theokit 0.4.0-beta.0 → 0.4.0

package/dist/chunk-TSLSIRBR.js

@@ -0,0 +1,107 @@
+import {
+  safeAudit
+} from "./chunk-UD3LFGDL.js";
+
+// src/server/security/csrf.ts
+function matchDisallowed(path, patterns) {
+  for (const p of patterns) {
+    if (typeof p === "string") {
+      if (path === p) return true;
+    } else if (p instanceof RegExp) {
+      p.lastIndex = 0;
+      if (p.test(path)) return true;
+    }
+  }
+  return false;
+}
+var CSRF_WARN_CODE = "CSRF_STRICT_CUTOVER";
+var CSRF_WARN_DOCS_URL = "https://theokit.dev/upgrade/csrf-strict-cutover";
+function pickHeader(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.length > 0) return value[0];
+  return "";
+}
+function isCsrfValidFromHeaders(opts) {
+  if (opts.csrfActionHeader !== "1") {
+    return { valid: false, reason: "Missing X-Theo-Action header" };
+  }
+  if (opts.origin === null || opts.origin === "") {
+    return { valid: true };
+  }
+  if (opts.host === null || opts.host === "") {
+    return { valid: true };
+  }
+  try {
+    const originHost = new URL(opts.origin).host;
+    if (originHost !== opts.host) {
+      return { valid: false, reason: `Origin ${opts.origin} does not match host ${opts.host}` };
+    }
+  } catch {
+    return { valid: false, reason: `Invalid origin: ${opts.origin}` };
+  }
+  return { valid: true };
+}
+function validateCsrf(req) {
+  const action = req.headers["x-theo-action"];
+  const origin = req.headers.origin;
+  const host = req.headers.host;
+  return isCsrfValidFromHeaders({
+    csrfActionHeader: typeof action === "string" ? action : null,
+    origin: origin !== void 0 ? pickHeader(origin) || null : null,
+    host: host !== void 0 ? pickHeader(host) || null : null
+  });
+}
+function validateCsrfRequest(request) {
+  return isCsrfValidFromHeaders({
+    csrfActionHeader: request.headers.get("x-theo-action"),
+    origin: request.headers.get("origin"),
+    host: request.headers.get("host")
+  });
+}
+function dispatchCsrfWarn(req, reason, logger, auditLogger, pathFallback = "") {
+  const payload = {
+    event: "csrf.warn",
+    method: req.method ?? "UNKNOWN",
+    path: logger?.path ?? pathFallback,
+    reason,
+    code: CSRF_WARN_CODE,
+    docsUrl: CSRF_WARN_DOCS_URL
+  };
+  logger?.warn(payload);
+  safeAudit(auditLogger, {
+    action: "csrf.warn",
+    actor: { type: "anonymous" },
+    metadata: { ...payload }
+  });
+}
+function enforceCsrf(req, mode, logger, disallowed, auditLogger) {
+  if (mode === "off") {
+    return { allow: true };
+  }
+  const check = validateCsrf(req);
+  if (check.valid) {
+    return { allow: true };
+  }
+  if (disallowed?.behavior === "raise") {
+    const path = logger?.path ?? req.url ?? "";
+    if (matchDisallowed(path, disallowed.routes)) {
+      return { allow: false, reason: check.reason };
+    }
+  }
+  if (mode === "warn") {
+    dispatchCsrfWarn(req, check.reason, logger, auditLogger);
+    return { allow: true, reason: check.reason };
+  }
+  dispatchCsrfWarn(req, check.reason, logger, auditLogger);
+  return { allow: false, reason: check.reason };
+}
+
+export {
+  matchDisallowed,
+  CSRF_WARN_CODE,
+  CSRF_WARN_DOCS_URL,
+  validateCsrf,
+  validateCsrfRequest,
+  enforceCsrf
+};
+//# sourceMappingURL=chunk-TSLSIRBR.js.map

package/dist/chunk-TSLSIRBR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/security/csrf.ts"],"sourcesContent":["import type { IncomingMessage } from 'node:http'\n\nimport type { AuditLogger } from '../observability/audit-log.js'\nimport { safeAudit } from '../observability/audit-log.js'\n\n/**\n * CSRF enforcement mode.\n *\n * - `off`     — skip CSRF entirely. Use only when you have another defense\n *               (e.g. you don't ship session cookies, all auth is bearer).\n * - `warn`    — log a structured warning when the check would fail, but\n *               still serve the request. Default for 0.2.0. Migration mode.\n * - `strict`  — reject failing requests with 403 + code `CSRF_INVALID`.\n *               Will become the default in 0.3.0.\n */\nexport type CsrfMode = 'off' | 'warn' | 'strict'\n\n/**\n * Per-request structured logger surface. Only `warn` is used by enforceCsrf;\n * we don't require a full Logger here so callers can pass a mock or the\n * console directly.\n */\nexport interface CsrfLogger {\n  warn: (payload: CsrfWarnPayload) => void\n  /** Optional path the request was destined for — used for log correlation. */\n  path?: string\n}\n\n/**\n * T5.1 — Rails-inspired per-route escalation.\n *\n * `routes` accepts string (exact match) or RegExp entries. When a request\n * path matches AND the request would otherwise emit a warning, the\n * `behavior` field decides what happens:\n *\n *   - `'warn'`  → normal warn dispatch (no-op vs default)\n *   - `'raise'` → escalate to 403 regardless of global `csrf` mode\n *\n * `'raise'` never downgrades: when global mode is `'off'`, validation is\n * skipped entirely and disallowed dispatch never runs.\n */\nexport interface DisallowedConfig {\n  routes: (string | RegExp)[]\n  behavior: 'warn' | 'raise'\n}\n\n/**\n * Test whether `path` matches any of the supplied patterns. String\n * patterns are EXACT (trailing slash matters — use RegExp for tolerance).\n *\n * EC-5: when a RegExp carries the `/g` flag, `.test()` mutates\n * `lastIndex` and the next invocation may miss. We reset `lastIndex`\n * before each test so the matcher is a pure function.\n */\nexport function matchDisallowed(path: string, patterns: readonly (string | RegExp)[]): boolean {\n  for (const p of patterns) {\n    if (typeof p === 'string') {\n      if (path === p) return true\n    } else if (p instanceof RegExp) {\n      p.lastIndex = 0\n      if (p.test(path)) return true\n    }\n    // Neither string nor RegExp: ignore silently (defensive — the public\n    // type forbids it but runtime data may slip past).\n  }\n  return false\n}\n\n/**\n * T2.2 — Stable cutover identifier shipped with every csrf.warn payload.\n *\n * Convention borrowed from Vite's `deprecations.ts:74` — a `code` plus a\n * `docsUrl` lets users (a) grep their logs for a single stable identifier\n * to find every csrf.warn line, and (b) click through directly to the\n * migration guide. Strings are exported constants so the analyzer (T2.3)\n * and migration guide can reference the same source of truth.\n */\nexport const CSRF_WARN_CODE = 'CSRF_STRICT_CUTOVER' as const\nexport const CSRF_WARN_DOCS_URL = 'https://theokit.dev/upgrade/csrf-strict-cutover' as const\n\n/**\n * Pick a header value, choosing the first entry when an array (Node sets\n * arrays for headers that legitimately appear multiple times). Returns\n * `''` when the header is absent or empty — callers treat `''` as \"skip\".\n */\nfunction pickHeader(value: string | string[] | undefined): string {\n  if (typeof value === 'string') return value\n  if (Array.isArray(value) && value.length > 0) return value[0]\n  return ''\n}\n\nexport interface CsrfWarnPayload {\n  event: 'csrf.warn'\n  method: string\n  path: string | undefined\n  reason: string\n  /**\n   * Stable identifier for the 0.2 → 0.3 CSRF strict cutover. Always\n   * `'CSRF_STRICT_CUTOVER'`. Grep-able from prod logs.\n   */\n  code: string\n  /**\n   * Link to the section of the migration guide explaining how to clear\n   * this specific warning class.\n   */\n  docsUrl: string\n}\n\n/**\n * T5a.2 Phase B (slice 1/6): pure header-only CSRF check extracted from\n * `validateCsrf(req: IncomingMessage)` so it can be re-used by the Web-\n * Standards `validateCsrfRequest(request: Request)` sibling. Per the T5a.2\n * plan v1.0 § Phase B, header-only leaves are first to migrate. This is\n * the dual-signature pattern (anti-pattern #2 avoidance): IncomingMessage\n * consumers unchanged; new Request consumers go through the same logic\n * via the shared helper.\n *\n * Pure logic — accepts pre-extracted header values as strings or null.\n */\nfunction isCsrfValidFromHeaders(opts: {\n  csrfActionHeader: string | null\n  origin: string | null\n  host: string | null\n}): { valid: true } | { valid: false; reason: string } {\n  // 1. Custom header must be present (primary defense — simple form posts\n  //    cannot set custom headers, browsers gate via CORS preflight)\n  if (opts.csrfActionHeader !== '1') {\n    return { valid: false, reason: 'Missing X-Theo-Action header' }\n  }\n\n  // 2. Origin matching (secondary defense)\n  if (opts.origin === null || opts.origin === '') {\n    // Browsers omit Origin for same-origin requests — treat as valid\n    return { valid: true }\n  }\n\n  if (opts.host === null || opts.host === '') {\n    return { valid: true }\n  }\n\n  try {\n    const originHost = new URL(opts.origin).host\n    if (originHost !== opts.host) {\n      return { valid: false, reason: `Origin ${opts.origin} does not match host ${opts.host}` }\n    }\n  } catch {\n    return { valid: false, reason: `Invalid origin: ${opts.origin}` }\n  }\n\n  return { valid: true }\n}\n\nexport function validateCsrf(\n  req: IncomingMessage,\n): { valid: true } | { valid: false; reason: string } {\n  // IncomingMessage adapter — normalize Node header shape to the pure\n  // helper's input shape (string|null).\n  const action = req.headers['x-theo-action']\n  const origin = req.headers.origin\n  const host = req.headers.host\n  return isCsrfValidFromHeaders({\n    csrfActionHeader: typeof action === 'string' ? action : null,\n    origin: origin !== undefined ? pickHeader(origin) || null : null,\n    host: host !== undefined ? pickHeader(host) || null : null,\n  })\n}\n\n/**\n * T5a.2 Phase B (slice 1/6) — Web-Standards-shaped CSRF validator.\n *\n * Mirror of `validateCsrf(req: IncomingMessage)` for the Web `Request`\n * shape. Consumes `request.headers.get(name)` (native Web `Headers` API)\n * instead of `req.headers[name]` (Node `IncomingMessage` indexer). Same\n * CSRF policy + same return shape — the difference is only the input\n * extraction.\n *\n * Used by `executeWebRequest` (T5a.2 Phase A) to enforce CSRF on the\n * Web-Standards request handler entry-point.\n */\nexport function validateCsrfRequest(\n  request: Request,\n): { valid: true } | { valid: false; reason: string } {\n  return isCsrfValidFromHeaders({\n    csrfActionHeader: request.headers.get('x-theo-action'),\n    origin: request.headers.get('origin'),\n    host: request.headers.get('host'),\n  })\n}\n\n/**\n * Enforce CSRF policy with mode-aware behavior. Wrapper over `validateCsrf`\n * that turns the boolean valid/invalid into a request-level allow decision,\n * gated by mode + structured warning in warn mode.\n *\n * Phase 5 — CSRF warn-first (EC-1). See plan docs/plans/nextjs-maturity-plan.md.\n */\n/**\n * Dispatch the csrf.warn payload to both the structured logger and the\n * audit sink (when configured). Extracted from `enforceCsrf` to keep that\n * function's complexity within ceiling.\n */\nfunction dispatchCsrfWarn(\n  req: IncomingMessage,\n  reason: string,\n  logger: CsrfLogger | undefined,\n  auditLogger: AuditLogger | undefined,\n  pathFallback = '',\n): void {\n  const payload: CsrfWarnPayload = {\n    event: 'csrf.warn',\n    method: req.method ?? 'UNKNOWN',\n    path: logger?.path ?? pathFallback,\n    reason,\n    code: CSRF_WARN_CODE,\n    docsUrl: CSRF_WARN_DOCS_URL,\n  }\n  logger?.warn(payload)\n  // `metadata` is typed as Record<string, unknown>; CsrfWarnPayload is a\n  // structurally-equivalent shape but lacks the index signature.\n  safeAudit(auditLogger, {\n    action: 'csrf.warn',\n    actor: { type: 'anonymous' },\n    metadata: { ...payload },\n  })\n}\n\nexport function enforceCsrf(\n  req: IncomingMessage,\n  mode: CsrfMode,\n  logger?: CsrfLogger,\n  disallowed?: DisallowedConfig,\n  auditLogger?: AuditLogger,\n): { allow: boolean; reason?: string } {\n  if (mode === 'off') {\n    // `off` short-circuits before disallowed dispatch — users who set\n    // csrf: 'off' globally have explicitly turned validation off, and\n    // disallowed must never re-introduce it. The escape hatch is to\n    // set csrf: 'warn' and use disallowed for surgical strict pockets.\n    return { allow: true }\n  }\n\n  const check = validateCsrf(req)\n  if (check.valid) {\n    return { allow: true }\n  }\n\n  // T5.1 — disallowed dispatch: when the failing request matches a\n  // disallowed pattern AND behavior is 'raise', escalate to 403 even if\n  // global mode is 'warn'. Strict mode would 403 anyway, so the branch\n  // is a no-op there.\n  if (disallowed?.behavior === 'raise') {\n    const path = logger?.path ?? req.url ?? ''\n    if (matchDisallowed(path, disallowed.routes)) {\n      return { allow: false, reason: check.reason }\n    }\n  }\n\n  if (mode === 'warn') {\n    // T2.1: emit via warnOnce by default — callers can override via the\n    // injected logger.warn (tests, custom log routers).\n    // T2.2: include the stable cutover code + docsUrl so logs are\n    // grep-able and click-through-able.\n    dispatchCsrfWarn(req, check.reason, logger, auditLogger)\n    return { allow: true, reason: check.reason }\n  }\n\n  // strict — 403 the request, AND emit a warn payload so the dev (and\n  // devtools UI) sees WHY it was blocked + the docsUrl to fix it.\n  // Without this, strict-mode users get a silent 403 with no context.\n  dispatchCsrfWarn(req, check.reason, logger, auditLogger)\n  return { allow: false, reason: check.reason }\n}\n"],"mappings":";;;;;AAsDO,SAAS,gBAAgB,MAAc,UAAiD;AAC7F,aAAW,KAAK,UAAU;AACxB,QAAI,OAAO,MAAM,UAAU;AACzB,UAAI,SAAS,EAAG,QAAO;AAAA,IACzB,WAAW,aAAa,QAAQ;AAC9B,QAAE,YAAY;AACd,UAAI,EAAE,KAAK,IAAI,EAAG,QAAO;AAAA,IAC3B;AAAA,EAGF;AACA,SAAO;AACT;AAWO,IAAM,iBAAiB;AACvB,IAAM,qBAAqB;AAOlC,SAAS,WAAW,OAA8C;AAChE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,CAAC;AAC5D,SAAO;AACT;AA8BA,SAAS,uBAAuB,MAIuB;AAGrD,MAAI,KAAK,qBAAqB,KAAK;AACjC,WAAO,EAAE,OAAO,OAAO,QAAQ,+BAA+B;AAAA,EAChE;AAGA,MAAI,KAAK,WAAW,QAAQ,KAAK,WAAW,IAAI;AAE9C,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,MAAI,KAAK,SAAS,QAAQ,KAAK,SAAS,IAAI;AAC1C,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,MAAI;AACF,UAAM,aAAa,IAAI,IAAI,KAAK,MAAM,EAAE;AACxC,QAAI,eAAe,KAAK,MAAM;AAC5B,aAAO,EAAE,OAAO,OAAO,QAAQ,UAAU,KAAK,MAAM,wBAAwB,KAAK,IAAI,GAAG;AAAA,IAC1F;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB,KAAK,MAAM,GAAG;AAAA,EAClE;AAEA,SAAO,EAAE,OAAO,KAAK;AACvB;AAEO,SAAS,aACd,KACoD;AAGpD,QAAM,SAAS,IAAI,QAAQ,eAAe;AAC1C,QAAM,SAAS,IAAI,QAAQ;AAC3B,QAAM,OAAO,IAAI,QAAQ;AACzB,SAAO,uBAAuB;AAAA,IAC5B,kBAAkB,OAAO,WAAW,WAAW,SAAS;AAAA,IACxD,QAAQ,WAAW,SAAY,WAAW,MAAM,KAAK,OAAO;AAAA,IAC5D,MAAM,SAAS,SAAY,WAAW,IAAI,KAAK,OAAO;AAAA,EACxD,CAAC;AACH;AAcO,SAAS,oBACd,SACoD;AACpD,SAAO,uBAAuB;AAAA,IAC5B,kBAAkB,QAAQ,QAAQ,IAAI,eAAe;AAAA,IACrD,QAAQ,QAAQ,QAAQ,IAAI,QAAQ;AAAA,IACpC,MAAM,QAAQ,QAAQ,IAAI,MAAM;AAAA,EAClC,CAAC;AACH;AAcA,SAAS,iBACP,KACA,QACA,QACA,aACA,eAAe,IACT;AACN,QAAM,UAA2B;AAAA,IAC/B,OAAO;AAAA,IACP,QAAQ,IAAI,UAAU;AAAA,IACtB,MAAM,QAAQ,QAAQ;AAAA,IACtB;AAAA,IACA,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACA,UAAQ,KAAK,OAAO;AAGpB,YAAU,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,OAAO,EAAE,MAAM,YAAY;AAAA,IAC3B,UAAU,EAAE,GAAG,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,SAAS,YACd,KACA,MACA,QACA,YACA,aACqC;AACrC,MAAI,SAAS,OAAO;AAKlB,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,MAAM,OAAO;AACf,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAMA,MAAI,YAAY,aAAa,SAAS;AACpC,UAAM,OAAO,QAAQ,QAAQ,IAAI,OAAO;AACxC,QAAI,gBAAgB,MAAM,WAAW,MAAM,GAAG;AAC5C,aAAO,EAAE,OAAO,OAAO,QAAQ,MAAM,OAAO;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI,SAAS,QAAQ;AAKnB,qBAAiB,KAAK,MAAM,QAAQ,QAAQ,WAAW;AACvD,WAAO,EAAE,OAAO,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC7C;AAKA,mBAAiB,KAAK,MAAM,QAAQ,QAAQ,WAAW;AACvD,SAAO,EAAE,OAAO,OAAO,QAAQ,MAAM,OAAO;AAC9C;","names":[]}

package/dist/{chunk-XP7YXRHO.js → chunk-U6TPSW4L.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   theoConfigSchema
-} from "./chunk-X4JAX2U3.js";
+} from "./chunk-4S2UCILN.js";
 
 // src/config/load-env.ts
 import { lstatSync, readFileSync, realpathSync, statSync } from "fs";
@@ -101,7 +101,6 @@ function loadEnv(options = {}) {
 // src/config/load-config.ts
 import { existsSync } from "fs";
 import { resolve as resolve2 } from "path";
-import { pathToFileURL } from "url";
 
 // src/config/errors.ts
 var TheoConfigError = class extends Error {
@@ -124,6 +123,38 @@ ${issueLines}
   }
 };
 
+// src/config/import-user-module.ts
+import { pathToFileURL } from "url";
+var CYCLE_PATTERNS = [
+  // Node 22 strict ESM cycle detection when a registered loader hook
+  // re-enters its own evaluation context.
+  "require() ES Module",
+  "in a cycle",
+  // Vite SSR throws this when it cannot resolve an out-of-root URL.
+  "Failed to load url",
+  "Does the file exist?",
+  // Node native ESM resolver throws this for `.ts` files when no
+  // tsx loader is registered globally (the common test-worker case).
+  "Cannot find module",
+  // ERR_UNKNOWN_FILE_EXTENSION for `.ts` files.
+  "Unknown file extension"
+];
+function isLoaderInteropError(err) {
+  if (!(err instanceof Error)) return false;
+  const msg = err.message;
+  return CYCLE_PATTERNS.some((p) => msg.includes(p));
+}
+async function importUserModule(absoluteFilePath, parentURL = import.meta.url) {
+  const fileURL = pathToFileURL(absoluteFilePath).href;
+  try {
+    return await import(fileURL);
+  } catch (err) {
+    if (!isLoaderInteropError(err)) throw err;
+    const { tsImport } = await import("tsx/esm/api");
+    return await tsImport(fileURL, parentURL);
+  }
+}
+
 // src/config/load-config.ts
 var CONFIG_FILE = "theo.config.ts";
 function deepMerge(base, override) {
@@ -151,7 +182,7 @@ async function loadConfig(dir) {
   }
   let mod;
   try {
-    mod = await import(pathToFileURL(configPath).href);
+    mod = await importUserModule(configPath);
   } catch (err) {
     throw new TheoConfigError([{ field: "_file", message: err.message }], configPath);
   }
@@ -174,7 +205,7 @@ async function loadConfig(dir) {
     const envPath = resolve2(dir, envFile);
     if (existsSync(envPath)) {
       try {
-        const envMod = await import(pathToFileURL(envPath).href);
+        const envMod = await importUserModule(envPath);
         const envConfig = envMod.default;
         if (envConfig != null && typeof envConfig === "object") {
           rawConfig = deepMerge(rawConfig, envConfig);
@@ -196,7 +227,8 @@ async function loadConfig(dir) {
 }
 
 export {
+  importUserModule,
   loadEnv,
   loadConfig
 };
-//# sourceMappingURL=chunk-XP7YXRHO.js.map
+//# sourceMappingURL=chunk-U6TPSW4L.js.map

package/dist/chunk-U6TPSW4L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/load-env.ts","../src/config/load-config.ts","../src/config/errors.ts","../src/config/import-user-module.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Reads `.env` files from a CLI-controlled `cwd`. File names are a fixed\n * literal set. Build-time + CLI tool; no HTTP input.\n */\n/**\n * `loadEnv()` — auto-loads `.env` files into `process.env` for server code.\n *\n * Implements the Next.js `loadEnvConfig` algorithm\n * (`referencias/next.js/packages/next-env/index.ts:114-180`) with TheoKit\n * adaptations:\n *\n * - EC-1: 1MB file-size cap (anti-OOM, anti-supply-chain).\n * - EC-2: `_resetEnvCache()` test-only side-door.\n * - EC-8: `dotenv-expand` circular-ref safe (lib-provided).\n * - EC-13: log when `.env` is a symlink (transparency).\n * - D6: real `process.env` wins over `.env`-file values.\n * - NODE_ENV stash: `.env`-set NODE_ENV NEVER overrides the real\n *   `process.env.NODE_ENV`. Stashed in `__THEOKIT_USER_NODE_ENV` instead.\n */\n\nimport { lstatSync, readFileSync, realpathSync, statSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport dotenv from 'dotenv'\nimport { expand, type DotenvPopulateInput } from 'dotenv-expand'\n\nimport type { LoadEnvOptions, LoadEnvResult } from './load-env-types.js'\n\n/** EC-1: 1MB cap. Real `.env`s are < 10KB. */\nconst MAX_ENV_FILE_BYTES = 1_048_576\n\nconst cache = new Map<string, LoadEnvResult>()\n\n/** Test-only side-door for EC-2 — clear the module-level cache between vitest test files. */\nexport function _resetEnvCache(): void {\n  cache.clear()\n}\n\nfunction envFilesInPriorityOrder(mode: string): string[] {\n  // Top of list = highest priority. Will be read in REVERSE so first-in\n  // wins via overwrite during merge.\n  const files = [`.env.${mode}.local`, `.env.local`, `.env.${mode}`, `.env`]\n  // Test mode skips `.env.local` per dotenv convention (avoid leaking dev\n  // secrets into the test suite).\n  if (mode === 'test') {\n    return files.filter((f) => f !== '.env.local')\n  }\n  return files\n}\n\nfunction readEnvFile(path: string): Record<string, string> | null {\n  let stat\n  try {\n    stat = statSync(path)\n  } catch {\n    return null // ENOENT / EACCES → skip\n  }\n\n  // Allow files + FIFOs (1Password/SOPS pipe support).\n  if (!stat.isFile() && !stat.isFIFO()) return null\n\n  // EC-1 — anti-OOM cap.\n  if (stat.size > MAX_ENV_FILE_BYTES) {\n    console.warn(\n      `[theokit] .env file at ${path} exceeds ${MAX_ENV_FILE_BYTES} bytes — skipping (likely a generated artifact, not a real env file)`,\n    )\n    return null\n  }\n\n  // EC-13 — symlink transparency. Don't refuse; just log.\n  try {\n    const lstat = lstatSync(path)\n    if (lstat.isSymbolicLink()) {\n      const real = realpathSync(path)\n      // eslint-disable-next-line no-console -- intentional transparency log on a build-time tool\n      console.info(`[theokit] .env at ${path} is a symlink → ${real}`)\n    }\n  } catch {\n    // lstat failure is non-fatal — fall through to read.\n  }\n\n  try {\n    const content = readFileSync(path, 'utf-8')\n    return dotenv.parse(content)\n  } catch {\n    return null\n  }\n}\n\n// eslint-disable-next-line complexity -- canonical env-load algorithm (priority → expand → guards → apply); inlining branches is clearer than extracting micro-helpers\nexport function loadEnv(options: LoadEnvOptions = {}): LoadEnvResult {\n  const cwd = options.cwd ?? process.cwd()\n  const mode = options.mode ?? process.env.NODE_ENV ?? 'development'\n  const cacheKey = `${cwd}:${mode}`\n\n  if (!options.forceReload) {\n    const cached = cache.get(cacheKey)\n    if (cached) return cached\n  }\n\n  const fileNames = envFilesInPriorityOrder(mode)\n  const filePaths = fileNames.map((f) => resolve(cwd, f))\n\n  // Read in REVERSE — lower-priority files first, so higher-priority\n  // (lower-index) overwrites during merge.\n  const merged: Record<string, string> = {}\n  const loadedFromFiles: string[] = []\n  for (const path of [...filePaths].reverse()) {\n    const parsed = readEnvFile(path)\n    if (parsed === null) continue\n    for (const [k, v] of Object.entries(parsed)) {\n      merged[k] = v\n    }\n    loadedFromFiles.unshift(path) // keep priority order in result\n  }\n\n  // NODE_ENV stash — `.env`-set NODE_ENV never overrides real process.env.NODE_ENV.\n  if (merged.NODE_ENV && process.env.__THEOKIT_USER_NODE_ENV === undefined) {\n    process.env.__THEOKIT_USER_NODE_ENV = merged.NODE_ENV\n  }\n  delete merged.NODE_ENV // never propagate\n\n  // EC-8 — dotenv-expand@11 stack-overflows on circular refs (A=${B}, B=${A}).\n  // Wrap in try/catch — on overflow, leave the parsed map untouched (literal\n  // values survive). Tested via test_loadEnv_circular_expand_no_loop_EC8.\n  // Pass a CLONE of process.env (string-only, filtered) so expand can\n  // reference real env without mutating it.\n  const processEnvClone: DotenvPopulateInput = {}\n  for (const [k, v] of Object.entries(process.env)) {\n    if (typeof v === 'string') processEnvClone[k] = v\n  }\n  try {\n    expand({ parsed: merged, processEnv: processEnvClone })\n  } catch (err) {\n    if (err instanceof RangeError) {\n      console.warn(\n        `[theokit] .env expansion overflow (likely circular reference like A=\\${B}, B=\\${A}). Leaving values as literals.`,\n      )\n    } else {\n      throw err\n    }\n  }\n\n  // Apply: D6 — real process.env wins over file values.\n  const loaded: Record<string, string> = {}\n  for (const [k, v] of Object.entries(merged)) {\n    if (process.env[k] !== undefined) continue // real env wins\n    process.env[k] = v\n    loaded[k] = v\n  }\n\n  // Sentinel\n  process.env.__THEOKIT_PROCESSED_ENV = 'true'\n\n  const result: LoadEnvResult = { loaded, loadedFromFiles }\n  cache.set(cacheKey, result)\n  return result\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Config loader. Reads `theo.config.{ts,js,mjs}` under the user's `cwd`.\n * Names are a fixed set of literals; `cwd` is a CLI arg resolved to\n * absolute. Build-time tool — no HTTP input.\n */\nimport { existsSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport { TheoConfigError } from './errors.js'\nimport { importUserModule } from './import-user-module.js'\nimport { loadEnv } from './load-env.js'\nimport { theoConfigSchema } from './schema.js'\nimport type { TheoConfig } from './schema.js'\n\nconst CONFIG_FILE = 'theo.config.ts'\n\n/**\n * Deep merges two plain objects. Override values take precedence.\n * Arrays are replaced (not concatenated).\n * Protects against prototype pollution (EC-4).\n */\nexport function deepMerge(\n  base: Record<string, unknown>,\n  override: Record<string, unknown>,\n): Record<string, unknown> {\n  const result = { ...base }\n  for (const key of Object.keys(override)) {\n    // EC-4: Prevent prototype pollution\n    if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue\n\n    const baseVal = base[key]\n    const overVal = override[key]\n\n    if (\n      overVal !== null &&\n      typeof overVal === 'object' &&\n      !Array.isArray(overVal) &&\n      baseVal !== null &&\n      typeof baseVal === 'object' &&\n      !Array.isArray(baseVal)\n    ) {\n      result[key] = deepMerge(\n        baseVal as Record<string, unknown>,\n        overVal as Record<string, unknown>,\n      )\n    } else {\n      result[key] = overVal\n    }\n  }\n  return result\n}\n\nexport async function loadConfig(dir: string): Promise<TheoConfig> {\n  // T1.3 — Load .env BEFORE reading theo.config.ts. Defensive: CLI commands\n  // (dev/build/start) already call loadEnv() first, but programmatic users\n  // who call loadConfig directly (tests, custom scripts) need this too.\n  // Module-level cache makes the second call a Map-lookup (no FS).\n  loadEnv({ cwd: dir })\n\n  const configPath = resolve(dir, CONFIG_FILE)\n\n  if (!existsSync(configPath)) {\n    return theoConfigSchema.parse({})\n  }\n\n  let mod: Record<string, unknown>\n  try {\n    mod = await importUserModule(configPath)\n  } catch (err) {\n    throw new TheoConfigError([{ field: '_file', message: (err as Error).message }], configPath)\n  }\n\n  const userConfig = mod.default\n\n  if (userConfig == null || typeof userConfig !== 'object') {\n    throw new TheoConfigError(\n      [\n        {\n          field: '_export',\n          message: 'theo.config.ts must use export default defineConfig({...})',\n        },\n      ],\n      configPath,\n    )\n  }\n\n  // Merge with per-environment config if NODE_ENV is set\n  let rawConfig = userConfig as Record<string, unknown>\n  const nodeEnv = process.env.NODE_ENV\n\n  if (nodeEnv) {\n    const envFile = `theo.config.${nodeEnv}.ts`\n    const envPath = resolve(dir, envFile)\n\n    if (existsSync(envPath)) {\n      try {\n        const envMod = await importUserModule(envPath)\n        const envConfig = envMod.default\n\n        if (envConfig != null && typeof envConfig === 'object') {\n          rawConfig = deepMerge(rawConfig, envConfig as Record<string, unknown>)\n        }\n      } catch (err) {\n        throw new TheoConfigError([{ field: '_file', message: (err as Error).message }], envPath)\n      }\n    }\n  }\n\n  const result = theoConfigSchema.safeParse(rawConfig)\n\n  if (!result.success) {\n    const issues = result.error.issues.map((i) => ({\n      field: i.path.join('.'),\n      message: i.message,\n    }))\n    throw new TheoConfigError(issues, configPath)\n  }\n\n  return result.data\n}\n","export interface ConfigIssue {\n  field: string\n  message: string\n}\n\nexport class TheoConfigError extends Error {\n  public readonly issues: ConfigIssue[]\n  public readonly configPath: string\n\n  constructor(issues: ConfigIssue[], configPath: string) {\n    const issueLines = issues.map((i) => `  - ${i.field}: ${i.message}`).join('\\n')\n\n    super(\n      `Invalid theo.config.ts\\n\\n` +\n        `  File: ${configPath}\\n\\n` +\n        (issueLines ? `  Issues:\\n${issueLines}\\n` : ''),\n    )\n\n    this.name = 'TheoConfigError'\n    this.issues = issues\n    this.configPath = configPath\n  }\n}\n","/**\n * Helper for loading user-authored TypeScript modules at runtime.\n *\n * Why this exists: theokit framework code (`load-config.ts`, `job-scan.ts`,\n * `cron-scan.ts`, `integrate-ui.ts`, `static.ts`) dynamically imports\n * `.ts` files from user space (`theo.config.ts`, `server/jobs/*.ts`,\n * `static-paths.ts`, etc.). Two execution environments must work:\n *\n *   1. **Production CLI** — `dist/cli/index.js` starts with\n *      `import \"tsx/esm\"` which registers a global Node ESM loader hook.\n *      Subsequent `await import('foo.ts')` calls are intercepted by the\n *      hook, transformed in-place, and returned as ESM namespaces.\n *\n *   2. **Vitest tests** — Vitest runs framework code through Vite's SSR\n *      pipeline. Dynamic imports inside framework modules are hijacked\n *      by Vite's `loadAndTransform`, which cannot resolve absolute paths\n *      outside the Vite project root (e.g., `/tmp/test-fixture/foo.ts`).\n *      Even with `server.deps.external` configured to hand the path\n *      back to Node, the registered tsx/esm loader hits a `require()`\n *      ESM cycle error on Node 22 because the calling stack contains\n *      both the loader's own evaluation context AND the importer.\n *\n * `tsImport()` from `tsx/esm/api` is the documented escape hatch for\n * exactly this scenario: it transforms the source file via tsx's\n * standalone pipeline and evaluates the result via a fresh namespace,\n * bypassing both Vite SSR and any registered global hook.\n *\n * Strategy:\n *   - Try native `await import()` first (zero overhead in production\n *     where tsx hook is registered).\n *   - On failure with the well-known cycle/resolution errors, fall back\n *     to `tsImport()`. Other errors (genuine syntax errors, missing\n *     module, etc.) propagate unchanged.\n *\n * Idempotent and side-effect-free.\n */\nimport { pathToFileURL } from 'node:url'\n\nconst CYCLE_PATTERNS = [\n  // Node 22 strict ESM cycle detection when a registered loader hook\n  // re-enters its own evaluation context.\n  'require() ES Module',\n  'in a cycle',\n  // Vite SSR throws this when it cannot resolve an out-of-root URL.\n  'Failed to load url',\n  'Does the file exist?',\n  // Node native ESM resolver throws this for `.ts` files when no\n  // tsx loader is registered globally (the common test-worker case).\n  'Cannot find module',\n  // ERR_UNKNOWN_FILE_EXTENSION for `.ts` files.\n  'Unknown file extension',\n]\n\nfunction isLoaderInteropError(err: unknown): boolean {\n  if (!(err instanceof Error)) return false\n  const msg = err.message\n  return CYCLE_PATTERNS.some((p) => msg.includes(p))\n}\n\n/**\n * Load a user-authored TS/JS module at the given absolute file path.\n * `parentURL` defaults to the URL of this module file.\n *\n * @returns module namespace object (matches `await import(...)` return)\n */\nexport async function importUserModule(\n  absoluteFilePath: string,\n  parentURL: string = import.meta.url,\n): Promise<Record<string, unknown>> {\n  const fileURL = pathToFileURL(absoluteFilePath).href\n  try {\n    return (await import(fileURL)) as Record<string, unknown>\n  } catch (err) {\n    if (!isLoaderInteropError(err)) throw err\n    // Fallback: tsx programmatic API. Imports are inline, no global hook\n    // mutation, no Vite SSR interference. Slower per call (~10-50ms vs\n    // microseconds for registered loader) but only used as a last resort.\n    const { tsImport } = (await import('tsx/esm/api')) as {\n      tsImport: (\n        specifier: string,\n        options: string | { parentURL: string; tsconfig?: string; namespace?: string },\n      ) => Promise<Record<string, unknown>>\n    }\n    // Bypass tsconfig — tsx's default bundler-style resolver handles\n    // `.js → .ts` fallback for relative imports under the user's module.\n    // Passing an explicit tsconfig sometimes shadows the default and\n    // breaks the `.js → .ts` rewrite chain inside the namespaced loader\n    // (verified empirically in cron-scan/job-scan vitest workers).\n    return await tsImport(fileURL, parentURL)\n  }\n}\n"],"mappings":";;;;;;;AAoBA,SAAS,WAAW,cAAc,cAAc,gBAAgB;AAChE,SAAS,eAAe;AAExB,OAAO,YAAY;AACnB,SAAS,cAAwC;AAKjD,IAAM,qBAAqB;AAE3B,IAAM,QAAQ,oBAAI,IAA2B;AAO7C,SAAS,wBAAwB,MAAwB;AAGvD,QAAM,QAAQ,CAAC,QAAQ,IAAI,UAAU,cAAc,QAAQ,IAAI,IAAI,MAAM;AAGzE,MAAI,SAAS,QAAQ;AACnB,WAAO,MAAM,OAAO,CAAC,MAAM,MAAM,YAAY;AAAA,EAC/C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAA6C;AAChE,MAAI;AACJ,MAAI;AACF,WAAO,SAAS,IAAI;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AAGA,MAAI,CAAC,KAAK,OAAO,KAAK,CAAC,KAAK,OAAO,EAAG,QAAO;AAG7C,MAAI,KAAK,OAAO,oBAAoB;AAClC,YAAQ;AAAA,MACN,0BAA0B,IAAI,YAAY,kBAAkB;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAGA,MAAI;AACF,UAAM,QAAQ,UAAU,IAAI;AAC5B,QAAI,MAAM,eAAe,GAAG;AAC1B,YAAM,OAAO,aAAa,IAAI;AAE9B,cAAQ,KAAK,qBAAqB,IAAI,wBAAmB,IAAI,EAAE;AAAA,IACjE;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,UAAU,aAAa,MAAM,OAAO;AAC1C,WAAO,OAAO,MAAM,OAAO;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,QAAQ,UAA0B,CAAC,GAAkB;AACnE,QAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACvC,QAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI,YAAY;AACrD,QAAM,WAAW,GAAG,GAAG,IAAI,IAAI;AAE/B,MAAI,CAAC,QAAQ,aAAa;AACxB,UAAM,SAAS,MAAM,IAAI,QAAQ;AACjC,QAAI,OAAQ,QAAO;AAAA,EACrB;AAEA,QAAM,YAAY,wBAAwB,IAAI;AAC9C,QAAM,YAAY,UAAU,IAAI,CAAC,MAAM,QAAQ,KAAK,CAAC,CAAC;AAItD,QAAM,SAAiC,CAAC;AACxC,QAAM,kBAA4B,CAAC;AACnC,aAAW,QAAQ,CAAC,GAAG,SAAS,EAAE,QAAQ,GAAG;AAC3C,UAAM,SAAS,YAAY,IAAI;AAC/B,QAAI,WAAW,KAAM;AACrB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,aAAO,CAAC,IAAI;AAAA,IACd;AACA,oBAAgB,QAAQ,IAAI;AAAA,EAC9B;AAGA,MAAI,OAAO,YAAY,QAAQ,IAAI,4BAA4B,QAAW;AACxE,YAAQ,IAAI,0BAA0B,OAAO;AAAA,EAC/C;AACA,SAAO,OAAO;AAOd,QAAM,kBAAuC,CAAC;AAC9C,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAChD,QAAI,OAAO,MAAM,SAAU,iBAAgB,CAAC,IAAI;AAAA,EAClD;AACA,MAAI;AACF,WAAO,EAAE,QAAQ,QAAQ,YAAY,gBAAgB,CAAC;AAAA,EACxD,SAAS,KAAK;AACZ,QAAI,eAAe,YAAY;AAC7B,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM;AAAA,IACR;AAAA,EACF;AAGA,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,QAAI,QAAQ,IAAI,CAAC,MAAM,OAAW;AAClC,YAAQ,IAAI,CAAC,IAAI;AACjB,WAAO,CAAC,IAAI;AAAA,EACd;AAGA,UAAQ,IAAI,0BAA0B;AAEtC,QAAM,SAAwB,EAAE,QAAQ,gBAAgB;AACxD,QAAM,IAAI,UAAU,MAAM;AAC1B,SAAO;AACT;;;ACxJA,SAAS,kBAAkB;AAC3B,SAAS,WAAAA,gBAAe;;;ACDjB,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACzB;AAAA,EACA;AAAA,EAEhB,YAAY,QAAuB,YAAoB;AACrD,UAAM,aAAa,OAAO,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI;AAE9E;AAAA,MACE;AAAA;AAAA,UACa,UAAU;AAAA;AAAA,KACpB,aAAa;AAAA,EAAc,UAAU;AAAA,IAAO;AAAA,IACjD;AAEA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;AAAA,EACpB;AACF;;;ACcA,SAAS,qBAAqB;AAE9B,IAAM,iBAAiB;AAAA;AAAA;AAAA,EAGrB;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EAEA;AACF;AAEA,SAAS,qBAAqB,KAAuB;AACnD,MAAI,EAAE,eAAe,OAAQ,QAAO;AACpC,QAAM,MAAM,IAAI;AAChB,SAAO,eAAe,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;AACnD;AAQA,eAAsB,iBACpB,kBACA,YAAoB,YAAY,KACE;AAClC,QAAM,UAAU,cAAc,gBAAgB,EAAE;AAChD,MAAI;AACF,WAAQ,MAAM,OAAO;AAAA,EACvB,SAAS,KAAK;AACZ,QAAI,CAAC,qBAAqB,GAAG,EAAG,OAAM;AAItC,UAAM,EAAE,SAAS,IAAK,MAAM,OAAO,aAAa;AAWhD,WAAO,MAAM,SAAS,SAAS,SAAS;AAAA,EAC1C;AACF;;;AF5EA,IAAM,cAAc;AAOb,SAAS,UACd,MACA,UACyB;AACzB,QAAM,SAAS,EAAE,GAAG,KAAK;AACzB,aAAW,OAAO,OAAO,KAAK,QAAQ,GAAG;AAEvC,QAAI,QAAQ,eAAe,QAAQ,iBAAiB,QAAQ,YAAa;AAEzE,UAAM,UAAU,KAAK,GAAG;AACxB,UAAM,UAAU,SAAS,GAAG;AAE5B,QACE,YAAY,QACZ,OAAO,YAAY,YACnB,CAAC,MAAM,QAAQ,OAAO,KACtB,YAAY,QACZ,OAAO,YAAY,YACnB,CAAC,MAAM,QAAQ,OAAO,GACtB;AACA,aAAO,GAAG,IAAI;AAAA,QACZ;AAAA,QACA;AAAA,MACF;AAAA,IACF,OAAO;AACL,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,WAAW,KAAkC;AAKjE,UAAQ,EAAE,KAAK,IAAI,CAAC;AAEpB,QAAM,aAAaC,SAAQ,KAAK,WAAW;AAE3C,MAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAO,iBAAiB,MAAM,CAAC,CAAC;AAAA,EAClC;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,iBAAiB,UAAU;AAAA,EACzC,SAAS,KAAK;AACZ,UAAM,IAAI,gBAAgB,CAAC,EAAE,OAAO,SAAS,SAAU,IAAc,QAAQ,CAAC,GAAG,UAAU;AAAA,EAC7F;AAEA,QAAM,aAAa,IAAI;AAEvB,MAAI,cAAc,QAAQ,OAAO,eAAe,UAAU;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,QACE;AAAA,UACE,OAAO;AAAA,UACP,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI,YAAY;AAChB,QAAM,UAAU,QAAQ,IAAI;AAE5B,MAAI,SAAS;AACX,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,UAAUA,SAAQ,KAAK,OAAO;AAEpC,QAAI,WAAW,OAAO,GAAG;AACvB,UAAI;AACF,cAAM,SAAS,MAAM,iBAAiB,OAAO;AAC7C,cAAM,YAAY,OAAO;AAEzB,YAAI,aAAa,QAAQ,OAAO,cAAc,UAAU;AACtD,sBAAY,UAAU,WAAW,SAAoC;AAAA,QACvE;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,IAAI,gBAAgB,CAAC,EAAE,OAAO,SAAS,SAAU,IAAc,QAAQ,CAAC,GAAG,OAAO;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,iBAAiB,UAAU,SAAS;AAEnD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OAAO,IAAI,CAAC,OAAO;AAAA,MAC7C,OAAO,EAAE,KAAK,KAAK,GAAG;AAAA,MACtB,SAAS,EAAE;AAAA,IACb,EAAE;AACF,UAAM,IAAI,gBAAgB,QAAQ,UAAU;AAAA,EAC9C;AAEA,SAAO,OAAO;AAChB;","names":["resolve","resolve"]}

package/dist/chunk-UD3LFGDL.js

@@ -0,0 +1,45 @@
+// src/server/observability/audit-log.ts
+var JsonStdoutSink = class {
+  log(event) {
+    const enriched = {
+      level: "audit",
+      ...event,
+      timestamp: event.timestamp ?? (/* @__PURE__ */ new Date()).toISOString()
+    };
+    try {
+      console.log(JSON.stringify(enriched, jsonReplacer));
+    } catch {
+      console.log(
+        `{"level":"audit","action":${JSON.stringify(event.action)},"timestamp":${JSON.stringify(enriched.timestamp)},"note":"payload could not be serialized"}`
+      );
+    }
+  }
+};
+function jsonReplacer(_key, value) {
+  if (typeof value === "bigint") return value.toString();
+  return value;
+}
+function createNoOpLogger() {
+  return {
+    log() {
+    }
+  };
+}
+function safeAudit(logger, event) {
+  if (!logger) return;
+  try {
+    const r = logger.log(event);
+    if (r && typeof r.then === "function") {
+      r.catch(() => {
+      });
+    }
+  } catch {
+  }
+}
+
+export {
+  JsonStdoutSink,
+  createNoOpLogger,
+  safeAudit
+};
+//# sourceMappingURL=chunk-UD3LFGDL.js.map

package/dist/chunk-UD3LFGDL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/observability/audit-log.ts"],"sourcesContent":["/**\n * T4.1 — Audit logging interface + default JSON stdout sink.\n *\n * Per ADR D4: define the interface; ship a zero-dep default; reserve\n * adapter shapes for Postgres, File, OpenTelemetry, Sentry as follow-up\n * packages. Persistence has heavy deps (`pg`, `better-sqlite3`); we\n * keep core dep-free and let users opt in.\n *\n * Compatibility:\n *   - Node / Bun / Deno / Vercel — console.log is sync, captured.\n *   - Edge runtimes (CF Workers, Vercel Edge) — console.log is captured\n *     but may be rate-limited by the platform. For high-volume edge audit,\n *     implement a custom sink writing to a queue / HTTP endpoint.\n */\n\nexport interface AuditEvent {\n  /** Domain-qualified verb. Convention: `<domain>.<verb>` (e.g. csrf.warn, session.rotated). */\n  action: string\n  /** Who triggered the event. Anonymous = no auth at time of event. */\n  actor?: { type: 'user' | 'system' | 'anonymous'; id?: string }\n  /** What was operated on (optional). */\n  resource?: { type: string; id?: string }\n  /** Arbitrary event-specific metadata. JSON-serializable. */\n  metadata?: Record<string, unknown>\n  /** ISO 8601 timestamp. If absent, sink fills in `new Date().toISOString()`. */\n  timestamp?: string\n  /** Optional trace id (populated by middleware from `x-trace-id`). */\n  traceId?: string\n}\n\nexport interface AuditLogger {\n  log(event: AuditEvent): void | Promise<void>\n}\n\n/**\n * Default sink: one JSON line per event to stdout. Sync. Never throws.\n *\n * EC: circular refs / BigInt values fall back to a placeholder line so\n * the event is still observable (action + traceId) without crashing the\n * request lifecycle.\n */\nexport class JsonStdoutSink implements AuditLogger {\n  log(event: AuditEvent): void {\n    const enriched = {\n      level: 'audit' as const,\n      ...event,\n      timestamp: event.timestamp ?? new Date().toISOString(),\n    }\n    try {\n      // eslint-disable-next-line no-console -- JsonStdoutSink IS the audit output\n      console.log(JSON.stringify(enriched, jsonReplacer))\n    } catch {\n      // eslint-disable-next-line no-console -- fallback when payload won't serialize\n      console.log(\n        `{\"level\":\"audit\",\"action\":${JSON.stringify(event.action)},\"timestamp\":${JSON.stringify(enriched.timestamp)},\"note\":\"payload could not be serialized\"}`,\n      )\n    }\n  }\n}\n\n/**\n * Replacer that walks BigInt → string. Circular ref handling is via the\n * outer try/catch (JSON.stringify throws TypeError on cycles; we drop to\n * the fallback line). We don't implement custom cycle-breaking walker\n * because the audit payload is meant to be JSON — if user metadata has\n * a cycle, the right answer is to fix the caller, not silently lose\n * the structure.\n */\nfunction jsonReplacer(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') return value.toString()\n  return value\n}\n\n/**\n * No-op logger. Returned when `config.audit` is unset. Zero overhead;\n * framework wiring sites null-check before calling.\n */\nexport function createNoOpLogger(): AuditLogger {\n  return {\n    log() {\n      // intentionally empty\n    },\n  }\n}\n\n/**\n * T4.2 — Safe-emit wrapper. Used by framework wiring sites (csrf.ts,\n * rate-limit.ts, session.ts) so a logger throw NEVER propagates into\n * the request handler.\n */\nexport function safeAudit(logger: AuditLogger | undefined, event: AuditEvent): void {\n  if (!logger) return\n  try {\n    const r = logger.log(event)\n    // Discard the Promise — async sinks are fire-and-forget by design.\n    if (r && typeof r.then === 'function') {\n      r.catch(() => {\n        // swallow async sink failures — audit must never crash the request\n      })\n    }\n  } catch {\n    // swallow sync sink failures — audit must never crash the request\n  }\n}\n"],"mappings":";AAyCO,IAAM,iBAAN,MAA4C;AAAA,EACjD,IAAI,OAAyB;AAC3B,UAAM,WAAW;AAAA,MACf,OAAO;AAAA,MACP,GAAG;AAAA,MACH,WAAW,MAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACvD;AACA,QAAI;AAEF,cAAQ,IAAI,KAAK,UAAU,UAAU,YAAY,CAAC;AAAA,IACpD,QAAQ;AAEN,cAAQ;AAAA,QACN,6BAA6B,KAAK,UAAU,MAAM,MAAM,CAAC,gBAAgB,KAAK,UAAU,SAAS,SAAS,CAAC;AAAA,MAC7G;AAAA,IACF;AAAA,EACF;AACF;AAUA,SAAS,aAAa,MAAc,OAAyB;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,SAAS;AACrD,SAAO;AACT;AAMO,SAAS,mBAAgC;AAC9C,SAAO;AAAA,IACL,MAAM;AAAA,IAEN;AAAA,EACF;AACF;AAOO,SAAS,UAAU,QAAiC,OAAyB;AAClF,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,UAAM,IAAI,OAAO,IAAI,KAAK;AAE1B,QAAI,KAAK,OAAO,EAAE,SAAS,YAAY;AACrC,QAAE,MAAM,MAAM;AAAA,MAEd,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AAAA,EAER;AACF;","names":[]}

package/dist/chunk-UUFYP2UM.js

@@ -0,0 +1,161 @@
+import {
+  extractTraceContext,
+  generateNewTraceContext
+} from "./chunk-6NEXVBPY.js";
+import {
+  __require
+} from "./chunk-DGUM43GV.js";
+
+// src/server/webhook/timing-safe-equal.ts
+var cachedNodeImpl;
+function resolveNodeImpl() {
+  if (cachedNodeImpl !== void 0) return cachedNodeImpl;
+  try {
+    const cryptoMod = __require("crypto");
+    cachedNodeImpl = cryptoMod.timingSafeEqual ?? null;
+  } catch {
+    cachedNodeImpl = null;
+  }
+  return cachedNodeImpl;
+}
+function timingSafeEqual(a, b) {
+  if (!(a instanceof Uint8Array) || !(b instanceof Uint8Array)) {
+    throw new TypeError(
+      `timingSafeEqual expects Uint8Array arguments (got ${typeof a} and ${typeof b})`
+    );
+  }
+  if (a.length !== b.length) return false;
+  if (a.length === 0) return true;
+  const nodeImpl = resolveNodeImpl();
+  if (nodeImpl) return nodeImpl(a, b);
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a[i] ^ b[i];
+  }
+  return diff === 0;
+}
+
+// src/server/webhook/raw-body.ts
+var DEFAULT_MAX_BODY_BYTES = 1e6;
+var BodyTooLargeError = class extends Error {
+  constructor(limit, actualSeen) {
+    super(`Request body exceeds maxBodyBytes: seen ${actualSeen} bytes, limit ${limit} bytes`);
+    this.limit = limit;
+    this.actualSeen = actualSeen;
+    this.name = "BodyTooLargeError";
+  }
+  limit;
+  actualSeen;
+  status = 413;
+  code = "BODY_TOO_LARGE";
+};
+async function readRawBody(request, options = {}) {
+  const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+  const clone = request.clone();
+  if (clone.body === null) {
+    return { rawBody: "", bodyClone: request };
+  }
+  const reader = clone.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maxBodyBytes) {
+        void reader.cancel();
+        throw new BodyTooLargeError(maxBodyBytes, total);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    try {
+      reader.releaseLock();
+    } catch {
+    }
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  const rawBody = new TextDecoder().decode(bytes);
+  return { rawBody, bodyClone: request };
+}
+
+// src/server/webhook/define-webhook.ts
+function defineWebhook(opts) {
+  return {
+    verify: opts.verify,
+    handler: opts.handler,
+    maxBodyBytes: opts.maxBodyBytes,
+    __theokit_kind: "webhook"
+  };
+}
+async function dispatchWebhook(def, request) {
+  let rawBody;
+  let bodyClone;
+  try {
+    const result2 = await readRawBody(request, { maxBodyBytes: def.maxBodyBytes });
+    rawBody = result2.rawBody;
+    bodyClone = result2.bodyClone;
+  } catch (err) {
+    if (err instanceof BodyTooLargeError) {
+      return new Response(JSON.stringify({ error: err.code, message: err.message }), {
+        status: 413,
+        headers: { "content-type": "application/json" }
+      });
+    }
+    return new Response(
+      JSON.stringify({
+        error: "BAD_REQUEST",
+        message: err instanceof Error ? err.message : "failed to read body"
+      }),
+      { status: 400, headers: { "content-type": "application/json" } }
+    );
+  }
+  const incomingTrace = extractTraceContext(request.headers);
+  const traceId = incomingTrace?.trace_id ?? generateNewTraceContext().trace_id;
+  let verifyResult;
+  try {
+    verifyResult = await def.verify(bodyClone);
+  } catch (err) {
+    verifyResult = {
+      ok: false,
+      reason: `verify threw: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (!verifyResult.ok) {
+    return new Response(
+      JSON.stringify({ error: "WEBHOOK_VERIFY_FAILED", message: verifyResult.reason }),
+      { status: 401, headers: { "content-type": "application/json" } }
+    );
+  }
+  const ctx = {
+    request: bodyClone,
+    rawBody,
+    traceId,
+    signal: request.signal
+  };
+  const result = await def.handler(ctx);
+  if (result instanceof Response) return result;
+  if (result === void 0 || result === null) {
+    return new Response(null, { status: 204 });
+  }
+  return new Response(JSON.stringify(result), {
+    status: 200,
+    headers: { "content-type": "application/json" }
+  });
+}
+
+export {
+  timingSafeEqual,
+  DEFAULT_MAX_BODY_BYTES,
+  BodyTooLargeError,
+  readRawBody,
+  defineWebhook,
+  dispatchWebhook
+};
+//# sourceMappingURL=chunk-UUFYP2UM.js.map

package/dist/chunk-UUFYP2UM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/webhook/timing-safe-equal.ts","../src/server/webhook/raw-body.ts","../src/server/webhook/define-webhook.ts"],"sourcesContent":["/**\n * Constant-time byte comparison.\n *\n * Wraps `node:crypto.timingSafeEqual` when available (Node 6.6+) and falls\n * back to a constant-time XOR loop for runtimes without `node:crypto`\n * (Cloudflare Workers, Deno, Bun edge). Required to defeat timing attacks\n * on webhook signature verification — a naive `===` or `Buffer.equals`\n * would short-circuit on first mismatch byte and leak signature position\n * via wall-clock timing.\n *\n * Web Crypto's `crypto.subtle.verify` would also work, but requires a\n * `CryptoKey` object and is asymmetric (verify a signature against a key).\n * For our case — comparing two pre-computed digests — raw byte equality\n * is the correct primitive.\n *\n * @see https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b\n * @see https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/verify\n */\n\ntype NodeTimingSafeEqual = (a: Uint8Array, b: Uint8Array) => boolean\n\nlet cachedNodeImpl: NodeTimingSafeEqual | null | undefined\n\nfunction resolveNodeImpl(): NodeTimingSafeEqual | null {\n  if (cachedNodeImpl !== undefined) return cachedNodeImpl\n  try {\n    // require() avoids the dynamic-import-of-node-builtin warnings some\n    // bundlers emit; `node:crypto` is always synchronously available.\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const cryptoMod = require('node:crypto') as {\n      timingSafeEqual?: NodeTimingSafeEqual\n    }\n    cachedNodeImpl = cryptoMod.timingSafeEqual ?? null\n  } catch {\n    cachedNodeImpl = null\n  }\n  return cachedNodeImpl\n}\n\n/**\n * Returns true iff `a` and `b` have identical bytes. Takes time\n * proportional to `a.length` regardless of where bytes differ.\n *\n * @throws TypeError if either argument is not a Uint8Array.\n */\nexport function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (!(a instanceof Uint8Array) || !(b instanceof Uint8Array)) {\n    throw new TypeError(\n      `timingSafeEqual expects Uint8Array arguments (got ${typeof a} and ${typeof b})`,\n    )\n  }\n  // Length mismatch is constant-time-safe by construction (no per-byte work).\n  if (a.length !== b.length) return false\n  if (a.length === 0) return true\n\n  // Prefer the Node built-in when present — it's implemented in C and\n  // matches the contract exactly. node:crypto.timingSafeEqual throws on\n  // length mismatch, which we've already filtered above.\n  const nodeImpl = resolveNodeImpl()\n  if (nodeImpl) return nodeImpl(a, b)\n\n  // Fallback: XOR-accumulate every byte into one accumulator. NEVER\n  // short-circuit. The compiler / V8 will not constant-fold this loop\n  // because the inputs are dynamic.\n  let diff = 0\n  for (let i = 0; i < a.length; i++) {\n    diff |= a[i] ^ b[i]\n  }\n  return diff === 0\n}\n","/**\n * Read a Web `Request` body as a raw string EXACTLY ONCE and expose it\n * alongside the original request (which remains readable by downstream\n * code). Enforces a configurable `maxBodyBytes` cap to prevent OOM via\n * pathological POST.\n *\n * MUST be called FIRST in the webhook pipeline, before any other code\n * touches the body (`request.text()`, `request.json()`, parsers). Once\n * the body is consumed, `Request.clone()` throws and this function fails.\n *\n * EC-101: default `maxBodyBytes = 1_000_000` (1 MB) covers Stripe\n * (256 KB max), Slack (4 MB but compressed), and is well below Node\n * memory thresholds. GitHub webhooks up to 25 MB MUST opt in\n * (`maxBodyBytes: 25_000_000`).\n *\n * @see https://docs.stripe.com/webhooks/signatures\n * @see https://docs.github.com/en/webhooks/using-webhooks/best-practices-for-using-webhooks\n */\n\nexport const DEFAULT_MAX_BODY_BYTES = 1_000_000\n\nexport interface ReadRawBodyOptions {\n  /** Maximum bytes to read before throwing `BodyTooLargeError`. Defaults to 1 MB. */\n  maxBodyBytes?: number\n}\n\nexport interface RawBodyResult {\n  /** UTF-8 decoded body (or empty string when no body present). */\n  rawBody: string\n  /** The ORIGINAL request, still readable by downstream code. */\n  bodyClone: Request\n}\n\n/**\n * Thrown when the request body exceeds `maxBodyBytes`. Carries status\n * 413 (Payload Too Large) and stable code `BODY_TOO_LARGE` so callers\n * can map it to an HTTP response without sniffing the message.\n */\nexport class BodyTooLargeError extends Error {\n  readonly status = 413\n  readonly code = 'BODY_TOO_LARGE'\n\n  constructor(\n    public readonly limit: number,\n    public readonly actualSeen: number,\n  ) {\n    super(`Request body exceeds maxBodyBytes: seen ${actualSeen} bytes, limit ${limit} bytes`)\n    this.name = 'BodyTooLargeError'\n  }\n}\n\nexport async function readRawBody(\n  request: Request,\n  options: ReadRawBodyOptions = {},\n): Promise<RawBodyResult> {\n  const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES\n\n  // Clone the request so the original remains readable. `.clone()` throws\n  // synchronously (TypeError) if the body was already consumed — we let\n  // that propagate so callers fail fast with a clear error.\n  const clone = request.clone()\n\n  // No body at all (GET, HEAD, or empty POST). Both clone.body and\n  // clone.text() handle this gracefully but we short-circuit for clarity\n  // and to avoid an unnecessary stream read.\n  if (clone.body === null) {\n    return { rawBody: '', bodyClone: request }\n  }\n\n  const reader = clone.body.getReader()\n  const chunks: Uint8Array[] = []\n  let total = 0\n\n  try {\n    for (;;) {\n      const { value, done } = await reader.read()\n      if (done) break\n      total += value.byteLength\n      if (total > maxBodyBytes) {\n        // Cancel the stream without awaiting (avoids deadlock on some\n        // ReadableStream impls). The finally block releases the lock.\n        void reader.cancel()\n        throw new BodyTooLargeError(maxBodyBytes, total)\n      }\n      chunks.push(value)\n    }\n  } finally {\n    try {\n      reader.releaseLock()\n    } catch {\n      // lock may already be released by cancel()\n    }\n  }\n\n  // Concat all chunks into a single Uint8Array, then UTF-8 decode.\n  const bytes = new Uint8Array(total)\n  let offset = 0\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset)\n    offset += chunk.byteLength\n  }\n  const rawBody = new TextDecoder().decode(bytes)\n\n  return { rawBody, bodyClone: request }\n}\n","import {\n  extractTraceContext,\n  generateNewTraceContext,\n} from '../observability/trace-context-propagation.js'\n\nimport { BodyTooLargeError, readRawBody } from './raw-body.js'\nimport type {\n  DefineWebhookOptions,\n  VerifyResult,\n  WebhookContext,\n  WebhookDefinition,\n} from './webhook-types.js'\n\n/**\n * Declare a webhook handler with first-class signature verification\n * (R0.5.10, ADR-0005). Pure identity helper — returns the definition\n * unchanged for downstream dispatch.\n *\n * @example\n * ```ts\n * // server/webhooks/stripe.ts\n * import { defineWebhook } from 'theokit/server'\n * import { stripe } from 'theokit/server/webhook/providers'\n *\n * export default defineWebhook({\n *   verify: stripe({ secret: process.env.STRIPE_WEBHOOK_SECRET! }),\n *   async handler({ rawBody }) {\n *     const event = JSON.parse(rawBody)\n *     // ...\n *     return new Response('ok')\n *   },\n * })\n * ```\n */\nexport function defineWebhook(opts: DefineWebhookOptions): WebhookDefinition {\n  return {\n    verify: opts.verify,\n    handler: opts.handler,\n    maxBodyBytes: opts.maxBodyBytes,\n    __theokit_kind: 'webhook',\n  }\n}\n\n/**\n * Dispatch a webhook request through the definition's verify → handler\n * pipeline. Returns the handler's `Response` (or a wrapped one), or a\n * 401/413 response when verification or body size guards trip.\n *\n * EC-101: enforces `maxBodyBytes` (default 1MB via readRawBody).\n * EC-103: every throw from `verify` (sync or async) is treated as\n * `{ok: false, reason: 'verify threw: <message>'}`. Handler NEVER\n * invoked on verify failure.\n */\nexport async function dispatchWebhook(def: WebhookDefinition, request: Request): Promise<Response> {\n  let rawBody: string\n  let bodyClone: Request\n  try {\n    const result = await readRawBody(request, { maxBodyBytes: def.maxBodyBytes })\n    rawBody = result.rawBody\n    bodyClone = result.bodyClone\n  } catch (err) {\n    if (err instanceof BodyTooLargeError) {\n      return new Response(JSON.stringify({ error: err.code, message: err.message }), {\n        status: 413,\n        headers: { 'content-type': 'application/json' },\n      })\n    }\n    return new Response(\n      JSON.stringify({\n        error: 'BAD_REQUEST',\n        message: err instanceof Error ? err.message : 'failed to read body',\n      }),\n      { status: 400, headers: { 'content-type': 'application/json' } },\n    )\n  }\n\n  // Resolve traceId — propagate or generate.\n  const incomingTrace = extractTraceContext(request.headers)\n  const traceId = incomingTrace?.trace_id ?? generateNewTraceContext().trace_id\n\n  // EC-103: verify exception MUST close the door, never let handler run.\n  let verifyResult: VerifyResult\n  try {\n    verifyResult = await def.verify(bodyClone)\n  } catch (err) {\n    verifyResult = {\n      ok: false,\n      reason: `verify threw: ${err instanceof Error ? err.message : String(err)}`,\n    }\n  }\n\n  if (!verifyResult.ok) {\n    return new Response(\n      JSON.stringify({ error: 'WEBHOOK_VERIFY_FAILED', message: verifyResult.reason }),\n      { status: 401, headers: { 'content-type': 'application/json' } },\n    )\n  }\n\n  const ctx: WebhookContext = {\n    request: bodyClone,\n    rawBody,\n    traceId,\n    signal: request.signal,\n  }\n\n  const result = await def.handler(ctx)\n  if (result instanceof Response) return result\n  if (result === undefined || result === null) {\n    return new Response(null, { status: 204 })\n  }\n  return new Response(JSON.stringify(result), {\n    status: 200,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n"],"mappings":";;;;;;;;;AAqBA,IAAI;AAEJ,SAAS,kBAA8C;AACrD,MAAI,mBAAmB,OAAW,QAAO;AACzC,MAAI;AAIF,UAAM,YAAY,UAAQ,QAAa;AAGvC,qBAAiB,UAAU,mBAAmB;AAAA,EAChD,QAAQ;AACN,qBAAiB;AAAA,EACnB;AACA,SAAO;AACT;AAQO,SAAS,gBAAgB,GAAe,GAAwB;AACrE,MAAI,EAAE,aAAa,eAAe,EAAE,aAAa,aAAa;AAC5D,UAAM,IAAI;AAAA,MACR,qDAAqD,OAAO,CAAC,QAAQ,OAAO,CAAC;AAAA,IAC/E;AAAA,EACF;AAEA,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,EAAE,WAAW,EAAG,QAAO;AAK3B,QAAM,WAAW,gBAAgB;AACjC,MAAI,SAAU,QAAO,SAAS,GAAG,CAAC;AAKlC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,YAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;AAAA,EACpB;AACA,SAAO,SAAS;AAClB;;;AClDO,IAAM,yBAAyB;AAmB/B,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAI3C,YACkB,OACA,YAChB;AACA,UAAM,2CAA2C,UAAU,iBAAiB,KAAK,QAAQ;AAHzE;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EALkB;AAAA,EACA;AAAA,EALT,SAAS;AAAA,EACT,OAAO;AASlB;AAEA,eAAsB,YACpB,SACA,UAA8B,CAAC,GACP;AACxB,QAAM,eAAe,QAAQ,gBAAgB;AAK7C,QAAM,QAAQ,QAAQ,MAAM;AAK5B,MAAI,MAAM,SAAS,MAAM;AACvB,WAAO,EAAE,SAAS,IAAI,WAAW,QAAQ;AAAA,EAC3C;AAEA,QAAM,SAAS,MAAM,KAAK,UAAU;AACpC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AAEZ,MAAI;AACF,eAAS;AACP,YAAM,EAAE,OAAO,KAAK,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,eAAS,MAAM;AACf,UAAI,QAAQ,cAAc;AAGxB,aAAK,OAAO,OAAO;AACnB,cAAM,IAAI,kBAAkB,cAAc,KAAK;AAAA,MACjD;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,UAAE;AACA,QAAI;AACF,aAAO,YAAY;AAAA,IACrB,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,QAAM,QAAQ,IAAI,WAAW,KAAK;AAClC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,UAAM,IAAI,OAAO,MAAM;AACvB,cAAU,MAAM;AAAA,EAClB;AACA,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK;AAE9C,SAAO,EAAE,SAAS,WAAW,QAAQ;AACvC;;;ACtEO,SAAS,cAAc,MAA+C;AAC3E,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,cAAc,KAAK;AAAA,IACnB,gBAAgB;AAAA,EAClB;AACF;AAYA,eAAsB,gBAAgB,KAAwB,SAAqC;AACjG,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAMA,UAAS,MAAM,YAAY,SAAS,EAAE,cAAc,IAAI,aAAa,CAAC;AAC5E,cAAUA,QAAO;AACjB,gBAAYA,QAAO;AAAA,EACrB,SAAS,KAAK;AACZ,QAAI,eAAe,mBAAmB;AACpC,aAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,IAAI,MAAM,SAAS,IAAI,QAAQ,CAAC,GAAG;AAAA,QAC7E,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAChD,CAAC;AAAA,IACH;AACA,WAAO,IAAI;AAAA,MACT,KAAK,UAAU;AAAA,QACb,OAAO;AAAA,QACP,SAAS,eAAe,QAAQ,IAAI,UAAU;AAAA,MAChD,CAAC;AAAA,MACD,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AAGA,QAAM,gBAAgB,oBAAoB,QAAQ,OAAO;AACzD,QAAM,UAAU,eAAe,YAAY,wBAAwB,EAAE;AAGrE,MAAI;AACJ,MAAI;AACF,mBAAe,MAAM,IAAI,OAAO,SAAS;AAAA,EAC3C,SAAS,KAAK;AACZ,mBAAe;AAAA,MACb,IAAI;AAAA,MACJ,QAAQ,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC3E;AAAA,EACF;AAEA,MAAI,CAAC,aAAa,IAAI;AACpB,WAAO,IAAI;AAAA,MACT,KAAK,UAAU,EAAE,OAAO,yBAAyB,SAAS,aAAa,OAAO,CAAC;AAAA,MAC/E,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AAEA,QAAM,MAAsB;AAAA,IAC1B,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,QAAQ,QAAQ;AAAA,EAClB;AAEA,QAAM,SAAS,MAAM,IAAI,QAAQ,GAAG;AACpC,MAAI,kBAAkB,SAAU,QAAO;AACvC,MAAI,WAAW,UAAa,WAAW,MAAM;AAC3C,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AACA,SAAO,IAAI,SAAS,KAAK,UAAU,MAAM,GAAG;AAAA,IAC1C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;","names":["result"]}

package/dist/{chunk-OXIQI2XZ.js → chunk-VBZCVFSA.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   walkSourceFiles
-} from "./chunk-5OFPQK6N.js";
+} from "./chunk-COXLEZCN.js";
 
 // src/core/contracts/http-methods.ts
 var HTTP_METHODS = [
@@ -268,4 +268,4 @@ export {
   scanServerRoutes,
   scanWebSocketRoutes
 };
-//# sourceMappingURL=chunk-OXIQI2XZ.js.map
+//# sourceMappingURL=chunk-VBZCVFSA.js.map