theokit 0.64.0 → 0.65.0-next.1

package/dist/{actions-virtual-module-AD7HFFOF.js → actions-virtual-module-6QVMUINF.js}

@@ -1,4 +1,4 @@
-import "./chunk-A3EMTZR2.js";
+import "./chunk-WAYUHS54.js";
 import "./chunk-2BYN7WTW.js";
 import "./chunk-EYRWD2AB.js";
 import "./chunk-5GZROLDV.js";
@@ -234,4 +234,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-AD7HFFOF.js.map
+//# sourceMappingURL=actions-virtual-module-6QVMUINF.js.map

package/dist/{actions-virtual-module-BKIT7HNS.js → actions-virtual-module-SYV4JN7B.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-2NARRZPP.js";
+import "./chunk-4DSRX3CO.js";
 import "./chunk-UETVDZBE.js";
-import "./chunk-GDZOWQV7.js";
+import "./chunk-QD5X56I3.js";
 import "./chunk-VV2VU3LJ.js";
 import "./chunk-5VLP3GQ2.js";
 import "./chunk-C27VRUVN.js";
@@ -218,4 +218,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-BKIT7HNS.js.map
+//# sourceMappingURL=actions-virtual-module-SYV4JN7B.js.map

package/dist/{agent-PL3FR4HI.js → agent-FYXX5HZD.js}

@@ -3,7 +3,7 @@ import "tsx/esm";
 import {
   agentCommand,
   createAgentSsrLoader
-} from "./chunk-BQJBFHAY.js";
+} from "./chunk-47OYUMXW.js";
 import "./chunk-UETVDZBE.js";
 import "./chunk-5NNFO7R7.js";
 import "./chunk-Z7CJHDLS.js";
@@ -12,4 +12,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=agent-PL3FR4HI.js.map
+//# sourceMappingURL=agent-FYXX5HZD.js.map

package/dist/{app-typed-client-AJRW3JJV.js → app-typed-client-4S33OHT4.js}

@@ -1,6 +1,6 @@
 import {
   scanControllerModules
-} from "./chunk-A3EMTZR2.js";
+} from "./chunk-WAYUHS54.js";
 import "./chunk-2BYN7WTW.js";
 import "./chunk-EYRWD2AB.js";
 import "./chunk-5GZROLDV.js";
@@ -427,4 +427,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-AJRW3JJV.js.map
+//# sourceMappingURL=app-typed-client-4S33OHT4.js.map

package/dist/{app-typed-client-NOXQEEVF.js → app-typed-client-KH27ZGRT.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-2NARRZPP.js";
+import "./chunk-4DSRX3CO.js";
 import "./chunk-UETVDZBE.js";
 import {
   scanControllerModules
-} from "./chunk-GDZOWQV7.js";
+} from "./chunk-QD5X56I3.js";
 import "./chunk-VV2VU3LJ.js";
 import "./chunk-5VLP3GQ2.js";
 import "./chunk-C27VRUVN.js";
@@ -411,4 +411,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-NOXQEEVF.js.map
+//# sourceMappingURL=app-typed-client-KH27ZGRT.js.map

package/dist/{build-C7CVA5AK.js → build-ZTJOAOF2.js}

@@ -3,7 +3,7 @@ import "tsx/esm";
 import {
   describeControllerArtifacts,
   emitControllerArtifacts
-} from "./chunk-2PF3TDM2.js";
+} from "./chunk-RE2WE7CD.js";
 import {
   validateProjectStructure
 } from "./chunk-GEQJAFSV.js";
@@ -14,7 +14,7 @@ import {
   emitOpenApi,
   loadRoutesForOpenApi
 } from "./chunk-47VNWTL4.js";
-import "./chunk-GDZOWQV7.js";
+import "./chunk-QD5X56I3.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
 import {
@@ -554,7 +554,7 @@ async function buildCommand(options) {
 `);
 }
 async function runAdapterBuild(target, config, cwd) {
-  const { theoPluginAsync } = await import("./vite-plugin-ZT2XNAGM.js");
+  const { theoPluginAsync } = await import("./vite-plugin-HPBVQNCG.js");
   const { default: react } = await import("@vitejs/plugin-react");
   const ctx = {
     // `react()` may return Plugin or Plugin[] depending on version; spread the
@@ -676,4 +676,4 @@ function relativize3(absPath, root) {
 export {
   buildCommand
 };
-//# sourceMappingURL=build-C7CVA5AK.js.map
+//# sourceMappingURL=build-ZTJOAOF2.js.map

package/dist/{chunk-GPX7I5ZY.js → chunk-2XYKRS7Y.js}

@@ -16,19 +16,31 @@ function headerValue(req, name) {
   if (Array.isArray(raw)) return raw[raw.length - 1];
   return raw;
 }
-function resolveClientIp(req, trustProxy = false) {
-  const socketAddress = req.socket?.remoteAddress ?? "unknown";
+function addressFromForwardedHeaders(header, realIpHeader, trustProxy) {
   const hops = hopCount(trustProxy);
-  if (hops < 1) return socketAddress;
-  const forwarded = headerValue(req, "x-forwarded-for");
-  if (forwarded) {
-    const entries = forwarded.split(",").map((entry) => entry.trim()).filter(Boolean);
+  if (hops < 1) return void 0;
+  if (header) {
+    const entries = header.split(",").map((entry) => entry.trim()).filter(Boolean);
     const index = entries.length - hops;
     if (index >= 0 && index < entries.length) return entries[index];
   }
-  const realIp = headerValue(req, "x-real-ip");
-  if (realIp) return realIp.trim();
-  return socketAddress;
+  const realIp = realIpHeader?.trim();
+  return realIp === void 0 || realIp === "" ? void 0 : realIp;
+}
+function resolveClientIp(req, trustProxy = false) {
+  const socketAddress = req.socket?.remoteAddress ?? "unknown";
+  return addressFromForwardedHeaders(
+    headerValue(req, "x-forwarded-for"),
+    headerValue(req, "x-real-ip"),
+    trustProxy
+  ) ?? socketAddress;
+}
+function resolveClientIpFromRequest(request, trustProxy = false) {
+  return addressFromForwardedHeaders(
+    request.headers.get("x-forwarded-for") ?? void 0,
+    request.headers.get("x-real-ip") ?? void 0,
+    trustProxy
+  );
 }
 
 // src/server/rate-limit/rate-limit-per-route.ts
@@ -202,11 +214,57 @@ function createRouteRateLimiterWeb(config) {
   };
 }
 
+// src/server/rate-limit/rate-limited-guard.ts
+import { TooManyRequestsException } from "@theokit/http";
+function assertCanBucket(options, keyBy) {
+  if (options.identify) return;
+  if (keyBy === "ip" && (options.trustProxy === void 0 || options.trustProxy === false)) {
+    throw new Error(
+      "RateLimited: keyBy: 'ip' needs a way to learn the caller's address \u2014 a Web Request has no socket. Declare `trustProxy: <number of proxies in front of the app>` so the address is read from x-forwarded-for, or pass `identify: (request) => ({ clientIp })` for a runtime that knows it another way (e.g. Cloudflare's cf-connecting-ip). Without either, every caller shares one bucket and the first few requests each window refuse everybody."
+    );
+  }
+  if (keyBy === "user") {
+    throw new Error(
+      "RateLimited: keyBy: 'user' needs `identify: (request) => ({ userId })` \u2014 the framework cannot read your app's notion of a user from a Request. Use keyBy: \"session\" to bucket on the session cookie instead."
+    );
+  }
+}
+function RateLimited(options) {
+  const keyBy = options.keyBy ?? "session";
+  assertCanBucket(options, keyBy);
+  const config = { max: options.max, windowMs: options.windowMs };
+  const limiter = createRouteRateLimiterWeb(
+    options.scope === "shared" ? { default: config, keyBy, cookieName: options.cookieName, store: options.store } : {
+      routePatterns: [[/^\//, config]],
+      keyBy,
+      cookieName: options.cookieName,
+      store: options.store
+    }
+  );
+  const message = options.message ?? "Rate limit exceeded";
+  async function contextFor(request) {
+    if (options.identify) return options.identify(request);
+    const clientIp = resolveClientIpFromRequest(request, options.trustProxy ?? false);
+    return clientIp === void 0 ? {} : { clientIp };
+  }
+  return class RateLimitedGuard {
+    async canActivate(context) {
+      const request = context.getRequest();
+      const { limited, headers } = await limiter(request, await contextFor(request));
+      if (limited) {
+        throw new TooManyRequestsException(message, { headers });
+      }
+      return true;
+    }
+  };
+}
+
 export {
   matchRoutePattern,
   deriveKey,
   createRouteRateLimiter,
   deriveKeyFromRequest,
-  createRouteRateLimiterWeb
+  createRouteRateLimiterWeb,
+  RateLimited
 };
-//# sourceMappingURL=chunk-GPX7I5ZY.js.map
+//# sourceMappingURL=chunk-2XYKRS7Y.js.map

package/dist/chunk-2XYKRS7Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/rate-limit/client-ip.ts","../src/server/rate-limit/rate-limit-per-route.ts","../src/server/rate-limit/rate-limited-guard.ts"],"mappings":";;;;;;;;AAuCA,SAAS,SAAS,YAAgC;AAChD,MAAI,eAAe,KAAM,QAAO;AAChC,MAAI,eAAe,MAAO,QAAO;AACjC,SAAO;AACT;AAGA,SAAS,YAAY,KAAsB,MAAkC;AAC3E,QAAM,MAAM,IAAI,QAAQ,IAAI;AAC5B,MAAI,MAAM,QAAQ,GAAG,EAAG,QAAO,IAAI,IAAI,SAAS,CAAC;AACjD,SAAO;AACT;AAkBA,SAAS,4BACP,QACA,cACA,YACoB;AACpB,QAAM,OAAO,SAAS,UAAU;AAChC,MAAI,OAAO,EAAG,QAAO;AAErB,MAAI,QAAQ;AACV,UAAM,UAAU,OACb,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AAMjB,UAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAI,SAAS,KAAK,QAAQ,QAAQ,OAAQ,QAAO,QAAQ,KAAK;AAAA,EAChE;AAIA,QAAM,SAAS,cAAc,KAAK;AAClC,SAAO,WAAW,UAAa,WAAW,KAAK,SAAY;AAC7D;AAEO,SAAS,gBAAgB,KAAsB,aAAyB,OAAe;AAI5F,QAAM,gBAAgB,IAAI,QAAQ,iBAAiB;AAEnD,SACE;AAAA,IACE,YAAY,KAAK,iBAAiB;AAAA,IAClC,YAAY,KAAK,WAAW;AAAA,IAC5B;AAAA,EACF,KAAK;AAET;AAUO,SAAS,2BACd,SACA,aAAyB,OACL;AACpB,SAAO;AAAA,IACL,QAAQ,QAAQ,IAAI,iBAAiB,KAAK;AAAA,IAC1C,QAAQ,QAAQ,IAAI,WAAW,KAAK;AAAA,IACpC;AAAA,EACF;AACF;;;AClEA,SAAS,cAAc,OAAuB;AAC5C,QAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,MAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAG,EAAG,QAAO,QAAQ,MAAM,GAAG,EAAE;AAC3E,SAAO;AACT;AAOO,SAAS,kBAAkB,MAAc,SAAmC;AACjF,QAAM,YAAY,cAAc,IAAI;AACpC,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO,cAAc,cAAc,OAAO;AAAA,EAC5C;AACA,UAAQ,YAAY;AACpB,SAAO,QAAQ,KAAK,SAAS;AAC/B;AAWA,eAAe,aAAa,OAAgC;AAC1D,QAAM,MAAM,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAC5F,QAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,OAAO,aAAa,CAAC;AAEnD,QAAM,SAAS,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAClF,SAAO,OAAO,MAAM,GAAG,EAAE;AAC3B;AAMA,SAAS,WAAW,KAAsB,MAAkC;AAC1E,SAAO,kBAAkB,IAAI,QAAQ,UAAU,MAAS,EAAE,IAAI,IAAI;AACpE;AAUA,eAAsB,UACpB,KACA,OACA,YACA,aAAyB,OACR;AACjB,MAAI,OAAO,UAAU,WAAY,QAAO,MAAM,GAAG;AAIjD,QAAM,KAAK,gBAAgB,KAAK,UAAU;AAC1C,UAAQ,OAAO;AAAA,IACb,KAAK,WAAW;AACd,YAAM,SAAS,WAAW,KAAK,UAAU;AACzC,aAAO,SAAS,WAAW,MAAM,aAAa,MAAM,CAAC,KAAK,MAAM,EAAE;AAAA,IACpE;AAAA,IACA,KAAK,QAAQ;AACX,YAAM,SAAU,IAA8C,MAAM;AACpE,aAAO,SAAS,QAAQ,MAAM,KAAK,MAAM,EAAE;AAAA,IAC7C;AAAA,IACA,KAAK;AAAA,IACL;AACE,aAAO,MAAM,EAAE;AAAA,EACnB;AACF;AASO,SAAS,uBAAuB,QAAgD;AAErF,QAAM,SACJ,cAAc,UAAU,SAAS,UAAU,EAAE,aAAa,WAAW,EAAE,YAAY;AACrF,QAAM,MAA4B,SAAS,EAAE,SAAS,OAAO,IAAI;AAEjE,QAAM,QAAQ,IAAI,SAAS,IAAI,cAAc;AAK7C,MAAI,EAAE,iBAAiB,gBAAgB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,gBAAgB;AACtB,QAAM,QAAQ,IAAI,SAAS;AAC3B,QAAM,aAAa,IAAI,cAAc;AACrC,QAAM,aAAa,IAAI,cAAc;AAGrC,QAAM,cAAoD,CAAC;AAC3D,MAAI,IAAI,QAAQ;AACd,eAAW,CAAC,SAAS,CAAC,KAAK,OAAO,QAAQ,IAAI,MAAM,EAAG,aAAY,KAAK,CAAC,SAAS,CAAC,CAAC;AAAA,EACtF;AACA,MAAI,IAAI,eAAe;AACrB,eAAW,SAAS,IAAI,cAAe,aAAY,KAAK,KAAK;AAAA,EAC/D;AAEA,SAAO,eAAe,oBAAoB,KAAgD;AACxF,UAAM,MAAM,IAAI,OAAO;AACvB,QAAI;AACJ,eAAW,CAAC,SAAS,CAAC,KAAK,aAAa;AACtC,UAAI,kBAAkB,KAAK,OAAO,GAAG;AACnC,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,WAAW,IAAI;AACjC,QAAI,CAAC,WAAW;AAEd,aAAO,EAAE,SAAS,OAAO,SAAS,CAAC,EAAE;AAAA,IACvC;AAIA,UAAM,eAAe,OAAO,YAAY,cAAc,cAAc,cAAc,GAAG;AACrF,UAAM,MAAM,GAAG,MAAM,UAAU,KAAK,OAAO,YAAY,UAAU,CAAC,IAAI,YAAY;AAClF,UAAM,QAAQ,cAAc,SAAS,KAAK,UAAU,QAAQ;AAE5D,QAAI,MAAM,QAAQ,UAAU,KAAK;AAC/B,YAAM,aAAa,KAAK,MAAM,MAAM,UAAU,KAAK,IAAI,KAAK,GAAI;AAChE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,UACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,UACzC,yBAAyB;AAAA,UACzB,eAAe,OAAO,UAAU;AAAA,QAClC;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,QACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,QACzC,yBAAyB,OAAO,KAAK,IAAI,GAAG,UAAU,MAAM,MAAM,KAAK,CAAC;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;AAmCA,eAAsB,qBACpB,SACA,OACA,YACA,MAA+B,CAAC,GACf;AACjB,QAAM,KAAK,IAAI,YAAY;AAC3B,UAAQ,OAAO;AAAA,IACb,KAAK,WAAW;AAGd,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,uBAAoB;AAClE,YAAM,SAAS,qBAAqB,SAAS,UAAU;AACvD,aAAO,SAAS,WAAW,MAAM,aAAa,MAAM,CAAC,KAAK,MAAM,EAAE;AAAA,IACpE;AAAA,IACA,KAAK,QAAQ;AACX,aAAO,IAAI,SAAS,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE;AAAA,IACrD;AAAA,IACA,KAAK;AAAA,IACL;AACE,aAAO,MAAM,EAAE;AAAA,EACnB;AACF;AAgBO,SAAS,0BAA0B,QAAgD;AACxF,QAAM,SACJ,cAAc,UAAU,SAAS,UAAU,EAAE,aAAa,WAAW,EAAE,YAAY;AACrF,QAAM,MAA4B,SAAS,EAAE,SAAS,OAAO,IAAI;AAEjE,QAAM,QAAQ,IAAI,SAAS,IAAI,cAAc;AAC7C,MAAI,EAAE,iBAAiB,gBAAgB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,gBAAgB;AACtB,QAAM,QAAS,IAAI,SAAS;AAC5B,QAAM,aAAa,IAAI,cAAc;AAErC,QAAM,cAAoD,CAAC;AAC3D,MAAI,IAAI,QAAQ;AACd,eAAW,CAAC,SAAS,CAAC,KAAK,OAAO,QAAQ,IAAI,MAAM,EAAG,aAAY,KAAK,CAAC,SAAS,CAAC,CAAC;AAAA,EACtF;AACA,MAAI,IAAI,eAAe;AACrB,eAAW,SAAS,IAAI,cAAe,aAAY,KAAK,KAAK;AAAA,EAC/D;AAEA,SAAO,eAAe,uBACpB,SACA,MAA+B,CAAC,GACN;AAG1B,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;AAClC,UAAM,MAAM,GAAG,OAAO,QAAQ,GAAG,OAAO,MAAM;AAC9C,QAAI;AACJ,eAAW,CAAC,SAAS,CAAC,KAAK,aAAa;AACtC,UAAI,kBAAkB,KAAK,OAAO,GAAG;AACnC,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,WAAW,IAAI;AACjC,QAAI,CAAC,WAAW;AACd,aAAO,EAAE,SAAS,OAAO,SAAS,CAAC,EAAE;AAAA,IACvC;AAEA,UAAM,eAAe,OAAO,YAAY,cAAc,cAAc,cAAc,GAAG;AACrF,UAAM,MAAM,GAAG,MAAM,qBAAqB,SAAS,OAAO,YAAY,GAAG,CAAC,IAAI,YAAY;AAC1F,UAAM,QAAQ,cAAc,SAAS,KAAK,UAAU,QAAQ;AAE5D,QAAI,MAAM,QAAQ,UAAU,KAAK;AAC/B,YAAM,aAAa,KAAK,MAAM,MAAM,UAAU,KAAK,IAAI,KAAK,GAAI;AAChE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,UACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,UACzC,yBAAyB;AAAA,UACzB,eAAe,OAAO,UAAU;AAAA,QAClC;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,QACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,QACzC,yBAAyB,OAAO,KAAK,IAAI,GAAG,UAAU,MAAM,MAAM,KAAK,CAAC;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;;;AChTA,SAAS,gCAAgC;AA2DzC,SAAS,gBAAgB,SAA6B,OAA+B;AACnF,MAAI,QAAQ,SAAU;AAEtB,MAAI,UAAU,SAAS,QAAQ,eAAe,UAAa,QAAQ,eAAe,QAAQ;AACxF,UAAM,IAAI;AAAA,MACR;AAAA,IAKF;AAAA,EACF;AAEA,MAAI,UAAU,QAAQ;AACpB,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACF;AA6BO,SAAS,YAAY,SAAoD;AAC9E,QAAM,QAAQ,QAAQ,SAAS;AAC/B,kBAAgB,SAAS,KAAK;AAE9B,QAAM,SAA0B,EAAE,KAAK,QAAQ,KAAK,UAAU,QAAQ,SAAS;AAK/E,QAAM,UAAU;AAAA,IACd,QAAQ,UAAU,WACd,EAAE,SAAS,QAAQ,OAAO,YAAY,QAAQ,YAAY,OAAO,QAAQ,MAAM,IAC/E;AAAA,MACE,eAAe,CAAC,CAAC,OAAO,MAAM,CAAC;AAAA,MAC/B;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,OAAO,QAAQ;AAAA,IACjB;AAAA,EACN;AAEA,QAAM,UAAU,QAAQ,WAAW;AAEnC,iBAAe,WAAW,SAAoD;AAC5E,QAAI,QAAQ,SAAU,QAAO,QAAQ,SAAS,OAAO;AACrD,UAAM,WAAW,2BAA2B,SAAS,QAAQ,cAAc,KAAK;AAChF,WAAO,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,EAClD;AAEA,SAAO,MAAM,iBAAwC;AAAA,IACnD,MAAM,YAAY,SAA6C;AAC7D,YAAM,UAAU,QAAQ,WAAW;AACnC,YAAM,EAAE,SAAS,QAAQ,IAAI,MAAM,QAAQ,SAAS,MAAM,WAAW,OAAO,CAAC;AAE7E,UAAI,SAAS;AAIX,cAAM,IAAI,yBAAyB,SAAS,EAAE,QAAQ,CAAC;AAAA,MACzD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-ELXOGRY5.js → chunk-3IIKKBOJ.js}

@@ -88,6 +88,105 @@ function _resetKeyCacheForTests() {
   keyCache.clear();
 }
 
+// src/server/auth/secret-strength.ts
+var MIN_SECRET_LENGTH = 32;
+var MIN_DISTINCT_CHARS = 8;
+var PLACEHOLDER_TERMS = [
+  /change[-_ ]?me/i,
+  /placeholder/i,
+  /\bsecret/i,
+  /passw(or)?d/i,
+  /insecure/i,
+  /example/i,
+  /sample/i,
+  /dummy/i,
+  /replace/i,
+  /generate/i,
+  /notasecret/i,
+  /foobar/i,
+  /hunter2/i,
+  /lorem/i
+];
+var DELIMITED_PLACEHOLDER_TERMS = [
+  "dev",
+  "test",
+  "demo",
+  "temp",
+  "fake",
+  "local",
+  "mine",
+  "todo",
+  "none",
+  "null",
+  "key",
+  "seed",
+  "value",
+  "here",
+  "your",
+  "xxx",
+  "yyy",
+  "zzz"
+];
+var WORD_CHARACTER = /[a-z0-9]/i;
+function isWordCharacter(char) {
+  return char !== void 0 && WORD_CHARACTER.test(char);
+}
+function containsDelimitedTerm(secret, term) {
+  const haystack = secret.toLowerCase();
+  for (let from = 0; from <= haystack.length - term.length; ) {
+    const at = haystack.indexOf(term, from);
+    if (at === -1) return false;
+    if (!isWordCharacter(haystack[at - 1]) && !isWordCharacter(haystack[at + term.length])) {
+      return true;
+    }
+    from = at + 1;
+  }
+  return false;
+}
+var RULES = [
+  {
+    code: "too_short",
+    check: (secret) => secret.length < MIN_SECRET_LENGTH ? `is ${secret.length} characters; the minimum is ${MIN_SECRET_LENGTH}` : null
+  },
+  {
+    code: "placeholder",
+    check: (secret) => {
+      const matched = PLACEHOLDER_TERMS.find((term) => term.test(secret));
+      if (matched) {
+        return `contains placeholder wording (matching ${String(matched)}); a generated secret contains no words`;
+      }
+      const delimited = DELIMITED_PLACEHOLDER_TERMS.find(
+        (term) => containsDelimitedTerm(secret, term)
+      );
+      if (delimited) {
+        return `contains the placeholder word "${delimited}" as a standalone term; a generated secret contains no words`;
+      }
+      return null;
+    }
+  },
+  {
+    code: "low_variety",
+    check: (secret) => {
+      const distinct = new Set(secret).size;
+      return distinct < MIN_DISTINCT_CHARS ? `uses only ${distinct} distinct characters; a generated secret of this length uses at least ${MIN_DISTINCT_CHARS}` : null;
+    }
+  },
+  {
+    code: "repeated_pattern",
+    check: (secret) => {
+      const period = (secret + secret).indexOf(secret, 1);
+      return period > 0 && period * 3 <= secret.length ? `is a ${period}-character block repeated ${Math.round(secret.length / period)} times` : null;
+    }
+  }
+];
+function inspectSecret(secret) {
+  for (const rule of RULES) {
+    const reason = rule.check(secret);
+    if (reason !== null) return { code: rule.code, reason };
+  }
+  return null;
+}
+
 // src/server/auth/session.ts
 var MAX_SECRETS = 5;
 function normalizeSecrets(input) {
@@ -240,33 +339,21 @@ async function rotateIfNeeded(sm, req, res) {
   }
   return data;
 }
-var PLACEHOLDER_PATTERN = /CHANGE_ME|demo[-_]|placeholder/i;
 function assertProductionSecret(secret) {
   const arr = Array.isArray(secret) ? secret : [secret];
   const isProd = process.env.NODE_ENV === "production";
   for (let i = 0; i < arr.length; i++) {
-    const s = arr[i];
-    const isPlaceholder = PLACEHOLDER_PATTERN.test(s);
-    const isTooShort = s.length < 32;
+    const weakness = inspectSecret(arr[i]);
+    if (!weakness) continue;
     const prefix = arr.length > 1 ? `Session secret at index ${i}` : "Session secret";
     if (isProd) {
-      if (isTooShort) {
-        throw new Error(
-          `${prefix} too short for production (${s.length} chars; minimum 32). Set a 32+ random char secret in your env (e.g., \`openssl rand -hex 32\`).`
-        );
-      }
-      if (isPlaceholder) {
-        throw new Error(
-          `${prefix} looks like a placeholder ("${s.slice(0, 16)}\u2026") and NODE_ENV is "production". Replace it with a 32+ random char secret (e.g., \`openssl rand -hex 32\`) before deploying.`
-        );
-      }
-      continue;
-    }
-    if (isPlaceholder || isTooShort) {
-      console.warn(
-        `[theokit] WARNING: ${prefix.toLowerCase()} is a placeholder or too short. This is OK for dev, but the production server will REFUSE to boot until you replace it.`
+      throw new Error(
+        `${prefix} ${weakness.reason}, and NODE_ENV is "production". Generate one with \`openssl rand -hex 32\` and read it from the environment.`
       );
     }
+    console.warn(
+      `[theokit] WARNING: ${prefix.toLowerCase()} ${weakness.reason}. This is OK for dev, but the production server will REFUSE to boot until you replace it.`
+    );
   }
 }
 
@@ -615,6 +702,8 @@ export {
   encrypt,
   decrypt,
   _resetKeyCacheForTests,
+  MIN_SECRET_LENGTH,
+  inspectSecret,
   createSessionManager,
   createSessionManagerWeb,
   rotateIfNeededWeb,
@@ -636,4 +725,4 @@ export {
   clearOidcCache,
   discoverOidcProvider
 };
-//# sourceMappingURL=chunk-ELXOGRY5.js.map
+//# sourceMappingURL=chunk-3IIKKBOJ.js.map

package/dist/chunk-3IIKKBOJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/auth/auth.ts","../src/server/auth/crypto.ts","../src/server/auth/secret-strength.ts","../src/server/auth/session.ts","../src/server/auth/authenticated-guard.ts","../src/server/_internal/encoding.ts","../src/server/auth/auth-totp.ts","../src/server/auth/auth-backup-codes.ts","../src/server/auth/auth-throttle.ts","../src/server/auth/oauth-pkce.ts","../src/server/auth/oauth-state.ts","../src/server/auth/oidc-discovery.ts"],"mappings":";;;;;;;;;;AAAO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,OAAO;AAAA,EACP,SAAS;AAAA,EAET,YAAY,UAAU,2BAA2B;AAC/C,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,YAAe,SAAqD;AAClF,MAAI,YAAY,QAAQ,YAAY,QAAW;AAC7C,UAAM,IAAI,kBAAkB;AAAA,EAC9B;AACF;;;ACEA,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAEhC,IAAM,oBAAoB,QAAQ,OAAO,iBAAiB;AAC1D,IAAM,kBAAkB,IAAI,WAAW,CAAC;AAKxC,IAAM,WAAW,oBAAI,IAAgC;AAErD,eAAe,UAAU,QAAoC;AAC3D,QAAM,SAAS,SAAS,IAAI,MAAM;AAClC,MAAI,OAAQ,QAAO;AAEnB,QAAM,UAAU,YAAY;AAC1B,UAAM,cAAc,MAAM,OAAO,OAAO;AAAA,MACtC;AAAA,MACA,QAAQ,OAAO,MAAM;AAAA,MACrB,EAAE,MAAM,OAAO;AAAA,MACf;AAAA,MACA,CAAC,WAAW;AAAA,IACd;AACA,WAAO,OAAO,OAAO;AAAA,MACnB,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,iBAAiB,MAAM,kBAAkB;AAAA,MAChF;AAAA,MACA,EAAE,MAAM,WAAW,QAAQ,IAAI;AAAA,MAC/B;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AAAA,EACF,GAAG;AAEH,WAAS,IAAI,QAAQ,MAAM;AAE3B,SAAO,MAAM,MAAM;AACjB,aAAS,OAAO,MAAM;AAAA,EACxB,CAAC;AACD,SAAO;AACT;AAEA,SAAS,YAAY,MAA0B;AAC7C,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,WAAW;AAC/C;AASA,SAAS,cAAc,KAAsC;AAC3D,QAAM,MAAM,OAAO,KAAK,KAAK,WAAW;AACxC,QAAM,OAAO,IAAI,WAAW,IAAI,MAAM;AACtC,OAAK,IAAI,GAAG;AACZ,SAAO;AACT;AAOA,eAAsB,QAAW,MAAS,QAAiC;AACzE,QAAM,MAAM,MAAM,UAAU,MAAM;AAClC,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACpD,QAAM,YAAY,QAAQ,OAAO,KAAK,UAAU,IAAI,CAAC;AACrD,QAAM,aAAa,IAAI;AAAA,IACrB,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,SAAS;AAAA,EACrE;AACA,SAAO,GAAG,YAAY,EAAE,CAAC,IAAI,YAAY,UAAU,CAAC;AACtD;AAEA,eAAsB,QAAW,OAAe,QAAmC;AACjF,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,UAAM,KAAK,cAAc,MAAM,CAAC,CAAC;AACjC,UAAM,aAAa,cAAc,MAAM,CAAC,CAAC;AACzC,UAAM,MAAM,MAAM,UAAU,MAAM;AAElC,UAAM,YAAY,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,UAAU;AACtF,WAAO,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,yBAA+B;AAC7C,WAAS,MAAM;AACjB;;;ACxDO,IAAM,oBAAoB;AAcjC,IAAM,qBAAqB;AAQ3B,IAAM,oBAAuC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASA,IAAM,8BAAiD;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,iBAAiB;AAGvB,SAAS,gBAAgB,MAAmC;AAC1D,SAAO,SAAS,UAAa,eAAe,KAAK,IAAI;AACvD;AAWA,SAAS,sBAAsB,QAAgB,MAAuB;AACpE,QAAM,WAAW,OAAO,YAAY;AACpC,WAAS,OAAO,GAAG,QAAQ,SAAS,SAAS,KAAK,UAAU;AAC1D,UAAM,KAAK,SAAS,QAAQ,MAAM,IAAI;AACtC,QAAI,OAAO,GAAI,QAAO;AACtB,QAAI,CAAC,gBAAgB,SAAS,KAAK,CAAC,CAAC,KAAK,CAAC,gBAAgB,SAAS,KAAK,KAAK,MAAM,CAAC,GAAG;AACtF,aAAO;AAAA,IACT;AACA,WAAO,KAAK;AAAA,EACd;AACA,SAAO;AACT;AAiBA,IAAM,QAA+B;AAAA,EACnC;AAAA,IACE,MAAM;AAAA,IACN,OAAO,CAAC,WACN,OAAO,SAAS,oBACZ,MAAM,OAAO,MAAM,+BAA+B,iBAAiB,KACnE;AAAA,EACR;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO,CAAC,WAAW;AACjB,YAAM,UAAU,kBAAkB,KAAK,CAAC,SAAS,KAAK,KAAK,MAAM,CAAC;AAClE,UAAI,SAAS;AACX,eAAO,0CAA0C,OAAO,OAAO,CAAC;AAAA,MAClE;AACA,YAAM,YAAY,4BAA4B;AAAA,QAAK,CAAC,SAClD,sBAAsB,QAAQ,IAAI;AAAA,MACpC;AACA,UAAI,WAAW;AACb,eAAO,kCAAkC,SAAS;AAAA,MACpD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO,CAAC,WAAW;AACjB,YAAM,WAAW,IAAI,IAAI,MAAM,EAAE;AACjC,aAAO,WAAW,qBACd,aAAa,QAAQ,yEAAyE,kBAAkB,KAChH;AAAA,IACN;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO,CAAC,WAAW;AAIjB,YAAM,UAAU,SAAS,QAAQ,QAAQ,QAAQ,CAAC;AAClD,aAAO,SAAS,KAAK,SAAS,KAAK,OAAO,SACtC,QAAQ,MAAM,6BAA6B,KAAK,MAAM,OAAO,SAAS,MAAM,CAAC,WAC7E;AAAA,IACN;AAAA,EACF;AACF;AAiBO,SAAS,cAAc,QAAuC;AACnE,aAAW,QAAQ,OAAO;AACxB,UAAM,SAAS,KAAK,MAAM,MAAM;AAChC,QAAI,WAAW,KAAM,QAAO,EAAE,MAAM,KAAK,MAAM,OAAO;AAAA,EACxD;AACA,SAAO;AACT;;;AC3KA,IAAM,cAAc;AAMpB,SAAS,iBAAiB,OAAoC;AAC5D,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,MAAM,IAAI,CAAC,KAAK;AACzD,MAAI,IAAI,WAAW,GAAG;AACpB,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,MAAI,IAAI,SAAS,aAAa;AAC5B,UAAM,IAAI;AAAA,MACR,2CAA2C,WAAW,qEAAgE,IAAI,MAAM;AAAA,IAClI;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,KAAK;AACpC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,UAAM,IAAI,IAAI,CAAC;AACf,QAAI,OAAO,MAAM,YAAY,EAAE,SAAS,IAAI;AAC1C,YAAM,QAAQ,WAAW,aAAa,CAAC,KAAK;AAC5C,YAAM,IAAI,MAAM,iBAAiB,KAAK,uDAAuD;AAAA,IAC/F;AAAA,EACF;AACA,SAAO;AACT;AAgBA,SAAS,eAAe,OAAoC;AAC1D,QAAM,UAAU,iBAAiB,KAAK;AACtC,yBAAuB,OAAO;AAC9B,SAAO;AACT;AAUA,eAAe,uBACb,MACA,SACA,QACiB;AACjB,QAAM,WAAqC;AAAA,IACzC;AAAA,IACA,KAAK,KAAK,IAAI,IAAI,SAAS;AAAA,EAC7B;AACA,SAAO,QAAQ,UAAU,QAAQ,CAAC,CAAC;AACrC;AAWA,eAAe,2BACb,KACA,SACwE;AACxE,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,QAAQ,IAAI,OAAO,QAAQ,MAAM;AAC/B,YAAM,MAAM,MAAM,QAAmC,KAAK,MAAM;AAChE,aAAO,MAAM,EAAE,UAAU,KAAK,OAAO,EAAE,IAAI;AAAA,IAC7C,CAAC;AAAA,EACH;AACA,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAQ,QAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEO,SAAS,qBAA+B,QAAiD;AAC9F,QAAM,UAAU,eAAe,OAAO,MAAM;AAC5C,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,SAAS,OAAO,UAAU;AAEhC,WAAS,YAAY,KAAqB,OAAqB;AAC7D,cAAU,KAAK,YAAY,OAAO;AAAA,MAChC,UAAU;AAAA,MACV,UAAU;AAAA,MACV;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,KAAK;AACpB,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,GAAG;AAClD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,mBAAmB,KAAK;AAC5B,YAAM,MAAM,UAAU,KAAK,UAAU;AACrC,UAAI,CAAC,IAAK,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AAChF,YAAM,UAAU,MAAM,2BAAqC,KAAK,OAAO;AACvE,UAAI,CAAC,QAAS,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AACpF,UAAI,QAAQ,SAAS,MAAM,KAAK,IAAI,GAAG;AACrC,eAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,MAAM,EAAE;AAAA,MACnF;AACA,aAAO;AAAA,QACL,MAAM,QAAQ,SAAS;AAAA,QACvB,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,IAEA,MAAM,cAAc,KAAK,MAAM;AAC7B,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,kBAAY,KAAK,KAAK;AAAA,IACxB;AAAA,IAEA,eAAe,KAAK;AAClB,mBAAa,KAAK,UAAU;AAAA,IAC9B;AAAA,IAEA,MAAM,cAAc,KAAK,KAAK;AAC5B,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,GAAG;AAClD,UAAI,SAAS,KAAM,QAAO;AAG1B,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,kBAAY,KAAK,KAAK;AACtB,aAAO;AAAA,IACT;AAAA,EACF;AACF;AA4BO,SAAS,wBACd,QAC6B;AAC7B,QAAM,UAAU,eAAe,OAAO,MAAM;AAC5C,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,SAAS,OAAO,UAAU;AAEhC,WAAS,eAAe,QAAiB,OAAqB;AAC5D,0BAAsB,QAAQ,YAAY,OAAO;AAAA,MAC/C,UAAU;AAAA,MACV,UAAU;AAAA,MACV;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,SAAS;AACxB,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,OAAO;AACtD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,mBAAmB,SAAS;AAChC,YAAM,MAAM,qBAAqB,SAAS,UAAU;AACpD,UAAI,QAAQ,OAAW,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AAC7F,YAAM,UAAU,MAAM,2BAAqC,KAAK,OAAO;AACvE,UAAI,CAAC,QAAS,QAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,IAAI,gBAAgB,MAAM,EAAE;AACpF,UAAI,QAAQ,SAAS,MAAM,KAAK,IAAI,GAAG;AACrC,eAAO,EAAE,MAAM,MAAM,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,MAAM,EAAE;AAAA,MACnF;AACA,aAAO;AAAA,QACL,MAAM,QAAQ,SAAS;AAAA,QACvB,MAAM,EAAE,aAAa,QAAQ,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,IAEA,MAAM,cAAc,QAAQ,MAAM;AAChC,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,qBAAe,QAAQ,KAAK;AAAA,IAC9B;AAAA,IAEA,eAAe,QAAQ;AACrB,kCAA4B,QAAQ,UAAU;AAAA,IAChD;AAAA,IAEA,MAAM,cAAc,SAAS,QAAQ;AACnC,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAmB,OAAO;AACtD,UAAI,SAAS,KAAM,QAAO;AAC1B,YAAM,QAAQ,MAAM,uBAAuB,MAAM,SAAS,MAAM;AAChE,qBAAe,QAAQ,KAAK;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAiBA,eAAsB,kBACpB,IACA,SACA,QAC0B;AAC1B,QAAM,EAAE,MAAM,KAAK,IAAI,MAAM,GAAG,mBAAmB,OAAO;AAC1D,MAAI,SAAS,QAAQ,KAAK,gBAAgB;AACxC,UAAM,GAAG,cAAc,QAAQ,IAAI;AAAA,EACrC;AACA,SAAO;AACT;AAmBA,eAAsB,eACpB,IACA,KACA,KAC0B;AAC1B,QAAM,EAAE,MAAM,KAAK,IAAI,MAAM,GAAG,mBAAmB,GAAG;AACtD,MAAI,SAAS,QAAQ,KAAK,gBAAgB;AACxC,UAAM,GAAG,cAAc,KAAK,IAAI;AAAA,EAClC;AACA,SAAO;AACT;AAoBO,SAAS,uBAAuB,QAAiC;AACtE,QAAM,MAAM,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;AACpD,QAAM,SAAS,QAAQ,IAAI,aAAa;AAExC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,UAAM,WAAW,cAAc,IAAI,CAAC,CAAC;AACrC,QAAI,CAAC,SAAU;AAEf,UAAM,SAAS,IAAI,SAAS,IAAI,2BAA2B,CAAC,KAAK;AAEjE,QAAI,QAAQ;AACV,YAAM,IAAI;AAAA,QACR,GAAG,MAAM,IAAI,SAAS,MAAM;AAAA,MAE9B;AAAA,IACF;AACA,YAAQ;AAAA,MACN,sBAAsB,OAAO,YAAY,CAAC,IAAI,SAAS,MAAM;AAAA,IAE/D;AAAA,EACF;AACF;;;AC5SO,SAAS,cAAwB,UAA0D;AAChG,SAAO,MAAM,mBAA0C;AAAA,IACrD,MAAM,YAAY,SAA6C;AAG7D,aAAQ,MAAM,SAAS,WAAW,QAAQ,WAAW,CAAC,MAAO;AAAA,IAC/D;AAAA,EACF;AACF;;;AC5EO,SAAS,gBAAgB,OAA2B;AACzD,MAAI,IAAI;AACR,aAAW,KAAK,MAAO,MAAK,OAAO,aAAa,CAAC;AAMjD,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AAgBO,SAAS,mBAAmB,GAAW,GAAoB;AAChE,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EAAG,QAAO;AAE7C,QAAM,SAAS,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AAC1C,MAAI,OAAO,EAAE,SAAS,EAAE;AACxB,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAG/B,UAAM,KAAK,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI;AAC5C,UAAM,KAAK,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI;AAC5C,YAAQ,KAAK;AAAA,EACf;AACA,SAAO,SAAS;AAClB;;;ACbA,IAAM,eAAe;AACrB,IAAM,iBAAiB;AACvB,IAAM,oBAAmC;AAGzC,SAAS,aAAa,GAAuB;AAC3C,QAAM,WAAW;AASjB,QAAM,QAAQ,EAAE,YAAY;AAC5B,MAAI,MAAM,MAAM;AAChB,SAAO,MAAM,KAAK,MAAM,WAAW,MAAM,CAAC,MAAM,GAAgB,QAAO;AACvE,QAAM,QAAQ,MAAM,MAAM,GAAG,GAAG,EAAE,QAAQ,QAAQ,EAAE;AACpD,MAAI,CAAC,cAAc,KAAK,KAAK,GAAG;AAC9B,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AACA,QAAM,OAAiB,CAAC;AACxB,aAAW,KAAK,OAAO;AACrB,UAAM,MAAM,SAAS,QAAQ,CAAC;AAC9B,aAAS,IAAI,GAAG,KAAK,GAAG,IAAK,MAAK,KAAM,OAAO,IAAK,CAAC;AAAA,EACvD;AAEA,QAAM,YAAY,KAAK,MAAM,KAAK,SAAS,CAAC;AAC5C,QAAM,MAAM,IAAI,WAAW,SAAS;AACpC,WAAS,IAAI,GAAG,IAAI,WAAW,KAAK;AAClC,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,GAAG,IAAK,KAAK,KAAK,IAAK,KAAK,IAAI,IAAI,CAAC;AACzD,QAAI,CAAC,IAAI;AAAA,EACX;AACA,SAAO;AACT;AAGA,SAAS,aAAa,OAA2B;AAC/C,QAAM,WAAW;AACjB,MAAI,MAAM;AACV,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,KAAK,OAAO;AACrB,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,aAAO,SAAU,UAAW,OAAO,IAAM,EAAI;AAC7C,cAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,EAAG,QAAO,SAAU,UAAW,IAAI,OAAS,EAAI;AAC3D,SAAO;AACT;AAEA,SAAS,gBAAgB,QAAyC;AAChE,MAAI,OAAO,WAAW,SAAU,QAAO,aAAa,MAAM;AAC1D,SAAO;AACT;AAGA,SAAS,aAAa,QAAgB,SAA6B;AACjE,QAAM,UAAU,KAAK,MAAM,SAAS,MAAO,OAAO;AAClD,QAAM,MAAM,IAAI,WAAW,CAAC;AAE5B,QAAM,KAAK,KAAK,MAAM,UAAU,UAAW;AAC3C,QAAM,KAAK,YAAY;AACvB,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,IAAK;AACtB,MAAI,CAAC,IAAI,KAAK;AACd,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,KAAM;AACvB,MAAI,CAAC,IAAK,OAAO,IAAK;AACtB,MAAI,CAAC,IAAI,KAAK;AACd,SAAO;AACT;AAEA,eAAe,KACb,QACA,SACA,WACqB;AACrB,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,MAAM,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,OAAuB;AACzE,SAAO,IAAI,WAAW,GAAG;AAC3B;AAGA,SAAS,SAAS,KAAiB,QAAwB;AACzD,QAAM,SAAS,IAAI,IAAI,SAAS,CAAC,IAAI;AACrC,QAAM,QACF,IAAI,MAAM,IAAI,QAAS,MACvB,IAAI,SAAS,CAAC,IAAI,QAAS,MAC3B,IAAI,SAAS,CAAC,IAAI,QAAS,IAC5B,IAAI,SAAS,CAAC,IAAI;AACrB,QAAM,MAAM,MAAM;AAClB,SAAO,OAAO,OAAO,GAAG,EAAE,SAAS,QAAQ,GAAG;AAChD;AAGA,eAAsB,aAAa,MAAoC;AACrE,QAAM,SAAS,gBAAgB,KAAK,MAAM;AAC1C,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,OAAO,KAAK,QAAQ,KAAK,IAAI;AACnC,QAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,MAAM,IAAI,GAAG,SAAS;AAClE,SAAO,SAAS,KAAK,MAAM;AAC7B;AAQA,eAAsB,WAAW,OAAe,MAA2C;AACzF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,MAAM,WAAW,OAAQ,QAAO;AAE5D,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,OAAO,KAAK,QAAQ,KAAK,IAAI;AACnC,QAAM,QAAQ,KAAK,UAAU;AAC7B,QAAM,SAAS,gBAAgB,KAAK,MAAM;AAG1C,MAAI,UAAU;AACd,WAAS,QAAQ,CAAC,OAAO,SAAS,OAAO,SAAS;AAChD,UAAM,IAAI,OAAO,QAAQ,OAAO;AAChC,UAAM,OAAO,SAAS,MAAM,KAAK,QAAQ,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM;AAClF,QAAI,mBAAmB,MAAM,KAAK,EAAG,WAAU;AAAA,EACjD;AACA,SAAO;AACT;AAGO,SAAS,mBAAmB,QAAQ,IAAgB;AACzD,MAAI,QAAQ,IAAI;AACd,UAAM,IAAI,MAAM,gEAA6D;AAAA,EAC/E;AACA,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,gBAAgB,GAAG;AAC1B,SAAO;AACT;AAgBO,SAAS,QAAQ,MAA8B;AACpD,QAAM,QAAQ,GAAG,KAAK,MAAM,IAAI,KAAK,OAAO;AAC5C,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,QAAQ,aAAa,KAAK,MAAM;AAAA,IAChC,QAAQ,KAAK;AAAA,IACb,WAAW,KAAK,aAAa;AAAA,IAC7B,QAAQ,OAAO,KAAK,UAAU,cAAc;AAAA,IAC5C,QAAQ,OAAO,KAAK,QAAQ,YAAY;AAAA,EAC1C,CAAC;AACD,SAAO,kBAAkB,mBAAmB,KAAK,CAAC,IAAI,OAAO,SAAS,CAAC;AACzE;;;AC7LA,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,iBAAiB;AAQvB,eAAsB,oBAAoB,OAA0B,CAAC,GAA0B;AAC7F,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,YAAY,KAAK,cAAc,SAAY,MAAM,KAAK;AAC5D,QAAM,WAAW,KAAK,YAAY;AAMlC,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,KAAK,QAAQ,KAAM;AAC1D,UAAM,IAAI;AAAA,MACR,mEAAmE,OAAO,KAAK,CAAC;AAAA,IAClF;AAAA,EACF;AACA,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,IAAI;AAC1D,UAAM,IAAI;AAAA,MACR,kEAAkE,OAAO,MAAM,CAAC;AAAA,IAClF;AAAA,EACF;AACA,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,IAAI;AAAA,MACR,6EAA6E,SAAS,MAAM;AAAA,IAC9F;AAAA,EACF;AAEA,QAAM,QAAsB,CAAC;AAC7B,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,MAAM,SAAS,OAAO;AAC3B,UAAM,MAAM,mBAAmB,QAAQ,QAAQ;AAC/C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,UAAM,YAAY,oBAAoB,KAAK,SAAS;AACpD,UAAM,OAAO,MAAM,UAAU,cAAc,SAAS,CAAC;AACrD,UAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAUA,eAAsB,iBACpB,MACA,QACmD;AACnD,QAAM,YAAY,MAAM,UAAU,cAAc,IAAI,CAAC;AACrD,MAAI;AAEJ,aAAW,KAAK,QAAQ;AACtB,QAAIA,oBAAmB,GAAG,SAAS,GAAG;AACpC,oBAAc;AAAA,IAChB;AAAA,EACF;AACA,SAAO,cAAc,EAAE,OAAO,MAAM,YAAY,IAAI,EAAE,OAAO,MAAM;AACrE;AAOA,SAAS,cAAc,OAAuB;AAC5C,SAAO,MAAM,YAAY,EAAE,QAAQ,WAAW,EAAE;AAClD;AAEA,SAAS,oBAAoB,KAAa,WAA+B;AACvE,MAAI,CAAC,aAAa,IAAI,SAAS,EAAG,QAAO;AACzC,QAAM,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC;AACrC,SAAO,IAAI,MAAM,GAAG,GAAG,IAAI,YAAY,IAAI,MAAM,GAAG;AACtD;AAEA,SAAS,mBAAmB,QAAgB,UAA0B;AACpE,QAAM,SAAS,IAAI,WAAW,MAAM;AACpC,SAAO,gBAAgB,MAAM;AAC7B,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC/B,WAAO,SAAS,OAAO,CAAC,IAAI,SAAS,MAAM;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,eAAe,UAAU,OAAgC;AACvD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK;AAC5C,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AACxD,SAAO,MAAM,KAAK,IAAI,WAAW,IAAI,CAAC,EACnC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEA,SAASA,oBAAmB,GAAW,GAAoB;AACzD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC3E,SAAO,SAAS;AAClB;;;ACjGA,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB,KAAK;AAOhC,eAAsB,cAAc,MAA+C;AACjF,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,QAAQ,MAAM,KAAK,MAAM,IAAI,KAAK,UAAU;AAClD,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,SAAS,MAAM,mBAAmB,YAAY;AAAA,EACzD;AACA,MAAI,MAAM,SAAS,aAAa;AAC9B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,mBAAmB;AAAA;AAAA,MAEnB,aAAa,IAAI,KAAK,MAAM,OAAO;AAAA,IACrC;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,mBAAmB,KAAK,IAAI,GAAG,cAAc,MAAM,KAAK;AAAA,EAC1D;AACF;AAWA,eAAsB,cACpB,MACA,SACwB;AACxB,QAAM,cAAc,KAAK,eAAe;AACxC,MAAI,SAAS;AACX,UAAM,KAAK,MAAM,MAAM,KAAK,UAAU;AACtC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,mBAAmB;AAAA,IACrB;AAAA,EACF;AACA,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,QAAQ,MAAM,KAAK,MAAM,KAAK,KAAK,YAAY,SAAS;AAE9D,MAAI,MAAM,SAAS,aAAa;AAC9B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,mBAAmB;AAAA,MACnB,aAAa,IAAI,KAAK,MAAM,OAAO;AAAA,IACrC;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,mBAAmB,KAAK,IAAI,GAAG,cAAc,MAAM,KAAK;AAAA,EAC1D;AACF;;;AClFA,eAAsB,0BAA0B,UAAmC;AACjF,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,QAAQ;AAC/C,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AACxD,SAAO,gBAAgB,IAAI,WAAW,IAAI,CAAC;AAC7C;AAWA,eAAsB,wBAAgD;AACpE,QAAM,SAAS,IAAI,WAAW,EAAE;AAChC,SAAO,gBAAgB,MAAM;AAC7B,QAAM,eAAe,gBAAgB,MAAM;AAC3C,QAAM,gBAAgB,MAAM,0BAA0B,YAAY;AAClE,SAAO,EAAE,cAAc,eAAe,qBAAqB,OAAO;AACpE;;;ACjCO,SAAS,mBAAmB,OAA2B,CAAC,GAAW;AACxE,QAAM,MAAM,KAAK,SAAS;AAC1B,QAAM,MAAM,IAAI,WAAW,GAAG;AAC9B,SAAO,gBAAgB,GAAG;AAC1B,SAAO,gBAAgB,GAAG;AAC5B;AASO,SAAS,iBAAiB,UAAkB,QAAyB;AAC1E,SAAO,mBAAmB,UAAU,MAAM;AAC5C;;;ACNA,IAAM,QAAQ,oBAAI,IAAmC;AAG9C,SAAS,iBAAuB;AACrC,QAAM,MAAM;AACd;AAEA,SAAS,WAAW,MAAuB;AACzC,SAAO,SAAS,eAAe,SAAS,eAAe,SAAS,WAAW,SAAS;AACtF;AAWA,eAAsB,qBAAqB,QAA6C;AACtF,QAAM,YAAY,OAAO,WAAW,WAAW,SAAS,OAAO,SAAS;AAExE,QAAM,MAAM,IAAI,IAAI,SAAS;AAC7B,MAAI,IAAI,aAAa,YAAY,CAAC,WAAW,IAAI,QAAQ,GAAG;AAC1D,UAAM,IAAI;AAAA,MACR,yCAAyC,IAAI,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAExE;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,IAAI,SAAS;AAClC,MAAI,OAAQ,QAAO;AAEnB,QAAM,WAAW,YAAY;AAC3B,UAAM,YAAY,IAAI;AAAA,MACpB;AAAA,MACA,UAAU,SAAS,GAAG,IAAI,YAAY,YAAY;AAAA,IACpD;AACA,UAAM,MAAM,MAAM,MAAM,SAAS;AACjC,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,IAAI,IAAI,UAAU,OAAO,SAAS,EAAE;AAAA,IAC1F;AACA,UAAM,WAAY,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,SAAS,wBAAwB;AACpC,YAAM,IAAI,MAAM,kFAA6E;AAAA,IAC/F;AACA,WAAO;AAAA,EACT,GAAG;AAEH,QAAM,IAAI,WAAW,OAAO;AAC5B,UAAQ,MAAM,MAAM;AAClB,QAAI,MAAM,IAAI,SAAS,MAAM,QAAS,OAAM,OAAO,SAAS;AAAA,EAC9D,CAAC;AACD,SAAO;AACT;","names":["constantTimeEquals"]}

package/dist/{chunk-BQJBFHAY.js → chunk-47OYUMXW.js}

@@ -178,7 +178,7 @@ async function agentCommand(name, message, deps = {}) {
 async function createAgentSsrLoader(projectRoot) {
   const { createServer } = await import("vite");
   const react = (await import("@vitejs/plugin-react")).default;
-  const { theoPluginAsync } = await import("./vite-plugin-ZT2XNAGM.js");
+  const { theoPluginAsync } = await import("./vite-plugin-HPBVQNCG.js");
   const { loadConfig } = await import("./load-config-VMKOV44Y.js");
   const config = await loadConfig(projectRoot);
   const theoPlugins = await theoPluginAsync({
@@ -212,4 +212,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=chunk-BQJBFHAY.js.map
+//# sourceMappingURL=chunk-47OYUMXW.js.map

package/dist/{chunk-2NARRZPP.js → chunk-4DSRX3CO.js}

@@ -12,7 +12,7 @@ import {
   sendError,
   sendJson,
   validateCsrfRequest
-} from "./chunk-GDZOWQV7.js";
+} from "./chunk-QD5X56I3.js";
 import {
   buildSecurityHeaders
 } from "./chunk-VV2VU3LJ.js";
@@ -2633,4 +2633,4 @@ export {
   CsrfReadinessStore,
   applySecurityHeaders
 };
-//# sourceMappingURL=chunk-2NARRZPP.js.map
+//# sourceMappingURL=chunk-4DSRX3CO.js.map

package/dist/{chunk-4BQIJ4HE.js → chunk-5LRBIP4B.js}

@@ -1,3 +1,7 @@
+import {
+  escapeHtml,
+  escapeHtmlAttribute
+} from "./chunk-O2KGDLA7.js";
 import {
   validateRouteInput
 } from "./chunk-5AGNZXHJ.js";
@@ -197,9 +201,6 @@ function createOpenApiHandler(opts = {}) {
 function hasDotDotSegment(p) {
   return p.split(/[/\\]/).includes("..");
 }
-function escapeHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
 function renderScalarHtml(title, specUrl, cdnUrl) {
   return `<!DOCTYPE html>
 <html>
@@ -209,8 +210,8 @@ function renderScalarHtml(title, specUrl, cdnUrl) {
   <meta name="viewport" content="width=device-width,initial-scale=1">
 </head>
 <body>
-  <script id="api-reference" data-url="${escapeHtml(specUrl)}"></script>
-  <script src="${escapeHtml(cdnUrl)}"></script>
+  <script id="api-reference" data-url="${escapeHtmlAttribute(specUrl)}"></script>
+  <script src="${escapeHtmlAttribute(cdnUrl)}"></script>
 </body>
 </html>`;
 }
@@ -270,4 +271,4 @@ export {
   callProcedure,
   createOpenApiHandler
 };
-//# sourceMappingURL=chunk-4BQIJ4HE.js.map
+//# sourceMappingURL=chunk-5LRBIP4B.js.map

package/dist/chunk-5LRBIP4B.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/http/error-pages.ts","../src/server/http/static.ts","../src/server/http/in-process-caller.ts","../src/server/openapi/serve-docs.ts"],"mappings":";;;;;;;;;;;;;AAgBA,SAAS,WAAW,WAAW,UAAU,oBAAoB;AAC7D,SAAS,eAAe;AAEjB,IAAM,uBAAuB;AAOpC,SAAS,WAAW,KAAa,MAAkC;AACjE,QAAM,OAAO,QAAQ,KAAK,IAAI;AAG9B,MAAI;AACJ,MAAI;AACF,SAAK,SAAS,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AAGZ,QAAK,IAA8B,SAAS,UAAU;AACpD,cAAQ,KAAK,4BAA4B,IAAI,KAAM,IAAc,OAAO,EAAE;AAAA,IAC5E;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,OAAO,UAAU,EAAE;AACzB,QAAI,KAAK,OAAO,sBAAsB;AACpC,cAAQ;AAAA,QACN,+BAA+B,IAAI,OAAO,KAAK,IAAI,eAAe,oBAAoB;AAAA,MACxF;AACA,aAAO;AAAA,IACT;AACA,WAAO,aAAa,IAAI,OAAO;AAAA,EACjC,SAAS,KAAK;AACZ,YAAQ,KAAK,4BAA4B,IAAI,KAAM,IAAc,OAAO,EAAE;AAC1E,WAAO;AAAA,EACT,UAAE;AACA,cAAU,EAAE;AAAA,EACd;AACF;AAMO,SAAS,qBAAqB,WAAqC;AACxE,SAAO;AAAA,IACL,eAAe,WAAW,WAAW,UAAU;AAAA,IAC/C,eAAe,WAAW,WAAW,UAAU;AAAA,EACjD;AACF;;;ACzDA,SAAS,aAAAA,YAAW,aAAAC,YAAW,YAAAC,WAAU,gBAAAC,eAAc,oBAAoB;AAE3E,SAAS,WAAAC,UAAS,SAAS,WAAW;AAEtC,IAAM,aAAqC;AAAA,EACzC,SAAS;AAAA,EACT,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,SAAS,gBACd,KACA,KACA,WACS;AACT,QAAM,WAAW,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAI7C,QAAM,WAAWA,SAAQ,WAAW,MAAM,OAAO;AACjD,MAAI,aAAa,aAAa,CAAC,SAAS,WAAW,YAAY,GAAG,GAAG;AACnE,QAAI,UAAU,GAAG;AACjB,QAAI,IAAI,WAAW;AACnB,WAAO;AAAA,EACT;AAOA,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,eAAW,aAAa,QAAQ;AAChC,eAAW,aAAa,SAAS;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,aAAa,YAAY,CAAC,SAAS,WAAW,WAAW,GAAG,EAAG,QAAO;AAI1E,MAAI;AACJ,MAAI;AACF,SAAKF,UAAS,UAAU,GAAG;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI;AACF,QAAI,CAACD,WAAU,EAAE,EAAE,OAAO,EAAG,QAAO;AAEpC,UAAM,MAAM,QAAQ,QAAQ;AAC5B,UAAM,cAAc,WAAW,GAAG,KAAK;AACvC,UAAM,UAAUE,cAAa,EAAE;AAE/B,QAAI,UAAU,KAAK;AAAA,MACjB,gBAAgB;AAAA,MAChB,kBAAkB,QAAQ;AAAA,IAC5B,CAAC;AACD,QAAI,IAAI,OAAO;AACf,WAAO;AAAA,EACT,UAAE;AACA,IAAAH,WAAU,EAAE;AAAA,EACd;AACF;;;ACtDO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EACpC;AAAA,EACA;AAAA,EACT,YAAY,SAA4B,OAAmB;AACzD,UAAM,WAAW,OAAO,mCAAmC,MAAM,OAAO,EAAE;AAC1E,SAAK,OAAO;AACZ,SAAK,UAAU;AACf,SAAK,SAAS,MAAM;AAAA,EACtB;AACF;AAMO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC;AAAA,EACT,YAAY,QAAgB;AAC1B,UAAM,kBAAkB,MAAM,EAAE;AAChC,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAMO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC;AAAA,EACT,YAAY,OAAmB;AAC7B,UAAM,2DAA2D,MAAM,OAAO,EAAE;AAChF,SAAK,OAAO;AACZ,SAAK,SAAS,MAAM;AAAA,EACtB;AACF;AAGA,SAAS,mBAA4B;AACnC,SAAO,IAAI,QAAQ,+BAA+B,EAAE,QAAQ,OAAO,CAAC;AACtE;AAaA,eAAsB,cAGpB,QACA,QAAwB,CAAC,GACzB,KACkB;AAClB,QAAM,YAAY,mBAAmB,QAAQ,KAAK;AAClD,MAAI,CAAC,UAAU,GAAI,OAAM,IAAI,oBAAoB,UAAU,SAAS,UAAU,KAAK;AAOnF,QAAM,WAAW,MAAM,oBAAoB,OAAO,QAAQ;AAAA,IACxD,SAAS,mBAAmB,GAAG;AAAA,IAC/B,OAAO,UAAU;AAAA,IACjB,MAAM,UAAU;AAAA,IAChB,QAAQ,UAAU;AAAA,EACpB,CAAC;AACD,MAAI,CAAC,SAAS,QAAS,OAAM,IAAI,qBAAqB,SAAS,MAAM;AAErE,QAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,IAClC,OAAO,UAAU;AAAA,IACjB,MAAM,UAAU;AAAA,IAChB,QAAQ,UAAU;AAAA,IAClB,SAAS,iBAAiB;AAAA,IAC1B;AAAA,EACF,CAAC;AAID,QAAM,iBAAiB,OAAO;AAC9B,MAAI,mBAAmB,UAAa,EAAE,kBAAkB,WAAW;AACjE,UAAM,SAAS,eAAe,UAAU,MAAM;AAC9C,QAAI,CAAC,OAAO,QAAS,OAAM,IAAI,qBAAqB,OAAO,KAAK;AAChE,WAAO,OAAO;AAAA,EAChB;AACA,SAAO;AACT;;;ACnHA,SAAS,aAAAK,YAAW,aAAAC,YAAW,YAAAC,WAAU,gBAAAC,qBAAoB;AAC7D,SAAS,WAAAC,gBAAe;AAiBxB,IAAM,iBAAiB,KAAK,OAAO;AACnC,IAAM,cAAc;AAMb,SAAS,qBAAqB,OAA2B,CAAC,GAAG;AAClE,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,WAAW,KAAK,mBAAmB;AACzC,QAAM,cAAc,KAAK,gBAAgB;AACzC,QAAM,QAAQ,KAAK,aAAa;AAChC,QAAM,MAAM,KAAK,UAAU;AAO3B,MAAI,iBAAiB,WAAW,GAAG;AACjC,UAAM,IAAI,MAAM,kEAAkE,WAAW,EAAE;AAAA,EACjG;AACA,QAAM,WAAWC,SAAQ,WAAW;AAEpC,SAAO,CAAC,YAAsC;AAC5C,QAAI,QAAQ,WAAW,MAAO,QAAO;AAErC,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAE/B,QAAI,IAAI,aAAa,UAAU;AAC7B,YAAM,UAAU,IAAI,IAAI,GAAG,EAAE;AAC7B,aAAO,IAAI,SAAS,iBAAiB,OAAO,UAAU,GAAG,GAAG;AAAA,QAC1D,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,2BAA2B,mCAAmC,OAAO,4DAA4D,OAAO,2BAA2B,OAAO,wBAAwB,OAAO;AAAA,QAC3M;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,IAAI,aAAa,UAAU;AAC7B,aAAO,cAAc,QAAQ;AAAA,IAC/B;AAEA,WAAO;AAAA,EACT;AACF;AAGA,SAAS,iBAAiB,GAAoB;AAC5C,SAAO,EAAE,MAAM,OAAO,EAAE,SAAS,IAAI;AACvC;AAQA,SAAS,iBAAiB,OAAe,SAAiB,QAAwB;AAChF,SAAO;AAAA;AAAA;AAAA;AAAA,WAIE,WAAW,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA,yCAIa,oBAAoB,OAAO,CAAC;AAAA,iBACpD,oBAAoB,MAAM,CAAC;AAAA;AAAA;AAG5C;AAIA,SAAS,cAAc,UAA4B;AAMjD,MAAI;AACJ,MAAI;AACF,SAAKC,UAAS,UAAU,GAAG;AAAA,EAC7B,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,UAAU;AACpD,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,QAAQ,EAAE,CAAC;AAAA,EAC9E;AACA,MAAI;AACF,UAAM,OAAOC,WAAU,EAAE;AACzB,QAAI,KAAK,OAAO,gBAAgB;AAC9B,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS,qBAAqB,iBAAiB,OAAO,IAAI;AAAA,QAC5D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,UAAUC,cAAa,IAAI,OAAO;AACxC,WAAO,IAAI,SAAS,SAAS;AAAA,MAC3B,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AAAA,IAC7E,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,MAAM,uBAAuB,QAAQ;AAAA,IAChD,CAAC;AAAA,EACH,UAAE;AACA,IAAAC,WAAU,EAAE;AAAA,EACd;AACF;AAEA,SAAS,aAAa,QAAgB,MAAyB;AAC7D,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;","names":["closeSync","fstatSync","openSync","readFileSync","resolve","closeSync","fstatSync","openSync","readFileSync","resolve","resolve","openSync","fstatSync","readFileSync","closeSync"]}

package/dist/{chunk-JHUFPH7B.js → chunk-B7GGQQ3F.js}

@@ -12,7 +12,7 @@ import {
   serveMatchedAuxRoute,
   serveThroughPluginLifecycle,
   setupSsrDevMiddleware
-} from "./chunk-6EV6FC7X.js";
+} from "./chunk-ZE2UHAET.js";
 import {
   resolveTheoRootDir
 } from "./chunk-FDOOBTXJ.js";
@@ -38,7 +38,7 @@ import {
   mountAgent,
   readAgentPolicy,
   writeWebResponseToServerResponse
-} from "./chunk-2NARRZPP.js";
+} from "./chunk-4DSRX3CO.js";
 import {
   getApprovalRegistry,
   resolveProvider
@@ -48,7 +48,7 @@ import {
   dispatchControllerRequest,
   incomingMessageToHandlerRequest,
   sendError
-} from "./chunk-GDZOWQV7.js";
+} from "./chunk-QD5X56I3.js";
 import {
   TRACE_HEADER,
   createObservabilityPluginFromConfig,
@@ -776,6 +776,7 @@ async function tryControllerFallthrough(ctx) {
     csrfMode: ctx.csrfMode,
     disallowed: ctx.disallowed,
     requestId: ctx.requestId,
+    pluginRunner: ctx.pluginRunner,
     // M47 — serve @Expose-bound agent routes via the ONE runtime (mountAgent). CSRF is already enforced
     // once at the controller-dispatch boundary (G5), so mountAgent runs with csrfMode 'off' (no double gate).
     //
@@ -846,12 +847,6 @@ function createApiMiddleware(vite, serverDir, rateLimitConfigOrOptions) {
       if (applyRateLimitOr429(req, res, { rateLimiter, requestId, url, start })) {
         return;
       }
-      if (pluginRunner && await runPluginsBeforeRouteMatch(pluginRunner, { req, res, requestId, start, url })) {
-        return;
-      }
-      if (await handleBatchIfMatch(req, res, { url, batching, requestId, start })) {
-        return;
-      }
       const routes = scanServerRoutes(serverDir);
       const match = matchRoute(url, routes);
       if (!match) {
@@ -864,10 +859,17 @@ function createApiMiddleware(vite, serverDir, rateLimitConfigOrOptions) {
           disallowed,
           requestId,
           url,
-          start
+          start,
+          pluginRunner
         })) {
           return;
         }
+        if (pluginRunner && await runPluginsBeforeRouteMatch(pluginRunner, { req, res, requestId, start, url })) {
+          return;
+        }
+        if (await handleBatchIfMatch(req, res, { url, batching, requestId, start })) {
+          return;
+        }
         const urlPath = url.split("?")[0];
         const routePaths = routes.map((r) => r.routePath);
         const suggestion = findSuggestion(urlPath, routePaths);
@@ -2179,19 +2181,19 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-NOXQEEVF.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-KH27ZGRT.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve5(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-BKIT7HNS.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-SYV4JN7B.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve5(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-D4OA2TXB.js");
-  const { generateManifest } = await import("./internal-api-TZTO4VMP.js");
+  const { generateManifest } = await import("./internal-api-LSB5E7BR.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -2208,7 +2210,7 @@ async function theoPluginAsync(rootOrOptions) {
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-Z5LSU7ZW.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-AS2UEMW5.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -2383,4 +2385,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-JHUFPH7B.js.map
+//# sourceMappingURL=chunk-B7GGQQ3F.js.map