theokit 0.57.1 → 0.58.1

package/dist/{actions-virtual-module-GMRXCAVN.js → actions-virtual-module-L6SCJLDI.js}

@@ -1,4 +1,4 @@
-import "./chunk-CMCEGW3B.js";
+import "./chunk-WOANPZBT.js";
 import "./chunk-M357ILK5.js";
 import "./chunk-BPYMC7SU.js";
 import "./chunk-IRQGAC4L.js";
@@ -18,7 +18,7 @@ import "./chunk-TNI4MARH.js";
 import "./chunk-4ERYQBL6.js";
 import {
   scanServerActionsEnriched
-} from "./chunk-XJOU425Y.js";
+} from "./chunk-GP6OJBXP.js";
 import "./chunk-KDP2HURW.js";
 import "./chunk-DV34VG3N.js";
 import "./chunk-V6Y2SMRG.js";
@@ -234,4 +234,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-GMRXCAVN.js.map
+//# sourceMappingURL=actions-virtual-module-L6SCJLDI.js.map

package/dist/{actions-virtual-module-XAWZOWSY.js → actions-virtual-module-YQBEDNHN.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-G5JYB2LO.js";
+import "./chunk-IF7CZXPW.js";
 import "./chunk-35QIWOHT.js";
-import "./chunk-CTRVTBGY.js";
+import "./chunk-L4TB6FXQ.js";
 import "./chunk-RPET332G.js";
 import "./chunk-5VLP3GQ2.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
-import "./chunk-2HWWJTOH.js";
+import "./chunk-BCFA6LHL.js";
 import "./chunk-5NNFO7R7.js";
 import {
   scanServerActionsEnriched
@@ -218,4 +218,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-XAWZOWSY.js.map
+//# sourceMappingURL=actions-virtual-module-YQBEDNHN.js.map

package/dist/{agent-LS7I3ZQB.js → agent-X7RDENTI.js}

@@ -3,7 +3,7 @@ import "tsx/esm";
 import {
   agentCommand,
   createAgentSsrLoader
-} from "./chunk-NC2OPE22.js";
+} from "./chunk-MWPC7EOR.js";
 import "./chunk-35QIWOHT.js";
 import "./chunk-5NNFO7R7.js";
 import "./chunk-Z7CJHDLS.js";
@@ -12,4 +12,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=agent-LS7I3ZQB.js.map
+//# sourceMappingURL=agent-X7RDENTI.js.map

package/dist/{app-typed-client-NMKJ4DR7.js → app-typed-client-BE4LZPK2.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-G5JYB2LO.js";
+import "./chunk-IF7CZXPW.js";
 import "./chunk-35QIWOHT.js";
 import {
   scanControllerModules
-} from "./chunk-CTRVTBGY.js";
+} from "./chunk-L4TB6FXQ.js";
 import "./chunk-RPET332G.js";
 import "./chunk-5VLP3GQ2.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
 import {
   generateManifest
-} from "./chunk-2HWWJTOH.js";
+} from "./chunk-BCFA6LHL.js";
 import "./chunk-5NNFO7R7.js";
 import {
   HTTP_METHODS
@@ -411,4 +411,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-NMKJ4DR7.js.map
+//# sourceMappingURL=app-typed-client-BE4LZPK2.js.map

package/dist/{app-typed-client-W74QO5LH.js → app-typed-client-F3YLMV4N.js}

@@ -1,6 +1,6 @@
 import {
   scanControllerModules
-} from "./chunk-CMCEGW3B.js";
+} from "./chunk-WOANPZBT.js";
 import "./chunk-M357ILK5.js";
 import "./chunk-BPYMC7SU.js";
 import "./chunk-IRQGAC4L.js";
@@ -20,7 +20,7 @@ import "./chunk-TNI4MARH.js";
 import "./chunk-4ERYQBL6.js";
 import {
   generateManifest
-} from "./chunk-XJOU425Y.js";
+} from "./chunk-GP6OJBXP.js";
 import "./chunk-KDP2HURW.js";
 import {
   HTTP_METHODS
@@ -427,4 +427,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-W74QO5LH.js.map
+//# sourceMappingURL=app-typed-client-F3YLMV4N.js.map

package/dist/{build-FHE72YXR.js → build-H2UDKBV7.js}

@@ -3,7 +3,7 @@ import "tsx/esm";
 import {
   describeControllerArtifacts,
   emitControllerArtifacts
-} from "./chunk-CLBJTDI6.js";
+} from "./chunk-KZ3PXNPT.js";
 import {
   validateProjectStructure
 } from "./chunk-GEQJAFSV.js";
@@ -14,13 +14,13 @@ import {
   emitOpenApi,
   loadRoutesForOpenApi
 } from "./chunk-47VNWTL4.js";
-import "./chunk-CTRVTBGY.js";
+import "./chunk-L4TB6FXQ.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
 import {
   generateManifest,
   writeManifest as writeManifest2
-} from "./chunk-2HWWJTOH.js";
+} from "./chunk-BCFA6LHL.js";
 import {
   scanAgents
 } from "./chunk-5NNFO7R7.js";
@@ -554,7 +554,7 @@ async function buildCommand(options) {
 `);
 }
 async function runAdapterBuild(target, config, cwd) {
-  const { theoPluginAsync } = await import("./vite-plugin-ABJIDKE6.js");
+  const { theoPluginAsync } = await import("./vite-plugin-TU3HQA43.js");
   const { default: react } = await import("@vitejs/plugin-react");
   const ctx = {
     // `react()` may return Plugin or Plugin[] depending on version; spread the
@@ -676,4 +676,4 @@ function relativize3(absPath, root) {
 export {
   buildCommand
 };
-//# sourceMappingURL=build-FHE72YXR.js.map
+//# sourceMappingURL=build-H2UDKBV7.js.map

package/dist/{chunk-KEDRCI2L.js → chunk-6YRZWT5X.js}

@@ -12,7 +12,7 @@ import {
   serveMatchedAuxRoute,
   serveThroughPluginLifecycle,
   setupSsrDevMiddleware
-} from "./chunk-OKDCBENR.js";
+} from "./chunk-VJRPOUKM.js";
 import {
   resolveTheoRootDir
 } from "./chunk-FDOOBTXJ.js";
@@ -38,7 +38,7 @@ import {
   mountAgent,
   readAgentPolicy,
   writeWebResponseToServerResponse
-} from "./chunk-G5JYB2LO.js";
+} from "./chunk-IF7CZXPW.js";
 import {
   getApprovalRegistry,
   resolveProvider
@@ -48,7 +48,7 @@ import {
   dispatchControllerRequest,
   incomingMessageToHandlerRequest,
   sendError
-} from "./chunk-CTRVTBGY.js";
+} from "./chunk-L4TB6FXQ.js";
 import {
   TRACE_HEADER,
   createObservabilityPluginFromConfig,
@@ -1028,7 +1028,7 @@ async function runConfigureServer(server, ctx) {
   server.watcher.on("unlink", handleRouteChange);
   if (ctx.resolvedOpenApi !== void 0) {
     const openApiCfg = ctx.resolvedOpenApi;
-    const { reEmitOpenApi } = await import("./dev-emit-QGSMUZLU.js");
+    const { reEmitOpenApi } = await import("./dev-emit-ZLB2J5ME.js");
     const openApiServerDir = ctx.serverDir;
     const openApiDistDir = resolve3(ctx.projectRoot, ctx.resolvedDistDir);
     const isRouteFileForOpenApi = (file) => file.startsWith(openApiServerDir) && /\.(ts|tsx|js|mjs)$/.test(file);
@@ -2179,19 +2179,19 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-NMKJ4DR7.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-BE4LZPK2.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve5(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-XAWZOWSY.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-YQBEDNHN.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve5(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-D4OA2TXB.js");
-  const { generateManifest } = await import("./internal-api-732K3H75.js");
+  const { generateManifest } = await import("./internal-api-4FBFRQ4G.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -2208,7 +2208,7 @@ async function theoPluginAsync(rootOrOptions) {
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-B6U4DRRH.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-CJIXOPCF.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -2383,4 +2383,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-KEDRCI2L.js.map
+//# sourceMappingURL=chunk-6YRZWT5X.js.map

package/dist/{chunk-2HWWJTOH.js → chunk-BCFA6LHL.js}

@@ -88,4 +88,4 @@ export {
   writeManifest,
   loadManifest
 };
-//# sourceMappingURL=chunk-2HWWJTOH.js.map
+//# sourceMappingURL=chunk-BCFA6LHL.js.map

package/dist/chunk-BCFA6LHL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/scan/manifest.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time manifest emitter / loader. All paths derived from `distDir`\n * + `serverDir`, themselves resolved from `process.cwd()`. No HTTP input.\n */\nimport { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs'\nimport { join, resolve, relative, dirname } from 'node:path'\n\nimport { scanServerActions } from './action-scan.js'\nimport type { ActionNode } from './action-scan.js'\nimport { scanAgents } from './agent-scan.js'\nimport type { AgentNode } from './agent-scan.js'\nimport { compilePattern } from './match.js'\nimport type { ServerRouteNode } from './match.js'\nimport { scanServerRoutes } from './scan.js'\nimport { scanWebSocketRoutes } from './ws-scan.js'\nimport type { WebSocketRouteNode } from './ws-scan.js'\n\n// --- Manifest Types ---\n\nexport interface ManifestRoute {\n  filePath: string\n  routePath: string\n  paramNames: string[]\n  /** HTTP methods (uppercase) the route file exports. Optional — manifests\n   * generated before G1 omit this; loaders treat absence as \"unknown\". */\n  methods?: string[]\n  /**\n   * The subset of `methods` declaring `policy('public')`. Optional for the same reason `methods`\n   * is: a manifest written before the field existed has none, and `public-exposure-gate.ts` reads\n   * that absence as \"not measured\" rather than as \"nothing is public\".\n   */\n  publicMethods?: string[]\n}\n\nexport interface ManifestAction {\n  filePath: string\n  actionPath: string\n}\n\nexport interface ManifestWebSocket {\n  filePath: string\n  wsPath: string\n}\n\n/** M2 — a top-level `agents/*.ts` convention entry. `filePath` is relative to the\n * project root (agents live OUTSIDE `serverDir`), unlike routes/actions/ws. */\nexport interface ManifestAgent {\n  filePath: string\n  agentPath: string\n  name: string\n}\n\nexport interface TheoManifest {\n  version: 1\n  generatedAt: string\n  /**\n   * FILE routes — what `scanServerRoutes` finds under `<serverDir>/routes`. Controllers are NOT\n   * here, and that is deliberate: they ship as a separate `controllers.json` so a deploy adapter\n   * that knows nothing about them keeps working unchanged (see `emit-controllers.ts`).\n   *\n   * Which makes `routes: []` ambiguous, and the ambiguity is worth stating rather than leaving for\n   * each reader to rediscover. It means \"no file routes\" — never \"this app serves nothing\". Measured\n   * on a nine-controller app: sixteen routes served, `routes: []` written (theokit#543). Anything\n   * answering \"what does this app serve?\" must read `controllers.json` too; `public-exposure-gate`\n   * is the one that had to learn this the expensive way.\n   */\n  routes: ManifestRoute[]\n  actions: ManifestAction[]\n  websockets: ManifestWebSocket[]\n  /** M2 — optional for backward compat: manifests generated before M2 omit it. */\n  agents?: ManifestAgent[]\n}\n\nexport interface LoadedManifest {\n  routes: ServerRouteNode[]\n  actions: ActionNode[]\n  websockets: WebSocketRouteNode[]\n  agents: AgentNode[]\n}\n\n// --- Generate ---\n\nexport function generateManifest(\n  serverDir: string,\n  // Agents live at `<projectRoot>/<agentsDir>`. Defaults to the server dir's parent; overridable\n  // for tests / non-standard layouts.\n  projectRoot: string = dirname(serverDir),\n  // Agents dir NAME (config `agentsDir`, default \"agents\"), relative to projectRoot (#95 follow-up).\n  agentsDir = 'agents',\n): TheoManifest {\n  const routes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const websockets = scanWebSocketRoutes(serverDir)\n  const agents = scanAgents(projectRoot, agentsDir)\n\n  return {\n    version: 1,\n    generatedAt: new Date().toISOString(),\n    routes: routes.map((r) => ({\n      filePath: relative(serverDir, r.filePath),\n      routePath: r.routePath,\n      paramNames: r.paramNames,\n      ...(r.methods !== undefined ? { methods: r.methods } : {}),\n      ...(r.publicMethods !== undefined ? { publicMethods: r.publicMethods } : {}),\n    })),\n    actions: actions.map((a) => ({\n      filePath: relative(serverDir, a.filePath),\n      actionPath: a.actionPath,\n    })),\n    websockets: websockets.map((w) => ({\n      filePath: relative(serverDir, w.filePath),\n      wsPath: w.wsPath,\n    })),\n    agents: agents.map((a) => ({\n      // Relative to projectRoot (agents/ is outside serverDir).\n      filePath: relative(projectRoot, a.filePath),\n      agentPath: a.agentPath,\n      name: a.name,\n    })),\n  }\n}\n\n// --- Write ---\n\nexport function writeManifest(manifest: TheoManifest, outputDir: string): void {\n  mkdirSync(outputDir, { recursive: true })\n  const manifestPath = join(outputDir, 'manifest.json')\n  writeFileSync(manifestPath, JSON.stringify(manifest, null, 2))\n}\n\n// --- Load ---\n\nexport function loadManifest(distDir: string, serverDir: string): LoadedManifest {\n  const manifestPath = join(distDir, 'manifest.json')\n\n  if (!existsSync(manifestPath)) {\n    throw new Error(`No manifest found at ${manifestPath}. Run \"theo build\" first.`)\n  }\n\n  const raw = JSON.parse(readFileSync(manifestPath, 'utf-8')) as TheoManifest\n\n  const routes: ServerRouteNode[] = raw.routes.map((r) => {\n    const { pattern, paramNames } = compilePattern(r.routePath)\n    return {\n      filePath: resolve(serverDir, r.filePath),\n      routePath: r.routePath,\n      paramNames,\n      pattern,\n      ...(r.methods !== undefined ? { methods: r.methods } : {}),\n      ...(r.publicMethods !== undefined ? { publicMethods: r.publicMethods } : {}),\n    }\n  })\n\n  const actions: ActionNode[] = raw.actions.map((a) => ({\n    filePath: resolve(serverDir, a.filePath),\n    actionPath: a.actionPath,\n  }))\n\n  const websockets: WebSocketRouteNode[] = raw.websockets.map((w) => ({\n    filePath: resolve(serverDir, w.filePath),\n    wsPath: w.wsPath,\n  }))\n\n  // M2 — agents resolve relative to the project root (sibling of serverDir).\n  // `?? []` keeps pre-M2 manifests (no `agents` field) loadable (fail-safe).\n  const projectRoot = dirname(serverDir)\n  const agents: AgentNode[] = (raw.agents ?? []).map((a) => ({\n    filePath: resolve(projectRoot, a.filePath),\n    agentPath: a.agentPath,\n    name: a.name,\n  }))\n\n  return { routes, actions, websockets, agents }\n}\n"],"mappings":";;;;;;;;;;;;;AAIA,SAAS,YAAY,cAAc,eAAe,iBAAiB;AACnE,SAAS,MAAM,SAAS,UAAU,eAAe;AA6E1C,SAAS,iBACd,WAGA,cAAsB,QAAQ,SAAS,GAEvC,YAAY,UACE;AACd,QAAM,SAAS,iBAAiB,SAAS;AACzC,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,aAAa,oBAAoB,SAAS;AAChD,QAAM,SAAS,WAAW,aAAa,SAAS;AAEhD,SAAO;AAAA,IACL,SAAS;AAAA,IACT,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,MACzB,UAAU,SAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,WAAW,EAAE;AAAA,MACb,YAAY,EAAE;AAAA,MACd,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxD,GAAI,EAAE,kBAAkB,SAAY,EAAE,eAAe,EAAE,cAAc,IAAI,CAAC;AAAA,IAC5E,EAAE;AAAA,IACF,SAAS,QAAQ,IAAI,CAAC,OAAO;AAAA,MAC3B,UAAU,SAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,YAAY,EAAE;AAAA,IAChB,EAAE;AAAA,IACF,YAAY,WAAW,IAAI,CAAC,OAAO;AAAA,MACjC,UAAU,SAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,QAAQ,EAAE;AAAA,IACZ,EAAE;AAAA,IACF,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA;AAAA,MAEzB,UAAU,SAAS,aAAa,EAAE,QAAQ;AAAA,MAC1C,WAAW,EAAE;AAAA,MACb,MAAM,EAAE;AAAA,IACV,EAAE;AAAA,EACJ;AACF;AAIO,SAAS,cAAc,UAAwB,WAAyB;AAC7E,YAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AACxC,QAAM,eAAe,KAAK,WAAW,eAAe;AACpD,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC/D;AAIO,SAAS,aAAa,SAAiB,WAAmC;AAC/E,QAAM,eAAe,KAAK,SAAS,eAAe;AAElD,MAAI,CAAC,WAAW,YAAY,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB,YAAY,2BAA2B;AAAA,EACjF;AAEA,QAAM,MAAM,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAE1D,QAAM,SAA4B,IAAI,OAAO,IAAI,CAAC,MAAM;AACtD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,EAAE,SAAS;AAC1D,WAAO;AAAA,MACL,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,MACvC,WAAW,EAAE;AAAA,MACb;AAAA,MACA;AAAA,MACA,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxD,GAAI,EAAE,kBAAkB,SAAY,EAAE,eAAe,EAAE,cAAc,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF,CAAC;AAED,QAAM,UAAwB,IAAI,QAAQ,IAAI,CAAC,OAAO;AAAA,IACpD,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,YAAY,EAAE;AAAA,EAChB,EAAE;AAEF,QAAM,aAAmC,IAAI,WAAW,IAAI,CAAC,OAAO;AAAA,IAClE,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,QAAQ,EAAE;AAAA,EACZ,EAAE;AAIF,QAAM,cAAc,QAAQ,SAAS;AACrC,QAAM,UAAuB,IAAI,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,IACzD,UAAU,QAAQ,aAAa,EAAE,QAAQ;AAAA,IACzC,WAAW,EAAE;AAAA,IACb,MAAM,EAAE;AAAA,EACV,EAAE;AAEF,SAAO,EAAE,QAAQ,SAAS,YAAY,OAAO;AAC/C;","names":[]}

package/dist/{chunk-XJOU425Y.js → chunk-GP6OJBXP.js}

@@ -632,4 +632,4 @@ export {
   writeManifest,
   loadManifest
 };
-//# sourceMappingURL=chunk-XJOU425Y.js.map
+//# sourceMappingURL=chunk-GP6OJBXP.js.map

package/dist/{chunk-XJOU425Y.js.map → chunk-GP6OJBXP.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/scan/action-scan.ts","../src/server/scan/match.ts","../src/server/scan/scan.ts","../src/server/scan/detect-http-methods.ts","../src/server/scan/detect-route-policy.ts","../src/server/scan/ws-scan.ts","../src/server/scan/manifest.ts"],"mappings":";;;;;;;;;;;;;;;;;;AAIA,SAAS,YAAY,cAAc,gBAAgB;AACnD,SAAS,SAAS,MAAM,gBAAgB;AAuBjC,IAAM,qBAAqB;AA8B3B,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAChC;AAAA,EACA;AAAA,EAET,YACE,MACA,SACA,kBACA;AACA,UAAM,OAAO;AAIb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,mBAAmB;AAAA,EAC1B;AACF;AAEA,IAAM,oBAAoB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAChE,IAAM,eAAe;AACrB,IAAM,iBAAiB,oBAAI,IAAI,CAAC,SAAS,eAAe,aAAa,aAAa,gBAAgB,CAAC;AAO5F,SAAS,kBAAkB,WAAiC;AACjE,QAAM,aAAa,KAAK,WAAW,SAAS;AAC5C,MAAI,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,UAAU,EAAE,YAAY,GAAG;AAClE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAwB,CAAC;AAC/B,kBAAgB,YAAY,EAAE,YAAY,kBAAkB,GAAG,CAAC,YAAY;AAC1E,QAAI,aAAa,KAAK,OAAO,EAAG;AAChC,QAAI,MAAM,SAAS,YAAY,OAAO;AACtC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM;AACvC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,YAAY;AAAA,IACd,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;AAUO,SAAS,0BAA0B,WAA0C;AAClF,QAAM,aAAa,KAAK,WAAW,SAAS;AAC5C,MAAI,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,UAAU,EAAE,YAAY,GAAG;AAClE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,YAAY,oBAAI,IAAY;AAClC,QAAM,UAAiC,CAAC;AAGxC,kBAAgB,YAAY,EAAE,YAAY,kBAAkB,GAAG,CAAC,YAAY;AAC1E,QAAI,aAAa,KAAK,OAAO,EAAG;AAChC,UAAM,MAAM,SAAS,YAAY,OAAO,EAAE,QAAQ,OAAO,GAAG;AAG5D,QAAI,IAAI,WAAW,GAAG,kBAAkB,GAAG,EAAG;AAC9C,UAAM,OAAO,IAAI,MAAM,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM;AAE9C,UAAMA,YAAW,KAAK,SAAS,GAAG,IAAK,KAAK,MAAM,GAAG,EAAE,IAAI,KAAK,OAAQ;AACxE,QAAI,eAAe,IAAIA,SAAQ,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,2BAA2BA,SAAQ,+BAA+B,OAAO;AAAA,QACzE,CAAC,OAAO;AAAA,MACV;AAAA,IACF;AAGA,UAAM,SAAS,aAAa,SAAS,MAAM;AAC3C,UAAM,WAAW,cAAc,MAAM;AACrC,UAAM,SAAS,8BAA8B,KAAK,QAAQ,IAAI,SAAS;AACvE,UAAM,WAAW,oBAAoB,KAAK,QAAQ,KAAK,sBAAsB,KAAK,QAAQ;AAS1F,UAAM,cAAc,yBAAyB,QAAQ;AAIrD,UAAM,iBAAiB,KAAK,SAAS,GAAG,IAAI,SAAY,iBAAiB,YAAYA,SAAQ;AAC7F,eAAW,cAAc,aAAa;AACpC,YAAM,WAAW,eAAe,YAAY,OAAO;AACnD,UAAI,UAAU,IAAI,QAAQ,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,+BAA+B,QAAQ;AAAA,UACvC,CAAC,OAAO;AAAA,QACV;AAAA,MACF;AACA,gBAAU,IAAI,QAAQ;AACtB,YAAM,QAA6B;AAAA,QACjC,MAAM;AAAA,QACN,UAAU;AAAA,QACV,SAAS,kBAAkB,IAAI,IAAI,UAAU;AAAA,QAC7C;AAAA,QACA;AAAA,MACF;AACA,UAAI,mBAAmB,QAAW;AAChC,cAAM,iBAAiB;AAAA,MACzB;AACA,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF,CAAC;AAID,aAAW,SAAS,SAAS;AAC3B,UAAM,cAAc,GAAG,MAAM,IAAI;AACjC,UAAM,mBAAmB,QAAQ,KAAK,CAAC,UAAU,MAAM,KAAK,WAAW,WAAW,CAAC;AACnF,QAAI,kBAAkB;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,WAAW,MAAM,IAAI,uDAAuD,iBAAiB,IAAI;AAAA,QACjG,CAAC,MAAM,UAAU,iBAAiB,QAAQ;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AACT;AAeA,SAAS,yBAAyB,UAA4B;AAC5D,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,UAAU;AAChB,MAAI;AACJ,UAAQ,IAAI,QAAQ,KAAK,QAAQ,OAAO,MAAM;AAC5C,UAAM,OAAO,EAAE,CAAC;AAChB,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,EAAG,OAAM,IAAI,IAAI;AAAA,EACjE;AACA,MAAI,sCAAsC,KAAK,QAAQ,GAAG;AACxD,UAAM,IAAI,SAAS;AAAA,EACrB;AACA,MAAI,MAAM,SAAS,EAAG,OAAM,IAAI,SAAS;AACzC,SAAO,CAAC,GAAG,KAAK;AAClB;AAOA,SAAS,iBAAiB,YAAoBA,WAAsC;AAClF,QAAM,aAAa,KAAK,YAAY,kBAAkB;AACtD,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,aAAW,OAAO,CAAC,OAAO,QAAQ,OAAO,MAAM,GAAG;AAChD,UAAM,YAAY,KAAK,YAAY,GAAGA,SAAQ,GAAG,GAAG,EAAE;AACtD,QAAI,WAAW,SAAS,EAAG,QAAO;AAAA,EACpC;AACA,SAAO;AACT;AAEA,SAAS,cAAc,QAAwB;AAC7C,MAAI,MAAM;AACV,MAAI,IAAI;AACR,SAAO,IAAI,OAAO,QAAQ;AACxB,UAAM,KAAK,OAAO,CAAC;AACnB,UAAM,OAAO,OAAO,IAAI,CAAC;AACzB,QAAI,OAAO,OAAO,SAAS,KAAK;AAE9B,aAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,KAAM;AAChD;AAAA,IACF;AACA,QAAI,OAAO,OAAO,SAAS,KAAK;AAE9B,WAAK;AACL,aAAO,IAAI,OAAO,SAAS,KAAK,EAAE,OAAO,CAAC,MAAM,OAAO,OAAO,IAAI,CAAC,MAAM,KAAM;AAC/E,WAAK;AACL;AAAA,IACF;AACA,WAAO;AACP;AAAA,EACF;AACA,SAAO;AACT;;;AC3PO,SAAS,eAAe,WAG7B;AACA,QAAM,aAAuB,CAAC;AAE9B,QAAM,WAAW,UAAU,QAAQ,wBAAwB,CAAC,OAAe,SAAiB;AAC1F,eAAW,KAAK,IAAI;AAEpB,WAAO,MAAM,WAAW,MAAM,IAAI,SAAS;AAAA,EAC7C,CAAC;AAKD,SAAO,EAAE,SAAS,IAAI,OAAO,IAAI,QAAQ,GAAG,GAAG,WAAW;AAC5D;AAEO,SAAS,WACd,KACA,QACmE;AAEnE,MAAI,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC;AAC3B,MAAI,KAAK,SAAS,KAAK,KAAK,SAAS,GAAG,GAAG;AACzC,WAAO,KAAK,MAAM,GAAG,EAAE;AAAA,EACzB;AAEA,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI;AACrC,QAAI,OAAO;AACT,YAAM,SAAiC,CAAC;AACxC,YAAM,WAAW,QAAQ,CAAC,MAAM,MAAM;AACpC,eAAO,IAAI,IAAI,MAAM,IAAI,CAAC;AAAA,MAC5B,CAAC;AACD,aAAO,EAAE,OAAO,OAAO;AAAA,IACzB;AAAA,EACF;AACA,SAAO;AACT;;;ACtDA,SAAS,cAAAC,aAAY,gBAAAC,eAAc,YAAAC,iBAAgB;AACnD,SAAS,UAAU,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;;;ACYlD,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,qBAAqB;AAO9B,IAAM,WAAW,cAAc,YAAY,GAAG;AAE9C,IAAM,KAAK,SAAS,YAAY;AAEhC,IAAM,oBAAoB,IAAI,IAAY,YAAY;AAEtD,SAAS,kBAAkB,WAAwD;AACjF,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,KAAK,WAAW;AACzB,QAAI,EAAE,SAAS,GAAG,WAAW,cAAe,QAAO;AAAA,EACrD;AACA,SAAO;AACT;AAMA,SAAS,qBAAqB,MAAoB,OAA8B;AAE9E,MAAI,GAAG,oBAAoB,IAAI,KAAK,kBAAkB,GAAG,aAAa,IAAI,CAAC,GAAG;AAC5E,eAAW,QAAQ,KAAK,gBAAgB,cAAc;AACpD,UAAI,GAAG,aAAa,KAAK,IAAI,KAAK,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACvE,cAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,MACxC;AAAA,IACF;AACA;AAAA,EACF;AAEA,OACG,GAAG,sBAAsB,IAAI,KAAK,GAAG,mBAAmB,IAAI,MAC7D,kBAAkB,GAAG,aAAa,IAAI,CAAC,GACvC;AACA,QAAI,KAAK,QAAQ,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACtD,YAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,IACxC;AACA;AAAA,EACF;AAGA,MAAI,GAAG,oBAAoB,IAAI,KAAK,KAAK,gBAAgB,GAAG,eAAe,KAAK,YAAY,GAAG;AAC7F,eAAW,QAAQ,KAAK,aAAa,UAAU;AAE7C,UAAI,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACzC,cAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,0BAA0B,UAAkB,SAAgC;AAI1F,QAAM,MAAM,WAAWC,cAAa,UAAU,OAAO;AACrD,QAAM,aAAa,GAAG;AAAA,IACpB;AAAA,IACA;AAAA,IACA,GAAG,aAAa;AAAA;AAAA,IACK;AAAA,IACrB,GAAG,WAAW;AAAA,EAChB;AACA,QAAM,QAAQ,oBAAI,IAAgB;AAClC,aAAW,QAAQ,WAAW,YAAY;AACxC,yBAAqB,MAAM,KAAK;AAAA,EAClC;AAKA,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK,iBAAiB;AAC1C;;;AC1DA,SAAS,iBAAAC,sBAAqB;AAM9B,IAAMC,YAAWC,eAAc,YAAY,GAAG;AAE9C,IAAMC,MAAKF,UAAS,YAAY;AAEhC,IAAMG,qBAAoB,IAAI,IAAY,YAAY;AAEtD,IAAM,aAAa;AAEnB,SAASC,mBAAkB,WAAwD;AACjF,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,KAAK,WAAW;AACzB,QAAI,EAAE,SAASF,IAAG,WAAW,cAAe,QAAO;AAAA,EACrD;AACA,SAAO;AACT;AAGA,SAAS,OAAO,YAA0C;AACxD,MAAI,UAAU;AACd,aAAS;AACP,QACEA,IAAG,0BAA0B,OAAO,KACpCA,IAAG,eAAe,OAAO,KACzBA,IAAG,sBAAsB,OAAO,KAChCA,IAAG,oBAAoB,OAAO,GAC9B;AACA,gBAAU,QAAQ;AAClB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,MAA4C;AACxE,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAIA,IAAG,aAAa,IAAI,EAAG,QAAO,KAAK,SAAS;AAChD,MAAIA,IAAG,gBAAgB,IAAI,EAAG,QAAO,KAAK,SAAS;AACnD,SAAO;AACT;AAsBA,SAAS,qBAAqB,YAA4C;AACxE,QAAM,MAAM,OAAO,UAAU;AAC7B,SAAOA,IAAG,gBAAgB,GAAG,KAAK,IAAI,SAAS,WAAW,WAAW;AACvE;AAGA,SAAS,iBAAiB,SAAkE;AAC1F,aAAW,YAAY,QAAQ,YAAY;AACzC,QAAIA,IAAG,mBAAmB,QAAQ,EAAG;AACrC,QAAI,CAAC,qBAAqB,SAAS,IAAI,EAAG;AAG1C,WAAOA,IAAG,qBAAqB,QAAQ,IACnC,qBAAqB,SAAS,WAAW,IACzC;AAAA,EACN;AACA,SAAO;AACT;AASA,SAAS,WAAW,YAAwD;AAC1E,QAAM,OAAO,OAAO,UAAU;AAE9B,MAAIA,IAAG,0BAA0B,IAAI,EAAG,QAAO,iBAAiB,IAAI;AAEpE,MAAI,CAACA,IAAG,iBAAiB,IAAI,EAAG,QAAO;AAEvC,QAAM,SAAS,OAAO,KAAK,UAAU;AAErC,MAAIA,IAAG,2BAA2B,MAAM,KAAK,OAAO,KAAK,SAAS,YAAY;AAE5E,WAAO,KAAK,UAAU,WAAW,IAAI,YAAY,qBAAqB,KAAK,UAAU,CAAC,CAAC;AAAA,EACzF;AAEA,aAAW,YAAY,KAAK,WAAW;AACrC,UAAM,MAAM,OAAO,QAAQ;AAC3B,QAAI,CAACA,IAAG,0BAA0B,GAAG,EAAG;AACxC,UAAM,OAAO,iBAAiB,GAAG;AACjC,QAAI,SAAS,OAAW,QAAO;AAAA,EACjC;AAIA,MAAIA,IAAG,2BAA2B,MAAM,EAAG,QAAO,WAAW,OAAO,UAAU;AAE9E,SAAO;AACT;AAGA,SAAS,yBAAyB,YAAuD;AACvF,QAAM,SAAS,oBAAI,IAA2B;AAC9C,aAAW,QAAQ,WAAW,YAAY;AACxC,QAAI,CAACA,IAAG,oBAAoB,IAAI,EAAG;AACnC,eAAW,QAAQ,KAAK,gBAAgB,cAAc;AACpD,UAAIA,IAAG,aAAa,KAAK,IAAI,KAAK,KAAK,gBAAgB,QAAW;AAChE,eAAO,IAAI,KAAK,KAAK,MAAM,KAAK,WAAW;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,6BACP,MACA,UACM;AACN,MAAI,CAACE,mBAAkBF,IAAG,aAAa,IAAI,CAAC,EAAG;AAC/C,aAAW,QAAQ,KAAK,gBAAgB,cAAc;AACpD,QAAI,CAACA,IAAG,aAAa,KAAK,IAAI,KAAK,CAACC,mBAAkB,IAAI,KAAK,KAAK,IAAI,EAAG;AAC3E,QAAI,KAAK,gBAAgB,OAAW;AACpC,UAAM,OAAO,WAAW,KAAK,WAAW;AACxC,QAAI,SAAS,OAAW,UAAS,IAAI,KAAK,KAAK,MAAoB,IAAI;AAAA,EACzE;AACF;AAMA,SAAS,6BACP,MACA,QACA,UACM;AACN,MAAI,KAAK,oBAAoB,OAAW;AACxC,MAAI,CAAC,KAAK,gBAAgB,CAACD,IAAG,eAAe,KAAK,YAAY,EAAG;AACjE,aAAW,QAAQ,KAAK,aAAa,UAAU;AAC7C,QAAI,CAACC,mBAAkB,IAAI,KAAK,KAAK,IAAI,EAAG;AAC5C,UAAM,QAAQ,OAAO,KAAK,KAAK,gBAAgB,KAAK,MAAM,IAAI;AAC9D,QAAI,UAAU,OAAW;AACzB,UAAM,OAAO,WAAW,KAAK;AAC7B,QAAI,SAAS,OAAW,UAAS,IAAI,KAAK,KAAK,MAAoB,IAAI;AAAA,EACzE;AACF;AAEA,SAASE,sBACP,MACA,QACA,UACM;AACN,MAAIH,IAAG,oBAAoB,IAAI,GAAG;AAChC,iCAA6B,MAAM,QAAQ;AAC3C;AAAA,EACF;AACA,MAAIA,IAAG,oBAAoB,IAAI,GAAG;AAChC,iCAA6B,MAAM,QAAQ,QAAQ;AAAA,EACrD;AAGF;AAYO,SAAS,uBACd,UACA,SACkC;AAClC,QAAM,aAAaA,IAAG;AAAA,IACpB;AAAA,IACA;AAAA,IACAA,IAAG,aAAa;AAAA;AAAA,IACK;AAAA,IACrBA,IAAG,WAAW;AAAA,EAChB;AACA,QAAM,SAAS,yBAAyB,UAAU;AAClD,QAAM,WAAW,oBAAI,IAAiC;AACtD,aAAW,QAAQ,WAAW,YAAY;AACxC,IAAAG,sBAAqB,MAAM,QAAQ,QAAQ;AAAA,EAC7C;AACA,SAAO;AACT;;;AFrOA,IAAM,mBAAmB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAK/D,IAAM,kBAAkB;AAExB,SAAS,iBAAiB,UAA2B;AACnD,SAAO,gBAAgB,KAAK,SAAS,QAAQ,CAAC;AAChD;AAEA,SAAS,sBAAsB,SAA0B;AACvD,MAAI,QAAQ;AACZ,aAAW,MAAM,SAAS;AACxB,QAAI,OAAO,IAAK;AAAA,aACP,OAAO,IAAK;AAAA,aACZ,OAAO,OAAO,UAAU,EAAG,QAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,kCAAkC,SAA2B;AACpE,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI,QAAQ;AACZ,aAAW,MAAM,SAAS;AACxB,QAAI,OAAO,KAAK;AACd;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,KAAK;AACrB;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,OAAO,UAAU,GAAG;AACpC,UAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,gBAAU;AAAA,IACZ,OAAO;AACL,iBAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,SAAO;AACT;AAEA,SAAS,+BAA+B,UAAkB,WAA2B;AACnF,QAAM,MAAMC,UAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,aAAa,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAC3C,QAAM,WAAW,WAAW,MAAM,GAAG,EAAE,QAAQ,iCAAiC;AAChF,SAAO,UAAU,SAAS,KAAK,GAAG,CAAC,GAAG,GAAG;AAC3C;AASA,SAAS,4BAA4B,UAAkB,WAAyB;AAC9E,QAAM,MAAMD,UAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,CAAC,OAAO,GAAG,IAAI,IAAI,IAAI,MAAM,GAAG;AACtC,MAAI,UAAU,SAAS,KAAK,WAAW,EAAG;AAE1C,QAAM,aAAa,IAAI,MAAM,GAAG,CAACC,SAAQ,GAAG,EAAE,MAAM;AACpD,QAAM,IAAI,yBAAyB;AAAA,IACjC,MAAM;AAAA,IACN,kBAAkB,QAAQ,UAAU;AAAA,IACpC,oBAAoB,UAAU,WAAW,MAAM,GAAG,EAAE,KAAK,GAAG,CAAC;AAAA,IAC7D,YAAY,UAAU,KAAK,KAAK,GAAG,CAAC;AAAA,EACtC,CAAC;AACH;AAEA,SAAS,sBAAsB,UAAkB,WAAyB;AACxE,QAAM,MAAMD,UAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,aAAa,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAC3C,QAAM,WAAW,WAAW,MAAM,GAAG;AACrC,aAAW,OAAO,UAAU;AAC1B,QAAI,sBAAsB,GAAG,GAAG;AAC9B,YAAM,IAAI,sBAAsB;AAAA,QAC9B,MAAM;AAAA,QACN,YAAY,+BAA+B,UAAU,SAAS;AAAA,MAChE,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAoBA,SAAS,gCACP,UACA,WACA,EAAE,SAAS,eAAe,GACpB;AACN,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,UAAU,QAAQ,OAAO,CAAC,WAAW,CAAC,eAAe,IAAI,MAAM,CAAC;AACtE,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,IAAI,wBAAwB,EAAE,MAAM,UAAU,WAAW,SAAS,QAAQ,CAAC;AACnF;AAwBA,IAAM,kBAAkB,qBAAuC;AAGxD,SAAS,+BAAqC;AACnD,kBAAgB,MAAM;AACxB;AAEA,SAAS,iBAAiB,SAAmC;AAC3D,SAAO,gBAAgB,IAAI,SAAS,MAAM;AACxC,UAAM,SAASC,cAAa,SAAS,OAAO;AAC5C,UAAM,UAAU,0BAA0B,SAAS,MAAM;AAIzD,UAAM,cACJ,QAAQ,WAAW,IACf,oBAAI,IAAiC,IACrC,uBAAuB,SAAS,MAAM;AAG5C,WAAO,EAAE,SAAS,gBAAgB,IAAI,IAAI,YAAY,KAAK,CAAC,GAAG,YAAY;AAAA,EAC7E,CAAC;AACH;AAEA,SAAS,gBAAgB,UAAkB,WAA2B;AACpE,MAAI,MAAMF,UAAS,WAAW,QAAQ;AAEtC,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAE9B,QAAM,IAAI,QAAQ,OAAO,GAAG;AAE5B,MAAI,IAAI,SAAS,QAAQ,GAAG;AAC1B,UAAM,IAAI,MAAM,GAAG,EAAE;AAAA,EACvB,WAAW,QAAQ,SAAS;AAC1B,UAAM;AAAA,EACR;AAIA,QAAM,IAAI,QAAQ,uBAAuB,QAAQ;AAEjD,QAAM,IAAI,QAAQ,iBAAiB,KAAK;AACxC,SAAO,QAAQ,GAAG;AACpB;AAEO,SAAS,iBAAiB,WAAsC;AACrE,QAAM,YAAYE,MAAK,WAAW,QAAQ;AAC1C,MAAI,CAACC,YAAW,SAAS,KAAK,CAACC,UAAS,SAAS,EAAE,YAAY,GAAG;AAChE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAA6B,CAAC;AACpC,kBAAgB,WAAW,EAAE,YAAY,iBAAiB,GAAG,CAAC,YAAY;AAExE,QAAI,iBAAiB,OAAO,EAAG;AAI/B,gCAA4B,SAAS,SAAS;AAC9C,0BAAsB,SAAS,SAAS;AAExC,UAAM,YAAY,gBAAgB,SAAS,SAAS;AACpD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,SAAS;AACxD,UAAM,QAAQ,iBAAiB,OAAO;AACtC,UAAM,EAAE,QAAQ,IAAI;AACpB,oCAAgC,SAAS,WAAW,KAAK;AACzD,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,MAIA,eAAe,CAAC,GAAG,MAAM,WAAW,EACjC,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,SAAS,QAAQ,EACtC,IAAI,CAAC,CAAC,MAAM,MAAM,MAAM;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AAID,QAAM,cAAc,QAAQ,KAAK,CAAC,MAAM,EAAE,cAAc,qBAAqB;AAC7E,MAAI,aAAa;AACf,UAAM,IAAI;AAAA,MACR,gBAAgB,YAAY,QAAQ;AAAA,IACtC;AAAA,EACF;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM,wBAAwB,EAAE,WAAW,EAAE,SAAS,CAAC;AAExE,SAAO;AACT;AAGA,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,oBAAoB;AAE1B,SAAS,mBAAmB,SAAyB;AACnD,MAAI,QAAQ,WAAW,MAAM,EAAG,QAAO;AACvC,MAAI,QAAQ,WAAW,GAAG,EAAG,QAAO;AACpC,SAAO;AACT;AA4BO,SAAS,wBAAwB,GAAW,GAAmB;AACpE,QAAM,YAAY,EAAE,MAAM,GAAG;AAC7B,QAAM,YAAY,EAAE,MAAM,GAAG;AAC7B,QAAM,SAAS,KAAK,IAAI,UAAU,QAAQ,UAAU,MAAM;AAE1D,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC/B,UAAM,aAAa,mBAAmB,UAAU,CAAC,CAAC,IAAI,mBAAmB,UAAU,CAAC,CAAC;AACrF,QAAI,eAAe,EAAG,QAAO;AAAA,EAC/B;AAEA,MAAI,IAAI,EAAG,QAAO;AAClB,MAAI,IAAI,EAAG,QAAO;AAClB,SAAO;AACT;;;AG5SA,SAAS,cAAAC,aAAY,YAAAC,iBAAgB;AACrC,SAAS,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;AAIxC,IAAM,gBAAgB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAOrD,SAAS,oBAAoB,WAAyC;AAC3E,QAAM,QAAQC,MAAK,WAAW,IAAI;AAClC,MAAI,CAACC,YAAW,KAAK,KAAK,CAACC,UAAS,KAAK,EAAE,YAAY,GAAG;AACxD,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAgC,CAAC;AACvC,kBAAgB,OAAO,EAAE,YAAY,cAAc,GAAG,CAAC,YAAY;AACjE,QAAI,MAAMC,UAAS,OAAO,OAAO;AACjC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAACC,SAAQ,GAAG,EAAE,MAAM;AACvC,QAAI,IAAI,SAAS,QAAQ,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AAAA,aACxC,QAAQ,QAAS,OAAM;AAChC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,QAAQ,OAAO,GAAG;AAAA,IACpB,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;;;AC/BA,SAAS,cAAAC,aAAY,gBAAAC,eAAc,eAAe,iBAAiB;AACnE,SAAS,QAAAC,OAAM,SAAS,YAAAC,WAAU,eAAe;AAkE1C,SAAS,iBACd,WAGA,cAAsB,QAAQ,SAAS,GAEvC,YAAY,UACE;AACd,QAAM,SAAS,iBAAiB,SAAS;AACzC,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,aAAa,oBAAoB,SAAS;AAChD,QAAM,SAAS,WAAW,aAAa,SAAS;AAEhD,SAAO;AAAA,IACL,SAAS;AAAA,IACT,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,MACzB,UAAUC,UAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,WAAW,EAAE;AAAA,MACb,YAAY,EAAE;AAAA,MACd,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxD,GAAI,EAAE,kBAAkB,SAAY,EAAE,eAAe,EAAE,cAAc,IAAI,CAAC;AAAA,IAC5E,EAAE;AAAA,IACF,SAAS,QAAQ,IAAI,CAAC,OAAO;AAAA,MAC3B,UAAUA,UAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,YAAY,EAAE;AAAA,IAChB,EAAE;AAAA,IACF,YAAY,WAAW,IAAI,CAAC,OAAO;AAAA,MACjC,UAAUA,UAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,QAAQ,EAAE;AAAA,IACZ,EAAE;AAAA,IACF,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA;AAAA,MAEzB,UAAUA,UAAS,aAAa,EAAE,QAAQ;AAAA,MAC1C,WAAW,EAAE;AAAA,MACb,MAAM,EAAE;AAAA,IACV,EAAE;AAAA,EACJ;AACF;AAIO,SAAS,cAAc,UAAwB,WAAyB;AAC7E,YAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AACxC,QAAM,eAAeC,MAAK,WAAW,eAAe;AACpD,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC/D;AAIO,SAAS,aAAa,SAAiB,WAAmC;AAC/E,QAAM,eAAeA,MAAK,SAAS,eAAe;AAElD,MAAI,CAACC,YAAW,YAAY,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB,YAAY,2BAA2B;AAAA,EACjF;AAEA,QAAM,MAAM,KAAK,MAAMC,cAAa,cAAc,OAAO,CAAC;AAE1D,QAAM,SAA4B,IAAI,OAAO,IAAI,CAAC,MAAM;AACtD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,EAAE,SAAS;AAC1D,WAAO;AAAA,MACL,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,MACvC,WAAW,EAAE;AAAA,MACb;AAAA,MACA;AAAA,MACA,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxD,GAAI,EAAE,kBAAkB,SAAY,EAAE,eAAe,EAAE,cAAc,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF,CAAC;AAED,QAAM,UAAwB,IAAI,QAAQ,IAAI,CAAC,OAAO;AAAA,IACpD,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,YAAY,EAAE;AAAA,EAChB,EAAE;AAEF,QAAM,aAAmC,IAAI,WAAW,IAAI,CAAC,OAAO;AAAA,IAClE,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,QAAQ,EAAE;AAAA,EACZ,EAAE;AAIF,QAAM,cAAc,QAAQ,SAAS;AACrC,QAAM,UAAuB,IAAI,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,IACzD,UAAU,QAAQ,aAAa,EAAE,QAAQ;AAAA,IACzC,WAAW,EAAE;AAAA,IACb,MAAM,EAAE;AAAA,EACV,EAAE;AAEF,SAAO,EAAE,QAAQ,SAAS,YAAY,OAAO;AAC/C;","names":["basename","existsSync","readFileSync","statSync","extname","join","relative","readFileSync","readFileSync","createRequire","require_","createRequire","ts","HTTP_METHOD_NAMES","hasExportModifier","collectFromStatement","relative","extname","readFileSync","join","existsSync","statSync","existsSync","statSync","extname","join","relative","join","existsSync","statSync","relative","extname","existsSync","readFileSync","join","relative","relative","join","existsSync","readFileSync"]}
+{"version":3,"sources":["../src/server/scan/action-scan.ts","../src/server/scan/match.ts","../src/server/scan/scan.ts","../src/server/scan/detect-http-methods.ts","../src/server/scan/detect-route-policy.ts","../src/server/scan/ws-scan.ts","../src/server/scan/manifest.ts"],"mappings":";;;;;;;;;;;;;;;;;;AAIA,SAAS,YAAY,cAAc,gBAAgB;AACnD,SAAS,SAAS,MAAM,gBAAgB;AAuBjC,IAAM,qBAAqB;AA8B3B,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAChC;AAAA,EACA;AAAA,EAET,YACE,MACA,SACA,kBACA;AACA,UAAM,OAAO;AAIb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,mBAAmB;AAAA,EAC1B;AACF;AAEA,IAAM,oBAAoB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAChE,IAAM,eAAe;AACrB,IAAM,iBAAiB,oBAAI,IAAI,CAAC,SAAS,eAAe,aAAa,aAAa,gBAAgB,CAAC;AAO5F,SAAS,kBAAkB,WAAiC;AACjE,QAAM,aAAa,KAAK,WAAW,SAAS;AAC5C,MAAI,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,UAAU,EAAE,YAAY,GAAG;AAClE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAwB,CAAC;AAC/B,kBAAgB,YAAY,EAAE,YAAY,kBAAkB,GAAG,CAAC,YAAY;AAC1E,QAAI,aAAa,KAAK,OAAO,EAAG;AAChC,QAAI,MAAM,SAAS,YAAY,OAAO;AACtC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM;AACvC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,YAAY;AAAA,IACd,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;AAUO,SAAS,0BAA0B,WAA0C;AAClF,QAAM,aAAa,KAAK,WAAW,SAAS;AAC5C,MAAI,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,UAAU,EAAE,YAAY,GAAG;AAClE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,YAAY,oBAAI,IAAY;AAClC,QAAM,UAAiC,CAAC;AAGxC,kBAAgB,YAAY,EAAE,YAAY,kBAAkB,GAAG,CAAC,YAAY;AAC1E,QAAI,aAAa,KAAK,OAAO,EAAG;AAChC,UAAM,MAAM,SAAS,YAAY,OAAO,EAAE,QAAQ,OAAO,GAAG;AAG5D,QAAI,IAAI,WAAW,GAAG,kBAAkB,GAAG,EAAG;AAC9C,UAAM,OAAO,IAAI,MAAM,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM;AAE9C,UAAMA,YAAW,KAAK,SAAS,GAAG,IAAK,KAAK,MAAM,GAAG,EAAE,IAAI,KAAK,OAAQ;AACxE,QAAI,eAAe,IAAIA,SAAQ,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,2BAA2BA,SAAQ,+BAA+B,OAAO;AAAA,QACzE,CAAC,OAAO;AAAA,MACV;AAAA,IACF;AAGA,UAAM,SAAS,aAAa,SAAS,MAAM;AAC3C,UAAM,WAAW,cAAc,MAAM;AACrC,UAAM,SAAS,8BAA8B,KAAK,QAAQ,IAAI,SAAS;AACvE,UAAM,WAAW,oBAAoB,KAAK,QAAQ,KAAK,sBAAsB,KAAK,QAAQ;AAS1F,UAAM,cAAc,yBAAyB,QAAQ;AAIrD,UAAM,iBAAiB,KAAK,SAAS,GAAG,IAAI,SAAY,iBAAiB,YAAYA,SAAQ;AAC7F,eAAW,cAAc,aAAa;AACpC,YAAM,WAAW,eAAe,YAAY,OAAO;AACnD,UAAI,UAAU,IAAI,QAAQ,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,+BAA+B,QAAQ;AAAA,UACvC,CAAC,OAAO;AAAA,QACV;AAAA,MACF;AACA,gBAAU,IAAI,QAAQ;AACtB,YAAM,QAA6B;AAAA,QACjC,MAAM;AAAA,QACN,UAAU;AAAA,QACV,SAAS,kBAAkB,IAAI,IAAI,UAAU;AAAA,QAC7C;AAAA,QACA;AAAA,MACF;AACA,UAAI,mBAAmB,QAAW;AAChC,cAAM,iBAAiB;AAAA,MACzB;AACA,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF,CAAC;AAID,aAAW,SAAS,SAAS;AAC3B,UAAM,cAAc,GAAG,MAAM,IAAI;AACjC,UAAM,mBAAmB,QAAQ,KAAK,CAAC,UAAU,MAAM,KAAK,WAAW,WAAW,CAAC;AACnF,QAAI,kBAAkB;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,WAAW,MAAM,IAAI,uDAAuD,iBAAiB,IAAI;AAAA,QACjG,CAAC,MAAM,UAAU,iBAAiB,QAAQ;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AACT;AAeA,SAAS,yBAAyB,UAA4B;AAC5D,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,UAAU;AAChB,MAAI;AACJ,UAAQ,IAAI,QAAQ,KAAK,QAAQ,OAAO,MAAM;AAC5C,UAAM,OAAO,EAAE,CAAC;AAChB,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,EAAG,OAAM,IAAI,IAAI;AAAA,EACjE;AACA,MAAI,sCAAsC,KAAK,QAAQ,GAAG;AACxD,UAAM,IAAI,SAAS;AAAA,EACrB;AACA,MAAI,MAAM,SAAS,EAAG,OAAM,IAAI,SAAS;AACzC,SAAO,CAAC,GAAG,KAAK;AAClB;AAOA,SAAS,iBAAiB,YAAoBA,WAAsC;AAClF,QAAM,aAAa,KAAK,YAAY,kBAAkB;AACtD,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,aAAW,OAAO,CAAC,OAAO,QAAQ,OAAO,MAAM,GAAG;AAChD,UAAM,YAAY,KAAK,YAAY,GAAGA,SAAQ,GAAG,GAAG,EAAE;AACtD,QAAI,WAAW,SAAS,EAAG,QAAO;AAAA,EACpC;AACA,SAAO;AACT;AAEA,SAAS,cAAc,QAAwB;AAC7C,MAAI,MAAM;AACV,MAAI,IAAI;AACR,SAAO,IAAI,OAAO,QAAQ;AACxB,UAAM,KAAK,OAAO,CAAC;AACnB,UAAM,OAAO,OAAO,IAAI,CAAC;AACzB,QAAI,OAAO,OAAO,SAAS,KAAK;AAE9B,aAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,KAAM;AAChD;AAAA,IACF;AACA,QAAI,OAAO,OAAO,SAAS,KAAK;AAE9B,WAAK;AACL,aAAO,IAAI,OAAO,SAAS,KAAK,EAAE,OAAO,CAAC,MAAM,OAAO,OAAO,IAAI,CAAC,MAAM,KAAM;AAC/E,WAAK;AACL;AAAA,IACF;AACA,WAAO;AACP;AAAA,EACF;AACA,SAAO;AACT;;;AC3PO,SAAS,eAAe,WAG7B;AACA,QAAM,aAAuB,CAAC;AAE9B,QAAM,WAAW,UAAU,QAAQ,wBAAwB,CAAC,OAAe,SAAiB;AAC1F,eAAW,KAAK,IAAI;AAEpB,WAAO,MAAM,WAAW,MAAM,IAAI,SAAS;AAAA,EAC7C,CAAC;AAKD,SAAO,EAAE,SAAS,IAAI,OAAO,IAAI,QAAQ,GAAG,GAAG,WAAW;AAC5D;AAEO,SAAS,WACd,KACA,QACmE;AAEnE,MAAI,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC;AAC3B,MAAI,KAAK,SAAS,KAAK,KAAK,SAAS,GAAG,GAAG;AACzC,WAAO,KAAK,MAAM,GAAG,EAAE;AAAA,EACzB;AAEA,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI;AACrC,QAAI,OAAO;AACT,YAAM,SAAiC,CAAC;AACxC,YAAM,WAAW,QAAQ,CAAC,MAAM,MAAM;AACpC,eAAO,IAAI,IAAI,MAAM,IAAI,CAAC;AAAA,MAC5B,CAAC;AACD,aAAO,EAAE,OAAO,OAAO;AAAA,IACzB;AAAA,EACF;AACA,SAAO;AACT;;;ACtDA,SAAS,cAAAC,aAAY,gBAAAC,eAAc,YAAAC,iBAAgB;AACnD,SAAS,UAAU,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;;;ACYlD,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,qBAAqB;AAO9B,IAAM,WAAW,cAAc,YAAY,GAAG;AAE9C,IAAM,KAAK,SAAS,YAAY;AAEhC,IAAM,oBAAoB,IAAI,IAAY,YAAY;AAEtD,SAAS,kBAAkB,WAAwD;AACjF,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,KAAK,WAAW;AACzB,QAAI,EAAE,SAAS,GAAG,WAAW,cAAe,QAAO;AAAA,EACrD;AACA,SAAO;AACT;AAMA,SAAS,qBAAqB,MAAoB,OAA8B;AAE9E,MAAI,GAAG,oBAAoB,IAAI,KAAK,kBAAkB,GAAG,aAAa,IAAI,CAAC,GAAG;AAC5E,eAAW,QAAQ,KAAK,gBAAgB,cAAc;AACpD,UAAI,GAAG,aAAa,KAAK,IAAI,KAAK,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACvE,cAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,MACxC;AAAA,IACF;AACA;AAAA,EACF;AAEA,OACG,GAAG,sBAAsB,IAAI,KAAK,GAAG,mBAAmB,IAAI,MAC7D,kBAAkB,GAAG,aAAa,IAAI,CAAC,GACvC;AACA,QAAI,KAAK,QAAQ,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACtD,YAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,IACxC;AACA;AAAA,EACF;AAGA,MAAI,GAAG,oBAAoB,IAAI,KAAK,KAAK,gBAAgB,GAAG,eAAe,KAAK,YAAY,GAAG;AAC7F,eAAW,QAAQ,KAAK,aAAa,UAAU;AAE7C,UAAI,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACzC,cAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,0BAA0B,UAAkB,SAAgC;AAI1F,QAAM,MAAM,WAAWC,cAAa,UAAU,OAAO;AACrD,QAAM,aAAa,GAAG;AAAA,IACpB;AAAA,IACA;AAAA,IACA,GAAG,aAAa;AAAA;AAAA,IACK;AAAA,IACrB,GAAG,WAAW;AAAA,EAChB;AACA,QAAM,QAAQ,oBAAI,IAAgB;AAClC,aAAW,QAAQ,WAAW,YAAY;AACxC,yBAAqB,MAAM,KAAK;AAAA,EAClC;AAKA,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK,iBAAiB;AAC1C;;;AC1DA,SAAS,iBAAAC,sBAAqB;AAM9B,IAAMC,YAAWC,eAAc,YAAY,GAAG;AAE9C,IAAMC,MAAKF,UAAS,YAAY;AAEhC,IAAMG,qBAAoB,IAAI,IAAY,YAAY;AAEtD,IAAM,aAAa;AAEnB,SAASC,mBAAkB,WAAwD;AACjF,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,KAAK,WAAW;AACzB,QAAI,EAAE,SAASF,IAAG,WAAW,cAAe,QAAO;AAAA,EACrD;AACA,SAAO;AACT;AAGA,SAAS,OAAO,YAA0C;AACxD,MAAI,UAAU;AACd,aAAS;AACP,QACEA,IAAG,0BAA0B,OAAO,KACpCA,IAAG,eAAe,OAAO,KACzBA,IAAG,sBAAsB,OAAO,KAChCA,IAAG,oBAAoB,OAAO,GAC9B;AACA,gBAAU,QAAQ;AAClB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,MAA4C;AACxE,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAIA,IAAG,aAAa,IAAI,EAAG,QAAO,KAAK,SAAS;AAChD,MAAIA,IAAG,gBAAgB,IAAI,EAAG,QAAO,KAAK,SAAS;AACnD,SAAO;AACT;AAsBA,SAAS,qBAAqB,YAA4C;AACxE,QAAM,MAAM,OAAO,UAAU;AAC7B,SAAOA,IAAG,gBAAgB,GAAG,KAAK,IAAI,SAAS,WAAW,WAAW;AACvE;AAGA,SAAS,iBAAiB,SAAkE;AAC1F,aAAW,YAAY,QAAQ,YAAY;AACzC,QAAIA,IAAG,mBAAmB,QAAQ,EAAG;AACrC,QAAI,CAAC,qBAAqB,SAAS,IAAI,EAAG;AAG1C,WAAOA,IAAG,qBAAqB,QAAQ,IACnC,qBAAqB,SAAS,WAAW,IACzC;AAAA,EACN;AACA,SAAO;AACT;AASA,SAAS,WAAW,YAAwD;AAC1E,QAAM,OAAO,OAAO,UAAU;AAE9B,MAAIA,IAAG,0BAA0B,IAAI,EAAG,QAAO,iBAAiB,IAAI;AAEpE,MAAI,CAACA,IAAG,iBAAiB,IAAI,EAAG,QAAO;AAEvC,QAAM,SAAS,OAAO,KAAK,UAAU;AAErC,MAAIA,IAAG,2BAA2B,MAAM,KAAK,OAAO,KAAK,SAAS,YAAY;AAE5E,WAAO,KAAK,UAAU,WAAW,IAAI,YAAY,qBAAqB,KAAK,UAAU,CAAC,CAAC;AAAA,EACzF;AAEA,aAAW,YAAY,KAAK,WAAW;AACrC,UAAM,MAAM,OAAO,QAAQ;AAC3B,QAAI,CAACA,IAAG,0BAA0B,GAAG,EAAG;AACxC,UAAM,OAAO,iBAAiB,GAAG;AACjC,QAAI,SAAS,OAAW,QAAO;AAAA,EACjC;AAIA,MAAIA,IAAG,2BAA2B,MAAM,EAAG,QAAO,WAAW,OAAO,UAAU;AAE9E,SAAO;AACT;AAGA,SAAS,yBAAyB,YAAuD;AACvF,QAAM,SAAS,oBAAI,IAA2B;AAC9C,aAAW,QAAQ,WAAW,YAAY;AACxC,QAAI,CAACA,IAAG,oBAAoB,IAAI,EAAG;AACnC,eAAW,QAAQ,KAAK,gBAAgB,cAAc;AACpD,UAAIA,IAAG,aAAa,KAAK,IAAI,KAAK,KAAK,gBAAgB,QAAW;AAChE,eAAO,IAAI,KAAK,KAAK,MAAM,KAAK,WAAW;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,6BACP,MACA,UACM;AACN,MAAI,CAACE,mBAAkBF,IAAG,aAAa,IAAI,CAAC,EAAG;AAC/C,aAAW,QAAQ,KAAK,gBAAgB,cAAc;AACpD,QAAI,CAACA,IAAG,aAAa,KAAK,IAAI,KAAK,CAACC,mBAAkB,IAAI,KAAK,KAAK,IAAI,EAAG;AAC3E,QAAI,KAAK,gBAAgB,OAAW;AACpC,UAAM,OAAO,WAAW,KAAK,WAAW;AACxC,QAAI,SAAS,OAAW,UAAS,IAAI,KAAK,KAAK,MAAoB,IAAI;AAAA,EACzE;AACF;AAMA,SAAS,6BACP,MACA,QACA,UACM;AACN,MAAI,KAAK,oBAAoB,OAAW;AACxC,MAAI,CAAC,KAAK,gBAAgB,CAACD,IAAG,eAAe,KAAK,YAAY,EAAG;AACjE,aAAW,QAAQ,KAAK,aAAa,UAAU;AAC7C,QAAI,CAACC,mBAAkB,IAAI,KAAK,KAAK,IAAI,EAAG;AAC5C,UAAM,QAAQ,OAAO,KAAK,KAAK,gBAAgB,KAAK,MAAM,IAAI;AAC9D,QAAI,UAAU,OAAW;AACzB,UAAM,OAAO,WAAW,KAAK;AAC7B,QAAI,SAAS,OAAW,UAAS,IAAI,KAAK,KAAK,MAAoB,IAAI;AAAA,EACzE;AACF;AAEA,SAASE,sBACP,MACA,QACA,UACM;AACN,MAAIH,IAAG,oBAAoB,IAAI,GAAG;AAChC,iCAA6B,MAAM,QAAQ;AAC3C;AAAA,EACF;AACA,MAAIA,IAAG,oBAAoB,IAAI,GAAG;AAChC,iCAA6B,MAAM,QAAQ,QAAQ;AAAA,EACrD;AAGF;AAYO,SAAS,uBACd,UACA,SACkC;AAClC,QAAM,aAAaA,IAAG;AAAA,IACpB;AAAA,IACA;AAAA,IACAA,IAAG,aAAa;AAAA;AAAA,IACK;AAAA,IACrBA,IAAG,WAAW;AAAA,EAChB;AACA,QAAM,SAAS,yBAAyB,UAAU;AAClD,QAAM,WAAW,oBAAI,IAAiC;AACtD,aAAW,QAAQ,WAAW,YAAY;AACxC,IAAAG,sBAAqB,MAAM,QAAQ,QAAQ;AAAA,EAC7C;AACA,SAAO;AACT;;;AFrOA,IAAM,mBAAmB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAK/D,IAAM,kBAAkB;AAExB,SAAS,iBAAiB,UAA2B;AACnD,SAAO,gBAAgB,KAAK,SAAS,QAAQ,CAAC;AAChD;AAEA,SAAS,sBAAsB,SAA0B;AACvD,MAAI,QAAQ;AACZ,aAAW,MAAM,SAAS;AACxB,QAAI,OAAO,IAAK;AAAA,aACP,OAAO,IAAK;AAAA,aACZ,OAAO,OAAO,UAAU,EAAG,QAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,kCAAkC,SAA2B;AACpE,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI,QAAQ;AACZ,aAAW,MAAM,SAAS;AACxB,QAAI,OAAO,KAAK;AACd;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,KAAK;AACrB;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,OAAO,UAAU,GAAG;AACpC,UAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,gBAAU;AAAA,IACZ,OAAO;AACL,iBAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,SAAO;AACT;AAEA,SAAS,+BAA+B,UAAkB,WAA2B;AACnF,QAAM,MAAMC,UAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,aAAa,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAC3C,QAAM,WAAW,WAAW,MAAM,GAAG,EAAE,QAAQ,iCAAiC;AAChF,SAAO,UAAU,SAAS,KAAK,GAAG,CAAC,GAAG,GAAG;AAC3C;AASA,SAAS,4BAA4B,UAAkB,WAAyB;AAC9E,QAAM,MAAMD,UAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,CAAC,OAAO,GAAG,IAAI,IAAI,IAAI,MAAM,GAAG;AACtC,MAAI,UAAU,SAAS,KAAK,WAAW,EAAG;AAE1C,QAAM,aAAa,IAAI,MAAM,GAAG,CAACC,SAAQ,GAAG,EAAE,MAAM;AACpD,QAAM,IAAI,yBAAyB;AAAA,IACjC,MAAM;AAAA,IACN,kBAAkB,QAAQ,UAAU;AAAA,IACpC,oBAAoB,UAAU,WAAW,MAAM,GAAG,EAAE,KAAK,GAAG,CAAC;AAAA,IAC7D,YAAY,UAAU,KAAK,KAAK,GAAG,CAAC;AAAA,EACtC,CAAC;AACH;AAEA,SAAS,sBAAsB,UAAkB,WAAyB;AACxE,QAAM,MAAMD,UAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,aAAa,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAC3C,QAAM,WAAW,WAAW,MAAM,GAAG;AACrC,aAAW,OAAO,UAAU;AAC1B,QAAI,sBAAsB,GAAG,GAAG;AAC9B,YAAM,IAAI,sBAAsB;AAAA,QAC9B,MAAM;AAAA,QACN,YAAY,+BAA+B,UAAU,SAAS;AAAA,MAChE,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAoBA,SAAS,gCACP,UACA,WACA,EAAE,SAAS,eAAe,GACpB;AACN,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,UAAU,QAAQ,OAAO,CAAC,WAAW,CAAC,eAAe,IAAI,MAAM,CAAC;AACtE,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,IAAI,wBAAwB,EAAE,MAAM,UAAU,WAAW,SAAS,QAAQ,CAAC;AACnF;AAwBA,IAAM,kBAAkB,qBAAuC;AAGxD,SAAS,+BAAqC;AACnD,kBAAgB,MAAM;AACxB;AAEA,SAAS,iBAAiB,SAAmC;AAC3D,SAAO,gBAAgB,IAAI,SAAS,MAAM;AACxC,UAAM,SAASC,cAAa,SAAS,OAAO;AAC5C,UAAM,UAAU,0BAA0B,SAAS,MAAM;AAIzD,UAAM,cACJ,QAAQ,WAAW,IACf,oBAAI,IAAiC,IACrC,uBAAuB,SAAS,MAAM;AAG5C,WAAO,EAAE,SAAS,gBAAgB,IAAI,IAAI,YAAY,KAAK,CAAC,GAAG,YAAY;AAAA,EAC7E,CAAC;AACH;AAEA,SAAS,gBAAgB,UAAkB,WAA2B;AACpE,MAAI,MAAMF,UAAS,WAAW,QAAQ;AAEtC,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAE9B,QAAM,IAAI,QAAQ,OAAO,GAAG;AAE5B,MAAI,IAAI,SAAS,QAAQ,GAAG;AAC1B,UAAM,IAAI,MAAM,GAAG,EAAE;AAAA,EACvB,WAAW,QAAQ,SAAS;AAC1B,UAAM;AAAA,EACR;AAIA,QAAM,IAAI,QAAQ,uBAAuB,QAAQ;AAEjD,QAAM,IAAI,QAAQ,iBAAiB,KAAK;AACxC,SAAO,QAAQ,GAAG;AACpB;AAEO,SAAS,iBAAiB,WAAsC;AACrE,QAAM,YAAYE,MAAK,WAAW,QAAQ;AAC1C,MAAI,CAACC,YAAW,SAAS,KAAK,CAACC,UAAS,SAAS,EAAE,YAAY,GAAG;AAChE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAA6B,CAAC;AACpC,kBAAgB,WAAW,EAAE,YAAY,iBAAiB,GAAG,CAAC,YAAY;AAExE,QAAI,iBAAiB,OAAO,EAAG;AAI/B,gCAA4B,SAAS,SAAS;AAC9C,0BAAsB,SAAS,SAAS;AAExC,UAAM,YAAY,gBAAgB,SAAS,SAAS;AACpD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,SAAS;AACxD,UAAM,QAAQ,iBAAiB,OAAO;AACtC,UAAM,EAAE,QAAQ,IAAI;AACpB,oCAAgC,SAAS,WAAW,KAAK;AACzD,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,MAIA,eAAe,CAAC,GAAG,MAAM,WAAW,EACjC,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,SAAS,QAAQ,EACtC,IAAI,CAAC,CAAC,MAAM,MAAM,MAAM;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AAID,QAAM,cAAc,QAAQ,KAAK,CAAC,MAAM,EAAE,cAAc,qBAAqB;AAC7E,MAAI,aAAa;AACf,UAAM,IAAI;AAAA,MACR,gBAAgB,YAAY,QAAQ;AAAA,IACtC;AAAA,EACF;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM,wBAAwB,EAAE,WAAW,EAAE,SAAS,CAAC;AAExE,SAAO;AACT;AAGA,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,oBAAoB;AAE1B,SAAS,mBAAmB,SAAyB;AACnD,MAAI,QAAQ,WAAW,MAAM,EAAG,QAAO;AACvC,MAAI,QAAQ,WAAW,GAAG,EAAG,QAAO;AACpC,SAAO;AACT;AA4BO,SAAS,wBAAwB,GAAW,GAAmB;AACpE,QAAM,YAAY,EAAE,MAAM,GAAG;AAC7B,QAAM,YAAY,EAAE,MAAM,GAAG;AAC7B,QAAM,SAAS,KAAK,IAAI,UAAU,QAAQ,UAAU,MAAM;AAE1D,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC/B,UAAM,aAAa,mBAAmB,UAAU,CAAC,CAAC,IAAI,mBAAmB,UAAU,CAAC,CAAC;AACrF,QAAI,eAAe,EAAG,QAAO;AAAA,EAC/B;AAEA,MAAI,IAAI,EAAG,QAAO;AAClB,MAAI,IAAI,EAAG,QAAO;AAClB,SAAO;AACT;;;AG5SA,SAAS,cAAAC,aAAY,YAAAC,iBAAgB;AACrC,SAAS,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;AAIxC,IAAM,gBAAgB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAOrD,SAAS,oBAAoB,WAAyC;AAC3E,QAAM,QAAQC,MAAK,WAAW,IAAI;AAClC,MAAI,CAACC,YAAW,KAAK,KAAK,CAACC,UAAS,KAAK,EAAE,YAAY,GAAG;AACxD,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAgC,CAAC;AACvC,kBAAgB,OAAO,EAAE,YAAY,cAAc,GAAG,CAAC,YAAY;AACjE,QAAI,MAAMC,UAAS,OAAO,OAAO;AACjC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAACC,SAAQ,GAAG,EAAE,MAAM;AACvC,QAAI,IAAI,SAAS,QAAQ,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AAAA,aACxC,QAAQ,QAAS,OAAM;AAChC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,QAAQ,OAAO,GAAG;AAAA,IACpB,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;;;AC/BA,SAAS,cAAAC,aAAY,gBAAAC,eAAc,eAAe,iBAAiB;AACnE,SAAS,QAAAC,OAAM,SAAS,YAAAC,WAAU,eAAe;AA6E1C,SAAS,iBACd,WAGA,cAAsB,QAAQ,SAAS,GAEvC,YAAY,UACE;AACd,QAAM,SAAS,iBAAiB,SAAS;AACzC,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,aAAa,oBAAoB,SAAS;AAChD,QAAM,SAAS,WAAW,aAAa,SAAS;AAEhD,SAAO;AAAA,IACL,SAAS;AAAA,IACT,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,MACzB,UAAUC,UAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,WAAW,EAAE;AAAA,MACb,YAAY,EAAE;AAAA,MACd,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxD,GAAI,EAAE,kBAAkB,SAAY,EAAE,eAAe,EAAE,cAAc,IAAI,CAAC;AAAA,IAC5E,EAAE;AAAA,IACF,SAAS,QAAQ,IAAI,CAAC,OAAO;AAAA,MAC3B,UAAUA,UAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,YAAY,EAAE;AAAA,IAChB,EAAE;AAAA,IACF,YAAY,WAAW,IAAI,CAAC,OAAO;AAAA,MACjC,UAAUA,UAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,QAAQ,EAAE;AAAA,IACZ,EAAE;AAAA,IACF,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA;AAAA,MAEzB,UAAUA,UAAS,aAAa,EAAE,QAAQ;AAAA,MAC1C,WAAW,EAAE;AAAA,MACb,MAAM,EAAE;AAAA,IACV,EAAE;AAAA,EACJ;AACF;AAIO,SAAS,cAAc,UAAwB,WAAyB;AAC7E,YAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AACxC,QAAM,eAAeC,MAAK,WAAW,eAAe;AACpD,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC/D;AAIO,SAAS,aAAa,SAAiB,WAAmC;AAC/E,QAAM,eAAeA,MAAK,SAAS,eAAe;AAElD,MAAI,CAACC,YAAW,YAAY,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB,YAAY,2BAA2B;AAAA,EACjF;AAEA,QAAM,MAAM,KAAK,MAAMC,cAAa,cAAc,OAAO,CAAC;AAE1D,QAAM,SAA4B,IAAI,OAAO,IAAI,CAAC,MAAM;AACtD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,EAAE,SAAS;AAC1D,WAAO;AAAA,MACL,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,MACvC,WAAW,EAAE;AAAA,MACb;AAAA,MACA;AAAA,MACA,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxD,GAAI,EAAE,kBAAkB,SAAY,EAAE,eAAe,EAAE,cAAc,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF,CAAC;AAED,QAAM,UAAwB,IAAI,QAAQ,IAAI,CAAC,OAAO;AAAA,IACpD,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,YAAY,EAAE;AAAA,EAChB,EAAE;AAEF,QAAM,aAAmC,IAAI,WAAW,IAAI,CAAC,OAAO;AAAA,IAClE,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,QAAQ,EAAE;AAAA,EACZ,EAAE;AAIF,QAAM,cAAc,QAAQ,SAAS;AACrC,QAAM,UAAuB,IAAI,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,IACzD,UAAU,QAAQ,aAAa,EAAE,QAAQ;AAAA,IACzC,WAAW,EAAE;AAAA,IACb,MAAM,EAAE;AAAA,EACV,EAAE;AAEF,SAAO,EAAE,QAAQ,SAAS,YAAY,OAAO;AAC/C;","names":["basename","existsSync","readFileSync","statSync","extname","join","relative","readFileSync","readFileSync","createRequire","require_","createRequire","ts","HTTP_METHOD_NAMES","hasExportModifier","collectFromStatement","relative","extname","readFileSync","join","existsSync","statSync","existsSync","statSync","extname","join","relative","join","existsSync","statSync","relative","extname","existsSync","readFileSync","join","relative","relative","join","existsSync","readFileSync"]}

package/dist/{chunk-G5JYB2LO.js → chunk-IF7CZXPW.js}

@@ -12,7 +12,7 @@ import {
   sendError,
   sendJson,
   validateCsrfRequest
-} from "./chunk-CTRVTBGY.js";
+} from "./chunk-L4TB6FXQ.js";
 import {
   buildSecurityHeaders
 } from "./chunk-RPET332G.js";
@@ -2616,4 +2616,4 @@ export {
   CsrfReadinessStore,
   applySecurityHeaders
 };
-//# sourceMappingURL=chunk-G5JYB2LO.js.map
+//# sourceMappingURL=chunk-IF7CZXPW.js.map

package/dist/{chunk-CLBJTDI6.js → chunk-KZ3PXNPT.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   findControllerFiles
-} from "./chunk-CTRVTBGY.js";
+} from "./chunk-L4TB6FXQ.js";
 
 // src/cli/commands/build/emit-controllers.ts
 import "reflect-metadata";
@@ -186,4 +186,4 @@ export {
   emitControllerArtifacts,
   describeControllerArtifacts
 };
-//# sourceMappingURL=chunk-CLBJTDI6.js.map
+//# sourceMappingURL=chunk-KZ3PXNPT.js.map

package/dist/{chunk-CTRVTBGY.js → chunk-L4TB6FXQ.js}

@@ -136,7 +136,13 @@ function incomingMessageToHandlerRequest(req) {
 // src/server/http/controller-dispatch.ts
 import { readdirSync } from "fs";
 import { join } from "path";
-import { createDecoratorHandler, isControllerClass } from "@theokit/http";
+import {
+  CONTROLLER_PREFIX,
+  createDecoratorHandler,
+  getMeta,
+  isControllerClass,
+  Reflector
+} from "@theokit/http";
 
 // src/server/security/csrf-warn-dispatch.ts
 function dispatchCsrfWarn(payload) {
@@ -256,6 +262,16 @@ function enforceCsrf(req, mode, logger, disallowed, auditLogger) {
 
 // src/server/http/controller-dispatch.ts
 var CSRF_PROTECTED_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var CSRF_EXEMPT_METADATA = "theokit:csrf-exempt";
+function segments(value) {
+  return value.split("/").filter(Boolean);
+}
+function pathOwnedByPrefix(pathname, prefix) {
+  const want = segments(prefix);
+  const got = segments(pathname);
+  if (want.length === 0 || got.length < want.length) return false;
+  return want.every((segment, i) => got[i] === segment);
+}
 function findControllerFiles(dir) {
   const found = [];
   const walk = (current) => {
@@ -296,9 +312,15 @@ async function createControllerDispatcher(opts) {
   const classes = await scanControllers(opts.controllersDir, opts.loadModule);
   if (classes.length === 0) return null;
   const handle = createDecoratorHandler({ controllers: classes, serveAgent: opts.serveAgent });
+  const reflector = new Reflector();
+  const exemptPrefixes = classes.filter((cls) => reflector.getByKey(CSRF_EXEMPT_METADATA, cls) === true).map((cls) => {
+    const meta = getMeta(CONTROLLER_PREFIX, cls);
+    return meta?.prefix ?? "";
+  }).filter((prefix) => prefix !== "");
   return {
     dispatch: (request) => handle(request),
-    matches: (method, pathname) => handle.matches(method, pathname)
+    matches: (method, pathname) => handle.matches(method, pathname),
+    isCsrfExempt: (pathname) => exemptPrefixes.some((p) => pathOwnedByPrefix(pathname, p))
   };
 }
 async function writeControllerResponse(res, response) {
@@ -323,7 +345,7 @@ async function dispatchControllerRequest(args) {
   const method = (req.method ?? "GET").toUpperCase();
   const webRequest = incomingMessageToWebRequest(req);
   const pathname = new URL(webRequest.url).pathname;
-  if (CSRF_PROTECTED_METHODS.has(method) && dispatcher.matches(method, pathname)) {
+  if (CSRF_PROTECTED_METHODS.has(method) && dispatcher.matches(method, pathname) && !dispatcher.isCsrfExempt(pathname)) {
     const decision = enforceCsrf(
       req,
       csrfMode,
@@ -361,4 +383,4 @@ export {
   scanControllerModules,
   dispatchControllerRequest
 };
-//# sourceMappingURL=chunk-CTRVTBGY.js.map
+//# sourceMappingURL=chunk-L4TB6FXQ.js.map

package/dist/chunk-L4TB6FXQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/contracts/client-safe-error.ts","../src/server/http/send-response.ts","../src/server/http/node-request.ts","../src/server/http/controller-dispatch.ts","../src/server/security/csrf-warn-dispatch.ts","../src/server/observability/audit-log.ts","../src/server/security/csrf.ts"],"sourcesContent":["import type { TheoErrorEnvelope } from './error-envelope.js'\n\n/**\n * What an error is allowed to tell the caller.\n *\n * Most error codes describe something the caller did and can fix, so their message is the useful\n * part of the response. An *internal* failure is the opposite: its message describes the server —\n * a connection string, an upstream host, a stack of internal names — and the caller can act on\n * none of it. In production it is redacted; in development it is exactly what makes the framework\n * debuggable, so it stays.\n *\n * This lives in one place because it was previously stated in two and missing from a third. The\n * Node runner redacted, the Web error builder redacted, and an exception escaping a Web handler\n * took a hand-built path that did neither — same route, same failure, more disclosure depending\n * on which transport served it. That is the \"one contract, three transports\" rule in\n * `rules/three-target-parity.md` being broken by duplication rather than by design.\n */\n\n/** Both spellings the codebase uses for \"this is our fault, and the detail is ours too\". */\nconst INTERNAL_CODES: ReadonlySet<string> = new Set(['INTERNAL_ERROR', 'INTERNAL_SERVER_ERROR'])\n\nconst GENERIC_INTERNAL_MESSAGE = 'Internal server error'\n\nfunction redacts(code: string): boolean {\n  return INTERNAL_CODES.has(code) && process.env.NODE_ENV === 'production'\n}\n\n/** The message this code may carry to the caller. */\nexport function clientSafeErrorMessage(code: string, message: string): string {\n  return redacts(code) ? GENERIC_INTERNAL_MESSAGE : message\n}\n\n/**\n * The envelope this code may carry to the caller.\n *\n * When it redacts, `cause`, `meta` and `ext` go with the message rather than being filtered\n * field by field: they exist to describe the failure, and the whole point is that this failure is\n * not describable to the caller. Keeping the code is what lets a client branch on it.\n */\nexport function clientSafeErrorEnvelope(envelope: TheoErrorEnvelope): TheoErrorEnvelope {\n  if (!redacts(envelope.code)) return envelope\n  return { code: envelope.code, message: GENERIC_INTERNAL_MESSAGE }\n}\n","import type { ServerResponse } from 'node:http'\n\nimport { clientSafeErrorMessage } from '../../core/contracts/client-safe-error.js'\nimport type { TheoTransformer } from '../transformer.js'\n\n/**\n * Canonical HTTP response helpers (T5.1 extraction).\n *\n * Moved out of execute.ts so request-pipeline stages (execute-stages.ts,\n * handle-request-error.ts, etc.) can depend on these helpers without\n * creating a cycle through execute.ts.\n *\n * Public surface re-exported from execute.ts for backward compat — every\n * existing caller of `sendError` / `sendJson` continues to work via the\n * `theokit/server` barrel.\n */\n\nexport function sendJson(\n  res: ServerResponse,\n  data: unknown,\n  status = 200,\n  transformer?: TheoTransformer,\n): void {\n  // T1.2 — transformer-aware serialization. Default (no transformer) uses\n  // JSON.stringify direct for backward compat.\n  const body = transformer ? transformer.serialize(data) : JSON.stringify(data)\n  res.writeHead(status, {\n    'Content-Type': 'application/json',\n    'Content-Length': Buffer.byteLength(body),\n  })\n  res.end(body)\n}\n\n/** Render anything that would end the log line as a visible escape, so one call logs one line. */\nfunction oneLine(value: string): string {\n  return value.replace(/[\\r\\n]/g, '\\\\n')\n}\n\nexport interface SendErrorOptions {\n  custom404Html?: string\n  custom500Html?: string\n}\n\n/**\n * Canonical error response.\n *\n * T6.3 (PV-17): the positional 7-param signature is preserved for backward\n * compat. New call sites should use the options-bag form:\n *\n *   sendError(res, { code, message, status, issues?, requestId?, options? })\n *\n * Both shapes resolve to the same implementation.\n */\nexport interface SendErrorInput {\n  code: string\n  message: string\n  status: number\n  issues?: unknown[]\n  requestId?: string\n  options?: SendErrorOptions\n}\n\nexport function sendError(res: ServerResponse, input: SendErrorInput): void\n/* eslint-disable-next-line max-params -- T6.3: positional overload preserved\n   for backward compat (callers across cli/server still use positional). The\n   options-bag overload above is the recommended path. */\nexport function sendError(\n  res: ServerResponse,\n  code: string,\n  message: string,\n  status: number,\n  issues?: unknown[],\n  requestId?: string,\n  options?: SendErrorOptions,\n): void\n/* eslint-disable-next-line max-params -- delegates to two surface overloads above; the parameter\n   count mirrors the back-compat contract, not internal complexity. The `complexity` half of this\n   suppression went away when the redaction rule stopped being restated inline. */\nexport function sendError(\n  res: ServerResponse,\n  codeOrInput: string | SendErrorInput,\n  message?: string,\n  status?: number,\n  issues?: unknown[],\n  requestId?: string,\n  options?: SendErrorOptions,\n): void {\n  let code: string\n  if (typeof codeOrInput === 'string') {\n    code = codeOrInput\n    message = message ?? ''\n    status = status ?? 500\n  } else {\n    code = codeOrInput.code\n    message = codeOrInput.message\n    status = codeOrInput.status\n    issues = codeOrInput.issues\n    requestId = codeOrInput.requestId\n    options = codeOrInput.options\n  }\n  const errorMessage = clientSafeErrorMessage(code, message)\n\n  if (code === 'INTERNAL_ERROR') {\n    // One log entry per call, whatever the message contains. An exception message can be built\n    // from request data and can therefore carry a newline; unescaped, that lets a caller append\n    // whatever lines it likes to the log — including a plausible entry attributed to something\n    // else (CodeQL `js/log-injection`).\n    console.error(`[${oneLine(requestId ?? 'no-id')}] ${oneLine(message)}`)\n  }\n\n  if (status === 404 && options?.custom404Html) {\n    const body = options.custom404Html\n    res.writeHead(404, {\n      'Content-Type': 'text/html; charset=utf-8',\n      'Content-Length': Buffer.byteLength(body),\n    })\n    res.end(body)\n    return\n  }\n  if (status === 500 && options?.custom500Html) {\n    const body = options.custom500Html\n    res.writeHead(500, {\n      'Content-Type': 'text/html; charset=utf-8',\n      'Content-Length': Buffer.byteLength(body),\n    })\n    res.end(body)\n    return\n  }\n\n  sendJson(\n    res,\n    {\n      error: {\n        code,\n        message: errorMessage,\n        ...(requestId ? { requestId } : {}),\n        ...(issues ? { issues } : {}),\n      },\n    },\n    status,\n  )\n}\n\n/**\n * T5a.2 Phase G slice 4/N — Web-Standards response helpers.\n *\n * Mirror of `sendJson` + `sendError` for the Web `Request`/`Response`\n * shape. Returns a native `Response` directly instead of mutating a\n * `ServerResponse`.\n *\n * v1.0 § Phase G.\n *\n * **Difference vs IncomingMessage path:**\n *   - No `Content-Length` set explicitly — the runtime computes it from\n *     the body when needed. CF Workers / Bun / Deno all do this; setting\n *     it manually risks conflict if the body is a stream rather than a\n *     fixed string.\n *   - Custom 404/500 HTML options preserved (same opts shape).\n *   - `requestId` flows into the response body's error envelope AND\n *     surfaces as `x-request-id` header (parity with handleWebRequestError\n *     Phase G slice 3/N).\n */\nexport function buildJsonResponse(\n  data: unknown,\n  status = 200,\n  transformer?: TheoTransformer,\n): Response {\n  const body = transformer ? transformer.serialize(data) : JSON.stringify(data)\n  return new Response(body, {\n    status,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\nexport function buildErrorResponse(input: SendErrorInput): Response {\n  const { code, message, status, issues, requestId, options } = input\n  const errorMessage = clientSafeErrorMessage(code, message)\n\n  if (code === 'INTERNAL_ERROR') {\n    // One log entry per call, whatever the message contains. An exception message can be built\n    // from request data and can therefore carry a newline; unescaped, that lets a caller append\n    // whatever lines it likes to the log — including a plausible entry attributed to something\n    // else (CodeQL `js/log-injection`).\n    console.error(`[${oneLine(requestId ?? 'no-id')}] ${oneLine(message)}`)\n  }\n\n  const headers: Record<string, string> = {}\n  if (requestId !== undefined) headers['x-request-id'] = requestId\n\n  if (status === 404 && options?.custom404Html !== undefined) {\n    headers['content-type'] = 'text/html; charset=utf-8'\n    return new Response(options.custom404Html, { status: 404, headers })\n  }\n  if (status === 500 && options?.custom500Html !== undefined) {\n    headers['content-type'] = 'text/html; charset=utf-8'\n    return new Response(options.custom500Html, { status: 500, headers })\n  }\n\n  headers['content-type'] = 'application/json'\n  const body = JSON.stringify({\n    error: {\n      code,\n      message: errorMessage,\n      ...(requestId ? { requestId } : {}),\n      ...(issues ? { issues } : {}),\n    },\n  })\n  return new Response(body, { status, headers })\n}\n","/**\n * Pure Node `IncomingMessage` → Web `Request` converters.\n *\n * Kept free of any dependency on `web-handler.js` / `execute*.js` so the\n * executor (`execute.ts`) can build the handler-facing Web `Request` without\n * pulling the Web dispatch pipeline into its import graph (ADR-0028 R3a — the\n * Node adapter is the ONLY place IncomingMessage ↔ Request conversion lives;\n * these are the primitive converters it and the executor share).\n */\nimport type { IncomingMessage } from 'node:http'\nimport { Readable } from 'node:stream'\n\n/** Pick the first usable string from Node's `string | string[] | undefined` headers. */\nfunction pickHeaderString(value: string | string[] | undefined): string | undefined {\n  if (typeof value === 'string') return value\n  if (Array.isArray(value)) {\n    for (const v of value) if (typeof v === 'string' && v.length > 0) return v\n  }\n  return undefined\n}\n\n/** Web Request requires an absolute URL; synthesize one from the Host header. */\nfunction synthesizeAbsoluteUrl(req: IncomingMessage): string {\n  const host = pickHeaderString(req.headers.host) ?? 'localhost'\n  return `http://${host}${req.url ?? '/'}`\n}\n\n/**\n * Collapse Node's `string | string[]` headers into a Web `Headers`. Repeated\n * headers are comma-joined (not `.append`ed) because `Headers.append` creates\n * multi-value entries that behave differently on `.get()` (EC-1).\n */\nfunction nodeHeadersToWeb(req: IncomingMessage): Headers {\n  const headers = new Headers()\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (value === undefined) continue\n    if (Array.isArray(value)) {\n      headers.set(key, value.join(', '))\n    } else {\n      headers.set(key, value)\n    }\n  }\n  return headers\n}\n\n/**\n * Build a Web `Request` from a Node `IncomingMessage`, body included. The Web\n * Request spec requires an absolute URL; we synthesize one from the Host header\n * (fallback `localhost` for test doubles).\n *\n * For methods with a body (POST/PUT/PATCH/DELETE), the Node Readable stream is\n * wrapped as a Web ReadableStream via `Readable.toWeb()` so downstream consumers\n * can call `request.json()` / `request.formData()` / `request.text()` natively.\n */\nexport function incomingMessageToWebRequest(req: IncomingMessage): Request {\n  const url = synthesizeAbsoluteUrl(req)\n  const headers = nodeHeadersToWeb(req)\n\n  const method = (req.method ?? 'GET').toUpperCase()\n  const hasBody = method !== 'GET' && method !== 'HEAD'\n\n  if (!hasBody) {\n    return new Request(url, { method, headers })\n  }\n\n  // Drain Node's Readable into a Web ReadableStream. `Readable.toWeb` is\n  // available in Node 18+ (theokit's engines.node floor is 22+, so safe).\n  const webStream = Readable.toWeb(req) as ReadableStream\n  return new Request(url, {\n    method,\n    headers,\n    body: webStream,\n    // EC-2: Node 18+ requires `duplex: 'half'` when body is a stream.\n    // The `RequestInit` type omits it (Web spec gap); cast accordingly.\n    ...({ duplex: 'half' } as { duplex: 'half' }),\n  })\n}\n\n/**\n * A Node request that has NOT been converted yet — method now, body only if someone claims it.\n *\n * theokit#400. `incomingMessageToWebRequest` drains the Node stream, and a stream drains once. A\n * dispatcher that converts in order to decide whether it owns a path has already spent the body on\n * every path it does not own: the next branch attaches to a readable that has already ended, waits\n * for an `'end'` that cannot fire twice, and the request hangs with no status at all.\n *\n * The fix is an ordering one, so the type encodes the ordering: a router reads `method` (free) and\n * calls `toRequest()` only after it has decided the request is its own. Passing the source instead\n * of a `Request` is what makes \"did you convert before deciding?\" answerable by reading a signature.\n *\n * `toRequest()` memoizes, because a second conversion of the same `IncomingMessage` yields a\n * Request whose body is an empty closed stream — a silent truncation, which is worse than the hang\n * it would replace.\n */\nexport interface WebRequestSource {\n  /** Uppercase HTTP method. Available without touching the body. */\n  readonly method: string\n  /** Convert on demand. Idempotent: repeated calls return the same `Request`. */\n  toRequest: () => Request\n}\n\n/** Wrap `req` as a {@link WebRequestSource} — the conversion is deferred and memoized. */\nexport function createWebRequestSource(req: IncomingMessage): WebRequestSource {\n  let converted: Request | undefined\n  return {\n    method: (req.method ?? 'GET').toUpperCase(),\n    toRequest: () => (converted ??= incomingMessageToWebRequest(req)),\n  }\n}\n\n/**\n * Build the Web `Request` handed to a route handler as `ctx.request` in the\n * Node server path (dev + `theokit start`). Method + absolute URL + headers\n * only — NO body.\n *\n * Why no body: the Node executor parses the request body BEFORE the handler\n * runs and exposes the parsed value as `ctx.body` (the typed, documented body\n * API). By the time the handler is called the Node stream is already drained,\n * so re-wrapping it would yield an empty/closed stream. Handlers read the body\n * via `ctx.body`; `ctx.request` is for the Web-standard header/cookie/URL/method\n * surface (e.g. `createSessionManagerWeb.getSession(ctx.request)`).\n *\n * Per ADR-0028 R3a, handlers see a Web `Request` in every runtime — this closes\n * the gap where the Node path leaked the raw `IncomingMessage` (whose `.headers`\n * is a plain object, so `.headers.get(...)` threw for Web-standard consumers).\n */\nexport function incomingMessageToHandlerRequest(req: IncomingMessage): Request {\n  return new Request(synthesizeAbsoluteUrl(req), {\n    method: (req.method ?? 'GET').toUpperCase(),\n    headers: nodeHeadersToWeb(req),\n  })\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Controller files are walked from the developer's `serverDir/controllers`\n * (a build-time config path), never from HTTP input. No injection vector.\n */\nimport { readdirSync, type Dirent } from 'node:fs'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport { join } from 'node:path'\n\nimport {\n  CONTROLLER_PREFIX,\n  createDecoratorHandler,\n  getMeta,\n  isControllerClass,\n  Reflector,\n  type ServeAgent,\n} from '@theokit/http'\n\nimport { dispatchCsrfWarn } from '../security/csrf-warn-dispatch.js'\nimport { enforceCsrf, type DisallowedConfig } from '../security/csrf.js'\n\nimport { incomingMessageToWebRequest } from './node-request.js'\nimport { sendError } from './send-response.js'\n\n/** A decorator controller constructor (`@Controller` class). */\ntype ControllerClass = new (...args: never[]) => object\n\n/** Loads a controller module by absolute path. In dev this is Vite's `ssrLoadModule`\n * (the Task 1.1 swc transform has already compiled the parameter decorators); tests\n * inject `@theokit/http`'s `loadControllerWithSwc`. */\nexport type ControllerModuleLoader = (absPath: string) => Promise<Record<string, unknown>>\n\n/** A built controller route table exposed as a pure Web-Standard handler. */\ninterface ControllerDispatcher {\n  /** `null` = no controller route matched — the host owns the miss (404 / fall-through). */\n  dispatch(request: Request): Promise<Response | null>\n  /** Non-executing route probe — true when a controller route owns `method` + `pathname`. */\n  matches(method: string, pathname: string): boolean\n  /** True when the controller owning `pathname` declared `theokit:csrf-exempt`. */\n  isCsrfExempt(pathname: string): boolean\n}\n\n// State-mutating methods get CSRF, mirroring the file-route pipeline (execute.ts).\nconst CSRF_PROTECTED_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])\n\n/**\n * A controller declaring that it authenticates by other means, so the CSRF gate has nothing to add.\n *\n * The case this exists for is a webhook. Stripe, GitHub and every other sender authenticate with an\n * HMAC over the request body — stronger than a header, and entirely unrelated to one. None of them\n * will ever send `X-Theo-Action`, so without this a webhook endpoint answers 403 to every real\n * delivery and the only escape is `csrf: 'warn'` for the whole application (theokit#535).\n *\n * DELIBERATELY separate from `theokit:public`. They answer different questions — \"may an\n * unauthenticated caller reach this?\" and \"does this route authenticate by other means?\" — and a\n * route can want the first without the second. Conflating them would lift the gate off every public\n * route in the ecosystem as a side effect of a webhook fix.\n *\n * Declared on the CONTROLLER, not the method: the granularity a webhook needs, and it avoids a\n * second path matcher alongside `handle.matches` that could drift from it.\n */\nconst CSRF_EXEMPT_METADATA = 'theokit:csrf-exempt'\n\n/**\n * Segment-wise, so `api/hooks` never matches `api/hooks-admin`.\n *\n * Split-and-filter rather than a trimming regex: `/^\\/+|\\/+$/` is quadratic on a pathname of\n * repeated slashes, and a pathname is attacker-supplied (sonarjs/slow-regex). Splitting is linear\n * and `filter(Boolean)` drops the empty segments the leading and trailing slashes produce, which is\n * all the trim was for.\n */\nfunction segments(value: string): string[] {\n  return value.split('/').filter(Boolean)\n}\n\nfunction pathOwnedByPrefix(pathname: string, prefix: string): boolean {\n  const want = segments(prefix)\n  const got = segments(pathname)\n  if (want.length === 0 || got.length < want.length) return false\n  return want.every((segment, i) => got[i] === segment)\n}\n\n/** Recursively collect `*.controller.ts` files under `dir` (absolute paths). */\n/**\n * Every `*.controller.ts` under `dir`, recursively. Exported for theokit#123: the build emitter\n * must find exactly the same set the dev dispatcher does, and two independent walks would be two\n * definitions of \"a controller\" that drift.\n */\nexport function findControllerFiles(dir: string): string[] {\n  const found: string[] = []\n  const walk = (current: string): void => {\n    let entries: Dirent[]\n    try {\n      entries = readdirSync(current, { withFileTypes: true })\n    } catch {\n      return // dir doesn't exist — no controllers\n    }\n    for (const entry of entries) {\n      const full = join(current, entry.name)\n      if (entry.isDirectory()) walk(full)\n      // theokit#123 — `.mjs` alongside `.ts`. Dev walks the SOURCE tree; production walks the\n      // COMPILED tree under `dist/controllers`, where the same files exist as `*.controller.mjs`.\n      // One walk for both keeps a single definition of \"a controller file\"; two would drift, and a\n      // file that counts in dev and not in production is exactly the dev/prod split this fixes.\n      else if (entry.name.endsWith('.controller.ts') || entry.name.endsWith('.controller.mjs'))\n        found.push(full)\n    }\n  }\n  walk(dir)\n  return found\n}\n\n/** A discovered controller: its source file + the loaded `@Controller` class. */\ninterface ControllerModule {\n  filePath: string\n  cls: ControllerClass\n  /**\n   * The module's full export namespace — theokit#124.\n   *\n   * Kept alongside the class because it is the ONLY place a `@Body(schema)` regains a name. The\n   * schema on `WalkResult.bodySchema` is a runtime `z.ZodType` with no source identifier, but it is\n   * the very object this module exported, so matching it back by reference identity recovers the\n   * exported name the typed-client codegen needs to write `z.infer<typeof ...>`.\n   *\n   * Unused by the dispatch path, which needs only the class.\n   */\n  exports: Readonly<Record<string, unknown>>\n}\n\n/**\n * Load every `@Controller` class under `controllersDir` via the injected loader,\n * keeping each class paired with its source file (needed by the typed-client\n * codegen to emit `import type { X } from '<file>'`). Non-controller exports are\n * ignored (`isControllerClass` — reused from @theokit/http).\n */\nexport async function scanControllerModules(\n  controllersDir: string,\n  loadModule: ControllerModuleLoader,\n): Promise<ControllerModule[]> {\n  const files = findControllerFiles(controllersDir)\n  const modules: ControllerModule[] = []\n  for (const filePath of files) {\n    const mod = await loadModule(filePath)\n    for (const exported of Object.values(mod)) {\n      if (typeof exported === 'function' && isControllerClass(exported)) {\n        modules.push({ filePath, cls: exported as ControllerClass, exports: mod })\n      }\n    }\n  }\n  return modules\n}\n\n/** Load every `@Controller` class under `controllersDir` (classes only). */\nasync function scanControllers(\n  controllersDir: string,\n  loadModule: ControllerModuleLoader,\n): Promise<ControllerClass[]> {\n  const modules = await scanControllerModules(controllersDir, loadModule)\n  return modules.map((m) => m.cls)\n}\n\n/**\n * Scan `controllersDir` and build a Web-Standard dispatcher over the decorator\n * controllers found. Returns `null` when the directory has no controllers, so\n * the host can skip the controller path entirely (zero cost for routes-only apps).\n *\n * Dispatch REUSES @theokit/http's `createDecoratorHandler` (match + `@Param`\n * binding + `@Body` validation + Response building) — never re-implemented (ADR-1).\n */\nexport async function createControllerDispatcher(opts: {\n  controllersDir: string\n  loadModule: ControllerModuleLoader\n  /** M47 — serves `@Expose`-bound agent routes (theo supplies a `mountAgent`-backed impl). */\n  serveAgent?: ServeAgent\n}): Promise<ControllerDispatcher | null> {\n  const classes = await scanControllers(opts.controllersDir, opts.loadModule)\n  if (classes.length === 0) return null\n  const handle = createDecoratorHandler({ controllers: classes, serveAgent: opts.serveAgent })\n  const reflector = new Reflector()\n\n  // Read once at construction: the metadata cannot change between requests, and re-walking every\n  // class per request would put a reflection pass on the hot path for a value that never moves.\n  const exemptPrefixes = classes\n    // `Reflector`, not `Reflect.getMetadata`: the global is only typed where `reflect-metadata`\n    // has been imported, and this module does not import it — the dts build fails on it (TS2339).\n    // `@SetMetadata` writes through the same store, so the reader is the framework's own.\n    .filter((cls) => reflector.getByKey<boolean>(CSRF_EXEMPT_METADATA, cls) === true)\n    .map((cls) => {\n      const meta = getMeta<{ prefix?: string }>(CONTROLLER_PREFIX, cls)\n      return meta?.prefix ?? ''\n    })\n    .filter((prefix) => prefix !== '')\n\n  return {\n    dispatch: (request) => handle(request),\n    matches: (method, pathname) => handle.matches(method, pathname),\n    isCsrfExempt: (pathname) => exemptPrefixes.some((p) => pathOwnedByPrefix(pathname, p)),\n  }\n}\n\n/**\n * Write a controller's Web `Response` to a Node response, byte for byte.\n *\n * The body used to be read with `await response.text()`, under a comment asserting that controllers\n * never stream. The comment was true of this path and hid the real problem: `text()` decodes as\n * UTF-8, so every byte >= 0x80 became `U+FFFD`. A payload of all 256 byte values arrived as 512\n * bytes; a 55 296-byte MPEG from `@theokit/plugin-voice` arrived as 76 790 bytes beginning\n * `ef bf bd`. Status 200, correct content-type, plausible length — invisible until someone opens\n * the file. File routes were never affected: `executeRoute` pumps the stream, so this was a silent\n * divergence between two paths meant to be at parity.\n *\n * `arrayBuffer()` fixes it without changing anything else. This path stays BUFFERED, exactly as\n * before — a controller returning a streamed body still has it collected here, so a plugin that\n * promises progressive delivery does not get it through a controller. That is a real limitation and\n * a separate change: making it stream alters when bytes reach the client, which is behaviour beyond\n * the corruption this repairs.\n */\nasync function writeControllerResponse(res: ServerResponse, response: Response): Promise<void> {\n  const headersBag: Record<string, string> = {}\n  for (const [k, v] of response.headers) {\n    if (k.toLowerCase() !== 'set-cookie') headersBag[k] = v\n  }\n  const setCookies = response.headers.getSetCookie()\n  if (setCookies.length > 0) res.setHeader('Set-Cookie', setCookies)\n  res.writeHead(response.status, headersBag)\n  // `Buffer.from(ArrayBuffer)` views the bytes as they are. Any string in between is a decode, and\n  // a decode of arbitrary bytes is a loss.\n  const body = response.body ? Buffer.from(await response.arrayBuffer()) : undefined\n  res.end(body !== undefined && body.length > 0 ? body : undefined)\n}\n\n/**\n * The `api-middleware` fall-through in one call: scan `controllersDir`, build the\n * dispatcher, and serve the request. Builds a body-ful Web `Request` (`@Body`\n * needs the body; the raw stream is undrained at a route miss) and enforces CSRF\n * with the SAME gate file routes use (parity). Returns `true` when a controller\n * handled it (or CSRF blocked it), `false` when there are no controllers OR none\n * matched (the host continues to its own 404). Built per-miss so controller edits\n * reflect via HMR.\n */\nexport async function dispatchControllerRequest(args: {\n  controllersDir: string\n  loadModule: ControllerModuleLoader\n  req: IncomingMessage\n  res: ServerResponse\n  csrfMode: 'off' | 'warn' | 'strict'\n  disallowed?: DisallowedConfig\n  requestId: string\n  /** M47 — serves `@Expose`-bound agent routes (mountAgent-backed); omit for routes-only apps. */\n  serveAgent?: ServeAgent\n}): Promise<boolean> {\n  const { req, res, csrfMode, disallowed, requestId } = args\n  const dispatcher = await createControllerDispatcher({\n    controllersDir: args.controllersDir,\n    loadModule: args.loadModule,\n    serveAgent: args.serveAgent,\n  })\n  if (!dispatcher) return false\n\n  const method = (req.method ?? 'GET').toUpperCase()\n  const webRequest = incomingMessageToWebRequest(req)\n  const pathname = new URL(webRequest.url).pathname\n\n  // CSRF parity: enforce ONLY when a protected-method controller route actually\n  // owns this path (probe with the non-executing matcher — never double-dispatch,\n  // which would run the handler + its side effects). An unrouted path falls\n  // through to the host's own 404, not a 403.\n  if (\n    CSRF_PROTECTED_METHODS.has(method) &&\n    dispatcher.matches(method, pathname) &&\n    !dispatcher.isCsrfExempt(pathname)\n  ) {\n    const decision = enforceCsrf(\n      req,\n      csrfMode,\n      { warn: dispatchCsrfWarn, path: req.url },\n      disallowed,\n    )\n    if (!decision.allow) {\n      sendError(\n        res,\n        'CSRF_INVALID',\n        decision.reason ?? 'CSRF check failed',\n        403,\n        undefined,\n        requestId,\n      )\n      return true\n    }\n  }\n\n  const response = await dispatcher.dispatch(webRequest)\n  if (response === null) return false\n  await writeControllerResponse(res, response)\n  return true\n}\n","/**\n * Canonical CSRF warn dispatcher (T3.3 of architecture-review-remediation-plan).\n *\n * Consolidates the duplicated `warn: (payload) => { warnOnce(...) }` closure\n * that previously appeared in both `http/execute.ts` and\n * `http/action-execute.ts`. Resolves PV-10 (DRY).\n *\n * `warnOnce` dedupes by `event:method:path` so a request loop with 1000 POSTs\n * doesn't flood logs with identical warnings. Apps grep for `event\":\"csrf.warn\"`\n * (stable event shape — see [[enforcement-cutover.md]]).\n */\nimport { warnOnce } from '../observability/logger.js'\n\ninterface CsrfWarnPayload {\n  event: string\n  method: string\n  path?: string\n  reason: string\n  code?: string\n  docsUrl?: string\n  warnOnce?: boolean\n}\n\n/**\n * Build the warn callback that `enforceCsrf` invokes for soft-mode warnings.\n * Returned function is suitable for the `warn` field of `enforceCsrf`'s options.\n */\nexport function dispatchCsrfWarn(payload: CsrfWarnPayload): void {\n  const key = `${payload.event}:${payload.method}:${payload.path ?? ''}`\n  warnOnce(key, payload as unknown as Record<string, unknown>)\n}\n","/**\n * T4.1 — Audit logging interface + default JSON stdout sink.\n *\n * Per ADR D4: define the interface; ship a zero-dep default; reserve\n * adapter shapes for Postgres, File, OpenTelemetry, Sentry as follow-up\n * packages. Persistence has heavy deps (`pg`, `better-sqlite3`); we\n * keep core dep-free and let users opt in.\n *\n * Compatibility:\n *   - Node / Bun / Deno / Vercel — console.log is sync, captured.\n *   - Edge runtimes (CF Workers, Vercel Edge) — console.log is captured\n *     but may be rate-limited by the platform. For high-volume edge audit,\n *     implement a custom sink writing to a queue / HTTP endpoint.\n */\n\nexport interface AuditEvent {\n  /** Domain-qualified verb. Convention: `<domain>.<verb>` (e.g. csrf.warn, session.rotated). */\n  action: string\n  /** Who triggered the event. Anonymous = no auth at time of event. */\n  actor?: { type: 'user' | 'system' | 'anonymous'; id?: string }\n  /** What was operated on (optional). */\n  resource?: { type: string; id?: string }\n  /** Arbitrary event-specific metadata. JSON-serializable. */\n  metadata?: Record<string, unknown>\n  /** ISO 8601 timestamp. If absent, sink fills in `new Date().toISOString()`. */\n  timestamp?: string\n  /** Optional trace id (populated by middleware from `x-trace-id`). */\n  traceId?: string\n}\n\nexport interface AuditLogger {\n  log(event: AuditEvent): void | Promise<void>\n}\n\n/**\n * Default sink: one JSON line per event to stdout. Sync. Never throws.\n *\n * EC: circular refs / BigInt values fall back to a placeholder line so\n * the event is still observable (action + traceId) without crashing the\n * request lifecycle.\n */\nexport class JsonStdoutSink implements AuditLogger {\n  log(event: AuditEvent): void {\n    const enriched = {\n      level: 'audit' as const,\n      ...event,\n      timestamp: event.timestamp ?? new Date().toISOString(),\n    }\n    try {\n      // eslint-disable-next-line no-console -- JsonStdoutSink IS the audit output\n      console.log(JSON.stringify(enriched, jsonReplacer))\n    } catch {\n      // eslint-disable-next-line no-console -- fallback when payload won't serialize\n      console.log(\n        `{\"level\":\"audit\",\"action\":${JSON.stringify(event.action)},\"timestamp\":${JSON.stringify(enriched.timestamp)},\"note\":\"payload could not be serialized\"}`,\n      )\n    }\n  }\n}\n\n/**\n * Replacer that walks BigInt → string. Circular ref handling is via the\n * outer try/catch (JSON.stringify throws TypeError on cycles; we drop to\n * the fallback line). We don't implement custom cycle-breaking walker\n * because the audit payload is meant to be JSON — if user metadata has\n * a cycle, the right answer is to fix the caller, not silently lose\n * the structure.\n */\nfunction jsonReplacer(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') return value.toString()\n  return value\n}\n\n/**\n * No-op logger. Returned when `config.audit` is unset. Zero overhead;\n * framework wiring sites null-check before calling.\n */\nexport function createNoOpLogger(): AuditLogger {\n  return {\n    log() {\n      // intentionally empty\n    },\n  }\n}\n\n/**\n * T4.2 — Safe-emit wrapper. Used by framework wiring sites (csrf.ts,\n * rate-limit.ts, session.ts) so a logger throw NEVER propagates into\n * the request handler.\n */\nexport function safeAudit(logger: AuditLogger | undefined, event: AuditEvent): void {\n  if (!logger) return\n  try {\n    const r = logger.log(event)\n    // Discard the Promise — async sinks are fire-and-forget by design.\n    if (r && typeof r.then === 'function') {\n      r.catch(() => {\n        // swallow async sink failures — audit must never crash the request\n      })\n    }\n  } catch {\n    // swallow sync sink failures — audit must never crash the request\n  }\n}\n","import type { IncomingMessage } from 'node:http'\n\nimport type { AuditLogger } from '../observability/audit-log.js'\nimport { safeAudit } from '../observability/audit-log.js'\n\n/**\n * CSRF enforcement mode.\n *\n * - `off`     — skip CSRF entirely. Use only when you have another defense\n *               (e.g. you don't ship session cookies, all auth is bearer).\n * - `warn`    — log a structured warning when the check would fail, but\n *               still serve the request. Default for 0.2.0. Migration mode.\n * - `strict`  — reject failing requests with 403 + code `CSRF_INVALID`.\n *               Will become the default in 0.3.0.\n */\nexport type CsrfMode = 'off' | 'warn' | 'strict'\n\n/**\n * Per-request structured logger surface. Only `warn` is used by enforceCsrf;\n * we don't require a full Logger here so callers can pass a mock or the\n * console directly.\n */\nexport interface CsrfLogger {\n  warn: (payload: CsrfWarnPayload) => void\n  /** Optional path the request was destined for — used for log correlation. */\n  path?: string\n}\n\n/**\n * T5.1 — Rails-inspired per-route escalation.\n *\n * `routes` accepts string (exact match) or RegExp entries. When a request\n * path matches AND the request would otherwise emit a warning, the\n * `behavior` field decides what happens:\n *\n *   - `'warn'`  → normal warn dispatch (no-op vs default)\n *   - `'raise'` → escalate to 403 regardless of global `csrf` mode\n *\n * `'raise'` never downgrades: when global mode is `'off'`, validation is\n * skipped entirely and disallowed dispatch never runs.\n */\nexport interface DisallowedConfig {\n  routes: (string | RegExp)[]\n  behavior: 'warn' | 'raise'\n}\n\n/**\n * Test whether `path` matches any of the supplied patterns. String\n * patterns are EXACT (trailing slash matters — use RegExp for tolerance).\n *\n * EC-5: when a RegExp carries the `/g` flag, `.test()` mutates\n * `lastIndex` and the next invocation may miss. We reset `lastIndex`\n * before each test so the matcher is a pure function.\n */\nexport function matchDisallowed(path: string, patterns: readonly (string | RegExp)[]): boolean {\n  for (const p of patterns) {\n    if (typeof p === 'string') {\n      if (path === p) return true\n    } else if (p instanceof RegExp) {\n      p.lastIndex = 0\n      if (p.test(path)) return true\n    }\n    // Neither string nor RegExp: ignore silently (defensive — the public\n    // type forbids it but runtime data may slip past).\n  }\n  return false\n}\n\n/**\n * T2.2 — Stable cutover identifier shipped with every csrf.warn payload.\n *\n * Convention borrowed from Vite's `deprecations.ts:74` — a `code` plus a\n * `docsUrl` lets users (a) grep their logs for a single stable identifier\n * to find every csrf.warn line, and (b) click through directly to the\n * migration guide. Strings are exported constants so the analyzer (T2.3)\n * and migration guide can reference the same source of truth.\n */\nexport const CSRF_WARN_CODE = 'CSRF_STRICT_CUTOVER' as const\nexport const CSRF_WARN_DOCS_URL = 'https://theokit.dev/upgrade/csrf-strict-cutover' as const\n\n/**\n * Pick a header value, choosing the first entry when an array (Node sets\n * arrays for headers that legitimately appear multiple times). Returns\n * `''` when the header is absent or empty — callers treat `''` as \"skip\".\n */\nfunction pickHeader(value: string | string[] | undefined): string {\n  if (typeof value === 'string') return value\n  if (Array.isArray(value) && value.length > 0) return value[0]\n  return ''\n}\n\nexport interface CsrfWarnPayload {\n  event: 'csrf.warn'\n  method: string\n  path: string | undefined\n  reason: string\n  /**\n   * Stable identifier for the 0.2 → 0.3 CSRF strict cutover. Always\n   * `'CSRF_STRICT_CUTOVER'`. Grep-able from prod logs.\n   */\n  code: string\n  /**\n   * Link to the section of the migration guide explaining how to clear\n   * this specific warning class.\n   */\n  docsUrl: string\n}\n\n/**\n * T5a.2 Phase B (slice 1/6): pure header-only CSRF check extracted from\n * `validateCsrf(req: IncomingMessage)` so it can be re-used by the Web-\n * Standards `validateCsrfRequest(request: Request)` sibling. Per the T5a.2\n * plan v1.0 § Phase B, header-only leaves are first to migrate. This is\n * the dual-signature pattern (anti-pattern #2 avoidance): IncomingMessage\n * consumers unchanged; new Request consumers go through the same logic\n * via the shared helper.\n *\n * Pure logic — accepts pre-extracted header values as strings or null.\n */\nfunction isCsrfValidFromHeaders(opts: {\n  csrfActionHeader: string | null\n  origin: string | null\n  host: string | null\n}): { valid: true } | { valid: false; reason: string } {\n  // 1. Custom header must be present (primary defense — simple form posts\n  //    cannot set custom headers, browsers gate via CORS preflight)\n  if (opts.csrfActionHeader !== '1') {\n    return { valid: false, reason: 'Missing X-Theo-Action header' }\n  }\n\n  // 2. Origin matching (secondary defense)\n  if (opts.origin === null || opts.origin === '') {\n    // Browsers omit Origin for same-origin requests — treat as valid\n    return { valid: true }\n  }\n\n  if (opts.host === null || opts.host === '') {\n    return { valid: true }\n  }\n\n  try {\n    const originHost = new URL(opts.origin).host\n    if (originHost !== opts.host) {\n      return { valid: false, reason: `Origin ${opts.origin} does not match host ${opts.host}` }\n    }\n  } catch {\n    return { valid: false, reason: `Invalid origin: ${opts.origin}` }\n  }\n\n  return { valid: true }\n}\n\nexport function validateCsrf(\n  req: IncomingMessage,\n): { valid: true } | { valid: false; reason: string } {\n  // IncomingMessage adapter — normalize Node header shape to the pure\n  // helper's input shape (string|null).\n  const action = req.headers['x-theo-action']\n  const origin = req.headers.origin\n  const host = req.headers.host\n\n  // RFC 6454: Origin is single-valued. A caller that synthesizes an\n  // IncomingMessage — an adapter, a shim, a proxy library — can hand us an\n  // array, and choosing one of two conflicting origins is a decision the\n  // request never authorized. The disagreement IS the rejection.\n  //\n  // `node:http` itself joins a repeated Origin with `, ` rather than\n  // producing an array, and that string already fails to parse as a URL\n  // below. This branch covers the shape the type allows and `pickHeader`\n  // used to resolve silently.\n  if (Array.isArray(origin)) {\n    return { valid: false, reason: 'Multiple Origin headers (RFC 6454 violation)' }\n  }\n\n  return isCsrfValidFromHeaders({\n    csrfActionHeader: typeof action === 'string' ? action : null,\n    origin: origin !== undefined ? origin || null : null,\n    host: host !== undefined ? pickHeader(host) || null : null,\n  })\n}\n\n/**\n * T5a.2 Phase B (slice 1/6) — Web-Standards-shaped CSRF validator.\n *\n * Mirror of `validateCsrf(req: IncomingMessage)` for the Web `Request`\n * shape. Consumes `request.headers.get(name)` (native Web `Headers` API)\n * instead of `req.headers[name]` (Node `IncomingMessage` indexer). Same\n * CSRF policy + same return shape — the difference is only the input\n * extraction.\n *\n * Used by `executeWebRequest` (T5a.2 Phase A) to enforce CSRF on the\n * Web-Standards request handler entry-point.\n */\nexport function validateCsrfRequest(\n  request: Request,\n): { valid: true } | { valid: false; reason: string } {\n  return isCsrfValidFromHeaders({\n    csrfActionHeader: request.headers.get('x-theo-action'),\n    origin: request.headers.get('origin'),\n    host: request.headers.get('host'),\n  })\n}\n\n/**\n * Enforce CSRF policy with mode-aware behavior. Wrapper over `validateCsrf`\n * that turns the boolean valid/invalid into a request-level allow decision,\n * gated by mode + structured warning in warn mode.\n *\n * Phase 5 — CSRF warn-first (EC-1).\n */\n/**\n * Dispatch the csrf.warn payload to both the structured logger and the\n * audit sink (when configured). Extracted from `enforceCsrf` to keep that\n * function's complexity within ceiling.\n */\nfunction dispatchCsrfWarn(\n  req: IncomingMessage,\n  reason: string,\n  logger: CsrfLogger | undefined,\n  auditLogger: AuditLogger | undefined,\n  pathFallback = '',\n): void {\n  const payload: CsrfWarnPayload = {\n    event: 'csrf.warn',\n    method: req.method ?? 'UNKNOWN',\n    path: logger?.path ?? pathFallback,\n    reason,\n    code: CSRF_WARN_CODE,\n    docsUrl: CSRF_WARN_DOCS_URL,\n  }\n  logger?.warn(payload)\n  // `metadata` is typed as Record<string, unknown>; CsrfWarnPayload is a\n  // structurally-equivalent shape but lacks the index signature.\n  safeAudit(auditLogger, {\n    action: 'csrf.warn',\n    actor: { type: 'anonymous' },\n    metadata: { ...payload },\n  })\n}\n\nexport function enforceCsrf(\n  req: IncomingMessage,\n  mode: CsrfMode,\n  logger?: CsrfLogger,\n  disallowed?: DisallowedConfig,\n  auditLogger?: AuditLogger,\n): { allow: boolean; reason?: string } {\n  if (mode === 'off') {\n    // `off` short-circuits before disallowed dispatch — users who set\n    // csrf: 'off' globally have explicitly turned validation off, and\n    // disallowed must never re-introduce it. The escape hatch is to\n    // set csrf: 'warn' and use disallowed for surgical strict pockets.\n    return { allow: true }\n  }\n\n  const check = validateCsrf(req)\n  if (check.valid) {\n    return { allow: true }\n  }\n\n  // T5.1 — disallowed dispatch: when the failing request matches a\n  // disallowed pattern AND behavior is 'raise', escalate to 403 even if\n  // global mode is 'warn'. Strict mode would 403 anyway, so the branch\n  // is a no-op there.\n  if (disallowed?.behavior === 'raise') {\n    const path = logger?.path ?? req.url ?? ''\n    if (matchDisallowed(path, disallowed.routes)) {\n      return { allow: false, reason: check.reason }\n    }\n  }\n\n  if (mode === 'warn') {\n    // T2.1: emit via warnOnce by default — callers can override via the\n    // injected logger.warn (tests, custom log routers).\n    // T2.2: include the stable cutover code + docsUrl so logs are\n    // grep-able and click-through-able.\n    dispatchCsrfWarn(req, check.reason, logger, auditLogger)\n    return { allow: true, reason: check.reason }\n  }\n\n  // strict — 403 the request, AND emit a warn payload so the dev (and\n  // devtools UI) sees WHY it was blocked + the docsUrl to fix it.\n  // Without this, strict-mode users get a silent 403 with no context.\n  dispatchCsrfWarn(req, check.reason, logger, auditLogger)\n  return { allow: false, reason: check.reason }\n}\n"],"mappings":";;;;;;;AAmBA,IAAM,iBAAsC,oBAAI,IAAI,CAAC,kBAAkB,uBAAuB,CAAC;AAE/F,IAAM,2BAA2B;AAEjC,SAAS,QAAQ,MAAuB;AACtC,SAAO,eAAe,IAAI,IAAI,KAAK,QAAQ,IAAI,aAAa;AAC9D;AAGO,SAAS,uBAAuB,MAAc,SAAyB;AAC5E,SAAO,QAAQ,IAAI,IAAI,2BAA2B;AACpD;;;ACbO,SAAS,SACd,KACA,MACA,SAAS,KACT,aACM;AAGN,QAAM,OAAO,cAAc,YAAY,UAAU,IAAI,IAAI,KAAK,UAAU,IAAI;AAC5E,MAAI,UAAU,QAAQ;AAAA,IACpB,gBAAgB;AAAA,IAChB,kBAAkB,OAAO,WAAW,IAAI;AAAA,EAC1C,CAAC;AACD,MAAI,IAAI,IAAI;AACd;AAGA,SAAS,QAAQ,OAAuB;AACtC,SAAO,MAAM,QAAQ,WAAW,KAAK;AACvC;AA0CO,SAAS,UACd,KACA,aACA,SACA,QACA,QACA,WACA,SACM;AACN,MAAI;AACJ,MAAI,OAAO,gBAAgB,UAAU;AACnC,WAAO;AACP,cAAU,WAAW;AACrB,aAAS,UAAU;AAAA,EACrB,OAAO;AACL,WAAO,YAAY;AACnB,cAAU,YAAY;AACtB,aAAS,YAAY;AACrB,aAAS,YAAY;AACrB,gBAAY,YAAY;AACxB,cAAU,YAAY;AAAA,EACxB;AACA,QAAM,eAAe,uBAAuB,MAAM,OAAO;AAEzD,MAAI,SAAS,kBAAkB;AAK7B,YAAQ,MAAM,IAAI,QAAQ,aAAa,OAAO,CAAC,KAAK,QAAQ,OAAO,CAAC,EAAE;AAAA,EACxE;AAEA,MAAI,WAAW,OAAO,SAAS,eAAe;AAC5C,UAAM,OAAO,QAAQ;AACrB,QAAI,UAAU,KAAK;AAAA,MACjB,gBAAgB;AAAA,MAChB,kBAAkB,OAAO,WAAW,IAAI;AAAA,IAC1C,CAAC;AACD,QAAI,IAAI,IAAI;AACZ;AAAA,EACF;AACA,MAAI,WAAW,OAAO,SAAS,eAAe;AAC5C,UAAM,OAAO,QAAQ;AACrB,QAAI,UAAU,KAAK;AAAA,MACjB,gBAAgB;AAAA,MAChB,kBAAkB,OAAO,WAAW,IAAI;AAAA,IAC1C,CAAC;AACD,QAAI,IAAI,IAAI;AACZ;AAAA,EACF;AAEA;AAAA,IACE;AAAA,IACA;AAAA,MACE,OAAO;AAAA,QACL;AAAA,QACA,SAAS;AAAA,QACT,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,QACjC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,MAC7B;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF;;;ACnIA,SAAS,gBAAgB;AAGzB,SAAS,iBAAiB,OAA0D;AAClF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,KAAK,MAAO,KAAI,OAAO,MAAM,YAAY,EAAE,SAAS,EAAG,QAAO;AAAA,EAC3E;AACA,SAAO;AACT;AAGA,SAAS,sBAAsB,KAA8B;AAC3D,QAAM,OAAO,iBAAiB,IAAI,QAAQ,IAAI,KAAK;AACnD,SAAO,UAAU,IAAI,GAAG,IAAI,OAAO,GAAG;AACxC;AAOA,SAAS,iBAAiB,KAA+B;AACvD,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AACtD,QAAI,UAAU,OAAW;AACzB,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,cAAQ,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,IACnC,OAAO;AACL,cAAQ,IAAI,KAAK,KAAK;AAAA,IACxB;AAAA,EACF;AACA,SAAO;AACT;AAWO,SAAS,4BAA4B,KAA+B;AACzE,QAAM,MAAM,sBAAsB,GAAG;AACrC,QAAM,UAAU,iBAAiB,GAAG;AAEpC,QAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,QAAM,UAAU,WAAW,SAAS,WAAW;AAE/C,MAAI,CAAC,SAAS;AACZ,WAAO,IAAI,QAAQ,KAAK,EAAE,QAAQ,QAAQ,CAAC;AAAA,EAC7C;AAIA,QAAM,YAAY,SAAS,MAAM,GAAG;AACpC,SAAO,IAAI,QAAQ,KAAK;AAAA,IACtB;AAAA,IACA;AAAA,IACA,MAAM;AAAA;AAAA;AAAA,IAGN,GAAI,EAAE,QAAQ,OAAO;AAAA,EACvB,CAAC;AACH;AA0BO,SAAS,uBAAuB,KAAwC;AAC7E,MAAI;AACJ,SAAO;AAAA,IACL,SAAS,IAAI,UAAU,OAAO,YAAY;AAAA,IAC1C,WAAW,MAAO,cAAc,4BAA4B,GAAG;AAAA,EACjE;AACF;AAkBO,SAAS,gCAAgC,KAA+B;AAC7E,SAAO,IAAI,QAAQ,sBAAsB,GAAG,GAAG;AAAA,IAC7C,SAAS,IAAI,UAAU,OAAO,YAAY;AAAA,IAC1C,SAAS,iBAAiB,GAAG;AAAA,EAC/B,CAAC;AACH;;;AC/HA,SAAS,mBAAgC;AAEzC,SAAS,YAAY;AAErB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;;;ACYA,SAAS,iBAAiB,SAAgC;AAC/D,QAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,QAAQ,MAAM,IAAI,QAAQ,QAAQ,EAAE;AACpE,WAAS,KAAK,OAA6C;AAC7D;;;AC4DO,SAAS,UAAU,QAAiC,OAAyB;AAClF,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,UAAM,IAAI,OAAO,IAAI,KAAK;AAE1B,QAAI,KAAK,OAAO,EAAE,SAAS,YAAY;AACrC,QAAE,MAAM,MAAM;AAAA,MAEd,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AAAA,EAER;AACF;;;ACjDO,SAAS,gBAAgB,MAAc,UAAiD;AAC7F,aAAW,KAAK,UAAU;AACxB,QAAI,OAAO,MAAM,UAAU;AACzB,UAAI,SAAS,EAAG,QAAO;AAAA,IACzB,WAAW,aAAa,QAAQ;AAC9B,QAAE,YAAY;AACd,UAAI,EAAE,KAAK,IAAI,EAAG,QAAO;AAAA,IAC3B;AAAA,EAGF;AACA,SAAO;AACT;AAWO,IAAM,iBAAiB;AACvB,IAAM,qBAAqB;AAOlC,SAAS,WAAW,OAA8C;AAChE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,CAAC;AAC5D,SAAO;AACT;AA8BA,SAAS,uBAAuB,MAIuB;AAGrD,MAAI,KAAK,qBAAqB,KAAK;AACjC,WAAO,EAAE,OAAO,OAAO,QAAQ,+BAA+B;AAAA,EAChE;AAGA,MAAI,KAAK,WAAW,QAAQ,KAAK,WAAW,IAAI;AAE9C,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,MAAI,KAAK,SAAS,QAAQ,KAAK,SAAS,IAAI;AAC1C,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,MAAI;AACF,UAAM,aAAa,IAAI,IAAI,KAAK,MAAM,EAAE;AACxC,QAAI,eAAe,KAAK,MAAM;AAC5B,aAAO,EAAE,OAAO,OAAO,QAAQ,UAAU,KAAK,MAAM,wBAAwB,KAAK,IAAI,GAAG;AAAA,IAC1F;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB,KAAK,MAAM,GAAG;AAAA,EAClE;AAEA,SAAO,EAAE,OAAO,KAAK;AACvB;AAEO,SAAS,aACd,KACoD;AAGpD,QAAM,SAAS,IAAI,QAAQ,eAAe;AAC1C,QAAM,SAAS,IAAI,QAAQ;AAC3B,QAAM,OAAO,IAAI,QAAQ;AAWzB,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO,EAAE,OAAO,OAAO,QAAQ,+CAA+C;AAAA,EAChF;AAEA,SAAO,uBAAuB;AAAA,IAC5B,kBAAkB,OAAO,WAAW,WAAW,SAAS;AAAA,IACxD,QAAQ,WAAW,SAAY,UAAU,OAAO;AAAA,IAChD,MAAM,SAAS,SAAY,WAAW,IAAI,KAAK,OAAO;AAAA,EACxD,CAAC;AACH;AAcO,SAAS,oBACd,SACoD;AACpD,SAAO,uBAAuB;AAAA,IAC5B,kBAAkB,QAAQ,QAAQ,IAAI,eAAe;AAAA,IACrD,QAAQ,QAAQ,QAAQ,IAAI,QAAQ;AAAA,IACpC,MAAM,QAAQ,QAAQ,IAAI,MAAM;AAAA,EAClC,CAAC;AACH;AAcA,SAASA,kBACP,KACA,QACA,QACA,aACA,eAAe,IACT;AACN,QAAM,UAA2B;AAAA,IAC/B,OAAO;AAAA,IACP,QAAQ,IAAI,UAAU;AAAA,IACtB,MAAM,QAAQ,QAAQ;AAAA,IACtB;AAAA,IACA,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACA,UAAQ,KAAK,OAAO;AAGpB,YAAU,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,OAAO,EAAE,MAAM,YAAY;AAAA,IAC3B,UAAU,EAAE,GAAG,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,SAAS,YACd,KACA,MACA,QACA,YACA,aACqC;AACrC,MAAI,SAAS,OAAO;AAKlB,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,MAAM,OAAO;AACf,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAMA,MAAI,YAAY,aAAa,SAAS;AACpC,UAAM,OAAO,QAAQ,QAAQ,IAAI,OAAO;AACxC,QAAI,gBAAgB,MAAM,WAAW,MAAM,GAAG;AAC5C,aAAO,EAAE,OAAO,OAAO,QAAQ,MAAM,OAAO;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI,SAAS,QAAQ;AAKnB,IAAAA,kBAAiB,KAAK,MAAM,QAAQ,QAAQ,WAAW;AACvD,WAAO,EAAE,OAAO,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC7C;AAKA,EAAAA,kBAAiB,KAAK,MAAM,QAAQ,QAAQ,WAAW;AACvD,SAAO,EAAE,OAAO,OAAO,QAAQ,MAAM,OAAO;AAC9C;;;AHnPA,IAAM,yBAAyB,oBAAI,IAAI,CAAC,QAAQ,OAAO,SAAS,QAAQ,CAAC;AAkBzE,IAAM,uBAAuB;AAU7B,SAAS,SAAS,OAAyB;AACzC,SAAO,MAAM,MAAM,GAAG,EAAE,OAAO,OAAO;AACxC;AAEA,SAAS,kBAAkB,UAAkB,QAAyB;AACpE,QAAM,OAAO,SAAS,MAAM;AAC5B,QAAM,MAAM,SAAS,QAAQ;AAC7B,MAAI,KAAK,WAAW,KAAK,IAAI,SAAS,KAAK,OAAQ,QAAO;AAC1D,SAAO,KAAK,MAAM,CAAC,SAAS,MAAM,IAAI,CAAC,MAAM,OAAO;AACtD;AAQO,SAAS,oBAAoB,KAAuB;AACzD,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,CAAC,YAA0B;AACtC,QAAI;AACJ,QAAI;AACF,gBAAU,YAAY,SAAS,EAAE,eAAe,KAAK,CAAC;AAAA,IACxD,QAAQ;AACN;AAAA,IACF;AACA,eAAW,SAAS,SAAS;AAC3B,YAAM,OAAO,KAAK,SAAS,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,EAAG,MAAK,IAAI;AAAA,eAKzB,MAAM,KAAK,SAAS,gBAAgB,KAAK,MAAM,KAAK,SAAS,iBAAiB;AACrF,cAAM,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,OAAK,GAAG;AACR,SAAO;AACT;AAyBA,eAAsB,sBACpB,gBACA,YAC6B;AAC7B,QAAM,QAAQ,oBAAoB,cAAc;AAChD,QAAM,UAA8B,CAAC;AACrC,aAAW,YAAY,OAAO;AAC5B,UAAM,MAAM,MAAM,WAAW,QAAQ;AACrC,eAAW,YAAY,OAAO,OAAO,GAAG,GAAG;AACzC,UAAI,OAAO,aAAa,cAAc,kBAAkB,QAAQ,GAAG;AACjE,gBAAQ,KAAK,EAAE,UAAU,KAAK,UAA6B,SAAS,IAAI,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,eAAe,gBACb,gBACA,YAC4B;AAC5B,QAAM,UAAU,MAAM,sBAAsB,gBAAgB,UAAU;AACtE,SAAO,QAAQ,IAAI,CAAC,MAAM,EAAE,GAAG;AACjC;AAUA,eAAsB,2BAA2B,MAKR;AACvC,QAAM,UAAU,MAAM,gBAAgB,KAAK,gBAAgB,KAAK,UAAU;AAC1E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,SAAS,uBAAuB,EAAE,aAAa,SAAS,YAAY,KAAK,WAAW,CAAC;AAC3F,QAAM,YAAY,IAAI,UAAU;AAIhC,QAAM,iBAAiB,QAIpB,OAAO,CAAC,QAAQ,UAAU,SAAkB,sBAAsB,GAAG,MAAM,IAAI,EAC/E,IAAI,CAAC,QAAQ;AACZ,UAAM,OAAO,QAA6B,mBAAmB,GAAG;AAChE,WAAO,MAAM,UAAU;AAAA,EACzB,CAAC,EACA,OAAO,CAAC,WAAW,WAAW,EAAE;AAEnC,SAAO;AAAA,IACL,UAAU,CAAC,YAAY,OAAO,OAAO;AAAA,IACrC,SAAS,CAAC,QAAQ,aAAa,OAAO,QAAQ,QAAQ,QAAQ;AAAA,IAC9D,cAAc,CAAC,aAAa,eAAe,KAAK,CAAC,MAAM,kBAAkB,UAAU,CAAC,CAAC;AAAA,EACvF;AACF;AAmBA,eAAe,wBAAwB,KAAqB,UAAmC;AAC7F,QAAM,aAAqC,CAAC;AAC5C,aAAW,CAAC,GAAG,CAAC,KAAK,SAAS,SAAS;AACrC,QAAI,EAAE,YAAY,MAAM,aAAc,YAAW,CAAC,IAAI;AAAA,EACxD;AACA,QAAM,aAAa,SAAS,QAAQ,aAAa;AACjD,MAAI,WAAW,SAAS,EAAG,KAAI,UAAU,cAAc,UAAU;AACjE,MAAI,UAAU,SAAS,QAAQ,UAAU;AAGzC,QAAM,OAAO,SAAS,OAAO,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC,IAAI;AACzE,MAAI,IAAI,SAAS,UAAa,KAAK,SAAS,IAAI,OAAO,MAAS;AAClE;AAWA,eAAsB,0BAA0B,MAU3B;AACnB,QAAM,EAAE,KAAK,KAAK,UAAU,YAAY,UAAU,IAAI;AACtD,QAAM,aAAa,MAAM,2BAA2B;AAAA,IAClD,gBAAgB,KAAK;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,YAAY,KAAK;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,QAAM,aAAa,4BAA4B,GAAG;AAClD,QAAM,WAAW,IAAI,IAAI,WAAW,GAAG,EAAE;AAMzC,MACE,uBAAuB,IAAI,MAAM,KACjC,WAAW,QAAQ,QAAQ,QAAQ,KACnC,CAAC,WAAW,aAAa,QAAQ,GACjC;AACA,UAAM,WAAW;AAAA,MACf;AAAA,MACA;AAAA,MACA,EAAE,MAAM,kBAAkB,MAAM,IAAI,IAAI;AAAA,MACxC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,OAAO;AACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA,SAAS,UAAU;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,WAAW,SAAS,UAAU;AACrD,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,wBAAwB,KAAK,QAAQ;AAC3C,SAAO;AACT;","names":["dispatchCsrfWarn"]}

package/dist/{chunk-NC2OPE22.js → chunk-MWPC7EOR.js}

@@ -178,7 +178,7 @@ async function agentCommand(name, message, deps = {}) {
 async function createAgentSsrLoader(projectRoot) {
   const { createServer } = await import("vite");
   const react = (await import("@vitejs/plugin-react")).default;
-  const { theoPluginAsync } = await import("./vite-plugin-ABJIDKE6.js");
+  const { theoPluginAsync } = await import("./vite-plugin-TU3HQA43.js");
   const { loadConfig } = await import("./load-config-BKUAMGO5.js");
   const config = await loadConfig(projectRoot);
   const theoPlugins = await theoPluginAsync({
@@ -212,4 +212,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=chunk-NC2OPE22.js.map
+//# sourceMappingURL=chunk-MWPC7EOR.js.map

package/dist/{chunk-OKDCBENR.js → chunk-VJRPOUKM.js}

@@ -25,14 +25,14 @@ import {
   parseAgentRequestBody,
   readAgentPolicy,
   subjectFromContext
-} from "./chunk-G5JYB2LO.js";
+} from "./chunk-IF7CZXPW.js";
 import {
   getApprovalRegistry
 } from "./chunk-35QIWOHT.js";
 import {
   sendError,
   validateCsrfRequest
-} from "./chunk-CTRVTBGY.js";
+} from "./chunk-L4TB6FXQ.js";
 import {
   generateNonce
 } from "./chunk-RPET332G.js";
@@ -867,4 +867,4 @@ export {
   applyNonceToInlineScripts,
   setupSsrDevMiddleware
 };
-//# sourceMappingURL=chunk-OKDCBENR.js.map
+//# sourceMappingURL=chunk-VJRPOUKM.js.map