theokit 0.50.0 → 0.50.2

package/dist/chunk-BND4YZTQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/body-parser.ts","../src/server/observability/request-log.ts","../src/server/observability/logger.ts","../src/server/http/trace-context.ts"],"mappings":";;;;;AACA,SAAS,gBAAgB;AAEzB,OAAO,YAAY;AA2CnB,IAAM,oBAAoB,oBAAI,IAAI,CAAC,QAAQ,OAAO,OAAO,CAAC;AAE1D,IAAM,wBAAwB,KAAK,OAAO;AAC1C,IAAM,oBAAoB;AAC1B,IAAM,yBAAyB,IAAI,OAAO;AAenC,IAAM,2BAAN,cAAuC,MAAM;AAAA,EACzC,OAAO;AAAA,EACP,SAAS;AAAA,EAClB,YAAY,QAAgB,KAAyB;AACnD;AAAA,MACE,oBAAoB,MAAM,IAAI,OAAO,eAAe;AAAA,IAItD;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAOA,SAAS,kBAAkB,KAA+B;AACxD,UAAQ,IAAI,QAAQ,gBAAgB,KAAK,QAAQ;AACnD;AAWA,SAAS,oBAAoB,KAA+B;AAC1D,SAAO,IAAI,iBAAiB,CAAC,kBAAkB,GAAG;AACpD;AAEO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAG3C,YACE,SACS,oBACA,aACT;AACA,UAAM,OAAO;AAHJ;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAAA,EACA;AAAA,EALF,OAAO;AAAA,EACP,SAAS;AASpB;AASA,SAAS,iBAAiB,KAAsB,MAAqB;AACnE,MAAI;AACF;AAAC,IAAC,IAA2C,qBAAqB,IAAI;AAAA,EACxE,QAAQ;AAAA,EAER;AACF;AAGA,SAAS,cAAc,KAA2E;AAChG,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAItC,QAAI,IAAI,eAAe;AACrB,UAAI,kBAAkB,GAAG,GAAG;AAC1B,gBAAQ,MAAS;AACjB;AAAA,MACF;AACA,aAAO,IAAI,yBAAyB,IAAI,UAAU,QAAQ,IAAI,GAAG,CAAC;AAClE;AAAA,IACF;AACA,UAAM,SAAmB,CAAC;AAC1B,QAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,QAAI,GAAG,OAAO,MAAM;AAClB,YAAM,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS;AAC3C,UAAI,CAAC,KAAK;AACR,gBAAQ,MAAS;AACjB;AAAA,MACF;AACA,UAAI;AACF,gBAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,GAAG,IAAI,CAAC;AAAA,MACxC,QAAQ;AACN,eAAO,IAAI,MAAM,mBAAmB,CAAC;AAAA,MACvC;AAAA,IACF,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAIA,SAAS,mBACP,KACA,aACA,SAC+E;AAE/E,MAAI,CAAC,YAAY,SAAS,WAAW,GAAG;AACtC,WAAO,QAAQ,OAAO,IAAI,MAAM,4BAA4B,CAAC;AAAA,EAC/D;AAMA,MAAI,oBAAoB,GAAG,GAAG;AAC5B,WAAO,QAAQ,OAAO,IAAI,yBAAyB,IAAI,UAAU,QAAQ,IAAI,GAAG,CAAC;AAAA,EACnF;AAEA,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAA4C,CAAC;AACnD,UAAM,QAAwB,CAAC;AAK/B,UAAM,qBAA+B,CAAC;AACtC,QAAI,YAAY;AAEhB,UAAM,KAAK,OAAO;AAAA,MAChB,SAAS,IAAI;AAAA,MACb,QAAQ;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,MACrB;AAAA,IACF,CAAC;AAED,OAAG,GAAG,SAAS,CAAC,MAAc,UAAkB;AAC9C,kBAAY,QAAQ,MAAM,KAAK;AAAA,IACjC,CAAC;AAED,OAAG;AAAA,MACD;AAAA,MACA,CACE,WACA,QACA,SACG;AACH;AACA,YAAI,YAAY,QAAQ,UAAU;AAChC,iBAAO,OAAO;AACd;AAAA,QACF;AAGA,cAAM,WAAW,SAAS,KAAK,YAAY,SAAS;AACpD,cAAM,SAAmB,CAAC;AAC1B,YAAI,OAAO;AACX,YAAI,YAAY;AAEhB,eAAO,GAAG,QAAQ,CAAC,UAAkB;AACnC,kBAAQ,MAAM;AACd,cAAI,OAAO,QAAQ,aAAa;AAC9B,wBAAY;AACZ,mBAAO,OAAO;AACd;AAAA,UACF;AACA,iBAAO,KAAK,KAAK;AAAA,QACnB,CAAC;AAED,eAAO,GAAG,OAAO,MAAM;AACrB,cAAI,WAAW;AACb,+BAAmB,KAAK,QAAQ;AAChC;AAAA,UACF;AAEA,gBAAM,SAAS,OAAO,OAAO,MAAM;AACnC,gBAAM,KAAK;AAAA,YACT;AAAA,YACA,UAAU;AAAA,YACV,UAAU,KAAK;AAAA,YACf,UAAU,KAAK;AAAA,YACf;AAAA,YACA,MAAM,OAAO;AAAA,UACf,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AAEA,OAAG,GAAG,cAAc,MAAM;AACxB,aAAO,IAAI,MAAM,4BAA4B,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAClE,CAAC;AAED,OAAG,GAAG,SAAS,CAAC,QAAe;AAC7B,aAAO,GAAG;AAAA,IACZ,CAAC;AAED,OAAG,GAAG,SAAS,MAAM;AACnB,UAAI,mBAAmB,SAAS,GAAG;AACjC;AAAA,UACE,IAAI;AAAA,YACF,uBAAuB,QAAQ,WAAW,YAAY,mBAAmB,KAAK,IAAI,CAAC;AAAA,YACnF;AAAA,YACA,QAAQ;AAAA,UACV;AAAA,QACF;AACA;AAAA,MACF;AACA,cAAQ,EAAE,QAAQ,MAAM,CAAC;AAAA,IAC3B,CAAC;AAED,QAAI,KAAK,EAAE;AAAA,EACb,CAAC;AACH;AAUO,IAAM,wBAAwB,uBAAO,2BAA2B;AAQvE,eAAe,iBAAiB,KAA2C;AACzE,QAAM,SAAS,MAAM,cAAc,GAAG;AACtC,mBAAiB,KAAK,QAAQ,IAAI;AAClC,SAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,GAAG,MAAM,QAAQ,MAAM,KAAK,QAAQ,IAAI;AACvE;AAEA,eAAsB,iBACpB,KACA,SACqB;AACrB,QAAM,SAAS,IAAI,QAAQ,YAAY,KAAK;AAC5C,MAAI,CAAC,kBAAkB,IAAI,MAAM,GAAG;AAClC,WAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,GAAG,MAAM,OAAU;AAAA,EAClD;AAEA,QAAM,cAAc,IAAI,QAAQ,cAAc,KAAK;AAGnD,MAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,WAAO,MAAM,iBAAiB,GAAG;AAAA,EACnC;AAGA,MAAI,YAAY,SAAS,qBAAqB,GAAG;AAC/C,UAAM,SAAS;AAAA,MACb,aAAa,SAAS,eAAe;AAAA,MACrC,UAAU,SAAS,YAAY;AAAA,MAC/B,cAAc,SAAS,gBAAgB;AAAA,IACzC;AACA,UAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,mBAAmB,KAAK,aAAa,MAAM;AAC3E,qBAAiB,KAAK;AAAA,MACpB;AAAA,MACA,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,QACvB,WAAW,EAAE;AAAA,QACb,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,MAAM,EAAE;AAAA,MACV,EAAE;AAAA,IACJ,CAAC;AACD,WAAO,EAAE,QAAQ,MAAM;AAAA,EACzB;AAGA,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,EAAE;AAAA,EACjC;AAGA,QAAM,IAAI,MAAM,6BAA6B,WAAW,EAAE;AAC5D;;;AC7TA,IAAM,kBAA4B,CAAC,QAAQ;AAEzC,UAAQ,IAAI,KAAK,UAAU,GAAG,CAAC;AACjC;AAEO,SAAS,WACd,MACA,cACA,KACM;AACN,QAAM,MAAkB;AAAA,IACtB,OAAO;AAAA,IACP,GAAG;AAAA,IACH,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,SAAS,gBAAgB;AAC/B,SAAO,GAAG;AAMV,6BAA2B,MAAM,GAAG;AACtC;AAOA,SAAS,kBAA0B;AAEjC,SAAO,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAC5E;AAUA,SAAS,wBACP,MACA,SACA,aACM;AACN,OAAK,QAAQ,IAAI;AAAA,IACf,OAAO,yBAAyC;AAAA,IAChD,OAAO,0CAA0D;AAAA,EACnE,CAAC,EACE,KAAK,CAAC,CAAC,EAAE,iBAAiB,GAAG,EAAE,wBAAwB,CAAC,MAAM;AAC7D,UAAM,WAAW,wBAAwB,WAAW;AACpD,qBAAiB;AAAA,MACf,IAAI,gBAAgB;AAAA,MACpB,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,MAC7B,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7B,GAAI,WACA;AAAA,QACE,aAAa,SAAS;AAAA,QACtB,YAAY,SAAS;AAAA,QACrB,eAAe,SAAS;AAAA,MAC1B,IACA,CAAC;AAAA,IACP,CAAC;AAAA,EACH,CAAC,EACA,MAAM,MAAM;AAAA,EAEb,CAAC;AACL;AAEA,SAAS,2BACP,MACA,KACM;AAEN,QAAM,UAAU,KAAK,UACjB,OAAO;AAAA,IACL,OAAO,QAAQ,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM;AAAA,MAC1C;AAAA,MACA,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,IAAK,KAAK;AAAA,IAC1C,CAAC;AAAA,EACH,IACA;AACJ,QAAM,cAAc,MACf,IAA2C,qBAAqB,IACjE;AACJ,0BAAwB,MAAM,SAAS,WAAW;AACpD;;;ACnGA,IAAM,cAAsC;AAAA,EAC1C,OAAO;AAAA,EACP,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO;AAAA,EACP,QAAQ;AACV;AAEA,SAAS,UAAU,UAAkB,aAA8B;AACjE,SAAO,YAAY,QAAQ,KAAK,YAAY,WAAW;AACzD;AAIA,SAAS,cAAc,KAA0B;AAE/C,UAAQ,IAAI,KAAK,UAAU,GAAG,CAAC;AACjC;AAIO,SAAS,aAAa,SAId;AACb,QAAM,QAAQ,SAAS,SAAS;AAChC,QAAM,SAAS,SAAS,UAAU;AAClC,QAAM,cAAc,SAAS,WAAW,CAAC;AAEzC,WAAS,IAAI,UAAkB,KAAa,SAAyC;AACnF,QAAI,CAAC,UAAU,UAAU,KAAK,EAAG;AAEjC,UAAM,QAAuB;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,GAAG;AAAA,MACH,GAAG;AAAA,IACL;AAGA,QAAI,MAAM,iBAAiB,OAAO;AAChC,YAAM,QAAQ,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,IACjD;AAEA,WAAO,KAAK;AAAA,EACd;AAEA,SAAO;AAAA,IACL,OAAO,CAAC,KAAK,QAAQ;AACnB,UAAI,SAAS,KAAK,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,CAAC,KAAK,QAAQ;AAClB,UAAI,QAAQ,KAAK,GAAG;AAAA,IACtB;AAAA,IACA,MAAM,CAAC,KAAK,QAAQ;AAClB,UAAI,QAAQ,KAAK,GAAG;AAAA,IACtB;AAAA,IACA,OAAO,CAAC,KAAK,QAAQ;AACnB,UAAI,SAAS,KAAK,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,KAAK;AACT,aAAO,aAAa;AAAA,QAClB;AAAA,QACA;AAAA,QACA,SAAS,EAAE,GAAG,aAAa,GAAG,IAAI;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAcA,IAAM,gBAAgB,oBAAI,IAAY;AACtC,IAAM,WAAW;AAKV,SAAS,yBAA+B;AAC7C,gBAAc,MAAM;AACtB;AAYO,SAAS,SAAS,KAAa,SAAwC;AAC5E,MAAI,cAAc,IAAI,GAAG,EAAG;AAE5B,MAAI,cAAc,QAAQ,UAAU;AAClC,UAAM,SAAS,cAAc,OAAO,EAAE,KAAK,EAAE;AAC7C,QAAI,WAAW,OAAW,eAAc,OAAO,MAAM;AAAA,EACvD;AACA,gBAAc,IAAI,GAAG;AAErB,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,UAAU,EAAE,GAAG,SAAS,UAAU,KAAK,CAAC;AAAA,EACtD,QAAQ;AAGN,WAAO,cAAc,GAAG;AAAA,EAC1B;AACA,UAAQ,KAAK,IAAI;AAKjB,8BAA4B,KAAK,OAAO;AAC1C;AAWA,SAAS,aAAa,SAAkC,KAAa,WAAW,IAAY;AAC1F,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,SAAO;AACT;AAEA,SAAS,mBAA2B;AAElC,SAAO,QAAQ,OAAO,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAC7E;AAEA,SAAS,4BAA4B,KAAa,SAAwC;AAGxF,OAAK,OAAO,yBAAyC,EAClD,KAAK,CAAC,EAAE,mBAAmB,eAAe,MAAM;AAC/C,QACE,QAAQ,UAAU,eAClB,OAAO,QAAQ,SAAS,YACxB,OAAO,QAAQ,YAAY,UAC3B;AACA,wBAAkB;AAAA,QAChB,OAAO;AAAA,QACP,MAAM,QAAQ;AAAA,QACd,SAAS,QAAQ;AAAA,QACjB,QAAQ,aAAa,SAAS,QAAQ;AAAA,QACtC,MAAM,aAAa,SAAS,MAAM;AAAA,QAClC,QAAQ,aAAa,SAAS,QAAQ;AAAA,MACxC,CAAC;AAAA,IACH,OAAO;AACL,qBAAe;AAAA,QACb,IAAI,iBAAiB;AAAA,QACrB,MAAM;AAAA,QACN,SAAS,aAAa,SAAS,SAAS,GAAG;AAAA,QAC3C,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF,CAAC,EACA,MAAM,MAAM;AAAA,EAEb,CAAC;AACL;;;ACnLO,IAAM,eAAe;AACrB,IAAM,sBAAsB;AACnC,IAAM,oBAAoB;AAG1B,IAAM,iBAAiB;AA4BhB,SAAS,wBAAwB,OAAuC;AAC7E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,IAAI,eAAe,KAAK,KAAK;AACnC,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,UAAU,EAAE,CAAC;AAEnB,MAAI,OAAO,KAAK,OAAO,EAAG,QAAO;AACjC,QAAM,eAAe,EAAE,CAAC;AAIxB,SAAO,OAAO,KAAK,YAAY,IAAI,EAAE,QAAQ,IAAI,EAAE,SAAS,aAAa;AAC3E;AAOO,SAAS,iBAAiB,OAA8B;AAC7D,SAAO,wBAAwB,KAAK,GAAG,WAAW;AACpD;AAgBA,IAAM,gBAAgB;AAEtB,SAAS,mBAAmB,OAAwB;AAClD,SAAO,cAAc,KAAK,KAAK;AACjC;AAWA,SAAS,WACP,OACA,YAA4C,MAAM,MACnC;AACf,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,KAAK,OAAO;AACrB,UAAI,OAAO,MAAM,YAAY,EAAE,SAAS,KAAK,UAAU,CAAC,EAAG,QAAO;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,UAAU,KAAK,EAAG,QAAO;AAC9E,SAAO;AACT;AAMA,SAAS,0BAA0B,aAA4B,WAAkC;AAC/F,MAAI,gBAAgB,MAAM;AACxB,UAAM,SAAS,iBAAiB,WAAW;AAC3C,QAAI,WAAW,KAAM,QAAO;AAAA,EAC9B;AACA,MAAI,cAAc,KAAM,QAAO;AAC/B,SAAO,WAAW,OAAO,WAAW;AACtC;AAKO,SAAS,eAAe,KAA8B;AAC3D,SAAO;AAAA,IACL,WAAW,IAAI,QAAQ,mBAAmB,CAAC;AAAA,IAC3C,WAAW,IAAI,QAAQ,iBAAiB,GAAG,kBAAkB;AAAA,EAC/D;AACF;AAmCO,SAAS,uBAAuB,SAA+C;AACpF,QAAM,cAAc,QAAQ,QAAQ,IAAI,mBAAmB;AAC3D,MAAI,gBAAgB,KAAM,QAAO;AACjC,SAAO,wBAAwB,WAAW,KAAK;AACjD;AAEO,SAAS,0BAA0B,SAA0B;AAClE,QAAM,YAAY,QAAQ,QAAQ,IAAI,iBAAiB;AACvD,SAAO;AAAA,IACL,QAAQ,QAAQ,IAAI,mBAAmB;AAAA;AAAA;AAAA,IAGvC,cAAc,QAAQ,mBAAmB,SAAS,IAAI,YAAY;AAAA,EACpE;AACF;","names":[]}

package/dist/{chunk-2AMLGJJA.js → chunk-C27VRUVN.js}

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 import "tsx/esm";
+import {
+  appendField
+} from "./chunk-7UZZHCRN.js";
 
 // src/server/body-parser.ts
 import { basename } from "path";
@@ -62,7 +65,7 @@ function parseJsonBody(req) {
         return;
       }
       try {
-        resolve(JSON.parse(raw));
+        resolve({ json: JSON.parse(raw), raw });
       } catch {
         reject(new Error("Invalid JSON body"));
       }
@@ -91,7 +94,7 @@ function parseMultipartBody(req, contentType, options) {
       }
     });
     bb.on("field", (name, value) => {
-      fields[name] = value;
+      appendField(fields, name, value);
     });
     bb.on(
       "file",
@@ -154,6 +157,11 @@ function parseMultipartBody(req, contentType, options) {
   });
 }
 var DEVTOOLS_BODY_PREVIEW = /* @__PURE__ */ Symbol("theo:devtools:bodyPreview");
+async function parseJsonRequest(req) {
+  const parsed = await parseJsonBody(req);
+  stashBodyPreview(req, parsed?.json);
+  return { fields: {}, files: [], json: parsed?.json, raw: parsed?.raw };
+}
 async function parseRequestBody(req, options) {
   const method = req.method?.toUpperCase() ?? "GET";
   if (!METHODS_WITH_BODY.has(method)) {
@@ -161,9 +169,7 @@ async function parseRequestBody(req, options) {
   }
   const contentType = req.headers["content-type"] ?? "";
   if (contentType.includes("application/json")) {
-    const json = await parseJsonBody(req);
-    stashBodyPreview(req, json);
-    return { fields: {}, files: [], json };
+    return await parseJsonRequest(req);
   }
   if (contentType.includes("multipart/form-data")) {
     const limits = {
@@ -352,4 +358,4 @@ export {
   createLogger,
   warnOnce
 };
-//# sourceMappingURL=chunk-2AMLGJJA.js.map
+//# sourceMappingURL=chunk-C27VRUVN.js.map

package/dist/chunk-C27VRUVN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/body-parser.ts","../src/server/observability/request-log.ts","../src/server/observability/logger.ts"],"sourcesContent":["import type { IncomingMessage } from 'node:http'\nimport { basename } from 'node:path'\n\nimport Busboy from 'busboy'\n\nimport { appendField } from './multipart-fields.js'\n\n// --- Types ---\n\nexport interface UploadedFile {\n  fieldname: string\n  filename: string\n  encoding: string\n  mimeType: string\n  buffer: Buffer\n  size: number\n}\n\nexport interface ParsedBody {\n  fields: Record<string, string | string[]>\n  files: UploadedFile[]\n  json?: unknown\n  /**\n   * The exact bytes of a JSON body, as they arrived.\n   *\n   * Kept so the `Request` a route handler receives can carry a readable body. Without it\n   * `ctx.request` reaches the handler with no body at all, and any framework API that takes a\n   * `Request` and reads it — `handleChannelWebhook` among them — answers 400 on a request whose\n   * body was valid (usetheokit/theokit#445).\n   *\n   * The RAW bytes rather than the parsed value re-serialised, because every platform that signs a\n   * webhook computes its HMAC over what it sent: `JSON.stringify(JSON.parse(x))` moves key order,\n   * whitespace and number formatting, and would verify against nothing.\n   *\n   * Absent for multipart, where the parsed `fields`/`files` are the interface and the raw form has\n   * no second consumer, and absent when no body arrived.\n   */\n  raw?: string\n}\n\nexport interface BodyParserOptions {\n  maxFileSize?: number // bytes, default 10MB\n  maxFiles?: number // default 10\n  maxFieldSize?: number // bytes, default 1MB\n}\n\nconst METHODS_WITH_BODY = new Set(['POST', 'PUT', 'PATCH'])\n\nconst DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024 // 10MB\nconst DEFAULT_MAX_FILES = 10\nconst DEFAULT_MAX_FIELD_SIZE = 1 * 1024 * 1024 // 1MB\n\n/**\n * theokit#400 — the request body was consumed before the parser could read it.\n *\n * A Node `IncomingMessage` is a single-use stream. Once something drains it, `'end'` has fired and\n * cannot fire again, so a parser that attaches its listeners afterwards waits for an event that\n * will never come: the request hangs with no status, no error, and no timeout — the failure family\n * of `docs/adr/0002`, in its least readable form, since nothing terminates at all.\n *\n * That is a framework bug wherever it happens (a dispatcher converting the request before deciding\n * it owns the path, a middleware reading the stream and not passing the value on), so this reports\n * it by name instead of waiting. A 500 that says which request lost its body is recoverable\n * information; silence is not.\n */\nexport class RequestBodyConsumedError extends Error {\n  readonly code = 'REQUEST_BODY_CONSUMED'\n  readonly status = 500\n  constructor(method: string, url: string | undefined) {\n    super(\n      `Request body for ${method} ${url ?? '(unknown url)'} was already consumed before the body ` +\n        `parser ran, so it can never arrive. Something upstream read the request stream — a route ` +\n        `dispatcher, a middleware, or an adapter that converted the request — without passing the ` +\n        `parsed body on.`,\n    )\n    this.name = 'RequestBodyConsumedError'\n  }\n}\n\n/**\n * Was the request declared to carry no bytes at all? `content-length: 0` is the one case where an\n * already-ended stream is honestly empty rather than eaten, and it must stay an `undefined` body\n * instead of an error — an empty POST is legal.\n */\nfunction declaresEmptyBody(req: IncomingMessage): boolean {\n  return (req.headers['content-length'] ?? '') === '0'\n}\n\n/**\n * True once the stream has emitted `'end'` — which, at the moment the parser is about to attach,\n * means somebody else drained it. A stream nobody has read yet reports `false` here even when Node\n * has already buffered every byte, because `'end'` only fires on consumption.\n *\n * Read as a plain truthiness check on purpose: the type says `boolean`, but the suite's request\n * doubles are plain emitters carrying `headers` and no `readableEnded` at all, and `undefined` must\n * take the untouched-stream path exactly as `false` does.\n */\nfunction bodyAlreadyConsumed(req: IncomingMessage): boolean {\n  return req.readableEnded && !declaresEmptyBody(req)\n}\n\nexport class FileTooLargeError extends Error {\n  readonly code = 'FILE_TOO_LARGE'\n  readonly status = 413\n  constructor(\n    message: string,\n    readonly truncatedFilenames: string[],\n    readonly maxFileSize: number,\n  ) {\n    super(message)\n    this.name = 'FileTooLargeError'\n  }\n}\n\n// --- JSON parsing ---\n\n/**\n * Stash the parsed body on the IncomingMessage for the devtools forwarder\n * to read at log time. Symbol-keyed so it never leaks into user-visible\n * surfaces. Best-effort — failures (e.g. frozen req) are swallowed.\n */\nfunction stashBodyPreview(req: IncomingMessage, body: unknown): void {\n  try {\n    ;(req as unknown as Record<symbol, unknown>)[DEVTOOLS_BODY_PREVIEW] = body\n  } catch {\n    // best-effort; never break the request\n  }\n}\n\n/** The parsed JSON and the bytes it came from, or undefined when no body arrived. */\nfunction parseJsonBody(req: IncomingMessage): Promise<{ json: unknown; raw: string } | undefined> {\n  return new Promise((resolve, reject) => {\n    // theokit#400 — an ended stream re-emits nothing, so attaching here would wait forever. A\n    // declared-empty body resolves as the absent body it is; anything else was eaten upstream and\n    // is reported rather than awaited.\n    if (req.readableEnded) {\n      if (declaresEmptyBody(req)) {\n        resolve(undefined)\n        return\n      }\n      reject(new RequestBodyConsumedError(req.method ?? 'POST', req.url))\n      return\n    }\n    const chunks: Buffer[] = []\n    req.on('data', (chunk: Buffer) => chunks.push(chunk))\n    req.on('end', () => {\n      const raw = Buffer.concat(chunks).toString()\n      if (!raw) {\n        resolve(undefined)\n        return\n      }\n      try {\n        resolve({ json: JSON.parse(raw), raw })\n      } catch {\n        reject(new Error('Invalid JSON body'))\n      }\n    })\n    req.on('error', reject)\n  })\n}\n\n// --- Multipart parsing ---\n\nfunction parseMultipartBody(\n  req: IncomingMessage,\n  contentType: string,\n  options: Required<Pick<BodyParserOptions, 'maxFileSize' | 'maxFiles' | 'maxFieldSize'>>,\n): Promise<{ fields: Record<string, string | string[]>; files: UploadedFile[] }> {\n  // EC-3: Validate boundary exists.\n  if (!contentType.includes('boundary=')) {\n    return Promise.reject(new Error('Missing multipart boundary'))\n  }\n\n  // theokit#400 — the multipart arm fails differently and no better. Piping an already-drained\n  // stream into busboy rejects with `Unexpected end of form` (measured), which\n  // `parseQueryAndBody` maps to a 400 VALIDATION_ERROR: the caller is told to fix a request that\n  // was correct, and the framework's own mistake reads as theirs. Same cause, so the same name.\n  if (bodyAlreadyConsumed(req)) {\n    return Promise.reject(new RequestBodyConsumedError(req.method ?? 'POST', req.url))\n  }\n\n  return new Promise((resolve, reject) => {\n    const fields: Record<string, string | string[]> = {}\n    const files: UploadedFile[] = []\n    // CR-010: track filenames that were truncated mid-stream. The previous\n    // implementation skipped truncated files from `files` and relied on\n    // `files.some(f => f.size > maxFileSize)` to detect — but since the\n    // file was never added, the guard never fired. Silent data loss.\n    const truncatedFilenames: string[] = []\n    let fileCount = 0\n\n    const bb = Busboy({\n      headers: req.headers,\n      limits: {\n        fileSize: options.maxFileSize,\n        files: options.maxFiles,\n        fieldSize: options.maxFieldSize,\n      },\n    })\n\n    bb.on('field', (name: string, value: string) => {\n      appendField(fields, name, value)\n    })\n\n    bb.on(\n      'file',\n      (\n        fieldname: string,\n        stream: NodeJS.ReadableStream,\n        info: { filename: string; encoding: string; mimeType: string },\n      ) => {\n        fileCount++\n        if (fileCount > options.maxFiles) {\n          stream.resume() // drain\n          return\n        }\n\n        // EC-6: Sanitize filename — basename only, no path traversal.\n        const safeName = basename(info.filename || 'unnamed')\n        const chunks: Buffer[] = []\n        let size = 0\n        let truncated = false\n\n        stream.on('data', (chunk: Buffer) => {\n          size += chunk.length\n          if (size > options.maxFileSize) {\n            truncated = true\n            stream.resume() // drain the rest\n            return\n          }\n          chunks.push(chunk)\n        })\n\n        stream.on('end', () => {\n          if (truncated) {\n            truncatedFilenames.push(safeName)\n            return\n          }\n\n          const buffer = Buffer.concat(chunks)\n          files.push({\n            fieldname,\n            filename: safeName,\n            encoding: info.encoding,\n            mimeType: info.mimeType,\n            buffer,\n            size: buffer.length,\n          })\n        })\n      },\n    )\n\n    bb.on('filesLimit', () => {\n      reject(new Error(`Too many files. Maximum: ${options.maxFiles}`))\n    })\n\n    bb.on('error', (err: Error) => {\n      reject(err)\n    })\n\n    bb.on('close', () => {\n      if (truncatedFilenames.length > 0) {\n        reject(\n          new FileTooLargeError(\n            `File too large (max ${options.maxFileSize} bytes): ${truncatedFilenames.join(', ')}`,\n            truncatedFilenames,\n            options.maxFileSize,\n          ),\n        )\n        return\n      }\n      resolve({ fields, files })\n    })\n\n    req.pipe(bb)\n  })\n}\n\n// --- Main parser ---\n\n/**\n * Symbol-keyed slot on IncomingMessage that the devtools request log\n * forwarder reads to enrich the broadcast payload with a body preview.\n * Symbol-keyed so it can't collide with user-land props and is invisible\n * to JSON.stringify / iteration. Always optional — readers must guard.\n */\nexport const DEVTOOLS_BODY_PREVIEW = Symbol('theo:devtools:bodyPreview')\n\n/**\n * A JSON body as a {@link ParsedBody}, keeping the bytes it arrived as.\n *\n * Its own function so `parseRequestBody` stays under the complexity budget: the raw-bytes branch\n * added by #445 is a third thing that shape was already doing.\n */\nasync function parseJsonRequest(req: IncomingMessage): Promise<ParsedBody> {\n  const parsed = await parseJsonBody(req)\n  stashBodyPreview(req, parsed?.json)\n  return { fields: {}, files: [], json: parsed?.json, raw: parsed?.raw }\n}\n\nexport async function parseRequestBody(\n  req: IncomingMessage,\n  options?: BodyParserOptions,\n): Promise<ParsedBody> {\n  const method = req.method?.toUpperCase() ?? 'GET'\n  if (!METHODS_WITH_BODY.has(method)) {\n    return { fields: {}, files: [], json: undefined }\n  }\n\n  const contentType = req.headers['content-type'] ?? ''\n\n  // JSON\n  if (contentType.includes('application/json')) {\n    return await parseJsonRequest(req)\n  }\n\n  // Multipart\n  if (contentType.includes('multipart/form-data')) {\n    const limits = {\n      maxFileSize: options?.maxFileSize ?? DEFAULT_MAX_FILE_SIZE,\n      maxFiles: options?.maxFiles ?? DEFAULT_MAX_FILES,\n      maxFieldSize: options?.maxFieldSize ?? DEFAULT_MAX_FIELD_SIZE,\n    }\n    const { fields, files } = await parseMultipartBody(req, contentType, limits)\n    stashBodyPreview(req, {\n      fields,\n      files: files.map((f) => ({\n        fieldname: f.fieldname,\n        filename: f.filename,\n        mimeType: f.mimeType,\n        size: f.size,\n      })),\n    })\n    return { fields, files }\n  }\n\n  // No body or empty\n  if (!contentType) {\n    return { fields: {}, files: [] }\n  }\n\n  // Unsupported content type\n  throw new Error(`Unsupported Content-Type: ${contentType}`)\n}\n","/**\n * Request log primitive (T6.2 of architecture-review-remediation-plan).\n *\n * Split out from `logger.ts` per PV-12 (SRP) — the file previously mixed\n * 3 concerns (factory, warnOnce, request log). This module owns ONLY the\n * `logRequest` flow + the devtools broadcast best-effort forwarder.\n *\n * Public API surface is unchanged — `logger.ts` re-exports `logRequest`\n * + `RequestLog` + `LoggerFn` for backward compat.\n */\nimport type { IncomingMessage } from 'node:http'\n\nimport { DEVTOOLS_BODY_PREVIEW } from '../body-parser.js'\n\nexport interface RequestLog {\n  level: string\n  method: string\n  url: string\n  status: number\n  duration: number\n  requestId: string\n  timestamp: string\n}\n\nexport type LoggerFn = (log: RequestLog) => void\n\nconst defaultLoggerFn: LoggerFn = (log) => {\n  // eslint-disable-next-line no-console -- request-log default output IS the contract\n  console.log(JSON.stringify(log))\n}\n\nexport function logRequest(\n  info: Omit<RequestLog, 'level' | 'timestamp'>,\n  customLogger?: LoggerFn,\n  req?: IncomingMessage,\n): void {\n  const log: RequestLog = {\n    level: 'info',\n    ...info,\n    timestamp: new Date().toISOString(),\n  }\n  const logger = customLogger ?? defaultLoggerFn\n  logger(log)\n  // T2.1 — also broadcast to devtools (no-op in prod / when no dev server).\n  // Pass `req` so the devtools forwarder can extract headers + body preview\n  // stashed by body-parser (Symbol-keyed). Without `req`, only metadata\n  // (method/path/status/duration) reaches the devtools UI — the expanded\n  // row view then shows nothing useful.\n  broadcastRequestToDevtools(info, req)\n}\n\n/**\n * T2.1 — Forward a request record to the devtools UI. Lazy import keeps\n * this module dep-free for prod; broadcast.ts internally guards on\n * `globalThis.__theoViteHotServer`.\n */\nfunction randomRequestId(): string {\n  // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id for devtools UI\n  return `req-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`\n}\n\n/**\n * T5a.2 Phase C slice 2/2 — pure devtools broadcast that takes a\n * pre-extracted headers object + optional stashed body, so both\n * IncomingMessage and Web Request paths share the same dispatch logic.\n *\n * Errors here must not propagate — devtools forwarding is best-effort\n * and silenced.\n */\nfunction broadcastToDevtoolsCore(\n  info: Omit<RequestLog, 'level' | 'timestamp'>,\n  headers: Record<string, string> | undefined,\n  stashedBody: unknown,\n): void {\n  void Promise.all([\n    import('../../devtools/server-side/broadcast.js'),\n    import('../../devtools/server-side/build-request-body-preview.js'),\n  ])\n    .then(([{ broadcastRequest }, { buildRequestBodyPreview }]) => {\n      const bodyInfo = buildRequestBodyPreview(stashedBody)\n      broadcastRequest({\n        id: randomRequestId(),\n        traceId: info.requestId,\n        method: info.method,\n        path: info.url,\n        status: info.status,\n        durationMs: info.duration,\n        startedAt: Date.now() - info.duration,\n        ...(headers ? { headers } : {}),\n        ...(bodyInfo\n          ? {\n              bodyPreview: bodyInfo.preview,\n              bodyLength: bodyInfo.length,\n              bodyTruncated: bodyInfo.truncated,\n            }\n          : {}),\n      })\n    })\n    .catch(() => {\n      // No-op: devtools forwarding is best-effort.\n    })\n}\n\nfunction broadcastRequestToDevtools(\n  info: Omit<RequestLog, 'level' | 'timestamp'>,\n  req?: IncomingMessage,\n): void {\n  // T2.1 forwarder. Errors here must not propagate.\n  const headers = req?.headers\n    ? Object.fromEntries(\n        Object.entries(req.headers).map(([k, v]) => [\n          k,\n          Array.isArray(v) ? v.join(', ') : (v ?? ''),\n        ]),\n      )\n    : undefined\n  const stashedBody = req\n    ? (req as unknown as Record<symbol, unknown>)[DEVTOOLS_BODY_PREVIEW]\n    : undefined\n  broadcastToDevtoolsCore(info, headers, stashedBody)\n}\n\n/**\n * T5a.2 Phase C slice 2/2 — Web-Standards request log + devtools\n * forward. Mirror of `logRequest(info, logger?, req?: IncomingMessage)`\n * accepting `request?: Request`.\n *\n * Extracts headers via `request.headers.entries()` (Web `Headers`\n * iterator). Body preview stash is NOT yet supported on the Web path —\n * `body-parser-web.ts` doesn't yet stash like `body-parser.ts` does for\n * the IncomingMessage path. That hookup is Phase E scope (body parsing\n * migration). Until then, the devtools UI shows headers but no body\n * preview for Web-handled requests — same surface as the IncomingMessage\n * path before the stash convention shipped.\n */\nexport function logRequestFromRequest(\n  info: Omit<RequestLog, 'level' | 'timestamp'>,\n  customLogger?: LoggerFn,\n  request?: Request,\n): void {\n  const log: RequestLog = {\n    level: 'info',\n    ...info,\n    timestamp: new Date().toISOString(),\n  }\n  const logger = customLogger ?? defaultLoggerFn\n  logger(log)\n\n  let headers: Record<string, string> | undefined\n  if (request) {\n    headers = {}\n    for (const [k, v] of request.headers.entries()) {\n      headers[k] = v\n    }\n  }\n  // Phase E will add body-preview stash on Web Request; for now no stash.\n  broadcastToDevtoolsCore(info, headers, undefined)\n}\n","// --- Types ---\n\nexport type LogLevel = 'debug' | 'info' | 'warn' | 'error' | 'silent'\n\nexport interface StructuredLog {\n  level: string\n  msg: string\n  timestamp: string\n  [key: string]: unknown\n}\n\nexport interface TheoLogger {\n  debug(msg: string, context?: Record<string, unknown>): void\n  info(msg: string, context?: Record<string, unknown>): void\n  warn(msg: string, context?: Record<string, unknown>): void\n  error(msg: string, context?: Record<string, unknown>): void\n  child(context: Record<string, unknown>): TheoLogger\n}\n\n// --- Level filtering ---\n\nconst LEVEL_ORDER: Record<string, number> = {\n  debug: 0,\n  info: 1,\n  warn: 2,\n  error: 3,\n  silent: 4,\n}\n\nfunction shouldLog(msgLevel: string, configLevel: string): boolean {\n  return LEVEL_ORDER[msgLevel] >= LEVEL_ORDER[configLevel]\n}\n\n// --- Default output ---\n\nfunction defaultOutput(log: StructuredLog): void {\n  // eslint-disable-next-line no-console -- structured logger output IS the contract here\n  console.log(JSON.stringify(log))\n}\n\n// --- Factory ---\n\nexport function createLogger(options?: {\n  level?: LogLevel\n  output?: (log: StructuredLog) => void\n  context?: Record<string, unknown>\n}): TheoLogger {\n  const level = options?.level ?? 'info'\n  const output = options?.output ?? defaultOutput\n  const baseContext = options?.context ?? {}\n\n  function log(msgLevel: string, msg: string, context?: Record<string, unknown>): void {\n    if (!shouldLog(msgLevel, level)) return\n\n    const entry: StructuredLog = {\n      level: msgLevel,\n      msg,\n      timestamp: new Date().toISOString(),\n      ...baseContext,\n      ...context,\n    }\n\n    // Serialize Error objects to stack string\n    if (entry.error instanceof Error) {\n      entry.error = entry.error.stack ?? entry.error.message\n    }\n\n    output(entry)\n  }\n\n  return {\n    debug: (msg, ctx) => {\n      log('debug', msg, ctx)\n    },\n    info: (msg, ctx) => {\n      log('info', msg, ctx)\n    },\n    warn: (msg, ctx) => {\n      log('warn', msg, ctx)\n    },\n    error: (msg, ctx) => {\n      log('error', msg, ctx)\n    },\n    child(ctx) {\n      return createLogger({\n        level,\n        output,\n        context: { ...baseContext, ...ctx },\n      })\n    },\n  }\n}\n\n// --- warnOnce (T2.1) ---\n\n/**\n * Per-key dedup state. Module-scoped — reset per-process at boot.\n *\n * CR-011 fix: previous implementation used an unbounded `Set` which grew\n * forever in long-running prod processes with high-cardinality keys\n * (e.g. dynamic path segments). The bound below uses LRU-by-insertion:\n * when the Set hits `MAX_SEEN`, the OLDEST key is evicted. Subsequent\n * occurrences of that key will warn ONCE more — acceptable in exchange\n * for bounded memory.\n */\nconst _warnOnceSeen = new Set<string>()\nconst MAX_SEEN = 1024\n\n/**\n * Reset internal state. Test-only export — do not call from production.\n */\nexport function _resetWarnOnceForTests(): void {\n  _warnOnceSeen.clear()\n}\n\n/**\n * Emit a structured warning ONCE per key. Subsequent calls with the same\n * key are suppressed. Used for cutover-style warnings (e.g. CSRF warn)\n * that would otherwise flood logs under load.\n *\n * Convention: key is `<event>:<method>:<path>` — see callers in csrf.ts.\n *\n * EC-2: payload may contain circular references. Wrap `JSON.stringify`\n * in try/catch so a malformed payload doesn't crash the request handler.\n */\nexport function warnOnce(key: string, payload: Record<string, unknown>): void {\n  if (_warnOnceSeen.has(key)) return\n  // CR-011: bounded LRU. Evict oldest insertion when at capacity.\n  if (_warnOnceSeen.size >= MAX_SEEN) {\n    const oldest = _warnOnceSeen.values().next().value\n    if (oldest !== undefined) _warnOnceSeen.delete(oldest)\n  }\n  _warnOnceSeen.add(key)\n\n  let line: string\n  try {\n    line = JSON.stringify({ ...payload, warnOnce: true })\n  } catch {\n    // EC-2 fallback — preserve the key for grep-ability even when payload\n    // can't serialize (e.g., circular references, BigInt, etc.).\n    line = `[warnOnce] ${key} — (payload could not be serialized)`\n  }\n  console.warn(line)\n\n  // T2.1 — also broadcast to devtools (no-op in prod / when no dev server).\n  // Imported lazily to keep logger.ts dependency-free for non-dev contexts;\n  // broadcastToDevtools internally guards on globalThis.__theoViteHotServer.\n  broadcastWarnOnceToDevtools(key, payload)\n}\n\n/**\n * T2.1 — Forward a warnOnce payload to the devtools UI. Recognizes the\n * canonical CSRF warn shape and dispatches as 'csrf.warn'; otherwise\n * falls back to a generic 'error' broadcast.\n *\n * No-op when:\n *  - globalThis.__theoViteHotServer is undefined (prod / no dev server)\n *  - any error occurs (default-deny via broadcastToDevtools' try/catch)\n */\nfunction payloadField(payload: Record<string, unknown>, key: string, fallback = ''): string {\n  const value = payload[key]\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  return fallback\n}\n\nfunction randomDevtoolsId(): string {\n  // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id for devtools UI\n  return `warn-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`\n}\n\nfunction broadcastWarnOnceToDevtools(key: string, payload: Record<string, unknown>): void {\n  // CR-021: removed dead `void key` statement.\n  // T2.1 forwarder. Errors here must not propagate (default-deny).\n  void import('../../devtools/server-side/broadcast.js')\n    .then(({ broadcastCsrfWarn, broadcastError }) => {\n      if (\n        payload.event === 'csrf.warn' &&\n        typeof payload.code === 'string' &&\n        typeof payload.docsUrl === 'string'\n      ) {\n        broadcastCsrfWarn({\n          event: 'csrf.warn',\n          code: payload.code,\n          docsUrl: payload.docsUrl,\n          method: payloadField(payload, 'method'),\n          path: payloadField(payload, 'path'),\n          reason: payloadField(payload, 'reason'),\n        })\n      } else {\n        broadcastError({\n          id: randomDevtoolsId(),\n          type: 'console',\n          message: payloadField(payload, 'event', key),\n          timestamp: Date.now(),\n        })\n      }\n    })\n    .catch(() => {\n      // No-op: devtools forwarding is best-effort.\n    })\n}\n\n// --- Backward compat re-exports ---\n//\n// T6.2 (PV-12 SRP): `logRequest` + `RequestLog` + `LoggerFn` moved to a\n// dedicated `request-log.ts`. Re-exported here so consumers importing\n// from `theokit/server` see no change.\n\nexport { logRequest } from './request-log.js'\nexport type { RequestLog, LoggerFn } from './request-log.js'\n"],"mappings":";;;;;;;AACA,SAAS,gBAAgB;AAEzB,OAAO,YAAY;AA2CnB,IAAM,oBAAoB,oBAAI,IAAI,CAAC,QAAQ,OAAO,OAAO,CAAC;AAE1D,IAAM,wBAAwB,KAAK,OAAO;AAC1C,IAAM,oBAAoB;AAC1B,IAAM,yBAAyB,IAAI,OAAO;AAenC,IAAM,2BAAN,cAAuC,MAAM;AAAA,EACzC,OAAO;AAAA,EACP,SAAS;AAAA,EAClB,YAAY,QAAgB,KAAyB;AACnD;AAAA,MACE,oBAAoB,MAAM,IAAI,OAAO,eAAe;AAAA,IAItD;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAOA,SAAS,kBAAkB,KAA+B;AACxD,UAAQ,IAAI,QAAQ,gBAAgB,KAAK,QAAQ;AACnD;AAWA,SAAS,oBAAoB,KAA+B;AAC1D,SAAO,IAAI,iBAAiB,CAAC,kBAAkB,GAAG;AACpD;AAEO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAG3C,YACE,SACS,oBACA,aACT;AACA,UAAM,OAAO;AAHJ;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAAA,EACA;AAAA,EALF,OAAO;AAAA,EACP,SAAS;AASpB;AASA,SAAS,iBAAiB,KAAsB,MAAqB;AACnE,MAAI;AACF;AAAC,IAAC,IAA2C,qBAAqB,IAAI;AAAA,EACxE,QAAQ;AAAA,EAER;AACF;AAGA,SAAS,cAAc,KAA2E;AAChG,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAItC,QAAI,IAAI,eAAe;AACrB,UAAI,kBAAkB,GAAG,GAAG;AAC1B,gBAAQ,MAAS;AACjB;AAAA,MACF;AACA,aAAO,IAAI,yBAAyB,IAAI,UAAU,QAAQ,IAAI,GAAG,CAAC;AAClE;AAAA,IACF;AACA,UAAM,SAAmB,CAAC;AAC1B,QAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,QAAI,GAAG,OAAO,MAAM;AAClB,YAAM,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS;AAC3C,UAAI,CAAC,KAAK;AACR,gBAAQ,MAAS;AACjB;AAAA,MACF;AACA,UAAI;AACF,gBAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,GAAG,IAAI,CAAC;AAAA,MACxC,QAAQ;AACN,eAAO,IAAI,MAAM,mBAAmB,CAAC;AAAA,MACvC;AAAA,IACF,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAIA,SAAS,mBACP,KACA,aACA,SAC+E;AAE/E,MAAI,CAAC,YAAY,SAAS,WAAW,GAAG;AACtC,WAAO,QAAQ,OAAO,IAAI,MAAM,4BAA4B,CAAC;AAAA,EAC/D;AAMA,MAAI,oBAAoB,GAAG,GAAG;AAC5B,WAAO,QAAQ,OAAO,IAAI,yBAAyB,IAAI,UAAU,QAAQ,IAAI,GAAG,CAAC;AAAA,EACnF;AAEA,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAA4C,CAAC;AACnD,UAAM,QAAwB,CAAC;AAK/B,UAAM,qBAA+B,CAAC;AACtC,QAAI,YAAY;AAEhB,UAAM,KAAK,OAAO;AAAA,MAChB,SAAS,IAAI;AAAA,MACb,QAAQ;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,MACrB;AAAA,IACF,CAAC;AAED,OAAG,GAAG,SAAS,CAAC,MAAc,UAAkB;AAC9C,kBAAY,QAAQ,MAAM,KAAK;AAAA,IACjC,CAAC;AAED,OAAG;AAAA,MACD;AAAA,MACA,CACE,WACA,QACA,SACG;AACH;AACA,YAAI,YAAY,QAAQ,UAAU;AAChC,iBAAO,OAAO;AACd;AAAA,QACF;AAGA,cAAM,WAAW,SAAS,KAAK,YAAY,SAAS;AACpD,cAAM,SAAmB,CAAC;AAC1B,YAAI,OAAO;AACX,YAAI,YAAY;AAEhB,eAAO,GAAG,QAAQ,CAAC,UAAkB;AACnC,kBAAQ,MAAM;AACd,cAAI,OAAO,QAAQ,aAAa;AAC9B,wBAAY;AACZ,mBAAO,OAAO;AACd;AAAA,UACF;AACA,iBAAO,KAAK,KAAK;AAAA,QACnB,CAAC;AAED,eAAO,GAAG,OAAO,MAAM;AACrB,cAAI,WAAW;AACb,+BAAmB,KAAK,QAAQ;AAChC;AAAA,UACF;AAEA,gBAAM,SAAS,OAAO,OAAO,MAAM;AACnC,gBAAM,KAAK;AAAA,YACT;AAAA,YACA,UAAU;AAAA,YACV,UAAU,KAAK;AAAA,YACf,UAAU,KAAK;AAAA,YACf;AAAA,YACA,MAAM,OAAO;AAAA,UACf,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AAEA,OAAG,GAAG,cAAc,MAAM;AACxB,aAAO,IAAI,MAAM,4BAA4B,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAClE,CAAC;AAED,OAAG,GAAG,SAAS,CAAC,QAAe;AAC7B,aAAO,GAAG;AAAA,IACZ,CAAC;AAED,OAAG,GAAG,SAAS,MAAM;AACnB,UAAI,mBAAmB,SAAS,GAAG;AACjC;AAAA,UACE,IAAI;AAAA,YACF,uBAAuB,QAAQ,WAAW,YAAY,mBAAmB,KAAK,IAAI,CAAC;AAAA,YACnF;AAAA,YACA,QAAQ;AAAA,UACV;AAAA,QACF;AACA;AAAA,MACF;AACA,cAAQ,EAAE,QAAQ,MAAM,CAAC;AAAA,IAC3B,CAAC;AAED,QAAI,KAAK,EAAE;AAAA,EACb,CAAC;AACH;AAUO,IAAM,wBAAwB,uBAAO,2BAA2B;AAQvE,eAAe,iBAAiB,KAA2C;AACzE,QAAM,SAAS,MAAM,cAAc,GAAG;AACtC,mBAAiB,KAAK,QAAQ,IAAI;AAClC,SAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,GAAG,MAAM,QAAQ,MAAM,KAAK,QAAQ,IAAI;AACvE;AAEA,eAAsB,iBACpB,KACA,SACqB;AACrB,QAAM,SAAS,IAAI,QAAQ,YAAY,KAAK;AAC5C,MAAI,CAAC,kBAAkB,IAAI,MAAM,GAAG;AAClC,WAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,GAAG,MAAM,OAAU;AAAA,EAClD;AAEA,QAAM,cAAc,IAAI,QAAQ,cAAc,KAAK;AAGnD,MAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,WAAO,MAAM,iBAAiB,GAAG;AAAA,EACnC;AAGA,MAAI,YAAY,SAAS,qBAAqB,GAAG;AAC/C,UAAM,SAAS;AAAA,MACb,aAAa,SAAS,eAAe;AAAA,MACrC,UAAU,SAAS,YAAY;AAAA,MAC/B,cAAc,SAAS,gBAAgB;AAAA,IACzC;AACA,UAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,mBAAmB,KAAK,aAAa,MAAM;AAC3E,qBAAiB,KAAK;AAAA,MACpB;AAAA,MACA,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,QACvB,WAAW,EAAE;AAAA,QACb,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,MAAM,EAAE;AAAA,MACV,EAAE;AAAA,IACJ,CAAC;AACD,WAAO,EAAE,QAAQ,MAAM;AAAA,EACzB;AAGA,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,EAAE;AAAA,EACjC;AAGA,QAAM,IAAI,MAAM,6BAA6B,WAAW,EAAE;AAC5D;;;AC7TA,IAAM,kBAA4B,CAAC,QAAQ;AAEzC,UAAQ,IAAI,KAAK,UAAU,GAAG,CAAC;AACjC;AAEO,SAAS,WACd,MACA,cACA,KACM;AACN,QAAM,MAAkB;AAAA,IACtB,OAAO;AAAA,IACP,GAAG;AAAA,IACH,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,SAAS,gBAAgB;AAC/B,SAAO,GAAG;AAMV,6BAA2B,MAAM,GAAG;AACtC;AAOA,SAAS,kBAA0B;AAEjC,SAAO,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAC5E;AAUA,SAAS,wBACP,MACA,SACA,aACM;AACN,OAAK,QAAQ,IAAI;AAAA,IACf,OAAO,yBAAyC;AAAA,IAChD,OAAO,0CAA0D;AAAA,EACnE,CAAC,EACE,KAAK,CAAC,CAAC,EAAE,iBAAiB,GAAG,EAAE,wBAAwB,CAAC,MAAM;AAC7D,UAAM,WAAW,wBAAwB,WAAW;AACpD,qBAAiB;AAAA,MACf,IAAI,gBAAgB;AAAA,MACpB,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,MAC7B,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7B,GAAI,WACA;AAAA,QACE,aAAa,SAAS;AAAA,QACtB,YAAY,SAAS;AAAA,QACrB,eAAe,SAAS;AAAA,MAC1B,IACA,CAAC;AAAA,IACP,CAAC;AAAA,EACH,CAAC,EACA,MAAM,MAAM;AAAA,EAEb,CAAC;AACL;AAEA,SAAS,2BACP,MACA,KACM;AAEN,QAAM,UAAU,KAAK,UACjB,OAAO;AAAA,IACL,OAAO,QAAQ,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM;AAAA,MAC1C;AAAA,MACA,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,IAAK,KAAK;AAAA,IAC1C,CAAC;AAAA,EACH,IACA;AACJ,QAAM,cAAc,MACf,IAA2C,qBAAqB,IACjE;AACJ,0BAAwB,MAAM,SAAS,WAAW;AACpD;;;ACnGA,IAAM,cAAsC;AAAA,EAC1C,OAAO;AAAA,EACP,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO;AAAA,EACP,QAAQ;AACV;AAEA,SAAS,UAAU,UAAkB,aAA8B;AACjE,SAAO,YAAY,QAAQ,KAAK,YAAY,WAAW;AACzD;AAIA,SAAS,cAAc,KAA0B;AAE/C,UAAQ,IAAI,KAAK,UAAU,GAAG,CAAC;AACjC;AAIO,SAAS,aAAa,SAId;AACb,QAAM,QAAQ,SAAS,SAAS;AAChC,QAAM,SAAS,SAAS,UAAU;AAClC,QAAM,cAAc,SAAS,WAAW,CAAC;AAEzC,WAAS,IAAI,UAAkB,KAAa,SAAyC;AACnF,QAAI,CAAC,UAAU,UAAU,KAAK,EAAG;AAEjC,UAAM,QAAuB;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,GAAG;AAAA,MACH,GAAG;AAAA,IACL;AAGA,QAAI,MAAM,iBAAiB,OAAO;AAChC,YAAM,QAAQ,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,IACjD;AAEA,WAAO,KAAK;AAAA,EACd;AAEA,SAAO;AAAA,IACL,OAAO,CAAC,KAAK,QAAQ;AACnB,UAAI,SAAS,KAAK,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,CAAC,KAAK,QAAQ;AAClB,UAAI,QAAQ,KAAK,GAAG;AAAA,IACtB;AAAA,IACA,MAAM,CAAC,KAAK,QAAQ;AAClB,UAAI,QAAQ,KAAK,GAAG;AAAA,IACtB;AAAA,IACA,OAAO,CAAC,KAAK,QAAQ;AACnB,UAAI,SAAS,KAAK,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,KAAK;AACT,aAAO,aAAa;AAAA,QAClB;AAAA,QACA;AAAA,QACA,SAAS,EAAE,GAAG,aAAa,GAAG,IAAI;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAcA,IAAM,gBAAgB,oBAAI,IAAY;AACtC,IAAM,WAAW;AAmBV,SAAS,SAAS,KAAa,SAAwC;AAC5E,MAAI,cAAc,IAAI,GAAG,EAAG;AAE5B,MAAI,cAAc,QAAQ,UAAU;AAClC,UAAM,SAAS,cAAc,OAAO,EAAE,KAAK,EAAE;AAC7C,QAAI,WAAW,OAAW,eAAc,OAAO,MAAM;AAAA,EACvD;AACA,gBAAc,IAAI,GAAG;AAErB,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,UAAU,EAAE,GAAG,SAAS,UAAU,KAAK,CAAC;AAAA,EACtD,QAAQ;AAGN,WAAO,cAAc,GAAG;AAAA,EAC1B;AACA,UAAQ,KAAK,IAAI;AAKjB,8BAA4B,KAAK,OAAO;AAC1C;AAWA,SAAS,aAAa,SAAkC,KAAa,WAAW,IAAY;AAC1F,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,SAAO;AACT;AAEA,SAAS,mBAA2B;AAElC,SAAO,QAAQ,OAAO,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAC7E;AAEA,SAAS,4BAA4B,KAAa,SAAwC;AAGxF,OAAK,OAAO,yBAAyC,EAClD,KAAK,CAAC,EAAE,mBAAmB,eAAe,MAAM;AAC/C,QACE,QAAQ,UAAU,eAClB,OAAO,QAAQ,SAAS,YACxB,OAAO,QAAQ,YAAY,UAC3B;AACA,wBAAkB;AAAA,QAChB,OAAO;AAAA,QACP,MAAM,QAAQ;AAAA,QACd,SAAS,QAAQ;AAAA,QACjB,QAAQ,aAAa,SAAS,QAAQ;AAAA,QACtC,MAAM,aAAa,SAAS,MAAM;AAAA,QAClC,QAAQ,aAAa,SAAS,QAAQ;AAAA,MACxC,CAAC;AAAA,IACH,OAAO;AACL,qBAAe;AAAA,QACb,IAAI,iBAAiB;AAAA,QACrB,MAAM;AAAA,QACN,SAAS,aAAa,SAAS,SAAS,GAAG;AAAA,QAC3C,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF,CAAC,EACA,MAAM,MAAM;AAAA,EAEb,CAAC;AACL;","names":[]}

package/dist/chunk-CHTAWXC2.js

@@ -0,0 +1,18 @@
+// src/server/multipart-fields.ts
+function appendField(fields, name, value) {
+  if (!Object.hasOwn(fields, name)) {
+    fields[name] = value;
+    return;
+  }
+  const prior = fields[name];
+  if (Array.isArray(prior)) {
+    prior.push(value);
+  } else {
+    fields[name] = [prior, value];
+  }
+}
+
+export {
+  appendField
+};
+//# sourceMappingURL=chunk-CHTAWXC2.js.map

package/dist/chunk-CHTAWXC2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/multipart-fields.ts"],"mappings":";AAkBO,SAAS,YACd,QACA,MACA,OACM;AAMN,MAAI,CAAC,OAAO,OAAO,QAAQ,IAAI,GAAG;AAChC,WAAO,IAAI,IAAI;AACf;AAAA,EACF;AAEA,QAAM,QAAQ,OAAO,IAAI;AACzB,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,KAAK,KAAK;AAAA,EAClB,OAAO;AACL,WAAO,IAAI,IAAI,CAAC,OAAO,KAAK;AAAA,EAC9B;AACF;","names":[]}

package/dist/{chunk-ULDCFL2O.js → chunk-DVYILYM6.js}

@@ -1,6 +1,6 @@
 import {
   validateRouteInput
-} from "./chunk-RWNYIU6A.js";
+} from "./chunk-5K7WIT3Z.js";
 import {
   evaluateRoutePolicy,
   subjectFromContext
@@ -270,4 +270,4 @@ export {
   callProcedure,
   createOpenApiHandler
 };
-//# sourceMappingURL=chunk-ULDCFL2O.js.map
+//# sourceMappingURL=chunk-DVYILYM6.js.map

package/dist/{chunk-JIKNR5LX.js → chunk-ECTUUAMR.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-SSYDEKWF.js";
 import {
   dispatchControllerRequest
-} from "./chunk-SL7YUHPV.js";
+} from "./chunk-IQRL5KZL.js";
 import {
   broadcastToDevtools
 } from "./chunk-OIGJOYX6.js";
@@ -35,7 +35,7 @@ import {
   securitySchema,
   storageSchema,
   uploadSchema
-} from "./chunk-WOBSEO75.js";
+} from "./chunk-JUDNKBDQ.js";
 import {
   loadEnv
 } from "./chunk-4X6H2BXP.js";
@@ -53,7 +53,7 @@ import {
   incomingMessageToHandlerRequest,
   sendError,
   writeWebResponseToServerResponse
-} from "./chunk-RWNYIU6A.js";
+} from "./chunk-5K7WIT3Z.js";
 import {
   findSuggestion
 } from "./chunk-NTDN54XO.js";
@@ -61,7 +61,7 @@ import {
   TRACE_HEADER,
   extractTraceId,
   logRequest
-} from "./chunk-72DMJBXI.js";
+} from "./chunk-BND4YZTQ.js";
 import {
   createPluginRunnerFromConfig
 } from "./chunk-VSLTKX5L.js";
@@ -3476,19 +3476,19 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-4LAIEGFX.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-CEW2KGXR.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve10(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-5WBVSDOM.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-ESKVARP4.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve10(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-INR2E7B3.js");
-  const { generateManifest } = await import("./internal-api-OPU456AT.js");
+  const { generateManifest } = await import("./internal-api-IXSWWH2N.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -3505,7 +3505,7 @@ async function theoPluginAsync(rootOrOptions) {
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-6B4ZQUY7.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-RBMMPWCV.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -3688,4 +3688,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-JIKNR5LX.js.map
+//# sourceMappingURL=chunk-ECTUUAMR.js.map

package/dist/{chunk-7PM6K5EV.js → chunk-GSIOWE5B.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   warnOnce
-} from "./chunk-2AMLGJJA.js";
+} from "./chunk-C27VRUVN.js";
 import {
   observabilitySchema
 } from "./chunk-VI7ZANB3.js";
@@ -510,4 +510,4 @@ export {
   _resetObservabilityAdapter,
   createObservabilityPluginFromConfig
 };
-//# sourceMappingURL=chunk-7PM6K5EV.js.map
+//# sourceMappingURL=chunk-GSIOWE5B.js.map

package/dist/{chunk-SL7YUHPV.js → chunk-IQRL5KZL.js}

@@ -2,7 +2,7 @@ import {
   dispatchCsrfWarn,
   incomingMessageToWebRequest,
   sendError
-} from "./chunk-RWNYIU6A.js";
+} from "./chunk-5K7WIT3Z.js";
 import {
   enforceCsrf
 } from "./chunk-P6OS7652.js";
@@ -108,4 +108,4 @@ export {
   scanControllerModules,
   dispatchControllerRequest
 };
-//# sourceMappingURL=chunk-SL7YUHPV.js.map
+//# sourceMappingURL=chunk-IQRL5KZL.js.map

package/dist/{chunk-WOBSEO75.js → chunk-JUDNKBDQ.js}

@@ -2,11 +2,11 @@ import {
   createObservabilityPlugin,
   requestTrace,
   resolveAdapter
-} from "./chunk-MCTC6HSE.js";
+} from "./chunk-2OEN3YTE.js";
 import {
   createLogger,
   warnOnce
-} from "./chunk-72DMJBXI.js";
+} from "./chunk-BND4YZTQ.js";
 import {
   validateCsrfRequest
 } from "./chunk-P6OS7652.js";
@@ -787,4 +787,4 @@ export {
   parseAgentRequestBody,
   mountAgent
 };
-//# sourceMappingURL=chunk-WOBSEO75.js.map
+//# sourceMappingURL=chunk-JUDNKBDQ.js.map

package/dist/{chunk-OAUI273L.js → chunk-LLMTORUY.js}

@@ -12,7 +12,7 @@ import {
   serveMatchedAuxRoute,
   serveThroughPluginLifecycle,
   setupSsrDevMiddleware
-} from "./chunk-JWRCZIA4.js";
+} from "./chunk-MLWETKFA.js";
 import {
   resolveTheoRootDir
 } from "./chunk-FDOOBTXJ.js";
@@ -38,7 +38,7 @@ import {
   mountAgent,
   readAgentPolicy,
   writeWebResponseToServerResponse
-} from "./chunk-C62IZEJI.js";
+} from "./chunk-QNGS7EVS.js";
 import {
   getApprovalRegistry,
   resolveProvider
@@ -48,15 +48,15 @@ import {
   dispatchControllerRequest,
   incomingMessageToHandlerRequest,
   sendError
-} from "./chunk-HWBRS4DZ.js";
+} from "./chunk-MWWFXYW3.js";
 import {
   TRACE_HEADER,
   createObservabilityPluginFromConfig,
   extractTraceId
-} from "./chunk-7PM6K5EV.js";
+} from "./chunk-GSIOWE5B.js";
 import {
   logRequest
-} from "./chunk-2AMLGJJA.js";
+} from "./chunk-C27VRUVN.js";
 import {
   scanAgents
 } from "./chunk-EVZKNA2W.js";
@@ -2179,19 +2179,19 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-DQM3Y6YY.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-NYZ2PLNC.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve5(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-ZYLMNW6K.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-2STC6RV3.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve5(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-D4OA2TXB.js");
-  const { generateManifest } = await import("./internal-api-IP35YU3G.js");
+  const { generateManifest } = await import("./internal-api-53L6FIQ2.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -2208,7 +2208,7 @@ async function theoPluginAsync(rootOrOptions) {
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-7VZQRPPX.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-ACFCBLZ4.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -2383,4 +2383,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-OAUI273L.js.map
+//# sourceMappingURL=chunk-LLMTORUY.js.map

package/dist/{chunk-JWRCZIA4.js → chunk-MLWETKFA.js}

@@ -25,14 +25,14 @@ import {
   parseAgentRequestBody,
   readAgentPolicy,
   subjectFromContext
-} from "./chunk-C62IZEJI.js";
+} from "./chunk-QNGS7EVS.js";
 import {
   getApprovalRegistry
 } from "./chunk-5YPXXSYY.js";
 import {
   sendError,
   validateCsrfRequest
-} from "./chunk-HWBRS4DZ.js";
+} from "./chunk-MWWFXYW3.js";
 import {
   generateNonce
 } from "./chunk-RPET332G.js";
@@ -867,4 +867,4 @@ export {
   applyNonceToInlineScripts,
   setupSsrDevMiddleware
 };
-//# sourceMappingURL=chunk-JWRCZIA4.js.map
+//# sourceMappingURL=chunk-MLWETKFA.js.map

package/dist/{chunk-HWBRS4DZ.js → chunk-MWWFXYW3.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   warnOnce
-} from "./chunk-2AMLGJJA.js";
+} from "./chunk-C27VRUVN.js";
 
 // src/core/contracts/client-safe-error.ts
 var INTERNAL_CODES = /* @__PURE__ */ new Set(["INTERNAL_ERROR", "INTERNAL_SERVER_ERROR"]);
@@ -361,4 +361,4 @@ export {
   scanControllerModules,
   dispatchControllerRequest
 };
-//# sourceMappingURL=chunk-HWBRS4DZ.js.map
+//# sourceMappingURL=chunk-MWWFXYW3.js.map

package/dist/{chunk-C62IZEJI.js → chunk-QNGS7EVS.js}

@@ -12,7 +12,7 @@ import {
   sendError,
   sendJson,
   validateCsrfRequest
-} from "./chunk-HWBRS4DZ.js";
+} from "./chunk-MWWFXYW3.js";
 import {
   buildSecurityHeaders
 } from "./chunk-RPET332G.js";
@@ -21,13 +21,13 @@ import {
   newSpanId,
   newTraceId,
   requestTrace
-} from "./chunk-7PM6K5EV.js";
+} from "./chunk-GSIOWE5B.js";
 import {
   RequestBodyConsumedError,
   createLogger,
   parseRequestBody,
   warnOnce
-} from "./chunk-2AMLGJJA.js";
+} from "./chunk-C27VRUVN.js";
 import {
   compareByCodeUnit
 } from "./chunk-FD4ZDTQ6.js";
@@ -329,8 +329,10 @@ async function parseQueryAndBody(req, res, requestId) {
   const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
   const query = Object.fromEntries(url.searchParams);
   let body;
+  let raw;
   try {
     const parsed = await parseRequestBody(req);
+    raw = parsed.raw;
     if (parsed.json !== void 0) {
       body = parsed.json;
     } else if (parsed.files.length > 0 || Object.keys(parsed.fields).length > 0) {
@@ -348,7 +350,7 @@ async function parseQueryAndBody(req, res, requestId) {
     sendError(res, "VALIDATION_ERROR", message, status, void 0, requestId);
     return { ok: false };
   }
-  return { ok: true, data: { query, body } };
+  return { ok: true, data: { query, body, raw } };
 }
 var isZodLike = (value) => typeof value === "object" && value !== null && typeof value.safeParse === "function";
 function runZodValidation(routeConfig, res, requestId, input) {
@@ -730,7 +732,7 @@ async function executeRoute(ctx) {
     const rc = routeConfig;
     const parseResult = await parseQueryAndBody(req, res, requestId);
     if (!parseResult.ok) return;
-    const { query } = parseResult.data;
+    const { query, raw } = parseResult.data;
     let { body } = parseResult.data;
     const validationResult = runZodValidation(rc, res, requestId, { query, body, params });
     if (!validationResult.ok) return;
@@ -757,7 +759,18 @@ async function executeRoute(ctx) {
       );
       return;
     }
-    const handlerResult = await callableHandler({ query, body, params, request: webRequest, ctx: ctx2 });
+    const handlerRequest = raw === void 0 ? webRequest : new Request(webRequest.url, {
+      method: webRequest.method,
+      headers: webRequest.headers,
+      body: raw
+    });
+    const handlerResult = await callableHandler({
+      query,
+      body,
+      params,
+      request: handlerRequest,
+      ctx: ctx2
+    });
     if (handlerResult === void 0 || handlerResult === null) {
       sendJson(res, null, rc.status ?? 204, transformer);
       if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
@@ -1149,7 +1162,11 @@ async function readActionBody(req, res, requestId, actionConfig) {
 function synthesizeFormData(parsed) {
   const fd = new FormData();
   for (const [name, value] of Object.entries(parsed.fields)) {
-    fd.append(name, value);
+    if (Array.isArray(value)) {
+      for (const single of value) fd.append(name, single);
+    } else {
+      fd.append(name, value);
+    }
   }
   for (const file of parsed.files) {
     const blob = new Blob([file.buffer], {
@@ -2599,4 +2616,4 @@ export {
   CsrfReadinessStore,
   applySecurityHeaders
 };
-//# sourceMappingURL=chunk-C62IZEJI.js.map
+//# sourceMappingURL=chunk-QNGS7EVS.js.map