  ;(globalThis as { __theoViteHotServer?: typeof server }).__theoViteHotServer = server\n\n  // T3.1 — re-broadcast the route manifest when the devtools bridge asks.\n  server.ws.on('theo:devtools:request-manifest', () => {\n    try {\n      const tree = scanRoutes(ctx.appDir)\n      broadcastRouteManifest(tree)\n    } catch {\n      /* fail silently — dev-only convenience */\n    }\n  })\n\n  // Server middleware (action before API — more specific prefix first). `serverDir` honors the\n  // config `serverDir` (default `<projectRoot>/server`) — no longer hardcoded (#95).\n  const serverDir = ctx.serverDir\n  server.middlewares.use(\n    createActionMiddleware(server, serverDir, {\n      pluginRunner: ctx.pluginRunner,\n      csrfMode: ctx.csrfMode,\n      disallowed: ctx.disallowed,\n    }),\n  )\n  // M2 — agent convention (`/api/agents/<name>`) before the generic api-middleware\n  // (mirrors the action prefix). Agents live at <projectRoot>/agents (LOCKED naming).\n  // CSRF is enforced in `mountAgent` (shared dev+prod point) at the same mode as routes.\n  server.middlewares.use(\n    createAgentMiddleware(server, ctx.projectRoot, ctx.csrfMode, ctx.agentsDir),\n  )\n  // Wave 2 completion — services-proxy prefixes flow through to the\n  // api-middleware so it can call `next()` for paths that should be\n  // forwarded to a sidecar by Vite's proxyMiddleware.\n  const servicesProxyPrefixes =\n    ctx.services && Object.keys(ctx.services).length > 0\n      ? Object.values(ctx.services).map((s) => s.proxy)\n      : []\n  // Auto-instantiate a dev-only CsrfReadinessStore so the devtools\n  // CSRF Readiness tab works out-of-the-box.\n  const csrfReadinessStore = ctx.csrfReadinessStoreOverride ?? new CsrfReadinessStore()\n  server.middlewares.use(\n    createApiMiddleware(server, serverDir, {\n      rateLimitConfig: ctx.rateLimit,\n      pluginRunner: ctx.pluginRunner,\n      batching: ctx.resolvedBatching,\n      transformer: ctx.transformer,\n      csrfMode: ctx.csrfMode,\n      securityHeaders: ctx.securityHeaders,\n      disallowed: ctx.disallowed,\n      cors: ctx.cors,\n      auditLogger: ctx.auditLogger,\n      servicesProxyPrefixes,\n      csrfReadinessStore,\n    }),\n  )\n\n  // EC-1: warn if theo.config.ts is edited during dev session.\n  const configPath = resolve(ctx.projectRoot, 'theo.config.ts')\n  server.watcher.on('change', (file) => {\n    if (file === configPath) {\n      console.warn(\n        '\\n[theokit] theo.config.ts changed; restart dev server for plugin changes to take effect\\n',\n      )\n    }\n  })\n\n  // T2.2 (architecture-medium-deferrals) — SSR dev middleware extracted.\n  if (ctx.ssrEnabled) {\n    setupSsrDevMiddleware(server, {\n      projectRoot: ctx.projectRoot,\n      virtualEntryServerId: ctx.virtualEntryServerId,\n      securityHeaders: ctx.securityHeaders,\n    })\n  }\n\n  // Frontend HMR watcher\n  function handleRouteChange(filePath: string): void {\n    if (!isRouteFile(basename(filePath))) return\n    if (!filePath.startsWith(ctx.appDir)) return\n\n    const mod = server.moduleGraph.getModuleById(ctx.resolvedManifestId)\n    if (mod) {\n      server.moduleGraph.invalidateModule(mod)\n      server.ws.send({ type: 'full-reload' })\n    }\n  }\n\n  server.watcher.on('add', handleRouteChange)\n  server.watcher.on('unlink', handleRouteChange)\n\n  // P#3 T1.1 — Dev-mode OpenAPI emit. Gated on config.openapi !== undefined.\n  if (ctx.resolvedOpenApi !== undefined) {\n    const openApiCfg = ctx.resolvedOpenApi\n    const { reEmitOpenApi } = await import('./openapi-emit/dev-emit.js')\n    // #95 — the OpenAPI dev-emit scans the SAME backend root as the route middleware (honor serverDir).\n    const openApiServerDir = ctx.serverDir\n    const openApiDistDir = resolve(ctx.projectRoot, ctx.resolvedDistDir)\n    const isRouteFileForOpenApi = (file: string): boolean =>\n      file.startsWith(openApiServerDir) && /\\.(ts|tsx|js|mjs)$/.test(file)\n    // Boot emit (fire-and-forget — boot doesn't await)\n    void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg)\n    // Watcher emit\n    server.watcher.on('change', (file: string) => {\n      if (isRouteFileForOpenApi(file)) {\n        void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg)\n      }\n    })\n    server.watcher.on('add', (file: string) => {\n      if (isRouteFileForOpenApi(file)) {\n        void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg)\n      }\n    })\n    server.watcher.on('unlink', (file: string) => {\n      if (isRouteFileForOpenApi(file)) {\n        void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg)\n      }\n    })\n  }\n\n  // T2.3 (architecture-medium-deferrals) — WS upgrade extracted to sibling.\n  setupWsUpgrade(server, ctx.projectRoot)\n\n  // T2.4 — clear devtools WS reference on shutdown\n  server.httpServer?.once('close', () => {\n    ;(globalThis as { __theoViteHotServer?: unknown }).__theoViteHotServer = undefined\n  })\n}\n","/**\n * T3.1 — Translate the server-side RouteNode tree into the devtools-facing\n * RouteManifest shape, then broadcast over the HMR bridge.\n *\n * No-op in production / when no dev server is attached.\n *\n * NEVER use dangerouslySetInnerHTML in any devtools component — see plan EC-20.\n */\nimport type { RouteNode } from '../../core/contracts/route-node.js'\nimport type { RouteInfo, RouteManifest } from '../shared.js'\n\nimport { broadcastToDevtools } from './broadcast.js'\n\ninterface FlattenAccumulator {\n  routes: RouteInfo[]\n}\n\nfunction buildPath(parents: string[], segment: string): string {\n  const joined = [...parents, segment].filter(Boolean).join('/')\n  return '/' + joined\n}\n\nfunction walk(\n  node: RouteNode,\n  parents: string[],\n  layoutChain: string[],\n  acc: FlattenAccumulator,\n): void {\n  const path = buildPath(parents, node.segment)\n  // Layout file (if any) joins the chain for any descendant page.\n  const nextChain = node.layout ? [...layoutChain, node.layout] : layoutChain\n\n  if (node.page) {\n    acc.routes.push({\n      path,\n      absoluteFilePath: node.page,\n      layoutChain: [...layoutChain], // freeze chain at this leaf\n      hasLoading: Boolean(node.loading),\n      hasError: Boolean(node.error),\n      hasNotFound: Boolean(node.notFound),\n    })\n  }\n\n  for (const child of node.children) {\n    const nextParents = node.segment ? [...parents, node.segment] : parents\n    walk(child, nextParents, nextChain, acc)\n  }\n}\n\n/**\n * Pure helper: convert RouteNode tree → RouteManifest for the devtools UI.\n * Exported for testing.\n */\nexport function buildRouteManifest(tree: RouteNode): RouteManifest {\n  const acc: FlattenAccumulator = { routes: [] }\n  walk(tree, [], [], acc)\n  return { routes: acc.routes }\n}\n\n/**\n * Broadcast the manifest to the devtools UI over the HMR bridge.\n * Safe to call from any dev-server context — no-op in production.\n */\nexport function broadcastRouteManifest(tree: RouteNode): void {\n  const manifest = buildRouteManifest(tree)\n  broadcastToDevtools('theo:devtools:manifest', manifest)\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time file-system scanner. All paths originate from `appDir`,\n * which is itself derived from `process.cwd()`. No HTTP input flows here.\n */\nimport { readdirSync, statSync, existsSync } from 'node:fs'\nimport { join, resolve } from 'node:path'\n\nimport type { RouteNode, RouteFileName } from './types.js'\nimport { ROUTE_FILE_NAMES, ROUTE_FILE_EXTENSIONS } from './types.js'\n\nfunction toNodeKey(name: RouteFileName): 'page' | 'layout' | 'error' | 'loading' | 'notFound' {\n  if (name === 'not-found') return 'notFound'\n  return name\n}\n\nfunction setRouteFile(\n  node: RouteNode,\n  key: 'page' | 'layout' | 'error' | 'loading' | 'notFound',\n  value: string,\n): void {\n  switch (key) {\n    case 'page':\n      node.page = value\n      break\n    case 'layout':\n      node.layout = value\n      break\n    case 'error':\n      node.error = value\n      break\n    case 'loading':\n      node.loading = value\n      break\n    case 'notFound':\n      node.notFound = value\n      break\n  }\n}\n\nfunction attachRouteFiles(node: RouteNode, dir: string): void {\n  // Check route files with extension priority (.tsx > .ts > .jsx > .js)\n  for (const name of ROUTE_FILE_NAMES) {\n    const key = toNodeKey(name)\n    if (node[key] !== undefined) continue\n    for (const ext of ROUTE_FILE_EXTENSIONS) {\n      const filename = `${name}${ext}`\n      if (existsSync(join(dir, filename))) {\n        setRouteFile(node, key, resolve(dir, filename))\n        break\n      }\n    }\n  }\n}\n\ninterface ParsedSegment {\n  kind: 'static' | 'dynamic' | 'catchall'\n  paramName?: string\n}\n\n/**\n * Classify a directory name as a static, dynamic (`[param]`), or catch-all\n * (`[...slug]`) route segment. Throws at build time on:\n *  - optional catch-all `[[...slug]]` (EC-4 — not supported yet; see plan Q3)\n *  - a param name outside `[A-Za-z0-9_]` (EC-5 — react-router would silently mis-match)\n * Order matters: catch-all is checked before single dynamic so `[...slug]` is\n * not misread as a dynamic param literally named `...slug`.\n */\nfunction parseSegment(name: string): ParsedSegment {\n  if (name.startsWith('[[')) {\n    throw new Error(\n      `Optional catch-all route segment is not supported yet: '${name}'. ` +\n        `Use '[...param]' for catch-all, or split into explicit segments.`,\n    )\n  }\n  const catchAll = /^\\[\\.\\.\\.(.+)\\]$/.exec(name)\n  if (catchAll) return checkedSegment('catchall', catchAll[1], name)\n  const dynamic = /^\\[(.+)\\]$/.exec(name)\n  if (dynamic) return checkedSegment('dynamic', dynamic[1], name)\n  return { kind: 'static' }\n}\n\nfunction checkedSegment(\n  kind: 'dynamic' | 'catchall',\n  paramName: string,\n  name: string,\n): ParsedSegment {\n  if (!/^\\w+$/.test(paramName)) {\n    throw new Error(\n      `Invalid route param '${paramName}' in segment '${name}' — ` +\n        `param names must match [A-Za-z0-9_] (react-router constraint).`,\n    )\n  }\n  return { kind, paramName }\n}\n\nfunction nodeHasContent(node: RouteNode): boolean {\n  return (\n    node.page !== undefined ||\n    node.layout !== undefined ||\n    node.error !== undefined ||\n    node.loading !== undefined ||\n    node.notFound !== undefined ||\n    node.children.length > 0\n  )\n}\n\nfunction buildChildPath(routePath: string, urlSegment: string): string {\n  if (!urlSegment) return routePath\n  return routePath === '/' ? `/${urlSegment}` : `${routePath}/${urlSegment}`\n}\n\n/** Scan one subdirectory into a child RouteNode, attaching dynamic-segment metadata. */\nfunction scanChild(parentDir: string, dirName: string, routePath: string): RouteNode {\n  const isRouteGroup = dirName.startsWith('(') && dirName.endsWith(')')\n  const urlSegment = isRouteGroup ? '' : dirName\n  const childPath = buildChildPath(routePath, urlSegment)\n  const child = scanDir(join(parentDir, dirName), isRouteGroup ? '' : dirName, childPath)\n\n  // Dynamic / catch-all segment metadata (throws on [[...]] or invalid charset).\n  if (!isRouteGroup) {\n    const parsed = parseSegment(dirName)\n    if (parsed.kind !== 'static' && parsed.paramName !== undefined) {\n      child.dynamic = { paramName: parsed.paramName, catchAll: parsed.kind === 'catchall' }\n    }\n  }\n  return child\n}\n\nfunction scanDir(dir: string, segment: string, routePath: string): RouteNode {\n  const node: RouteNode = { segment, path: routePath, children: [] }\n  attachRouteFiles(node, dir)\n\n  for (const entry of readdirSync(dir, { withFileTypes: true })) {\n    if (!entry.isDirectory()) continue\n    if (entry.name.startsWith('_') || entry.name.startsWith('.')) continue\n\n    const child = scanChild(dir, entry.name, routePath)\n    // Prune empty nodes — a directory with no route files AND no children is\n    // irrelevant to the manifest.\n    if (nodeHasContent(child)) {\n      node.children.push(child)\n    }\n  }\n\n  return node\n}\n\nexport function scanRoutes(appDir: string): RouteNode {\n  if (!existsSync(appDir)) {\n    throw new Error(`App directory does not exist: ${appDir}`)\n  }\n  if (!statSync(appDir).isDirectory()) {\n    throw new Error(`App path is not a directory: ${appDir}`)\n  }\n  return scanDir(appDir, '', '/')\n}\n","// T2.2 (architecture-cleanup) — RouteNode moved to core/contracts/route-node.ts\n// (canonical home per ADR-0001 v3). Re-export keeps the local path stable.\nexport type { RouteNode } from '../core/contracts/route-node.js'\n\nexport const ROUTE_FILE_NAMES = ['page', 'layout', 'error', 'loading', 'not-found'] as const\n\nexport type RouteFileName = (typeof ROUTE_FILE_NAMES)[number]\n\nexport const ROUTE_FILE_EXTENSIONS = ['.tsx', '.ts', '.jsx', '.js'] as const\n\nconst ROUTE_FILE_REGEX = /^(page|layout|error|loading|not-found)\\.(tsx|ts|jsx|js)$/\n\nexport function isRouteFile(filename: string): boolean {\n  return ROUTE_FILE_REGEX.test(filename)\n}\n","import { randomUUID } from 'node:crypto'\n\nimport type { ViteDevServer, Connect } from 'vite'\n\nimport {\n  createViteLoader,\n  executeAction,\n  findSuggestion,\n  logRequest,\n  scanServerActions,\n  sendError,\n  type CsrfMode,\n  type DisallowedConfig,\n  type PluginRunner,\n} from '../server/internal-api.js'\n\nconst PREFIX = '/api/__actions/'\n\nexport interface ActionMiddlewareOptions {\n  pluginRunner?: PluginRunner\n  /**\n   * CSRF mode passed through to `executeAction`. Parity with the route\n   * middleware — actions inherit the same warn/strict policy as routes.\n   * Defaults to 'strict' (the 0.3.0 default).\n   */\n  csrfMode?: CsrfMode\n  /**\n   * T5.1 — Rails-inspired per-route escalation. Forwarded to `executeAction`.\n   */\n  disallowed?: DisallowedConfig\n}\n\nexport function createActionMiddleware(\n  vite: ViteDevServer,\n  serverDir: string,\n  options?: ActionMiddlewareOptions,\n): Connect.NextHandleFunction {\n  const loadModule = createViteLoader(vite)\n  const pluginRunner = options?.pluginRunner\n  const csrfMode: CsrfMode = options?.csrfMode ?? 'strict'\n  const disallowed = options?.disallowed\n  return (req, res, next) => {\n    void (async () => {\n      const url = req.url ?? ''\n      if (!url.startsWith(PREFIX)) {\n        next()\n        return\n      }\n\n      const requestId = randomUUID()\n      const start = Date.now()\n      res.setHeader('x-request-id', requestId)\n\n      const pathAfterPrefix = url.slice(PREFIX.length).split('?')[0]\n      const segments = pathAfterPrefix.split('/').filter(Boolean)\n\n      if (segments.length < 2) {\n        sendError(\n          res,\n          'BAD_REQUEST',\n          'Action URL must be /api/__actions/{file}/{exportName}',\n          400,\n          undefined,\n          requestId,\n        )\n        logRequest({\n          method: req.method ?? 'POST',\n          url,\n          status: 400,\n          duration: Date.now() - start,\n          requestId,\n        })\n        return\n      }\n\n      const exportName = segments[segments.length - 1]\n      const actionPath = segments.slice(0, -1).join('/')\n\n      const actions = scanServerActions(serverDir)\n      const action = actions.find((a) => a.actionPath === actionPath)\n\n      if (!action) {\n        const actionPaths = actions.map((a) => a.actionPath)\n        const suggestion = findSuggestion(actionPath, actionPaths)\n        const msg = suggestion\n          ? `Action file \"${actionPath}\" not found. Did you mean: ${suggestion}?`\n          : `Action file \"${actionPath}\" not found`\n        sendError(res, 'NOT_FOUND', msg, 404, undefined, requestId)\n        logRequest({\n          method: req.method ?? 'POST',\n          url,\n          status: 404,\n          duration: Date.now() - start,\n          requestId,\n        })\n        return\n      }\n\n      await executeAction(\n        action.filePath,\n        exportName,\n        req,\n        res,\n        loadModule,\n        serverDir,\n        requestId,\n        pluginRunner,\n        csrfMode,\n        disallowed,\n      )\n      logRequest(\n        {\n          method: req.method ?? 'POST',\n          url,\n          status: res.statusCode,\n          duration: Date.now() - start,\n          requestId,\n        },\n        undefined,\n        req,\n      )\n    })()\n  }\n}\n","/**\n * M2 (theokit-ai-first) — dev middleware for the `agents/<name>.ts` convention.\n *\n * Serves `POST /api/agents/<name>` in `theokit dev` by scanning the top-level `agents/`\n * directory on each request, loading the matched module via Vite's SSR loader, and\n * streaming the M0/M1 UIMessageStream through `mountAgent` — the SAME wiring point the\n * prod server uses (`start/handlers.ts` `tryServeAgent`), so dev and build never drift.\n *\n * Registered under the reserved `/api/agents/` prefix BEFORE the generic api-middleware\n * (mirrors how the action middleware owns `/api/__actions/`); an unmatched agent path\n * falls through to `next()` so the api-middleware can 404 it consistently.\n */\nimport { randomUUID } from 'node:crypto'\nimport type { ServerResponse } from 'node:http'\n\nimport type { ViteDevServer, Connect } from 'vite'\n\nimport { isAgentCardPath } from '../server/agent/agent-card-handler.js'\nimport { getApprovalRegistry } from '../server/agent/approval-registry.js'\nimport { handleAgentApproval, isApprovalPath } from '../server/agent/approve-agent.js'\nimport { isListApprovalsPath } from '../server/agent/list-approvals-handler.js'\nimport { isMcpPath } from '../server/agent/mcp-handler.js'\nimport { mountAgent } from '../server/agent/mount-agent.js'\nimport { resolveProvider } from '../server/agent/provider-resolver.js'\nimport { serveAgentAuxRoute } from '../server/agent/serve-aux-routes.js'\nimport {\n  incomingMessageToWebRequest,\n  writeWebResponseToServerResponse,\n} from '../server/http/node-web-adapter.js'\nimport {\n  createViteLoader,\n  logRequest,\n  scanAgents,\n  sendError,\n  type CsrfMode,\n} from '../server/internal-api.js'\n\nconst PREFIX = '/api/agents/'\n\n/**\n * M15 — serve `/.well-known/<name>/agent-card.json` (GET) if the request matches. Returns `true`\n * when it owned the request (responded or fell through to `next()`), `false` to let the caller\n * continue. Extracted from the middleware arrow to keep that function within the complexity budget.\n */\ninterface CardDeps {\n  projectRoot: string\n  loadModule: (filePath: string) => Promise<unknown>\n  agentsDir: string\n  /** M34 (#97) — CSRF mode threaded to the MCP aux route (which drives the agent → spends tokens). */\n  csrfMode: CsrfMode\n}\n\n/** M4 — serve the HITL approve route `/api/agents/<name>/approve/<id>` (already matched). */\nasync function serveApprove(\n  req: Connect.IncomingMessage,\n  res: ServerResponse,\n  urlPath: string,\n  csrfMode: CsrfMode,\n  log: { requestId: string; start: number },\n): Promise<void> {\n  const method = (req.method ?? 'POST').toUpperCase()\n  if (method !== 'POST') {\n    sendError(\n      res,\n      'METHOD_NOT_ALLOWED',\n      'Approve endpoints accept POST',\n      405,\n      undefined,\n      log.requestId,\n    )\n    logRequest({\n      method,\n      url: req.url ?? '',\n      status: 405,\n      duration: Date.now() - log.start,\n      requestId: log.requestId,\n    })\n    return\n  }\n  try {\n    const response = await handleAgentApproval(\n      incomingMessageToWebRequest(req),\n      urlPath,\n      getApprovalRegistry(),\n      csrfMode,\n    )\n    await writeWebResponseToServerResponse(response, res)\n  } catch (err) {\n    sendError(\n      res,\n      'INTERNAL',\n      err instanceof Error ? err.message : 'Approve handler failed',\n      500,\n      undefined,\n      log.requestId,\n    )\n  }\n  logRequest({\n    method,\n    url: req.url ?? '',\n    status: res.statusCode,\n    duration: Date.now() - log.start,\n    requestId: log.requestId,\n  })\n}\n\n/**\n * M15/M16/M14 — serve an agent AUXILIARY route (agent card / MCP / pending-approvals listing) via\n * the shared `serveAgentAuxRoute` dispatcher (the SAME one `theokit start`'s `tryServeAgentAux`\n * uses, so dev and prod never drift). Falls through to `next()` when the path is not an aux route,\n * the method is wrong, or the agent is unknown.\n */\nasync function serveAux(\n  req: Connect.IncomingMessage,\n  res: ServerResponse,\n  next: Connect.NextFunction,\n  urlPath: string,\n  deps: CardDeps,\n): Promise<void> {\n  const requestId = randomUUID()\n  const start = Date.now()\n  try {\n    const request = incomingMessageToWebRequest(req)\n    const response = await serveAgentAuxRoute(request, urlPath, {\n      agents: scanAgents(deps.projectRoot, deps.agentsDir),\n      loadModule: deps.loadModule,\n      baseUrl: `http://${req.headers.host ?? 'localhost'}`,\n      csrfMode: deps.csrfMode,\n      // M39 — the thread follow-up route drives the agent; resolve the key on demand.\n      resolveApiKey: () => resolveProvider().apiKey,\n    })\n    if (response === null) {\n      next()\n      return\n    }\n    res.setHeader('x-request-id', requestId)\n    await writeWebResponseToServerResponse(response, res)\n  } catch (err) {\n    res.setHeader('x-request-id', requestId)\n    sendError(\n      res,\n      'INTERNAL',\n      err instanceof Error ? err.message : 'Agent aux handler failed',\n      500,\n      undefined,\n      requestId,\n    )\n  }\n  logRequest({\n    method: (req.method ?? 'GET').toUpperCase(),\n    url: req.url ?? '',\n    status: res.statusCode,\n    duration: Date.now() - start,\n    requestId,\n  })\n}\n\nexport function createAgentMiddleware(\n  vite: ViteDevServer,\n  projectRoot: string,\n  csrfMode: CsrfMode = 'strict',\n  agentsDir = 'agents',\n): Connect.NextHandleFunction {\n  const loadModule = createViteLoader(vite)\n  return (req, res, next) => {\n    void (async () => {\n      const url = req.url ?? ''\n\n      // M15 — A2A agent card at `/.well-known/<name>/agent-card.json` (GET). The match check is\n      // SYNC so a non-card request still calls `next()` synchronously (no `await` before it — a\n      // dev-middleware contract some tests rely on); only a real card path enters the async path.\n      if (isAgentCardPath(url.split('?')[0]) !== null) {\n        await serveAux(req, res, next, url.split('?')[0], {\n          projectRoot,\n          loadModule,\n          agentsDir,\n          csrfMode,\n        })\n        return\n      }\n\n      if (!url.startsWith(PREFIX)) {\n        next()\n        return\n      }\n\n      const requestId = randomUUID()\n      const start = Date.now()\n      res.setHeader('x-request-id', requestId)\n\n      const urlPath = url.split('?')[0]\n\n      // HITL approve route (`/api/agents/<name>/approve/<id>`, M4) — resolve the pending approval.\n      // Branches BEFORE the agent-path exact match (the approve path never equals an `agentPath`).\n      // Extracted to keep this arrow within the complexity budget (G6).\n      if (isApprovalPath(urlPath)) {\n        await serveApprove(req, res, urlPath, csrfMode, { requestId, start })\n        return\n      }\n\n      // M14 (list approvals) + M16 (MCP) — both are agent aux routes served by the shared\n      // dispatcher. Branch BEFORE the agent exact-match (neither path equals an `agentPath`).\n      if (isListApprovalsPath(urlPath) !== null || isMcpPath(urlPath) !== null) {\n        await serveAux(req, res, next, urlPath, { projectRoot, loadModule, agentsDir, csrfMode })\n        return\n      }\n\n      const agent = scanAgents(projectRoot, agentsDir).find((a) => a.agentPath === urlPath)\n      if (!agent) {\n        // Not a known agent — let the api-middleware own the 404 (single 404 shape).\n        next()\n        return\n      }\n\n      const method = (req.method ?? 'POST').toUpperCase()\n      if (method !== 'POST') {\n        sendError(\n          res,\n          'METHOD_NOT_ALLOWED',\n          'Agent endpoints accept POST',\n          405,\n          undefined,\n          requestId,\n        )\n        logRequest({ method, url, status: 405, duration: Date.now() - start, requestId })\n        return\n      }\n\n      try {\n        const mod = await loadModule(agent.filePath)\n        const apiKey = resolveProvider().apiKey\n        const request = incomingMessageToWebRequest(req)\n        const response = await mountAgent(mod, request, apiKey, {\n          source: agent.filePath,\n          csrfMode,\n          projectRoot,\n        })\n        await writeWebResponseToServerResponse(response, res)\n      } catch (err) {\n        sendError(\n          res,\n          'INTERNAL',\n          err instanceof Error ? err.message : 'Agent handler failed',\n          500,\n          undefined,\n          requestId,\n        )\n      }\n      logRequest({ method, url, status: res.statusCode, duration: Date.now() - start, requestId })\n    })()\n  }\n}\n","/**\n * M15 (theokit-ai-first) — serve the A2A agent card at `/.well-known/<name>/agent-card.json`.\n *\n * `buildAgentCard` (@theokit/agents) is the pure generator; this handler compiles a loaded agent\n * module to its tools + streaming capability, builds the card, and returns it as a Web-Standard\n * JSON `Response` (G8). The dev middleware + prod handler branch to this before the agent POST route.\n */\nimport {\n  type AgentManifestEntry,\n  buildAgentCard,\n  compileAgentModule,\n} from '@theokit/agents'\n\nconst WELL_KNOWN = /^\\/\\.well-known\\/([^/]+)\\/agent-card\\.json$/\n\n/** Return the agent name when `urlPath` is a well-known card path, else `null`. */\nexport function isAgentCardPath(urlPath: string): string | null {\n  const match = WELL_KNOWN.exec(urlPath)\n  return match ? decodeURIComponent(match[1]) : null\n}\n\n/** Build a minimal manifest entry (the subset `buildAgentCard` reads) from a compiled agent. */\nfunction toManifestEntry(name: string, route: string, mod: unknown): AgentManifestEntry {\n  const compiled = compileAgentModule(mod, `agent card for \"${name}\"`)\n  return {\n    name,\n    route,\n    stream: compiled.stream,\n    mainLoop: { method: '', strategy: '' },\n    guards: [],\n    interceptors: [],\n    tools: compiled.tools.map((t) => ({\n      name: t.name,\n      description: t.description,\n      approval: false,\n      trace: false,\n      audit: false,\n    })),\n    subAgents: [],\n  }\n}\n\n/**\n * Serve the A2A card for a loaded agent module. Returns 200 with the card JSON, or 500 with an\n * error body if the module is not a valid agent (fail-clear, not a silent empty card).\n */\nexport function handleAgentCard(mod: unknown, name: string, route: string, baseUrl: string): Response {\n  try {\n    const card = buildAgentCard(toManifestEntry(name, route, mod), { baseUrl })\n    return new Response(JSON.stringify(card), {\n      status: 200,\n      headers: { 'content-type': 'application/json; charset=utf-8' },\n    })\n  } catch (err) {\n    return new Response(\n      JSON.stringify({ error: { code: 'AGENT_CARD_FAILED', message: err instanceof Error ? err.message : 'card build failed' } }),\n      { status: 500, headers: { 'content-type': 'application/json; charset=utf-8' } },\n    )\n  }\n}\n","/**\n * M4 (theokit-ai-first) — the HITL approve endpoint: `POST /api/agents/<name>/approve/<approvalId>`.\n *\n * The counterpart to `mountAgent`'s HITL pause. While a gated tool holds the SDK run paused (the\n * awaited `pre_tool_call` hook), the client POSTs here with `{ approved }`; this resolves the\n * pending approval in the shared registry, which un-pauses the run (allow) or vetoes the tool (deny).\n *\n * Web-Standard `Request` → `Response`, one wiring point shared by dev (vite middleware) and prod\n * (built server) so the two never drift (EC-4 parity with `mountAgent`). The registry is INJECTED —\n * dev/prod pass the process singleton (`getApprovalRegistry`), tests pass a fresh instance.\n */\nimport { validateCsrfRequest, type CsrfMode } from '../security/csrf.js'\n\nimport type { ApprovalDecision, ApprovalRegistry } from './approval-registry.js'\n\n/** The path segment separating the agent name from the approval id. */\nconst APPROVE_SEGMENT = '/approve/'\n\n/**\n * Extract the `<approvalId>` from a `/api/agents/<name>/approve/<approvalId>` path.\n * Returns `null` when the path has no `/approve/` segment or an empty / nested id.\n */\nexport function parseApprovalId(urlPath: string): string | null {\n  const at = urlPath.indexOf(APPROVE_SEGMENT)\n  if (at === -1) return null\n  const id = urlPath.slice(at + APPROVE_SEGMENT.length)\n  return id.length > 0 && !id.includes('/') ? id : null\n}\n\n/** True when `urlPath` targets a HITL approve endpoint (used by dev/prod routing to branch early). */\nexport function isApprovalPath(urlPath: string): boolean {\n  return urlPath.includes(APPROVE_SEGMENT)\n}\n\nfunction jsonError(status: number, code: string, message: string): Response {\n  return new Response(JSON.stringify({ error: { code, message } }), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\n/**\n * M20 — cap on the serialized custom payload (16 KiB). A payload is a small structured note\n * (edited args, a reviewer comment), not a data channel — an oversized one is rejected fail-fast\n * rather than silently truncated (Rule 8).\n */\nconst MAX_PAYLOAD_BYTES = 16 * 1024\n\n/**\n * Extract an {@link ApprovalDecision} from an untrusted body; `null` when the shape is wrong.\n *\n * M20 — accepts an optional `reason` (string) and `payload` (object, capped at\n * {@link MAX_PAYLOAD_BYTES}). Backward-compatible: `{ approved }` and `{ approved, reason }` parse\n * unchanged. A non-object or oversized `payload` is rejected (returns `null` → the route 400s).\n *\n * @public\n */\nexport function parseApprovalBody(body: unknown): ApprovalDecision | null {\n  if (typeof body !== 'object' || body === null) return null\n  const b = body as Record<string, unknown>\n  if (typeof b.approved !== 'boolean') return null\n  const decision: ApprovalDecision = { approved: b.approved }\n  if (b.reason !== undefined) {\n    if (typeof b.reason !== 'string') return null\n    decision.reason = b.reason\n  }\n  if (b.payload !== undefined) {\n    if (typeof b.payload !== 'object' || b.payload === null || Array.isArray(b.payload)) return null\n    if (JSON.stringify(b.payload).length > MAX_PAYLOAD_BYTES) return null\n    decision.payload = b.payload\n  }\n  return decision\n}\n\n/**\n * Resolve a pending HITL approval. CSRF-guarded like `mountAgent` (the custom `X-Theo-Action`\n * header + Origin match) — a cross-origin POST must not approve a paused tool. Returns:\n *   403 CSRF_FAILED  — strict CSRF check failed\n *   400 BAD_REQUEST  — no `/approve/<id>` in the path, or body lacks a boolean `approved`\n *   404 NOT_PENDING  — the id is unknown or already settled (idempotent double-submit)\n *   200 { resolved:true } — the approval was settled by this call\n */\nexport async function handleAgentApproval(\n  request: Request,\n  urlPath: string,\n  registry: ApprovalRegistry,\n  csrfMode: CsrfMode = 'strict',\n): Promise<Response> {\n  if (csrfMode !== 'off') {\n    const csrf = validateCsrfRequest(request)\n    if (!csrf.valid && csrfMode === 'strict') {\n      return jsonError(403, 'CSRF_FAILED', `CSRF check failed: ${csrf.reason}`)\n    }\n  }\n\n  const approvalId = parseApprovalId(urlPath)\n  if (approvalId === null) {\n    return jsonError(400, 'BAD_REQUEST', 'Approval path must be /api/agents/<name>/approve/<id>.')\n  }\n\n  let body: unknown = null\n  try {\n    body = await request.json()\n  } catch {\n    /* invalid/empty JSON → handled below as a 400 */\n  }\n  const parsed = parseApprovalBody(body)\n  if (parsed === null) {\n    return jsonError(400, 'BAD_REQUEST', 'Request body must contain a boolean `approved`.')\n  }\n\n  const resolved = registry.resolve(approvalId, parsed)\n  if (!resolved) {\n    return jsonError(404, 'NOT_PENDING', `No pending approval for id '${approvalId}'.`)\n  }\n  return new Response(JSON.stringify({ resolved: true }), {\n    status: 200,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n","/**\n * M14 (theokit-ai-first) — GET /api/agents/<name>/approvals: list pending HITL approvals.\n *\n * Serves `ApprovalRegistry.list()` as JSON. Single-process contract (ADR 0038) — the list is\n * process-wide; the `<name>` segment is accepted for a future per-agent/durable store but the\n * in-process registry lists all pending approvals. Web Standards Response (G8).\n */\nimport type { ApprovalRegistry } from './approval-registry.js'\n\nconst LIST_PATH = /^\\/api\\/agents\\/([^/]+)\\/approvals$/\n\n/** Return the agent name when `urlPath` is the approvals-listing path, else `null`. */\nexport function isListApprovalsPath(urlPath: string): string | null {\n  const match = LIST_PATH.exec(urlPath)\n  return match ? decodeURIComponent(match[1]) : null\n}\n\n/** Serve the currently-pending approvals as `{ approvals: [...] }` JSON. */\nexport function handleListApprovals(registry: ApprovalRegistry): Response {\n  return new Response(JSON.stringify({ approvals: registry.list() }), {\n    status: 200,\n    headers: { 'content-type': 'application/json; charset=utf-8' },\n  })\n}\n","import {\n  encodeSse,\n  formatSseFrame,\n  RUN_ID_HEADER,\n  SSE_BASE_HEADERS,\n  SSE_DONE_FRAME,\n} from './durable-ui-message-stream-response.js'\nimport type { RunEventCache } from './run-event-cache.js'\n\n/**\n * M37 (ADR-0046 D5) — the reconnect / observe endpoint handler for\n * `GET /api/agents/<name>/runs/<runId>/stream`.\n *\n * Replays the frames the client missed (`seq > Last-Event-ID`, SSE-native), then\n * — if the run is still live — follows the live tail; a SECOND client can\n * observe a run a first started. Run already ended ⇒ replay + `[DONE]`. Unknown\n * `runId` ⇒ 404. The request `AbortSignal` unsubscribes on disconnect.\n */\n\nconst RUN_STREAM_PATH = /^\\/api\\/agents\\/([^/]+)\\/runs\\/([^/]+)\\/stream$/\n\n/**\n * Match `GET /api/agents/<name>/runs/<runId>/stream`; returns the decoded\n * `{ name, runId }` or `null` to fall through (mirrors `isMcpPath` etc.).\n */\nexport function isAgentRunStreamPath(urlPath: string): { name: string; runId: string } | null {\n  const m = RUN_STREAM_PATH.exec(urlPath)\n  return m ? { name: decodeURIComponent(m[1]), runId: decodeURIComponent(m[2]) } : null\n}\n\n/** Parse `Last-Event-ID` (a frame `seq`) to a number; absent/invalid ⇒ -1 (replay from the start). */\nfunction parseLastEventId(raw: string | null): number {\n  if (raw === null) return -1\n  const n = Number.parseInt(raw, 10)\n  return Number.isInteger(n) && n >= 0 ? n : -1\n}\n\nexport function handleAgentRunReconnect(\n  runId: string,\n  request: Request,\n  cache: RunEventCache,\n): Response {\n  // Unknown run ⇒ 404 (a run never started here, or already evicted).\n  if (!cache.has(runId)) {\n    return new Response(\n      JSON.stringify({ error: { code: 'RUN_NOT_FOUND', message: `Unknown run '${runId}'.` } }),\n      {\n        status: 404,\n        headers: { 'content-type': 'application/json' },\n      },\n    )\n  }\n\n  const afterSeq = parseLastEventId(request.headers.get('last-event-id'))\n\n  const stream = new ReadableStream<Uint8Array>({\n    start(controller) {\n      let closed = false\n      const safeEnqueue = (text: string): void => {\n        if (closed) return\n        try {\n          controller.enqueue(encodeSse(text))\n        } catch {\n          /* controller already closed by an abort race — ignore */\n        }\n      }\n      const close = (): void => {\n        if (closed) return\n        safeEnqueue(SSE_DONE_FRAME)\n        closed = true\n        try {\n          controller.close()\n        } catch {\n          /* already closed */\n        }\n      }\n\n      // Atomic: snapshot replay frames AND subscribe to the live tail in one tick.\n      const res = cache.attach(\n        runId,\n        afterSeq,\n        (frame) => {\n          safeEnqueue(formatSseFrame(frame.seq, frame.data))\n        },\n        () => {\n          close()\n        },\n      )\n      // Evicted between has() and attach() (rare TOCTOU) ⇒ just end the stream.\n      if (!res.known) {\n        close()\n        return\n      }\n      for (const frame of res.replay) {\n        safeEnqueue(formatSseFrame(frame.seq, frame.data))\n      }\n      if (res.ended) {\n        close()\n        return\n      }\n      // Client disconnects ⇒ detach the live listener + close.\n      request.signal.addEventListener('abort', () => {\n        res.unsubscribe()\n        close()\n      })\n    },\n  })\n\n  return new Response(stream, { headers: { ...SSE_BASE_HEADERS, [RUN_ID_HEADER]: runId } })\n}\n","/**\n * M39 (ADR-0048) — the thread follow-up dispatcher.\n *\n * Drives a run over the M37 durable cache HEADLESS — it iterates the SDK chunk\n * generator and `cache.append`s directly, NOT via a `Response` `ReadableStream`\n * (whose backpressure would stall a run with no HTTP reader). Subscribers read\n * from the cache via the thread / reconnect stream.\n *\n * - Post to an IDLE thread ⇒ start a run + pump.\n * - Post to an ACTIVE thread ⇒ FIFO-queue the follow-up.\n * - On terminal ⇒ `registry.endRun` hands back the next queued follow-up, which\n *   is dispatched as a continuation on the SAME sessionId (⇒ the SDK continues\n *   the conversation via its `ConversationStorageAdapter`).\n *\n * This adds NO agent loop — it reuses the SDK run (`startRun`) + the M37 cache.\n * Single-process (ADR-0048 D2).\n */\n\nimport type { UIMessageChunk } from 'ai'\n\nimport { type RunEventCache, mintRunId } from './run-event-cache.js'\nimport type { ThreadRunRegistry } from './thread-run-registry.js'\n\nexport interface ThreadDispatchDeps {\n  readonly registry: ThreadRunRegistry\n  readonly cache: RunEventCache\n  /** Start a run for a follow-up on `sessionId`; returns the SDK chunk stream. */\n  readonly startRun: (sessionId: string, message: string) => AsyncIterable<UIMessageChunk>\n}\n\n/** Result of posting a follow-up: the started `runId` (idle thread) or `queued` (active thread). */\nexport type PostFollowUpResult = { runId: string } | { queued: true }\n\n/**\n * Post a follow-up on a thread. IDLE ⇒ start a run (returns its `runId`); ACTIVE\n * ⇒ FIFO-queue it (returns `{ queued: true }`) — dispatched when the active run ends.\n */\nexport function postThreadFollowUp(\n  deps: ThreadDispatchDeps,\n  sessionId: string,\n  message: string,\n): PostFollowUpResult {\n  if (deps.registry.getActive(sessionId) !== null) {\n    deps.registry.queue(sessionId, { message })\n    return { queued: true }\n  }\n  return { runId: startAndPump(deps, sessionId, message) }\n}\n\n/** Mint a runId, mark the thread active, and pump the run into the cache headless. */\nfunction startAndPump(deps: ThreadDispatchDeps, sessionId: string, message: string): string {\n  const runId = mintRunId()\n  // Register the run in the cache SYNCHRONOUSLY (before the async pump appends its\n  // first frame) so a subscriber resolving the active runId can attach immediately.\n  deps.cache.begin(runId)\n  deps.registry.startRun(sessionId, runId)\n  pumpIntoCache(deps, sessionId, runId, deps.startRun(sessionId, message))\n  return runId\n}\n\n/**\n * Drive `chunks` into the cache under `runId`, then end the run and dispatch the\n * next queued follow-up (if any) as a continuation. Fire-and-forget — the caller\n * does not await the run; subscribers observe it via the cache.\n */\nfunction pumpIntoCache(\n  deps: ThreadDispatchDeps,\n  sessionId: string,\n  runId: string,\n  chunks: AsyncIterable<UIMessageChunk>,\n): void {\n  void (async () => {\n    try {\n      for await (const chunk of chunks) {\n        deps.cache.append(runId, JSON.stringify(chunk))\n      }\n    } catch {\n      // The SDK translator owns error semantics (surfaces failures as chunks);\n      // the transport guarantees only a terminated, cache-ended run.\n    } finally {\n      deps.cache.end(runId)\n      const next = deps.registry.endRun(sessionId, runId)\n      if (next !== undefined) startAndPump(deps, sessionId, next.message)\n    }\n  })()\n}\n","/**\n * M39 (ADR-0048) — the in-process thread→run registry.\n *\n * A thread is the existing `sessionId` (the SDK conversation key). This registry\n * tracks, per thread, the single ACTIVE run, a FIFO queue of follow-ups to\n * dispatch as continuations, and one-shot \"next run\" waiters (so a client can\n * subscribe to a thread before posting a message and attach when the run starts).\n *\n * Pure state only — it never starts a run or touches the transport. The route\n * layer owns dispatch: on `endRun` it receives the next queued follow-up (if any)\n * and starts the continuation over the M37 durable transport.\n *\n * Single-process contract (ADR-0048 D2): a multi-instance deploy needs a shared\n * registry + leasing — that is infra (TheoCloud), explicitly out of M39. The\n * interface is injectable so a durable impl slots in later without touching the\n * routes. We do NOT build a distributed store now (YAGNI).\n */\n\n/** A follow-up message queued on an active thread, dispatched as a continuation. */\nexport interface FollowUp {\n  readonly message: string\n}\n\nexport interface ThreadRunRegistry {\n  /** The active runId for a thread, or `null` when the thread is idle. */\n  getActive(sessionId: string): string | null\n  /** Mark a run started for a thread (sets it active; fires + clears one-shot waiters). */\n  startRun(sessionId: string, runId: string): void\n  /**\n   * Mark `runId` ended for a thread. A no-op unless `runId` is the current active\n   * run (a stale terminal never clears a newer run). Clears the active run and\n   * returns the next FIFO follow-up to dispatch as a continuation, or `undefined`.\n   */\n  endRun(sessionId: string, runId: string): FollowUp | undefined\n  /** FIFO-enqueue a follow-up on a thread (dispatched when the active run ends). */\n  queue(sessionId: string, followUp: FollowUp): void\n  /**\n   * Register a ONE-SHOT waiter fired with the runId of the NEXT run started on\n   * this thread. Returns an unsubscribe fn. Used by subscribe-by-thread on an\n   * idle thread (attach when the next run starts).\n   */\n  onNextRun(sessionId: string, cb: (runId: string) => void): () => void\n}\n\ninterface ThreadState {\n  activeRunId: string | null\n  readonly queue: FollowUp[]\n  readonly waiters: Set<(runId: string) => void>\n}\n\nexport function createInProcessThreadRunRegistry(): ThreadRunRegistry {\n  const threads = new Map<string, ThreadState>()\n  const ensure = (sessionId: string): ThreadState => {\n    let s = threads.get(sessionId)\n    if (s === undefined) {\n      s = { activeRunId: null, queue: [], waiters: new Set() }\n      threads.set(sessionId, s)\n    }\n    return s\n  }\n\n  return {\n    getActive(sessionId) {\n      return threads.get(sessionId)?.activeRunId ?? null\n    },\n    startRun(sessionId, runId) {\n      const s = ensure(sessionId)\n      s.activeRunId = runId\n      // Fire one-shot waiters, then clear them (single-threaded → no re-entrancy race).\n      const waiters = [...s.waiters]\n      s.waiters.clear()\n      for (const cb of waiters) cb(runId)\n    },\n    endRun(sessionId, runId) {\n      const s = threads.get(sessionId)\n      if (s?.activeRunId !== runId) return undefined\n      s.activeRunId = null\n      return s.queue.shift()\n    },\n    queue(sessionId, followUp) {\n      ensure(sessionId).queue.push(followUp)\n    },\n    onNextRun(sessionId, cb) {\n      const s = ensure(sessionId)\n      s.waiters.add(cb)\n      return () => {\n        s.waiters.delete(cb)\n      }\n    },\n  }\n}\n\nlet serverRegistry: ThreadRunRegistry | undefined\n\n/** Process-wide singleton (mirrors `getRunEventCache` / `getApprovalRegistry`). */\nexport function getThreadRunRegistry(): ThreadRunRegistry {\n  serverRegistry ??= createInProcessThreadRunRegistry()\n  return serverRegistry\n}\n","/**\n * M39 (ADR-0048) — the thread signal routes over the M37 durable transport:\n *\n *  - `POST /api/agents/<name>/threads/<sessionId>/message` — a follow-up. ACTIVE\n *    run ⇒ FIFO-queue (dispatched as a continuation when it ends); IDLE ⇒ start a\n *    run. Returns `202` (the run streams headless into the cache; observe it via\n *    the thread stream). Spends LLM tokens ⇒ CSRF-gated (parity with mount-agent).\n *  - `GET /api/agents/<name>/threads/<sessionId>/stream` — subscribe. ACTIVE ⇒\n *    attach to the durable stream (reuse the M37 reconnect handler); IDLE ⇒ wait\n *    (bounded) for the next run on the thread, then attach (subscribe-then-post).\n *\n * These DRIVE the SDK run (via `makeThreadStartRun`) + the M37 cache — no new loop.\n */\n\nimport { validateCsrfRequest, type CsrfMode } from '../security/csrf.js'\n\nimport { makeThreadStartRun } from './build-agent-streamer.js'\nimport {\n  encodeSse,\n  formatSseFrame,\n  RUN_ID_HEADER,\n  SSE_BASE_HEADERS,\n  SSE_DONE_FRAME,\n} from './durable-ui-message-stream-response.js'\nimport { handleAgentRunReconnect } from './handle-agent-run-reconnect.js'\nimport { parseAgentRequestBody } from './mount-agent.js'\nimport { getRunEventCache, type RunEventCache } from './run-event-cache.js'\nimport { postThreadFollowUp } from './thread-dispatcher.js'\nimport { getThreadRunRegistry, type ThreadRunRegistry } from './thread-run-registry.js'\n\nconst THREAD_MESSAGE_PATH = /^\\/api\\/agents\\/([^/]+)\\/threads\\/([^/]+)\\/message$/\nconst THREAD_STREAM_PATH = /^\\/api\\/agents\\/([^/]+)\\/threads\\/([^/]+)\\/stream$/\n\n/** How long a subscribe-to-idle-thread waits for the next run before closing. */\nconst DEFAULT_IDLE_WAIT_MS = 30_000\n\nfunction matchThread(re: RegExp, urlPath: string): { name: string; sessionId: string } | null {\n  const m = re.exec(urlPath)\n  return m ? { name: decodeURIComponent(m[1]), sessionId: decodeURIComponent(m[2]) } : null\n}\n\nexport const isThreadMessagePath = (urlPath: string) => matchThread(THREAD_MESSAGE_PATH, urlPath)\nexport const isThreadStreamPath = (urlPath: string) => matchThread(THREAD_STREAM_PATH, urlPath)\n\nfunction jsonError(status: number, code: string, message: string): Response {\n  return new Response(JSON.stringify({ error: { code, message } }), {\n    status,\n    headers: { 'content-type': 'application/json; charset=utf-8' },\n  })\n}\n\n/** Inputs for {@link handleThreadMessage} (bundled to stay within the arity budget). */\nexport interface ThreadMessageArgs {\n  readonly mod: unknown\n  readonly apiKey: string\n  readonly sessionId: string\n  readonly request: Request\n  readonly source: string\n  readonly csrfMode?: CsrfMode\n}\n\n/** POST a follow-up on a thread. Returns `202` with `{ runId }` (started) or `{ queued: true }`. */\nexport async function handleThreadMessage(args: ThreadMessageArgs): Promise<Response> {\n  const { mod, apiKey, sessionId, request, source, csrfMode = 'strict' } = args\n  // A follow-up drives the agent (spends LLM tokens) — reject a cross-origin POST.\n  if (csrfMode === 'strict') {\n    const csrf = validateCsrfRequest(request)\n    if (!csrf.valid) return jsonError(403, 'CSRF_FAILED', `CSRF check failed: ${csrf.reason}`)\n  }\n  let body: unknown = null\n  try {\n    body = await request.json()\n  } catch {\n    /* invalid/empty JSON → 400 below */\n  }\n  const input = parseAgentRequestBody(body)\n  if (input === null) {\n    return jsonError(400, 'BAD_REQUEST', 'Request must contain a non-empty message.')\n  }\n  const result = postThreadFollowUp(\n    {\n      registry: getThreadRunRegistry(),\n      cache: getRunEventCache(),\n      startRun: makeThreadStartRun(mod, apiKey, source),\n    },\n    sessionId,\n    input.message,\n  )\n  const headers: Record<string, string> = { 'content-type': 'application/json; charset=utf-8' }\n  if ('runId' in result) headers[RUN_ID_HEADER] = result.runId\n  return new Response(JSON.stringify(result), { status: 202, headers })\n}\n\n/** GET the thread's durable stream. Active ⇒ attach now; idle ⇒ wait (bounded) for the next run. */\nexport function handleThreadStream(\n  sessionId: string,\n  request: Request,\n  registry: ThreadRunRegistry = getThreadRunRegistry(),\n  cache: RunEventCache = getRunEventCache(),\n  idleWaitMs = DEFAULT_IDLE_WAIT_MS,\n): Response {\n  const active = registry.getActive(sessionId)\n  if (active !== null && cache.has(active)) {\n    // Reuse the M37 reconnect handler — replay + live tail on the active run.\n    return handleAgentRunReconnect(active, request, cache)\n  }\n  return waitThenAttachStream(sessionId, request, registry, cache, idleWaitMs)\n}\n\n/** Subscribe to an idle thread: wait (bounded) for the NEXT run to start, then attach + tail. */\nfunction waitThenAttachStream(\n  sessionId: string,\n  request: Request,\n  registry: ThreadRunRegistry,\n  cache: RunEventCache,\n  idleWaitMs: number,\n): Response {\n  const stream = new ReadableStream<Uint8Array>({\n    start(controller) {\n      let closed = false\n      const send = (text: string): void => {\n        if (closed) return\n        try {\n          controller.enqueue(encodeSse(text))\n        } catch {\n          /* closed by an abort race */\n        }\n      }\n      let detachAttach: (() => void) | undefined\n      const close = (): void => {\n        if (closed) return\n        send(SSE_DONE_FRAME)\n        closed = true\n        try {\n          controller.close()\n        } catch {\n          /* already closed */\n        }\n      }\n      const offNext = registry.onNextRun(sessionId, (runId) => {\n        const res = cache.attach(\n          runId,\n          -1,\n          (frame) => {\n            send(formatSseFrame(frame.seq, frame.data))\n          },\n          () => {\n            close()\n          },\n        )\n        if (!res.known) {\n          close()\n          return\n        }\n        for (const frame of res.replay) send(formatSseFrame(frame.seq, frame.data))\n        if (res.ended) {\n          close()\n          return\n        }\n        detachAttach = res.unsubscribe\n      })\n      // HIGH-1 — the waiter teardown MUST run on BOTH the idle-wait timeout AND the\n      // client abort, else the (one-shot) `onNextRun` waiter leaks in the registry\n      // when a timed-out subscriber's session never receives another run.\n      const teardownWaiter = (): void => {\n        offNext()\n        detachAttach?.()\n      }\n      const timer = setTimeout(() => {\n        teardownWaiter()\n        close()\n      }, idleWaitMs)\n      timer.unref()\n      request.signal.addEventListener('abort', () => {\n        teardownWaiter()\n        clearTimeout(timer)\n        close()\n      })\n    },\n  })\n  return new Response(stream, { headers: { ...SSE_BASE_HEADERS } })\n}\n","/**\n * M15/M16 follow-up — shared dispatcher for the agent AUXILIARY routes that BOTH dev (vite\n * middleware) and prod (`theokit start` handler) must serve identically. Before this, these routes\n * were wired only into the dev middleware, so a built/deployed app served none of them (agent cards,\n * MCP, pending-approvals listing all 404'd in production).\n *\n * Single source of truth (DRY): one Web-Request→Response dispatcher, two callers. It handles the\n * routes that derive purely from the agent module + shared registry:\n *  - **M15** `GET /.well-known/<name>/agent-card.json` → {@link handleAgentCard}\n *  - **M14** `GET /api/agents/<name>/approvals`        → {@link handleListApprovals}\n *  - **M16** `POST /api/agents/<name>/mcp`             → {@link handleMcpJsonRpc}\n *\n * Channels (M27) are NOT here: a channel webhook needs app-supplied `validators` + `onMessage`, so\n * the app wires `handleChannelWebhook` in its own route (it cannot be auto-derived from the module).\n * The HITL approve route stays in each caller (it carries caller-specific rate-limiting/CSRF plumbing).\n */\nimport type { AgentNode } from '../scan/agent-scan.js'\nimport { validateCsrfRequest, type CsrfMode } from '../security/csrf.js'\n\nimport { isAgentCardPath, handleAgentCard } from './agent-card-handler.js'\nimport { getApprovalRegistry } from './approval-registry.js'\nimport { handleAgentRunReconnect, isAgentRunStreamPath } from './handle-agent-run-reconnect.js'\nimport {\n  handleThreadMessage,\n  handleThreadStream,\n  isThreadMessagePath,\n  isThreadStreamPath,\n} from './handle-thread-routes.js'\nimport { isListApprovalsPath, handleListApprovals } from './list-approvals-handler.js'\nimport { extractAppResources } from './mcp-app-resources.js'\nimport { isMcpPath, handleMcpJsonRpc } from './mcp-handler.js'\nimport { getRunEventCache } from './run-event-cache.js'\n\n/** JSON error envelope (mirrors mount-agent.ts:37 — the parity source for the MCP CSRF gate). */\nfunction jsonError(status: number, code: string, message: string): Response {\n  return new Response(JSON.stringify({ error: { code, message } }), {\n    status,\n    headers: { 'content-type': 'application/json; charset=utf-8' },\n  })\n}\n\n/** Dependencies the aux dispatcher needs from its caller (dev or prod). */\nexport interface AuxRouteDeps {\n  /** Discovered agents (from `scanAgents`). */\n  agents: readonly AgentNode[]\n  /** Load an agent module from its file path (dev: vite loader; prod: dynamic import). */\n  loadModule: (filePath: string) => Promise<unknown>\n  /** Absolute base URL (`http(s)://host`) for the agent-card endpoint URLs. */\n  baseUrl: string\n  /**\n   * M34 (#97) — CSRF enforcement mode for the MCP route. `POST /api/agents/<name>/mcp` drives the\n   * agent (spends LLM tokens), so a cross-origin POST MUST be rejected in `'strict'` — parity with\n   * the agent-run route (`mount-agent.ts:83-91`). Defaults to `'strict'` (safe-by-default); a caller\n   * that already gated upstream may pass `'off'`.\n   */\n  csrfMode?: CsrfMode\n  /**\n   * M39 — lazily resolve the provider apiKey. Required only for the thread\n   * follow-up route (which drives the agent); resolved on demand so non-agent\n   * aux routes (card, approvals, stream) never need a provider key.\n   */\n  resolveApiKey?: () => string\n}\n\n/**\n * Serve an agent auxiliary route. Returns a `Response` when `urlPath` matches an aux route (card /\n * list-approvals / mcp) and the method + agent resolve; returns `null` to fall through (not an aux\n * route, wrong method, or unknown agent — the caller then owns the 404/next).\n */\nexport async function serveAgentAuxRoute(\n  request: Request,\n  urlPath: string,\n  deps: AuxRouteDeps,\n): Promise<Response | null> {\n  const method = request.method.toUpperCase()\n\n  // M15 — A2A agent card at `/.well-known/<name>/agent-card.json` (GET).\n  const cardName = isAgentCardPath(urlPath)\n  if (cardName !== null) {\n    if (method !== 'GET') return null\n    const agent = deps.agents.find((a) => a.name === cardName)\n    if (!agent) return null\n    const mod = await deps.loadModule(agent.filePath)\n    return handleAgentCard(mod, agent.name, agent.agentPath, deps.baseUrl)\n  }\n\n  // M14 — GET /api/agents/<name>/approvals (pending HITL approvals).\n  if (isListApprovalsPath(urlPath)) {\n    if (method !== 'GET') return null\n    return handleListApprovals(getApprovalRegistry())\n  }\n\n  // M37 — GET /api/agents/<name>/runs/<runId>/stream (durable reconnect / observe).\n  // INTENTIONALLY open (no CSRF, no auth gate): a GET is not CSRF-vulnerable, the\n  // run-start POST is already gated, and the `runId` is a 122-bit UUID (unguessable).\n  // Observe-by-runId is a FEATURE (ADR-0046 D5) — a second client resumes a run a\n  // first started. Do NOT add a custom-header CSRF check here: browsers send NO\n  // custom headers with `EventSource`, so it would break native SSE reconnect.\n  const runStream = isAgentRunStreamPath(urlPath)\n  if (runStream !== null) {\n    if (method !== 'GET') return null\n    if (!deps.agents.some((a) => a.name === runStream.name)) return null\n    return handleAgentRunReconnect(runStream.runId, request, getRunEventCache())\n  }\n\n  // M39 — thread signal routes (follow-up message + subscribe-by-thread). Extracted\n  // to keep this dispatcher within the cognitive-complexity budget (G6).\n  const threadResponse = await serveThreadRoute(request, method, urlPath, deps)\n  if (threadResponse !== null) return threadResponse\n\n  // M16 — POST /api/agents/<name>/mcp (JSON-RPC MCP server). Extracted to keep this dispatcher\n  // within the cognitive-complexity budget (G6).\n  const mcpName = isMcpPath(urlPath)\n  if (mcpName !== null) {\n    return serveMcpRoute(request, method, mcpName, deps)\n  }\n\n  return null\n}\n\n/**\n * M39 — serve the thread routes:\n *  - `POST .../threads/<sessionId>/message` (follow-up) — loads the module, drives\n *    the run headless via the thread dispatcher. Needs `resolveApiKey` (drives the\n *    agent) → 501 when absent (rather than a silent 404).\n *  - `GET .../threads/<sessionId>/stream` (subscribe) — attach to the active/next\n *    run's durable stream. INTENTIONALLY open (GET, no custom headers — like the\n *    M37 reconnect route).\n *\n * SECURITY (thread stream): unlike the M37 reconnect route — keyed on an\n * `mintRunId()` UUID (122-bit unguessable) — the thread stream is keyed on the\n * caller-supplied `sessionId`. The open GET is safe ONLY if the `sessionId` is\n * unguessable (e.g. a client-minted UUID). An app that uses a PREDICTABLE\n * sessionId (user id, email, sequential id) MUST add its own auth gate before\n * this endpoint, or any party who can guess the sessionId can read the thread's\n * live conversation stream. Documented in `docs/architecture/multi-surface-architecture.md`.\n *\n * Returns `null` to fall through (not a thread route, wrong method, unknown agent).\n */\nasync function serveThreadRoute(\n  request: Request,\n  method: string,\n  urlPath: string,\n  deps: AuxRouteDeps,\n): Promise<Response | null> {\n  const stream = isThreadStreamPath(urlPath)\n  if (stream !== null) {\n    if (method !== 'GET') return null\n    if (!deps.agents.some((a) => a.name === stream.name)) return null\n    return handleThreadStream(stream.sessionId, request)\n  }\n\n  const msg = isThreadMessagePath(urlPath)\n  if (msg !== null) {\n    if (method !== 'POST') return null\n    const agent = deps.agents.find((a) => a.name === msg.name)\n    if (!agent) return null\n    if (deps.resolveApiKey === undefined) {\n      // MEDIUM-1 — the path matched but the caller wired no provider-key resolver.\n      // Fail loudly (501) instead of a silent 404 that reads as \"route not found\".\n      return jsonError(\n        501,\n        'NOT_CONFIGURED',\n        'Thread follow-up requires a provider API key (resolveApiKey was not provided to serveAgentAuxRoute).',\n      )\n    }\n    const mod = await deps.loadModule(agent.filePath)\n    return handleThreadMessage({\n      mod,\n      apiKey: deps.resolveApiKey(),\n      sessionId: msg.sessionId,\n      request,\n      source: `agent \"${msg.name}\"`,\n      csrfMode: deps.csrfMode ?? 'strict',\n    })\n  }\n  return null\n}\n\n/**\n * Serve the MCP route with the M34 gates: default-DENY opt-in → CSRF → dispatch. Returns `null` to\n * fall through (wrong method / unknown or non-opted-in agent), a 403 on CSRF failure, else the\n * JSON-RPC response.\n */\nasync function serveMcpRoute(\n  request: Request,\n  method: string,\n  mcpName: string,\n  deps: AuxRouteDeps,\n): Promise<Response | null> {\n  if (method !== 'POST') return null\n  const agent = deps.agents.find((a) => a.name === mcpName)\n  if (!agent) return null\n\n  const mod = await deps.loadModule(agent.filePath)\n\n  // M34 — DEFAULT-DENY: an agent is NOT exposed on MCP unless it explicitly opts in with a named\n  // `export const mcp = true` (blueprint D5 — default-EXPOSE is the footgun magnified by the\n  // multi-surface thesis). Absent the opt-in, fall through to 404 (the agent is web-only). This is a\n  // breaking change from the M16 auto-mount (documented in the CHANGELOG § Security).\n  if (!isMcpExposed(mod)) return null\n\n  // M34 (#97) — enforce CSRF BEFORE any work. The MCP route drives the agent (real LLM tokens), so a\n  // cross-origin POST must be rejected — parity with the agent-run route (`mount-agent.ts:83-91`).\n  const csrfMode = deps.csrfMode ?? 'strict'\n  if (csrfMode === 'strict') {\n    const csrf = validateCsrfRequest(request)\n    if (!csrf.valid) return jsonError(403, 'CSRF_FAILED', `CSRF check failed: ${csrf.reason}`)\n  }\n\n  let body: unknown = null\n  try {\n    body = await request.json()\n  } catch {\n    /* malformed/empty JSON → handleMcpJsonRpc returns a -32600 envelope */\n  }\n  // M30 — pass the agent's declared `ui://` App resources (named `appResources` export) so the MCP\n  // server advertises + serves them via resources/list + resources/read.\n  return handleMcpJsonRpc(mod, agent.name, body, extractAppResources(mod))\n}\n\n/**\n * M34 — DEFAULT-DENY opt-in check: is this agent module exposed on the MCP surface? An agent opts in\n * with a named `export const mcp = true` (mirroring the `appResources` named-export convention).\n * Anything else (absent / falsy) → NOT exposed. Read at the emit layer (blueprint D5).\n */\nfunction isMcpExposed(mod: unknown): boolean {\n  return (mod as { mcp?: unknown } | null | undefined)?.mcp === true\n}\n","/**\n * T5a.2 Phase G slice 5/N — Node adapter shim for the Web request handler.\n *\n * Bridges Node's `IncomingMessage` + `ServerResponse` shape to the\n * Web-Standards `executeWebRequest` (Phase A → G slices 1-4). Per\n * ADR-0028 R3a, the Node adapter is the ONLY place IncomingMessage ↔\n * Request conversion happens — every other layer of `server/` flows\n * through Web `Request`/`Response`.\n *\n * **Two conversions:**\n *\n *   1. `incomingMessageToWebRequest(req)` — Node → Web. Reads\n *      `req.method`, `req.url`, `req.headers`, and (for POST/PUT/etc.)\n *      drains the Node Readable body into a Web `ReadableStream`. The\n *      request URL is resolved to absolute form using `req.headers.host`\n *      (Web Request guarantees absolute URL).\n *\n *   2. `writeWebResponseToServerResponse(response, res)` — Web → Node.\n *      Sets status code + status text, copies headers (including all\n *      `Set-Cookie` values via `getSetCookie()`), then drains the Web\n *      `ReadableStream` body into the Node ServerResponse.\n *\n * Plus the convenience composer `executeWebRequestFromNode(req, res,\n * routeModule, opts?)` that wires both ends — exactly what api-middleware\n * (and the prod CLI start path) need to migrate from the legacy\n * `executeRoute` to `executeWebRequest` without touching call sites.\n *\n * Per `docs/plans/t5a2-incoming-message-to-request-shape-refactor-plan.md`\n * v1.0 § Phase G slice 5/N (closes the executor bridge surface).\n */\nimport type { IncomingMessage, ServerResponse } from 'node:http'\n\nimport { executeWebRequest, type ExecuteWebRequestOptions } from '../web-handler.js'\n\nimport { incomingMessageToWebRequest } from './node-request.js'\n\n// The primitive `IncomingMessage` → Web `Request` converters live in\n// `node-request.js` (dependency-free, shared with the executor). Re-exported\n// here so existing importers of the adapter keep resolving them.\nexport { incomingMessageToWebRequest, incomingMessageToHandlerRequest } from './node-request.js'\n\n/**\n * Write a Web `Response` into a Node `ServerResponse`. Mirrors the Node\n * `res.writeHead` + `res.end` pattern.\n *\n * Set-Cookie is the only multi-value header the Web spec exposes via\n * `getSetCookie()`. We append each entry individually so Node emits\n * separate `Set-Cookie:` lines per the HTTP spec.\n *\n * If the Response body is a `ReadableStream`, it's piped chunk-by-chunk\n * to `res`. Empty body (null) → just close.\n */\nexport async function writeWebResponseToServerResponse(\n  response: Response,\n  res: ServerResponse,\n): Promise<void> {\n  // Status + headers FIRST (writeHead locks them).\n  // EC-3: Set-Cookie needs special handling (writeHead's plain object\n  // shape conflicts with multi-value headers; we set them via setHeader\n  // BEFORE writeHead so the array form is preserved).\n  const setCookies = response.headers.getSetCookie()\n  if (setCookies.length > 0) {\n    res.setHeader('Set-Cookie', setCookies)\n  }\n  const otherHeaders: Record<string, string> = {}\n  for (const [key, value] of response.headers.entries()) {\n    if (key.toLowerCase() === 'set-cookie') continue\n    otherHeaders[key] = value\n  }\n  res.writeHead(response.status, response.statusText, otherHeaders)\n\n  // Body — drain ReadableStream OR just end() for null body.\n  if (response.body === null) {\n    res.end()\n    return\n  }\n  const reader = response.body.getReader()\n  try {\n    for (;;) {\n      const { done, value } = await reader.read()\n      if (done) break\n      // Node's res.write accepts Uint8Array natively (no conversion needed).\n      res.write(value)\n    }\n    res.end()\n  } finally {\n    reader.releaseLock()\n  }\n}\n\n/**\n * Convenience composer — full request lifecycle Node → Web → Node.\n *\n * Use case: existing api-middleware (and the prod CLI start path)\n * receive Node `(req, res)` from `http.createServer`. To migrate to the\n * Web-Standards executor without rewriting every call site, wrap with\n * this composer:\n *\n *   import * as users from './app/users/route.js'\n *   await executeWebRequestFromNode(req, res, users, { csrfMode: 'strict' })\n *\n * The Web request is built, dispatched through executeWebRequest, and\n * the Response is drained back into `res`. Caller does NOT need to call\n * `res.end()` afterwards — this composer handles it.\n */\nexport async function executeWebRequestFromNode(\n  req: IncomingMessage,\n  res: ServerResponse,\n  routeModule: Parameters<typeof executeWebRequest>[1],\n  opts?: ExecuteWebRequestOptions,\n): Promise<void> {\n  const webRequest = incomingMessageToWebRequest(req)\n  const webResponse = await executeWebRequest(webRequest, routeModule, opts)\n  await writeWebResponseToServerResponse(webResponse, res)\n}\n","import type { IncomingMessage, ServerResponse } from 'node:http'\nimport { resolve } from 'node:path'\n\nimport type { ViteDevServer, Connect } from 'vite'\n\nimport {\n  BATCH_PATH,\n  CSP_REPORT_PATH,\n  TRACE_HEADER,\n  applySecurityHeaders,\n  createCorsHandler,\n  createRateLimiter,\n  createViteLoader,\n  executeRoute,\n  extractTraceId,\n  findSuggestion,\n  handleBatchRequest,\n  handleCspReport,\n  handleCsrfReadiness,\n  incomingMessageToHandlerRequest,\n  logRequest,\n  dispatchControllerRequest,\n  mountAgent,\n  resolveProvider,\n  matchRoute,\n  scanServerRoutes,\n  sendError,\n  type AuditLogger,\n  type CorsConfig,\n  type CspReportHandlerOptions,\n  type CsrfReadinessStore,\n  type DisallowedConfig,\n  type LoadModule,\n  type PluginRunner,\n  type RateLimitConfig,\n  type SecurityHeadersConfig,\n} from '../server/internal-api.js'\nimport type { TheoTransformer } from '../server/transformer.js'\n\nexport interface ApiMiddlewareOptions {\n  rateLimitConfig?: RateLimitConfig\n  pluginRunner?: PluginRunner\n  transformer?: TheoTransformer\n  /** When defined, enables /api/__theo_batch__ endpoint with given options. */\n  batching?: { max?: number }\n  /** Phase 5 — CSRF enforcement mode. Default 'warn' (0.2.0). */\n  csrfMode?: 'off' | 'warn' | 'strict'\n  /** Phase 6 — Default security headers config. */\n  securityHeaders?: SecurityHeadersConfig\n  /** T5.1 — per-route disallowed escalation pattern. */\n  disallowed?: DisallowedConfig\n  /** T1.2 — CORS configuration. When undefined, no CORS handling (same-origin only). */\n  cors?: CorsConfig\n  /** T4.1 — Audit logger. Receives csrf.warn, rate-limit.exceeded, csp.violation events. */\n  auditLogger?: AuditLogger\n  /** T5.1 — Optional CSP violation hook (forwarded to Sentry / custom sink). */\n  onCspViolation?: CspReportHandlerOptions['onViolation']\n  /**\n   * T2.2 — Optional CSRF readiness store. When provided, the\n   * `/__theo/csrf-readiness` endpoint is mounted and warn events are\n   * recorded into the store. Dev-mode middleware wires this automatically;\n   * production hosts opt in via config.security.csrfTelemetry.exposeReadinessEndpoint.\n   */\n  csrfReadinessStore?: CsrfReadinessStore\n  /**\n   * Wave 2 completion (T1.1 vite-proxy) — list of services-proxy path prefixes\n   * (e.g. `['/api/agent', '/api/worker']`). Requests whose path starts with\n   * any of these prefixes bypass the api-middleware (call `next()`) so the\n   * later proxyMiddleware (installed by Vite from `server.proxy`) can forward\n   * them to the polyglot sidecar. Empty / undefined preserves Wave 1 BC.\n   */\n  servicesProxyPrefixes?: readonly string[]\n}\n\n/**\n * Wave 2 completion — true when `url` is OUTSIDE TheoKit's API namespace,\n * either because it doesn't start with `/api/` OR because it matches a\n * services-proxy prefix. In both cases the middleware should call `next()`\n * so the request reaches Vite's proxyMiddleware / static fallback. Combining\n * both checks into one helper keeps the main arrow function's cyclomatic\n * complexity within the eslint ceiling.\n */\nfunction shouldBypassApiMiddleware(url: string, prefixes: readonly string[]): boolean {\n  if (!url.startsWith('/api/')) return true\n  if (prefixes.length === 0) return false\n  const path = url.split('?')[0]\n  for (const prefix of prefixes) {\n    if (path === prefix || path.startsWith(`${prefix}/`)) return true\n  }\n  return false\n}\n\nasync function handleCspReportIfMatch(\n  req: IncomingMessage,\n  res: ServerResponse,\n  url: string,\n  ctx: {\n    auditLogger: AuditLogger | undefined\n    onCspViolation: CspReportHandlerOptions['onViolation'] | undefined\n  },\n): Promise<boolean> {\n  const pathOnly = url.split('?')[0]\n  if (pathOnly !== CSP_REPORT_PATH || req.method !== 'POST') return false\n  await handleCspReport(req, res, { auditLogger: ctx.auditLogger, onViolation: ctx.onCspViolation })\n  return true\n}\n\ninterface RateLimitCtx {\n  rateLimiter:\n    | ((req: IncomingMessage) => { limited: boolean; headers: Record<string, string> })\n    | null\n  requestId: string\n  url: string\n  start: number\n}\n\n/**\n * Apply rate-limit headers and send 429 if exceeded. Returns true when\n * the caller should stop handling the request (limit hit), false otherwise.\n * Extracted from `createApiMiddleware` to keep complexity within ceiling.\n */\nfunction applyRateLimitOr429(\n  req: IncomingMessage,\n  res: ServerResponse,\n  ctx: RateLimitCtx,\n): boolean {\n  if (!ctx.rateLimiter) return false\n  const check = ctx.rateLimiter(req)\n  for (const [k, v] of Object.entries(check.headers)) res.setHeader(k, v)\n  if (!check.limited) return false\n  sendError(res, 'RATE_LIMITED', 'Too many requests', 429, undefined, ctx.requestId)\n  logRequest({\n    method: req.method ?? 'GET',\n    url: ctx.url,\n    status: 429,\n    duration: Date.now() - ctx.start,\n    requestId: ctx.requestId,\n  })\n  return true\n}\n\ninterface BatchMatchCtx {\n  url: string\n  batching: { max?: number } | undefined\n  requestId: string\n  start: number\n}\n\nasync function handleBatchIfMatch(\n  req: IncomingMessage,\n  res: ServerResponse,\n  ctx: BatchMatchCtx,\n): Promise<boolean> {\n  if (!ctx.batching) return false\n  const urlPathOnly = ctx.url.split('?')[0]\n  if (urlPathOnly !== BATCH_PATH || req.method !== 'POST') return false\n  await handleBatchInline(req, res, ctx.batching, ctx.requestId)\n  logRequest({\n    method: req.method ?? 'POST',\n    url: ctx.url,\n    status: res.statusCode,\n    duration: Date.now() - ctx.start,\n    requestId: ctx.requestId,\n  })\n  return true\n}\n\nasync function handleBatchInline(\n  req: IncomingMessage,\n  res: ServerResponse,\n  batching: { max?: number },\n  requestId: string,\n): Promise<void> {\n  try {\n    const chunks: Buffer[] = []\n    await new Promise<void>((resolve, reject) => {\n      req.on('data', (c) => chunks.push(c as Buffer))\n      req.on('end', () => {\n        resolve()\n      })\n      req.on('error', reject)\n    })\n    // CR-028: pass the parsed JSON as `unknown`; Zod inside\n    // handleBatchRequest is the validation boundary.\n    const payload: unknown = JSON.parse(Buffer.concat(chunks).toString())\n    const outerHeaders: Record<string, string> = {}\n    for (const [k, v] of Object.entries(req.headers)) {\n      if (typeof v === 'string') outerHeaders[k.toLowerCase()] = v\n    }\n    const result = await handleBatchRequest(payload, {\n      max: batching.max,\n      outerHeaders,\n      // T1.4 placeholder — full per-item route execution lands in a\n      // follow-up; for now we return an empty ack so the integration\n      // tests of the batch endpoint shape pass.\n      execute: () => Promise.resolve({ data: { ok: true } }),\n    })\n    res.writeHead(200, { 'Content-Type': 'application/json' })\n    res.end(JSON.stringify(result))\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err)\n    sendError(res, 'BATCH_ERROR', message, 400, undefined, requestId)\n  }\n}\n\n/**\n * P#3 T4.1 — fire pluginRunner.onRequest for unmatched routes so plugins\n * can intercept paths outside server/routes/ (e.g., @theokit/plugin-openapi\n * /api/docs). Returns true when a plugin short-circuited the response.\n */\ninterface RunPluginsCtx {\n  req: IncomingMessage\n  res: ServerResponse\n  requestId: string\n  start: number\n  url: string\n}\n\nasync function runPluginsBeforeRouteMatch(\n  pluginRunner: PluginRunner,\n  reqCtx: RunPluginsCtx,\n): Promise<boolean> {\n  const { req, res, requestId, start, url } = reqCtx\n  try {\n    const hookResult = await pluginRunner.runOnRequest({\n      // #119 — plugin hooks see a Web `Request` in every runtime (ADR-0028 R3a).\n      request: incomingMessageToHandlerRequest(req),\n      response: res,\n      ctx: {},\n      requestId,\n    })\n    if (hookResult.shortCircuited) {\n      logRequest(\n        {\n          method: req.method ?? 'GET',\n          url,\n          status: res.statusCode,\n          duration: Date.now() - start,\n          requestId,\n        },\n        undefined,\n        req,\n      )\n      return true\n    }\n  } catch (err) {\n    sendError(res, 'PLUGIN_ERROR', (err as Error).message, 500, undefined, requestId)\n    return true\n  }\n  return false\n}\n\n/**\n * #122 (T1.2) — controller fall-through for the `!match` arm. Serves a decorator\n * controller under `<serverDir>/controllers/` (dev parity); inherits the security-\n * headers/CORS/rate-limit/plugin gates already run upstream, and CSRF is enforced\n * inside `dispatchControllerRequest`. Zero cost for routes-only apps. Returns `true`\n * when a controller handled the request (response already written + logged).\n */\nasync function tryControllerFallthrough(ctx: {\n  req: IncomingMessage\n  res: ServerResponse\n  serverDir: string\n  loadModule: LoadModule\n  csrfMode: 'off' | 'warn' | 'strict'\n  disallowed: DisallowedConfig | undefined\n  requestId: string\n  url: string\n  start: number\n}): Promise<boolean> {\n  const handled = await dispatchControllerRequest({\n    controllersDir: resolve(ctx.serverDir, 'controllers'),\n    loadModule: ctx.loadModule,\n    req: ctx.req,\n    res: ctx.res,\n    csrfMode: ctx.csrfMode,\n    disallowed: ctx.disallowed,\n    requestId: ctx.requestId,\n    // M47 — serve @Expose-bound agent routes via the ONE runtime (mountAgent). CSRF is already enforced\n    // once at the controller-dispatch boundary (G5), so mountAgent runs with csrfMode 'off' (no double gate).\n    serveAgent: (agent: unknown, request: Request) =>\n      mountAgent(agent, request, resolveProvider().apiKey, { source: 'expose', csrfMode: 'off' }),\n  })\n  if (!handled) return false\n  logRequest(\n    {\n      method: (ctx.req.method ?? 'GET').toUpperCase(),\n      url: ctx.url,\n      status: ctx.res.statusCode,\n      duration: Date.now() - ctx.start,\n      requestId: ctx.requestId,\n    },\n    undefined,\n    ctx.req,\n  )\n  return true\n}\n\nexport function createApiMiddleware(\n  vite: ViteDevServer,\n  serverDir: string,\n  rateLimitConfigOrOptions?: RateLimitConfig | ApiMiddlewareOptions,\n): Connect.NextHandleFunction {\n  // Backward-compat: accept either RateLimitConfig directly (old signature)\n  // or an ApiMiddlewareOptions object (new signature with pluginRunner).\n  const opts: ApiMiddlewareOptions =\n    rateLimitConfigOrOptions && 'windowMs' in rateLimitConfigOrOptions\n      ? { rateLimitConfig: rateLimitConfigOrOptions }\n      : (rateLimitConfigOrOptions ?? {})\n\n  const loadModule = createViteLoader(vite)\n  const rateLimiter = opts.rateLimitConfig ? createRateLimiter(opts.rateLimitConfig) : null\n  const pluginRunner = opts.pluginRunner\n  const transformer = opts.transformer\n  const batching = opts.batching\n  // T6.1 — default flipped from 'warn' to 'strict' for 0.3.0.\n  const csrfMode = opts.csrfMode ?? 'strict'\n  const disallowed = opts.disallowed\n  const securityHeadersConfig = opts.securityHeaders ?? {}\n  const securityEnv = { production: process.env.NODE_ENV === 'production' }\n  // T1.2 — CORS handler runs FIRST in the pipeline (D10).\n  const corsHandler = opts.cors ? createCorsHandler(opts.cors) : null\n  const auditLogger = opts.auditLogger\n  const onCspViolation = opts.onCspViolation\n  const csrfReadinessStore = opts.csrfReadinessStore\n  const servicesProxyPrefixes = opts.servicesProxyPrefixes ?? []\n\n  return (req, res, next) => {\n    // Middleware dispatch arm: each branch guards a protocol concern\n    // (CSP report, CSRF readiness, services proxy, CORS preflight, rate\n    // limit, plugin onRequest, batch, route match); linear dispatch order\n    // is more readable than per-concern function extraction.\n    // eslint-disable-next-line complexity\n    const handle = async (): Promise<void> => {\n      const url = req.url ?? ''\n\n      // T5.1 — built-in CSP report endpoint. Matched BEFORE the /api/* gate\n      // so the path lives outside the user's route namespace. Endpoint is\n      // CSRF-exempt (browsers don't send X-Theo-Action on report POSTs).\n      if (await handleCspReportIfMatch(req, res, url, { auditLogger, onCspViolation })) {\n        return\n      }\n\n      // T2.2 — CSRF readiness endpoint. Only mounted when a store is wired\n      // (dev-mode wires it automatically; prod opt-in via config).\n      if (csrfReadinessStore && (await handleCsrfReadiness(req, res, csrfReadinessStore))) {\n        return\n      }\n\n      if (shouldBypassApiMiddleware(url, servicesProxyPrefixes)) {\n        next()\n        return\n      }\n\n      // T1.2 + D10 — CORS preflight runs BEFORE rate limit, BEFORE CSRF.\n      // Preflight short-circuits the response (204 + Access-Control-* headers).\n      if (corsHandler?.handlePreflight(req, res)) {\n        return\n      }\n\n      // Phase 7 — traceId resolution. Reads traceparent / x-request-id /\n      // generates UUID. The `requestId` name is kept for backward compat\n      // with downstream helpers (sendError, logRequest) — same value flows\n      // under both `x-request-id` (legacy) and `x-trace-id` (canonical).\n      const requestId = extractTraceId(req)\n      const start = Date.now()\n      res.setHeader('x-request-id', requestId)\n      res.setHeader(TRACE_HEADER, requestId)\n      // Phase 6 — Apply security headers BEFORE the handler runs so route\n      // handlers can still override via res.setHeader (last write wins).\n      applySecurityHeaders(res, securityHeadersConfig, securityEnv)\n      // T1.2 — Add CORS headers to non-preflight responses.\n      corsHandler?.applyHeaders(req, res)\n\n      if (applyRateLimitOr429(req, res, { rateLimiter, requestId, url, start })) {\n        return\n      }\n\n      // P#3 T4.1 — fire pluginRunner.onRequest BEFORE matchRoute so plugins\n      // can intercept unmatched paths (e.g., @theokit/plugin-openapi /api/docs).\n      if (\n        pluginRunner &&\n        (await runPluginsBeforeRouteMatch(pluginRunner, { req, res, requestId, start, url }))\n      ) {\n        return\n      }\n\n      // T1.4 — Batch endpoint (only when batching is enabled in config)\n      if (await handleBatchIfMatch(req, res, { url, batching, requestId, start })) {\n        return\n      }\n\n      const routes = scanServerRoutes(serverDir)\n      const match = matchRoute(url, routes)\n\n      if (!match) {\n        // #122 (T1.2) — no file route matched; try a decorator controller (dev parity).\n        if (\n          await tryControllerFallthrough({\n            req,\n            res,\n            serverDir,\n            loadModule,\n            csrfMode,\n            disallowed,\n            requestId,\n            url,\n            start,\n          })\n        ) {\n          return\n        }\n\n        const urlPath = url.split('?')[0]\n        const routePaths = routes.map((r) => r.routePath)\n        const suggestion = findSuggestion(urlPath, routePaths)\n        const msg = suggestion\n          ? `API route not found: ${urlPath}. Did you mean: ${suggestion}?`\n          : 'API route not found'\n        sendError(res, 'NOT_FOUND', msg, 404, undefined, requestId)\n        logRequest(\n          {\n            method: req.method ?? 'GET',\n            url,\n            status: 404,\n            duration: Date.now() - start,\n            requestId,\n          },\n          undefined,\n          req,\n        )\n        return\n      }\n\n      const method = (req.method ?? 'GET').toUpperCase()\n      // T3.1 (ADR-0016) — context object replaces 12 positional args\n      await executeRoute({\n        route: match.route,\n        method,\n        params: match.params,\n        req,\n        res,\n        loadModule,\n        serverDir,\n        requestId,\n        pluginRunner,\n        transformer,\n        csrfMode,\n        disallowed,\n      })\n      logRequest(\n        { method, url, status: res.statusCode, duration: Date.now() - start, requestId },\n        undefined,\n        req,\n      )\n    }\n    void handle()\n  }\n}\n","/**\n * T2.2 (architecture-medium-deferrals plan, ADR D2) — SSR dev middleware\n * extracted from `vite-plugin/index.ts` for SRP.\n *\n * `setupSsrDevMiddleware(server, opts)` registers a Connect-style middleware\n * on the Vite dev server that:\n *   1. Skips API, static, and HMR requests (let other middlewares handle).\n *   2. Reads `index.html`, runs `transformIndexHtml`.\n *   3. Generates per-request nonce, applies security headers (CSP + Cache-Control).\n *   4. Calls `ssrLoadModule(VIRTUAL_ENTRY_SERVER_ID).render(url, { nonce })`.\n *   5. Injects rendered HTML (with hydration script) into root div.\n *   6. On error: ssrFixStacktrace + fallback to CSR via `next()`.\n *\n * No-op when `ssrEnabled === false`. Caller's responsibility to gate.\n */\n\nimport { readFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { ViteDevServer } from 'vite'\n\nimport {\n  applySecurityHeaders,\n  generateNonce,\n  type SecurityHeadersConfig,\n} from '../server/internal-api.js'\n\ninterface SsrRenderResult {\n  html: string\n  hydrationData: {\n    loaderData?: unknown\n    actionData?: unknown\n    errors?: unknown\n  }\n}\n\ninterface SsrEntryServer {\n  render: (\n    url: string,\n    opts: { nonce: string },\n  ) => Promise<SsrRenderResult | { redirect: Response } | string>\n}\n\nfunction isSsrRenderResult(value: unknown): value is SsrRenderResult {\n  if (typeof value !== 'object' || value === null) return false\n  if (!('html' in value)) return false\n  return typeof (value as Record<string, unknown>).html === 'string'\n}\n\nexport interface SsrDevMiddlewareOptions {\n  projectRoot: string\n  virtualEntryServerId: string\n  securityHeaders: SecurityHeadersConfig | undefined\n}\n\n/**\n * Attach the SSR dev middleware to a Vite dev server. Caller decides whether\n * to invoke this based on `ssrEnabled` — this function does not gate.\n */\nexport function setupSsrDevMiddleware(server: ViteDevServer, opts: SsrDevMiddlewareOptions): void {\n  server.middlewares.use((req, res, next) => {\n    void (async () => {\n      const url = req.url ?? '/'\n      // Skip API, static, and HMR requests\n      if (\n        url.startsWith('/api/') ||\n        url.startsWith('/@') ||\n        url.startsWith('/node_modules/') ||\n        url.includes('.')\n      ) {\n        next()\n        return\n      }\n\n      try {\n        const indexPath = resolve(opts.projectRoot, 'index.html')\n        // eslint-disable-next-line security/detect-non-literal-fs-filename -- projectRoot is from `theokit dev`'s caller-controlled cwd\n        let template = readFileSync(indexPath, 'utf-8')\n        template = await server.transformIndexHtml(url, template)\n\n        // T4.1 — Generate a per-request nonce and apply security headers BEFORE render.\n        // The same nonce flows into React's renderToPipeableStream({ nonce }) so every\n        // emitted <script> carries it AND into the CSP script-src directive.\n        // EC-3: applySecurityHeaders also forces Cache-Control: private, no-store.\n        const nonce = generateNonce()\n        applySecurityHeaders(\n          res,\n          opts.securityHeaders ?? {},\n          { production: process.env.NODE_ENV === 'production' },\n          { nonce },\n        )\n\n        const mod = (await server.ssrLoadModule(opts.virtualEntryServerId)) as SsrEntryServer\n        const result = await mod.render(url, { nonce })\n\n        if (result && typeof result === 'object' && 'redirect' in result) {\n          res.writeHead(302, {\n            Location: result.redirect.headers.get('location') ?? '/',\n          })\n          res.end()\n          return\n        }\n\n        // Backward-compat: old render returned string. New shape returns\n        // { html, hydrationData } so the framework can emit the hydration\n        // data script OUTSIDE the React root (fixes hydration mismatch).\n        let ssrHtml: string\n        let hydrationScript = ''\n        if (typeof result === 'string') {\n          ssrHtml = result\n        } else if (isSsrRenderResult(result)) {\n          ssrHtml = result.html\n          const dataJson = JSON.stringify(result.hydrationData).replace(/</g, '\\\\u003c')\n          hydrationScript = `<script nonce=\"${nonce}\">window.__staticRouterHydrationData=${dataJson}</script>`\n        } else {\n          ssrHtml = ''\n        }\n        const rootDivMatch = /<div id=[\"']root[\"'][^>]*>/.exec(template)\n        if (!rootDivMatch) {\n          res.writeHead(200, { 'Content-Type': 'text/html' })\n          res.end(template)\n          return\n        }\n\n        const splitIdx = template.indexOf(rootDivMatch[0]) + rootDivMatch[0].length\n        const html =\n          template.slice(0, splitIdx) + ssrHtml + hydrationScript + template.slice(splitIdx)\n\n        res.writeHead(200, { 'Content-Type': 'text/html' })\n        res.end(html)\n      } catch (err) {\n        server.ssrFixStacktrace(err as Error)\n        console.error('[SSR Dev Error]', err)\n        // Fallback to CSR\n        next()\n        return\n      }\n    })()\n  })\n}\n","/**\n * T2.3 (architecture-medium-deferrals plan, ADR D2) — WebSocket upgrade\n * handler extracted from `vite-plugin/index.ts` for SRP.\n *\n * `setupWsUpgrade(server, projectRoot)` scans `server/ws/*` and attaches an\n * upgrade handler to `server.httpServer`. Lazy-imports the `ws` package so\n * non-WS apps don't pay the cost.\n *\n * **EC-1 (architecture-medium-deferrals plan v1.1 MUST FIX):** must tolerate\n * `server.httpServer === null` (Vite middleware mode — embed in Express/etc).\n * Without the guard, dev embeds crash on plugin init. The function exits\n * silently when no httpServer is available; consumer can wire their own.\n *\n * Mirrors the prod surface in `cli/commands/start-websocket-handler.ts` —\n * same `onOpen`/`onMessage`/`onClose`/`onError` handler shape (EC-6 parity).\n */\n\nimport type { IncomingMessage } from 'node:http'\nimport { resolve } from 'node:path'\nimport type { Duplex } from 'node:stream'\n\nimport type { ViteDevServer } from 'vite'\n\nimport { scanWebSocketRoutes } from '../server/internal-api.js'\n\ninterface WsHandler {\n  onOpen?: (ws: unknown, request: unknown) => void | Promise<void>\n  onMessage?: (ws: unknown, data: string) => void | Promise<void>\n  onClose?: (ws: unknown, code: number, reason: Buffer) => void | Promise<void>\n  onError?: (ws: unknown, err: Error) => void | Promise<void>\n}\n\nexport function setupWsUpgrade(server: ViteDevServer, projectRoot: string): void {\n  const wsRoutes = scanWebSocketRoutes(resolve(projectRoot, 'server'))\n  if (wsRoutes.length === 0) return\n\n  // EC-1 — middleware-mode Vite has no httpServer. Silently skip; the host\n  // platform owns its own upgrade routing in that case.\n  const wsHttpServer = server.httpServer\n  if (!wsHttpServer) return\n\n  // Lazy-import `ws` so non-WS apps don't pay the cost.\n  void import('ws')\n    .then(({ WebSocketServer }) => {\n      const wss = new WebSocketServer({ noServer: true })\n\n      wsHttpServer.on('upgrade', (request: IncomingMessage, socket: Duplex, head: Buffer) => {\n        void (async () => {\n          const url = request.url ?? '/'\n          if (!url.startsWith('/ws/')) return // Let Vite handle HMR etc.\n\n          const wsPath = url.split('?')[0]\n          const match = wsRoutes.find((r) => r.wsPath === wsPath)\n          if (!match) {\n            socket.destroy()\n            return\n          }\n\n          try {\n            const mod = await server.ssrLoadModule(match.filePath)\n            const handler = ((mod as { default?: unknown }).default ?? mod) as WsHandler\n\n            wss.handleUpgrade(request, socket, head, (ws) => {\n              void handler.onOpen?.(ws, request)\n              ws.on('message', (data: Buffer) => {\n                void handler.onMessage?.(ws, data.toString())\n              })\n              ws.on('close', (code: number, reason: Buffer) => {\n                void handler.onClose?.(ws, code, reason)\n              })\n              ws.on('error', (err: Error) => {\n                void handler.onError?.(ws, err)\n              })\n            })\n          } catch {\n            socket.destroy()\n          }\n        })()\n      })\n    })\n    .catch(() => {\n      console.warn(\n        '[Theo] WebSocket routes found but \"ws\" package not installed. Run: npm install ws',\n      )\n    })\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time tool. Read-only filesystem walks under cwd + node_modules\n * to resolve consumer-side optional deps. Paths are derived from the\n * CLI-controlled cwd and a fixed package name list.\n */\n/**\n * `integrateUseTheoUI(cwd, opts)` — auto-chains the Vite plugins needed\n * for `@theokit/ui` styling when the consumer has the dep declared.\n *\n * Algorithm (D3 + D5 of the plan):\n *   1. opts.enabled === false → return [].\n *   2. detectPackage('@theokit/ui') — if absent, return [].\n *   3. opts.consumerTailwindConfig or opts.consumerPostcssConfig set →\n *      log info + return []. Consumer-in-control wins (D3).\n *   4. detectPackage('@tailwindcss/vite') — if absent, log warn + return [].\n *   5. Dynamic-import both. Type-check default exports (EC-5). Type-check\n *      return shapes (EC-6). If any guard fails, log + return [].\n *   6. Return [tailwindcssPlugin(), useTheoUIPlugin()].\n */\n\nimport { existsSync, readFileSync } from 'node:fs'\nimport { dirname, join } from 'node:path'\nimport { pathToFileURL } from 'node:url'\n\nimport type { Plugin } from 'vite'\n\nimport { detectPackage } from './auto-detect.js'\n\nexport interface IntegrateUiOptions {\n  /** When `false`, disable auto-config regardless of detection. Default: true. */\n  enabled?: boolean\n  /** Path to the consumer's tailwind.config.* (any extension), if present. D3 deferral. */\n  consumerTailwindConfig?: string\n  /** Path to the consumer's postcss.config.* (any extension), if present. D3 deferral. */\n  consumerPostcssConfig?: string\n}\n\n/**\n * Resolve a bare specifier to an absolute file URL by walking up from the\n * consumer's `cwd`, scanning `node_modules` directly. Works for ESM-only\n * packages that don't expose a `require` condition (createRequire fails\n * on those). Reads the resolved package.json's `exports.\".\"` field to\n * find the entry. Returns the file:// URL or null if not resolvable.\n */\nfunction resolveConsumerImport(name: string, cwd: string): string | null {\n  let dir = cwd\n  for (let i = 0; i < 10; i++) {\n    const pkgDir = join(dir, 'node_modules', ...name.split('/'))\n    const pkgJsonPath = join(pkgDir, 'package.json')\n    if (existsSync(pkgJsonPath)) {\n      try {\n        const raw = readFileSync(pkgJsonPath, 'utf-8')\n        const pkg = JSON.parse(raw) as {\n          exports?: { '.'?: { import?: string; default?: string } | string }\n          main?: string\n          module?: string\n        }\n        let entry: string | undefined\n        const dotExport = pkg.exports?.['.']\n        if (typeof dotExport === 'string') entry = dotExport\n        else if (dotExport && typeof dotExport === 'object') {\n          entry = dotExport.import ?? dotExport.default\n        }\n        entry ??= pkg.module ?? pkg.main\n        if (!entry) return null\n        // Strip leading ./ then join.\n        const cleaned = entry.replace(/^\\.\\//, '')\n        return pathToFileURL(join(pkgDir, cleaned)).href\n      } catch {\n        return null\n      }\n    }\n    const parent = dirname(dir)\n    if (parent === dir) break\n    dir = parent\n  }\n  return null\n}\n\nfunction isValidPlugin(value: unknown): value is Plugin {\n  if (value === null || typeof value !== 'object') return false\n  if (Array.isArray(value)) return false\n  // Vite Plugin shape: object with a `name: string` field at minimum.\n  if (!('name' in value)) return false\n  return typeof (value as Record<string, unknown>).name === 'string'\n}\n\n/**\n * Normalize a Vite plugin factory return value into a flat Plugin[].\n *\n * Background: Tailwind v3 returned a single Plugin from its factory.\n * Tailwind v4 (`@tailwindcss/vite@4.x`) returns an ARRAY of 3 plugins\n * (`@tailwindcss/vite:scan` + `:generate:serve` + `:generate:build`).\n * The EC-6 single-Plugin guard rejected the v4 array shape and silently\n * skipped chain integration, causing 0 utilities generated in the\n * consumer's CSS. This normalizer accepts both shapes.\n */\nfunction normalizePluginReturn(value: unknown): Plugin[] | null {\n  if (Array.isArray(value)) {\n    const result: Plugin[] = []\n    for (const entry of value) {\n      if (!isValidPlugin(entry)) return null\n      result.push(entry)\n    }\n    return result.length > 0 ? result : null\n  }\n  if (isValidPlugin(value)) return [value]\n  return null\n}\n\n/** Test-only side-door so EC-6 shape guard can be unit-tested directly. */\nexport const _isValidPluginForTest = isValidPlugin\n/** Test-only side-door for the v3/v4 normalizer. */\nexport const _normalizePluginReturnForTest = normalizePluginReturn\n\n// eslint-disable-next-line complexity -- canonical auto-config gate (5 detection branches + 2 import guards + 2 shape guards); flattening to micro-helpers would hide the linear contract\nexport async function integrateUseTheoUI(\n  cwd: string,\n  opts?: IntegrateUiOptions,\n): Promise<Plugin[]> {\n  if (opts?.enabled === false) return []\n\n  const uiDetect = detectPackage('@theokit/ui', cwd)\n  if (!uiDetect.installed) return []\n\n  // D3 — consumer's manual config wins\n  if (opts?.consumerTailwindConfig || opts?.consumerPostcssConfig) {\n    // eslint-disable-next-line no-console -- one-line transparency hint; goal is to surface the override path\n    console.info(\n      `[theokit] Detected your tailwind.config / postcss.config — skipping auto-config. Extend with \\`import preset from '@theokit/ui/preset'\\` to apply UI theme.`,\n    )\n    return []\n  }\n\n  const tailwindDetect = detectPackage('@tailwindcss/vite', cwd)\n  if (!tailwindDetect.installed) {\n    console.warn(\n      `[theokit] @theokit/ui detected but @tailwindcss/vite is not installed. Run \\`pnpm add -D @tailwindcss/vite\\` to enable styling.`,\n    )\n    return []\n  }\n\n  // Explicit chain: @tailwindcss/vite FIRST + @theokit/ui/vite-plugin\n  // with `{ tailwind: false }` (avoids double-add of @tailwindcss/vite).\n  //\n  // Why resolve via filesystem then import by URL: this module runs from\n  // theokit's own dist/, so `await import('@tailwindcss/vite')` would\n  // try to resolve from theokit's node_modules — where the consumer's\n  // optional deps don't exist. Resolving from the consumer's cwd\n  // gives the correct path.\n  const tailwindUrl = resolveConsumerImport('@tailwindcss/vite', cwd)\n  if (!tailwindUrl) {\n    console.warn(\n      `[theokit] @tailwindcss/vite installed but its package entry was not resolvable from ${cwd}. Skipping auto-config.`,\n    )\n    return []\n  }\n  let tailwindMod: { default?: unknown }\n  let uiMod: { default?: unknown }\n  try {\n    tailwindMod = (await import(tailwindUrl)) as { default?: unknown }\n  } catch (err) {\n    console.warn(\n      `[theokit] @tailwindcss/vite dynamic import failed (${(err as Error).message}). Skipping auto-config.`,\n    )\n    return []\n  }\n  // For @theokit/ui/vite-plugin, resolve via package + subpath:\n  // node_modules/@theokit/ui/dist/vite-plugin.js\n  const uiPkgInstalled = detectPackage('@theokit/ui', cwd)\n  const uiPkgDir = uiPkgInstalled.resolvedPath\n    ? uiPkgInstalled.resolvedPath.replace(/[\\\\/]package\\.json$/, '')\n    : null\n  const uiPluginPath = uiPkgDir ? join(uiPkgDir, 'dist', 'vite-plugin.js') : null\n  if (!uiPluginPath || !existsSync(uiPluginPath)) {\n    console.warn(\n      `[theokit] @theokit/ui/vite-plugin entry not found at ${String(uiPluginPath)}. Skipping auto-config.`,\n    )\n    return []\n  }\n  try {\n    uiMod = (await import(pathToFileURL(uiPluginPath).href)) as { default?: unknown }\n  } catch (err) {\n    console.warn(\n      `[theokit] @theokit/ui/vite-plugin dynamic import failed (${(err as Error).message}). Skipping auto-config.`,\n    )\n    return []\n  }\n\n  if (typeof tailwindMod.default !== 'function') {\n    console.warn(\n      `[theokit] @tailwindcss/vite does not expose a default-export function. Skipping auto-config.`,\n    )\n    return []\n  }\n  if (typeof uiMod.default !== 'function') {\n    console.warn(\n      `[theokit] @theokit/ui/vite-plugin does not expose a default-export function. Skipping auto-config.`,\n    )\n    return []\n  }\n\n  let tailwindPlugin: unknown\n  let uiPlugin: unknown\n  try {\n    tailwindPlugin = (tailwindMod.default as () => unknown)()\n  } catch (err) {\n    console.warn(`[theokit] @tailwindcss/vite() threw: ${(err as Error).message}`)\n    return []\n  }\n  try {\n    // Pass { tailwind: false } so the UI plugin skips its internal\n    // @tailwindcss/vite chain (we already added it above).\n    uiPlugin = (uiMod.default as (opts?: { tailwind?: boolean }) => unknown)({\n      tailwind: false,\n    })\n  } catch (err) {\n    console.warn(`[theokit] @theokit/ui/vite-plugin() threw: ${(err as Error).message}`)\n    return []\n  }\n\n  const tailwindPlugins = normalizePluginReturn(tailwindPlugin)\n  if (tailwindPlugins === null) {\n    console.warn(`[theokit] @tailwindcss/vite returned unexpected shape. Skipping auto-config.`)\n    return []\n  }\n  const uiPlugins = normalizePluginReturn(uiPlugin)\n  if (uiPlugins === null) {\n    console.warn(\n      `[theokit] @theokit/ui/vite-plugin returned unexpected shape. Skipping auto-config.`,\n    )\n    return []\n  }\n\n  return [...tailwindPlugins, ...uiPlugins]\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Reads <projectRoot>/package.json + resolves the target package's own\n * package.json. Paths come from controlled CLI/config inputs; this is a\n * build-time tool, no HTTP.\n */\n/**\n * `detectPackage(name, cwd)` — generalized form of `theoui-detect.ts`.\n *\n * Used by T3.2 `integrateUseTheoUI` to gate auto-config on whether the\n * consumer has `@theokit/ui` AND `@tailwindcss/vite` installed.\n *\n * Algorithm (same as `theoui-detect.ts` but parameterized):\n *   1. Read `<cwd>/package.json`. Check `dependencies` / `devDependencies` /\n *      `peerDependencies` for the package name.\n *   2. If declared, probe `require.resolve('<name>/package.json', { paths: [cwd] })`.\n *      Read the resolved package.json to capture `version`.\n *   3. If resolution fails, fall back to probing common entrypoints (so\n *      packages whose `exports` doesn't include `./package.json` still\n *      detect).\n *\n * NEVER throws. Returns `{installed: false}` on any failure.\n */\n\nimport { existsSync, readFileSync } from 'node:fs'\nimport { dirname, join } from 'node:path'\n\nimport type { DetectResult } from './auto-detect-types.js'\n\n/**\n * D13 invariant (ADR 0021): @theokit/ui is ESM-only by design.\n * NÃO usar `createRequire(...).resolve()` — `ERR_PACKAGE_PATH_NOT_EXPORTED`\n * em runtime para packages que declaram `type:\"module\"` sem `require` condition.\n * Tudo filesystem walk direto.\n */\n\nfunction isDeclared(name: string, projectRoot: string): boolean {\n  try {\n    const raw = readFileSync(join(projectRoot, 'package.json'), 'utf-8')\n    const pkg = JSON.parse(raw) as {\n      dependencies?: Record<string, string>\n      devDependencies?: Record<string, string>\n      peerDependencies?: Record<string, string>\n    }\n    return Boolean(\n      pkg.dependencies?.[name] ?? pkg.devDependencies?.[name] ?? pkg.peerDependencies?.[name],\n    )\n  } catch {\n    return false\n  }\n}\n\n/**\n * D13: filesystem walk pra encontrar package.json (substitui require.resolve).\n * Walks node_modules up to 10 levels (handles pnpm hoist + workspace symlinks).\n */\nfunction resolvePackageJson(name: string, cwd: string): { path: string; version?: string } | null {\n  let dir = cwd\n  for (let depth = 0; depth < 10; depth++) {\n    const pkgJsonPath = join(dir, 'node_modules', ...name.split('/'), 'package.json')\n    if (existsSync(pkgJsonPath)) {\n      try {\n        const raw = readFileSync(pkgJsonPath, 'utf-8')\n        const pkg = JSON.parse(raw) as { name?: string; version?: string }\n        // Validate package name matches (defesa contra colisão path)\n        if (pkg.name === name) {\n          return { path: pkgJsonPath, version: pkg.version }\n        }\n      } catch {\n        // continue walking\n      }\n    }\n    const parent = dirname(dir)\n    if (parent === dir) break\n    dir = parent\n  }\n  return null\n}\n\n/**\n * D13: fallback probe via filesystem (substitui require.resolve).\n * Tenta common entry paths em node_modules. Retorna path do entry achado.\n */\nfunction fallbackProbe(name: string, cwd: string): { resolvedEntry: string } | null {\n  const candidates = ['index.mjs', 'dist/index.mjs', 'dist/index.js', 'index.js']\n  let dir = cwd\n  for (let depth = 0; depth < 10; depth++) {\n    const pkgDir = join(dir, 'node_modules', ...name.split('/'))\n    for (const candidate of candidates) {\n      const entry = join(pkgDir, candidate)\n      if (existsSync(entry)) return { resolvedEntry: entry }\n    }\n    const parent = dirname(dir)\n    if (parent === dir) break\n    dir = parent\n  }\n  return null\n}\n\n/** Walk up from a resolved entry path until we hit the package's own package.json\n *  whose `name` field matches `expectedName`. Returns null on any failure. */\nfunction findOwningPackageJson(\n  entry: string,\n  expectedName: string,\n): { path: string; version?: string } | null {\n  let dir = dirname(entry)\n  // Bound the walk to ~10 levels to avoid pathological cases.\n  for (let i = 0; i < 10; i++) {\n    const candidate = join(dir, 'package.json')\n    if (existsSync(candidate)) {\n      try {\n        const raw = readFileSync(candidate, 'utf-8')\n        const pkg = JSON.parse(raw) as { name?: string; version?: string }\n        if (pkg.name === expectedName) {\n          return { path: candidate, version: pkg.version }\n        }\n      } catch {\n        // ignore + continue walking\n      }\n    }\n    const parent = dirname(dir)\n    if (parent === dir) break\n    dir = parent\n  }\n  return null\n}\n\nexport function detectPackage(name: string, cwd: string): DetectResult {\n  if (!isDeclared(name, cwd)) {\n    return { installed: false }\n  }\n\n  const pkgJson = resolvePackageJson(name, cwd)\n  if (pkgJson) {\n    return {\n      installed: true,\n      version: pkgJson.version,\n      resolvedPath: pkgJson.path,\n    }\n  }\n\n  // Filesystem fallback: ESM-only packages (no `require` condition) can't\n  // be resolved by createRequire. Check node_modules directly. The walk\n  // upward handles pnpm hoist + workspace symlinks.\n  let dir = cwd\n  for (let i = 0; i < 10; i++) {\n    const nmPath = join(dir, 'node_modules', ...name.split('/'))\n    const nmPkgJson = join(nmPath, 'package.json')\n    if (existsSync(nmPkgJson)) {\n      try {\n        const raw = readFileSync(nmPkgJson, 'utf-8')\n        const pkg = JSON.parse(raw) as { name?: string; version?: string }\n        if (pkg.name === name) {\n          return { installed: true, version: pkg.version, resolvedPath: nmPkgJson }\n        }\n      } catch {\n        /* fall through to entry probe */\n      }\n      return { installed: true }\n    }\n    const parent = dirname(dir)\n    if (parent === dir) break\n    dir = parent\n  }\n\n  // Last-resort fallback — exports doesn't include ./package.json. Walk up from\n  // the resolved entry to find the package's own package.json.\n  const probe = fallbackProbe(name, cwd)\n  if (probe) {\n    const owning = findOwningPackageJson(probe.resolvedEntry, name)\n    if (owning) {\n      return { installed: true, version: owning.version, resolvedPath: owning.path }\n    }\n    return { installed: true }\n  }\n\n  return { installed: false }\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Resolves theokit's own install directory (the `node_modules/theokit/`).\n * Build-time tool. Read-only check. No HTTP input.\n */\nimport { existsSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\n/**\n * Resolve the directory that holds the framework's compiled (or source)\n * subpaths — `client/`, `server/`, `react-query/`, etc.\n *\n * Cases (regression T1.3):\n *   - Source mode (`src/vite-plugin/index.ts`) — `currentDir` is\n *     `…/src/vite-plugin`. Parent (`…/src`) contains `client/`. Return parent.\n *   - Dist mode (`dist/chunk-XYZ.js`) — `currentDir` is `…/dist`. That dir\n *     itself contains `client/`. Return currentDir.\n *   - Unknown shape — fall back to parent (legacy behavior). The dogfood\n *     validator will catch the misconfiguration before runtime.\n *\n * Pure function — no side effects, only filesystem reads via `existsSync`.\n * Exported so the regression test can exercise the branch logic directly.\n */\nexport function resolveTheoRootDir(currentDir: string): string {\n  if (existsSync(resolve(currentDir, 'client'))) {\n    return currentDir\n  }\n  return resolve(currentDir, '..')\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * transformIndexHtml extraction (T2.6 / M6). hasPackage probe reads\n * `node_modules/<name>` paths built from build-time projectRoot. No\n * HTTP input.\n */\nimport { existsSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport { injectDevtoolsScript } from './inject-devtools.js'\nimport { injectEntryClient } from './inject-entry-client.js'\nimport { injectStylesheets } from './inject-stylesheets.js'\n\nexport interface TransformHtmlCtx {\n  isDevMode: { value: boolean }\n  devtoolsEnabled: boolean\n  projectRoot: string\n}\n\n/**\n * Runs the 3-step HTML injection sequence in the canonical order:\n *   1. entry-client (always)\n *   2. devtools (dev only)\n *   3. stylesheets (dev only)\n * Order is part of the contract — devtools depends on entry-client\n * being present; stylesheets injection sits last so the <link>\n * follows the bundled <script>. EC-10 honored.\n */\nexport function runTransformIndexHtml(html: string, ctx: TransformHtmlCtx): string {\n  // 1. entry-client (always)\n  const entry = injectEntryClient(html)\n\n  if (entry.warning) console.warn(entry.warning)\n  let next = entry.html\n\n  // 2. devtools (dev only, respecting config.devtools = false)\n  const devtools = injectDevtoolsScript(next, {\n    isDev: ctx.isDevMode.value,\n    enabled: ctx.devtoolsEnabled,\n  })\n\n  if (devtools.warning) console.warn(devtools.warning)\n  next = devtools.html\n\n  // 3. Stylesheet link (dev only) — fixes LCP. Without the\n  // <link rel=\"stylesheet\">, CSS only loads after the JS bundle\n  // executes `import 'styles.css'`, causing FOUC + LCP > 9s.\n  // Production builds rely on Vite's SSR bundle for the\n  // correctly-hashed <link>. Font preload was tried + reverted\n  // (see inject-stylesheets.ts comment); CLS was hydration\n  // mismatch, not font swap.\n  const styles = injectStylesheets(next, {\n    isDev: ctx.isDevMode.value,\n    hasPackage: (name) => existsSync(resolve(ctx.projectRoot, 'node_modules', ...name.split('/'))),\n  })\n  next = styles.html\n\n  return next\n}\n","/**\n * T1.2 — Auto-inject the devtools entry `<script>` into served HTML (dev only).\n *\n * Origin: matches the inject-entry-client.ts pattern but for the devtools\n * module. In dev, the Vite plugin's transformIndexHtml hook calls this for\n * every served HTML. In build, this is a no-op.\n *\n * - EC-30: naive `.replace('</head>', ...)` IS used; alternative HTML parser\n *   is too heavy for the bug class (user putting `</head>` literal in inline\n *   JS is near-zero). Documented in known limitations.\n * - User opt-out via `config.devtools = false` is respected at the plugin\n *   level (this function is simply not called).\n *\n * NEVER use dangerouslySetInnerHTML in any devtools component — see plan EC-20.\n */\n\nexport const DEVTOOLS_VIRTUAL_ID = '/@theo/devtools/entry.js'\nexport const DEVTOOLS_RESOLVED_ID = '\\0@theo/devtools/entry.js'\n\nconst SCRIPT_TAG = `<script type=\"module\" src=\"${DEVTOOLS_VIRTUAL_ID}\"></script>`\n\nexport interface InjectDevtoolsResult {\n  html: string\n  injected: boolean\n  warning?: string\n}\n\nexport function injectDevtoolsScript(\n  html: string,\n  opts: { isDev: boolean; enabled?: boolean },\n): InjectDevtoolsResult {\n  // Build mode → no inject\n  if (!opts.isDev) return { html, injected: false }\n  // User opt-out via config.devtools = false\n  if (opts.enabled === false) return { html, injected: false }\n\n  // Already present (HMR re-run, user added manually) → idempotent\n  if (html.includes(DEVTOOLS_VIRTUAL_ID)) {\n    return { html, injected: false }\n  }\n\n  // Inject before </head> (case-insensitive, first occurrence)\n  const headClosePattern = /<\\/head\\s*>/i\n  if (headClosePattern.test(html)) {\n    return {\n      html: html.replace(headClosePattern, (match) => `    ${SCRIPT_TAG}\\n  ${match}`),\n      injected: true,\n    }\n  }\n\n  // No </head> tag — skip inject + warn (rather than corrupt the HTML)\n  return {\n    html,\n    injected: false,\n    warning:\n      'theokit devtools: index.html has no </head> tag; devtools script was NOT injected. Add <head>…</head> to your template to enable devtools.',\n  }\n}\n","/**\n * Auto-inject the entry-client `<script>` into served HTML.\n *\n * Origin: a real user (live session) wrote `index.html` without the\n * `<script type=\"module\" src=\"/@theo/entry-client\"></script>` tag. The\n * page rendered SSR perfectly but NO JS ran — every onClick was dead.\n * No error, no warning. An hour of debugging.\n *\n * Fix: the Vite plugin's `transformIndexHtml` hook runs this for every\n * served HTML. If the script is already present (by URL substring match\n * — handles every quoting/ordering variant) the HTML is returned\n * unchanged. Otherwise the script is inserted before `</body>`. If\n * there's no `</body>` at all (malformed HTML), the script is appended\n * at the end and we emit a console.warn in dev.\n */\n\nconst ENTRY_CLIENT_URL = '/@theo/entry-client'\nconst SCRIPT_TAG = `<script type=\"module\" src=\"${ENTRY_CLIENT_URL}\"></script>`\n\nexport interface InjectResult {\n  html: string\n  injected: boolean\n  warning?: string\n}\n\nexport function injectEntryClient(html: string): InjectResult {\n  // Detect via URL substring — robust against:\n  //   <script src='/@theo/entry-client'>\n  //   <script type=\"module\" src=\"/@theo/entry-client\" />\n  //   <link rel=\"modulepreload\" href=\"/@theo/entry-client\">\n  if (html.includes(ENTRY_CLIENT_URL)) {\n    return { html, injected: false }\n  }\n\n  // Inject before </body> (case-insensitive, first occurrence)\n  const bodyClosePattern = /<\\/body\\s*>/i\n  if (bodyClosePattern.test(html)) {\n    return {\n      html: html.replace(bodyClosePattern, (match) => `    ${SCRIPT_TAG}\\n  ${match}`),\n      injected: true,\n    }\n  }\n\n  // Malformed HTML — append at end and warn\n  return {\n    html: `${html}\\n${SCRIPT_TAG}`,\n    injected: true,\n    warning:\n      'theokit: index.html has no </body> tag; entry-client script was appended at end. Add <body>…</body> to your template.',\n  }\n}\n","/**\n * Inject `<link rel=\"stylesheet\">` tags into served HTML during DEV.\n *\n * Why this exists (real bug, 2026-05-22): the example chat app had an\n * LCP of 9-16s because the HTML response landed WITHOUT any `<link>` tag\n * for `@theokit/ui/styles.css`. CSS only loaded after entry-client.js\n * ran the layout import. Browser paint waited for the JS → CSS chain:\n *\n *   HTML arrives → browser paints nothing\n *   JS bundle arrives → React hydrates → encounters `import 'styles.css'`\n *   CSS arrives → browser RE-paints with styles\n *\n * Fix: emit the `<link>` in the HTML head so the browser fetches CSS in\n * PARALLEL with JS. LCP becomes time-to-CSS instead of time-to-JS-exec.\n *\n * DEV-only: in production builds, Vite's SSR pipeline emits the\n * appropriate `<link>` via its own asset manifest (with content hashes).\n * We must not double-inject there.\n */\n\ninterface StylesheetTarget {\n  /** Vite dev URL — what the browser hits */\n  href: string\n  /** node_modules path checked before injection */\n  packageRoot: string\n}\n\nconst TARGETS: StylesheetTarget[] = [\n  {\n    href: '/@id/@theokit/ui/styles.css',\n    packageRoot: '@theokit/ui',\n  },\n]\n\n/**\n * Note (2026-05-23): font preloads were briefly added here to address a\n * \"FOUT-looking\" CLS of 0.39 measured in DevTools. They turned out to\n * be a misdiagnosis — the real cause was a React hydration mismatch\n * from `<StaticRouterProvider hydrate>` emitting a `<script>` inside\n * the React tree (fixed in commit 31506d1).\n *\n * Why we don't preload fonts:\n *   - In dev, pnpm hoists @theokit/ui via `.pnpm/<hash>/...`. The CSS\n *     `@font-face` resolves to the real path; our preload would use the\n *     symlink path. Browser doesn't dedupe — preload is \"wasted\" and\n *     Chrome logs \"preloaded but not used within a few seconds\".\n *   - In prod, Vite's SSR bundle emits proper hashed preload metadata\n *     for fonts referenced from compiled CSS. Manual preload there\n *     would conflict.\n *\n * If a future regression brings back font-related CLS, the right path\n * is `font-display: optional` (no swap) or size-adjust metric matching\n * in @theokit/ui itself — not framework-side preload.\n */\n\nexport interface InjectStylesheetsResult {\n  html: string\n  injected: string[]\n}\n\nexport interface InjectStylesheetsOptions {\n  /** Only inject in dev (default). Skip when building for production. */\n  isDev: boolean\n  /** Function that checks whether a package is installed at projectRoot. */\n  hasPackage(name: string): boolean\n}\n\nexport function injectStylesheets(\n  html: string,\n  opts: InjectStylesheetsOptions,\n): InjectStylesheetsResult {\n  if (!opts.isDev) return { html, injected: [] }\n\n  const tagsToInject: string[] = []\n  for (const target of TARGETS) {\n    if (!opts.hasPackage(target.packageRoot)) continue\n    // Idempotency: skip if href already present\n    if (html.includes(target.href)) continue\n    tagsToInject.push(`<link rel=\"stylesheet\" href=\"${target.href}\" />`)\n  }\n\n  if (tagsToInject.length === 0) return { html, injected: [] }\n\n  const joined = tagsToInject.join('\\n    ')\n  // Inject before </head>; fall back to start of <body> if no head close.\n  const headClosePattern = /<\\/head\\s*>/i\n  if (headClosePattern.test(html)) {\n    return {\n      html: html.replace(headClosePattern, (match) => `    ${joined}\\n  ${match}`),\n      injected: tagsToInject,\n    }\n  }\n\n  const bodyOpenPattern = /<body[^>]*>/i\n  if (bodyOpenPattern.test(html)) {\n    return {\n      html: html.replace(bodyOpenPattern, (match) => `${match}\\n    ${joined}`),\n      injected: tagsToInject,\n    }\n  }\n\n  // Malformed HTML — prepend and trust the browser\n  return { html: `${joined}\\n${html}`, injected: tagsToInject }\n}\n","export interface EntryServerOptions {\n  /** When true, emit a streaming entry using onShellReady + signal cleanup.\n   *  When false (default), emit the legacy single-shot onAllReady entry. */\n  streaming?: boolean\n  /**\n   * TheoUI config — when present, the SSR React tree wraps StaticRouterProvider\n   * in <TheoUIProvider> + <Suspense> to MATCH the client entry exactly. Without\n   * this, hydration falls back silently because the trees differ — button\n   * onClick handlers never get attached and the page looks dead.\n   *\n   * EC-2 (CSS): the SSR entry never imports CSS. Only the React tree is\n   * mirrored — the CSS stays client-only.\n   */\n  theoUi?: { theme?: 'violet-forge' | 'noir' | 'paper' }\n}\n\nexport function generateEntryServer(options: EntryServerOptions = {}): string {\n  if (options.streaming) {\n    return generateStreamingEntry(options)\n  }\n  return generateSingleShotEntry(options)\n}\n\n/**\n * Build the React element tree the server renders. Must mirror the client\n * tree shape from `generateEntryClient` — same wrapper components, same\n * order — or hydration silently falls back to client-only render.\n */\nfunction buildAppTreeJs(options: EntryServerOptions): string {\n  const theme = options.theoUi?.theme ?? 'violet-forge'\n  // T4.1 — pass options.nonce to StaticRouterProvider so its internal\n  // hydration data script (`<script>window.__staticRouterHydrationData\n  // = ...</script>`) carries the nonce attribute. Without this, CSP\n  // enforce mode (without 'unsafe-inline') blocks the hydration script\n  // → React falls back to client-only render → button onClick handlers\n  // never attach → page looks dead. The nonce option to\n  // renderToPipeableStream covers React-emitted scripts but NOT the\n  // hydration script which is emitted by react-router itself.\n  // hydrate: false — CRITICAL fix for hydration mismatch.\n  //\n  // StaticRouterProvider with `hydrate: true` (default) emits\n  // `<script>window.__staticRouterHydrationData = ...</script>` INSIDE\n  // the React tree. The client's `<RouterProvider>` does NOT emit any\n  // script. React's reconciler sees server={...stuff, <script>} vs\n  // client={...stuff} and DISCARDS the entire server tree, regenerating\n  // from scratch on the client. That regeneration causes a massive\n  // layout shift (CLS 0.39 measured in the example).\n  //\n  // Fix: tell StaticRouterProvider to NOT emit the script. The framework\n  // emits the hydration data as a separate `<script>` in the HTML\n  // template (outside #root), via the `hydrationData` returned from\n  // `render()`. The script still runs BEFORE entry-client.js, so\n  // window.__staticRouterHydrationData is populated when\n  // createBrowserRouter reads it.\n  if (options.theoUi) {\n    return [\n      `React.createElement(TheoUIProvider, { theme: { defaultTheme: '${theme}' } },`,\n      `      React.createElement(Suspense, { fallback: null },`,\n      `        React.createElement(StaticRouterProvider, { router, context, hydrate: false })`,\n      `      )`,\n      `    )`,\n    ].join('\\n')\n  }\n  return `React.createElement(Suspense, { fallback: null },\\n      React.createElement(StaticRouterProvider, { router, context, hydrate: false })\\n    )`\n}\n\n/**\n * Generate the hydration data extraction snippet. Reads\n * loaderData/actionData/errors from the StaticHandlerContext and returns\n * them as an object the framework can serialize into a `<script>` tag.\n */\nfunction hydrationDataExtractSnippet(): string {\n  return [\n    `    const hydrationData = {`,\n    `      loaderData: context.loaderData,`,\n    `      actionData: context.actionData,`,\n    `      errors: context.errors,`,\n    `    }`,\n  ].join('\\n')\n}\n\nfunction generateSingleShotEntry(options: EntryServerOptions): string {\n  const theoUiImport = options.theoUi ? `import { TheoUIProvider } from '@theokit/ui'\\n` : ''\n  const appTree = buildAppTreeJs(options)\n  return [\n    `import React, { Suspense } from 'react'`,\n    `import { renderToPipeableStream } from 'react-dom/server'`,\n    `import { createStaticHandler, createStaticRouter, StaticRouterProvider } from 'react-router'`,\n    `import { PassThrough } from 'node:stream'`,\n    `import { routes } from '/@theo/route-manifest'`,\n    theoUiImport,\n    `export async function render(url, options = {}) {`,\n    `  const handler = createStaticHandler(routes)`,\n    `  const request = new Request('http://localhost' + url)`,\n    `  const context = await handler.query(request)`,\n    ``,\n    `  if (context instanceof Response) {`,\n    `    return { redirect: context }`,\n    `  }`,\n    ``,\n    `  const router = createStaticRouter(handler.dataRoutes, context)`,\n    `  const app = ${appTree}`,\n    ``,\n    hydrationDataExtractSnippet(),\n    ``,\n    `  return new Promise((resolve, reject) => {`,\n    `    let html = ''`,\n    `    let piped = false`,\n    `    const passthrough = new PassThrough()`,\n    `    passthrough.on('data', (chunk) => { html += chunk.toString() })`,\n    `    passthrough.on('end', () => { resolve({ html, hydrationData }) })`,\n    `    passthrough.on('error', reject)`,\n    ``,\n    `    // Pipe on onShellReady (Next.js pattern). Calling pipe() twice`,\n    `    // throws \"React currently only supports piping to one writable`,\n    `    // stream\". The \\`piped\\` flag is a belt-and-suspenders guard if`,\n    `    // onShellReady fires unexpectedly more than once.`,\n    `    // Forward options.nonce to React so every <script> tag React`,\n    `    // emits (Suspense boundary scripts) carries the nonce attribute.`,\n    `    const { pipe } = renderToPipeableStream(app, {`,\n    `      nonce: options.nonce,`,\n    `      onShellReady() { if (!piped) { piped = true; pipe(passthrough) } },`,\n    `      onShellError(err) { reject(err) },`,\n    `      onError(err) { console.error('[SSR Error]', err) },`,\n    `    })`,\n    `  })`,\n    `}`,\n  ].join('\\n')\n}\n\n// Generated-code fragments — extracted so the parent emitter stays under\n// the max-lines-per-function ceiling.\nfunction streamingWebRenderer(appTree: string): string[] {\n  return [\n    `// T2.3 — Web Standards streaming entry for edge runtimes (Cloudflare,`,\n    `// Bun, Deno, Vercel Edge). Uses renderToReadableStream and returns a`,\n    `// Response with the stream as body. Honors request.signal for client`,\n    `// disconnect cleanup.`,\n    `export async function renderStreamingWeb(request, options = {}) {`,\n    `  const handler = createStaticHandler(routes)`,\n    `  const url = new URL(request.url)`,\n    `  const context = await handler.query(request)`,\n    ``,\n    `  if (context instanceof Response) {`,\n    `    return context`,\n    `  }`,\n    ``,\n    `  const router = createStaticRouter(handler.dataRoutes, context)`,\n    `  const app = ${appTree}`,\n    ``,\n    `  const stream = await renderToReadableStream(app, {`,\n    `    signal: request.signal,`,\n    `    nonce: options.nonce,`,\n    `    onError(err) { console.error('[SSR Web Stream Error]', err) },`,\n    `  })`,\n    `  return new Response(stream, {`,\n    `    status: 200,`,\n    `    headers: {`,\n    `      'Content-Type': 'text/html; charset=utf-8',`,\n    `      'Transfer-Encoding': 'chunked',`,\n    `    },`,\n    `  })`,\n    `}`,\n  ]\n}\n\nfunction streamingNodeRenderer(appTree: string): string[] {\n  return [\n    `// T6.1 — Node streaming SSR entry (opt-in via theo.config.ts > ssrStreaming: true)`,\n    `// Flushes the shell as soon as it's ready, then streams Suspense boundaries.`,\n    `// EC-11: respects request.signal for client-disconnect cleanup.`,\n    `export async function renderStreaming(url, response, options = {}) {`,\n    `  const handler = createStaticHandler(routes)`,\n    `  const request = new Request('http://localhost' + url, { signal: options.signal })`,\n    `  const context = await handler.query(request)`,\n    ``,\n    `  if (context instanceof Response) {`,\n    `    return { redirect: context }`,\n    `  }`,\n    ``,\n    `  const router = createStaticRouter(handler.dataRoutes, context)`,\n    `  const app = ${appTree}`,\n    ``,\n    `  return new Promise((resolve, reject) => {`,\n    `    let didError = false`,\n    `    const stream = renderToPipeableStream(app, {`,\n    `      nonce: options.nonce,`,\n    `      onShellReady() {`,\n    `        response.statusCode = didError ? 500 : 200`,\n    `        response.setHeader('Content-Type', 'text/html; charset=utf-8')`,\n    `        response.setHeader('Transfer-Encoding', 'chunked')`,\n    `        stream.pipe(response)`,\n    `        resolve({ streaming: true })`,\n    `      },`,\n    `      onShellError(err) { reject(err) },`,\n    `      onError(err) {`,\n    `        didError = true`,\n    `        console.error('[SSR Stream Error]', err)`,\n    `      },`,\n    `    })`,\n    ``,\n    `    // EC-11: client disconnect cleanup`,\n    `    if (options.signal) {`,\n    `      options.signal.addEventListener('abort', () => { stream.abort() })`,\n    `    }`,\n    `  })`,\n    `}`,\n  ]\n}\n\nfunction backCompatRenderer(appTree: string): string[] {\n  return [\n    `// Backward compatibility: keep the single-shot render export available so`,\n    `// callers that always used 'render()' don't break when streaming is on.`,\n    `export async function render(url, options = {}) {`,\n    `  const handler = createStaticHandler(routes)`,\n    `  const request = new Request('http://localhost' + url)`,\n    `  const context = await handler.query(request)`,\n    ``,\n    `  if (context instanceof Response) {`,\n    `    return { redirect: context }`,\n    `  }`,\n    ``,\n    `  const router = createStaticRouter(handler.dataRoutes, context)`,\n    `  const app = ${appTree}`,\n    ``,\n    hydrationDataExtractSnippet(),\n    ``,\n    `  const { PassThrough } = await import('node:stream')`,\n    `  return new Promise((resolve, reject) => {`,\n    `    let html = ''`,\n    `    let piped = false`,\n    `    const passthrough = new PassThrough()`,\n    `    passthrough.on('data', (chunk) => { html += chunk.toString() })`,\n    `    passthrough.on('end', () => { resolve({ html, hydrationData }) })`,\n    `    passthrough.on('error', reject)`,\n    ``,\n    `    // Pipe on onShellReady (Next.js pattern). nonce forwarded.`,\n    `    const { pipe } = renderToPipeableStream(app, {`,\n    `      nonce: options.nonce,`,\n    `      onShellReady() { if (!piped) { piped = true; pipe(passthrough) } },`,\n    `      onShellError(err) { reject(err) },`,\n    `      onError(err) { console.error('[SSR Error]', err) },`,\n    `    })`,\n    `  })`,\n    `}`,\n  ]\n}\n\nfunction generateStreamingEntry(options: EntryServerOptions): string {\n  const theoUiImport = options.theoUi ? `import { TheoUIProvider } from '@theokit/ui'\\n` : ''\n  const appTree = buildAppTreeJs(options)\n  return [\n    `import React, { Suspense } from 'react'`,\n    `import { renderToPipeableStream, renderToReadableStream } from 'react-dom/server'`,\n    `import { createStaticHandler, createStaticRouter, StaticRouterProvider } from 'react-router'`,\n    `import { routes } from '/@theo/route-manifest'`,\n    theoUiImport,\n    ``,\n    ...streamingWebRenderer(appTree),\n    ``,\n    ...streamingNodeRenderer(appTree),\n    ``,\n    ...backCompatRenderer(appTree),\n  ].join('\\n')\n}\n","export interface EntryClientOptions {\n  theoUi?: {\n    fonts?: 'bundled' | 'cdn'\n    theme?: 'violet-forge' | 'noir' | 'paper'\n  }\n}\n\nexport function generateEntryClient(ssr?: boolean, opts: EntryClientOptions = {}): string {\n  const rootMethod = ssr ? 'hydrateRoot' : 'createRoot'\n\n  // T2.2 — TheoUI CSS imports (client-only; EC-2: NEVER in entry-server)\n  // T2.3 — Wrap RouterProvider in <TheoUIProvider>\n  const theoUiImports: string[] = []\n  if (opts.theoUi) {\n    theoUiImports.push(\n      `// T2.2 — TheoUI CSS auto-injected (config.ui)`,\n      `import '@theokit/ui/styles.css'`,\n    )\n    const fontsModule = opts.theoUi.fonts === 'cdn' ? 'fonts-cdn.css' : 'fonts.css'\n    theoUiImports.push(\n      `import '@theokit/ui/${fontsModule}'`,\n      `// T2.3 — TheoUIProvider auto-wraps RouterProvider`,\n      `import { TheoUIProvider } from '@theokit/ui'`,\n    )\n  }\n\n  const theme = opts.theoUi?.theme ?? 'violet-forge'\n  // Build the React tree: when theoUi enabled, RouterProvider sits inside\n  // TheoUIProvider; otherwise RouterProvider is the top-level child.\n  const routerTree = opts.theoUi\n    ? `React.createElement(TheoUIProvider, { theme: { defaultTheme: '${theme}' } },\\n      React.createElement(Suspense, { fallback: null },\\n        React.createElement(RouterProvider, { router })\\n      )\\n    )`\n    : `React.createElement(Suspense, { fallback: null },\\n      React.createElement(RouterProvider, { router })\\n    )`\n\n  const renderCall = ssr\n    ? `  ${rootMethod}(el,\\n    ${routerTree}\\n  )`\n    : `  ${rootMethod}(el).render(\\n    ${routerTree}\\n  )`\n\n  // SSR hydration: <StaticRouterProvider hydrate> emits\n  // `<script>window.__staticRouterHydrationData = …</script>` into the\n  // server HTML. The browser router MUST receive this so it continues\n  // from the server's state instead of re-fetching everything.\n  //\n  // Without `hydrationData`, `createBrowserRouter` boots from scratch,\n  // React detects a DOM mismatch with the SSR-rendered HTML, and\n  // hydration silently falls back to client-only render — every\n  // `onClick` handler attached during hydration is lost. The page\n  // looks fine but is \"dead HTML\".\n  const hydrationLine = ssr\n    ? `const router = createBrowserRouter(routes, { hydrationData: window.__staticRouterHydrationData })`\n    : `const router = createBrowserRouter(routes)`\n\n  // Phase 4 — Code-splitting + matchRoutes safeguard (EC-3).\n  //\n  // SSR mode: pages are React.lazy()-wrapped in the manifest. If we render\n  // before the matched route's module is loaded, React.lazy throws a\n  // promise, the outer Suspense fires its fallback (null), and the SSR\n  // DOM is wiped before hydration → onClick handlers die.\n  //\n  // The fix:\n  //   1. matchRoutes(routes, location.pathname) on the client to discover\n  //      which routes actually render at this URL. Using the client matcher\n  //      (not a server hint) avoids URL-drift races: SSR may have prepared\n  //      /foo while a browser auto-redirect now points at /bar.\n  //   2. Look up each matched route's path in __theoPreloadMap and call\n  //      the import() factory. Browsers cache modules by URL — when\n  //      React.lazy fires its own import() during render, it gets the\n  //      cached promise instantly.\n  //   3. Promise.all with a 1500ms timeout. On slow networks we'd rather\n  //      lose hydration on ONE request than hang the page forever. The\n  //      fallback path proceeds to hydrate anyway — React.lazy will then\n  //      Suspense its fallback as usual.\n  const preloadBlock = ssr\n    ? [\n        `// Phase 4 — preload matched-route modules before hydrate (EC-3 safeguard)`,\n        `const __theoMatches = matchRoutes(routes, window.location.pathname) ?? []`,\n        `const __theoPreloadPaths = __theoMatches`,\n        `  .map((m) => m.route && (m.route).path)`,\n        `  .filter((p) => typeof p === 'string' && p in __theoPreloadMap)`,\n        `const __theoPreloadPromise = Promise.all(`,\n        `  __theoPreloadPaths.map((p) => __theoPreloadMap[p]().catch((err) => { console.error('[theo] preload failed', p, err); return null }))`,\n        `)`,\n        `const __theoTimeout = new Promise((resolve) => setTimeout(() => resolve('timeout'), 1500))`,\n        `await Promise.race([__theoPreloadPromise, __theoTimeout])`,\n        '',\n      ]\n    : []\n\n  // The hydrate/render call needs to live inside an async IIFE when we\n  // await preloads. In CSR-only mode we keep the existing synchronous\n  // block for backward compat.\n  const renderBlock = ssr\n    ? [\n        `if (el) {`,\n        `  ;(async () => {`,\n        ...preloadBlock.map((l) => '    ' + l),\n        renderCall,\n        `  })()`,\n        `}`,\n      ]\n    : [`if (el) {`, renderCall, `}`]\n\n  const manifestImports = ssr\n    ? `import { routes, __theoPreloadMap } from '/@theo/route-manifest'`\n    : `import { routes } from '/@theo/route-manifest'`\n\n  const reactRouterImports = ssr\n    ? `import { createBrowserRouter, RouterProvider, matchRoutes } from 'react-router'`\n    : `import { createBrowserRouter, RouterProvider } from 'react-router'`\n\n  return [\n    `import React, { Suspense } from 'react'`,\n    `import { ${rootMethod} } from 'react-dom/client'`,\n    reactRouterImports,\n    manifestImports,\n    `// T1.3 — side-effect import sets globalThis.__THEO_TRANSFORMER__ for theoFetch`,\n    `import '/@theo/runtime-config'`,\n    ...theoUiImports,\n    ``,\n    hydrationLine,\n    `const el = document.getElementById('root')`,\n    ...renderBlock,\n  ].join('\\n')\n}\n","import type { RouteNode } from './types.js'\n\nfunction normalizePath(p: string): string {\n  return p.replace(/\\\\/g, '/')\n}\n\nfunction safeVarName(segment: string, prefix: string): string {\n  const safe = segment.replace(/[^a-zA-Z0-9]/g, '_') || 'root'\n  return `${prefix}_${safe}`\n}\n\n/**\n * Map a route node to its react-router path segment. Dynamic `[slug]` →\n * `:slug`; catch-all `[...slug]` → `*` (react-router splat — param read via\n * `params['*']`); static segments pass through unchanged. (T2.2 — the page\n * router uses react-router's own matcher, NOT the server regex; see plan D3.)\n */\nfunction segmentPath(node: RouteNode): string {\n  if (node.dynamic?.catchAll) return '*'\n  if (node.dynamic) return `:${node.dynamic.paramName}`\n  return node.segment\n}\n\ninterface ImportEntry {\n  varName: string\n  importPath: string\n}\n\n/**\n * Build the absolute route path for a node by accumulating segments from\n * the root. Used to key the preload map exactly as react-router's\n * `matchRoutes` reports `match.route.path`.\n */\nfunction buildRoutePath(parents: string[], segment: string): string {\n  const joined = [...parents, segment].filter(Boolean).join('/')\n  return '/' + joined\n}\n\ninterface WalkAccumulator {\n  staticImports: ImportEntry[]\n  lazyPages: { varName: string; importPath: string; routePath: string }[]\n  layoutState: { found: boolean }\n}\n\nfunction pushIf(staticImports: ImportEntry[], filePath: string | undefined, varName: string): void {\n  if (filePath !== undefined) {\n    staticImports.push({ varName, importPath: normalizePath(filePath) })\n  }\n}\n\nfunction walkRouteTree(node: RouteNode, parents: string[], acc: WalkAccumulator): void {\n  const seg = node.segment || 'root'\n  const routePath = buildRoutePath(parents, segmentPath(node))\n\n  if (node.page !== undefined) {\n    acc.lazyPages.push({\n      varName: safeVarName(seg, 'Page'),\n      importPath: normalizePath(node.page),\n      routePath,\n    })\n  }\n  if (node.layout !== undefined) acc.layoutState.found = true\n  pushIf(acc.staticImports, node.layout, safeVarName(seg, 'Layout'))\n  pushIf(acc.staticImports, node.error, safeVarName(seg, 'Error'))\n  pushIf(acc.staticImports, node.loading, safeVarName(seg, 'Loading'))\n  pushIf(acc.staticImports, node.notFound, safeVarName(seg, 'NotFound'))\n  for (const child of node.children) {\n    const childSegPath = segmentPath(node)\n    const nextParents = childSegPath ? [...parents, childSegPath] : parents\n    walkRouteTree(child, nextParents, acc)\n  }\n}\n\nexport function generateRouteManifest(tree: RouteNode): string {\n  // Static imports (always-needed at boot): layouts, errors, loading, not-found.\n  // Lazy-loaded pages — tracked separately so we emit React.lazy() and\n  // build the preload map.\n  const acc: WalkAccumulator = {\n    staticImports: [],\n    lazyPages: [],\n    layoutState: { found: false },\n  }\n  walkRouteTree(tree, [], acc)\n  const staticImports = acc.staticImports\n  const lazyPages = acc.lazyPages\n  const layoutState = acc.layoutState\n\n  // Phase 4 — Code-splitting + matchRoutes safeguard (EC-3).\n  // PAGES are lazy. LAYOUTS / ERROR / LOADING / NOT-FOUND stay static\n  // because they're always needed at boot regardless of route.\n  // The preload map exposes the same `import()` calls keyed by absolute\n  // route path. The entry-client re-matches `routes` against\n  // `location.pathname` and awaits the matched entries BEFORE\n  // `hydrateRoot`, so React.lazy modules resolve from cache and no\n  // Suspense fallback fires during hydration.\n  const lines: string[] = [`import React, { Suspense } from 'react'`]\n\n  if (layoutState.found) {\n    lines.push(`import { Outlet } from 'react-router'`)\n  }\n\n  lines.push('')\n\n  // Static imports first\n  for (const imp of staticImports) {\n    lines.push(`import ${imp.varName} from '${imp.importPath}'`)\n  }\n\n  // Lazy-loaded pages\n  for (const lp of lazyPages) {\n    lines.push(`const ${lp.varName} = React.lazy(() => import('${lp.importPath}'))`)\n  }\n\n  lines.push('')\n\n  // Preload map — keys are absolute route paths, values are factories that\n  // return the same import() the lazy() above resolves. Browsers cache the\n  // module by URL so the preload + lazy() share a single promise.\n  const preloadEntries = lazyPages.map(\n    (lp) => `  '${lp.routePath}': () => import('${lp.importPath}'),`,\n  )\n  // No TS type annotation — this manifest is emitted as a virtual JS module\n  // and Rollup rejects type annotations in production builds.\n  lines.push('export const __theoPreloadMap = {')\n  for (const e of preloadEntries) lines.push(e)\n  lines.push('}', '')\n\n  // Build the children-array string for one node, separately from the\n  // wrapping logic — keeps `genRouteConfig` under the complexity ceiling.\n  function buildChildrenArray(node: RouteNode, seg: string): string {\n    const childConfigs: string[] = []\n\n    // Index route for this node's page — wrap in Suspense (the lazy module\n    // is preloaded on initial hydrate, so this fallback never fires there;\n    // it covers client-side navigation to other routes too).\n    if (node.page) {\n      const pageVar = safeVarName(seg, 'Page')\n      const fallbackEl = node.loading\n        ? `React.createElement(${safeVarName(seg, 'Loading')})`\n        : 'null'\n      const pageElement = `React.createElement(Suspense, { fallback: ${fallbackEl} }, React.createElement(${pageVar}))`\n      childConfigs.push(`{ index: true, element: ${pageElement} }`)\n    }\n\n    // Child routes\n    for (const child of node.children) {\n      childConfigs.push(genRouteConfig(child, false))\n    }\n\n    // Not-found wildcard (only at this level)\n    if (node.notFound) {\n      const nfVar = safeVarName(seg, 'NotFound')\n      childConfigs.push(`{ path: '*', element: React.createElement(${nfVar}) }`)\n    }\n\n    let arr = `[${childConfigs.join(', ')}]`\n    if (node.error) {\n      const errVar = safeVarName(seg, 'Error')\n      arr = `[{ errorElement: React.createElement(${errVar}), children: ${arr} }]`\n    }\n    return arr\n  }\n\n  // Generate route config\n  function genRouteConfig(node: RouteNode, isRoot: boolean): string {\n    const seg = node.segment || 'root'\n    const childrenArray = buildChildrenArray(node, seg)\n\n    // Build route object\n    if (node.layout) {\n      const layoutVar = safeVarName(seg, 'Layout')\n      const pathPart = isRoot ? `path: '/'` : `path: '${segmentPath(node)}'`\n      // Layout receives `<Outlet />` as `children` prop. This supports BOTH\n      // conventions: Next.js-style layouts that render `{children}` AND\n      // layouts that call `<Outlet />` directly (the prop is the same element,\n      // ignored by the latter). Without this, Next.js-style templates render\n      // empty because react-router does not pass a `children` prop by default.\n      return `{ ${pathPart}, element: React.createElement(${layoutVar}, { children: React.createElement(Outlet) }), children: ${childrenArray} }`\n    }\n\n    // No layout — if root, wrap in path '/'\n    if (isRoot) {\n      if (node.children.length === 0 && !node.page && !node.notFound && !node.error) {\n        return `{ path: '/', children: [] }`\n      }\n      // Root without layout: children are direct routes\n      return `{ path: '/', children: ${childrenArray} }`\n    }\n\n    // Child segment without layout — just a route\n    if (node.page && node.children.length === 0 && !node.error && !node.notFound) {\n      const pageVar = safeVarName(seg, 'Page')\n      const fallbackEl = node.loading\n        ? `React.createElement(${safeVarName(seg, 'Loading')})`\n        : 'null'\n      const pageElement = `React.createElement(Suspense, { fallback: ${fallbackEl} }, React.createElement(${pageVar}))`\n      return `{ path: '${segmentPath(node)}', element: ${pageElement} }`\n    }\n\n    // Child with children but no layout\n    return `{ path: '${segmentPath(node)}', children: ${childrenArray} }`\n  }\n\n  const routeConfig = genRouteConfig(tree, true)\n  lines.push(`export const routes = [${routeConfig}]`)\n\n  return lines.join('\\n')\n}\n","/**\n * Virtual modules resolveId + load extraction (T2.6 / M6).\n *\n * Pure structural split — every branch identity preserved from the\n * original inline body in `theoPlugin()`. The dispatcher is purely\n * synchronous; effects (broadcast, transformer wiring) keep their\n * original ordering so EC-10 (Vite hook ordering side effects) is\n * honored.\n */\n\nimport { broadcastRouteManifest } from '../devtools/server-side/route-manifest.js'\nimport { generateEntryServer } from '../router/entry-server.js'\nimport { generateEntryClient } from '../router/entry.js'\nimport { generateRouteManifest } from '../router/generate.js'\nimport { scanRoutes } from '../router/scan.js'\nimport type { TheoTransformer } from '../server/transformer.js'\n\nimport { DEVTOOLS_RESOLVED_ID, DEVTOOLS_VIRTUAL_ID } from './inject-devtools.js'\nimport type { TheoUiDetectResult } from './theoui-detect.js'\n\nexport interface VirtualModuleIds {\n  VIRTUAL_ENTRY_ID: string\n  RESOLVED_ENTRY_ID: string\n  VIRTUAL_MANIFEST_ID: string\n  RESOLVED_MANIFEST_ID: string\n  VIRTUAL_ENTRY_SERVER_ID: string\n  RESOLVED_ENTRY_SERVER_ID: string\n  VIRTUAL_RUNTIME_CONFIG_ID: string\n  RESOLVED_RUNTIME_CONFIG_ID: string\n}\n\nexport interface VirtualModulesCtx {\n  ids: VirtualModuleIds\n  appDir: string\n  ssrEnabled: boolean\n  streamingEnabled: boolean\n  theoUi: TheoUiDetectResult | undefined\n  transformer: TheoTransformer | undefined\n}\n\nexport function resolveVirtualModuleId(id: string, ids: VirtualModuleIds): string | undefined {\n  if (id === ids.VIRTUAL_ENTRY_ID) return ids.RESOLVED_ENTRY_ID\n  if (id === ids.VIRTUAL_MANIFEST_ID) return ids.RESOLVED_MANIFEST_ID\n  if (id === ids.VIRTUAL_ENTRY_SERVER_ID) return ids.RESOLVED_ENTRY_SERVER_ID\n  if (id === ids.VIRTUAL_RUNTIME_CONFIG_ID) return ids.RESOLVED_RUNTIME_CONFIG_ID\n  // T1.2 — devtools virtual module. Only resolves in dev; build mode\n  // never serves it because transformIndexHtml never injects the tag.\n  if (id === DEVTOOLS_VIRTUAL_ID) return DEVTOOLS_RESOLVED_ID\n  return undefined\n}\n\nexport function loadVirtualModule(id: string, ctx: VirtualModulesCtx): string | undefined {\n  if (id === ctx.ids.RESOLVED_ENTRY_ID) {\n    return generateEntryClient(ctx.ssrEnabled, {\n      theoUi: ctx.theoUi?.enabled\n        ? { fonts: ctx.theoUi.config.fonts, theme: ctx.theoUi.config.theme }\n        : undefined,\n    })\n  }\n  if (id === ctx.ids.RESOLVED_MANIFEST_ID) {\n    const tree = scanRoutes(ctx.appDir)\n    // T3.1 — also broadcast a devtools-shaped manifest to the overlay\n    // (no-op in prod / when no dev server is attached).\n    broadcastRouteManifest(tree)\n    return generateRouteManifest(tree)\n  }\n  if (id === ctx.ids.RESOLVED_ENTRY_SERVER_ID) {\n    // SSR tree MUST mirror client tree shape — pass theoUi through so\n    // <TheoUIProvider> wraps in both. Without this, React detects a\n    // hydration mismatch and silently falls back to client-only\n    // render — onClick handlers never get attached.\n    return generateEntryServer({\n      streaming: ctx.streamingEnabled,\n      theoUi: ctx.theoUi?.enabled ? { theme: ctx.theoUi.config.theme } : undefined,\n    })\n  }\n  if (id === ctx.ids.RESOLVED_RUNTIME_CONFIG_ID) {\n    // T1.3 — set globalThis.__THEO_TRANSFORMER__ so theoFetch picks it up\n    const tName = ctx.transformer?.name ?? 'json'\n    return [\n      `// Generated by Theo Vite plugin`,\n      `;(globalThis).__THEO_TRANSFORMER__ = ${JSON.stringify(tName)}`,\n      `export const TRANSFORMER_NAME = ${JSON.stringify(tName)}`,\n    ].join('\\n')\n  }\n  if (id === DEVTOOLS_RESOLVED_ID) {\n    // T1.2 — virtual module re-exports the real entry from theokit's devtools subpath.\n    return [\n      `// Theo devtools — virtual entry (DEV only)`,\n      `import('theokit/devtools/entry').catch((e) => console.error('[theo devtools] mount failed', e))`,\n    ].join('\\n')\n  }\n  return undefined\n}\n","/**\n * T3.1 — Vite integration extension API (`defineTheoIntegration`).\n *\n * Build-time extension system (mirrors Astro Integrations). Lets third\n * parties hook into Theo's Vite lifecycle without forking the plugin.\n *\n * Strictly separated from runtime `defineTheoPlugin` (Phase 4) — different\n * concerns, different surfaces. See ADR D7 in the plan.\n */\n\nexport type HookName =\n  | 'theo:config:setup'\n  | 'theo:build:start'\n  | 'theo:build:done'\n  | 'theo:dev:start'\n\nexport interface HookContext {\n  addVirtualModule?: (id: string, code: string) => void\n  addRoute?: (path: string, handler: RouteHandler) => void\n  [key: string]: unknown\n}\n\nexport type Hook = (ctx: HookContext) => void | Promise<void>\n\nexport type RouteHandler = (request: Request) => Response | Promise<Response>\n\nexport interface TheoIntegration {\n  name: string\n  hooks: Partial<Record<HookName, Hook>>\n}\n\n/**\n * Identity factory for type-checking against TheoIntegration shape.\n */\nexport function defineTheoIntegration(integration: TheoIntegration): TheoIntegration {\n  return integration\n}\n\nexport class IntegrationVirtualModulePrefixError extends Error {\n  constructor(integrationName: string, id: string) {\n    super(\n      `Integration \"${integrationName}\" tried to addVirtualModule(\"${id}\"). ` +\n        `Virtual module IDs must start with \"virtual:integration:${integrationName}/\" ` +\n        `to avoid collisions with Theo internals or other integrations.`,\n    )\n    this.name = 'IntegrationVirtualModulePrefixError'\n  }\n}\n\nexport class IntegrationRouteCollisionError extends Error {\n  constructor(integrationName: string, path: string) {\n    super(\n      `Integration \"${integrationName}\" tried to register route \"${path}\", ` +\n        `but it conflicts with an existing route. Choose a different path.`,\n    )\n    this.name = 'IntegrationRouteCollisionError'\n  }\n}\n\nexport interface IntegrationRegistryOptions {\n  /** Routes already scanned from `server/routes/`. Used to detect collisions. */\n  existingRoutes: string[]\n}\n\nexport interface IntegrationRoute {\n  path: string\n  owner: string\n}\n\nexport interface IntegrationRegistry {\n  registerIntegration(integration: TheoIntegration): void\n  fire(hookName: HookName, baseCtx: Record<string, unknown>): Promise<void>\n  addVirtualModule(integrationName: string, id: string, code: string): void\n  addRoute(integrationName: string, path: string, handler: RouteHandler): void\n  getVirtualModule(id: string): string | undefined\n  listVirtualModules(): string[]\n  listRoutes(): IntegrationRoute[]\n  /** Test helper: invoke hook surface directly without firing the lifecycle. */\n  callHook(\n    integrationName: string,\n    hookName: HookName,\n    extraCtx: Partial<HookContext>,\n  ): Promise<void>\n}\n\nexport function createIntegrationRegistry(\n  options: IntegrationRegistryOptions,\n): IntegrationRegistry {\n  const integrations: TheoIntegration[] = []\n  const virtualModules = new Map<string, { code: string; owner: string }>()\n  const routes: { path: string; owner: string; handler: RouteHandler }[] = []\n  const userRoutes = new Set(options.existingRoutes)\n\n  function buildHookCtxFor(integrationName: string, extra: Partial<HookContext>): HookContext {\n    return {\n      ...extra,\n      addVirtualModule: (id: string, code: string) => {\n        addVirtualModule(integrationName, id, code)\n      },\n      addRoute: (path: string, handler: RouteHandler) => {\n        addRoute(integrationName, path, handler)\n      },\n    }\n  }\n\n  function addVirtualModule(integrationName: string, id: string, code: string): void {\n    const expectedPrefix = `virtual:integration:${integrationName}/`\n    if (!id.startsWith(expectedPrefix)) {\n      throw new IntegrationVirtualModulePrefixError(integrationName, id)\n    }\n    virtualModules.set(id, { code, owner: integrationName })\n  }\n\n  function addRoute(integrationName: string, path: string, handler: RouteHandler): void {\n    if (userRoutes.has(path)) {\n      throw new IntegrationRouteCollisionError(integrationName, path)\n    }\n    if (routes.some((r) => r.path === path)) {\n      throw new IntegrationRouteCollisionError(integrationName, path)\n    }\n    routes.push({ path, owner: integrationName, handler })\n  }\n\n  return {\n    registerIntegration(integration) {\n      integrations.push(integration)\n    },\n    async fire(hookName, baseCtx) {\n      for (const intg of integrations) {\n        const hook = intg.hooks[hookName]\n        if (!hook) continue\n        try {\n          await hook(buildHookCtxFor(intg.name, baseCtx))\n        } catch (err) {\n          const e = err instanceof Error ? err : new Error(String(err))\n          const wrapped = new Error(\n            `Integration \"${intg.name}\" hook \"${hookName}\" threw: ${e.message}`,\n          )\n          ;(wrapped as { cause?: unknown }).cause = e\n          throw wrapped\n        }\n      }\n    },\n    addVirtualModule,\n    addRoute,\n    getVirtualModule(id) {\n      return virtualModules.get(id)?.code\n    },\n    listVirtualModules() {\n      return Array.from(virtualModules.keys())\n    },\n    listRoutes() {\n      return routes.map((r) => ({ path: r.path, owner: r.owner }))\n    },\n    // eslint-disable-next-line @typescript-eslint/require-await -- async surface for the public callHook contract\n    async callHook(integrationName, _hookName, extraCtx) {\n      // Build the ctx for parity with `fire()` so test invocations\n      // observe the same shape; we don't actually need the value here.\n      buildHookCtxFor(integrationName, extraCtx)\n      // Surface for direct test invocation; production code uses fire()\n      if (typeof extraCtx.addVirtualModule === 'function') {\n        extraCtx.addVirtualModule(\n          `virtual:integration:${integrationName}/test`,\n          'export const ok = true',\n        )\n      }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,WAAAC,WAAS,WAAAC,gBAAe;AACjC,SAAS,qBAAqB;;;ACF9B,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AAiBjB,SAAS,cAAc,KAA6C;AAEzE,QAAM,MAAM,WAAW,QAAQ,IAAI,YAAY,UAAU,CAAC,IAAI,QAAQ;AAKtE,QAAM,oBAA8B,CAAC;AACrC,aAAW,aAAa,CAAC,kBAAkB,gBAAgB,cAAc,GAAG;AAC1E,UAAM,OAAO,QAAQ,IAAI,aAAa,SAAS;AAC/C,QAAI,WAAW,IAAI,EAAG,mBAAkB,KAAK,KAAK,SAAS,EAAE;AAAA,EAC/D;AAIA,QAAM,gBACJ,IAAI,YAAY,OAAO,KAAK,IAAI,QAAQ,EAAE,SAAS,IAC/C,yBAAyB,IAAI,QAAQ,IACrC;AAQN,SAAO;AAAA,IACL,WAAW;AAAA,IACX,cAAc;AAAA,MACZ,GAAI,IAAI,oBAAoB,SAAS,IAAI,EAAE,SAAS,IAAI,oBAAoB,IAAI,CAAC;AAAA,MACjF,OAAO;AAAA,IACT;AAAA,IACA,QAAQ;AAAA,MACN,GAAI,kBAAkB,SAAS,IAAI,EAAE,QAAQ,EAAE,aAAa,kBAAkB,EAAE,IAAI,CAAC;AAAA,MACrF,GAAI,kBAAkB,SAAY,EAAE,OAAO,cAAc,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAM9D,OAAO;AAAA,QACL,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,OAAO;AAAA;AAAA;AAAA,QAGL,EAAE,MAAM,kBAAkB,aAAa,QAAQ,IAAI,YAAY,eAAe,GAAG,EAAE,EAAE;AAAA,QACrF,EAAE,MAAM,kBAAkB,aAAa,QAAQ,IAAI,YAAY,eAAe,GAAG,EAAE,EAAE;AAAA,QACrF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAME,MAAM;AAAA,UACN,aAAa,QAAQ,IAAI,YAAY,qBAAqB,GAAG,EAAE;AAAA,QACjE;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,aAAa,QAAQ,IAAI,YAAY,oBAAoB,GAAG,EAAE;AAAA,QAChE;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,aAAa,QAAQ,IAAI,YAAY,oBAAoB,GAAG,EAAE;AAAA,QAChE;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,aAAa,QAAQ,IAAI,YAAY,mBAAmB,GAAG,EAAE;AAAA,QAC/D;AAAA;AAAA;AAAA;AAAA,QAIA;AAAA,UACE,MAAM;AAAA,UACN,aAAa;AAAA,YACX,IAAI;AAAA,YACJ,QAAQ,QAAQ,2BAA2B;AAAA,UAC7C;AAAA,QACF;AAAA,QACA,EAAE,MAAM,WAAW,aAAa,QAAQ,IAAI,YAAY,QAAQ,GAAG,EAAE,EAAE;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AACF;;;ACjHA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,WAAAC,gBAAe;;;ACDjB,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACzB;AAAA,EACA;AAAA,EAEhB,YAAY,QAAuB,YAAoB;AACrD,UAAM,aAAa,OAAO,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI;AAE9E;AAAA,MACE;AAAA;AAAA,UACa,UAAU;AAAA;AAAA,KACpB,aAAa;AAAA,EAAc,UAAU;AAAA,IAAO;AAAA,IACjD;AAEA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;AAAA,EACpB;AACF;;;ACtBA,SAAS,KAAAC,UAAS;;;ACAlB,SAAS,SAAS;AAWX,IAAM,mBAAmB,EAC7B,OAAO,EACP,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,GAAG,EAAE,SAAS,sCAAsC,CAAC;;;ACbtF,SAAS,KAAAC,UAAS;AAKlB,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EACnC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAC7B,CAAC;AAOM,IAAM,kBAAkBA,GAAE,MAAM;AAAA,EACrC;AAAA,EACAA,GAAE,OAAO;AAAA,IACP,SAAS,oBAAoB,SAAS;AAAA,IACtC,QAAQA,GAAE,OAAOA,GAAE,OAAO,GAAG,mBAAmB,EAAE,SAAS;AAAA,IAC3D,OAAOA,GACJ,MAAM;AAAA,MACLA,GAAE,KAAK,CAAC,MAAM,WAAW,MAAM,CAAC;AAAA,MAChCA,GAAE,SAAS,EAAE,OAAOA,GAAE,MAAM,CAACA,GAAE,QAAQ,CAAC,CAAC,GAAG,QAAQA,GAAE,OAAO,EAAE,CAAC;AAAA,IAClE,CAAC,EACA,SAAS;AAAA,IACZ,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,CAAC;AACH,CAAC;;;AC5BD,SAAS,KAAAC,UAAS;AAEX,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,aAAaA,GACV,OAAO,EACP,IAAI,CAAC,EACL,QAAQ,KAAK,OAAO,IAAI;AAAA;AAAA,EAC3B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE;AAAA,EAC5C,cAAcA,GACX,OAAO,EACP,IAAI,CAAC,EACL,QAAQ,IAAI,OAAO,IAAI;AAAA;AAC5B,CAAC;;;ACZD,SAAS,KAAAC,UAAS;AAEX,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,OAAOA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,SAAS,QAAQ,CAAC,EAAE,QAAQ,MAAM;AAC5E,CAAC;;;ACJD,SAAS,KAAAC,UAAS;AASlB,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EAC/B,QAAQA,GAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EACnD,KAAKA,GAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChD,MAAMA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AACrC,CAAC;AAEM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,SAASA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEjC,SAASA,GAAE,MAAM,CAACA,GAAE,QAAQ,QAAQ,GAAGA,GAAE,OAAgB,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC7E,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACpD,UAAUA,GACP,OAAO;AAAA,IACN,QAAQA,GAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC;AAAA,IACnD,KAAKA,GAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChD,aAAaA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,CAAC,EACA,QAAQ,EAAE,QAAQ,GAAG,aAAa,MAAM,CAAC;AAAA,EAC5C,eAAeA,GACZ,OAAO;AAAA,IACN,cAAcA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IAC3C,WAAWA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,IACnC,eAAeA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EACzC,CAAC,EACA,QAAQ,EAAE,WAAW,MAAM,eAAe,KAAK,CAAC;AAAA,EACnD,YAAYA,GAAE,OAAOA,GAAE,OAAO,GAAG,eAAe,EAAE,SAAS;AAC7D,CAAC;;;ACnCD,SAAS,KAAAC,UAAS;AA4BX,IAAM,wBAAwBC,GAAE,OAAO;AAAA,EAC5C,KAAKA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5D,SAASA,GAAE,KAAK,CAAC,WAAW,eAAe,KAAK,CAAC,EAAE,QAAQ,SAAS;AAAA,EACpE,MAAMA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7D,cAAcA,GAAE,KAAK,CAAC,QAAQ,YAAY,CAAC,EAAE,QAAQ,MAAM;AAAA,EAC3D,oBAAoBA,GAAE,QAAQ,SAAS,EAAE,QAAQ,SAAS;AAAA,EAC1D,gBAAgB,iBAAiB,QAAQ,iCAAiC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1E,mBAAmBA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAC5E,CAAC;AAcM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,QAAQA,GAAE,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,EAC3D,UAAUA,GAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,QAAQ,OAAO;AACrD,CAAC;AAaM,IAAM,aAAaA,GACvB,OAAO;AAAA,EACN,SAASA,GAAE,MAAM;AAAA,IACfA,GAAE,QAAQ,GAAG;AAAA,IACb;AAAA,IACAA,GAAE,WAAW,MAAM;AAAA,IACnBA,GAAE,MAAMA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,IACzDA,GAAE,SAAS,EAAE,OAAOA,GAAE,MAAM,CAACA,GAAE,OAAO,CAAC,CAAC,GAAG,QAAQA,GAAE,QAAQ,EAAE,CAAC;AAAA,EAClE,CAAC;AAAA,EACD,SAASA,GACN,MAAMA,GAAE,KAAK,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,WAAW,MAAM,CAAC,CAAC,EAC1E,SAAS;AAAA,EACZ,gBAAgBA,GAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,EACnD,gBAAgBA,GAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,EACnD,aAAaA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAG;AACxD,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,EAAE,YAAY,OAAO,EAAE,cAAc;AAAA,EACpD,SAAS;AACX,CAAC;AAEI,IAAM,iBAAiBA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,MAAMA,GAAE,KAAK,CAAC,OAAO,QAAQ,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACxD,SAAS,sBAAsB,SAAS;AAAA;AAAA,EAExC,YAAY,uBAAuB,SAAS;AAAA;AAAA,EAE5C,MAAM,WAAW,SAAS;AAC5B,CAAC;;;ACzGD,SAAS,KAAAC,UAAS;AAqBlB,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EAC/B,oBAAoBA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACzC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EAClC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,EACtD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,UAAUA,GAAE,OAAO;AAAA,EACnB,KAAK,gBAAgB,SAAS;AAChC,CAAC;AAED,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EACxC,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC7C,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,yBAAyBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9D,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAC7D,CAAC;AAED,IAAM,+BAA+BA,GAAE,OAAO;AAAA;AAAA,EAE5C,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,yBAAyB,SAAS;AAC1C,CAAC;AAED,IAAM,0BAA0B,mBAAmB,OAAO;AAAA,EACxD,IAAIA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC5C,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAChE,CAAC;AAEM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAG,kBAAkB,EAAE,SAAS;AAAA,EAC3D,WAAWA,GAAE,OAAOA,GAAE,OAAO,GAAG,4BAA4B,EAAE,SAAS;AAAA,EACvE,OAAOA,GAAE,OAAOA,GAAE,OAAO,GAAG,uBAAuB,EAAE,SAAS;AAChE,CAAC;;;APjBM,IAAM,mBAAmBC,GAC7B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQN,MAAMA,GACH,OAAO,EACP,IAAI,EAAE,EACN;AAAA;AAAA;AAAA,IAGC,CAAC,UACC,MAAM,SAAS,KACf,gBAAgB,KAAK,KAAK,KAC1B,CAAC,MAAM,WAAW,GAAG,KACrB,CAAC,MAAM,SAAS,GAAG;AAAA,IACrB;AAAA,EACF,EACC,SAAS;AAAA,EACZ,QAAQA,GAAE,OAAO,EAAE,QAAQ,KAAK;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,WAAWA,GAAE,OAAO,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtC,SAASA,GACN,OAAO,EACP,QAAQ,UAAU,EAClB;AAAA,IACC,CAAC,MAAM,CAAC,qBAAqB,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,IAAI;AAAA,IAC1D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBF,QAAQA,GACL,OAAO;AAAA,IACN,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,IACtD,UAAUA,GACP,OAAO;AAAA;AAAA,MAEN,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAG;AAAA;AAAA,MAE9D,eAAeA,GACZ,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,QAAQ,KAAK,GAAM;AAAA,IACxB,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AAAA,EACZ,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAI;AAAA;AAAA,EAErD,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,WAAW;AAAA;AAAA,EAE5D,MAAMA,GAAE,MAAM,CAACA,GAAE,QAAQ,GAAGA,GAAE,OAAO,CAAC,CAAC,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEtD,YAAYA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAErC,gBAAgBA,GACb,MAAM;AAAA,IACLA,GAAE,QAAQ;AAAA,IACVA,GAAE,OAAO;AAAA,MACP,iBAAiBA,GAAE,QAAQ,EAAE,SAAS;AAAA,MACtC,WAAWA,GAAE,MAAMA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,OAAO,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,IACjF,CAAC;AAAA,EACH,CAAC,EACA,QAAQ,KAAK;AAAA;AAAA,EAEhB,QAAQA,GACL,OAAO;AAAA,IACN,aAAaA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IAC1C,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACzC,CAAC,EACA,SAAS;AAAA,EACZ,KAAKA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI9B,cAAcA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACvC,WAAW,gBAAgB,SAAS;AAAA,EACpC,QAAQ,aAAa,SAAS;AAAA,EAC9B,SAAS,cAAc,SAAS;AAAA,EAChC,UAAU,eAAe,SAAS;AAAA,EAClC,eAAeA,GAAE,KAAK,CAAC,QAAQ,WAAW,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA,EAI3D,SAASA,GAAE,MAAMA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,UAAUA,GACP,MAAM,CAACA,GAAE,QAAQ,GAAGA,GAAE,OAAO,EAAE,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAC9E,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,OAAOA,GACJ,OAAO;AAAA,IACN,QAAQA,GAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,CAAC,EACA,SAAS;AAAA;AAAA;AAAA,EAGZ,IAAIA,GACD,MAAM;AAAA,IACLA,GAAE,QAAQ,KAAK;AAAA,IACfA,GAAE,OAAO;AAAA,MACP,OAAOA,GAAE,KAAK,CAAC,gBAAgB,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,MAC1D,OAAOA,GAAE,KAAK,CAAC,WAAW,KAAK,CAAC,EAAE,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMZ,OAAO,YAAY,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW5B,UAAUA,GACP,MAAM;AAAA,IACLA,GAAE,QAAQ,KAAK;AAAA,IACfA,GAAE,OAAO;AAAA,MACP,UAAUA,GAAE,KAAK,CAAC,YAAY,aAAa,eAAe,cAAc,CAAC,EAAE,SAAS;AAAA,MACpF,OAAOA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,CAAC,EAAE,SAAS;AAAA,IACtD,CAAC;AAAA,EACH,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOZ,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAevC,kBAAkBA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,MAAMA,GACH,OAAO;AAAA,IACN,SAASA,GAAE,OAAgB,CAAC,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI;AAAA,EACvE,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWZ,SAAS,cAAc,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeV,SAASA,GACN,OAAO;AAAA,IACN,SAASA,GACN;AAAA,MACCA,GAAE,OAAO;AAAA,QACP,KAAKA,GAAE,IAAI;AAAA,QACX,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,MACnC,CAAC;AAAA,IACH,EACC,QAAQ,CAAC,EAAE,KAAK,yBAAyB,aAAa,oBAAoB,CAAC,CAAC;AAAA,IAC/E,aAAaA,GAAE,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,QAAQ,OAAO;AAAA,IACvD,OAAOA,GAAE,OAAO,EAAE,QAAQ,aAAa;AAAA,IACvC,SAASA,GAAE,OAAO,EAAE,QAAQ,OAAO;AAAA,IACnC,QAAQA,GAAE,OAAO,EAAE,QAAQ,UAAU;AAAA,EACvC,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBZ,aAAaA,GACV,OAAwB,CAAC,QAAQ,OAAO,QAAQ,YAAY;AAAA,IAC3D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AACd,CAAC,EAEA,OAAO,CAAC,QAAQ,CAAC,OAAO,OAAO,IAAI,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,GAAG;AAAA,EAC9E,SAAS;AAAA,EACT,MAAM,CAAC,UAAU;AACnB,CAAC;;;AF1SH,IAAM,cAAc;AAOb,SAAS,UACd,MACA,UACyB;AACzB,QAAM,SAAS,EAAE,GAAG,KAAK;AACzB,aAAW,OAAO,OAAO,KAAK,QAAQ,GAAG;AAEvC,QAAI,QAAQ,eAAe,QAAQ,iBAAiB,QAAQ,YAAa;AAEzE,UAAM,UAAU,KAAK,GAAG;AACxB,UAAM,UAAU,SAAS,GAAG;AAE5B,QACE,YAAY,QACZ,OAAO,YAAY,YACnB,CAAC,MAAM,QAAQ,OAAO,KACtB,YAAY,QACZ,OAAO,YAAY,YACnB,CAAC,MAAM,QAAQ,OAAO,GACtB;AACA,aAAO,GAAG,IAAI;AAAA,QACZ;AAAA,QACA;AAAA,MACF;AAAA,IACF,OAAO;AACL,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,WAAW,KAAkC;AAKjE,UAAQ,EAAE,KAAK,IAAI,CAAC;AAEpB,QAAM,aAAaC,SAAQ,KAAK,WAAW;AAE3C,MAAI,CAACC,YAAW,UAAU,GAAG;AAC3B,WAAO,iBAAiB,MAAM,CAAC,CAAC;AAAA,EAClC;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,iBAAiB,UAAU;AAAA,EACzC,SAAS,KAAK;AACZ,UAAM,IAAI,gBAAgB,CAAC,EAAE,OAAO,SAAS,SAAU,IAAc,QAAQ,CAAC,GAAG,UAAU;AAAA,EAC7F;AAEA,QAAM,aAAa,IAAI;AAEvB,MAAI,cAAc,QAAQ,OAAO,eAAe,UAAU;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,QACE;AAAA,UACE,OAAO;AAAA,UACP,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI,YAAY;AAChB,QAAM,UAAU,QAAQ,IAAI;AAE5B,MAAI,SAAS;AACX,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,UAAUD,SAAQ,KAAK,OAAO;AAEpC,QAAIC,YAAW,OAAO,GAAG;AACvB,UAAI;AACF,cAAM,SAAS,MAAM,iBAAiB,OAAO;AAC7C,cAAM,YAAY,OAAO;AAEzB,YAAI,aAAa,QAAQ,OAAO,cAAc,UAAU;AACtD,sBAAY,UAAU,WAAW,SAAoC;AAAA,QACvE;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,IAAI,gBAAgB,CAAC,EAAE,OAAO,SAAS,SAAU,IAAc,QAAQ,CAAC,GAAG,OAAO;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,iBAAiB,UAAU,SAAS;AAEnD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OAAO,IAAI,CAAC,OAAO;AAAA,MAC7C,OAAO,EAAE,KAAK,KAAK,GAAG;AAAA,MACtB,SAAS,EAAE;AAAA,IACb,EAAE;AACF,UAAM,IAAI,gBAAgB,QAAQ,UAAU;AAAA,EAC9C;AAEA,SAAO,OAAO;AAChB;;;AUvGA,SAAS,cAAAC,aAAY,oBAAoB;AACzC,SAAS,SAAS,YAAY;AAyBvB,SAAS,oBACd,KACc;AACd,SAAO;AAAA,IACL,OAAO,KAAK,SAAS;AAAA,IACrB,OAAO,KAAK,SAAS;AAAA,EACvB;AACF;AAiCA,SAAS,qBAAqB,SAAiB,SAAgC;AAC7E,QAAM,cAAc,KAAK,SAAS,cAAc;AAChD,MAAI,CAACA,YAAW,WAAW,EAAG,QAAO;AACrC,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,aAAa,aAAa,OAAO,CAAC;AAGzD,UAAM,YAAY,KAAK,OAAO;AAC9B,UAAM,MAAM,IAAI,UAAU,SAAS;AACnC,QAAI,CAAC,KAAK;AAER,YAAM,WAAW,KAAK,SAAS,QAAQ,OAAO;AAC9C,aAAOA,YAAW,QAAQ,IAAI,WAAW;AAAA,IAC3C;AAEA,QAAI;AACJ,QAAI,OAAO,QAAQ,SAAU,UAAS;AAAA,aAC7B,OAAO,QAAQ,UAAU;AAChC,YAAM,IAAI;AACV,eAAS,EAAE,UAAU,EAAE;AAAA,IACzB;AACA,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,UAAU,OAAO,QAAQ,SAAS,EAAE;AAC1C,UAAM,YAAY,KAAK,SAAS,OAAO;AACvC,WAAOA,YAAW,SAAS,IAAI,YAAY;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,kBAAmC,CAAC,WAAW,gBAAgB;AACnE,QAAM,QAAQ,UAAU,MAAM,GAAG;AACjC,QAAM,UACJ,MAAM,CAAC,GAAG,WAAW,GAAG,KAAK,MAAM,UAAU,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC;AACtF,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,UAAU,UAAU,MAAM,QAAQ,SAAS,CAAC;AAClD,MAAI,CAAC,QAAS,QAAO;AAErB,MAAI,MAAM;AACV,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS;AACvC,UAAM,UAAU,KAAK,KAAK,gBAAgB,GAAG,QAAQ,MAAM,GAAG,CAAC;AAC/D,QAAIA,YAAW,OAAO,GAAG;AACvB,YAAM,WAAW,qBAAqB,SAAS,OAAO;AACtD,UAAI,SAAU,QAAO;AAAA,IACvB;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAMA,SAAS,wBAAwB,aAA8B;AAC7D,MAAI;AACF,UAAM,MAAM,aAAa,KAAK,aAAa,cAAc,GAAG,OAAO;AACnE,UAAM,MAAM,KAAK,MAAM,GAAG;AAQ1B,WAAO;AAAA,MACL,IAAI,eAAe,aAAa,KAChC,IAAI,kBAAkB,aAAa,KACnC,IAAI,mBAAmB,aAAa;AAAA,IACtC;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aACd,aACA,WACA,WAA4B,iBACR;AACpB,QAAM,SAAS,oBAAoB,OAAO,cAAc,WAAW,YAAY,MAAS;AAGxF,MAAI,cAAc,OAAO;AACvB,WAAO,EAAE,SAAS,OAAO,OAAO;AAAA,EAClC;AAMA,MAAI,CAAC,wBAAwB,WAAW,GAAG;AACzC,WAAO,EAAE,SAAS,OAAO,OAAO;AAAA,EAClC;AAIA,QAAM,SAAS,CAAC,0BAA0B,uBAAuB;AACjE,aAAW,SAAS,QAAQ;AAC1B,QAAI,SAAS,OAAO,WAAW,GAAG;AAChC,aAAO,EAAE,SAAS,MAAM,OAAO;AAAA,IACjC;AAAA,EACF;AACA,SAAO,EAAE,SAAS,OAAO,OAAO;AAClC;;;ACvIA,IAAM,mBAAyC;AAAA,EAC7C,cAAc;AAAA,EACd,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,SAAS;AACX;AAEA,eAAsB,oBAAoB,aAAoD;AAC5F,MAAI;AACF,UAAM,aAAa,MAAM,WAAW,WAAW;AAC/C,UAAM,eAAe,MAAM,6BAA6B,WAAW,OAAO;AAC1E,UAAM,cAAc,mBAAmB,WAAW,aAAa;AAG/D,QAAI;AACJ,QAAI,WAAW,aAAa,MAAM;AAChC,yBAAmB,CAAC;AAAA,IACtB,WAAW,OAAO,WAAW,aAAa,UAAU;AAClD,yBAAmB,WAAW;AAAA,IAChC;AAEA,UAAM,SAAS,aAAa,aAAa,WAAW,EAAE;AAGtD,QAAI;AACJ,UAAM,cAAe,WAAgD,OAAO;AAC5E,QAAI,eAAe,OAAQ,YAAkC,QAAQ,YAAY;AAC/E,oBAAc;AAAA,IAChB;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,WAAW,UAAU,QAAQ;AAAA,MACvC,iBAAiB,WAAW,UAAU;AAAA,MACtC,YAAY,WAAW,UAAU;AAAA,MACjC,MAAM,WAAW,UAAU;AAAA,MAC3B;AAAA,MACA,iBAAiB,WAAW,aAAa;AAAA,MACzC,SAAS,WAAW;AAAA,MACpB,SAAS,WAAW;AAAA,IACtB;AAAA,EACF,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;;;AC9GA,SAAS,WAAAC,UAAS,gBAAgB;;;ACiBlC,SAAS,UAAU,SAAmB,SAAyB;AAC7D,QAAM,SAAS,CAAC,GAAG,SAAS,OAAO,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AAC7D,SAAO,MAAM;AACf;AAEA,SAAS,KACP,MACA,SACA,aACA,KACM;AACN,QAAM,OAAO,UAAU,SAAS,KAAK,OAAO;AAE5C,QAAM,YAAY,KAAK,SAAS,CAAC,GAAG,aAAa,KAAK,MAAM,IAAI;AAEhE,MAAI,KAAK,MAAM;AACb,QAAI,OAAO,KAAK;AAAA,MACd;AAAA,MACA,kBAAkB,KAAK;AAAA,MACvB,aAAa,CAAC,GAAG,WAAW;AAAA;AAAA,MAC5B,YAAY,QAAQ,KAAK,OAAO;AAAA,MAChC,UAAU,QAAQ,KAAK,KAAK;AAAA,MAC5B,aAAa,QAAQ,KAAK,QAAQ;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,aAAW,SAAS,KAAK,UAAU;AACjC,UAAM,cAAc,KAAK,UAAU,CAAC,GAAG,SAAS,KAAK,OAAO,IAAI;AAChE,SAAK,OAAO,aAAa,WAAW,GAAG;AAAA,EACzC;AACF;AAMO,SAAS,mBAAmB,MAAgC;AACjE,QAAM,MAA0B,EAAE,QAAQ,CAAC,EAAE;AAC7C,OAAK,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG;AACtB,SAAO,EAAE,QAAQ,IAAI,OAAO;AAC9B;AAMO,SAAS,uBAAuB,MAAuB;AAC5D,QAAM,WAAW,mBAAmB,IAAI;AACxC,sBAAoB,0BAA0B,QAAQ;AACxD;;;AC9DA,SAAS,aAAa,UAAU,cAAAC,mBAAkB;AAClD,SAAS,QAAAC,OAAM,WAAAC,gBAAe;;;ACDvB,IAAM,mBAAmB,CAAC,QAAQ,UAAU,SAAS,WAAW,WAAW;AAI3E,IAAM,wBAAwB,CAAC,QAAQ,OAAO,QAAQ,KAAK;AAElE,IAAM,mBAAmB;AAElB,SAAS,YAAY,UAA2B;AACrD,SAAO,iBAAiB,KAAK,QAAQ;AACvC;;;ADJA,SAAS,UAAU,MAA2E;AAC5F,MAAI,SAAS,YAAa,QAAO;AACjC,SAAO;AACT;AAEA,SAAS,aACP,MACA,KACA,OACM;AACN,UAAQ,KAAK;AAAA,IACX,KAAK;AACH,WAAK,OAAO;AACZ;AAAA,IACF,KAAK;AACH,WAAK,SAAS;AACd;AAAA,IACF,KAAK;AACH,WAAK,QAAQ;AACb;AAAA,IACF,KAAK;AACH,WAAK,UAAU;AACf;AAAA,IACF,KAAK;AACH,WAAK,WAAW;AAChB;AAAA,EACJ;AACF;AAEA,SAAS,iBAAiB,MAAiB,KAAmB;AAE5D,aAAW,QAAQ,kBAAkB;AACnC,UAAM,MAAM,UAAU,IAAI;AAC1B,QAAI,KAAK,GAAG,MAAM,OAAW;AAC7B,eAAW,OAAO,uBAAuB;AACvC,YAAM,WAAW,GAAG,IAAI,GAAG,GAAG;AAC9B,UAAIC,YAAWC,MAAK,KAAK,QAAQ,CAAC,GAAG;AACnC,qBAAa,MAAM,KAAKC,SAAQ,KAAK,QAAQ,CAAC;AAC9C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAeA,SAAS,aAAa,MAA6B;AACjD,MAAI,KAAK,WAAW,IAAI,GAAG;AACzB,UAAM,IAAI;AAAA,MACR,2DAA2D,IAAI;AAAA,IAEjE;AAAA,EACF;AACA,QAAM,WAAW,mBAAmB,KAAK,IAAI;AAC7C,MAAI,SAAU,QAAO,eAAe,YAAY,SAAS,CAAC,GAAG,IAAI;AACjE,QAAM,UAAU,aAAa,KAAK,IAAI;AACtC,MAAI,QAAS,QAAO,eAAe,WAAW,QAAQ,CAAC,GAAG,IAAI;AAC9D,SAAO,EAAE,MAAM,SAAS;AAC1B;AAEA,SAAS,eACP,MACA,WACA,MACe;AACf,MAAI,CAAC,QAAQ,KAAK,SAAS,GAAG;AAC5B,UAAM,IAAI;AAAA,MACR,wBAAwB,SAAS,iBAAiB,IAAI;AAAA,IAExD;AAAA,EACF;AACA,SAAO,EAAE,MAAM,UAAU;AAC3B;AAEA,SAAS,eAAe,MAA0B;AAChD,SACE,KAAK,SAAS,UACd,KAAK,WAAW,UAChB,KAAK,UAAU,UACf,KAAK,YAAY,UACjB,KAAK,aAAa,UAClB,KAAK,SAAS,SAAS;AAE3B;AAEA,SAAS,eAAe,WAAmB,YAA4B;AACrE,MAAI,CAAC,WAAY,QAAO;AACxB,SAAO,cAAc,MAAM,IAAI,UAAU,KAAK,GAAG,SAAS,IAAI,UAAU;AAC1E;AAGA,SAAS,UAAU,WAAmB,SAAiB,WAA8B;AACnF,QAAM,eAAe,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG;AACpE,QAAM,aAAa,eAAe,KAAK;AACvC,QAAM,YAAY,eAAe,WAAW,UAAU;AACtD,QAAM,QAAQ,QAAQD,MAAK,WAAW,OAAO,GAAG,eAAe,KAAK,SAAS,SAAS;AAGtF,MAAI,CAAC,cAAc;AACjB,UAAM,SAAS,aAAa,OAAO;AACnC,QAAI,OAAO,SAAS,YAAY,OAAO,cAAc,QAAW;AAC9D,YAAM,UAAU,EAAE,WAAW,OAAO,WAAW,UAAU,OAAO,SAAS,WAAW;AAAA,IACtF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,KAAa,SAAiB,WAA8B;AAC3E,QAAM,OAAkB,EAAE,SAAS,MAAM,WAAW,UAAU,CAAC,EAAE;AACjE,mBAAiB,MAAM,GAAG;AAE1B,aAAW,SAAS,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC,GAAG;AAC7D,QAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,QAAI,MAAM,KAAK,WAAW,GAAG,KAAK,MAAM,KAAK,WAAW,GAAG,EAAG;AAE9D,UAAM,QAAQ,UAAU,KAAK,MAAM,MAAM,SAAS;AAGlD,QAAI,eAAe,KAAK,GAAG;AACzB,WAAK,SAAS,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,WAAW,QAA2B;AACpD,MAAI,CAACD,YAAW,MAAM,GAAG;AACvB,UAAM,IAAI,MAAM,iCAAiC,MAAM,EAAE;AAAA,EAC3D;AACA,MAAI,CAAC,SAAS,MAAM,EAAE,YAAY,GAAG;AACnC,UAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AAAA,EAC1D;AACA,SAAO,QAAQ,QAAQ,IAAI,GAAG;AAChC;;;AE3JA,SAAS,kBAAkB;AAgB3B,IAAM,SAAS;AAgBR,SAAS,uBACd,MACA,WACA,SAC4B;AAC5B,QAAM,aAAa,iBAAiB,IAAI;AACxC,QAAM,eAAe,SAAS;AAC9B,QAAM,WAAqB,SAAS,YAAY;AAChD,QAAM,aAAa,SAAS;AAC5B,SAAO,CAAC,KAAK,KAAK,SAAS;AACzB,UAAM,YAAY;AAChB,YAAM,MAAM,IAAI,OAAO;AACvB,UAAI,CAAC,IAAI,WAAW,MAAM,GAAG;AAC3B,aAAK;AACL;AAAA,MACF;AAEA,YAAM,YAAY,WAAW;AAC7B,YAAM,QAAQ,KAAK,IAAI;AACvB,UAAI,UAAU,gBAAgB,SAAS;AAEvC,YAAM,kBAAkB,IAAI,MAAM,OAAO,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC;AAC7D,YAAM,WAAW,gBAAgB,MAAM,GAAG,EAAE,OAAO,OAAO;AAE1D,UAAI,SAAS,SAAS,GAAG;AACvB;AAAA,UACE;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,mBAAW;AAAA,UACT,QAAQ,IAAI,UAAU;AAAA,UACtB;AAAA,UACA,QAAQ;AAAA,UACR,UAAU,KAAK,IAAI,IAAI;AAAA,UACvB;AAAA,QACF,CAAC;AACD;AAAA,MACF;AAEA,YAAM,aAAa,SAAS,SAAS,SAAS,CAAC;AAC/C,YAAM,aAAa,SAAS,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AAEjD,YAAM,UAAU,kBAAkB,SAAS;AAC3C,YAAM,SAAS,QAAQ,KAAK,CAAC,MAAM,EAAE,eAAe,UAAU;AAE9D,UAAI,CAAC,QAAQ;AACX,cAAM,cAAc,QAAQ,IAAI,CAAC,MAAM,EAAE,UAAU;AACnD,cAAM,aAAa,eAAe,YAAY,WAAW;AACzD,cAAM,MAAM,aACR,gBAAgB,UAAU,8BAA8B,UAAU,MAClE,gBAAgB,UAAU;AAC9B,kBAAU,KAAK,aAAa,KAAK,KAAK,QAAW,SAAS;AAC1D,mBAAW;AAAA,UACT,QAAQ,IAAI,UAAU;AAAA,UACtB;AAAA,UACA,QAAQ;AAAA,UACR,UAAU,KAAK,IAAI,IAAI;AAAA,UACvB;AAAA,QACF,CAAC;AACD;AAAA,MACF;AAEA,YAAM;AAAA,QACJ,OAAO;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA;AAAA,QACE;AAAA,UACE,QAAQ,IAAI,UAAU;AAAA,UACtB;AAAA,UACA,QAAQ,IAAI;AAAA,UACZ,UAAU,KAAK,IAAI,IAAI;AAAA,UACvB;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,GAAG;AAAA,EACL;AACF;;;AC/GA,SAAS,cAAAG,mBAAkB;;;ACL3B;AAAA,EAEE;AAAA,EACA;AAAA,OACK;AAEP,IAAM,aAAa;AAGZ,SAAS,gBAAgB,SAAgC;AAC9D,QAAM,QAAQ,WAAW,KAAK,OAAO;AACrC,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AAGA,SAAS,gBAAgB,MAAc,OAAe,KAAkC;AACtF,QAAM,WAAW,mBAAmB,KAAK,mBAAmB,IAAI,GAAG;AACnE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAQ,SAAS;AAAA,IACjB,UAAU,EAAE,QAAQ,IAAI,UAAU,GAAG;AAAA,IACrC,QAAQ,CAAC;AAAA,IACT,cAAc,CAAC;AAAA,IACf,OAAO,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,MAChC,MAAM,EAAE;AAAA,MACR,aAAa,EAAE;AAAA,MACf,UAAU;AAAA,MACV,OAAO;AAAA,MACP,OAAO;AAAA,IACT,EAAE;AAAA,IACF,WAAW,CAAC;AAAA,EACd;AACF;AAMO,SAAS,gBAAgB,KAAc,MAAc,OAAe,SAA2B;AACpG,MAAI;AACF,UAAM,OAAO,eAAe,gBAAgB,MAAM,OAAO,GAAG,GAAG,EAAE,QAAQ,CAAC;AAC1E,WAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,MACxC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,kCAAkC;AAAA,IAC/D,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,IAAI;AAAA,MACT,KAAK,UAAU,EAAE,OAAO,EAAE,MAAM,qBAAqB,SAAS,eAAe,QAAQ,IAAI,UAAU,oBAAoB,EAAE,CAAC;AAAA,MAC1H,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,kCAAkC,EAAE;AAAA,IAChF;AAAA,EACF;AACF;;;AC3CA,IAAM,kBAAkB;AAMjB,SAAS,gBAAgB,SAAgC;AAC9D,QAAM,KAAK,QAAQ,QAAQ,eAAe;AAC1C,MAAI,OAAO,GAAI,QAAO;AACtB,QAAM,KAAK,QAAQ,MAAM,KAAK,gBAAgB,MAAM;AACpD,SAAO,GAAG,SAAS,KAAK,CAAC,GAAG,SAAS,GAAG,IAAI,KAAK;AACnD;AAGO,SAAS,eAAe,SAA0B;AACvD,SAAO,QAAQ,SAAS,eAAe;AACzC;AAEA,SAAS,UAAU,QAAgB,MAAc,SAA2B;AAC1E,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,EAAE,MAAM,QAAQ,EAAE,CAAC,GAAG;AAAA,IAChE;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAOA,IAAM,oBAAoB,KAAK;AAWxB,SAAS,kBAAkB,MAAwC;AACxE,MAAI,OAAO,SAAS,YAAY,SAAS,KAAM,QAAO;AACtD,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,aAAa,UAAW,QAAO;AAC5C,QAAM,WAA6B,EAAE,UAAU,EAAE,SAAS;AAC1D,MAAI,EAAE,WAAW,QAAW;AAC1B,QAAI,OAAO,EAAE,WAAW,SAAU,QAAO;AACzC,aAAS,SAAS,EAAE;AAAA,EACtB;AACA,MAAI,EAAE,YAAY,QAAW;AAC3B,QAAI,OAAO,EAAE,YAAY,YAAY,EAAE,YAAY,QAAQ,MAAM,QAAQ,EAAE,OAAO,EAAG,QAAO;AAC5F,QAAI,KAAK,UAAU,EAAE,OAAO,EAAE,SAAS,kBAAmB,QAAO;AACjE,aAAS,UAAU,EAAE;AAAA,EACvB;AACA,SAAO;AACT;AAUA,eAAsB,oBACpB,SACA,SACA,UACA,WAAqB,UACF;AACnB,MAAI,aAAa,OAAO;AACtB,UAAM,OAAO,oBAAoB,OAAO;AACxC,QAAI,CAAC,KAAK,SAAS,aAAa,UAAU;AACxC,aAAO,UAAU,KAAK,eAAe,sBAAsB,KAAK,MAAM,EAAE;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,aAAa,gBAAgB,OAAO;AAC1C,MAAI,eAAe,MAAM;AACvB,WAAO,UAAU,KAAK,eAAe,wDAAwD;AAAA,EAC/F;AAEA,MAAI,OAAgB;AACpB,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,EAC5B,QAAQ;AAAA,EAER;AACA,QAAM,SAAS,kBAAkB,IAAI;AACrC,MAAI,WAAW,MAAM;AACnB,WAAO,UAAU,KAAK,eAAe,iDAAiD;AAAA,EACxF;AAEA,QAAM,WAAW,SAAS,QAAQ,YAAY,MAAM;AACpD,MAAI,CAAC,UAAU;AACb,WAAO,UAAU,KAAK,eAAe,+BAA+B,UAAU,IAAI;AAAA,EACpF;AACA,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,UAAU,KAAK,CAAC,GAAG;AAAA,IACtD,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;;;AC9GA,IAAM,YAAY;AAGX,SAAS,oBAAoB,SAAgC;AAClE,QAAM,QAAQ,UAAU,KAAK,OAAO;AACpC,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AAGO,SAAS,oBAAoB,UAAsC;AACxE,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,WAAW,SAAS,KAAK,EAAE,CAAC,GAAG;AAAA,IAClE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,kCAAkC;AAAA,EAC/D,CAAC;AACH;;;ACJA,IAAM,kBAAkB;AAMjB,SAAS,qBAAqB,SAAyD;AAC5F,QAAM,IAAI,gBAAgB,KAAK,OAAO;AACtC,SAAO,IAAI,EAAE,MAAM,mBAAmB,EAAE,CAAC,CAAC,GAAG,OAAO,mBAAmB,EAAE,CAAC,CAAC,EAAE,IAAI;AACnF;AAGA,SAAS,iBAAiB,KAA4B;AACpD,MAAI,QAAQ,KAAM,QAAO;AACzB,QAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,SAAO,OAAO,UAAU,CAAC,KAAK,KAAK,IAAI,IAAI;AAC7C;AAEO,SAAS,wBACd,OACA,SACA,OACU;AAEV,MAAI,CAAC,MAAM,IAAI,KAAK,GAAG;AACrB,WAAO,IAAI;AAAA,MACT,KAAK,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,SAAS,gBAAgB,KAAK,KAAK,EAAE,CAAC;AAAA,MACvF;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,iBAAiB,QAAQ,QAAQ,IAAI,eAAe,CAAC;AAEtE,QAAM,SAAS,IAAI,eAA2B;AAAA,IAC5C,MAAM,YAAY;AAChB,UAAI,SAAS;AACb,YAAM,cAAc,CAAC,SAAuB;AAC1C,YAAI,OAAQ;AACZ,YAAI;AACF,qBAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,QACpC,QAAQ;AAAA,QAER;AAAA,MACF;AACA,YAAM,QAAQ,MAAY;AACxB,YAAI,OAAQ;AACZ,oBAAY,cAAc;AAC1B,iBAAS;AACT,YAAI;AACF,qBAAW,MAAM;AAAA,QACnB,QAAQ;AAAA,QAER;AAAA,MACF;AAGA,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA;AAAA,QACA,CAAC,UAAU;AACT,sBAAY,eAAe,MAAM,KAAK,MAAM,IAAI,CAAC;AAAA,QACnD;AAAA,QACA,MAAM;AACJ,gBAAM;AAAA,QACR;AAAA,MACF;AAEA,UAAI,CAAC,IAAI,OAAO;AACd,cAAM;AACN;AAAA,MACF;AACA,iBAAW,SAAS,IAAI,QAAQ;AAC9B,oBAAY,eAAe,MAAM,KAAK,MAAM,IAAI,CAAC;AAAA,MACnD;AACA,UAAI,IAAI,OAAO;AACb,cAAM;AACN;AAAA,MACF;AAEA,cAAQ,OAAO,iBAAiB,SAAS,MAAM;AAC7C,YAAI,YAAY;AAChB,cAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,SAAO,IAAI,SAAS,QAAQ,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,aAAa,GAAG,MAAM,EAAE,CAAC;AAC1F;;;ACxEO,SAAS,mBACd,MACA,WACA,SACoB;AACpB,MAAI,KAAK,SAAS,UAAU,SAAS,MAAM,MAAM;AAC/C,SAAK,SAAS,MAAM,WAAW,EAAE,QAAQ,CAAC;AAC1C,WAAO,EAAE,QAAQ,KAAK;AAAA,EACxB;AACA,SAAO,EAAE,OAAO,aAAa,MAAM,WAAW,OAAO,EAAE;AACzD;AAGA,SAAS,aAAa,MAA0B,WAAmB,SAAyB;AAC1F,QAAM,QAAQ,UAAU;AAGxB,OAAK,MAAM,MAAM,KAAK;AACtB,OAAK,SAAS,SAAS,WAAW,KAAK;AACvC,gBAAc,MAAM,WAAW,OAAO,KAAK,SAAS,WAAW,OAAO,CAAC;AACvE,SAAO;AACT;AAOA,SAAS,cACP,MACA,WACA,OACA,QACM;AACN,QAAM,YAAY;AAChB,QAAI;AACF,uBAAiB,SAAS,QAAQ;AAChC,aAAK,MAAM,OAAO,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,MAChD;AAAA,IACF,QAAQ;AAAA,IAGR,UAAE;AACA,WAAK,MAAM,IAAI,KAAK;AACpB,YAAM,OAAO,KAAK,SAAS,OAAO,WAAW,KAAK;AAClD,UAAI,SAAS,OAAW,cAAa,MAAM,WAAW,KAAK,OAAO;AAAA,IACpE;AAAA,EACF,GAAG;AACL;;;ACnCO,SAAS,mCAAsD;AACpE,QAAM,UAAU,oBAAI,IAAyB;AAC7C,QAAM,SAAS,CAAC,cAAmC;AACjD,QAAI,IAAI,QAAQ,IAAI,SAAS;AAC7B,QAAI,MAAM,QAAW;AACnB,UAAI,EAAE,aAAa,MAAM,OAAO,CAAC,GAAG,SAAS,oBAAI,IAAI,EAAE;AACvD,cAAQ,IAAI,WAAW,CAAC;AAAA,IAC1B;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,UAAU,WAAW;AACnB,aAAO,QAAQ,IAAI,SAAS,GAAG,eAAe;AAAA,IAChD;AAAA,IACA,SAAS,WAAW,OAAO;AACzB,YAAM,IAAI,OAAO,SAAS;AAC1B,QAAE,cAAc;AAEhB,YAAM,UAAU,CAAC,GAAG,EAAE,OAAO;AAC7B,QAAE,QAAQ,MAAM;AAChB,iBAAW,MAAM,QAAS,IAAG,KAAK;AAAA,IACpC;AAAA,IACA,OAAO,WAAW,OAAO;AACvB,YAAM,IAAI,QAAQ,IAAI,SAAS;AAC/B,UAAI,GAAG,gBAAgB,MAAO,QAAO;AACrC,QAAE,cAAc;AAChB,aAAO,EAAE,MAAM,MAAM;AAAA,IACvB;AAAA,IACA,MAAM,WAAW,UAAU;AACzB,aAAO,SAAS,EAAE,MAAM,KAAK,QAAQ;AAAA,IACvC;AAAA,IACA,UAAU,WAAW,IAAI;AACvB,YAAM,IAAI,OAAO,SAAS;AAC1B,QAAE,QAAQ,IAAI,EAAE;AAChB,aAAO,MAAM;AACX,UAAE,QAAQ,OAAO,EAAE;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAI;AAGG,SAAS,uBAA0C;AACxD,qBAAmB,iCAAiC;AACpD,SAAO;AACT;;;ACpEA,IAAM,sBAAsB;AAC5B,IAAM,qBAAqB;AAG3B,IAAM,uBAAuB;AAE7B,SAAS,YAAY,IAAY,SAA6D;AAC5F,QAAM,IAAI,GAAG,KAAK,OAAO;AACzB,SAAO,IAAI,EAAE,MAAM,mBAAmB,EAAE,CAAC,CAAC,GAAG,WAAW,mBAAmB,EAAE,CAAC,CAAC,EAAE,IAAI;AACvF;AAEO,IAAM,sBAAsB,CAAC,YAAoB,YAAY,qBAAqB,OAAO;AACzF,IAAM,qBAAqB,CAAC,YAAoB,YAAY,oBAAoB,OAAO;AAE9F,SAASC,WAAU,QAAgB,MAAc,SAA2B;AAC1E,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,EAAE,MAAM,QAAQ,EAAE,CAAC,GAAG;AAAA,IAChE;AAAA,IACA,SAAS,EAAE,gBAAgB,kCAAkC;AAAA,EAC/D,CAAC;AACH;AAaA,eAAsB,oBAAoB,MAA4C;AACpF,QAAM,EAAE,KAAK,QAAQ,WAAW,SAAS,QAAQ,WAAW,SAAS,IAAI;AAEzE,MAAI,aAAa,UAAU;AACzB,UAAM,OAAO,oBAAoB,OAAO;AACxC,QAAI,CAAC,KAAK,MAAO,QAAOA,WAAU,KAAK,eAAe,sBAAsB,KAAK,MAAM,EAAE;AAAA,EAC3F;AACA,MAAI,OAAgB;AACpB,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,EAC5B,QAAQ;AAAA,EAER;AACA,QAAM,QAAQ,sBAAsB,IAAI;AACxC,MAAI,UAAU,MAAM;AAClB,WAAOA,WAAU,KAAK,eAAe,2CAA2C;AAAA,EAClF;AACA,QAAM,SAAS;AAAA,IACb;AAAA,MACE,UAAU,qBAAqB;AAAA,MAC/B,OAAO,iBAAiB;AAAA,MACxB,UAAU,mBAAmB,KAAK,QAAQ,MAAM;AAAA,IAClD;AAAA,IACA;AAAA,IACA,MAAM;AAAA,EACR;AACA,QAAM,UAAkC,EAAE,gBAAgB,kCAAkC;AAC5F,MAAI,WAAW,OAAQ,SAAQ,aAAa,IAAI,OAAO;AACvD,SAAO,IAAI,SAAS,KAAK,UAAU,MAAM,GAAG,EAAE,QAAQ,KAAK,QAAQ,CAAC;AACtE;AAGO,SAAS,mBACd,WACA,SACA,WAA8B,qBAAqB,GACnD,QAAuB,iBAAiB,GACxC,aAAa,sBACH;AACV,QAAM,SAAS,SAAS,UAAU,SAAS;AAC3C,MAAI,WAAW,QAAQ,MAAM,IAAI,MAAM,GAAG;AAExC,WAAO,wBAAwB,QAAQ,SAAS,KAAK;AAAA,EACvD;AACA,SAAO,qBAAqB,WAAW,SAAS,UAAU,OAAO,UAAU;AAC7E;AAGA,SAAS,qBACP,WACA,SACA,UACA,OACA,YACU;AACV,QAAM,SAAS,IAAI,eAA2B;AAAA,IAC5C,MAAM,YAAY;AAChB,UAAI,SAAS;AACb,YAAM,OAAO,CAAC,SAAuB;AACnC,YAAI,OAAQ;AACZ,YAAI;AACF,qBAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,QACpC,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI;AACJ,YAAM,QAAQ,MAAY;AACxB,YAAI,OAAQ;AACZ,aAAK,cAAc;AACnB,iBAAS;AACT,YAAI;AACF,qBAAW,MAAM;AAAA,QACnB,QAAQ;AAAA,QAER;AAAA,MACF;AACA,YAAM,UAAU,SAAS,UAAU,WAAW,CAAC,UAAU;AACvD,cAAM,MAAM,MAAM;AAAA,UAChB;AAAA,UACA;AAAA,UACA,CAAC,UAAU;AACT,iBAAK,eAAe,MAAM,KAAK,MAAM,IAAI,CAAC;AAAA,UAC5C;AAAA,UACA,MAAM;AACJ,kBAAM;AAAA,UACR;AAAA,QACF;AACA,YAAI,CAAC,IAAI,OAAO;AACd,gBAAM;AACN;AAAA,QACF;AACA,mBAAW,SAAS,IAAI,OAAQ,MAAK,eAAe,MAAM,KAAK,MAAM,IAAI,CAAC;AAC1E,YAAI,IAAI,OAAO;AACb,gBAAM;AACN;AAAA,QACF;AACA,uBAAe,IAAI;AAAA,MACrB,CAAC;AAID,YAAM,iBAAiB,MAAY;AACjC,gBAAQ;AACR,uBAAe;AAAA,MACjB;AACA,YAAM,QAAQ,WAAW,MAAM;AAC7B,uBAAe;AACf,cAAM;AAAA,MACR,GAAG,UAAU;AACb,YAAM,MAAM;AACZ,cAAQ,OAAO,iBAAiB,SAAS,MAAM;AAC7C,uBAAe;AACf,qBAAa,KAAK;AAClB,cAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACD,SAAO,IAAI,SAAS,QAAQ,EAAE,SAAS,EAAE,GAAG,iBAAiB,EAAE,CAAC;AAClE;;;ACnJA,SAASC,WAAU,QAAgB,MAAc,SAA2B;AAC1E,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,EAAE,MAAM,QAAQ,EAAE,CAAC,GAAG;AAAA,IAChE;AAAA,IACA,SAAS,EAAE,gBAAgB,kCAAkC;AAAA,EAC/D,CAAC;AACH;AA8BA,eAAsB,mBACpB,SACA,SACA,MAC0B;AAC1B,QAAM,SAAS,QAAQ,OAAO,YAAY;AAG1C,QAAM,WAAW,gBAAgB,OAAO;AACxC,MAAI,aAAa,MAAM;AACrB,QAAI,WAAW,MAAO,QAAO;AAC7B,UAAM,QAAQ,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AACzD,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,MAAM,MAAM,KAAK,WAAW,MAAM,QAAQ;AAChD,WAAO,gBAAgB,KAAK,MAAM,MAAM,MAAM,WAAW,KAAK,OAAO;AAAA,EACvE;AAGA,MAAI,oBAAoB,OAAO,GAAG;AAChC,QAAI,WAAW,MAAO,QAAO;AAC7B,WAAO,oBAAoB,oBAAoB,CAAC;AAAA,EAClD;AAQA,QAAM,YAAY,qBAAqB,OAAO;AAC9C,MAAI,cAAc,MAAM;AACtB,QAAI,WAAW,MAAO,QAAO;AAC7B,QAAI,CAAC,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,UAAU,IAAI,EAAG,QAAO;AAChE,WAAO,wBAAwB,UAAU,OAAO,SAAS,iBAAiB,CAAC;AAAA,EAC7E;AAIA,QAAM,iBAAiB,MAAM,iBAAiB,SAAS,QAAQ,SAAS,IAAI;AAC5E,MAAI,mBAAmB,KAAM,QAAO;AAIpC,QAAM,UAAU,UAAU,OAAO;AACjC,MAAI,YAAY,MAAM;AACpB,WAAO,cAAc,SAAS,QAAQ,SAAS,IAAI;AAAA,EACrD;AAEA,SAAO;AACT;AAqBA,eAAe,iBACb,SACA,QACA,SACA,MAC0B;AAC1B,QAAM,SAAS,mBAAmB,OAAO;AACzC,MAAI,WAAW,MAAM;AACnB,QAAI,WAAW,MAAO,QAAO;AAC7B,QAAI,CAAC,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,OAAO,IAAI,EAAG,QAAO;AAC7D,WAAO,mBAAmB,OAAO,WAAW,OAAO;AAAA,EACrD;AAEA,QAAM,MAAM,oBAAoB,OAAO;AACvC,MAAI,QAAQ,MAAM;AAChB,QAAI,WAAW,OAAQ,QAAO;AAC9B,UAAM,QAAQ,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI;AACzD,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,kBAAkB,QAAW;AAGpC,aAAOA;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,MAAM,MAAM,KAAK,WAAW,MAAM,QAAQ;AAChD,WAAO,oBAAoB;AAAA,MACzB;AAAA,MACA,QAAQ,KAAK,cAAc;AAAA,MAC3B,WAAW,IAAI;AAAA,MACf;AAAA,MACA,QAAQ,UAAU,IAAI,IAAI;AAAA,MAC1B,UAAU,KAAK,YAAY;AAAA,IAC7B,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAOA,eAAe,cACb,SACA,QACA,SACA,MAC0B;AAC1B,MAAI,WAAW,OAAQ,QAAO;AAC9B,QAAM,QAAQ,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,OAAO;AACxD,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,MAAM,MAAM,KAAK,WAAW,MAAM,QAAQ;AAMhD,MAAI,CAAC,aAAa,GAAG,EAAG,QAAO;AAI/B,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,aAAa,UAAU;AACzB,UAAM,OAAO,oBAAoB,OAAO;AACxC,QAAI,CAAC,KAAK,MAAO,QAAOA,WAAU,KAAK,eAAe,sBAAsB,KAAK,MAAM,EAAE;AAAA,EAC3F;AAEA,MAAI,OAAgB;AACpB,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,EAC5B,QAAQ;AAAA,EAER;AAGA,SAAO,iBAAiB,KAAK,MAAM,MAAM,MAAM,oBAAoB,GAAG,CAAC;AACzE;AAOA,SAAS,aAAa,KAAuB;AAC3C,SAAQ,KAA8C,QAAQ;AAChE;;;AChLA,eAAsB,iCACpB,UACA,KACe;AAKf,QAAM,aAAa,SAAS,QAAQ,aAAa;AACjD,MAAI,WAAW,SAAS,GAAG;AACzB,QAAI,UAAU,cAAc,UAAU;AAAA,EACxC;AACA,QAAM,eAAuC,CAAC;AAC9C,aAAW,CAAC,KAAK,KAAK,KAAK,SAAS,QAAQ,QAAQ,GAAG;AACrD,QAAI,IAAI,YAAY,MAAM,aAAc;AACxC,iBAAa,GAAG,IAAI;AAAA,EACtB;AACA,MAAI,UAAU,SAAS,QAAQ,SAAS,YAAY,YAAY;AAGhE,MAAI,SAAS,SAAS,MAAM;AAC1B,QAAI,IAAI;AACR;AAAA,EACF;AACA,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,MAAI;AACF,eAAS;AACP,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AAEV,UAAI,MAAM,KAAK;AAAA,IACjB;AACA,QAAI,IAAI;AAAA,EACV,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AACF;;;ATnDA,IAAMC,UAAS;AAgBf,eAAe,aACb,KACA,KACA,SACA,UACA,KACe;AACf,QAAM,UAAU,IAAI,UAAU,QAAQ,YAAY;AAClD,MAAI,WAAW,QAAQ;AACrB;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,IAAI;AAAA,IACN;AACA,eAAW;AAAA,MACT;AAAA,MACA,KAAK,IAAI,OAAO;AAAA,MAChB,QAAQ;AAAA,MACR,UAAU,KAAK,IAAI,IAAI,IAAI;AAAA,MAC3B,WAAW,IAAI;AAAA,IACjB,CAAC;AACD;AAAA,EACF;AACA,MAAI;AACF,UAAM,WAAW,MAAM;AAAA,MACrB,4BAA4B,GAAG;AAAA,MAC/B;AAAA,MACA,oBAAoB;AAAA,MACpB;AAAA,IACF;AACA,UAAM,iCAAiC,UAAU,GAAG;AAAA,EACtD,SAAS,KAAK;AACZ;AAAA,MACE;AAAA,MACA;AAAA,MACA,eAAe,QAAQ,IAAI,UAAU;AAAA,MACrC;AAAA,MACA;AAAA,MACA,IAAI;AAAA,IACN;AAAA,EACF;AACA,aAAW;AAAA,IACT;AAAA,IACA,KAAK,IAAI,OAAO;AAAA,IAChB,QAAQ,IAAI;AAAA,IACZ,UAAU,KAAK,IAAI,IAAI,IAAI;AAAA,IAC3B,WAAW,IAAI;AAAA,EACjB,CAAC;AACH;AAQA,eAAe,SACb,KACA,KACA,MACA,SACA,MACe;AACf,QAAM,YAAYC,YAAW;AAC7B,QAAM,QAAQ,KAAK,IAAI;AACvB,MAAI;AACF,UAAM,UAAU,4BAA4B,GAAG;AAC/C,UAAM,WAAW,MAAM,mBAAmB,SAAS,SAAS;AAAA,MAC1D,QAAQ,WAAW,KAAK,aAAa,KAAK,SAAS;AAAA,MACnD,YAAY,KAAK;AAAA,MACjB,SAAS,UAAU,IAAI,QAAQ,QAAQ,WAAW;AAAA,MAClD,UAAU,KAAK;AAAA;AAAA,MAEf,eAAe,MAAM,gBAAgB,EAAE;AAAA,IACzC,CAAC;AACD,QAAI,aAAa,MAAM;AACrB,WAAK;AACL;AAAA,IACF;AACA,QAAI,UAAU,gBAAgB,SAAS;AACvC,UAAM,iCAAiC,UAAU,GAAG;AAAA,EACtD,SAAS,KAAK;AACZ,QAAI,UAAU,gBAAgB,SAAS;AACvC;AAAA,MACE;AAAA,MACA;AAAA,MACA,eAAe,QAAQ,IAAI,UAAU;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,aAAW;AAAA,IACT,SAAS,IAAI,UAAU,OAAO,YAAY;AAAA,IAC1C,KAAK,IAAI,OAAO;AAAA,IAChB,QAAQ,IAAI;AAAA,IACZ,UAAU,KAAK,IAAI,IAAI;AAAA,IACvB;AAAA,EACF,CAAC;AACH;AAEO,SAAS,sBACd,MACA,aACA,WAAqB,UACrB,YAAY,UACgB;AAC5B,QAAM,aAAa,iBAAiB,IAAI;AACxC,SAAO,CAAC,KAAK,KAAK,SAAS;AACzB,UAAM,YAAY;AAChB,YAAM,MAAM,IAAI,OAAO;AAKvB,UAAI,gBAAgB,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,MAAM;AAC/C,cAAM,SAAS,KAAK,KAAK,MAAM,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG;AAAA,UAChD;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AACD;AAAA,MACF;AAEA,UAAI,CAAC,IAAI,WAAWD,OAAM,GAAG;AAC3B,aAAK;AACL;AAAA,MACF;AAEA,YAAM,YAAYC,YAAW;AAC7B,YAAM,QAAQ,KAAK,IAAI;AACvB,UAAI,UAAU,gBAAgB,SAAS;AAEvC,YAAM,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC;AAKhC,UAAI,eAAe,OAAO,GAAG;AAC3B,cAAM,aAAa,KAAK,KAAK,SAAS,UAAU,EAAE,WAAW,MAAM,CAAC;AACpE;AAAA,MACF;AAIA,UAAI,oBAAoB,OAAO,MAAM,QAAQ,UAAU,OAAO,MAAM,MAAM;AACxE,cAAM,SAAS,KAAK,KAAK,MAAM,SAAS,EAAE,aAAa,YAAY,WAAW,SAAS,CAAC;AACxF;AAAA,MACF;AAEA,YAAM,QAAQ,WAAW,aAAa,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,OAAO;AACpF,UAAI,CAAC,OAAO;AAEV,aAAK;AACL;AAAA,MACF;AAEA,YAAM,UAAU,IAAI,UAAU,QAAQ,YAAY;AAClD,UAAI,WAAW,QAAQ;AACrB;AAAA,UACE;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,mBAAW,EAAE,QAAQ,KAAK,QAAQ,KAAK,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,CAAC;AAChF;AAAA,MACF;AAEA,UAAI;AACF,cAAM,MAAM,MAAM,WAAW,MAAM,QAAQ;AAC3C,cAAM,SAAS,gBAAgB,EAAE;AACjC,cAAM,UAAU,4BAA4B,GAAG;AAC/C,cAAM,WAAW,MAAM,WAAW,KAAK,SAAS,QAAQ;AAAA,UACtD,QAAQ,MAAM;AAAA,UACd;AAAA,UACA;AAAA,QACF,CAAC;AACD,cAAM,iCAAiC,UAAU,GAAG;AAAA,MACtD,SAAS,KAAK;AACZ;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ,IAAI,UAAU;AAAA,UACrC;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,iBAAW,EAAE,QAAQ,KAAK,QAAQ,IAAI,YAAY,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,CAAC;AAAA,IAC7F,GAAG;AAAA,EACL;AACF;;;AU1PA,SAAS,WAAAC,gBAAe;AAiFxB,SAAS,0BAA0B,KAAa,UAAsC;AACpF,MAAI,CAAC,IAAI,WAAW,OAAO,EAAG,QAAO;AACrC,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,QAAM,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC;AAC7B,aAAW,UAAU,UAAU;AAC7B,QAAI,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG,EAAG,QAAO;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,eAAe,uBACb,KACA,KACA,KACA,KAIkB;AAClB,QAAM,WAAW,IAAI,MAAM,GAAG,EAAE,CAAC;AACjC,MAAI,aAAa,mBAAmB,IAAI,WAAW,OAAQ,QAAO;AAClE,QAAM,gBAAgB,KAAK,KAAK,EAAE,aAAa,IAAI,aAAa,aAAa,IAAI,eAAe,CAAC;AACjG,SAAO;AACT;AAgBA,SAAS,oBACP,KACA,KACA,KACS;AACT,MAAI,CAAC,IAAI,YAAa,QAAO;AAC7B,QAAM,QAAQ,IAAI,YAAY,GAAG;AACjC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,OAAO,EAAG,KAAI,UAAU,GAAG,CAAC;AACtE,MAAI,CAAC,MAAM,QAAS,QAAO;AAC3B,YAAU,KAAK,gBAAgB,qBAAqB,KAAK,QAAW,IAAI,SAAS;AACjF,aAAW;AAAA,IACT,QAAQ,IAAI,UAAU;AAAA,IACtB,KAAK,IAAI;AAAA,IACT,QAAQ;AAAA,IACR,UAAU,KAAK,IAAI,IAAI,IAAI;AAAA,IAC3B,WAAW,IAAI;AAAA,EACjB,CAAC;AACD,SAAO;AACT;AASA,eAAe,mBACb,KACA,KACA,KACkB;AAClB,MAAI,CAAC,IAAI,SAAU,QAAO;AAC1B,QAAM,cAAc,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC;AACxC,MAAI,gBAAgB,cAAc,IAAI,WAAW,OAAQ,QAAO;AAChE,QAAM,kBAAkB,KAAK,KAAK,IAAI,UAAU,IAAI,SAAS;AAC7D,aAAW;AAAA,IACT,QAAQ,IAAI,UAAU;AAAA,IACtB,KAAK,IAAI;AAAA,IACT,QAAQ,IAAI;AAAA,IACZ,UAAU,KAAK,IAAI,IAAI,IAAI;AAAA,IAC3B,WAAW,IAAI;AAAA,EACjB,CAAC;AACD,SAAO;AACT;AAEA,eAAe,kBACb,KACA,KACA,UACA,WACe;AACf,MAAI;AACF,UAAM,SAAmB,CAAC;AAC1B,UAAM,IAAI,QAAc,CAACC,WAAS,WAAW;AAC3C,UAAI,GAAG,QAAQ,CAAC,MAAM,OAAO,KAAK,CAAW,CAAC;AAC9C,UAAI,GAAG,OAAO,MAAM;AAClB,QAAAA,UAAQ;AAAA,MACV,CAAC;AACD,UAAI,GAAG,SAAS,MAAM;AAAA,IACxB,CAAC;AAGD,UAAM,UAAmB,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,CAAC;AACpE,UAAM,eAAuC,CAAC;AAC9C,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,UAAI,OAAO,MAAM,SAAU,cAAa,EAAE,YAAY,CAAC,IAAI;AAAA,IAC7D;AACA,UAAM,SAAS,MAAM,mBAAmB,SAAS;AAAA,MAC/C,KAAK,SAAS;AAAA,MACd;AAAA;AAAA;AAAA;AAAA,MAIA,SAAS,MAAM,QAAQ,QAAQ,EAAE,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;AAAA,IACvD,CAAC;AACD,QAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,QAAI,IAAI,KAAK,UAAU,MAAM,CAAC;AAAA,EAChC,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,cAAU,KAAK,eAAe,SAAS,KAAK,QAAW,SAAS;AAAA,EAClE;AACF;AAeA,eAAe,2BACb,cACA,QACkB;AAClB,QAAM,EAAE,KAAK,KAAK,WAAW,OAAO,IAAI,IAAI;AAC5C,MAAI;AACF,UAAM,aAAa,MAAM,aAAa,aAAa;AAAA;AAAA,MAEjD,SAAS,gCAAgC,GAAG;AAAA,MAC5C,UAAU;AAAA,MACV,KAAK,CAAC;AAAA,MACN;AAAA,IACF,CAAC;AACD,QAAI,WAAW,gBAAgB;AAC7B;AAAA,QACE;AAAA,UACE,QAAQ,IAAI,UAAU;AAAA,UACtB;AAAA,UACA,QAAQ,IAAI;AAAA,UACZ,UAAU,KAAK,IAAI,IAAI;AAAA,UACvB;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF,SAAS,KAAK;AACZ,cAAU,KAAK,gBAAiB,IAAc,SAAS,KAAK,QAAW,SAAS;AAChF,WAAO;AAAA,EACT;AACA,SAAO;AACT;AASA,eAAe,yBAAyB,KAUnB;AACnB,QAAM,UAAU,MAAM,0BAA0B;AAAA,IAC9C,gBAAgBA,SAAQ,IAAI,WAAW,aAAa;AAAA,IACpD,YAAY,IAAI;AAAA,IAChB,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,UAAU,IAAI;AAAA,IACd,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA;AAAA;AAAA,IAGf,YAAY,CAAC,OAAgB,YAC3B,WAAW,OAAO,SAAS,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,UAAU,UAAU,MAAM,CAAC;AAAA,EAC9F,CAAC;AACD,MAAI,CAAC,QAAS,QAAO;AACrB;AAAA,IACE;AAAA,MACE,SAAS,IAAI,IAAI,UAAU,OAAO,YAAY;AAAA,MAC9C,KAAK,IAAI;AAAA,MACT,QAAQ,IAAI,IAAI;AAAA,MAChB,UAAU,KAAK,IAAI,IAAI,IAAI;AAAA,MAC3B,WAAW,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,IACA,IAAI;AAAA,EACN;AACA,SAAO;AACT;AAEO,SAAS,oBACd,MACA,WACA,0BAC4B;AAG5B,QAAM,OACJ,4BAA4B,cAAc,2BACtC,EAAE,iBAAiB,yBAAyB,IAC3C,4BAA4B,CAAC;AAEpC,QAAM,aAAa,iBAAiB,IAAI;AACxC,QAAM,cAAc,KAAK,kBAAkB,kBAAkB,KAAK,eAAe,IAAI;AACrF,QAAM,eAAe,KAAK;AAC1B,QAAM,cAAc,KAAK;AACzB,QAAM,WAAW,KAAK;AAEtB,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,aAAa,KAAK;AACxB,QAAM,wBAAwB,KAAK,mBAAmB,CAAC;AACvD,QAAM,cAAc,EAAE,YAAY,QAAQ,IAAI,aAAa,aAAa;AAExE,QAAM,cAAc,KAAK,OAAO,kBAAkB,KAAK,IAAI,IAAI;AAC/D,QAAM,cAAc,KAAK;AACzB,QAAM,iBAAiB,KAAK;AAC5B,QAAM,qBAAqB,KAAK;AAChC,QAAM,wBAAwB,KAAK,yBAAyB,CAAC;AAE7D,SAAO,CAAC,KAAK,KAAK,SAAS;AAMzB,UAAM,SAAS,YAA2B;AACxC,YAAM,MAAM,IAAI,OAAO;AAKvB,UAAI,MAAM,uBAAuB,KAAK,KAAK,KAAK,EAAE,aAAa,eAAe,CAAC,GAAG;AAChF;AAAA,MACF;AAIA,UAAI,sBAAuB,MAAM,oBAAoB,KAAK,KAAK,kBAAkB,GAAI;AACnF;AAAA,MACF;AAEA,UAAI,0BAA0B,KAAK,qBAAqB,GAAG;AACzD,aAAK;AACL;AAAA,MACF;AAIA,UAAI,aAAa,gBAAgB,KAAK,GAAG,GAAG;AAC1C;AAAA,MACF;AAMA,YAAM,YAAY,eAAe,GAAG;AACpC,YAAM,QAAQ,KAAK,IAAI;AACvB,UAAI,UAAU,gBAAgB,SAAS;AACvC,UAAI,UAAU,cAAc,SAAS;AAGrC,2BAAqB,KAAK,uBAAuB,WAAW;AAE5D,mBAAa,aAAa,KAAK,GAAG;AAElC,UAAI,oBAAoB,KAAK,KAAK,EAAE,aAAa,WAAW,KAAK,MAAM,CAAC,GAAG;AACzE;AAAA,MACF;AAIA,UACE,gBACC,MAAM,2BAA2B,cAAc,EAAE,KAAK,KAAK,WAAW,OAAO,IAAI,CAAC,GACnF;AACA;AAAA,MACF;AAGA,UAAI,MAAM,mBAAmB,KAAK,KAAK,EAAE,KAAK,UAAU,WAAW,MAAM,CAAC,GAAG;AAC3E;AAAA,MACF;AAEA,YAAM,SAAS,iBAAiB,SAAS;AACzC,YAAM,QAAQ,WAAW,KAAK,MAAM;AAEpC,UAAI,CAAC,OAAO;AAEV,YACE,MAAM,yBAAyB;AAAA,UAC7B;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC,GACD;AACA;AAAA,QACF;AAEA,cAAM,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC;AAChC,cAAM,aAAa,OAAO,IAAI,CAAC,MAAM,EAAE,SAAS;AAChD,cAAM,aAAa,eAAe,SAAS,UAAU;AACrD,cAAM,MAAM,aACR,wBAAwB,OAAO,mBAAmB,UAAU,MAC5D;AACJ,kBAAU,KAAK,aAAa,KAAK,KAAK,QAAW,SAAS;AAC1D;AAAA,UACE;AAAA,YACE,QAAQ,IAAI,UAAU;AAAA,YACtB;AAAA,YACA,QAAQ;AAAA,YACR,UAAU,KAAK,IAAI,IAAI;AAAA,YACvB;AAAA,UACF;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA;AAAA,MACF;AAEA,YAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AAEjD,YAAM,aAAa;AAAA,QACjB,OAAO,MAAM;AAAA,QACb;AAAA,QACA,QAAQ,MAAM;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD;AAAA,QACE,EAAE,QAAQ,KAAK,QAAQ,IAAI,YAAY,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU;AAAA,QAC/E;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;;;AC1bA,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,WAAAC,gBAAe;AA0BxB,SAAS,kBAAkB,OAA0C;AACnE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,MAAI,EAAE,UAAU,OAAQ,QAAO;AAC/B,SAAO,OAAQ,MAAkC,SAAS;AAC5D;AAYO,SAAS,sBAAsB,QAAuB,MAAqC;AAChG,SAAO,YAAY,IAAI,CAAC,KAAK,KAAK,SAAS;AACzC,UAAM,YAAY;AAChB,YAAM,MAAM,IAAI,OAAO;AAEvB,UACE,IAAI,WAAW,OAAO,KACtB,IAAI,WAAW,IAAI,KACnB,IAAI,WAAW,gBAAgB,KAC/B,IAAI,SAAS,GAAG,GAChB;AACA,aAAK;AACL;AAAA,MACF;AAEA,UAAI;AACF,cAAM,YAAYC,SAAQ,KAAK,aAAa,YAAY;AAExD,YAAI,WAAWC,cAAa,WAAW,OAAO;AAC9C,mBAAW,MAAM,OAAO,mBAAmB,KAAK,QAAQ;AAMxD,cAAM,QAAQ,cAAc;AAC5B;AAAA,UACE;AAAA,UACA,KAAK,mBAAmB,CAAC;AAAA,UACzB,EAAE,YAAY,QAAQ,IAAI,aAAa,aAAa;AAAA,UACpD,EAAE,MAAM;AAAA,QACV;AAEA,cAAM,MAAO,MAAM,OAAO,cAAc,KAAK,oBAAoB;AACjE,cAAM,SAAS,MAAM,IAAI,OAAO,KAAK,EAAE,MAAM,CAAC;AAE9C,YAAI,UAAU,OAAO,WAAW,YAAY,cAAc,QAAQ;AAChE,cAAI,UAAU,KAAK;AAAA,YACjB,UAAU,OAAO,SAAS,QAAQ,IAAI,UAAU,KAAK;AAAA,UACvD,CAAC;AACD,cAAI,IAAI;AACR;AAAA,QACF;AAKA,YAAI;AACJ,YAAI,kBAAkB;AACtB,YAAI,OAAO,WAAW,UAAU;AAC9B,oBAAU;AAAA,QACZ,WAAW,kBAAkB,MAAM,GAAG;AACpC,oBAAU,OAAO;AACjB,gBAAM,WAAW,KAAK,UAAU,OAAO,aAAa,EAAE,QAAQ,MAAM,SAAS;AAC7E,4BAAkB,kBAAkB,KAAK,wCAAwC,QAAQ;AAAA,QAC3F,OAAO;AACL,oBAAU;AAAA,QACZ;AACA,cAAM,eAAe,6BAA6B,KAAK,QAAQ;AAC/D,YAAI,CAAC,cAAc;AACjB,cAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;AAClD,cAAI,IAAI,QAAQ;AAChB;AAAA,QACF;AAEA,cAAM,WAAW,SAAS,QAAQ,aAAa,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE;AACrE,cAAM,OACJ,SAAS,MAAM,GAAG,QAAQ,IAAI,UAAU,kBAAkB,SAAS,MAAM,QAAQ;AAEnF,YAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;AAClD,YAAI,IAAI,IAAI;AAAA,MACd,SAAS,KAAK;AACZ,eAAO,iBAAiB,GAAY;AACpC,gBAAQ,MAAM,mBAAmB,GAAG;AAEpC,aAAK;AACL;AAAA,MACF;AAAA,IACF,GAAG;AAAA,EACL,CAAC;AACH;;;ACzHA,SAAS,WAAAC,gBAAe;AAcjB,SAAS,eAAe,QAAuB,aAA2B;AAC/E,QAAM,WAAW,oBAAoBC,SAAQ,aAAa,QAAQ,CAAC;AACnE,MAAI,SAAS,WAAW,EAAG;AAI3B,QAAM,eAAe,OAAO;AAC5B,MAAI,CAAC,aAAc;AAGnB,OAAK,OAAO,IAAI,EACb,KAAK,CAAC,EAAE,gBAAgB,MAAM;AAC7B,UAAM,MAAM,IAAI,gBAAgB,EAAE,UAAU,KAAK,CAAC;AAElD,iBAAa,GAAG,WAAW,CAAC,SAA0B,QAAgB,SAAiB;AACrF,YAAM,YAAY;AAChB,cAAM,MAAM,QAAQ,OAAO;AAC3B,YAAI,CAAC,IAAI,WAAW,MAAM,EAAG;AAE7B,cAAM,SAAS,IAAI,MAAM,GAAG,EAAE,CAAC;AAC/B,cAAM,QAAQ,SAAS,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM;AACtD,YAAI,CAAC,OAAO;AACV,iBAAO,QAAQ;AACf;AAAA,QACF;AAEA,YAAI;AACF,gBAAM,MAAM,MAAM,OAAO,cAAc,MAAM,QAAQ;AACrD,gBAAM,UAAY,IAA8B,WAAW;AAE3D,cAAI,cAAc,SAAS,QAAQ,MAAM,CAAC,OAAO;AAC/C,iBAAK,QAAQ,SAAS,IAAI,OAAO;AACjC,eAAG,GAAG,WAAW,CAAC,SAAiB;AACjC,mBAAK,QAAQ,YAAY,IAAI,KAAK,SAAS,CAAC;AAAA,YAC9C,CAAC;AACD,eAAG,GAAG,SAAS,CAAC,MAAc,WAAmB;AAC/C,mBAAK,QAAQ,UAAU,IAAI,MAAM,MAAM;AAAA,YACzC,CAAC;AACD,eAAG,GAAG,SAAS,CAAC,QAAe;AAC7B,mBAAK,QAAQ,UAAU,IAAI,GAAG;AAAA,YAChC,CAAC;AAAA,UACH,CAAC;AAAA,QACH,QAAQ;AACN,iBAAO,QAAQ;AAAA,QACjB;AAAA,MACF,GAAG;AAAA,IACL,CAAC;AAAA,EACH,CAAC,EACA,MAAM,MAAM;AACX,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF,CAAC;AACL;;;AjBrBA,eAAsB,mBACpB,QACA,KACe;AAIf,MAAI,UAAU,QAAQ;AAGrB,EAAC,WAAuD,sBAAsB;AAG/E,SAAO,GAAG,GAAG,kCAAkC,MAAM;AACnD,QAAI;AACF,YAAM,OAAO,WAAW,IAAI,MAAM;AAClC,6BAAuB,IAAI;AAAA,IAC7B,QAAQ;AAAA,IAER;AAAA,EACF,CAAC;AAID,QAAM,YAAY,IAAI;AACtB,SAAO,YAAY;AAAA,IACjB,uBAAuB,QAAQ,WAAW;AAAA,MACxC,cAAc,IAAI;AAAA,MAClB,UAAU,IAAI;AAAA,MACd,YAAY,IAAI;AAAA,IAClB,CAAC;AAAA,EACH;AAIA,SAAO,YAAY;AAAA,IACjB,sBAAsB,QAAQ,IAAI,aAAa,IAAI,UAAU,IAAI,SAAS;AAAA,EAC5E;AAIA,QAAM,wBACJ,IAAI,YAAY,OAAO,KAAK,IAAI,QAAQ,EAAE,SAAS,IAC/C,OAAO,OAAO,IAAI,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,IAC9C,CAAC;AAGP,QAAM,qBAAqB,IAAI,8BAA8B,IAAI,mBAAmB;AACpF,SAAO,YAAY;AAAA,IACjB,oBAAoB,QAAQ,WAAW;AAAA,MACrC,iBAAiB,IAAI;AAAA,MACrB,cAAc,IAAI;AAAA,MAClB,UAAU,IAAI;AAAA,MACd,aAAa,IAAI;AAAA,MACjB,UAAU,IAAI;AAAA,MACd,iBAAiB,IAAI;AAAA,MACrB,YAAY,IAAI;AAAA,MAChB,MAAM,IAAI;AAAA,MACV,aAAa,IAAI;AAAA,MACjB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAGA,QAAM,aAAaC,SAAQ,IAAI,aAAa,gBAAgB;AAC5D,SAAO,QAAQ,GAAG,UAAU,CAAC,SAAS;AACpC,QAAI,SAAS,YAAY;AACvB,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAGD,MAAI,IAAI,YAAY;AAClB,0BAAsB,QAAQ;AAAA,MAC5B,aAAa,IAAI;AAAA,MACjB,sBAAsB,IAAI;AAAA,MAC1B,iBAAiB,IAAI;AAAA,IACvB,CAAC;AAAA,EACH;AAGA,WAAS,kBAAkB,UAAwB;AACjD,QAAI,CAAC,YAAY,SAAS,QAAQ,CAAC,EAAG;AACtC,QAAI,CAAC,SAAS,WAAW,IAAI,MAAM,EAAG;AAEtC,UAAM,MAAM,OAAO,YAAY,cAAc,IAAI,kBAAkB;AACnE,QAAI,KAAK;AACP,aAAO,YAAY,iBAAiB,GAAG;AACvC,aAAO,GAAG,KAAK,EAAE,MAAM,cAAc,CAAC;AAAA,IACxC;AAAA,EACF;AAEA,SAAO,QAAQ,GAAG,OAAO,iBAAiB;AAC1C,SAAO,QAAQ,GAAG,UAAU,iBAAiB;AAG7C,MAAI,IAAI,oBAAoB,QAAW;AACrC,UAAM,aAAa,IAAI;AACvB,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,wBAA4B;AAEnE,UAAM,mBAAmB,IAAI;AAC7B,UAAM,iBAAiBA,SAAQ,IAAI,aAAa,IAAI,eAAe;AACnE,UAAM,wBAAwB,CAAC,SAC7B,KAAK,WAAW,gBAAgB,KAAK,qBAAqB,KAAK,IAAI;AAErE,SAAK,cAAc,kBAAkB,gBAAgB,UAAU;AAE/D,WAAO,QAAQ,GAAG,UAAU,CAAC,SAAiB;AAC5C,UAAI,sBAAsB,IAAI,GAAG;AAC/B,aAAK,cAAc,kBAAkB,gBAAgB,UAAU;AAAA,MACjE;AAAA,IACF,CAAC;AACD,WAAO,QAAQ,GAAG,OAAO,CAAC,SAAiB;AACzC,UAAI,sBAAsB,IAAI,GAAG;AAC/B,aAAK,cAAc,kBAAkB,gBAAgB,UAAU;AAAA,MACjE;AAAA,IACF,CAAC;AACD,WAAO,QAAQ,GAAG,UAAU,CAAC,SAAiB;AAC5C,UAAI,sBAAsB,IAAI,GAAG;AAC/B,aAAK,cAAc,kBAAkB,gBAAgB,UAAU;AAAA,MACjE;AAAA,IACF,CAAC;AAAA,EACH;AAGA,iBAAe,QAAQ,IAAI,WAAW;AAGtC,SAAO,YAAY,KAAK,SAAS,MAAM;AACrC;AAAC,IAAC,WAAiD,sBAAsB;AAAA,EAC3E,CAAC;AACH;;;AkBlLA,SAAS,cAAAC,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,WAAAC,UAAS,QAAAC,aAAY;AAC9B,SAAS,qBAAqB;;;ACC9B,SAAS,cAAAC,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,WAAAC,UAAS,QAAAC,aAAY;AAW9B,SAAS,WAAW,MAAc,aAA8B;AAC9D,MAAI;AACF,UAAM,MAAMF,cAAaE,MAAK,aAAa,cAAc,GAAG,OAAO;AACnE,UAAM,MAAM,KAAK,MAAM,GAAG;AAK1B,WAAO;AAAA,MACL,IAAI,eAAe,IAAI,KAAK,IAAI,kBAAkB,IAAI,KAAK,IAAI,mBAAmB,IAAI;AAAA,IACxF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,SAAS,mBAAmB,MAAc,KAAwD;AAChG,MAAI,MAAM;AACV,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS;AACvC,UAAM,cAAcA,MAAK,KAAK,gBAAgB,GAAG,KAAK,MAAM,GAAG,GAAG,cAAc;AAChF,QAAIH,YAAW,WAAW,GAAG;AAC3B,UAAI;AACF,cAAM,MAAMC,cAAa,aAAa,OAAO;AAC7C,cAAM,MAAM,KAAK,MAAM,GAAG;AAE1B,YAAI,IAAI,SAAS,MAAM;AACrB,iBAAO,EAAE,MAAM,aAAa,SAAS,IAAI,QAAQ;AAAA,QACnD;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,SAASC,SAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAMA,SAAS,cAAc,MAAc,KAA+C;AAClF,QAAM,aAAa,CAAC,aAAa,kBAAkB,iBAAiB,UAAU;AAC9E,MAAI,MAAM;AACV,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS;AACvC,UAAM,SAASC,MAAK,KAAK,gBAAgB,GAAG,KAAK,MAAM,GAAG,CAAC;AAC3D,eAAW,aAAa,YAAY;AAClC,YAAM,QAAQA,MAAK,QAAQ,SAAS;AACpC,UAAIH,YAAW,KAAK,EAAG,QAAO,EAAE,eAAe,MAAM;AAAA,IACvD;AACA,UAAM,SAASE,SAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAIA,SAAS,sBACP,OACA,cAC2C;AAC3C,MAAI,MAAMA,SAAQ,KAAK;AAEvB,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAM,YAAYC,MAAK,KAAK,cAAc;AAC1C,QAAIH,YAAW,SAAS,GAAG;AACzB,UAAI;AACF,cAAM,MAAMC,cAAa,WAAW,OAAO;AAC3C,cAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,YAAI,IAAI,SAAS,cAAc;AAC7B,iBAAO,EAAE,MAAM,WAAW,SAAS,IAAI,QAAQ;AAAA,QACjD;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,SAASC,SAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAEO,SAAS,cAAc,MAAc,KAA2B;AACrE,MAAI,CAAC,WAAW,MAAM,GAAG,GAAG;AAC1B,WAAO,EAAE,WAAW,MAAM;AAAA,EAC5B;AAEA,QAAM,UAAU,mBAAmB,MAAM,GAAG;AAC5C,MAAI,SAAS;AACX,WAAO;AAAA,MACL,WAAW;AAAA,MACX,SAAS,QAAQ;AAAA,MACjB,cAAc,QAAQ;AAAA,IACxB;AAAA,EACF;AAKA,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAM,SAASC,MAAK,KAAK,gBAAgB,GAAG,KAAK,MAAM,GAAG,CAAC;AAC3D,UAAM,YAAYA,MAAK,QAAQ,cAAc;AAC7C,QAAIH,YAAW,SAAS,GAAG;AACzB,UAAI;AACF,cAAM,MAAMC,cAAa,WAAW,OAAO;AAC3C,cAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,YAAI,IAAI,SAAS,MAAM;AACrB,iBAAO,EAAE,WAAW,MAAM,SAAS,IAAI,SAAS,cAAc,UAAU;AAAA,QAC1E;AAAA,MACF,QAAQ;AAAA,MAER;AACA,aAAO,EAAE,WAAW,KAAK;AAAA,IAC3B;AACA,UAAM,SAASC,SAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AAIA,QAAM,QAAQ,cAAc,MAAM,GAAG;AACrC,MAAI,OAAO;AACT,UAAM,SAAS,sBAAsB,MAAM,eAAe,IAAI;AAC9D,QAAI,QAAQ;AACV,aAAO,EAAE,WAAW,MAAM,SAAS,OAAO,SAAS,cAAc,OAAO,KAAK;AAAA,IAC/E;AACA,WAAO,EAAE,WAAW,KAAK;AAAA,EAC3B;AAEA,SAAO,EAAE,WAAW,MAAM;AAC5B;;;ADpIA,SAAS,sBAAsB,MAAc,KAA4B;AACvE,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAM,SAASE,MAAK,KAAK,gBAAgB,GAAG,KAAK,MAAM,GAAG,CAAC;AAC3D,UAAM,cAAcA,MAAK,QAAQ,cAAc;AAC/C,QAAIC,YAAW,WAAW,GAAG;AAC3B,UAAI;AACF,cAAM,MAAMC,cAAa,aAAa,OAAO;AAC7C,cAAM,MAAM,KAAK,MAAM,GAAG;AAK1B,YAAI;AACJ,cAAM,YAAY,IAAI,UAAU,GAAG;AACnC,YAAI,OAAO,cAAc,SAAU,SAAQ;AAAA,iBAClC,aAAa,OAAO,cAAc,UAAU;AACnD,kBAAQ,UAAU,UAAU,UAAU;AAAA,QACxC;AACA,kBAAU,IAAI,UAAU,IAAI;AAC5B,YAAI,CAAC,MAAO,QAAO;AAEnB,cAAM,UAAU,MAAM,QAAQ,SAAS,EAAE;AACzC,eAAO,cAAcF,MAAK,QAAQ,OAAO,CAAC,EAAE;AAAA,MAC9C,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,SAASG,SAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAiC;AACtD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AAEjC,MAAI,EAAE,UAAU,OAAQ,QAAO;AAC/B,SAAO,OAAQ,MAAkC,SAAS;AAC5D;AAYA,SAAS,sBAAsB,OAAiC;AAC9D,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,SAAmB,CAAC;AAC1B,eAAW,SAAS,OAAO;AACzB,UAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAClC,aAAO,KAAK,KAAK;AAAA,IACnB;AACA,WAAO,OAAO,SAAS,IAAI,SAAS;AAAA,EACtC;AACA,MAAI,cAAc,KAAK,EAAG,QAAO,CAAC,KAAK;AACvC,SAAO;AACT;AAQA,eAAsB,mBACpB,KACA,MACmB;AACnB,MAAI,MAAM,YAAY,MAAO,QAAO,CAAC;AAErC,QAAM,WAAW,cAAc,eAAe,GAAG;AACjD,MAAI,CAAC,SAAS,UAAW,QAAO,CAAC;AAGjC,MAAI,MAAM,0BAA0B,MAAM,uBAAuB;AAE/D,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,iBAAiB,cAAc,qBAAqB,GAAG;AAC7D,MAAI,CAAC,eAAe,WAAW;AAC7B,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO,CAAC;AAAA,EACV;AAUA,QAAM,cAAc,sBAAsB,qBAAqB,GAAG;AAClE,MAAI,CAAC,aAAa;AAChB,YAAQ;AAAA,MACN,uFAAuF,GAAG;AAAA,IAC5F;AACA,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,kBAAe,MAAM,OAAO;AAAA,EAC9B,SAAS,KAAK;AACZ,YAAQ;AAAA,MACN,sDAAuD,IAAc,OAAO;AAAA,IAC9E;AACA,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,iBAAiB,cAAc,eAAe,GAAG;AACvD,QAAM,WAAW,eAAe,eAC5B,eAAe,aAAa,QAAQ,uBAAuB,EAAE,IAC7D;AACJ,QAAM,eAAe,WAAWC,MAAK,UAAU,QAAQ,gBAAgB,IAAI;AAC3E,MAAI,CAAC,gBAAgB,CAACC,YAAW,YAAY,GAAG;AAC9C,YAAQ;AAAA,MACN,wDAAwD,OAAO,YAAY,CAAC;AAAA,IAC9E;AACA,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACF,YAAS,MAAM,OAAO,cAAc,YAAY,EAAE;AAAA,EACpD,SAAS,KAAK;AACZ,YAAQ;AAAA,MACN,4DAA6D,IAAc,OAAO;AAAA,IACpF;AACA,WAAO,CAAC;AAAA,EACV;AAEA,MAAI,OAAO,YAAY,YAAY,YAAY;AAC7C,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO,CAAC;AAAA,EACV;AACA,MAAI,OAAO,MAAM,YAAY,YAAY;AACvC,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO,CAAC;AAAA,EACV;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,qBAAkB,YAAY,QAA0B;AAAA,EAC1D,SAAS,KAAK;AACZ,YAAQ,KAAK,wCAAyC,IAAc,OAAO,EAAE;AAC7E,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AAGF,eAAY,MAAM,QAAuD;AAAA,MACvE,UAAU;AAAA,IACZ,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,KAAK,8CAA+C,IAAc,OAAO,EAAE;AACnF,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,kBAAkB,sBAAsB,cAAc;AAC5D,MAAI,oBAAoB,MAAM;AAC5B,YAAQ,KAAK,8EAA8E;AAC3F,WAAO,CAAC;AAAA,EACV;AACA,QAAM,YAAY,sBAAsB,QAAQ;AAChD,MAAI,cAAc,MAAM;AACtB,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO,CAAC;AAAA,EACV;AAEA,SAAO,CAAC,GAAG,iBAAiB,GAAG,SAAS;AAC1C;;;AEvOA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,WAAAC,gBAAe;AAiBjB,SAAS,mBAAmB,YAA4B;AAC7D,MAAID,YAAWC,SAAQ,YAAY,QAAQ,CAAC,GAAG;AAC7C,WAAO;AAAA,EACT;AACA,SAAOA,SAAQ,YAAY,IAAI;AACjC;;;ACtBA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,WAAAC,gBAAe;;;ACUjB,IAAM,sBAAsB;AAC5B,IAAM,uBAAuB;AAEpC,IAAM,aAAa,8BAA8B,mBAAmB;AAQ7D,SAAS,qBACd,MACA,MACsB;AAEtB,MAAI,CAAC,KAAK,MAAO,QAAO,EAAE,MAAM,UAAU,MAAM;AAEhD,MAAI,KAAK,YAAY,MAAO,QAAO,EAAE,MAAM,UAAU,MAAM;AAG3D,MAAI,KAAK,SAAS,mBAAmB,GAAG;AACtC,WAAO,EAAE,MAAM,UAAU,MAAM;AAAA,EACjC;AAGA,QAAM,mBAAmB;AACzB,MAAI,iBAAiB,KAAK,IAAI,GAAG;AAC/B,WAAO;AAAA,MACL,MAAM,KAAK,QAAQ,kBAAkB,CAAC,UAAU,OAAO,UAAU;AAAA,IAAO,KAAK,EAAE;AAAA,MAC/E,UAAU;AAAA,IACZ;AAAA,EACF;AAGA,SAAO;AAAA,IACL;AAAA,IACA,UAAU;AAAA,IACV,SACE;AAAA,EACJ;AACF;;;ACzCA,IAAM,mBAAmB;AACzB,IAAMC,cAAa,8BAA8B,gBAAgB;AAQ1D,SAAS,kBAAkB,MAA4B;AAK5D,MAAI,KAAK,SAAS,gBAAgB,GAAG;AACnC,WAAO,EAAE,MAAM,UAAU,MAAM;AAAA,EACjC;AAGA,QAAM,mBAAmB;AACzB,MAAI,iBAAiB,KAAK,IAAI,GAAG;AAC/B,WAAO;AAAA,MACL,MAAM,KAAK,QAAQ,kBAAkB,CAAC,UAAU,OAAOA,WAAU;AAAA,IAAO,KAAK,EAAE;AAAA,MAC/E,UAAU;AAAA,IACZ;AAAA,EACF;AAGA,SAAO;AAAA,IACL,MAAM,GAAG,IAAI;AAAA,EAAKA,WAAU;AAAA,IAC5B,UAAU;AAAA,IACV,SACE;AAAA,EACJ;AACF;;;ACvBA,IAAM,UAA8B;AAAA,EAClC;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AACF;AAmCO,SAAS,kBACd,MACA,MACyB;AACzB,MAAI,CAAC,KAAK,MAAO,QAAO,EAAE,MAAM,UAAU,CAAC,EAAE;AAE7C,QAAM,eAAyB,CAAC;AAChC,aAAW,UAAU,SAAS;AAC5B,QAAI,CAAC,KAAK,WAAW,OAAO,WAAW,EAAG;AAE1C,QAAI,KAAK,SAAS,OAAO,IAAI,EAAG;AAChC,iBAAa,KAAK,gCAAgC,OAAO,IAAI,MAAM;AAAA,EACrE;AAEA,MAAI,aAAa,WAAW,EAAG,QAAO,EAAE,MAAM,UAAU,CAAC,EAAE;AAE3D,QAAM,SAAS,aAAa,KAAK,QAAQ;AAEzC,QAAM,mBAAmB;AACzB,MAAI,iBAAiB,KAAK,IAAI,GAAG;AAC/B,WAAO;AAAA,MACL,MAAM,KAAK,QAAQ,kBAAkB,CAAC,UAAU,OAAO,MAAM;AAAA,IAAO,KAAK,EAAE;AAAA,MAC3E,UAAU;AAAA,IACZ;AAAA,EACF;AAEA,QAAM,kBAAkB;AACxB,MAAI,gBAAgB,KAAK,IAAI,GAAG;AAC9B,WAAO;AAAA,MACL,MAAM,KAAK,QAAQ,iBAAiB,CAAC,UAAU,GAAG,KAAK;AAAA,MAAS,MAAM,EAAE;AAAA,MACxE,UAAU;AAAA,IACZ;AAAA,EACF;AAGA,SAAO,EAAE,MAAM,GAAG,MAAM;AAAA,EAAK,IAAI,IAAI,UAAU,aAAa;AAC9D;;;AH5EO,SAAS,sBAAsB,MAAc,KAA+B;AAEjF,QAAM,QAAQ,kBAAkB,IAAI;AAEpC,MAAI,MAAM,QAAS,SAAQ,KAAK,MAAM,OAAO;AAC7C,MAAI,OAAO,MAAM;AAGjB,QAAM,WAAW,qBAAqB,MAAM;AAAA,IAC1C,OAAO,IAAI,UAAU;AAAA,IACrB,SAAS,IAAI;AAAA,EACf,CAAC;AAED,MAAI,SAAS,QAAS,SAAQ,KAAK,SAAS,OAAO;AACnD,SAAO,SAAS;AAShB,QAAM,SAAS,kBAAkB,MAAM;AAAA,IACrC,OAAO,IAAI,UAAU;AAAA,IACrB,YAAY,CAAC,SAASC,YAAWC,SAAQ,IAAI,aAAa,gBAAgB,GAAG,KAAK,MAAM,GAAG,CAAC,CAAC;AAAA,EAC/F,CAAC;AACD,SAAO,OAAO;AAEd,SAAO;AACT;;;AIzCO,SAAS,oBAAoB,UAA8B,CAAC,GAAW;AAC5E,MAAI,QAAQ,WAAW;AACrB,WAAO,uBAAuB,OAAO;AAAA,EACvC;AACA,SAAO,wBAAwB,OAAO;AACxC;AAOA,SAAS,eAAe,SAAqC;AAC3D,QAAM,QAAQ,QAAQ,QAAQ,SAAS;AAyBvC,MAAI,QAAQ,QAAQ;AAClB,WAAO;AAAA,MACL,iEAAiE,KAAK;AAAA,MACtE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACA,SAAO;AAAA;AAAA;AACT;AAOA,SAAS,8BAAsC;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,wBAAwB,SAAqC;AACpE,QAAM,eAAe,QAAQ,SAAS;AAAA,IAAmD;AACzF,QAAM,UAAU,eAAe,OAAO;AACtC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,OAAO;AAAA,IACxB;AAAA,IACA,4BAA4B;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAIA,SAAS,qBAAqB,SAA2B;AACvD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,OAAO;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,SAA2B;AACxD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,OAAO;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,SAA2B;AACrD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,OAAO;AAAA,IACxB;AAAA,IACA,4BAA4B;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,SAAqC;AACnE,QAAM,eAAe,QAAQ,SAAS;AAAA,IAAmD;AACzF,QAAM,UAAU,eAAe,OAAO;AACtC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,qBAAqB,OAAO;AAAA,IAC/B;AAAA,IACA,GAAG,sBAAsB,OAAO;AAAA,IAChC;AAAA,IACA,GAAG,mBAAmB,OAAO;AAAA,EAC/B,EAAE,KAAK,IAAI;AACb;;;AClQO,SAAS,oBAAoB,KAAe,OAA2B,CAAC,GAAW;AACxF,QAAM,aAAa,MAAM,gBAAgB;AAIzC,QAAM,gBAA0B,CAAC;AACjC,MAAI,KAAK,QAAQ;AACf,kBAAc;AAAA,MACZ;AAAA,MACA;AAAA,IACF;AACA,UAAM,cAAc,KAAK,OAAO,UAAU,QAAQ,kBAAkB;AACpE,kBAAc;AAAA,MACZ,uBAAuB,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,KAAK,QAAQ,SAAS;AAGpC,QAAM,aAAa,KAAK,SACpB,iEAAiE,KAAK;AAAA;AAAA;AAAA;AAAA,SACtE;AAAA;AAAA;AAEJ,QAAM,aAAa,MACf,KAAK,UAAU;AAAA,MAAa,UAAU;AAAA,OACtC,KAAK,UAAU;AAAA,MAAqB,UAAU;AAAA;AAYlD,QAAM,gBAAgB,MAClB,sGACA;AAsBJ,QAAM,eAAe,MACjB;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IACA,CAAC;AAKL,QAAM,cAAc,MAChB;AAAA,IACE;AAAA,IACA;AAAA,IACA,GAAG,aAAa,IAAI,CAAC,MAAM,SAAS,CAAC;AAAA,IACrC;AAAA,IACA;AAAA,IACA;AAAA,EACF,IACA,CAAC,aAAa,YAAY,GAAG;AAEjC,QAAM,kBAAkB,MACpB,qEACA;AAEJ,QAAM,qBAAqB,MACvB,oFACA;AAEJ,SAAO;AAAA,IACL;AAAA,IACA,YAAY,UAAU;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,EACL,EAAE,KAAK,IAAI;AACb;;;ACxHA,SAAS,cAAc,GAAmB;AACxC,SAAO,EAAE,QAAQ,OAAO,GAAG;AAC7B;AAEA,SAAS,YAAY,SAAiB,QAAwB;AAC5D,QAAM,OAAO,QAAQ,QAAQ,iBAAiB,GAAG,KAAK;AACtD,SAAO,GAAG,MAAM,IAAI,IAAI;AAC1B;AAQA,SAAS,YAAY,MAAyB;AAC5C,MAAI,KAAK,SAAS,SAAU,QAAO;AACnC,MAAI,KAAK,QAAS,QAAO,IAAI,KAAK,QAAQ,SAAS;AACnD,SAAO,KAAK;AACd;AAYA,SAAS,eAAe,SAAmB,SAAyB;AAClE,QAAM,SAAS,CAAC,GAAG,SAAS,OAAO,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AAC7D,SAAO,MAAM;AACf;AAQA,SAAS,OAAO,eAA8B,UAA8B,SAAuB;AACjG,MAAI,aAAa,QAAW;AAC1B,kBAAc,KAAK,EAAE,SAAS,YAAY,cAAc,QAAQ,EAAE,CAAC;AAAA,EACrE;AACF;AAEA,SAAS,cAAc,MAAiB,SAAmB,KAA4B;AACrF,QAAM,MAAM,KAAK,WAAW;AAC5B,QAAM,YAAY,eAAe,SAAS,YAAY,IAAI,CAAC;AAE3D,MAAI,KAAK,SAAS,QAAW;AAC3B,QAAI,UAAU,KAAK;AAAA,MACjB,SAAS,YAAY,KAAK,MAAM;AAAA,MAChC,YAAY,cAAc,KAAK,IAAI;AAAA,MACnC;AAAA,IACF,CAAC;AAAA,EACH;AACA,MAAI,KAAK,WAAW,OAAW,KAAI,YAAY,QAAQ;AACvD,SAAO,IAAI,eAAe,KAAK,QAAQ,YAAY,KAAK,QAAQ,CAAC;AACjE,SAAO,IAAI,eAAe,KAAK,OAAO,YAAY,KAAK,OAAO,CAAC;AAC/D,SAAO,IAAI,eAAe,KAAK,SAAS,YAAY,KAAK,SAAS,CAAC;AACnE,SAAO,IAAI,eAAe,KAAK,UAAU,YAAY,KAAK,UAAU,CAAC;AACrE,aAAW,SAAS,KAAK,UAAU;AACjC,UAAM,eAAe,YAAY,IAAI;AACrC,UAAM,cAAc,eAAe,CAAC,GAAG,SAAS,YAAY,IAAI;AAChE,kBAAc,OAAO,aAAa,GAAG;AAAA,EACvC;AACF;AAEO,SAAS,sBAAsB,MAAyB;AAI7D,QAAM,MAAuB;AAAA,IAC3B,eAAe,CAAC;AAAA,IAChB,WAAW,CAAC;AAAA,IACZ,aAAa,EAAE,OAAO,MAAM;AAAA,EAC9B;AACA,gBAAc,MAAM,CAAC,GAAG,GAAG;AAC3B,QAAM,gBAAgB,IAAI;AAC1B,QAAM,YAAY,IAAI;AACtB,QAAM,cAAc,IAAI;AAUxB,QAAM,QAAkB,CAAC,yCAAyC;AAElE,MAAI,YAAY,OAAO;AACrB,UAAM,KAAK,uCAAuC;AAAA,EACpD;AAEA,QAAM,KAAK,EAAE;AAGb,aAAW,OAAO,eAAe;AAC/B,UAAM,KAAK,UAAU,IAAI,OAAO,UAAU,IAAI,UAAU,GAAG;AAAA,EAC7D;AAGA,aAAW,MAAM,WAAW;AAC1B,UAAM,KAAK,SAAS,GAAG,OAAO,+BAA+B,GAAG,UAAU,KAAK;AAAA,EACjF;AAEA,QAAM,KAAK,EAAE;AAKb,QAAM,iBAAiB,UAAU;AAAA,IAC/B,CAAC,OAAO,MAAM,GAAG,SAAS,oBAAoB,GAAG,UAAU;AAAA,EAC7D;AAGA,QAAM,KAAK,mCAAmC;AAC9C,aAAW,KAAK,eAAgB,OAAM,KAAK,CAAC;AAC5C,QAAM,KAAK,KAAK,EAAE;AAIlB,WAAS,mBAAmB,MAAiB,KAAqB;AAChE,UAAM,eAAyB,CAAC;AAKhC,QAAI,KAAK,MAAM;AACb,YAAM,UAAU,YAAY,KAAK,MAAM;AACvC,YAAM,aAAa,KAAK,UACpB,uBAAuB,YAAY,KAAK,SAAS,CAAC,MAClD;AACJ,YAAM,cAAc,6CAA6C,UAAU,2BAA2B,OAAO;AAC7G,mBAAa,KAAK,2BAA2B,WAAW,IAAI;AAAA,IAC9D;AAGA,eAAW,SAAS,KAAK,UAAU;AACjC,mBAAa,KAAK,eAAe,OAAO,KAAK,CAAC;AAAA,IAChD;AAGA,QAAI,KAAK,UAAU;AACjB,YAAM,QAAQ,YAAY,KAAK,UAAU;AACzC,mBAAa,KAAK,6CAA6C,KAAK,KAAK;AAAA,IAC3E;AAEA,QAAI,MAAM,IAAI,aAAa,KAAK,IAAI,CAAC;AACrC,QAAI,KAAK,OAAO;AACd,YAAM,SAAS,YAAY,KAAK,OAAO;AACvC,YAAM,wCAAwC,MAAM,gBAAgB,GAAG;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AAGA,WAAS,eAAe,MAAiB,QAAyB;AAChE,UAAM,MAAM,KAAK,WAAW;AAC5B,UAAM,gBAAgB,mBAAmB,MAAM,GAAG;AAGlD,QAAI,KAAK,QAAQ;AACf,YAAM,YAAY,YAAY,KAAK,QAAQ;AAC3C,YAAM,WAAW,SAAS,cAAc,UAAU,YAAY,IAAI,CAAC;AAMnE,aAAO,KAAK,QAAQ,kCAAkC,SAAS,2DAA2D,aAAa;AAAA,IACzI;AAGA,QAAI,QAAQ;AACV,UAAI,KAAK,SAAS,WAAW,KAAK,CAAC,KAAK,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AAC7E,eAAO;AAAA,MACT;AAEA,aAAO,0BAA0B,aAAa;AAAA,IAChD;AAGA,QAAI,KAAK,QAAQ,KAAK,SAAS,WAAW,KAAK,CAAC,KAAK,SAAS,CAAC,KAAK,UAAU;AAC5E,YAAM,UAAU,YAAY,KAAK,MAAM;AACvC,YAAM,aAAa,KAAK,UACpB,uBAAuB,YAAY,KAAK,SAAS,CAAC,MAClD;AACJ,YAAM,cAAc,6CAA6C,UAAU,2BAA2B,OAAO;AAC7G,aAAO,YAAY,YAAY,IAAI,CAAC,eAAe,WAAW;AAAA,IAChE;AAGA,WAAO,YAAY,YAAY,IAAI,CAAC,gBAAgB,aAAa;AAAA,EACnE;AAEA,QAAM,cAAc,eAAe,MAAM,IAAI;AAC7C,QAAM,KAAK,0BAA0B,WAAW,GAAG;AAEnD,SAAO,MAAM,KAAK,IAAI;AACxB;;;ACvKO,SAAS,uBAAuB,IAAY,KAA2C;AAC5F,MAAI,OAAO,IAAI,iBAAkB,QAAO,IAAI;AAC5C,MAAI,OAAO,IAAI,oBAAqB,QAAO,IAAI;AAC/C,MAAI,OAAO,IAAI,wBAAyB,QAAO,IAAI;AACnD,MAAI,OAAO,IAAI,0BAA2B,QAAO,IAAI;AAGrD,MAAI,OAAO,oBAAqB,QAAO;AACvC,SAAO;AACT;AAEO,SAAS,kBAAkB,IAAY,KAA4C;AACxF,MAAI,OAAO,IAAI,IAAI,mBAAmB;AACpC,WAAO,oBAAoB,IAAI,YAAY;AAAA,MACzC,QAAQ,IAAI,QAAQ,UAChB,EAAE,OAAO,IAAI,OAAO,OAAO,OAAO,OAAO,IAAI,OAAO,OAAO,MAAM,IACjE;AAAA,IACN,CAAC;AAAA,EACH;AACA,MAAI,OAAO,IAAI,IAAI,sBAAsB;AACvC,UAAM,OAAO,WAAW,IAAI,MAAM;AAGlC,2BAAuB,IAAI;AAC3B,WAAO,sBAAsB,IAAI;AAAA,EACnC;AACA,MAAI,OAAO,IAAI,IAAI,0BAA0B;AAK3C,WAAO,oBAAoB;AAAA,MACzB,WAAW,IAAI;AAAA,MACf,QAAQ,IAAI,QAAQ,UAAU,EAAE,OAAO,IAAI,OAAO,OAAO,MAAM,IAAI;AAAA,IACrE,CAAC;AAAA,EACH;AACA,MAAI,OAAO,IAAI,IAAI,4BAA4B;AAE7C,UAAM,QAAQ,IAAI,aAAa,QAAQ;AACvC,WAAO;AAAA,MACL;AAAA,MACA,wCAAwC,KAAK,UAAU,KAAK,CAAC;AAAA,MAC7D,mCAAmC,KAAK,UAAU,KAAK,CAAC;AAAA,IAC1D,EAAE,KAAK,IAAI;AAAA,EACb;AACA,MAAI,OAAO,sBAAsB;AAE/B,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACA,SAAO;AACT;;;AC3DO,SAAS,sBAAsB,aAA+C;AACnF,SAAO;AACT;AAEO,IAAM,sCAAN,cAAkD,MAAM;AAAA,EAC7D,YAAY,iBAAyB,IAAY;AAC/C;AAAA,MACE,gBAAgB,eAAe,gCAAgC,EAAE,+DACJ,eAAe;AAAA,IAE9E;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iCAAN,cAA6C,MAAM;AAAA,EACxD,YAAY,iBAAyB,MAAc;AACjD;AAAA,MACE,gBAAgB,eAAe,8BAA8B,IAAI;AAAA,IAEnE;AACA,SAAK,OAAO;AAAA,EACd;AACF;AA4BO,SAAS,0BACd,SACqB;AACrB,QAAM,eAAkC,CAAC;AACzC,QAAM,iBAAiB,oBAAI,IAA6C;AACxE,QAAM,SAAmE,CAAC;AAC1E,QAAM,aAAa,IAAI,IAAI,QAAQ,cAAc;AAEjD,WAAS,gBAAgB,iBAAyB,OAA0C;AAC1F,WAAO;AAAA,MACL,GAAG;AAAA,MACH,kBAAkB,CAAC,IAAY,SAAiB;AAC9C,yBAAiB,iBAAiB,IAAI,IAAI;AAAA,MAC5C;AAAA,MACA,UAAU,CAAC,MAAc,YAA0B;AACjD,iBAAS,iBAAiB,MAAM,OAAO;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AAEA,WAAS,iBAAiB,iBAAyB,IAAY,MAAoB;AACjF,UAAM,iBAAiB,uBAAuB,eAAe;AAC7D,QAAI,CAAC,GAAG,WAAW,cAAc,GAAG;AAClC,YAAM,IAAI,oCAAoC,iBAAiB,EAAE;AAAA,IACnE;AACA,mBAAe,IAAI,IAAI,EAAE,MAAM,OAAO,gBAAgB,CAAC;AAAA,EACzD;AAEA,WAAS,SAAS,iBAAyB,MAAc,SAA6B;AACpF,QAAI,WAAW,IAAI,IAAI,GAAG;AACxB,YAAM,IAAI,+BAA+B,iBAAiB,IAAI;AAAA,IAChE;AACA,QAAI,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,GAAG;AACvC,YAAM,IAAI,+BAA+B,iBAAiB,IAAI;AAAA,IAChE;AACA,WAAO,KAAK,EAAE,MAAM,OAAO,iBAAiB,QAAQ,CAAC;AAAA,EACvD;AAEA,SAAO;AAAA,IACL,oBAAoB,aAAa;AAC/B,mBAAa,KAAK,WAAW;AAAA,IAC/B;AAAA,IACA,MAAM,KAAK,UAAU,SAAS;AAC5B,iBAAW,QAAQ,cAAc;AAC/B,cAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,YAAI,CAAC,KAAM;AACX,YAAI;AACF,gBAAM,KAAK,gBAAgB,KAAK,MAAM,OAAO,CAAC;AAAA,QAChD,SAAS,KAAK;AACZ,gBAAM,IAAI,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAC5D,gBAAM,UAAU,IAAI;AAAA,YAClB,gBAAgB,KAAK,IAAI,WAAW,QAAQ,YAAY,EAAE,OAAO;AAAA,UACnE;AACC,UAAC,QAAgC,QAAQ;AAC1C,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,IAAI;AACnB,aAAO,eAAe,IAAI,EAAE,GAAG;AAAA,IACjC;AAAA,IACA,qBAAqB;AACnB,aAAO,MAAM,KAAK,eAAe,KAAK,CAAC;AAAA,IACzC;AAAA,IACA,aAAa;AACX,aAAO,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,MAAM,EAAE;AAAA,IAC7D;AAAA;AAAA,IAEA,MAAM,SAAS,iBAAiB,WAAW,UAAU;AAGnD,sBAAgB,iBAAiB,QAAQ;AAEzC,UAAI,OAAO,SAAS,qBAAqB,YAAY;AACnD,iBAAS;AAAA,UACP,uBAAuB,eAAe;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;A3CnHA,IAAM,mBAAmB;AACzB,IAAM,oBAAoB;AAC1B,IAAM,sBAAsB;AAC5B,IAAM,uBAAuB;AAC7B,IAAM,0BAA0B;AAChC,IAAM,2BAA2B;AACjC,IAAM,4BAA4B;AAClC,IAAM,6BAA6B;AA+DnC,SAAS,mBAAmB,aAAqBC,WAAsC;AACrF,QAAM,aAAa,CAAC,OAAO,OAAO,QAAQ,MAAM;AAChD,MAAI,MAAM;AACV,WAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS;AACtC,eAAW,OAAO,YAAY;AAC5B,YAAM,YAAYC,UAAQ,KAAK,GAAGD,SAAQ,GAAG,GAAG,EAAE;AAClD,UAAIE,YAAW,SAAS,EAAG,QAAO;AAAA,IACpC;AACA,UAAM,SAASC,SAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAiBA,eAAsB,gBACpB,eACmB;AACnB,QAAM,UACJ,OAAO,kBAAkB,WAAW,EAAE,MAAM,cAAc,IAAK,iBAAiB,CAAC;AACnF,QAAM,cAAc,QAAQ,QAAQ,QAAQ,IAAI;AAGhD,QAAM,eAAeF,UAAQ,aAAa,QAAQ,aAAa,QAAQ;AAGvE,QAAM,gBAAgB,QAAQ,aAAa;AAE3C,QAAM,yBAAyB,mBAAmB,aAAa,iBAAiB;AAChF,QAAM,wBAAwB,mBAAmB,aAAa,gBAAgB;AAC9E,QAAM,YAAY,MAAM,mBAAmB,aAAa;AAAA,IACtD;AAAA,IACA;AAAA,EACF,CAAC;AAID,QAAM,kBAA4B,CAAC;AACnC,MAAI,QAAQ,YAAY,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,GAAG;AAChE,UAAM,EAAE,0BAA0B,IAAI,MAAM,OAAO,qCAA4B;AAC/E,oBAAgB;AAAA,MACd,0BAA0B;AAAA,QACxB,KAAK;AAAA,QACL,UAAU,QAAQ;AAAA,MACpB,CAAC;AAAA,IACH;AAAA,EACF;AAIA,QAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,gCAAuB;AACrE,QAAM,kBAAkB,qBAAqB;AAAA,IAC3C,KAAK;AAAA,IACL,WAAW;AAAA,IACX,SAASA,UAAQ,aAAa,UAAU;AAAA,EAC1C,CAAC;AAOD,QAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,sCAA6B;AAC3E,QAAM,gBAAgB,qBAAqB;AAAA,IACzC,WAAW;AAAA,IACX,SAASA,UAAQ,aAAa,UAAU;AAAA,EAC1C,CAAC;AAKD,QAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,mCAA0B;AAC3E,QAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,4BAA2B;AACrE,QAAM,qBAAqB,wBAAwB;AAAA,IACjD;AAAA,IACA,WAAW;AAAA,IACX,SAASA,UAAQ,aAAa,UAAU;AAAA;AAAA;AAAA,IAGxC,cAAc,MAAM,iBAAiB,cAAc,aAAa,aAAa;AAAA,EAC/E,CAAC;AAKD,QAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,iCAAwB;AACvE,QAAM,kBAAkB,sBAAsB;AAAA,IAC5C,WAAW;AAAA,EACb,CAAC;AAMD,QAAM,EAAE,6BAA6B,IAAI,MAAM,OAAO,wCAA+B;AACrF,QAAM,4BAA4B,6BAA6B;AAAA,IAC7D,WAAW;AAAA,EACb,CAAC;AAED,SAAO;AAAA,IACL,WAAW,aAAa;AAAA,IACxB,GAAG;AAAA,IACH,GAAG;AAAA;AAAA,IAEH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAUA,SAAS,yBACP,aACA,kBACU;AACV,QAAM,UAAoB,CAAC;AAC3B,MAAIC,YAAWD,UAAQ,aAAa,gBAAgB,YAAY,IAAI,CAAC,GAAG;AACtE,YAAQ,KAAK,aAAa;AAAA,EAC5B;AACA,MAAIC,YAAWD,UAAQ,aAAa,gBAAgB,cAAc,CAAC,GAAG;AACpE,YAAQ,KAAK,cAAc;AAAA,EAC7B;AAKA,UAAQ,KAAK,SAAS;AACtB,MAAI,MAAM,QAAQ,gBAAgB,GAAG;AACnC,eAAW,OAAO,kBAAkB;AAClC,UAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,KAAK,CAAC,QAAQ,SAAS,GAAG,GAAG;AACvE,gBAAQ,KAAK,GAAG;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAM,qBAAuC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,WAAW,eAAoD;AAC7E,QAAM,UACJ,OAAO,kBAAkB,WAAW,EAAE,MAAM,cAAc,IAAK,iBAAiB,CAAC;AACnF,QAAM,cAAc,QAAQ,QAAQ,QAAQ,IAAI;AAEhD,QAAM,SAASA,UAAQ,aAAa,QAAQ,UAAU,KAAK;AAE3D,QAAM,YAAYA,UAAQ,aAAa,QAAQ,aAAa,QAAQ;AAEpE,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,aAAa,QAAQ,OAAO;AAIlC,QAAM,aAAaE,SAAQ,cAAc,YAAY,GAAG,CAAC;AACzD,QAAM,aAAa,mBAAmB,UAAU;AAKhD,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,WAAsC;AAC1C,MAAI;AACJ,MAAI;AAEJ,MAAI;AAEJ,MAAI;AAEJ,MAAI,kBAAkB;AAEtB,MAAI;AACJ,MAAI,kBAAkB;AAKtB,QAAM,eAAe,EAAE,OAAO,MAAM;AACpC,MAAI,mBAAmB;AAEvB,SAAO;AAAA,IACL,MAAM;AAAA,IAEN,MAAM,iBAAiB;AAIrB,UAAI,iBAAkB;AACtB,yBAAmB;AACnB,YAAM,WAAW,MAAM,oBAAoB,WAAW;AACtD,qBAAe,SAAS;AACxB,oBAAc,SAAS;AACvB,yBAAmB,SAAS;AAC5B,eAAS,SAAS;AAClB,iBAAW,SAAS;AACpB,wBAAkB,SAAS;AAC3B,mBAAa,SAAS;AACtB,aAAO,SAAS;AAChB,oBAAc,SAAS;AACvB,wBAAkB,SAAS;AAC3B,wBAAkB,SAAS;AAC3B,wBAAkB,SAAS;AAAA,IAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,SAAS;AACP,aAAO,cAAc;AAAA,QACnB;AAAA,QACA;AAAA,QACA,UAAU,QAAQ;AAAA,QAClB,qBAAqB,yBAAyB,aAAa,QAAQ,gBAAgB;AAAA,MACrF,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA,IAKA,oBAAoB;AAAA,MAClB,OAAO;AAAA,MACP,QAAQ,MAAsB;AAC5B,eAAO,sBAAsB,MAAM;AAAA,UACjC,WAAW;AAAA,UACX;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA;AAAA;AAAA;AAAA,IAKA,UAAU,IAAY;AACpB,aAAO,uBAAuB,IAAI,kBAAkB;AAAA,IACtD;AAAA,IAEA,KAAK,IAAY;AACf,aAAO,kBAAkB,IAAI;AAAA,QAC3B,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,kBAAkB,QAAQ,iBAAiB;AAAA,QAC3C;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,gBAAgB,QAAQ;AAC5B,YAAM,mBAAmB,QAAQ;AAAA,QAC/B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,UAAU,QAAQ;AAAA,QAClB,WAAW,QAAQ;AAAA,QACnB,4BAA4B,QAAQ;AAAA,QACpC,sBAAsB;AAAA,QACtB,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["existsSync","resolve","dirname","existsSync","resolve","z","z","z","z","z","z","z","z","z","resolve","existsSync","existsSync","resolve","existsSync","join","resolve","existsSync","join","resolve","randomUUID","jsonError","jsonError","PREFIX","randomUUID","resolve","resolve","readFileSync","resolve","resolve","readFileSync","resolve","resolve","resolve","existsSync","readFileSync","dirname","join","existsSync","readFileSync","dirname","join","join","existsSync","readFileSync","dirname","join","existsSync","existsSync","resolve","existsSync","resolve","SCRIPT_TAG","existsSync","resolve","basename","resolve","existsSync","dirname"]}