theokit 0.48.13 → 0.50.0

package/dist/chunk-5YPXXSYY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/_internal/process-singleton.ts","../src/server/agent/provider-resolver.ts","../src/server/agent/approval-registry.ts"],"sourcesContent":["/**\n * One object per PROCESS, whatever the bundler did to the module holding it.\n *\n * ## The defect this exists to remove\n *\n * A module-level `let x` gives one instance per **module instance**, and a bundler is free to place\n * the same source in more than one chunk. When it does, each chunk gets its own `x` and any state\n * written through one is invisible through the other.\n *\n * Measured in this repository's own `dist` (usetheokit/theokit#401) by grepping the built chunks for\n * each module's marker: `provider-resolver` lands in two chunks, and `approval-registry` in two.\n * Neither copy is redundant — one of the provider chunks is tree-shaken to `resolveProvider` and\n * does not carry `resetProviderRegistry` at all, which is precisely how the halves diverge: an\n * application calling `registerProvider` — public API, with a documented self-hosting example —\n * mutated the array in one chunk while `theokit start` resolved against the array in the other.\n *\n * The second is worse in kind, because `approval-registry.ts` states the requirement in its own\n * source: *\"the approval a request awaits and the approval the route resolves MUST be the same\n * object, so a single instance per process is not a convenience but a correctness requirement.\"* A\n * chunk boundary can break that silently, and the symptom would be a HITL pause that never resumes.\n *\n * ## Why `globalThis` and not better chunking\n *\n * Chunking is a bundler heuristic that changes between versions and with the shape of the import\n * graph. A fix that depends on tsup continuing to place this module in exactly one chunk is a fix\n * that holds until someone adds an import. `Symbol.for` gives a key that is equal across every\n * module instance in the realm, so identity stops depending on the build at all.\n *\n * @internal\n */\n\n/** Namespaced so a key cannot collide with an unrelated global. */\nconst NAMESPACE = 'theokit.singleton.'\n\n/**\n * The object registered under `key`, creating it with `factory` the first time.\n *\n * `factory` runs at most once per process. A later call with the same key returns what the first\n * call built and never replaces it — replacing it is the same defect wearing a different hat, since\n * two callers would again hold different objects.\n */\nexport function processSingleton<T extends object>(key: string, factory: () => T): T {\n  const slot = Symbol.for(NAMESPACE + key)\n  const host = globalThis as unknown as Record<symbol, T | undefined>\n\n  const existing = host[slot]\n  if (existing !== undefined) return existing\n\n  const created = factory()\n  host[slot] = created\n  return created\n}\n","import { processSingleton } from '../_internal/process-singleton.js'\n\n/**\n * Provider Resolver — Strategy + Registry pattern (FAANG-grade).\n *\n * Inspiration: Dapr Conversation Registry (`dapr/pkg/components/conversation/registry.go`)\n * + Encore Manager provider array (`encore/runtimes/go/pubsub/manager_internal.go`).\n *\n * Principle: provider routing is the FRAMEWORK's responsibility, not the consumer's — but the\n * consumer still gets to SAY which provider it wants, and it says so in the model id.\n *\n * `provider/model` is the convention every agent in this ecosystem already writes\n * (`anthropic/claude-sonnet-4-6`, `openrouter/anthropic/claude-haiku-4.5`), and it is the one the\n * SDK routes on. Until theokit#326 this resolver ignored it entirely and picked by env-var\n * priority, so an agent that declared `anthropic/...` was handed an OpenRouter key whenever one\n * happened to be present — and every turn failed with `auth_failed (HTTP 401)` against a provider\n * nobody asked for. The declared provider now wins; priority is the fallback for a bare model id.\n *\n * Wire protocol: OpenAI Chat Completions (universal — implemented by every\n * os providers: OpenRouter, Groq, Mistral, Together, Anthropic via proxy, etc).\n *\n * Resolution by priority (FIRST match wins):\n *   1. OPENROUTER_API_KEY → baseUrl=openrouter.ai (multi-model gateway)\n *   2. OPENAI_API_KEY     → baseUrl=api.openai.com\n *   3. ANTHROPIC_API_KEY  → direct Anthropic (Messages API, not OpenAI-compat)\n *\n * Escape hatch: an explicit `options.apiKey` OVERRIDES auto-resolution\n * (the consumer can force a specific provider if it wants to).\n */\n\n/**\n * Provider configuration descriptor — Registry entry shape.\n *\n * @public\n */\nexport interface ProviderDescriptor {\n  /** Stable name used internally — not exposed on the wire. */\n  name: string\n  /**\n   * Environment variable that holds the API key for this provider.\n   *\n   * **Absent means the provider needs no credential** — a model running on the developer's own\n   * machine has nothing to authenticate against. Such a provider is reachable ONLY when a model id\n   * names it (`ollama/llama3.2`); it never participates in the priority walk, because the walk\n   * reads \"this variable is set\" as \"a human configured this provider\", and a keyless entry offers\n   * no equivalent signal. Including it would route every bare model id to localhost the moment no\n   * cloud key was set (usetheokit/theokit#407).\n   */\n  envKey?: string\n  /** Base URL for the provider's OpenAI-compatible (or native) API. */\n  baseUrl: string\n  /**\n   * Environment variable that OVERRIDES {@link baseUrl} when set.\n   *\n   * Scoped honestly: every caller inside this framework takes `.apiKey` from the resolved provider\n   * and discards `.baseUrl` (`cli/commands/start/handlers.ts`, `vite-plugin/api-middleware.ts`,\n   * `cli/commands/agent.ts`), so the endpoint a request actually reaches is chosen by the SDK, from\n   * its own profile — which reads `OLLAMA_HOST` itself. This field therefore does not redirect\n   * traffic today.\n   *\n   * It exists so that the `baseUrl` this function REPORTS agrees with where the request goes, for\n   * the consumers that read it — `resolveProvider` is public API, and a reported endpoint that\n   * contradicts the real one is a debugging trap rather than a harmless inaccuracy.\n   */\n  baseUrlEnv?: string\n  /** Resolution priority (lower = higher priority). FIRST match wins. */\n  priority: number\n}\n\n/**\n * Resolved provider configuration — output of `resolveProvider()`.\n *\n * @public\n */\nexport interface ResolvedProvider {\n  name: string\n  apiKey: string\n  baseUrl: string\n}\n\n/**\n * Default provider registry. Order = priority (first = highest).\n *\n * Adding a new provider:\n *   1. Append entry below (or register via `registerProvider()`).\n *   2. Set `envKey` matching the user's env var convention.\n *   3. Set `baseUrl` to the OpenAI-compat endpoint (or native if not compat).\n *   4. Provider name used in telemetry/logs only — never wire-exposed.\n */\nconst DEFAULT_REGISTRY: ProviderDescriptor[] = [\n  {\n    name: 'openrouter',\n    envKey: 'OPENROUTER_API_KEY',\n    baseUrl: 'https://openrouter.ai/api/v1',\n    priority: 1,\n  },\n  {\n    name: 'openai',\n    envKey: 'OPENAI_API_KEY',\n    baseUrl: 'https://api.openai.com/v1',\n    priority: 2,\n  },\n  {\n    name: 'anthropic',\n    envKey: 'ANTHROPIC_API_KEY',\n    baseUrl: 'https://api.anthropic.com',\n    priority: 3,\n  },\n  {\n    // Mirrors the profile `@theokit/sdk` already ships for this provider — same default host, same\n    // override variable — so the two cannot disagree about where ollama is listening. The SDK is\n    // what dials it (see `baseUrlEnv`); this entry's job is to stop the resolver from rejecting the\n    // model before the SDK is ever reached. No `envKey`: see that field's doc comment for why the\n    // absence also keeps this entry out of the priority walk.\n    name: 'ollama',\n    baseUrl: 'http://localhost:11434',\n    baseUrlEnv: 'OLLAMA_HOST',\n    priority: 100,\n  },\n]\n\n/**\n * Runtime registry — copy of DEFAULT_REGISTRY mutable via registerProvider().\n * Sorted by priority on every resolve (stable, O(n log n) — n <= ~10 providers).\n *\n * Held per PROCESS rather than per module instance (usetheokit/theokit#401). As a module-level\n * `const` it was one array per chunk, and the bundler emits this module into two of them: an\n * application calling `registerProvider` mutated one array while `theokit start` resolved against\n * another, so the call had no effect and the resulting error listed the defaults while the\n * registered provider sat in an object nobody read.\n */\nfunction registryOf(): ProviderDescriptor[] {\n  return processSingleton('provider-registry', () => [...DEFAULT_REGISTRY])\n}\n\n/**\n * Providers already announced, so a boot line does not become a per-request line.\n *\n * theokit#326 — resolution was silent on success. `resolveProvider` returns `{ name, apiKey,\n * baseUrl }` and every call site consumes only the key, so an operator could only learn which\n * provider was selected from an error message: exactly when it has already failed, and never in\n * the case that hurts most — a stale key that resolves cleanly and 401s at the provider.\n */\nconst announced = new Set<string>()\n\n/** Test-only reset, so announcement state does not leak between cases. @public */\nexport function resetProviderAnnouncements(): void {\n  announced.clear()\n}\n\n/** Where the announcement goes, and what it may contain. @public */\nexport interface ResolveOptions {\n  /** Receives one line per provider, at most once. NEVER receives the key. */\n  announce?: (line: string) => void\n}\n\n/**\n * Register a new provider (Registry pattern — runtime extension point).\n * Useful for self-hosted endpoints or custom providers without touching theokit src.\n *\n * @example\n * registerProvider({\n *   name: 'self-hosted',\n *   envKey: 'SELF_HOSTED_API_KEY',\n *   baseUrl: 'https://llm.internal.acme.com/v1',\n *   priority: 0, // highest priority\n * })\n *\n * @public\n */\nexport function registerProvider(descriptor: ProviderDescriptor): void {\n  // Idempotent — replace existing by name.\n  const registry = registryOf()\n  const idx = registry.findIndex((p) => p.name === descriptor.name)\n  if (idx >= 0) registry[idx] = descriptor\n  else registry.push(descriptor)\n}\n\n/**\n * Reset registry to DEFAULT_REGISTRY (test-only / dev escape hatch).\n *\n * @public\n */\nexport function resetProviderRegistry(): void {\n  const registry = registryOf()\n  registry.length = 0\n  registry.push(...DEFAULT_REGISTRY)\n}\n\n/**\n * Get current registry snapshot (read-only — inspection).\n *\n * @public\n */\nexport function listProviders(): readonly ProviderDescriptor[] {\n  return [...registryOf()].sort((a, b) => a.priority - b.priority)\n}\n\n/**\n * Says which provider was selected, once.\n *\n * Carries the provider, HOW it was chosen, and the variable the credential came from — never the\n * credential. Which env var holds it is what an operator needs to fix a mis-selection; the value\n * is what a log must never hold.\n */\nfunction announce(\n  desc: ProviderDescriptor,\n  how: 'declared by the model' | 'by env priority',\n  options: ResolveOptions | undefined,\n): void {\n  if (announced.has(desc.name)) return\n  announced.add(desc.name)\n  const source = desc.envKey ?? 'none (this provider takes no credential)'\n  const line = `[theokit] provider=${desc.name} (${how}) source=${source} baseUrl=${baseUrlOf(desc)}`\n  if (options?.announce) options.announce(line)\n  // `warn` rather than `info` because the repo's lint rule allows only `warn`/`error` — and this\n  // line is closer to a warning in spirit anyway: it is the one chance an operator gets to notice\n  // that the provider serving their agents is not the one they expected.\n  else console.warn(line)\n}\n\n/**\n * Where this provider is listening, after any environment override.\n *\n * One function so the announcement line and the resolved config can never name different hosts —\n * an operator reading a log to find out where requests went must be reading the truth.\n */\nfunction baseUrlOf(desc: ProviderDescriptor): string {\n  if (desc.baseUrlEnv === undefined) return desc.baseUrl\n  const override = process.env[desc.baseUrlEnv]\n  return override !== undefined && override.length > 0 ? override : desc.baseUrl\n}\n\n/**\n * The provider a model id declares, or `undefined` when it declares none.\n *\n * `provider/model` and `gateway/provider/model` both resolve on the FIRST segment: a gateway is a\n * provider from the framework's point of view (it holds the credential), and everything after it\n * is the upstream namespace the gateway itself routes on.\n *\n * A bare id (`gpt-4o-mini`, `qwen2.5:3b`) declares nothing, and an unregistered prefix is treated\n * the same way rather than as an error — a project may legitimately point a custom id at a\n * registered provider's endpoint, and refusing it here would break that before it reached the SDK.\n */\nfunction providerOf(\n  modelId: string | undefined,\n  registered: readonly ProviderDescriptor[],\n): ProviderDescriptor | undefined {\n  const prefix = declaredPrefixOf(modelId)\n  if (prefix === undefined) return undefined\n  return registered.find((p) => p.name === prefix)\n}\n\n/**\n * The provider name a model id declares, registered or not.\n *\n * Split out of {@link providerOf} because the two questions differ exactly where the error message\n * used to go wrong: \"which registered provider is this?\" answers `undefined` both for a bare id and\n * for `groq/…`, and the resolver needs to tell those apart to say something true about the second.\n */\nfunction declaredPrefixOf(modelId: string | undefined): string | undefined {\n  if (modelId === undefined) return undefined\n  const slash = modelId.indexOf('/')\n  if (slash <= 0) return undefined\n  return modelId.slice(0, slash)\n}\n\n/** A provider that authenticates — the only kind the priority walk may select. */\ntype CredentialedProvider = ProviderDescriptor & { envKey: string }\n\nfunction takesCredential(desc: ProviderDescriptor): desc is CredentialedProvider {\n  return desc.envKey !== undefined\n}\n\n/**\n * Resolve the provider for a model.\n *\n * When `modelId` declares a registered provider (`anthropic/…`), THAT provider's key is\n * required — no substitution. Otherwise the registry is walked by priority, first match wins.\n *\n * @returns ResolvedProvider with apiKey + baseUrl + name\n * @throws Error if NO provider env var is set (actionable message)\n *\n * @public\n */\nexport function resolveProvider(modelId?: string, options?: ResolveOptions): ResolvedProvider {\n  const sorted = [...registryOf()].sort((a, b) => a.priority - b.priority)\n\n  const declared = modelId === undefined ? undefined : providerOf(modelId, sorted)\n  if (declared !== undefined && modelId !== undefined) {\n    if (declared.envKey === undefined) {\n      // Keyless — a model on the developer's own machine. The empty string is the honest value and\n      // not a placeholder: the SDK's client sets an `authorization` header only when the key is\n      // non-empty, so anything else would put a meaningless credential on every local request.\n      announce(declared, 'declared by the model', options)\n      return { name: declared.name, apiKey: '', baseUrl: baseUrlOf(declared) }\n    }\n    const apiKey = process.env[declared.envKey]\n    if (apiKey && apiKey.length > 0) {\n      announce(declared, 'declared by the model', options)\n      return { name: declared.name, apiKey, baseUrl: baseUrlOf(declared) }\n    }\n    // Deliberately NOT falling back to another provider's key. Silently substituting one is how\n    // theokit#326 produced a 401 nobody could attribute: the request went somewhere the agent\n    // never named. Say which variable is missing and stop.\n    throw new Error(\n      `Model \"${modelId}\" declares provider \"${declared.name}\", but ${declared.envKey} is not set. ` +\n        `Set ${declared.envKey}, or change the model's provider prefix.`,\n    )\n  }\n\n  // Only providers that take a credential. A keyless entry is reachable exclusively through the\n  // declared branch above; see `ProviderDescriptor.envKey` for why the walk cannot include it.\n  const credentialed = sorted.filter(takesCredential)\n\n  for (const desc of credentialed) {\n    const apiKey = process.env[desc.envKey]\n    if (apiKey && apiKey.length > 0) {\n      announce(desc, 'by env priority', options)\n      return {\n        name: desc.name,\n        apiKey,\n        baseUrl: baseUrlOf(desc),\n      }\n    }\n  }\n\n  // Nothing resolved. When the model id named a provider this registry does not know, say THAT —\n  // the generic message below sent a reader whose id read `groq/…` off to buy an OpenRouter key,\n  // which would not have helped and could not have been the fix (usetheokit/theokit#407).\n  const prefix = declaredPrefixOf(modelId)\n  if (prefix !== undefined) {\n    throw new Error(\n      `Model \"${modelId}\" declares provider \"${prefix}\", which is not registered. ` +\n        `Registered providers: ${sorted.map((p) => p.name).join(', ')}. ` +\n        `Register it with registerProvider({ name: '${prefix}', … }), or use a registered prefix.`,\n    )\n  }\n\n  const envKeys = credentialed.map((p) => p.envKey).join(' OR ')\n  throw new Error(\n    `No LLM provider API key found in environment. Set one of: ${envKeys}. ` +\n      `Get a free OpenRouter key at https://openrouter.ai/keys (recommended — one key, many models).`,\n  )\n}\n\n/**\n * Try to resolve — does NOT throw. Returns null if no provider available.\n * Useful for graceful degradation (e.g., mock mode).\n *\n * @public\n */\nexport function tryResolveProvider(modelId?: string): ResolvedProvider | null {\n  try {\n    return resolveProvider(modelId)\n  } catch {\n    return null\n  }\n}\n","/**\n * M4 (theokit-ai-first) — the in-process HITL approval registry.\n *\n * The HITL plugin's `awaitApproval` calls `register(approvalId)` and awaits the returned Promise\n * (this is what genuinely PAUSES the SDK run — the SDK `pre_tool_call` hook is awaited). The\n * approve route calls `resolve(approvalId, approved)` to settle it. A per-approval timeout settles\n * the Promise deterministically per the `@HumanInTheLoop` `onTimeout` policy so a hung approval\n * never leaks the paused stream.\n *\n * Single-process contract (ADR 0038 / plan Drawback 2): a multi-instance deploy needs a shared\n * registry — the interface is injectable so a durable impl (Redis, etc.) slots in without touching\n * the harness. We do NOT build a durable store now (YAGNI).\n */\n// The timeout policy vocabulary is owned by the `@HumanInTheLoop` decorator (DRY / G12) — reuse it\n// rather than re-declaring the union, so the two can never drift.\nimport type { TimeoutAction } from '@theokit/agents'\n\nimport { processSingleton } from '../_internal/process-singleton.js'\n\nexport interface RegisterOptions {\n  /** Milliseconds before the approval auto-settles per `onTimeout`. */\n  timeoutMs: number\n  /**\n   * What a timeout means. Only `'proceed'` auto-approves; `'abort'` and `'retry'` both deny — the\n   * registry does NOT implement retry semantics (a timed-out `'retry'` is a deny, not a re-prompt).\n   */\n  onTimeout: TimeoutAction\n  /** M14 — the gated tool name, surfaced by `list()` (optional; absent for legacy callers). */\n  toolName?: string\n  /** M14 — the approval question, surfaced by `list()` (optional). */\n  question?: string\n  /**\n   * Who the run belongs to — the `RouteSubject.id` admitted for it (B-016).\n   *\n   * Absent when the run had no identity to record, which is the `'public'` agent path:\n   * `admitAgentRequest` deliberately does not resolve a subject when the policy is absent or\n   * `'public'`, so there is nothing to attribute the approval to. Absent therefore means \"no owner\n   * was established\", never \"anyone\", and the caller must branch on the difference — a rule that\n   * refused when it is absent would start turning public agents away.\n   *\n   * Deliberately NOT surfaced by `list()`: that listing feeds a UI, and owner ids are identity.\n   */\n  owner?: string\n  /**\n   * M20 — an optional JSON-schema descriptor of the custom payload the approver may attach. Carried\n   * verbatim into `list()` + the `approval_required` event so the UI knows what to collect. Kept as\n   * a plain JSON object (not a live Zod schema) so the registry stays serializable and SDK-free.\n   */\n  payloadSchema?: Record<string, unknown>\n}\n\n/**\n * M20 — a settled HITL decision. `approved` is the allow/deny bit (backward-compatible with the\n * legacy boolean); `reason` + `payload` are the optional approver-attached extras that surface to\n * the model (on denial, via the veto message) and to the app/UI.\n */\nexport interface ApprovalDecision {\n  approved: boolean\n  reason?: string\n  payload?: unknown\n  /**\n   * What settled this, when it was not a person (usetheokit/theokit#393).\n   *\n   * Absent means the decision arrived through `resolve()` — a human, or whatever the application\n   * wired to that route. `'timeout'` means the window closed with nobody deciding and `onTimeout`\n   * was applied.\n   *\n   * The distinction is the whole point of a HITL gate: without it an expired approval and an\n   * explicit deny are byte-identical on the wire, and the sentence the caller gets — \"denied by\n   * human approver\" — asserts a fact that did not happen. It is marked on the ALLOW side too:\n   * `onTimeout: 'proceed'` permits the tool BECAUSE nobody answered, and recording that as a plain\n   * approval is the same fabrication with the opposite sign.\n   *\n   * One member rather than `timedOut: boolean`, because the question is what settled it; a second\n   * cause (a cancel, a shutdown) joins the union instead of adding another boolean.\n   */\n  settledBy?: 'timeout'\n}\n\n/** M14 — a pending approval as surfaced by {@link ApprovalRegistry.list}. */\nexport interface PendingApproval {\n  approvalId: string\n  toolName?: string\n  question?: string\n  /** Epoch millis when the pending approval auto-settles (registeredAt + timeoutMs). */\n  expiresAt: number\n  /** M20 — the declared custom-payload schema, if the gated tool declares one. */\n  payloadSchema?: Record<string, unknown>\n}\n\nexport interface ApprovalRegistry {\n  /**\n   * Register a pending approval; the returned Promise settles with the full {@link ApprovalDecision}\n   * on `resolve` or timeout (M20 — was a bare boolean pre-M20).\n   */\n  register(approvalId: string, opts: RegisterOptions): Promise<ApprovalDecision>\n  /**\n   * Settle a pending approval. Accepts a full {@link ApprovalDecision} OR a bare boolean (coerced to\n   * `{ approved }` — backward-compatible). Returns false if the id is unknown or already settled.\n   */\n  resolve(approvalId: string, decision: boolean | ApprovalDecision): boolean\n  /** M14 — list the currently-pending approvals (process-wide; single-process contract). */\n  list(): PendingApproval[]\n  /**\n   * Who owns the pending approval `approvalId`, or `undefined` (B-016).\n   *\n   * `undefined` covers three cases the caller treats identically — never registered, already\n   * settled, and registered without an owner — because in all three there is nothing to compare a\n   * caller against.\n   */\n  ownerOf(approvalId: string): string | undefined\n}\n\ninterface Pending {\n  settle: (decision: ApprovalDecision) => void\n  timer: ReturnType<typeof setTimeout>\n  info: PendingApproval\n  /** Held beside `info` rather than inside it, so `list()` cannot leak it (B-016). */\n  owner?: string\n}\n\n/**\n * The one process-wide registry the stream mount (`mountAgent`) and the approve route share.\n *\n * The in-process impl holds LIVE Promise resolvers in memory — the approval a request awaits and\n * the approval the route resolves MUST be the same object, so a single instance per process is not\n * a convenience but a correctness requirement. Lazily created; a durable/multi-instance deploy\n * swaps this accessor for a shared-store impl (ADR 0038 / plan Drawback 2) without touching callers.\n * Tests use {@link createInProcessApprovalRegistry} directly — never this singleton.\n */\nexport function getApprovalRegistry(): ApprovalRegistry {\n  // Per PROCESS, not per module instance (usetheokit/theokit#401). The paragraph above calls a\n  // single instance \"not a convenience but a correctness requirement\", and a module-level `let`\n  // does not deliver that: it gives one instance per MODULE INSTANCE, and this module is emitted\n  // into two chunks of the published bundle. A run awaiting an approval and the route resolving it\n  // could hold different objects, and the symptom would be a HITL pause that never resumes.\n  return processSingleton('approval-registry', () => createInProcessApprovalRegistry())\n}\n\nexport function createInProcessApprovalRegistry(): ApprovalRegistry {\n  const pending = new Map<string, Pending>()\n\n  return {\n    register(approvalId, opts) {\n      return new Promise<ApprovalDecision>((resolve) => {\n        const settle = (decision: ApprovalDecision): void => {\n          const entry = pending.get(approvalId)\n          if (!entry) return\n          clearTimeout(entry.timer)\n          pending.delete(approvalId)\n          resolve(decision)\n        }\n        // 'proceed' → allow on timeout; 'abort'/'retry' → deny on timeout.\n        const timer = setTimeout(() => {\n          settle({\n            approved: opts.onTimeout === 'proceed',\n            settledBy: 'timeout',\n            // Every value in this sentence was already here and none of it used to survive the\n            // settle. `onTimeout` is named because all three of its values reach this line and two\n            // of them deny — an operator who wrote `'retry'` and got a denial had nothing to read\n            // that mentioned retry.\n            reason: `no decision within ${String(opts.timeoutMs)} ms; onTimeout: '${opts.onTimeout}' was applied`,\n          })\n        }, opts.timeoutMs)\n        const info: PendingApproval = {\n          approvalId,\n          toolName: opts.toolName,\n          question: opts.question,\n          expiresAt: Date.now() + opts.timeoutMs,\n          ...(opts.payloadSchema !== undefined ? { payloadSchema: opts.payloadSchema } : {}),\n        }\n        pending.set(approvalId, {\n          settle,\n          timer,\n          info,\n          ...(opts.owner !== undefined ? { owner: opts.owner } : {}),\n        })\n      })\n    },\n    resolve(approvalId, decision) {\n      const entry = pending.get(approvalId)\n      if (!entry) return false\n      // M20 — coerce the legacy bare-boolean form to a decision object.\n      entry.settle(typeof decision === 'boolean' ? { approved: decision } : decision)\n      return true\n    },\n    list() {\n      return [...pending.values()].map((p) => p.info)\n    },\n    ownerOf(approvalId) {\n      // `settle` deletes the entry, so an approval that has been answered or timed out reports no\n      // owner — which is what stops a later registration of the same id from inheriting one.\n      return pending.get(approvalId)?.owner\n    },\n  }\n}\n"],"mappings":";;;;AAgCA,IAAM,YAAY;AASX,SAAS,iBAAmC,KAAa,SAAqB;AACnF,QAAM,OAAO,uBAAO,IAAI,YAAY,GAAG;AACvC,QAAM,OAAO;AAEb,QAAM,WAAW,KAAK,IAAI;AAC1B,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,UAAU,QAAQ;AACxB,OAAK,IAAI,IAAI;AACb,SAAO;AACT;;;ACsCA,IAAM,mBAAyC;AAAA,EAC7C;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAME,MAAM;AAAA,IACN,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,UAAU;AAAA,EACZ;AACF;AAYA,SAAS,aAAmC;AAC1C,SAAO,iBAAiB,qBAAqB,MAAM,CAAC,GAAG,gBAAgB,CAAC;AAC1E;AAUA,IAAM,YAAY,oBAAI,IAAY;AA8DlC,SAAS,SACP,MACA,KACA,SACM;AACN,MAAI,UAAU,IAAI,KAAK,IAAI,EAAG;AAC9B,YAAU,IAAI,KAAK,IAAI;AACvB,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,OAAO,sBAAsB,KAAK,IAAI,KAAK,GAAG,YAAY,MAAM,YAAY,UAAU,IAAI,CAAC;AACjG,MAAI,SAAS,SAAU,SAAQ,SAAS,IAAI;AAAA,MAIvC,SAAQ,KAAK,IAAI;AACxB;AAQA,SAAS,UAAU,MAAkC;AACnD,MAAI,KAAK,eAAe,OAAW,QAAO,KAAK;AAC/C,QAAM,WAAW,QAAQ,IAAI,KAAK,UAAU;AAC5C,SAAO,aAAa,UAAa,SAAS,SAAS,IAAI,WAAW,KAAK;AACzE;AAaA,SAAS,WACP,SACA,YACgC;AAChC,QAAM,SAAS,iBAAiB,OAAO;AACvC,MAAI,WAAW,OAAW,QAAO;AACjC,SAAO,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM;AACjD;AASA,SAAS,iBAAiB,SAAiD;AACzE,MAAI,YAAY,OAAW,QAAO;AAClC,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,SAAS,EAAG,QAAO;AACvB,SAAO,QAAQ,MAAM,GAAG,KAAK;AAC/B;AAKA,SAAS,gBAAgB,MAAwD;AAC/E,SAAO,KAAK,WAAW;AACzB;AAaO,SAAS,gBAAgB,SAAkB,SAA4C;AAC5F,QAAM,SAAS,CAAC,GAAG,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AAEvE,QAAM,WAAW,YAAY,SAAY,SAAY,WAAW,SAAS,MAAM;AAC/E,MAAI,aAAa,UAAa,YAAY,QAAW;AACnD,QAAI,SAAS,WAAW,QAAW;AAIjC,eAAS,UAAU,yBAAyB,OAAO;AACnD,aAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,IAAI,SAAS,UAAU,QAAQ,EAAE;AAAA,IACzE;AACA,UAAM,SAAS,QAAQ,IAAI,SAAS,MAAM;AAC1C,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,UAAU,yBAAyB,OAAO;AACnD,aAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,SAAS,UAAU,QAAQ,EAAE;AAAA,IACrE;AAIA,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,wBAAwB,SAAS,IAAI,UAAU,SAAS,MAAM,oBACtE,SAAS,MAAM;AAAA,IAC1B;AAAA,EACF;AAIA,QAAM,eAAe,OAAO,OAAO,eAAe;AAElD,aAAW,QAAQ,cAAc;AAC/B,UAAM,SAAS,QAAQ,IAAI,KAAK,MAAM;AACtC,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,MAAM,mBAAmB,OAAO;AACzC,aAAO;AAAA,QACL,MAAM,KAAK;AAAA,QACX;AAAA,QACA,SAAS,UAAU,IAAI;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAKA,QAAM,SAAS,iBAAiB,OAAO;AACvC,MAAI,WAAW,QAAW;AACxB,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,wBAAwB,MAAM,qDACpB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,gDACf,MAAM;AAAA,IACxD;AAAA,EACF;AAEA,QAAM,UAAU,aAAa,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,MAAM;AAC7D,QAAM,IAAI;AAAA,IACR,6DAA6D,OAAO;AAAA,EAEtE;AACF;;;ACtNO,SAAS,sBAAwC;AAMtD,SAAO,iBAAiB,qBAAqB,MAAM,gCAAgC,CAAC;AACtF;AAEO,SAAS,kCAAoD;AAClE,QAAM,UAAU,oBAAI,IAAqB;AAEzC,SAAO;AAAA,IACL,SAAS,YAAY,MAAM;AACzB,aAAO,IAAI,QAA0B,CAAC,YAAY;AAChD,cAAM,SAAS,CAAC,aAAqC;AACnD,gBAAM,QAAQ,QAAQ,IAAI,UAAU;AACpC,cAAI,CAAC,MAAO;AACZ,uBAAa,MAAM,KAAK;AACxB,kBAAQ,OAAO,UAAU;AACzB,kBAAQ,QAAQ;AAAA,QAClB;AAEA,cAAM,QAAQ,WAAW,MAAM;AAC7B,iBAAO;AAAA,YACL,UAAU,KAAK,cAAc;AAAA,YAC7B,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA,YAKX,QAAQ,sBAAsB,OAAO,KAAK,SAAS,CAAC,oBAAoB,KAAK,SAAS;AAAA,UACxF,CAAC;AAAA,QACH,GAAG,KAAK,SAAS;AACjB,cAAM,OAAwB;AAAA,UAC5B;AAAA,UACA,UAAU,KAAK;AAAA,UACf,UAAU,KAAK;AAAA,UACf,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,UAC7B,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,QAClF;AACA,gBAAQ,IAAI,YAAY;AAAA,UACtB;AAAA,UACA;AAAA,UACA;AAAA,UACA,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,QAC1D,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAAA,IACA,QAAQ,YAAY,UAAU;AAC5B,YAAM,QAAQ,QAAQ,IAAI,UAAU;AACpC,UAAI,CAAC,MAAO,QAAO;AAEnB,YAAM,OAAO,OAAO,aAAa,YAAY,EAAE,UAAU,SAAS,IAAI,QAAQ;AAC9E,aAAO;AAAA,IACT;AAAA,IACA,OAAO;AACL,aAAO,CAAC,GAAG,QAAQ,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAChD;AAAA,IACA,QAAQ,YAAY;AAGlB,aAAO,QAAQ,IAAI,UAAU,GAAG;AAAA,IAClC;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-YGAXV5HR.js → chunk-6J4JWHDJ.js}

@@ -1,13 +1,23 @@
 import {
   HTTP_METHODS
 } from "./chunk-DV34VG3N.js";
+import {
+  MissingRoutePolicyError,
+  RouterConventionError,
+  createFileStampCache,
+  scanAgents
+} from "./chunk-L4VFNFDL.js";
 import {
   walkSourceFiles
-} from "./chunk-U267AOWS.js";
+} from "./chunk-5K4TDLRG.js";
+import {
+  compareByCodeUnit
+} from "./chunk-ZWN3AODA.js";
 
 // src/server/scan/action-scan.ts
 import { existsSync, readFileSync, statSync } from "fs";
 import { extname, join, relative } from "path";
+var ACTION_SCHEMAS_DIR = "schemas";
 var ActionScanError = class extends Error {
   code;
   conflictingPaths;
@@ -49,7 +59,7 @@ function scanServerActionsEnriched(serverDir) {
   walkSourceFiles(actionsDir, { extensions: ACTION_EXTENSIONS }, (absPath) => {
     if (TEST_FILE_RE.test(absPath)) return;
     const rel = relative(actionsDir, absPath).replace(/\\/g, "/");
-    if (rel.startsWith("schemas/")) return;
+    if (rel.startsWith(`${ACTION_SCHEMAS_DIR}/`)) return;
     const name = rel.slice(0, -extname(rel).length);
     const basename2 = name.includes("/") ? name.split("/").pop() ?? name : name;
     if (RESERVED_NAMES.has(basename2)) {
@@ -121,7 +131,7 @@ function extractActionExportNames(stripped) {
   return [...names];
 }
 function detectSchemaFile(actionsDir, basename2) {
-  const schemasDir = join(actionsDir, "schemas");
+  const schemasDir = join(actionsDir, ACTION_SCHEMAS_DIR);
   if (!existsSync(schemasDir)) return void 0;
   for (const ext of [".ts", ".tsx", ".js", ".jsx"]) {
     const candidate = join(schemasDir, `${basename2}${ext}`);
@@ -151,50 +161,6 @@ function stripComments(source) {
   return out;
 }
 
-// src/server/scan/agent-scan.ts
-import { existsSync as existsSync2, statSync as statSync2 } from "fs";
-import { extname as extname2, join as join2, relative as relative2 } from "path";
-var AGENT_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
-var TEST_FILE = /\.(test|spec)$/;
-var AGENT_SUBFOLDERS = /* @__PURE__ */ new Set([
-  "tools",
-  "skills",
-  "prompts",
-  "lib",
-  "hooks",
-  "channels",
-  "connections",
-  "subagents",
-  "schedules",
-  "sandbox",
-  "workflows",
-  "evals",
-  "memory"
-]);
-function scanAgents(projectRoot, agentsDirName = "agents") {
-  const agentsDir = join2(projectRoot, agentsDirName);
-  if (!existsSync2(agentsDir) || !statSync2(agentsDir).isDirectory()) {
-    return [];
-  }
-  const results = [];
-  walkSourceFiles(agentsDir, { extensions: AGENT_EXTENSIONS }, (absPath) => {
-    let rel = relative2(agentsDir, absPath);
-    rel = rel.replace(/\\/g, "/");
-    rel = rel.slice(0, -extname2(rel).length);
-    if (TEST_FILE.test(rel)) return;
-    const dirs = rel.split("/").slice(0, -1);
-    if (dirs.some((segment) => AGENT_SUBFOLDERS.has(segment))) return;
-    if (rel.endsWith("/index")) rel = rel.slice(0, -6);
-    if (rel === "index" || rel === "") return;
-    results.push({
-      filePath: absPath,
-      agentPath: `/api/agents/${rel}`,
-      name: rel
-    });
-  });
-  return results;
-}
-
 // src/server/scan/match.ts
 function compilePattern(routePath) {
   const paramNames = [];
@@ -223,8 +189,8 @@ function matchRoute(url, routes) {
 }
 
 // src/server/scan/scan.ts
-import { existsSync as existsSync3, statSync as statSync3 } from "fs";
-import { basename, extname as extname3, join as join3, relative as relative3 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { basename, extname as extname2, join as join2, relative as relative2 } from "path";
 
 // src/server/scan/detect-http-methods.ts
 import { readFileSync as readFileSync2 } from "fs";
@@ -276,33 +242,115 @@ function detectExportedHttpMethods(filePath, content) {
   for (const stmt of sourceFile.statements) {
     collectFromStatement(stmt, found);
   }
-  return [...found].sort((a, b) => a.localeCompare(b));
+  return [...found].sort(compareByCodeUnit);
 }
 
-// src/server/scan/errors.ts
-var ROUTER_MIGRATION_GUIDE_URL = "https://theokit.dev/migration/0.3-to-0.4-router";
-var RouterConventionError = class extends Error {
-  name = "RouterConventionError";
-  file;
-  suggestion;
-  migrationUrl;
-  constructor(opts) {
-    const migrationUrl = opts.migrationUrl ?? ROUTER_MIGRATION_GUIDE_URL;
-    const message = [
-      `Router convention violation: dotted route basename is not supported in theokit 0.4+.`,
-      ``,
-      `  File: ${opts.file}`,
-      `  Use directory-nested form: ${opts.suggestion}`,
-      ``,
-      `Migration guide: ${migrationUrl}`,
-      `Run \`theokit migrate router\` to convert all dotted basenames automatically.`
-    ].join("\n");
-    super(message);
-    this.file = opts.file;
-    this.suggestion = opts.suggestion;
-    this.migrationUrl = migrationUrl;
+// src/server/scan/detect-route-policy.ts
+import { createRequire as createRequire2 } from "module";
+var require_2 = createRequire2(import.meta.url);
+var ts2 = require_2("typescript");
+var HTTP_METHOD_NAMES2 = new Set(HTTP_METHODS);
+var POLICY_KEY = "policy";
+function hasExportModifier2(modifiers) {
+  if (!modifiers) return false;
+  for (const m of modifiers) {
+    if (m.kind === ts2.SyntaxKind.ExportKeyword) return true;
   }
-};
+  return false;
+}
+function unwrap(expression) {
+  let current = expression;
+  for (; ; ) {
+    if (ts2.isParenthesizedExpression(current) || ts2.isAsExpression(current) || ts2.isSatisfiesExpression(current) || ts2.isNonNullExpression(current)) {
+      current = current.expression;
+      continue;
+    }
+    return current;
+  }
+}
+function propertyNameIsPolicy(name) {
+  if (name === void 0) return false;
+  if (ts2.isIdentifier(name)) return name.text === POLICY_KEY;
+  if (ts2.isStringLiteral(name)) return name.text === POLICY_KEY;
+  return false;
+}
+function objectDeclaresPolicy(literal) {
+  for (const property of literal.properties) {
+    if (ts2.isSpreadAssignment(property)) continue;
+    if (propertyNameIsPolicy(property.name)) return true;
+  }
+  return false;
+}
+function declaresPolicy(expression) {
+  const expr = unwrap(expression);
+  if (ts2.isObjectLiteralExpression(expr)) return objectDeclaresPolicy(expr);
+  if (!ts2.isCallExpression(expr)) return false;
+  const callee = unwrap(expr.expression);
+  if (ts2.isPropertyAccessExpression(callee) && callee.name.text === POLICY_KEY) return true;
+  for (const argument of expr.arguments) {
+    const arg = unwrap(argument);
+    if (ts2.isObjectLiteralExpression(arg) && objectDeclaresPolicy(arg)) return true;
+  }
+  if (ts2.isPropertyAccessExpression(callee)) return declaresPolicy(callee.expression);
+  return false;
+}
+function collectLocalInitializers(sourceFile) {
+  const locals = /* @__PURE__ */ new Map();
+  for (const stmt of sourceFile.statements) {
+    if (!ts2.isVariableStatement(stmt)) continue;
+    for (const decl of stmt.declarationList.declarations) {
+      if (ts2.isIdentifier(decl.name) && decl.initializer !== void 0) {
+        locals.set(decl.name.text, decl.initializer);
+      }
+    }
+  }
+  return locals;
+}
+function collectFromVariableStatement(stmt, declared) {
+  if (!hasExportModifier2(ts2.getModifiers(stmt))) return;
+  for (const decl of stmt.declarationList.declarations) {
+    if (!ts2.isIdentifier(decl.name) || !HTTP_METHOD_NAMES2.has(decl.name.text)) continue;
+    if (decl.initializer !== void 0 && declaresPolicy(decl.initializer)) {
+      declared.add(decl.name.text);
+    }
+  }
+}
+function collectFromExportDeclaration(stmt, locals, declared) {
+  if (stmt.moduleSpecifier !== void 0) return;
+  if (!stmt.exportClause || !ts2.isNamedExports(stmt.exportClause)) return;
+  for (const spec of stmt.exportClause.elements) {
+    if (!HTTP_METHOD_NAMES2.has(spec.name.text)) continue;
+    const local = locals.get((spec.propertyName ?? spec.name).text);
+    if (local !== void 0 && declaresPolicy(local)) {
+      declared.add(spec.name.text);
+    }
+  }
+}
+function collectFromStatement2(stmt, locals, declared) {
+  if (ts2.isVariableStatement(stmt)) {
+    collectFromVariableStatement(stmt, declared);
+    return;
+  }
+  if (ts2.isExportDeclaration(stmt)) {
+    collectFromExportDeclaration(stmt, locals, declared);
+  }
+}
+function detectMethodsWithDeclaredPolicy(filePath, content) {
+  const sourceFile = ts2.createSourceFile(
+    filePath,
+    content,
+    ts2.ScriptTarget.Latest,
+    /* setParentNodes */
+    false,
+    ts2.ScriptKind.TS
+  );
+  const locals = collectLocalInitializers(sourceFile);
+  const declared = /* @__PURE__ */ new Set();
+  for (const stmt of sourceFile.statements) {
+    collectFromStatement2(stmt, locals, declared);
+  }
+  return declared;
+}
 
 // src/server/scan/scan.ts
 var ROUTE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
@@ -341,15 +389,15 @@ function splitDottedSegmentOutsideBrackets(segment) {
   return parts;
 }
 function buildDirectoryNestedSuggestion(filePath, routesDir) {
-  const rel = relative3(routesDir, filePath).replace(/\\/g, "/");
-  const ext = extname3(rel);
+  const rel = relative2(routesDir, filePath).replace(/\\/g, "/");
+  const ext = extname2(rel);
   const withoutExt = rel.slice(0, -ext.length);
   const segments = withoutExt.split("/").flatMap(splitDottedSegmentOutsideBrackets);
   return `routes/${segments.join("/")}${ext}`;
 }
 function assertNoDottedSegment(filePath, routesDir) {
-  const rel = relative3(routesDir, filePath).replace(/\\/g, "/");
-  const ext = extname3(rel);
+  const rel = relative2(routesDir, filePath).replace(/\\/g, "/");
+  const ext = extname2(rel);
   const withoutExt = rel.slice(0, -ext.length);
   const segments = withoutExt.split("/");
   for (const seg of segments) {
@@ -361,9 +409,27 @@ function assertNoDottedSegment(filePath, routesDir) {
     }
   }
 }
+function assertEveryMethodDeclaresPolicy(filePath, routePath, { methods, declaredPolicy }) {
+  if (methods.length === 0) return;
+  const missing = methods.filter((method) => !declaredPolicy.has(method));
+  if (missing.length === 0) return;
+  throw new MissingRoutePolicyError({ file: filePath, routePath, methods: missing });
+}
+var routeFactsCache = createFileStampCache();
+function _resetRouteScanCacheForTests() {
+  routeFactsCache.clear();
+}
+function routeSourceFacts(absPath) {
+  return routeFactsCache.get(absPath, () => {
+    const source = readFileSync3(absPath, "utf-8");
+    const methods = detectExportedHttpMethods(absPath, source);
+    const declaredPolicy = methods.length === 0 ? /* @__PURE__ */ new Set() : detectMethodsWithDeclaredPolicy(absPath, source);
+    return { methods, declaredPolicy };
+  });
+}
 function fileToRoutePath(filePath, routesDir) {
-  let rel = relative3(routesDir, filePath);
-  const ext = extname3(rel);
+  let rel = relative2(routesDir, filePath);
+  const ext = extname2(rel);
   rel = rel.slice(0, -ext.length);
   rel = rel.replace(/\\/g, "/");
   if (rel.endsWith("/index")) {
@@ -376,8 +442,8 @@ function fileToRoutePath(filePath, routesDir) {
   return `/api/${rel}`;
 }
 function scanServerRoutes(serverDir) {
-  const routesDir = join3(serverDir, "routes");
-  if (!existsSync3(routesDir) || !statSync3(routesDir).isDirectory()) {
+  const routesDir = join2(serverDir, "routes");
+  if (!existsSync2(routesDir) || !statSync2(routesDir).isDirectory()) {
     return [];
   }
   const results = [];
@@ -386,7 +452,9 @@ function scanServerRoutes(serverDir) {
     assertNoDottedSegment(absPath, routesDir);
     const routePath = fileToRoutePath(absPath, routesDir);
     const { pattern, paramNames } = compilePattern(routePath);
-    const methods = detectExportedHttpMethods(absPath);
+    const facts = routeSourceFacts(absPath);
+    const { methods } = facts;
+    assertEveryMethodDeclaresPolicy(absPath, routePath, facts);
     results.push({
       filePath: absPath,
       routePath,
@@ -401,35 +469,44 @@ function scanServerRoutes(serverDir) {
       `Server route ${conflicting.filePath} resolves to '/api/__theo_batch__' which is reserved for the batch endpoint. Rename the route or disable batching in theo.config.ts.`
     );
   }
-  const isCatchAll = (route) => route.routePath.includes(":...");
-  results.sort((a, b) => {
-    const aStatic = a.paramNames.length === 0;
-    const bStatic = b.paramNames.length === 0;
-    const aCatchAll = isCatchAll(a);
-    const bCatchAll = isCatchAll(b);
-    if (aStatic && !bStatic) return -1;
-    if (!aStatic && bStatic) return 1;
-    if (aCatchAll && !bCatchAll) return 1;
-    if (!aCatchAll && bCatchAll) return -1;
-    return a.routePath.localeCompare(b.routePath);
-  });
+  results.sort((a, b) => compareRouteSpecificity(a.routePath, b.routePath));
   return results;
 }
+var SEGMENT_STATIC = 0;
+var SEGMENT_DYNAMIC = 1;
+var SEGMENT_CATCH_ALL = 2;
+function segmentSpecificity(segment) {
+  if (segment.startsWith(":...")) return SEGMENT_CATCH_ALL;
+  if (segment.startsWith(":")) return SEGMENT_DYNAMIC;
+  return SEGMENT_STATIC;
+}
+function compareRouteSpecificity(a, b) {
+  const aSegments = a.split("/");
+  const bSegments = b.split("/");
+  const shared = Math.min(aSegments.length, bSegments.length);
+  for (let i = 0; i < shared; i++) {
+    const difference = segmentSpecificity(aSegments[i]) - segmentSpecificity(bSegments[i]);
+    if (difference !== 0) return difference;
+  }
+  if (a < b) return -1;
+  if (a > b) return 1;
+  return 0;
+}
 
 // src/server/scan/ws-scan.ts
-import { existsSync as existsSync4, statSync as statSync4 } from "fs";
-import { extname as extname4, join as join4, relative as relative4 } from "path";
+import { existsSync as existsSync3, statSync as statSync3 } from "fs";
+import { extname as extname3, join as join3, relative as relative3 } from "path";
 var WS_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
 function scanWebSocketRoutes(serverDir) {
-  const wsDir = join4(serverDir, "ws");
-  if (!existsSync4(wsDir) || !statSync4(wsDir).isDirectory()) {
+  const wsDir = join3(serverDir, "ws");
+  if (!existsSync3(wsDir) || !statSync3(wsDir).isDirectory()) {
     return [];
   }
   const results = [];
   walkSourceFiles(wsDir, { extensions: WS_EXTENSIONS }, (absPath) => {
-    let rel = relative4(wsDir, absPath);
+    let rel = relative3(wsDir, absPath);
     rel = rel.replace(/\\/g, "/");
-    rel = rel.slice(0, -extname4(rel).length);
+    rel = rel.slice(0, -extname3(rel).length);
     if (rel.endsWith("/index")) rel = rel.slice(0, -6);
     else if (rel === "index") rel = "";
     results.push({
@@ -441,8 +518,8 @@ function scanWebSocketRoutes(serverDir) {
 }
 
 // src/server/scan/manifest.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync, mkdirSync } from "fs";
-import { join as join5, resolve, relative as relative5, dirname } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync, mkdirSync } from "fs";
+import { join as join4, resolve, relative as relative4, dirname } from "path";
 function generateManifest(serverDir, projectRoot = dirname(serverDir), agentsDir = "agents") {
   const routes = scanServerRoutes(serverDir);
   const actions = scanServerActions(serverDir);
@@ -452,22 +529,22 @@ function generateManifest(serverDir, projectRoot = dirname(serverDir), agentsDir
     version: 1,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     routes: routes.map((r) => ({
-      filePath: relative5(serverDir, r.filePath),
+      filePath: relative4(serverDir, r.filePath),
       routePath: r.routePath,
       paramNames: r.paramNames,
       ...r.methods !== void 0 ? { methods: r.methods } : {}
     })),
     actions: actions.map((a) => ({
-      filePath: relative5(serverDir, a.filePath),
+      filePath: relative4(serverDir, a.filePath),
       actionPath: a.actionPath
     })),
     websockets: websockets.map((w) => ({
-      filePath: relative5(serverDir, w.filePath),
+      filePath: relative4(serverDir, w.filePath),
       wsPath: w.wsPath
     })),
     agents: agents.map((a) => ({
       // Relative to projectRoot (agents/ is outside serverDir).
-      filePath: relative5(projectRoot, a.filePath),
+      filePath: relative4(projectRoot, a.filePath),
       agentPath: a.agentPath,
       name: a.name
     }))
@@ -475,15 +552,15 @@ function generateManifest(serverDir, projectRoot = dirname(serverDir), agentsDir
 }
 function writeManifest(manifest, outputDir) {
   mkdirSync(outputDir, { recursive: true });
-  const manifestPath = join5(outputDir, "manifest.json");
+  const manifestPath = join4(outputDir, "manifest.json");
   writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
 }
 function loadManifest(distDir, serverDir) {
-  const manifestPath = join5(distDir, "manifest.json");
-  if (!existsSync5(manifestPath)) {
+  const manifestPath = join4(distDir, "manifest.json");
+  if (!existsSync4(manifestPath)) {
     throw new Error(`No manifest found at ${manifestPath}. Run "theo build" first.`);
   }
-  const raw = JSON.parse(readFileSync3(manifestPath, "utf-8"));
+  const raw = JSON.parse(readFileSync4(manifestPath, "utf-8"));
   const routes = raw.routes.map((r) => {
     const { pattern, paramNames } = compilePattern(r.routePath);
     return {
@@ -512,16 +589,18 @@ function loadManifest(distDir, serverDir) {
 }
 
 export {
+  ACTION_SCHEMAS_DIR,
   ActionScanError,
   scanServerActions,
   scanServerActionsEnriched,
-  scanAgents,
   compilePattern,
   matchRoute,
+  _resetRouteScanCacheForTests,
   scanServerRoutes,
+  compareRouteSpecificity,
   scanWebSocketRoutes,
   generateManifest,
   writeManifest,
   loadManifest
 };
-//# sourceMappingURL=chunk-YGAXV5HR.js.map
+//# sourceMappingURL=chunk-6J4JWHDJ.js.map

package/dist/chunk-6J4JWHDJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/scan/action-scan.ts","../src/server/scan/match.ts","../src/server/scan/scan.ts","../src/server/scan/detect-http-methods.ts","../src/server/scan/detect-route-policy.ts","../src/server/scan/ws-scan.ts","../src/server/scan/manifest.ts"],"mappings":";;;;;;;;;;;;;;;;;AAIA,SAAS,YAAY,cAAc,gBAAgB;AACnD,SAAS,SAAS,MAAM,gBAAgB;AAuBjC,IAAM,qBAAqB;AA8B3B,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAChC;AAAA,EACA;AAAA,EAET,YACE,MACA,SACA,kBACA;AACA,UAAM,OAAO;AAIb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,mBAAmB;AAAA,EAC1B;AACF;AAEA,IAAM,oBAAoB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAChE,IAAM,eAAe;AACrB,IAAM,iBAAiB,oBAAI,IAAI,CAAC,SAAS,eAAe,aAAa,aAAa,gBAAgB,CAAC;AAO5F,SAAS,kBAAkB,WAAiC;AACjE,QAAM,aAAa,KAAK,WAAW,SAAS;AAC5C,MAAI,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,UAAU,EAAE,YAAY,GAAG;AAClE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAwB,CAAC;AAC/B,kBAAgB,YAAY,EAAE,YAAY,kBAAkB,GAAG,CAAC,YAAY;AAC1E,QAAI,aAAa,KAAK,OAAO,EAAG;AAChC,QAAI,MAAM,SAAS,YAAY,OAAO;AACtC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM;AACvC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,YAAY;AAAA,IACd,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;AAUO,SAAS,0BAA0B,WAA0C;AAClF,QAAM,aAAa,KAAK,WAAW,SAAS;AAC5C,MAAI,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,UAAU,EAAE,YAAY,GAAG;AAClE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,YAAY,oBAAI,IAAY;AAClC,QAAM,UAAiC,CAAC;AAGxC,kBAAgB,YAAY,EAAE,YAAY,kBAAkB,GAAG,CAAC,YAAY;AAC1E,QAAI,aAAa,KAAK,OAAO,EAAG;AAChC,UAAM,MAAM,SAAS,YAAY,OAAO,EAAE,QAAQ,OAAO,GAAG;AAG5D,QAAI,IAAI,WAAW,GAAG,kBAAkB,GAAG,EAAG;AAC9C,UAAM,OAAO,IAAI,MAAM,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM;AAE9C,UAAMA,YAAW,KAAK,SAAS,GAAG,IAAK,KAAK,MAAM,GAAG,EAAE,IAAI,KAAK,OAAQ;AACxE,QAAI,eAAe,IAAIA,SAAQ,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,2BAA2BA,SAAQ,+BAA+B,OAAO;AAAA,QACzE,CAAC,OAAO;AAAA,MACV;AAAA,IACF;AAGA,UAAM,SAAS,aAAa,SAAS,MAAM;AAC3C,UAAM,WAAW,cAAc,MAAM;AACrC,UAAM,SAAS,8BAA8B,KAAK,QAAQ,IAAI,SAAS;AACvE,UAAM,WAAW,oBAAoB,KAAK,QAAQ,KAAK,sBAAsB,KAAK,QAAQ;AAS1F,UAAM,cAAc,yBAAyB,QAAQ;AAIrD,UAAM,iBAAiB,KAAK,SAAS,GAAG,IAAI,SAAY,iBAAiB,YAAYA,SAAQ;AAC7F,eAAW,cAAc,aAAa;AACpC,YAAM,WAAW,eAAe,YAAY,OAAO;AACnD,UAAI,UAAU,IAAI,QAAQ,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,+BAA+B,QAAQ;AAAA,UACvC,CAAC,OAAO;AAAA,QACV;AAAA,MACF;AACA,gBAAU,IAAI,QAAQ;AACtB,YAAM,QAA6B;AAAA,QACjC,MAAM;AAAA,QACN,UAAU;AAAA,QACV,SAAS,kBAAkB,IAAI,IAAI,UAAU;AAAA,QAC7C;AAAA,QACA;AAAA,MACF;AACA,UAAI,mBAAmB,QAAW;AAChC,cAAM,iBAAiB;AAAA,MACzB;AACA,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF,CAAC;AAID,aAAW,SAAS,SAAS;AAC3B,UAAM,cAAc,GAAG,MAAM,IAAI;AACjC,UAAM,mBAAmB,QAAQ,KAAK,CAAC,UAAU,MAAM,KAAK,WAAW,WAAW,CAAC;AACnF,QAAI,kBAAkB;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,WAAW,MAAM,IAAI,uDAAuD,iBAAiB,IAAI;AAAA,QACjG,CAAC,MAAM,UAAU,iBAAiB,QAAQ;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AACT;AAeA,SAAS,yBAAyB,UAA4B;AAC5D,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,UAAU;AAChB,MAAI;AACJ,UAAQ,IAAI,QAAQ,KAAK,QAAQ,OAAO,MAAM;AAC5C,UAAM,OAAO,EAAE,CAAC;AAChB,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,EAAG,OAAM,IAAI,IAAI;AAAA,EACjE;AACA,MAAI,sCAAsC,KAAK,QAAQ,GAAG;AACxD,UAAM,IAAI,SAAS;AAAA,EACrB;AACA,MAAI,MAAM,SAAS,EAAG,OAAM,IAAI,SAAS;AACzC,SAAO,CAAC,GAAG,KAAK;AAClB;AAOA,SAAS,iBAAiB,YAAoBA,WAAsC;AAClF,QAAM,aAAa,KAAK,YAAY,kBAAkB;AACtD,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,aAAW,OAAO,CAAC,OAAO,QAAQ,OAAO,MAAM,GAAG;AAChD,UAAM,YAAY,KAAK,YAAY,GAAGA,SAAQ,GAAG,GAAG,EAAE;AACtD,QAAI,WAAW,SAAS,EAAG,QAAO;AAAA,EACpC;AACA,SAAO;AACT;AAEA,SAAS,cAAc,QAAwB;AAC7C,MAAI,MAAM;AACV,MAAI,IAAI;AACR,SAAO,IAAI,OAAO,QAAQ;AACxB,UAAM,KAAK,OAAO,CAAC;AACnB,UAAM,OAAO,OAAO,IAAI,CAAC;AACzB,QAAI,OAAO,OAAO,SAAS,KAAK;AAE9B,aAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,KAAM;AAChD;AAAA,IACF;AACA,QAAI,OAAO,OAAO,SAAS,KAAK;AAE9B,WAAK;AACL,aAAO,IAAI,OAAO,SAAS,KAAK,EAAE,OAAO,CAAC,MAAM,OAAO,OAAO,IAAI,CAAC,MAAM,KAAM;AAC/E,WAAK;AACL;AAAA,IACF;AACA,WAAO;AACP;AAAA,EACF;AACA,SAAO;AACT;;;ACnQO,SAAS,eAAe,WAG7B;AACA,QAAM,aAAuB,CAAC;AAE9B,QAAM,WAAW,UAAU,QAAQ,wBAAwB,CAAC,OAAe,SAAiB;AAC1F,eAAW,KAAK,IAAI;AAEpB,WAAO,MAAM,WAAW,MAAM,IAAI,SAAS;AAAA,EAC7C,CAAC;AAKD,SAAO,EAAE,SAAS,IAAI,OAAO,IAAI,QAAQ,GAAG,GAAG,WAAW;AAC5D;AAEO,SAAS,WACd,KACA,QACmE;AAEnE,MAAI,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC;AAC3B,MAAI,KAAK,SAAS,KAAK,KAAK,SAAS,GAAG,GAAG;AACzC,WAAO,KAAK,MAAM,GAAG,EAAE;AAAA,EACzB;AAEA,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI;AACrC,QAAI,OAAO;AACT,YAAM,SAAiC,CAAC;AACxC,YAAM,WAAW,QAAQ,CAAC,MAAM,MAAM;AACpC,eAAO,IAAI,IAAI,MAAM,IAAI,CAAC;AAAA,MAC5B,CAAC;AACD,aAAO,EAAE,OAAO,OAAO;AAAA,IACzB;AAAA,EACF;AACA,SAAO;AACT;;;AC9CA,SAAS,cAAAC,aAAY,gBAAAC,eAAc,YAAAC,iBAAgB;AACnD,SAAS,UAAU,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;;;ACYlD,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,qBAAqB;AAO9B,IAAM,WAAW,cAAc,YAAY,GAAG;AAE9C,IAAM,KAAK,SAAS,YAAY;AAEhC,IAAM,oBAAoB,IAAI,IAAY,YAAY;AAEtD,SAAS,kBAAkB,WAAwD;AACjF,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,KAAK,WAAW;AACzB,QAAI,EAAE,SAAS,GAAG,WAAW,cAAe,QAAO;AAAA,EACrD;AACA,SAAO;AACT;AAMA,SAAS,qBAAqB,MAAoB,OAA8B;AAE9E,MAAI,GAAG,oBAAoB,IAAI,KAAK,kBAAkB,GAAG,aAAa,IAAI,CAAC,GAAG;AAC5E,eAAW,QAAQ,KAAK,gBAAgB,cAAc;AACpD,UAAI,GAAG,aAAa,KAAK,IAAI,KAAK,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACvE,cAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,MACxC;AAAA,IACF;AACA;AAAA,EACF;AAEA,OACG,GAAG,sBAAsB,IAAI,KAAK,GAAG,mBAAmB,IAAI,MAC7D,kBAAkB,GAAG,aAAa,IAAI,CAAC,GACvC;AACA,QAAI,KAAK,QAAQ,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACtD,YAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,IACxC;AACA;AAAA,EACF;AAGA,MAAI,GAAG,oBAAoB,IAAI,KAAK,KAAK,gBAAgB,GAAG,eAAe,KAAK,YAAY,GAAG;AAC7F,eAAW,QAAQ,KAAK,aAAa,UAAU;AAE7C,UAAI,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACzC,cAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,0BAA0B,UAAkB,SAAgC;AAI1F,QAAM,MAAM,WAAWC,cAAa,UAAU,OAAO;AACrD,QAAM,aAAa,GAAG;AAAA,IACpB;AAAA,IACA;AAAA,IACA,GAAG,aAAa;AAAA;AAAA,IACK;AAAA,IACrB,GAAG,WAAW;AAAA,EAChB;AACA,QAAM,QAAQ,oBAAI,IAAgB;AAClC,aAAW,QAAQ,WAAW,YAAY;AACxC,yBAAqB,MAAM,KAAK;AAAA,EAClC;AAKA,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK,iBAAiB;AAC1C;;;AC1DA,SAAS,iBAAAC,sBAAqB;AAM9B,IAAMC,YAAWC,eAAc,YAAY,GAAG;AAE9C,IAAMC,MAAKF,UAAS,YAAY;AAEhC,IAAMG,qBAAoB,IAAI,IAAY,YAAY;AAEtD,IAAM,aAAa;AAEnB,SAASC,mBAAkB,WAAwD;AACjF,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,KAAK,WAAW;AACzB,QAAI,EAAE,SAASF,IAAG,WAAW,cAAe,QAAO;AAAA,EACrD;AACA,SAAO;AACT;AAGA,SAAS,OAAO,YAA0C;AACxD,MAAI,UAAU;AACd,aAAS;AACP,QACEA,IAAG,0BAA0B,OAAO,KACpCA,IAAG,eAAe,OAAO,KACzBA,IAAG,sBAAsB,OAAO,KAChCA,IAAG,oBAAoB,OAAO,GAC9B;AACA,gBAAU,QAAQ;AAClB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,MAA4C;AACxE,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAIA,IAAG,aAAa,IAAI,EAAG,QAAO,KAAK,SAAS;AAChD,MAAIA,IAAG,gBAAgB,IAAI,EAAG,QAAO,KAAK,SAAS;AACnD,SAAO;AACT;AAGA,SAAS,qBAAqB,SAA8C;AAC1E,aAAW,YAAY,QAAQ,YAAY;AACzC,QAAIA,IAAG,mBAAmB,QAAQ,EAAG;AACrC,QAAI,qBAAqB,SAAS,IAAI,EAAG,QAAO;AAAA,EAClD;AACA,SAAO;AACT;AASA,SAAS,eAAe,YAAoC;AAC1D,QAAM,OAAO,OAAO,UAAU;AAE9B,MAAIA,IAAG,0BAA0B,IAAI,EAAG,QAAO,qBAAqB,IAAI;AAExE,MAAI,CAACA,IAAG,iBAAiB,IAAI,EAAG,QAAO;AAEvC,QAAM,SAAS,OAAO,KAAK,UAAU;AAErC,MAAIA,IAAG,2BAA2B,MAAM,KAAK,OAAO,KAAK,SAAS,WAAY,QAAO;AAErF,aAAW,YAAY,KAAK,WAAW;AACrC,UAAM,MAAM,OAAO,QAAQ;AAC3B,QAAIA,IAAG,0BAA0B,GAAG,KAAK,qBAAqB,GAAG,EAAG,QAAO;AAAA,EAC7E;AAIA,MAAIA,IAAG,2BAA2B,MAAM,EAAG,QAAO,eAAe,OAAO,UAAU;AAElF,SAAO;AACT;AAGA,SAAS,yBAAyB,YAAuD;AACvF,QAAM,SAAS,oBAAI,IAA2B;AAC9C,aAAW,QAAQ,WAAW,YAAY;AACxC,QAAI,CAACA,IAAG,oBAAoB,IAAI,EAAG;AACnC,eAAW,QAAQ,KAAK,gBAAgB,cAAc;AACpD,UAAIA,IAAG,aAAa,KAAK,IAAI,KAAK,KAAK,gBAAgB,QAAW;AAChE,eAAO,IAAI,KAAK,KAAK,MAAM,KAAK,WAAW;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,6BAA6B,MAA4B,UAAiC;AACjG,MAAI,CAACE,mBAAkBF,IAAG,aAAa,IAAI,CAAC,EAAG;AAC/C,aAAW,QAAQ,KAAK,gBAAgB,cAAc;AACpD,QAAI,CAACA,IAAG,aAAa,KAAK,IAAI,KAAK,CAACC,mBAAkB,IAAI,KAAK,KAAK,IAAI,EAAG;AAC3E,QAAI,KAAK,gBAAgB,UAAa,eAAe,KAAK,WAAW,GAAG;AACtE,eAAS,IAAI,KAAK,KAAK,IAAkB;AAAA,IAC3C;AAAA,EACF;AACF;AAMA,SAAS,6BACP,MACA,QACA,UACM;AACN,MAAI,KAAK,oBAAoB,OAAW;AACxC,MAAI,CAAC,KAAK,gBAAgB,CAACD,IAAG,eAAe,KAAK,YAAY,EAAG;AACjE,aAAW,QAAQ,KAAK,aAAa,UAAU;AAC7C,QAAI,CAACC,mBAAkB,IAAI,KAAK,KAAK,IAAI,EAAG;AAC5C,UAAM,QAAQ,OAAO,KAAK,KAAK,gBAAgB,KAAK,MAAM,IAAI;AAC9D,QAAI,UAAU,UAAa,eAAe,KAAK,GAAG;AAChD,eAAS,IAAI,KAAK,KAAK,IAAkB;AAAA,IAC3C;AAAA,EACF;AACF;AAEA,SAASE,sBACP,MACA,QACA,UACM;AACN,MAAIH,IAAG,oBAAoB,IAAI,GAAG;AAChC,iCAA6B,MAAM,QAAQ;AAC3C;AAAA,EACF;AACA,MAAIA,IAAG,oBAAoB,IAAI,GAAG;AAChC,iCAA6B,MAAM,QAAQ,QAAQ;AAAA,EACrD;AAGF;AAQO,SAAS,gCACd,UACA,SACiB;AACjB,QAAM,aAAaA,IAAG;AAAA,IACpB;AAAA,IACA;AAAA,IACAA,IAAG,aAAa;AAAA;AAAA,IACK;AAAA,IACrBA,IAAG,WAAW;AAAA,EAChB;AACA,QAAM,SAAS,yBAAyB,UAAU;AAClD,QAAM,WAAW,oBAAI,IAAgB;AACrC,aAAW,QAAQ,WAAW,YAAY;AACxC,IAAAG,sBAAqB,MAAM,QAAQ,QAAQ;AAAA,EAC7C;AACA,SAAO;AACT;;;AF/LA,IAAM,mBAAmB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAK/D,IAAM,kBAAkB;AAExB,SAAS,iBAAiB,UAA2B;AACnD,SAAO,gBAAgB,KAAK,SAAS,QAAQ,CAAC;AAChD;AAEA,SAAS,sBAAsB,SAA0B;AACvD,MAAI,QAAQ;AACZ,aAAW,MAAM,SAAS;AACxB,QAAI,OAAO,IAAK;AAAA,aACP,OAAO,IAAK;AAAA,aACZ,OAAO,OAAO,UAAU,EAAG,QAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,kCAAkC,SAA2B;AACpE,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI,QAAQ;AACZ,aAAW,MAAM,SAAS;AACxB,QAAI,OAAO,KAAK;AACd;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,KAAK;AACrB;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,OAAO,UAAU,GAAG;AACpC,UAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,gBAAU;AAAA,IACZ,OAAO;AACL,iBAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,SAAO;AACT;AAEA,SAAS,+BAA+B,UAAkB,WAA2B;AACnF,QAAM,MAAMC,UAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,aAAa,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAC3C,QAAM,WAAW,WAAW,MAAM,GAAG,EAAE,QAAQ,iCAAiC;AAChF,SAAO,UAAU,SAAS,KAAK,GAAG,CAAC,GAAG,GAAG;AAC3C;AAEA,SAAS,sBAAsB,UAAkB,WAAyB;AACxE,QAAM,MAAMD,UAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,aAAa,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAC3C,QAAM,WAAW,WAAW,MAAM,GAAG;AACrC,aAAW,OAAO,UAAU;AAC1B,QAAI,sBAAsB,GAAG,GAAG;AAC9B,YAAM,IAAI,sBAAsB;AAAA,QAC9B,MAAM;AAAA,QACN,YAAY,+BAA+B,UAAU,SAAS;AAAA,MAChE,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAoBA,SAAS,gCACP,UACA,WACA,EAAE,SAAS,eAAe,GACpB;AACN,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,UAAU,QAAQ,OAAO,CAAC,WAAW,CAAC,eAAe,IAAI,MAAM,CAAC;AACtE,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,IAAI,wBAAwB,EAAE,MAAM,UAAU,WAAW,SAAS,QAAQ,CAAC;AACnF;AAsBA,IAAM,kBAAkB,qBAAuC;AAGxD,SAAS,+BAAqC;AACnD,kBAAgB,MAAM;AACxB;AAEA,SAAS,iBAAiB,SAAmC;AAC3D,SAAO,gBAAgB,IAAI,SAAS,MAAM;AACxC,UAAM,SAASC,cAAa,SAAS,OAAO;AAC5C,UAAM,UAAU,0BAA0B,SAAS,MAAM;AAIzD,UAAM,iBACJ,QAAQ,WAAW,IACf,oBAAI,IAAgB,IACpB,gCAAgC,SAAS,MAAM;AACrD,WAAO,EAAE,SAAS,eAAe;AAAA,EACnC,CAAC;AACH;AAEA,SAAS,gBAAgB,UAAkB,WAA2B;AACpE,MAAI,MAAMF,UAAS,WAAW,QAAQ;AAEtC,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAE9B,QAAM,IAAI,QAAQ,OAAO,GAAG;AAE5B,MAAI,IAAI,SAAS,QAAQ,GAAG;AAC1B,UAAM,IAAI,MAAM,GAAG,EAAE;AAAA,EACvB,WAAW,QAAQ,SAAS;AAC1B,UAAM;AAAA,EACR;AAIA,QAAM,IAAI,QAAQ,uBAAuB,QAAQ;AAEjD,QAAM,IAAI,QAAQ,iBAAiB,KAAK;AACxC,SAAO,QAAQ,GAAG;AACpB;AAEO,SAAS,iBAAiB,WAAsC;AACrE,QAAM,YAAYE,MAAK,WAAW,QAAQ;AAC1C,MAAI,CAACC,YAAW,SAAS,KAAK,CAACC,UAAS,SAAS,EAAE,YAAY,GAAG;AAChE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAA6B,CAAC;AACpC,kBAAgB,WAAW,EAAE,YAAY,iBAAiB,GAAG,CAAC,YAAY;AAExE,QAAI,iBAAiB,OAAO,EAAG;AAI/B,0BAAsB,SAAS,SAAS;AAExC,UAAM,YAAY,gBAAgB,SAAS,SAAS;AACpD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,SAAS;AACxD,UAAM,QAAQ,iBAAiB,OAAO;AACtC,UAAM,EAAE,QAAQ,IAAI;AACpB,oCAAgC,SAAS,WAAW,KAAK;AACzD,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAID,QAAM,cAAc,QAAQ,KAAK,CAAC,MAAM,EAAE,cAAc,qBAAqB;AAC7E,MAAI,aAAa;AACf,UAAM,IAAI;AAAA,MACR,gBAAgB,YAAY,QAAQ;AAAA,IACtC;AAAA,EACF;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM,wBAAwB,EAAE,WAAW,EAAE,SAAS,CAAC;AAExE,SAAO;AACT;AAGA,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,oBAAoB;AAE1B,SAAS,mBAAmB,SAAyB;AACnD,MAAI,QAAQ,WAAW,MAAM,EAAG,QAAO;AACvC,MAAI,QAAQ,WAAW,GAAG,EAAG,QAAO;AACpC,SAAO;AACT;AA4BO,SAAS,wBAAwB,GAAW,GAAmB;AACpE,QAAM,YAAY,EAAE,MAAM,GAAG;AAC7B,QAAM,YAAY,EAAE,MAAM,GAAG;AAC7B,QAAM,SAAS,KAAK,IAAI,UAAU,QAAQ,UAAU,MAAM;AAE1D,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC/B,UAAM,aAAa,mBAAmB,UAAU,CAAC,CAAC,IAAI,mBAAmB,UAAU,CAAC,CAAC;AACrF,QAAI,eAAe,EAAG,QAAO;AAAA,EAC/B;AAEA,MAAI,IAAI,EAAG,QAAO;AAClB,MAAI,IAAI,EAAG,QAAO;AAClB,SAAO;AACT;;;AGxQA,SAAS,cAAAC,aAAY,YAAAC,iBAAgB;AACrC,SAAS,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;AAIxC,IAAM,gBAAgB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAOrD,SAAS,oBAAoB,WAAyC;AAC3E,QAAM,QAAQC,MAAK,WAAW,IAAI;AAClC,MAAI,CAACC,YAAW,KAAK,KAAK,CAACC,UAAS,KAAK,EAAE,YAAY,GAAG;AACxD,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAgC,CAAC;AACvC,kBAAgB,OAAO,EAAE,YAAY,cAAc,GAAG,CAAC,YAAY;AACjE,QAAI,MAAMC,UAAS,OAAO,OAAO;AACjC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAACC,SAAQ,GAAG,EAAE,MAAM;AACvC,QAAI,IAAI,SAAS,QAAQ,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AAAA,aACxC,QAAQ,QAAS,OAAM;AAChC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,QAAQ,OAAO,GAAG;AAAA,IACpB,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;;;AC/BA,SAAS,cAAAC,aAAY,gBAAAC,eAAc,eAAe,iBAAiB;AACnE,SAAS,QAAAC,OAAM,SAAS,YAAAC,WAAU,eAAe;AA4D1C,SAAS,iBACd,WAGA,cAAsB,QAAQ,SAAS,GAEvC,YAAY,UACE;AACd,QAAM,SAAS,iBAAiB,SAAS;AACzC,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,aAAa,oBAAoB,SAAS;AAChD,QAAM,SAAS,WAAW,aAAa,SAAS;AAEhD,SAAO;AAAA,IACL,SAAS;AAAA,IACT,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,MACzB,UAAUC,UAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,WAAW,EAAE;AAAA,MACb,YAAY,EAAE;AAAA,MACd,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1D,EAAE;AAAA,IACF,SAAS,QAAQ,IAAI,CAAC,OAAO;AAAA,MAC3B,UAAUA,UAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,YAAY,EAAE;AAAA,IAChB,EAAE;AAAA,IACF,YAAY,WAAW,IAAI,CAAC,OAAO;AAAA,MACjC,UAAUA,UAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,QAAQ,EAAE;AAAA,IACZ,EAAE;AAAA,IACF,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA;AAAA,MAEzB,UAAUA,UAAS,aAAa,EAAE,QAAQ;AAAA,MAC1C,WAAW,EAAE;AAAA,MACb,MAAM,EAAE;AAAA,IACV,EAAE;AAAA,EACJ;AACF;AAIO,SAAS,cAAc,UAAwB,WAAyB;AAC7E,YAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AACxC,QAAM,eAAeC,MAAK,WAAW,eAAe;AACpD,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC/D;AAIO,SAAS,aAAa,SAAiB,WAAmC;AAC/E,QAAM,eAAeA,MAAK,SAAS,eAAe;AAElD,MAAI,CAACC,YAAW,YAAY,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB,YAAY,2BAA2B;AAAA,EACjF;AAEA,QAAM,MAAM,KAAK,MAAMC,cAAa,cAAc,OAAO,CAAC;AAE1D,QAAM,SAA4B,IAAI,OAAO,IAAI,CAAC,MAAM;AACtD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,EAAE,SAAS;AAC1D,WAAO;AAAA,MACL,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,MACvC,WAAW,EAAE;AAAA,MACb;AAAA,MACA;AAAA,MACA,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AAED,QAAM,UAAwB,IAAI,QAAQ,IAAI,CAAC,OAAO;AAAA,IACpD,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,YAAY,EAAE;AAAA,EAChB,EAAE;AAEF,QAAM,aAAmC,IAAI,WAAW,IAAI,CAAC,OAAO;AAAA,IAClE,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,QAAQ,EAAE;AAAA,EACZ,EAAE;AAIF,QAAM,cAAc,QAAQ,SAAS;AACrC,QAAM,UAAuB,IAAI,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,IACzD,UAAU,QAAQ,aAAa,EAAE,QAAQ;AAAA,IACzC,WAAW,EAAE;AAAA,IACb,MAAM,EAAE;AAAA,EACV,EAAE;AAEF,SAAO,EAAE,QAAQ,SAAS,YAAY,OAAO;AAC/C;","names":["basename","existsSync","readFileSync","statSync","extname","join","relative","readFileSync","readFileSync","createRequire","require_","createRequire","ts","HTTP_METHOD_NAMES","hasExportModifier","collectFromStatement","relative","extname","readFileSync","join","existsSync","statSync","existsSync","statSync","extname","join","relative","join","existsSync","statSync","relative","extname","existsSync","readFileSync","join","relative","relative","join","existsSync","readFileSync"]}