theokit 0.5.4 → 0.6.1

package/dist/chunk-SJIRP73B.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/auth/auth.ts","../src/server/auth/crypto.ts","../src/server/auth/session.ts","../src/server/_internal/encoding.ts","../src/server/auth/auth-totp.ts","../src/server/auth/auth-backup-codes.ts","../src/server/auth/auth-throttle.ts","../src/server/auth/oauth-pkce.ts","../src/server/auth/oauth-state.ts","../src/server/auth/oidc-discovery.ts"],"sourcesContent":["export class AuthRequiredError extends Error {\n  code = 'AUTH_REQUIRED' as const\n  status = 401\n\n  constructor(message = 'Authentication required') {\n    super(message)\n    this.name = 'AuthRequiredError'\n  }\n}\n\nexport function requireAuth<T>(session: T | null | undefined): asserts session is T {\n  if (session === null || session === undefined) {\n    throw new AuthRequiredError()\n  }\n}\n","// AES-GCM-256 token encryption with cached key derivation.\n//\n// CR-002 fixes:\n//   - KDF: HKDF (RFC 5869) over the raw secret, not raw SHA-256.\n//     HKDF binds the application context (\"theo-session-v1\") into the\n//     derived key so the same secret used elsewhere cannot decrypt these\n//     tokens. SHA-256 of the raw secret has neither domain separation nor\n//     proper key-stretching guarantees.\n//   - Cache: derived `CryptoKey` is memoized per (secret, info) tuple.\n//     Pre-fix, every encrypt/decrypt re-ran SHA-256 + importKey, which (a)\n//     burned CPU on every authenticated request and (b) made\n//     `decryptWithFallback` leak rotation-array position via timing.\n//   - Buffer typing: `Uint8Array` flows directly into Web Crypto\n//     (`BufferSource`-compatible). The previous `as unknown as ArrayBuffer`\n//     double-cast (CR-016) is removed.\n\nconst encoder = new TextEncoder()\nconst decoder = new TextDecoder()\n\nconst HKDF_INFO_DEFAULT = encoder.encode('theo-session-v1')\nconst HKDF_SALT_EMPTY = new Uint8Array(0)\n\n// Memoize derived keys. Bounded by the number of distinct secrets the app\n// ever uses (typically 1 in steady state, 2-5 during rotation). Map-based\n// so distinct secrets do not evict each other.\nconst keyCache = new Map<string, Promise<CryptoKey>>()\n\nasync function deriveKey(secret: string): Promise<CryptoKey> {\n  const cached = keyCache.get(secret)\n  if (cached) return cached\n\n  const derive = (async () => {\n    const keyMaterial = await crypto.subtle.importKey(\n      'raw',\n      encoder.encode(secret),\n      { name: 'HKDF' },\n      false,\n      ['deriveKey'],\n    )\n    return crypto.subtle.deriveKey(\n      { name: 'HKDF', hash: 'SHA-256', salt: HKDF_SALT_EMPTY, info: HKDF_INFO_DEFAULT },\n      keyMaterial,\n      { name: 'AES-GCM', length: 256 },\n      false,\n      ['encrypt', 'decrypt'],\n    )\n  })()\n\n  keyCache.set(secret, derive)\n  // If derivation fails (invalid secret), evict so a retry can try fresh.\n  derive.catch(() => {\n    keyCache.delete(secret)\n  })\n  return derive\n}\n\nfunction toBase64Url(data: Uint8Array): string {\n  return Buffer.from(data).toString('base64url')\n}\n\n/**\n * Decode a base64url string into a `Uint8Array<ArrayBuffer>`. The explicit\n * generic matters: Web Crypto APIs expect `BufferSource`, and TS 5.7+\n * tightened `Uint8Array` to `Uint8Array<ArrayBufferLike>` which includes\n * `SharedArrayBuffer`. Returning the narrower generic lets the value pass\n * `crypto.subtle.decrypt` without `as` casts (CR-016 follow-through).\n */\nfunction fromBase64Url(str: string): Uint8Array<ArrayBuffer> {\n  const buf = Buffer.from(str, 'base64url')\n  const copy = new Uint8Array(buf.length)\n  copy.set(buf)\n  return copy\n}\n\n// The `T` generic exists so call sites get type-safe round-tripping\n// (`encrypt<Session>(s, ...)` pairs with `decrypt<Session>(...)`); the\n// runtime body just stringifies `data`, hence T does not appear in the\n// signature beyond the argument.\n// eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters -- T documents the round-trip contract with decrypt<T>\nexport async function encrypt<T>(data: T, secret: string): Promise<string> {\n  const key = await deriveKey(secret)\n  const iv = crypto.getRandomValues(new Uint8Array(12))\n  const plaintext = encoder.encode(JSON.stringify(data))\n  const ciphertext = new Uint8Array(\n    await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext),\n  )\n  return `${toBase64Url(iv)}:${toBase64Url(ciphertext)}`\n}\n\nexport async function decrypt<T>(token: string, secret: string): Promise<T | null> {\n  try {\n    const parts = token.split(':')\n    if (parts.length !== 2) return null\n\n    const iv = fromBase64Url(parts[0])\n    const ciphertext = fromBase64Url(parts[1])\n    const key = await deriveKey(secret)\n\n    const plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext)\n    return JSON.parse(decoder.decode(plaintext)) as T\n  } catch {\n    return null\n  }\n}\n\n/**\n * Reset the derived-key cache. Test helper — never call from production code.\n * Used by Vitest to guarantee isolation between tests that use distinct\n * secrets and want to confirm the derivation path runs.\n */\nexport function _resetKeyCacheForTests(): void {\n  keyCache.clear()\n}\n","import type { IncomingMessage, ServerResponse } from 'node:http'\n\nimport {\n  getCookie,\n  setCookie,\n  deleteCookie,\n  getCookieFromRequest,\n  appendCookieToHeaders,\n  appendDeleteCookieToHeaders,\n} from '../http/cookies.js'\n\nimport { encrypt, decrypt } from './crypto.js'\n\nexport interface SessionConfig {\n  /**\n   * Session secret. Either a single string (legacy) or an array of strings\n   * where index 0 is the newest. The array form enables dual-key rotation\n   * (T3.1 / ADR D5): encrypt always uses `secrets[0]`, decrypt walks the\n   * array, transparent re-encrypt on legacy hits (T3.2).\n   *\n   * EC-1: array length capped at 5 — enforced via throw at construction.\n   */\n  secret: string | string[]\n  cookieName?: string\n  maxAge?: number\n}\n\ninterface SessionEnvelope<T> {\n  data: T\n  exp: number\n}\n\nexport interface SessionMeta {\n  /** Index of the secret that decrypted the session. 0 = newest; > 0 = legacy. */\n  secretIndex: number\n  /** True when the decrypt used a legacy secret and the cookie should be re-encrypted. */\n  needsReencrypt: boolean\n}\n\nexport interface SessionManager<TSession> {\n  getSession(req: IncomingMessage): Promise<TSession | null>\n  /**\n   * T3.2 — Variant of `getSession` that surfaces decrypt metadata.\n   * Used by `api-middleware.ts` to wire transparent re-encrypt BEFORE\n   * the handler runs (so streaming SSR routes don't miss the Set-Cookie\n   * window — EC-4).\n   */\n  getSessionWithMeta(req: IncomingMessage): Promise<{ data: TSession | null; meta: SessionMeta }>\n  createSession(res: ServerResponse, data: TSession): Promise<void>\n  destroySession(res: ServerResponse): void\n  /**\n   * T3.3 — OWASP A07:2021 session fixation mitigation. Re-encrypts the\n   * current session with a fresh IV and refreshed expiry. No-op when no\n   * session is present.\n   */\n  rotateSession(req: IncomingMessage, res: ServerResponse): Promise<TSession | null>\n}\n\n/**\n * EC-1 — array length cap. Enforced via throw at construction. Silent\n * truncation would create false sense of rotation; silent acceptance\n * would create unbounded CPU on legacy decrypt walks.\n */\nconst MAX_SECRETS = 5\n\n/**\n * Validate + normalize the secret config into a non-empty array of\n * strings ≥ 32 chars each.\n */\nfunction normalizeSecrets(input: string | string[]): string[] {\n  const arr = Array.isArray(input) ? input.slice() : [input]\n  if (arr.length === 0) {\n    throw new Error('Session secret must be non-empty (received an empty array)')\n  }\n  if (arr.length > MAX_SECRETS) {\n    throw new Error(\n      `Session secret array exceeds maximum of ${MAX_SECRETS} entries — drop the oldest before adding a new one (received ${arr.length})`,\n    )\n  }\n  const wasArray = Array.isArray(input)\n  for (let i = 0; i < arr.length; i++) {\n    const s = arr[i]\n    if (typeof s !== 'string' || s.length < 32) {\n      const where = wasArray ? ` at index ${i}` : ''\n      throw new Error(`Session secret${where} must be at least 32 characters for secure encryption`)\n    }\n  }\n  return arr\n}\n\n/**\n * T5a.2 Phase D slice 3/3 — module-level pure helpers extracted so\n * `createSessionManager` (IncomingMessage path) and\n * `createSessionManagerWeb` (Web path) share the same encryption +\n * dual-key rotation logic without code duplication (sonarjs\n * no-identical-functions). Both wrappers pass `secrets` + `maxAge`\n * captured from their respective factory scope.\n */\nasync function encryptSessionEnvelope(\n  data: unknown,\n  secrets: string[],\n  maxAge: number,\n): Promise<string> {\n  const envelope: SessionEnvelope<unknown> = {\n    data,\n    exp: Date.now() + maxAge * 1000,\n  }\n  return encrypt(envelope, secrets[0]) // newest\n}\n\n/**\n * CR-002 constant-time: try EVERY rotation entry in parallel, then pick\n * the newest match. Sequential early-exit leaked rotation position via\n * timing (success on entry 0 returned in ~3 ms; success on entry 4 in\n * ~15 ms). Running in parallel binds wall-clock to the slowest single\n * attempt, independent of which entry actually matched. With derived-key\n * cache (CR-002 in crypto.ts), the CPU multiplier per request is ~0\n * after the first request per secret.\n */\nasync function decryptSessionWithFallback<TSession>(\n  raw: string,\n  secrets: string[],\n): Promise<{ envelope: SessionEnvelope<TSession>; index: number } | null> {\n  const results = await Promise.all(\n    secrets.map(async (secret, i) => {\n      const env = await decrypt<SessionEnvelope<TSession>>(raw, secret)\n      return env ? { envelope: env, index: i } : null\n    }),\n  )\n  for (const result of results) {\n    if (result) return result\n  }\n  return null\n}\n\nexport function createSessionManager<TSession>(config: SessionConfig): SessionManager<TSession> {\n  const secrets = normalizeSecrets(config.secret)\n  const cookieName = config.cookieName ?? 'theo_session'\n  const maxAge = config.maxAge ?? 604800 // 7 days\n\n  function writeCookie(res: ServerResponse, token: string): void {\n    setCookie(res, cookieName, token, {\n      httpOnly: true,\n      sameSite: 'lax',\n      maxAge,\n      path: '/',\n    })\n  }\n\n  return {\n    async getSession(req) {\n      const { data } = await this.getSessionWithMeta(req)\n      return data\n    },\n\n    async getSessionWithMeta(req) {\n      const raw = getCookie(req, cookieName)\n      if (!raw) return { data: null, meta: { secretIndex: -1, needsReencrypt: false } }\n      const decoded = await decryptSessionWithFallback<TSession>(raw, secrets)\n      if (!decoded) return { data: null, meta: { secretIndex: -1, needsReencrypt: false } }\n      if (decoded.envelope.exp < Date.now()) {\n        return { data: null, meta: { secretIndex: decoded.index, needsReencrypt: false } }\n      }\n      return {\n        data: decoded.envelope.data,\n        meta: { secretIndex: decoded.index, needsReencrypt: decoded.index > 0 },\n      }\n    },\n\n    async createSession(res, data) {\n      const token = await encryptSessionEnvelope(data, secrets, maxAge)\n      writeCookie(res, token)\n    },\n\n    destroySession(res) {\n      deleteCookie(res, cookieName)\n    },\n\n    async rotateSession(req, res) {\n      const { data } = await this.getSessionWithMeta(req)\n      if (data === null) return null\n      // Fresh IV per encrypt call (Web Crypto guarantee — see crypto.ts)\n      // + refreshed expiry. Last write wins for the cookie value.\n      const token = await encryptSessionEnvelope(data, secrets, maxAge)\n      writeCookie(res, token)\n      return data\n    },\n  }\n}\n\n/**\n * T5a.2 Phase D slice 3/3 — Web-Standards session manager.\n *\n * Mirror of `SessionManager<TSession>` for the Web `Request` + `Headers`\n * shape. Same `SessionConfig`, same encryption (`encrypt`/`decrypt` from\n * `./crypto.js`), same dual-key rotation logic (CR-002 constant-time\n * decrypt fallback walk + transparent re-encrypt), same OWASP A07\n * `rotateSession` invariant.\n *\n * **Signature differences vs `SessionManager`:**\n *   - Read methods take `Request` (instead of `IncomingMessage`).\n *   - Write methods take a `Headers` instance to mutate (instead of\n *     `ServerResponse`) — caller passes the headers they're building\n *     for their `Response` constructor.\n *\n * Uses `getCookieFromRequest` / `appendCookieToHeaders` /\n * `appendDeleteCookieToHeaders` from Phase B slice 6/6.\n */\nexport interface SessionManagerWeb<TSession> {\n  getSession(request: Request): Promise<TSession | null>\n  getSessionWithMeta(request: Request): Promise<{ data: TSession | null; meta: SessionMeta }>\n  createSession(target: Headers, data: TSession): Promise<void>\n  destroySession(target: Headers): void\n  rotateSession(request: Request, target: Headers): Promise<TSession | null>\n}\n\nexport function createSessionManagerWeb<TSession>(\n  config: SessionConfig,\n): SessionManagerWeb<TSession> {\n  const secrets = normalizeSecrets(config.secret)\n  const cookieName = config.cookieName ?? 'theo_session'\n  const maxAge = config.maxAge ?? 604800 // 7 days\n\n  function writeCookieWeb(target: Headers, token: string): void {\n    appendCookieToHeaders(target, cookieName, token, {\n      httpOnly: true,\n      sameSite: 'lax',\n      maxAge,\n      path: '/',\n    })\n  }\n\n  return {\n    async getSession(request) {\n      const { data } = await this.getSessionWithMeta(request)\n      return data\n    },\n\n    async getSessionWithMeta(request) {\n      const raw = getCookieFromRequest(request, cookieName)\n      if (raw === undefined) return { data: null, meta: { secretIndex: -1, needsReencrypt: false } }\n      const decoded = await decryptSessionWithFallback<TSession>(raw, secrets)\n      if (!decoded) return { data: null, meta: { secretIndex: -1, needsReencrypt: false } }\n      if (decoded.envelope.exp < Date.now()) {\n        return { data: null, meta: { secretIndex: decoded.index, needsReencrypt: false } }\n      }\n      return {\n        data: decoded.envelope.data,\n        meta: { secretIndex: decoded.index, needsReencrypt: decoded.index > 0 },\n      }\n    },\n\n    async createSession(target, data) {\n      const token = await encryptSessionEnvelope(data, secrets, maxAge)\n      writeCookieWeb(target, token)\n    },\n\n    destroySession(target) {\n      appendDeleteCookieToHeaders(target, cookieName)\n    },\n\n    async rotateSession(request, target) {\n      const { data } = await this.getSessionWithMeta(request)\n      if (data === null) return null\n      const token = await encryptSessionEnvelope(data, secrets, maxAge)\n      writeCookieWeb(target, token)\n      return data\n    },\n  }\n}\n\n/**\n * T5a.2 Phase D slice 3/3 — Web-Standards transparent re-encrypt helper.\n *\n * Mirror of `rotateIfNeeded(sm, req, res)` for the Web Request + Headers\n * shape. Reads session via `getSessionWithMeta`; if the cookie was\n * decrypted with a legacy secret (index > 0), re-issues the cookie with\n * the newest secret via `createSession(target, data)`.\n *\n * **EC-4 honest framing:** unlike the IncomingMessage path where the\n * timing constraint is \"before `res.writeHead` fires\", the Web Request\n * path's constraint is \"before the `Response` object is constructed and\n * returned to the runtime\". Caller MUST invoke `rotateIfNeededWeb`\n * BEFORE building the final `Response(body, { headers: target })` so the\n * re-encrypted Set-Cookie lands on the wire.\n */\nexport async function rotateIfNeededWeb<TSession>(\n  sm: SessionManagerWeb<TSession>,\n  request: Request,\n  target: Headers,\n): Promise<TSession | null> {\n  const { data, meta } = await sm.getSessionWithMeta(request)\n  if (data !== null && meta.needsReencrypt) {\n    await sm.createSession(target, data)\n  }\n  return data\n}\n\n/**\n * T3.2 — Transparent re-encrypt helper (EC-4 timing-safe wrapper).\n *\n * Call this in your `createContext` (before any rendering / streaming\n * starts). It:\n *   1. Reads the session via `getSessionWithMeta`.\n *   2. If the cookie was decrypted with a legacy secret (index > 0), it\n *      immediately re-issues the cookie with `secrets[0]` so the next\n *      request lands on the newest key.\n *   3. Returns the session data (or null) for use downstream.\n *\n * EC-4: this MUST run before `renderToPipeableStream` / `res.writeHead`\n * fires. Calling it inside an SSR component or handler body that has\n * already streamed bytes makes the re-encrypt a silent no-op (Set-Cookie\n * is locked once headers commit), trapping users on the legacy secret\n * forever once it's removed from the array.\n */\nexport async function rotateIfNeeded<TSession>(\n  sm: SessionManager<TSession>,\n  req: IncomingMessage,\n  res: ServerResponse,\n): Promise<TSession | null> {\n  const { data, meta } = await sm.getSessionWithMeta(req)\n  if (data !== null && meta.needsReencrypt) {\n    await sm.createSession(res, data)\n  }\n  return data\n}\n\n/**\n * EC-2 — Production secret guard. Refuses to boot when `NODE_ENV === 'production'`\n * AND the secret is too short (< 32 chars) OR matches a known placeholder.\n *\n * Accepts a single secret OR an array. In array form, each entry is validated\n * independently — a single bad entry refuses boot with an index-qualified message.\n */\nconst PLACEHOLDER_PATTERN = /CHANGE_ME|demo[-_]|placeholder/i\n\nexport function assertProductionSecret(secret: string | string[]): void {\n  const arr = Array.isArray(secret) ? secret : [secret]\n  const isProd = process.env.NODE_ENV === 'production'\n\n  for (let i = 0; i < arr.length; i++) {\n    const s = arr[i]\n    const isPlaceholder = PLACEHOLDER_PATTERN.test(s)\n    const isTooShort = s.length < 32\n    const prefix = arr.length > 1 ? `Session secret at index ${i}` : 'Session secret'\n\n    if (isProd) {\n      if (isTooShort) {\n        throw new Error(\n          `${prefix} too short for production (${s.length} chars; minimum 32). ` +\n            `Set a 32+ random char secret in your env (e.g., \\`openssl rand -hex 32\\`).`,\n        )\n      }\n      if (isPlaceholder) {\n        throw new Error(\n          `${prefix} looks like a placeholder (\"${s.slice(0, 16)}…\") and NODE_ENV is \"production\". ` +\n            `Replace it with a 32+ random char secret (e.g., \\`openssl rand -hex 32\\`) before deploying.`,\n        )\n      }\n      continue\n    }\n    if (isPlaceholder || isTooShort) {\n      console.warn(\n        `[theokit] WARNING: ${prefix.toLowerCase()} is a placeholder or too short. ` +\n          `This is OK for dev, but the production server will REFUSE to boot until you replace it.`,\n      )\n    }\n  }\n}\n","/**\n * Shared encoding utilities for crypto-adjacent code.\n *\n * CR-020 DRY: `base64urlEncode` was duplicated across `oauth-pkce.ts` and\n * `oauth-state.ts`. Duplication in cryptographic helpers is a bug class —\n * a future RFC-driven tweak (e.g., padding semantics) would diverge across\n * files. Centralizing the single canonical implementation eliminates that\n * vector.\n *\n * Module is intentionally under `_internal/` so it is **not** part of the\n * public API surface. Consumers outside `packages/theo/src/server` must\n * not import from here.\n */\n\n/**\n * RFC 4648 §5 — base64url-encode bytes without padding. Used wherever an\n * RFC requires URL-safe base64 (PKCE per RFC 7636 §4.1, JWT per RFC 7515,\n * etc.). Pure function — does not mutate `bytes`.\n */\nexport function base64urlEncode(bytes: Uint8Array): string {\n  let s = ''\n  for (const b of bytes) s += String.fromCharCode(b)\n  // The `=+$` trailing-padding regex is bounded (at most 2 chars for\n  // base64). sonarjs flags the `+` quantifier conservatively, but the\n  // input is the output of `btoa()` — a string with at most 2 trailing\n  // `=` characters by spec.\n  // eslint-disable-next-line sonarjs/slow-regex -- bounded trailing-padding pattern (max 2 chars)\n  return btoa(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\n/**\n * Constant-time string equality.\n *\n * CR-012: prior implementations early-exited on length mismatch\n * (`if (a.length !== b.length) return false`). That early exit leaks\n * the comparison-target length via wall-clock timing — observable when\n * the secret length is itself sensitive (length-based bucket assignment,\n * variable-length nonces). This implementation always iterates\n * `max(a.length, b.length)` characters, OR-folding mismatches into a\n * single accumulator that is checked once at the end.\n *\n * Returns `false` for empty inputs as a defensive default — never accept\n * \"both empty\" as a match.\n */\nexport function constantTimeEquals(a: string, b: string): boolean {\n  if (typeof a !== 'string' || typeof b !== 'string') return false\n  if (a.length === 0 || b.length === 0) return false\n\n  const maxLen = Math.max(a.length, b.length)\n  let diff = a.length ^ b.length\n  for (let i = 0; i < maxLen; i++) {\n    // charCodeAt returns NaN for out-of-range indices; (NaN ^ x) is x, so we\n    // explicitly substitute 0 to keep the OR-fold meaningful.\n    const ca = i < a.length ? a.charCodeAt(i) : 0\n    const cb = i < b.length ? b.charCodeAt(i) : 0\n    diff |= ca ^ cb\n  }\n  return diff === 0\n}\n","/**\n * T6.2 — RFC 6238 TOTP primitive.\n *\n * Reference: https://datatracker.ietf.org/doc/html/rfc6238\n * HMAC-based one-time password (HOTP) base: https://datatracker.ietf.org/doc/html/rfc4226\n *\n * Pure-function, dependency-free implementation via Web Crypto. Secrets\n * may be passed as Uint8Array (preferred) or base32 string.\n *\n * SECURITY NOTES (documented per EC-13):\n *   - TOTP secrets are equivalent to passwords. Encrypt at rest using a\n *     separate KMS key from the session secret. If your DB leaks, ALL\n *     2FA codes are compromised — rotate by forcing all users to re-enroll.\n *   - Use `verifyTotp` constant-time (we use crypto.timingSafeEqual internally).\n */\n\n// CR-012 fix: use the shared constant-time helper that does not early-exit\n// on length mismatch (the previous local version did, leaking the digit\n// count via timing).\nimport { constantTimeEquals } from '../_internal/encoding.js'\n\n/** Supported HMAC algorithms per RFC 6238 §1.2. Default SHA-1. */\nexport type TotpAlgorithm = 'SHA-1' | 'SHA-256' | 'SHA-512'\n\nexport interface TotpOptions {\n  /** Shared secret — bytes (preferred) OR base32 string. */\n  secret: Uint8Array | string\n  /** Time step in seconds. Default 30 (RFC 6238 §5.2 recommended). */\n  step?: number\n  /** Code length: 6, 7, or 8 digits. Default 6. */\n  digits?: 6 | 7 | 8\n  /** HMAC algorithm. Default SHA-1 (RFC default). */\n  algorithm?: TotpAlgorithm\n  /** Time in ms since epoch. Default Date.now(). */\n  time?: number\n}\n\nexport interface VerifyTotpOptions extends TotpOptions {\n  /**\n   * Drift tolerance in number of steps on each side. Default 1\n   * (RFC 6238 §5.2 recommends ±1 step = 90s total window).\n   */\n  window?: number\n}\n\nconst DEFAULT_STEP = 30\nconst DEFAULT_DIGITS = 6\nconst DEFAULT_ALGORITHM: TotpAlgorithm = 'SHA-1'\n\n/** Decode base32 (RFC 4648, no padding) to bytes. Throws on invalid input. */\nfunction base32Decode(s: string): Uint8Array {\n  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'\n  // Trailing `=` is bounded by spec to 0..6 chars; `\\s+` collapses runs\n  // of whitespace. Input length is the user's TOTP secret (10..50 chars\n  // typical), so super-linear backtracking cannot escalate.\n  // eslint-disable-next-line sonarjs/slow-regex -- bounded inputs (TOTP secrets are short)\n  const clean = s.toUpperCase().replace(/=+$/, '').replace(/\\s+/g, '')\n  if (!/^[A-Z2-7]+$/.test(clean)) {\n    throw new Error('Invalid base32 secret')\n  }\n  const bits: number[] = []\n  for (const c of clean) {\n    const idx = alphabet.indexOf(c)\n    for (let i = 4; i >= 0; i--) bits.push((idx >> i) & 1)\n  }\n  // Trim trailing partial byte\n  const fullBytes = Math.floor(bits.length / 8)\n  const out = new Uint8Array(fullBytes)\n  for (let i = 0; i < fullBytes; i++) {\n    let v = 0\n    for (let j = 0; j < 8; j++) v = (v << 1) | bits[i * 8 + j]\n    out[i] = v\n  }\n  return out\n}\n\n/** Encode bytes to base32 (RFC 4648, no padding). */\nfunction base32Encode(bytes: Uint8Array): string {\n  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'\n  let out = ''\n  let buffer = 0\n  let bits = 0\n  for (const b of bytes) {\n    buffer = (buffer << 8) | b\n    bits += 8\n    while (bits >= 5) {\n      out += alphabet[(buffer >> (bits - 5)) & 0x1f]\n      bits -= 5\n    }\n  }\n  if (bits > 0) out += alphabet[(buffer << (5 - bits)) & 0x1f]\n  return out\n}\n\nfunction normalizeSecret(secret: Uint8Array | string): Uint8Array {\n  if (typeof secret === 'string') return base32Decode(secret)\n  return secret\n}\n\n/** Counter (8-byte big-endian) from time in ms / step in seconds. */\nfunction counterBytes(timeMs: number, stepSec: number): Uint8Array {\n  const counter = Math.floor(timeMs / 1000 / stepSec)\n  const out = new Uint8Array(8)\n  // Two 32-bit halves (Number can safely represent up to 2^53; OK until year 285,000+)\n  const hi = Math.floor(counter / 0x100000000)\n  const lo = counter >>> 0\n  out[0] = (hi >>> 24) & 0xff\n  out[1] = (hi >>> 16) & 0xff\n  out[2] = (hi >>> 8) & 0xff\n  out[3] = hi & 0xff\n  out[4] = (lo >>> 24) & 0xff\n  out[5] = (lo >>> 16) & 0xff\n  out[6] = (lo >>> 8) & 0xff\n  out[7] = lo & 0xff\n  return out\n}\n\nasync function hmac(\n  secret: Uint8Array,\n  message: Uint8Array,\n  algorithm: TotpAlgorithm,\n): Promise<Uint8Array> {\n  const key = await crypto.subtle.importKey(\n    'raw',\n    secret as BufferSource,\n    { name: 'HMAC', hash: algorithm },\n    false,\n    ['sign'],\n  )\n  const sig = await crypto.subtle.sign('HMAC', key, message as BufferSource)\n  return new Uint8Array(sig)\n}\n\n/** RFC 4226 §5.3 dynamic truncation. */\nfunction truncate(mac: Uint8Array, digits: number): string {\n  const offset = mac[mac.length - 1] & 0x0f\n  const code =\n    ((mac[offset] & 0x7f) << 24) |\n    ((mac[offset + 1] & 0xff) << 16) |\n    ((mac[offset + 2] & 0xff) << 8) |\n    (mac[offset + 3] & 0xff)\n  const mod = 10 ** digits\n  return String(code % mod).padStart(digits, '0')\n}\n\n/** Generate a TOTP code for a given time. */\nexport async function generateTotp(opts: TotpOptions): Promise<string> {\n  const secret = normalizeSecret(opts.secret)\n  const step = opts.step ?? DEFAULT_STEP\n  const digits = opts.digits ?? DEFAULT_DIGITS\n  const algorithm = opts.algorithm ?? DEFAULT_ALGORITHM\n  const time = opts.time ?? Date.now()\n  const mac = await hmac(secret, counterBytes(time, step), algorithm)\n  return truncate(mac, digits)\n}\n\n/**\n * Verify a TOTP code against the current window ± `window` steps.\n *\n * Returns `false` for malformed tokens (non-digit, wrong length) without\n * throwing — defensive against accidental user-input passthrough.\n */\nexport async function verifyTotp(token: string, opts: VerifyTotpOptions): Promise<boolean> {\n  if (typeof token !== 'string') return false\n  const digits = opts.digits ?? DEFAULT_DIGITS\n  if (!/^\\d+$/.test(token) || token.length !== digits) return false\n\n  const step = opts.step ?? DEFAULT_STEP\n  const algorithm = opts.algorithm ?? DEFAULT_ALGORITHM\n  const time = opts.time ?? Date.now()\n  const drift = opts.window ?? 1\n  const secret = normalizeSecret(opts.secret)\n\n  // Walk the whole drift range constant-time-ish (no early exit).\n  let matched = false\n  for (let delta = -drift; delta <= drift; delta++) {\n    const t = time + delta * step * 1000\n    const code = truncate(await hmac(secret, counterBytes(t, step), algorithm), digits)\n    if (constantTimeEquals(code, token)) matched = true\n  }\n  return matched\n}\n\n/** Generate a cryptographically random TOTP secret. Default 20 bytes (RFC minimum). */\nexport function generateTotpSecret(bytes = 20): Uint8Array {\n  if (bytes < 16) {\n    throw new Error('TOTP secret must be at least 16 bytes (RFC 6238 §3 minimum)')\n  }\n  const out = new Uint8Array(bytes)\n  crypto.getRandomValues(out)\n  return out\n}\n\n/**\n * Build an `otpauth://` URI for QR code enrollment. Format follows the\n * de facto Google Authenticator spec adopted by every major TOTP app.\n *   otpauth://totp/<issuer>:<account>?secret=<base32>&issuer=<issuer>&algorithm=<alg>&digits=<n>&period=<sec>\n */\nexport interface TotpUriOptions {\n  secret: Uint8Array\n  issuer: string\n  account: string\n  algorithm?: TotpAlgorithm\n  digits?: 6 | 7 | 8\n  step?: number\n}\n\nexport function totpUri(opts: TotpUriOptions): string {\n  const label = `${opts.issuer}:${opts.account}`\n  const params = new URLSearchParams({\n    secret: base32Encode(opts.secret),\n    issuer: opts.issuer,\n    algorithm: opts.algorithm ?? DEFAULT_ALGORITHM,\n    digits: String(opts.digits ?? DEFAULT_DIGITS),\n    period: String(opts.step ?? DEFAULT_STEP),\n  })\n  return `otpauth://totp/${encodeURIComponent(label)}?${params.toString()}`\n}\n","/**\n * T6.3 — Backup codes for 2FA recovery.\n *\n * generateBackupCodes returns N plaintexts (display once to user) + hashes\n * (store in DB). verifyBackupCode constant-time-walks all hashes and\n * returns the matchedHash so caller can delete the used code from storage\n * — replay protection lives at the caller (we can't see their database).\n *\n * SECURITY NOTES:\n *   - Codes have ~40 bits entropy (8 chars × 5 bits per char from a\n *     32-char alphabet excluding I/L/O/0/1). Single-use → argon2id\n *     overhead is unnecessary; SHA-256 of the normalized code suffices.\n *   - The caller MUST atomically delete the matched hash on successful\n *     verify. Without that, the code is replayable. We surface\n *     matchedHash explicitly so this step is conspicuous.\n *   - Pair this with throttleLoginAttempts (T6.1) on the verify endpoint\n *     to prevent online brute-force against the 40-bit space.\n */\n\nexport interface BackupCodeOptions {\n  /** How many codes to generate. Default 10. */\n  count?: number\n  /** Length in chars (excluding separator). Default 8. */\n  length?: number\n  /** Separator inserted at the midpoint. Default '-'; pass null to omit. */\n  separator?: '-' | null\n  /** Custom alphabet. Default excludes ambiguous chars (I, L, O, 0, 1). */\n  alphabet?: string\n}\n\nexport interface BackupCode {\n  plaintext: string\n  hash: string\n}\n\nconst DEFAULT_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789' // no I, O, 0, 1\nconst DEFAULT_COUNT = 10\nconst DEFAULT_LENGTH = 8\n\n/**\n * Generate cryptographically random backup codes + their SHA-256 hashes.\n *\n * Plaintext is uppercase alphanumeric (default alphabet excludes ambiguous\n * chars). Separator inserted at the midpoint (default `-`).\n */\nexport async function generateBackupCodes(opts: BackupCodeOptions = {}): Promise<BackupCode[]> {\n  const count = opts.count ?? DEFAULT_COUNT\n  const length = opts.length ?? DEFAULT_LENGTH\n  const separator = opts.separator === undefined ? '-' : opts.separator\n  const alphabet = opts.alphabet ?? DEFAULT_ALPHABET\n\n  // CR-022 fix: bound count and length explicitly. Pathological inputs\n  // (count=Infinity, length=0) would cause an infinite loop or wasteful\n  // resource usage. Bounds are generous (count ≤ 1000, length ∈ [4, 64])\n  // — well above any realistic 2FA backup-codes use case.\n  if (!Number.isInteger(count) || count <= 0 || count > 1000) {\n    throw new RangeError(\n      `generateBackupCodes: count must be an integer in [1, 1000] (got ${String(count)})`,\n    )\n  }\n  if (!Number.isInteger(length) || length < 4 || length > 64) {\n    throw new RangeError(\n      `generateBackupCodes: length must be an integer in [4, 64] (got ${String(length)})`,\n    )\n  }\n  if (alphabet.length < 8) {\n    throw new RangeError(\n      `generateBackupCodes: alphabet must contain at least 8 distinct chars (got ${alphabet.length})`,\n    )\n  }\n\n  const codes: BackupCode[] = []\n  const seen = new Set<string>()\n  while (codes.length < count) {\n    const raw = randomFromAlphabet(length, alphabet)\n    if (seen.has(raw)) continue\n    seen.add(raw)\n    const plaintext = formatWithSeparator(raw, separator)\n    const hash = await sha256Hex(normalizeCode(plaintext))\n    codes.push({ plaintext, hash })\n  }\n  return codes\n}\n\n/**\n * Verify a code against a list of stored hashes. Walks all hashes\n * constant-time (no early exit). Returns `valid:true` + matchedHash on\n * hit; `valid:false` otherwise.\n *\n * `matchedHash` is the EXACT string the caller stored, ready to be passed\n * to a `DELETE FROM backup_codes WHERE hash = ?` query.\n */\nexport async function verifyBackupCode(\n  code: string,\n  hashes: readonly string[],\n): Promise<{ valid: boolean; matchedHash?: string }> {\n  const candidate = await sha256Hex(normalizeCode(code))\n  let matchedHash: string | undefined\n  // Constant-time iteration over hashes: never short-circuit.\n  for (const h of hashes) {\n    if (constantTimeEquals(h, candidate)) {\n      matchedHash = h\n    }\n  }\n  return matchedHash ? { valid: true, matchedHash } : { valid: false }\n}\n\n/**\n * Normalize a code for hashing: uppercase + strip separator. This way\n * `abcd-efgh` and `ABCDEFGH` produce the same hash. Whitespace is also\n * stripped defensively.\n */\nfunction normalizeCode(input: string): string {\n  return input.toUpperCase().replace(/[-\\s]+/g, '')\n}\n\nfunction formatWithSeparator(raw: string, separator: '-' | null): string {\n  if (!separator || raw.length < 4) return raw\n  const mid = Math.floor(raw.length / 2)\n  return raw.slice(0, mid) + separator + raw.slice(mid)\n}\n\nfunction randomFromAlphabet(length: number, alphabet: string): string {\n  const random = new Uint8Array(length)\n  crypto.getRandomValues(random)\n  let out = ''\n  for (let i = 0; i < length; i++) {\n    out += alphabet[random[i] % alphabet.length]\n  }\n  return out\n}\n\nasync function sha256Hex(input: string): Promise<string> {\n  const bytes = new TextEncoder().encode(input)\n  const hash = await crypto.subtle.digest('SHA-256', bytes)\n  return Array.from(new Uint8Array(hash))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\nfunction constantTimeEquals(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return diff === 0\n}\n","import type { RateLimitStore } from '../rate-limit/rate-limit-store.js'\n\n/**\n * T6.1 — Login throttling primitive.\n *\n * Per-credential failure counter backed by any `RateLimitStore`. After\n * `maxAttempts` failures within `windowMs`, the identifier is locked\n * for `lockoutMs`. Successful login resets the counter.\n *\n * Usage in a login handler:\n *\n *   const state = await checkThrottle({ store, identifier: hash(email) })\n *   if (!state.allowed) return 429\n *   const valid = await verifyPassword(creds)\n *   await recordAttempt({ store, identifier: hash(email) }, valid)\n *   if (!valid) return 401\n *\n * SECURITY:\n *   - NEVER pass raw email/username as `identifier`. Hash or normalize\n *     first (e.g. SHA-256 of the lowercased email). This prevents PII\n *     from landing in the rate-limit store or audit logs.\n *   - Combine with the per-route IP rate limit (T2.2) for layered defense:\n *     IP-level limits stop scripted floods; credential-level limits stop\n *     distributed brute force.\n */\n\nexport interface ThrottleOptions {\n  store: RateLimitStore\n  /**\n   * Stable identifier per credential. Hash raw emails/usernames before\n   * passing in — never leak PII to the rate-limit key space.\n   */\n  identifier: string\n  /** Failures before lockout. Default 5. */\n  maxAttempts?: number\n  /** Sliding window for counting failures. Default 15 minutes. */\n  windowMs?: number\n  /** Lockout duration after maxAttempts hit. Default 1 hour. */\n  lockoutMs?: number\n}\n\nexport interface ThrottleState {\n  allowed: boolean\n  remainingAttempts: number\n  /** Set when `allowed === false`. Absolute timestamp when the lockout expires. */\n  lockedUntil?: Date\n}\n\nconst DEFAULT_MAX_ATTEMPTS = 5\nconst DEFAULT_LOCKOUT_MS = 60 * 60_000\n\n/**\n * Read the current throttle state for an identifier WITHOUT modifying\n * the counter. Call before validating credentials so locked attempts\n * are rejected fast.\n */\nexport async function checkThrottle(opts: ThrottleOptions): Promise<ThrottleState> {\n  const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS\n  const state = await opts.store.get(opts.identifier)\n  if (!state) {\n    return { allowed: true, remainingAttempts: maxAttempts }\n  }\n  if (state.count >= maxAttempts) {\n    return {\n      allowed: false,\n      remainingAttempts: 0,\n      // Lockout expires when the store TTL fires.\n      lockedUntil: new Date(state.resetAt),\n    }\n  }\n  return {\n    allowed: true,\n    remainingAttempts: Math.max(0, maxAttempts - state.count),\n  }\n}\n\n/**\n * Record an attempt outcome. On success → reset the counter. On failure\n * → increment within the sliding window. Returns the new throttle state.\n *\n * Storage model: the store entry's TTL is `lockoutMs` (which doubles as\n * the failure-accumulation window). When `lockoutMs` is short — common\n * in tests or for soft lockouts — the entry auto-expires and the next\n * attempt starts fresh.\n */\nexport async function recordAttempt(\n  opts: ThrottleOptions,\n  success: boolean,\n): Promise<ThrottleState> {\n  const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS\n  if (success) {\n    await opts.store.reset(opts.identifier)\n    return {\n      allowed: true,\n      remainingAttempts: maxAttempts,\n    }\n  }\n  const lockoutMs = opts.lockoutMs ?? DEFAULT_LOCKOUT_MS\n  const state = await opts.store.incr(opts.identifier, lockoutMs)\n\n  if (state.count >= maxAttempts) {\n    return {\n      allowed: false,\n      remainingAttempts: 0,\n      lockedUntil: new Date(state.resetAt),\n    }\n  }\n  return {\n    allowed: true,\n    remainingAttempts: Math.max(0, maxAttempts - state.count),\n  }\n}\n","/**\n * T7.3 — RFC 7636 PKCE primitive.\n *\n * Reference: https://datatracker.ietf.org/doc/html/rfc7636\n *\n * Pure-function, dependency-free implementation using Web Crypto.\n *\n * Usage in an OAuth authorization-code flow:\n *\n *   const { codeVerifier, codeChallenge, codeChallengeMethod } = await generatePkceChallenge()\n *   // Store codeVerifier in the user's session\n *   // Send codeChallenge + codeChallengeMethod in the /authorize redirect\n *   // ... user authenticates with provider ...\n *   // On /callback, send codeVerifier with the code → token exchange\n */\n\nexport interface PkceChallenge {\n  codeVerifier: string\n  codeChallenge: string\n  codeChallengeMethod: 'S256'\n}\n\n// CR-020 DRY: single canonical base64url encoder lives in _internal/encoding.\nimport { base64urlEncode } from '../_internal/encoding.js'\n\n/**\n * Compute the code_challenge from a code_verifier per RFC 7636 §4.2.\n * Exported separately to enable RFC 7636 Appendix B vector testing.\n */\nexport async function pkceChallengeFromVerifier(verifier: string): Promise<string> {\n  const bytes = new TextEncoder().encode(verifier)\n  const hash = await crypto.subtle.digest('SHA-256', bytes)\n  return base64urlEncode(new Uint8Array(hash))\n}\n\n/**\n * Generate a fresh PKCE challenge pair.\n *\n * Verifier: 32 cryptographically random bytes → 43-char base64url string.\n * RFC 7636 §4.1 allows 43–128 chars; we ship the minimum-safe default.\n *\n * Method: 'S256' only — no 'plain' fallback. RFC 7636 §7.2 strongly\n * discourages plain and modern providers reject it.\n */\nexport async function generatePkceChallenge(): Promise<PkceChallenge> {\n  const random = new Uint8Array(32)\n  crypto.getRandomValues(random)\n  const codeVerifier = base64urlEncode(random)\n  const codeChallenge = await pkceChallengeFromVerifier(codeVerifier)\n  return { codeVerifier, codeChallenge, codeChallengeMethod: 'S256' }\n}\n","/**\n * T7.4 — OAuth `state` parameter helpers (RFC 6749 §10.12).\n *\n * `state` is a cryptographically random anti-CSRF token. The client\n * stores it (in session/cookie/db) before redirecting to the\n * authorization endpoint and verifies it on the callback. Without it,\n * an attacker can authorize on the user's account using a captured code.\n */\n\n// CR-020 DRY + CR-012 constant-time: shared helpers in _internal/encoding.\nimport { base64urlEncode, constantTimeEquals } from '../_internal/encoding.js'\n\n/**\n * Generate a cryptographically random state token. Default 32 bytes\n * (~43 base64url chars). Increase for higher entropy if your provider\n * supports it.\n */\nexport function generateOAuthState(opts: { bytes?: number } = {}): string {\n  const len = opts.bytes ?? 32\n  const buf = new Uint8Array(len)\n  crypto.getRandomValues(buf)\n  return base64urlEncode(buf)\n}\n\n/**\n * Verify a state token. Constant-time compare. Empty inputs always fail\n * (defensive — never accept empty as \"they match\").\n *\n * CR-012 fix: `constantTimeEquals` does not early-exit on length mismatch,\n * so the comparison time is independent of how the input was forged.\n */\nexport function verifyOAuthState(provided: string, stored: string): boolean {\n  return constantTimeEquals(provided, stored)\n}\n","/**\n * T7.4 — OpenID Connect Discovery 1.0 metadata fetcher.\n *\n * Reference: https://openid.net/specs/openid-connect-discovery-1_0.html\n *\n * Caches metadata in module scope. Cache key is the exact issuer string\n * (trailing-slash sensitive per RFC 8414 §3). Failures are NOT cached —\n * subsequent calls retry the fetch.\n *\n * EC-7 — HTTPS enforced. RFC 8414 §3 requires HTTPS for OIDC issuers.\n * Localhost (loopback) is allowed for development.\n */\n\nexport interface OidcMetadata {\n  issuer: string\n  authorization_endpoint: string\n  token_endpoint: string\n  jwks_uri?: string\n  userinfo_endpoint?: string\n  end_session_endpoint?: string\n  scopes_supported?: string[]\n  response_types_supported?: string[]\n  grant_types_supported?: string[]\n  id_token_signing_alg_values_supported?: string[]\n  [key: string]: unknown // OIDC providers ship many optional fields\n}\n\nconst cache = new Map<string, Promise<OidcMetadata>>()\n\n/** Clear the discovery cache. Used by tests. */\nexport function clearOidcCache(): void {\n  cache.clear()\n}\n\nfunction isLoopback(host: string): boolean {\n  return host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1'\n}\n\n/**\n * Fetch (or return cached) OIDC provider metadata.\n *\n * Throws when:\n *   - Issuer URL is malformed\n *   - Issuer is HTTP and not a loopback host (EC-7)\n *   - HTTP response is non-OK\n *   - Metadata lacks `authorization_endpoint` (sanity check)\n */\nexport async function discoverOidcProvider(issuer: string | URL): Promise<OidcMetadata> {\n  const issuerStr = typeof issuer === 'string' ? issuer : issuer.toString()\n  // Validate protocol BEFORE checking cache — invalid issuers should never poison.\n  const url = new URL(issuerStr)\n  if (url.protocol !== 'https:' && !isLoopback(url.hostname)) {\n    throw new Error(\n      `OIDC issuer must use HTTPS (received \"${url.protocol}//${url.hostname}…\"). ` +\n        `RFC 8414 §3 forbids plain HTTP except for loopback hosts.`,\n    )\n  }\n\n  const cached = cache.get(issuerStr)\n  if (cached) return cached\n\n  const promise = (async () => {\n    const wellKnown = new URL(\n      '.well-known/openid-configuration',\n      issuerStr.endsWith('/') ? issuerStr : issuerStr + '/',\n    )\n    const res = await fetch(wellKnown)\n    if (!res.ok) {\n      throw new Error(`OIDC discovery failed: ${res.status} ${res.statusText} at ${wellKnown}`)\n    }\n    const metadata = (await res.json()) as OidcMetadata\n    if (!metadata.authorization_endpoint) {\n      throw new Error('OIDC metadata missing authorization_endpoint — provider response is invalid')\n    }\n    return metadata\n  })()\n  // Cache the promise; on rejection, remove so the next call retries.\n  cache.set(issuerStr, promise)\n  promise.catch(() => {\n    if (cache.get(issuerStr) === promise) cache.delete(issuerStr)\n  })\n  return promise\n}\n"],"mappings":";;;;;;;;;;AAAO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,OAAO;AAAA,EACP,SAAS;AAAA,EAET,YAAY,UAAU,2BAA2B;AAC/C,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,YAAe,SAAqD;AAClF,MAAI,YAAY,QAAQ,YAAY,QAAW;AAC7C,UAAM,IAAI,kBAAkB;AAAA,EAC9B;AACF;;;ACEA,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAEhC,IAAM,oBAAoB,QAAQ,OAAO,iBAAiB;AAC1D,IAAM,kBAAkB,IAAI,WAAW,CAAC;AAKxC,IAAM,WAAW,oBAAI,IAAgC;AAErD,eAAe,UAAU,QAAoC;AAC3D,QAAM,SAAS,SAAS,IAAI,MAAM;AAClC,MAAI,OAAQ,QAAO;AAEnB,QAAM,UAAU,YAAY;AAC1B,UAAM,cAAc,MAAM,OAAO,OAAO;AAAA,MACtC;AAAA,MACA,QAAQ,OAAO,MAAM;AAAA,MACrB,EAAE,MAAM,OAAO;AAAA,MACf;AAAA,MACA,CAAC,WAAW;AAAA,IACd;AACA,WAAO,OAAO,OAAO;AAAA,MACnB,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,iBAAiB,MAAM,kBAAkB;AAAA,MAChF;AAAA,MACA,EAAE,MAAM,WAAW,QAAQ,IAAI;AAAA,MAC/B;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AAAA,EACF,GAAG;AAEH,WAAS,IAAI,QAAQ,MAAM;AAE3B,SAAO,MAAM,MAAM;AACjB,aAAS,OAAO,MAAM;AAAA,EACxB,CAAC;AACD,SAAO;AACT;AAEA,SAAS,YAAY,MAA0B;AAC7C,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,WAAW;AAC/C;AASA,SAAS,cAAc,KAAsC;AAC3D,QAAM,MAAM,OAAO,KAAK,KAAK,WAAW;AACxC,QAAM,OAAO,IAAI,WAAW,IAAI,MAAM;AACtC,OAAK,IAAI,GAAG;AACZ,SAAO;AACT;AAOA,eAAsB,QAAW,MAAS,QAAiC;AACzE,QAAM,MAAM,MAAM,UAAU,MAAM;AAClC,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACpD,QAAM,YAAY,QAAQ,OAAO,KAAK,UAAU,IAAI,CAAC;AACrD,QAAM,aAAa,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,SAAS;AAAA,EACrE;AACA,SAAO,GAAG,YAAY,EAAE,CAAC,IAAI,YAAY,UAAU,CAAC;AACtD;AAEA,eAAsB,QAAW,OAAe,QAAmC;AACjF,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,UAAM,KAAK,cAAc,MAAM,CAAC,CAAC;AACjC,UAAM,aAAa,cAAc,MAAM,CAAC,CAAC;AACzC,UAAM,MAAM,MAAM,UAAU,MAAM;AAElC,UAAM,YAAY,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,UAAU;AACtF,WAAO,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,yBAA+B;AAC7C,WAAS,MAAM;AACjB;;;ACjDA,IAAM,cAAc;AAMpB,SAAS,iBAAiB,OAAoC;AAC5D,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,MAAM,IAAI,CAAC,KAAK;AACzD,MAAI,IAAI,WAAW,GAAG;AACpB,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,MAAI,IAAI,SAAS,aAAa;AAC5B,UAAM,IAAI;AAAA,MACR,2CAA2C,WAAW,qEAAgE,IAAI,MAAM;AAAA,IAClI;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,KAAK;AACpC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,UAAM,IAAI,IAAI,CAAC;AACf,QAAI,OAAO,MAAM,YAAY,EAAE,SAAS,IAAI;AAC1C,YAAM,QAAQ,WAAW,aAAa,CAAC,KAAK;AAC5C,YAAM,IAAI,MAAM,iBAAiB,KAAK,uDAAuD;AAAA,IAC/F;AAAA,EACF;AACA,SAAO;AACT;AAUA,eAAe,uBACb,MACA,SACA,QACiB;AACjB,QAAM,WAAqC;AAAA,IACzC;AAAA,IACA,KAAK,KAAK,IAAI,IAAI,SAAS;AAAA,EAC7B;AACA,SAAO,QAAQ,UAAU,QAAQ,CAAC,CAAC;AACrC;AAWA,eAAe,2BACb,KACA,SACwE;AACxE,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,QAAQ,IAAI,OAAO,QAAQ,MAAM;AAC/B,YAAM,MAAM,MAAM,QAAmC,KAAK,MAAM;AAChE,aAAO,MAAM,EAAE,UAAU,KAAK,OAAO,EAAE,IAAI;AAAA,IAC7C,CAAC;AAAA,EACH;AACA,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAQ,QAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEO,SAAS,qBAA+B,QAAiD;AAC9F,QAAM,UAAU,iBAAiB,OAAO,MAAM;AAC9C,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,SAAS,OAAO,UAAU;AAEhC,WAAS,YAAY,KAAqB,OAAqB;AAC7D,cAAU,KAAK,YAAY,OAAO;AAAA,MAChC,UAAU;AAAA,MACV,UAAU;AAAA,MACV;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,KAAK;AACpB,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,GAAG;AAClD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,mBAAmB,KAAK;AAC5B,YAAM,MAAM,UAAU,KAAK,UAAU;AACrC,UAAI,CAAC,IAAK,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AAChF,YAAM,UAAU,MAAM,2BAAqC,KAAK,OAAO;AACvE,UAAI,CAAC,QAAS,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AACpF,UAAI,QAAQ,SAAS,MAAM,KAAK,IAAI,GAAG;AACrC,eAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,MAAM,EAAE;AAAA,MACnF;AACA,aAAO;AAAA,QACL,MAAM,QAAQ,SAAS;AAAA,QACvB,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,IAEA,MAAM,cAAc,KAAK,MAAM;AAC7B,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,kBAAY,KAAK,KAAK;AAAA,IACxB;AAAA,IAEA,eAAe,KAAK;AAClB,mBAAa,KAAK,UAAU;AAAA,IAC9B;AAAA,IAEA,MAAM,cAAc,KAAK,KAAK;AAC5B,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,GAAG;AAClD,UAAI,SAAS,KAAM,QAAO;AAG1B,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,kBAAY,KAAK,KAAK;AACtB,aAAO;AAAA,IACT;AAAA,EACF;AACF;AA4BO,SAAS,wBACd,QAC6B;AAC7B,QAAM,UAAU,iBAAiB,OAAO,MAAM;AAC9C,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,SAAS,OAAO,UAAU;AAEhC,WAAS,eAAe,QAAiB,OAAqB;AAC5D,0BAAsB,QAAQ,YAAY,OAAO;AAAA,MAC/C,UAAU;AAAA,MACV,UAAU;AAAA,MACV;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,SAAS;AACxB,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,OAAO;AACtD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,mBAAmB,SAAS;AAChC,YAAM,MAAM,qBAAqB,SAAS,UAAU;AACpD,UAAI,QAAQ,OAAW,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AAC7F,YAAM,UAAU,MAAM,2BAAqC,KAAK,OAAO;AACvE,UAAI,CAAC,QAAS,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AACpF,UAAI,QAAQ,SAAS,MAAM,KAAK,IAAI,GAAG;AACrC,eAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,MAAM,EAAE;AAAA,MACnF;AACA,aAAO;AAAA,QACL,MAAM,QAAQ,SAAS;AAAA,QACvB,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,IAEA,MAAM,cAAc,QAAQ,MAAM;AAChC,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,qBAAe,QAAQ,KAAK;AAAA,IAC9B;AAAA,IAEA,eAAe,QAAQ;AACrB,kCAA4B,QAAQ,UAAU;AAAA,IAChD;AAAA,IAEA,MAAM,cAAc,SAAS,QAAQ;AACnC,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,OAAO;AACtD,UAAI,SAAS,KAAM,QAAO;AAC1B,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,qBAAe,QAAQ,KAAK;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAiBA,eAAsB,kBACpB,IACA,SACA,QAC0B;AAC1B,QAAM,EAAE,MAAM,KAAK,IAAI,MAAM,GAAG,mBAAmB,OAAO;AAC1D,MAAI,SAAS,QAAQ,KAAK,gBAAgB;AACxC,UAAM,GAAG,cAAc,QAAQ,IAAI;AAAA,EACrC;AACA,SAAO;AACT;AAmBA,eAAsB,eACpB,IACA,KACA,KAC0B;AAC1B,QAAM,EAAE,MAAM,KAAK,IAAI,MAAM,GAAG,mBAAmB,GAAG;AACtD,MAAI,SAAS,QAAQ,KAAK,gBAAgB;AACxC,UAAM,GAAG,cAAc,KAAK,IAAI;AAAA,EAClC;AACA,SAAO;AACT;AASA,IAAM,sBAAsB;AAErB,SAAS,uBAAuB,QAAiC;AACtE,QAAM,MAAM,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;AACpD,QAAM,SAAS,QAAQ,IAAI,aAAa;AAExC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,UAAM,IAAI,IAAI,CAAC;AACf,UAAM,gBAAgB,oBAAoB,KAAK,CAAC;AAChD,UAAM,aAAa,EAAE,SAAS;AAC9B,UAAM,SAAS,IAAI,SAAS,IAAI,2BAA2B,CAAC,KAAK;AAEjE,QAAI,QAAQ;AACV,UAAI,YAAY;AACd,cAAM,IAAI;AAAA,UACR,GAAG,MAAM,8BAA8B,EAAE,MAAM;AAAA,QAEjD;AAAA,MACF;AACA,UAAI,eAAe;AACjB,cAAM,IAAI;AAAA,UACR,GAAG,MAAM,+BAA+B,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,QAExD;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,iBAAiB,YAAY;AAC/B,cAAQ;AAAA,QACN,sBAAsB,OAAO,YAAY,CAAC;AAAA,MAE5C;AAAA,IACF;AAAA,EACF;AACF;;;AC7VO,SAAS,gBAAgB,OAA2B;AACzD,MAAI,IAAI;AACR,aAAW,KAAK,MAAO,MAAK,OAAO,aAAa,CAAC;AAMjD,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AAgBO,SAAS,mBAAmB,GAAW,GAAoB;AAChE,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EAAG,QAAO;AAE7C,QAAM,SAAS,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AAC1C,MAAI,OAAO,EAAE,SAAS,EAAE;AACxB,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAG/B,UAAM,KAAK,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI;AAC5C,UAAM,KAAK,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI;AAC5C,YAAQ,KAAK;AAAA,EACf;AACA,SAAO,SAAS;AAClB;;;ACbA,IAAM,eAAe;AACrB,IAAM,iBAAiB;AACvB,IAAM,oBAAmC;AAGzC,SAAS,aAAa,GAAuB;AAC3C,QAAM,WAAW;AAKjB,QAAM,QAAQ,EAAE,YAAY,EAAE,QAAQ,OAAO,EAAE,EAAE,QAAQ,QAAQ,EAAE;AACnE,MAAI,CAAC,cAAc,KAAK,KAAK,GAAG;AAC9B,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AACA,QAAM,OAAiB,CAAC;AACxB,aAAW,KAAK,OAAO;AACrB,UAAM,MAAM,SAAS,QAAQ,CAAC;AAC9B,aAAS,IAAI,GAAG,KAAK,GAAG,IAAK,MAAK,KAAM,OAAO,IAAK,CAAC;AAAA,EACvD;AAEA,QAAM,YAAY,KAAK,MAAM,KAAK,SAAS,CAAC;AAC5C,QAAM,MAAM,IAAI,WAAW,SAAS;AACpC,WAAS,IAAI,GAAG,IAAI,WAAW,KAAK;AAClC,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,GAAG,IAAK,KAAK,KAAK,IAAK,KAAK,IAAI,IAAI,CAAC;AACzD,QAAI,CAAC,IAAI;AAAA,EACX;AACA,SAAO;AACT;AAGA,SAAS,aAAa,OAA2B;AAC/C,QAAM,WAAW;AACjB,MAAI,MAAM;AACV,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,KAAK,OAAO;AACrB,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,aAAO,SAAU,UAAW,OAAO,IAAM,EAAI;AAC7C,cAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,EAAG,QAAO,SAAU,UAAW,IAAI,OAAS,EAAI;AAC3D,SAAO;AACT;AAEA,SAAS,gBAAgB,QAAyC;AAChE,MAAI,OAAO,WAAW,SAAU,QAAO,aAAa,MAAM;AAC1D,SAAO;AACT;AAGA,SAAS,aAAa,QAAgB,SAA6B;AACjE,QAAM,UAAU,KAAK,MAAM,SAAS,MAAO,OAAO;AAClD,QAAM,MAAM,IAAI,WAAW,CAAC;AAE5B,QAAM,KAAK,KAAK,MAAM,UAAU,UAAW;AAC3C,QAAM,KAAK,YAAY;AACvB,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,IAAK;AACtB,MAAI,CAAC,IAAI,KAAK;AACd,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,IAAK;AACtB,MAAI,CAAC,IAAI,KAAK;AACd,SAAO;AACT;AAEA,eAAe,KACb,QACA,SACA,WACqB;AACrB,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,MAAM,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,OAAuB;AACzE,SAAO,IAAI,WAAW,GAAG;AAC3B;AAGA,SAAS,SAAS,KAAiB,QAAwB;AACzD,QAAM,SAAS,IAAI,IAAI,SAAS,CAAC,IAAI;AACrC,QAAM,QACF,IAAI,MAAM,IAAI,QAAS,MACvB,IAAI,SAAS,CAAC,IAAI,QAAS,MAC3B,IAAI,SAAS,CAAC,IAAI,QAAS,IAC5B,IAAI,SAAS,CAAC,IAAI;AACrB,QAAM,MAAM,MAAM;AAClB,SAAO,OAAO,OAAO,GAAG,EAAE,SAAS,QAAQ,GAAG;AAChD;AAGA,eAAsB,aAAa,MAAoC;AACrE,QAAM,SAAS,gBAAgB,KAAK,MAAM;AAC1C,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,OAAO,KAAK,QAAQ,KAAK,IAAI;AACnC,QAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,MAAM,IAAI,GAAG,SAAS;AAClE,SAAO,SAAS,KAAK,MAAM;AAC7B;AAQA,eAAsB,WAAW,OAAe,MAA2C;AACzF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,MAAM,WAAW,OAAQ,QAAO;AAE5D,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,OAAO,KAAK,QAAQ,KAAK,IAAI;AACnC,QAAM,QAAQ,KAAK,UAAU;AAC7B,QAAM,SAAS,gBAAgB,KAAK,MAAM;AAG1C,MAAI,UAAU;AACd,WAAS,QAAQ,CAAC,OAAO,SAAS,OAAO,SAAS;AAChD,UAAM,IAAI,OAAO,QAAQ,OAAO;AAChC,UAAM,OAAO,SAAS,MAAM,KAAK,QAAQ,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM;AAClF,QAAI,mBAAmB,MAAM,KAAK,EAAG,WAAU;AAAA,EACjD;AACA,SAAO;AACT;AAGO,SAAS,mBAAmB,QAAQ,IAAgB;AACzD,MAAI,QAAQ,IAAI;AACd,UAAM,IAAI,MAAM,gEAA6D;AAAA,EAC/E;AACA,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,gBAAgB,GAAG;AAC1B,SAAO;AACT;AAgBO,SAAS,QAAQ,MAA8B;AACpD,QAAM,QAAQ,GAAG,KAAK,MAAM,IAAI,KAAK,OAAO;AAC5C,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,QAAQ,aAAa,KAAK,MAAM;AAAA,IAChC,QAAQ,KAAK;AAAA,IACb,WAAW,KAAK,aAAa;AAAA,IAC7B,QAAQ,OAAO,KAAK,UAAU,cAAc;AAAA,IAC5C,QAAQ,OAAO,KAAK,QAAQ,YAAY;AAAA,EAC1C,CAAC;AACD,SAAO,kBAAkB,mBAAmB,KAAK,CAAC,IAAI,OAAO,SAAS,CAAC;AACzE;;;ACtLA,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,iBAAiB;AAQvB,eAAsB,oBAAoB,OAA0B,CAAC,GAA0B;AAC7F,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,YAAY,KAAK,cAAc,SAAY,MAAM,KAAK;AAC5D,QAAM,WAAW,KAAK,YAAY;AAMlC,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,KAAK,QAAQ,KAAM;AAC1D,UAAM,IAAI;AAAA,MACR,mEAAmE,OAAO,KAAK,CAAC;AAAA,IAClF;AAAA,EACF;AACA,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,IAAI;AAC1D,UAAM,IAAI;AAAA,MACR,kEAAkE,OAAO,MAAM,CAAC;AAAA,IAClF;AAAA,EACF;AACA,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,IAAI;AAAA,MACR,6EAA6E,SAAS,MAAM;AAAA,IAC9F;AAAA,EACF;AAEA,QAAM,QAAsB,CAAC;AAC7B,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,MAAM,SAAS,OAAO;AAC3B,UAAM,MAAM,mBAAmB,QAAQ,QAAQ;AAC/C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,UAAM,YAAY,oBAAoB,KAAK,SAAS;AACpD,UAAM,OAAO,MAAM,UAAU,cAAc,SAAS,CAAC;AACrD,UAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAUA,eAAsB,iBACpB,MACA,QACmD;AACnD,QAAM,YAAY,MAAM,UAAU,cAAc,IAAI,CAAC;AACrD,MAAI;AAEJ,aAAW,KAAK,QAAQ;AACtB,QAAIA,oBAAmB,GAAG,SAAS,GAAG;AACpC,oBAAc;AAAA,IAChB;AAAA,EACF;AACA,SAAO,cAAc,EAAE,OAAO,MAAM,YAAY,IAAI,EAAE,OAAO,MAAM;AACrE;AAOA,SAAS,cAAc,OAAuB;AAC5C,SAAO,MAAM,YAAY,EAAE,QAAQ,WAAW,EAAE;AAClD;AAEA,SAAS,oBAAoB,KAAa,WAA+B;AACvE,MAAI,CAAC,aAAa,IAAI,SAAS,EAAG,QAAO;AACzC,QAAM,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC;AACrC,SAAO,IAAI,MAAM,GAAG,GAAG,IAAI,YAAY,IAAI,MAAM,GAAG;AACtD;AAEA,SAAS,mBAAmB,QAAgB,UAA0B;AACpE,QAAM,SAAS,IAAI,WAAW,MAAM;AACpC,SAAO,gBAAgB,MAAM;AAC7B,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC/B,WAAO,SAAS,OAAO,CAAC,IAAI,SAAS,MAAM;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,eAAe,UAAU,OAAgC;AACvD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK;AAC5C,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AACxD,SAAO,MAAM,KAAK,IAAI,WAAW,IAAI,CAAC,EACnC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEA,SAASA,oBAAmB,GAAW,GAAoB;AACzD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC3E,SAAO,SAAS;AAClB;;;ACjGA,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB,KAAK;AAOhC,eAAsB,cAAc,MAA+C;AACjF,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,QAAQ,MAAM,KAAK,MAAM,IAAI,KAAK,UAAU;AAClD,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,SAAS,MAAM,mBAAmB,YAAY;AAAA,EACzD;AACA,MAAI,MAAM,SAAS,aAAa;AAC9B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,mBAAmB;AAAA;AAAA,MAEnB,aAAa,IAAI,KAAK,MAAM,OAAO;AAAA,IACrC;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,mBAAmB,KAAK,IAAI,GAAG,cAAc,MAAM,KAAK;AAAA,EAC1D;AACF;AAWA,eAAsB,cACpB,MACA,SACwB;AACxB,QAAM,cAAc,KAAK,eAAe;AACxC,MAAI,SAAS;AACX,UAAM,KAAK,MAAM,MAAM,KAAK,UAAU;AACtC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,mBAAmB;AAAA,IACrB;AAAA,EACF;AACA,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,QAAQ,MAAM,KAAK,MAAM,KAAK,KAAK,YAAY,SAAS;AAE9D,MAAI,MAAM,SAAS,aAAa;AAC9B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,mBAAmB;AAAA,MACnB,aAAa,IAAI,KAAK,MAAM,OAAO;AAAA,IACrC;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,mBAAmB,KAAK,IAAI,GAAG,cAAc,MAAM,KAAK;AAAA,EAC1D;AACF;;;AClFA,eAAsB,0BAA0B,UAAmC;AACjF,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,QAAQ;AAC/C,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AACxD,SAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;AAC7C;AAWA,eAAsB,wBAAgD;AACpE,QAAM,SAAS,IAAI,WAAW,EAAE;AAChC,SAAO,gBAAgB,MAAM;AAC7B,QAAM,eAAe,gBAAgB,MAAM;AAC3C,QAAM,gBAAgB,MAAM,0BAA0B,YAAY;AAClE,SAAO,EAAE,cAAc,eAAe,qBAAqB,OAAO;AACpE;;;ACjCO,SAAS,mBAAmB,OAA2B,CAAC,GAAW;AACxE,QAAM,MAAM,KAAK,SAAS;AAC1B,QAAM,MAAM,IAAI,WAAW,GAAG;AAC9B,SAAO,gBAAgB,GAAG;AAC1B,SAAO,gBAAgB,GAAG;AAC5B;AASO,SAAS,iBAAiB,UAAkB,QAAyB;AAC1E,SAAO,mBAAmB,UAAU,MAAM;AAC5C;;;ACNA,IAAM,QAAQ,oBAAI,IAAmC;AAG9C,SAAS,iBAAuB;AACrC,QAAM,MAAM;AACd;AAEA,SAAS,WAAW,MAAuB;AACzC,SAAO,SAAS,eAAe,SAAS,eAAe,SAAS,WAAW,SAAS;AACtF;AAWA,eAAsB,qBAAqB,QAA6C;AACtF,QAAM,YAAY,OAAO,WAAW,WAAW,SAAS,OAAO,SAAS;AAExE,QAAM,MAAM,IAAI,IAAI,SAAS;AAC7B,MAAI,IAAI,aAAa,YAAY,CAAC,WAAW,IAAI,QAAQ,GAAG;AAC1D,UAAM,IAAI;AAAA,MACR,yCAAyC,IAAI,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAExE;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,IAAI,SAAS;AAClC,MAAI,OAAQ,QAAO;AAEnB,QAAM,WAAW,YAAY;AAC3B,UAAM,YAAY,IAAI;AAAA,MACpB;AAAA,MACA,UAAU,SAAS,GAAG,IAAI,YAAY,YAAY;AAAA,IACpD;AACA,UAAM,MAAM,MAAM,MAAM,SAAS;AACjC,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,IAAI,IAAI,UAAU,OAAO,SAAS,EAAE;AAAA,IAC1F;AACA,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,SAAS,wBAAwB;AACpC,YAAM,IAAI,MAAM,kFAA6E;AAAA,IAC/F;AACA,WAAO;AAAA,EACT,GAAG;AAEH,QAAM,IAAI,WAAW,OAAO;AAC5B,UAAQ,MAAM,MAAM;AAClB,QAAI,MAAM,IAAI,SAAS,MAAM,QAAS,OAAM,OAAO,SAAS;AAAA,EAC9D,CAAC;AACD,SAAO;AACT;","names":["constantTimeEquals"]}

package/dist/cli/index.js

@@ -6,12 +6,12 @@ import "../chunk-KT3MWNZG.js";
 import cac from "cac";
 var cli = cac("theokit");
 cli.command("dev", "Start development server").option("--port <port>", "Port number").action(async (options) => {
-  const { devCommand } = await import("../dev-ZU46C5AZ.js");
+  const { devCommand } = await import("../dev-NDEZA2MP.js");
   await devCommand({ port: options.port ? Number(options.port) : void 0 });
 });
 cli.command("build", "Build for production").option("--target <target>", "Deploy target (node, vercel, cloudflare)").action(async (options) => {
   try {
-    const { buildCommand } = await import("../build-R74EU6BP.js");
+    const { buildCommand } = await import("../build-KQD2EDU4.js");
     await buildCommand({ target: options.target });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -23,7 +23,7 @@ cli.command("build", "Build for production").option("--target <target>", "Deploy
 });
 cli.command("start", "Start production server").option("--port <port>", "Port number").action(async (options) => {
   try {
-    const { startCommand } = await import("../start-HGUNNF5X.js");
+    const { startCommand } = await import("../start-SPFWOGHL.js");
     await startCommand({ port: options.port ? Number(options.port) : void 0 });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -33,10 +33,13 @@ cli.command("start", "Start production server").option("--port <port>", "Port nu
     process.exit(1);
   }
 });
-cli.command("generate <type> <name>", "Generate a route, action, page, ws, or controller endpoint").action(async (type, name) => {
+cli.command(
+  "generate <type> <name> [...fields]",
+  "Generate a route, action, page, ws, controller, or resource (resource accepts field:type args)"
+).action(async (type, name, fields) => {
   try {
-    const { generateCommand } = await import("../generate-AZ2K6Z2Z.js");
-    await generateCommand(type, name);
+    const { generateCommand } = await import("../generate-ODDAYXNR.js");
+    await generateCommand(type, name, fields.length > 0 ? fields : void 0);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.error(`
@@ -47,7 +50,7 @@ cli.command("generate <type> <name>", "Generate a route, action, page, ws, or co
 });
 cli.command("routes", "List all routes, actions, and WebSocket endpoints").action(async () => {
   try {
-    const { routesCommand } = await import("../routes-GAXVWJUK.js");
+    const { routesCommand } = await import("../routes-6A5XFGF7.js");
     await routesCommand();
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -80,7 +83,7 @@ cli.command("check", "Run typecheck + scan + (optional) eslint").option(
     });
     return;
   }
-  const { checkCommand } = await import("../check-NXYPLM6M.js");
+  const { checkCommand } = await import("../check-F3UDYSZ4.js");
   await checkCommand();
 });
 cli.command("add <package>", "Install a known TheoKit adapter or plugin (whitelist-only)").action(async (pkg) => {
@@ -88,7 +91,7 @@ cli.command("add <package>", "Install a known TheoKit adapter or plugin (whiteli
   await addCommand(pkg);
 });
 cli.command("info", "Print environment info (runtime, config, routes)").action(async () => {
-  const { infoCommand } = await import("../info-CORLCPEJ.js");
+  const { infoCommand } = await import("../info-CSGWIAXA.js");
   await infoCommand();
 });
 cli.command(
@@ -96,7 +99,7 @@ cli.command(
   "Generate <distDir>/openapi.json from route schemas (opt-in via config.openapi)"
 ).option("--dry-run", "Print the document to stdout without writing to disk (EC-3)").action(async (options) => {
   try {
-    const { openapiCommand } = await import("../openapi-TEOUOIJ2.js");
+    const { openapiCommand } = await import("../openapi-NXGRXABL.js");
     await openapiCommand({ dryRun: Boolean(options.dryRun) });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -153,6 +156,18 @@ cli.command("docker", "Generate Dockerfile for production").option("--force", "O
     process.exit(1);
   }
 });
+cli.command("db <action>", "Database commands: migrate (push schema), generate (SQL files), seed").action(async (action) => {
+  try {
+    const { dbCommandCli } = await import("../db-ZPDW3UCU.js");
+    dbCommandCli(action);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`
+  \u2717 ${msg}
+`);
+    process.exit(1);
+  }
+});
 cli.help();
 cli.version("0.1.0-alpha.0");
 function main() {

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/cli/index.ts"],"sourcesContent":["import cac from 'cac'\n\ninterface CliOptions {\n  port?: string | number\n  target?: string\n  upgradeReadiness?: string | number\n  json?: boolean\n  allowWarnings?: boolean\n  force?: boolean\n  dryRun?: boolean\n}\n\nconst cli = cac('theokit')\n\ncli\n  .command('dev', 'Start development server')\n  .option('--port <port>', 'Port number')\n  .action(async (options: CliOptions) => {\n    const { devCommand } = await import('./commands/dev.js')\n    await devCommand({ port: options.port ? Number(options.port) : undefined })\n  })\n\ncli\n  .command('build', 'Build for production')\n  .option('--target <target>', 'Deploy target (node, vercel, cloudflare)')\n  .action(async (options: CliOptions) => {\n    try {\n      const { buildCommand } = await import('./commands/build.js')\n      await buildCommand({ target: options.target })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('start', 'Start production server')\n  .option('--port <port>', 'Port number')\n  .action(async (options: CliOptions) => {\n    try {\n      const { startCommand } = await import('./commands/start/index.js')\n      await startCommand({ port: options.port ? Number(options.port) : undefined })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('generate <type> <name>', 'Generate a route, action, page, ws, or controller endpoint')\n  .action(async (type: string, name: string) => {\n    try {\n      const { generateCommand } = await import('./commands/generate.js')\n      await generateCommand(type, name)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli.command('routes', 'List all routes, actions, and WebSocket endpoints').action(async () => {\n  try {\n    const { routesCommand } = await import('./commands/routes.js')\n    await routesCommand()\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err)\n    console.error(`\\n  ✗ ${msg}\\n`)\n    process.exit(1)\n  }\n})\n\ncli\n  .command('check', 'Run typecheck + scan + (optional) eslint')\n  .option(\n    '--upgrade-readiness <version>',\n    'Scan source for anticipated breakage under a future TheoKit version (currently supports 0.3). See docs/migration/0.2-to-0.3.md',\n  )\n  .option('--json', 'Emit machine-readable JSON (only with --upgrade-readiness)')\n  .option(\n    '--allow-warnings',\n    'Do not fail the build when violations are present (only with --upgrade-readiness)',\n  )\n  .action(async (options: CliOptions) => {\n    // cac may coerce `0.3` to a JS number — normalize before comparing.\n    const targetRaw = options.upgradeReadiness\n    if (targetRaw !== undefined) {\n      const target = String(targetRaw)\n      if (target !== '0.3') {\n        console.error(`\\n  ✗ --upgrade-readiness: only '0.3' is supported (got '${target}')\\n`)\n        process.exit(1)\n      }\n      const { upgradeReadinessCommand } = await import('./commands/upgrade-readiness.js')\n      await upgradeReadinessCommand({\n        json: Boolean(options.json),\n        allowWarnings: Boolean(options.allowWarnings),\n      })\n      return\n    }\n    const { checkCommand } = await import('./commands/check.js')\n    await checkCommand()\n  })\n\ncli\n  .command('add <package>', 'Install a known TheoKit adapter or plugin (whitelist-only)')\n  .action(async (pkg: string) => {\n    const { addCommand } = await import('./commands/add.js')\n    await addCommand(pkg)\n  })\n\ncli.command('info', 'Print environment info (runtime, config, routes)').action(async () => {\n  const { infoCommand } = await import('./commands/info.js')\n  await infoCommand()\n})\n\ncli\n  .command(\n    'openapi',\n    'Generate <distDir>/openapi.json from route schemas (opt-in via config.openapi)',\n  )\n  .option('--dry-run', 'Print the document to stdout without writing to disk (EC-3)')\n  .action(async (options: CliOptions) => {\n    try {\n      const { openapiCommand } = await import('./commands/openapi.js')\n      await openapiCommand({ dryRun: Boolean(options.dryRun) })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command(\n    'migrate <kind>',\n    'Run a one-shot convention migration. Supported: router (G6 dotted→nested), services-json-v1-to-v2 (Plan v1.2 T2.3)',\n  )\n  .option('--dry-run', 'Print the migration plan but do not touch the filesystem')\n  .option('--force', 'Skip the dev-server port pre-flight check (CI / non-TTY)')\n  .option('--name <slug>', 'Explicit project name (DNS-1123). Services-json migrate only.')\n  .action(async (kind: string, options: CliOptions & { name?: string }) => {\n    try {\n      if (kind === 'router') {\n        const { routerMigrateCommand } = await import('./commands/migrate/router.js')\n        await routerMigrateCommand({\n          dryRun: Boolean(options.dryRun),\n          force: Boolean(options.force),\n        })\n        return\n      }\n      if (kind === 'services-json-v1-to-v2' || kind === 'services-json') {\n        const { servicesJsonMigrateCommand } = await import('./commands/migrate/services-json.js')\n        await servicesJsonMigrateCommand({\n          dryRun: Boolean(options.dryRun),\n          name: options.name,\n        })\n        return\n      }\n      console.error(\n        `\\n  ✗ Unknown migration kind: ${kind}. Supported: router, services-json-v1-to-v2\\n`,\n      )\n      process.exit(1)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('docker', 'Generate Dockerfile for production')\n  .option('--force', 'Overwrite existing Dockerfile')\n  .action(async (options: CliOptions) => {\n    try {\n      const { dockerCommand } = await import('./commands/docker.js')\n      await dockerCommand({ force: options.force })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli.help()\ncli.version('0.1.0-alpha.0')\n\nexport function main(): void {\n  cli.parse()\n}\n\n// Auto-execute when run as script\nmain()\n"],"mappings":";;;;;AAAA,OAAO,SAAS;AAYhB,IAAM,MAAM,IAAI,SAAS;AAEzB,IACG,QAAQ,OAAO,0BAA0B,EACzC,OAAO,iBAAiB,aAAa,EACrC,OAAO,OAAO,YAAwB;AACrC,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAmB;AACvD,QAAM,WAAW,EAAE,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,IAAI,OAAU,CAAC;AAC5E,CAAC;AAEH,IACG,QAAQ,SAAS,sBAAsB,EACvC,OAAO,qBAAqB,0CAA0C,EACtE,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAqB;AAC3D,UAAM,aAAa,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,SAAS,yBAAyB,EAC1C,OAAO,iBAAiB,aAAa,EACrC,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAA2B;AACjE,UAAM,aAAa,EAAE,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,IAAI,OAAU,CAAC;AAAA,EAC9E,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,0BAA0B,4DAA4D,EAC9F,OAAO,OAAO,MAAc,SAAiB;AAC5C,MAAI;AACF,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,yBAAwB;AACjE,UAAM,gBAAgB,MAAM,IAAI;AAAA,EAClC,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IAAI,QAAQ,UAAU,mDAAmD,EAAE,OAAO,YAAY;AAC5F,MAAI;AACF,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAsB;AAC7D,UAAM,cAAc;AAAA,EACtB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAED,IACG,QAAQ,SAAS,0CAA0C,EAC3D;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,UAAU,4DAA4D,EAC7E;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,OAAO,YAAwB;AAErC,QAAM,YAAY,QAAQ;AAC1B,MAAI,cAAc,QAAW;AAC3B,UAAM,SAAS,OAAO,SAAS;AAC/B,QAAI,WAAW,OAAO;AACpB,cAAQ,MAAM;AAAA,8DAA4D,MAAM;AAAA,CAAM;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,UAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,kCAAiC;AAClF,UAAM,wBAAwB;AAAA,MAC5B,MAAM,QAAQ,QAAQ,IAAI;AAAA,MAC1B,eAAe,QAAQ,QAAQ,aAAa;AAAA,IAC9C,CAAC;AACD;AAAA,EACF;AACA,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAqB;AAC3D,QAAM,aAAa;AACrB,CAAC;AAEH,IACG,QAAQ,iBAAiB,4DAA4D,EACrF,OAAO,OAAO,QAAgB;AAC7B,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAmB;AACvD,QAAM,WAAW,GAAG;AACtB,CAAC;AAEH,IAAI,QAAQ,QAAQ,kDAAkD,EAAE,OAAO,YAAY;AACzF,QAAM,EAAE,YAAY,IAAI,MAAM,OAAO,qBAAoB;AACzD,QAAM,YAAY;AACpB,CAAC;AAED,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,aAAa,6DAA6D,EACjF,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,wBAAuB;AAC/D,UAAM,eAAe,EAAE,QAAQ,QAAQ,QAAQ,MAAM,EAAE,CAAC;AAAA,EAC1D,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,aAAa,0DAA0D,EAC9E,OAAO,WAAW,0DAA0D,EAC5E,OAAO,iBAAiB,+DAA+D,EACvF,OAAO,OAAO,MAAc,YAA4C;AACvE,MAAI;AACF,QAAI,SAAS,UAAU;AACrB,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,uBAA8B;AAC5E,YAAM,qBAAqB;AAAA,QACzB,QAAQ,QAAQ,QAAQ,MAAM;AAAA,QAC9B,OAAO,QAAQ,QAAQ,KAAK;AAAA,MAC9B,CAAC;AACD;AAAA,IACF;AACA,QAAI,SAAS,4BAA4B,SAAS,iBAAiB;AACjE,YAAM,EAAE,2BAA2B,IAAI,MAAM,OAAO,8BAAqC;AACzF,YAAM,2BAA2B;AAAA,QAC/B,QAAQ,QAAQ,QAAQ,MAAM;AAAA,QAC9B,MAAM,QAAQ;AAAA,MAChB,CAAC;AACD;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,mCAAiC,IAAI;AAAA;AAAA,IACvC;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,UAAU,oCAAoC,EACtD,OAAO,WAAW,+BAA+B,EACjD,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAsB;AAC7D,UAAM,cAAc,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,EAC9C,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IAAI,KAAK;AACT,IAAI,QAAQ,eAAe;AAEpB,SAAS,OAAa;AAC3B,MAAI,MAAM;AACZ;AAGA,KAAK;","names":[]}
+{"version":3,"sources":["../../src/cli/index.ts"],"sourcesContent":["import cac from 'cac'\n\ninterface CliOptions {\n  port?: string | number\n  target?: string\n  upgradeReadiness?: string | number\n  json?: boolean\n  allowWarnings?: boolean\n  force?: boolean\n  dryRun?: boolean\n}\n\nconst cli = cac('theokit')\n\ncli\n  .command('dev', 'Start development server')\n  .option('--port <port>', 'Port number')\n  .action(async (options: CliOptions) => {\n    const { devCommand } = await import('./commands/dev.js')\n    await devCommand({ port: options.port ? Number(options.port) : undefined })\n  })\n\ncli\n  .command('build', 'Build for production')\n  .option('--target <target>', 'Deploy target (node, vercel, cloudflare)')\n  .action(async (options: CliOptions) => {\n    try {\n      const { buildCommand } = await import('./commands/build.js')\n      await buildCommand({ target: options.target })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('start', 'Start production server')\n  .option('--port <port>', 'Port number')\n  .action(async (options: CliOptions) => {\n    try {\n      const { startCommand } = await import('./commands/start/index.js')\n      await startCommand({ port: options.port ? Number(options.port) : undefined })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command(\n    'generate <type> <name> [...fields]',\n    'Generate a route, action, page, ws, controller, or resource (resource accepts field:type args)',\n  )\n  .action(async (type: string, name: string, fields: string[]) => {\n    try {\n      const { generateCommand } = await import('./commands/generate.js')\n      await generateCommand(type, name, fields.length > 0 ? fields : undefined)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli.command('routes', 'List all routes, actions, and WebSocket endpoints').action(async () => {\n  try {\n    const { routesCommand } = await import('./commands/routes.js')\n    await routesCommand()\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err)\n    console.error(`\\n  ✗ ${msg}\\n`)\n    process.exit(1)\n  }\n})\n\ncli\n  .command('check', 'Run typecheck + scan + (optional) eslint')\n  .option(\n    '--upgrade-readiness <version>',\n    'Scan source for anticipated breakage under a future TheoKit version (currently supports 0.3). See docs/migration/0.2-to-0.3.md',\n  )\n  .option('--json', 'Emit machine-readable JSON (only with --upgrade-readiness)')\n  .option(\n    '--allow-warnings',\n    'Do not fail the build when violations are present (only with --upgrade-readiness)',\n  )\n  .action(async (options: CliOptions) => {\n    // cac may coerce `0.3` to a JS number — normalize before comparing.\n    const targetRaw = options.upgradeReadiness\n    if (targetRaw !== undefined) {\n      const target = String(targetRaw)\n      if (target !== '0.3') {\n        console.error(`\\n  ✗ --upgrade-readiness: only '0.3' is supported (got '${target}')\\n`)\n        process.exit(1)\n      }\n      const { upgradeReadinessCommand } = await import('./commands/upgrade-readiness.js')\n      await upgradeReadinessCommand({\n        json: Boolean(options.json),\n        allowWarnings: Boolean(options.allowWarnings),\n      })\n      return\n    }\n    const { checkCommand } = await import('./commands/check.js')\n    await checkCommand()\n  })\n\ncli\n  .command('add <package>', 'Install a known TheoKit adapter or plugin (whitelist-only)')\n  .action(async (pkg: string) => {\n    const { addCommand } = await import('./commands/add.js')\n    await addCommand(pkg)\n  })\n\ncli.command('info', 'Print environment info (runtime, config, routes)').action(async () => {\n  const { infoCommand } = await import('./commands/info.js')\n  await infoCommand()\n})\n\ncli\n  .command(\n    'openapi',\n    'Generate <distDir>/openapi.json from route schemas (opt-in via config.openapi)',\n  )\n  .option('--dry-run', 'Print the document to stdout without writing to disk (EC-3)')\n  .action(async (options: CliOptions) => {\n    try {\n      const { openapiCommand } = await import('./commands/openapi.js')\n      await openapiCommand({ dryRun: Boolean(options.dryRun) })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command(\n    'migrate <kind>',\n    'Run a one-shot convention migration. Supported: router (G6 dotted→nested), services-json-v1-to-v2 (Plan v1.2 T2.3)',\n  )\n  .option('--dry-run', 'Print the migration plan but do not touch the filesystem')\n  .option('--force', 'Skip the dev-server port pre-flight check (CI / non-TTY)')\n  .option('--name <slug>', 'Explicit project name (DNS-1123). Services-json migrate only.')\n  .action(async (kind: string, options: CliOptions & { name?: string }) => {\n    try {\n      if (kind === 'router') {\n        const { routerMigrateCommand } = await import('./commands/migrate/router.js')\n        await routerMigrateCommand({\n          dryRun: Boolean(options.dryRun),\n          force: Boolean(options.force),\n        })\n        return\n      }\n      if (kind === 'services-json-v1-to-v2' || kind === 'services-json') {\n        const { servicesJsonMigrateCommand } = await import('./commands/migrate/services-json.js')\n        await servicesJsonMigrateCommand({\n          dryRun: Boolean(options.dryRun),\n          name: options.name,\n        })\n        return\n      }\n      console.error(\n        `\\n  ✗ Unknown migration kind: ${kind}. Supported: router, services-json-v1-to-v2\\n`,\n      )\n      process.exit(1)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('docker', 'Generate Dockerfile for production')\n  .option('--force', 'Overwrite existing Dockerfile')\n  .action(async (options: CliOptions) => {\n    try {\n      const { dockerCommand } = await import('./commands/docker.js')\n      await dockerCommand({ force: options.force })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('db <action>', 'Database commands: migrate (push schema), generate (SQL files), seed')\n  .action(async (action: string) => {\n    try {\n      const { dbCommandCli } = await import('./commands/db.js')\n      dbCommandCli(action)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli.help()\ncli.version('0.1.0-alpha.0')\n\nexport function main(): void {\n  cli.parse()\n}\n\n// Auto-execute when run as script\nmain()\n"],"mappings":";;;;;AAAA,OAAO,SAAS;AAYhB,IAAM,MAAM,IAAI,SAAS;AAEzB,IACG,QAAQ,OAAO,0BAA0B,EACzC,OAAO,iBAAiB,aAAa,EACrC,OAAO,OAAO,YAAwB;AACrC,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAmB;AACvD,QAAM,WAAW,EAAE,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,IAAI,OAAU,CAAC;AAC5E,CAAC;AAEH,IACG,QAAQ,SAAS,sBAAsB,EACvC,OAAO,qBAAqB,0CAA0C,EACtE,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAqB;AAC3D,UAAM,aAAa,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,SAAS,yBAAyB,EAC1C,OAAO,iBAAiB,aAAa,EACrC,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAA2B;AACjE,UAAM,aAAa,EAAE,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,IAAI,OAAU,CAAC;AAAA,EAC9E,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,OAAO,MAAc,MAAc,WAAqB;AAC9D,MAAI;AACF,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,yBAAwB;AACjE,UAAM,gBAAgB,MAAM,MAAM,OAAO,SAAS,IAAI,SAAS,MAAS;AAAA,EAC1E,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IAAI,QAAQ,UAAU,mDAAmD,EAAE,OAAO,YAAY;AAC5F,MAAI;AACF,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAsB;AAC7D,UAAM,cAAc;AAAA,EACtB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAED,IACG,QAAQ,SAAS,0CAA0C,EAC3D;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,UAAU,4DAA4D,EAC7E;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,OAAO,YAAwB;AAErC,QAAM,YAAY,QAAQ;AAC1B,MAAI,cAAc,QAAW;AAC3B,UAAM,SAAS,OAAO,SAAS;AAC/B,QAAI,WAAW,OAAO;AACpB,cAAQ,MAAM;AAAA,8DAA4D,MAAM;AAAA,CAAM;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,UAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,kCAAiC;AAClF,UAAM,wBAAwB;AAAA,MAC5B,MAAM,QAAQ,QAAQ,IAAI;AAAA,MAC1B,eAAe,QAAQ,QAAQ,aAAa;AAAA,IAC9C,CAAC;AACD;AAAA,EACF;AACA,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAqB;AAC3D,QAAM,aAAa;AACrB,CAAC;AAEH,IACG,QAAQ,iBAAiB,4DAA4D,EACrF,OAAO,OAAO,QAAgB;AAC7B,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAmB;AACvD,QAAM,WAAW,GAAG;AACtB,CAAC;AAEH,IAAI,QAAQ,QAAQ,kDAAkD,EAAE,OAAO,YAAY;AACzF,QAAM,EAAE,YAAY,IAAI,MAAM,OAAO,qBAAoB;AACzD,QAAM,YAAY;AACpB,CAAC;AAED,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,aAAa,6DAA6D,EACjF,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,wBAAuB;AAC/D,UAAM,eAAe,EAAE,QAAQ,QAAQ,QAAQ,MAAM,EAAE,CAAC;AAAA,EAC1D,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,aAAa,0DAA0D,EAC9E,OAAO,WAAW,0DAA0D,EAC5E,OAAO,iBAAiB,+DAA+D,EACvF,OAAO,OAAO,MAAc,YAA4C;AACvE,MAAI;AACF,QAAI,SAAS,UAAU;AACrB,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,uBAA8B;AAC5E,YAAM,qBAAqB;AAAA,QACzB,QAAQ,QAAQ,QAAQ,MAAM;AAAA,QAC9B,OAAO,QAAQ,QAAQ,KAAK;AAAA,MAC9B,CAAC;AACD;AAAA,IACF;AACA,QAAI,SAAS,4BAA4B,SAAS,iBAAiB;AACjE,YAAM,EAAE,2BAA2B,IAAI,MAAM,OAAO,8BAAqC;AACzF,YAAM,2BAA2B;AAAA,QAC/B,QAAQ,QAAQ,QAAQ,MAAM;AAAA,QAC9B,MAAM,QAAQ;AAAA,MAChB,CAAC;AACD;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,mCAAiC,IAAI;AAAA;AAAA,IACvC;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,UAAU,oCAAoC,EACtD,OAAO,WAAW,+BAA+B,EACjD,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAsB;AAC7D,UAAM,cAAc,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,EAC9C,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,eAAe,sEAAsE,EAC7F,OAAO,OAAO,WAAmB;AAChC,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,mBAAkB;AACxD,iBAAa,MAAM;AAAA,EACrB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IAAI,KAAK;AACT,IAAI,QAAQ,eAAe;AAEpB,SAAS,OAAa;AAC3B,MAAI,MAAM;AACZ;AAGA,KAAK;","names":[]}

package/dist/client/index.d.ts

@@ -3,7 +3,7 @@ import { T as TheoErrorEnvelope } from '../error-envelope-BsNzzAV5.js';
 export { FetchOptionsLike, Fetcher, QueryKey, UseTheoQueryConfig, buildUseTheoQueryConfig, stableQueryKey } from '../react-query/index.js';
 import { A as AgentEvent } from '../agent-events-B3KNV9ER.js';
 export { a as AgentErrorEvent, b as AgentMessageEvent, c as AgentToolCallEvent, d as AgentToolResultEvent } from '../agent-events-B3KNV9ER.js';
-import * as react_jsx_runtime from 'react/jsx-runtime';
+import * as react from 'react';
 import { LinkProps as LinkProps$1 } from 'react-router';
 
 /** Infer the response type from a route's handler return */
@@ -205,7 +205,7 @@ interface LinkProps extends LinkProps$1 {
  * <Link to="/settings" prefetch="none">Settings</Link>
  * ```
  */
-declare function Link({ prefetch, to, onMouseEnter, onFocus, ...rest }: LinkProps): react_jsx_runtime.JSX.Element;
+declare function Link({ prefetch, to, onMouseEnter, onFocus, ...rest }: LinkProps): react.JSX.Element;
 
 /**
  * <Metadata> — SEO-ready head tags from a single component.
@@ -245,7 +245,7 @@ interface MetadataProps {
     /** Custom meta tags rendered as children */
     children?: React.ReactNode;
 }
-declare function Metadata(props: MetadataProps): react_jsx_runtime.JSX.Element;
+declare function Metadata(props: MetadataProps): react.JSX.Element;
 
 /**
  * <Image> — optimized image component with lazy loading.
@@ -283,6 +283,6 @@ interface ImageProps extends React.ImgHTMLAttributes<HTMLImageElement> {
     /** If true, loading="eager" — use for above-the-fold images. */
     priority?: boolean;
 }
-declare function Image({ priority, loading, decoding, ...props }: ImageProps): react_jsx_runtime.JSX.Element;
+declare function Image({ priority, loading, decoding, ...props }: ImageProps): react.JSX.Element;
 
 export { AgentEvent, type AgentStreamStatus, type BatchRequest, type BatchResponse, type BatchTransport, type Batcher, type BatcherOptions, type ConsumeOptions, type CreateAppClientOptions, Image, type ImageProps, type InferBody, type InferQuery, type InferResponse, Link, type LinkProps, Metadata, type MetadataProps, type PrefetchBehavior, TheoFetchError, type TheoFetchOptions, type UseAgentStreamOptions, type UseAgentStreamReturn, consumeAgentStream, createAppClient, createBatcher, parseSSEChunk, theoFetch, useAgentStream };

package/dist/{cloudflare-IZ6VJ2OU.js → cloudflare-U5GYYI47.js}

@@ -2,11 +2,11 @@
 import "tsx/esm";
 import {
   nodeAdapter
-} from "./chunk-MWYSRZI4.js";
+} from "./chunk-EQV67HZL.js";
 import {
   assertServicesUnsupported,
   readManifest
-} from "./chunk-X32KQH5C.js";
+} from "./chunk-CCVC6P6B.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/adapters/cloudflare.ts
@@ -120,4 +120,4 @@ export {
   renderCloudflareWorkerEntry,
   renderWranglerToml
 };
-//# sourceMappingURL=cloudflare-IZ6VJ2OU.js.map
+//# sourceMappingURL=cloudflare-U5GYYI47.js.map

package/dist/db-ZPDW3UCU.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import "./chunk-KT3MWNZG.js";
+
+// src/cli/commands/db.ts
+import { execSync } from "child_process";
+import { existsSync } from "fs";
+import { resolve } from "path";
+var VALID_ACTIONS = /* @__PURE__ */ new Set(["migrate", "generate", "seed"]);
+function assertFileExists(cwd, relPath, hint) {
+  if (!existsSync(resolve(cwd, relPath))) {
+    throw new Error(`${relPath} not found. ${hint}`);
+  }
+}
+function assertBinExists(cwd, bin) {
+  const binPath = resolve(cwd, "node_modules", ".bin", bin);
+  if (!existsSync(binPath)) {
+    throw new Error(`${bin} not found. Run: npm install -D ${bin}`);
+  }
+}
+function dbCommand(action, cwd) {
+  if (!VALID_ACTIONS.has(action)) {
+    return {
+      status: "invalid_action",
+      message: `Unknown db action "${action}". Available: ${[...VALID_ACTIONS].join(", ")}`
+    };
+  }
+  const dbAction = action;
+  try {
+    switch (dbAction) {
+      case "migrate": {
+        assertFileExists(cwd, "drizzle.config.ts", "Create a drizzle.config.ts for your project.");
+        assertBinExists(cwd, "drizzle-kit");
+        console.log("\n  \u25B8 Running drizzle-kit push...\n");
+        execSync("npx drizzle-kit push", { cwd, stdio: "inherit" });
+        return { status: "success", message: "Database migrated successfully", action: dbAction };
+      }
+      case "generate": {
+        assertFileExists(cwd, "drizzle.config.ts", "Create a drizzle.config.ts for your project.");
+        assertBinExists(cwd, "drizzle-kit");
+        console.log("\n  \u25B8 Running drizzle-kit generate...\n");
+        execSync("npx drizzle-kit generate", { cwd, stdio: "inherit" });
+        return {
+          status: "success",
+          message: "Migration files generated in drizzle/",
+          action: dbAction
+        };
+      }
+      case "seed": {
+        assertFileExists(cwd, "server/db/seed.ts", "Create server/db/seed.ts with your seed data.");
+        console.log("\n  \u25B8 Running seed...\n");
+        execSync("npx tsx server/db/seed.ts", { cwd, stdio: "inherit" });
+        return { status: "success", message: "Database seeded successfully", action: dbAction };
+      }
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { status: "error", message: msg, action: dbAction };
+  }
+}
+function dbCommandCli(action) {
+  const result = dbCommand(action, process.cwd());
+  if (result.status === "success") {
+    console.log(`
+  \u2713 ${result.message}
+`);
+  } else {
+    console.error(`
+  \u2717 ${result.message}
+`);
+    process.exit(1);
+  }
+}
+export {
+  dbCommand,
+  dbCommandCli
+};
+//# sourceMappingURL=db-ZPDW3UCU.js.map

package/dist/db-ZPDW3UCU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/db.ts"],"sourcesContent":["import { execSync } from 'node:child_process'\nimport { existsSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nexport type DbAction = 'migrate' | 'generate' | 'seed'\n\nconst VALID_ACTIONS = new Set<DbAction>(['migrate', 'generate', 'seed'])\n\nexport interface DbCommandResult {\n  status: 'success' | 'error' | 'invalid_action'\n  message: string\n  action?: DbAction\n}\n\nfunction assertFileExists(cwd: string, relPath: string, hint: string): void {\n  if (!existsSync(resolve(cwd, relPath))) {\n    throw new Error(`${relPath} not found. ${hint}`)\n  }\n}\n\nfunction assertBinExists(cwd: string, bin: string): void {\n  const binPath = resolve(cwd, 'node_modules', '.bin', bin)\n  if (!existsSync(binPath)) {\n    throw new Error(`${bin} not found. Run: npm install -D ${bin}`)\n  }\n}\n\nexport function dbCommand(action: string, cwd: string): DbCommandResult {\n  if (!VALID_ACTIONS.has(action as DbAction)) {\n    return {\n      status: 'invalid_action',\n      message: `Unknown db action \"${action}\". Available: ${[...VALID_ACTIONS].join(', ')}`,\n    }\n  }\n\n  const dbAction = action as DbAction\n\n  try {\n    switch (dbAction) {\n      case 'migrate': {\n        assertFileExists(cwd, 'drizzle.config.ts', 'Create a drizzle.config.ts for your project.')\n        assertBinExists(cwd, 'drizzle-kit')\n        console.log('\\n  ▸ Running drizzle-kit push...\\n')\n        execSync('npx drizzle-kit push', { cwd, stdio: 'inherit' })\n        return { status: 'success', message: 'Database migrated successfully', action: dbAction }\n      }\n      case 'generate': {\n        assertFileExists(cwd, 'drizzle.config.ts', 'Create a drizzle.config.ts for your project.')\n        assertBinExists(cwd, 'drizzle-kit')\n        console.log('\\n  ▸ Running drizzle-kit generate...\\n')\n        execSync('npx drizzle-kit generate', { cwd, stdio: 'inherit' })\n        return {\n          status: 'success',\n          message: 'Migration files generated in drizzle/',\n          action: dbAction,\n        }\n      }\n      case 'seed': {\n        assertFileExists(cwd, 'server/db/seed.ts', 'Create server/db/seed.ts with your seed data.')\n        console.log('\\n  ▸ Running seed...\\n')\n        execSync('npx tsx server/db/seed.ts', { cwd, stdio: 'inherit' })\n        return { status: 'success', message: 'Database seeded successfully', action: dbAction }\n      }\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err)\n    return { status: 'error', message: msg, action: dbAction }\n  }\n}\n\nexport function dbCommandCli(action: string): void {\n  const result = dbCommand(action, process.cwd())\n  if (result.status === 'success') {\n    console.log(`\\n  ✓ ${result.message}\\n`)\n  } else {\n    console.error(`\\n  ✗ ${result.message}\\n`)\n    process.exit(1)\n  }\n}\n"],"mappings":";;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AAIxB,IAAM,gBAAgB,oBAAI,IAAc,CAAC,WAAW,YAAY,MAAM,CAAC;AAQvE,SAAS,iBAAiB,KAAa,SAAiB,MAAoB;AAC1E,MAAI,CAAC,WAAW,QAAQ,KAAK,OAAO,CAAC,GAAG;AACtC,UAAM,IAAI,MAAM,GAAG,OAAO,eAAe,IAAI,EAAE;AAAA,EACjD;AACF;AAEA,SAAS,gBAAgB,KAAa,KAAmB;AACvD,QAAM,UAAU,QAAQ,KAAK,gBAAgB,QAAQ,GAAG;AACxD,MAAI,CAAC,WAAW,OAAO,GAAG;AACxB,UAAM,IAAI,MAAM,GAAG,GAAG,mCAAmC,GAAG,EAAE;AAAA,EAChE;AACF;AAEO,SAAS,UAAU,QAAgB,KAA8B;AACtE,MAAI,CAAC,cAAc,IAAI,MAAkB,GAAG;AAC1C,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,sBAAsB,MAAM,iBAAiB,CAAC,GAAG,aAAa,EAAE,KAAK,IAAI,CAAC;AAAA,IACrF;AAAA,EACF;AAEA,QAAM,WAAW;AAEjB,MAAI;AACF,YAAQ,UAAU;AAAA,MAChB,KAAK,WAAW;AACd,yBAAiB,KAAK,qBAAqB,8CAA8C;AACzF,wBAAgB,KAAK,aAAa;AAClC,gBAAQ,IAAI,0CAAqC;AACjD,iBAAS,wBAAwB,EAAE,KAAK,OAAO,UAAU,CAAC;AAC1D,eAAO,EAAE,QAAQ,WAAW,SAAS,kCAAkC,QAAQ,SAAS;AAAA,MAC1F;AAAA,MACA,KAAK,YAAY;AACf,yBAAiB,KAAK,qBAAqB,8CAA8C;AACzF,wBAAgB,KAAK,aAAa;AAClC,gBAAQ,IAAI,8CAAyC;AACrD,iBAAS,4BAA4B,EAAE,KAAK,OAAO,UAAU,CAAC;AAC9D,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,KAAK,QAAQ;AACX,yBAAiB,KAAK,qBAAqB,+CAA+C;AAC1F,gBAAQ,IAAI,8BAAyB;AACrC,iBAAS,6BAA6B,EAAE,KAAK,OAAO,UAAU,CAAC;AAC/D,eAAO,EAAE,QAAQ,WAAW,SAAS,gCAAgC,QAAQ,SAAS;AAAA,MACxF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,WAAO,EAAE,QAAQ,SAAS,SAAS,KAAK,QAAQ,SAAS;AAAA,EAC3D;AACF;AAEO,SAAS,aAAa,QAAsB;AACjD,QAAM,SAAS,UAAU,QAAQ,QAAQ,IAAI,CAAC;AAC9C,MAAI,OAAO,WAAW,WAAW;AAC/B,YAAQ,IAAI;AAAA,WAAS,OAAO,OAAO;AAAA,CAAI;AAAA,EACzC,OAAO;AACL,YAAQ,MAAM;AAAA,WAAS,OAAO,OAAO;AAAA,CAAI;AACzC,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":[]}

package/dist/{deno-deploy-O73NBXIW.js → deno-deploy-3QHJ3AJQ.js}

@@ -2,11 +2,11 @@
 import "tsx/esm";
 import {
   nodeAdapter
-} from "./chunk-MWYSRZI4.js";
+} from "./chunk-EQV67HZL.js";
 import {
   assertServicesUnsupported,
   readManifest
-} from "./chunk-X32KQH5C.js";
+} from "./chunk-CCVC6P6B.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/adapters/deno-deploy.ts
@@ -105,4 +105,4 @@ export {
   denoDeployAdapter,
   renderDenoEntry
 };
-//# sourceMappingURL=deno-deploy-O73NBXIW.js.map
+//# sourceMappingURL=deno-deploy-3QHJ3AJQ.js.map

package/dist/{dev-ZU46C5AZ.js → dev-NDEZA2MP.js}

@@ -2,26 +2,28 @@
 import "tsx/esm";
 import {
   validateProjectStructure
-} from "./chunk-XMS5VRIK.js";
+} from "./chunk-JQSFBJR5.js";
 import {
   preflightNodeAndBindings
 } from "./chunk-HNBWZKIQ.js";
 import {
   theoPluginAsync
-} from "./chunk-JD7AQNJS.js";
-import "./chunk-S74FECKW.js";
+} from "./chunk-4I47JW5O.js";
+import "./chunk-PBEH6NXR.js";
 import {
   loadConfig,
   loadEnv
-} from "./chunk-DUKXQNM7.js";
-import "./chunk-FGOX37NB.js";
+} from "./chunk-IHMJV2OK.js";
+import "./chunk-CBGRFVF5.js";
+import "./chunk-MV4LKTW6.js";
+import "./chunk-BNGBG2SQ.js";
 import {
   orchestrateDev
-} from "./chunk-X32KQH5C.js";
+} from "./chunk-CCVC6P6B.js";
 import "./chunk-5ODOE6EF.js";
-import "./chunk-CG563V5M.js";
-import "./chunk-P2RS3WWY.js";
-import "./chunk-UVHRD33F.js";
+import "./chunk-IEES3CHD.js";
+import "./chunk-3LVRAGAZ.js";
+import "./chunk-6FYD34NX.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/cli/commands/dev.ts
@@ -59,7 +61,15 @@ async function startDevServer(cwd, options) {
     server = await createServer({
       root: cwd,
       plugins: [react(), ...theoPlugins],
-      server: { port },
+      server: {
+        port,
+        host: config.host,
+        open: config.open,
+        strictPort: config.strictPort,
+        warmup: config.warmup ?? {
+          clientFiles: ["./app/**/*.tsx", "./app/**/*.ts"]
+        }
+      },
       logLevel: options?.port === 0 ? "silent" : void 0
     });
     await server.listen();
@@ -89,4 +99,4 @@ export {
   devCommand,
   startDevServer
 };
-//# sourceMappingURL=dev-ZU46C5AZ.js.map
+//# sourceMappingURL=dev-NDEZA2MP.js.map

package/dist/dev-NDEZA2MP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/dev.ts"],"sourcesContent":["import react from '@vitejs/plugin-react'\nimport { createServer, type Plugin, type ViteDevServer } from 'vite'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { loadEnv } from '../../config/load-env.js'\nimport { validateProjectStructure } from '../../config/validate-structure.js'\nimport { orchestrateDev } from '../../services/index.js'\nimport { theoPluginAsync } from '../../vite-plugin/index.js'\nimport { preflightNodeAndBindings } from '../preflight-node-version.js'\n\ninterface DevOptions {\n  port?: number\n}\n\nexport async function startDevServer(cwd: string, options?: DevOptions): Promise<ViteDevServer> {\n  // Preflight (FIRST — BEFORE anything that touches native bindings):\n  // verifies Node version + native binding ABI match. Emits actionable\n  // error referencing `nvm use` + `pnpm rebuild` when the dev server\n  // was spawned under the wrong Node (common gotcha with `nohup env ...`\n  // stripping the nvm PATH prefix).\n  preflightNodeAndBindings(cwd)\n\n  // Phase 1 (T1.2) — Load .env files into process.env BEFORE any module\n  // reads them. Must run before loadConfig() so theo.config.ts functions\n  // referencing process.env.* resolve correctly.\n  loadEnv({ cwd, mode: 'development' })\n\n  const config = await loadConfig(cwd)\n  validateProjectStructure(cwd)\n\n  // Wave 2 (T1.1) — spawn polyglot services BEFORE Vite. Healthcheck gates\n  // readiness. Empty `services: {}` → early return (Wave 1 BC preserved).\n  const orchestration = await orchestrateDev({\n    cwd,\n    services: config.services,\n  })\n  if (!orchestration.allHealthy) {\n    await orchestration.stop()\n    throw new Error(\n      `[services] services failed healthcheck: ${orchestration.unhealthy.join(', ')}. ` +\n        `Check that each declared service binds its port and responds 200 on its ` +\n        `healthcheck path within 30s.`,\n    )\n  }\n\n  // Phase 7 — legacy fs-mtime sweep removed: SDK's Agent.registry handles\n  // LRU + idle eviction natively (configurable via theo.config.ts >\n  // agents.registry; lazy-configured on first request).\n\n  const port = options?.port ?? config.port\n  // Narrow the rateLimit union: only the legacy flat shape (windowMs+max)\n  // flows into the theoPlugin's RateLimitConfig parameter. The per-route\n  // variant is consumed inside the api-middleware via the loaded user\n  // config separately.\n  const flatRateLimit =\n    config.rateLimit && 'windowMs' in config.rateLimit && 'max' in config.rateLimit\n      ? config.rateLimit\n      : undefined\n  // theoPluginAsync auto-chains @theokit/ui + @tailwindcss/vite via\n  // top-level Plugin[] return (sync `theoPlugin()` factory's config()\n  // hook returning {plugins:[...]} is silently dropped by Vite — see\n  // commit history). Spread the result so Vite flattens them.\n  let server: ViteDevServer\n  try {\n    const theoPlugins = await theoPluginAsync({\n      root: cwd,\n      rateLimit: flatRateLimit,\n      ssr: config.ssr,\n      // Wave 2 (T3.1) — wire typed-client plugin when services declared.\n      services: config.services,\n      // T4.1 (canvas-ecosystem-refactor / ADR D6) — passthrough peer-deps\n      // that plugins import dynamically (e.g., mermaid via plugin-canvas).\n      viteOptimizeDeps: config.viteOptimizeDeps,\n    })\n    server = await createServer({\n      root: cwd,\n      plugins: [react(), ...theoPlugins] as Plugin[],\n      server: {\n        port,\n        host: config.host,\n        open: config.open,\n        strictPort: config.strictPort,\n        warmup: config.warmup ?? {\n          clientFiles: ['./app/**/*.tsx', './app/**/*.ts'],\n        },\n      },\n      logLevel: options?.port === 0 ? 'silent' : undefined,\n    })\n\n    await server.listen()\n  } catch (err) {\n    // EC-1 / try-finally pattern: if Vite create/listen fails AFTER services\n    // started, stop them so we don't leak child processes.\n    await orchestration.stop()\n    throw err\n  }\n\n  // EC-1 fix: attach orchestration.stop() to the underlying HTTP server's\n  // close event via Node-native API. We do NOT mutate `server.close`\n  // (fragile across Vite upgrades). httpServer is `http.Server | null`.\n  server.httpServer?.on('close', () => {\n    void orchestration.stop()\n  })\n\n  return server\n}\n\nexport async function devCommand(options: DevOptions): Promise<void> {\n  try {\n    const cwd = process.cwd()\n    const server = await startDevServer(cwd, options)\n    server.printUrls()\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err)\n    console.error(`\\n  ✗ ${msg}\\n`)\n    process.exit(1)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,WAAW;AAClB,SAAS,oBAAqD;AAa9D,eAAsB,eAAe,KAAa,SAA8C;AAM9F,2BAAyB,GAAG;AAK5B,UAAQ,EAAE,KAAK,MAAM,cAAc,CAAC;AAEpC,QAAM,SAAS,MAAM,WAAW,GAAG;AACnC,2BAAyB,GAAG;AAI5B,QAAM,gBAAgB,MAAM,eAAe;AAAA,IACzC;AAAA,IACA,UAAU,OAAO;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,cAAc,YAAY;AAC7B,UAAM,cAAc,KAAK;AACzB,UAAM,IAAI;AAAA,MACR,2CAA2C,cAAc,UAAU,KAAK,IAAI,CAAC;AAAA,IAG/E;AAAA,EACF;AAMA,QAAM,OAAO,SAAS,QAAQ,OAAO;AAKrC,QAAM,gBACJ,OAAO,aAAa,cAAc,OAAO,aAAa,SAAS,OAAO,YAClE,OAAO,YACP;AAKN,MAAI;AACJ,MAAI;AACF,UAAM,cAAc,MAAM,gBAAgB;AAAA,MACxC,MAAM;AAAA,MACN,WAAW;AAAA,MACX,KAAK,OAAO;AAAA;AAAA,MAEZ,UAAU,OAAO;AAAA;AAAA;AAAA,MAGjB,kBAAkB,OAAO;AAAA,IAC3B,CAAC;AACD,aAAS,MAAM,aAAa;AAAA,MAC1B,MAAM;AAAA,MACN,SAAS,CAAC,MAAM,GAAG,GAAG,WAAW;AAAA,MACjC,QAAQ;AAAA,QACN;AAAA,QACA,MAAM,OAAO;AAAA,QACb,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO,UAAU;AAAA,UACvB,aAAa,CAAC,kBAAkB,eAAe;AAAA,QACjD;AAAA,MACF;AAAA,MACA,UAAU,SAAS,SAAS,IAAI,WAAW;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,OAAO;AAAA,EACtB,SAAS,KAAK;AAGZ,UAAM,cAAc,KAAK;AACzB,UAAM;AAAA,EACR;AAKA,SAAO,YAAY,GAAG,SAAS,MAAM;AACnC,SAAK,cAAc,KAAK;AAAA,EAC1B,CAAC;AAED,SAAO;AACT;AAEA,eAAsB,WAAW,SAAoC;AACnE,MAAI;AACF,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,SAAS,MAAM,eAAe,KAAK,OAAO;AAChD,WAAO,UAAU;AAAA,EACnB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":[]}