theokit 0.43.12 → 0.44.3

package/dist/chunk-L2S2R3TI.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/observability/span.ts","../src/server/observability/adapters/noop.ts","../src/server/observability/adapters/console.ts","../src/server/observability/otlp-serializer.ts","../src/server/observability/adapters/theo-cloud.ts","../src/server/observability/adapter-registry.ts","../src/server/observability/middleware.ts","../src/server/observability/define-adapter.ts"],"sourcesContent":["/**\n * SpanHandle implementation — records timing + attributes.\n *\n * Used by console and theo-cloud adapters. Noop adapter uses NoopSpan.\n */\nimport type { SpanHandle, SpanAttributes } from './adapters/types.js'\n\nexport interface SpanData {\n  name: string\n  attributes: Record<string, string | number | boolean>\n  status: 'ok' | 'error'\n  statusMessage?: string\n  startTimeMs: number\n  endTimeMs?: number\n  durationMs?: number\n}\n\nexport class SpanImpl implements SpanHandle {\n  private readonly data: SpanData\n  private ended = false\n\n  constructor(name: string, attributes?: SpanAttributes) {\n    this.data = {\n      name,\n      attributes: {},\n      status: 'ok',\n      startTimeMs: Date.now(),\n    }\n    if (attributes) {\n      for (const [k, v] of Object.entries(attributes)) {\n        if (v !== undefined) this.data.attributes[k] = v\n      }\n    }\n  }\n\n  setAttribute(key: string, value: string | number | boolean): void {\n    if (!this.ended) this.data.attributes[key] = value\n  }\n\n  setStatus(status: 'ok' | 'error', message?: string): void {\n    if (!this.ended) {\n      this.data.status = status\n      this.data.statusMessage = message\n    }\n  }\n\n  end(): void {\n    if (this.ended) return // idempotent\n    this.ended = true\n    this.data.endTimeMs = Date.now()\n    this.data.durationMs = this.data.endTimeMs - this.data.startTimeMs\n  }\n\n  /** Read-only access to span data (for adapters to export). */\n  getData(): SpanData {\n    return { ...this.data, attributes: { ...this.data.attributes } }\n  }\n\n  isEnded(): boolean {\n    return this.ended\n  }\n}\n\n/** Noop span — used by NoopAdapter and post-shutdown fallback (EC-2). */\nexport class NoopSpan implements SpanHandle {\n  setAttribute(): void {}\n  setStatus(): void {}\n  end(): void {}\n}\n","/**\n * NoopObservabilityAdapter — silent fallback.\n *\n * All methods are no-ops. Never throws, never blocks.\n * Used as the default when no other adapter is configured.\n * EC-2: startSpan after shutdown returns a noop span (no crash).\n */\nimport { NoopSpan } from '../span.js'\n\nimport type { ObservabilityAdapter, SpanHandle, SpanAttributes } from './types.js'\n\nexport class NoopObservabilityAdapter implements ObservabilityAdapter {\n  readonly name = 'noop'\n  private isShutdown = false\n\n  startSpan(_name: string, _attributes?: SpanAttributes): SpanHandle {\n    return new NoopSpan()\n  }\n\n  // Null Object: discarding the call IS the behaviour. An empty body is the honest\n  // implementation — a fabricated one would only hide that from the next reader.\n  /* eslint-disable @typescript-eslint/no-empty-function -- no-op adapter by design */\n  counter(_name: string, _value: number, _attributes?: SpanAttributes): void {}\n  histogram(_name: string, _value: number, _attributes?: SpanAttributes): void {}\n  log(\n    _level: 'debug' | 'info' | 'warn' | 'error',\n    _message: string,\n    _attributes?: SpanAttributes,\n  ): void {}\n  /* eslint-enable @typescript-eslint/no-empty-function */\n\n  // Not `async`: there is nothing to await, and declaring it so would claim otherwise.\n  flush(): Promise<void> {\n    return Promise.resolve()\n  }\n\n  shutdown(): Promise<void> {\n    this.isShutdown = true\n    return Promise.resolve()\n  }\n}\n","/**\n * ConsoleObservabilityAdapter — dev-mode console output.\n *\n * Emits JSON-structured lines to a configurable writer (default: process.stderr).\n * Inspired by Hono middleware timing pattern.\n */\nimport { SpanImpl, NoopSpan, type SpanData } from '../span.js'\n\nimport type { ObservabilityAdapter, SpanHandle, SpanAttributes } from './types.js'\n\ninterface ConsoleAdapterOptions {\n  /** Writer function — defaults to process.stderr.write. */\n  write?: (line: string) => void\n}\n\nexport class ConsoleObservabilityAdapter implements ObservabilityAdapter {\n  readonly name = 'console'\n  private write: (line: string) => void\n  private isShutdown = false\n  private spans: SpanImpl[] = []\n\n  constructor(options: ConsoleAdapterOptions = {}) {\n    this.write = options.write ?? ((line: string) => process.stderr.write(line + '\\n'))\n  }\n\n  startSpan(name: string, attributes?: SpanAttributes): SpanHandle {\n    if (this.isShutdown) return new NoopSpan()\n    const span = new SpanImpl(name, attributes)\n    this.spans.push(span)\n    return {\n      setAttribute: (k, v) => {\n        span.setAttribute(k, v)\n      },\n      setStatus: (s, m) => {\n        span.setStatus(s, m)\n      },\n      end: () => {\n        span.end()\n        this.emitSpan(span.getData())\n      },\n    }\n  }\n\n  counter(name: string, value: number, attributes?: SpanAttributes): void {\n    if (this.isShutdown) return\n    this.emit({\n      type: 'counter',\n      metric: name,\n      value,\n      attributes: attributes ?? {},\n      timestamp: Date.now(),\n    })\n  }\n\n  histogram(name: string, value: number, attributes?: SpanAttributes): void {\n    if (this.isShutdown) return\n    this.emit({\n      type: 'histogram',\n      metric: name,\n      value,\n      attributes: attributes ?? {},\n      timestamp: Date.now(),\n    })\n  }\n\n  log(\n    level: 'debug' | 'info' | 'warn' | 'error',\n    message: string,\n    attributes?: SpanAttributes,\n  ): void {\n    if (this.isShutdown) return\n    this.emit({ type: 'log', level, message, attributes: attributes ?? {}, timestamp: Date.now() })\n  }\n\n  // Not `async`: this adapter writes synchronously, so there is nothing to await.\n  flush(): Promise<void> {\n    return Promise.resolve()\n  }\n\n  shutdown(): Promise<void> {\n    this.isShutdown = true\n    return Promise.resolve()\n  }\n\n  private emitSpan(data: SpanData): void {\n    this.emit({\n      type: 'span',\n      name: data.name,\n      status: data.status,\n      duration_ms: data.durationMs ?? 0,\n      attributes: data.attributes,\n      timestamp: data.startTimeMs,\n    })\n  }\n\n  private emit(record: Record<string, unknown>): void {\n    this.write(JSON.stringify(record))\n  }\n}\n","/**\n * Lightweight OTLP JSON serializer — ~50 LoC, no @opentelemetry/* dependency.\n *\n * Per ADR D456: in-house serializer for the theo-cloud adapter.\n * Produces valid ExportTraceServiceRequest JSON (OTLP v1.0).\n * Pinned to OTLP JSON v1.0 (stable since 2023).\n */\nimport type { SpanData } from './span.js'\n\ninterface OtlpSpan {\n  traceId: string\n  spanId: string\n  name: string\n  kind: number\n  startTimeUnixNano: string\n  endTimeUnixNano: string\n  attributes: { key: string; value: { stringValue?: string; intValue?: string; boolValue?: boolean } }[]\n  status: { code: number; message?: string }\n}\n\ninterface ExportTraceServiceRequest {\n  resourceSpans: [{\n    scopeSpans: [{\n      scope: { name: string; version: string }\n      spans: OtlpSpan[]\n    }]\n  }]\n}\n\n/** Convert SpanData[] to OTLP JSON bytes (Uint8Array). */\nexport function serializeSpansToOtlp(spans: SpanData[], serviceName = 'theokit'): Uint8Array {\n  const otlpSpans: OtlpSpan[] = spans.map((s) => ({\n    traceId: randomHex(32),\n    spanId: randomHex(16),\n    name: s.name,\n    kind: 2, // SPAN_KIND_SERVER\n    startTimeUnixNano: String(s.startTimeMs * 1_000_000),\n    endTimeUnixNano: String((s.endTimeMs ?? s.startTimeMs) * 1_000_000),\n    attributes: Object.entries(s.attributes).map(([key, value]) => ({\n      key,\n      value: typeof value === 'string'\n        ? { stringValue: value }\n        : typeof value === 'number'\n          ? { intValue: String(value) }\n          : { boolValue: value },\n    })),\n    status: { code: s.status === 'ok' ? 1 : 2, message: s.statusMessage },\n  }))\n\n  const request: ExportTraceServiceRequest = {\n    resourceSpans: [{\n      scopeSpans: [{\n        scope: { name: serviceName, version: '1.0.0' },\n        spans: otlpSpans,\n      }],\n    }],\n  }\n\n  return new TextEncoder().encode(JSON.stringify(request))\n}\n\nfunction randomHex(length: number): string {\n  const bytes = new Uint8Array(length / 2)\n  globalThis.crypto.getRandomValues(bytes)\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n","/**\n * TheoCloudObservabilityAdapter — OTLP/HTTP batched export for TheoCloud.\n *\n * Zero-config via env vars (THEO_CLOUD_INGEST_URL, THEO_CLOUD_API_KEY).\n * Batches spans and flushes via native fetch() POST.\n *\n * EC-1: flush failure logs warning, does NOT throw, does NOT retry (KISS).\n * EC-2: startSpan after shutdown returns noop span.\n */\nimport { serializeSpansToOtlp } from '../otlp-serializer.js'\nimport { SpanImpl, NoopSpan, type SpanData } from '../span.js'\n\nimport type { ObservabilityAdapter, SpanHandle, SpanAttributes } from './types.js'\n\ninterface TheoCloudAdapterOptions {\n  /** TheoCloud ingest endpoint URL. */\n  ingestUrl: string\n  /** TheoCloud API key for authentication. */\n  token: string\n  /** Flush interval in ms (default: 5000). */\n  flushIntervalMs?: number\n  /** Mock fetch for testing (never in production). */\n  _mockFetch?: typeof globalThis.fetch\n}\n\nexport class TheoCloudObservabilityAdapter implements ObservabilityAdapter {\n  readonly name = 'theo-cloud'\n  private pendingSpans: SpanData[] = []\n  private isShutdown = false\n  private readonly opts: Required<Pick<TheoCloudAdapterOptions, 'ingestUrl' | 'token'>> &\n    TheoCloudAdapterOptions\n\n  constructor(options: TheoCloudAdapterOptions) {\n    this.opts = { flushIntervalMs: 5000, ...options }\n  }\n\n  startSpan(name: string, attributes?: SpanAttributes): SpanHandle {\n    if (this.isShutdown) return new NoopSpan()\n    const span = new SpanImpl(name, attributes)\n    return {\n      setAttribute: (k, v) => {\n        span.setAttribute(k, v)\n      },\n      setStatus: (s, m) => {\n        span.setStatus(s, m)\n      },\n      end: () => {\n        span.end()\n        this.pendingSpans.push(span.getData())\n      },\n    }\n  }\n\n  /* eslint-disable @typescript-eslint/no-empty-function -- metrics not shipped by this adapter yet; an empty body is honest, a fabricated one is not */\n  counter(_name: string, _value: number, _attributes?: SpanAttributes): void {}\n  histogram(_name: string, _value: number, _attributes?: SpanAttributes): void {}\n  log(\n    _level: 'debug' | 'info' | 'warn' | 'error',\n    _message: string,\n    _attributes?: SpanAttributes,\n  ): void {}\n  /* eslint-enable @typescript-eslint/no-empty-function */\n\n  async flush(): Promise<void> {\n    if (this.isShutdown || this.pendingSpans.length === 0) return\n\n    const spans = this.pendingSpans.splice(0)\n    const body = serializeSpansToOtlp(spans) as unknown as BodyInit\n    const fetchFn = this.opts._mockFetch ?? globalThis.fetch\n\n    try {\n      await fetchFn(this.opts.ingestUrl, {\n        method: 'POST',\n        headers: {\n          'content-type': 'application/json',\n          authorization: `Bearer ${this.opts.token}`,\n        },\n        body,\n      })\n    } catch (err) {\n      // EC-1: log warning, don't throw, don't retry\n      console.error(\n        `[theokit:observability] flush failed: ${err instanceof Error ? err.message : 'unknown error'}`,\n      )\n    }\n  }\n\n  async shutdown(): Promise<void> {\n    if (this.isShutdown) return\n    await this.flush()\n    this.isShutdown = true\n  }\n}\n","/**\n * Adapter registry — resolves the active observability adapter.\n *\n * Per ADR D457 (v1.1) priority chain:\n *   1. Explicit config (theo.config.ts observability.provider) — ALWAYS wins\n *   2. THEO_CLOUD_INGEST_URL env → theo-cloud adapter\n *   3. NODE_ENV=development → console adapter\n *   4. Fallback → noop adapter\n */\nimport { ConsoleObservabilityAdapter } from './adapters/console.js'\nimport { NoopObservabilityAdapter } from './adapters/noop.js'\nimport { TheoCloudObservabilityAdapter } from './adapters/theo-cloud.js'\nimport type { ObservabilityAdapter } from './adapters/types.js'\n\ninterface ResolveAdapterOptions {\n  env: Record<string, string | undefined>\n  config?: {\n    provider?: ObservabilityAdapter\n  }\n}\n\n/**\n * Resolve the observability adapter from config + env.\n * Called once at boot — returns the active adapter for the process lifetime.\n */\nexport function resolveAdapter(options: ResolveAdapterOptions): ObservabilityAdapter {\n  // 1. Explicit config ALWAYS wins (EC-4)\n  if (options.config?.provider) {\n    return options.config.provider\n  }\n\n  // 2. TheoCloud env vars → theo-cloud adapter\n  const ingestUrl = options.env.THEO_CLOUD_INGEST_URL\n  const apiKey = options.env.THEO_CLOUD_API_KEY\n  if (ingestUrl && apiKey) {\n    return new TheoCloudObservabilityAdapter({ ingestUrl, token: apiKey })\n  }\n\n  // 3. Development → console adapter\n  if (options.env.NODE_ENV === 'development') {\n    return new ConsoleObservabilityAdapter()\n  }\n\n  // 4. Fallback → noop\n  return new NoopObservabilityAdapter()\n}\n","/**\n * Auto-instrumentation middleware — creates spans for every HTTP request.\n *\n * Registers as a standard TheoKit plugin via existing hook system.\n * No changes to plugin-runner needed.\n *\n * Per blueprint Pattern 2 (Hono middleware timing):\n * - onRequest: start span with method + path\n * - onResponse: end span with status + duration\n * - onError: set span status to error\n */\nimport type { ObservabilityAdapter, SpanHandle } from './adapters/types.js'\n\ninterface PluginContext {\n  requestId: string\n  request: { method: string; url: string }\n  response?: { statusCode: number }\n}\n\ninterface ObservabilityPlugin {\n  name: string\n  onRequest(ctx: PluginContext): Promise<void>\n  onResponse(ctx: PluginContext): Promise<void>\n  onError(ctx: PluginContext & { error: unknown }): Promise<void>\n}\n\n// Active spans keyed by requestId — cleared on response/error\nconst activeSpans = new Map<string, SpanHandle>()\n\n/**\n * Create an observability plugin that auto-instruments HTTP requests.\n *\n * EC-5: For SSE responses, span ends on response close, not headers sent.\n * The caller should invoke onResponse when the stream actually closes.\n */\nexport function createObservabilityPlugin(adapter: ObservabilityAdapter): ObservabilityPlugin {\n  return {\n    name: 'theokit:observability',\n\n    // NOT `async`: every hook here is synchronous work on an in-memory span map. Declaring them\n    // async would advertise awaiting that never happens (M56).\n    onRequest(ctx: PluginContext): Promise<void> {\n      const url = new URL(ctx.request.url, 'http://localhost')\n      const span = adapter.startSpan('http.request', {\n        method: ctx.request.method,\n        path: url.pathname,\n        requestId: ctx.requestId,\n      })\n      activeSpans.set(ctx.requestId, span)\n      return Promise.resolve()\n    },\n\n    onResponse(ctx: PluginContext): Promise<void> {\n      const span = activeSpans.get(ctx.requestId)\n      if (!span) return Promise.resolve()\n      activeSpans.delete(ctx.requestId)\n\n      if (ctx.response) {\n        span.setAttribute('status', ctx.response.statusCode)\n      }\n      span.setStatus('ok')\n      span.end()\n\n      adapter.counter('http.requests', 1, {\n        method: ctx.request.method,\n        status: ctx.response?.statusCode ?? 0,\n      })\n      return Promise.resolve()\n    },\n\n    onError(ctx: PluginContext & { error: unknown }): Promise<void> {\n      const span = activeSpans.get(ctx.requestId)\n      if (!span) return Promise.resolve()\n      activeSpans.delete(ctx.requestId)\n\n      const message = ctx.error instanceof Error ? ctx.error.message : 'unknown error'\n      span.setAttribute('error', true)\n      span.setStatus('error', message)\n      span.end()\n\n      adapter.counter('http.errors', 1, {\n        method: ctx.request.method,\n      })\n      return Promise.resolve()\n    },\n  }\n}\n","/**\n * defineObservabilityAdapter() — public API for custom adapters.\n *\n * The escape hatch for self-host users who want Datadog, Grafana, Honeycomb, etc.\n * Validates the adapter shape and returns a typed ObservabilityAdapter.\n *\n * @example\n * ```ts\n * const datadogAdapter = defineObservabilityAdapter({\n *   name: 'datadog',\n *   startSpan: (name, attrs) => { ... },\n *   counter: (name, value) => { ... },\n *   histogram: (name, value) => { ... },\n *   log: (level, message) => { ... },\n *   flush: async () => { ... },\n *   shutdown: async () => { ... },\n * })\n *\n * // theo.config.ts\n * export default defineConfig({\n *   observability: { provider: datadogAdapter },\n * })\n * ```\n */\nimport type { ObservabilityAdapter, SpanHandle, SpanAttributes } from './adapters/types.js'\n\ninterface DefineAdapterConfig {\n  name: string\n  startSpan(name: string, attributes?: SpanAttributes): SpanHandle\n  counter(name: string, value: number, attributes?: SpanAttributes): void\n  histogram(name: string, value: number, attributes?: SpanAttributes): void\n  log(\n    level: 'debug' | 'info' | 'warn' | 'error',\n    message: string,\n    attributes?: SpanAttributes,\n  ): void\n  flush(): Promise<void>\n  shutdown(): Promise<void>\n}\n\nexport function defineObservabilityAdapter(config: DefineAdapterConfig): ObservabilityAdapter {\n  return {\n    name: config.name,\n    startSpan: (name, attrs) => config.startSpan(name, attrs),\n    counter: (name, value, attrs) => {\n      config.counter(name, value, attrs)\n    },\n    histogram: (name, value, attrs) => {\n      config.histogram(name, value, attrs)\n    },\n    log: (level, message, attrs) => {\n      config.log(level, message, attrs)\n    },\n    flush: () => config.flush(),\n    shutdown: () => config.shutdown(),\n  }\n}\n"],"mappings":";AAiBO,IAAM,WAAN,MAAqC;AAAA,EACzB;AAAA,EACT,QAAQ;AAAA,EAEhB,YAAY,MAAc,YAA6B;AACrD,SAAK,OAAO;AAAA,MACV;AAAA,MACA,YAAY,CAAC;AAAA,MACb,QAAQ;AAAA,MACR,aAAa,KAAK,IAAI;AAAA,IACxB;AACA,QAAI,YAAY;AACd,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC/C,YAAI,MAAM,OAAW,MAAK,KAAK,WAAW,CAAC,IAAI;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAa,KAAa,OAAwC;AAChE,QAAI,CAAC,KAAK,MAAO,MAAK,KAAK,WAAW,GAAG,IAAI;AAAA,EAC/C;AAAA,EAEA,UAAU,QAAwB,SAAwB;AACxD,QAAI,CAAC,KAAK,OAAO;AACf,WAAK,KAAK,SAAS;AACnB,WAAK,KAAK,gBAAgB;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAY;AACV,QAAI,KAAK,MAAO;AAChB,SAAK,QAAQ;AACb,SAAK,KAAK,YAAY,KAAK,IAAI;AAC/B,SAAK,KAAK,aAAa,KAAK,KAAK,YAAY,KAAK,KAAK;AAAA,EACzD;AAAA;AAAA,EAGA,UAAoB;AAClB,WAAO,EAAE,GAAG,KAAK,MAAM,YAAY,EAAE,GAAG,KAAK,KAAK,WAAW,EAAE;AAAA,EACjE;AAAA,EAEA,UAAmB;AACjB,WAAO,KAAK;AAAA,EACd;AACF;AAGO,IAAM,WAAN,MAAqC;AAAA,EAC1C,eAAqB;AAAA,EAAC;AAAA,EACtB,YAAkB;AAAA,EAAC;AAAA,EACnB,MAAY;AAAA,EAAC;AACf;;;ACzDO,IAAM,2BAAN,MAA+D;AAAA,EAC3D,OAAO;AAAA,EACR,aAAa;AAAA,EAErB,UAAU,OAAe,aAA0C;AACjE,WAAO,IAAI,SAAS;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,OAAe,QAAgB,aAAoC;AAAA,EAAC;AAAA,EAC5E,UAAU,OAAe,QAAgB,aAAoC;AAAA,EAAC;AAAA,EAC9E,IACE,QACA,UACA,aACM;AAAA,EAAC;AAAA;AAAA;AAAA,EAIT,QAAuB;AACrB,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA,EAEA,WAA0B;AACxB,SAAK,aAAa;AAClB,WAAO,QAAQ,QAAQ;AAAA,EACzB;AACF;;;ACzBO,IAAM,8BAAN,MAAkE;AAAA,EAC9D,OAAO;AAAA,EACR;AAAA,EACA,aAAa;AAAA,EACb,QAAoB,CAAC;AAAA,EAE7B,YAAY,UAAiC,CAAC,GAAG;AAC/C,SAAK,QAAQ,QAAQ,UAAU,CAAC,SAAiB,QAAQ,OAAO,MAAM,OAAO,IAAI;AAAA,EACnF;AAAA,EAEA,UAAU,MAAc,YAAyC;AAC/D,QAAI,KAAK,WAAY,QAAO,IAAI,SAAS;AACzC,UAAM,OAAO,IAAI,SAAS,MAAM,UAAU;AAC1C,SAAK,MAAM,KAAK,IAAI;AACpB,WAAO;AAAA,MACL,cAAc,CAAC,GAAG,MAAM;AACtB,aAAK,aAAa,GAAG,CAAC;AAAA,MACxB;AAAA,MACA,WAAW,CAAC,GAAG,MAAM;AACnB,aAAK,UAAU,GAAG,CAAC;AAAA,MACrB;AAAA,MACA,KAAK,MAAM;AACT,aAAK,IAAI;AACT,aAAK,SAAS,KAAK,QAAQ,CAAC;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAAQ,MAAc,OAAe,YAAmC;AACtE,QAAI,KAAK,WAAY;AACrB,SAAK,KAAK;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA,YAAY,cAAc,CAAC;AAAA,MAC3B,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,UAAU,MAAc,OAAe,YAAmC;AACxE,QAAI,KAAK,WAAY;AACrB,SAAK,KAAK;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA,YAAY,cAAc,CAAC;AAAA,MAC3B,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,IACE,OACA,SACA,YACM;AACN,QAAI,KAAK,WAAY;AACrB,SAAK,KAAK,EAAE,MAAM,OAAO,OAAO,SAAS,YAAY,cAAc,CAAC,GAAG,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,EAChG;AAAA;AAAA,EAGA,QAAuB;AACrB,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA,EAEA,WAA0B;AACxB,SAAK,aAAa;AAClB,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA,EAEQ,SAAS,MAAsB;AACrC,SAAK,KAAK;AAAA,MACR,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,aAAa,KAAK,cAAc;AAAA,MAChC,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,IAClB,CAAC;AAAA,EACH;AAAA,EAEQ,KAAK,QAAuC;AAClD,SAAK,MAAM,KAAK,UAAU,MAAM,CAAC;AAAA,EACnC;AACF;;;ACpEO,SAAS,qBAAqB,OAAmB,cAAc,WAAuB;AAC3F,QAAM,YAAwB,MAAM,IAAI,CAAC,OAAO;AAAA,IAC9C,SAAS,UAAU,EAAE;AAAA,IACrB,QAAQ,UAAU,EAAE;AAAA,IACpB,MAAM,EAAE;AAAA,IACR,MAAM;AAAA;AAAA,IACN,mBAAmB,OAAO,EAAE,cAAc,GAAS;AAAA,IACnD,iBAAiB,QAAQ,EAAE,aAAa,EAAE,eAAe,GAAS;AAAA,IAClE,YAAY,OAAO,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;AAAA,MAC9D;AAAA,MACA,OAAO,OAAO,UAAU,WACpB,EAAE,aAAa,MAAM,IACrB,OAAO,UAAU,WACf,EAAE,UAAU,OAAO,KAAK,EAAE,IAC1B,EAAE,WAAW,MAAM;AAAA,IAC3B,EAAE;AAAA,IACF,QAAQ,EAAE,MAAM,EAAE,WAAW,OAAO,IAAI,GAAG,SAAS,EAAE,cAAc;AAAA,EACtE,EAAE;AAEF,QAAM,UAAqC;AAAA,IACzC,eAAe,CAAC;AAAA,MACd,YAAY,CAAC;AAAA,QACX,OAAO,EAAE,MAAM,aAAa,SAAS,QAAQ;AAAA,QAC7C,OAAO;AAAA,MACT,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAEA,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,OAAO,CAAC;AACzD;AAEA,SAAS,UAAU,QAAwB;AACzC,QAAM,QAAQ,IAAI,WAAW,SAAS,CAAC;AACvC,aAAW,OAAO,gBAAgB,KAAK;AACvC,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;;;ACxCO,IAAM,gCAAN,MAAoE;AAAA,EAChE,OAAO;AAAA,EACR,eAA2B,CAAC;AAAA,EAC5B,aAAa;AAAA,EACJ;AAAA,EAGjB,YAAY,SAAkC;AAC5C,SAAK,OAAO,EAAE,iBAAiB,KAAM,GAAG,QAAQ;AAAA,EAClD;AAAA,EAEA,UAAU,MAAc,YAAyC;AAC/D,QAAI,KAAK,WAAY,QAAO,IAAI,SAAS;AACzC,UAAM,OAAO,IAAI,SAAS,MAAM,UAAU;AAC1C,WAAO;AAAA,MACL,cAAc,CAAC,GAAG,MAAM;AACtB,aAAK,aAAa,GAAG,CAAC;AAAA,MACxB;AAAA,MACA,WAAW,CAAC,GAAG,MAAM;AACnB,aAAK,UAAU,GAAG,CAAC;AAAA,MACrB;AAAA,MACA,KAAK,MAAM;AACT,aAAK,IAAI;AACT,aAAK,aAAa,KAAK,KAAK,QAAQ,CAAC;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,QAAQ,OAAe,QAAgB,aAAoC;AAAA,EAAC;AAAA,EAC5E,UAAU,OAAe,QAAgB,aAAoC;AAAA,EAAC;AAAA,EAC9E,IACE,QACA,UACA,aACM;AAAA,EAAC;AAAA;AAAA,EAGT,MAAM,QAAuB;AAC3B,QAAI,KAAK,cAAc,KAAK,aAAa,WAAW,EAAG;AAEvD,UAAM,QAAQ,KAAK,aAAa,OAAO,CAAC;AACxC,UAAM,OAAO,qBAAqB,KAAK;AACvC,UAAM,UAAU,KAAK,KAAK,cAAc,WAAW;AAEnD,QAAI;AACF,YAAM,QAAQ,KAAK,KAAK,WAAW;AAAA,QACjC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,eAAe,UAAU,KAAK,KAAK,KAAK;AAAA,QAC1C;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AAEZ,cAAQ;AAAA,QACN,yCAAyC,eAAe,QAAQ,IAAI,UAAU,eAAe;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,WAA0B;AAC9B,QAAI,KAAK,WAAY;AACrB,UAAM,KAAK,MAAM;AACjB,SAAK,aAAa;AAAA,EACpB;AACF;;;ACnEO,SAAS,eAAe,SAAsD;AAEnF,MAAI,QAAQ,QAAQ,UAAU;AAC5B,WAAO,QAAQ,OAAO;AAAA,EACxB;AAGA,QAAM,YAAY,QAAQ,IAAI;AAC9B,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,aAAa,QAAQ;AACvB,WAAO,IAAI,8BAA8B,EAAE,WAAW,OAAO,OAAO,CAAC;AAAA,EACvE;AAGA,MAAI,QAAQ,IAAI,aAAa,eAAe;AAC1C,WAAO,IAAI,4BAA4B;AAAA,EACzC;AAGA,SAAO,IAAI,yBAAyB;AACtC;;;AClBA,IAAM,cAAc,oBAAI,IAAwB;AAQzC,SAAS,0BAA0B,SAAoD;AAC5F,SAAO;AAAA,IACL,MAAM;AAAA;AAAA;AAAA,IAIN,UAAU,KAAmC;AAC3C,YAAM,MAAM,IAAI,IAAI,IAAI,QAAQ,KAAK,kBAAkB;AACvD,YAAM,OAAO,QAAQ,UAAU,gBAAgB;AAAA,QAC7C,QAAQ,IAAI,QAAQ;AAAA,QACpB,MAAM,IAAI;AAAA,QACV,WAAW,IAAI;AAAA,MACjB,CAAC;AACD,kBAAY,IAAI,IAAI,WAAW,IAAI;AACnC,aAAO,QAAQ,QAAQ;AAAA,IACzB;AAAA,IAEA,WAAW,KAAmC;AAC5C,YAAM,OAAO,YAAY,IAAI,IAAI,SAAS;AAC1C,UAAI,CAAC,KAAM,QAAO,QAAQ,QAAQ;AAClC,kBAAY,OAAO,IAAI,SAAS;AAEhC,UAAI,IAAI,UAAU;AAChB,aAAK,aAAa,UAAU,IAAI,SAAS,UAAU;AAAA,MACrD;AACA,WAAK,UAAU,IAAI;AACnB,WAAK,IAAI;AAET,cAAQ,QAAQ,iBAAiB,GAAG;AAAA,QAClC,QAAQ,IAAI,QAAQ;AAAA,QACpB,QAAQ,IAAI,UAAU,cAAc;AAAA,MACtC,CAAC;AACD,aAAO,QAAQ,QAAQ;AAAA,IACzB;AAAA,IAEA,QAAQ,KAAwD;AAC9D,YAAM,OAAO,YAAY,IAAI,IAAI,SAAS;AAC1C,UAAI,CAAC,KAAM,QAAO,QAAQ,QAAQ;AAClC,kBAAY,OAAO,IAAI,SAAS;AAEhC,YAAM,UAAU,IAAI,iBAAiB,QAAQ,IAAI,MAAM,UAAU;AACjE,WAAK,aAAa,SAAS,IAAI;AAC/B,WAAK,UAAU,SAAS,OAAO;AAC/B,WAAK,IAAI;AAET,cAAQ,QAAQ,eAAe,GAAG;AAAA,QAChC,QAAQ,IAAI,QAAQ;AAAA,MACtB,CAAC;AACD,aAAO,QAAQ,QAAQ;AAAA,IACzB;AAAA,EACF;AACF;;;AC9CO,SAAS,2BAA2B,QAAmD;AAC5F,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,WAAW,CAAC,MAAM,UAAU,OAAO,UAAU,MAAM,KAAK;AAAA,IACxD,SAAS,CAAC,MAAM,OAAO,UAAU;AAC/B,aAAO,QAAQ,MAAM,OAAO,KAAK;AAAA,IACnC;AAAA,IACA,WAAW,CAAC,MAAM,OAAO,UAAU;AACjC,aAAO,UAAU,MAAM,OAAO,KAAK;AAAA,IACrC;AAAA,IACA,KAAK,CAAC,OAAO,SAAS,UAAU;AAC9B,aAAO,IAAI,OAAO,SAAS,KAAK;AAAA,IAClC;AAAA,IACA,OAAO,MAAM,OAAO,MAAM;AAAA,IAC1B,UAAU,MAAM,OAAO,SAAS;AAAA,EAClC;AACF;","names":[]}

package/dist/chunk-N2D5AVRR.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/http/controller-dispatch.ts","../src/server/http/batch-handler.ts","../src/server/http/cors.ts","../src/server/http/trace-context.ts","../src/server/security/csp-report.ts","../src/server/security/csrf-readiness-endpoint.ts","../src/server/security/csrf-readiness-store.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Controller files are walked from the developer's `serverDir/controllers`\n * (a build-time config path), never from HTTP input. No injection vector.\n */\nimport { readdirSync, type Dirent } from 'node:fs'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport { join } from 'node:path'\n\nimport { createDecoratorHandler, isControllerClass, type ServeAgent } from '@theokit/http'\n\nimport { dispatchCsrfWarn } from '../security/csrf-warn-dispatch.js'\nimport { enforceCsrf, type DisallowedConfig } from '../security/csrf.js'\n\nimport { incomingMessageToWebRequest } from './node-request.js'\nimport { sendError } from './send-response.js'\n\n/** A decorator controller constructor (`@Controller` class). */\ntype ControllerClass = new (...args: never[]) => object\n\n/** Loads a controller module by absolute path. In dev this is Vite's `ssrLoadModule`\n * (the Task 1.1 swc transform has already compiled the parameter decorators); tests\n * inject `@theokit/http`'s `loadControllerWithSwc`. */\nexport type ControllerModuleLoader = (absPath: string) => Promise<Record<string, unknown>>\n\n/** A built controller route table exposed as a pure Web-Standard handler. */\ninterface ControllerDispatcher {\n  /** `null` = no controller route matched — the host owns the miss (404 / fall-through). */\n  dispatch(request: Request): Promise<Response | null>\n  /** Non-executing route probe — true when a controller route owns `method` + `pathname`. */\n  matches(method: string, pathname: string): boolean\n}\n\n// State-mutating methods get CSRF, mirroring the file-route pipeline (execute.ts).\nconst CSRF_PROTECTED_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])\n\n/** Recursively collect `*.controller.ts` files under `dir` (absolute paths). */\nfunction findControllerFiles(dir: string): string[] {\n  const found: string[] = []\n  const walk = (current: string): void => {\n    let entries: Dirent[]\n    try {\n      entries = readdirSync(current, { withFileTypes: true })\n    } catch {\n      return // dir doesn't exist — no controllers\n    }\n    for (const entry of entries) {\n      const full = join(current, entry.name)\n      if (entry.isDirectory()) walk(full)\n      else if (entry.name.endsWith('.controller.ts')) found.push(full)\n    }\n  }\n  walk(dir)\n  return found\n}\n\n/** A discovered controller: its source file + the loaded `@Controller` class. */\ninterface ControllerModule {\n  filePath: string\n  cls: ControllerClass\n}\n\n/**\n * Load every `@Controller` class under `controllersDir` via the injected loader,\n * keeping each class paired with its source file (needed by the typed-client\n * codegen to emit `import type { X } from '<file>'`). Non-controller exports are\n * ignored (`isControllerClass` — reused from @theokit/http).\n */\nexport async function scanControllerModules(\n  controllersDir: string,\n  loadModule: ControllerModuleLoader,\n): Promise<ControllerModule[]> {\n  const files = findControllerFiles(controllersDir)\n  const modules: ControllerModule[] = []\n  for (const filePath of files) {\n    const mod = await loadModule(filePath)\n    for (const exported of Object.values(mod)) {\n      if (typeof exported === 'function' && isControllerClass(exported)) {\n        modules.push({ filePath, cls: exported as ControllerClass })\n      }\n    }\n  }\n  return modules\n}\n\n/** Load every `@Controller` class under `controllersDir` (classes only). */\nasync function scanControllers(\n  controllersDir: string,\n  loadModule: ControllerModuleLoader,\n): Promise<ControllerClass[]> {\n  const modules = await scanControllerModules(controllersDir, loadModule)\n  return modules.map((m) => m.cls)\n}\n\n/**\n * Scan `controllersDir` and build a Web-Standard dispatcher over the decorator\n * controllers found. Returns `null` when the directory has no controllers, so\n * the host can skip the controller path entirely (zero cost for routes-only apps).\n *\n * Dispatch REUSES @theokit/http's `createDecoratorHandler` (match + `@Param`\n * binding + `@Body` validation + Response building) — never re-implemented (ADR-1).\n */\nexport async function createControllerDispatcher(opts: {\n  controllersDir: string\n  loadModule: ControllerModuleLoader\n  /** M47 — serves `@Expose`-bound agent routes (theo supplies a `mountAgent`-backed impl). */\n  serveAgent?: ServeAgent\n}): Promise<ControllerDispatcher | null> {\n  const classes = await scanControllers(opts.controllersDir, opts.loadModule)\n  if (classes.length === 0) return null\n  const handle = createDecoratorHandler({ controllers: classes, serveAgent: opts.serveAgent })\n  return {\n    dispatch: (request) => handle(request),\n    matches: (method, pathname) => handle.matches(method, pathname),\n  }\n}\n\n/** Write a buffered Web `Response` (controllers never stream) to a Node response. */\nasync function writeControllerResponse(res: ServerResponse, response: Response): Promise<void> {\n  const headersBag: Record<string, string> = {}\n  for (const [k, v] of response.headers) {\n    if (k.toLowerCase() !== 'set-cookie') headersBag[k] = v\n  }\n  const setCookies = response.headers.getSetCookie()\n  if (setCookies.length > 0) res.setHeader('Set-Cookie', setCookies)\n  res.writeHead(response.status, headersBag)\n  const body = response.body ? await response.text() : ''\n  res.end(body || undefined)\n}\n\n/**\n * The `api-middleware` fall-through in one call: scan `controllersDir`, build the\n * dispatcher, and serve the request. Builds a body-ful Web `Request` (`@Body`\n * needs the body; the raw stream is undrained at a route miss) and enforces CSRF\n * with the SAME gate file routes use (parity). Returns `true` when a controller\n * handled it (or CSRF blocked it), `false` when there are no controllers OR none\n * matched (the host continues to its own 404). Built per-miss so controller edits\n * reflect via HMR.\n */\nexport async function dispatchControllerRequest(args: {\n  controllersDir: string\n  loadModule: ControllerModuleLoader\n  req: IncomingMessage\n  res: ServerResponse\n  csrfMode: 'off' | 'warn' | 'strict'\n  disallowed?: DisallowedConfig\n  requestId: string\n  /** M47 — serves `@Expose`-bound agent routes (mountAgent-backed); omit for routes-only apps. */\n  serveAgent?: ServeAgent\n}): Promise<boolean> {\n  const { req, res, csrfMode, disallowed, requestId } = args\n  const dispatcher = await createControllerDispatcher({\n    controllersDir: args.controllersDir,\n    loadModule: args.loadModule,\n    serveAgent: args.serveAgent,\n  })\n  if (!dispatcher) return false\n\n  const method = (req.method ?? 'GET').toUpperCase()\n  const webRequest = incomingMessageToWebRequest(req)\n  const pathname = new URL(webRequest.url).pathname\n\n  // CSRF parity: enforce ONLY when a protected-method controller route actually\n  // owns this path (probe with the non-executing matcher — never double-dispatch,\n  // which would run the handler + its side effects). An unrouted path falls\n  // through to the host's own 404, not a 403.\n  if (CSRF_PROTECTED_METHODS.has(method) && dispatcher.matches(method, pathname)) {\n    const decision = enforceCsrf(\n      req,\n      csrfMode,\n      { warn: dispatchCsrfWarn, path: req.url },\n      disallowed,\n    )\n    if (!decision.allow) {\n      sendError(\n        res,\n        'CSRF_INVALID',\n        decision.reason ?? 'CSRF check failed',\n        403,\n        undefined,\n        requestId,\n      )\n      return true\n    }\n  }\n\n  const response = await dispatcher.dispatch(webRequest)\n  if (response === null) return false\n  await writeControllerResponse(res, response)\n  return true\n}\n","/**\n * T1.4 — Server-side batch handler.\n *\n * Receives `{ requests: [...] }` POSTed to `/api/__theo_batch__` and returns\n * `{ results: [...] }` with per-item error isolation. EC-2: items cannot\n * override auth/forwarded headers (would be a session-bypass vector).\n */\n\nimport { z } from 'zod'\n\nexport const STRIPPED_HEADERS = [\n  'authorization',\n  'cookie',\n  'x-forwarded-for',\n  'x-forwarded-host',\n  'x-forwarded-proto',\n  'x-real-ip',\n  'host',\n] as const\n\nexport const BATCH_PATH = '/api/__theo_batch__'\nconst DEFAULT_MAX_BATCH = 32\n\nexport class BatchPathConflictError extends Error {\n  constructor(path: string) {\n    super(\n      `Server route conflicts with reserved batch path ${path}. ` +\n        `Rename the route or disable batching in theo.config.ts.`,\n    )\n    this.name = 'BatchPathConflictError'\n  }\n}\n\nconst batchRequestSchema = z.object({\n  path: z.string().min(1),\n  method: z.string().min(1),\n  query: z.record(z.string(), z.unknown()).optional(),\n  body: z.unknown().optional(),\n  headers: z.record(z.string(), z.string()).optional(),\n})\n\nconst batchPayloadSchema = z.object({\n  requests: z.array(batchRequestSchema).min(1),\n})\n\nexport type BatchRequestItem = z.infer<typeof batchRequestSchema>\nexport type BatchPayload = z.infer<typeof batchPayloadSchema>\n\nexport type BatchExecuteFn = (\n  req: BatchRequestItem,\n) => Promise<{ data: unknown } | { error: { message: string; code?: string } }>\n\nexport interface HandleBatchOptions {\n  execute: BatchExecuteFn\n  /** Max number of items per batch. Default 32. */\n  max?: number\n  /** Outer-request headers that override per-item headers in STRIPPED_HEADERS. */\n  outerHeaders?: Record<string, string>\n}\n\nexport type BatchResultItem = { data: unknown } | { error: { message: string; code?: string } }\n\nexport interface BatchResponse {\n  results: BatchResultItem[]\n}\n\n/**\n * Sanitize a per-item header object: keys in STRIPPED_HEADERS are removed,\n * then the outer request's values for those keys are layered on top so that\n * downstream middlewares see the real session/auth headers.\n */\nfunction sanitizeItemHeaders(\n  itemHeaders: Record<string, string> | undefined,\n  outerHeaders: Record<string, string> | undefined,\n): Record<string, string> {\n  const out: Record<string, string> = {}\n  if (itemHeaders) {\n    for (const [k, v] of Object.entries(itemHeaders)) {\n      const lower = k.toLowerCase()\n      if (!(STRIPPED_HEADERS as readonly string[]).includes(lower)) {\n        out[lower] = v\n      }\n    }\n  }\n  if (outerHeaders) {\n    for (const stripped of STRIPPED_HEADERS) {\n      // `Object.hasOwn` defends against missing keys without triggering\n      // `no-unnecessary-condition` (TypeScript types `outerHeaders` keys\n      // as defined; `hasOwn` keeps the conditional honest at runtime).\n      if (Object.hasOwn(outerHeaders, stripped)) {\n        out[stripped] = outerHeaders[stripped]\n      }\n    }\n  }\n  return out\n}\n\n/**\n * Validate + execute a batch request.\n *\n * CR-028 fix: previously the signature was `payload: BatchPayload`,\n * suggesting the caller had already validated. In reality `api-middleware`\n * passes `JSON.parse(rawBody) as BatchPayload` — an unsafe cast over raw\n * HTTP input. We widen the input type to `unknown` so the type system\n * forces validation, then run Zod once at this single trust boundary.\n */\nexport async function handleBatchRequest(\n  payload: unknown,\n  options: HandleBatchOptions,\n): Promise<BatchResponse> {\n  const parsed = batchPayloadSchema.parse(payload)\n  const max = options.max ?? DEFAULT_MAX_BATCH\n  if (parsed.requests.length > max) {\n    throw new Error(`Batch size ${parsed.requests.length} exceeds max ${max}`)\n  }\n\n  const results: BatchResultItem[] = []\n  for (const item of parsed.requests) {\n    const sanitized: BatchRequestItem = {\n      ...item,\n      headers: sanitizeItemHeaders(item.headers, options.outerHeaders),\n    }\n    try {\n      const r = await options.execute(sanitized)\n      results.push(r)\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err)\n      results.push({ error: { message } })\n    }\n  }\n  return { results }\n}\n","import type { IncomingMessage, ServerResponse } from 'node:http'\n\n/**\n * T1.2 — CORS middleware.\n *\n * Single global middleware that runs FIRST in the request pipeline:\n *   CORS preflight → rate limit → CSRF → security headers → handler\n *\n * Preflight (`OPTIONS` with `Access-Control-Request-Method`) is handled\n * by `handlePreflight`, which short-circuits the response with 204 +\n * Access-Control-* headers.\n *\n * Non-preflight requests pass through; `applyHeaders` adds\n * `Access-Control-Allow-Origin` (echoing the request's Origin),\n * `Access-Control-Expose-Headers`, and `Access-Control-Allow-Credentials`.\n *\n * Per ADR D3: preflight responses are deterministic and only the matched\n * origin is echoed back (never `'*'` when credentials are enabled —\n * required by the CORS spec).\n */\n\n// `'*'` is conceptually distinct from a regular host string (it means\n// \"any origin\"), but TypeScript-wise it is just `string`, so we collapse\n// the union and document the wildcard via the type's name. Callers should\n// still pass the literal `'*'` to mean \"allow anywhere\" for readability.\nexport type CorsOrigin =\n  | string\n  | RegExp\n  | readonly (string | RegExp)[]\n  | ((origin: string) => boolean)\n\nexport interface CorsConfig {\n  origins: CorsOrigin\n  methods?: readonly ('GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS' | 'HEAD')[]\n  allowedHeaders?: readonly string[]\n  exposedHeaders?: readonly string[]\n  credentials?: boolean\n  maxAge?: number\n}\n\nexport interface CorsHandler {\n  handlePreflight(req: IncomingMessage, res: ServerResponse): boolean\n  applyHeaders(req: IncomingMessage, res: ServerResponse): void\n}\n\nconst DEFAULT_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'HEAD'] as const\nconst DEFAULT_ALLOWED_HEADERS = ['Content-Type', 'X-Theo-Action', 'Authorization'] as const\nconst DEFAULT_MAX_AGE = 600\n\n/**\n * Read the request Origin header. Per Node typing, it can be a string,\n * string[] (proxy doubled), or undefined. We take the FIRST non-empty\n * value (consistent with `csrf.ts:121-122`).\n */\nfunction readOrigin(req: IncomingMessage): string | undefined {\n  const raw = req.headers.origin\n  if (raw === undefined) return undefined\n  if (Array.isArray(raw)) {\n    return raw.find((v): v is string => typeof v === 'string' && v.length > 0)\n  }\n  return raw\n}\n\n/**\n * Test whether `origin` is allowed by `allowed`. Pure function — no I/O.\n *\n * EC-8: callback variants that throw are fail-closed (deny). Without\n * this, a transient datastore outage would silently widen CORS during\n * the failure window.\n */\nexport function matchesOrigin(origin: string, allowed: CorsOrigin): boolean {\n  if (allowed === '*') return true\n  if (typeof allowed === 'string') return origin === allowed\n  if (allowed instanceof RegExp) {\n    allowed.lastIndex = 0\n    return allowed.test(origin)\n  }\n  if (Array.isArray(allowed)) {\n    for (const entry of allowed) {\n      if (typeof entry === 'string' && origin === entry) return true\n      if (entry instanceof RegExp) {\n        entry.lastIndex = 0\n        if (entry.test(origin)) return true\n      }\n    }\n    return false\n  }\n  if (typeof allowed === 'function') {\n    // EC-8: fail-closed on any throw\n    try {\n      return allowed(origin)\n    } catch {\n      return false\n    }\n  }\n  return false\n}\n\nexport function createCorsHandler(config: CorsConfig): CorsHandler {\n  const methods = (config.methods ?? DEFAULT_METHODS).slice()\n  const allowedHeaders = (config.allowedHeaders ?? DEFAULT_ALLOWED_HEADERS).slice()\n  const maxAge = String(config.maxAge ?? DEFAULT_MAX_AGE)\n  const credentials = config.credentials === true\n\n  return {\n    handlePreflight(req, res) {\n      if (req.method !== 'OPTIONS') return false\n      const acMethod = req.headers['access-control-request-method']\n      if (!acMethod) return false\n      const origin = readOrigin(req)\n      if (!origin) return false\n\n      if (!matchesOrigin(origin, config.origins)) {\n        res.statusCode = 403\n        res.end()\n        return true\n      }\n\n      // Echo the matched origin (NEVER '*' when credentials are enabled —\n      // browsers reject wildcard responses with credentials per CORS spec).\n      res.setHeader('Access-Control-Allow-Origin', origin)\n      res.setHeader('Access-Control-Allow-Methods', methods.join(', '))\n      res.setHeader('Access-Control-Allow-Headers', allowedHeaders.join(', '))\n      res.setHeader('Access-Control-Max-Age', maxAge)\n      // Mark the response as origin-varying so caches don't poison\n      res.setHeader('Vary', 'Origin')\n      if (credentials) res.setHeader('Access-Control-Allow-Credentials', 'true')\n      res.statusCode = 204\n      res.end()\n      return true\n    },\n\n    applyHeaders(req, res) {\n      const origin = readOrigin(req)\n      if (!origin) return\n      if (!matchesOrigin(origin, config.origins)) return\n\n      res.setHeader('Access-Control-Allow-Origin', origin)\n      res.setHeader('Vary', 'Origin')\n      if (credentials) res.setHeader('Access-Control-Allow-Credentials', 'true')\n      if (config.exposedHeaders && config.exposedHeaders.length > 0) {\n        res.setHeader('Access-Control-Expose-Headers', config.exposedHeaders.join(', '))\n      }\n    },\n  }\n}\n\n/**\n * T5a.2 Phase B slice 5/6 — Web-Standards CORS handler.\n *\n * Mirror of `createCorsHandler(config): CorsHandler` for the Web `Request`\n * shape. Same `CorsConfig`, same `matchesOrigin` logic (pure helper\n * already), same security guarantees (echo matched origin only — never\n * `'*'` when credentials enabled; EC-8 fail-closed on callback throw).\n *\n * Signature differences vs the IncomingMessage pair:\n *   - `handlePreflightRequest(request, config): Response | null` — returns\n *     `Response` when this is a CORS preflight; `null` when not. Caller\n *     short-circuits accordingly (same control-flow semantic as boolean).\n *   - `applyCorsHeaders(request, target, config): void` — mutates a\n *     `Headers` instance in place. Caller passes the headers they're\n *     building for their Response.\n */\nexport interface CorsWebHandler {\n  handlePreflightRequest(request: Request): Response | null\n  applyCorsHeaders(request: Request, target: Headers): void\n}\n\nexport function createCorsWebHandler(config: CorsConfig): CorsWebHandler {\n  const methods = (config.methods ?? DEFAULT_METHODS).slice()\n  const allowedHeaders = (config.allowedHeaders ?? DEFAULT_ALLOWED_HEADERS).slice()\n  const maxAge = String(config.maxAge ?? DEFAULT_MAX_AGE)\n  const credentials = config.credentials === true\n\n  return {\n    handlePreflightRequest(request) {\n      if (request.method !== 'OPTIONS') return null\n      const acMethod = request.headers.get('access-control-request-method')\n      if (acMethod === null || acMethod.length === 0) return null\n      const origin = request.headers.get('origin')\n      if (origin === null || origin.length === 0) return null\n\n      if (!matchesOrigin(origin, config.origins)) {\n        return new Response(null, { status: 403 })\n      }\n\n      // Echo matched origin only (security: never `'*'` when credentials\n      // enabled — browsers reject per CORS spec).\n      const headers = new Headers({\n        'Access-Control-Allow-Origin': origin,\n        'Access-Control-Allow-Methods': methods.join(', '),\n        'Access-Control-Allow-Headers': allowedHeaders.join(', '),\n        'Access-Control-Max-Age': maxAge,\n        Vary: 'Origin',\n      })\n      if (credentials) headers.set('Access-Control-Allow-Credentials', 'true')\n      return new Response(null, { status: 204, headers })\n    },\n\n    applyCorsHeaders(request, target) {\n      const origin = request.headers.get('origin')\n      if (origin === null || origin.length === 0) return\n      if (!matchesOrigin(origin, config.origins)) return\n\n      target.set('Access-Control-Allow-Origin', origin)\n      target.set('Vary', 'Origin')\n      if (credentials) target.set('Access-Control-Allow-Credentials', 'true')\n      if (config.exposedHeaders !== undefined && config.exposedHeaders.length > 0) {\n        target.set('Access-Control-Expose-Headers', config.exposedHeaders.join(', '))\n      }\n    },\n  }\n}\n","// T5a.1b — Web Crypto migration. randomUUID() moved to globalThis.crypto.\n// IncomingMessage stays as a type-only import (runtime-clean — TS erases at\n// build); full IncomingMessage→Request boundary migration deferred to a\n// later T5a.1c+ slice per ADR-0028 incremental leaf-first sequence.\nimport type { IncomingMessage } from 'node:http'\n\n/**\n * Phase 7 — Observability: traceId propagation (D7).\n *\n * Extract a stable identifier from incoming requests so a single value\n * correlates the client request, every server log line, the response\n * envelope, and any downstream span. Precedence:\n *\n *   1. `traceparent` (W3C Trace Context — `00-{32-hex}-{16-hex}-{flags}`)\n *   2. `x-request-id` (Heroku / GCP / generic proxy header)\n *   3. Generated UUID (fresh per request)\n *\n * UUIDs are accepted as trace identifiers by every major vendor that\n * does not enforce strict 32-hex (Datadog, Honeycomb, Sentry, Logflare,\n * Axiom, etc). We don't need ULIDs to ship this surface.\n */\n\nexport const TRACE_HEADER = 'x-trace-id'\nexport const TRACE_PARENT_HEADER = 'traceparent'\nconst REQUEST_ID_HEADER = 'x-request-id'\n\n// W3C Trace Context: 00-<trace-id 32 hex>-<span-id 16 hex>-<flags 2 hex>\nconst TRACEPARENT_RE = /^00-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}$/\n\n/**\n * Parse a W3C Trace Context `traceparent` header value. Returns the\n * 32-hex trace-id when valid (and not the reserved all-zeros), else\n * `null`.\n */\nexport function parseTraceparent(value: string): string | null {\n  if (!value) return null\n  const m = TRACEPARENT_RE.exec(value)\n  if (!m) return null\n  const traceId = m[1]\n  // W3C: trace-id of all zeroes is invalid by spec\n  if (/^0+$/.test(traceId)) return null\n  return traceId\n}\n\n/**\n * Pick the first string value out of an IncomingMessage header. Node\n * collapses repeated headers into arrays; proxies sometimes do this for\n * `x-request-id`. Empty strings count as absent.\n */\nfunction pickHeader(value: string | string[] | undefined): string | null {\n  if (Array.isArray(value)) {\n    for (const v of value) {\n      if (typeof v === 'string' && v.length > 0) return v\n    }\n    return null\n  }\n  if (typeof value === 'string' && value.length > 0) return value\n  return null\n}\n\n/**\n * T5a.2 Phase C slice 1/2 — pure traceId resolution from pre-extracted\n * header values. Shared between IncomingMessage and Web Request wrappers.\n */\nfunction resolveTraceIdFromHeaders(traceparent: string | null, requestId: string | null): string {\n  if (traceparent !== null) {\n    const parsed = parseTraceparent(traceparent)\n    if (parsed !== null) return parsed\n  }\n  if (requestId !== null) return requestId\n  return globalThis.crypto.randomUUID()\n}\n\n/**\n * Resolve the request's traceId following the precedence above.\n */\nexport function extractTraceId(req: IncomingMessage): string {\n  return resolveTraceIdFromHeaders(\n    pickHeader(req.headers[TRACE_PARENT_HEADER]),\n    pickHeader(req.headers[REQUEST_ID_HEADER]),\n  )\n}\n\n/**\n * T5a.2 Phase C slice 1/2 — Web-Standards-shaped traceId resolver.\n *\n * Mirror of `extractTraceId(req: IncomingMessage)` for the Web `Request`\n * shape. Same precedence (`traceparent` → `x-request-id` → generated\n * UUID). Uses `request.headers.get(name)` (native Web `Headers` API)\n * instead of the Node indexer.\n *\n * **Multi-value note:** Web `Headers` collapses repeated headers into a\n * single comma-separated string at parse. The IncomingMessage path's\n * `pickHeader` \"first non-empty value\" semantic is naturally satisfied\n * because there's no array to pick from on the Web side — `.get()`\n * returns the comma-joined value, which for `traceparent` / `x-request-id`\n * is treated as a single string anyway (both headers are conventionally\n * single-valued).\n */\nexport function extractTraceIdFromRequest(request: Request): string {\n  return resolveTraceIdFromHeaders(\n    request.headers.get(TRACE_PARENT_HEADER),\n    request.headers.get(REQUEST_ID_HEADER),\n  )\n}\n","import type { IncomingMessage, ServerResponse } from 'node:http'\n\nimport { safeAudit, type AuditLogger } from '../observability/audit-log.js'\n\n/**\n * T5.1 — Built-in CSP report endpoint.\n *\n * Browsers POST violation reports to `report-uri` (legacy `application/csp-report`)\n * or `Reporting API` (`application/reports+json`). Framework auto-registers this\n * endpoint so `cspMode: 'report-only'` is actually useful out of the box.\n *\n * Forwards normalized violations to:\n *   - audit logger (`csp.violation`)\n *   - devtools dispatcher (dev only, for Errors tab)\n *   - optional user hook (Sentry, etc.)\n *\n * EC-2: browser MAY send `{\"csp-report\": null}`, empty `{}`, or\n * reports+json entries lacking `body`. Handler MUST short-circuit to\n * 204 (valid format, no violation), NEVER crash via null deref.\n */\n\nexport const CSP_REPORT_PATH = '/__theo/csp-report'\n\n/** Max body bytes accepted. Real CSP reports are < 2 KB; 16 KB is generous. */\nconst MAX_BODY = 16 * 1024\n\nexport interface CspViolation {\n  blockedUrl: string\n  documentUrl: string\n  violatedDirective: string\n  effectiveDirective?: string\n  originalPolicy?: string\n  disposition?: 'enforce' | 'report'\n  statusCode?: number\n  sourceFile?: string\n  lineNumber?: number\n  columnNumber?: number\n}\n\nexport interface CspReportHandlerOptions {\n  auditLogger?: AuditLogger\n  devtoolsDispatcher?: {\n    onCspViolation?: (v: CspViolation) => void\n  }\n  /** Optional user-provided sink (Sentry, custom log router). Errors here are swallowed. */\n  onViolation?: (v: CspViolation) => void\n}\n\n/**\n * Map a legacy `application/csp-report` payload to the internal shape.\n * Caller must ensure `raw` is a non-null object.\n */\nfunction pickHeader(value: string | string[] | undefined): string {\n  if (typeof value === 'string') return value\n  if (Array.isArray(value) && value.length > 0) return value[0]\n  return ''\n}\n\nfunction toStringSafe(value: unknown, fallback = '(missing)'): string {\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  return fallback\n}\n\nexport function normalizeLegacy(raw: Record<string, unknown>): CspViolation {\n  return {\n    blockedUrl: toStringSafe(raw['blocked-uri']),\n    documentUrl: toStringSafe(raw['document-uri']),\n    violatedDirective: toStringSafe(raw['violated-directive']),\n    effectiveDirective:\n      typeof raw['effective-directive'] === 'string' ? raw['effective-directive'] : undefined,\n    originalPolicy: typeof raw['original-policy'] === 'string' ? raw['original-policy'] : undefined,\n    disposition:\n      raw.disposition === 'enforce' || raw.disposition === 'report' ? raw.disposition : undefined,\n    statusCode: typeof raw['status-code'] === 'number' ? raw['status-code'] : undefined,\n    sourceFile: typeof raw['source-file'] === 'string' ? raw['source-file'] : undefined,\n    lineNumber: typeof raw['line-number'] === 'number' ? raw['line-number'] : undefined,\n    columnNumber: typeof raw['column-number'] === 'number' ? raw['column-number'] : undefined,\n  }\n}\n\n/**\n * Map a `reports+json` entry to the internal shape. Returns `null` if\n * the entry lacks a usable `body` object (EC-2).\n */\nexport function normalizeNew(entry: unknown): CspViolation | null {\n  if (!entry || typeof entry !== 'object') return null\n  const body = (entry as { body?: unknown }).body\n  if (!body || typeof body !== 'object') return null\n  const b = body as Record<string, unknown>\n  return {\n    blockedUrl: toStringSafe(b.blockedURL),\n    documentUrl: toStringSafe(b.documentURL),\n    violatedDirective: toStringSafe(b.violatedDirective),\n    effectiveDirective: typeof b.effectiveDirective === 'string' ? b.effectiveDirective : undefined,\n    originalPolicy: typeof b.originalPolicy === 'string' ? b.originalPolicy : undefined,\n    disposition:\n      b.disposition === 'enforce' || b.disposition === 'report' ? b.disposition : undefined,\n    statusCode: typeof b.statusCode === 'number' ? b.statusCode : undefined,\n    sourceFile: typeof b.sourceFile === 'string' ? b.sourceFile : undefined,\n    lineNumber: typeof b.lineNumber === 'number' ? b.lineNumber : undefined,\n    columnNumber: typeof b.columnNumber === 'number' ? b.columnNumber : undefined,\n  }\n}\n\nasync function readBody(req: IncomingMessage, maxBytes: number): Promise<string> {\n  return await new Promise<string>((resolve, reject) => {\n    const chunks: Buffer[] = []\n    let total = 0\n    req.on('data', (chunk: Buffer) => {\n      total += chunk.length\n      if (total > maxBytes) {\n        reject(new Error('body too large'))\n        req.destroy()\n        return\n      }\n      chunks.push(chunk)\n    })\n    req.on('end', () => {\n      resolve(Buffer.concat(chunks).toString('utf8'))\n    })\n    req.on('error', reject)\n  })\n}\n\nexport async function handleCspReport(\n  req: IncomingMessage,\n  res: ServerResponse,\n  opts: CspReportHandlerOptions,\n): Promise<void> {\n  const ctHeader = req.headers['content-type']\n  const ct = pickHeader(ctHeader)\n\n  let raw: string\n  try {\n    raw = await readBody(req, MAX_BODY)\n  } catch {\n    res.statusCode = 413\n    res.end()\n    return\n  }\n\n  let violations: CspViolation[]\n  try {\n    if (ct.startsWith('application/csp-report')) {\n      // EC-2: browsers MAY POST {\"csp-report\": null} or {} on\n      // disposition='report' policies. Guard against null/undefined/non-object.\n      const parsed = JSON.parse(raw) as Record<string, unknown>\n      const inner = parsed['csp-report']\n      if (!inner || typeof inner !== 'object') {\n        res.statusCode = 204\n        res.end()\n        return\n      }\n      violations = [normalizeLegacy(inner as Record<string, unknown>)]\n    } else if (ct.startsWith('application/reports+json')) {\n      // EC-2: filter out entries lacking `body` BEFORE normalizing.\n      const parsed: unknown = JSON.parse(raw)\n      const entries = Array.isArray(parsed) ? parsed : []\n      violations = entries.map((e) => normalizeNew(e)).filter((v): v is CspViolation => v !== null)\n    } else {\n      res.statusCode = 415\n      res.end()\n      return\n    }\n  } catch {\n    res.statusCode = 400\n    res.end()\n    return\n  }\n\n  for (const v of violations) {\n    safeAudit(opts.auditLogger, {\n      action: 'csp.violation',\n      metadata: v as unknown as Record<string, unknown>,\n    })\n    try {\n      opts.devtoolsDispatcher?.onCspViolation?.(v)\n    } catch {\n      // dispatcher errors are isolated from the request\n    }\n    try {\n      opts.onViolation?.(v)\n    } catch {\n      // user hook throws are swallowed — never crash the request\n    }\n  }\n\n  res.statusCode = 204\n  res.end()\n}\n\n/**\n * T5a.2 Phase B slice 4/6 — Web-Standards CSP report handler.\n *\n * Mirror of `handleCspReport(req: IncomingMessage, res: ServerResponse,\n * opts): Promise<void>` for the Web `Request` shape. Returns\n * `Response` directly instead of mutating `res`.\n *\n * Same content-type dispatch (legacy `application/csp-report` vs new\n * `application/reports+json`), same normalizers (`normalizeLegacy`,\n * `normalizeNew`), same side-effect loop (safeAudit + devtools + user\n * hook). The body cap is enforced post-read because Web Request body\n * streaming doesn't have a portable mid-stream rejection primitive\n * across CF Workers / Bun / Deno; CSP reports are < 2 KB typical, well\n * under MAX_BODY (16 KB).\n *\n * Returns:\n *   - 204 on accepted reports OR no-op empty payload\n *   - 413 on body too large (post-read check)\n *   - 415 on unsupported content-type\n *   - 400 on malformed JSON\n */\nasync function readBodyFromRequest(request: Request, maxBytes: number): Promise<string | null> {\n  const contentLengthHeader = request.headers.get('content-length')\n  if (contentLengthHeader !== null) {\n    const declared = Number.parseInt(contentLengthHeader, 10)\n    if (Number.isFinite(declared) && declared > maxBytes) return null\n  }\n  const text = await request.text()\n  if (text.length > maxBytes) return null\n  return text\n}\n\nfunction dispatchViolations(violations: CspViolation[], opts: CspReportHandlerOptions): void {\n  for (const v of violations) {\n    safeAudit(opts.auditLogger, {\n      action: 'csp.violation',\n      metadata: v as unknown as Record<string, unknown>,\n    })\n    try {\n      opts.devtoolsDispatcher?.onCspViolation?.(v)\n    } catch {\n      // dispatcher errors are isolated from the request\n    }\n    try {\n      opts.onViolation?.(v)\n    } catch {\n      // user hook throws are swallowed — never crash the request\n    }\n  }\n}\n\nexport async function handleCspReportRequest(\n  request: Request,\n  opts: CspReportHandlerOptions,\n): Promise<Response> {\n  const ct = request.headers.get('content-type') ?? ''\n\n  const raw = await readBodyFromRequest(request, MAX_BODY)\n  if (raw === null) {\n    return new Response(null, { status: 413 })\n  }\n\n  let violations: CspViolation[]\n  try {\n    if (ct.startsWith('application/csp-report')) {\n      const parsed = JSON.parse(raw) as Record<string, unknown>\n      const inner = parsed['csp-report']\n      if (!inner || typeof inner !== 'object') {\n        return new Response(null, { status: 204 })\n      }\n      violations = [normalizeLegacy(inner as Record<string, unknown>)]\n    } else if (ct.startsWith('application/reports+json')) {\n      const parsed: unknown = JSON.parse(raw)\n      const entries = Array.isArray(parsed) ? parsed : []\n      violations = entries.map((e) => normalizeNew(e)).filter((v): v is CspViolation => v !== null)\n    } else {\n      return new Response(null, { status: 415 })\n    }\n  } catch {\n    return new Response(null, { status: 400 })\n  }\n\n  dispatchViolations(violations, opts)\n  return new Response(null, { status: 204 })\n}\n","/**\n * T2.2 — `/__theo/csrf-readiness` endpoint.\n *\n *   GET  /__theo/csrf-readiness        → 200 + JSON summary\n *   POST /__theo/csrf-readiness/reset  → 204; clears the store\n *\n * The reset endpoint enforces CSRF (own dog food) — requires\n * `X-Theo-Action: 1` AND a matching Origin header (EC-15). This avoids\n * the endpoint being weaponizable from a cross-origin page when the\n * endpoint is opt-in exposed in production.\n *\n * Mount opt-in: in dev mode, the host wires this in unconditionally. In\n * production, only mount when `config.security.csrfTelemetry.exposeReadinessEndpoint === true`.\n * EC-10 parallel: returns 404 (via boolean false return) when the URL\n * does not match — the caller continues normal request handling.\n */\nimport type { IncomingMessage, ServerResponse } from 'node:http'\n\nimport type { CsrfReadinessStore } from './csrf-readiness-store.js'\n\nexport const CSRF_READINESS_PATH = '/__theo/csrf-readiness'\nexport const CSRF_READINESS_RESET_PATH = '/__theo/csrf-readiness/reset'\n\nfunction originMatchesHost(req: IncomingMessage): boolean {\n  const origin = req.headers.origin\n  if (typeof origin !== 'string') return false\n  const host = req.headers.host\n  if (typeof host !== 'string') return false\n  try {\n    const parsed = new URL(origin)\n    return parsed.host === host\n  } catch {\n    return false\n  }\n}\n\nfunction sendJson(res: ServerResponse, status: number, body: unknown): void {\n  res.writeHead(status, { 'content-type': 'application/json' })\n  res.end(JSON.stringify(body))\n}\n\nfunction sendNoContent(res: ServerResponse): void {\n  res.writeHead(204)\n  res.end()\n}\n\nfunction sendError(res: ServerResponse, status: number, code: string, message: string): void {\n  res.writeHead(status, { 'content-type': 'application/json' })\n  res.end(JSON.stringify({ error: { code, message } }))\n}\n\n// eslint-disable-next-line @typescript-eslint/require-await -- async return for future telemetry hooks\nexport async function handleCsrfReadiness(\n  req: IncomingMessage,\n  res: ServerResponse,\n  store: CsrfReadinessStore,\n): Promise<boolean> {\n  const url = (req.url ?? '').split('?')[0]\n  const method = req.method ?? 'GET'\n\n  if (url === CSRF_READINESS_PATH) {\n    if (method === 'GET') {\n      sendJson(res, 200, store.summary())\n      return true\n    }\n    sendError(res, 405, 'METHOD_NOT_ALLOWED', `Use GET on ${CSRF_READINESS_PATH}`)\n    return true\n  }\n\n  if (url === CSRF_READINESS_RESET_PATH) {\n    if (method !== 'POST') {\n      sendError(res, 405, 'METHOD_NOT_ALLOWED', `Use POST on ${CSRF_READINESS_RESET_PATH}`)\n      return true\n    }\n    // Enforce CSRF on our own endpoint (dog-food).\n    const hasHeader = req.headers['x-theo-action'] === '1'\n    if (!hasHeader || !originMatchesHost(req)) {\n      sendError(res, 403, 'CSRF_INVALID', 'Reset requires X-Theo-Action: 1 + same-origin')\n      return true\n    }\n    store.reset()\n    sendNoContent(res)\n    return true\n  }\n\n  return false\n}\n\n/**\n * T5a.2 Phase B slice 3/6 — Web-Standards-shaped CSRF readiness handler.\n *\n * Mirror of `handleCsrfReadiness(req: IncomingMessage, res: ServerResponse,\n * store): Promise<boolean>` for the Web `Request` shape. Returns\n * `Response | null` instead of mutating `res` and returning a boolean:\n *   - `Response` → this handler claimed the URL; caller short-circuits.\n *   - `null` → URL doesn't match our endpoint; caller continues normal dispatch.\n *\n * Same routes (GET `CSRF_READINESS_PATH`, POST `CSRF_READINESS_RESET_PATH`).\n * Same CSRF dog-food on reset (X-Theo-Action + same-origin).\n *\n * Wire into `executeWebRequest` integration via a future Phase B sub-slice\n * (consumer can also call this directly today via the\n * `theokit/server/security` sub-path).\n */\nfunction buildJsonResponse(status: number, body: unknown): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\nfunction buildErrorResponse(status: number, code: string, message: string): Response {\n  return buildJsonResponse(status, { error: { code, message } })\n}\n\n/**\n * Returns true when `Origin` header and request URL host match (RFC 6454\n * same-origin check). Web-Standards counterpart of `originMatchesHost`.\n */\nfunction originMatchesHostFromRequest(request: Request): boolean {\n  const origin = request.headers.get('origin')\n  if (origin === null || origin.length === 0) return false\n  const host = request.headers.get('host')\n  if (host === null || host.length === 0) {\n    // Fallback: derive host from request.url (Web Request guarantees absolute URL)\n    try {\n      const reqHost = new URL(request.url).host\n      const originHost = new URL(origin).host\n      return originHost === reqHost\n    } catch {\n      return false\n    }\n  }\n  try {\n    return new URL(origin).host === host\n  } catch {\n    return false\n  }\n}\n\n// eslint-disable-next-line @typescript-eslint/require-await -- async return for future telemetry hooks\nexport async function handleCsrfReadinessRequest(\n  request: Request,\n  store: CsrfReadinessStore,\n): Promise<Response | null> {\n  const url = new URL(request.url).pathname\n  const method = request.method.toUpperCase()\n\n  if (url === CSRF_READINESS_PATH) {\n    if (method === 'GET') {\n      return buildJsonResponse(200, store.summary())\n    }\n    return buildErrorResponse(405, 'METHOD_NOT_ALLOWED', `Use GET on ${CSRF_READINESS_PATH}`)\n  }\n\n  if (url === CSRF_READINESS_RESET_PATH) {\n    if (method !== 'POST') {\n      return buildErrorResponse(\n        405,\n        'METHOD_NOT_ALLOWED',\n        `Use POST on ${CSRF_READINESS_RESET_PATH}`,\n      )\n    }\n    // Enforce CSRF on our own endpoint (dog-food).\n    const hasHeader = request.headers.get('x-theo-action') === '1'\n    if (!hasHeader || !originMatchesHostFromRequest(request)) {\n      return buildErrorResponse(\n        403,\n        'CSRF_INVALID',\n        'Reset requires X-Theo-Action: 1 + same-origin',\n      )\n    }\n    store.reset()\n    return new Response(null, { status: 204 })\n  }\n\n  return null\n}\n","/**\n * T2.2 — In-memory bounded counter for CSRF warn events.\n *\n * Aggregates `csrf.warn` payloads by `(method, path, reason)` triple.\n * Used by the `/__theo/csrf-readiness` endpoint to expose a summary the\n * developer (or devtools tab) can inspect, so users do NOT need to grep\n * stdout to know which endpoints will break under 0.3.0 strict CSRF.\n *\n * Bounded at 1000 distinct keys (EC-22). Eviction is LRU-by-insertion —\n * when the cap is hit, the oldest key is dropped and a re-record of an\n * evicted key starts fresh (count: 1).\n *\n * Single-threaded by virtue of the JS event loop; Map operations are\n * atomic. NOT shared across processes — each worker has its own store.\n */\n\nexport interface CsrfWarnRecord {\n  method: string\n  path: string\n  reason: string\n}\n\nexport interface CsrfReadinessRouteSummary {\n  method: string\n  path: string\n  reason: string\n  count: number\n  firstSeen: string\n  lastSeen: string\n}\n\nexport interface CsrfReadinessSummary {\n  generatedAt: string\n  totalEvents: number\n  routes: CsrfReadinessRouteSummary[]\n}\n\ninterface StoredEntry {\n  count: number\n  firstSeen: string\n  lastSeen: string\n}\n\nexport class CsrfReadinessStore {\n  static readonly MAX_ENTRIES = 1000\n  private readonly entries = new Map<string, StoredEntry>()\n\n  private keyFor(event: CsrfWarnRecord): string {\n    return `${event.method}\u0000${event.path}\u0000${event.reason}`\n  }\n\n  record(event: CsrfWarnRecord): void {\n    const key = this.keyFor(event)\n    const now = new Date().toISOString()\n    const existing = this.entries.get(key)\n    if (existing) {\n      existing.count++\n      existing.lastSeen = now\n      return\n    }\n    if (this.entries.size >= CsrfReadinessStore.MAX_ENTRIES) {\n      const firstKey = this.entries.keys().next().value\n      if (firstKey !== undefined) this.entries.delete(firstKey)\n    }\n    this.entries.set(key, { count: 1, firstSeen: now, lastSeen: now })\n  }\n\n  summary(): CsrfReadinessSummary {\n    let total = 0\n    const routes: CsrfReadinessRouteSummary[] = []\n    for (const [key, entry] of this.entries) {\n      const [method, path, reason] = key.split('\u0000')\n      routes.push({\n        method,\n        path,\n        reason,\n        count: entry.count,\n        firstSeen: entry.firstSeen,\n        lastSeen: entry.lastSeen,\n      })\n      total += entry.count\n    }\n    return {\n      generatedAt: new Date().toISOString(),\n      totalEvents: total,\n      routes,\n    }\n  }\n\n  reset(): void {\n    this.entries.clear()\n  }\n}\n"],"mappings":";;;;;;;;;;;AAIA,SAAS,mBAAgC;AAEzC,SAAS,YAAY;AAErB,SAAS,wBAAwB,yBAA0C;AAyB3E,IAAM,yBAAyB,oBAAI,IAAI,CAAC,QAAQ,OAAO,SAAS,QAAQ,CAAC;AAGzE,SAAS,oBAAoB,KAAuB;AAClD,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,CAAC,YAA0B;AACtC,QAAI;AACJ,QAAI;AACF,gBAAU,YAAY,SAAS,EAAE,eAAe,KAAK,CAAC;AAAA,IACxD,QAAQ;AACN;AAAA,IACF;AACA,eAAW,SAAS,SAAS;AAC3B,YAAM,OAAO,KAAK,SAAS,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,EAAG,MAAK,IAAI;AAAA,eACzB,MAAM,KAAK,SAAS,gBAAgB,EAAG,OAAM,KAAK,IAAI;AAAA,IACjE;AAAA,EACF;AACA,OAAK,GAAG;AACR,SAAO;AACT;AAcA,eAAsB,sBACpB,gBACA,YAC6B;AAC7B,QAAM,QAAQ,oBAAoB,cAAc;AAChD,QAAM,UAA8B,CAAC;AACrC,aAAW,YAAY,OAAO;AAC5B,UAAM,MAAM,MAAM,WAAW,QAAQ;AACrC,eAAW,YAAY,OAAO,OAAO,GAAG,GAAG;AACzC,UAAI,OAAO,aAAa,cAAc,kBAAkB,QAAQ,GAAG;AACjE,gBAAQ,KAAK,EAAE,UAAU,KAAK,SAA4B,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,eAAe,gBACb,gBACA,YAC4B;AAC5B,QAAM,UAAU,MAAM,sBAAsB,gBAAgB,UAAU;AACtE,SAAO,QAAQ,IAAI,CAAC,MAAM,EAAE,GAAG;AACjC;AAUA,eAAsB,2BAA2B,MAKR;AACvC,QAAM,UAAU,MAAM,gBAAgB,KAAK,gBAAgB,KAAK,UAAU;AAC1E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,SAAS,uBAAuB,EAAE,aAAa,SAAS,YAAY,KAAK,WAAW,CAAC;AAC3F,SAAO;AAAA,IACL,UAAU,CAAC,YAAY,OAAO,OAAO;AAAA,IACrC,SAAS,CAAC,QAAQ,aAAa,OAAO,QAAQ,QAAQ,QAAQ;AAAA,EAChE;AACF;AAGA,eAAe,wBAAwB,KAAqB,UAAmC;AAC7F,QAAM,aAAqC,CAAC;AAC5C,aAAW,CAAC,GAAG,CAAC,KAAK,SAAS,SAAS;AACrC,QAAI,EAAE,YAAY,MAAM,aAAc,YAAW,CAAC,IAAI;AAAA,EACxD;AACA,QAAM,aAAa,SAAS,QAAQ,aAAa;AACjD,MAAI,WAAW,SAAS,EAAG,KAAI,UAAU,cAAc,UAAU;AACjE,MAAI,UAAU,SAAS,QAAQ,UAAU;AACzC,QAAM,OAAO,SAAS,OAAO,MAAM,SAAS,KAAK,IAAI;AACrD,MAAI,IAAI,QAAQ,MAAS;AAC3B;AAWA,eAAsB,0BAA0B,MAU3B;AACnB,QAAM,EAAE,KAAK,KAAK,UAAU,YAAY,UAAU,IAAI;AACtD,QAAM,aAAa,MAAM,2BAA2B;AAAA,IAClD,gBAAgB,KAAK;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,YAAY,KAAK;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,QAAM,aAAa,4BAA4B,GAAG;AAClD,QAAM,WAAW,IAAI,IAAI,WAAW,GAAG,EAAE;AAMzC,MAAI,uBAAuB,IAAI,MAAM,KAAK,WAAW,QAAQ,QAAQ,QAAQ,GAAG;AAC9E,UAAM,WAAW;AAAA,MACf;AAAA,MACA;AAAA,MACA,EAAE,MAAM,kBAAkB,MAAM,IAAI,IAAI;AAAA,MACxC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,OAAO;AACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA,SAAS,UAAU;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,WAAW,SAAS,UAAU;AACrD,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,wBAAwB,KAAK,QAAQ;AAC3C,SAAO;AACT;;;ACrLA,SAAS,SAAS;AAEX,IAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,aAAa;AAC1B,IAAM,oBAAoB;AAY1B,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAClD,MAAM,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC3B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AACrD,CAAC;AAED,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,UAAU,EAAE,MAAM,kBAAkB,EAAE,IAAI,CAAC;AAC7C,CAAC;AA4BD,SAAS,oBACP,aACA,cACwB;AACxB,QAAM,MAA8B,CAAC;AACrC,MAAI,aAAa;AACf,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,WAAW,GAAG;AAChD,YAAM,QAAQ,EAAE,YAAY;AAC5B,UAAI,CAAE,iBAAuC,SAAS,KAAK,GAAG;AAC5D,YAAI,KAAK,IAAI;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,MAAI,cAAc;AAChB,eAAW,YAAY,kBAAkB;AAIvC,UAAI,OAAO,OAAO,cAAc,QAAQ,GAAG;AACzC,YAAI,QAAQ,IAAI,aAAa,QAAQ;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAWA,eAAsB,mBACpB,SACA,SACwB;AACxB,QAAM,SAAS,mBAAmB,MAAM,OAAO;AAC/C,QAAM,MAAM,QAAQ,OAAO;AAC3B,MAAI,OAAO,SAAS,SAAS,KAAK;AAChC,UAAM,IAAI,MAAM,cAAc,OAAO,SAAS,MAAM,gBAAgB,GAAG,EAAE;AAAA,EAC3E;AAEA,QAAM,UAA6B,CAAC;AACpC,aAAW,QAAQ,OAAO,UAAU;AAClC,UAAM,YAA8B;AAAA,MAClC,GAAG;AAAA,MACH,SAAS,oBAAoB,KAAK,SAAS,QAAQ,YAAY;AAAA,IACjE;AACA,QAAI;AACF,YAAM,IAAI,MAAM,QAAQ,QAAQ,SAAS;AACzC,cAAQ,KAAK,CAAC;AAAA,IAChB,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,cAAQ,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAAA,IACrC;AAAA,EACF;AACA,SAAO,EAAE,QAAQ;AACnB;;;ACtFA,IAAM,kBAAkB,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,WAAW,MAAM;AACnF,IAAM,0BAA0B,CAAC,gBAAgB,iBAAiB,eAAe;AACjF,IAAM,kBAAkB;AAOxB,SAAS,WAAW,KAA0C;AAC5D,QAAM,MAAM,IAAI,QAAQ;AACxB,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,WAAO,IAAI,KAAK,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC;AAAA,EAC3E;AACA,SAAO;AACT;AASO,SAAS,cAAc,QAAgB,SAA8B;AAC1E,MAAI,YAAY,IAAK,QAAO;AAC5B,MAAI,OAAO,YAAY,SAAU,QAAO,WAAW;AACnD,MAAI,mBAAmB,QAAQ;AAC7B,YAAQ,YAAY;AACpB,WAAO,QAAQ,KAAK,MAAM;AAAA,EAC5B;AACA,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,eAAW,SAAS,SAAS;AAC3B,UAAI,OAAO,UAAU,YAAY,WAAW,MAAO,QAAO;AAC1D,UAAI,iBAAiB,QAAQ;AAC3B,cAAM,YAAY;AAClB,YAAI,MAAM,KAAK,MAAM,EAAG,QAAO;AAAA,MACjC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,YAAY;AAEjC,QAAI;AACF,aAAO,QAAQ,MAAM;AAAA,IACvB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,QAAiC;AACjE,QAAM,WAAW,OAAO,WAAW,iBAAiB,MAAM;AAC1D,QAAM,kBAAkB,OAAO,kBAAkB,yBAAyB,MAAM;AAChF,QAAM,SAAS,OAAO,OAAO,UAAU,eAAe;AACtD,QAAM,cAAc,OAAO,gBAAgB;AAE3C,SAAO;AAAA,IACL,gBAAgB,KAAK,KAAK;AACxB,UAAI,IAAI,WAAW,UAAW,QAAO;AACrC,YAAM,WAAW,IAAI,QAAQ,+BAA+B;AAC5D,UAAI,CAAC,SAAU,QAAO;AACtB,YAAM,SAAS,WAAW,GAAG;AAC7B,UAAI,CAAC,OAAQ,QAAO;AAEpB,UAAI,CAAC,cAAc,QAAQ,OAAO,OAAO,GAAG;AAC1C,YAAI,aAAa;AACjB,YAAI,IAAI;AACR,eAAO;AAAA,MACT;AAIA,UAAI,UAAU,+BAA+B,MAAM;AACnD,UAAI,UAAU,gCAAgC,QAAQ,KAAK,IAAI,CAAC;AAChE,UAAI,UAAU,gCAAgC,eAAe,KAAK,IAAI,CAAC;AACvE,UAAI,UAAU,0BAA0B,MAAM;AAE9C,UAAI,UAAU,QAAQ,QAAQ;AAC9B,UAAI,YAAa,KAAI,UAAU,oCAAoC,MAAM;AACzE,UAAI,aAAa;AACjB,UAAI,IAAI;AACR,aAAO;AAAA,IACT;AAAA,IAEA,aAAa,KAAK,KAAK;AACrB,YAAM,SAAS,WAAW,GAAG;AAC7B,UAAI,CAAC,OAAQ;AACb,UAAI,CAAC,cAAc,QAAQ,OAAO,OAAO,EAAG;AAE5C,UAAI,UAAU,+BAA+B,MAAM;AACnD,UAAI,UAAU,QAAQ,QAAQ;AAC9B,UAAI,YAAa,KAAI,UAAU,oCAAoC,MAAM;AACzE,UAAI,OAAO,kBAAkB,OAAO,eAAe,SAAS,GAAG;AAC7D,YAAI,UAAU,iCAAiC,OAAO,eAAe,KAAK,IAAI,CAAC;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACF;;;AC3HO,IAAM,eAAe;AACrB,IAAM,sBAAsB;AACnC,IAAM,oBAAoB;AAG1B,IAAM,iBAAiB;AAOhB,SAAS,iBAAiB,OAA8B;AAC7D,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,IAAI,eAAe,KAAK,KAAK;AACnC,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,UAAU,EAAE,CAAC;AAEnB,MAAI,OAAO,KAAK,OAAO,EAAG,QAAO;AACjC,SAAO;AACT;AAOA,SAAS,WAAW,OAAqD;AACvE,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,KAAK,OAAO;AACrB,UAAI,OAAO,MAAM,YAAY,EAAE,SAAS,EAAG,QAAO;AAAA,IACpD;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAC1D,SAAO;AACT;AAMA,SAAS,0BAA0B,aAA4B,WAAkC;AAC/F,MAAI,gBAAgB,MAAM;AACxB,UAAM,SAAS,iBAAiB,WAAW;AAC3C,QAAI,WAAW,KAAM,QAAO;AAAA,EAC9B;AACA,MAAI,cAAc,KAAM,QAAO;AAC/B,SAAO,WAAW,OAAO,WAAW;AACtC;AAKO,SAAS,eAAe,KAA8B;AAC3D,SAAO;AAAA,IACL,WAAW,IAAI,QAAQ,mBAAmB,CAAC;AAAA,IAC3C,WAAW,IAAI,QAAQ,iBAAiB,CAAC;AAAA,EAC3C;AACF;;;AC5DO,IAAM,kBAAkB;AAG/B,IAAM,WAAW,KAAK;AA4BtB,SAASA,YAAW,OAA8C;AAChE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,CAAC;AAC5D,SAAO;AACT;AAEA,SAAS,aAAa,OAAgB,WAAW,aAAqB;AACpE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,SAAO;AACT;AAEO,SAAS,gBAAgB,KAA4C;AAC1E,SAAO;AAAA,IACL,YAAY,aAAa,IAAI,aAAa,CAAC;AAAA,IAC3C,aAAa,aAAa,IAAI,cAAc,CAAC;AAAA,IAC7C,mBAAmB,aAAa,IAAI,oBAAoB,CAAC;AAAA,IACzD,oBACE,OAAO,IAAI,qBAAqB,MAAM,WAAW,IAAI,qBAAqB,IAAI;AAAA,IAChF,gBAAgB,OAAO,IAAI,iBAAiB,MAAM,WAAW,IAAI,iBAAiB,IAAI;AAAA,IACtF,aACE,IAAI,gBAAgB,aAAa,IAAI,gBAAgB,WAAW,IAAI,cAAc;AAAA,IACpF,YAAY,OAAO,IAAI,aAAa,MAAM,WAAW,IAAI,aAAa,IAAI;AAAA,IAC1E,YAAY,OAAO,IAAI,aAAa,MAAM,WAAW,IAAI,aAAa,IAAI;AAAA,IAC1E,YAAY,OAAO,IAAI,aAAa,MAAM,WAAW,IAAI,aAAa,IAAI;AAAA,IAC1E,cAAc,OAAO,IAAI,eAAe,MAAM,WAAW,IAAI,eAAe,IAAI;AAAA,EAClF;AACF;AAMO,SAAS,aAAa,OAAqC;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,OAAQ,MAA6B;AAC3C,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,IAAI;AACV,SAAO;AAAA,IACL,YAAY,aAAa,EAAE,UAAU;AAAA,IACrC,aAAa,aAAa,EAAE,WAAW;AAAA,IACvC,mBAAmB,aAAa,EAAE,iBAAiB;AAAA,IACnD,oBAAoB,OAAO,EAAE,uBAAuB,WAAW,EAAE,qBAAqB;AAAA,IACtF,gBAAgB,OAAO,EAAE,mBAAmB,WAAW,EAAE,iBAAiB;AAAA,IAC1E,aACE,EAAE,gBAAgB,aAAa,EAAE,gBAAgB,WAAW,EAAE,cAAc;AAAA,IAC9E,YAAY,OAAO,EAAE,eAAe,WAAW,EAAE,aAAa;AAAA,IAC9D,YAAY,OAAO,EAAE,eAAe,WAAW,EAAE,aAAa;AAAA,IAC9D,YAAY,OAAO,EAAE,eAAe,WAAW,EAAE,aAAa;AAAA,IAC9D,cAAc,OAAO,EAAE,iBAAiB,WAAW,EAAE,eAAe;AAAA,EACtE;AACF;AAEA,eAAe,SAAS,KAAsB,UAAmC;AAC/E,SAAO,MAAM,IAAI,QAAgB,CAAC,SAAS,WAAW;AACpD,UAAM,SAAmB,CAAC;AAC1B,QAAI,QAAQ;AACZ,QAAI,GAAG,QAAQ,CAAC,UAAkB;AAChC,eAAS,MAAM;AACf,UAAI,QAAQ,UAAU;AACpB,eAAO,IAAI,MAAM,gBAAgB,CAAC;AAClC,YAAI,QAAQ;AACZ;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB,CAAC;AACD,QAAI,GAAG,OAAO,MAAM;AAClB,cAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAAA,IAChD,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,eAAsB,gBACpB,KACA,KACA,MACe;AACf,QAAM,WAAW,IAAI,QAAQ,cAAc;AAC3C,QAAM,KAAKA,YAAW,QAAQ;AAE9B,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,SAAS,KAAK,QAAQ;AAAA,EACpC,QAAQ;AACN,QAAI,aAAa;AACjB,QAAI,IAAI;AACR;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,QAAI,GAAG,WAAW,wBAAwB,GAAG;AAG3C,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,YAAM,QAAQ,OAAO,YAAY;AACjC,UAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,YAAI,aAAa;AACjB,YAAI,IAAI;AACR;AAAA,MACF;AACA,mBAAa,CAAC,gBAAgB,KAAgC,CAAC;AAAA,IACjE,WAAW,GAAG,WAAW,0BAA0B,GAAG;AAEpD,YAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,YAAM,UAAU,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC;AAClD,mBAAa,QAAQ,IAAI,CAAC,MAAM,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,MAAyB,MAAM,IAAI;AAAA,IAC9F,OAAO;AACL,UAAI,aAAa;AACjB,UAAI,IAAI;AACR;AAAA,IACF;AAAA,EACF,QAAQ;AACN,QAAI,aAAa;AACjB,QAAI,IAAI;AACR;AAAA,EACF;AAEA,aAAW,KAAK,YAAY;AAC1B,cAAU,KAAK,aAAa;AAAA,MAC1B,QAAQ;AAAA,MACR,UAAU;AAAA,IACZ,CAAC;AACD,QAAI;AACF,WAAK,oBAAoB,iBAAiB,CAAC;AAAA,IAC7C,QAAQ;AAAA,IAER;AACA,QAAI;AACF,WAAK,cAAc,CAAC;AAAA,IACtB,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,aAAa;AACjB,MAAI,IAAI;AACV;;;AC1KO,IAAM,sBAAsB;AAC5B,IAAM,4BAA4B;AAEzC,SAAS,kBAAkB,KAA+B;AACxD,QAAM,SAAS,IAAI,QAAQ;AAC3B,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAM,OAAO,IAAI,QAAQ;AACzB,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,MAAM;AAC7B,WAAO,OAAO,SAAS;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,SAAS,KAAqB,QAAgB,MAAqB;AAC1E,MAAI,UAAU,QAAQ,EAAE,gBAAgB,mBAAmB,CAAC;AAC5D,MAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;AAEA,SAAS,cAAc,KAA2B;AAChD,MAAI,UAAU,GAAG;AACjB,MAAI,IAAI;AACV;AAEA,SAASC,WAAU,KAAqB,QAAgB,MAAc,SAAuB;AAC3F,MAAI,UAAU,QAAQ,EAAE,gBAAgB,mBAAmB,CAAC;AAC5D,MAAI,IAAI,KAAK,UAAU,EAAE,OAAO,EAAE,MAAM,QAAQ,EAAE,CAAC,CAAC;AACtD;AAGA,eAAsB,oBACpB,KACA,KACA,OACkB;AAClB,QAAM,OAAO,IAAI,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC;AACxC,QAAM,SAAS,IAAI,UAAU;AAE7B,MAAI,QAAQ,qBAAqB;AAC/B,QAAI,WAAW,OAAO;AACpB,eAAS,KAAK,KAAK,MAAM,QAAQ,CAAC;AAClC,aAAO;AAAA,IACT;AACA,IAAAA,WAAU,KAAK,KAAK,sBAAsB,cAAc,mBAAmB,EAAE;AAC7E,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,2BAA2B;AACrC,QAAI,WAAW,QAAQ;AACrB,MAAAA,WAAU,KAAK,KAAK,sBAAsB,eAAe,yBAAyB,EAAE;AACpF,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,IAAI,QAAQ,eAAe,MAAM;AACnD,QAAI,CAAC,aAAa,CAAC,kBAAkB,GAAG,GAAG;AACzC,MAAAA,WAAU,KAAK,KAAK,gBAAgB,+CAA+C;AACnF,aAAO;AAAA,IACT;AACA,UAAM,MAAM;AACZ,kBAAc,GAAG;AACjB,WAAO;AAAA,EACT;AAEA,SAAO;AACT;;;AC3CO,IAAM,qBAAN,MAAM,oBAAmB;AAAA,EAC9B,OAAgB,cAAc;AAAA,EACb,UAAU,oBAAI,IAAyB;AAAA,EAEhD,OAAO,OAA+B;AAC5C,WAAO,GAAG,MAAM,MAAM,KAAI,MAAM,IAAI,KAAI,MAAM,MAAM;AAAA,EACtD;AAAA,EAEA,OAAO,OAA6B;AAClC,UAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;AACrC,QAAI,UAAU;AACZ,eAAS;AACT,eAAS,WAAW;AACpB;AAAA,IACF;AACA,QAAI,KAAK,QAAQ,QAAQ,oBAAmB,aAAa;AACvD,YAAM,WAAW,KAAK,QAAQ,KAAK,EAAE,KAAK,EAAE;AAC5C,UAAI,aAAa,OAAW,MAAK,QAAQ,OAAO,QAAQ;AAAA,IAC1D;AACA,SAAK,QAAQ,IAAI,KAAK,EAAE,OAAO,GAAG,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,EACnE;AAAA,EAEA,UAAgC;AAC9B,QAAI,QAAQ;AACZ,UAAM,SAAsC,CAAC;AAC7C,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,SAAS;AACvC,YAAM,CAAC,QAAQ,MAAM,MAAM,IAAI,IAAI,MAAM,IAAG;AAC5C,aAAO,KAAK;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,MAAM;AAAA,QACb,WAAW,MAAM;AAAA,QACjB,UAAU,MAAM;AAAA,MAClB,CAAC;AACD,eAAS,MAAM;AAAA,IACjB;AACA,WAAO;AAAA,MACL,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,aAAa;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,QAAQ,MAAM;AAAA,EACrB;AACF;","names":["pickHeader","sendError"]}

package/dist/chunk-NM4WF3XD.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/realtime/channel-manager.ts"],"sourcesContent":["import type { WebSocketLike } from '../define/define-websocket.js'\n\nexport class ChannelManager {\n  private rooms = new Map<string, Set<WebSocketLike>>()\n  private wsRooms = new Map<WebSocketLike, Set<string>>()\n\n  subscribe(ws: WebSocketLike, room: string): void {\n    let roomSet = this.rooms.get(room)\n    if (!roomSet) {\n      roomSet = new Set()\n      this.rooms.set(room, roomSet)\n    }\n    roomSet.add(ws)\n\n    let wsSet = this.wsRooms.get(ws)\n    if (!wsSet) {\n      wsSet = new Set()\n      this.wsRooms.set(ws, wsSet)\n    }\n    wsSet.add(room)\n  }\n\n  unsubscribe(ws: WebSocketLike, room: string): void {\n    this.rooms.get(room)?.delete(ws)\n    if (this.rooms.get(room)?.size === 0) this.rooms.delete(room)\n\n    this.wsRooms.get(ws)?.delete(room)\n    if (this.wsRooms.get(ws)?.size === 0) this.wsRooms.delete(ws)\n  }\n\n  broadcast(room: string, data: unknown, exclude?: WebSocketLike): void {\n    const clients = this.rooms.get(room)\n    if (!clients) return\n\n    const msg = JSON.stringify(data)\n    for (const ws of clients) {\n      if (ws !== exclude) ws.send(msg)\n    }\n  }\n\n  broadcastAll(data: unknown): void {\n    const msg = JSON.stringify(data)\n    const seen = new Set<WebSocketLike>()\n    for (const clients of this.rooms.values()) {\n      for (const ws of clients) {\n        if (!seen.has(ws)) {\n          ws.send(msg)\n          seen.add(ws)\n        }\n      }\n    }\n  }\n\n  getRoomSize(room: string): number {\n    return this.rooms.get(room)?.size ?? 0\n  }\n\n  cleanup(ws: WebSocketLike): void {\n    const rooms = this.wsRooms.get(ws)\n    if (rooms) {\n      for (const room of rooms) {\n        this.rooms.get(room)?.delete(ws)\n        if (this.rooms.get(room)?.size === 0) this.rooms.delete(room)\n      }\n    }\n    this.wsRooms.delete(ws)\n  }\n}\n"],"mappings":";AAEO,IAAM,iBAAN,MAAqB;AAAA,EAClB,QAAQ,oBAAI,IAAgC;AAAA,EAC5C,UAAU,oBAAI,IAAgC;AAAA,EAEtD,UAAU,IAAmB,MAAoB;AAC/C,QAAI,UAAU,KAAK,MAAM,IAAI,IAAI;AACjC,QAAI,CAAC,SAAS;AACZ,gBAAU,oBAAI,IAAI;AAClB,WAAK,MAAM,IAAI,MAAM,OAAO;AAAA,IAC9B;AACA,YAAQ,IAAI,EAAE;AAEd,QAAI,QAAQ,KAAK,QAAQ,IAAI,EAAE;AAC/B,QAAI,CAAC,OAAO;AACV,cAAQ,oBAAI,IAAI;AAChB,WAAK,QAAQ,IAAI,IAAI,KAAK;AAAA,IAC5B;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AAAA,EAEA,YAAY,IAAmB,MAAoB;AACjD,SAAK,MAAM,IAAI,IAAI,GAAG,OAAO,EAAE;AAC/B,QAAI,KAAK,MAAM,IAAI,IAAI,GAAG,SAAS,EAAG,MAAK,MAAM,OAAO,IAAI;AAE5D,SAAK,QAAQ,IAAI,EAAE,GAAG,OAAO,IAAI;AACjC,QAAI,KAAK,QAAQ,IAAI,EAAE,GAAG,SAAS,EAAG,MAAK,QAAQ,OAAO,EAAE;AAAA,EAC9D;AAAA,EAEA,UAAU,MAAc,MAAe,SAA+B;AACpE,UAAM,UAAU,KAAK,MAAM,IAAI,IAAI;AACnC,QAAI,CAAC,QAAS;AAEd,UAAM,MAAM,KAAK,UAAU,IAAI;AAC/B,eAAW,MAAM,SAAS;AACxB,UAAI,OAAO,QAAS,IAAG,KAAK,GAAG;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,aAAa,MAAqB;AAChC,UAAM,MAAM,KAAK,UAAU,IAAI;AAC/B,UAAM,OAAO,oBAAI,IAAmB;AACpC,eAAW,WAAW,KAAK,MAAM,OAAO,GAAG;AACzC,iBAAW,MAAM,SAAS;AACxB,YAAI,CAAC,KAAK,IAAI,EAAE,GAAG;AACjB,aAAG,KAAK,GAAG;AACX,eAAK,IAAI,EAAE;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,YAAY,MAAsB;AAChC,WAAO,KAAK,MAAM,IAAI,IAAI,GAAG,QAAQ;AAAA,EACvC;AAAA,EAEA,QAAQ,IAAyB;AAC/B,UAAM,QAAQ,KAAK,QAAQ,IAAI,EAAE;AACjC,QAAI,OAAO;AACT,iBAAW,QAAQ,OAAO;AACxB,aAAK,MAAM,IAAI,IAAI,GAAG,OAAO,EAAE;AAC/B,YAAI,KAAK,MAAM,IAAI,IAAI,GAAG,SAAS,EAAG,MAAK,MAAM,OAAO,IAAI;AAAA,MAC9D;AAAA,IACF;AACA,SAAK,QAAQ,OAAO,EAAE;AAAA,EACxB;AACF;","names":[]}

package/dist/chunk-NPMCKOX4.js

@@ -1 +0,0 @@
-//# sourceMappingURL=chunk-NPMCKOX4.js.map

package/dist/chunk-NPMCKOX4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-OP7QCTR5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/cost/track-agent-run.ts","../src/server/cost/usage-storage-memory.ts","../src/server/cost/track-agent-tools.ts"],"sourcesContent":["import type { AgentRunRecord } from '../../devtools/shared.js'\n\nimport type { UsageRecord, UsageStorageAdapter } from './cost-types.js'\n\nexport interface TrackAgentRunInput {\n  userId: string\n  model: string\n  tokens: { input: number; output: number }\n  costUsd: number\n  /** Defaults to `new Date()`. */\n  timestamp?: Date\n  /** Optional execution status surfaced to devtools (default 'finished'). */\n  status?: 'finished' | 'error' | 'aborted'\n}\n\nexport interface TrackAgentRunOptions {\n  /** Adapter resolved from `theo.config.ts > cost.storage`. */\n  storage: UsageStorageAdapter | undefined\n}\n\n// v1.1 EC-4 MUST FIX — universal dev gate (Vite OR tsup-bundled).\n// Both checks are statically replaceable by bundlers in prod build,\n// so the entire dispatcher import is tree-shaken from the prod bundle.\nconst __IS_DEV = (() => {\n  try {\n    return (import.meta as { env?: { DEV?: boolean } }).env?.DEV === true\n  } catch {\n    return process.env.NODE_ENV !== 'production'\n  }\n})()\n\n/**\n * Record a single agent run's usage + cost. Companion to the client-side\n * `<CostMeter>` from `@theokit/ui`.\n *\n * EC-14: this function NEVER bubbles errors back to the caller. Adapter\n * failures (network outage, DB down, etc.) are logged via `console.warn`\n * and swallowed. The agent response MUST NOT fail because cost tracking\n * is degraded.\n *\n * No-op when `storage` is undefined (cost tracking unconfigured).\n *\n * In dev mode (Vite OR tsup-built with NODE_ENV != 'production'), fires a\n * `theokit-evolution-ci-and-dx` Phase 3 dispatcher event so the devtools\n * Agents tab can render the run. Prod tree-shakes the entire dispatcher\n * import via the `__IS_DEV` IIFE guard.\n *\n * @see docs/concepts/cost-tracking.md (when implemented in T6.3)\n */\nexport async function trackAgentRun(\n  input: TrackAgentRunInput,\n  opts: TrackAgentRunOptions,\n): Promise<void> {\n  // Dev-only: surface run to devtools Agents tab (T3.1)\n  if (__IS_DEV) {\n    try {\n      const mod = (await import('../../devtools/bridge/dispatcher.js')) as {\n        dispatcher: { onAgentRun: (r: AgentRunRecord) => void }\n      }\n      mod.dispatcher.onAgentRun({\n        // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id\n        id: `run-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`,\n        timestamp: (input.timestamp ?? new Date()).getTime(),\n        userId: input.userId,\n        model: input.model,\n        tokensInput: input.tokens.input,\n        tokensOutput: input.tokens.output,\n        costUsd: input.costUsd,\n        status: input.status ?? 'finished',\n      })\n    } catch {\n      // devtools dispatcher missing in some prod-like bundle — silently skip\n    }\n  }\n\n  if (!opts.storage) return\n  const record: UsageRecord = {\n    userId: input.userId,\n    model: input.model,\n    tokens: input.tokens,\n    costUsd: input.costUsd,\n    timestamp: input.timestamp ?? new Date(),\n  }\n  try {\n    await opts.storage.record(record)\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err)\n\n    console.warn(\n      `[theokit:cost] usage storage record failed: ${message}. ` +\n        '(Response is unaffected — cost tracking degraded.)',\n    )\n  }\n}\n","import type { StorageAdapter } from '../storage/storage-types.js'\n\nimport type {\n  ToolUsageRecord,\n  UsageQuery,\n  UsageRecord,\n  UsageResult,\n  UsageStorageAdapter,\n} from './cost-types.js'\n\n/**\n * In-memory usage storage for dev/tests. Unbounded — production\n * deployments MUST plug in a durable adapter (Postgres/Redis recipes\n * land with R0.6.7; documented in EC-114).\n *\n * Phase 5 — Production-Readiness #4: accepts both `UsageRecord` (LLM call,\n * kind='llm' or omitted) AND `ToolUsageRecord` (tool call, kind='tool').\n * `getUsage` only sums LLM records (tools have no token/cost dimension).\n *\n * EC-9 (backward compat): input without `kind` is normalized to `kind:'llm'`\n * — adapters from older versions stay working.\n *\n * Concurrency: Node's single-threaded event loop guarantees that\n * `Array.push` is atomic, so concurrent record() calls cannot lose data.\n */\nexport class InMemoryUsageStorage implements UsageStorageAdapter, StorageAdapter {\n  readonly name = 'memory'\n  readonly #records: (UsageRecord | ToolUsageRecord)[] = []\n\n  /**\n   * T2.3 — `StorageAdapter` lifecycle hook (ADR-0007 D6). In-memory storage\n   * has no real cleanup to perform — this is intentionally a noop so the\n   * adapter can be registered with `StorageManager.register()` and\n   * participate in graceful shutdown without changing behavior.\n   *\n   * Does NOT clear stored records (dispose ≠ reset). For test reset use\n   * a fresh instance.\n   */\n  dispose(): Promise<void> {\n    // Intentional noop — see jsdoc above\n    return Promise.resolve()\n  }\n\n  async record(input: UsageRecord | ToolUsageRecord): Promise<void> {\n    // EC-9: normalize legacy input (no `kind` field) to kind:'llm'.\n    const normalized: UsageRecord | ToolUsageRecord =\n      'kind' in input && input.kind === 'tool'\n        ? { ...input }\n        : ({ ...input, kind: 'llm' as const } satisfies UsageRecord)\n    this.#records.push(normalized)\n    return Promise.resolve()\n  }\n\n  async getUsage(query: UsageQuery): Promise<UsageResult> {\n    const from = query.period.from.getTime()\n    const to = query.period.to.getTime()\n    let totalTokens = 0\n    let totalCostUsd = 0\n    let runs = 0\n    for (const r of this.#records) {\n      if (r.kind === 'tool') continue\n      if (r.userId !== query.userId) continue\n      const t = r.timestamp.getTime()\n      if (t < from || t > to) continue\n      totalTokens += r.tokens.input + r.tokens.output\n      totalCostUsd += r.costUsd\n      runs += 1\n    }\n    return Promise.resolve({ totalTokens, totalCostUsd, runs })\n  }\n\n  /** @internal — test helper to inspect raw record stream */\n  __getRecords(): readonly (UsageRecord | ToolUsageRecord)[] {\n    return this.#records\n  }\n}\n","import type { ToolUsageRecord, UsageStorageAdapter } from './cost-types.js'\n\n/**\n * Phase 5 — Production-Readiness #4: tool lifecycle hooks for cost tracking.\n *\n * The SDK calls `onToolStart` → handler runs → `onToolEnd` (success) or\n * `onToolError` (throw). This factory returns the three callbacks ready to\n * attach to `Agent.create({ tools, onToolStart, onToolEnd, onToolError })`.\n *\n * Each successful tool call writes a `ToolUsageRecord{success:true}`; each\n * failure writes `ToolUsageRecord{success:false}` with `errorMessage` from\n * the thrown Error.\n *\n * Invariants:\n *   - `onToolStart` records nothing yet (no duration available). Only stashes\n *     a `startedAt` timestamp by `callId` in a per-factory Map.\n *   - `onToolEnd` reads the stashed timestamp, computes `durationMs`, writes\n *     a successful record. Removes the Map entry.\n *   - `onToolError` analog with `success:false`.\n *   - Hook throws are SWALLOWED to stderr — observation hooks must not crash\n *     the run (per the v1.1.0 release contract).\n *   - EC-8 (SHOULD TEST) — orphan starts (no matching End/Error) are pruned\n *     on every onToolStart if older than 5 minutes. Bounded memory.\n *   - EC-16 (DOCUMENT) — callId uniqueness is SDK contract; duplicate Start\n *     for the same callId uses last-write-wins.\n */\n\nconst ORPHAN_TTL_MS = 5 * 60 * 1000\n\ninterface PendingStart {\n  startedAt: number\n  userId: string\n  conversationId: string\n}\n\nexport interface TrackAgentToolsOptions {\n  storage: UsageStorageAdapter\n  /** Defaults to () => new Date() — overridable for deterministic testing. */\n  now?: () => Date\n  /** Identifier for the user — passed through to ToolUsageRecord.userId. */\n  userId?: string\n  /** Identifier for the conversation — passed through to ToolUsageRecord.conversationId. */\n  conversationId?: string\n}\n\nexport interface ToolHookEvent {\n  callId: string\n  name: string\n  // SDK shape — we only read these structurally\n  [key: string]: unknown\n}\n\nexport interface TrackAgentToolsHooks {\n  onToolStart: (event: ToolHookEvent) => void\n  onToolEnd: (event: ToolHookEvent) => void\n  onToolError: (event: ToolHookEvent) => void\n}\n\n/**\n * Create the three tool-lifecycle callbacks. Hand the returned object's\n * methods to `Agent.create({ tools, onToolStart, onToolEnd, onToolError })`.\n */\nexport function trackAgentTools(opts: TrackAgentToolsOptions): TrackAgentToolsHooks {\n  const pending = new Map<string, PendingStart>()\n  const now = opts.now ?? ((): Date => new Date())\n  const userId = opts.userId ?? 'anonymous'\n  const conversationId = opts.conversationId ?? 'unknown'\n\n  function pruneOrphans(): void {\n    const cutoff = now().getTime() - ORPHAN_TTL_MS\n    for (const [id, p] of pending) {\n      if (p.startedAt < cutoff) pending.delete(id)\n    }\n  }\n\n  function safeRecord(record: ToolUsageRecord): void {\n    Promise.resolve(opts.storage.record(record)).catch((err: unknown) => {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.warn(`[theokit:trackAgentTools] storage.record failed: ${msg}`)\n    })\n  }\n\n  return {\n    onToolStart(event: ToolHookEvent): void {\n      try {\n        pruneOrphans()\n        pending.set(event.callId, {\n          startedAt: now().getTime(),\n          userId,\n          conversationId,\n        })\n      } catch (err) {\n        console.warn(\n          `[theokit:trackAgentTools] onToolStart hook crashed (swallowed): ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        )\n      }\n    },\n    onToolEnd(event: ToolHookEvent): void {\n      try {\n        const start = pending.get(event.callId)\n        const startedAt = start?.startedAt ?? now().getTime()\n        const durationMs = start ? now().getTime() - startedAt : 0\n        pending.delete(event.callId)\n        if (!start) {\n          console.warn(\n            `[theokit:trackAgentTools] orphan onToolEnd for callId=${event.callId}; durationMs:0 recorded`,\n          )\n        }\n        safeRecord({\n          kind: 'tool',\n          userId: start?.userId ?? userId,\n          conversationId: start?.conversationId ?? conversationId,\n          toolName: event.name,\n          callId: event.callId,\n          success: true,\n          durationMs,\n          timestamp: now(),\n        })\n      } catch (err) {\n        console.warn(\n          `[theokit:trackAgentTools] onToolEnd hook crashed (swallowed): ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        )\n      }\n    },\n    onToolError(event: ToolHookEvent): void {\n      try {\n        const start = pending.get(event.callId)\n        const startedAt = start?.startedAt ?? now().getTime()\n        const durationMs = start ? now().getTime() - startedAt : 0\n        pending.delete(event.callId)\n        const error = event.error\n        let errorMessage = 'unknown error'\n        if (error instanceof Error) errorMessage = error.message\n        else if (typeof error === 'string') errorMessage = error\n        safeRecord({\n          kind: 'tool',\n          userId: start?.userId ?? userId,\n          conversationId: start?.conversationId ?? conversationId,\n          toolName: event.name,\n          callId: event.callId,\n          success: false,\n          durationMs,\n          errorMessage,\n          timestamp: now(),\n        })\n      } catch (err) {\n        console.warn(\n          `[theokit:trackAgentTools] onToolError hook crashed (swallowed): ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        )\n      }\n    },\n  }\n}\n\n/**\n * @internal — testing helper. Inspects the size of the pending-starts Map of\n * a factory instance. Not in the public API.\n */\nconst __internalsForTesting = {\n  ORPHAN_TTL_MS,\n}\n"],"mappings":";AAuBA,IAAM,YAAY,MAAM;AACtB,MAAI;AACF,WAAQ,YAA4C,KAAK,QAAQ;AAAA,EACnE,QAAQ;AACN,WAAO,QAAQ,IAAI,aAAa;AAAA,EAClC;AACF,GAAG;AAoBH,eAAsB,cACpB,OACA,MACe;AAEf,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,MAAO,MAAM,OAAO,0BAAqC;AAG/D,UAAI,WAAW,WAAW;AAAA;AAAA,QAExB,IAAI,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,QACvE,YAAY,MAAM,aAAa,oBAAI,KAAK,GAAG,QAAQ;AAAA,QACnD,QAAQ,MAAM;AAAA,QACd,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,OAAO;AAAA,QAC1B,cAAc,MAAM,OAAO;AAAA,QAC3B,SAAS,MAAM;AAAA,QACf,QAAQ,MAAM,UAAU;AAAA,MAC1B,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,QAAS;AACnB,QAAM,SAAsB;AAAA,IAC1B,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,WAAW,MAAM,aAAa,oBAAI,KAAK;AAAA,EACzC;AACA,MAAI;AACF,UAAM,KAAK,QAAQ,OAAO,MAAM;AAAA,EAClC,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAE/D,YAAQ;AAAA,MACN,+CAA+C,OAAO;AAAA,IAExD;AAAA,EACF;AACF;;;ACpEO,IAAM,uBAAN,MAA0E;AAAA,EACtE,OAAO;AAAA,EACP,WAA8C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWxD,UAAyB;AAEvB,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA,EAEA,MAAM,OAAO,OAAqD;AAEhE,UAAM,aACJ,UAAU,SAAS,MAAM,SAAS,SAC9B,EAAE,GAAG,MAAM,IACV,EAAE,GAAG,OAAO,MAAM,MAAe;AACxC,SAAK,SAAS,KAAK,UAAU;AAC7B,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA,EAEA,MAAM,SAAS,OAAyC;AACtD,UAAM,OAAO,MAAM,OAAO,KAAK,QAAQ;AACvC,UAAM,KAAK,MAAM,OAAO,GAAG,QAAQ;AACnC,QAAI,cAAc;AAClB,QAAI,eAAe;AACnB,QAAI,OAAO;AACX,eAAW,KAAK,KAAK,UAAU;AAC7B,UAAI,EAAE,SAAS,OAAQ;AACvB,UAAI,EAAE,WAAW,MAAM,OAAQ;AAC/B,YAAM,IAAI,EAAE,UAAU,QAAQ;AAC9B,UAAI,IAAI,QAAQ,IAAI,GAAI;AACxB,qBAAe,EAAE,OAAO,QAAQ,EAAE,OAAO;AACzC,sBAAgB,EAAE;AAClB,cAAQ;AAAA,IACV;AACA,WAAO,QAAQ,QAAQ,EAAE,aAAa,cAAc,KAAK,CAAC;AAAA,EAC5D;AAAA;AAAA,EAGA,eAA2D;AACzD,WAAO,KAAK;AAAA,EACd;AACF;;;AChDA,IAAM,gBAAgB,IAAI,KAAK;AAmCxB,SAAS,gBAAgB,MAAoD;AAClF,QAAM,UAAU,oBAAI,IAA0B;AAC9C,QAAM,MAAM,KAAK,QAAQ,MAAY,oBAAI,KAAK;AAC9C,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,iBAAiB,KAAK,kBAAkB;AAE9C,WAAS,eAAqB;AAC5B,UAAM,SAAS,IAAI,EAAE,QAAQ,IAAI;AACjC,eAAW,CAAC,IAAI,CAAC,KAAK,SAAS;AAC7B,UAAI,EAAE,YAAY,OAAQ,SAAQ,OAAO,EAAE;AAAA,IAC7C;AAAA,EACF;AAEA,WAAS,WAAW,QAA+B;AACjD,YAAQ,QAAQ,KAAK,QAAQ,OAAO,MAAM,CAAC,EAAE,MAAM,CAAC,QAAiB;AACnE,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,cAAQ,KAAK,oDAAoD,GAAG,EAAE;AAAA,IACxE,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,YAAY,OAA4B;AACtC,UAAI;AACF,qBAAa;AACb,gBAAQ,IAAI,MAAM,QAAQ;AAAA,UACxB,WAAW,IAAI,EAAE,QAAQ;AAAA,UACzB;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,mEACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,UAAU,OAA4B;AACpC,UAAI;AACF,cAAM,QAAQ,QAAQ,IAAI,MAAM,MAAM;AACtC,cAAM,YAAY,OAAO,aAAa,IAAI,EAAE,QAAQ;AACpD,cAAM,aAAa,QAAQ,IAAI,EAAE,QAAQ,IAAI,YAAY;AACzD,gBAAQ,OAAO,MAAM,MAAM;AAC3B,YAAI,CAAC,OAAO;AACV,kBAAQ;AAAA,YACN,yDAAyD,MAAM,MAAM;AAAA,UACvE;AAAA,QACF;AACA,mBAAW;AAAA,UACT,MAAM;AAAA,UACN,QAAQ,OAAO,UAAU;AAAA,UACzB,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,UAAU,MAAM;AAAA,UAChB,QAAQ,MAAM;AAAA,UACd,SAAS;AAAA,UACT;AAAA,UACA,WAAW,IAAI;AAAA,QACjB,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,iEACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,YAAY,OAA4B;AACtC,UAAI;AACF,cAAM,QAAQ,QAAQ,IAAI,MAAM,MAAM;AACtC,cAAM,YAAY,OAAO,aAAa,IAAI,EAAE,QAAQ;AACpD,cAAM,aAAa,QAAQ,IAAI,EAAE,QAAQ,IAAI,YAAY;AACzD,gBAAQ,OAAO,MAAM,MAAM;AAC3B,cAAM,QAAQ,MAAM;AACpB,YAAI,eAAe;AACnB,YAAI,iBAAiB,MAAO,gBAAe,MAAM;AAAA,iBACxC,OAAO,UAAU,SAAU,gBAAe;AACnD,mBAAW;AAAA,UACT,MAAM;AAAA,UACN,QAAQ,OAAO,UAAU;AAAA,UACzB,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,UAAU,MAAM;AAAA,UAChB,QAAQ,MAAM;AAAA,UACd,SAAS;AAAA,UACT;AAAA,UACA;AAAA,UACA,WAAW,IAAI;AAAA,QACjB,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,mEACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-OPLICDUB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/http/error-pages.ts","../src/server/http/static.ts"],"sourcesContent":["/**\n * T2.4 — Custom error pages loader.\n *\n * Loads optional `.theokit/client/404.html` and `500.html` from disk so adapters\n * (Node, CF, Vercel, Bun, Netlify, AWS Lambda, Deno) can pass them to the\n * shared `sendError` pipeline.\n *\n * EC-9: caps file size at 1MB. Files beyond the limit are skipped with a\n * console.warn and the default JSON error path is used.\n */\n\n/* eslint-disable security/detect-non-literal-fs-filename --\n * Loads `.theokit/client/404.html` and `500.html` from a directory `dir` that\n * is always the build output of the current project. The names are fixed\n * literals (`'404.html'` / `'500.html'`) — no HTTP input.\n */\nimport { existsSync, readFileSync, statSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nexport const MAX_ERROR_HTML_BYTES = 1_048_576 // 1MB\n\nexport interface CustomErrorPages {\n  custom404Html?: string\n  custom500Html?: string\n}\n\nfunction loadIfSafe(dir: string, name: string): string | undefined {\n  const path = resolve(dir, name)\n  if (!existsSync(path)) return undefined\n  try {\n    const stat = statSync(path)\n    if (stat.size > MAX_ERROR_HTML_BYTES) {\n      console.warn(\n        `[theokit] Custom error page ${name} is ${stat.size} bytes (max ${MAX_ERROR_HTML_BYTES}); skipping.`,\n      )\n      return undefined\n    }\n    return readFileSync(path, 'utf-8')\n  } catch (err) {\n    console.warn(`[theokit] Failed to read ${name}: ${(err as Error).message}`)\n    return undefined\n  }\n}\n\n/**\n * Load `.theokit/client/{404,500}.html` from the given client directory.\n * Returns object with both fields when present; missing pages remain undefined.\n */\nexport function loadCustomErrorPages(clientDir: string): CustomErrorPages {\n  return {\n    custom404Html: loadIfSafe(clientDir, '404.html'),\n    custom500Html: loadIfSafe(clientDir, '500.html'),\n  }\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Static-file server. The URL path IS user-controlled, BUT before any fs\n * call we resolve to absolute and reject with 403 if the resolved path\n * escapes `clientDir` (see EC-1 guard at line below). The guard is\n * authoritative; the rule cannot see it.\n */\nimport { existsSync, readFileSync, statSync } from 'node:fs'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport { resolve, extname } from 'node:path'\n\nconst MIME_TYPES: Record<string, string> = {\n  '.html': 'text/html',\n  '.js': 'application/javascript',\n  '.mjs': 'application/javascript',\n  '.css': 'text/css',\n  '.json': 'application/json',\n  '.png': 'image/png',\n  '.jpg': 'image/jpeg',\n  '.jpeg': 'image/jpeg',\n  '.gif': 'image/gif',\n  '.svg': 'image/svg+xml',\n  '.ico': 'image/x-icon',\n  '.woff': 'font/woff',\n  '.woff2': 'font/woff2',\n  '.ttf': 'font/ttf',\n  '.txt': 'text/plain',\n  '.map': 'application/json',\n}\n\nexport function serveStaticFile(\n  req: IncomingMessage,\n  res: ServerResponse,\n  clientDir: string,\n): boolean {\n  const urlPath = (req.url ?? '/').split('?')[0]\n\n  // Path traversal prevention (EC-1)\n  const filePath = resolve(clientDir, '.' + urlPath)\n  if (!filePath.startsWith(clientDir)) {\n    res.writeHead(403)\n    res.end('Forbidden')\n    return true\n  }\n\n  if (!existsSync(filePath)) return false\n\n  const stat = statSync(filePath)\n  if (!stat.isFile()) return false\n\n  const ext = extname(filePath)\n  const contentType = MIME_TYPES[ext] ?? 'application/octet-stream'\n  const content = readFileSync(filePath)\n\n  res.writeHead(200, {\n    'Content-Type': contentType,\n    'Content-Length': content.length,\n  })\n  res.end(content)\n  return true\n}\n"],"mappings":";AAgBA,SAAS,YAAY,cAAc,gBAAgB;AACnD,SAAS,eAAe;AAEjB,IAAM,uBAAuB;AAOpC,SAAS,WAAW,KAAa,MAAkC;AACjE,QAAM,OAAO,QAAQ,KAAK,IAAI;AAC9B,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,OAAO,SAAS,IAAI;AAC1B,QAAI,KAAK,OAAO,sBAAsB;AACpC,cAAQ;AAAA,QACN,+BAA+B,IAAI,OAAO,KAAK,IAAI,eAAe,oBAAoB;AAAA,MACxF;AACA,aAAO;AAAA,IACT;AACA,WAAO,aAAa,MAAM,OAAO;AAAA,EACnC,SAAS,KAAK;AACZ,YAAQ,KAAK,4BAA4B,IAAI,KAAM,IAAc,OAAO,EAAE;AAC1E,WAAO;AAAA,EACT;AACF;AAMO,SAAS,qBAAqB,WAAqC;AACxE,SAAO;AAAA,IACL,eAAe,WAAW,WAAW,UAAU;AAAA,IAC/C,eAAe,WAAW,WAAW,UAAU;AAAA,EACjD;AACF;;;AC/CA,SAAS,cAAAA,aAAY,gBAAAC,eAAc,YAAAC,iBAAgB;AAEnD,SAAS,WAAAC,UAAS,eAAe;AAEjC,IAAM,aAAqC;AAAA,EACzC,SAAS;AAAA,EACT,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,SAAS,gBACd,KACA,KACA,WACS;AACT,QAAM,WAAW,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAG7C,QAAM,WAAWA,SAAQ,WAAW,MAAM,OAAO;AACjD,MAAI,CAAC,SAAS,WAAW,SAAS,GAAG;AACnC,QAAI,UAAU,GAAG;AACjB,QAAI,IAAI,WAAW;AACnB,WAAO;AAAA,EACT;AAEA,MAAI,CAACH,YAAW,QAAQ,EAAG,QAAO;AAElC,QAAM,OAAOE,UAAS,QAAQ;AAC9B,MAAI,CAAC,KAAK,OAAO,EAAG,QAAO;AAE3B,QAAM,MAAM,QAAQ,QAAQ;AAC5B,QAAM,cAAc,WAAW,GAAG,KAAK;AACvC,QAAM,UAAUD,cAAa,QAAQ;AAErC,MAAI,UAAU,KAAK;AAAA,IACjB,gBAAgB;AAAA,IAChB,kBAAkB,QAAQ;AAAA,EAC5B,CAAC;AACD,MAAI,IAAI,OAAO;AACf,SAAO;AACT;","names":["existsSync","readFileSync","statSync","resolve"]}

package/dist/chunk-OVHW23YC.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/jobs/define-job.ts","../src/server/jobs/job-backend.ts","../src/server/jobs/job-backend-memory.ts","../src/server/jobs/job-backend-postgres.ts","../src/server/jobs/job-runner.ts","../src/server/jobs/job-manifest.ts","../src/server/jobs/job-scan.ts"],"sourcesContent":["import type { JobDefinition, JobOptions } from './job-types.js'\n\nconst NAME_RE = /^[a-z0-9][a-z0-9-]{0,63}$/\n\nfunction validateName(name: string): void {\n  if (typeof name !== 'string' || !NAME_RE.test(name)) {\n    throw new Error(\n      `defineJob: invalid name \"${name}\". ` +\n        'Must be 1-64 chars, lowercase alphanumeric + hyphen, starting with [a-z0-9].',\n    )\n  }\n}\n\n/**\n * Declare a background job. Pure identity helper — no registration side\n * effect; the build-time scanner (T2.3) discovers definitions by walking\n * `server/jobs/` and emits `.theokit/jobs.json`.\n *\n * Per ADR-0003, handler returns `void` (or `Promise<void>`); no workflow\n * API. To run another job after this one, call `ctx.queue.enqueue` from\n * the handler.\n *\n * @example\n * ```ts\n * // server/jobs/process-document.ts\n * import { defineJob } from 'theokit/server'\n * import { z } from 'zod'\n *\n * export default defineJob('process-document', {\n *   input: z.object({ documentId: z.string() }),\n *   maxAttempts: 3,\n *   async handler({ input, traceId }) {\n *     // process input.documentId\n *   },\n * })\n * ```\n */\nexport function defineJob<TInput = unknown>(\n  name: string,\n  options: JobOptions<TInput>,\n): JobDefinition<TInput> {\n  validateName(name)\n  return {\n    name,\n    maxAttempts: options.maxAttempts ?? 1,\n    hasInputSchema: options.input !== undefined,\n    handler: options.handler,\n    inputSchema: options.input,\n  }\n}\n","/**\n * Neutral `JobBackend` interface per ADR-0002.\n *\n * Implementations ship in core:\n *   - `InMemoryJobBackend` (T2.2) — dev + tests; no external deps\n *   - `PostgresJobBackend` (T3.1) — production; requires `pg` peer dep\n *\n * Community packages (`@theokit/jobs-redis`, `@theokit/jobs-sqs`, etc.)\n * implement this same interface to plug in alternate substrates without\n * modifying TheoKit core.\n */\n\nexport interface JobEnqueueInput {\n  /** The job name (matches a `defineJob` declaration). */\n  name: string\n  /** Validated input (already passed through Zod or equivalent at the queue-client layer). */\n  input: unknown\n  /** Optional idempotency key for at-most-once dispatch within TTL. */\n  idempotencyKey?: string\n  /** Optional delay before the job becomes available for dispatch. */\n  delaySeconds?: number\n  /** W3C Trace Context propagation per ADR/R0.5.9. */\n  traceparent?: string\n  /** Maximum dispatch attempts (read from JobDefinition by the queue client). */\n  maxAttempts?: number\n}\n\nexport interface JobLease {\n  readonly jobId: string\n  readonly name: string\n  readonly input: unknown\n  readonly attempts: number\n  readonly maxAttempts: number\n  readonly traceparent?: string\n  readonly lockExpiresAt: Date\n}\n\nexport interface JobBackend {\n  /** Human-readable name for logging (e.g., \"memory\", \"postgres\"). */\n  readonly name: string\n\n  /** Persist a job for later dispatch. Returns the generated jobId. */\n  enqueue(input: JobEnqueueInput): Promise<{ jobId: string }>\n\n  /** Worker loop polls for the next available leases. */\n  dequeue(opts: { batchSize?: number; lockSeconds?: number }): Promise<JobLease[]>\n\n  /** Mark a job complete (success). */\n  ack(jobId: string): Promise<void>\n\n  /** Mark a job failed; backend decides retry vs DLQ via attempts. */\n  nack(jobId: string, opts: { error: string; nonRetryable?: boolean }): Promise<void>\n\n  /** Optional: return existing jobId if `key` was enqueued within `ttlSeconds`. */\n  idempotency?(key: string, ttlSeconds: number): Promise<{ jobId: string } | null>\n}\n\n/**\n * Thrown from a job handler to opt out of retry policy. The backend MUST\n * nack with `nonRetryable: true` and permanently remove the job.\n */\nexport class NonRetryableError extends Error {\n  readonly code = 'NON_RETRYABLE'\n  constructor(message: string) {\n    super(message)\n    this.name = 'NonRetryableError'\n  }\n}\n","// T5a.1a — Web Standards migration (leaf-first slice). Web Crypto's\n// `crypto.randomUUID()` is available on globalThis in every supported\n// runtime per ADR-0028 (Node 22+, CF Workers, Bun, Deno, browsers).\n// No node:crypto import needed.\n\nimport type { JobBackend, JobEnqueueInput, JobLease } from './job-backend.js'\n\n/**\n * In-memory job backend for dev + tests + single-instance prototypes.\n *\n * Zero external dependencies. Storage is two Maps:\n *   - `pending: Map<jobId, PendingEntry>` — all enqueued jobs (locked or not)\n *   - `idempotencyMap: Map<key, { jobId; expiresAt }>` — dedup window\n *\n * Per ADR-0002: this is one of two first-party backends shipped in core.\n * Production deploys plug in PostgresJobBackend (T3.1).\n *\n * EC-104 (jobs-crons-webhooks-cost-tracking-plan): registers a\n * `process.on('beforeExit')` handler that clears pending dispatch timers\n * and logs a warning with the dropped count. Failure mode is visible,\n * not silent. `destroy()` removes the listener for test isolation.\n */\n\nexport interface InMemoryJobBackendOptions {\n  /** Maximum pending entries before oldest is dropped + warning logged. */\n  maxPending?: number\n}\n\ninterface PendingEntry {\n  jobId: string\n  name: string\n  input: unknown\n  attempts: number\n  maxAttempts: number\n  traceparent?: string\n  availableAt: number\n  lockExpiresAt: number | null\n  dispatchTimer: NodeJS.Timeout | null\n}\n\ninterface IdempotencyEntry {\n  jobId: string\n  expiresAt: number\n}\n\nconst DEFAULT_MAX_PENDING = 10_000\n\nexport class InMemoryJobBackend implements JobBackend {\n  readonly name = 'memory'\n  readonly #pending = new Map<string, PendingEntry>()\n  readonly #idempotency = new Map<string, IdempotencyEntry>()\n  readonly #maxPending: number\n  #beforeExitHandler: (() => void) | null = null\n  #destroyed = false\n\n  constructor(opts: InMemoryJobBackendOptions = {}) {\n    this.#maxPending = opts.maxPending ?? DEFAULT_MAX_PENDING\n    // EC-104 — register graceful shutdown handler. We keep a reference\n    // so `destroy()` can remove it (test isolation; avoid leaking\n    // listeners across vitest test files).\n    this.#beforeExitHandler = (): void => {\n      this.#cleanupOnShutdown()\n    }\n    process.on('beforeExit', this.#beforeExitHandler)\n  }\n\n  async enqueue(input: JobEnqueueInput): Promise<{ jobId: string }> {\n    // Overflow eviction (visible failure, not silent leak)\n    if (this.#pending.size >= this.#maxPending) {\n      const oldestKey = this.#pending.keys().next().value\n      if (oldestKey) {\n        const oldest = this.#pending.get(oldestKey)\n        if (oldest?.dispatchTimer) clearTimeout(oldest.dispatchTimer)\n        this.#pending.delete(oldestKey)\n      }\n\n      console.warn(\n        `[theokit:jobs:memory] pending overflow at ${this.#maxPending} — dropped oldest. ` +\n          'Switch to PostgresJobBackend for production.',\n      )\n    }\n\n    // Idempotency dedup\n    if (input.idempotencyKey) {\n      const existing = this.#idempotency.get(input.idempotencyKey)\n      const now = Date.now()\n      if (existing && existing.expiresAt > now) {\n        return { jobId: existing.jobId }\n      }\n    }\n\n    const jobId = globalThis.crypto.randomUUID()\n    const now = Date.now()\n    const availableAt = now + (input.delaySeconds ?? 0) * 1000\n    const entry: PendingEntry = {\n      jobId,\n      name: input.name,\n      input: input.input,\n      attempts: 0,\n      maxAttempts: input.maxAttempts ?? 1,\n      traceparent: input.traceparent,\n      availableAt,\n      lockExpiresAt: null,\n      dispatchTimer: null,\n    }\n    this.#pending.set(jobId, entry)\n\n    if (input.idempotencyKey) {\n      // Default TTL window matches typical idempotency expectations;\n      // explicit idempotency(key, ttl) check overrides per caller.\n      this.#idempotency.set(input.idempotencyKey, {\n        jobId,\n        expiresAt: now + 60_000,\n      })\n    }\n\n    return Promise.resolve({ jobId })\n  }\n\n  async dequeue(opts: { batchSize?: number; lockSeconds?: number }): Promise<JobLease[]> {\n    const batchSize = opts.batchSize ?? 1\n    const lockSeconds = opts.lockSeconds ?? 30\n    const now = Date.now()\n\n    const leases: JobLease[] = []\n    for (const entry of this.#pending.values()) {\n      if (leases.length >= batchSize) break\n      // Skip if locked + lock still valid\n      if (entry.lockExpiresAt !== null && entry.lockExpiresAt > now) continue\n      // Skip if not yet available (delay)\n      if (entry.availableAt > now) continue\n\n      entry.lockExpiresAt = now + lockSeconds * 1000\n      entry.attempts += 1\n      leases.push({\n        jobId: entry.jobId,\n        name: entry.name,\n        input: entry.input,\n        attempts: entry.attempts,\n        maxAttempts: entry.maxAttempts,\n        traceparent: entry.traceparent,\n        lockExpiresAt: new Date(entry.lockExpiresAt),\n      })\n    }\n    return Promise.resolve(leases)\n  }\n\n  async ack(jobId: string): Promise<void> {\n    const entry = this.#pending.get(jobId)\n    if (entry?.dispatchTimer) clearTimeout(entry.dispatchTimer)\n    this.#pending.delete(jobId)\n    return Promise.resolve()\n  }\n\n  async nack(jobId: string, opts: { error: string; nonRetryable?: boolean }): Promise<void> {\n    const entry = this.#pending.get(jobId)\n    if (!entry) return Promise.resolve()\n    if (opts.nonRetryable || entry.attempts >= entry.maxAttempts) {\n      if (entry.dispatchTimer) clearTimeout(entry.dispatchTimer)\n      this.#pending.delete(jobId)\n    } else {\n      // Release lock — becomes available again\n      entry.lockExpiresAt = null\n    }\n    return Promise.resolve()\n  }\n\n  idempotency(key: string, ttlSeconds: number): Promise<{ jobId: string } | null> {\n    const now = Date.now()\n    const existing = this.#idempotency.get(key)\n    if (!existing || existing.expiresAt <= now) {\n      return Promise.resolve(null)\n    }\n    // Renew if caller's ttl differs\n    existing.expiresAt = Math.max(existing.expiresAt, now + ttlSeconds * 1000)\n    return Promise.resolve({ jobId: existing.jobId })\n  }\n\n  /**\n   * Remove the beforeExit listener and clear all pending timers.\n   * Idempotent — safe to call multiple times. Use in test teardown to\n   * avoid leaking listeners across vitest test files.\n   */\n  destroy(): void {\n    if (this.#destroyed) return\n    this.#destroyed = true\n    if (this.#beforeExitHandler) {\n      process.off('beforeExit', this.#beforeExitHandler)\n      this.#beforeExitHandler = null\n    }\n    for (const entry of this.#pending.values()) {\n      if (entry.dispatchTimer) clearTimeout(entry.dispatchTimer)\n    }\n  }\n\n  /** EC-104 test hook — invokes the shutdown handler synchronously. */\n  triggerBeforeExitForTest(): void {\n    this.#cleanupOnShutdown()\n  }\n\n  #cleanupOnShutdown(): void {\n    const droppedCount = this.#pending.size\n    for (const entry of this.#pending.values()) {\n      if (entry.dispatchTimer) clearTimeout(entry.dispatchTimer)\n    }\n    if (droppedCount > 0) {\n      console.warn(\n        `[theokit:jobs:memory] ${droppedCount} jobs dropped on shutdown — ` +\n          'use PostgresJobBackend for durability across restarts.',\n      )\n    }\n  }\n}\n","import type { PostgresFactory, StorageManager } from '../storage/storage-manager.js'\nimport type { PoolLike } from '../storage/storage-types.js'\n\nimport type { JobBackend, JobEnqueueInput, JobLease } from './job-backend.js'\n\n/**\n * Postgres-backed `JobBackend` per ADR-0002 (T3.1).\n *\n * Uses the Graphile Worker pattern:\n *   - Single `theokit_jobs` table.\n *   - Dequeue via `SELECT ... FOR UPDATE SKIP LOCKED` (concurrent workers\n *     never race for the same job).\n *   - Idempotency via UNIQUE INDEX on (name, idempotency_key).\n *\n * `pg` is an OPTIONAL peer dependency — the caller provides their own\n * `pg.Pool` (or compatible). This avoids forcing every TheoKit user to\n * install Postgres tooling for in-memory dev work.\n *\n * Pool size recommendation (EC-108): set `connectionTimeoutMillis` to\n * a finite value (e.g., 5000) so a saturated pool errors instead of\n * deadlocking. Suggested pool size: `min(workerConcurrency * 1.5, 20)`.\n *\n * @see https://github.com/graphile/worker (Postgres SKIP LOCKED reference)\n * @see docs/adr/0002-job-backend-interface-neutral-contract.md\n */\n\n/**\n * `PoolLike` moved to `../storage/storage-types.ts` (T0.2 / ADR-0007 D7) to\n * deduplicate the shape across multiple adapters. Re-exported here so existing\n * `import { PoolLike } from 'theokit/server'` (which routes through the jobs\n * barrel today) continues to compile unchanged.\n */\nexport type { PoolLike } from '../storage/storage-types.js'\n\nexport interface PostgresJobBackendOptions {\n  pool: PoolLike\n  /** Table name override (default `theokit_jobs`). */\n  tableName?: string\n}\n\nconst DEFAULT_TABLE = 'theokit_jobs'\n\nexport class PostgresJobBackend implements JobBackend {\n  readonly name = 'postgres'\n  readonly #pool: PoolLike\n  readonly #table: string\n\n  constructor(opts: PostgresJobBackendOptions) {\n    // Runtime guard for users who pass `pool: undefined` despite the type;\n    // helps surface \"you forgot to install pg\" early with an actionable\n    // error rather than a cryptic TypeError later.\n    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition\n    if (!opts.pool) {\n      throw new Error(\n        'PostgresJobBackend requires a `pool` option (pg.Pool or compatible). ' +\n          'Install pg via `pnpm add pg` and pass a configured Pool instance.',\n      )\n    }\n    this.#pool = opts.pool\n    this.#table = opts.tableName ?? DEFAULT_TABLE\n  }\n\n  /**\n   * T2.1 — Construct a `PostgresJobBackend` using a pool managed by the\n   * shared `StorageManager`. The manager caches the pool per `dbName`, so\n   * repeated calls (in the same process) re-use the same connection pool.\n   *\n   * Equivalent to:\n   *   ```ts\n   *   const pool = manager.usePostgres(dbName, factory)\n   *   new PostgresJobBackend({ pool, ...options })\n   *   ```\n   *\n   * Errors thrown by the manager (unknown dbName, dangling server reference,\n   * manager already disposed) propagate to the caller with actionable text.\n   *\n   * @see ADR-0007\n   */\n  static fromStorageManager(\n    manager: StorageManager,\n    dbName: string,\n    factory: PostgresFactory,\n    options?: Omit<PostgresJobBackendOptions, 'pool'>,\n  ): PostgresJobBackend {\n    const pool = manager.usePostgres(dbName, factory)\n    return new PostgresJobBackend({ pool, ...options })\n  }\n\n  /**\n   * Create or upgrade the schema. Idempotent (uses IF NOT EXISTS).\n   * Call once at process start; safe to re-run on every deploy.\n   */\n  async migrate(): Promise<void> {\n    const t = this.#table\n    await this.#pool.query(`\n      CREATE TABLE IF NOT EXISTS ${t} (\n        id TEXT PRIMARY KEY,\n        name TEXT NOT NULL,\n        input JSONB NOT NULL,\n        attempts INT NOT NULL DEFAULT 0,\n        max_attempts INT NOT NULL DEFAULT 1,\n        available_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n        locked_until TIMESTAMPTZ,\n        traceparent TEXT,\n        idempotency_key TEXT,\n        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()\n      )\n    `)\n    await this.#pool.query(`\n      CREATE UNIQUE INDEX IF NOT EXISTS ${t}_idempotency_key_idx\n      ON ${t} (name, idempotency_key)\n      WHERE idempotency_key IS NOT NULL\n    `)\n    await this.#pool.query(`\n      CREATE INDEX IF NOT EXISTS ${t}_available_at_idx\n      ON ${t} (available_at)\n      WHERE locked_until IS NULL\n    `)\n  }\n\n  async enqueue(input: JobEnqueueInput): Promise<{ jobId: string }> {\n    const id = randomId()\n    const delaySeconds = input.delaySeconds ?? 0\n    const t = this.#table\n\n    // Idempotency: explicit SELECT-then-INSERT. The UNIQUE INDEX is the\n    // safety net under race conditions (we surface the conflict by\n    // re-selecting on insert-error). This 2-step path is pg-mem compatible\n    // AND works on real Postgres.\n    if (input.idempotencyKey) {\n      const existing = await this.#pool.query<{ id: string }>(\n        `SELECT id FROM ${t} WHERE name = $1 AND idempotency_key = $2 LIMIT 1`,\n        [input.name, input.idempotencyKey],\n      )\n      if (existing.rows.length > 0) {\n        return { jobId: existing.rows[0].id }\n      }\n    }\n\n    await this.#pool.query(\n      `INSERT INTO ${t} (id, name, input, max_attempts, available_at, traceparent, idempotency_key)\n       VALUES ($1, $2, $3::jsonb, $4, NOW() + ($5 || ' seconds')::interval, $6, $7)`,\n      [\n        id,\n        input.name,\n        JSON.stringify(input.input),\n        input.maxAttempts ?? 1,\n        delaySeconds.toString(),\n        input.traceparent ?? null,\n        input.idempotencyKey ?? null,\n      ],\n    )\n    return { jobId: id }\n  }\n\n  async dequeue(opts: { batchSize?: number; lockSeconds?: number }): Promise<JobLease[]> {\n    const t = this.#table\n    const batchSize = opts.batchSize ?? 1\n    const lockSeconds = opts.lockSeconds ?? 30\n\n    // Two-step pattern (pg-mem compatible AND real-Postgres compatible):\n    // 1. SELECT FOR UPDATE SKIP LOCKED to claim candidate IDs.\n    // 2. UPDATE in-place to mark lock_until + bump attempts.\n    // On real Postgres, the FOR UPDATE SKIP LOCKED prevents concurrent\n    // workers from seeing the same rows. On pg-mem the lock is silently\n    // ignored, but pg-mem serializes all queries through one in-memory\n    // db so the test still verifies single-claim semantics.\n    const candidates = await this.#pool.query<{ id: string }>(\n      `SELECT id FROM ${t}\n       WHERE (locked_until IS NULL OR locked_until < NOW())\n         AND available_at <= NOW()\n       ORDER BY available_at ASC\n       LIMIT $1\n       FOR UPDATE SKIP LOCKED`,\n      [batchSize],\n    )\n\n    if (candidates.rows.length === 0) return []\n\n    const ids = candidates.rows.map((r) => r.id)\n    // Build a parameterized IN clause: ($2, $3, ...). pg-mem's UPDATE\n    // does not support `ANY($1::text[])`, so we materialize the list.\n    // For batch sizes we expect (typically ≤100), this is fine.\n    const placeholders = ids.map((_, i) => `$${i + 2}`).join(', ')\n\n    const r = await this.#pool.query<{\n      id: string\n      name: string\n      input: unknown\n      attempts: number\n      max_attempts: number\n      traceparent: string | null\n      locked_until: Date | string\n    }>(\n      `UPDATE ${t}\n       SET locked_until = NOW() + ($1 || ' seconds')::interval,\n           attempts = attempts + 1\n       WHERE id IN (${placeholders})\n       RETURNING id, name, input, attempts, max_attempts, traceparent, locked_until`,\n      [lockSeconds.toString(), ...ids],\n    )\n\n    return r.rows.map((row) => ({\n      jobId: row.id,\n      name: row.name,\n      input: row.input,\n      attempts: row.attempts,\n      maxAttempts: row.max_attempts,\n      traceparent: row.traceparent ?? undefined,\n      lockExpiresAt:\n        row.locked_until instanceof Date ? row.locked_until : new Date(row.locked_until),\n    }))\n  }\n\n  async ack(jobId: string): Promise<void> {\n    await this.#pool.query(`DELETE FROM ${this.#table} WHERE id = $1`, [jobId])\n  }\n\n  async nack(jobId: string, opts: { error: string; nonRetryable?: boolean }): Promise<void> {\n    const t = this.#table\n    if (opts.nonRetryable) {\n      await this.#pool.query(`DELETE FROM ${t} WHERE id = $1`, [jobId])\n      return\n    }\n    // Check attempts >= maxAttempts → permanent removal.\n    const r = await this.#pool.query<{\n      attempts: number\n      max_attempts: number\n    }>(`SELECT attempts, max_attempts FROM ${t} WHERE id = $1`, [jobId])\n    if (r.rows.length === 0) return\n    const { attempts, max_attempts } = r.rows[0]\n    if (attempts >= max_attempts) {\n      await this.#pool.query(`DELETE FROM ${t} WHERE id = $1`, [jobId])\n    } else {\n      // Release lock — next dequeue picks it up again.\n      await this.#pool.query(`UPDATE ${t} SET locked_until = NULL WHERE id = $1`, [jobId])\n    }\n  }\n\n  async idempotency(key: string, _ttlSeconds: number): Promise<{ jobId: string } | null> {\n    // The UNIQUE INDEX is the source of truth. Look for any non-deleted\n    // row with this idempotency_key.\n    const r = await this.#pool.query<{ id: string }>(\n      `SELECT id FROM ${this.#table} WHERE idempotency_key = $1 LIMIT 1`,\n      [key],\n    )\n    return r.rows.length > 0 ? { jobId: r.rows[0].id } : null\n  }\n}\n\nfunction randomId(): string {\n  // Use crypto.randomUUID if available; this is process-local, not DB-generated.\n  // The DB UNIQUE constraint is on (name, idempotency_key), not on id, so\n  // collisions across processes are functionally impossible.\n  return globalThis.crypto.randomUUID()\n}\n","import {\n  extractTraceContext,\n  generateNewTraceContext,\n} from '../observability/trace-context-propagation.js'\n\nimport { type JobBackend, type JobLease, NonRetryableError } from './job-backend.js'\nimport type { JobContext, JobDefinition } from './job-types.js'\n\n/**\n * Job runner — pulls leases from a backend and invokes the matching\n * handler. Each invocation wires up `JobContext` with:\n *   - `traceId` extracted from the lease's `traceparent` header (W3C\n *     Trace Context per R0.5.9), OR a fresh generated trace_id when\n *     the upstream had no traceparent OR it was malformed.\n *   - `attempt` from the lease.\n *   - `signal` that aborts when the lease times out.\n *\n * `tick()` runs one dequeue+dispatch cycle and returns when all leases\n * have been ack'd or nack'd. Production deploys call `tick()` in a loop\n * with backoff (the loop is outside this module's scope).\n *\n * EC-6 (trace continuity edge): when a lease has no traceparent OR a\n * malformed one, the handler still gets a valid traceId (generated) —\n * never null/undefined. The job MAY itself enqueue child jobs that\n * continue the new trace_id.\n */\n\nexport interface JobRunner {\n  /** Run one dequeue+dispatch cycle. */\n  tick(opts?: { batchSize?: number; lockSeconds?: number }): Promise<number>\n}\n\nexport function createJobRunner(\n  backend: JobBackend,\n  definitions: readonly JobDefinition[],\n): JobRunner {\n  const byName = new Map<string, JobDefinition>()\n  for (const def of definitions) {\n    byName.set(def.name, def)\n  }\n\n  const runOne = async (lease: JobLease): Promise<void> => {\n    const def = byName.get(lease.name)\n    if (!def) {\n      // Job name not registered in this runner's definition set. Nack\n      // permanently — the lease can't be processed by this runner.\n      await backend.nack(lease.jobId, {\n        error: `No job definition for \"${lease.name}\"`,\n        nonRetryable: true,\n      })\n      return\n    }\n\n    // Resolve trace ID from lease's traceparent, or fall back to fresh.\n    let traceId: string\n    if (lease.traceparent) {\n      const headers = new Headers({ traceparent: lease.traceparent })\n      const ctx = extractTraceContext(headers)\n      traceId = ctx?.trace_id ?? generateNewTraceContext().trace_id\n    } else {\n      traceId = generateNewTraceContext().trace_id\n    }\n\n    // Optional Zod validation on input.\n    let parsedInput: unknown = lease.input\n    if (def.inputSchema) {\n      try {\n        parsedInput = def.inputSchema.parse(lease.input)\n      } catch (err) {\n        await backend.nack(lease.jobId, {\n          error: `Input validation failed: ${err instanceof Error ? err.message : String(err)}`,\n          nonRetryable: true,\n        })\n        return\n      }\n    }\n\n    const abortController = new AbortController()\n    // Auto-abort when lease expires\n    const lockMs = lease.lockExpiresAt.getTime() - Date.now()\n    const lockTimer = setTimeout(\n      () => {\n        abortController.abort()\n      },\n      Math.max(0, lockMs),\n    )\n\n    const jobCtx: JobContext = {\n      traceId,\n      input: parsedInput,\n      signal: abortController.signal,\n      attempt: lease.attempts,\n    }\n\n    try {\n      await def.handler(jobCtx)\n      await backend.ack(lease.jobId)\n    } catch (err) {\n      const isNonRetryable = err instanceof NonRetryableError\n      await backend.nack(lease.jobId, {\n        error: err instanceof Error ? err.message : String(err),\n        nonRetryable: isNonRetryable,\n      })\n    } finally {\n      clearTimeout(lockTimer)\n    }\n  }\n\n  return {\n    async tick(opts) {\n      const leases = await backend.dequeue({\n        batchSize: opts?.batchSize ?? 10,\n        lockSeconds: opts?.lockSeconds ?? 30,\n      })\n      // Process leases sequentially — caller controls concurrency via\n      // batchSize and tick frequency.\n      for (const lease of leases) {\n        await runOne(lease)\n      }\n      return leases.length\n    },\n  }\n}\n","import { writeAtomic } from '../_internal/atomic-write.js'\n\nimport type { JobNode } from './job-scan.js'\n\nexport const JOB_MANIFEST_SCHEMA_VERSION = 1 as const\n\nexport interface JobManifestEntry {\n  readonly name: string\n  readonly filePath: string\n  readonly maxAttempts: number\n  readonly hasInputSchema: boolean\n}\n\nexport interface JobManifest {\n  readonly schemaVersion: typeof JOB_MANIFEST_SCHEMA_VERSION\n  readonly generatedAt: string\n  readonly jobs: readonly JobManifestEntry[]\n}\n\nexport function buildJobManifest(nodes: readonly JobNode[], projectRoot?: string): JobManifest {\n  const jobs: JobManifestEntry[] = nodes.map((n) => ({\n    name: n.name,\n    filePath: projectRoot ? relativize(n.filePath, projectRoot) : n.filePath,\n    maxAttempts: n.maxAttempts,\n    hasInputSchema: n.hasInputSchema,\n  }))\n  return {\n    schemaVersion: JOB_MANIFEST_SCHEMA_VERSION,\n    generatedAt: new Date().toISOString(),\n    jobs,\n  }\n}\n\nexport function writeJobManifest(\n  path: string,\n  input: readonly JobNode[] | JobManifest,\n  projectRoot?: string,\n): void {\n  const manifest: JobManifest = isManifest(input) ? input : buildJobManifest(input, projectRoot)\n  writeAtomic(path, JSON.stringify(manifest, null, 2))\n}\n\nfunction isManifest(value: unknown): value is JobManifest {\n  return typeof value === 'object' && value !== null && 'schemaVersion' in value && 'jobs' in value\n}\n\nfunction relativize(absPath: string, root: string): string {\n  if (absPath.startsWith(root)) {\n    const trimmed = absPath.slice(root.length)\n    return trimmed.startsWith('/') ? trimmed.slice(1) : trimmed\n  }\n  return absPath\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: caller-controlled directory paths only.\n */\nimport { existsSync } from 'node:fs'\nimport { basename } from 'node:path'\n\nimport { importUserModule } from '../../config/import-user-module.js'\nimport { walkSourceFiles } from '../_internal/scan-walker.js'\n\nimport type { JobDefinition } from './job-types.js'\n\nexport interface JobNode {\n  readonly name: string\n  readonly filePath: string\n  readonly maxAttempts: number\n  readonly hasInputSchema: boolean\n}\n\nexport class DuplicateJobNameError extends Error {\n  readonly code = 'DUPLICATE_JOB_NAME'\n  constructor(\n    public readonly jobName: string,\n    public readonly filePaths: readonly string[],\n  ) {\n    super(\n      `Duplicate job name \"${jobName}\" defined in: ${filePaths.join(', ')}. ` +\n        'Job names must be unique across server/jobs/.',\n    )\n    this.name = 'DuplicateJobNameError'\n  }\n}\n\nconst JOB_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.mjs'])\n\ninterface JobModule {\n  default?: unknown\n}\n\nfunction isJobDefinition(value: unknown): value is JobDefinition {\n  if (typeof value !== 'object' || value === null) return false\n  const def = value as Record<string, unknown>\n  return (\n    typeof def.name === 'string' &&\n    typeof def.handler === 'function' &&\n    typeof def.maxAttempts === 'number' &&\n    typeof def.hasInputSchema === 'boolean'\n  )\n}\n\nexport async function scanJobs(jobsDir: string): Promise<JobNode[]> {\n  if (!existsSync(jobsDir)) return []\n\n  const filePaths: string[] = []\n  walkSourceFiles(jobsDir, { extensions: JOB_EXTENSIONS }, (p) => {\n    const base = basename(p)\n    if (base.startsWith('_') || base.startsWith('.')) return\n    filePaths.push(p)\n  })\n\n  const nodes: JobNode[] = []\n  for (const filePath of filePaths) {\n    let mod: JobModule\n    try {\n      mod = await importUserModule(filePath)\n    } catch (err) {\n      const reason = err instanceof Error ? err.message : String(err)\n      throw new Error(`Failed to import job file \"${filePath}\": ${reason}`)\n    }\n    const exported = mod.default\n    if (!isJobDefinition(exported)) {\n      throw new Error(\n        `Job file \"${filePath}\" is missing a valid default export. ` +\n          'Expected `export default defineJob(name, { handler })`.',\n      )\n    }\n    nodes.push({\n      name: exported.name,\n      filePath,\n      maxAttempts: exported.maxAttempts,\n      hasInputSchema: exported.hasInputSchema,\n    })\n  }\n\n  const byName = new Map<string, string[]>()\n  for (const node of nodes) {\n    const bucket = byName.get(node.name) ?? []\n    bucket.push(node.filePath)\n    byName.set(node.name, bucket)\n  }\n  for (const [name, paths] of byName) {\n    if (paths.length > 1) {\n      throw new DuplicateJobNameError(name, paths)\n    }\n  }\n\n  return nodes.sort((a, b) => a.name.localeCompare(b.name))\n}\n"],"mappings":";;;;;;;;;;;;;;;AAEA,IAAM,UAAU;AAEhB,SAAS,aAAa,MAAoB;AACxC,MAAI,OAAO,SAAS,YAAY,CAAC,QAAQ,KAAK,IAAI,GAAG;AACnD,UAAM,IAAI;AAAA,MACR,4BAA4B,IAAI;AAAA,IAElC;AAAA,EACF;AACF;AA0BO,SAAS,UACd,MACA,SACuB;AACvB,eAAa,IAAI;AACjB,SAAO;AAAA,IACL;AAAA,IACA,aAAa,QAAQ,eAAe;AAAA,IACpC,gBAAgB,QAAQ,UAAU;AAAA,IAClC,SAAS,QAAQ;AAAA,IACjB,aAAa,QAAQ;AAAA,EACvB;AACF;;;ACYO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC,OAAO;AAAA,EAChB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACtBA,IAAM,sBAAsB;AAErB,IAAM,qBAAN,MAA+C;AAAA,EAC3C,OAAO;AAAA,EACP,WAAW,oBAAI,IAA0B;AAAA,EACzC,eAAe,oBAAI,IAA8B;AAAA,EACjD;AAAA,EACT,qBAA0C;AAAA,EAC1C,aAAa;AAAA,EAEb,YAAY,OAAkC,CAAC,GAAG;AAChD,SAAK,cAAc,KAAK,cAAc;AAItC,SAAK,qBAAqB,MAAY;AACpC,WAAK,mBAAmB;AAAA,IAC1B;AACA,YAAQ,GAAG,cAAc,KAAK,kBAAkB;AAAA,EAClD;AAAA,EAEA,MAAM,QAAQ,OAAoD;AAEhE,QAAI,KAAK,SAAS,QAAQ,KAAK,aAAa;AAC1C,YAAM,YAAY,KAAK,SAAS,KAAK,EAAE,KAAK,EAAE;AAC9C,UAAI,WAAW;AACb,cAAM,SAAS,KAAK,SAAS,IAAI,SAAS;AAC1C,YAAI,QAAQ,cAAe,cAAa,OAAO,aAAa;AAC5D,aAAK,SAAS,OAAO,SAAS;AAAA,MAChC;AAEA,cAAQ;AAAA,QACN,6CAA6C,KAAK,WAAW;AAAA,MAE/D;AAAA,IACF;AAGA,QAAI,MAAM,gBAAgB;AACxB,YAAM,WAAW,KAAK,aAAa,IAAI,MAAM,cAAc;AAC3D,YAAMA,OAAM,KAAK,IAAI;AACrB,UAAI,YAAY,SAAS,YAAYA,MAAK;AACxC,eAAO,EAAE,OAAO,SAAS,MAAM;AAAA,MACjC;AAAA,IACF;AAEA,UAAM,QAAQ,WAAW,OAAO,WAAW;AAC3C,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,cAAc,OAAO,MAAM,gBAAgB,KAAK;AACtD,UAAM,QAAsB;AAAA,MAC1B;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,OAAO,MAAM;AAAA,MACb,UAAU;AAAA,MACV,aAAa,MAAM,eAAe;AAAA,MAClC,aAAa,MAAM;AAAA,MACnB;AAAA,MACA,eAAe;AAAA,MACf,eAAe;AAAA,IACjB;AACA,SAAK,SAAS,IAAI,OAAO,KAAK;AAE9B,QAAI,MAAM,gBAAgB;AAGxB,WAAK,aAAa,IAAI,MAAM,gBAAgB;AAAA,QAC1C;AAAA,QACA,WAAW,MAAM;AAAA,MACnB,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,EAAE,MAAM,CAAC;AAAA,EAClC;AAAA,EAEA,MAAM,QAAQ,MAAyE;AACrF,UAAM,YAAY,KAAK,aAAa;AACpC,UAAM,cAAc,KAAK,eAAe;AACxC,UAAM,MAAM,KAAK,IAAI;AAErB,UAAM,SAAqB,CAAC;AAC5B,eAAW,SAAS,KAAK,SAAS,OAAO,GAAG;AAC1C,UAAI,OAAO,UAAU,UAAW;AAEhC,UAAI,MAAM,kBAAkB,QAAQ,MAAM,gBAAgB,IAAK;AAE/D,UAAI,MAAM,cAAc,IAAK;AAE7B,YAAM,gBAAgB,MAAM,cAAc;AAC1C,YAAM,YAAY;AAClB,aAAO,KAAK;AAAA,QACV,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,QACZ,OAAO,MAAM;AAAA,QACb,UAAU,MAAM;AAAA,QAChB,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,eAAe,IAAI,KAAK,MAAM,aAAa;AAAA,MAC7C,CAAC;AAAA,IACH;AACA,WAAO,QAAQ,QAAQ,MAAM;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,OAA8B;AACtC,UAAM,QAAQ,KAAK,SAAS,IAAI,KAAK;AACrC,QAAI,OAAO,cAAe,cAAa,MAAM,aAAa;AAC1D,SAAK,SAAS,OAAO,KAAK;AAC1B,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA,EAEA,MAAM,KAAK,OAAe,MAAgE;AACxF,UAAM,QAAQ,KAAK,SAAS,IAAI,KAAK;AACrC,QAAI,CAAC,MAAO,QAAO,QAAQ,QAAQ;AACnC,QAAI,KAAK,gBAAgB,MAAM,YAAY,MAAM,aAAa;AAC5D,UAAI,MAAM,cAAe,cAAa,MAAM,aAAa;AACzD,WAAK,SAAS,OAAO,KAAK;AAAA,IAC5B,OAAO;AAEL,YAAM,gBAAgB;AAAA,IACxB;AACA,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA,EAEA,YAAY,KAAa,YAAuD;AAC9E,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,WAAW,KAAK,aAAa,IAAI,GAAG;AAC1C,QAAI,CAAC,YAAY,SAAS,aAAa,KAAK;AAC1C,aAAO,QAAQ,QAAQ,IAAI;AAAA,IAC7B;AAEA,aAAS,YAAY,KAAK,IAAI,SAAS,WAAW,MAAM,aAAa,GAAI;AACzE,WAAO,QAAQ,QAAQ,EAAE,OAAO,SAAS,MAAM,CAAC;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAAgB;AACd,QAAI,KAAK,WAAY;AACrB,SAAK,aAAa;AAClB,QAAI,KAAK,oBAAoB;AAC3B,cAAQ,IAAI,cAAc,KAAK,kBAAkB;AACjD,WAAK,qBAAqB;AAAA,IAC5B;AACA,eAAW,SAAS,KAAK,SAAS,OAAO,GAAG;AAC1C,UAAI,MAAM,cAAe,cAAa,MAAM,aAAa;AAAA,IAC3D;AAAA,EACF;AAAA;AAAA,EAGA,2BAAiC;AAC/B,SAAK,mBAAmB;AAAA,EAC1B;AAAA,EAEA,qBAA2B;AACzB,UAAM,eAAe,KAAK,SAAS;AACnC,eAAW,SAAS,KAAK,SAAS,OAAO,GAAG;AAC1C,UAAI,MAAM,cAAe,cAAa,MAAM,aAAa;AAAA,IAC3D;AACA,QAAI,eAAe,GAAG;AACpB,cAAQ;AAAA,QACN,yBAAyB,YAAY;AAAA,MAEvC;AAAA,IACF;AAAA,EACF;AACF;;;AC5KA,IAAM,gBAAgB;AAEf,IAAM,qBAAN,MAAM,oBAAyC;AAAA,EAC3C,OAAO;AAAA,EACP;AAAA,EACA;AAAA,EAET,YAAY,MAAiC;AAK3C,QAAI,CAAC,KAAK,MAAM;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,SAAK,QAAQ,KAAK;AAClB,SAAK,SAAS,KAAK,aAAa;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,OAAO,mBACL,SACA,QACA,SACA,SACoB;AACpB,UAAM,OAAO,QAAQ,YAAY,QAAQ,OAAO;AAChD,WAAO,IAAI,oBAAmB,EAAE,MAAM,GAAG,QAAQ,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAyB;AAC7B,UAAM,IAAI,KAAK;AACf,UAAM,KAAK,MAAM,MAAM;AAAA,mCACQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAY/B;AACD,UAAM,KAAK,MAAM,MAAM;AAAA,0CACe,CAAC;AAAA,WAChC,CAAC;AAAA;AAAA,KAEP;AACD,UAAM,KAAK,MAAM,MAAM;AAAA,mCACQ,CAAC;AAAA,WACzB,CAAC;AAAA;AAAA,KAEP;AAAA,EACH;AAAA,EAEA,MAAM,QAAQ,OAAoD;AAChE,UAAM,KAAK,SAAS;AACpB,UAAM,eAAe,MAAM,gBAAgB;AAC3C,UAAM,IAAI,KAAK;AAMf,QAAI,MAAM,gBAAgB;AACxB,YAAM,WAAW,MAAM,KAAK,MAAM;AAAA,QAChC,kBAAkB,CAAC;AAAA,QACnB,CAAC,MAAM,MAAM,MAAM,cAAc;AAAA,MACnC;AACA,UAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,eAAO,EAAE,OAAO,SAAS,KAAK,CAAC,EAAE,GAAG;AAAA,MACtC;AAAA,IACF;AAEA,UAAM,KAAK,MAAM;AAAA,MACf,eAAe,CAAC;AAAA;AAAA,MAEhB;AAAA,QACE;AAAA,QACA,MAAM;AAAA,QACN,KAAK,UAAU,MAAM,KAAK;AAAA,QAC1B,MAAM,eAAe;AAAA,QACrB,aAAa,SAAS;AAAA,QACtB,MAAM,eAAe;AAAA,QACrB,MAAM,kBAAkB;AAAA,MAC1B;AAAA,IACF;AACA,WAAO,EAAE,OAAO,GAAG;AAAA,EACrB;AAAA,EAEA,MAAM,QAAQ,MAAyE;AACrF,UAAM,IAAI,KAAK;AACf,UAAM,YAAY,KAAK,aAAa;AACpC,UAAM,cAAc,KAAK,eAAe;AASxC,UAAM,aAAa,MAAM,KAAK,MAAM;AAAA,MAClC,kBAAkB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMnB,CAAC,SAAS;AAAA,IACZ;AAEA,QAAI,WAAW,KAAK,WAAW,EAAG,QAAO,CAAC;AAE1C,UAAM,MAAM,WAAW,KAAK,IAAI,CAACC,OAAMA,GAAE,EAAE;AAI3C,UAAM,eAAe,IAAI,IAAI,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI;AAE7D,UAAM,IAAI,MAAM,KAAK,MAAM;AAAA,MASzB,UAAU,CAAC;AAAA;AAAA;AAAA,sBAGK,YAAY;AAAA;AAAA,MAE5B,CAAC,YAAY,SAAS,GAAG,GAAG,GAAG;AAAA,IACjC;AAEA,WAAO,EAAE,KAAK,IAAI,CAAC,SAAS;AAAA,MAC1B,OAAO,IAAI;AAAA,MACX,MAAM,IAAI;AAAA,MACV,OAAO,IAAI;AAAA,MACX,UAAU,IAAI;AAAA,MACd,aAAa,IAAI;AAAA,MACjB,aAAa,IAAI,eAAe;AAAA,MAChC,eACE,IAAI,wBAAwB,OAAO,IAAI,eAAe,IAAI,KAAK,IAAI,YAAY;AAAA,IACnF,EAAE;AAAA,EACJ;AAAA,EAEA,MAAM,IAAI,OAA8B;AACtC,UAAM,KAAK,MAAM,MAAM,eAAe,KAAK,MAAM,kBAAkB,CAAC,KAAK,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAM,KAAK,OAAe,MAAgE;AACxF,UAAM,IAAI,KAAK;AACf,QAAI,KAAK,cAAc;AACrB,YAAM,KAAK,MAAM,MAAM,eAAe,CAAC,kBAAkB,CAAC,KAAK,CAAC;AAChE;AAAA,IACF;AAEA,UAAM,IAAI,MAAM,KAAK,MAAM,MAGxB,sCAAsC,CAAC,kBAAkB,CAAC,KAAK,CAAC;AACnE,QAAI,EAAE,KAAK,WAAW,EAAG;AACzB,UAAM,EAAE,UAAU,aAAa,IAAI,EAAE,KAAK,CAAC;AAC3C,QAAI,YAAY,cAAc;AAC5B,YAAM,KAAK,MAAM,MAAM,eAAe,CAAC,kBAAkB,CAAC,KAAK,CAAC;AAAA,IAClE,OAAO;AAEL,YAAM,KAAK,MAAM,MAAM,UAAU,CAAC,0CAA0C,CAAC,KAAK,CAAC;AAAA,IACrF;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,KAAa,aAAwD;AAGrF,UAAM,IAAI,MAAM,KAAK,MAAM;AAAA,MACzB,kBAAkB,KAAK,MAAM;AAAA,MAC7B,CAAC,GAAG;AAAA,IACN;AACA,WAAO,EAAE,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI;AAAA,EACvD;AACF;AAEA,SAAS,WAAmB;AAI1B,SAAO,WAAW,OAAO,WAAW;AACtC;;;AC/NO,SAAS,gBACd,SACA,aACW;AACX,QAAM,SAAS,oBAAI,IAA2B;AAC9C,aAAW,OAAO,aAAa;AAC7B,WAAO,IAAI,IAAI,MAAM,GAAG;AAAA,EAC1B;AAEA,QAAM,SAAS,OAAO,UAAmC;AACvD,UAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,QAAI,CAAC,KAAK;AAGR,YAAM,QAAQ,KAAK,MAAM,OAAO;AAAA,QAC9B,OAAO,0BAA0B,MAAM,IAAI;AAAA,QAC3C,cAAc;AAAA,MAChB,CAAC;AACD;AAAA,IACF;AAGA,QAAI;AACJ,QAAI,MAAM,aAAa;AACrB,YAAM,UAAU,IAAI,QAAQ,EAAE,aAAa,MAAM,YAAY,CAAC;AAC9D,YAAM,MAAM,oBAAoB,OAAO;AACvC,gBAAU,KAAK,YAAY,wBAAwB,EAAE;AAAA,IACvD,OAAO;AACL,gBAAU,wBAAwB,EAAE;AAAA,IACtC;AAGA,QAAI,cAAuB,MAAM;AACjC,QAAI,IAAI,aAAa;AACnB,UAAI;AACF,sBAAc,IAAI,YAAY,MAAM,MAAM,KAAK;AAAA,MACjD,SAAS,KAAK;AACZ,cAAM,QAAQ,KAAK,MAAM,OAAO;AAAA,UAC9B,OAAO,4BAA4B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UACnF,cAAc;AAAA,QAChB,CAAC;AACD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,kBAAkB,IAAI,gBAAgB;AAE5C,UAAM,SAAS,MAAM,cAAc,QAAQ,IAAI,KAAK,IAAI;AACxD,UAAM,YAAY;AAAA,MAChB,MAAM;AACJ,wBAAgB,MAAM;AAAA,MACxB;AAAA,MACA,KAAK,IAAI,GAAG,MAAM;AAAA,IACpB;AAEA,UAAM,SAAqB;AAAA,MACzB;AAAA,MACA,OAAO;AAAA,MACP,QAAQ,gBAAgB;AAAA,MACxB,SAAS,MAAM;AAAA,IACjB;AAEA,QAAI;AACF,YAAM,IAAI,QAAQ,MAAM;AACxB,YAAM,QAAQ,IAAI,MAAM,KAAK;AAAA,IAC/B,SAAS,KAAK;AACZ,YAAM,iBAAiB,eAAe;AACtC,YAAM,QAAQ,KAAK,MAAM,OAAO;AAAA,QAC9B,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,QACtD,cAAc;AAAA,MAChB,CAAC;AAAA,IACH,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,KAAK,MAAM;AACf,YAAM,SAAS,MAAM,QAAQ,QAAQ;AAAA,QACnC,WAAW,MAAM,aAAa;AAAA,QAC9B,aAAa,MAAM,eAAe;AAAA,MACpC,CAAC;AAGD,iBAAW,SAAS,QAAQ;AAC1B,cAAM,OAAO,KAAK;AAAA,MACpB;AACA,aAAO,OAAO;AAAA,IAChB;AAAA,EACF;AACF;;;ACtHO,IAAM,8BAA8B;AAepC,SAAS,iBAAiB,OAA2B,aAAmC;AAC7F,QAAM,OAA2B,MAAM,IAAI,CAAC,OAAO;AAAA,IACjD,MAAM,EAAE;AAAA,IACR,UAAU,cAAc,WAAW,EAAE,UAAU,WAAW,IAAI,EAAE;AAAA,IAChE,aAAa,EAAE;AAAA,IACf,gBAAgB,EAAE;AAAA,EACpB,EAAE;AACF,SAAO;AAAA,IACL,eAAe;AAAA,IACf,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AAAA,EACF;AACF;AAEO,SAAS,iBACd,MACA,OACA,aACM;AACN,QAAM,WAAwB,WAAW,KAAK,IAAI,QAAQ,iBAAiB,OAAO,WAAW;AAC7F,cAAY,MAAM,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AACrD;AAEA,SAAS,WAAW,OAAsC;AACxD,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,mBAAmB,SAAS,UAAU;AAC9F;AAEA,SAAS,WAAW,SAAiB,MAAsB;AACzD,MAAI,QAAQ,WAAW,IAAI,GAAG;AAC5B,UAAM,UAAU,QAAQ,MAAM,KAAK,MAAM;AACzC,WAAO,QAAQ,WAAW,GAAG,IAAI,QAAQ,MAAM,CAAC,IAAI;AAAA,EACtD;AACA,SAAO;AACT;;;ACjDA,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB;AAclB,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAE/C,YACkB,SACA,WAChB;AACA;AAAA,MACE,uBAAuB,OAAO,iBAAiB,UAAU,KAAK,IAAI,CAAC;AAAA,IAErE;AANgB;AACA;AAMhB,SAAK,OAAO;AAAA,EACd;AAAA,EARkB;AAAA,EACA;AAAA,EAHT,OAAO;AAWlB;AAEA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAM7D,SAAS,gBAAgB,OAAwC;AAC/D,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,MAAM;AACZ,SACE,OAAO,IAAI,SAAS,YACpB,OAAO,IAAI,YAAY,cACvB,OAAO,IAAI,gBAAgB,YAC3B,OAAO,IAAI,mBAAmB;AAElC;AAEA,eAAsB,SAAS,SAAqC;AAClE,MAAI,CAAC,WAAW,OAAO,EAAG,QAAO,CAAC;AAElC,QAAM,YAAsB,CAAC;AAC7B,kBAAgB,SAAS,EAAE,YAAY,eAAe,GAAG,CAAC,MAAM;AAC9D,UAAM,OAAO,SAAS,CAAC;AACvB,QAAI,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,EAAG;AAClD,cAAU,KAAK,CAAC;AAAA,EAClB,CAAC;AAED,QAAM,QAAmB,CAAC;AAC1B,aAAW,YAAY,WAAW;AAChC,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,iBAAiB,QAAQ;AAAA,IACvC,SAAS,KAAK;AACZ,YAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC9D,YAAM,IAAI,MAAM,8BAA8B,QAAQ,MAAM,MAAM,EAAE;AAAA,IACtE;AACA,UAAM,WAAW,IAAI;AACrB,QAAI,CAAC,gBAAgB,QAAQ,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR,aAAa,QAAQ;AAAA,MAEvB;AAAA,IACF;AACA,UAAM,KAAK;AAAA,MACT,MAAM,SAAS;AAAA,MACf;AAAA,MACA,aAAa,SAAS;AAAA,MACtB,gBAAgB,SAAS;AAAA,IAC3B,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,QAAQ,OAAO;AACxB,UAAM,SAAS,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC;AACzC,WAAO,KAAK,KAAK,QAAQ;AACzB,WAAO,IAAI,KAAK,MAAM,MAAM;AAAA,EAC9B;AACA,aAAW,CAAC,MAAM,KAAK,KAAK,QAAQ;AAClC,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,IAAI,sBAAsB,MAAM,KAAK;AAAA,IAC7C;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC1D;","names":["now","r"]}

package/dist/chunk-SJIRP73B.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/auth/auth.ts","../src/server/auth/crypto.ts","../src/server/auth/session.ts","../src/server/_internal/encoding.ts","../src/server/auth/auth-totp.ts","../src/server/auth/auth-backup-codes.ts","../src/server/auth/auth-throttle.ts","../src/server/auth/oauth-pkce.ts","../src/server/auth/oauth-state.ts","../src/server/auth/oidc-discovery.ts"],"sourcesContent":["export class AuthRequiredError extends Error {\n  code = 'AUTH_REQUIRED' as const\n  status = 401\n\n  constructor(message = 'Authentication required') {\n    super(message)\n    this.name = 'AuthRequiredError'\n  }\n}\n\nexport function requireAuth<T>(session: T | null | undefined): asserts session is T {\n  if (session === null || session === undefined) {\n    throw new AuthRequiredError()\n  }\n}\n","// AES-GCM-256 token encryption with cached key derivation.\n//\n// CR-002 fixes:\n//   - KDF: HKDF (RFC 5869) over the raw secret, not raw SHA-256.\n//     HKDF binds the application context (\"theo-session-v1\") into the\n//     derived key so the same secret used elsewhere cannot decrypt these\n//     tokens. SHA-256 of the raw secret has neither domain separation nor\n//     proper key-stretching guarantees.\n//   - Cache: derived `CryptoKey` is memoized per (secret, info) tuple.\n//     Pre-fix, every encrypt/decrypt re-ran SHA-256 + importKey, which (a)\n//     burned CPU on every authenticated request and (b) made\n//     `decryptWithFallback` leak rotation-array position via timing.\n//   - Buffer typing: `Uint8Array` flows directly into Web Crypto\n//     (`BufferSource`-compatible). The previous `as unknown as ArrayBuffer`\n//     double-cast (CR-016) is removed.\n\nconst encoder = new TextEncoder()\nconst decoder = new TextDecoder()\n\nconst HKDF_INFO_DEFAULT = encoder.encode('theo-session-v1')\nconst HKDF_SALT_EMPTY = new Uint8Array(0)\n\n// Memoize derived keys. Bounded by the number of distinct secrets the app\n// ever uses (typically 1 in steady state, 2-5 during rotation). Map-based\n// so distinct secrets do not evict each other.\nconst keyCache = new Map<string, Promise<CryptoKey>>()\n\nasync function deriveKey(secret: string): Promise<CryptoKey> {\n  const cached = keyCache.get(secret)\n  if (cached) return cached\n\n  const derive = (async () => {\n    const keyMaterial = await crypto.subtle.importKey(\n      'raw',\n      encoder.encode(secret),\n      { name: 'HKDF' },\n      false,\n      ['deriveKey'],\n    )\n    return crypto.subtle.deriveKey(\n      { name: 'HKDF', hash: 'SHA-256', salt: HKDF_SALT_EMPTY, info: HKDF_INFO_DEFAULT },\n      keyMaterial,\n      { name: 'AES-GCM', length: 256 },\n      false,\n      ['encrypt', 'decrypt'],\n    )\n  })()\n\n  keyCache.set(secret, derive)\n  // If derivation fails (invalid secret), evict so a retry can try fresh.\n  derive.catch(() => {\n    keyCache.delete(secret)\n  })\n  return derive\n}\n\nfunction toBase64Url(data: Uint8Array): string {\n  return Buffer.from(data).toString('base64url')\n}\n\n/**\n * Decode a base64url string into a `Uint8Array<ArrayBuffer>`. The explicit\n * generic matters: Web Crypto APIs expect `BufferSource`, and TS 5.7+\n * tightened `Uint8Array` to `Uint8Array<ArrayBufferLike>` which includes\n * `SharedArrayBuffer`. Returning the narrower generic lets the value pass\n * `crypto.subtle.decrypt` without `as` casts (CR-016 follow-through).\n */\nfunction fromBase64Url(str: string): Uint8Array<ArrayBuffer> {\n  const buf = Buffer.from(str, 'base64url')\n  const copy = new Uint8Array(buf.length)\n  copy.set(buf)\n  return copy\n}\n\n// The `T` generic exists so call sites get type-safe round-tripping\n// (`encrypt<Session>(s, ...)` pairs with `decrypt<Session>(...)`); the\n// runtime body just stringifies `data`, hence T does not appear in the\n// signature beyond the argument.\n// eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters -- T documents the round-trip contract with decrypt<T>\nexport async function encrypt<T>(data: T, secret: string): Promise<string> {\n  const key = await deriveKey(secret)\n  const iv = crypto.getRandomValues(new Uint8Array(12))\n  const plaintext = encoder.encode(JSON.stringify(data))\n  const ciphertext = new Uint8Array(\n    await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext),\n  )\n  return `${toBase64Url(iv)}:${toBase64Url(ciphertext)}`\n}\n\nexport async function decrypt<T>(token: string, secret: string): Promise<T | null> {\n  try {\n    const parts = token.split(':')\n    if (parts.length !== 2) return null\n\n    const iv = fromBase64Url(parts[0])\n    const ciphertext = fromBase64Url(parts[1])\n    const key = await deriveKey(secret)\n\n    const plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext)\n    return JSON.parse(decoder.decode(plaintext)) as T\n  } catch {\n    return null\n  }\n}\n\n/**\n * Reset the derived-key cache. Test helper — never call from production code.\n * Used by Vitest to guarantee isolation between tests that use distinct\n * secrets and want to confirm the derivation path runs.\n */\nexport function _resetKeyCacheForTests(): void {\n  keyCache.clear()\n}\n","import type { IncomingMessage, ServerResponse } from 'node:http'\n\nimport {\n  getCookie,\n  setCookie,\n  deleteCookie,\n  getCookieFromRequest,\n  appendCookieToHeaders,\n  appendDeleteCookieToHeaders,\n} from '../http/cookies.js'\n\nimport { encrypt, decrypt } from './crypto.js'\n\nexport interface SessionConfig {\n  /**\n   * Session secret. Either a single string (legacy) or an array of strings\n   * where index 0 is the newest. The array form enables dual-key rotation\n   * (T3.1 / ADR D5): encrypt always uses `secrets[0]`, decrypt walks the\n   * array, transparent re-encrypt on legacy hits (T3.2).\n   *\n   * EC-1: array length capped at 5 — enforced via throw at construction.\n   */\n  secret: string | string[]\n  cookieName?: string\n  maxAge?: number\n}\n\ninterface SessionEnvelope<T> {\n  data: T\n  exp: number\n}\n\nexport interface SessionMeta {\n  /** Index of the secret that decrypted the session. 0 = newest; > 0 = legacy. */\n  secretIndex: number\n  /** True when the decrypt used a legacy secret and the cookie should be re-encrypted. */\n  needsReencrypt: boolean\n}\n\nexport interface SessionManager<TSession> {\n  getSession(req: IncomingMessage): Promise<TSession | null>\n  /**\n   * T3.2 — Variant of `getSession` that surfaces decrypt metadata.\n   * Used by `api-middleware.ts` to wire transparent re-encrypt BEFORE\n   * the handler runs (so streaming SSR routes don't miss the Set-Cookie\n   * window — EC-4).\n   */\n  getSessionWithMeta(req: IncomingMessage): Promise<{ data: TSession | null; meta: SessionMeta }>\n  createSession(res: ServerResponse, data: TSession): Promise<void>\n  destroySession(res: ServerResponse): void\n  /**\n   * T3.3 — OWASP A07:2021 session fixation mitigation. Re-encrypts the\n   * current session with a fresh IV and refreshed expiry. No-op when no\n   * session is present.\n   */\n  rotateSession(req: IncomingMessage, res: ServerResponse): Promise<TSession | null>\n}\n\n/**\n * EC-1 — array length cap. Enforced via throw at construction. Silent\n * truncation would create false sense of rotation; silent acceptance\n * would create unbounded CPU on legacy decrypt walks.\n */\nconst MAX_SECRETS = 5\n\n/**\n * Validate + normalize the secret config into a non-empty array of\n * strings ≥ 32 chars each.\n */\nfunction normalizeSecrets(input: string | string[]): string[] {\n  const arr = Array.isArray(input) ? input.slice() : [input]\n  if (arr.length === 0) {\n    throw new Error('Session secret must be non-empty (received an empty array)')\n  }\n  if (arr.length > MAX_SECRETS) {\n    throw new Error(\n      `Session secret array exceeds maximum of ${MAX_SECRETS} entries — drop the oldest before adding a new one (received ${arr.length})`,\n    )\n  }\n  const wasArray = Array.isArray(input)\n  for (let i = 0; i < arr.length; i++) {\n    const s = arr[i]\n    if (typeof s !== 'string' || s.length < 32) {\n      const where = wasArray ? ` at index ${i}` : ''\n      throw new Error(`Session secret${where} must be at least 32 characters for secure encryption`)\n    }\n  }\n  return arr\n}\n\n/**\n * T5a.2 Phase D slice 3/3 — module-level pure helpers extracted so\n * `createSessionManager` (IncomingMessage path) and\n * `createSessionManagerWeb` (Web path) share the same encryption +\n * dual-key rotation logic without code duplication (sonarjs\n * no-identical-functions). Both wrappers pass `secrets` + `maxAge`\n * captured from their respective factory scope.\n */\nasync function encryptSessionEnvelope(\n  data: unknown,\n  secrets: string[],\n  maxAge: number,\n): Promise<string> {\n  const envelope: SessionEnvelope<unknown> = {\n    data,\n    exp: Date.now() + maxAge * 1000,\n  }\n  return encrypt(envelope, secrets[0]) // newest\n}\n\n/**\n * CR-002 constant-time: try EVERY rotation entry in parallel, then pick\n * the newest match. Sequential early-exit leaked rotation position via\n * timing (success on entry 0 returned in ~3 ms; success on entry 4 in\n * ~15 ms). Running in parallel binds wall-clock to the slowest single\n * attempt, independent of which entry actually matched. With derived-key\n * cache (CR-002 in crypto.ts), the CPU multiplier per request is ~0\n * after the first request per secret.\n */\nasync function decryptSessionWithFallback<TSession>(\n  raw: string,\n  secrets: string[],\n): Promise<{ envelope: SessionEnvelope<TSession>; index: number } | null> {\n  const results = await Promise.all(\n    secrets.map(async (secret, i) => {\n      const env = await decrypt<SessionEnvelope<TSession>>(raw, secret)\n      return env ? { envelope: env, index: i } : null\n    }),\n  )\n  for (const result of results) {\n    if (result) return result\n  }\n  return null\n}\n\nexport function createSessionManager<TSession>(config: SessionConfig): SessionManager<TSession> {\n  const secrets = normalizeSecrets(config.secret)\n  const cookieName = config.cookieName ?? 'theo_session'\n  const maxAge = config.maxAge ?? 604800 // 7 days\n\n  function writeCookie(res: ServerResponse, token: string): void {\n    setCookie(res, cookieName, token, {\n      httpOnly: true,\n      sameSite: 'lax',\n      maxAge,\n      path: '/',\n    })\n  }\n\n  return {\n    async getSession(req) {\n      const { data } = await this.getSessionWithMeta(req)\n      return data\n    },\n\n    async getSessionWithMeta(req) {\n      const raw = getCookie(req, cookieName)\n      if (!raw) return { data: null, meta: { secretIndex: -1, needsReencrypt: false } }\n      const decoded = await decryptSessionWithFallback<TSession>(raw, secrets)\n      if (!decoded) return { data: null, meta: { secretIndex: -1, needsReencrypt: false } }\n      if (decoded.envelope.exp < Date.now()) {\n        return { data: null, meta: { secretIndex: decoded.index, needsReencrypt: false } }\n      }\n      return {\n        data: decoded.envelope.data,\n        meta: { secretIndex: decoded.index, needsReencrypt: decoded.index > 0 },\n      }\n    },\n\n    async createSession(res, data) {\n      const token = await encryptSessionEnvelope(data, secrets, maxAge)\n      writeCookie(res, token)\n    },\n\n    destroySession(res) {\n      deleteCookie(res, cookieName)\n    },\n\n    async rotateSession(req, res) {\n      const { data } = await this.getSessionWithMeta(req)\n      if (data === null) return null\n      // Fresh IV per encrypt call (Web Crypto guarantee — see crypto.ts)\n      // + refreshed expiry. Last write wins for the cookie value.\n      const token = await encryptSessionEnvelope(data, secrets, maxAge)\n      writeCookie(res, token)\n      return data\n    },\n  }\n}\n\n/**\n * T5a.2 Phase D slice 3/3 — Web-Standards session manager.\n *\n * Mirror of `SessionManager<TSession>` for the Web `Request` + `Headers`\n * shape. Same `SessionConfig`, same encryption (`encrypt`/`decrypt` from\n * `./crypto.js`), same dual-key rotation logic (CR-002 constant-time\n * decrypt fallback walk + transparent re-encrypt), same OWASP A07\n * `rotateSession` invariant.\n *\n * **Signature differences vs `SessionManager`:**\n *   - Read methods take `Request` (instead of `IncomingMessage`).\n *   - Write methods take a `Headers` instance to mutate (instead of\n *     `ServerResponse`) — caller passes the headers they're building\n *     for their `Response` constructor.\n *\n * Uses `getCookieFromRequest` / `appendCookieToHeaders` /\n * `appendDeleteCookieToHeaders` from Phase B slice 6/6.\n */\nexport interface SessionManagerWeb<TSession> {\n  getSession(request: Request): Promise<TSession | null>\n  getSessionWithMeta(request: Request): Promise<{ data: TSession | null; meta: SessionMeta }>\n  createSession(target: Headers, data: TSession): Promise<void>\n  destroySession(target: Headers): void\n  rotateSession(request: Request, target: Headers): Promise<TSession | null>\n}\n\nexport function createSessionManagerWeb<TSession>(\n  config: SessionConfig,\n): SessionManagerWeb<TSession> {\n  const secrets = normalizeSecrets(config.secret)\n  const cookieName = config.cookieName ?? 'theo_session'\n  const maxAge = config.maxAge ?? 604800 // 7 days\n\n  function writeCookieWeb(target: Headers, token: string): void {\n    appendCookieToHeaders(target, cookieName, token, {\n      httpOnly: true,\n      sameSite: 'lax',\n      maxAge,\n      path: '/',\n    })\n  }\n\n  return {\n    async getSession(request) {\n      const { data } = await this.getSessionWithMeta(request)\n      return data\n    },\n\n    async getSessionWithMeta(request) {\n      const raw = getCookieFromRequest(request, cookieName)\n      if (raw === undefined) return { data: null, meta: { secretIndex: -1, needsReencrypt: false } }\n      const decoded = await decryptSessionWithFallback<TSession>(raw, secrets)\n      if (!decoded) return { data: null, meta: { secretIndex: -1, needsReencrypt: false } }\n      if (decoded.envelope.exp < Date.now()) {\n        return { data: null, meta: { secretIndex: decoded.index, needsReencrypt: false } }\n      }\n      return {\n        data: decoded.envelope.data,\n        meta: { secretIndex: decoded.index, needsReencrypt: decoded.index > 0 },\n      }\n    },\n\n    async createSession(target, data) {\n      const token = await encryptSessionEnvelope(data, secrets, maxAge)\n      writeCookieWeb(target, token)\n    },\n\n    destroySession(target) {\n      appendDeleteCookieToHeaders(target, cookieName)\n    },\n\n    async rotateSession(request, target) {\n      const { data } = await this.getSessionWithMeta(request)\n      if (data === null) return null\n      const token = await encryptSessionEnvelope(data, secrets, maxAge)\n      writeCookieWeb(target, token)\n      return data\n    },\n  }\n}\n\n/**\n * T5a.2 Phase D slice 3/3 — Web-Standards transparent re-encrypt helper.\n *\n * Mirror of `rotateIfNeeded(sm, req, res)` for the Web Request + Headers\n * shape. Reads session via `getSessionWithMeta`; if the cookie was\n * decrypted with a legacy secret (index > 0), re-issues the cookie with\n * the newest secret via `createSession(target, data)`.\n *\n * **EC-4 honest framing:** unlike the IncomingMessage path where the\n * timing constraint is \"before `res.writeHead` fires\", the Web Request\n * path's constraint is \"before the `Response` object is constructed and\n * returned to the runtime\". Caller MUST invoke `rotateIfNeededWeb`\n * BEFORE building the final `Response(body, { headers: target })` so the\n * re-encrypted Set-Cookie lands on the wire.\n */\nexport async function rotateIfNeededWeb<TSession>(\n  sm: SessionManagerWeb<TSession>,\n  request: Request,\n  target: Headers,\n): Promise<TSession | null> {\n  const { data, meta } = await sm.getSessionWithMeta(request)\n  if (data !== null && meta.needsReencrypt) {\n    await sm.createSession(target, data)\n  }\n  return data\n}\n\n/**\n * T3.2 — Transparent re-encrypt helper (EC-4 timing-safe wrapper).\n *\n * Call this in your `createContext` (before any rendering / streaming\n * starts). It:\n *   1. Reads the session via `getSessionWithMeta`.\n *   2. If the cookie was decrypted with a legacy secret (index > 0), it\n *      immediately re-issues the cookie with `secrets[0]` so the next\n *      request lands on the newest key.\n *   3. Returns the session data (or null) for use downstream.\n *\n * EC-4: this MUST run before `renderToPipeableStream` / `res.writeHead`\n * fires. Calling it inside an SSR component or handler body that has\n * already streamed bytes makes the re-encrypt a silent no-op (Set-Cookie\n * is locked once headers commit), trapping users on the legacy secret\n * forever once it's removed from the array.\n */\nexport async function rotateIfNeeded<TSession>(\n  sm: SessionManager<TSession>,\n  req: IncomingMessage,\n  res: ServerResponse,\n): Promise<TSession | null> {\n  const { data, meta } = await sm.getSessionWithMeta(req)\n  if (data !== null && meta.needsReencrypt) {\n    await sm.createSession(res, data)\n  }\n  return data\n}\n\n/**\n * EC-2 — Production secret guard. Refuses to boot when `NODE_ENV === 'production'`\n * AND the secret is too short (< 32 chars) OR matches a known placeholder.\n *\n * Accepts a single secret OR an array. In array form, each entry is validated\n * independently — a single bad entry refuses boot with an index-qualified message.\n */\nconst PLACEHOLDER_PATTERN = /CHANGE_ME|demo[-_]|placeholder/i\n\nexport function assertProductionSecret(secret: string | string[]): void {\n  const arr = Array.isArray(secret) ? secret : [secret]\n  const isProd = process.env.NODE_ENV === 'production'\n\n  for (let i = 0; i < arr.length; i++) {\n    const s = arr[i]\n    const isPlaceholder = PLACEHOLDER_PATTERN.test(s)\n    const isTooShort = s.length < 32\n    const prefix = arr.length > 1 ? `Session secret at index ${i}` : 'Session secret'\n\n    if (isProd) {\n      if (isTooShort) {\n        throw new Error(\n          `${prefix} too short for production (${s.length} chars; minimum 32). ` +\n            `Set a 32+ random char secret in your env (e.g., \\`openssl rand -hex 32\\`).`,\n        )\n      }\n      if (isPlaceholder) {\n        throw new Error(\n          `${prefix} looks like a placeholder (\"${s.slice(0, 16)}…\") and NODE_ENV is \"production\". ` +\n            `Replace it with a 32+ random char secret (e.g., \\`openssl rand -hex 32\\`) before deploying.`,\n        )\n      }\n      continue\n    }\n    if (isPlaceholder || isTooShort) {\n      console.warn(\n        `[theokit] WARNING: ${prefix.toLowerCase()} is a placeholder or too short. ` +\n          `This is OK for dev, but the production server will REFUSE to boot until you replace it.`,\n      )\n    }\n  }\n}\n","/**\n * Shared encoding utilities for crypto-adjacent code.\n *\n * CR-020 DRY: `base64urlEncode` was duplicated across `oauth-pkce.ts` and\n * `oauth-state.ts`. Duplication in cryptographic helpers is a bug class —\n * a future RFC-driven tweak (e.g., padding semantics) would diverge across\n * files. Centralizing the single canonical implementation eliminates that\n * vector.\n *\n * Module is intentionally under `_internal/` so it is **not** part of the\n * public API surface. Consumers outside `packages/theo/src/server` must\n * not import from here.\n */\n\n/**\n * RFC 4648 §5 — base64url-encode bytes without padding. Used wherever an\n * RFC requires URL-safe base64 (PKCE per RFC 7636 §4.1, JWT per RFC 7515,\n * etc.). Pure function — does not mutate `bytes`.\n */\nexport function base64urlEncode(bytes: Uint8Array): string {\n  let s = ''\n  for (const b of bytes) s += String.fromCharCode(b)\n  // The `=+$` trailing-padding regex is bounded (at most 2 chars for\n  // base64). sonarjs flags the `+` quantifier conservatively, but the\n  // input is the output of `btoa()` — a string with at most 2 trailing\n  // `=` characters by spec.\n  // eslint-disable-next-line sonarjs/slow-regex -- bounded trailing-padding pattern (max 2 chars)\n  return btoa(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\n/**\n * Constant-time string equality.\n *\n * CR-012: prior implementations early-exited on length mismatch\n * (`if (a.length !== b.length) return false`). That early exit leaks\n * the comparison-target length via wall-clock timing — observable when\n * the secret length is itself sensitive (length-based bucket assignment,\n * variable-length nonces). This implementation always iterates\n * `max(a.length, b.length)` characters, OR-folding mismatches into a\n * single accumulator that is checked once at the end.\n *\n * Returns `false` for empty inputs as a defensive default — never accept\n * \"both empty\" as a match.\n */\nexport function constantTimeEquals(a: string, b: string): boolean {\n  if (typeof a !== 'string' || typeof b !== 'string') return false\n  if (a.length === 0 || b.length === 0) return false\n\n  const maxLen = Math.max(a.length, b.length)\n  let diff = a.length ^ b.length\n  for (let i = 0; i < maxLen; i++) {\n    // charCodeAt returns NaN for out-of-range indices; (NaN ^ x) is x, so we\n    // explicitly substitute 0 to keep the OR-fold meaningful.\n    const ca = i < a.length ? a.charCodeAt(i) : 0\n    const cb = i < b.length ? b.charCodeAt(i) : 0\n    diff |= ca ^ cb\n  }\n  return diff === 0\n}\n","/**\n * T6.2 — RFC 6238 TOTP primitive.\n *\n * Reference: https://datatracker.ietf.org/doc/html/rfc6238\n * HMAC-based one-time password (HOTP) base: https://datatracker.ietf.org/doc/html/rfc4226\n *\n * Pure-function, dependency-free implementation via Web Crypto. Secrets\n * may be passed as Uint8Array (preferred) or base32 string.\n *\n * SECURITY NOTES (documented per EC-13):\n *   - TOTP secrets are equivalent to passwords. Encrypt at rest using a\n *     separate KMS key from the session secret. If your DB leaks, ALL\n *     2FA codes are compromised — rotate by forcing all users to re-enroll.\n *   - Use `verifyTotp` constant-time (we use crypto.timingSafeEqual internally).\n */\n\n// CR-012 fix: use the shared constant-time helper that does not early-exit\n// on length mismatch (the previous local version did, leaking the digit\n// count via timing).\nimport { constantTimeEquals } from '../_internal/encoding.js'\n\n/** Supported HMAC algorithms per RFC 6238 §1.2. Default SHA-1. */\nexport type TotpAlgorithm = 'SHA-1' | 'SHA-256' | 'SHA-512'\n\nexport interface TotpOptions {\n  /** Shared secret — bytes (preferred) OR base32 string. */\n  secret: Uint8Array | string\n  /** Time step in seconds. Default 30 (RFC 6238 §5.2 recommended). */\n  step?: number\n  /** Code length: 6, 7, or 8 digits. Default 6. */\n  digits?: 6 | 7 | 8\n  /** HMAC algorithm. Default SHA-1 (RFC default). */\n  algorithm?: TotpAlgorithm\n  /** Time in ms since epoch. Default Date.now(). */\n  time?: number\n}\n\nexport interface VerifyTotpOptions extends TotpOptions {\n  /**\n   * Drift tolerance in number of steps on each side. Default 1\n   * (RFC 6238 §5.2 recommends ±1 step = 90s total window).\n   */\n  window?: number\n}\n\nconst DEFAULT_STEP = 30\nconst DEFAULT_DIGITS = 6\nconst DEFAULT_ALGORITHM: TotpAlgorithm = 'SHA-1'\n\n/** Decode base32 (RFC 4648, no padding) to bytes. Throws on invalid input. */\nfunction base32Decode(s: string): Uint8Array {\n  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'\n  // Trailing `=` is bounded by spec to 0..6 chars; `\\s+` collapses runs\n  // of whitespace. Input length is the user's TOTP secret (10..50 chars\n  // typical), so super-linear backtracking cannot escalate.\n  // eslint-disable-next-line sonarjs/slow-regex -- bounded inputs (TOTP secrets are short)\n  const clean = s.toUpperCase().replace(/=+$/, '').replace(/\\s+/g, '')\n  if (!/^[A-Z2-7]+$/.test(clean)) {\n    throw new Error('Invalid base32 secret')\n  }\n  const bits: number[] = []\n  for (const c of clean) {\n    const idx = alphabet.indexOf(c)\n    for (let i = 4; i >= 0; i--) bits.push((idx >> i) & 1)\n  }\n  // Trim trailing partial byte\n  const fullBytes = Math.floor(bits.length / 8)\n  const out = new Uint8Array(fullBytes)\n  for (let i = 0; i < fullBytes; i++) {\n    let v = 0\n    for (let j = 0; j < 8; j++) v = (v << 1) | bits[i * 8 + j]\n    out[i] = v\n  }\n  return out\n}\n\n/** Encode bytes to base32 (RFC 4648, no padding). */\nfunction base32Encode(bytes: Uint8Array): string {\n  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'\n  let out = ''\n  let buffer = 0\n  let bits = 0\n  for (const b of bytes) {\n    buffer = (buffer << 8) | b\n    bits += 8\n    while (bits >= 5) {\n      out += alphabet[(buffer >> (bits - 5)) & 0x1f]\n      bits -= 5\n    }\n  }\n  if (bits > 0) out += alphabet[(buffer << (5 - bits)) & 0x1f]\n  return out\n}\n\nfunction normalizeSecret(secret: Uint8Array | string): Uint8Array {\n  if (typeof secret === 'string') return base32Decode(secret)\n  return secret\n}\n\n/** Counter (8-byte big-endian) from time in ms / step in seconds. */\nfunction counterBytes(timeMs: number, stepSec: number): Uint8Array {\n  const counter = Math.floor(timeMs / 1000 / stepSec)\n  const out = new Uint8Array(8)\n  // Two 32-bit halves (Number can safely represent up to 2^53; OK until year 285,000+)\n  const hi = Math.floor(counter / 0x100000000)\n  const lo = counter >>> 0\n  out[0] = (hi >>> 24) & 0xff\n  out[1] = (hi >>> 16) & 0xff\n  out[2] = (hi >>> 8) & 0xff\n  out[3] = hi & 0xff\n  out[4] = (lo >>> 24) & 0xff\n  out[5] = (lo >>> 16) & 0xff\n  out[6] = (lo >>> 8) & 0xff\n  out[7] = lo & 0xff\n  return out\n}\n\nasync function hmac(\n  secret: Uint8Array,\n  message: Uint8Array,\n  algorithm: TotpAlgorithm,\n): Promise<Uint8Array> {\n  const key = await crypto.subtle.importKey(\n    'raw',\n    secret as BufferSource,\n    { name: 'HMAC', hash: algorithm },\n    false,\n    ['sign'],\n  )\n  const sig = await crypto.subtle.sign('HMAC', key, message as BufferSource)\n  return new Uint8Array(sig)\n}\n\n/** RFC 4226 §5.3 dynamic truncation. */\nfunction truncate(mac: Uint8Array, digits: number): string {\n  const offset = mac[mac.length - 1] & 0x0f\n  const code =\n    ((mac[offset] & 0x7f) << 24) |\n    ((mac[offset + 1] & 0xff) << 16) |\n    ((mac[offset + 2] & 0xff) << 8) |\n    (mac[offset + 3] & 0xff)\n  const mod = 10 ** digits\n  return String(code % mod).padStart(digits, '0')\n}\n\n/** Generate a TOTP code for a given time. */\nexport async function generateTotp(opts: TotpOptions): Promise<string> {\n  const secret = normalizeSecret(opts.secret)\n  const step = opts.step ?? DEFAULT_STEP\n  const digits = opts.digits ?? DEFAULT_DIGITS\n  const algorithm = opts.algorithm ?? DEFAULT_ALGORITHM\n  const time = opts.time ?? Date.now()\n  const mac = await hmac(secret, counterBytes(time, step), algorithm)\n  return truncate(mac, digits)\n}\n\n/**\n * Verify a TOTP code against the current window ± `window` steps.\n *\n * Returns `false` for malformed tokens (non-digit, wrong length) without\n * throwing — defensive against accidental user-input passthrough.\n */\nexport async function verifyTotp(token: string, opts: VerifyTotpOptions): Promise<boolean> {\n  if (typeof token !== 'string') return false\n  const digits = opts.digits ?? DEFAULT_DIGITS\n  if (!/^\\d+$/.test(token) || token.length !== digits) return false\n\n  const step = opts.step ?? DEFAULT_STEP\n  const algorithm = opts.algorithm ?? DEFAULT_ALGORITHM\n  const time = opts.time ?? Date.now()\n  const drift = opts.window ?? 1\n  const secret = normalizeSecret(opts.secret)\n\n  // Walk the whole drift range constant-time-ish (no early exit).\n  let matched = false\n  for (let delta = -drift; delta <= drift; delta++) {\n    const t = time + delta * step * 1000\n    const code = truncate(await hmac(secret, counterBytes(t, step), algorithm), digits)\n    if (constantTimeEquals(code, token)) matched = true\n  }\n  return matched\n}\n\n/** Generate a cryptographically random TOTP secret. Default 20 bytes (RFC minimum). */\nexport function generateTotpSecret(bytes = 20): Uint8Array {\n  if (bytes < 16) {\n    throw new Error('TOTP secret must be at least 16 bytes (RFC 6238 §3 minimum)')\n  }\n  const out = new Uint8Array(bytes)\n  crypto.getRandomValues(out)\n  return out\n}\n\n/**\n * Build an `otpauth://` URI for QR code enrollment. Format follows the\n * de facto Google Authenticator spec adopted by every major TOTP app.\n *   otpauth://totp/<issuer>:<account>?secret=<base32>&issuer=<issuer>&algorithm=<alg>&digits=<n>&period=<sec>\n */\nexport interface TotpUriOptions {\n  secret: Uint8Array\n  issuer: string\n  account: string\n  algorithm?: TotpAlgorithm\n  digits?: 6 | 7 | 8\n  step?: number\n}\n\nexport function totpUri(opts: TotpUriOptions): string {\n  const label = `${opts.issuer}:${opts.account}`\n  const params = new URLSearchParams({\n    secret: base32Encode(opts.secret),\n    issuer: opts.issuer,\n    algorithm: opts.algorithm ?? DEFAULT_ALGORITHM,\n    digits: String(opts.digits ?? DEFAULT_DIGITS),\n    period: String(opts.step ?? DEFAULT_STEP),\n  })\n  return `otpauth://totp/${encodeURIComponent(label)}?${params.toString()}`\n}\n","/**\n * T6.3 — Backup codes for 2FA recovery.\n *\n * generateBackupCodes returns N plaintexts (display once to user) + hashes\n * (store in DB). verifyBackupCode constant-time-walks all hashes and\n * returns the matchedHash so caller can delete the used code from storage\n * — replay protection lives at the caller (we can't see their database).\n *\n * SECURITY NOTES:\n *   - Codes have ~40 bits entropy (8 chars × 5 bits per char from a\n *     32-char alphabet excluding I/L/O/0/1). Single-use → argon2id\n *     overhead is unnecessary; SHA-256 of the normalized code suffices.\n *   - The caller MUST atomically delete the matched hash on successful\n *     verify. Without that, the code is replayable. We surface\n *     matchedHash explicitly so this step is conspicuous.\n *   - Pair this with throttleLoginAttempts (T6.1) on the verify endpoint\n *     to prevent online brute-force against the 40-bit space.\n */\n\nexport interface BackupCodeOptions {\n  /** How many codes to generate. Default 10. */\n  count?: number\n  /** Length in chars (excluding separator). Default 8. */\n  length?: number\n  /** Separator inserted at the midpoint. Default '-'; pass null to omit. */\n  separator?: '-' | null\n  /** Custom alphabet. Default excludes ambiguous chars (I, L, O, 0, 1). */\n  alphabet?: string\n}\n\nexport interface BackupCode {\n  plaintext: string\n  hash: string\n}\n\nconst DEFAULT_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789' // no I, O, 0, 1\nconst DEFAULT_COUNT = 10\nconst DEFAULT_LENGTH = 8\n\n/**\n * Generate cryptographically random backup codes + their SHA-256 hashes.\n *\n * Plaintext is uppercase alphanumeric (default alphabet excludes ambiguous\n * chars). Separator inserted at the midpoint (default `-`).\n */\nexport async function generateBackupCodes(opts: BackupCodeOptions = {}): Promise<BackupCode[]> {\n  const count = opts.count ?? DEFAULT_COUNT\n  const length = opts.length ?? DEFAULT_LENGTH\n  const separator = opts.separator === undefined ? '-' : opts.separator\n  const alphabet = opts.alphabet ?? DEFAULT_ALPHABET\n\n  // CR-022 fix: bound count and length explicitly. Pathological inputs\n  // (count=Infinity, length=0) would cause an infinite loop or wasteful\n  // resource usage. Bounds are generous (count ≤ 1000, length ∈ [4, 64])\n  // — well above any realistic 2FA backup-codes use case.\n  if (!Number.isInteger(count) || count <= 0 || count > 1000) {\n    throw new RangeError(\n      `generateBackupCodes: count must be an integer in [1, 1000] (got ${String(count)})`,\n    )\n  }\n  if (!Number.isInteger(length) || length < 4 || length > 64) {\n    throw new RangeError(\n      `generateBackupCodes: length must be an integer in [4, 64] (got ${String(length)})`,\n    )\n  }\n  if (alphabet.length < 8) {\n    throw new RangeError(\n      `generateBackupCodes: alphabet must contain at least 8 distinct chars (got ${alphabet.length})`,\n    )\n  }\n\n  const codes: BackupCode[] = []\n  const seen = new Set<string>()\n  while (codes.length < count) {\n    const raw = randomFromAlphabet(length, alphabet)\n    if (seen.has(raw)) continue\n    seen.add(raw)\n    const plaintext = formatWithSeparator(raw, separator)\n    const hash = await sha256Hex(normalizeCode(plaintext))\n    codes.push({ plaintext, hash })\n  }\n  return codes\n}\n\n/**\n * Verify a code against a list of stored hashes. Walks all hashes\n * constant-time (no early exit). Returns `valid:true` + matchedHash on\n * hit; `valid:false` otherwise.\n *\n * `matchedHash` is the EXACT string the caller stored, ready to be passed\n * to a `DELETE FROM backup_codes WHERE hash = ?` query.\n */\nexport async function verifyBackupCode(\n  code: string,\n  hashes: readonly string[],\n): Promise<{ valid: boolean; matchedHash?: string }> {\n  const candidate = await sha256Hex(normalizeCode(code))\n  let matchedHash: string | undefined\n  // Constant-time iteration over hashes: never short-circuit.\n  for (const h of hashes) {\n    if (constantTimeEquals(h, candidate)) {\n      matchedHash = h\n    }\n  }\n  return matchedHash ? { valid: true, matchedHash } : { valid: false }\n}\n\n/**\n * Normalize a code for hashing: uppercase + strip separator. This way\n * `abcd-efgh` and `ABCDEFGH` produce the same hash. Whitespace is also\n * stripped defensively.\n */\nfunction normalizeCode(input: string): string {\n  return input.toUpperCase().replace(/[-\\s]+/g, '')\n}\n\nfunction formatWithSeparator(raw: string, separator: '-' | null): string {\n  if (!separator || raw.length < 4) return raw\n  const mid = Math.floor(raw.length / 2)\n  return raw.slice(0, mid) + separator + raw.slice(mid)\n}\n\nfunction randomFromAlphabet(length: number, alphabet: string): string {\n  const random = new Uint8Array(length)\n  crypto.getRandomValues(random)\n  let out = ''\n  for (let i = 0; i < length; i++) {\n    out += alphabet[random[i] % alphabet.length]\n  }\n  return out\n}\n\nasync function sha256Hex(input: string): Promise<string> {\n  const bytes = new TextEncoder().encode(input)\n  const hash = await crypto.subtle.digest('SHA-256', bytes)\n  return Array.from(new Uint8Array(hash))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\nfunction constantTimeEquals(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return diff === 0\n}\n","import type { RateLimitStore } from '../rate-limit/rate-limit-store.js'\n\n/**\n * T6.1 — Login throttling primitive.\n *\n * Per-credential failure counter backed by any `RateLimitStore`. After\n * `maxAttempts` failures within `windowMs`, the identifier is locked\n * for `lockoutMs`. Successful login resets the counter.\n *\n * Usage in a login handler:\n *\n *   const state = await checkThrottle({ store, identifier: hash(email) })\n *   if (!state.allowed) return 429\n *   const valid = await verifyPassword(creds)\n *   await recordAttempt({ store, identifier: hash(email) }, valid)\n *   if (!valid) return 401\n *\n * SECURITY:\n *   - NEVER pass raw email/username as `identifier`. Hash or normalize\n *     first (e.g. SHA-256 of the lowercased email). This prevents PII\n *     from landing in the rate-limit store or audit logs.\n *   - Combine with the per-route IP rate limit (T2.2) for layered defense:\n *     IP-level limits stop scripted floods; credential-level limits stop\n *     distributed brute force.\n */\n\nexport interface ThrottleOptions {\n  store: RateLimitStore\n  /**\n   * Stable identifier per credential. Hash raw emails/usernames before\n   * passing in — never leak PII to the rate-limit key space.\n   */\n  identifier: string\n  /** Failures before lockout. Default 5. */\n  maxAttempts?: number\n  /** Sliding window for counting failures. Default 15 minutes. */\n  windowMs?: number\n  /** Lockout duration after maxAttempts hit. Default 1 hour. */\n  lockoutMs?: number\n}\n\nexport interface ThrottleState {\n  allowed: boolean\n  remainingAttempts: number\n  /** Set when `allowed === false`. Absolute timestamp when the lockout expires. */\n  lockedUntil?: Date\n}\n\nconst DEFAULT_MAX_ATTEMPTS = 5\nconst DEFAULT_LOCKOUT_MS = 60 * 60_000\n\n/**\n * Read the current throttle state for an identifier WITHOUT modifying\n * the counter. Call before validating credentials so locked attempts\n * are rejected fast.\n */\nexport async function checkThrottle(opts: ThrottleOptions): Promise<ThrottleState> {\n  const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS\n  const state = await opts.store.get(opts.identifier)\n  if (!state) {\n    return { allowed: true, remainingAttempts: maxAttempts }\n  }\n  if (state.count >= maxAttempts) {\n    return {\n      allowed: false,\n      remainingAttempts: 0,\n      // Lockout expires when the store TTL fires.\n      lockedUntil: new Date(state.resetAt),\n    }\n  }\n  return {\n    allowed: true,\n    remainingAttempts: Math.max(0, maxAttempts - state.count),\n  }\n}\n\n/**\n * Record an attempt outcome. On success → reset the counter. On failure\n * → increment within the sliding window. Returns the new throttle state.\n *\n * Storage model: the store entry's TTL is `lockoutMs` (which doubles as\n * the failure-accumulation window). When `lockoutMs` is short — common\n * in tests or for soft lockouts — the entry auto-expires and the next\n * attempt starts fresh.\n */\nexport async function recordAttempt(\n  opts: ThrottleOptions,\n  success: boolean,\n): Promise<ThrottleState> {\n  const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS\n  if (success) {\n    await opts.store.reset(opts.identifier)\n    return {\n      allowed: true,\n      remainingAttempts: maxAttempts,\n    }\n  }\n  const lockoutMs = opts.lockoutMs ?? DEFAULT_LOCKOUT_MS\n  const state = await opts.store.incr(opts.identifier, lockoutMs)\n\n  if (state.count >= maxAttempts) {\n    return {\n      allowed: false,\n      remainingAttempts: 0,\n      lockedUntil: new Date(state.resetAt),\n    }\n  }\n  return {\n    allowed: true,\n    remainingAttempts: Math.max(0, maxAttempts - state.count),\n  }\n}\n","/**\n * T7.3 — RFC 7636 PKCE primitive.\n *\n * Reference: https://datatracker.ietf.org/doc/html/rfc7636\n *\n * Pure-function, dependency-free implementation using Web Crypto.\n *\n * Usage in an OAuth authorization-code flow:\n *\n *   const { codeVerifier, codeChallenge, codeChallengeMethod } = await generatePkceChallenge()\n *   // Store codeVerifier in the user's session\n *   // Send codeChallenge + codeChallengeMethod in the /authorize redirect\n *   // ... user authenticates with provider ...\n *   // On /callback, send codeVerifier with the code → token exchange\n */\n\nexport interface PkceChallenge {\n  codeVerifier: string\n  codeChallenge: string\n  codeChallengeMethod: 'S256'\n}\n\n// CR-020 DRY: single canonical base64url encoder lives in _internal/encoding.\nimport { base64urlEncode } from '../_internal/encoding.js'\n\n/**\n * Compute the code_challenge from a code_verifier per RFC 7636 §4.2.\n * Exported separately to enable RFC 7636 Appendix B vector testing.\n */\nexport async function pkceChallengeFromVerifier(verifier: string): Promise<string> {\n  const bytes = new TextEncoder().encode(verifier)\n  const hash = await crypto.subtle.digest('SHA-256', bytes)\n  return base64urlEncode(new Uint8Array(hash))\n}\n\n/**\n * Generate a fresh PKCE challenge pair.\n *\n * Verifier: 32 cryptographically random bytes → 43-char base64url string.\n * RFC 7636 §4.1 allows 43–128 chars; we ship the minimum-safe default.\n *\n * Method: 'S256' only — no 'plain' fallback. RFC 7636 §7.2 strongly\n * discourages plain and modern providers reject it.\n */\nexport async function generatePkceChallenge(): Promise<PkceChallenge> {\n  const random = new Uint8Array(32)\n  crypto.getRandomValues(random)\n  const codeVerifier = base64urlEncode(random)\n  const codeChallenge = await pkceChallengeFromVerifier(codeVerifier)\n  return { codeVerifier, codeChallenge, codeChallengeMethod: 'S256' }\n}\n","/**\n * T7.4 — OAuth `state` parameter helpers (RFC 6749 §10.12).\n *\n * `state` is a cryptographically random anti-CSRF token. The client\n * stores it (in session/cookie/db) before redirecting to the\n * authorization endpoint and verifies it on the callback. Without it,\n * an attacker can authorize on the user's account using a captured code.\n */\n\n// CR-020 DRY + CR-012 constant-time: shared helpers in _internal/encoding.\nimport { base64urlEncode, constantTimeEquals } from '../_internal/encoding.js'\n\n/**\n * Generate a cryptographically random state token. Default 32 bytes\n * (~43 base64url chars). Increase for higher entropy if your provider\n * supports it.\n */\nexport function generateOAuthState(opts: { bytes?: number } = {}): string {\n  const len = opts.bytes ?? 32\n  const buf = new Uint8Array(len)\n  crypto.getRandomValues(buf)\n  return base64urlEncode(buf)\n}\n\n/**\n * Verify a state token. Constant-time compare. Empty inputs always fail\n * (defensive — never accept empty as \"they match\").\n *\n * CR-012 fix: `constantTimeEquals` does not early-exit on length mismatch,\n * so the comparison time is independent of how the input was forged.\n */\nexport function verifyOAuthState(provided: string, stored: string): boolean {\n  return constantTimeEquals(provided, stored)\n}\n","/**\n * T7.4 — OpenID Connect Discovery 1.0 metadata fetcher.\n *\n * Reference: https://openid.net/specs/openid-connect-discovery-1_0.html\n *\n * Caches metadata in module scope. Cache key is the exact issuer string\n * (trailing-slash sensitive per RFC 8414 §3). Failures are NOT cached —\n * subsequent calls retry the fetch.\n *\n * EC-7 — HTTPS enforced. RFC 8414 §3 requires HTTPS for OIDC issuers.\n * Localhost (loopback) is allowed for development.\n */\n\nexport interface OidcMetadata {\n  issuer: string\n  authorization_endpoint: string\n  token_endpoint: string\n  jwks_uri?: string\n  userinfo_endpoint?: string\n  end_session_endpoint?: string\n  scopes_supported?: string[]\n  response_types_supported?: string[]\n  grant_types_supported?: string[]\n  id_token_signing_alg_values_supported?: string[]\n  [key: string]: unknown // OIDC providers ship many optional fields\n}\n\nconst cache = new Map<string, Promise<OidcMetadata>>()\n\n/** Clear the discovery cache. Used by tests. */\nexport function clearOidcCache(): void {\n  cache.clear()\n}\n\nfunction isLoopback(host: string): boolean {\n  return host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1'\n}\n\n/**\n * Fetch (or return cached) OIDC provider metadata.\n *\n * Throws when:\n *   - Issuer URL is malformed\n *   - Issuer is HTTP and not a loopback host (EC-7)\n *   - HTTP response is non-OK\n *   - Metadata lacks `authorization_endpoint` (sanity check)\n */\nexport async function discoverOidcProvider(issuer: string | URL): Promise<OidcMetadata> {\n  const issuerStr = typeof issuer === 'string' ? issuer : issuer.toString()\n  // Validate protocol BEFORE checking cache — invalid issuers should never poison.\n  const url = new URL(issuerStr)\n  if (url.protocol !== 'https:' && !isLoopback(url.hostname)) {\n    throw new Error(\n      `OIDC issuer must use HTTPS (received \"${url.protocol}//${url.hostname}…\"). ` +\n        `RFC 8414 §3 forbids plain HTTP except for loopback hosts.`,\n    )\n  }\n\n  const cached = cache.get(issuerStr)\n  if (cached) return cached\n\n  const promise = (async () => {\n    const wellKnown = new URL(\n      '.well-known/openid-configuration',\n      issuerStr.endsWith('/') ? issuerStr : issuerStr + '/',\n    )\n    const res = await fetch(wellKnown)\n    if (!res.ok) {\n      throw new Error(`OIDC discovery failed: ${res.status} ${res.statusText} at ${wellKnown}`)\n    }\n    const metadata = (await res.json()) as OidcMetadata\n    if (!metadata.authorization_endpoint) {\n      throw new Error('OIDC metadata missing authorization_endpoint — provider response is invalid')\n    }\n    return metadata\n  })()\n  // Cache the promise; on rejection, remove so the next call retries.\n  cache.set(issuerStr, promise)\n  promise.catch(() => {\n    if (cache.get(issuerStr) === promise) cache.delete(issuerStr)\n  })\n  return promise\n}\n"],"mappings":";;;;;;;;;;AAAO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,OAAO;AAAA,EACP,SAAS;AAAA,EAET,YAAY,UAAU,2BAA2B;AAC/C,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,YAAe,SAAqD;AAClF,MAAI,YAAY,QAAQ,YAAY,QAAW;AAC7C,UAAM,IAAI,kBAAkB;AAAA,EAC9B;AACF;;;ACEA,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAEhC,IAAM,oBAAoB,QAAQ,OAAO,iBAAiB;AAC1D,IAAM,kBAAkB,IAAI,WAAW,CAAC;AAKxC,IAAM,WAAW,oBAAI,IAAgC;AAErD,eAAe,UAAU,QAAoC;AAC3D,QAAM,SAAS,SAAS,IAAI,MAAM;AAClC,MAAI,OAAQ,QAAO;AAEnB,QAAM,UAAU,YAAY;AAC1B,UAAM,cAAc,MAAM,OAAO,OAAO;AAAA,MACtC;AAAA,MACA,QAAQ,OAAO,MAAM;AAAA,MACrB,EAAE,MAAM,OAAO;AAAA,MACf;AAAA,MACA,CAAC,WAAW;AAAA,IACd;AACA,WAAO,OAAO,OAAO;AAAA,MACnB,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,iBAAiB,MAAM,kBAAkB;AAAA,MAChF;AAAA,MACA,EAAE,MAAM,WAAW,QAAQ,IAAI;AAAA,MAC/B;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AAAA,EACF,GAAG;AAEH,WAAS,IAAI,QAAQ,MAAM;AAE3B,SAAO,MAAM,MAAM;AACjB,aAAS,OAAO,MAAM;AAAA,EACxB,CAAC;AACD,SAAO;AACT;AAEA,SAAS,YAAY,MAA0B;AAC7C,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,WAAW;AAC/C;AASA,SAAS,cAAc,KAAsC;AAC3D,QAAM,MAAM,OAAO,KAAK,KAAK,WAAW;AACxC,QAAM,OAAO,IAAI,WAAW,IAAI,MAAM;AACtC,OAAK,IAAI,GAAG;AACZ,SAAO;AACT;AAOA,eAAsB,QAAW,MAAS,QAAiC;AACzE,QAAM,MAAM,MAAM,UAAU,MAAM;AAClC,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACpD,QAAM,YAAY,QAAQ,OAAO,KAAK,UAAU,IAAI,CAAC;AACrD,QAAM,aAAa,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,SAAS;AAAA,EACrE;AACA,SAAO,GAAG,YAAY,EAAE,CAAC,IAAI,YAAY,UAAU,CAAC;AACtD;AAEA,eAAsB,QAAW,OAAe,QAAmC;AACjF,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,UAAM,KAAK,cAAc,MAAM,CAAC,CAAC;AACjC,UAAM,aAAa,cAAc,MAAM,CAAC,CAAC;AACzC,UAAM,MAAM,MAAM,UAAU,MAAM;AAElC,UAAM,YAAY,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,UAAU;AACtF,WAAO,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,yBAA+B;AAC7C,WAAS,MAAM;AACjB;;;ACjDA,IAAM,cAAc;AAMpB,SAAS,iBAAiB,OAAoC;AAC5D,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,MAAM,IAAI,CAAC,KAAK;AACzD,MAAI,IAAI,WAAW,GAAG;AACpB,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,MAAI,IAAI,SAAS,aAAa;AAC5B,UAAM,IAAI;AAAA,MACR,2CAA2C,WAAW,qEAAgE,IAAI,MAAM;AAAA,IAClI;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,KAAK;AACpC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,UAAM,IAAI,IAAI,CAAC;AACf,QAAI,OAAO,MAAM,YAAY,EAAE,SAAS,IAAI;AAC1C,YAAM,QAAQ,WAAW,aAAa,CAAC,KAAK;AAC5C,YAAM,IAAI,MAAM,iBAAiB,KAAK,uDAAuD;AAAA,IAC/F;AAAA,EACF;AACA,SAAO;AACT;AAUA,eAAe,uBACb,MACA,SACA,QACiB;AACjB,QAAM,WAAqC;AAAA,IACzC;AAAA,IACA,KAAK,KAAK,IAAI,IAAI,SAAS;AAAA,EAC7B;AACA,SAAO,QAAQ,UAAU,QAAQ,CAAC,CAAC;AACrC;AAWA,eAAe,2BACb,KACA,SACwE;AACxE,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,QAAQ,IAAI,OAAO,QAAQ,MAAM;AAC/B,YAAM,MAAM,MAAM,QAAmC,KAAK,MAAM;AAChE,aAAO,MAAM,EAAE,UAAU,KAAK,OAAO,EAAE,IAAI;AAAA,IAC7C,CAAC;AAAA,EACH;AACA,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAQ,QAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEO,SAAS,qBAA+B,QAAiD;AAC9F,QAAM,UAAU,iBAAiB,OAAO,MAAM;AAC9C,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,SAAS,OAAO,UAAU;AAEhC,WAAS,YAAY,KAAqB,OAAqB;AAC7D,cAAU,KAAK,YAAY,OAAO;AAAA,MAChC,UAAU;AAAA,MACV,UAAU;AAAA,MACV;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,KAAK;AACpB,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,GAAG;AAClD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,mBAAmB,KAAK;AAC5B,YAAM,MAAM,UAAU,KAAK,UAAU;AACrC,UAAI,CAAC,IAAK,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AAChF,YAAM,UAAU,MAAM,2BAAqC,KAAK,OAAO;AACvE,UAAI,CAAC,QAAS,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AACpF,UAAI,QAAQ,SAAS,MAAM,KAAK,IAAI,GAAG;AACrC,eAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,MAAM,EAAE;AAAA,MACnF;AACA,aAAO;AAAA,QACL,MAAM,QAAQ,SAAS;AAAA,QACvB,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,IAEA,MAAM,cAAc,KAAK,MAAM;AAC7B,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,kBAAY,KAAK,KAAK;AAAA,IACxB;AAAA,IAEA,eAAe,KAAK;AAClB,mBAAa,KAAK,UAAU;AAAA,IAC9B;AAAA,IAEA,MAAM,cAAc,KAAK,KAAK;AAC5B,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,GAAG;AAClD,UAAI,SAAS,KAAM,QAAO;AAG1B,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,kBAAY,KAAK,KAAK;AACtB,aAAO;AAAA,IACT;AAAA,EACF;AACF;AA4BO,SAAS,wBACd,QAC6B;AAC7B,QAAM,UAAU,iBAAiB,OAAO,MAAM;AAC9C,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,SAAS,OAAO,UAAU;AAEhC,WAAS,eAAe,QAAiB,OAAqB;AAC5D,0BAAsB,QAAQ,YAAY,OAAO;AAAA,MAC/C,UAAU;AAAA,MACV,UAAU;AAAA,MACV;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,SAAS;AACxB,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,OAAO;AACtD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,mBAAmB,SAAS;AAChC,YAAM,MAAM,qBAAqB,SAAS,UAAU;AACpD,UAAI,QAAQ,OAAW,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AAC7F,YAAM,UAAU,MAAM,2BAAqC,KAAK,OAAO;AACvE,UAAI,CAAC,QAAS,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AACpF,UAAI,QAAQ,SAAS,MAAM,KAAK,IAAI,GAAG;AACrC,eAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,MAAM,EAAE;AAAA,MACnF;AACA,aAAO;AAAA,QACL,MAAM,QAAQ,SAAS;AAAA,QACvB,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,IAEA,MAAM,cAAc,QAAQ,MAAM;AAChC,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,qBAAe,QAAQ,KAAK;AAAA,IAC9B;AAAA,IAEA,eAAe,QAAQ;AACrB,kCAA4B,QAAQ,UAAU;AAAA,IAChD;AAAA,IAEA,MAAM,cAAc,SAAS,QAAQ;AACnC,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,OAAO;AACtD,UAAI,SAAS,KAAM,QAAO;AAC1B,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,qBAAe,QAAQ,KAAK;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAiBA,eAAsB,kBACpB,IACA,SACA,QAC0B;AAC1B,QAAM,EAAE,MAAM,KAAK,IAAI,MAAM,GAAG,mBAAmB,OAAO;AAC1D,MAAI,SAAS,QAAQ,KAAK,gBAAgB;AACxC,UAAM,GAAG,cAAc,QAAQ,IAAI;AAAA,EACrC;AACA,SAAO;AACT;AAmBA,eAAsB,eACpB,IACA,KACA,KAC0B;AAC1B,QAAM,EAAE,MAAM,KAAK,IAAI,MAAM,GAAG,mBAAmB,GAAG;AACtD,MAAI,SAAS,QAAQ,KAAK,gBAAgB;AACxC,UAAM,GAAG,cAAc,KAAK,IAAI;AAAA,EAClC;AACA,SAAO;AACT;AASA,IAAM,sBAAsB;AAErB,SAAS,uBAAuB,QAAiC;AACtE,QAAM,MAAM,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;AACpD,QAAM,SAAS,QAAQ,IAAI,aAAa;AAExC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,UAAM,IAAI,IAAI,CAAC;AACf,UAAM,gBAAgB,oBAAoB,KAAK,CAAC;AAChD,UAAM,aAAa,EAAE,SAAS;AAC9B,UAAM,SAAS,IAAI,SAAS,IAAI,2BAA2B,CAAC,KAAK;AAEjE,QAAI,QAAQ;AACV,UAAI,YAAY;AACd,cAAM,IAAI;AAAA,UACR,GAAG,MAAM,8BAA8B,EAAE,MAAM;AAAA,QAEjD;AAAA,MACF;AACA,UAAI,eAAe;AACjB,cAAM,IAAI;AAAA,UACR,GAAG,MAAM,+BAA+B,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,QAExD;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,iBAAiB,YAAY;AAC/B,cAAQ;AAAA,QACN,sBAAsB,OAAO,YAAY,CAAC;AAAA,MAE5C;AAAA,IACF;AAAA,EACF;AACF;;;AC7VO,SAAS,gBAAgB,OAA2B;AACzD,MAAI,IAAI;AACR,aAAW,KAAK,MAAO,MAAK,OAAO,aAAa,CAAC;AAMjD,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AAgBO,SAAS,mBAAmB,GAAW,GAAoB;AAChE,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EAAG,QAAO;AAE7C,QAAM,SAAS,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AAC1C,MAAI,OAAO,EAAE,SAAS,EAAE;AACxB,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAG/B,UAAM,KAAK,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI;AAC5C,UAAM,KAAK,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI;AAC5C,YAAQ,KAAK;AAAA,EACf;AACA,SAAO,SAAS;AAClB;;;ACbA,IAAM,eAAe;AACrB,IAAM,iBAAiB;AACvB,IAAM,oBAAmC;AAGzC,SAAS,aAAa,GAAuB;AAC3C,QAAM,WAAW;AAKjB,QAAM,QAAQ,EAAE,YAAY,EAAE,QAAQ,OAAO,EAAE,EAAE,QAAQ,QAAQ,EAAE;AACnE,MAAI,CAAC,cAAc,KAAK,KAAK,GAAG;AAC9B,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AACA,QAAM,OAAiB,CAAC;AACxB,aAAW,KAAK,OAAO;AACrB,UAAM,MAAM,SAAS,QAAQ,CAAC;AAC9B,aAAS,IAAI,GAAG,KAAK,GAAG,IAAK,MAAK,KAAM,OAAO,IAAK,CAAC;AAAA,EACvD;AAEA,QAAM,YAAY,KAAK,MAAM,KAAK,SAAS,CAAC;AAC5C,QAAM,MAAM,IAAI,WAAW,SAAS;AACpC,WAAS,IAAI,GAAG,IAAI,WAAW,KAAK;AAClC,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,GAAG,IAAK,KAAK,KAAK,IAAK,KAAK,IAAI,IAAI,CAAC;AACzD,QAAI,CAAC,IAAI;AAAA,EACX;AACA,SAAO;AACT;AAGA,SAAS,aAAa,OAA2B;AAC/C,QAAM,WAAW;AACjB,MAAI,MAAM;AACV,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,KAAK,OAAO;AACrB,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,aAAO,SAAU,UAAW,OAAO,IAAM,EAAI;AAC7C,cAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,EAAG,QAAO,SAAU,UAAW,IAAI,OAAS,EAAI;AAC3D,SAAO;AACT;AAEA,SAAS,gBAAgB,QAAyC;AAChE,MAAI,OAAO,WAAW,SAAU,QAAO,aAAa,MAAM;AAC1D,SAAO;AACT;AAGA,SAAS,aAAa,QAAgB,SAA6B;AACjE,QAAM,UAAU,KAAK,MAAM,SAAS,MAAO,OAAO;AAClD,QAAM,MAAM,IAAI,WAAW,CAAC;AAE5B,QAAM,KAAK,KAAK,MAAM,UAAU,UAAW;AAC3C,QAAM,KAAK,YAAY;AACvB,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,IAAK;AACtB,MAAI,CAAC,IAAI,KAAK;AACd,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,IAAK;AACtB,MAAI,CAAC,IAAI,KAAK;AACd,SAAO;AACT;AAEA,eAAe,KACb,QACA,SACA,WACqB;AACrB,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,MAAM,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,OAAuB;AACzE,SAAO,IAAI,WAAW,GAAG;AAC3B;AAGA,SAAS,SAAS,KAAiB,QAAwB;AACzD,QAAM,SAAS,IAAI,IAAI,SAAS,CAAC,IAAI;AACrC,QAAM,QACF,IAAI,MAAM,IAAI,QAAS,MACvB,IAAI,SAAS,CAAC,IAAI,QAAS,MAC3B,IAAI,SAAS,CAAC,IAAI,QAAS,IAC5B,IAAI,SAAS,CAAC,IAAI;AACrB,QAAM,MAAM,MAAM;AAClB,SAAO,OAAO,OAAO,GAAG,EAAE,SAAS,QAAQ,GAAG;AAChD;AAGA,eAAsB,aAAa,MAAoC;AACrE,QAAM,SAAS,gBAAgB,KAAK,MAAM;AAC1C,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,OAAO,KAAK,QAAQ,KAAK,IAAI;AACnC,QAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,MAAM,IAAI,GAAG,SAAS;AAClE,SAAO,SAAS,KAAK,MAAM;AAC7B;AAQA,eAAsB,WAAW,OAAe,MAA2C;AACzF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,MAAM,WAAW,OAAQ,QAAO;AAE5D,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,OAAO,KAAK,QAAQ,KAAK,IAAI;AACnC,QAAM,QAAQ,KAAK,UAAU;AAC7B,QAAM,SAAS,gBAAgB,KAAK,MAAM;AAG1C,MAAI,UAAU;AACd,WAAS,QAAQ,CAAC,OAAO,SAAS,OAAO,SAAS;AAChD,UAAM,IAAI,OAAO,QAAQ,OAAO;AAChC,UAAM,OAAO,SAAS,MAAM,KAAK,QAAQ,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM;AAClF,QAAI,mBAAmB,MAAM,KAAK,EAAG,WAAU;AAAA,EACjD;AACA,SAAO;AACT;AAGO,SAAS,mBAAmB,QAAQ,IAAgB;AACzD,MAAI,QAAQ,IAAI;AACd,UAAM,IAAI,MAAM,gEAA6D;AAAA,EAC/E;AACA,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,gBAAgB,GAAG;AAC1B,SAAO;AACT;AAgBO,SAAS,QAAQ,MAA8B;AACpD,QAAM,QAAQ,GAAG,KAAK,MAAM,IAAI,KAAK,OAAO;AAC5C,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,QAAQ,aAAa,KAAK,MAAM;AAAA,IAChC,QAAQ,KAAK;AAAA,IACb,WAAW,KAAK,aAAa;AAAA,IAC7B,QAAQ,OAAO,KAAK,UAAU,cAAc;AAAA,IAC5C,QAAQ,OAAO,KAAK,QAAQ,YAAY;AAAA,EAC1C,CAAC;AACD,SAAO,kBAAkB,mBAAmB,KAAK,CAAC,IAAI,OAAO,SAAS,CAAC;AACzE;;;ACtLA,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,iBAAiB;AAQvB,eAAsB,oBAAoB,OAA0B,CAAC,GAA0B;AAC7F,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,YAAY,KAAK,cAAc,SAAY,MAAM,KAAK;AAC5D,QAAM,WAAW,KAAK,YAAY;AAMlC,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,KAAK,QAAQ,KAAM;AAC1D,UAAM,IAAI;AAAA,MACR,mEAAmE,OAAO,KAAK,CAAC;AAAA,IAClF;AAAA,EACF;AACA,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,IAAI;AAC1D,UAAM,IAAI;AAAA,MACR,kEAAkE,OAAO,MAAM,CAAC;AAAA,IAClF;AAAA,EACF;AACA,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,IAAI;AAAA,MACR,6EAA6E,SAAS,MAAM;AAAA,IAC9F;AAAA,EACF;AAEA,QAAM,QAAsB,CAAC;AAC7B,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,MAAM,SAAS,OAAO;AAC3B,UAAM,MAAM,mBAAmB,QAAQ,QAAQ;AAC/C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,UAAM,YAAY,oBAAoB,KAAK,SAAS;AACpD,UAAM,OAAO,MAAM,UAAU,cAAc,SAAS,CAAC;AACrD,UAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAUA,eAAsB,iBACpB,MACA,QACmD;AACnD,QAAM,YAAY,MAAM,UAAU,cAAc,IAAI,CAAC;AACrD,MAAI;AAEJ,aAAW,KAAK,QAAQ;AACtB,QAAIA,oBAAmB,GAAG,SAAS,GAAG;AACpC,oBAAc;AAAA,IAChB;AAAA,EACF;AACA,SAAO,cAAc,EAAE,OAAO,MAAM,YAAY,IAAI,EAAE,OAAO,MAAM;AACrE;AAOA,SAAS,cAAc,OAAuB;AAC5C,SAAO,MAAM,YAAY,EAAE,QAAQ,WAAW,EAAE;AAClD;AAEA,SAAS,oBAAoB,KAAa,WAA+B;AACvE,MAAI,CAAC,aAAa,IAAI,SAAS,EAAG,QAAO;AACzC,QAAM,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC;AACrC,SAAO,IAAI,MAAM,GAAG,GAAG,IAAI,YAAY,IAAI,MAAM,GAAG;AACtD;AAEA,SAAS,mBAAmB,QAAgB,UAA0B;AACpE,QAAM,SAAS,IAAI,WAAW,MAAM;AACpC,SAAO,gBAAgB,MAAM;AAC7B,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC/B,WAAO,SAAS,OAAO,CAAC,IAAI,SAAS,MAAM;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,eAAe,UAAU,OAAgC;AACvD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK;AAC5C,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AACxD,SAAO,MAAM,KAAK,IAAI,WAAW,IAAI,CAAC,EACnC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEA,SAASA,oBAAmB,GAAW,GAAoB;AACzD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC3E,SAAO,SAAS;AAClB;;;ACjGA,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB,KAAK;AAOhC,eAAsB,cAAc,MAA+C;AACjF,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,QAAQ,MAAM,KAAK,MAAM,IAAI,KAAK,UAAU;AAClD,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,SAAS,MAAM,mBAAmB,YAAY;AAAA,EACzD;AACA,MAAI,MAAM,SAAS,aAAa;AAC9B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,mBAAmB;AAAA;AAAA,MAEnB,aAAa,IAAI,KAAK,MAAM,OAAO;AAAA,IACrC;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,mBAAmB,KAAK,IAAI,GAAG,cAAc,MAAM,KAAK;AAAA,EAC1D;AACF;AAWA,eAAsB,cACpB,MACA,SACwB;AACxB,QAAM,cAAc,KAAK,eAAe;AACxC,MAAI,SAAS;AACX,UAAM,KAAK,MAAM,MAAM,KAAK,UAAU;AACtC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,mBAAmB;AAAA,IACrB;AAAA,EACF;AACA,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,QAAQ,MAAM,KAAK,MAAM,KAAK,KAAK,YAAY,SAAS;AAE9D,MAAI,MAAM,SAAS,aAAa;AAC9B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,mBAAmB;AAAA,MACnB,aAAa,IAAI,KAAK,MAAM,OAAO;AAAA,IACrC;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,mBAAmB,KAAK,IAAI,GAAG,cAAc,MAAM,KAAK;AAAA,EAC1D;AACF;;;AClFA,eAAsB,0BAA0B,UAAmC;AACjF,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,QAAQ;AAC/C,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AACxD,SAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;AAC7C;AAWA,eAAsB,wBAAgD;AACpE,QAAM,SAAS,IAAI,WAAW,EAAE;AAChC,SAAO,gBAAgB,MAAM;AAC7B,QAAM,eAAe,gBAAgB,MAAM;AAC3C,QAAM,gBAAgB,MAAM,0BAA0B,YAAY;AAClE,SAAO,EAAE,cAAc,eAAe,qBAAqB,OAAO;AACpE;;;ACjCO,SAAS,mBAAmB,OAA2B,CAAC,GAAW;AACxE,QAAM,MAAM,KAAK,SAAS;AAC1B,QAAM,MAAM,IAAI,WAAW,GAAG;AAC9B,SAAO,gBAAgB,GAAG;AAC1B,SAAO,gBAAgB,GAAG;AAC5B;AASO,SAAS,iBAAiB,UAAkB,QAAyB;AAC1E,SAAO,mBAAmB,UAAU,MAAM;AAC5C;;;ACNA,IAAM,QAAQ,oBAAI,IAAmC;AAG9C,SAAS,iBAAuB;AACrC,QAAM,MAAM;AACd;AAEA,SAAS,WAAW,MAAuB;AACzC,SAAO,SAAS,eAAe,SAAS,eAAe,SAAS,WAAW,SAAS;AACtF;AAWA,eAAsB,qBAAqB,QAA6C;AACtF,QAAM,YAAY,OAAO,WAAW,WAAW,SAAS,OAAO,SAAS;AAExE,QAAM,MAAM,IAAI,IAAI,SAAS;AAC7B,MAAI,IAAI,aAAa,YAAY,CAAC,WAAW,IAAI,QAAQ,GAAG;AAC1D,UAAM,IAAI;AAAA,MACR,yCAAyC,IAAI,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAExE;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,IAAI,SAAS;AAClC,MAAI,OAAQ,QAAO;AAEnB,QAAM,WAAW,YAAY;AAC3B,UAAM,YAAY,IAAI;AAAA,MACpB;AAAA,MACA,UAAU,SAAS,GAAG,IAAI,YAAY,YAAY;AAAA,IACpD;AACA,UAAM,MAAM,MAAM,MAAM,SAAS;AACjC,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,IAAI,IAAI,UAAU,OAAO,SAAS,EAAE;AAAA,IAC1F;AACA,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,SAAS,wBAAwB;AACpC,YAAM,IAAI,MAAM,kFAA6E;AAAA,IAC/F;AACA,WAAO;AAAA,EACT,GAAG;AAEH,QAAM,IAAI,WAAW,OAAO;AAC5B,UAAQ,MAAM,MAAM;AAClB,QAAI,MAAM,IAAI,SAAS,MAAM,QAAS,OAAM,OAAO,SAAS;AAAA,EAC9D,CAAC;AACD,SAAO;AACT;","names":["constantTimeEquals"]}

package/dist/chunk-TSLSIRBR.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/security/csrf.ts"],"sourcesContent":["import type { IncomingMessage } from 'node:http'\n\nimport type { AuditLogger } from '../observability/audit-log.js'\nimport { safeAudit } from '../observability/audit-log.js'\n\n/**\n * CSRF enforcement mode.\n *\n * - `off`     — skip CSRF entirely. Use only when you have another defense\n *               (e.g. you don't ship session cookies, all auth is bearer).\n * - `warn`    — log a structured warning when the check would fail, but\n *               still serve the request. Default for 0.2.0. Migration mode.\n * - `strict`  — reject failing requests with 403 + code `CSRF_INVALID`.\n *               Will become the default in 0.3.0.\n */\nexport type CsrfMode = 'off' | 'warn' | 'strict'\n\n/**\n * Per-request structured logger surface. Only `warn` is used by enforceCsrf;\n * we don't require a full Logger here so callers can pass a mock or the\n * console directly.\n */\nexport interface CsrfLogger {\n  warn: (payload: CsrfWarnPayload) => void\n  /** Optional path the request was destined for — used for log correlation. */\n  path?: string\n}\n\n/**\n * T5.1 — Rails-inspired per-route escalation.\n *\n * `routes` accepts string (exact match) or RegExp entries. When a request\n * path matches AND the request would otherwise emit a warning, the\n * `behavior` field decides what happens:\n *\n *   - `'warn'`  → normal warn dispatch (no-op vs default)\n *   - `'raise'` → escalate to 403 regardless of global `csrf` mode\n *\n * `'raise'` never downgrades: when global mode is `'off'`, validation is\n * skipped entirely and disallowed dispatch never runs.\n */\nexport interface DisallowedConfig {\n  routes: (string | RegExp)[]\n  behavior: 'warn' | 'raise'\n}\n\n/**\n * Test whether `path` matches any of the supplied patterns. String\n * patterns are EXACT (trailing slash matters — use RegExp for tolerance).\n *\n * EC-5: when a RegExp carries the `/g` flag, `.test()` mutates\n * `lastIndex` and the next invocation may miss. We reset `lastIndex`\n * before each test so the matcher is a pure function.\n */\nexport function matchDisallowed(path: string, patterns: readonly (string | RegExp)[]): boolean {\n  for (const p of patterns) {\n    if (typeof p === 'string') {\n      if (path === p) return true\n    } else if (p instanceof RegExp) {\n      p.lastIndex = 0\n      if (p.test(path)) return true\n    }\n    // Neither string nor RegExp: ignore silently (defensive — the public\n    // type forbids it but runtime data may slip past).\n  }\n  return false\n}\n\n/**\n * T2.2 — Stable cutover identifier shipped with every csrf.warn payload.\n *\n * Convention borrowed from Vite's `deprecations.ts:74` — a `code` plus a\n * `docsUrl` lets users (a) grep their logs for a single stable identifier\n * to find every csrf.warn line, and (b) click through directly to the\n * migration guide. Strings are exported constants so the analyzer (T2.3)\n * and migration guide can reference the same source of truth.\n */\nexport const CSRF_WARN_CODE = 'CSRF_STRICT_CUTOVER' as const\nexport const CSRF_WARN_DOCS_URL = 'https://theokit.dev/upgrade/csrf-strict-cutover' as const\n\n/**\n * Pick a header value, choosing the first entry when an array (Node sets\n * arrays for headers that legitimately appear multiple times). Returns\n * `''` when the header is absent or empty — callers treat `''` as \"skip\".\n */\nfunction pickHeader(value: string | string[] | undefined): string {\n  if (typeof value === 'string') return value\n  if (Array.isArray(value) && value.length > 0) return value[0]\n  return ''\n}\n\nexport interface CsrfWarnPayload {\n  event: 'csrf.warn'\n  method: string\n  path: string | undefined\n  reason: string\n  /**\n   * Stable identifier for the 0.2 → 0.3 CSRF strict cutover. Always\n   * `'CSRF_STRICT_CUTOVER'`. Grep-able from prod logs.\n   */\n  code: string\n  /**\n   * Link to the section of the migration guide explaining how to clear\n   * this specific warning class.\n   */\n  docsUrl: string\n}\n\n/**\n * T5a.2 Phase B (slice 1/6): pure header-only CSRF check extracted from\n * `validateCsrf(req: IncomingMessage)` so it can be re-used by the Web-\n * Standards `validateCsrfRequest(request: Request)` sibling. Per the T5a.2\n * plan v1.0 § Phase B, header-only leaves are first to migrate. This is\n * the dual-signature pattern (anti-pattern #2 avoidance): IncomingMessage\n * consumers unchanged; new Request consumers go through the same logic\n * via the shared helper.\n *\n * Pure logic — accepts pre-extracted header values as strings or null.\n */\nfunction isCsrfValidFromHeaders(opts: {\n  csrfActionHeader: string | null\n  origin: string | null\n  host: string | null\n}): { valid: true } | { valid: false; reason: string } {\n  // 1. Custom header must be present (primary defense — simple form posts\n  //    cannot set custom headers, browsers gate via CORS preflight)\n  if (opts.csrfActionHeader !== '1') {\n    return { valid: false, reason: 'Missing X-Theo-Action header' }\n  }\n\n  // 2. Origin matching (secondary defense)\n  if (opts.origin === null || opts.origin === '') {\n    // Browsers omit Origin for same-origin requests — treat as valid\n    return { valid: true }\n  }\n\n  if (opts.host === null || opts.host === '') {\n    return { valid: true }\n  }\n\n  try {\n    const originHost = new URL(opts.origin).host\n    if (originHost !== opts.host) {\n      return { valid: false, reason: `Origin ${opts.origin} does not match host ${opts.host}` }\n    }\n  } catch {\n    return { valid: false, reason: `Invalid origin: ${opts.origin}` }\n  }\n\n  return { valid: true }\n}\n\nexport function validateCsrf(\n  req: IncomingMessage,\n): { valid: true } | { valid: false; reason: string } {\n  // IncomingMessage adapter — normalize Node header shape to the pure\n  // helper's input shape (string|null).\n  const action = req.headers['x-theo-action']\n  const origin = req.headers.origin\n  const host = req.headers.host\n  return isCsrfValidFromHeaders({\n    csrfActionHeader: typeof action === 'string' ? action : null,\n    origin: origin !== undefined ? pickHeader(origin) || null : null,\n    host: host !== undefined ? pickHeader(host) || null : null,\n  })\n}\n\n/**\n * T5a.2 Phase B (slice 1/6) — Web-Standards-shaped CSRF validator.\n *\n * Mirror of `validateCsrf(req: IncomingMessage)` for the Web `Request`\n * shape. Consumes `request.headers.get(name)` (native Web `Headers` API)\n * instead of `req.headers[name]` (Node `IncomingMessage` indexer). Same\n * CSRF policy + same return shape — the difference is only the input\n * extraction.\n *\n * Used by `executeWebRequest` (T5a.2 Phase A) to enforce CSRF on the\n * Web-Standards request handler entry-point.\n */\nexport function validateCsrfRequest(\n  request: Request,\n): { valid: true } | { valid: false; reason: string } {\n  return isCsrfValidFromHeaders({\n    csrfActionHeader: request.headers.get('x-theo-action'),\n    origin: request.headers.get('origin'),\n    host: request.headers.get('host'),\n  })\n}\n\n/**\n * Enforce CSRF policy with mode-aware behavior. Wrapper over `validateCsrf`\n * that turns the boolean valid/invalid into a request-level allow decision,\n * gated by mode + structured warning in warn mode.\n *\n * Phase 5 — CSRF warn-first (EC-1). See plan docs/plans/nextjs-maturity-plan.md.\n */\n/**\n * Dispatch the csrf.warn payload to both the structured logger and the\n * audit sink (when configured). Extracted from `enforceCsrf` to keep that\n * function's complexity within ceiling.\n */\nfunction dispatchCsrfWarn(\n  req: IncomingMessage,\n  reason: string,\n  logger: CsrfLogger | undefined,\n  auditLogger: AuditLogger | undefined,\n  pathFallback = '',\n): void {\n  const payload: CsrfWarnPayload = {\n    event: 'csrf.warn',\n    method: req.method ?? 'UNKNOWN',\n    path: logger?.path ?? pathFallback,\n    reason,\n    code: CSRF_WARN_CODE,\n    docsUrl: CSRF_WARN_DOCS_URL,\n  }\n  logger?.warn(payload)\n  // `metadata` is typed as Record<string, unknown>; CsrfWarnPayload is a\n  // structurally-equivalent shape but lacks the index signature.\n  safeAudit(auditLogger, {\n    action: 'csrf.warn',\n    actor: { type: 'anonymous' },\n    metadata: { ...payload },\n  })\n}\n\nexport function enforceCsrf(\n  req: IncomingMessage,\n  mode: CsrfMode,\n  logger?: CsrfLogger,\n  disallowed?: DisallowedConfig,\n  auditLogger?: AuditLogger,\n): { allow: boolean; reason?: string } {\n  if (mode === 'off') {\n    // `off` short-circuits before disallowed dispatch — users who set\n    // csrf: 'off' globally have explicitly turned validation off, and\n    // disallowed must never re-introduce it. The escape hatch is to\n    // set csrf: 'warn' and use disallowed for surgical strict pockets.\n    return { allow: true }\n  }\n\n  const check = validateCsrf(req)\n  if (check.valid) {\n    return { allow: true }\n  }\n\n  // T5.1 — disallowed dispatch: when the failing request matches a\n  // disallowed pattern AND behavior is 'raise', escalate to 403 even if\n  // global mode is 'warn'. Strict mode would 403 anyway, so the branch\n  // is a no-op there.\n  if (disallowed?.behavior === 'raise') {\n    const path = logger?.path ?? req.url ?? ''\n    if (matchDisallowed(path, disallowed.routes)) {\n      return { allow: false, reason: check.reason }\n    }\n  }\n\n  if (mode === 'warn') {\n    // T2.1: emit via warnOnce by default — callers can override via the\n    // injected logger.warn (tests, custom log routers).\n    // T2.2: include the stable cutover code + docsUrl so logs are\n    // grep-able and click-through-able.\n    dispatchCsrfWarn(req, check.reason, logger, auditLogger)\n    return { allow: true, reason: check.reason }\n  }\n\n  // strict — 403 the request, AND emit a warn payload so the dev (and\n  // devtools UI) sees WHY it was blocked + the docsUrl to fix it.\n  // Without this, strict-mode users get a silent 403 with no context.\n  dispatchCsrfWarn(req, check.reason, logger, auditLogger)\n  return { allow: false, reason: check.reason }\n}\n"],"mappings":";;;;;AAsDO,SAAS,gBAAgB,MAAc,UAAiD;AAC7F,aAAW,KAAK,UAAU;AACxB,QAAI,OAAO,MAAM,UAAU;AACzB,UAAI,SAAS,EAAG,QAAO;AAAA,IACzB,WAAW,aAAa,QAAQ;AAC9B,QAAE,YAAY;AACd,UAAI,EAAE,KAAK,IAAI,EAAG,QAAO;AAAA,IAC3B;AAAA,EAGF;AACA,SAAO;AACT;AAWO,IAAM,iBAAiB;AACvB,IAAM,qBAAqB;AAOlC,SAAS,WAAW,OAA8C;AAChE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,CAAC;AAC5D,SAAO;AACT;AA8BA,SAAS,uBAAuB,MAIuB;AAGrD,MAAI,KAAK,qBAAqB,KAAK;AACjC,WAAO,EAAE,OAAO,OAAO,QAAQ,+BAA+B;AAAA,EAChE;AAGA,MAAI,KAAK,WAAW,QAAQ,KAAK,WAAW,IAAI;AAE9C,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,MAAI,KAAK,SAAS,QAAQ,KAAK,SAAS,IAAI;AAC1C,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,MAAI;AACF,UAAM,aAAa,IAAI,IAAI,KAAK,MAAM,EAAE;AACxC,QAAI,eAAe,KAAK,MAAM;AAC5B,aAAO,EAAE,OAAO,OAAO,QAAQ,UAAU,KAAK,MAAM,wBAAwB,KAAK,IAAI,GAAG;AAAA,IAC1F;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB,KAAK,MAAM,GAAG;AAAA,EAClE;AAEA,SAAO,EAAE,OAAO,KAAK;AACvB;AAEO,SAAS,aACd,KACoD;AAGpD,QAAM,SAAS,IAAI,QAAQ,eAAe;AAC1C,QAAM,SAAS,IAAI,QAAQ;AAC3B,QAAM,OAAO,IAAI,QAAQ;AACzB,SAAO,uBAAuB;AAAA,IAC5B,kBAAkB,OAAO,WAAW,WAAW,SAAS;AAAA,IACxD,QAAQ,WAAW,SAAY,WAAW,MAAM,KAAK,OAAO;AAAA,IAC5D,MAAM,SAAS,SAAY,WAAW,IAAI,KAAK,OAAO;AAAA,EACxD,CAAC;AACH;AAcO,SAAS,oBACd,SACoD;AACpD,SAAO,uBAAuB;AAAA,IAC5B,kBAAkB,QAAQ,QAAQ,IAAI,eAAe;AAAA,IACrD,QAAQ,QAAQ,QAAQ,IAAI,QAAQ;AAAA,IACpC,MAAM,QAAQ,QAAQ,IAAI,MAAM;AAAA,EAClC,CAAC;AACH;AAcA,SAAS,iBACP,KACA,QACA,QACA,aACA,eAAe,IACT;AACN,QAAM,UAA2B;AAAA,IAC/B,OAAO;AAAA,IACP,QAAQ,IAAI,UAAU;AAAA,IACtB,MAAM,QAAQ,QAAQ;AAAA,IACtB;AAAA,IACA,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACA,UAAQ,KAAK,OAAO;AAGpB,YAAU,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,OAAO,EAAE,MAAM,YAAY;AAAA,IAC3B,UAAU,EAAE,GAAG,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,SAAS,YACd,KACA,MACA,QACA,YACA,aACqC;AACrC,MAAI,SAAS,OAAO;AAKlB,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,MAAM,OAAO;AACf,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAMA,MAAI,YAAY,aAAa,SAAS;AACpC,UAAM,OAAO,QAAQ,QAAQ,IAAI,OAAO;AACxC,QAAI,gBAAgB,MAAM,WAAW,MAAM,GAAG;AAC5C,aAAO,EAAE,OAAO,OAAO,QAAQ,MAAM,OAAO;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI,SAAS,QAAQ;AAKnB,qBAAiB,KAAK,MAAM,QAAQ,QAAQ,WAAW;AACvD,WAAO,EAAE,OAAO,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC7C;AAKA,mBAAiB,KAAK,MAAM,QAAQ,QAAQ,WAAW;AACvD,SAAO,EAAE,OAAO,OAAO,QAAQ,MAAM,OAAO;AAC9C;","names":[]}

package/dist/chunk-UD3LFGDL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/observability/audit-log.ts"],"sourcesContent":["/**\n * T4.1 — Audit logging interface + default JSON stdout sink.\n *\n * Per ADR D4: define the interface; ship a zero-dep default; reserve\n * adapter shapes for Postgres, File, OpenTelemetry, Sentry as follow-up\n * packages. Persistence has heavy deps (`pg`, `better-sqlite3`); we\n * keep core dep-free and let users opt in.\n *\n * Compatibility:\n *   - Node / Bun / Deno / Vercel — console.log is sync, captured.\n *   - Edge runtimes (CF Workers, Vercel Edge) — console.log is captured\n *     but may be rate-limited by the platform. For high-volume edge audit,\n *     implement a custom sink writing to a queue / HTTP endpoint.\n */\n\nexport interface AuditEvent {\n  /** Domain-qualified verb. Convention: `<domain>.<verb>` (e.g. csrf.warn, session.rotated). */\n  action: string\n  /** Who triggered the event. Anonymous = no auth at time of event. */\n  actor?: { type: 'user' | 'system' | 'anonymous'; id?: string }\n  /** What was operated on (optional). */\n  resource?: { type: string; id?: string }\n  /** Arbitrary event-specific metadata. JSON-serializable. */\n  metadata?: Record<string, unknown>\n  /** ISO 8601 timestamp. If absent, sink fills in `new Date().toISOString()`. */\n  timestamp?: string\n  /** Optional trace id (populated by middleware from `x-trace-id`). */\n  traceId?: string\n}\n\nexport interface AuditLogger {\n  log(event: AuditEvent): void | Promise<void>\n}\n\n/**\n * Default sink: one JSON line per event to stdout. Sync. Never throws.\n *\n * EC: circular refs / BigInt values fall back to a placeholder line so\n * the event is still observable (action + traceId) without crashing the\n * request lifecycle.\n */\nexport class JsonStdoutSink implements AuditLogger {\n  log(event: AuditEvent): void {\n    const enriched = {\n      level: 'audit' as const,\n      ...event,\n      timestamp: event.timestamp ?? new Date().toISOString(),\n    }\n    try {\n      // eslint-disable-next-line no-console -- JsonStdoutSink IS the audit output\n      console.log(JSON.stringify(enriched, jsonReplacer))\n    } catch {\n      // eslint-disable-next-line no-console -- fallback when payload won't serialize\n      console.log(\n        `{\"level\":\"audit\",\"action\":${JSON.stringify(event.action)},\"timestamp\":${JSON.stringify(enriched.timestamp)},\"note\":\"payload could not be serialized\"}`,\n      )\n    }\n  }\n}\n\n/**\n * Replacer that walks BigInt → string. Circular ref handling is via the\n * outer try/catch (JSON.stringify throws TypeError on cycles; we drop to\n * the fallback line). We don't implement custom cycle-breaking walker\n * because the audit payload is meant to be JSON — if user metadata has\n * a cycle, the right answer is to fix the caller, not silently lose\n * the structure.\n */\nfunction jsonReplacer(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') return value.toString()\n  return value\n}\n\n/**\n * No-op logger. Returned when `config.audit` is unset. Zero overhead;\n * framework wiring sites null-check before calling.\n */\nexport function createNoOpLogger(): AuditLogger {\n  return {\n    log() {\n      // intentionally empty\n    },\n  }\n}\n\n/**\n * T4.2 — Safe-emit wrapper. Used by framework wiring sites (csrf.ts,\n * rate-limit.ts, session.ts) so a logger throw NEVER propagates into\n * the request handler.\n */\nexport function safeAudit(logger: AuditLogger | undefined, event: AuditEvent): void {\n  if (!logger) return\n  try {\n    const r = logger.log(event)\n    // Discard the Promise — async sinks are fire-and-forget by design.\n    if (r && typeof r.then === 'function') {\n      r.catch(() => {\n        // swallow async sink failures — audit must never crash the request\n      })\n    }\n  } catch {\n    // swallow sync sink failures — audit must never crash the request\n  }\n}\n"],"mappings":";AAyCO,IAAM,iBAAN,MAA4C;AAAA,EACjD,IAAI,OAAyB;AAC3B,UAAM,WAAW;AAAA,MACf,OAAO;AAAA,MACP,GAAG;AAAA,MACH,WAAW,MAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACvD;AACA,QAAI;AAEF,cAAQ,IAAI,KAAK,UAAU,UAAU,YAAY,CAAC;AAAA,IACpD,QAAQ;AAEN,cAAQ;AAAA,QACN,6BAA6B,KAAK,UAAU,MAAM,MAAM,CAAC,gBAAgB,KAAK,UAAU,SAAS,SAAS,CAAC;AAAA,MAC7G;AAAA,IACF;AAAA,EACF;AACF;AAUA,SAAS,aAAa,MAAc,OAAyB;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,SAAS;AACrD,SAAO;AACT;AAMO,SAAS,mBAAgC;AAC9C,SAAO;AAAA,IACL,MAAM;AAAA,IAEN;AAAA,EACF;AACF;AAOO,SAAS,UAAU,QAAiC,OAAyB;AAClF,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,UAAM,IAAI,OAAO,IAAI,KAAK;AAE1B,QAAI,KAAK,OAAO,EAAE,SAAS,YAAY;AACrC,QAAE,MAAM,MAAM;AAAA,MAEd,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AAAA,EAER;AACF;","names":[]}