theokit 0.48.14 → 0.50.1

package/dist/chunk-RJJF457I.js

@@ -0,0 +1,111 @@
+import {
+  dispatchCsrfWarn,
+  incomingMessageToWebRequest,
+  sendError
+} from "./chunk-JKF25N73.js";
+import {
+  enforceCsrf
+} from "./chunk-P6OS7652.js";
+
+// src/server/http/controller-dispatch.ts
+import { readdirSync } from "fs";
+import { join } from "path";
+import { createDecoratorHandler, isControllerClass } from "@theokit/http";
+var CSRF_PROTECTED_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function findControllerFiles(dir) {
+  const found = [];
+  const walk = (current) => {
+    let entries;
+    try {
+      entries = readdirSync(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = join(current, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.name.endsWith(".controller.ts") || entry.name.endsWith(".controller.mjs"))
+        found.push(full);
+    }
+  };
+  walk(dir);
+  return found;
+}
+async function scanControllerModules(controllersDir, loadModule) {
+  const files = findControllerFiles(controllersDir);
+  const modules = [];
+  for (const filePath of files) {
+    const mod = await loadModule(filePath);
+    for (const exported of Object.values(mod)) {
+      if (typeof exported === "function" && isControllerClass(exported)) {
+        modules.push({ filePath, cls: exported, exports: mod });
+      }
+    }
+  }
+  return modules;
+}
+async function scanControllers(controllersDir, loadModule) {
+  const modules = await scanControllerModules(controllersDir, loadModule);
+  return modules.map((m) => m.cls);
+}
+async function createControllerDispatcher(opts) {
+  const classes = await scanControllers(opts.controllersDir, opts.loadModule);
+  if (classes.length === 0) return null;
+  const handle = createDecoratorHandler({ controllers: classes, serveAgent: opts.serveAgent });
+  return {
+    dispatch: (request) => handle(request),
+    matches: (method, pathname) => handle.matches(method, pathname)
+  };
+}
+async function writeControllerResponse(res, response) {
+  const headersBag = {};
+  for (const [k, v] of response.headers) {
+    if (k.toLowerCase() !== "set-cookie") headersBag[k] = v;
+  }
+  const setCookies = response.headers.getSetCookie();
+  if (setCookies.length > 0) res.setHeader("Set-Cookie", setCookies);
+  res.writeHead(response.status, headersBag);
+  const body = response.body ? await response.text() : "";
+  res.end(body || void 0);
+}
+async function dispatchControllerRequest(args) {
+  const { req, res, csrfMode, disallowed, requestId } = args;
+  const dispatcher = await createControllerDispatcher({
+    controllersDir: args.controllersDir,
+    loadModule: args.loadModule,
+    serveAgent: args.serveAgent
+  });
+  if (!dispatcher) return false;
+  const method = (req.method ?? "GET").toUpperCase();
+  const webRequest = incomingMessageToWebRequest(req);
+  const pathname = new URL(webRequest.url).pathname;
+  if (CSRF_PROTECTED_METHODS.has(method) && dispatcher.matches(method, pathname)) {
+    const decision = enforceCsrf(
+      req,
+      csrfMode,
+      { warn: dispatchCsrfWarn, path: req.url },
+      disallowed
+    );
+    if (!decision.allow) {
+      sendError(
+        res,
+        "CSRF_INVALID",
+        decision.reason ?? "CSRF check failed",
+        403,
+        void 0,
+        requestId
+      );
+      return true;
+    }
+  }
+  const response = await dispatcher.dispatch(webRequest);
+  if (response === null) return false;
+  await writeControllerResponse(res, response);
+  return true;
+}
+
+export {
+  scanControllerModules,
+  dispatchControllerRequest
+};
+//# sourceMappingURL=chunk-RJJF457I.js.map

package/dist/chunk-RJJF457I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/http/controller-dispatch.ts"],"mappings":";;;;;;;;;;AAIA,SAAS,mBAAgC;AAEzC,SAAS,YAAY;AAErB,SAAS,wBAAwB,yBAA0C;AAyB3E,IAAM,yBAAyB,oBAAI,IAAI,CAAC,QAAQ,OAAO,SAAS,QAAQ,CAAC;AAQlE,SAAS,oBAAoB,KAAuB;AACzD,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,CAAC,YAA0B;AACtC,QAAI;AACJ,QAAI;AACF,gBAAU,YAAY,SAAS,EAAE,eAAe,KAAK,CAAC;AAAA,IACxD,QAAQ;AACN;AAAA,IACF;AACA,eAAW,SAAS,SAAS;AAC3B,YAAM,OAAO,KAAK,SAAS,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,EAAG,MAAK,IAAI;AAAA,eAKzB,MAAM,KAAK,SAAS,gBAAgB,KAAK,MAAM,KAAK,SAAS,iBAAiB;AACrF,cAAM,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,OAAK,GAAG;AACR,SAAO;AACT;AAyBA,eAAsB,sBACpB,gBACA,YAC6B;AAC7B,QAAM,QAAQ,oBAAoB,cAAc;AAChD,QAAM,UAA8B,CAAC;AACrC,aAAW,YAAY,OAAO;AAC5B,UAAM,MAAM,MAAM,WAAW,QAAQ;AACrC,eAAW,YAAY,OAAO,OAAO,GAAG,GAAG;AACzC,UAAI,OAAO,aAAa,cAAc,kBAAkB,QAAQ,GAAG;AACjE,gBAAQ,KAAK,EAAE,UAAU,KAAK,UAA6B,SAAS,IAAI,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,eAAe,gBACb,gBACA,YAC4B;AAC5B,QAAM,UAAU,MAAM,sBAAsB,gBAAgB,UAAU;AACtE,SAAO,QAAQ,IAAI,CAAC,MAAM,EAAE,GAAG;AACjC;AAUA,eAAsB,2BAA2B,MAKR;AACvC,QAAM,UAAU,MAAM,gBAAgB,KAAK,gBAAgB,KAAK,UAAU;AAC1E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,SAAS,uBAAuB,EAAE,aAAa,SAAS,YAAY,KAAK,WAAW,CAAC;AAC3F,SAAO;AAAA,IACL,UAAU,CAAC,YAAY,OAAO,OAAO;AAAA,IACrC,SAAS,CAAC,QAAQ,aAAa,OAAO,QAAQ,QAAQ,QAAQ;AAAA,EAChE;AACF;AAGA,eAAe,wBAAwB,KAAqB,UAAmC;AAC7F,QAAM,aAAqC,CAAC;AAC5C,aAAW,CAAC,GAAG,CAAC,KAAK,SAAS,SAAS;AACrC,QAAI,EAAE,YAAY,MAAM,aAAc,YAAW,CAAC,IAAI;AAAA,EACxD;AACA,QAAM,aAAa,SAAS,QAAQ,aAAa;AACjD,MAAI,WAAW,SAAS,EAAG,KAAI,UAAU,cAAc,UAAU;AACjE,MAAI,UAAU,SAAS,QAAQ,UAAU;AACzC,QAAM,OAAO,SAAS,OAAO,MAAM,SAAS,KAAK,IAAI;AACrD,MAAI,IAAI,QAAQ,MAAS;AAC3B;AAWA,eAAsB,0BAA0B,MAU3B;AACnB,QAAM,EAAE,KAAK,KAAK,UAAU,YAAY,UAAU,IAAI;AACtD,QAAM,aAAa,MAAM,2BAA2B;AAAA,IAClD,gBAAgB,KAAK;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,YAAY,KAAK;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,QAAM,aAAa,4BAA4B,GAAG;AAClD,QAAM,WAAW,IAAI,IAAI,WAAW,GAAG,EAAE;AAMzC,MAAI,uBAAuB,IAAI,MAAM,KAAK,WAAW,QAAQ,QAAQ,QAAQ,GAAG;AAC9E,UAAM,WAAW;AAAA,MACf;AAAA,MACA;AAAA,MACA,EAAE,MAAM,kBAAkB,MAAM,IAAI,IAAI;AAAA,MACxC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,OAAO;AACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA,SAAS,UAAU;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,WAAW,SAAS,UAAU;AACrD,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,wBAAwB,KAAK,QAAQ;AAC3C,SAAO;AACT;","names":[]}

package/dist/chunk-RPET332G.js

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/core/contracts/security-headers.ts
+var DEFAULT_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'; report-uri /__theo/csp-report";
+var DEFAULT_PERMISSIONS_POLICY = "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()";
+var DEFAULT_HSTS = "max-age=31536000; includeSubDomains";
+function applyNonceToCsp(policy, nonce) {
+  return policy.split(";").map((directive) => {
+    const trimmed = directive.trim();
+    if (!trimmed.startsWith("script-src")) return directive;
+    if (trimmed.includes("'unsafe-inline'")) {
+      return directive.replace("'unsafe-inline'", `'nonce-${nonce}'`);
+    }
+    return `${directive} 'nonce-${nonce}'`;
+  }).join(";");
+}
+function applyCsp(out, config, effectiveNonce) {
+  if (config.csp === false || config.cspMode === "off") return;
+  let policy = typeof config.csp === "string" ? config.csp : DEFAULT_CSP;
+  if (effectiveNonce) {
+    policy = applyNonceToCsp(policy, effectiveNonce);
+  }
+  const mode = config.cspMode ?? "enforce";
+  if (mode === "enforce") {
+    out["Content-Security-Policy"] = policy;
+  } else {
+    out["Content-Security-Policy-Report-Only"] = policy;
+  }
+}
+function buildSecurityHeaders(config, env, options = {}) {
+  const out = {};
+  const effectiveNonce = options.prerender ? void 0 : options.nonce;
+  applyCsp(out, config, effectiveNonce);
+  out["X-Frame-Options"] = config.frameOptions ?? "DENY";
+  out["X-Content-Type-Options"] = config.contentTypeOptions ?? "nosniff";
+  out["Referrer-Policy"] = config.referrerPolicy ?? "strict-origin-when-cross-origin";
+  if (config.permissionsPolicy !== false) {
+    out["Permissions-Policy"] = typeof config.permissionsPolicy === "string" ? config.permissionsPolicy : DEFAULT_PERMISSIONS_POLICY;
+  }
+  if (env.production && config.hsts !== false) {
+    out["Strict-Transport-Security"] = typeof config.hsts === "string" ? config.hsts : DEFAULT_HSTS;
+  }
+  if (effectiveNonce) {
+    out["Cache-Control"] = "private, no-store";
+  }
+  return out;
+}
+
+// src/core/contracts/nonce.ts
+function bytesToBase64(bytes) {
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(bytes).toString("base64");
+  }
+  let binary = "";
+  for (const b of bytes) {
+    binary += String.fromCharCode(b);
+  }
+  return btoa(binary);
+}
+var cachedWebCrypto;
+function getWebCrypto() {
+  if (cachedWebCrypto === void 0) {
+    const candidate = globalThis.crypto;
+    cachedWebCrypto = candidate && typeof candidate.getRandomValues === "function" ? candidate : null;
+  }
+  if (!cachedWebCrypto) {
+    throw new Error(
+      "generateNonce: Web Crypto unavailable. TheoKit requires Node.js 19+, Bun, Deno, or any modern Edge runtime where `globalThis.crypto.getRandomValues` is present."
+    );
+  }
+  return cachedWebCrypto;
+}
+function generateNonce() {
+  const buf = new Uint8Array(16);
+  getWebCrypto().getRandomValues(buf);
+  return bytesToBase64(buf);
+}
+
+export {
+  buildSecurityHeaders,
+  generateNonce
+};
+//# sourceMappingURL=chunk-RPET332G.js.map

package/dist/chunk-RPET332G.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/contracts/security-headers.ts","../src/core/contracts/nonce.ts"],"sourcesContent":["/**\n * The security-header baseline, as a pure function of configuration.\n *\n * It lives in `core/contracts/` because **every** target needs it and none of it\n * is transport-specific: `buildSecurityHeaders` takes a config object and\n * returns `Record<string, string>`. `theokit start` writes that map onto a Node\n * `ServerResponse` (`server/security/security-headers.ts`); the six Web deploy\n * adapters write it onto a `Response` (`adapters/security-headers.ts`). Putting\n * it under `server/` made the second group import across a boundary the\n * dependency graph forbids — `adapters → server` is not a declared edge in\n * ADR-0001 v3 — and the fix is not to widen the rule but to notice that this\n * code was never server code.\n *\n * `core/contracts/<file>.ts` is the declared exception to the deep-import rule,\n * so both callers reach it directly and there is still exactly ONE definition of\n * what a configured header set means.\n *\n * Phase 6 — Default Security Headers (D4 / EC-2).\n *\n * Per-response security baseline. The framework applies these BEFORE the\n * route handler runs so a handler can still override via `res.setHeader`.\n *\n * EC-2 backward-compatibility: CSP ships in `report-only` mode by default\n * for 0.2.0. Existing apps with inline scripts or third-party CDN scripts\n * keep working but consumers see violation reports via their CSP report\n * collector (or browser DevTools). 0.3.0 will flip the default to\n * `enforce` after a release of visibility.\n */\n\n/**\n * Default Content-Security-Policy. Conservative-but-not-paralyzing:\n *\n *   - default-src 'self'              — every fetch falls back to same-origin\n *   - script-src 'self'               — T6.1 (0.3.0): `'unsafe-inline'`\n *                                         dropped. The SSR pipeline issues a\n *                                         per-request nonce that REPLACES\n *                                         this directive at runtime\n *                                         (`'nonce-<token>'`). For static /\n *                                         non-SSR contexts where no nonce is\n *                                         available, the policy is strict-\n *                                         no-inline — user inline scripts\n *                                         must be migrated to external\n *                                         `<script src=\"...\">` or threaded\n *                                         through `ctx.nonce`.\n *   - style-src 'self' 'unsafe-inline' — Tailwind + TheoUI use style attrs\n *                                         in animation directives\n *   - img-src 'self' data: blob:      — supports inline data URIs, blobs\n *                                         from canvas exports\n *   - font-src 'self' data:           — Geist fonts inline-base64\n *   - connect-src 'self' ws: wss:     — WebSocket dev HMR + agent streams\n *   - frame-ancestors 'none'          — clickjacking defense\n */\n/**\n * T5.1 — default CSP includes the built-in report endpoint so violations\n * are visible without extra config. Apps that ship a custom `csp` string\n * override the report-uri.\n */\nexport const DEFAULT_CSP =\n  \"default-src 'self'; \" +\n  \"script-src 'self'; \" +\n  \"style-src 'self' 'unsafe-inline'; \" +\n  \"img-src 'self' data: blob:; \" +\n  \"font-src 'self' data:; \" +\n  \"connect-src 'self' ws: wss:; \" +\n  \"frame-ancestors 'none'; \" +\n  'report-uri /__theo/csp-report'\n\n/**\n * T1.1 — Default Permissions-Policy header (default-deny stance).\n *\n * Disables sensitive Web APIs that the vast majority of apps don't use.\n * Apps that DO need any of these opt in by overriding `permissionsPolicy`\n * in `config.security.headers`.\n *\n * The seven features listed are the most-abused for: tracking\n * (geolocation, accelerometer, gyroscope), spyware (camera, microphone),\n * fraud (payment), and hardware exfiltration (usb).\n *\n * Aligns with Mozilla baseline + OWASP Secure Headers + Lighthouse PWA.\n */\nexport const DEFAULT_PERMISSIONS_POLICY =\n  'geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()'\n\nexport type CspMode = 'enforce' | 'report-only' | 'off'\n\nexport interface SecurityHeadersConfig {\n  /**\n   * Custom CSP policy string. When set, replaces the default verbatim.\n   * Pass `false` to disable CSP entirely (alias for `cspMode: 'off'`).\n   */\n  csp?: string | false\n  /**\n   * Enforcement mode for CSP. Default `report-only` for 0.2.0 (EC-2).\n   * 0.3.0 will default to `enforce`.\n   */\n  cspMode?: CspMode\n  /**\n   * Strict-Transport-Security value. Defaults to\n   * `max-age=31536000; includeSubDomains` in production. Pass `false` to\n   * suppress (e.g. internal LANs without TLS).\n   */\n  hsts?: string | false\n  /** X-Frame-Options. Default DENY. */\n  frameOptions?: 'DENY' | 'SAMEORIGIN'\n  /** X-Content-Type-Options. Default `nosniff`. */\n  contentTypeOptions?: 'nosniff'\n  /** Referrer-Policy. Default `strict-origin-when-cross-origin`. */\n  referrerPolicy?: string\n  /**\n   * T1.1 — Permissions-Policy directive string. When set, replaces the\n   * default verbatim (no merge — see ADR-EC-12). Pass `false` to disable\n   * the header entirely. Schema-level refinement rejects any string\n   * containing CR/LF (EC-3 — CWE-113 HTTP Response Splitting mitigation).\n   */\n  permissionsPolicy?: string | false\n}\n\nexport interface SecurityEnv {\n  production: boolean\n}\n\n/**\n * T4.1 — Per-request options passed by the SSR pipeline.\n *\n * - `nonce`: when set, the framework substitutes the `'unsafe-inline'`\n *   token in `script-src` with `'nonce-<nonce>'`. EC-3 forces\n *   `Cache-Control: private, no-store` so a CDN cannot cache the HTML\n *   (carrying one nonce) and re-serve it with a freshly-generated CSP\n *   header (carrying a different nonce).\n * - `prerender`: when true, the nonce is IGNORED. Prerendered HTML is\n *   generated at build time with no nonce in the script tags; mixing a\n *   runtime nonce in the header would block every script. EC-4.\n */\nexport interface SecurityHeadersOptions {\n  nonce?: string\n  prerender?: boolean\n}\n\nconst DEFAULT_HSTS = 'max-age=31536000; includeSubDomains'\n\n/**\n * Apply a nonce to the script-src directive of an existing CSP policy\n * string. Replaces `'unsafe-inline'` (if present) with `'nonce-<value>'`;\n * otherwise appends the nonce directive to the script-src line.\n */\nfunction applyNonceToCsp(policy: string, nonce: string): string {\n  return policy\n    .split(';')\n    .map((directive) => {\n      const trimmed = directive.trim()\n      if (!trimmed.startsWith('script-src')) return directive\n      if (trimmed.includes(\"'unsafe-inline'\")) {\n        return directive.replace(\"'unsafe-inline'\", `'nonce-${nonce}'`)\n      }\n      return `${directive} 'nonce-${nonce}'`\n    })\n    .join(';')\n}\n\n/**\n * Apply Content-Security-Policy header(s) to `out`. Extracted from\n * `buildSecurityHeaders` to keep that function's complexity within ceiling.\n * Handles the four shapes:\n *   csp: false             → opt out\n *   cspMode: 'off'         → opt out\n *   cspMode: 'enforce'     → Content-Security-Policy (T6.1 default for 0.3.0)\n *   cspMode: 'report-only' → Content-Security-Policy-Report-Only (legacy 0.2.x)\n */\nfunction applyCsp(\n  out: Record<string, string>,\n  config: SecurityHeadersConfig,\n  effectiveNonce: string | undefined,\n): void {\n  if (config.csp === false || config.cspMode === 'off') return\n  let policy = typeof config.csp === 'string' ? config.csp : DEFAULT_CSP\n  if (effectiveNonce) {\n    policy = applyNonceToCsp(policy, effectiveNonce)\n  }\n  // T6.1 — default flipped from 'report-only' to 'enforce' for 0.3.0.\n  const mode: CspMode = config.cspMode ?? 'enforce'\n  if (mode === 'enforce') {\n    out['Content-Security-Policy'] = policy\n  } else {\n    out['Content-Security-Policy-Report-Only'] = policy\n  }\n}\n\n/**\n * Build the security headers map for a given config + env. Pure function —\n * returned object can be inspected, logged, or applied to a response.\n */\nexport function buildSecurityHeaders(\n  config: SecurityHeadersConfig,\n  env: SecurityEnv,\n  options: SecurityHeadersOptions = {},\n): Record<string, string> {\n  const out: Record<string, string> = {}\n\n  // EC-4: prerendered routes must NOT receive a nonce — the build-time\n  // HTML carries no nonce, so a runtime nonce would mismatch.\n  const effectiveNonce = options.prerender ? undefined : options.nonce\n\n  applyCsp(out, config, effectiveNonce)\n\n  // X-Frame-Options\n  out['X-Frame-Options'] = config.frameOptions ?? 'DENY'\n\n  // X-Content-Type-Options\n  out['X-Content-Type-Options'] = config.contentTypeOptions ?? 'nosniff'\n\n  // Referrer-Policy\n  out['Referrer-Policy'] = config.referrerPolicy ?? 'strict-origin-when-cross-origin'\n\n  // T1.1 — Permissions-Policy. Default-deny on geo/camera/mic/payment/usb;\n  // configurable via `permissionsPolicy`; suppressed via `permissionsPolicy: false`.\n  if (config.permissionsPolicy !== false) {\n    out['Permissions-Policy'] =\n      typeof config.permissionsPolicy === 'string'\n        ? config.permissionsPolicy\n        : DEFAULT_PERMISSIONS_POLICY\n  }\n\n  // HSTS — production only, suppressible via hsts: false\n  if (env.production && config.hsts !== false) {\n    out['Strict-Transport-Security'] = typeof config.hsts === 'string' ? config.hsts : DEFAULT_HSTS\n  }\n\n  // EC-3: when a nonce is in play, the response carries a one-shot CSP\n  // header AND inline scripts in the HTML body. A CDN that caches the\n  // HTML and proxies a fresh CSP per request would block every script\n  // (nonces wouldn't match). Force no-store to prevent that class of\n  // silent prod-only failure. Prerendered routes (which carry no nonce\n  // by design — EC-4) are exempt; their HTML is meant to be cacheable.\n  if (effectiveNonce) {\n    out['Cache-Control'] = 'private, no-store'\n  }\n\n  return out\n}\n","/**\n * The per-request CSP nonce, minted the same way on every target.\n *\n * It lives in `core/contracts/` for the same reason\n * `core/contracts/security-headers.ts` does: `theokit start` needs it\n * (`cli/commands/start/request-handler.ts`) and so does the streamed Cloudflare\n * worker, which is the one deploy path that renders HTML at request time and can\n * put the same value on the script tags it emits. `adapters → server` is not an\n * edge in the module DAG (ADR-0001 v3), and a Web-Crypto call that returns a\n * base64 string was never server code.\n *\n * T4.1 — Per-request CSP nonce generation.\n *\n * Returns a 22–24 character base64-encoded string carrying 16 bytes of\n * cryptographic entropy. Used by the SSR pipeline to nonce the inline\n * hydration data script so the default CSP can drop `'unsafe-inline'`\n * from `script-src` in 0.3.0.\n *\n * Runtime portability: prefers Web Crypto (`globalThis.crypto`) because\n * it is available on every target runtime (Node 19+, Bun, Deno, Vercel\n * Edge, Cloudflare Workers). Falls back to `node:crypto` for older Node\n * builds where `globalThis.crypto` is absent.\n *\n * NOT a security primitive in the cryptographic sense — the nonce is a\n * one-shot, single-request value that defeats trivial XSS injection by\n * making the attacker guess a 128-bit string per request. It is NOT\n * suitable for signing or session tokens.\n */\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n  // Prefer Buffer when available (Node, Bun) — its base64 encoder is fast\n  // and well-tested. In Edge runtimes that lack Buffer, fall back to the\n  // standard btoa(String.fromCharCode(...)) trick.\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(bytes).toString('base64')\n  }\n  let binary = ''\n  for (const b of bytes) {\n    binary += String.fromCharCode(b)\n  }\n  // `btoa` exists in browsers + edge runtimes; if it doesn't, the caller\n  // is on a JS runtime we don't support — let the ReferenceError bubble.\n  return btoa(binary)\n}\n\n// CR-027 fix: the previous fallback path used `require('node:crypto')`,\n// which throws ReferenceError in strict ESM contexts (Bun, Deno, Vercel\n// Edge) when reached. Web Crypto has been a hard requirement since Node\n// 19; for older Node we now throw a clear error at module load time\n// instead of failing on first SSR request.\nlet cachedWebCrypto: Crypto | null | undefined\n\nfunction getWebCrypto(): Crypto {\n  if (cachedWebCrypto === undefined) {\n    const candidate = (globalThis as { crypto?: Crypto }).crypto\n    cachedWebCrypto =\n      candidate && typeof candidate.getRandomValues === 'function' ? candidate : null\n  }\n  if (!cachedWebCrypto) {\n    throw new Error(\n      'generateNonce: Web Crypto unavailable. TheoKit requires Node.js 19+, Bun, Deno, ' +\n        'or any modern Edge runtime where `globalThis.crypto.getRandomValues` is present.',\n    )\n  }\n  return cachedWebCrypto\n}\n\nexport function generateNonce(): string {\n  const buf = new Uint8Array(16)\n  getWebCrypto().getRandomValues(buf)\n  return bytesToBase64(buf)\n}\n"],"mappings":";;;;AAyDO,IAAM,cACX;AAsBK,IAAM,6BACX;AAyDF,IAAM,eAAe;AAOrB,SAAS,gBAAgB,QAAgB,OAAuB;AAC9D,SAAO,OACJ,MAAM,GAAG,EACT,IAAI,CAAC,cAAc;AAClB,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,QAAQ,WAAW,YAAY,EAAG,QAAO;AAC9C,QAAI,QAAQ,SAAS,iBAAiB,GAAG;AACvC,aAAO,UAAU,QAAQ,mBAAmB,UAAU,KAAK,GAAG;AAAA,IAChE;AACA,WAAO,GAAG,SAAS,WAAW,KAAK;AAAA,EACrC,CAAC,EACA,KAAK,GAAG;AACb;AAWA,SAAS,SACP,KACA,QACA,gBACM;AACN,MAAI,OAAO,QAAQ,SAAS,OAAO,YAAY,MAAO;AACtD,MAAI,SAAS,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAC3D,MAAI,gBAAgB;AAClB,aAAS,gBAAgB,QAAQ,cAAc;AAAA,EACjD;AAEA,QAAM,OAAgB,OAAO,WAAW;AACxC,MAAI,SAAS,WAAW;AACtB,QAAI,yBAAyB,IAAI;AAAA,EACnC,OAAO;AACL,QAAI,qCAAqC,IAAI;AAAA,EAC/C;AACF;AAMO,SAAS,qBACd,QACA,KACA,UAAkC,CAAC,GACX;AACxB,QAAM,MAA8B,CAAC;AAIrC,QAAM,iBAAiB,QAAQ,YAAY,SAAY,QAAQ;AAE/D,WAAS,KAAK,QAAQ,cAAc;AAGpC,MAAI,iBAAiB,IAAI,OAAO,gBAAgB;AAGhD,MAAI,wBAAwB,IAAI,OAAO,sBAAsB;AAG7D,MAAI,iBAAiB,IAAI,OAAO,kBAAkB;AAIlD,MAAI,OAAO,sBAAsB,OAAO;AACtC,QAAI,oBAAoB,IACtB,OAAO,OAAO,sBAAsB,WAChC,OAAO,oBACP;AAAA,EACR;AAGA,MAAI,IAAI,cAAc,OAAO,SAAS,OAAO;AAC3C,QAAI,2BAA2B,IAAI,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EACrF;AAQA,MAAI,gBAAgB;AAClB,QAAI,eAAe,IAAI;AAAA,EACzB;AAEA,SAAO;AACT;;;ACjNA,SAAS,cAAc,OAA2B;AAIhD,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AAAA,EAC7C;AACA,MAAI,SAAS;AACb,aAAW,KAAK,OAAO;AACrB,cAAU,OAAO,aAAa,CAAC;AAAA,EACjC;AAGA,SAAO,KAAK,MAAM;AACpB;AAOA,IAAI;AAEJ,SAAS,eAAuB;AAC9B,MAAI,oBAAoB,QAAW;AACjC,UAAM,YAAa,WAAmC;AACtD,sBACE,aAAa,OAAO,UAAU,oBAAoB,aAAa,YAAY;AAAA,EAC/E;AACA,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,gBAAwB;AACtC,QAAM,MAAM,IAAI,WAAW,EAAE;AAC7B,eAAa,EAAE,gBAAgB,GAAG;AAClC,SAAO,cAAc,GAAG;AAC1B;","names":[]}

package/dist/{chunk-646CA6RV.js → chunk-RQW5YMH7.js}

@@ -110,6 +110,11 @@ function normalizeSecrets(input) {
   }
   return arr;
 }
+function resolveSecrets(input) {
+  const secrets = normalizeSecrets(input);
+  assertProductionSecret(secrets);
+  return secrets;
+}
 async function encryptSessionEnvelope(data, secrets, maxAge) {
   const envelope = {
     data,
@@ -130,7 +135,7 @@ async function decryptSessionWithFallback(raw, secrets) {
   return null;
 }
 function createSessionManager(config) {
-  const secrets = normalizeSecrets(config.secret);
+  const secrets = resolveSecrets(config.secret);
   const cookieName = config.cookieName ?? "theo_session";
   const maxAge = config.maxAge ?? 604800;
   function writeCookie(res, token) {
@@ -176,7 +181,7 @@ function createSessionManager(config) {
   };
 }
 function createSessionManagerWeb(config) {
-  const secrets = normalizeSecrets(config.secret);
+  const secrets = resolveSecrets(config.secret);
   const cookieName = config.cookieName ?? "theo_session";
   const maxAge = config.maxAge ?? 604800;
   function writeCookieWeb(target, token) {
@@ -290,7 +295,10 @@ var DEFAULT_DIGITS = 6;
 var DEFAULT_ALGORITHM = "SHA-1";
 function base32Decode(s) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-  const clean = s.toUpperCase().replace(/=+$/, "").replace(/\s+/g, "");
+  const upper = s.toUpperCase();
+  let end = upper.length;
+  while (end > 0 && upper.charCodeAt(end - 1) === 61) end -= 1;
+  const clean = upper.slice(0, end).replace(/\s+/g, "");
   if (!/^[A-Z2-7]+$/.test(clean)) {
     throw new Error("Invalid base32 secret");
   }
@@ -618,4 +626,4 @@ export {
   clearOidcCache,
   discoverOidcProvider
 };
-//# sourceMappingURL=chunk-646CA6RV.js.map
+//# sourceMappingURL=chunk-RQW5YMH7.js.map

package/dist/chunk-RQW5YMH7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/auth/auth.ts","../src/server/auth/crypto.ts","../src/server/auth/session.ts","../src/server/_internal/encoding.ts","../src/server/auth/auth-totp.ts","../src/server/auth/auth-backup-codes.ts","../src/server/auth/auth-throttle.ts","../src/server/auth/oauth-pkce.ts","../src/server/auth/oauth-state.ts","../src/server/auth/oidc-discovery.ts"],"mappings":";;;;;;;;;;AAAO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,OAAO;AAAA,EACP,SAAS;AAAA,EAET,YAAY,UAAU,2BAA2B;AAC/C,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,YAAe,SAAqD;AAClF,MAAI,YAAY,QAAQ,YAAY,QAAW;AAC7C,UAAM,IAAI,kBAAkB;AAAA,EAC9B;AACF;;;ACEA,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAEhC,IAAM,oBAAoB,QAAQ,OAAO,iBAAiB;AAC1D,IAAM,kBAAkB,IAAI,WAAW,CAAC;AAKxC,IAAM,WAAW,oBAAI,IAAgC;AAErD,eAAe,UAAU,QAAoC;AAC3D,QAAM,SAAS,SAAS,IAAI,MAAM;AAClC,MAAI,OAAQ,QAAO;AAEnB,QAAM,UAAU,YAAY;AAC1B,UAAM,cAAc,MAAM,OAAO,OAAO;AAAA,MACtC;AAAA,MACA,QAAQ,OAAO,MAAM;AAAA,MACrB,EAAE,MAAM,OAAO;AAAA,MACf;AAAA,MACA,CAAC,WAAW;AAAA,IACd;AACA,WAAO,OAAO,OAAO;AAAA,MACnB,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,iBAAiB,MAAM,kBAAkB;AAAA,MAChF;AAAA,MACA,EAAE,MAAM,WAAW,QAAQ,IAAI;AAAA,MAC/B;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AAAA,EACF,GAAG;AAEH,WAAS,IAAI,QAAQ,MAAM;AAE3B,SAAO,MAAM,MAAM;AACjB,aAAS,OAAO,MAAM;AAAA,EACxB,CAAC;AACD,SAAO;AACT;AAEA,SAAS,YAAY,MAA0B;AAC7C,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,WAAW;AAC/C;AASA,SAAS,cAAc,KAAsC;AAC3D,QAAM,MAAM,OAAO,KAAK,KAAK,WAAW;AACxC,QAAM,OAAO,IAAI,WAAW,IAAI,MAAM;AACtC,OAAK,IAAI,GAAG;AACZ,SAAO;AACT;AAOA,eAAsB,QAAW,MAAS,QAAiC;AACzE,QAAM,MAAM,MAAM,UAAU,MAAM;AAClC,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACpD,QAAM,YAAY,QAAQ,OAAO,KAAK,UAAU,IAAI,CAAC;AACrD,QAAM,aAAa,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,SAAS;AAAA,EACrE;AACA,SAAO,GAAG,YAAY,EAAE,CAAC,IAAI,YAAY,UAAU,CAAC;AACtD;AAEA,eAAsB,QAAW,OAAe,QAAmC;AACjF,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,UAAM,KAAK,cAAc,MAAM,CAAC,CAAC;AACjC,UAAM,aAAa,cAAc,MAAM,CAAC,CAAC;AACzC,UAAM,MAAM,MAAM,UAAU,MAAM;AAElC,UAAM,YAAY,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,UAAU;AACtF,WAAO,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,yBAA+B;AAC7C,WAAS,MAAM;AACjB;;;ACjDA,IAAM,cAAc;AAMpB,SAAS,iBAAiB,OAAoC;AAC5D,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,MAAM,IAAI,CAAC,KAAK;AACzD,MAAI,IAAI,WAAW,GAAG;AACpB,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,MAAI,IAAI,SAAS,aAAa;AAC5B,UAAM,IAAI;AAAA,MACR,2CAA2C,WAAW,qEAAgE,IAAI,MAAM;AAAA,IAClI;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,KAAK;AACpC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,UAAM,IAAI,IAAI,CAAC;AACf,QAAI,OAAO,MAAM,YAAY,EAAE,SAAS,IAAI;AAC1C,YAAM,QAAQ,WAAW,aAAa,CAAC,KAAK;AAC5C,YAAM,IAAI,MAAM,iBAAiB,KAAK,uDAAuD;AAAA,IAC/F;AAAA,EACF;AACA,SAAO;AACT;AAgBA,SAAS,eAAe,OAAoC;AAC1D,QAAM,UAAU,iBAAiB,KAAK;AACtC,yBAAuB,OAAO;AAC9B,SAAO;AACT;AAUA,eAAe,uBACb,MACA,SACA,QACiB;AACjB,QAAM,WAAqC;AAAA,IACzC;AAAA,IACA,KAAK,KAAK,IAAI,IAAI,SAAS;AAAA,EAC7B;AACA,SAAO,QAAQ,UAAU,QAAQ,CAAC,CAAC;AACrC;AAWA,eAAe,2BACb,KACA,SACwE;AACxE,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,QAAQ,IAAI,OAAO,QAAQ,MAAM;AAC/B,YAAM,MAAM,MAAM,QAAmC,KAAK,MAAM;AAChE,aAAO,MAAM,EAAE,UAAU,KAAK,OAAO,EAAE,IAAI;AAAA,IAC7C,CAAC;AAAA,EACH;AACA,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAQ,QAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEO,SAAS,qBAA+B,QAAiD;AAC9F,QAAM,UAAU,eAAe,OAAO,MAAM;AAC5C,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,SAAS,OAAO,UAAU;AAEhC,WAAS,YAAY,KAAqB,OAAqB;AAC7D,cAAU,KAAK,YAAY,OAAO;AAAA,MAChC,UAAU;AAAA,MACV,UAAU;AAAA,MACV;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,KAAK;AACpB,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,GAAG;AAClD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,mBAAmB,KAAK;AAC5B,YAAM,MAAM,UAAU,KAAK,UAAU;AACrC,UAAI,CAAC,IAAK,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AAChF,YAAM,UAAU,MAAM,2BAAqC,KAAK,OAAO;AACvE,UAAI,CAAC,QAAS,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AACpF,UAAI,QAAQ,SAAS,MAAM,KAAK,IAAI,GAAG;AACrC,eAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,MAAM,EAAE;AAAA,MACnF;AACA,aAAO;AAAA,QACL,MAAM,QAAQ,SAAS;AAAA,QACvB,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,IAEA,MAAM,cAAc,KAAK,MAAM;AAC7B,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,kBAAY,KAAK,KAAK;AAAA,IACxB;AAAA,IAEA,eAAe,KAAK;AAClB,mBAAa,KAAK,UAAU;AAAA,IAC9B;AAAA,IAEA,MAAM,cAAc,KAAK,KAAK;AAC5B,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,GAAG;AAClD,UAAI,SAAS,KAAM,QAAO;AAG1B,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,kBAAY,KAAK,KAAK;AACtB,aAAO;AAAA,IACT;AAAA,EACF;AACF;AA4BO,SAAS,wBACd,QAC6B;AAC7B,QAAM,UAAU,eAAe,OAAO,MAAM;AAC5C,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,SAAS,OAAO,UAAU;AAEhC,WAAS,eAAe,QAAiB,OAAqB;AAC5D,0BAAsB,QAAQ,YAAY,OAAO;AAAA,MAC/C,UAAU;AAAA,MACV,UAAU;AAAA,MACV;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,SAAS;AACxB,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,OAAO;AACtD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,mBAAmB,SAAS;AAChC,YAAM,MAAM,qBAAqB,SAAS,UAAU;AACpD,UAAI,QAAQ,OAAW,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AAC7F,YAAM,UAAU,MAAM,2BAAqC,KAAK,OAAO;AACvE,UAAI,CAAC,QAAS,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AACpF,UAAI,QAAQ,SAAS,MAAM,KAAK,IAAI,GAAG;AACrC,eAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,MAAM,EAAE;AAAA,MACnF;AACA,aAAO;AAAA,QACL,MAAM,QAAQ,SAAS;AAAA,QACvB,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,IAEA,MAAM,cAAc,QAAQ,MAAM;AAChC,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,qBAAe,QAAQ,KAAK;AAAA,IAC9B;AAAA,IAEA,eAAe,QAAQ;AACrB,kCAA4B,QAAQ,UAAU;AAAA,IAChD;AAAA,IAEA,MAAM,cAAc,SAAS,QAAQ;AACnC,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,OAAO;AACtD,UAAI,SAAS,KAAM,QAAO;AAC1B,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,qBAAe,QAAQ,KAAK;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAiBA,eAAsB,kBACpB,IACA,SACA,QAC0B;AAC1B,QAAM,EAAE,MAAM,KAAK,IAAI,MAAM,GAAG,mBAAmB,OAAO;AAC1D,MAAI,SAAS,QAAQ,KAAK,gBAAgB;AACxC,UAAM,GAAG,cAAc,QAAQ,IAAI;AAAA,EACrC;AACA,SAAO;AACT;AAmBA,eAAsB,eACpB,IACA,KACA,KAC0B;AAC1B,QAAM,EAAE,MAAM,KAAK,IAAI,MAAM,GAAG,mBAAmB,GAAG;AACtD,MAAI,SAAS,QAAQ,KAAK,gBAAgB;AACxC,UAAM,GAAG,cAAc,KAAK,IAAI;AAAA,EAClC;AACA,SAAO;AACT;AASA,IAAM,sBAAsB;AAErB,SAAS,uBAAuB,QAAiC;AACtE,QAAM,MAAM,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;AACpD,QAAM,SAAS,QAAQ,IAAI,aAAa;AAExC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,UAAM,IAAI,IAAI,CAAC;AACf,UAAM,gBAAgB,oBAAoB,KAAK,CAAC;AAChD,UAAM,aAAa,EAAE,SAAS;AAC9B,UAAM,SAAS,IAAI,SAAS,IAAI,2BAA2B,CAAC,KAAK;AAEjE,QAAI,QAAQ;AACV,UAAI,YAAY;AACd,cAAM,IAAI;AAAA,UACR,GAAG,MAAM,8BAA8B,EAAE,MAAM;AAAA,QAEjD;AAAA,MACF;AACA,UAAI,eAAe;AACjB,cAAM,IAAI;AAAA,UACR,GAAG,MAAM,+BAA+B,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,QAExD;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,iBAAiB,YAAY;AAC/B,cAAQ;AAAA,QACN,sBAAsB,OAAO,YAAY,CAAC;AAAA,MAE5C;AAAA,IACF;AAAA,EACF;AACF;;;ACjXO,SAAS,gBAAgB,OAA2B;AACzD,MAAI,IAAI;AACR,aAAW,KAAK,MAAO,MAAK,OAAO,aAAa,CAAC;AAMjD,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AAgBO,SAAS,mBAAmB,GAAW,GAAoB;AAChE,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EAAG,QAAO;AAE7C,QAAM,SAAS,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AAC1C,MAAI,OAAO,EAAE,SAAS,EAAE;AACxB,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAG/B,UAAM,KAAK,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI;AAC5C,UAAM,KAAK,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI;AAC5C,YAAQ,KAAK;AAAA,EACf;AACA,SAAO,SAAS;AAClB;;;ACbA,IAAM,eAAe;AACrB,IAAM,iBAAiB;AACvB,IAAM,oBAAmC;AAGzC,SAAS,aAAa,GAAuB;AAC3C,QAAM,WAAW;AASjB,QAAM,QAAQ,EAAE,YAAY;AAC5B,MAAI,MAAM,MAAM;AAChB,SAAO,MAAM,KAAK,MAAM,WAAW,MAAM,CAAC,MAAM,GAAgB,QAAO;AACvE,QAAM,QAAQ,MAAM,MAAM,GAAG,GAAG,EAAE,QAAQ,QAAQ,EAAE;AACpD,MAAI,CAAC,cAAc,KAAK,KAAK,GAAG;AAC9B,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AACA,QAAM,OAAiB,CAAC;AACxB,aAAW,KAAK,OAAO;AACrB,UAAM,MAAM,SAAS,QAAQ,CAAC;AAC9B,aAAS,IAAI,GAAG,KAAK,GAAG,IAAK,MAAK,KAAM,OAAO,IAAK,CAAC;AAAA,EACvD;AAEA,QAAM,YAAY,KAAK,MAAM,KAAK,SAAS,CAAC;AAC5C,QAAM,MAAM,IAAI,WAAW,SAAS;AACpC,WAAS,IAAI,GAAG,IAAI,WAAW,KAAK;AAClC,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,GAAG,IAAK,KAAK,KAAK,IAAK,KAAK,IAAI,IAAI,CAAC;AACzD,QAAI,CAAC,IAAI;AAAA,EACX;AACA,SAAO;AACT;AAGA,SAAS,aAAa,OAA2B;AAC/C,QAAM,WAAW;AACjB,MAAI,MAAM;AACV,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,KAAK,OAAO;AACrB,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,aAAO,SAAU,UAAW,OAAO,IAAM,EAAI;AAC7C,cAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,EAAG,QAAO,SAAU,UAAW,IAAI,OAAS,EAAI;AAC3D,SAAO;AACT;AAEA,SAAS,gBAAgB,QAAyC;AAChE,MAAI,OAAO,WAAW,SAAU,QAAO,aAAa,MAAM;AAC1D,SAAO;AACT;AAGA,SAAS,aAAa,QAAgB,SAA6B;AACjE,QAAM,UAAU,KAAK,MAAM,SAAS,MAAO,OAAO;AAClD,QAAM,MAAM,IAAI,WAAW,CAAC;AAE5B,QAAM,KAAK,KAAK,MAAM,UAAU,UAAW;AAC3C,QAAM,KAAK,YAAY;AACvB,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,IAAK;AACtB,MAAI,CAAC,IAAI,KAAK;AACd,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,IAAK;AACtB,MAAI,CAAC,IAAI,KAAK;AACd,SAAO;AACT;AAEA,eAAe,KACb,QACA,SACA,WACqB;AACrB,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,MAAM,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,OAAuB;AACzE,SAAO,IAAI,WAAW,GAAG;AAC3B;AAGA,SAAS,SAAS,KAAiB,QAAwB;AACzD,QAAM,SAAS,IAAI,IAAI,SAAS,CAAC,IAAI;AACrC,QAAM,QACF,IAAI,MAAM,IAAI,QAAS,MACvB,IAAI,SAAS,CAAC,IAAI,QAAS,MAC3B,IAAI,SAAS,CAAC,IAAI,QAAS,IAC5B,IAAI,SAAS,CAAC,IAAI;AACrB,QAAM,MAAM,MAAM;AAClB,SAAO,OAAO,OAAO,GAAG,EAAE,SAAS,QAAQ,GAAG;AAChD;AAGA,eAAsB,aAAa,MAAoC;AACrE,QAAM,SAAS,gBAAgB,KAAK,MAAM;AAC1C,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,OAAO,KAAK,QAAQ,KAAK,IAAI;AACnC,QAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,MAAM,IAAI,GAAG,SAAS;AAClE,SAAO,SAAS,KAAK,MAAM;AAC7B;AAQA,eAAsB,WAAW,OAAe,MAA2C;AACzF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,MAAM,WAAW,OAAQ,QAAO;AAE5D,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,OAAO,KAAK,QAAQ,KAAK,IAAI;AACnC,QAAM,QAAQ,KAAK,UAAU;AAC7B,QAAM,SAAS,gBAAgB,KAAK,MAAM;AAG1C,MAAI,UAAU;AACd,WAAS,QAAQ,CAAC,OAAO,SAAS,OAAO,SAAS;AAChD,UAAM,IAAI,OAAO,QAAQ,OAAO;AAChC,UAAM,OAAO,SAAS,MAAM,KAAK,QAAQ,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM;AAClF,QAAI,mBAAmB,MAAM,KAAK,EAAG,WAAU;AAAA,EACjD;AACA,SAAO;AACT;AAGO,SAAS,mBAAmB,QAAQ,IAAgB;AACzD,MAAI,QAAQ,IAAI;AACd,UAAM,IAAI,MAAM,gEAA6D;AAAA,EAC/E;AACA,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,gBAAgB,GAAG;AAC1B,SAAO;AACT;AAgBO,SAAS,QAAQ,MAA8B;AACpD,QAAM,QAAQ,GAAG,KAAK,MAAM,IAAI,KAAK,OAAO;AAC5C,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,QAAQ,aAAa,KAAK,MAAM;AAAA,IAChC,QAAQ,KAAK;AAAA,IACb,WAAW,KAAK,aAAa;AAAA,IAC7B,QAAQ,OAAO,KAAK,UAAU,cAAc;AAAA,IAC5C,QAAQ,OAAO,KAAK,QAAQ,YAAY;AAAA,EAC1C,CAAC;AACD,SAAO,kBAAkB,mBAAmB,KAAK,CAAC,IAAI,OAAO,SAAS,CAAC;AACzE;;;AC7LA,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,iBAAiB;AAQvB,eAAsB,oBAAoB,OAA0B,CAAC,GAA0B;AAC7F,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,YAAY,KAAK,cAAc,SAAY,MAAM,KAAK;AAC5D,QAAM,WAAW,KAAK,YAAY;AAMlC,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,KAAK,QAAQ,KAAM;AAC1D,UAAM,IAAI;AAAA,MACR,mEAAmE,OAAO,KAAK,CAAC;AAAA,IAClF;AAAA,EACF;AACA,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,IAAI;AAC1D,UAAM,IAAI;AAAA,MACR,kEAAkE,OAAO,MAAM,CAAC;AAAA,IAClF;AAAA,EACF;AACA,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,IAAI;AAAA,MACR,6EAA6E,SAAS,MAAM;AAAA,IAC9F;AAAA,EACF;AAEA,QAAM,QAAsB,CAAC;AAC7B,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,MAAM,SAAS,OAAO;AAC3B,UAAM,MAAM,mBAAmB,QAAQ,QAAQ;AAC/C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,UAAM,YAAY,oBAAoB,KAAK,SAAS;AACpD,UAAM,OAAO,MAAM,UAAU,cAAc,SAAS,CAAC;AACrD,UAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAUA,eAAsB,iBACpB,MACA,QACmD;AACnD,QAAM,YAAY,MAAM,UAAU,cAAc,IAAI,CAAC;AACrD,MAAI;AAEJ,aAAW,KAAK,QAAQ;AACtB,QAAIA,oBAAmB,GAAG,SAAS,GAAG;AACpC,oBAAc;AAAA,IAChB;AAAA,EACF;AACA,SAAO,cAAc,EAAE,OAAO,MAAM,YAAY,IAAI,EAAE,OAAO,MAAM;AACrE;AAOA,SAAS,cAAc,OAAuB;AAC5C,SAAO,MAAM,YAAY,EAAE,QAAQ,WAAW,EAAE;AAClD;AAEA,SAAS,oBAAoB,KAAa,WAA+B;AACvE,MAAI,CAAC,aAAa,IAAI,SAAS,EAAG,QAAO;AACzC,QAAM,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC;AACrC,SAAO,IAAI,MAAM,GAAG,GAAG,IAAI,YAAY,IAAI,MAAM,GAAG;AACtD;AAEA,SAAS,mBAAmB,QAAgB,UAA0B;AACpE,QAAM,SAAS,IAAI,WAAW,MAAM;AACpC,SAAO,gBAAgB,MAAM;AAC7B,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC/B,WAAO,SAAS,OAAO,CAAC,IAAI,SAAS,MAAM;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,eAAe,UAAU,OAAgC;AACvD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK;AAC5C,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AACxD,SAAO,MAAM,KAAK,IAAI,WAAW,IAAI,CAAC,EACnC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEA,SAASA,oBAAmB,GAAW,GAAoB;AACzD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC3E,SAAO,SAAS;AAClB;;;ACjGA,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB,KAAK;AAOhC,eAAsB,cAAc,MAA+C;AACjF,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,QAAQ,MAAM,KAAK,MAAM,IAAI,KAAK,UAAU;AAClD,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,SAAS,MAAM,mBAAmB,YAAY;AAAA,EACzD;AACA,MAAI,MAAM,SAAS,aAAa;AAC9B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,mBAAmB;AAAA;AAAA,MAEnB,aAAa,IAAI,KAAK,MAAM,OAAO;AAAA,IACrC;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,mBAAmB,KAAK,IAAI,GAAG,cAAc,MAAM,KAAK;AAAA,EAC1D;AACF;AAWA,eAAsB,cACpB,MACA,SACwB;AACxB,QAAM,cAAc,KAAK,eAAe;AACxC,MAAI,SAAS;AACX,UAAM,KAAK,MAAM,MAAM,KAAK,UAAU;AACtC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,mBAAmB;AAAA,IACrB;AAAA,EACF;AACA,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,QAAQ,MAAM,KAAK,MAAM,KAAK,KAAK,YAAY,SAAS;AAE9D,MAAI,MAAM,SAAS,aAAa;AAC9B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,mBAAmB;AAAA,MACnB,aAAa,IAAI,KAAK,MAAM,OAAO;AAAA,IACrC;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,mBAAmB,KAAK,IAAI,GAAG,cAAc,MAAM,KAAK;AAAA,EAC1D;AACF;;;AClFA,eAAsB,0BAA0B,UAAmC;AACjF,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,QAAQ;AAC/C,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AACxD,SAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;AAC7C;AAWA,eAAsB,wBAAgD;AACpE,QAAM,SAAS,IAAI,WAAW,EAAE;AAChC,SAAO,gBAAgB,MAAM;AAC7B,QAAM,eAAe,gBAAgB,MAAM;AAC3C,QAAM,gBAAgB,MAAM,0BAA0B,YAAY;AAClE,SAAO,EAAE,cAAc,eAAe,qBAAqB,OAAO;AACpE;;;ACjCO,SAAS,mBAAmB,OAA2B,CAAC,GAAW;AACxE,QAAM,MAAM,KAAK,SAAS;AAC1B,QAAM,MAAM,IAAI,WAAW,GAAG;AAC9B,SAAO,gBAAgB,GAAG;AAC1B,SAAO,gBAAgB,GAAG;AAC5B;AASO,SAAS,iBAAiB,UAAkB,QAAyB;AAC1E,SAAO,mBAAmB,UAAU,MAAM;AAC5C;;;ACNA,IAAM,QAAQ,oBAAI,IAAmC;AAG9C,SAAS,iBAAuB;AACrC,QAAM,MAAM;AACd;AAEA,SAAS,WAAW,MAAuB;AACzC,SAAO,SAAS,eAAe,SAAS,eAAe,SAAS,WAAW,SAAS;AACtF;AAWA,eAAsB,qBAAqB,QAA6C;AACtF,QAAM,YAAY,OAAO,WAAW,WAAW,SAAS,OAAO,SAAS;AAExE,QAAM,MAAM,IAAI,IAAI,SAAS;AAC7B,MAAI,IAAI,aAAa,YAAY,CAAC,WAAW,IAAI,QAAQ,GAAG;AAC1D,UAAM,IAAI;AAAA,MACR,yCAAyC,IAAI,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAExE;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,IAAI,SAAS;AAClC,MAAI,OAAQ,QAAO;AAEnB,QAAM,WAAW,YAAY;AAC3B,UAAM,YAAY,IAAI;AAAA,MACpB;AAAA,MACA,UAAU,SAAS,GAAG,IAAI,YAAY,YAAY;AAAA,IACpD;AACA,UAAM,MAAM,MAAM,MAAM,SAAS;AACjC,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,IAAI,IAAI,UAAU,OAAO,SAAS,EAAE;AAAA,IAC1F;AACA,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,SAAS,wBAAwB;AACpC,YAAM,IAAI,MAAM,kFAA6E;AAAA,IAC/F;AACA,WAAO;AAAA,EACT,GAAG;AAEH,QAAM,IAAI,WAAW,OAAO;AAC5B,UAAQ,MAAM,MAAM;AAClB,QAAI,MAAM,IAAI,SAAS,MAAM,QAAS,OAAM,OAAO,SAAS;AAAA,EAC9D,CAAC;AACD,SAAO;AACT;","names":["constantTimeEquals"]}

package/dist/chunk-U5PWXS3J.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/config/import-user-module.ts
+import { pathToFileURL } from "url";
+var CYCLE_PATTERNS = [
+  // Node 22 strict ESM cycle detection when a registered loader hook
+  // re-enters its own evaluation context.
+  "require() ES Module",
+  "in a cycle",
+  // Vite SSR throws this when it cannot resolve an out-of-root URL.
+  "Failed to load url",
+  "Does the file exist?",
+  // Node native ESM resolver throws this for `.ts` files when no
+  // tsx loader is registered globally (the common test-worker case).
+  "Cannot find module",
+  // ERR_UNKNOWN_FILE_EXTENSION for `.ts` files.
+  "Unknown file extension"
+];
+function isLoaderInteropError(err) {
+  if (!(err instanceof Error)) return false;
+  const msg = err.message;
+  return CYCLE_PATTERNS.some((p) => msg.includes(p));
+}
+async function importUserModule(absoluteFilePath, parentURL = import.meta.url) {
+  const fileURL = pathToFileURL(absoluteFilePath).href;
+  try {
+    return await import(fileURL);
+  } catch (err) {
+    if (!isLoaderInteropError(err)) throw err;
+    const { tsImport } = await import("tsx/esm/api");
+    return await tsImport(fileURL, parentURL);
+  }
+}
+
+export {
+  importUserModule
+};
+//# sourceMappingURL=chunk-U5PWXS3J.js.map

package/dist/chunk-U5PWXS3J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/import-user-module.ts"],"sourcesContent":["/**\n * Helper for loading user-authored TypeScript modules at runtime.\n *\n * Why this exists: theokit framework code (`load-config.ts`, `job-scan.ts`,\n * `cron-scan.ts`, `integrate-ui.ts`, `static.ts`) dynamically imports\n * `.ts` files from user space (`theo.config.ts`, `server/jobs/*.ts`,\n * `static-paths.ts`, etc.). Two execution environments must work:\n *\n *   1. **Production CLI** — `dist/cli/index.js` starts with\n *      `import \"tsx/esm\"` which registers a global Node ESM loader hook.\n *      Subsequent `await import('foo.ts')` calls are intercepted by the\n *      hook, transformed in-place, and returned as ESM namespaces.\n *\n *   2. **Vitest tests** — Vitest runs framework code through Vite's SSR\n *      pipeline. Dynamic imports inside framework modules are hijacked\n *      by Vite's `loadAndTransform`, which cannot resolve absolute paths\n *      outside the Vite project root (e.g., `/tmp/test-fixture/foo.ts`).\n *      Even with `server.deps.external` configured to hand the path\n *      back to Node, the registered tsx/esm loader hits a `require()`\n *      ESM cycle error on Node 22 because the calling stack contains\n *      both the loader's own evaluation context AND the importer.\n *\n * `tsImport()` from `tsx/esm/api` is the documented escape hatch for\n * exactly this scenario: it transforms the source file via tsx's\n * standalone pipeline and evaluates the result via a fresh namespace,\n * bypassing both Vite SSR and any registered global hook.\n *\n * Strategy:\n *   - Try native `await import()` first (zero overhead in production\n *     where tsx hook is registered).\n *   - On failure with the well-known cycle/resolution errors, fall back\n *     to `tsImport()`. Other errors (genuine syntax errors, missing\n *     module, etc.) propagate unchanged.\n *\n * Idempotent and side-effect-free.\n */\nimport { pathToFileURL } from 'node:url'\n\nconst CYCLE_PATTERNS = [\n  // Node 22 strict ESM cycle detection when a registered loader hook\n  // re-enters its own evaluation context.\n  'require() ES Module',\n  'in a cycle',\n  // Vite SSR throws this when it cannot resolve an out-of-root URL.\n  'Failed to load url',\n  'Does the file exist?',\n  // Node native ESM resolver throws this for `.ts` files when no\n  // tsx loader is registered globally (the common test-worker case).\n  'Cannot find module',\n  // ERR_UNKNOWN_FILE_EXTENSION for `.ts` files.\n  'Unknown file extension',\n]\n\nfunction isLoaderInteropError(err: unknown): boolean {\n  if (!(err instanceof Error)) return false\n  const msg = err.message\n  return CYCLE_PATTERNS.some((p) => msg.includes(p))\n}\n\n/**\n * Load a user-authored TS/JS module at the given absolute file path.\n * `parentURL` defaults to the URL of this module file.\n *\n * @returns module namespace object (matches `await import(...)` return)\n */\nexport async function importUserModule(\n  absoluteFilePath: string,\n  parentURL: string = import.meta.url,\n): Promise<Record<string, unknown>> {\n  const fileURL = pathToFileURL(absoluteFilePath).href\n  try {\n    return (await import(fileURL)) as Record<string, unknown>\n  } catch (err) {\n    if (!isLoaderInteropError(err)) throw err\n    // Fallback: tsx programmatic API. Imports are inline, no global hook\n    // mutation, no Vite SSR interference. Slower per call (~10-50ms vs\n    // microseconds for registered loader) but only used as a last resort.\n    const { tsImport } = (await import('tsx/esm/api')) as {\n      tsImport: (\n        specifier: string,\n        options: string | { parentURL: string; tsconfig?: string; namespace?: string },\n      ) => Promise<Record<string, unknown>>\n    }\n    // Bypass tsconfig — tsx's default bundler-style resolver handles\n    // `.js → .ts` fallback for relative imports under the user's module.\n    // Passing an explicit tsconfig sometimes shadows the default and\n    // breaks the `.js → .ts` rewrite chain inside the namespaced loader\n    // (verified empirically in cron-scan/job-scan vitest workers).\n    return await tsImport(fileURL, parentURL)\n  }\n}\n"],"mappings":";;;;AAoCA,SAAS,qBAAqB;AAE9B,IAAM,iBAAiB;AAAA;AAAA;AAAA,EAGrB;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EAEA;AACF;AAEA,SAAS,qBAAqB,KAAuB;AACnD,MAAI,EAAE,eAAe,OAAQ,QAAO;AACpC,QAAM,MAAM,IAAI;AAChB,SAAO,eAAe,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;AACnD;AAQA,eAAsB,iBACpB,kBACA,YAAoB,YAAY,KACE;AAClC,QAAM,UAAU,cAAc,gBAAgB,EAAE;AAChD,MAAI;AACF,WAAQ,MAAM,OAAO;AAAA,EACvB,SAAS,KAAK;AACZ,QAAI,CAAC,qBAAqB,GAAG,EAAG,OAAM;AAItC,UAAM,EAAE,SAAS,IAAK,MAAM,OAAO,aAAa;AAWhD,WAAO,MAAM,SAAS,SAAS,SAAS;AAAA,EAC1C;AACF;","names":[]}

package/dist/{chunk-RWNSW4FM.js → chunk-UMNXCU3K.js}

@@ -16,13 +16,17 @@ function extractTraceContext(headers) {
 }
 function generateNewTraceContext() {
   return {
-    trace_id: randomHex(16),
-    // 16 bytes = 32 hex chars
-    span_id: randomHex(8),
-    //  8 bytes = 16 hex chars
+    trace_id: newTraceId(),
+    span_id: newSpanId(),
     flags: "01"
   };
 }
+function newTraceId() {
+  return randomHex(16);
+}
+function newSpanId() {
+  return randomHex(8);
+}
 function randomHex(bytes) {
   for (; ; ) {
     const buf = new Uint8Array(bytes);
@@ -35,6 +39,8 @@ function randomHex(bytes) {
 
 export {
   extractTraceContext,
-  generateNewTraceContext
+  generateNewTraceContext,
+  newTraceId,
+  newSpanId
 };
-//# sourceMappingURL=chunk-RWNSW4FM.js.map
+//# sourceMappingURL=chunk-UMNXCU3K.js.map

package/dist/{chunk-RWNSW4FM.js.map → chunk-UMNXCU3K.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/observability/trace-context-propagation.ts"],"mappings":";AAoCA,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AAWhB,SAAS,oBAAoB,SAAuC;AACzE,QAAM,QAAQ,QAAQ,IAAI,aAAa;AACvC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,IAAI,eAAe,KAAK,KAAK;AACnC,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,WAAW,EAAE,CAAC;AACpB,QAAM,UAAU,EAAE,CAAC;AACnB,QAAM,QAAQ,EAAE,CAAC;AACjB,MAAI,aAAa,gBAAiB,QAAO;AACzC,MAAI,YAAY,eAAgB,QAAO;AACvC,SAAO,EAAE,UAAU,SAAS,MAAM;AACpC;AAgBO,SAAS,0BAAwC;AACtD,SAAO;AAAA,IACL,UAAU,UAAU,EAAE;AAAA;AAAA,IACtB,SAAS,UAAU,CAAC;AAAA;AAAA,IACpB,OAAO;AAAA,EACT;AACF;AAEA,SAAS,UAAU,OAAuB;AAKxC,aAAS;AACP,UAAM,MAAM,IAAI,WAAW,KAAK;AAChC,eAAW,OAAO,gBAAgB,GAAG;AACrC,QAAI,MAAM;AACV,eAAW,KAAK,IAAK,QAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC1D,QAAI,CAAC,OAAO,KAAK,GAAG,EAAG,QAAO;AAAA,EAChC;AACF;","names":[]}
+{"version":3,"sources":["../src/server/observability/trace-context-propagation.ts"],"mappings":";AAoCA,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AAWhB,SAAS,oBAAoB,SAAuC;AACzE,QAAM,QAAQ,QAAQ,IAAI,aAAa;AACvC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,IAAI,eAAe,KAAK,KAAK;AACnC,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,WAAW,EAAE,CAAC;AACpB,QAAM,UAAU,EAAE,CAAC;AACnB,QAAM,QAAQ,EAAE,CAAC;AACjB,MAAI,aAAa,gBAAiB,QAAO;AACzC,MAAI,YAAY,eAAgB,QAAO;AACvC,SAAO,EAAE,UAAU,SAAS,MAAM;AACpC;AAgBO,SAAS,0BAAwC;AACtD,SAAO;AAAA,IACL,UAAU,WAAW;AAAA,IACrB,SAAS,UAAU;AAAA,IACnB,OAAO;AAAA,EACT;AACF;AAUO,SAAS,aAAqB;AACnC,SAAO,UAAU,EAAE;AACrB;AAGO,SAAS,YAAoB;AAClC,SAAO,UAAU,CAAC;AACpB;AAEA,SAAS,UAAU,OAAuB;AAKxC,aAAS;AACP,UAAM,MAAM,IAAI,WAAW,KAAK;AAChC,eAAW,OAAO,gBAAgB,GAAG;AACrC,QAAI,MAAM;AACV,eAAW,KAAK,IAAK,QAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC1D,QAAI,CAAC,OAAO,KAAK,GAAG,EAAG,QAAO;AAAA,EAChC;AACF;","names":[]}

package/dist/{chunk-DS5MCU2X.js → chunk-URCXSUI3.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import {
-  loadEnv
-} from "./chunk-HBU2GIMZ.js";
 import {
   getApprovalRegistry,
   resolveProvider
-} from "./chunk-DQIPV7L5.js";
+} from "./chunk-5YPXXSYY.js";
 import {
   scanAgents
-} from "./chunk-LNVMHQ2Z.js";
+} from "./chunk-EVZKNA2W.js";
+import {
+  loadEnv
+} from "./chunk-3QPVEJ7D.js";
 
 // src/server/agent/run-terminal-agent.ts
 import {
@@ -145,7 +145,7 @@ async function agentCommand(name, message, deps = {}) {
     );
   }
   const projectRoot = deps.projectRoot ?? process.cwd();
-  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-FIWNKOJO.js")).loadConfig(projectRoot)).agentsDir;
+  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-4ATXQUN3.js")).loadConfig(projectRoot)).agentsDir;
   const agents = scanAgents(projectRoot, agentsDir);
   const agent = agents.find((a) => a.name === name);
   if (!agent) {
@@ -178,8 +178,8 @@ async function agentCommand(name, message, deps = {}) {
 async function createAgentSsrLoader(projectRoot) {
   const { createServer } = await import("vite");
   const react = (await import("@vitejs/plugin-react")).default;
-  const { theoPluginAsync } = await import("./vite-plugin-RJFKLF2U.js");
-  const { loadConfig } = await import("./load-config-FIWNKOJO.js");
+  const { theoPluginAsync } = await import("./vite-plugin-USXUIV3H.js");
+  const { loadConfig } = await import("./load-config-4ATXQUN3.js");
   const config = await loadConfig(projectRoot);
   const theoPlugins = await theoPluginAsync({
     root: projectRoot,
@@ -212,4 +212,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=chunk-DS5MCU2X.js.map
+//# sourceMappingURL=chunk-URCXSUI3.js.map

package/dist/chunk-VI7ZANB3.js

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/config/schemas/rate-limit.ts
+import { z } from "zod";
+var baseRateLimitSchema = z.object({
+  windowMs: z.number().min(1),
+  max: z.number().int().min(1)
+});
+var rateLimitSchema = z.union([
+  baseRateLimitSchema,
+  z.object({
+    default: baseRateLimitSchema.optional(),
+    routes: z.record(z.string(), baseRateLimitSchema).optional(),
+    keyBy: z.union([
+      z.enum(["ip", "session", "user"]),
+      z.function({ input: z.tuple([z.unknown()]), output: z.string() })
+    ]).optional(),
+    cookieName: z.string().min(1).optional(),
+    /**
+     * How many reverse proxies sit in front of the app, for `keyBy: 'ip'`. `false` (default)
+     * trusts none; `true` means one; a number names a longer chain.
+     *
+     * Required for correct limiting behind Caddy/nginx/a load balancer — without it every visitor
+     * keys on the proxy address and shares a single bucket. Off by default because
+     * `x-forwarded-for` is client-writable.
+     */
+    trustProxy: z.union([z.boolean(), z.number().int().min(0)]).optional()
+  })
+]);
+
+// src/config/schemas/upload.ts
+import { z as z2 } from "zod";
+var uploadSchema = z2.object({
+  maxFileSize: z2.number().min(1).default(10 * 1024 * 1024),
+  // 10MB
+  maxFiles: z2.number().int().min(1).default(10),
+  maxFieldSize: z2.number().min(1).default(1 * 1024 * 1024)
+  // 1MB
+});
+
+// src/config/schemas/logging.ts
+import { z as z3 } from "zod";
+var loggingSchema = z3.object({
+  level: z3.enum(["debug", "info", "warn", "error", "silent"]).default("info")
+});
+
+// src/config/schemas/cache.ts
+import { z as z4 } from "zod";
+var routeRuleSchema = z4.object({
+  maxAge: z4.number().nonnegative().optional(),
+  swr: z4.number().nonnegative().optional(),
+  tags: z4.array(z4.string()).optional()
+});
+var cacheSchema = z4.object({
+  enabled: z4.boolean().default(true),
+  /** 'memory' uses InMemoryCacheAdapter; otherwise pass a custom adapter instance. */
+  storage: z4.union([z4.literal("memory"), z4.custom()]).default("memory"),
+  maxEntries: z4.number().int().positive().default(1e3),
+  defaults: z4.object({
+    maxAge: z4.number().nonnegative().default(1),
+    swr: z4.number().nonnegative().optional(),
+    cacheErrors: z4.boolean().default(false)
+  }).default({ maxAge: 1, cacheErrors: false }),
+  keyDerivation: z4.object({
+    excludeQuery: z4.array(z4.string()).optional(),
+    sortQuery: z4.boolean().default(true),
+    lowercaseHost: z4.boolean().default(true)
+  }).default({ sortQuery: true, lowercaseHost: true }),
+  routeRules: z4.record(z4.string(), routeRuleSchema).optional()
+});
+
+// src/config/schemas/observability.ts
+import { z as z5 } from "zod";
+var observabilitySchema = z5.object({
+  /** Set `false` to opt out even when the environment would enable an exporter. */
+  enabled: z5.boolean().default(true),
+  /**
+   * An `ObservabilityAdapter` instance. Validated structurally rather than by
+   * shape, for the same reason `storage` and `plugins` are: the config layer
+   * cannot import the adapter contract without inverting the module graph, and
+   * the adapter is a live object rather than data.
+   */
+  provider: z5.custom().optional()
+});
+
+// src/config/schemas/security.ts
+import { z as z7 } from "zod";
+
+// src/config/schemas/header-safe.ts
+import { z as z6 } from "zod";
+var headerSafeString = z6.string().refine((s) => !/[\r\n]/.test(s), { message: "Header value must not contain CR/LF" });
+
+// src/config/schemas/security.ts
+var securityHeadersSchema = z7.object({
+  csp: z7.union([headerSafeString, z7.literal(false)]).optional(),
+  // T6.1 — default flipped from 'report-only' to 'enforce' for 0.3.0.
+  // Users who want the old behaviour set `cspMode: 'report-only'`
+  // explicitly.
+  cspMode: z7.enum(["enforce", "report-only", "off"]).default("enforce"),
+  hsts: z7.union([headerSafeString, z7.literal(false)]).optional(),
+  frameOptions: z7.enum(["DENY", "SAMEORIGIN"]).default("DENY"),
+  contentTypeOptions: z7.literal("nosniff").default("nosniff"),
+  referrerPolicy: headerSafeString.default("strict-origin-when-cross-origin"),
+  /**
+   * T1.1 — Permissions-Policy directive string. EC-3-refined: rejects CR/LF.
+   * Pass `false` to suppress the header.
+   */
+  permissionsPolicy: z7.union([headerSafeString, z7.literal(false)]).optional()
+});
+var disallowedConfigSchema = z7.object({
+  routes: z7.array(z7.union([z7.string(), z7.instanceof(RegExp)])),
+  behavior: z7.enum(["warn", "raise"]).default("raise")
+});
+var corsSchema = z7.object({
+  origins: z7.union([
+    z7.literal("*"),
+    headerSafeString,
+    z7.instanceof(RegExp),
+    z7.array(z7.union([headerSafeString, z7.instanceof(RegExp)])),
+    z7.function({ input: z7.tuple([z7.string()]), output: z7.boolean() })
+  ]),
+  methods: z7.array(z7.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"])).optional(),
+  allowedHeaders: z7.array(headerSafeString).optional(),
+  exposedHeaders: z7.array(headerSafeString).optional(),
+  credentials: z7.boolean().default(false),
+  maxAge: z7.number().int().min(0).max(86400).default(600)
+}).refine((c) => !(c.origins === "*" && c.credentials), {
+  message: 'CORS spec forbids origins:"*" with credentials:true \u2014 browsers ignore the wildcard'
+});
+var securitySchema = z7.object({
+  // T6.1 — default flipped from 'warn' to 'strict' for 0.3.0. Apps that
+  // grep their warn-mode logs from 0.2.x already know which endpoints
+  // break; opt back into 'warn' globally OR use disallowedRoutes for
+  // surgical migration.
+  csrf: z7.enum(["off", "warn", "strict"]).default("strict"),
+  headers: securityHeadersSchema.optional(),
+  /** T5.1 — per-route escalation (Rails disallowed_warnings pattern). */
+  disallowed: disallowedConfigSchema.optional(),
+  /** T1.2 — Cross-Origin Resource Sharing. Single global config; runs first in pipeline. */
+  cors: corsSchema.optional()
+});
+
+// src/config/schemas/storage.ts
+import { z as z8 } from "zod";
+var tlsConfigSchema = z8.object({
+  rejectUnauthorized: z8.boolean().optional(),
+  caCert: z8.string().optional(),
+  clientCert: z8.string().optional(),
+  clientKey: z8.string().optional()
+});
+var serverConfigSchema = z8.object({
+  host: z8.string().min(1),
+  port: z8.number().int().positive().max(65535).optional(),
+  user: z8.string().min(1),
+  /** Password may be the empty string (some providers permit it). */
+  password: z8.string(),
+  tls: tlsConfigSchema.optional()
+});
+var postgresPoolConfigSchema = z8.object({
+  min: z8.number().int().nonnegative().optional(),
+  max: z8.number().int().positive().optional(),
+  connectionTimeoutMillis: z8.number().int().positive().optional(),
+  idleTimeoutMillis: z8.number().int().nonnegative().optional()
+});
+var postgresDatabaseConfigSchema = z8.object({
+  /** References a key in `storage.servers`. Resolved at `usePostgres()` call time. */
+  server: z8.string().min(1),
+  database: z8.string().min(1),
+  pool: postgresPoolConfigSchema.optional()
+});
+var redisServerConfigSchema = serverConfigSchema.extend({
+  db: z8.number().int().nonnegative().optional(),
+  maxRetriesPerRequest: z8.number().int().nonnegative().optional()
+});
+var storageSchema = z8.object({
+  servers: z8.record(z8.string(), serverConfigSchema).optional(),
+  databases: z8.record(z8.string(), postgresDatabaseConfigSchema).optional(),
+  redis: z8.record(z8.string(), redisServerConfigSchema).optional()
+});
+
+export {
+  rateLimitSchema,
+  uploadSchema,
+  loggingSchema,
+  cacheSchema,
+  observabilitySchema,
+  securityHeadersSchema,
+  corsSchema,
+  securitySchema,
+  storageSchema
+};
+//# sourceMappingURL=chunk-VI7ZANB3.js.map