theokit 0.43.12 → 0.45.0

package/dist/chunk-EIRQM55C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/http/controller-dispatch.ts","../src/server/agent/mount-agent.ts","../src/server/agent/build-agent-streamer.ts","../src/server/agent/approval-registry.ts","../src/server/agent/durable-ui-message-stream-response.ts","../src/server/agent/run-event-cache.ts","../src/server/agent/provider-resolver.ts"],"mappings":";;;;;;;;;;;AAIA,SAAS,mBAAgC;AAEzC,SAAS,YAAY;AAErB,SAAS,wBAAwB,yBAA0C;AAyB3E,IAAM,yBAAyB,oBAAI,IAAI,CAAC,QAAQ,OAAO,SAAS,QAAQ,CAAC;AAQlE,SAAS,oBAAoB,KAAuB;AACzD,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,CAAC,YAA0B;AACtC,QAAI;AACJ,QAAI;AACF,gBAAU,YAAY,SAAS,EAAE,eAAe,KAAK,CAAC;AAAA,IACxD,QAAQ;AACN;AAAA,IACF;AACA,eAAW,SAAS,SAAS;AAC3B,YAAM,OAAO,KAAK,SAAS,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,EAAG,MAAK,IAAI;AAAA,eAKzB,MAAM,KAAK,SAAS,gBAAgB,KAAK,MAAM,KAAK,SAAS,iBAAiB;AACrF,cAAM,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,OAAK,GAAG;AACR,SAAO;AACT;AAyBA,eAAsB,sBACpB,gBACA,YAC6B;AAC7B,QAAM,QAAQ,oBAAoB,cAAc;AAChD,QAAM,UAA8B,CAAC;AACrC,aAAW,YAAY,OAAO;AAC5B,UAAM,MAAM,MAAM,WAAW,QAAQ;AACrC,eAAW,YAAY,OAAO,OAAO,GAAG,GAAG;AACzC,UAAI,OAAO,aAAa,cAAc,kBAAkB,QAAQ,GAAG;AACjE,gBAAQ,KAAK,EAAE,UAAU,KAAK,UAA6B,SAAS,IAAI,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,eAAe,gBACb,gBACA,YAC4B;AAC5B,QAAM,UAAU,MAAM,sBAAsB,gBAAgB,UAAU;AACtE,SAAO,QAAQ,IAAI,CAAC,MAAM,EAAE,GAAG;AACjC;AAUA,eAAsB,2BAA2B,MAKR;AACvC,QAAM,UAAU,MAAM,gBAAgB,KAAK,gBAAgB,KAAK,UAAU;AAC1E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,SAAS,uBAAuB,EAAE,aAAa,SAAS,YAAY,KAAK,WAAW,CAAC;AAC3F,SAAO;AAAA,IACL,UAAU,CAAC,YAAY,OAAO,OAAO;AAAA,IACrC,SAAS,CAAC,QAAQ,aAAa,OAAO,QAAQ,QAAQ,QAAQ;AAAA,EAChE;AACF;AAGA,eAAe,wBAAwB,KAAqB,UAAmC;AAC7F,QAAM,aAAqC,CAAC;AAC5C,aAAW,CAAC,GAAG,CAAC,KAAK,SAAS,SAAS;AACrC,QAAI,EAAE,YAAY,MAAM,aAAc,YAAW,CAAC,IAAI;AAAA,EACxD;AACA,QAAM,aAAa,SAAS,QAAQ,aAAa;AACjD,MAAI,WAAW,SAAS,EAAG,KAAI,UAAU,cAAc,UAAU;AACjE,MAAI,UAAU,SAAS,QAAQ,UAAU;AACzC,QAAM,OAAO,SAAS,OAAO,MAAM,SAAS,KAAK,IAAI;AACrD,MAAI,IAAI,QAAQ,MAAS;AAC3B;AAWA,eAAsB,0BAA0B,MAU3B;AACnB,QAAM,EAAE,KAAK,KAAK,UAAU,YAAY,UAAU,IAAI;AACtD,QAAM,aAAa,MAAM,2BAA2B;AAAA,IAClD,gBAAgB,KAAK;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,YAAY,KAAK;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,QAAM,aAAa,4BAA4B,GAAG;AAClD,QAAM,WAAW,IAAI,IAAI,WAAW,GAAG,EAAE;AAMzC,MAAI,uBAAuB,IAAI,MAAM,KAAK,WAAW,QAAQ,QAAQ,QAAQ,GAAG;AAC9E,UAAM,WAAW;AAAA,MACf;AAAA,MACA;AAAA,MACA,EAAE,MAAM,kBAAkB,MAAM,IAAI,IAAI;AAAA,MACxC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,OAAO;AACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA,SAAS,UAAU;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,WAAW,SAAS,UAAU;AACrD,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,wBAAwB,KAAK,QAAQ;AAC3C,SAAO;AACT;;;ACvMA,SAAS,sBAAAA,qBAAoB,wBAAAC,uBAAsB,yBAAAC,8BAA6B;;;ACJhF;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,OACK;;;AC6EP,IAAI;AACG,SAAS,sBAAwC;AACtD,qBAAmB,gCAAgC;AACnD,SAAO;AACT;AAEO,SAAS,kCAAoD;AAClE,QAAM,UAAU,oBAAI,IAAqB;AAEzC,SAAO;AAAA,IACL,SAAS,YAAY,MAAM;AACzB,aAAO,IAAI,QAA0B,CAAC,YAAY;AAChD,cAAM,SAAS,CAAC,aAAqC;AACnD,gBAAM,QAAQ,QAAQ,IAAI,UAAU;AACpC,cAAI,CAAC,MAAO;AACZ,uBAAa,MAAM,KAAK;AACxB,kBAAQ,OAAO,UAAU;AACzB,kBAAQ,QAAQ;AAAA,QAClB;AAEA,cAAM,QAAQ,WAAW,MAAM;AAC7B,iBAAO,EAAE,UAAU,KAAK,cAAc,UAAU,CAAC;AAAA,QACnD,GAAG,KAAK,SAAS;AACjB,cAAM,OAAwB;AAAA,UAC5B;AAAA,UACA,UAAU,KAAK;AAAA,UACf,UAAU,KAAK;AAAA,UACf,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,UAC7B,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,QAClF;AACA,gBAAQ,IAAI,YAAY,EAAE,QAAQ,OAAO,KAAK,CAAC;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,IACA,QAAQ,YAAY,UAAU;AAC5B,YAAM,QAAQ,QAAQ,IAAI,UAAU;AACpC,UAAI,CAAC,MAAO,QAAO;AAEnB,YAAM,OAAO,OAAO,aAAa,YAAY,EAAE,UAAU,SAAS,IAAI,QAAQ;AAC9E,aAAO;AAAA,IACT;AAAA,IACA,OAAO;AACL,aAAO,CAAC,GAAG,QAAQ,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAChD;AAAA,EACF;AACF;;;AD5GO,SAAS,eAAe,UAAoB;AACjD,QAAM,QAAQ,SAAS;AACvB,MAAI,UAAU,UAAa,MAAM,SAAS,EAAG,QAAO;AACpD,QAAMC,YAAW,oBAAoB;AACrC,SAAO;AAAA,IACL;AAAA,IACA,eAAe,CAAC,YAAoB,MAA6B,aAC/DA,UAAS,SAAS,YAAY;AAAA,MAC5B,WAAW,KAAK,WAAW;AAAA,MAC3B,WAAW,KAAK,aAAa;AAAA,MAC7B;AAAA,MACA,UAAU,KAAK;AAAA,MACf,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,IAClF,CAAC;AAAA,EACL;AACF;AAQO,SAAS,mBACd,KACA,QACA,QACuE;AACvE,SAAO,CAAC,WAAW,aAChB,mBAAmB;AAClB,UAAM,WAAW,mBAAmB,KAAK,MAAM;AAC/C,QAAI,SAAS,gBAAgB;AAC3B,YAAM,UAAU,MAAM;AAAA,QACpB,SAAS;AAAA,QACT,SAAS,cAAc,CAAC;AAAA,MAC1B;AACA,UAAI,YAAY,OAAW,UAAS,SAAS,EAAE,SAAS,YAAY,KAAK;AAAA,IAC3E;AACA,UAAM,OAAO,eAAe,QAAQ;AACpC,WAAO,sBAAsB,UAAU,QAAQ,EAAE,SAAS,WAAW,KAAK,CAAC;AAAA,EAC7E,GAAG;AACP;;;AE7CO,IAAM,mBAAmB;AAAA,EAC9B,gBAAgB;AAAA,EAChB,iCAAiC;AACnC;AAGO,IAAM,gBAAgB;AAEtB,IAAM,iBAAiB;AAGvB,SAAS,eAAe,KAAa,MAAsB;AAChE,SAAO,OAAO,GAAG;AAAA,QAAW,IAAI;AAAA;AAAA;AAClC;AAGO,SAAS,UAAU,MAA0B;AAClD,SAAO,IAAI,YAAY,EAAE,OAAO,IAAI;AACtC;AAOO,SAAS,+BACd,QACA,MACU;AACV,QAAM,EAAE,OAAO,MAAM,IAAI;AACzB,QAAM,SAAS,IAAI,eAA2B;AAAA,IAC5C,MAAM,MAAM,YAAY;AACtB,UAAI;AACF,yBAAiB,SAAS,QAAQ;AAChC,gBAAM,OAAO,KAAK,UAAU,KAAK;AACjC,gBAAM,MAAM,MAAM,OAAO,OAAO,IAAI;AACpC,qBAAW,QAAQ,UAAU,eAAe,KAAK,IAAI,CAAC,CAAC;AAAA,QACzD;AAAA,MACF,QAAQ;AAAA,MAIR,UAAE;AACA,cAAM,IAAI,KAAK;AACf,mBAAW,QAAQ,UAAU,cAAc,CAAC;AAC5C,mBAAW,MAAM;AAAA,MACnB;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO,IAAI,SAAS,QAAQ;AAAA,IAC1B,SAAS,EAAE,GAAG,kBAAkB,CAAC,aAAa,GAAG,MAAM;AAAA,EACzD,CAAC;AACH;;;ACIA,IAAM,yBAAyB,IAAI;AAEnC,IAAM,mBAAmB,MAAY;AAErC;AAOO,SAAS,4BAA4B,OAA6B,CAAC,GAAkB;AAC1F,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,OAAO,oBAAI,IAAuB;AAExC,WAAS,YAAY,OAA0B;AAC7C,QAAI,MAAM,KAAK,IAAI,KAAK;AACxB,QAAI,QAAQ,QAAW;AACrB,YAAM,EAAE,QAAQ,CAAC,GAAG,OAAO,OAAO,WAAW,oBAAI,IAAI,EAAE;AACvD,WAAK,IAAI,OAAO,GAAG;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,OAAO;AACX,kBAAY,KAAK;AAAA,IACnB;AAAA,IAEA,OAAO,OAAO,MAAM;AAClB,YAAM,MAAM,YAAY,KAAK;AAC7B,YAAM,MAAM,IAAI,OAAO;AACvB,YAAM,QAAqB,EAAE,KAAK,KAAK;AACvC,UAAI,OAAO,KAAK,KAAK;AAErB,iBAAW,KAAK,IAAI,WAAW;AAC7B,YAAI;AACF,YAAE,QAAQ,KAAK;AAAA,QACjB,QAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IAEA,IAAI,OAAO;AACT,aAAO,KAAK,IAAI,KAAK;AAAA,IACvB;AAAA,IAEA,IAAI,OAAO;AACT,YAAM,MAAM,KAAK,IAAI,KAAK;AAC1B,UAAI,QAAQ,UAAa,IAAI,MAAO;AACpC,UAAI,QAAQ;AACZ,iBAAW,KAAK,IAAI,WAAW;AAC7B,YAAI;AACF,YAAE,MAAM;AAAA,QACV,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI,UAAU,MAAM;AACpB,UAAI,aAAa,WAAW,MAAM,KAAK,OAAO,KAAK,GAAG,YAAY;AAElE,UAAI,WAAW,MAAM;AAAA,IACvB;AAAA,IAEA,OAAO,OAAO,UAAU,SAAS,OAAO;AACtC,YAAM,MAAM,KAAK,IAAI,KAAK;AAC1B,UAAI,QAAQ,QAAW;AACrB,eAAO,EAAE,OAAO,OAAO,QAAQ,CAAC,GAAG,OAAO,OAAO,aAAa,iBAAiB;AAAA,MACjF;AAGA,YAAM,SAAS,IAAI,OAAO,OAAO,CAAC,MAAM,EAAE,MAAM,QAAQ;AACxD,UAAI,IAAI,OAAO;AACb,eAAO,EAAE,OAAO,MAAM,QAAQ,OAAO,MAAM,aAAa,iBAAiB;AAAA,MAC3E;AACA,YAAM,WAAqB,EAAE,SAAS,MAAM;AAC5C,UAAI,UAAU,IAAI,QAAQ;AAC1B,aAAO;AAAA,QACL,OAAO;AAAA,QACP;AAAA,QACA,OAAO;AAAA,QACP,aAAa,MAAM;AACjB,cAAI,UAAU,OAAO,QAAQ;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAQA,IAAI;AACG,SAAS,mBAAkC;AAChD,kBAAgB,4BAA4B;AAC5C,SAAO;AACT;AAGO,SAAS,YAAoB;AAClC,SAAO,OAAO,OAAO,WAAW,CAAC;AACnC;;;AJ7JA,SAAS,SAAS,MAAuB;AACvC,MAAI,OAAO,SAAS,YAAY,SAAS,KAAM,QAAO;AACtD,QAAM,IAAI;AACV,SAAO,EAAE,SAAS,UAAU,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AACpE;AAEA,SAAS,UAAU,QAAgB,MAAc,SAA2B;AAC1E,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,EAAE,MAAM,QAAQ,EAAE,CAAC,GAAG;AAAA,IAChE;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAMO,SAAS,sBAAsB,MAAyC;AAC7E,MAAI,OAAO,SAAS,YAAY,SAAS,KAAM,QAAO;AACtD,QAAM,IAAI;AAGV,MAAI,MAAM,QAAQ,EAAE,QAAQ,KAAK,EAAE,SAAS,SAAS,GAAG;AACtD,UAAM,OAAO,EAAE,SAAS,EAAE,SAAS,SAAS,CAAC;AAC7C,UAAM,QAAQ,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AACxD,UAAM,OAAO,MAAM,IAAI,QAAQ,EAAE,KAAK,EAAE;AACxC,QAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,UAAM,YAAY,OAAO,EAAE,OAAO,YAAY,EAAE,GAAG,SAAS,IAAI,EAAE,KAAK,OAAO,WAAW;AACzF,WAAO,EAAE,SAAS,MAAM,UAAU;AAAA,EACpC;AAGA,MAAI,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,SAAS,GAAG;AACzD,UAAM,YACJ,OAAO,EAAE,cAAc,YAAY,EAAE,UAAU,SAAS,IAAI,EAAE,YAAY,OAAO,WAAW;AAC9F,WAAO,EAAE,SAAS,EAAE,SAAS,UAAU;AAAA,EACzC;AAEA,SAAO;AACT;AAmBA,eAAsB,WACpB,KACA,SACA,QACA,EAAE,SAAS,gBAAgB,WAAW,UAAU,YAAY,IAAuB,CAAC,GACjE;AAKnB,MAAI,aAAa,OAAO;AACtB,UAAM,OAAO,oBAAoB,OAAO;AACxC,QAAI,CAAC,KAAK,SAAS,aAAa,UAAU;AACxC,aAAO,UAAU,KAAK,eAAe,sBAAsB,KAAK,MAAM,EAAE;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,WAAWC,oBAAmB,KAAK,MAAM;AAK/C,MAAI,SAAS,gBAAgB;AAC3B,UAAM,UAAU,MAAMC,sBAAqB,SAAS,gBAAgB,SAAS,cAAc,CAAC,CAAC;AAC7F,QAAI,YAAY,OAAW,UAAS,SAAS,EAAE,SAAS,YAAY,KAAK;AAAA,EAC3E;AAEA,MAAI,OAAgB;AACpB,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,EAC5B,QAAQ;AAAA,EAER;AAEA,QAAM,QAAQ,sBAAsB,IAAI;AACxC,MAAI,UAAU,MAAM;AAClB,WAAO,UAAU,KAAK,eAAe,yDAAyD;AAAA,EAChG;AAMA,QAAM,OAAO,eAAe,QAAQ;AAMpC,QAAM,QAAQ,UAAU;AACxB,SAAO;AAAA,IACLC,uBAAsB,UAAU,QAAQ;AAAA,MACtC,GAAG;AAAA,MACH;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB,KAAK,oBAAoB,UAAU,WAAW;AAAA,MAC9C,SAAS,sBAAsB,WAAW;AAAA,IAC5C,CAAC;AAAA,IACD,EAAE,OAAO,OAAO,iBAAiB,EAAE;AAAA,EACrC;AACF;AAOA,SAAS,oBACP,UACA,aACoB;AACpB,QAAM,WAAW,SAAS,gBAAgB,UAAU,KAAK;AACzD,SAAO,gBAAgB,UAAa,UAAU,cAAc;AAC9D;AAGA,SAAS,oBAAoB,OAAuB;AAClD,MAAI,MAAM,MAAM;AAChB,SAAO,MAAM,KAAK,MAAM,MAAM,CAAC,MAAM,IAAK,QAAO;AACjD,SAAO,MAAM,MAAM,GAAG,GAAG;AAC3B;AASO,SAAS,sBAAsB,aAAqD;AACzF,MAAI,gBAAgB,OAAW,QAAO;AAKtC,SAAO,GAAG,oBAAoB,WAAW,CAAC;AAC5C;;;AK3HA,IAAM,mBAAyC;AAAA,EAC7C;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AACF;AAMA,IAAM,WAAiC,CAAC,GAAG,gBAAgB;AAkDpD,SAAS,kBAAoC;AAClD,QAAM,SAAS,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AACnE,aAAW,QAAQ,QAAQ;AACzB,UAAM,SAAS,QAAQ,IAAI,KAAK,MAAM;AACtC,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,aAAO;AAAA,QACL,MAAM,KAAK;AAAA,QACX;AAAA,QACA,SAAS,KAAK;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,MAAM;AACvD,QAAM,IAAI;AAAA,IACR,6DAA6D,OAAO;AAAA,EAEtE;AACF;","names":["compileAgentModule","resolveEnabledSkills","streamAgentUIMessages","registry","compileAgentModule","resolveEnabledSkills","streamAgentUIMessages"]}

package/dist/{chunk-ZEGYW52B.js → chunk-FB2HBNIC.js}

@@ -23,4 +23,4 @@ function scanMiddlewares(serverDir) {
 export {
   scanMiddlewares
 };
-//# sourceMappingURL=chunk-ZEGYW52B.js.map
+//# sourceMappingURL=chunk-FB2HBNIC.js.map

package/dist/chunk-FB2HBNIC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/scan/middleware-scan.ts"],"mappings":";AAIA,SAAS,aAAa,YAAY,gBAAgB;AAClD,SAAS,MAAM,eAAe;AAE9B,IAAM,gBAAgB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AASrD,SAAS,gBAAgB,WAA6B;AAC3D,QAAM,QAAQ,KAAK,WAAW,YAAY;AAC1C,MAAI,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,KAAK,EAAE,YAAY,GAAG;AACxD,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAU,YAAY,OAAO,EAAE,eAAe,KAAK,CAAC;AAC1D,QAAM,QAAkB,CAAC;AAEzB,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,OAAO,EAAG;AACrB,QAAI,MAAM,KAAK,WAAW,GAAG,KAAK,MAAM,KAAK,WAAW,GAAG,EAAG;AAC9D,UAAM,MAAM,QAAQ,MAAM,IAAI;AAC9B,QAAI,CAAC,cAAc,IAAI,GAAG,EAAG;AAC7B,UAAM,KAAK,KAAK,OAAO,MAAM,IAAI,CAAC;AAAA,EACpC;AAIA,QAAM,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACvC,SAAO;AACT;","names":[]}

package/dist/chunk-FXZZS7YW.js

@@ -0,0 +1,605 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/server/body-parser.ts
+import { basename } from "path";
+import Busboy from "busboy";
+var METHODS_WITH_BODY = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
+var DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
+var DEFAULT_MAX_FILES = 10;
+var DEFAULT_MAX_FIELD_SIZE = 1 * 1024 * 1024;
+var FileTooLargeError = class extends Error {
+  constructor(message, truncatedFilenames, maxFileSize) {
+    super(message);
+    this.truncatedFilenames = truncatedFilenames;
+    this.maxFileSize = maxFileSize;
+    this.name = "FileTooLargeError";
+  }
+  truncatedFilenames;
+  maxFileSize;
+  code = "FILE_TOO_LARGE";
+  status = 413;
+};
+function stashBodyPreview(req, body) {
+  try {
+    ;
+    req[DEVTOOLS_BODY_PREVIEW] = body;
+  } catch {
+  }
+}
+function parseJsonBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString();
+      if (!raw) {
+        resolve(void 0);
+        return;
+      }
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        reject(new Error("Invalid JSON body"));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+function parseMultipartBody(req, contentType, options) {
+  if (!contentType.includes("boundary=")) {
+    return Promise.reject(new Error("Missing multipart boundary"));
+  }
+  return new Promise((resolve, reject) => {
+    const fields = {};
+    const files = [];
+    const truncatedFilenames = [];
+    let fileCount = 0;
+    const bb = Busboy({
+      headers: req.headers,
+      limits: {
+        fileSize: options.maxFileSize,
+        files: options.maxFiles,
+        fieldSize: options.maxFieldSize
+      }
+    });
+    bb.on("field", (name, value) => {
+      fields[name] = value;
+    });
+    bb.on(
+      "file",
+      (fieldname, stream, info) => {
+        fileCount++;
+        if (fileCount > options.maxFiles) {
+          stream.resume();
+          return;
+        }
+        const safeName = basename(info.filename || "unnamed");
+        const chunks = [];
+        let size = 0;
+        let truncated = false;
+        stream.on("data", (chunk) => {
+          size += chunk.length;
+          if (size > options.maxFileSize) {
+            truncated = true;
+            stream.resume();
+            return;
+          }
+          chunks.push(chunk);
+        });
+        stream.on("end", () => {
+          if (truncated) {
+            truncatedFilenames.push(safeName);
+            return;
+          }
+          const buffer = Buffer.concat(chunks);
+          files.push({
+            fieldname,
+            filename: safeName,
+            encoding: info.encoding,
+            mimeType: info.mimeType,
+            buffer,
+            size: buffer.length
+          });
+        });
+      }
+    );
+    bb.on("filesLimit", () => {
+      reject(new Error(`Too many files. Maximum: ${options.maxFiles}`));
+    });
+    bb.on("error", (err) => {
+      reject(err);
+    });
+    bb.on("close", () => {
+      if (truncatedFilenames.length > 0) {
+        reject(
+          new FileTooLargeError(
+            `File too large (max ${options.maxFileSize} bytes): ${truncatedFilenames.join(", ")}`,
+            truncatedFilenames,
+            options.maxFileSize
+          )
+        );
+        return;
+      }
+      resolve({ fields, files });
+    });
+    req.pipe(bb);
+  });
+}
+var DEVTOOLS_BODY_PREVIEW = /* @__PURE__ */ Symbol("theo:devtools:bodyPreview");
+async function parseRequestBody(req, options) {
+  const method = req.method?.toUpperCase() ?? "GET";
+  if (!METHODS_WITH_BODY.has(method)) {
+    return { fields: {}, files: [], json: void 0 };
+  }
+  const contentType = req.headers["content-type"] ?? "";
+  if (contentType.includes("application/json")) {
+    const json = await parseJsonBody(req);
+    stashBodyPreview(req, json);
+    return { fields: {}, files: [], json };
+  }
+  if (contentType.includes("multipart/form-data")) {
+    const limits = {
+      maxFileSize: options?.maxFileSize ?? DEFAULT_MAX_FILE_SIZE,
+      maxFiles: options?.maxFiles ?? DEFAULT_MAX_FILES,
+      maxFieldSize: options?.maxFieldSize ?? DEFAULT_MAX_FIELD_SIZE
+    };
+    const { fields, files } = await parseMultipartBody(req, contentType, limits);
+    stashBodyPreview(req, {
+      fields,
+      files: files.map((f) => ({
+        fieldname: f.fieldname,
+        filename: f.filename,
+        mimeType: f.mimeType,
+        size: f.size
+      }))
+    });
+    return { fields, files };
+  }
+  if (!contentType) {
+    return { fields: {}, files: [] };
+  }
+  throw new Error(`Unsupported Content-Type: ${contentType}`);
+}
+
+// src/server/observability/request-log.ts
+var defaultLoggerFn = (log) => {
+  console.log(JSON.stringify(log));
+};
+function logRequest(info, customLogger, req) {
+  const log = {
+    level: "info",
+    ...info,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const logger = customLogger ?? defaultLoggerFn;
+  logger(log);
+  broadcastRequestToDevtools(info, req);
+}
+function randomRequestId() {
+  return `req-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function broadcastToDevtoolsCore(info, headers, stashedBody) {
+  void Promise.all([
+    import("./broadcast-LUMOJIJT.js"),
+    import("./build-request-body-preview-XPZ2GYMG.js")
+  ]).then(([{ broadcastRequest }, { buildRequestBodyPreview }]) => {
+    const bodyInfo = buildRequestBodyPreview(stashedBody);
+    broadcastRequest({
+      id: randomRequestId(),
+      traceId: info.requestId,
+      method: info.method,
+      path: info.url,
+      status: info.status,
+      durationMs: info.duration,
+      startedAt: Date.now() - info.duration,
+      ...headers ? { headers } : {},
+      ...bodyInfo ? {
+        bodyPreview: bodyInfo.preview,
+        bodyLength: bodyInfo.length,
+        bodyTruncated: bodyInfo.truncated
+      } : {}
+    });
+  }).catch(() => {
+  });
+}
+function broadcastRequestToDevtools(info, req) {
+  const headers = req?.headers ? Object.fromEntries(
+    Object.entries(req.headers).map(([k, v]) => [
+      k,
+      Array.isArray(v) ? v.join(", ") : v ?? ""
+    ])
+  ) : void 0;
+  const stashedBody = req ? req[DEVTOOLS_BODY_PREVIEW] : void 0;
+  broadcastToDevtoolsCore(info, headers, stashedBody);
+}
+
+// src/server/observability/logger.ts
+var _warnOnceSeen = /* @__PURE__ */ new Set();
+var MAX_SEEN = 1024;
+function warnOnce(key, payload) {
+  if (_warnOnceSeen.has(key)) return;
+  if (_warnOnceSeen.size >= MAX_SEEN) {
+    const oldest = _warnOnceSeen.values().next().value;
+    if (oldest !== void 0) _warnOnceSeen.delete(oldest);
+  }
+  _warnOnceSeen.add(key);
+  let line;
+  try {
+    line = JSON.stringify({ ...payload, warnOnce: true });
+  } catch {
+    line = `[warnOnce] ${key} \u2014 (payload could not be serialized)`;
+  }
+  console.warn(line);
+  broadcastWarnOnceToDevtools(key, payload);
+}
+function payloadField(payload, key, fallback = "") {
+  const value = payload[key];
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return fallback;
+}
+function randomDevtoolsId() {
+  return `warn-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function broadcastWarnOnceToDevtools(key, payload) {
+  void import("./broadcast-LUMOJIJT.js").then(({ broadcastCsrfWarn, broadcastError }) => {
+    if (payload.event === "csrf.warn" && typeof payload.code === "string" && typeof payload.docsUrl === "string") {
+      broadcastCsrfWarn({
+        event: "csrf.warn",
+        code: payload.code,
+        docsUrl: payload.docsUrl,
+        method: payloadField(payload, "method"),
+        path: payloadField(payload, "path"),
+        reason: payloadField(payload, "reason")
+      });
+    } else {
+      broadcastError({
+        id: randomDevtoolsId(),
+        type: "console",
+        message: payloadField(payload, "event", key),
+        timestamp: Date.now()
+      });
+    }
+  }).catch(() => {
+  });
+}
+
+// src/server/http/send-response.ts
+function sendJson(res, data, status = 200, transformer) {
+  const body = transformer ? transformer.serialize(data) : JSON.stringify(data);
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Content-Length": Buffer.byteLength(body)
+  });
+  res.end(body);
+}
+function sendError(res, codeOrInput, message, status, issues, requestId, options) {
+  let code;
+  if (typeof codeOrInput === "string") {
+    code = codeOrInput;
+    message = message ?? "";
+    status = status ?? 500;
+  } else {
+    code = codeOrInput.code;
+    message = codeOrInput.message;
+    status = codeOrInput.status;
+    issues = codeOrInput.issues;
+    requestId = codeOrInput.requestId;
+    options = codeOrInput.options;
+  }
+  const errorMessage = code === "INTERNAL_ERROR" && process.env.NODE_ENV === "production" ? "Internal server error" : message;
+  if (code === "INTERNAL_ERROR") {
+    console.error(`[${requestId ?? "no-id"}] ${message}`);
+  }
+  if (status === 404 && options?.custom404Html) {
+    const body = options.custom404Html;
+    res.writeHead(404, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Content-Length": Buffer.byteLength(body)
+    });
+    res.end(body);
+    return;
+  }
+  if (status === 500 && options?.custom500Html) {
+    const body = options.custom500Html;
+    res.writeHead(500, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Content-Length": Buffer.byteLength(body)
+    });
+    res.end(body);
+    return;
+  }
+  sendJson(
+    res,
+    {
+      error: {
+        code,
+        message: errorMessage,
+        ...requestId ? { requestId } : {},
+        ...issues ? { issues } : {}
+      }
+    },
+    status
+  );
+}
+
+// src/server/http/node-request.ts
+import { Readable } from "stream";
+function pickHeaderString(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) {
+    for (const v of value) if (typeof v === "string" && v.length > 0) return v;
+  }
+  return void 0;
+}
+function synthesizeAbsoluteUrl(req) {
+  const host = pickHeaderString(req.headers.host) ?? "localhost";
+  return `http://${host}${req.url ?? "/"}`;
+}
+function nodeHeadersToWeb(req) {
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (value === void 0) continue;
+    if (Array.isArray(value)) {
+      headers.set(key, value.join(", "));
+    } else {
+      headers.set(key, value);
+    }
+  }
+  return headers;
+}
+function incomingMessageToWebRequest(req) {
+  const url = synthesizeAbsoluteUrl(req);
+  const headers = nodeHeadersToWeb(req);
+  const method = (req.method ?? "GET").toUpperCase();
+  const hasBody = method !== "GET" && method !== "HEAD";
+  if (!hasBody) {
+    return new Request(url, { method, headers });
+  }
+  const webStream = Readable.toWeb(req);
+  return new Request(url, {
+    method,
+    headers,
+    body: webStream,
+    // EC-2: Node 18+ requires `duplex: 'half'` when body is a stream.
+    // The `RequestInit` type omits it (Web spec gap); cast accordingly.
+    ...{ duplex: "half" }
+  });
+}
+function incomingMessageToHandlerRequest(req) {
+  return new Request(synthesizeAbsoluteUrl(req), {
+    method: (req.method ?? "GET").toUpperCase(),
+    headers: nodeHeadersToWeb(req)
+  });
+}
+
+// src/server/http/controller-dispatch.ts
+import { readdirSync } from "fs";
+import { join } from "path";
+import { createDecoratorHandler, isControllerClass } from "@theokit/http";
+
+// src/server/security/csrf-warn-dispatch.ts
+function dispatchCsrfWarn(payload) {
+  const key = `${payload.event}:${payload.method}:${payload.path ?? ""}`;
+  warnOnce(key, payload);
+}
+
+// src/server/observability/audit-log.ts
+function safeAudit(logger, event) {
+  if (!logger) return;
+  try {
+    const r = logger.log(event);
+    if (r && typeof r.then === "function") {
+      r.catch(() => {
+      });
+    }
+  } catch {
+  }
+}
+
+// src/server/security/csrf.ts
+function matchDisallowed(path, patterns) {
+  for (const p of patterns) {
+    if (typeof p === "string") {
+      if (path === p) return true;
+    } else if (p instanceof RegExp) {
+      p.lastIndex = 0;
+      if (p.test(path)) return true;
+    }
+  }
+  return false;
+}
+var CSRF_WARN_CODE = "CSRF_STRICT_CUTOVER";
+var CSRF_WARN_DOCS_URL = "https://theokit.dev/upgrade/csrf-strict-cutover";
+function pickHeader(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.length > 0) return value[0];
+  return "";
+}
+function isCsrfValidFromHeaders(opts) {
+  if (opts.csrfActionHeader !== "1") {
+    return { valid: false, reason: "Missing X-Theo-Action header" };
+  }
+  if (opts.origin === null || opts.origin === "") {
+    return { valid: true };
+  }
+  if (opts.host === null || opts.host === "") {
+    return { valid: true };
+  }
+  try {
+    const originHost = new URL(opts.origin).host;
+    if (originHost !== opts.host) {
+      return { valid: false, reason: `Origin ${opts.origin} does not match host ${opts.host}` };
+    }
+  } catch {
+    return { valid: false, reason: `Invalid origin: ${opts.origin}` };
+  }
+  return { valid: true };
+}
+function validateCsrf(req) {
+  const action = req.headers["x-theo-action"];
+  const origin = req.headers.origin;
+  const host = req.headers.host;
+  return isCsrfValidFromHeaders({
+    csrfActionHeader: typeof action === "string" ? action : null,
+    origin: origin !== void 0 ? pickHeader(origin) || null : null,
+    host: host !== void 0 ? pickHeader(host) || null : null
+  });
+}
+function validateCsrfRequest(request) {
+  return isCsrfValidFromHeaders({
+    csrfActionHeader: request.headers.get("x-theo-action"),
+    origin: request.headers.get("origin"),
+    host: request.headers.get("host")
+  });
+}
+function dispatchCsrfWarn2(req, reason, logger, auditLogger, pathFallback = "") {
+  const payload = {
+    event: "csrf.warn",
+    method: req.method ?? "UNKNOWN",
+    path: logger?.path ?? pathFallback,
+    reason,
+    code: CSRF_WARN_CODE,
+    docsUrl: CSRF_WARN_DOCS_URL
+  };
+  logger?.warn(payload);
+  safeAudit(auditLogger, {
+    action: "csrf.warn",
+    actor: { type: "anonymous" },
+    metadata: { ...payload }
+  });
+}
+function enforceCsrf(req, mode, logger, disallowed, auditLogger) {
+  if (mode === "off") {
+    return { allow: true };
+  }
+  const check = validateCsrf(req);
+  if (check.valid) {
+    return { allow: true };
+  }
+  if (disallowed?.behavior === "raise") {
+    const path = logger?.path ?? req.url ?? "";
+    if (matchDisallowed(path, disallowed.routes)) {
+      return { allow: false, reason: check.reason };
+    }
+  }
+  if (mode === "warn") {
+    dispatchCsrfWarn2(req, check.reason, logger, auditLogger);
+    return { allow: true, reason: check.reason };
+  }
+  dispatchCsrfWarn2(req, check.reason, logger, auditLogger);
+  return { allow: false, reason: check.reason };
+}
+
+// src/server/http/controller-dispatch.ts
+var CSRF_PROTECTED_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function findControllerFiles(dir) {
+  const found = [];
+  const walk = (current) => {
+    let entries;
+    try {
+      entries = readdirSync(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = join(current, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.name.endsWith(".controller.ts") || entry.name.endsWith(".controller.mjs"))
+        found.push(full);
+    }
+  };
+  walk(dir);
+  return found;
+}
+async function scanControllerModules(controllersDir, loadModule) {
+  const files = findControllerFiles(controllersDir);
+  const modules = [];
+  for (const filePath of files) {
+    const mod = await loadModule(filePath);
+    for (const exported of Object.values(mod)) {
+      if (typeof exported === "function" && isControllerClass(exported)) {
+        modules.push({ filePath, cls: exported, exports: mod });
+      }
+    }
+  }
+  return modules;
+}
+async function scanControllers(controllersDir, loadModule) {
+  const modules = await scanControllerModules(controllersDir, loadModule);
+  return modules.map((m) => m.cls);
+}
+async function createControllerDispatcher(opts) {
+  const classes = await scanControllers(opts.controllersDir, opts.loadModule);
+  if (classes.length === 0) return null;
+  const handle = createDecoratorHandler({ controllers: classes, serveAgent: opts.serveAgent });
+  return {
+    dispatch: (request) => handle(request),
+    matches: (method, pathname) => handle.matches(method, pathname)
+  };
+}
+async function writeControllerResponse(res, response) {
+  const headersBag = {};
+  for (const [k, v] of response.headers) {
+    if (k.toLowerCase() !== "set-cookie") headersBag[k] = v;
+  }
+  const setCookies = response.headers.getSetCookie();
+  if (setCookies.length > 0) res.setHeader("Set-Cookie", setCookies);
+  res.writeHead(response.status, headersBag);
+  const body = response.body ? await response.text() : "";
+  res.end(body || void 0);
+}
+async function dispatchControllerRequest(args) {
+  const { req, res, csrfMode, disallowed, requestId } = args;
+  const dispatcher = await createControllerDispatcher({
+    controllersDir: args.controllersDir,
+    loadModule: args.loadModule,
+    serveAgent: args.serveAgent
+  });
+  if (!dispatcher) return false;
+  const method = (req.method ?? "GET").toUpperCase();
+  const webRequest = incomingMessageToWebRequest(req);
+  const pathname = new URL(webRequest.url).pathname;
+  if (CSRF_PROTECTED_METHODS.has(method) && dispatcher.matches(method, pathname)) {
+    const decision = enforceCsrf(
+      req,
+      csrfMode,
+      { warn: dispatchCsrfWarn, path: req.url },
+      disallowed
+    );
+    if (!decision.allow) {
+      sendError(
+        res,
+        "CSRF_INVALID",
+        decision.reason ?? "CSRF check failed",
+        403,
+        void 0,
+        requestId
+      );
+      return true;
+    }
+  }
+  const response = await dispatcher.dispatch(webRequest);
+  if (response === null) return false;
+  await writeControllerResponse(res, response);
+  return true;
+}
+
+export {
+  parseRequestBody,
+  logRequest,
+  warnOnce,
+  dispatchCsrfWarn,
+  safeAudit,
+  validateCsrfRequest,
+  enforceCsrf,
+  sendJson,
+  sendError,
+  incomingMessageToWebRequest,
+  incomingMessageToHandlerRequest,
+  findControllerFiles,
+  scanControllerModules,
+  dispatchControllerRequest
+};
+//# sourceMappingURL=chunk-FXZZS7YW.js.map