theokit 0.43.7 → 0.44.3

package/dist/chunk-FXZZS7YW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/body-parser.ts","../src/server/observability/request-log.ts","../src/server/observability/logger.ts","../src/server/http/send-response.ts","../src/server/http/node-request.ts","../src/server/http/controller-dispatch.ts","../src/server/security/csrf-warn-dispatch.ts","../src/server/observability/audit-log.ts","../src/server/security/csrf.ts"],"sourcesContent":["import type { IncomingMessage } from 'node:http'\nimport { basename } from 'node:path'\n\nimport Busboy from 'busboy'\n\n// --- Types ---\n\nexport interface UploadedFile {\n  fieldname: string\n  filename: string\n  encoding: string\n  mimeType: string\n  buffer: Buffer\n  size: number\n}\n\nexport interface ParsedBody {\n  fields: Record<string, string>\n  files: UploadedFile[]\n  json?: unknown\n}\n\nexport interface BodyParserOptions {\n  maxFileSize?: number // bytes, default 10MB\n  maxFiles?: number // default 10\n  maxFieldSize?: number // bytes, default 1MB\n}\n\nconst METHODS_WITH_BODY = new Set(['POST', 'PUT', 'PATCH'])\n\nconst DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024 // 10MB\nconst DEFAULT_MAX_FILES = 10\nconst DEFAULT_MAX_FIELD_SIZE = 1 * 1024 * 1024 // 1MB\n\nexport class FileTooLargeError extends Error {\n  readonly code = 'FILE_TOO_LARGE'\n  readonly status = 413\n  constructor(\n    message: string,\n    readonly truncatedFilenames: string[],\n    readonly maxFileSize: number,\n  ) {\n    super(message)\n    this.name = 'FileTooLargeError'\n  }\n}\n\n// --- JSON parsing ---\n\n/**\n * Stash the parsed body on the IncomingMessage for the devtools forwarder\n * to read at log time. Symbol-keyed so it never leaks into user-visible\n * surfaces. Best-effort — failures (e.g. frozen req) are swallowed.\n */\nfunction stashBodyPreview(req: IncomingMessage, body: unknown): void {\n  try {\n    ;(req as unknown as Record<symbol, unknown>)[DEVTOOLS_BODY_PREVIEW] = body\n  } catch {\n    // best-effort; never break the request\n  }\n}\n\nfunction parseJsonBody(req: IncomingMessage): Promise<unknown> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = []\n    req.on('data', (chunk: Buffer) => chunks.push(chunk))\n    req.on('end', () => {\n      const raw = Buffer.concat(chunks).toString()\n      if (!raw) {\n        resolve(undefined)\n        return\n      }\n      try {\n        resolve(JSON.parse(raw))\n      } catch {\n        reject(new Error('Invalid JSON body'))\n      }\n    })\n    req.on('error', reject)\n  })\n}\n\n// --- Multipart parsing ---\n\nfunction parseMultipartBody(\n  req: IncomingMessage,\n  contentType: string,\n  options: Required<Pick<BodyParserOptions, 'maxFileSize' | 'maxFiles' | 'maxFieldSize'>>,\n): Promise<{ fields: Record<string, string>; files: UploadedFile[] }> {\n  // EC-3: Validate boundary exists.\n  if (!contentType.includes('boundary=')) {\n    return Promise.reject(new Error('Missing multipart boundary'))\n  }\n\n  return new Promise((resolve, reject) => {\n    const fields: Record<string, string> = {}\n    const files: UploadedFile[] = []\n    // CR-010: track filenames that were truncated mid-stream. The previous\n    // implementation skipped truncated files from `files` and relied on\n    // `files.some(f => f.size > maxFileSize)` to detect — but since the\n    // file was never added, the guard never fired. Silent data loss.\n    const truncatedFilenames: string[] = []\n    let fileCount = 0\n\n    const bb = Busboy({\n      headers: req.headers,\n      limits: {\n        fileSize: options.maxFileSize,\n        files: options.maxFiles,\n        fieldSize: options.maxFieldSize,\n      },\n    })\n\n    bb.on('field', (name: string, value: string) => {\n      fields[name] = value\n    })\n\n    bb.on(\n      'file',\n      (\n        fieldname: string,\n        stream: NodeJS.ReadableStream,\n        info: { filename: string; encoding: string; mimeType: string },\n      ) => {\n        fileCount++\n        if (fileCount > options.maxFiles) {\n          stream.resume() // drain\n          return\n        }\n\n        // EC-6: Sanitize filename — basename only, no path traversal.\n        const safeName = basename(info.filename || 'unnamed')\n        const chunks: Buffer[] = []\n        let size = 0\n        let truncated = false\n\n        stream.on('data', (chunk: Buffer) => {\n          size += chunk.length\n          if (size > options.maxFileSize) {\n            truncated = true\n            stream.resume() // drain the rest\n            return\n          }\n          chunks.push(chunk)\n        })\n\n        stream.on('end', () => {\n          if (truncated) {\n            truncatedFilenames.push(safeName)\n            return\n          }\n\n          const buffer = Buffer.concat(chunks)\n          files.push({\n            fieldname,\n            filename: safeName,\n            encoding: info.encoding,\n            mimeType: info.mimeType,\n            buffer,\n            size: buffer.length,\n          })\n        })\n      },\n    )\n\n    bb.on('filesLimit', () => {\n      reject(new Error(`Too many files. Maximum: ${options.maxFiles}`))\n    })\n\n    bb.on('error', (err: Error) => {\n      reject(err)\n    })\n\n    bb.on('close', () => {\n      if (truncatedFilenames.length > 0) {\n        reject(\n          new FileTooLargeError(\n            `File too large (max ${options.maxFileSize} bytes): ${truncatedFilenames.join(', ')}`,\n            truncatedFilenames,\n            options.maxFileSize,\n          ),\n        )\n        return\n      }\n      resolve({ fields, files })\n    })\n\n    req.pipe(bb)\n  })\n}\n\n// --- Main parser ---\n\n/**\n * Symbol-keyed slot on IncomingMessage that the devtools request log\n * forwarder reads to enrich the broadcast payload with a body preview.\n * Symbol-keyed so it can't collide with user-land props and is invisible\n * to JSON.stringify / iteration. Always optional — readers must guard.\n */\nexport const DEVTOOLS_BODY_PREVIEW = Symbol('theo:devtools:bodyPreview')\n\nexport async function parseRequestBody(\n  req: IncomingMessage,\n  options?: BodyParserOptions,\n): Promise<ParsedBody> {\n  const method = req.method?.toUpperCase() ?? 'GET'\n  if (!METHODS_WITH_BODY.has(method)) {\n    return { fields: {}, files: [], json: undefined }\n  }\n\n  const contentType = req.headers['content-type'] ?? ''\n\n  // JSON\n  if (contentType.includes('application/json')) {\n    const json = await parseJsonBody(req)\n    stashBodyPreview(req, json)\n    return { fields: {}, files: [], json }\n  }\n\n  // Multipart\n  if (contentType.includes('multipart/form-data')) {\n    const limits = {\n      maxFileSize: options?.maxFileSize ?? DEFAULT_MAX_FILE_SIZE,\n      maxFiles: options?.maxFiles ?? DEFAULT_MAX_FILES,\n      maxFieldSize: options?.maxFieldSize ?? DEFAULT_MAX_FIELD_SIZE,\n    }\n    const { fields, files } = await parseMultipartBody(req, contentType, limits)\n    stashBodyPreview(req, {\n      fields,\n      files: files.map((f) => ({\n        fieldname: f.fieldname,\n        filename: f.filename,\n        mimeType: f.mimeType,\n        size: f.size,\n      })),\n    })\n    return { fields, files }\n  }\n\n  // No body or empty\n  if (!contentType) {\n    return { fields: {}, files: [] }\n  }\n\n  // Unsupported content type\n  throw new Error(`Unsupported Content-Type: ${contentType}`)\n}\n","/**\n * Request log primitive (T6.2 of architecture-review-remediation-plan).\n *\n * Split out from `logger.ts` per PV-12 (SRP) — the file previously mixed\n * 3 concerns (factory, warnOnce, request log). This module owns ONLY the\n * `logRequest` flow + the devtools broadcast best-effort forwarder.\n *\n * Public API surface is unchanged — `logger.ts` re-exports `logRequest`\n * + `RequestLog` + `LoggerFn` for backward compat.\n */\nimport type { IncomingMessage } from 'node:http'\n\nimport { DEVTOOLS_BODY_PREVIEW } from '../body-parser.js'\n\nexport interface RequestLog {\n  level: string\n  method: string\n  url: string\n  status: number\n  duration: number\n  requestId: string\n  timestamp: string\n}\n\nexport type LoggerFn = (log: RequestLog) => void\n\nconst defaultLoggerFn: LoggerFn = (log) => {\n  // eslint-disable-next-line no-console -- request-log default output IS the contract\n  console.log(JSON.stringify(log))\n}\n\nexport function logRequest(\n  info: Omit<RequestLog, 'level' | 'timestamp'>,\n  customLogger?: LoggerFn,\n  req?: IncomingMessage,\n): void {\n  const log: RequestLog = {\n    level: 'info',\n    ...info,\n    timestamp: new Date().toISOString(),\n  }\n  const logger = customLogger ?? defaultLoggerFn\n  logger(log)\n  // T2.1 — also broadcast to devtools (no-op in prod / when no dev server).\n  // Pass `req` so the devtools forwarder can extract headers + body preview\n  // stashed by body-parser (Symbol-keyed). Without `req`, only metadata\n  // (method/path/status/duration) reaches the devtools UI — the expanded\n  // row view then shows nothing useful.\n  broadcastRequestToDevtools(info, req)\n}\n\n/**\n * T2.1 — Forward a request record to the devtools UI. Lazy import keeps\n * this module dep-free for prod; broadcast.ts internally guards on\n * `globalThis.__theoViteHotServer`.\n */\nfunction randomRequestId(): string {\n  // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id for devtools UI\n  return `req-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`\n}\n\n/**\n * T5a.2 Phase C slice 2/2 — pure devtools broadcast that takes a\n * pre-extracted headers object + optional stashed body, so both\n * IncomingMessage and Web Request paths share the same dispatch logic.\n *\n * Errors here must not propagate — devtools forwarding is best-effort\n * and silenced.\n */\nfunction broadcastToDevtoolsCore(\n  info: Omit<RequestLog, 'level' | 'timestamp'>,\n  headers: Record<string, string> | undefined,\n  stashedBody: unknown,\n): void {\n  void Promise.all([\n    import('../../devtools/server-side/broadcast.js'),\n    import('../../devtools/server-side/build-request-body-preview.js'),\n  ])\n    .then(([{ broadcastRequest }, { buildRequestBodyPreview }]) => {\n      const bodyInfo = buildRequestBodyPreview(stashedBody)\n      broadcastRequest({\n        id: randomRequestId(),\n        traceId: info.requestId,\n        method: info.method,\n        path: info.url,\n        status: info.status,\n        durationMs: info.duration,\n        startedAt: Date.now() - info.duration,\n        ...(headers ? { headers } : {}),\n        ...(bodyInfo\n          ? {\n              bodyPreview: bodyInfo.preview,\n              bodyLength: bodyInfo.length,\n              bodyTruncated: bodyInfo.truncated,\n            }\n          : {}),\n      })\n    })\n    .catch(() => {\n      // No-op: devtools forwarding is best-effort.\n    })\n}\n\nfunction broadcastRequestToDevtools(\n  info: Omit<RequestLog, 'level' | 'timestamp'>,\n  req?: IncomingMessage,\n): void {\n  // T2.1 forwarder. Errors here must not propagate.\n  const headers = req?.headers\n    ? Object.fromEntries(\n        Object.entries(req.headers).map(([k, v]) => [\n          k,\n          Array.isArray(v) ? v.join(', ') : (v ?? ''),\n        ]),\n      )\n    : undefined\n  const stashedBody = req\n    ? (req as unknown as Record<symbol, unknown>)[DEVTOOLS_BODY_PREVIEW]\n    : undefined\n  broadcastToDevtoolsCore(info, headers, stashedBody)\n}\n\n/**\n * T5a.2 Phase C slice 2/2 — Web-Standards request log + devtools\n * forward. Mirror of `logRequest(info, logger?, req?: IncomingMessage)`\n * accepting `request?: Request`.\n *\n * Extracts headers via `request.headers.entries()` (Web `Headers`\n * iterator). Body preview stash is NOT yet supported on the Web path —\n * `body-parser-web.ts` doesn't yet stash like `body-parser.ts` does for\n * the IncomingMessage path. That hookup is Phase E scope (body parsing\n * migration). Until then, the devtools UI shows headers but no body\n * preview for Web-handled requests — same surface as the IncomingMessage\n * path before the stash convention shipped.\n */\nexport function logRequestFromRequest(\n  info: Omit<RequestLog, 'level' | 'timestamp'>,\n  customLogger?: LoggerFn,\n  request?: Request,\n): void {\n  const log: RequestLog = {\n    level: 'info',\n    ...info,\n    timestamp: new Date().toISOString(),\n  }\n  const logger = customLogger ?? defaultLoggerFn\n  logger(log)\n\n  let headers: Record<string, string> | undefined\n  if (request) {\n    headers = {}\n    for (const [k, v] of request.headers.entries()) {\n      headers[k] = v\n    }\n  }\n  // Phase E will add body-preview stash on Web Request; for now no stash.\n  broadcastToDevtoolsCore(info, headers, undefined)\n}\n","// --- Types ---\n\nexport type LogLevel = 'debug' | 'info' | 'warn' | 'error' | 'silent'\n\nexport interface StructuredLog {\n  level: string\n  msg: string\n  timestamp: string\n  [key: string]: unknown\n}\n\nexport interface TheoLogger {\n  debug(msg: string, context?: Record<string, unknown>): void\n  info(msg: string, context?: Record<string, unknown>): void\n  warn(msg: string, context?: Record<string, unknown>): void\n  error(msg: string, context?: Record<string, unknown>): void\n  child(context: Record<string, unknown>): TheoLogger\n}\n\n// --- Level filtering ---\n\nconst LEVEL_ORDER: Record<string, number> = {\n  debug: 0,\n  info: 1,\n  warn: 2,\n  error: 3,\n  silent: 4,\n}\n\nfunction shouldLog(msgLevel: string, configLevel: string): boolean {\n  return LEVEL_ORDER[msgLevel] >= LEVEL_ORDER[configLevel]\n}\n\n// --- Default output ---\n\nfunction defaultOutput(log: StructuredLog): void {\n  // eslint-disable-next-line no-console -- structured logger output IS the contract here\n  console.log(JSON.stringify(log))\n}\n\n// --- Factory ---\n\nexport function createLogger(options?: {\n  level?: LogLevel\n  output?: (log: StructuredLog) => void\n  context?: Record<string, unknown>\n}): TheoLogger {\n  const level = options?.level ?? 'info'\n  const output = options?.output ?? defaultOutput\n  const baseContext = options?.context ?? {}\n\n  function log(msgLevel: string, msg: string, context?: Record<string, unknown>): void {\n    if (!shouldLog(msgLevel, level)) return\n\n    const entry: StructuredLog = {\n      level: msgLevel,\n      msg,\n      timestamp: new Date().toISOString(),\n      ...baseContext,\n      ...context,\n    }\n\n    // Serialize Error objects to stack string\n    if (entry.error instanceof Error) {\n      entry.error = entry.error.stack ?? entry.error.message\n    }\n\n    output(entry)\n  }\n\n  return {\n    debug: (msg, ctx) => {\n      log('debug', msg, ctx)\n    },\n    info: (msg, ctx) => {\n      log('info', msg, ctx)\n    },\n    warn: (msg, ctx) => {\n      log('warn', msg, ctx)\n    },\n    error: (msg, ctx) => {\n      log('error', msg, ctx)\n    },\n    child(ctx) {\n      return createLogger({\n        level,\n        output,\n        context: { ...baseContext, ...ctx },\n      })\n    },\n  }\n}\n\n// --- warnOnce (T2.1) ---\n\n/**\n * Per-key dedup state. Module-scoped — reset per-process at boot.\n *\n * CR-011 fix: previous implementation used an unbounded `Set` which grew\n * forever in long-running prod processes with high-cardinality keys\n * (e.g. dynamic path segments). The bound below uses LRU-by-insertion:\n * when the Set hits `MAX_SEEN`, the OLDEST key is evicted. Subsequent\n * occurrences of that key will warn ONCE more — acceptable in exchange\n * for bounded memory.\n */\nconst _warnOnceSeen = new Set<string>()\nconst MAX_SEEN = 1024\n\n/**\n * Reset internal state. Test-only export — do not call from production.\n */\nexport function _resetWarnOnceForTests(): void {\n  _warnOnceSeen.clear()\n}\n\n/**\n * Emit a structured warning ONCE per key. Subsequent calls with the same\n * key are suppressed. Used for cutover-style warnings (e.g. CSRF warn)\n * that would otherwise flood logs under load.\n *\n * Convention: key is `<event>:<method>:<path>` — see callers in csrf.ts.\n *\n * EC-2: payload may contain circular references. Wrap `JSON.stringify`\n * in try/catch so a malformed payload doesn't crash the request handler.\n */\nexport function warnOnce(key: string, payload: Record<string, unknown>): void {\n  if (_warnOnceSeen.has(key)) return\n  // CR-011: bounded LRU. Evict oldest insertion when at capacity.\n  if (_warnOnceSeen.size >= MAX_SEEN) {\n    const oldest = _warnOnceSeen.values().next().value\n    if (oldest !== undefined) _warnOnceSeen.delete(oldest)\n  }\n  _warnOnceSeen.add(key)\n\n  let line: string\n  try {\n    line = JSON.stringify({ ...payload, warnOnce: true })\n  } catch {\n    // EC-2 fallback — preserve the key for grep-ability even when payload\n    // can't serialize (e.g., circular references, BigInt, etc.).\n    line = `[warnOnce] ${key} — (payload could not be serialized)`\n  }\n  console.warn(line)\n\n  // T2.1 — also broadcast to devtools (no-op in prod / when no dev server).\n  // Imported lazily to keep logger.ts dependency-free for non-dev contexts;\n  // broadcastToDevtools internally guards on globalThis.__theoViteHotServer.\n  broadcastWarnOnceToDevtools(key, payload)\n}\n\n/**\n * T2.1 — Forward a warnOnce payload to the devtools UI. Recognizes the\n * canonical CSRF warn shape and dispatches as 'csrf.warn'; otherwise\n * falls back to a generic 'error' broadcast.\n *\n * No-op when:\n *  - globalThis.__theoViteHotServer is undefined (prod / no dev server)\n *  - any error occurs (default-deny via broadcastToDevtools' try/catch)\n */\nfunction payloadField(payload: Record<string, unknown>, key: string, fallback = ''): string {\n  const value = payload[key]\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  return fallback\n}\n\nfunction randomDevtoolsId(): string {\n  // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id for devtools UI\n  return `warn-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`\n}\n\nfunction broadcastWarnOnceToDevtools(key: string, payload: Record<string, unknown>): void {\n  // CR-021: removed dead `void key` statement.\n  // T2.1 forwarder. Errors here must not propagate (default-deny).\n  void import('../../devtools/server-side/broadcast.js')\n    .then(({ broadcastCsrfWarn, broadcastError }) => {\n      if (\n        payload.event === 'csrf.warn' &&\n        typeof payload.code === 'string' &&\n        typeof payload.docsUrl === 'string'\n      ) {\n        broadcastCsrfWarn({\n          event: 'csrf.warn',\n          code: payload.code,\n          docsUrl: payload.docsUrl,\n          method: payloadField(payload, 'method'),\n          path: payloadField(payload, 'path'),\n          reason: payloadField(payload, 'reason'),\n        })\n      } else {\n        broadcastError({\n          id: randomDevtoolsId(),\n          type: 'console',\n          message: payloadField(payload, 'event', key),\n          timestamp: Date.now(),\n        })\n      }\n    })\n    .catch(() => {\n      // No-op: devtools forwarding is best-effort.\n    })\n}\n\n// --- Backward compat re-exports ---\n//\n// T6.2 (PV-12 SRP): `logRequest` + `RequestLog` + `LoggerFn` moved to a\n// dedicated `request-log.ts`. Re-exported here so consumers importing\n// from `theokit/server` see no change.\n\nexport { logRequest } from './request-log.js'\nexport type { RequestLog, LoggerFn } from './request-log.js'\n","import type { ServerResponse } from 'node:http'\n\nimport type { TheoTransformer } from '../transformer.js'\n\n/**\n * Canonical HTTP response helpers (T5.1 extraction).\n *\n * Moved out of execute.ts so request-pipeline stages (execute-stages.ts,\n * handle-request-error.ts, etc.) can depend on these helpers without\n * creating a cycle through execute.ts.\n *\n * Public surface re-exported from execute.ts for backward compat — every\n * existing caller of `sendError` / `sendJson` continues to work via the\n * `theokit/server` barrel.\n */\n\nexport function sendJson(\n  res: ServerResponse,\n  data: unknown,\n  status = 200,\n  transformer?: TheoTransformer,\n): void {\n  // T1.2 — transformer-aware serialization. Default (no transformer) uses\n  // JSON.stringify direct for backward compat.\n  const body = transformer ? transformer.serialize(data) : JSON.stringify(data)\n  res.writeHead(status, {\n    'Content-Type': 'application/json',\n    'Content-Length': Buffer.byteLength(body),\n  })\n  res.end(body)\n}\n\nexport interface SendErrorOptions {\n  custom404Html?: string\n  custom500Html?: string\n}\n\n/**\n * Canonical error response.\n *\n * T6.3 (PV-17): the positional 7-param signature is preserved for backward\n * compat. New call sites should use the options-bag form:\n *\n *   sendError(res, { code, message, status, issues?, requestId?, options? })\n *\n * Both shapes resolve to the same implementation.\n */\nexport interface SendErrorInput {\n  code: string\n  message: string\n  status: number\n  issues?: unknown[]\n  requestId?: string\n  options?: SendErrorOptions\n}\n\nexport function sendError(res: ServerResponse, input: SendErrorInput): void\n/* eslint-disable-next-line max-params -- T6.3: positional overload preserved\n   for backward compat (callers across cli/server still use positional). The\n   options-bag overload above is the recommended path. */\nexport function sendError(\n  res: ServerResponse,\n  code: string,\n  message: string,\n  status: number,\n  issues?: unknown[],\n  requestId?: string,\n  options?: SendErrorOptions,\n): void\n/* eslint-disable-next-line max-params, complexity -- delegates to two\n   surface overloads above; the branch density mirrors the back-compat\n   contract, not internal complexity. */\nexport function sendError(\n  res: ServerResponse,\n  codeOrInput: string | SendErrorInput,\n  message?: string,\n  status?: number,\n  issues?: unknown[],\n  requestId?: string,\n  options?: SendErrorOptions,\n): void {\n  let code: string\n  if (typeof codeOrInput === 'string') {\n    code = codeOrInput\n    message = message ?? ''\n    status = status ?? 500\n  } else {\n    code = codeOrInput.code\n    message = codeOrInput.message\n    status = codeOrInput.status\n    issues = codeOrInput.issues\n    requestId = codeOrInput.requestId\n    options = codeOrInput.options\n  }\n  const errorMessage =\n    code === 'INTERNAL_ERROR' && process.env.NODE_ENV === 'production'\n      ? 'Internal server error'\n      : message\n\n  if (code === 'INTERNAL_ERROR') {\n    console.error(`[${requestId ?? 'no-id'}] ${message}`)\n  }\n\n  if (status === 404 && options?.custom404Html) {\n    const body = options.custom404Html\n    res.writeHead(404, {\n      'Content-Type': 'text/html; charset=utf-8',\n      'Content-Length': Buffer.byteLength(body),\n    })\n    res.end(body)\n    return\n  }\n  if (status === 500 && options?.custom500Html) {\n    const body = options.custom500Html\n    res.writeHead(500, {\n      'Content-Type': 'text/html; charset=utf-8',\n      'Content-Length': Buffer.byteLength(body),\n    })\n    res.end(body)\n    return\n  }\n\n  sendJson(\n    res,\n    {\n      error: {\n        code,\n        message: errorMessage,\n        ...(requestId ? { requestId } : {}),\n        ...(issues ? { issues } : {}),\n      },\n    },\n    status,\n  )\n}\n\n/**\n * T5a.2 Phase G slice 4/N — Web-Standards response helpers.\n *\n * Mirror of `sendJson` + `sendError` for the Web `Request`/`Response`\n * shape. Returns a native `Response` directly instead of mutating a\n * `ServerResponse`.\n *\n * Per `docs/plans/t5a2-incoming-message-to-request-shape-refactor-plan.md`\n * v1.0 § Phase G.\n *\n * **Difference vs IncomingMessage path:**\n *   - No `Content-Length` set explicitly — the runtime computes it from\n *     the body when needed. CF Workers / Bun / Deno all do this; setting\n *     it manually risks conflict if the body is a stream rather than a\n *     fixed string.\n *   - Custom 404/500 HTML options preserved (same opts shape).\n *   - `requestId` flows into the response body's error envelope AND\n *     surfaces as `x-request-id` header (parity with handleWebRequestError\n *     Phase G slice 3/N).\n */\nexport function buildJsonResponse(\n  data: unknown,\n  status = 200,\n  transformer?: TheoTransformer,\n): Response {\n  const body = transformer ? transformer.serialize(data) : JSON.stringify(data)\n  return new Response(body, {\n    status,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\nexport function buildErrorResponse(input: SendErrorInput): Response {\n  const { code, message, status, issues, requestId, options } = input\n  const errorMessage =\n    code === 'INTERNAL_ERROR' && process.env.NODE_ENV === 'production'\n      ? 'Internal server error'\n      : message\n\n  if (code === 'INTERNAL_ERROR') {\n    console.error(`[${requestId ?? 'no-id'}] ${message}`)\n  }\n\n  const headers: Record<string, string> = {}\n  if (requestId !== undefined) headers['x-request-id'] = requestId\n\n  if (status === 404 && options?.custom404Html !== undefined) {\n    headers['content-type'] = 'text/html; charset=utf-8'\n    return new Response(options.custom404Html, { status: 404, headers })\n  }\n  if (status === 500 && options?.custom500Html !== undefined) {\n    headers['content-type'] = 'text/html; charset=utf-8'\n    return new Response(options.custom500Html, { status: 500, headers })\n  }\n\n  headers['content-type'] = 'application/json'\n  const body = JSON.stringify({\n    error: {\n      code,\n      message: errorMessage,\n      ...(requestId ? { requestId } : {}),\n      ...(issues ? { issues } : {}),\n    },\n  })\n  return new Response(body, { status, headers })\n}\n","/**\n * Pure Node `IncomingMessage` → Web `Request` converters.\n *\n * Kept free of any dependency on `web-handler.js` / `execute*.js` so the\n * executor (`execute.ts`) can build the handler-facing Web `Request` without\n * pulling the Web dispatch pipeline into its import graph (ADR-0028 R3a — the\n * Node adapter is the ONLY place IncomingMessage ↔ Request conversion lives;\n * these are the primitive converters it and the executor share).\n */\nimport type { IncomingMessage } from 'node:http'\nimport { Readable } from 'node:stream'\n\n/** Pick the first usable string from Node's `string | string[] | undefined` headers. */\nfunction pickHeaderString(value: string | string[] | undefined): string | undefined {\n  if (typeof value === 'string') return value\n  if (Array.isArray(value)) {\n    for (const v of value) if (typeof v === 'string' && v.length > 0) return v\n  }\n  return undefined\n}\n\n/** Web Request requires an absolute URL; synthesize one from the Host header. */\nfunction synthesizeAbsoluteUrl(req: IncomingMessage): string {\n  const host = pickHeaderString(req.headers.host) ?? 'localhost'\n  return `http://${host}${req.url ?? '/'}`\n}\n\n/**\n * Collapse Node's `string | string[]` headers into a Web `Headers`. Repeated\n * headers are comma-joined (not `.append`ed) because `Headers.append` creates\n * multi-value entries that behave differently on `.get()` (EC-1).\n */\nfunction nodeHeadersToWeb(req: IncomingMessage): Headers {\n  const headers = new Headers()\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (value === undefined) continue\n    if (Array.isArray(value)) {\n      headers.set(key, value.join(', '))\n    } else {\n      headers.set(key, value)\n    }\n  }\n  return headers\n}\n\n/**\n * Build a Web `Request` from a Node `IncomingMessage`, body included. The Web\n * Request spec requires an absolute URL; we synthesize one from the Host header\n * (fallback `localhost` for test doubles).\n *\n * For methods with a body (POST/PUT/PATCH/DELETE), the Node Readable stream is\n * wrapped as a Web ReadableStream via `Readable.toWeb()` so downstream consumers\n * can call `request.json()` / `request.formData()` / `request.text()` natively.\n */\nexport function incomingMessageToWebRequest(req: IncomingMessage): Request {\n  const url = synthesizeAbsoluteUrl(req)\n  const headers = nodeHeadersToWeb(req)\n\n  const method = (req.method ?? 'GET').toUpperCase()\n  const hasBody = method !== 'GET' && method !== 'HEAD'\n\n  if (!hasBody) {\n    return new Request(url, { method, headers })\n  }\n\n  // Drain Node's Readable into a Web ReadableStream. `Readable.toWeb` is\n  // available in Node 18+ (theokit's engines.node floor is 22+, so safe).\n  const webStream = Readable.toWeb(req) as ReadableStream\n  return new Request(url, {\n    method,\n    headers,\n    body: webStream,\n    // EC-2: Node 18+ requires `duplex: 'half'` when body is a stream.\n    // The `RequestInit` type omits it (Web spec gap); cast accordingly.\n    ...({ duplex: 'half' } as { duplex: 'half' }),\n  })\n}\n\n/**\n * Build the Web `Request` handed to a route handler as `ctx.request` in the\n * Node server path (dev + `theokit start`). Method + absolute URL + headers\n * only — NO body.\n *\n * Why no body: the Node executor parses the request body BEFORE the handler\n * runs and exposes the parsed value as `ctx.body` (the typed, documented body\n * API). By the time the handler is called the Node stream is already drained,\n * so re-wrapping it would yield an empty/closed stream. Handlers read the body\n * via `ctx.body`; `ctx.request` is for the Web-standard header/cookie/URL/method\n * surface (e.g. `createSessionManagerWeb.getSession(ctx.request)`).\n *\n * Per ADR-0028 R3a, handlers see a Web `Request` in every runtime — this closes\n * the gap where the Node path leaked the raw `IncomingMessage` (whose `.headers`\n * is a plain object, so `.headers.get(...)` threw for Web-standard consumers).\n */\nexport function incomingMessageToHandlerRequest(req: IncomingMessage): Request {\n  return new Request(synthesizeAbsoluteUrl(req), {\n    method: (req.method ?? 'GET').toUpperCase(),\n    headers: nodeHeadersToWeb(req),\n  })\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Controller files are walked from the developer's `serverDir/controllers`\n * (a build-time config path), never from HTTP input. No injection vector.\n */\nimport { readdirSync, type Dirent } from 'node:fs'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport { join } from 'node:path'\n\nimport { createDecoratorHandler, isControllerClass, type ServeAgent } from '@theokit/http'\n\nimport { dispatchCsrfWarn } from '../security/csrf-warn-dispatch.js'\nimport { enforceCsrf, type DisallowedConfig } from '../security/csrf.js'\n\nimport { incomingMessageToWebRequest } from './node-request.js'\nimport { sendError } from './send-response.js'\n\n/** A decorator controller constructor (`@Controller` class). */\ntype ControllerClass = new (...args: never[]) => object\n\n/** Loads a controller module by absolute path. In dev this is Vite's `ssrLoadModule`\n * (the Task 1.1 swc transform has already compiled the parameter decorators); tests\n * inject `@theokit/http`'s `loadControllerWithSwc`. */\nexport type ControllerModuleLoader = (absPath: string) => Promise<Record<string, unknown>>\n\n/** A built controller route table exposed as a pure Web-Standard handler. */\ninterface ControllerDispatcher {\n  /** `null` = no controller route matched — the host owns the miss (404 / fall-through). */\n  dispatch(request: Request): Promise<Response | null>\n  /** Non-executing route probe — true when a controller route owns `method` + `pathname`. */\n  matches(method: string, pathname: string): boolean\n}\n\n// State-mutating methods get CSRF, mirroring the file-route pipeline (execute.ts).\nconst CSRF_PROTECTED_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])\n\n/** Recursively collect `*.controller.ts` files under `dir` (absolute paths). */\n/**\n * Every `*.controller.ts` under `dir`, recursively. Exported for theokit#123: the build emitter\n * must find exactly the same set the dev dispatcher does, and two independent walks would be two\n * definitions of \"a controller\" that drift.\n */\nexport function findControllerFiles(dir: string): string[] {\n  const found: string[] = []\n  const walk = (current: string): void => {\n    let entries: Dirent[]\n    try {\n      entries = readdirSync(current, { withFileTypes: true })\n    } catch {\n      return // dir doesn't exist — no controllers\n    }\n    for (const entry of entries) {\n      const full = join(current, entry.name)\n      if (entry.isDirectory()) walk(full)\n      // theokit#123 — `.mjs` alongside `.ts`. Dev walks the SOURCE tree; production walks the\n      // COMPILED tree under `dist/controllers`, where the same files exist as `*.controller.mjs`.\n      // One walk for both keeps a single definition of \"a controller file\"; two would drift, and a\n      // file that counts in dev and not in production is exactly the dev/prod split this fixes.\n      else if (entry.name.endsWith('.controller.ts') || entry.name.endsWith('.controller.mjs'))\n        found.push(full)\n    }\n  }\n  walk(dir)\n  return found\n}\n\n/** A discovered controller: its source file + the loaded `@Controller` class. */\ninterface ControllerModule {\n  filePath: string\n  cls: ControllerClass\n  /**\n   * The module's full export namespace — theokit#124.\n   *\n   * Kept alongside the class because it is the ONLY place a `@Body(schema)` regains a name. The\n   * schema on `WalkResult.bodySchema` is a runtime `z.ZodType` with no source identifier, but it is\n   * the very object this module exported, so matching it back by reference identity recovers the\n   * exported name the typed-client codegen needs to write `z.infer<typeof ...>`.\n   *\n   * Unused by the dispatch path, which needs only the class.\n   */\n  exports: Readonly<Record<string, unknown>>\n}\n\n/**\n * Load every `@Controller` class under `controllersDir` via the injected loader,\n * keeping each class paired with its source file (needed by the typed-client\n * codegen to emit `import type { X } from '<file>'`). Non-controller exports are\n * ignored (`isControllerClass` — reused from @theokit/http).\n */\nexport async function scanControllerModules(\n  controllersDir: string,\n  loadModule: ControllerModuleLoader,\n): Promise<ControllerModule[]> {\n  const files = findControllerFiles(controllersDir)\n  const modules: ControllerModule[] = []\n  for (const filePath of files) {\n    const mod = await loadModule(filePath)\n    for (const exported of Object.values(mod)) {\n      if (typeof exported === 'function' && isControllerClass(exported)) {\n        modules.push({ filePath, cls: exported as ControllerClass, exports: mod })\n      }\n    }\n  }\n  return modules\n}\n\n/** Load every `@Controller` class under `controllersDir` (classes only). */\nasync function scanControllers(\n  controllersDir: string,\n  loadModule: ControllerModuleLoader,\n): Promise<ControllerClass[]> {\n  const modules = await scanControllerModules(controllersDir, loadModule)\n  return modules.map((m) => m.cls)\n}\n\n/**\n * Scan `controllersDir` and build a Web-Standard dispatcher over the decorator\n * controllers found. Returns `null` when the directory has no controllers, so\n * the host can skip the controller path entirely (zero cost for routes-only apps).\n *\n * Dispatch REUSES @theokit/http's `createDecoratorHandler` (match + `@Param`\n * binding + `@Body` validation + Response building) — never re-implemented (ADR-1).\n */\nexport async function createControllerDispatcher(opts: {\n  controllersDir: string\n  loadModule: ControllerModuleLoader\n  /** M47 — serves `@Expose`-bound agent routes (theo supplies a `mountAgent`-backed impl). */\n  serveAgent?: ServeAgent\n}): Promise<ControllerDispatcher | null> {\n  const classes = await scanControllers(opts.controllersDir, opts.loadModule)\n  if (classes.length === 0) return null\n  const handle = createDecoratorHandler({ controllers: classes, serveAgent: opts.serveAgent })\n  return {\n    dispatch: (request) => handle(request),\n    matches: (method, pathname) => handle.matches(method, pathname),\n  }\n}\n\n/** Write a buffered Web `Response` (controllers never stream) to a Node response. */\nasync function writeControllerResponse(res: ServerResponse, response: Response): Promise<void> {\n  const headersBag: Record<string, string> = {}\n  for (const [k, v] of response.headers) {\n    if (k.toLowerCase() !== 'set-cookie') headersBag[k] = v\n  }\n  const setCookies = response.headers.getSetCookie()\n  if (setCookies.length > 0) res.setHeader('Set-Cookie', setCookies)\n  res.writeHead(response.status, headersBag)\n  const body = response.body ? await response.text() : ''\n  res.end(body || undefined)\n}\n\n/**\n * The `api-middleware` fall-through in one call: scan `controllersDir`, build the\n * dispatcher, and serve the request. Builds a body-ful Web `Request` (`@Body`\n * needs the body; the raw stream is undrained at a route miss) and enforces CSRF\n * with the SAME gate file routes use (parity). Returns `true` when a controller\n * handled it (or CSRF blocked it), `false` when there are no controllers OR none\n * matched (the host continues to its own 404). Built per-miss so controller edits\n * reflect via HMR.\n */\nexport async function dispatchControllerRequest(args: {\n  controllersDir: string\n  loadModule: ControllerModuleLoader\n  req: IncomingMessage\n  res: ServerResponse\n  csrfMode: 'off' | 'warn' | 'strict'\n  disallowed?: DisallowedConfig\n  requestId: string\n  /** M47 — serves `@Expose`-bound agent routes (mountAgent-backed); omit for routes-only apps. */\n  serveAgent?: ServeAgent\n}): Promise<boolean> {\n  const { req, res, csrfMode, disallowed, requestId } = args\n  const dispatcher = await createControllerDispatcher({\n    controllersDir: args.controllersDir,\n    loadModule: args.loadModule,\n    serveAgent: args.serveAgent,\n  })\n  if (!dispatcher) return false\n\n  const method = (req.method ?? 'GET').toUpperCase()\n  const webRequest = incomingMessageToWebRequest(req)\n  const pathname = new URL(webRequest.url).pathname\n\n  // CSRF parity: enforce ONLY when a protected-method controller route actually\n  // owns this path (probe with the non-executing matcher — never double-dispatch,\n  // which would run the handler + its side effects). An unrouted path falls\n  // through to the host's own 404, not a 403.\n  if (CSRF_PROTECTED_METHODS.has(method) && dispatcher.matches(method, pathname)) {\n    const decision = enforceCsrf(\n      req,\n      csrfMode,\n      { warn: dispatchCsrfWarn, path: req.url },\n      disallowed,\n    )\n    if (!decision.allow) {\n      sendError(\n        res,\n        'CSRF_INVALID',\n        decision.reason ?? 'CSRF check failed',\n        403,\n        undefined,\n        requestId,\n      )\n      return true\n    }\n  }\n\n  const response = await dispatcher.dispatch(webRequest)\n  if (response === null) return false\n  await writeControllerResponse(res, response)\n  return true\n}\n","/**\n * Canonical CSRF warn dispatcher (T3.3 of architecture-review-remediation-plan).\n *\n * Consolidates the duplicated `warn: (payload) => { warnOnce(...) }` closure\n * that previously appeared in both `http/execute.ts` and\n * `http/action-execute.ts`. Resolves PV-10 (DRY).\n *\n * `warnOnce` dedupes by `event:method:path` so a request loop with 1000 POSTs\n * doesn't flood logs with identical warnings. Apps grep for `event\":\"csrf.warn\"`\n * (stable event shape — see [[enforcement-cutover.md]]).\n */\nimport { warnOnce } from '../observability/logger.js'\n\ninterface CsrfWarnPayload {\n  event: string\n  method: string\n  path?: string\n  reason: string\n  code?: string\n  docsUrl?: string\n  warnOnce?: boolean\n}\n\n/**\n * Build the warn callback that `enforceCsrf` invokes for soft-mode warnings.\n * Returned function is suitable for the `warn` field of `enforceCsrf`'s options.\n */\nexport function dispatchCsrfWarn(payload: CsrfWarnPayload): void {\n  const key = `${payload.event}:${payload.method}:${payload.path ?? ''}`\n  warnOnce(key, payload as unknown as Record<string, unknown>)\n}\n","/**\n * T4.1 — Audit logging interface + default JSON stdout sink.\n *\n * Per ADR D4: define the interface; ship a zero-dep default; reserve\n * adapter shapes for Postgres, File, OpenTelemetry, Sentry as follow-up\n * packages. Persistence has heavy deps (`pg`, `better-sqlite3`); we\n * keep core dep-free and let users opt in.\n *\n * Compatibility:\n *   - Node / Bun / Deno / Vercel — console.log is sync, captured.\n *   - Edge runtimes (CF Workers, Vercel Edge) — console.log is captured\n *     but may be rate-limited by the platform. For high-volume edge audit,\n *     implement a custom sink writing to a queue / HTTP endpoint.\n */\n\nexport interface AuditEvent {\n  /** Domain-qualified verb. Convention: `<domain>.<verb>` (e.g. csrf.warn, session.rotated). */\n  action: string\n  /** Who triggered the event. Anonymous = no auth at time of event. */\n  actor?: { type: 'user' | 'system' | 'anonymous'; id?: string }\n  /** What was operated on (optional). */\n  resource?: { type: string; id?: string }\n  /** Arbitrary event-specific metadata. JSON-serializable. */\n  metadata?: Record<string, unknown>\n  /** ISO 8601 timestamp. If absent, sink fills in `new Date().toISOString()`. */\n  timestamp?: string\n  /** Optional trace id (populated by middleware from `x-trace-id`). */\n  traceId?: string\n}\n\nexport interface AuditLogger {\n  log(event: AuditEvent): void | Promise<void>\n}\n\n/**\n * Default sink: one JSON line per event to stdout. Sync. Never throws.\n *\n * EC: circular refs / BigInt values fall back to a placeholder line so\n * the event is still observable (action + traceId) without crashing the\n * request lifecycle.\n */\nexport class JsonStdoutSink implements AuditLogger {\n  log(event: AuditEvent): void {\n    const enriched = {\n      level: 'audit' as const,\n      ...event,\n      timestamp: event.timestamp ?? new Date().toISOString(),\n    }\n    try {\n      // eslint-disable-next-line no-console -- JsonStdoutSink IS the audit output\n      console.log(JSON.stringify(enriched, jsonReplacer))\n    } catch {\n      // eslint-disable-next-line no-console -- fallback when payload won't serialize\n      console.log(\n        `{\"level\":\"audit\",\"action\":${JSON.stringify(event.action)},\"timestamp\":${JSON.stringify(enriched.timestamp)},\"note\":\"payload could not be serialized\"}`,\n      )\n    }\n  }\n}\n\n/**\n * Replacer that walks BigInt → string. Circular ref handling is via the\n * outer try/catch (JSON.stringify throws TypeError on cycles; we drop to\n * the fallback line). We don't implement custom cycle-breaking walker\n * because the audit payload is meant to be JSON — if user metadata has\n * a cycle, the right answer is to fix the caller, not silently lose\n * the structure.\n */\nfunction jsonReplacer(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') return value.toString()\n  return value\n}\n\n/**\n * No-op logger. Returned when `config.audit` is unset. Zero overhead;\n * framework wiring sites null-check before calling.\n */\nexport function createNoOpLogger(): AuditLogger {\n  return {\n    log() {\n      // intentionally empty\n    },\n  }\n}\n\n/**\n * T4.2 — Safe-emit wrapper. Used by framework wiring sites (csrf.ts,\n * rate-limit.ts, session.ts) so a logger throw NEVER propagates into\n * the request handler.\n */\nexport function safeAudit(logger: AuditLogger | undefined, event: AuditEvent): void {\n  if (!logger) return\n  try {\n    const r = logger.log(event)\n    // Discard the Promise — async sinks are fire-and-forget by design.\n    if (r && typeof r.then === 'function') {\n      r.catch(() => {\n        // swallow async sink failures — audit must never crash the request\n      })\n    }\n  } catch {\n    // swallow sync sink failures — audit must never crash the request\n  }\n}\n","import type { IncomingMessage } from 'node:http'\n\nimport type { AuditLogger } from '../observability/audit-log.js'\nimport { safeAudit } from '../observability/audit-log.js'\n\n/**\n * CSRF enforcement mode.\n *\n * - `off`     — skip CSRF entirely. Use only when you have another defense\n *               (e.g. you don't ship session cookies, all auth is bearer).\n * - `warn`    — log a structured warning when the check would fail, but\n *               still serve the request. Default for 0.2.0. Migration mode.\n * - `strict`  — reject failing requests with 403 + code `CSRF_INVALID`.\n *               Will become the default in 0.3.0.\n */\nexport type CsrfMode = 'off' | 'warn' | 'strict'\n\n/**\n * Per-request structured logger surface. Only `warn` is used by enforceCsrf;\n * we don't require a full Logger here so callers can pass a mock or the\n * console directly.\n */\nexport interface CsrfLogger {\n  warn: (payload: CsrfWarnPayload) => void\n  /** Optional path the request was destined for — used for log correlation. */\n  path?: string\n}\n\n/**\n * T5.1 — Rails-inspired per-route escalation.\n *\n * `routes` accepts string (exact match) or RegExp entries. When a request\n * path matches AND the request would otherwise emit a warning, the\n * `behavior` field decides what happens:\n *\n *   - `'warn'`  → normal warn dispatch (no-op vs default)\n *   - `'raise'` → escalate to 403 regardless of global `csrf` mode\n *\n * `'raise'` never downgrades: when global mode is `'off'`, validation is\n * skipped entirely and disallowed dispatch never runs.\n */\nexport interface DisallowedConfig {\n  routes: (string | RegExp)[]\n  behavior: 'warn' | 'raise'\n}\n\n/**\n * Test whether `path` matches any of the supplied patterns. String\n * patterns are EXACT (trailing slash matters — use RegExp for tolerance).\n *\n * EC-5: when a RegExp carries the `/g` flag, `.test()` mutates\n * `lastIndex` and the next invocation may miss. We reset `lastIndex`\n * before each test so the matcher is a pure function.\n */\nexport function matchDisallowed(path: string, patterns: readonly (string | RegExp)[]): boolean {\n  for (const p of patterns) {\n    if (typeof p === 'string') {\n      if (path === p) return true\n    } else if (p instanceof RegExp) {\n      p.lastIndex = 0\n      if (p.test(path)) return true\n    }\n    // Neither string nor RegExp: ignore silently (defensive — the public\n    // type forbids it but runtime data may slip past).\n  }\n  return false\n}\n\n/**\n * T2.2 — Stable cutover identifier shipped with every csrf.warn payload.\n *\n * Convention borrowed from Vite's `deprecations.ts:74` — a `code` plus a\n * `docsUrl` lets users (a) grep their logs for a single stable identifier\n * to find every csrf.warn line, and (b) click through directly to the\n * migration guide. Strings are exported constants so the analyzer (T2.3)\n * and migration guide can reference the same source of truth.\n */\nexport const CSRF_WARN_CODE = 'CSRF_STRICT_CUTOVER' as const\nexport const CSRF_WARN_DOCS_URL = 'https://theokit.dev/upgrade/csrf-strict-cutover' as const\n\n/**\n * Pick a header value, choosing the first entry when an array (Node sets\n * arrays for headers that legitimately appear multiple times). Returns\n * `''` when the header is absent or empty — callers treat `''` as \"skip\".\n */\nfunction pickHeader(value: string | string[] | undefined): string {\n  if (typeof value === 'string') return value\n  if (Array.isArray(value) && value.length > 0) return value[0]\n  return ''\n}\n\nexport interface CsrfWarnPayload {\n  event: 'csrf.warn'\n  method: string\n  path: string | undefined\n  reason: string\n  /**\n   * Stable identifier for the 0.2 → 0.3 CSRF strict cutover. Always\n   * `'CSRF_STRICT_CUTOVER'`. Grep-able from prod logs.\n   */\n  code: string\n  /**\n   * Link to the section of the migration guide explaining how to clear\n   * this specific warning class.\n   */\n  docsUrl: string\n}\n\n/**\n * T5a.2 Phase B (slice 1/6): pure header-only CSRF check extracted from\n * `validateCsrf(req: IncomingMessage)` so it can be re-used by the Web-\n * Standards `validateCsrfRequest(request: Request)` sibling. Per the T5a.2\n * plan v1.0 § Phase B, header-only leaves are first to migrate. This is\n * the dual-signature pattern (anti-pattern #2 avoidance): IncomingMessage\n * consumers unchanged; new Request consumers go through the same logic\n * via the shared helper.\n *\n * Pure logic — accepts pre-extracted header values as strings or null.\n */\nfunction isCsrfValidFromHeaders(opts: {\n  csrfActionHeader: string | null\n  origin: string | null\n  host: string | null\n}): { valid: true } | { valid: false; reason: string } {\n  // 1. Custom header must be present (primary defense — simple form posts\n  //    cannot set custom headers, browsers gate via CORS preflight)\n  if (opts.csrfActionHeader !== '1') {\n    return { valid: false, reason: 'Missing X-Theo-Action header' }\n  }\n\n  // 2. Origin matching (secondary defense)\n  if (opts.origin === null || opts.origin === '') {\n    // Browsers omit Origin for same-origin requests — treat as valid\n    return { valid: true }\n  }\n\n  if (opts.host === null || opts.host === '') {\n    return { valid: true }\n  }\n\n  try {\n    const originHost = new URL(opts.origin).host\n    if (originHost !== opts.host) {\n      return { valid: false, reason: `Origin ${opts.origin} does not match host ${opts.host}` }\n    }\n  } catch {\n    return { valid: false, reason: `Invalid origin: ${opts.origin}` }\n  }\n\n  return { valid: true }\n}\n\nexport function validateCsrf(\n  req: IncomingMessage,\n): { valid: true } | { valid: false; reason: string } {\n  // IncomingMessage adapter — normalize Node header shape to the pure\n  // helper's input shape (string|null).\n  const action = req.headers['x-theo-action']\n  const origin = req.headers.origin\n  const host = req.headers.host\n  return isCsrfValidFromHeaders({\n    csrfActionHeader: typeof action === 'string' ? action : null,\n    origin: origin !== undefined ? pickHeader(origin) || null : null,\n    host: host !== undefined ? pickHeader(host) || null : null,\n  })\n}\n\n/**\n * T5a.2 Phase B (slice 1/6) — Web-Standards-shaped CSRF validator.\n *\n * Mirror of `validateCsrf(req: IncomingMessage)` for the Web `Request`\n * shape. Consumes `request.headers.get(name)` (native Web `Headers` API)\n * instead of `req.headers[name]` (Node `IncomingMessage` indexer). Same\n * CSRF policy + same return shape — the difference is only the input\n * extraction.\n *\n * Used by `executeWebRequest` (T5a.2 Phase A) to enforce CSRF on the\n * Web-Standards request handler entry-point.\n */\nexport function validateCsrfRequest(\n  request: Request,\n): { valid: true } | { valid: false; reason: string } {\n  return isCsrfValidFromHeaders({\n    csrfActionHeader: request.headers.get('x-theo-action'),\n    origin: request.headers.get('origin'),\n    host: request.headers.get('host'),\n  })\n}\n\n/**\n * Enforce CSRF policy with mode-aware behavior. Wrapper over `validateCsrf`\n * that turns the boolean valid/invalid into a request-level allow decision,\n * gated by mode + structured warning in warn mode.\n *\n * Phase 5 — CSRF warn-first (EC-1). See plan docs/plans/nextjs-maturity-plan.md.\n */\n/**\n * Dispatch the csrf.warn payload to both the structured logger and the\n * audit sink (when configured). Extracted from `enforceCsrf` to keep that\n * function's complexity within ceiling.\n */\nfunction dispatchCsrfWarn(\n  req: IncomingMessage,\n  reason: string,\n  logger: CsrfLogger | undefined,\n  auditLogger: AuditLogger | undefined,\n  pathFallback = '',\n): void {\n  const payload: CsrfWarnPayload = {\n    event: 'csrf.warn',\n    method: req.method ?? 'UNKNOWN',\n    path: logger?.path ?? pathFallback,\n    reason,\n    code: CSRF_WARN_CODE,\n    docsUrl: CSRF_WARN_DOCS_URL,\n  }\n  logger?.warn(payload)\n  // `metadata` is typed as Record<string, unknown>; CsrfWarnPayload is a\n  // structurally-equivalent shape but lacks the index signature.\n  safeAudit(auditLogger, {\n    action: 'csrf.warn',\n    actor: { type: 'anonymous' },\n    metadata: { ...payload },\n  })\n}\n\nexport function enforceCsrf(\n  req: IncomingMessage,\n  mode: CsrfMode,\n  logger?: CsrfLogger,\n  disallowed?: DisallowedConfig,\n  auditLogger?: AuditLogger,\n): { allow: boolean; reason?: string } {\n  if (mode === 'off') {\n    // `off` short-circuits before disallowed dispatch — users who set\n    // csrf: 'off' globally have explicitly turned validation off, and\n    // disallowed must never re-introduce it. The escape hatch is to\n    // set csrf: 'warn' and use disallowed for surgical strict pockets.\n    return { allow: true }\n  }\n\n  const check = validateCsrf(req)\n  if (check.valid) {\n    return { allow: true }\n  }\n\n  // T5.1 — disallowed dispatch: when the failing request matches a\n  // disallowed pattern AND behavior is 'raise', escalate to 403 even if\n  // global mode is 'warn'. Strict mode would 403 anyway, so the branch\n  // is a no-op there.\n  if (disallowed?.behavior === 'raise') {\n    const path = logger?.path ?? req.url ?? ''\n    if (matchDisallowed(path, disallowed.routes)) {\n      return { allow: false, reason: check.reason }\n    }\n  }\n\n  if (mode === 'warn') {\n    // T2.1: emit via warnOnce by default — callers can override via the\n    // injected logger.warn (tests, custom log routers).\n    // T2.2: include the stable cutover code + docsUrl so logs are\n    // grep-able and click-through-able.\n    dispatchCsrfWarn(req, check.reason, logger, auditLogger)\n    return { allow: true, reason: check.reason }\n  }\n\n  // strict — 403 the request, AND emit a warn payload so the dev (and\n  // devtools UI) sees WHY it was blocked + the docsUrl to fix it.\n  // Without this, strict-mode users get a silent 403 with no context.\n  dispatchCsrfWarn(req, check.reason, logger, auditLogger)\n  return { allow: false, reason: check.reason }\n}\n"],"mappings":";;;;AACA,SAAS,gBAAgB;AAEzB,OAAO,YAAY;AAyBnB,IAAM,oBAAoB,oBAAI,IAAI,CAAC,QAAQ,OAAO,OAAO,CAAC;AAE1D,IAAM,wBAAwB,KAAK,OAAO;AAC1C,IAAM,oBAAoB;AAC1B,IAAM,yBAAyB,IAAI,OAAO;AAEnC,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAG3C,YACE,SACS,oBACA,aACT;AACA,UAAM,OAAO;AAHJ;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAAA,EACA;AAAA,EALF,OAAO;AAAA,EACP,SAAS;AASpB;AASA,SAAS,iBAAiB,KAAsB,MAAqB;AACnE,MAAI;AACF;AAAC,IAAC,IAA2C,qBAAqB,IAAI;AAAA,EACxE,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,cAAc,KAAwC;AAC7D,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,QAAI,GAAG,OAAO,MAAM;AAClB,YAAM,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS;AAC3C,UAAI,CAAC,KAAK;AACR,gBAAQ,MAAS;AACjB;AAAA,MACF;AACA,UAAI;AACF,gBAAQ,KAAK,MAAM,GAAG,CAAC;AAAA,MACzB,QAAQ;AACN,eAAO,IAAI,MAAM,mBAAmB,CAAC;AAAA,MACvC;AAAA,IACF,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAIA,SAAS,mBACP,KACA,aACA,SACoE;AAEpE,MAAI,CAAC,YAAY,SAAS,WAAW,GAAG;AACtC,WAAO,QAAQ,OAAO,IAAI,MAAM,4BAA4B,CAAC;AAAA,EAC/D;AAEA,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAiC,CAAC;AACxC,UAAM,QAAwB,CAAC;AAK/B,UAAM,qBAA+B,CAAC;AACtC,QAAI,YAAY;AAEhB,UAAM,KAAK,OAAO;AAAA,MAChB,SAAS,IAAI;AAAA,MACb,QAAQ;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,MACrB;AAAA,IACF,CAAC;AAED,OAAG,GAAG,SAAS,CAAC,MAAc,UAAkB;AAC9C,aAAO,IAAI,IAAI;AAAA,IACjB,CAAC;AAED,OAAG;AAAA,MACD;AAAA,MACA,CACE,WACA,QACA,SACG;AACH;AACA,YAAI,YAAY,QAAQ,UAAU;AAChC,iBAAO,OAAO;AACd;AAAA,QACF;AAGA,cAAM,WAAW,SAAS,KAAK,YAAY,SAAS;AACpD,cAAM,SAAmB,CAAC;AAC1B,YAAI,OAAO;AACX,YAAI,YAAY;AAEhB,eAAO,GAAG,QAAQ,CAAC,UAAkB;AACnC,kBAAQ,MAAM;AACd,cAAI,OAAO,QAAQ,aAAa;AAC9B,wBAAY;AACZ,mBAAO,OAAO;AACd;AAAA,UACF;AACA,iBAAO,KAAK,KAAK;AAAA,QACnB,CAAC;AAED,eAAO,GAAG,OAAO,MAAM;AACrB,cAAI,WAAW;AACb,+BAAmB,KAAK,QAAQ;AAChC;AAAA,UACF;AAEA,gBAAM,SAAS,OAAO,OAAO,MAAM;AACnC,gBAAM,KAAK;AAAA,YACT;AAAA,YACA,UAAU;AAAA,YACV,UAAU,KAAK;AAAA,YACf,UAAU,KAAK;AAAA,YACf;AAAA,YACA,MAAM,OAAO;AAAA,UACf,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AAEA,OAAG,GAAG,cAAc,MAAM;AACxB,aAAO,IAAI,MAAM,4BAA4B,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAClE,CAAC;AAED,OAAG,GAAG,SAAS,CAAC,QAAe;AAC7B,aAAO,GAAG;AAAA,IACZ,CAAC;AAED,OAAG,GAAG,SAAS,MAAM;AACnB,UAAI,mBAAmB,SAAS,GAAG;AACjC;AAAA,UACE,IAAI;AAAA,YACF,uBAAuB,QAAQ,WAAW,YAAY,mBAAmB,KAAK,IAAI,CAAC;AAAA,YACnF;AAAA,YACA,QAAQ;AAAA,UACV;AAAA,QACF;AACA;AAAA,MACF;AACA,cAAQ,EAAE,QAAQ,MAAM,CAAC;AAAA,IAC3B,CAAC;AAED,QAAI,KAAK,EAAE;AAAA,EACb,CAAC;AACH;AAUO,IAAM,wBAAwB,uBAAO,2BAA2B;AAEvE,eAAsB,iBACpB,KACA,SACqB;AACrB,QAAM,SAAS,IAAI,QAAQ,YAAY,KAAK;AAC5C,MAAI,CAAC,kBAAkB,IAAI,MAAM,GAAG;AAClC,WAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,GAAG,MAAM,OAAU;AAAA,EAClD;AAEA,QAAM,cAAc,IAAI,QAAQ,cAAc,KAAK;AAGnD,MAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,UAAM,OAAO,MAAM,cAAc,GAAG;AACpC,qBAAiB,KAAK,IAAI;AAC1B,WAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK;AAAA,EACvC;AAGA,MAAI,YAAY,SAAS,qBAAqB,GAAG;AAC/C,UAAM,SAAS;AAAA,MACb,aAAa,SAAS,eAAe;AAAA,MACrC,UAAU,SAAS,YAAY;AAAA,MAC/B,cAAc,SAAS,gBAAgB;AAAA,IACzC;AACA,UAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,mBAAmB,KAAK,aAAa,MAAM;AAC3E,qBAAiB,KAAK;AAAA,MACpB;AAAA,MACA,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,QACvB,WAAW,EAAE;AAAA,QACb,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,MAAM,EAAE;AAAA,MACV,EAAE;AAAA,IACJ,CAAC;AACD,WAAO,EAAE,QAAQ,MAAM;AAAA,EACzB;AAGA,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,EAAE;AAAA,EACjC;AAGA,QAAM,IAAI,MAAM,6BAA6B,WAAW,EAAE;AAC5D;;;AC5NA,IAAM,kBAA4B,CAAC,QAAQ;AAEzC,UAAQ,IAAI,KAAK,UAAU,GAAG,CAAC;AACjC;AAEO,SAAS,WACd,MACA,cACA,KACM;AACN,QAAM,MAAkB;AAAA,IACtB,OAAO;AAAA,IACP,GAAG;AAAA,IACH,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,SAAS,gBAAgB;AAC/B,SAAO,GAAG;AAMV,6BAA2B,MAAM,GAAG;AACtC;AAOA,SAAS,kBAA0B;AAEjC,SAAO,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAC5E;AAUA,SAAS,wBACP,MACA,SACA,aACM;AACN,OAAK,QAAQ,IAAI;AAAA,IACf,OAAO,yBAAyC;AAAA,IAChD,OAAO,0CAA0D;AAAA,EACnE,CAAC,EACE,KAAK,CAAC,CAAC,EAAE,iBAAiB,GAAG,EAAE,wBAAwB,CAAC,MAAM;AAC7D,UAAM,WAAW,wBAAwB,WAAW;AACpD,qBAAiB;AAAA,MACf,IAAI,gBAAgB;AAAA,MACpB,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,MAC7B,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7B,GAAI,WACA;AAAA,QACE,aAAa,SAAS;AAAA,QACtB,YAAY,SAAS;AAAA,QACrB,eAAe,SAAS;AAAA,MAC1B,IACA,CAAC;AAAA,IACP,CAAC;AAAA,EACH,CAAC,EACA,MAAM,MAAM;AAAA,EAEb,CAAC;AACL;AAEA,SAAS,2BACP,MACA,KACM;AAEN,QAAM,UAAU,KAAK,UACjB,OAAO;AAAA,IACL,OAAO,QAAQ,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM;AAAA,MAC1C;AAAA,MACA,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,IAAK,KAAK;AAAA,IAC1C,CAAC;AAAA,EACH,IACA;AACJ,QAAM,cAAc,MACf,IAA2C,qBAAqB,IACjE;AACJ,0BAAwB,MAAM,SAAS,WAAW;AACpD;;;ACfA,IAAM,gBAAgB,oBAAI,IAAY;AACtC,IAAM,WAAW;AAmBV,SAAS,SAAS,KAAa,SAAwC;AAC5E,MAAI,cAAc,IAAI,GAAG,EAAG;AAE5B,MAAI,cAAc,QAAQ,UAAU;AAClC,UAAM,SAAS,cAAc,OAAO,EAAE,KAAK,EAAE;AAC7C,QAAI,WAAW,OAAW,eAAc,OAAO,MAAM;AAAA,EACvD;AACA,gBAAc,IAAI,GAAG;AAErB,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,UAAU,EAAE,GAAG,SAAS,UAAU,KAAK,CAAC;AAAA,EACtD,QAAQ;AAGN,WAAO,cAAc,GAAG;AAAA,EAC1B;AACA,UAAQ,KAAK,IAAI;AAKjB,8BAA4B,KAAK,OAAO;AAC1C;AAWA,SAAS,aAAa,SAAkC,KAAa,WAAW,IAAY;AAC1F,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,SAAO;AACT;AAEA,SAAS,mBAA2B;AAElC,SAAO,QAAQ,OAAO,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAC7E;AAEA,SAAS,4BAA4B,KAAa,SAAwC;AAGxF,OAAK,OAAO,yBAAyC,EAClD,KAAK,CAAC,EAAE,mBAAmB,eAAe,MAAM;AAC/C,QACE,QAAQ,UAAU,eAClB,OAAO,QAAQ,SAAS,YACxB,OAAO,QAAQ,YAAY,UAC3B;AACA,wBAAkB;AAAA,QAChB,OAAO;AAAA,QACP,MAAM,QAAQ;AAAA,QACd,SAAS,QAAQ;AAAA,QACjB,QAAQ,aAAa,SAAS,QAAQ;AAAA,QACtC,MAAM,aAAa,SAAS,MAAM;AAAA,QAClC,QAAQ,aAAa,SAAS,QAAQ;AAAA,MACxC,CAAC;AAAA,IACH,OAAO;AACL,qBAAe;AAAA,QACb,IAAI,iBAAiB;AAAA,QACrB,MAAM;AAAA,QACN,SAAS,aAAa,SAAS,SAAS,GAAG;AAAA,QAC3C,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF,CAAC,EACA,MAAM,MAAM;AAAA,EAEb,CAAC;AACL;;;ACzLO,SAAS,SACd,KACA,MACA,SAAS,KACT,aACM;AAGN,QAAM,OAAO,cAAc,YAAY,UAAU,IAAI,IAAI,KAAK,UAAU,IAAI;AAC5E,MAAI,UAAU,QAAQ;AAAA,IACpB,gBAAgB;AAAA,IAChB,kBAAkB,OAAO,WAAW,IAAI;AAAA,EAC1C,CAAC;AACD,MAAI,IAAI,IAAI;AACd;AA0CO,SAAS,UACd,KACA,aACA,SACA,QACA,QACA,WACA,SACM;AACN,MAAI;AACJ,MAAI,OAAO,gBAAgB,UAAU;AACnC,WAAO;AACP,cAAU,WAAW;AACrB,aAAS,UAAU;AAAA,EACrB,OAAO;AACL,WAAO,YAAY;AACnB,cAAU,YAAY;AACtB,aAAS,YAAY;AACrB,aAAS,YAAY;AACrB,gBAAY,YAAY;AACxB,cAAU,YAAY;AAAA,EACxB;AACA,QAAM,eACJ,SAAS,oBAAoB,QAAQ,IAAI,aAAa,eAClD,0BACA;AAEN,MAAI,SAAS,kBAAkB;AAC7B,YAAQ,MAAM,IAAI,aAAa,OAAO,KAAK,OAAO,EAAE;AAAA,EACtD;AAEA,MAAI,WAAW,OAAO,SAAS,eAAe;AAC5C,UAAM,OAAO,QAAQ;AACrB,QAAI,UAAU,KAAK;AAAA,MACjB,gBAAgB;AAAA,MAChB,kBAAkB,OAAO,WAAW,IAAI;AAAA,IAC1C,CAAC;AACD,QAAI,IAAI,IAAI;AACZ;AAAA,EACF;AACA,MAAI,WAAW,OAAO,SAAS,eAAe;AAC5C,UAAM,OAAO,QAAQ;AACrB,QAAI,UAAU,KAAK;AAAA,MACjB,gBAAgB;AAAA,MAChB,kBAAkB,OAAO,WAAW,IAAI;AAAA,IAC1C,CAAC;AACD,QAAI,IAAI,IAAI;AACZ;AAAA,EACF;AAEA;AAAA,IACE;AAAA,IACA;AAAA,MACE,OAAO;AAAA,QACL;AAAA,QACA,SAAS;AAAA,QACT,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,QACjC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,MAC7B;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF;;;AC5HA,SAAS,gBAAgB;AAGzB,SAAS,iBAAiB,OAA0D;AAClF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,KAAK,MAAO,KAAI,OAAO,MAAM,YAAY,EAAE,SAAS,EAAG,QAAO;AAAA,EAC3E;AACA,SAAO;AACT;AAGA,SAAS,sBAAsB,KAA8B;AAC3D,QAAM,OAAO,iBAAiB,IAAI,QAAQ,IAAI,KAAK;AACnD,SAAO,UAAU,IAAI,GAAG,IAAI,OAAO,GAAG;AACxC;AAOA,SAAS,iBAAiB,KAA+B;AACvD,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AACtD,QAAI,UAAU,OAAW;AACzB,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,cAAQ,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,IACnC,OAAO;AACL,cAAQ,IAAI,KAAK,KAAK;AAAA,IACxB;AAAA,EACF;AACA,SAAO;AACT;AAWO,SAAS,4BAA4B,KAA+B;AACzE,QAAM,MAAM,sBAAsB,GAAG;AACrC,QAAM,UAAU,iBAAiB,GAAG;AAEpC,QAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,QAAM,UAAU,WAAW,SAAS,WAAW;AAE/C,MAAI,CAAC,SAAS;AACZ,WAAO,IAAI,QAAQ,KAAK,EAAE,QAAQ,QAAQ,CAAC;AAAA,EAC7C;AAIA,QAAM,YAAY,SAAS,MAAM,GAAG;AACpC,SAAO,IAAI,QAAQ,KAAK;AAAA,IACtB;AAAA,IACA;AAAA,IACA,MAAM;AAAA;AAAA;AAAA,IAGN,GAAI,EAAE,QAAQ,OAAO;AAAA,EACvB,CAAC;AACH;AAkBO,SAAS,gCAAgC,KAA+B;AAC7E,SAAO,IAAI,QAAQ,sBAAsB,GAAG,GAAG;AAAA,IAC7C,SAAS,IAAI,UAAU,OAAO,YAAY;AAAA,IAC1C,SAAS,iBAAiB,GAAG;AAAA,EAC/B,CAAC;AACH;;;AC/FA,SAAS,mBAAgC;AAEzC,SAAS,YAAY;AAErB,SAAS,wBAAwB,yBAA0C;;;ACmBpE,SAAS,iBAAiB,SAAgC;AAC/D,QAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,QAAQ,MAAM,IAAI,QAAQ,QAAQ,EAAE;AACpE,WAAS,KAAK,OAA6C;AAC7D;;;AC4DO,SAAS,UAAU,QAAiC,OAAyB;AAClF,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,UAAM,IAAI,OAAO,IAAI,KAAK;AAE1B,QAAI,KAAK,OAAO,EAAE,SAAS,YAAY;AACrC,QAAE,MAAM,MAAM;AAAA,MAEd,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AAAA,EAER;AACF;;;ACjDO,SAAS,gBAAgB,MAAc,UAAiD;AAC7F,aAAW,KAAK,UAAU;AACxB,QAAI,OAAO,MAAM,UAAU;AACzB,UAAI,SAAS,EAAG,QAAO;AAAA,IACzB,WAAW,aAAa,QAAQ;AAC9B,QAAE,YAAY;AACd,UAAI,EAAE,KAAK,IAAI,EAAG,QAAO;AAAA,IAC3B;AAAA,EAGF;AACA,SAAO;AACT;AAWO,IAAM,iBAAiB;AACvB,IAAM,qBAAqB;AAOlC,SAAS,WAAW,OAA8C;AAChE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,CAAC;AAC5D,SAAO;AACT;AA8BA,SAAS,uBAAuB,MAIuB;AAGrD,MAAI,KAAK,qBAAqB,KAAK;AACjC,WAAO,EAAE,OAAO,OAAO,QAAQ,+BAA+B;AAAA,EAChE;AAGA,MAAI,KAAK,WAAW,QAAQ,KAAK,WAAW,IAAI;AAE9C,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,MAAI,KAAK,SAAS,QAAQ,KAAK,SAAS,IAAI;AAC1C,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,MAAI;AACF,UAAM,aAAa,IAAI,IAAI,KAAK,MAAM,EAAE;AACxC,QAAI,eAAe,KAAK,MAAM;AAC5B,aAAO,EAAE,OAAO,OAAO,QAAQ,UAAU,KAAK,MAAM,wBAAwB,KAAK,IAAI,GAAG;AAAA,IAC1F;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB,KAAK,MAAM,GAAG;AAAA,EAClE;AAEA,SAAO,EAAE,OAAO,KAAK;AACvB;AAEO,SAAS,aACd,KACoD;AAGpD,QAAM,SAAS,IAAI,QAAQ,eAAe;AAC1C,QAAM,SAAS,IAAI,QAAQ;AAC3B,QAAM,OAAO,IAAI,QAAQ;AACzB,SAAO,uBAAuB;AAAA,IAC5B,kBAAkB,OAAO,WAAW,WAAW,SAAS;AAAA,IACxD,QAAQ,WAAW,SAAY,WAAW,MAAM,KAAK,OAAO;AAAA,IAC5D,MAAM,SAAS,SAAY,WAAW,IAAI,KAAK,OAAO;AAAA,EACxD,CAAC;AACH;AAcO,SAAS,oBACd,SACoD;AACpD,SAAO,uBAAuB;AAAA,IAC5B,kBAAkB,QAAQ,QAAQ,IAAI,eAAe;AAAA,IACrD,QAAQ,QAAQ,QAAQ,IAAI,QAAQ;AAAA,IACpC,MAAM,QAAQ,QAAQ,IAAI,MAAM;AAAA,EAClC,CAAC;AACH;AAcA,SAASA,kBACP,KACA,QACA,QACA,aACA,eAAe,IACT;AACN,QAAM,UAA2B;AAAA,IAC/B,OAAO;AAAA,IACP,QAAQ,IAAI,UAAU;AAAA,IACtB,MAAM,QAAQ,QAAQ;AAAA,IACtB;AAAA,IACA,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACA,UAAQ,KAAK,OAAO;AAGpB,YAAU,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,OAAO,EAAE,MAAM,YAAY;AAAA,IAC3B,UAAU,EAAE,GAAG,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,SAAS,YACd,KACA,MACA,QACA,YACA,aACqC;AACrC,MAAI,SAAS,OAAO;AAKlB,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,MAAM,OAAO;AACf,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAMA,MAAI,YAAY,aAAa,SAAS;AACpC,UAAM,OAAO,QAAQ,QAAQ,IAAI,OAAO;AACxC,QAAI,gBAAgB,MAAM,WAAW,MAAM,GAAG;AAC5C,aAAO,EAAE,OAAO,OAAO,QAAQ,MAAM,OAAO;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI,SAAS,QAAQ;AAKnB,IAAAA,kBAAiB,KAAK,MAAM,QAAQ,QAAQ,WAAW;AACvD,WAAO,EAAE,OAAO,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC7C;AAKA,EAAAA,kBAAiB,KAAK,MAAM,QAAQ,QAAQ,WAAW;AACvD,SAAO,EAAE,OAAO,OAAO,QAAQ,MAAM,OAAO;AAC9C;;;AH9OA,IAAM,yBAAyB,oBAAI,IAAI,CAAC,QAAQ,OAAO,SAAS,QAAQ,CAAC;AAQlE,SAAS,oBAAoB,KAAuB;AACzD,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,CAAC,YAA0B;AACtC,QAAI;AACJ,QAAI;AACF,gBAAU,YAAY,SAAS,EAAE,eAAe,KAAK,CAAC;AAAA,IACxD,QAAQ;AACN;AAAA,IACF;AACA,eAAW,SAAS,SAAS;AAC3B,YAAM,OAAO,KAAK,SAAS,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,EAAG,MAAK,IAAI;AAAA,eAKzB,MAAM,KAAK,SAAS,gBAAgB,KAAK,MAAM,KAAK,SAAS,iBAAiB;AACrF,cAAM,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,OAAK,GAAG;AACR,SAAO;AACT;AAyBA,eAAsB,sBACpB,gBACA,YAC6B;AAC7B,QAAM,QAAQ,oBAAoB,cAAc;AAChD,QAAM,UAA8B,CAAC;AACrC,aAAW,YAAY,OAAO;AAC5B,UAAM,MAAM,MAAM,WAAW,QAAQ;AACrC,eAAW,YAAY,OAAO,OAAO,GAAG,GAAG;AACzC,UAAI,OAAO,aAAa,cAAc,kBAAkB,QAAQ,GAAG;AACjE,gBAAQ,KAAK,EAAE,UAAU,KAAK,UAA6B,SAAS,IAAI,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,eAAe,gBACb,gBACA,YAC4B;AAC5B,QAAM,UAAU,MAAM,sBAAsB,gBAAgB,UAAU;AACtE,SAAO,QAAQ,IAAI,CAAC,MAAM,EAAE,GAAG;AACjC;AAUA,eAAsB,2BAA2B,MAKR;AACvC,QAAM,UAAU,MAAM,gBAAgB,KAAK,gBAAgB,KAAK,UAAU;AAC1E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,SAAS,uBAAuB,EAAE,aAAa,SAAS,YAAY,KAAK,WAAW,CAAC;AAC3F,SAAO;AAAA,IACL,UAAU,CAAC,YAAY,OAAO,OAAO;AAAA,IACrC,SAAS,CAAC,QAAQ,aAAa,OAAO,QAAQ,QAAQ,QAAQ;AAAA,EAChE;AACF;AAGA,eAAe,wBAAwB,KAAqB,UAAmC;AAC7F,QAAM,aAAqC,CAAC;AAC5C,aAAW,CAAC,GAAG,CAAC,KAAK,SAAS,SAAS;AACrC,QAAI,EAAE,YAAY,MAAM,aAAc,YAAW,CAAC,IAAI;AAAA,EACxD;AACA,QAAM,aAAa,SAAS,QAAQ,aAAa;AACjD,MAAI,WAAW,SAAS,EAAG,KAAI,UAAU,cAAc,UAAU;AACjE,MAAI,UAAU,SAAS,QAAQ,UAAU;AACzC,QAAM,OAAO,SAAS,OAAO,MAAM,SAAS,KAAK,IAAI;AACrD,MAAI,IAAI,QAAQ,MAAS;AAC3B;AAWA,eAAsB,0BAA0B,MAU3B;AACnB,QAAM,EAAE,KAAK,KAAK,UAAU,YAAY,UAAU,IAAI;AACtD,QAAM,aAAa,MAAM,2BAA2B;AAAA,IAClD,gBAAgB,KAAK;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,YAAY,KAAK;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,QAAM,aAAa,4BAA4B,GAAG;AAClD,QAAM,WAAW,IAAI,IAAI,WAAW,GAAG,EAAE;AAMzC,MAAI,uBAAuB,IAAI,MAAM,KAAK,WAAW,QAAQ,QAAQ,QAAQ,GAAG;AAC9E,UAAM,WAAW;AAAA,MACf;AAAA,MACA;AAAA,MACA,EAAE,MAAM,kBAAkB,MAAM,IAAI,IAAI;AAAA,MACxC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,OAAO;AACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA,SAAS,UAAU;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,WAAW,SAAS,UAAU;AACrD,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,wBAAwB,KAAK,QAAQ;AAC3C,SAAO;AACT;","names":["dispatchCsrfWarn"]}

package/dist/{chunk-5AVPWHUE.js → chunk-FZG3JYB3.js}

@@ -1,9 +1,9 @@
 import {
   handleMcpJsonRpc
-} from "./chunk-HZ6USUHC.js";
+} from "./chunk-YOIVCCZT.js";
 import {
   defineAgentTool
-} from "./chunk-E25FBYJP.js";
+} from "./chunk-SAFGDIPQ.js";
 
 // src/server/agent/workflow-tool.ts
 import { z } from "zod";
@@ -35,7 +35,6 @@ function createWorkflowTool(workflow, config) {
 // src/server/agent/acp-tool.ts
 import { spawn } from "child_process";
 import { AcpClient } from "@theokit/agents";
-import { encodeAcpMessage } from "@theokit/agents";
 var NodeAcpTransport = class {
   // stdin=pipe, stdout=pipe, stderr=inherit → the third stream is null.
   proc;
@@ -59,7 +58,9 @@ function defaultTransport(config) {
 }
 function createACPTool(config) {
   if (typeof config.onPermissionRequest !== "function") {
-    throw new Error("[theokit] createACPTool requires onPermissionRequest (security by default \u2014 no default-allow)");
+    throw new Error(
+      "[theokit] createACPTool requires onPermissionRequest (security by default \u2014 no default-allow)"
+    );
   }
   const makeTransport = config.transportFactory ?? defaultTransport;
   return {
@@ -67,7 +68,9 @@ function createACPTool(config) {
     description: config.description,
     inputSchema: {
       type: "object",
-      properties: { message: { type: "string", description: "The task/prompt for the coding agent." } },
+      properties: {
+        message: { type: "string", description: "The task/prompt for the coding agent." }
+      },
       required: ["message"]
     },
     handler: async (input) => {
@@ -242,47 +245,8 @@ async function handleChannelWebhook(request, urlPath, config) {
   });
 }
 
-// src/server/agent/stream-agent-turn-in-process.ts
-import {
-  compileAgentModule,
-  resolveEnabledSkills,
-  streamAgentUIMessages
-} from "@theokit/agents";
-var InProcessApprovalRequiredError = class extends Error {
-  constructor(toolNames) {
-    super(
-      `Agent has HITL-gated tool(s) [${toolNames.join(", ")}] but no \`awaitApproval\` resolver was supplied to streamAgentTurnInProcess. In-process runs must resolve approvals inline \u2014 pass awaitApproval, or remove the gate. Refused (fail-closed).`
-    );
-    this.name = "InProcessApprovalRequiredError";
-  }
-};
-function streamAgentTurnInProcess(mod, apiKey, input, deps = { stream: streamAgentUIMessages }) {
-  const compiled = compileAgentModule(mod, input.source);
-  const gated = compiled.hitl;
-  if (gated && gated.size > 0 && !input.awaitApproval) {
-    throw new InProcessApprovalRequiredError([...gated.keys()]);
-  }
-  const resolve = input.awaitApproval;
-  const hitl = gated && gated.size > 0 && resolve ? {
-    gated,
-    awaitApproval: (approvalId, opts, toolName) => resolve({ approvalId, toolName, opts })
-  } : void 0;
-  const sessionId = input.sessionId ?? crypto.randomUUID();
-  return (async function* () {
-    if (compiled.skillsResolver) {
-      const enabled = await resolveEnabledSkills(compiled.skillsResolver, compiled.runContext ?? {});
-      if (enabled !== void 0) compiled.skills = { enabled, autoInject: true };
-    }
-    yield* deps.stream(compiled, apiKey, {
-      message: input.message,
-      // M35 — pass images through so the SDK send uses the structured `{ text, images }` form.
-      ...input.images !== void 0 ? { images: input.images } : {},
-      sessionId,
-      hitl,
-      signal: input.signal
-    });
-  })();
-}
+// src/server/agent/index.ts
+import { streamAgentTurnInProcess, InProcessApprovalRequiredError } from "@theokit/agents";
 
 // src/server/agent/mcp-stdio.ts
 async function handleMcpStdioLine(line, mod, name, appResources = []) {
@@ -320,9 +284,9 @@ export {
   parseChannelPath,
   isChannelPath,
   handleChannelWebhook,
-  InProcessApprovalRequiredError,
-  streamAgentTurnInProcess,
   handleMcpStdioLine,
-  serveMcpStdio
+  serveMcpStdio,
+  streamAgentTurnInProcess,
+  InProcessApprovalRequiredError
 };
-//# sourceMappingURL=chunk-5AVPWHUE.js.map
+//# sourceMappingURL=chunk-FZG3JYB3.js.map

package/dist/chunk-FZG3JYB3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/agent/workflow-tool.ts","../src/server/agent/acp-tool.ts","../src/server/agent/vendor-agent-tool.ts","../src/server/agent/code-mode.ts","../src/server/agent/channel-webhook.ts","../src/server/agent/index.ts","../src/server/agent/mcp-stdio.ts"],"mappings":";;;;;;;;AASA,SAAS,SAAS;AAuBlB,IAAM,mBAAmB,oBAAI,IAAI,CAAC,UAAU,SAAS,aAAa,UAAU,CAAC;AAOtE,SAAS,mBAAmB,UAAwB,QAAwC;AACjG,QAAM,QAAS,UAAmD;AAClE,MAAI,OAAO,UAAU,YAAY;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,eAAe,EAAE,YAAY,CAAC,CAAC;AAE1D,SAAO,gBAAgB;AAAA,IACrB,MAAM,OAAO;AAAA,IACb,aAAa,OAAO;AAAA,IACpB;AAAA,IACA,SAAS,OAAO,UAAoC;AAClD,YAAM,MAAM,MAAM,SAAS,IAAI,KAAK;AACpC,UAAI,iBAAiB,IAAI,IAAI,MAAM,GAAG;AACpC,cAAM,IAAI;AAAA,UACR,sBAAsB,KAAK,UAAU,OAAO,IAAI,CAAC,mBAC/C,IAAI,QAAQ,IAAI,IAAI,KAAK,OAAO,EAClC,uBAAuB,IAAI,MAAM;AAAA,QACnC;AAAA,MACF;AACA,aAAO,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS,KAAK,UAAU,IAAI,MAAM;AAAA,IAChF;AAAA,EACF,CAAC;AACH;;;AC1DA,SAAS,aAAuC;AAGhD,SAAS,iBAAoC;AAItC,IAAM,mBAAN,MAA+C;AAAA;AAAA,EAEnC;AAAA,EAEjB,YAAY,SAAiB,OAAiB,CAAC,GAAG,KAAc;AAC9D,SAAK,OAAO,MAAM,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,QAAQ,QAAQ,SAAS,EAAE,CAAC;AAAA,EAC9E;AAAA,EAEA,KAAK,MAAoB;AACvB,SAAK,KAAK,MAAM,MAAM,IAAI;AAAA,EAC5B;AAAA,EAEA,UAAU,QAAuC;AAC/C,SAAK,KAAK,OAAO,GAAG,QAAQ,CAAC,QAAgB;AAC3C,aAAO,IAAI,SAAS,MAAM,CAAC;AAAA,IAC7B,CAAC;AAAA,EACH;AAAA,EAEA,QAAc;AACZ,SAAK,KAAK,KAAK;AAAA,EACjB;AACF;AAsBA,SAAS,iBAAiB,QAAqC;AAC7D,SAAO,IAAI,iBAAiB,OAAO,SAAS,OAAO,MAAM,OAAO,GAAG;AACrE;AAGO,SAAS,cAAc,QAAmC;AAC/D,MAAI,OAAO,OAAO,wBAAwB,YAAY;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,gBAAgB,OAAO,oBAAoB;AACjD,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,aAAa,OAAO;AAAA,IACpB,aAAa;AAAA,MACX,MAAM;AAAA,MACN,YAAY;AAAA,QACV,SAAS,EAAE,MAAM,UAAU,aAAa,wCAAwC;AAAA,MAClF;AAAA,MACA,UAAU,CAAC,SAAS;AAAA,IACtB;AAAA,IACA,SAAS,OAAO,UAAoD;AAClE,YAAM,UAAU,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU;AACpE,YAAM,SAAS,IAAI,UAAU,cAAc,MAAM,CAAC;AAClD,aAAO,UAAU,8BAA8B,CAAC,WAAW,OAAO,oBAAoB,MAAM,CAAC;AAC7F,YAAM,SAAU,MAAM,OAAO,QAAQ,kBAAkB,EAAE,QAAQ,CAAC;AAClE,aAAO,OAAO,QAAQ;AAAA,IACxB;AAAA,EACF;AACF;;;AC3CO,SAAS,sBAAsB,QAA2C;AAC/E,MAAI,CAAC,OAAO,UAAU,OAAO,OAAO,WAAW,GAAG;AAChD,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,UAAW,OAAO,QAAmD;AAC3E,MAAI,OAAO,YAAY,YAAY;AACjC,UAAM,IAAI;AAAA,MACR,yBAAyB,KAAK,UAAU,OAAO,MAAM,CAAC;AAAA,IAExD;AAAA,EACF;AAEA,QAAM,OAAO,OAAO,QAAQ,GAAG,OAAO,MAAM;AAC5C,QAAM,cACJ,OAAO,eAAe,0BAA0B,OAAO,MAAM;AAE/D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,aAAa;AAAA,MACX,MAAM;AAAA,MACN,YAAY;AAAA,QACV,QAAQ,EAAE,MAAM,UAAU,aAAa,wCAAwC;AAAA,QAC/E,iBAAiB;AAAA,UACf,MAAM;AAAA,UACN,aAAa;AAAA,QACf;AAAA,MACF;AAAA,MACA,UAAU,CAAC,QAAQ;AAAA,IACrB;AAAA,IACA,SAAS,OAAO,UAAoD;AAClE,YAAM,SAAS,OAAO,MAAM,WAAW,WAAW,MAAM,SAAS;AACjE,YAAM,kBACJ,OAAO,MAAM,oBAAoB,WAAW,MAAM,kBAAkB;AACtE,YAAM,SAAS,MAAM,OAAO,OAAO;AAAA,QACjC;AAAA,QACA,oBAAoB,SAAY,EAAE,gBAAgB,IAAI;AAAA,MACxD;AACA,UAAI,OAAO,cAAc,UAAa,OAAO,UAAW,QAAO,UAAU,OAAO,SAAS;AACzF,aAAO,OAAO;AAAA,IAChB;AAAA,EACF;AACF;;;AC9BO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YAAY,MAAc,QAAiB;AACzC,UAAM,SAAS,SAAS,KAAK,MAAM,KAAK;AACxC,UAAM,oBAAoB,IAAI,8BAA8B,MAAM,EAAE;AACpE,SAAK,OAAO;AAAA,EACd;AACF;AAGA,SAAS,kBAAkB,aAA8C;AACvE,QAAM,QAAS,YAAY,cAAiE,CAAC;AAC7F,QAAM,WAAW,IAAI,IAAK,YAAY,YAAqC,CAAC,CAAC;AAC7E,QAAM,UAAU,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM;AAEzD,UAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AACzD,WAAO,GAAG,GAAG,GAAG,SAAS,IAAI,GAAG,IAAI,KAAK,GAAG,KAAK,IAAI;AAAA,EACvD,CAAC;AACD,SAAO,QAAQ,SAAS,IAAI,KAAK,QAAQ,KAAK,IAAI,CAAC,OAAO;AAC5D;AAQA,SAAS,6BAA6B,OAAqB,UAA0B;AACnF,QAAM,QAAQ,MACX,IAAI,CAAC,MAAM,iBAAiB,EAAE,IAAI,IAAI,kBAAkB,EAAE,WAAW,CAAC,cAAS,EAAE,WAAW,EAAE,EAC9F,KAAK,IAAI;AACZ,SAAO;AAAA,IACL,SAAS,QAAQ;AAAA,IACjB;AAAA,IACA;AAAA,EACF,EAAE,KAAK,MAAM;AACf;AASO,SAAS,eAAe,QAAoE;AACjG,MAAI,OAAO,OAAO,wBAAwB,YAAY;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAc,OAAO,SAAkD;AAC7E,MAAI,OAAO,eAAe,YAAY;AACpC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,MAAM,WAAW,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,MAAmB,CAAC;AAC1B,aAAWA,SAAQ,OAAO,OAAO;AAC/B,QAAIA,MAAK,IAAI,IAAI,OAAO,SAAoC;AAC1D,YAAM,WAAW,MAAM,OAAO,oBAAoB,EAAE,MAAMA,MAAK,MAAM,KAAK,CAAC;AAC3E,UAAI,CAAC,SAAS,QAAS,OAAM,IAAI,8BAA8BA,MAAK,MAAM,SAAS,MAAM;AACzF,aAAOA,MAAK,QAAQ,IAA+B;AAAA,IACrD;AAAA,EACF;AAEA,QAAM,OAAO,OAAO,QAAQ;AAC5B,QAAM,OAAmB;AAAA,IACvB;AAAA,IACA,aACE,OAAO,eACP;AAAA,IACF,aAAa;AAAA,MACX,MAAM;AAAA,MACN,YAAY,EAAE,MAAM,EAAE,MAAM,UAAU,aAAa,kCAAkC,EAAE;AAAA,MACvF,UAAU,CAAC,MAAM;AAAA,IACnB;AAAA,IACA,SAAS,OAAO,UAAoD;AAClE,YAAM,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;AAC3D,YAAM,SAAS,MAAM,OAAO,QAAQ,IAAI,MAAM,GAAG;AACjD,aAAO,OAAO,WAAW,WAAW,SAAS,KAAK,UAAU,MAAM;AAAA,IACpE;AAAA,EACF;AACA,SAAO,EAAE,MAAM,cAAc,6BAA6B,OAAO,OAAO,IAAI,EAAE;AAChF;;;ACzIA,IAAM,eAAe;AAGd,SAAS,iBAAiB,SAA6D;AAC5F,QAAM,QAAQ,aAAa,KAAK,OAAO;AACvC,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,EAAE,OAAO,mBAAmB,MAAM,CAAC,CAAC,GAAG,UAAU,mBAAmB,MAAM,CAAC,CAAC,EAAE;AACvF;AAGO,SAAS,cAAc,SAA0B;AACtD,SAAO,aAAa,KAAK,OAAO;AAClC;AAiBA,SAAS,UAAU,QAAgB,MAAc,SAA2B;AAC1E,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,EAAE,MAAM,QAAQ,EAAE,CAAC,GAAG;AAAA,IAChE;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AASA,eAAsB,qBACpB,SACA,SACA,QACmB;AACnB,QAAM,SAAS,iBAAiB,OAAO;AACvC,MAAI,WAAW,MAAM;AACnB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,GAAG;AACtD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,yCAAyC,OAAO,QAAQ;AAAA,IAC1D;AAAA,EACF;AACA,QAAM,SAAS,OAAO,WAAW,OAAO,QAAQ;AAGhD,QAAM,eAAe,MAAM,OAAO,QAAQ,MAAM,CAAC;AACjD,MAAI,CAAC,aAAa,IAAI;AACpB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,gCAAgC,aAAa,MAAM;AAAA,IACrD;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,KAAK;AAAA,EAC/B,QAAQ;AACN,WAAO,UAAU,KAAK,eAAe,4BAA4B;AAAA,EACnE;AAEA,QAAM,OAAO,UAAU,EAAE,OAAO,OAAO,OAAO,UAAU,OAAO,UAAU,QAAQ,CAAC;AAClF,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,IAAI,KAAK,CAAC,GAAG;AAAA,IAChD,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;;;ACvEA,SAAS,0BAA0B,sCAAsC;;;ACTzE,eAAsB,mBACpB,MACA,KACA,MACA,eAAuC,CAAC,GAChB;AACxB,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO,KAAK,UAAU;AAAA,MACpB,SAAS;AAAA,MACT,IAAI;AAAA,MACJ,OAAO,EAAE,MAAM,QAAQ,SAAS,cAAc;AAAA,IAChD,CAAC;AAAA,EACH;AACA,QAAM,WAAW,MAAM,iBAAiB,KAAK,MAAM,MAAM,YAAY;AACrE,QAAM,UAAmB,MAAM,SAAS,KAAK;AAC7C,SAAO,KAAK,UAAU,OAAO;AAC/B;AAcA,eAAsB,cACpB,KACA,MACA,cACA,SACe;AACf,mBAAiB,QAAQ,QAAQ,OAAO;AACtC,UAAM,MAAM,MAAM,mBAAmB,MAAM,KAAK,MAAM,YAAY;AAClE,QAAI,QAAQ,KAAM,SAAQ,MAAM,GAAG,GAAG;AAAA,CAAI;AAAA,EAC5C;AACF;","names":["tool"]}

package/dist/{chunk-V3LJN2GS.js → chunk-GAPBPRPP.js}

@@ -35,4 +35,4 @@ export {
   defineReadyRoute,
   serveReservedRoute
 };
-//# sourceMappingURL=chunk-V3LJN2GS.js.map
+//# sourceMappingURL=chunk-GAPBPRPP.js.map

package/dist/chunk-GAPBPRPP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/define/health-route.ts"],"mappings":";AAcO,IAAM,cAAc;AAEpB,IAAM,aAAa;AAgCnB,SAAS,kBACd,UAAyB,OAAO,EAAE,QAAQ,KAAK,IAC5B;AACnB,SAAO,EAAE,MAAM,UAAU,QAAQ;AACnC;AAMO,SAAS,iBAAiB,OAA2D;AAC1F,SAAO,EAAE,MAAM,SAAS,MAAM;AAChC;AAQA,eAAsB,mBACpB,UACA,SAAyB,CAAC,GACQ;AAClC,MAAI,aAAa,aAAa;AAC5B,UAAM,UAAU,OAAO,QAAQ,YAAY,OAAO,EAAE,QAAQ,KAAK;AACjE,WAAO,EAAE,QAAQ,KAAK,MAAM,QAAQ,EAAE;AAAA,EACxC;AACA,MAAI,aAAa,YAAY;AAC3B,UAAM,QAAQ,OAAO,OAAO;AAC5B,QAAI,UAAU,QAAW;AACvB,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,QAAQ,EAAE;AAAA,IAClD;AACA,QAAI;AACF,YAAM,QAAQ,MAAM,MAAM;AAC1B,aAAO,QACH,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,QAAQ,EAAE,IACzC,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,YAAY,EAAE;AAAA,IACnD,SAAS,KAAK;AAIZ,cAAQ,MAAM,6DAAwD,GAAG;AACzE,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,YAAY,EAAE;AAAA,IACtD;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-GUBN5UTT.js

@@ -0,0 +1 @@
+//# sourceMappingURL=chunk-GUBN5UTT.js.map

package/dist/chunk-GUBN5UTT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"mappings":"","names":[]}

package/dist/{chunk-GSO77FSM.js → chunk-HEK4SET7.js}

@@ -2,77 +2,79 @@
 import "tsx/esm";
 import {
   servicesConfigSchema
-} from "./chunk-45C3WUQ7.js";
+} from "./chunk-QPVXGC7O.js";
 
 // src/config/schema.ts
 import { z as z8 } from "zod";
 
-// src/config/schemas/header-safe.ts
-import { z } from "zod";
-var headerSafeString = z.string().refine((s) => !/[\r\n]/.test(s), { message: "Header value must not contain CR/LF" });
-
 // src/config/schemas/rate-limit.ts
-import { z as z2 } from "zod";
-var baseRateLimitSchema = z2.object({
-  windowMs: z2.number().min(1),
-  max: z2.number().int().min(1)
+import { z } from "zod";
+var baseRateLimitSchema = z.object({
+  windowMs: z.number().min(1),
+  max: z.number().int().min(1)
 });
-var rateLimitSchema = z2.union([
+var rateLimitSchema = z.union([
   baseRateLimitSchema,
-  z2.object({
+  z.object({
     default: baseRateLimitSchema.optional(),
-    routes: z2.record(z2.string(), baseRateLimitSchema).optional(),
-    keyBy: z2.union([
-      z2.enum(["ip", "session", "user"]),
-      z2.function({ input: z2.tuple([z2.unknown()]), output: z2.string() })
+    routes: z.record(z.string(), baseRateLimitSchema).optional(),
+    keyBy: z.union([
+      z.enum(["ip", "session", "user"]),
+      z.function({ input: z.tuple([z.unknown()]), output: z.string() })
     ]).optional(),
-    cookieName: z2.string().min(1).optional()
+    cookieName: z.string().min(1).optional()
   })
 ]);
 
 // src/config/schemas/upload.ts
-import { z as z3 } from "zod";
-var uploadSchema = z3.object({
-  maxFileSize: z3.number().min(1).default(10 * 1024 * 1024),
+import { z as z2 } from "zod";
+var uploadSchema = z2.object({
+  maxFileSize: z2.number().min(1).default(10 * 1024 * 1024),
   // 10MB
-  maxFiles: z3.number().int().min(1).default(10),
-  maxFieldSize: z3.number().min(1).default(1 * 1024 * 1024)
+  maxFiles: z2.number().int().min(1).default(10),
+  maxFieldSize: z2.number().min(1).default(1 * 1024 * 1024)
   // 1MB
 });
 
 // src/config/schemas/logging.ts
-import { z as z4 } from "zod";
-var loggingSchema = z4.object({
-  level: z4.enum(["debug", "info", "warn", "error", "silent"]).default("info")
+import { z as z3 } from "zod";
+var loggingSchema = z3.object({
+  level: z3.enum(["debug", "info", "warn", "error", "silent"]).default("info")
 });
 
 // src/config/schemas/cache.ts
-import { z as z5 } from "zod";
-var routeRuleSchema = z5.object({
-  maxAge: z5.number().nonnegative().finite().optional(),
-  swr: z5.number().nonnegative().finite().optional(),
-  tags: z5.array(z5.string()).optional()
+import { z as z4 } from "zod";
+var routeRuleSchema = z4.object({
+  maxAge: z4.number().nonnegative().optional(),
+  swr: z4.number().nonnegative().optional(),
+  tags: z4.array(z4.string()).optional()
 });
-var cacheSchema = z5.object({
-  enabled: z5.boolean().default(true),
+var cacheSchema = z4.object({
+  enabled: z4.boolean().default(true),
   /** 'memory' uses InMemoryCacheAdapter; otherwise pass a custom adapter instance. */
-  storage: z5.union([z5.literal("memory"), z5.custom()]).default("memory"),
-  maxEntries: z5.number().int().positive().default(1e3),
-  defaults: z5.object({
-    maxAge: z5.number().nonnegative().finite().default(1),
-    swr: z5.number().nonnegative().finite().optional(),
-    cacheErrors: z5.boolean().default(false)
+  storage: z4.union([z4.literal("memory"), z4.custom()]).default("memory"),
+  maxEntries: z4.number().int().positive().default(1e3),
+  defaults: z4.object({
+    maxAge: z4.number().nonnegative().default(1),
+    swr: z4.number().nonnegative().optional(),
+    cacheErrors: z4.boolean().default(false)
   }).default({ maxAge: 1, cacheErrors: false }),
-  keyDerivation: z5.object({
-    excludeQuery: z5.array(z5.string()).optional(),
-    sortQuery: z5.boolean().default(true),
-    lowercaseHost: z5.boolean().default(true)
+  keyDerivation: z4.object({
+    excludeQuery: z4.array(z4.string()).optional(),
+    sortQuery: z4.boolean().default(true),
+    lowercaseHost: z4.boolean().default(true)
   }).default({ sortQuery: true, lowercaseHost: true }),
-  routeRules: z5.record(z5.string(), routeRuleSchema).optional()
+  routeRules: z4.record(z4.string(), routeRuleSchema).optional()
 });
 
 // src/config/schemas/security.ts
 import { z as z6 } from "zod";
+
+// src/config/schemas/header-safe.ts
+import { z as z5 } from "zod";
+var headerSafeString = z5.string().refine((s) => !/[\r\n]/.test(s), { message: "Header value must not contain CR/LF" });
+
+// src/config/schemas/security.ts
 var securityHeadersSchema = z6.object({
   csp: z6.union([headerSafeString, z6.literal(false)]).optional(),
   // T6.1 — default flipped from 'report-only' to 'enforce' for 0.3.0.
@@ -391,16 +393,12 @@ var theoConfigSchema = z8.object({
 });
 
 export {
-  headerSafeString,
   rateLimitSchema,
-  uploadSchema,
-  loggingSchema,
   cacheSchema,
   securityHeadersSchema,
-  disallowedConfigSchema,
   corsSchema,
   securitySchema,
   storageSchema,
   theoConfigSchema
 };
-//# sourceMappingURL=chunk-GSO77FSM.js.map
+//# sourceMappingURL=chunk-HEK4SET7.js.map

package/dist/chunk-HEK4SET7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/schema.ts","../src/config/schemas/rate-limit.ts","../src/config/schemas/upload.ts","../src/config/schemas/logging.ts","../src/config/schemas/cache.ts","../src/config/schemas/security.ts","../src/config/schemas/header-safe.ts","../src/config/schemas/storage.ts"],"sourcesContent":["import { z } from 'zod'\n\nimport { servicesConfigSchema } from '../services/index.js'\n\nimport {\n  cacheSchema,\n  loggingSchema,\n  rateLimitSchema,\n  securitySchema,\n  storageSchema,\n  uploadSchema,\n  type FormatErrorContext,\n  type FormatErrorHook,\n} from './schemas/index.js'\n\n// Re-export per-concern schemas + types so downstream consumers\n// (`adapters/*`, vite-plugin, generators, tests) keep their existing\n// imports valid. Per plan T2.3 — pure structural split; zero behavior\n// change at the call site.\nexport {\n  cacheSchema,\n  corsSchema,\n  rateLimitSchema,\n  securityHeadersSchema,\n  securitySchema,\n  storageSchema,\n} from './schemas/index.js'\n\nexport type { StorageConfig } from './schemas/index.js'\n\n/**\n * Root `theo.config.ts` schema — composer assembled from the per-concern\n * primitives re-exported above.\n *\n * Embedded blocks that exist ONLY as part of the root config (`agents`,\n * `ui`, `devtools`, `jobs`, `openapi`) stay inline below. They have no\n * external consumers; splitting them would create lonely files (M5\n * smell) without comprehension benefit.\n */\nexport const theoConfigSchema = z\n  .object({\n    /**\n     * Plan v1.2 T2.1 — project identifier propagated into\n     * `.theokit/services.json` v2 `project` field. DNS-1123 compatible (drives\n     * Gitea repo + ArgoCD App naming on TheoCloud). When omitted, the build\n     * emits services.json v1 with the legacy `services-bundle` fallback\n     * (ADR D10) and logs a deprecation warning.\n     */\n    name: z\n      .string()\n      .max(63)\n      .refine(\n        // DNS-1123 equivalent expressed as explicit single-char anchors so\n        // security/detect-unsafe-regex stays clean (no backtracking).\n        (value) =>\n          value.length > 0 &&\n          /^[a-z0-9-]+$/u.test(value) &&\n          !value.startsWith('-') &&\n          !value.endsWith('-'),\n        'name must match DNS-1123 (lowercase alphanumeric+hyphens, 1-63 chars, no leading/trailing hyphen)',\n      )\n      .optional(),\n    appDir: z.string().default('app'),\n    serverDir: z.string().default('server'),\n    /**\n     * Directory (relative to the project root) holding `agents/<name>.ts` definitions, scanned by\n     * dev/build/terminal/mcp. Defaults to `\"agents\"` — apps that keep the canonical layout are\n     * unaffected. Set to e.g. `\"core/agents\"` to organize agents under a domain root (#95 follow-up).\n     */\n    agentsDir: z.string().default('agents'),\n    /**\n     * T2.2 / EC-4 — Build output directory. Must be a relative path inside\n     * the project root. Refused absolute or parent-relative paths to prevent\n     * `cleanOutDir` from wiping arbitrary locations (defense-in-depth on\n     * top of cleanOutDir's runtime EC-3 guard).\n     */\n    distDir: z\n      .string()\n      .default('.theokit')\n      .refine(\n        (d) => !/^([A-Za-z]:)?[/\\\\]/.test(d) && !d.startsWith('..'),\n        'distDir must be a relative path inside the project root (e.g., \".theokit\")',\n      ),\n    /**\n     * Agent runtime configuration.\n     *\n     * - `maxRegistries` (T2.3, legacy): dev-mode cleanup of stale\n     *   `.theokit/agents/<id>/` dirs by mtime. Now superseded by SDK's\n     *   native registry GC but kept for backward-compat.\n     * - `registry` (Phase 6, Production-Readiness #2): forwarded to\n     *   `Agent.registry.configure()` lazily on first request.\n     *   * `maxAgents` — LRU cap. MUST be ≥ max-concurrent-active-conversations\n     *     (EC-17 DOCUMENT): with maxAgents:1 and 2 concurrent chats, LRU evicts\n     *     mid-stream → SDK aborts with code:'aborted'. Default 100 covers\n     *     indie/small-team; tune up for high-traffic.\n     *   * `idleTimeoutMs` — auto-evict idle agents (default 30 min). 0 disables\n     *     idle eviction (LRU only).\n     */\n    agents: z\n      .object({\n        maxRegistries: z.number().int().positive().default(100),\n        registry: z\n          .object({\n            /** LRU cap — MUST be ≥ max-concurrent-active-conversations. */\n            maxAgents: z.number().int().positive().max(10_000).default(100),\n            /** Idle eviction window in ms. 0 disables idle eviction (LRU only). */\n            idleTimeoutMs: z\n              .number()\n              .int()\n              .nonnegative()\n              .default(30 * 60_000),\n          })\n          .optional(),\n      })\n      .optional(),\n    port: z.number().int().min(1).max(65535).default(3000),\n    /** Listen on all addresses (0.0.0.0) for LAN/mobile testing. */\n    host: z.union([z.string(), z.boolean()]).default('localhost'),\n    /** Automatically open browser on `theokit dev`. */\n    open: z.union([z.boolean(), z.string()]).default(false),\n    /** Exit if port is already in use instead of trying next available. */\n    strictPort: z.boolean().default(false),\n    /** Forward browser console/errors to terminal — useful for AI agent dev. */\n    forwardConsole: z\n      .union([\n        z.boolean(),\n        z.object({\n          unhandledErrors: z.boolean().optional(),\n          logLevels: z.array(z.enum(['error', 'warn', 'info', 'log', 'debug'])).optional(),\n        }),\n      ])\n      .default(false),\n    /** Pre-transform files on startup for faster first page load. */\n    warmup: z\n      .object({\n        clientFiles: z.array(z.string()).optional(),\n        ssrFiles: z.array(z.string()).optional(),\n      })\n      .optional(),\n    ssr: z.boolean().default(false),\n    /** When true (and ssr === true), use renderToPipeableStream with progressive\n     * shell flush instead of single-shot renderToString. Opt-in for streaming\n     * SSR; default false preserves the current behavior. */\n    ssrStreaming: z.boolean().default(false),\n    rateLimit: rateLimitSchema.optional(),\n    upload: uploadSchema.optional(),\n    logging: loggingSchema.optional(),\n    security: securitySchema.optional(),\n    serialization: z.enum(['json', 'superjson']).default('json'),\n    // Plugins are validated structurally at runtime by createPluginRunnerFromConfig.\n    // Zod only checks the shape minimally (must be array). Type-level safety is\n    // provided through defineConfig at the user surface.\n    plugins: z.array(z.unknown()).optional(),\n    /** Enable client-side batching of theoFetch calls and the\n     * /api/__theo_batch__ server endpoint. */\n    batching: z\n      .union([z.boolean(), z.object({ max: z.number().int().positive().optional() })])\n      .optional(),\n    /** T4.1 — Audit log. When `logger` is provided, framework events\n     * (csrf.warn, rate-limit.exceeded, session.rotated, csp.violation) are\n     * emitted to it. Default: noop. */\n    audit: z\n      .object({\n        logger: z.unknown().optional(),\n      })\n      .optional(),\n    /** TheoUI auto-wire (T2.1). `false` = opt-out; object = explicit theme/fonts;\n     * undefined = enabled when @theokit/ui is detected in node_modules. */\n    ui: z\n      .union([\n        z.literal(false),\n        z.object({\n          theme: z.enum(['violet-forge', 'noir', 'paper']).optional(),\n          fonts: z.enum(['bundled', 'cdn']).optional(),\n        }),\n      ])\n      .optional(),\n    /**\n     * Cache subsystem (caching-and-revalidation-plan).\n     * Default `undefined` keeps caching disabled (backward compatible).\n     * Pass `cache: {}` to opt in with defaults.\n     */\n    cache: cacheSchema.optional(),\n    /**\n     * Devtools overlay (Phase 0.4.0+ — see docs/plans/devtools-plan.md).\n     *\n     * - `undefined` (default): devtools auto-injects in `pnpm dev`, NEVER in `vite build`.\n     * - `false`: devtools disabled entirely (Vite plugin skips injection even in dev).\n     * - `{ ... }`: devtools enabled with explicit defaults (position, theme).\n     *\n     * Tree-shaken to noop in prod via the dual-export pattern in\n     * `packages/theo/src/devtools/index.ts` (EC-17 positive prod check).\n     */\n    devtools: z\n      .union([\n        z.literal(false),\n        z.object({\n          position: z.enum(['top-left', 'top-right', 'bottom-left', 'bottom-right']).optional(),\n          theme: z.enum(['light', 'dark', 'system']).optional(),\n        }),\n      ])\n      .optional(),\n    /**\n     * Informative list of deploy adapters the app supports. Does NOT\n     * trigger per-build translations — only the `--target` CLI flag does\n     * (EC-201 / ADR D2). If `config.adapters` includes a target NOT\n     * matching `--target`, `theokit build` emits a cross-reference note.\n     */\n    adapters: z.array(z.string()).optional(),\n    /**\n     * Extra package names to pre-bundle via Vite's `optimizeDeps.include`.\n     *\n     * Framework auto-includes `@theokit/ui` and `lucide-react` when present.\n     * Apps adding plugin peer-deps that rely on a runtime `import('<pkg>')`\n     * (dynamic specifier) — e.g. `@theokit/plugin-canvas` consumers\n     * installing `mermaid` for Mermaid SVG rendering — must declare those\n     * here so Vite can resolve the literal in dev mode without\n     * \"Failed to resolve module specifier\" errors. Production builds use\n     * tsup/esbuild bundling and are not affected.\n     *\n     * Example:\n     *   viteOptimizeDeps: ['mermaid']\n     */\n    viteOptimizeDeps: z.array(z.string()).optional(),\n    /**\n     * Jobs backend (ADR D3 + T2.1). When configured, every request gets\n     * `ctx.queue.enqueue` auto-wired via the outbox lifecycle. Pass a\n     * `JobBackend` instance (InMemoryJobBackend, PostgresJobBackend, etc.).\n     */\n    jobs: z\n      .object({\n        backend: z.custom<unknown>((v) => typeof v === 'object' && v !== null),\n      })\n      .optional(),\n    /**\n     * StorageManager configuration (T1.1 / ADR-0007).\n     *\n     * Declares Postgres servers + databases + Redis servers. Consumed by\n     * `getStorageManager().configure()` at boot via `start.ts`.\n     *\n     * Default `undefined` means manager exists but is not configured — adapters\n     * relying on the manager (PostgresJobBackend.fromStorageManager, etc.) will\n     * throw with an actionable error on first use.\n     */\n    storage: storageSchema.optional(),\n    /**\n     * Wave 2 — Polyglot services orchestration (T1.1 / ADR-0012/0013/0014/0015).\n     *\n     * Declarative external sidecar processes (Python FastAPI / Node Hono)\n     * that boot alongside the TheoKit TS app. Empty `services: {}` is the\n     * default and preserves Wave 1 behavior.\n     */\n    services: servicesConfigSchema,\n    /**\n     * G2 — OpenAPI emit (build-time only).\n     *\n     * When present, `theokit build` writes a generated `openapi.json` from\n     * every `defineRoute()` body/query/params Zod schema. `undefined` keeps\n     * the framework backward-compatible (no emit). Pass `openapi: {}` to\n     * opt in with defaults.\n     *\n     * Defaults: spec 3.1.0 · servers `http://localhost:3000` · title\n     * \"TheoKit App\" · version \"0.0.0\" · outDir \".theokit\" (next to dist).\n     *\n     * The env var `THEOKIT_OPENAPI_SERVERS` (CSV of URLs) overrides\n     * `servers[].url` at emit time without rebuilding the config.\n     */\n    openapi: z\n      .object({\n        servers: z\n          .array(\n            z.object({\n              url: z.url(),\n              description: z.string().optional(),\n            }),\n          )\n          .default([{ url: 'http://localhost:3000', description: 'Local development' }]),\n        specVersion: z.enum(['3.1.0', '3.0.3']).default('3.1.0'),\n        title: z.string().default('TheoKit App'),\n        version: z.string().default('0.0.0'),\n        outDir: z.string().default('.theokit'),\n      })\n      .optional(),\n    /**\n     * G5 T1.3 — error envelope transformer hook (blueprint ADR D3).\n     *\n     * When present, runs at framework error-boundary time to enrich the\n     * envelope with consumer-defined extensions (`hint`, custom telemetry\n     * tags, etc.) BEFORE the envelope is serialized to the client. The\n     * function signature is preserved via the explicit `FormatErrorHook`\n     * type — TS inference flows from `theo.config.ts` into `@theo/client`\n     * codegen and `@theokit/ui` AgentErrorCard consumers.\n     *\n     * Use `z.custom<FormatErrorHook>(...)` because Zod's built-in\n     * `z.function()` discards its TS signature after parse; `z.custom`\n     * with a function-typed runtime guard preserves the call-site type\n     * without trading off Zod runtime validation.\n     */\n    formatError: z\n      .custom<FormatErrorHook>((val) => typeof val === 'function', {\n        message: 'formatError must be a function',\n      })\n      .optional(),\n  })\n  // EC-2 fix: cross-config refine — no service may share TheoKit's web port.\n  .refine((cfg) => !Object.values(cfg.services).some((s) => s.port === cfg.port), {\n    message: 'service.port collides with TheoKit web port — change one of them',\n    path: ['services'],\n  })\n\nexport type TheoConfig = z.infer<typeof theoConfigSchema>\n\n// Silence unused-import warnings for type-only re-exports — TS strips at compile,\n// but exports above re-introduce them for downstream consumers.\ntype _FormatErrorContext = FormatErrorContext\n","import { z } from 'zod'\n\n/**\n * Base bucket config — legacy shape preserved for backwards compatibility.\n */\nconst baseRateLimitSchema = z.object({\n  windowMs: z.number().min(1),\n  max: z.number().int().min(1),\n})\n\n/**\n * T2.2 — Per-route + per-user rate limit. The new shape adds `routes`\n * (path map), `keyBy`, and `cookieName`. The legacy flat shape is still\n * accepted via the union — see `createRouteRateLimiter` for normalization.\n */\nexport const rateLimitSchema = z.union([\n  baseRateLimitSchema,\n  z.object({\n    default: baseRateLimitSchema.optional(),\n    routes: z.record(z.string(), baseRateLimitSchema).optional(),\n    keyBy: z\n      .union([\n        z.enum(['ip', 'session', 'user']),\n        z.function({ input: z.tuple([z.unknown()]), output: z.string() }),\n      ])\n      .optional(),\n    cookieName: z.string().min(1).optional(),\n  }),\n])\n","import { z } from 'zod'\n\nexport const uploadSchema = z.object({\n  maxFileSize: z\n    .number()\n    .min(1)\n    .default(10 * 1024 * 1024), // 10MB\n  maxFiles: z.number().int().min(1).default(10),\n  maxFieldSize: z\n    .number()\n    .min(1)\n    .default(1 * 1024 * 1024), // 1MB\n})\n","import { z } from 'zod'\n\nexport const loggingSchema = z.object({\n  level: z.enum(['debug', 'info', 'warn', 'error', 'silent']).default('info'),\n})\n","import { z } from 'zod'\n\n// `.finite()` foi removido dos 4 schemas numéricos abaixo (agent-builder#319): em zod 4 ele é\n// no-op — `z.number()` já rejeita `Infinity`, `-Infinity` e `NaN` por padrão. Medido antes de\n// remover, contra zod 4.4.3 instalado, e não presumido a partir da mensagem de depreciação:\n// os cinco casos (`Infinity`, `-Infinity`, `NaN`, `1.5`, `0`) dão o MESMO veredito com e sem ele.\n\n/**\n * Cache subsystem config (caching-and-revalidation-plan).\n * Default `cache: undefined` keeps the framework backward-compatible\n * (no engine initialized → no cache primitives available).\n *\n * Setting `cache: {}` opts in with all defaults.\n */\nconst routeRuleSchema = z.object({\n  maxAge: z.number().nonnegative().optional(),\n  swr: z.number().nonnegative().optional(),\n  tags: z.array(z.string()).optional(),\n})\n\nexport const cacheSchema = z.object({\n  enabled: z.boolean().default(true),\n  /** 'memory' uses InMemoryCacheAdapter; otherwise pass a custom adapter instance. */\n  storage: z.union([z.literal('memory'), z.custom<unknown>()]).default('memory'),\n  maxEntries: z.number().int().positive().default(1000),\n  defaults: z\n    .object({\n      maxAge: z.number().nonnegative().default(1),\n      swr: z.number().nonnegative().optional(),\n      cacheErrors: z.boolean().default(false),\n    })\n    .default({ maxAge: 1, cacheErrors: false }),\n  keyDerivation: z\n    .object({\n      excludeQuery: z.array(z.string()).optional(),\n      sortQuery: z.boolean().default(true),\n      lowercaseHost: z.boolean().default(true),\n    })\n    .default({ sortQuery: true, lowercaseHost: true }),\n  routeRules: z.record(z.string(), routeRuleSchema).optional(),\n})\n","import { z } from 'zod'\n\nimport { headerSafeString } from './header-safe.js'\n\n/**\n * Phase 5 — CSRF warn-first (EC-1).\n *\n * 0.2.0 default: `warn`. Existing apps keep working but get structured\n * warnings about every state-mutating request that does not carry the\n * `X-Theo-Action: 1` header. 0.3.0 will flip the default to `strict`.\n *\n * Set explicitly to `strict` to opt into the future default early,\n * or `off` to disable CSRF entirely (only valid when you have another\n * defense — bearer auth, no session cookies, etc).\n */\n\n/**\n * Phase 6 — Default security headers (D4 / EC-2).\n *\n * 0.2.0 defaults:\n *   - CSP in `report-only` mode (EC-2: don't break existing apps)\n *   - X-Frame-Options: DENY · X-Content-Type-Options: nosniff\n *   - Referrer-Policy: strict-origin-when-cross-origin\n *   - HSTS in production only (no TLS on localhost)\n *\n * Users override individual headers, swap CSP to `enforce`, or disable\n * CSP entirely (`csp: false` / `cspMode: 'off'`).\n */\nexport const securityHeadersSchema = z.object({\n  csp: z.union([headerSafeString, z.literal(false)]).optional(),\n  // T6.1 — default flipped from 'report-only' to 'enforce' for 0.3.0.\n  // Users who want the old behaviour set `cspMode: 'report-only'`\n  // explicitly. See docs/migrating/0.2-to-0.3.md.\n  cspMode: z.enum(['enforce', 'report-only', 'off']).default('enforce'),\n  hsts: z.union([headerSafeString, z.literal(false)]).optional(),\n  frameOptions: z.enum(['DENY', 'SAMEORIGIN']).default('DENY'),\n  contentTypeOptions: z.literal('nosniff').default('nosniff'),\n  referrerPolicy: headerSafeString.default('strict-origin-when-cross-origin'),\n  /**\n   * T1.1 — Permissions-Policy directive string. EC-3-refined: rejects CR/LF.\n   * Pass `false` to suppress the header.\n   */\n  permissionsPolicy: z.union([headerSafeString, z.literal(false)]).optional(),\n})\n\n/**\n * T5.1 — Disallowed-routes escalation pattern (Rails-inspired).\n *\n * `routes` accepts string (exact match — trailing slash matters) or\n * RegExp entries. Matched routes that would otherwise emit `csrf.warn`\n * dispatch through `disallowedBehavior` instead:\n *   - `'warn'`  : no-op vs the default warn-mode behavior\n *   - `'raise'` : escalate to 403, even when global `csrf` mode is 'warn'\n *\n * Use to roll out strict mode per-route (e.g., flip /api/auth/* first)\n * without committing the entire surface to strict at once.\n */\nconst disallowedConfigSchema = z.object({\n  routes: z.array(z.union([z.string(), z.instanceof(RegExp)])),\n  behavior: z.enum(['warn', 'raise']).default('raise'),\n})\n\n/**\n * T1.2 — CORS configuration.\n *\n * `origins` accepts a single value (`'*'`, string, RegExp, callback) OR an\n * array of (string | RegExp). The spec-violating `origins: '*'` +\n * `credentials: true` combination is rejected at parse time (browsers\n * ignore wildcards when credentials are sent).\n *\n * EC-3 — `allowedHeaders` and `exposedHeaders` entries go through the\n * header-safe refinement (CR/LF rejected — CWE-113 mitigation).\n */\nexport const corsSchema = z\n  .object({\n    origins: z.union([\n      z.literal('*'),\n      headerSafeString,\n      z.instanceof(RegExp),\n      z.array(z.union([headerSafeString, z.instanceof(RegExp)])),\n      z.function({ input: z.tuple([z.string()]), output: z.boolean() }),\n    ]),\n    methods: z\n      .array(z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'HEAD']))\n      .optional(),\n    allowedHeaders: z.array(headerSafeString).optional(),\n    exposedHeaders: z.array(headerSafeString).optional(),\n    credentials: z.boolean().default(false),\n    maxAge: z.number().int().min(0).max(86400).default(600),\n  })\n  .refine((c) => !(c.origins === '*' && c.credentials), {\n    message: 'CORS spec forbids origins:\"*\" with credentials:true — browsers ignore the wildcard',\n  })\n\nexport const securitySchema = z.object({\n  // T6.1 — default flipped from 'warn' to 'strict' for 0.3.0. Apps that\n  // grep their warn-mode logs from 0.2.x already know which endpoints\n  // break; opt back into 'warn' globally OR use disallowedRoutes for\n  // surgical migration. See docs/migrating/0.2-to-0.3.md.\n  csrf: z.enum(['off', 'warn', 'strict']).default('strict'),\n  headers: securityHeadersSchema.optional(),\n  /** T5.1 — per-route escalation (Rails disallowed_warnings pattern). */\n  disallowed: disallowedConfigSchema.optional(),\n  /** T1.2 — Cross-Origin Resource Sharing. Single global config; runs first in pipeline. */\n  cors: corsSchema.optional(),\n})\n","import { z } from 'zod'\n\n/**\n * EC-3 — CWE-113 HTTP Response Splitting mitigation.\n *\n * Every string that becomes a header value must reject CR/LF. Apps that\n * derive header values from untrusted input (feature flags, tenant config,\n * URL params) would otherwise let attackers inject Set-Cookie / Location\n * headers via `\\r\\n`. Apply this refinement to every header-bound string\n * field: permissionsPolicy, csp, hsts, referrerPolicy, CORS allow/expose.\n */\nexport const headerSafeString = z\n  .string()\n  .refine((s) => !/[\\r\\n]/.test(s), { message: 'Header value must not contain CR/LF' })\n","import { z } from 'zod'\n\n/**\n * StorageManager schemas (T1.1 / ADR-0007 D4).\n *\n * `theo.config.ts > storage` declares Postgres servers (credentials), the\n * databases on each server (TheoCloud / managed PG / self-host), and Redis\n * servers. The runtime `StorageManager` consumes this block; adapters\n * (PostgresJobBackend, PostgresConversationStorage, etc.) request pools by\n * database name and never see raw credentials at the call site.\n *\n * EC-1 (DOCUMENT in concept doc T4.1): Zod default strip-unknown mode\n * silently drops typo keys (`databasees` instead of `databases`). The\n * concept doc warns users to use exact names; runtime errors are still\n * actionable (`Database \"X\" not configured`).\n *\n * EC-2 (DEFERRED to use-time): `databases.X.server` references a key in\n * `servers`. Cross-field validation is intentionally NOT enforced at parse\n * time — `StorageManager.usePostgres()` throws an actionable error on the\n * first call with the dangling reference, matching Rails / Nitro behavior.\n */\nconst tlsConfigSchema = z.object({\n  rejectUnauthorized: z.boolean().optional(),\n  caCert: z.string().optional(),\n  clientCert: z.string().optional(),\n  clientKey: z.string().optional(),\n})\n\nconst serverConfigSchema = z.object({\n  host: z.string().min(1),\n  port: z.number().int().positive().max(65535).optional(),\n  user: z.string().min(1),\n  /** Password may be the empty string (some providers permit it). */\n  password: z.string(),\n  tls: tlsConfigSchema.optional(),\n})\n\nconst postgresPoolConfigSchema = z.object({\n  min: z.number().int().nonnegative().optional(),\n  max: z.number().int().positive().optional(),\n  connectionTimeoutMillis: z.number().int().positive().optional(),\n  idleTimeoutMillis: z.number().int().nonnegative().optional(),\n})\n\nconst postgresDatabaseConfigSchema = z.object({\n  /** References a key in `storage.servers`. Resolved at `usePostgres()` call time. */\n  server: z.string().min(1),\n  database: z.string().min(1),\n  pool: postgresPoolConfigSchema.optional(),\n})\n\nconst redisServerConfigSchema = serverConfigSchema.extend({\n  db: z.number().int().nonnegative().optional(),\n  maxRetriesPerRequest: z.number().int().nonnegative().optional(),\n})\n\nexport const storageSchema = z.object({\n  servers: z.record(z.string(), serverConfigSchema).optional(),\n  databases: z.record(z.string(), postgresDatabaseConfigSchema).optional(),\n  redis: z.record(z.string(), redisServerConfigSchema).optional(),\n})\n\nexport type StorageConfig = z.infer<typeof storageSchema>\n"],"mappings":";;;;;;;AAAA,SAAS,KAAAA,UAAS;;;ACAlB,SAAS,SAAS;AAKlB,IAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAC7B,CAAC;AAOM,IAAM,kBAAkB,EAAE,MAAM;AAAA,EACrC;AAAA,EACA,EAAE,OAAO;AAAA,IACP,SAAS,oBAAoB,SAAS;AAAA,IACtC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,mBAAmB,EAAE,SAAS;AAAA,IAC3D,OAAO,EACJ,MAAM;AAAA,MACL,EAAE,KAAK,CAAC,MAAM,WAAW,MAAM,CAAC;AAAA,MAChC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AAAA,IAClE,CAAC,EACA,SAAS;AAAA,IACZ,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,CAAC;AACH,CAAC;;;AC5BD,SAAS,KAAAC,UAAS;AAEX,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,aAAaA,GACV,OAAO,EACP,IAAI,CAAC,EACL,QAAQ,KAAK,OAAO,IAAI;AAAA;AAAA,EAC3B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE;AAAA,EAC5C,cAAcA,GACX,OAAO,EACP,IAAI,CAAC,EACL,QAAQ,IAAI,OAAO,IAAI;AAAA;AAC5B,CAAC;;;ACZD,SAAS,KAAAC,UAAS;AAEX,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,OAAOA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,SAAS,QAAQ,CAAC,EAAE,QAAQ,MAAM;AAC5E,CAAC;;;ACJD,SAAS,KAAAC,UAAS;AAclB,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EAC/B,QAAQA,GAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EAC1C,KAAKA,GAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EACvC,MAAMA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AACrC,CAAC;AAEM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,SAASA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEjC,SAASA,GAAE,MAAM,CAACA,GAAE,QAAQ,QAAQ,GAAGA,GAAE,OAAgB,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC7E,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACpD,UAAUA,GACP,OAAO;AAAA,IACN,QAAQA,GAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,IAC1C,KAAKA,GAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,IACvC,aAAaA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,CAAC,EACA,QAAQ,EAAE,QAAQ,GAAG,aAAa,MAAM,CAAC;AAAA,EAC5C,eAAeA,GACZ,OAAO;AAAA,IACN,cAAcA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IAC3C,WAAWA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,IACnC,eAAeA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EACzC,CAAC,EACA,QAAQ,EAAE,WAAW,MAAM,eAAe,KAAK,CAAC;AAAA,EACnD,YAAYA,GAAE,OAAOA,GAAE,OAAO,GAAG,eAAe,EAAE,SAAS;AAC7D,CAAC;;;ACxCD,SAAS,KAAAC,UAAS;;;ACAlB,SAAS,KAAAC,UAAS;AAWX,IAAM,mBAAmBA,GAC7B,OAAO,EACP,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,GAAG,EAAE,SAAS,sCAAsC,CAAC;;;ADe/E,IAAM,wBAAwBC,GAAE,OAAO;AAAA,EAC5C,KAAKA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5D,SAASA,GAAE,KAAK,CAAC,WAAW,eAAe,KAAK,CAAC,EAAE,QAAQ,SAAS;AAAA,EACpE,MAAMA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7D,cAAcA,GAAE,KAAK,CAAC,QAAQ,YAAY,CAAC,EAAE,QAAQ,MAAM;AAAA,EAC3D,oBAAoBA,GAAE,QAAQ,SAAS,EAAE,QAAQ,SAAS;AAAA,EAC1D,gBAAgB,iBAAiB,QAAQ,iCAAiC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1E,mBAAmBA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAC5E,CAAC;AAcD,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EACtC,QAAQA,GAAE,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,EAC3D,UAAUA,GAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,QAAQ,OAAO;AACrD,CAAC;AAaM,IAAM,aAAaA,GACvB,OAAO;AAAA,EACN,SAASA,GAAE,MAAM;AAAA,IACfA,GAAE,QAAQ,GAAG;AAAA,IACb;AAAA,IACAA,GAAE,WAAW,MAAM;AAAA,IACnBA,GAAE,MAAMA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,IACzDA,GAAE,SAAS,EAAE,OAAOA,GAAE,MAAM,CAACA,GAAE,OAAO,CAAC,CAAC,GAAG,QAAQA,GAAE,QAAQ,EAAE,CAAC;AAAA,EAClE,CAAC;AAAA,EACD,SAASA,GACN,MAAMA,GAAE,KAAK,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,WAAW,MAAM,CAAC,CAAC,EAC1E,SAAS;AAAA,EACZ,gBAAgBA,GAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,EACnD,gBAAgBA,GAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,EACnD,aAAaA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAG;AACxD,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,EAAE,YAAY,OAAO,EAAE,cAAc;AAAA,EACpD,SAAS;AACX,CAAC;AAEI,IAAM,iBAAiBA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,MAAMA,GAAE,KAAK,CAAC,OAAO,QAAQ,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACxD,SAAS,sBAAsB,SAAS;AAAA;AAAA,EAExC,YAAY,uBAAuB,SAAS;AAAA;AAAA,EAE5C,MAAM,WAAW,SAAS;AAC5B,CAAC;;;AEzGD,SAAS,KAAAC,UAAS;AAqBlB,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EAC/B,oBAAoBA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACzC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EAClC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,EACtD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,UAAUA,GAAE,OAAO;AAAA,EACnB,KAAK,gBAAgB,SAAS;AAChC,CAAC;AAED,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EACxC,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC7C,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,yBAAyBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9D,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAC7D,CAAC;AAED,IAAM,+BAA+BA,GAAE,OAAO;AAAA;AAAA,EAE5C,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,yBAAyB,SAAS;AAC1C,CAAC;AAED,IAAM,0BAA0B,mBAAmB,OAAO;AAAA,EACxD,IAAIA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC5C,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAChE,CAAC;AAEM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAG,kBAAkB,EAAE,SAAS;AAAA,EAC3D,WAAWA,GAAE,OAAOA,GAAE,OAAO,GAAG,4BAA4B,EAAE,SAAS;AAAA,EACvE,OAAOA,GAAE,OAAOA,GAAE,OAAO,GAAG,uBAAuB,EAAE,SAAS;AAChE,CAAC;;;APrBM,IAAM,mBAAmBC,GAC7B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQN,MAAMA,GACH,OAAO,EACP,IAAI,EAAE,EACN;AAAA;AAAA;AAAA,IAGC,CAAC,UACC,MAAM,SAAS,KACf,gBAAgB,KAAK,KAAK,KAC1B,CAAC,MAAM,WAAW,GAAG,KACrB,CAAC,MAAM,SAAS,GAAG;AAAA,IACrB;AAAA,EACF,EACC,SAAS;AAAA,EACZ,QAAQA,GAAE,OAAO,EAAE,QAAQ,KAAK;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,WAAWA,GAAE,OAAO,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtC,SAASA,GACN,OAAO,EACP,QAAQ,UAAU,EAClB;AAAA,IACC,CAAC,MAAM,CAAC,qBAAqB,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,IAAI;AAAA,IAC1D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBF,QAAQA,GACL,OAAO;AAAA,IACN,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,IACtD,UAAUA,GACP,OAAO;AAAA;AAAA,MAEN,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAG;AAAA;AAAA,MAE9D,eAAeA,GACZ,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,QAAQ,KAAK,GAAM;AAAA,IACxB,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AAAA,EACZ,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAI;AAAA;AAAA,EAErD,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,WAAW;AAAA;AAAA,EAE5D,MAAMA,GAAE,MAAM,CAACA,GAAE,QAAQ,GAAGA,GAAE,OAAO,CAAC,CAAC,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEtD,YAAYA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAErC,gBAAgBA,GACb,MAAM;AAAA,IACLA,GAAE,QAAQ;AAAA,IACVA,GAAE,OAAO;AAAA,MACP,iBAAiBA,GAAE,QAAQ,EAAE,SAAS;AAAA,MACtC,WAAWA,GAAE,MAAMA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,OAAO,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,IACjF,CAAC;AAAA,EACH,CAAC,EACA,QAAQ,KAAK;AAAA;AAAA,EAEhB,QAAQA,GACL,OAAO;AAAA,IACN,aAAaA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IAC1C,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACzC,CAAC,EACA,SAAS;AAAA,EACZ,KAAKA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI9B,cAAcA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACvC,WAAW,gBAAgB,SAAS;AAAA,EACpC,QAAQ,aAAa,SAAS;AAAA,EAC9B,SAAS,cAAc,SAAS;AAAA,EAChC,UAAU,eAAe,SAAS;AAAA,EAClC,eAAeA,GAAE,KAAK,CAAC,QAAQ,WAAW,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA,EAI3D,SAASA,GAAE,MAAMA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,UAAUA,GACP,MAAM,CAACA,GAAE,QAAQ,GAAGA,GAAE,OAAO,EAAE,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAC9E,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,OAAOA,GACJ,OAAO;AAAA,IACN,QAAQA,GAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,CAAC,EACA,SAAS;AAAA;AAAA;AAAA,EAGZ,IAAIA,GACD,MAAM;AAAA,IACLA,GAAE,QAAQ,KAAK;AAAA,IACfA,GAAE,OAAO;AAAA,MACP,OAAOA,GAAE,KAAK,CAAC,gBAAgB,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,MAC1D,OAAOA,GAAE,KAAK,CAAC,WAAW,KAAK,CAAC,EAAE,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMZ,OAAO,YAAY,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW5B,UAAUA,GACP,MAAM;AAAA,IACLA,GAAE,QAAQ,KAAK;AAAA,IACfA,GAAE,OAAO;AAAA,MACP,UAAUA,GAAE,KAAK,CAAC,YAAY,aAAa,eAAe,cAAc,CAAC,EAAE,SAAS;AAAA,MACpF,OAAOA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,CAAC,EAAE,SAAS;AAAA,IACtD,CAAC;AAAA,EACH,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOZ,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAevC,kBAAkBA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,MAAMA,GACH,OAAO;AAAA,IACN,SAASA,GAAE,OAAgB,CAAC,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI;AAAA,EACvE,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWZ,SAAS,cAAc,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeV,SAASA,GACN,OAAO;AAAA,IACN,SAASA,GACN;AAAA,MACCA,GAAE,OAAO;AAAA,QACP,KAAKA,GAAE,IAAI;AAAA,QACX,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,MACnC,CAAC;AAAA,IACH,EACC,QAAQ,CAAC,EAAE,KAAK,yBAAyB,aAAa,oBAAoB,CAAC,CAAC;AAAA,IAC/E,aAAaA,GAAE,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,QAAQ,OAAO;AAAA,IACvD,OAAOA,GAAE,OAAO,EAAE,QAAQ,aAAa;AAAA,IACvC,SAASA,GAAE,OAAO,EAAE,QAAQ,OAAO;AAAA,IACnC,QAAQA,GAAE,OAAO,EAAE,QAAQ,UAAU;AAAA,EACvC,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBZ,aAAaA,GACV,OAAwB,CAAC,QAAQ,OAAO,QAAQ,YAAY;AAAA,IAC3D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AACd,CAAC,EAEA,OAAO,CAAC,QAAQ,CAAC,OAAO,OAAO,IAAI,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,GAAG;AAAA,EAC9E,SAAS;AAAA,EACT,MAAM,CAAC,UAAU;AACnB,CAAC;","names":["z","z","z","z","z","z","z","z","z"]}