theokit 0.48.13 → 0.50.0

package/dist/chunk-VI7ZANB3.js

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/config/schemas/rate-limit.ts
+import { z } from "zod";
+var baseRateLimitSchema = z.object({
+  windowMs: z.number().min(1),
+  max: z.number().int().min(1)
+});
+var rateLimitSchema = z.union([
+  baseRateLimitSchema,
+  z.object({
+    default: baseRateLimitSchema.optional(),
+    routes: z.record(z.string(), baseRateLimitSchema).optional(),
+    keyBy: z.union([
+      z.enum(["ip", "session", "user"]),
+      z.function({ input: z.tuple([z.unknown()]), output: z.string() })
+    ]).optional(),
+    cookieName: z.string().min(1).optional(),
+    /**
+     * How many reverse proxies sit in front of the app, for `keyBy: 'ip'`. `false` (default)
+     * trusts none; `true` means one; a number names a longer chain.
+     *
+     * Required for correct limiting behind Caddy/nginx/a load balancer — without it every visitor
+     * keys on the proxy address and shares a single bucket. Off by default because
+     * `x-forwarded-for` is client-writable.
+     */
+    trustProxy: z.union([z.boolean(), z.number().int().min(0)]).optional()
+  })
+]);
+
+// src/config/schemas/upload.ts
+import { z as z2 } from "zod";
+var uploadSchema = z2.object({
+  maxFileSize: z2.number().min(1).default(10 * 1024 * 1024),
+  // 10MB
+  maxFiles: z2.number().int().min(1).default(10),
+  maxFieldSize: z2.number().min(1).default(1 * 1024 * 1024)
+  // 1MB
+});
+
+// src/config/schemas/logging.ts
+import { z as z3 } from "zod";
+var loggingSchema = z3.object({
+  level: z3.enum(["debug", "info", "warn", "error", "silent"]).default("info")
+});
+
+// src/config/schemas/cache.ts
+import { z as z4 } from "zod";
+var routeRuleSchema = z4.object({
+  maxAge: z4.number().nonnegative().optional(),
+  swr: z4.number().nonnegative().optional(),
+  tags: z4.array(z4.string()).optional()
+});
+var cacheSchema = z4.object({
+  enabled: z4.boolean().default(true),
+  /** 'memory' uses InMemoryCacheAdapter; otherwise pass a custom adapter instance. */
+  storage: z4.union([z4.literal("memory"), z4.custom()]).default("memory"),
+  maxEntries: z4.number().int().positive().default(1e3),
+  defaults: z4.object({
+    maxAge: z4.number().nonnegative().default(1),
+    swr: z4.number().nonnegative().optional(),
+    cacheErrors: z4.boolean().default(false)
+  }).default({ maxAge: 1, cacheErrors: false }),
+  keyDerivation: z4.object({
+    excludeQuery: z4.array(z4.string()).optional(),
+    sortQuery: z4.boolean().default(true),
+    lowercaseHost: z4.boolean().default(true)
+  }).default({ sortQuery: true, lowercaseHost: true }),
+  routeRules: z4.record(z4.string(), routeRuleSchema).optional()
+});
+
+// src/config/schemas/observability.ts
+import { z as z5 } from "zod";
+var observabilitySchema = z5.object({
+  /** Set `false` to opt out even when the environment would enable an exporter. */
+  enabled: z5.boolean().default(true),
+  /**
+   * An `ObservabilityAdapter` instance. Validated structurally rather than by
+   * shape, for the same reason `storage` and `plugins` are: the config layer
+   * cannot import the adapter contract without inverting the module graph, and
+   * the adapter is a live object rather than data.
+   */
+  provider: z5.custom().optional()
+});
+
+// src/config/schemas/security.ts
+import { z as z7 } from "zod";
+
+// src/config/schemas/header-safe.ts
+import { z as z6 } from "zod";
+var headerSafeString = z6.string().refine((s) => !/[\r\n]/.test(s), { message: "Header value must not contain CR/LF" });
+
+// src/config/schemas/security.ts
+var securityHeadersSchema = z7.object({
+  csp: z7.union([headerSafeString, z7.literal(false)]).optional(),
+  // T6.1 — default flipped from 'report-only' to 'enforce' for 0.3.0.
+  // Users who want the old behaviour set `cspMode: 'report-only'`
+  // explicitly.
+  cspMode: z7.enum(["enforce", "report-only", "off"]).default("enforce"),
+  hsts: z7.union([headerSafeString, z7.literal(false)]).optional(),
+  frameOptions: z7.enum(["DENY", "SAMEORIGIN"]).default("DENY"),
+  contentTypeOptions: z7.literal("nosniff").default("nosniff"),
+  referrerPolicy: headerSafeString.default("strict-origin-when-cross-origin"),
+  /**
+   * T1.1 — Permissions-Policy directive string. EC-3-refined: rejects CR/LF.
+   * Pass `false` to suppress the header.
+   */
+  permissionsPolicy: z7.union([headerSafeString, z7.literal(false)]).optional()
+});
+var disallowedConfigSchema = z7.object({
+  routes: z7.array(z7.union([z7.string(), z7.instanceof(RegExp)])),
+  behavior: z7.enum(["warn", "raise"]).default("raise")
+});
+var corsSchema = z7.object({
+  origins: z7.union([
+    z7.literal("*"),
+    headerSafeString,
+    z7.instanceof(RegExp),
+    z7.array(z7.union([headerSafeString, z7.instanceof(RegExp)])),
+    z7.function({ input: z7.tuple([z7.string()]), output: z7.boolean() })
+  ]),
+  methods: z7.array(z7.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"])).optional(),
+  allowedHeaders: z7.array(headerSafeString).optional(),
+  exposedHeaders: z7.array(headerSafeString).optional(),
+  credentials: z7.boolean().default(false),
+  maxAge: z7.number().int().min(0).max(86400).default(600)
+}).refine((c) => !(c.origins === "*" && c.credentials), {
+  message: 'CORS spec forbids origins:"*" with credentials:true \u2014 browsers ignore the wildcard'
+});
+var securitySchema = z7.object({
+  // T6.1 — default flipped from 'warn' to 'strict' for 0.3.0. Apps that
+  // grep their warn-mode logs from 0.2.x already know which endpoints
+  // break; opt back into 'warn' globally OR use disallowedRoutes for
+  // surgical migration.
+  csrf: z7.enum(["off", "warn", "strict"]).default("strict"),
+  headers: securityHeadersSchema.optional(),
+  /** T5.1 — per-route escalation (Rails disallowed_warnings pattern). */
+  disallowed: disallowedConfigSchema.optional(),
+  /** T1.2 — Cross-Origin Resource Sharing. Single global config; runs first in pipeline. */
+  cors: corsSchema.optional()
+});
+
+// src/config/schemas/storage.ts
+import { z as z8 } from "zod";
+var tlsConfigSchema = z8.object({
+  rejectUnauthorized: z8.boolean().optional(),
+  caCert: z8.string().optional(),
+  clientCert: z8.string().optional(),
+  clientKey: z8.string().optional()
+});
+var serverConfigSchema = z8.object({
+  host: z8.string().min(1),
+  port: z8.number().int().positive().max(65535).optional(),
+  user: z8.string().min(1),
+  /** Password may be the empty string (some providers permit it). */
+  password: z8.string(),
+  tls: tlsConfigSchema.optional()
+});
+var postgresPoolConfigSchema = z8.object({
+  min: z8.number().int().nonnegative().optional(),
+  max: z8.number().int().positive().optional(),
+  connectionTimeoutMillis: z8.number().int().positive().optional(),
+  idleTimeoutMillis: z8.number().int().nonnegative().optional()
+});
+var postgresDatabaseConfigSchema = z8.object({
+  /** References a key in `storage.servers`. Resolved at `usePostgres()` call time. */
+  server: z8.string().min(1),
+  database: z8.string().min(1),
+  pool: postgresPoolConfigSchema.optional()
+});
+var redisServerConfigSchema = serverConfigSchema.extend({
+  db: z8.number().int().nonnegative().optional(),
+  maxRetriesPerRequest: z8.number().int().nonnegative().optional()
+});
+var storageSchema = z8.object({
+  servers: z8.record(z8.string(), serverConfigSchema).optional(),
+  databases: z8.record(z8.string(), postgresDatabaseConfigSchema).optional(),
+  redis: z8.record(z8.string(), redisServerConfigSchema).optional()
+});
+
+export {
+  rateLimitSchema,
+  uploadSchema,
+  loggingSchema,
+  cacheSchema,
+  observabilitySchema,
+  securityHeadersSchema,
+  corsSchema,
+  securitySchema,
+  storageSchema
+};
+//# sourceMappingURL=chunk-VI7ZANB3.js.map

package/dist/chunk-VI7ZANB3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/schemas/rate-limit.ts","../src/config/schemas/upload.ts","../src/config/schemas/logging.ts","../src/config/schemas/cache.ts","../src/config/schemas/observability.ts","../src/config/schemas/security.ts","../src/config/schemas/header-safe.ts","../src/config/schemas/storage.ts"],"sourcesContent":["import { z } from 'zod'\n\n/**\n * Base bucket config — legacy shape preserved for backwards compatibility.\n */\nconst baseRateLimitSchema = z.object({\n  windowMs: z.number().min(1),\n  max: z.number().int().min(1),\n})\n\n/**\n * T2.2 — Per-route + per-user rate limit. The new shape adds `routes`\n * (path map), `keyBy`, and `cookieName`. The legacy flat shape is still\n * accepted via the union — see `createRouteRateLimiter` for normalization.\n */\nexport const rateLimitSchema = z.union([\n  baseRateLimitSchema,\n  z.object({\n    default: baseRateLimitSchema.optional(),\n    routes: z.record(z.string(), baseRateLimitSchema).optional(),\n    keyBy: z\n      .union([\n        z.enum(['ip', 'session', 'user']),\n        z.function({ input: z.tuple([z.unknown()]), output: z.string() }),\n      ])\n      .optional(),\n    cookieName: z.string().min(1).optional(),\n    /**\n     * How many reverse proxies sit in front of the app, for `keyBy: 'ip'`. `false` (default)\n     * trusts none; `true` means one; a number names a longer chain.\n     *\n     * Required for correct limiting behind Caddy/nginx/a load balancer — without it every visitor\n     * keys on the proxy address and shares a single bucket. Off by default because\n     * `x-forwarded-for` is client-writable.\n     */\n    trustProxy: z.union([z.boolean(), z.number().int().min(0)]).optional(),\n  }),\n])\n","import { z } from 'zod'\n\nexport const uploadSchema = z.object({\n  maxFileSize: z\n    .number()\n    .min(1)\n    .default(10 * 1024 * 1024), // 10MB\n  maxFiles: z.number().int().min(1).default(10),\n  maxFieldSize: z\n    .number()\n    .min(1)\n    .default(1 * 1024 * 1024), // 1MB\n})\n","import { z } from 'zod'\n\nexport const loggingSchema = z.object({\n  level: z.enum(['debug', 'info', 'warn', 'error', 'silent']).default('info'),\n})\n","import { z } from 'zod'\n\n// `.finite()` was removed from the 4 numeric schemas below (agent-builder#319): in zod 4 it is a\n// no-op — `z.number()` already rejects `Infinity`, `-Infinity` and `NaN` by default. Measured before\n// removing, against the installed zod 4.4.3, and not assumed from the deprecation message: all five\n// cases (`Infinity`, `-Infinity`, `NaN`, `1.5`, `0`) give the SAME verdict with and without it.\n\n/**\n * Cache subsystem config (caching-and-revalidation-plan).\n * Default `cache: undefined` keeps the framework backward-compatible\n * (no engine initialized → no cache primitives available).\n *\n * Setting `cache: {}` opts in with all defaults.\n */\nconst routeRuleSchema = z.object({\n  maxAge: z.number().nonnegative().optional(),\n  swr: z.number().nonnegative().optional(),\n  tags: z.array(z.string()).optional(),\n})\n\nexport const cacheSchema = z.object({\n  enabled: z.boolean().default(true),\n  /** 'memory' uses InMemoryCacheAdapter; otherwise pass a custom adapter instance. */\n  storage: z.union([z.literal('memory'), z.custom<unknown>()]).default('memory'),\n  maxEntries: z.number().int().positive().default(1000),\n  defaults: z\n    .object({\n      maxAge: z.number().nonnegative().default(1),\n      swr: z.number().nonnegative().optional(),\n      cacheErrors: z.boolean().default(false),\n    })\n    .default({ maxAge: 1, cacheErrors: false }),\n  keyDerivation: z\n    .object({\n      excludeQuery: z.array(z.string()).optional(),\n      sortQuery: z.boolean().default(true),\n      lowercaseHost: z.boolean().default(true),\n    })\n    .default({ sortQuery: true, lowercaseHost: true }),\n  routeRules: z.record(z.string(), routeRuleSchema).optional(),\n})\n","import { z } from 'zod'\n\n/**\n * Observability subsystem config.\n *\n * `adapter-registry.ts` has documented `theo.config.ts > observability.provider`\n * as the first source in its resolution chain since it was written, and the key\n * did not exist in the schema — so the chain's highest-priority entry was\n * unreachable and every consumer fell through to the environment\n * (usetheokit/theokit#353).\n *\n * Default `observability: undefined` keeps telemetry off, which is what an\n * application that never asked for it should get.\n */\nexport const observabilitySchema = z.object({\n  /** Set `false` to opt out even when the environment would enable an exporter. */\n  enabled: z.boolean().default(true),\n  /**\n   * An `ObservabilityAdapter` instance. Validated structurally rather than by\n   * shape, for the same reason `storage` and `plugins` are: the config layer\n   * cannot import the adapter contract without inverting the module graph, and\n   * the adapter is a live object rather than data.\n   */\n  provider: z.custom<unknown>().optional(),\n})\n","import { z } from 'zod'\n\nimport { headerSafeString } from './header-safe.js'\n\n/**\n * Phase 5 — CSRF warn-first (EC-1).\n *\n * 0.2.0 default: `warn`. Existing apps keep working but get structured\n * warnings about every state-mutating request that does not carry the\n * `X-Theo-Action: 1` header. 0.3.0 will flip the default to `strict`.\n *\n * Set explicitly to `strict` to opt into the future default early,\n * or `off` to disable CSRF entirely (only valid when you have another\n * defense — bearer auth, no session cookies, etc).\n */\n\n/**\n * Phase 6 — Default security headers (D4 / EC-2).\n *\n * 0.2.0 defaults:\n *   - CSP in `report-only` mode (EC-2: don't break existing apps)\n *   - X-Frame-Options: DENY · X-Content-Type-Options: nosniff\n *   - Referrer-Policy: strict-origin-when-cross-origin\n *   - HSTS in production only (no TLS on localhost)\n *\n * Users override individual headers, swap CSP to `enforce`, or disable\n * CSP entirely (`csp: false` / `cspMode: 'off'`).\n */\nexport const securityHeadersSchema = z.object({\n  csp: z.union([headerSafeString, z.literal(false)]).optional(),\n  // T6.1 — default flipped from 'report-only' to 'enforce' for 0.3.0.\n  // Users who want the old behaviour set `cspMode: 'report-only'`\n  // explicitly.\n  cspMode: z.enum(['enforce', 'report-only', 'off']).default('enforce'),\n  hsts: z.union([headerSafeString, z.literal(false)]).optional(),\n  frameOptions: z.enum(['DENY', 'SAMEORIGIN']).default('DENY'),\n  contentTypeOptions: z.literal('nosniff').default('nosniff'),\n  referrerPolicy: headerSafeString.default('strict-origin-when-cross-origin'),\n  /**\n   * T1.1 — Permissions-Policy directive string. EC-3-refined: rejects CR/LF.\n   * Pass `false` to suppress the header.\n   */\n  permissionsPolicy: z.union([headerSafeString, z.literal(false)]).optional(),\n})\n\n/**\n * T5.1 — Disallowed-routes escalation pattern (Rails-inspired).\n *\n * `routes` accepts string (exact match — trailing slash matters) or\n * RegExp entries. Matched routes that would otherwise emit `csrf.warn`\n * dispatch through `disallowedBehavior` instead:\n *   - `'warn'`  : no-op vs the default warn-mode behavior\n *   - `'raise'` : escalate to 403, even when global `csrf` mode is 'warn'\n *\n * Use to roll out strict mode per-route (e.g., flip /api/auth/* first)\n * without committing the entire surface to strict at once.\n */\nconst disallowedConfigSchema = z.object({\n  routes: z.array(z.union([z.string(), z.instanceof(RegExp)])),\n  behavior: z.enum(['warn', 'raise']).default('raise'),\n})\n\n/**\n * T1.2 — CORS configuration.\n *\n * `origins` accepts a single value (`'*'`, string, RegExp, callback) OR an\n * array of (string | RegExp). The spec-violating `origins: '*'` +\n * `credentials: true` combination is rejected at parse time (browsers\n * ignore wildcards when credentials are sent).\n *\n * EC-3 — `allowedHeaders` and `exposedHeaders` entries go through the\n * header-safe refinement (CR/LF rejected — CWE-113 mitigation).\n */\nexport const corsSchema = z\n  .object({\n    origins: z.union([\n      z.literal('*'),\n      headerSafeString,\n      z.instanceof(RegExp),\n      z.array(z.union([headerSafeString, z.instanceof(RegExp)])),\n      z.function({ input: z.tuple([z.string()]), output: z.boolean() }),\n    ]),\n    methods: z\n      .array(z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'HEAD']))\n      .optional(),\n    allowedHeaders: z.array(headerSafeString).optional(),\n    exposedHeaders: z.array(headerSafeString).optional(),\n    credentials: z.boolean().default(false),\n    maxAge: z.number().int().min(0).max(86400).default(600),\n  })\n  .refine((c) => !(c.origins === '*' && c.credentials), {\n    message: 'CORS spec forbids origins:\"*\" with credentials:true — browsers ignore the wildcard',\n  })\n\nexport const securitySchema = z.object({\n  // T6.1 — default flipped from 'warn' to 'strict' for 0.3.0. Apps that\n  // grep their warn-mode logs from 0.2.x already know which endpoints\n  // break; opt back into 'warn' globally OR use disallowedRoutes for\n  // surgical migration.\n  csrf: z.enum(['off', 'warn', 'strict']).default('strict'),\n  headers: securityHeadersSchema.optional(),\n  /** T5.1 — per-route escalation (Rails disallowed_warnings pattern). */\n  disallowed: disallowedConfigSchema.optional(),\n  /** T1.2 — Cross-Origin Resource Sharing. Single global config; runs first in pipeline. */\n  cors: corsSchema.optional(),\n})\n","import { z } from 'zod'\n\n/**\n * EC-3 — CWE-113 HTTP Response Splitting mitigation.\n *\n * Every string that becomes a header value must reject CR/LF. Apps that\n * derive header values from untrusted input (feature flags, tenant config,\n * URL params) would otherwise let attackers inject Set-Cookie / Location\n * headers via `\\r\\n`. Apply this refinement to every header-bound string\n * field: permissionsPolicy, csp, hsts, referrerPolicy, CORS allow/expose.\n */\nexport const headerSafeString = z\n  .string()\n  .refine((s) => !/[\\r\\n]/.test(s), { message: 'Header value must not contain CR/LF' })\n","import { z } from 'zod'\n\n/**\n * StorageManager schemas (T1.1 / ADR-0007 D4).\n *\n * `theo.config.ts > storage` declares Postgres servers (credentials), the\n * databases on each server (TheoCloud / managed PG / self-host), and Redis\n * servers. The runtime `StorageManager` consumes this block; adapters\n * (PostgresJobBackend, PostgresConversationStorage, etc.) request pools by\n * database name and never see raw credentials at the call site.\n *\n * EC-1 (DOCUMENT in concept doc T4.1): Zod default strip-unknown mode\n * silently drops typo keys (`databasees` instead of `databases`). The\n * concept doc warns users to use exact names; runtime errors are still\n * actionable (`Database \"X\" not configured`).\n *\n * EC-2 (DEFERRED to use-time): `databases.X.server` references a key in\n * `servers`. Cross-field validation is intentionally NOT enforced at parse\n * time — `StorageManager.usePostgres()` throws an actionable error on the\n * first call with the dangling reference, matching Rails / Nitro behavior.\n */\nconst tlsConfigSchema = z.object({\n  rejectUnauthorized: z.boolean().optional(),\n  caCert: z.string().optional(),\n  clientCert: z.string().optional(),\n  clientKey: z.string().optional(),\n})\n\nconst serverConfigSchema = z.object({\n  host: z.string().min(1),\n  port: z.number().int().positive().max(65535).optional(),\n  user: z.string().min(1),\n  /** Password may be the empty string (some providers permit it). */\n  password: z.string(),\n  tls: tlsConfigSchema.optional(),\n})\n\nconst postgresPoolConfigSchema = z.object({\n  min: z.number().int().nonnegative().optional(),\n  max: z.number().int().positive().optional(),\n  connectionTimeoutMillis: z.number().int().positive().optional(),\n  idleTimeoutMillis: z.number().int().nonnegative().optional(),\n})\n\nconst postgresDatabaseConfigSchema = z.object({\n  /** References a key in `storage.servers`. Resolved at `usePostgres()` call time. */\n  server: z.string().min(1),\n  database: z.string().min(1),\n  pool: postgresPoolConfigSchema.optional(),\n})\n\nconst redisServerConfigSchema = serverConfigSchema.extend({\n  db: z.number().int().nonnegative().optional(),\n  maxRetriesPerRequest: z.number().int().nonnegative().optional(),\n})\n\nexport const storageSchema = z.object({\n  servers: z.record(z.string(), serverConfigSchema).optional(),\n  databases: z.record(z.string(), postgresDatabaseConfigSchema).optional(),\n  redis: z.record(z.string(), redisServerConfigSchema).optional(),\n})\n\nexport type StorageConfig = z.infer<typeof storageSchema>\n"],"mappings":";;;;AAAA,SAAS,SAAS;AAKlB,IAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAC7B,CAAC;AAOM,IAAM,kBAAkB,EAAE,MAAM;AAAA,EACrC;AAAA,EACA,EAAE,OAAO;AAAA,IACP,SAAS,oBAAoB,SAAS;AAAA,IACtC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,mBAAmB,EAAE,SAAS;AAAA,IAC3D,OAAO,EACJ,MAAM;AAAA,MACL,EAAE,KAAK,CAAC,MAAM,WAAW,MAAM,CAAC;AAAA,MAChC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AAAA,IAClE,CAAC,EACA,SAAS;AAAA,IACZ,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASvC,YAAY,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS;AAAA,EACvE,CAAC;AACH,CAAC;;;ACrCD,SAAS,KAAAA,UAAS;AAEX,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,aAAaA,GACV,OAAO,EACP,IAAI,CAAC,EACL,QAAQ,KAAK,OAAO,IAAI;AAAA;AAAA,EAC3B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE;AAAA,EAC5C,cAAcA,GACX,OAAO,EACP,IAAI,CAAC,EACL,QAAQ,IAAI,OAAO,IAAI;AAAA;AAC5B,CAAC;;;ACZD,SAAS,KAAAC,UAAS;AAEX,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,OAAOA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,SAAS,QAAQ,CAAC,EAAE,QAAQ,MAAM;AAC5E,CAAC;;;ACJD,SAAS,KAAAC,UAAS;AAclB,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EAC/B,QAAQA,GAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EAC1C,KAAKA,GAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EACvC,MAAMA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AACrC,CAAC;AAEM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,SAASA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEjC,SAASA,GAAE,MAAM,CAACA,GAAE,QAAQ,QAAQ,GAAGA,GAAE,OAAgB,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC7E,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACpD,UAAUA,GACP,OAAO;AAAA,IACN,QAAQA,GAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,IAC1C,KAAKA,GAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,IACvC,aAAaA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,CAAC,EACA,QAAQ,EAAE,QAAQ,GAAG,aAAa,MAAM,CAAC;AAAA,EAC5C,eAAeA,GACZ,OAAO;AAAA,IACN,cAAcA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IAC3C,WAAWA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,IACnC,eAAeA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EACzC,CAAC,EACA,QAAQ,EAAE,WAAW,MAAM,eAAe,KAAK,CAAC;AAAA,EACnD,YAAYA,GAAE,OAAOA,GAAE,OAAO,GAAG,eAAe,EAAE,SAAS;AAC7D,CAAC;;;ACxCD,SAAS,KAAAC,UAAS;AAcX,IAAM,sBAAsBA,GAAE,OAAO;AAAA;AAAA,EAE1C,SAASA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjC,UAAUA,GAAE,OAAgB,EAAE,SAAS;AACzC,CAAC;;;ACxBD,SAAS,KAAAC,UAAS;;;ACAlB,SAAS,KAAAC,UAAS;AAWX,IAAM,mBAAmBA,GAC7B,OAAO,EACP,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,GAAG,EAAE,SAAS,sCAAsC,CAAC;;;ADe/E,IAAM,wBAAwBC,GAAE,OAAO;AAAA,EAC5C,KAAKA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5D,SAASA,GAAE,KAAK,CAAC,WAAW,eAAe,KAAK,CAAC,EAAE,QAAQ,SAAS;AAAA,EACpE,MAAMA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7D,cAAcA,GAAE,KAAK,CAAC,QAAQ,YAAY,CAAC,EAAE,QAAQ,MAAM;AAAA,EAC3D,oBAAoBA,GAAE,QAAQ,SAAS,EAAE,QAAQ,SAAS;AAAA,EAC1D,gBAAgB,iBAAiB,QAAQ,iCAAiC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1E,mBAAmBA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAC5E,CAAC;AAcD,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EACtC,QAAQA,GAAE,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,EAC3D,UAAUA,GAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,QAAQ,OAAO;AACrD,CAAC;AAaM,IAAM,aAAaA,GACvB,OAAO;AAAA,EACN,SAASA,GAAE,MAAM;AAAA,IACfA,GAAE,QAAQ,GAAG;AAAA,IACb;AAAA,IACAA,GAAE,WAAW,MAAM;AAAA,IACnBA,GAAE,MAAMA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,IACzDA,GAAE,SAAS,EAAE,OAAOA,GAAE,MAAM,CAACA,GAAE,OAAO,CAAC,CAAC,GAAG,QAAQA,GAAE,QAAQ,EAAE,CAAC;AAAA,EAClE,CAAC;AAAA,EACD,SAASA,GACN,MAAMA,GAAE,KAAK,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,WAAW,MAAM,CAAC,CAAC,EAC1E,SAAS;AAAA,EACZ,gBAAgBA,GAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,EACnD,gBAAgBA,GAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,EACnD,aAAaA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAG;AACxD,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,EAAE,YAAY,OAAO,EAAE,cAAc;AAAA,EACpD,SAAS;AACX,CAAC;AAEI,IAAM,iBAAiBA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,MAAMA,GAAE,KAAK,CAAC,OAAO,QAAQ,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACxD,SAAS,sBAAsB,SAAS;AAAA;AAAA,EAExC,YAAY,uBAAuB,SAAS;AAAA;AAAA,EAE5C,MAAM,WAAW,SAAS;AAC5B,CAAC;;;AEzGD,SAAS,KAAAC,UAAS;AAqBlB,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EAC/B,oBAAoBA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACzC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EAClC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,EACtD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,UAAUA,GAAE,OAAO;AAAA,EACnB,KAAK,gBAAgB,SAAS;AAChC,CAAC;AAED,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EACxC,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC7C,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,yBAAyBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9D,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAC7D,CAAC;AAED,IAAM,+BAA+BA,GAAE,OAAO;AAAA;AAAA,EAE5C,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,yBAAyB,SAAS;AAC1C,CAAC;AAED,IAAM,0BAA0B,mBAAmB,OAAO;AAAA,EACxD,IAAIA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC5C,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAChE,CAAC;AAEM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAG,kBAAkB,EAAE,SAAS;AAAA,EAC3D,WAAWA,GAAE,OAAOA,GAAE,OAAO,GAAG,4BAA4B,EAAE,SAAS;AAAA,EACvE,OAAOA,GAAE,OAAOA,GAAE,OAAO,GAAG,uBAAuB,EAAE,SAAS;AAChE,CAAC;","names":["z","z","z","z","z","z","z","z"]}

package/dist/chunk-VQPHPQ5L.js

@@ -0,0 +1,14 @@
+// src/vite-plugin/resolve-theo-root.ts
+import { existsSync } from "fs";
+import { resolve } from "path";
+function resolveTheoRootDir(currentDir) {
+  if (existsSync(resolve(currentDir, "client"))) {
+    return currentDir;
+  }
+  return resolve(currentDir, "..");
+}
+
+export {
+  resolveTheoRootDir
+};
+//# sourceMappingURL=chunk-VQPHPQ5L.js.map

package/dist/chunk-VQPHPQ5L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vite-plugin/resolve-theo-root.ts"],"mappings":";AAIA,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AAiBjB,SAAS,mBAAmB,YAA4B;AAC7D,MAAI,WAAW,QAAQ,YAAY,QAAQ,CAAC,GAAG;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,YAAY,IAAI;AACjC;","names":[]}

package/dist/chunk-WNJTJRM6.js

@@ -0,0 +1,147 @@
+// src/server/_internal/log-safe.ts
+var DEFAULT_MAX_LEN = 100;
+function limitUntrustedHeaderValueForLogs(value, maxLen = DEFAULT_MAX_LEN) {
+  const truncated = value.length > maxLen ? `${value.slice(0, maxLen)}\u2026` : value;
+  return truncated.replace(/[\x00-\x1F\x7F]/g, (ch) => {
+    const code = ch.charCodeAt(0);
+    return `\\x${code.toString(16).padStart(2, "0").toUpperCase()}`;
+  });
+}
+
+// src/server/security/wildcard-origin.ts
+function matchWildcardDomain(domain, pattern) {
+  const normalizedDomain = domain.replace(/[A-Z]/g, (c) => c.toLowerCase());
+  const normalizedPattern = pattern.replace(/[A-Z]/g, (c) => c.toLowerCase());
+  const domainParts = normalizedDomain.split(".");
+  const patternParts = normalizedPattern.split(".");
+  if (patternParts.length < 1) return false;
+  if (domainParts.length < patternParts.length) return false;
+  if (patternParts.length === 1) {
+    const only = patternParts[0];
+    if (only === "*" || only === "**") return false;
+  }
+  while (patternParts.length > 0) {
+    const patternPart = patternParts.pop();
+    const domainPart = domainParts.pop();
+    if (patternPart === "") return false;
+    if (patternPart === "*") {
+      if (domainPart) continue;
+      return false;
+    }
+    if (patternPart === "**") {
+      if (patternParts.length > 0) return false;
+      return domainPart !== void 0;
+    }
+    if (domainPart !== patternPart) return false;
+  }
+  return domainParts.length === 0;
+}
+function isCsrfOriginAllowed(originDomain, allowedOrigins = []) {
+  const normalizedOrigin = originDomain.replace(/[A-Z]/g, (c) => c.toLowerCase());
+  return allowedOrigins.some((allowed) => {
+    if (!allowed) return false;
+    const normalizedAllowed = allowed.replace(/[A-Z]/g, (c) => c.toLowerCase());
+    return normalizedAllowed === normalizedOrigin || matchWildcardDomain(originDomain, allowed);
+  });
+}
+
+// src/server/security/csrf-multi-header.ts
+function evaluateCsrfMultiHeaderFromInputs(inputs, ownOrigin, options) {
+  if (inputs.secFetchSite !== void 0) {
+    if (inputs.secFetchSite === "same-origin" || inputs.secFetchSite === "none") {
+      return { allow: true, signal: "sec-fetch-site" };
+    }
+    return {
+      allow: false,
+      signal: "sec-fetch-site",
+      reason: `Sec-Fetch-Site header indicates ${limitUntrustedHeaderValueForLogs(inputs.secFetchSite)}`
+    };
+  }
+  if (inputs.origin !== void 0) {
+    if (inputs.origin === "null") {
+      return { allow: false, signal: "origin", reason: "Origin is null (opaque origin)" };
+    }
+    if (originMatches(inputs.origin, ownOrigin, options.allowedOrigins)) {
+      return { allow: true, signal: "origin" };
+    }
+    return { allow: false, signal: "origin", reason: "Origin not in allowlist" };
+  }
+  if (inputs.referer !== void 0) {
+    const refererOrigin = safeOriginFromUrl(inputs.referer);
+    if (refererOrigin === void 0) {
+      return { allow: false, signal: "referer", reason: "Referer not a valid URL" };
+    }
+    if (originMatches(refererOrigin, ownOrigin, options.allowedOrigins)) {
+      return { allow: true, signal: "referer" };
+    }
+    return { allow: false, signal: "referer", reason: "Referer origin not in allowlist" };
+  }
+  if (options.allowRequestsWithoutOriginCheck === true) {
+    return { allow: true, signal: "no-headers-allowed" };
+  }
+  return {
+    allow: false,
+    signal: "no-headers",
+    reason: "No Sec-Fetch-Site / Origin / Referer header provided"
+  };
+}
+function evaluateCsrfMultiHeaderRequest(request, options = {}) {
+  const ownOrigin = getOwnOriginFromRequest(request, options.trustForwardedHeaders === true);
+  return evaluateCsrfMultiHeaderFromInputs(
+    {
+      secFetchSite: request.headers.get("sec-fetch-site") ?? void 0,
+      origin: request.headers.get("origin") ?? void 0,
+      referer: request.headers.get("referer") ?? void 0
+    },
+    ownOrigin,
+    options
+  );
+}
+function getOwnOriginFromRequest(request, trustForwarded) {
+  if (trustForwarded) {
+    const fwdHost = request.headers.get("x-forwarded-host");
+    if (fwdHost !== null && fwdHost.length > 0) {
+      const fwdProto = request.headers.get("x-forwarded-proto") ?? "http";
+      return `${fwdProto}://${fwdHost}`;
+    }
+  }
+  const host = request.headers.get("host");
+  if (host !== null && host.length > 0) {
+    return `http://${host}`;
+  }
+  try {
+    return new URL(request.url).origin;
+  } catch {
+    return void 0;
+  }
+}
+function originMatches(candidateOrigin, ownOrigin, allowedOrigins) {
+  if (candidateOrigin.toLowerCase() === ownOrigin?.toLowerCase()) {
+    return true;
+  }
+  const host = safeHostFromUrl(candidateOrigin);
+  if (host === void 0) return false;
+  if (allowedOrigins === void 0 || allowedOrigins.length === 0) return false;
+  return isCsrfOriginAllowed(host, allowedOrigins);
+}
+function safeOriginFromUrl(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return void 0;
+  }
+}
+function safeHostFromUrl(originLike) {
+  try {
+    return new URL(originLike).host;
+  } catch {
+    return void 0;
+  }
+}
+
+export {
+  matchWildcardDomain,
+  isCsrfOriginAllowed,
+  evaluateCsrfMultiHeaderRequest
+};
+//# sourceMappingURL=chunk-WNJTJRM6.js.map

package/dist/chunk-WNJTJRM6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/_internal/log-safe.ts","../src/server/security/wildcard-origin.ts","../src/server/security/csrf-multi-header.ts"],"mappings":";AASA,IAAM,kBAAkB;AAOjB,SAAS,iCACd,OACA,SAAiB,iBACT;AACR,QAAM,YAAY,MAAM,SAAS,SAAS,GAAG,MAAM,MAAM,GAAG,MAAM,CAAC,WAAM;AAKzE,SAAO,UAAU,QAAQ,oBAAoB,CAAC,OAAO;AACnD,UAAM,OAAO,GAAG,WAAW,CAAC;AAC5B,WAAO,MAAM,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,EAAE,YAAY,CAAC;AAAA,EAC/D,CAAC;AACH;;;ACZO,SAAS,oBAAoB,QAAgB,SAA0B;AAC5E,QAAM,mBAAmB,OAAO,QAAQ,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;AACxE,QAAM,oBAAoB,QAAQ,QAAQ,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;AAE1E,QAAM,cAAc,iBAAiB,MAAM,GAAG;AAC9C,QAAM,eAAe,kBAAkB,MAAM,GAAG;AAEhD,MAAI,aAAa,SAAS,EAAG,QAAO;AACpC,MAAI,YAAY,SAAS,aAAa,OAAQ,QAAO;AAGrD,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,OAAO,aAAa,CAAC;AAC3B,QAAI,SAAS,OAAO,SAAS,KAAM,QAAO;AAAA,EAC5C;AAEA,SAAO,aAAa,SAAS,GAAG;AAC9B,UAAM,cAAc,aAAa,IAAI;AACrC,UAAM,aAAa,YAAY,IAAI;AAEnC,QAAI,gBAAgB,GAAI,QAAO;AAC/B,QAAI,gBAAgB,KAAK;AACvB,UAAI,WAAY;AAChB,aAAO;AAAA,IACT;AACA,QAAI,gBAAgB,MAAM;AAExB,UAAI,aAAa,SAAS,EAAG,QAAO;AACpC,aAAO,eAAe;AAAA,IACxB;AACA,QAAI,eAAe,YAAa,QAAO;AAAA,EACzC;AAEA,SAAO,YAAY,WAAW;AAChC;AAMO,SAAS,oBACd,cACA,iBAAoC,CAAC,GAC5B;AACT,QAAM,mBAAmB,aAAa,QAAQ,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;AAC9E,SAAO,eAAe,KAAK,CAAC,YAAY;AACtC,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,oBAAoB,QAAQ,QAAQ,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;AAC1E,WAAO,sBAAsB,oBAAoB,oBAAoB,cAAc,OAAO;AAAA,EAC5F,CAAC;AACH;;;ACGA,SAAS,kCACP,QACA,WACA,SACc;AASd,MAAI,OAAO,iBAAiB,QAAW;AACrC,QAAI,OAAO,iBAAiB,iBAAiB,OAAO,iBAAiB,QAAQ;AAC3E,aAAO,EAAE,OAAO,MAAM,QAAQ,iBAAiB;AAAA,IACjD;AACA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,QAAQ,mCAAmC,iCAAiC,OAAO,YAAY,CAAC;AAAA,IAClG;AAAA,EACF;AAGA,MAAI,OAAO,WAAW,QAAW;AAK/B,QAAI,OAAO,WAAW,QAAQ;AAC5B,aAAO,EAAE,OAAO,OAAO,QAAQ,UAAU,QAAQ,iCAAiC;AAAA,IACpF;AACA,QAAI,cAAc,OAAO,QAAQ,WAAW,QAAQ,cAAc,GAAG;AACnE,aAAO,EAAE,OAAO,MAAM,QAAQ,SAAS;AAAA,IACzC;AACA,WAAO,EAAE,OAAO,OAAO,QAAQ,UAAU,QAAQ,0BAA0B;AAAA,EAC7E;AAGA,MAAI,OAAO,YAAY,QAAW;AAChC,UAAM,gBAAgB,kBAAkB,OAAO,OAAO;AACtD,QAAI,kBAAkB,QAAW;AAC/B,aAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,QAAQ,0BAA0B;AAAA,IAC9E;AACA,QAAI,cAAc,eAAe,WAAW,QAAQ,cAAc,GAAG;AACnE,aAAO,EAAE,OAAO,MAAM,QAAQ,UAAU;AAAA,IAC1C;AACA,WAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,QAAQ,kCAAkC;AAAA,EACtF;AAGA,MAAI,QAAQ,oCAAoC,MAAM;AACpD,WAAO,EAAE,OAAO,MAAM,QAAQ,qBAAqB;AAAA,EACrD;AACA,SAAO;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACF;AAgBO,SAAS,+BACd,SACA,UAAkC,CAAC,GACrB;AACd,QAAM,YAAY,wBAAwB,SAAS,QAAQ,0BAA0B,IAAI;AACzF,SAAO;AAAA,IACL;AAAA,MACE,cAAc,QAAQ,QAAQ,IAAI,gBAAgB,KAAK;AAAA,MACvD,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AAAA,MACzC,SAAS,QAAQ,QAAQ,IAAI,SAAS,KAAK;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAYA,SAAS,wBAAwB,SAAkB,gBAA6C;AAC9F,MAAI,gBAAgB;AAClB,UAAM,UAAU,QAAQ,QAAQ,IAAI,kBAAkB;AACtD,QAAI,YAAY,QAAQ,QAAQ,SAAS,GAAG;AAC1C,YAAM,WAAW,QAAQ,QAAQ,IAAI,mBAAmB,KAAK;AAC7D,aAAO,GAAG,QAAQ,MAAM,OAAO;AAAA,IACjC;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,QAAQ,IAAI,MAAM;AACvC,MAAI,SAAS,QAAQ,KAAK,SAAS,GAAG;AACpC,WAAO,UAAU,IAAI;AAAA,EACvB;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cACP,iBACA,WACA,gBACS;AAET,MAAI,gBAAgB,YAAY,MAAM,WAAW,YAAY,GAAG;AAC9D,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,gBAAgB,eAAe;AAC5C,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAI,mBAAmB,UAAa,eAAe,WAAW,EAAG,QAAO;AACxE,SAAO,oBAAoB,MAAM,cAAc;AACjD;AAEA,SAAS,kBAAkB,KAAiC;AAC1D,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,YAAwC;AAC/D,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,EAAE;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}