theokit 0.1.0-alpha.8 → 0.2.1

package/dist/chunk-F3TG5FJV.js

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/cli/preflight-node-version.ts
+import { existsSync, readFileSync } from "fs";
+import { createRequire } from "module";
+import { join } from "path";
+var NODE_MIN_MAJOR = 22;
+var NODE_MIN_FULL = "22.12.0";
+var BINDINGS_TO_CHECK = [
+  // better-sqlite3 is the only HARD-required native dep at framework boot
+  // (cost ledger + cron persistence + memory index). Other native deps
+  // (@lancedb/lancedb) are opt-in peers — preflight skips them when absent.
+  { pkg: "better-sqlite3", required: true },
+  { pkg: "@lancedb/lancedb", required: false }
+];
+function checkNodeFloor() {
+  const major = Number.parseInt(process.versions.node.split(".")[0] ?? "0", 10);
+  if (major >= NODE_MIN_MAJOR) return { ok: true };
+  return {
+    ok: false,
+    reason: `theokit requires Node >= ${NODE_MIN_FULL} (you are running v${process.versions.node}).
+
+Quick fix:
+  nvm use 22                    # switch to a Node 22.x already installed
+  nvm install 22.12             # install + switch if you don't have it
+
+Why this matters:
+  theokit ships AsyncLocalStorage + native fetch + structured WHATWG
+  Streams optimizations that depend on Node 22 internals. Older Node
+  versions silently miscompile SSR streaming and break native
+  bindings (NODE_MODULE_VERSION mismatch).
+
+Production tip: pin your CI runner to \`actions/setup-node\` v4 with
+  \`node-version-file: .nvmrc\` \u2014 that's what \`create-theokit\` writes.`
+  };
+}
+function checkBindingAbi(cwd) {
+  const offenders = [];
+  const cwdRequire = createRequire(join(cwd, "package.json"));
+  for (const probe of BINDINGS_TO_CHECK) {
+    try {
+      cwdRequire.resolve(probe.pkg);
+    } catch {
+      if (probe.required) {
+        offenders.push(`${probe.pkg} (required dep is NOT installed \u2014 run \`pnpm install\`)`);
+      }
+      continue;
+    }
+    try {
+      cwdRequire(probe.pkg);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/NODE_MODULE_VERSION|was compiled against|did not self-register/.test(msg)) {
+        offenders.push(`${probe.pkg} (compiled against different Node ABI)`);
+      } else if (probe.required) {
+        offenders.push(`${probe.pkg} (require failed: ${msg.split("\n")[0]})`);
+      }
+    }
+  }
+  if (offenders.length === 0) return { ok: true };
+  return {
+    ok: false,
+    reason: `Native binding ABI mismatch detected (Node v${process.versions.node}, ABI ${process.versions.modules}).
+
+Offending packages:
+` + offenders.map((o) => `  - ${o}`).join("\n") + '\n\nQuick fix:\n  pnpm rebuild                  # rebuild ALL native bindings for current Node\n  pnpm rebuild better-sqlite3   # rebuild just one\n\nWhy this happened:\n  Your `theokit dev` (or build/start) launched under a different\n  Node version than the one used to install/build node_modules.\n  Common cause: `nohup env ...` strips the nvm PATH prefix, so the\n  dev server picked the system `node` instead of `nvm use 22`.\n\nPermanent fix:\n  Prefix your dev/start command with the absolute Node 22 path:\n    PATH="$(nvm which 22 | xargs dirname):$PATH" theokit dev\n  Or use direnv with `.envrc` containing `use node 22.12.0`.'
+  };
+}
+function readNvmrcFloor(cwd) {
+  const path = join(cwd, ".nvmrc");
+  if (!existsSync(path)) return void 0;
+  try {
+    return readFileSync(path, "utf8").trim();
+  } catch {
+    return void 0;
+  }
+}
+function preflightNodeAndBindings(cwd) {
+  const nodeCheck = checkNodeFloor();
+  if (!nodeCheck.ok) {
+    const pinned = readNvmrcFloor(cwd);
+    const suffix = pinned !== void 0 ? `
+
+Your project pins Node ${pinned} in .nvmrc.` : "";
+    throw new Error(`[theokit preflight] ${nodeCheck.reason}${suffix}`);
+  }
+  const abiCheck = checkBindingAbi(cwd);
+  if (!abiCheck.ok) {
+    throw new Error(`[theokit preflight] ${abiCheck.reason}`);
+  }
+}
+
+export {
+  preflightNodeAndBindings
+};
+//# sourceMappingURL=chunk-F3TG5FJV.js.map

package/dist/chunk-F3TG5FJV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/preflight-node-version.ts"],"sourcesContent":["/**\n * Node version + native-binding ABI preflight for `theokit dev` / `theokit build` / `theokit start`.\n *\n * Why this exists:\n *   In multi-Node-version setups (developer workflow: Node 22 for one\n *   project, Node 20 for another, nvm switching frequently), the\n *   `nohup env ...` invocation pattern strips the nvm PATH prefix and\n *   the dev server launches under whichever `node` binary is FIRST in\n *   PATH at spawn time — NOT the version the calling shell reported.\n *\n *   When `theokit dev` boots under the wrong Node, every native binding\n *   in `node_modules` (`better-sqlite3`, optionally `@lancedb/lancedb`,\n *   etc.) fails with NODE_MODULE_VERSION mismatch on first use. The\n *   error message references a low-level binary path; the dev wastes\n *   time investigating a process-management issue.\n *\n *   This preflight runs UPFRONT (before any module that touches native\n *   bindings loads) and emits an actionable error referencing nvm + the\n *   pinned `.nvmrc` floor.\n *\n * What it does:\n *   1. Reads `process.versions.node` + `process.versions.modules` (ABI).\n *   2. If Node major < 22, refuse to boot with a nvm install/use hint.\n *   3. If at least one native binding's compiled ABI != current ABI,\n *      refuse to boot with a `pnpm rebuild <pkg>` hint.\n *\n * What it does NOT do:\n *   * Auto-rebuild — that's the SDK's preflight (vitest setup, sentinel\n *     cached). Auto-rebuild in a dev CLI is risky (slow, can run during\n *     `pnpm dev` watch loops).\n *   * Probe every native dep — only checks the ones the framework KNOWS\n *     are required (currently `better-sqlite3` because of the cost\n *     ledger + cron persistence + memory index DB).\n *\n * @internal\n */\n\nimport { existsSync, readFileSync } from 'node:fs'\nimport { createRequire } from 'node:module'\nimport { join } from 'node:path'\n\nconst NODE_MIN_MAJOR = 22\nconst NODE_MIN_FULL = '22.12.0'\n\ninterface BindingProbe {\n  pkg: string\n  /** path under <cwd>/node_modules — used only for the diagnostic message */\n  hintPath?: string\n  required: boolean\n}\n\nconst BINDINGS_TO_CHECK: readonly BindingProbe[] = [\n  // better-sqlite3 is the only HARD-required native dep at framework boot\n  // (cost ledger + cron persistence + memory index). Other native deps\n  // (@lancedb/lancedb) are opt-in peers — preflight skips them when absent.\n  { pkg: 'better-sqlite3', required: true },\n  { pkg: '@lancedb/lancedb', required: false },\n]\n\nfunction checkNodeFloor(): { ok: true } | { ok: false; reason: string } {\n  const major = Number.parseInt(process.versions.node.split('.')[0] ?? '0', 10)\n  if (major >= NODE_MIN_MAJOR) return { ok: true }\n  return {\n    ok: false,\n    reason:\n      `theokit requires Node >= ${NODE_MIN_FULL} (you are running v${process.versions.node}).\\n\\n` +\n      'Quick fix:\\n' +\n      '  nvm use 22                    # switch to a Node 22.x already installed\\n' +\n      \"  nvm install 22.12             # install + switch if you don't have it\\n\\n\" +\n      'Why this matters:\\n' +\n      '  theokit ships AsyncLocalStorage + native fetch + structured WHATWG\\n' +\n      '  Streams optimizations that depend on Node 22 internals. Older Node\\n' +\n      '  versions silently miscompile SSR streaming and break native\\n' +\n      '  bindings (NODE_MODULE_VERSION mismatch).\\n\\n' +\n      'Production tip: pin your CI runner to `actions/setup-node` v4 with\\n' +\n      \"  `node-version-file: .nvmrc` — that's what `create-theokit` writes.\",\n  }\n}\n\nfunction checkBindingAbi(cwd: string): { ok: true } | { ok: false; reason: string } {\n  const offenders: string[] = []\n  // Build createRequire from the cwd so we resolve the consumer's deps,\n  // NOT theokit's own node_modules.\n  const cwdRequire = createRequire(join(cwd, 'package.json'))\n  for (const probe of BINDINGS_TO_CHECK) {\n    try {\n      cwdRequire.resolve(probe.pkg)\n    } catch {\n      // not installed — required vs optional gates the behaviour\n      if (probe.required) {\n        offenders.push(`${probe.pkg} (required dep is NOT installed — run \\`pnpm install\\`)`)\n      }\n      continue\n    }\n    // Try a dry require — better-sqlite3 dlopens at load-time, so the ABI\n    // mismatch surfaces here as a sync throw.\n    try {\n      cwdRequire(probe.pkg)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      if (/NODE_MODULE_VERSION|was compiled against|did not self-register/.test(msg)) {\n        offenders.push(`${probe.pkg} (compiled against different Node ABI)`)\n      } else if (probe.required) {\n        // surface non-ABI errors verbatim for required deps\n        offenders.push(`${probe.pkg} (require failed: ${msg.split('\\n')[0]})`)\n      }\n    }\n  }\n  if (offenders.length === 0) return { ok: true }\n  return {\n    ok: false,\n    reason:\n      `Native binding ABI mismatch detected (Node v${process.versions.node}, ABI ${process.versions.modules}).\\n\\n` +\n      'Offending packages:\\n' +\n      offenders.map((o) => `  - ${o}`).join('\\n') +\n      '\\n\\nQuick fix:\\n' +\n      '  pnpm rebuild                  # rebuild ALL native bindings for current Node\\n' +\n      '  pnpm rebuild better-sqlite3   # rebuild just one\\n\\n' +\n      'Why this happened:\\n' +\n      '  Your `theokit dev` (or build/start) launched under a different\\n' +\n      '  Node version than the one used to install/build node_modules.\\n' +\n      '  Common cause: `nohup env ...` strips the nvm PATH prefix, so the\\n' +\n      '  dev server picked the system `node` instead of `nvm use 22`.\\n\\n' +\n      'Permanent fix:\\n' +\n      '  Prefix your dev/start command with the absolute Node 22 path:\\n' +\n      '    PATH=\"$(nvm which 22 | xargs dirname):$PATH\" theokit dev\\n' +\n      '  Or use direnv with `.envrc` containing `use node 22.12.0`.',\n  }\n}\n\n/**\n * Read `.nvmrc` from cwd if present — used only to enrich error messages\n * with the project's pinned floor. Falls back to the framework default.\n *\n * @internal\n */\nfunction readNvmrcFloor(cwd: string): string | undefined {\n  const path = join(cwd, '.nvmrc')\n  // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI reads consumer's own .nvmrc; consumer owns cwd\n  if (!existsSync(path)) return undefined\n  try {\n    // eslint-disable-next-line security/detect-non-literal-fs-filename -- same\n    return readFileSync(path, 'utf8').trim()\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Run the Node + ABI preflight. Throws a descriptive Error on mismatch\n * BEFORE any module that imports better-sqlite3 loads. The error message\n * is the only user-facing artefact — caller can rely on `error.message`\n * being a full actionable diagnostic.\n *\n * @throws Error with multi-line actionable message when Node version or\n *   native binding ABI is wrong.\n * @internal\n */\nexport function preflightNodeAndBindings(cwd: string): void {\n  const nodeCheck = checkNodeFloor()\n  if (!nodeCheck.ok) {\n    const pinned = readNvmrcFloor(cwd)\n    const suffix = pinned !== undefined ? `\\n\\nYour project pins Node ${pinned} in .nvmrc.` : ''\n    throw new Error(`[theokit preflight] ${nodeCheck.reason}${suffix}`)\n  }\n  const abiCheck = checkBindingAbi(cwd)\n  if (!abiCheck.ok) {\n    throw new Error(`[theokit preflight] ${abiCheck.reason}`)\n  }\n}\n"],"mappings":";;;;AAqCA,SAAS,YAAY,oBAAoB;AACzC,SAAS,qBAAqB;AAC9B,SAAS,YAAY;AAErB,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AAStB,IAAM,oBAA6C;AAAA;AAAA;AAAA;AAAA,EAIjD,EAAE,KAAK,kBAAkB,UAAU,KAAK;AAAA,EACxC,EAAE,KAAK,oBAAoB,UAAU,MAAM;AAC7C;AAEA,SAAS,iBAA+D;AACtE,QAAM,QAAQ,OAAO,SAAS,QAAQ,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE;AAC5E,MAAI,SAAS,eAAgB,QAAO,EAAE,IAAI,KAAK;AAC/C,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,QACE,4BAA4B,aAAa,sBAAsB,QAAQ,SAAS,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWxF;AACF;AAEA,SAAS,gBAAgB,KAA2D;AAClF,QAAM,YAAsB,CAAC;AAG7B,QAAM,aAAa,cAAc,KAAK,KAAK,cAAc,CAAC;AAC1D,aAAW,SAAS,mBAAmB;AACrC,QAAI;AACF,iBAAW,QAAQ,MAAM,GAAG;AAAA,IAC9B,QAAQ;AAEN,UAAI,MAAM,UAAU;AAClB,kBAAU,KAAK,GAAG,MAAM,GAAG,8DAAyD;AAAA,MACtF;AACA;AAAA,IACF;AAGA,QAAI;AACF,iBAAW,MAAM,GAAG;AAAA,IACtB,SAAS,KAAK;AACZ,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,UAAI,iEAAiE,KAAK,GAAG,GAAG;AAC9E,kBAAU,KAAK,GAAG,MAAM,GAAG,wCAAwC;AAAA,MACrE,WAAW,MAAM,UAAU;AAEzB,kBAAU,KAAK,GAAG,MAAM,GAAG,qBAAqB,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,WAAW,EAAG,QAAO,EAAE,IAAI,KAAK;AAC9C,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,QACE,+CAA+C,QAAQ,SAAS,IAAI,SAAS,QAAQ,SAAS,OAAO;AAAA;AAAA;AAAA,IAErG,UAAU,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,IAC1C;AAAA,EAYJ;AACF;AAQA,SAAS,eAAe,KAAiC;AACvD,QAAM,OAAO,KAAK,KAAK,QAAQ;AAE/B,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AAEF,WAAO,aAAa,MAAM,MAAM,EAAE,KAAK;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYO,SAAS,yBAAyB,KAAmB;AAC1D,QAAM,YAAY,eAAe;AACjC,MAAI,CAAC,UAAU,IAAI;AACjB,UAAM,SAAS,eAAe,GAAG;AACjC,UAAM,SAAS,WAAW,SAAY;AAAA;AAAA,yBAA8B,MAAM,gBAAgB;AAC1F,UAAM,IAAI,MAAM,uBAAuB,UAAU,MAAM,GAAG,MAAM,EAAE;AAAA,EACpE;AACA,QAAM,WAAW,gBAAgB,GAAG;AACpC,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,uBAAuB,SAAS,MAAM,EAAE;AAAA,EAC1D;AACF;","names":[]}

package/dist/chunk-KJVEJILQ.js

@@ -0,0 +1,109 @@
+// src/devtools/shared.ts
+var RING_BUFFER_CAP = 50;
+var MAX_QUEUE_SIZE = 100;
+var STORAGE_VERSION = 2;
+var initialState = {
+  open: false,
+  visible: true,
+  position: "bottom-right",
+  theme: "dark",
+  activeTab: "requests",
+  requests: [],
+  errors: [],
+  agentRuns: [],
+  actionCalls: [],
+  routeManifest: null,
+  activeRoutePath: null,
+  activeChain: []
+};
+var CHANNEL_REQUEST = "theo:devtools:request";
+var CHANNEL_ERROR = "theo:devtools:error";
+var CHANNEL_CSRF_WARN = "theo:devtools:csrf.warn";
+var CHANNEL_MANIFEST = "theo:devtools:manifest";
+var CHANNEL_ROUTE_MATCHED = "theo:devtools:route-matched";
+
+// src/devtools/dispatcher.ts
+var _dispatch = null;
+var _queue = [];
+function queuable(fn) {
+  return (...args) => {
+    if (_dispatch) {
+      try {
+        fn(_dispatch, ...args);
+      } catch (err) {
+        console.error("[theo devtools] dispatch failed", err);
+      }
+    } else {
+      if (_queue.length >= MAX_QUEUE_SIZE) _queue.shift();
+      _queue.push((d) => {
+        fn(d, ...args);
+      });
+    }
+  };
+}
+function flushQueue() {
+  while (_queue.length) {
+    const fn = _queue.shift();
+    if (!fn || !_dispatch) break;
+    try {
+      fn(_dispatch);
+    } catch (err) {
+      console.error("[theo devtools] queued event failed", err);
+    }
+  }
+}
+var dispatcher = {
+  onRequest: queuable((d, req) => {
+    d({ type: "REQUEST_ADD", request: req });
+  }),
+  onError: queuable((d, err) => {
+    d({ type: "ERROR_ADD", error: err });
+  }),
+  onCsrfWarn: queuable((d, payload) => {
+    d({ type: "CSRF_WARN", payload });
+  }),
+  onManifestUpdated: queuable((d, manifest) => {
+    d({ type: "MANIFEST_UPDATED", manifest });
+  }),
+  onRouteMatched: queuable((d, path, chain) => {
+    d({ type: "ROUTE_MATCHED", path, chain });
+  }),
+  onAgentRun: queuable((d, run) => {
+    d({ type: "AGENT_RUN_ADD", run });
+  }),
+  onActionCall: queuable((d, record) => {
+    d({ type: "ACTION_CALL_ADD", record });
+  }),
+  /**
+   * Wire React's dispatch function in. Idempotent (EC-24): only the
+   * NULL → non-null transition flushes the queue; subsequent non-null
+   * sets just replace the reference (used for StrictMode re-mount).
+   */
+  setDispatch(d) {
+    const prev = _dispatch;
+    _dispatch = d;
+    if (d && !prev) flushQueue();
+  },
+  /** Testing helper — clear queue + dispatch reference between tests. */
+  _reset() {
+    _dispatch = null;
+    _queue.length = 0;
+  },
+  /** Testing helper — observe queue length. */
+  _queueLength() {
+    return _queue.length;
+  }
+};
+
+export {
+  RING_BUFFER_CAP,
+  STORAGE_VERSION,
+  initialState,
+  CHANNEL_REQUEST,
+  CHANNEL_ERROR,
+  CHANNEL_CSRF_WARN,
+  CHANNEL_MANIFEST,
+  CHANNEL_ROUTE_MATCHED,
+  dispatcher
+};
+//# sourceMappingURL=chunk-KJVEJILQ.js.map

package/dist/chunk-KJVEJILQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/devtools/shared.ts","../src/devtools/dispatcher.ts"],"sourcesContent":["/**\n * Devtools — shared types.\n *\n * NEVER use dangerouslySetInnerHTML in any devtools component — see plan EC-20.\n */\n\nexport type DevtoolsPosition = 'top-left' | 'top-right' | 'bottom-left' | 'bottom-right'\nexport type DevtoolsTab =\n  | 'requests'\n  | 'routes'\n  | 'agents'\n  | 'actions'\n  | 'errors'\n  | 'csrf-readiness'\n  | 'settings'\nexport type DevtoolsTheme = 'light' | 'dark' | 'system'\n\nexport interface RequestRecord {\n  id: string\n  traceId: string\n  method: string\n  path: string\n  status: number\n  durationMs: number\n  startedAt: number\n  csrfWarn?: { code: string; docsUrl: string }\n  headers?: Record<string, string>\n  bodyPreview?: string\n  bodyLength?: number\n  bodyTruncated?: boolean\n}\n\nexport interface ErrorRecord {\n  id: string\n  type: 'console' | 'unhandled' | 'csrf.warn'\n  message: string\n  stack?: string\n  code?: string\n  docsUrl?: string\n  timestamp: number\n}\n\nexport interface CsrfWarnPayload {\n  event: 'csrf.warn'\n  code: string\n  docsUrl: string\n  method: string\n  path: string\n  reason: string\n}\n\nexport interface RouteInfo {\n  path: string\n  absoluteFilePath: string\n  layoutChain: string[]\n  hasLoading: boolean\n  hasError: boolean\n  hasNotFound: boolean\n}\n\nexport interface RouteManifest {\n  routes: RouteInfo[]\n}\n\n/**\n * Per-agent-run telemetry surfaced to the Agents devtools tab.\n *\n * Emitted by `trackAgentRun` (server-side) via the dispatcher in dev mode;\n * prod tree-shakes the entire wire (v1.1 EC-4 `__IS_DEV` IIFE guard).\n * Type lives here (devtools/shared) since both producer (server/cost) and\n * consumer (AgentsTab) need the shape; following architecture v3 ADR-0001\n * rule \"shared types in core/contracts\" is the canonical home — for this\n * one we keep it in devtools/shared to minimize churn in core/contracts/.\n */\nexport interface AgentRunRecord {\n  id: string\n  timestamp: number\n  userId: string\n  model: string\n  tokensInput: number\n  tokensOutput: number\n  costUsd: number\n  status: 'finished' | 'error' | 'aborted'\n}\n\n/**\n * T5.1 — Per-action-call telemetry surfaced to the Actions devtools tab.\n *\n * Emitted by `action-execute.ts` (server-side) via the dispatcher in dev\n * mode; prod tree-shakes the wire (mirrors AgentRunRecord pattern).\n * Field-level error pins consume `error.fields` directly when status='error'\n * (per plan ADR D6).\n */\nexport interface ActionCallRecord {\n  id: string\n  timestamp: number\n  name: string\n  input: unknown\n  output?: unknown\n  error?: {\n    code: string\n    message: string\n    fields?: Record<string, string[]>\n    issues?: unknown[]\n  }\n  durationMs: number\n  status: 'success' | 'error'\n}\n\nexport interface DevtoolsState {\n  open: boolean\n  visible: boolean\n  position: DevtoolsPosition\n  theme: DevtoolsTheme\n  activeTab: DevtoolsTab\n  requests: RequestRecord[]\n  errors: ErrorRecord[]\n  agentRuns: AgentRunRecord[]\n  actionCalls: ActionCallRecord[]\n  routeManifest: RouteManifest | null\n  activeRoutePath: string | null\n  activeChain: string[]\n}\n\nexport type DevtoolsAction =\n  | { type: 'TOGGLE_PANEL' }\n  | { type: 'TOGGLE_VISIBLE' }\n  | { type: 'SET_TAB'; tab: DevtoolsTab }\n  | { type: 'SET_POSITION'; position: DevtoolsPosition }\n  | { type: 'SET_THEME'; theme: DevtoolsTheme }\n  | { type: 'REQUEST_ADD'; request: RequestRecord }\n  | { type: 'ERROR_ADD'; error: ErrorRecord }\n  | { type: 'CSRF_WARN'; payload: CsrfWarnPayload }\n  | { type: 'MANIFEST_UPDATED'; manifest: RouteManifest }\n  | { type: 'ROUTE_MATCHED'; path: string; chain: string[] }\n  | { type: 'AGENT_RUN_ADD'; run: AgentRunRecord }\n  | { type: 'ACTION_CALL_ADD'; record: ActionCallRecord }\n  | { type: 'RESET_REQUESTS' }\n  | { type: 'RESET_ERRORS' }\n  | { type: 'RESET_AGENT_RUNS' }\n  | { type: 'RESET_ACTION_CALLS' }\n\nexport const RING_BUFFER_CAP = 50\nexport const MAX_QUEUE_SIZE = 100\nexport const STORAGE_VERSION = 2\n\nexport const initialState: DevtoolsState = {\n  open: false,\n  visible: true,\n  position: 'bottom-right',\n  theme: 'dark',\n  activeTab: 'requests',\n  requests: [],\n  errors: [],\n  agentRuns: [],\n  actionCalls: [],\n  routeManifest: null,\n  activeRoutePath: null,\n  activeChain: [],\n}\n\nexport const CHANNEL_REQUEST = 'theo:devtools:request' as const\nexport const CHANNEL_ERROR = 'theo:devtools:error' as const\nexport const CHANNEL_CSRF_WARN = 'theo:devtools:csrf.warn' as const\nexport const CHANNEL_MANIFEST = 'theo:devtools:manifest' as const\nexport const CHANNEL_ROUTE_MATCHED = 'theo:devtools:route-matched' as const\nexport const CHANNEL_AGENT_RUN = 'theo:devtools:agent.run' as const\nexport const CHANNEL_ACTION_CALL = 'theo:devtools:action.call' as const\n","/**\n * T2.1 — Devtools dispatcher with pre-mount event queue.\n *\n * Pattern: events emitted from anywhere (server WS, browser console.error,\n * dispatcher.onCsrfWarn) can fire BEFORE the React tree mounts. Each call\n * either dispatches immediately (when `setDispatch` registered a dispatch\n * fn) or queues until React is ready, then flushes on first mount.\n *\n * EC-23: queue capped at MAX_QUEUE_SIZE (FIFO eviction).\n * EC-24: setDispatch is idempotent — flush only on NULL → non-null\n *   transition (StrictMode re-mount safe).\n *\n * NEVER use dangerouslySetInnerHTML in any devtools component — see plan EC-20.\n */\nimport {\n  type ActionCallRecord,\n  type AgentRunRecord,\n  type CsrfWarnPayload,\n  type DevtoolsAction,\n  type ErrorRecord,\n  MAX_QUEUE_SIZE,\n  type RequestRecord,\n  type RouteManifest,\n} from './shared.js'\n\ntype Dispatch = (action: DevtoolsAction) => void\ntype QueuedItem = (d: Dispatch) => void\n\nlet _dispatch: Dispatch | null = null\nconst _queue: QueuedItem[] = []\n\nfunction queuable<Args extends unknown[]>(\n  fn: (d: Dispatch, ...args: Args) => void,\n): (...args: Args) => void {\n  return (...args: Args) => {\n    if (_dispatch) {\n      try {\n        fn(_dispatch, ...args)\n      } catch (err) {\n        // EC-25: an error inside reducer-bound dispatch path MUST NOT bubble\n        // to the original event source (e.g. logger / HMR callback / global\n        // error handler). Log and continue.\n\n        console.error('[theo devtools] dispatch failed', err)\n      }\n    } else {\n      // EC-23: cap queue, FIFO-evict if full\n      if (_queue.length >= MAX_QUEUE_SIZE) _queue.shift()\n      _queue.push((d) => {\n        fn(d, ...args)\n      })\n    }\n  }\n}\n\nfunction flushQueue(): void {\n  while (_queue.length) {\n    const fn = _queue.shift()\n    if (!fn || !_dispatch) break\n    try {\n      fn(_dispatch)\n    } catch (err) {\n      console.error('[theo devtools] queued event failed', err)\n    }\n  }\n}\n\nexport const dispatcher = {\n  onRequest: queuable((d: Dispatch, req: RequestRecord) => {\n    d({ type: 'REQUEST_ADD', request: req })\n  }),\n  onError: queuable((d: Dispatch, err: ErrorRecord) => {\n    d({ type: 'ERROR_ADD', error: err })\n  }),\n  onCsrfWarn: queuable((d: Dispatch, payload: CsrfWarnPayload) => {\n    d({ type: 'CSRF_WARN', payload })\n  }),\n  onManifestUpdated: queuable((d: Dispatch, manifest: RouteManifest) => {\n    d({ type: 'MANIFEST_UPDATED', manifest })\n  }),\n  onRouteMatched: queuable((d: Dispatch, path: string, chain: string[]) => {\n    d({ type: 'ROUTE_MATCHED', path, chain })\n  }),\n  onAgentRun: queuable((d: Dispatch, run: AgentRunRecord) => {\n    d({ type: 'AGENT_RUN_ADD', run })\n  }),\n  onActionCall: queuable((d: Dispatch, record: ActionCallRecord) => {\n    d({ type: 'ACTION_CALL_ADD', record })\n  }),\n\n  /**\n   * Wire React's dispatch function in. Idempotent (EC-24): only the\n   * NULL → non-null transition flushes the queue; subsequent non-null\n   * sets just replace the reference (used for StrictMode re-mount).\n   */\n  setDispatch(d: Dispatch | null): void {\n    const prev = _dispatch\n    _dispatch = d\n    if (d && !prev) flushQueue()\n  },\n\n  /** Testing helper — clear queue + dispatch reference between tests. */\n  _reset(): void {\n    _dispatch = null\n    _queue.length = 0\n  },\n\n  /** Testing helper — observe queue length. */\n  _queueLength(): number {\n    return _queue.length\n  },\n}\n\nexport type Dispatcher = typeof dispatcher\n"],"mappings":";AA8IO,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AAExB,IAAM,eAA8B;AAAA,EACzC,MAAM;AAAA,EACN,SAAS;AAAA,EACT,UAAU;AAAA,EACV,OAAO;AAAA,EACP,WAAW;AAAA,EACX,UAAU,CAAC;AAAA,EACX,QAAQ,CAAC;AAAA,EACT,WAAW,CAAC;AAAA,EACZ,aAAa,CAAC;AAAA,EACd,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,aAAa,CAAC;AAChB;AAEO,IAAM,kBAAkB;AACxB,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB;AACzB,IAAM,wBAAwB;;;ACzIrC,IAAI,YAA6B;AACjC,IAAM,SAAuB,CAAC;AAE9B,SAAS,SACP,IACyB;AACzB,SAAO,IAAI,SAAe;AACxB,QAAI,WAAW;AACb,UAAI;AACF,WAAG,WAAW,GAAG,IAAI;AAAA,MACvB,SAAS,KAAK;AAKZ,gBAAQ,MAAM,mCAAmC,GAAG;AAAA,MACtD;AAAA,IACF,OAAO;AAEL,UAAI,OAAO,UAAU,eAAgB,QAAO,MAAM;AAClD,aAAO,KAAK,CAAC,MAAM;AACjB,WAAG,GAAG,GAAG,IAAI;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,aAAmB;AAC1B,SAAO,OAAO,QAAQ;AACpB,UAAM,KAAK,OAAO,MAAM;AACxB,QAAI,CAAC,MAAM,CAAC,UAAW;AACvB,QAAI;AACF,SAAG,SAAS;AAAA,IACd,SAAS,KAAK;AACZ,cAAQ,MAAM,uCAAuC,GAAG;AAAA,IAC1D;AAAA,EACF;AACF;AAEO,IAAM,aAAa;AAAA,EACxB,WAAW,SAAS,CAAC,GAAa,QAAuB;AACvD,MAAE,EAAE,MAAM,eAAe,SAAS,IAAI,CAAC;AAAA,EACzC,CAAC;AAAA,EACD,SAAS,SAAS,CAAC,GAAa,QAAqB;AACnD,MAAE,EAAE,MAAM,aAAa,OAAO,IAAI,CAAC;AAAA,EACrC,CAAC;AAAA,EACD,YAAY,SAAS,CAAC,GAAa,YAA6B;AAC9D,MAAE,EAAE,MAAM,aAAa,QAAQ,CAAC;AAAA,EAClC,CAAC;AAAA,EACD,mBAAmB,SAAS,CAAC,GAAa,aAA4B;AACpE,MAAE,EAAE,MAAM,oBAAoB,SAAS,CAAC;AAAA,EAC1C,CAAC;AAAA,EACD,gBAAgB,SAAS,CAAC,GAAa,MAAc,UAAoB;AACvE,MAAE,EAAE,MAAM,iBAAiB,MAAM,MAAM,CAAC;AAAA,EAC1C,CAAC;AAAA,EACD,YAAY,SAAS,CAAC,GAAa,QAAwB;AACzD,MAAE,EAAE,MAAM,iBAAiB,IAAI,CAAC;AAAA,EAClC,CAAC;AAAA,EACD,cAAc,SAAS,CAAC,GAAa,WAA6B;AAChE,MAAE,EAAE,MAAM,mBAAmB,OAAO,CAAC;AAAA,EACvC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOD,YAAY,GAA0B;AACpC,UAAM,OAAO;AACb,gBAAY;AACZ,QAAI,KAAK,CAAC,KAAM,YAAW;AAAA,EAC7B;AAAA;AAAA,EAGA,SAAe;AACb,gBAAY;AACZ,WAAO,SAAS;AAAA,EAClB;AAAA;AAAA,EAGA,eAAuB;AACrB,WAAO,OAAO;AAAA,EAChB;AACF;","names":[]}

package/dist/{chunk-MCP6Y5BA.js → chunk-M23FP2AS.js}

@@ -1,5 +1,29 @@
 // src/server/cost/track-agent-run.ts
+var __IS_DEV = (() => {
+  try {
+    return import.meta.env?.DEV === true;
+  } catch {
+    return process.env.NODE_ENV !== "production";
+  }
+})();
 async function trackAgentRun(input, opts) {
+  if (__IS_DEV) {
+    try {
+      const mod = await import("./dispatcher-AQJGI3HU.js");
+      mod.dispatcher.onAgentRun({
+        // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id
+        id: `run-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`,
+        timestamp: (input.timestamp ?? /* @__PURE__ */ new Date()).getTime(),
+        userId: input.userId,
+        model: input.model,
+        tokensInput: input.tokens.input,
+        tokensOutput: input.tokens.output,
+        costUsd: input.costUsd,
+        status: input.status ?? "finished"
+      });
+    } catch {
+    }
+  }
   if (!opts.storage) return;
   const record = {
     userId: input.userId,
@@ -158,4 +182,4 @@ export {
   InMemoryUsageStorage,
   trackAgentTools
 };
-//# sourceMappingURL=chunk-MCP6Y5BA.js.map
+//# sourceMappingURL=chunk-M23FP2AS.js.map

package/dist/chunk-M23FP2AS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/cost/track-agent-run.ts","../src/server/cost/usage-storage-memory.ts","../src/server/cost/track-agent-tools.ts"],"sourcesContent":["import type { AgentRunRecord } from '../../devtools/shared.js'\n\nimport type { UsageRecord, UsageStorageAdapter } from './cost-types.js'\n\nexport interface TrackAgentRunInput {\n  userId: string\n  model: string\n  tokens: { input: number; output: number }\n  costUsd: number\n  /** Defaults to `new Date()`. */\n  timestamp?: Date\n  /** Optional execution status surfaced to devtools (default 'finished'). */\n  status?: 'finished' | 'error' | 'aborted'\n}\n\nexport interface TrackAgentRunOptions {\n  /** Adapter resolved from `theo.config.ts > cost.storage`. */\n  storage: UsageStorageAdapter | undefined\n}\n\n// v1.1 EC-4 MUST FIX — universal dev gate (Vite OR tsup-bundled).\n// Both checks are statically replaceable by bundlers in prod build,\n// so the entire dispatcher import is tree-shaken from the prod bundle.\nconst __IS_DEV = (() => {\n  try {\n    return (import.meta as { env?: { DEV?: boolean } }).env?.DEV === true\n  } catch {\n    return process.env.NODE_ENV !== 'production'\n  }\n})()\n\n/**\n * Record a single agent run's usage + cost. Companion to the client-side\n * `<CostMeter>` from `@usetheo/ui`.\n *\n * EC-14: this function NEVER bubbles errors back to the caller. Adapter\n * failures (network outage, DB down, etc.) are logged via `console.warn`\n * and swallowed. The agent response MUST NOT fail because cost tracking\n * is degraded.\n *\n * No-op when `storage` is undefined (cost tracking unconfigured).\n *\n * In dev mode (Vite OR tsup-built with NODE_ENV != 'production'), fires a\n * `theokit-evolution-ci-and-dx` Phase 3 dispatcher event so the devtools\n * Agents tab can render the run. Prod tree-shakes the entire dispatcher\n * import via the `__IS_DEV` IIFE guard.\n *\n * @see docs/concepts/cost-tracking.md (when implemented in T6.3)\n */\nexport async function trackAgentRun(\n  input: TrackAgentRunInput,\n  opts: TrackAgentRunOptions,\n): Promise<void> {\n  // Dev-only: surface run to devtools Agents tab (T3.1)\n  if (__IS_DEV) {\n    try {\n      const mod = (await import('../../devtools/dispatcher.js')) as {\n        dispatcher: { onAgentRun: (r: AgentRunRecord) => void }\n      }\n      mod.dispatcher.onAgentRun({\n        // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id\n        id: `run-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`,\n        timestamp: (input.timestamp ?? new Date()).getTime(),\n        userId: input.userId,\n        model: input.model,\n        tokensInput: input.tokens.input,\n        tokensOutput: input.tokens.output,\n        costUsd: input.costUsd,\n        status: input.status ?? 'finished',\n      })\n    } catch {\n      // devtools dispatcher missing in some prod-like bundle — silently skip\n    }\n  }\n\n  if (!opts.storage) return\n  const record: UsageRecord = {\n    userId: input.userId,\n    model: input.model,\n    tokens: input.tokens,\n    costUsd: input.costUsd,\n    timestamp: input.timestamp ?? new Date(),\n  }\n  try {\n    await opts.storage.record(record)\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err)\n\n    console.warn(\n      `[theokit:cost] usage storage record failed: ${message}. ` +\n        '(Response is unaffected — cost tracking degraded.)',\n    )\n  }\n}\n","import type { StorageAdapter } from '../storage/storage-types.js'\n\nimport type {\n  ToolUsageRecord,\n  UsageQuery,\n  UsageRecord,\n  UsageResult,\n  UsageStorageAdapter,\n} from './cost-types.js'\n\n/**\n * In-memory usage storage for dev/tests. Unbounded — production\n * deployments MUST plug in a durable adapter (Postgres/Redis recipes\n * land with R0.6.7; documented in EC-114).\n *\n * Phase 5 — Production-Readiness #4: accepts both `UsageRecord` (LLM call,\n * kind='llm' or omitted) AND `ToolUsageRecord` (tool call, kind='tool').\n * `getUsage` only sums LLM records (tools have no token/cost dimension).\n *\n * EC-9 (backward compat): input without `kind` is normalized to `kind:'llm'`\n * — adapters from older versions stay working.\n *\n * Concurrency: Node's single-threaded event loop guarantees that\n * `Array.push` is atomic, so concurrent record() calls cannot lose data.\n */\nexport class InMemoryUsageStorage implements UsageStorageAdapter, StorageAdapter {\n  readonly name = 'memory'\n  readonly #records: (UsageRecord | ToolUsageRecord)[] = []\n\n  /**\n   * T2.3 — `StorageAdapter` lifecycle hook (ADR-0007 D6). In-memory storage\n   * has no real cleanup to perform — this is intentionally a noop so the\n   * adapter can be registered with `StorageManager.register()` and\n   * participate in graceful shutdown without changing behavior.\n   *\n   * Does NOT clear stored records (dispose ≠ reset). For test reset use\n   * a fresh instance.\n   */\n  dispose(): Promise<void> {\n    // Intentional noop — see jsdoc above\n    return Promise.resolve()\n  }\n\n  async record(input: UsageRecord | ToolUsageRecord): Promise<void> {\n    // EC-9: normalize legacy input (no `kind` field) to kind:'llm'.\n    const normalized: UsageRecord | ToolUsageRecord =\n      'kind' in input && input.kind === 'tool'\n        ? { ...input }\n        : ({ ...input, kind: 'llm' as const } satisfies UsageRecord)\n    this.#records.push(normalized)\n    return Promise.resolve()\n  }\n\n  async getUsage(query: UsageQuery): Promise<UsageResult> {\n    const from = query.period.from.getTime()\n    const to = query.period.to.getTime()\n    let totalTokens = 0\n    let totalCostUsd = 0\n    let runs = 0\n    for (const r of this.#records) {\n      if (r.kind === 'tool') continue\n      if (r.userId !== query.userId) continue\n      const t = r.timestamp.getTime()\n      if (t < from || t > to) continue\n      totalTokens += r.tokens.input + r.tokens.output\n      totalCostUsd += r.costUsd\n      runs += 1\n    }\n    return Promise.resolve({ totalTokens, totalCostUsd, runs })\n  }\n\n  /** @internal — test helper to inspect raw record stream */\n  __getRecords(): readonly (UsageRecord | ToolUsageRecord)[] {\n    return this.#records\n  }\n}\n","import type { ToolUsageRecord, UsageStorageAdapter } from './cost-types.js'\n\n/**\n * Phase 5 — Production-Readiness #4: tool lifecycle hooks for cost tracking.\n *\n * The SDK calls `onToolStart` → handler runs → `onToolEnd` (success) or\n * `onToolError` (throw). This factory returns the three callbacks ready to\n * attach to `Agent.create({ tools, onToolStart, onToolEnd, onToolError })`.\n *\n * Each successful tool call writes a `ToolUsageRecord{success:true}`; each\n * failure writes `ToolUsageRecord{success:false}` with `errorMessage` from\n * the thrown Error.\n *\n * Invariants:\n *   - `onToolStart` records nothing yet (no duration available). Only stashes\n *     a `startedAt` timestamp by `callId` in a per-factory Map.\n *   - `onToolEnd` reads the stashed timestamp, computes `durationMs`, writes\n *     a successful record. Removes the Map entry.\n *   - `onToolError` analog with `success:false`.\n *   - Hook throws are SWALLOWED to stderr — observation hooks must not crash\n *     the run (per the v1.1.0 release contract).\n *   - EC-8 (SHOULD TEST) — orphan starts (no matching End/Error) are pruned\n *     on every onToolStart if older than 5 minutes. Bounded memory.\n *   - EC-16 (DOCUMENT) — callId uniqueness is SDK contract; duplicate Start\n *     for the same callId uses last-write-wins.\n */\n\nconst ORPHAN_TTL_MS = 5 * 60 * 1000\n\ninterface PendingStart {\n  startedAt: number\n  userId: string\n  conversationId: string\n}\n\nexport interface TrackAgentToolsOptions {\n  storage: UsageStorageAdapter\n  /** Defaults to () => new Date() — overridable for deterministic testing. */\n  now?: () => Date\n  /** Identifier for the user — passed through to ToolUsageRecord.userId. */\n  userId?: string\n  /** Identifier for the conversation — passed through to ToolUsageRecord.conversationId. */\n  conversationId?: string\n}\n\nexport interface ToolHookEvent {\n  callId: string\n  name: string\n  // SDK shape — we only read these structurally\n  [key: string]: unknown\n}\n\nexport interface TrackAgentToolsHooks {\n  onToolStart: (event: ToolHookEvent) => void\n  onToolEnd: (event: ToolHookEvent) => void\n  onToolError: (event: ToolHookEvent) => void\n}\n\n/**\n * Create the three tool-lifecycle callbacks. Hand the returned object's\n * methods to `Agent.create({ tools, onToolStart, onToolEnd, onToolError })`.\n */\nexport function trackAgentTools(opts: TrackAgentToolsOptions): TrackAgentToolsHooks {\n  const pending = new Map<string, PendingStart>()\n  const now = opts.now ?? ((): Date => new Date())\n  const userId = opts.userId ?? 'anonymous'\n  const conversationId = opts.conversationId ?? 'unknown'\n\n  function pruneOrphans(): void {\n    const cutoff = now().getTime() - ORPHAN_TTL_MS\n    for (const [id, p] of pending) {\n      if (p.startedAt < cutoff) pending.delete(id)\n    }\n  }\n\n  function safeRecord(record: ToolUsageRecord): void {\n    Promise.resolve(opts.storage.record(record)).catch((err: unknown) => {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.warn(`[theokit:trackAgentTools] storage.record failed: ${msg}`)\n    })\n  }\n\n  return {\n    onToolStart(event: ToolHookEvent): void {\n      try {\n        pruneOrphans()\n        pending.set(event.callId, {\n          startedAt: now().getTime(),\n          userId,\n          conversationId,\n        })\n      } catch (err) {\n        console.warn(\n          `[theokit:trackAgentTools] onToolStart hook crashed (swallowed): ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        )\n      }\n    },\n    onToolEnd(event: ToolHookEvent): void {\n      try {\n        const start = pending.get(event.callId)\n        const startedAt = start?.startedAt ?? now().getTime()\n        const durationMs = start ? now().getTime() - startedAt : 0\n        pending.delete(event.callId)\n        if (!start) {\n          console.warn(\n            `[theokit:trackAgentTools] orphan onToolEnd for callId=${event.callId}; durationMs:0 recorded`,\n          )\n        }\n        safeRecord({\n          kind: 'tool',\n          userId: start?.userId ?? userId,\n          conversationId: start?.conversationId ?? conversationId,\n          toolName: event.name,\n          callId: event.callId,\n          success: true,\n          durationMs,\n          timestamp: now(),\n        })\n      } catch (err) {\n        console.warn(\n          `[theokit:trackAgentTools] onToolEnd hook crashed (swallowed): ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        )\n      }\n    },\n    onToolError(event: ToolHookEvent): void {\n      try {\n        const start = pending.get(event.callId)\n        const startedAt = start?.startedAt ?? now().getTime()\n        const durationMs = start ? now().getTime() - startedAt : 0\n        pending.delete(event.callId)\n        const error = event.error\n        let errorMessage = 'unknown error'\n        if (error instanceof Error) errorMessage = error.message\n        else if (typeof error === 'string') errorMessage = error\n        safeRecord({\n          kind: 'tool',\n          userId: start?.userId ?? userId,\n          conversationId: start?.conversationId ?? conversationId,\n          toolName: event.name,\n          callId: event.callId,\n          success: false,\n          durationMs,\n          errorMessage,\n          timestamp: now(),\n        })\n      } catch (err) {\n        console.warn(\n          `[theokit:trackAgentTools] onToolError hook crashed (swallowed): ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        )\n      }\n    },\n  }\n}\n\n/**\n * @internal — testing helper. Inspects the size of the pending-starts Map of\n * a factory instance. Not in the public API.\n */\nexport const __internalsForTesting = {\n  ORPHAN_TTL_MS,\n}\n"],"mappings":";AAuBA,IAAM,YAAY,MAAM;AACtB,MAAI;AACF,WAAQ,YAA4C,KAAK,QAAQ;AAAA,EACnE,QAAQ;AACN,WAAO,QAAQ,IAAI,aAAa;AAAA,EAClC;AACF,GAAG;AAoBH,eAAsB,cACpB,OACA,MACe;AAEf,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,MAAO,MAAM,OAAO,0BAA8B;AAGxD,UAAI,WAAW,WAAW;AAAA;AAAA,QAExB,IAAI,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,QACvE,YAAY,MAAM,aAAa,oBAAI,KAAK,GAAG,QAAQ;AAAA,QACnD,QAAQ,MAAM;AAAA,QACd,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,OAAO;AAAA,QAC1B,cAAc,MAAM,OAAO;AAAA,QAC3B,SAAS,MAAM;AAAA,QACf,QAAQ,MAAM,UAAU;AAAA,MAC1B,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,QAAS;AACnB,QAAM,SAAsB;AAAA,IAC1B,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,WAAW,MAAM,aAAa,oBAAI,KAAK;AAAA,EACzC;AACA,MAAI;AACF,UAAM,KAAK,QAAQ,OAAO,MAAM;AAAA,EAClC,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAE/D,YAAQ;AAAA,MACN,+CAA+C,OAAO;AAAA,IAExD;AAAA,EACF;AACF;;;ACpEO,IAAM,uBAAN,MAA0E;AAAA,EACtE,OAAO;AAAA,EACP,WAA8C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWxD,UAAyB;AAEvB,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA,EAEA,MAAM,OAAO,OAAqD;AAEhE,UAAM,aACJ,UAAU,SAAS,MAAM,SAAS,SAC9B,EAAE,GAAG,MAAM,IACV,EAAE,GAAG,OAAO,MAAM,MAAe;AACxC,SAAK,SAAS,KAAK,UAAU;AAC7B,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA,EAEA,MAAM,SAAS,OAAyC;AACtD,UAAM,OAAO,MAAM,OAAO,KAAK,QAAQ;AACvC,UAAM,KAAK,MAAM,OAAO,GAAG,QAAQ;AACnC,QAAI,cAAc;AAClB,QAAI,eAAe;AACnB,QAAI,OAAO;AACX,eAAW,KAAK,KAAK,UAAU;AAC7B,UAAI,EAAE,SAAS,OAAQ;AACvB,UAAI,EAAE,WAAW,MAAM,OAAQ;AAC/B,YAAM,IAAI,EAAE,UAAU,QAAQ;AAC9B,UAAI,IAAI,QAAQ,IAAI,GAAI;AACxB,qBAAe,EAAE,OAAO,QAAQ,EAAE,OAAO;AACzC,sBAAgB,EAAE;AAClB,cAAQ;AAAA,IACV;AACA,WAAO,QAAQ,QAAQ,EAAE,aAAa,cAAc,KAAK,CAAC;AAAA,EAC5D;AAAA;AAAA,EAGA,eAA2D;AACzD,WAAO,KAAK;AAAA,EACd;AACF;;;AChDA,IAAM,gBAAgB,IAAI,KAAK;AAmCxB,SAAS,gBAAgB,MAAoD;AAClF,QAAM,UAAU,oBAAI,IAA0B;AAC9C,QAAM,MAAM,KAAK,QAAQ,MAAY,oBAAI,KAAK;AAC9C,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,iBAAiB,KAAK,kBAAkB;AAE9C,WAAS,eAAqB;AAC5B,UAAM,SAAS,IAAI,EAAE,QAAQ,IAAI;AACjC,eAAW,CAAC,IAAI,CAAC,KAAK,SAAS;AAC7B,UAAI,EAAE,YAAY,OAAQ,SAAQ,OAAO,EAAE;AAAA,IAC7C;AAAA,EACF;AAEA,WAAS,WAAW,QAA+B;AACjD,YAAQ,QAAQ,KAAK,QAAQ,OAAO,MAAM,CAAC,EAAE,MAAM,CAAC,QAAiB;AACnE,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,cAAQ,KAAK,oDAAoD,GAAG,EAAE;AAAA,IACxE,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,YAAY,OAA4B;AACtC,UAAI;AACF,qBAAa;AACb,gBAAQ,IAAI,MAAM,QAAQ;AAAA,UACxB,WAAW,IAAI,EAAE,QAAQ;AAAA,UACzB;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,mEACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,UAAU,OAA4B;AACpC,UAAI;AACF,cAAM,QAAQ,QAAQ,IAAI,MAAM,MAAM;AACtC,cAAM,YAAY,OAAO,aAAa,IAAI,EAAE,QAAQ;AACpD,cAAM,aAAa,QAAQ,IAAI,EAAE,QAAQ,IAAI,YAAY;AACzD,gBAAQ,OAAO,MAAM,MAAM;AAC3B,YAAI,CAAC,OAAO;AACV,kBAAQ;AAAA,YACN,yDAAyD,MAAM,MAAM;AAAA,UACvE;AAAA,QACF;AACA,mBAAW;AAAA,UACT,MAAM;AAAA,UACN,QAAQ,OAAO,UAAU;AAAA,UACzB,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,UAAU,MAAM;AAAA,UAChB,QAAQ,MAAM;AAAA,UACd,SAAS;AAAA,UACT;AAAA,UACA,WAAW,IAAI;AAAA,QACjB,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,iEACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,YAAY,OAA4B;AACtC,UAAI;AACF,cAAM,QAAQ,QAAQ,IAAI,MAAM,MAAM;AACtC,cAAM,YAAY,OAAO,aAAa,IAAI,EAAE,QAAQ;AACpD,cAAM,aAAa,QAAQ,IAAI,EAAE,QAAQ,IAAI,YAAY;AACzD,gBAAQ,OAAO,MAAM,MAAM;AAC3B,cAAM,QAAQ,MAAM;AACpB,YAAI,eAAe;AACnB,YAAI,iBAAiB,MAAO,gBAAe,MAAM;AAAA,iBACxC,OAAO,UAAU,SAAU,gBAAe;AACnD,mBAAW;AAAA,UACT,MAAM;AAAA,UACN,QAAQ,OAAO,UAAU;AAAA,UACzB,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,UAAU,MAAM;AAAA,UAChB,QAAQ,MAAM;AAAA,UACd,SAAS;AAAA,UACT;AAAA,UACA;AAAA,UACA,WAAW,IAAI;AAAA,QACjB,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,mEACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-S3JBIFKS.js → chunk-MG7H3LAW.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   theoConfigSchema
-} from "./chunk-3Q36SEDK.js";
+} from "./chunk-ZBWROIIO.js";
 
 // src/config/load-env.ts
 import { lstatSync, readFileSync, realpathSync, statSync } from "fs";
@@ -199,4 +199,4 @@ export {
   loadEnv,
   loadConfig
 };
-//# sourceMappingURL=chunk-S3JBIFKS.js.map
+//# sourceMappingURL=chunk-MG7H3LAW.js.map

package/dist/chunk-MOT42NAH.js

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/server/scan/action-scan.ts
+import { existsSync, readFileSync, statSync } from "fs";
+import { extname as extname2, join as join2, relative } from "path";
+
+// src/server/_internal/scan-walker.ts
+import { readdirSync } from "fs";
+import { extname, join, resolve } from "path";
+function walkSourceFiles(root, opts, onFile) {
+  const skipPrefixes = opts.skipPrefixes ?? ["_", "."];
+  const visit = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+      if (entry.isDirectory() && !skipPrefixes.some((p) => entry.name.startsWith(p))) {
+        visit(fullPath);
+      } else if (entry.isFile() && opts.extensions.has(extname(entry.name))) {
+        onFile(resolve(fullPath));
+      }
+    }
+  };
+  visit(root);
+}
+
+// src/server/scan/action-scan.ts
+var ActionScanError = class extends Error {
+  code;
+  conflictingPaths;
+  constructor(code, message, conflictingPaths) {
+    super(message);
+    this.code = code;
+    this.conflictingPaths = conflictingPaths;
+  }
+};
+var ACTION_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
+var TEST_FILE_RE = /\.(test|spec)\.(ts|tsx|js|jsx)$/;
+var RESERVED_NAMES = /* @__PURE__ */ new Set(["index", "constructor", "__proto__", "prototype", "hasOwnProperty"]);
+function scanServerActions(serverDir) {
+  const actionsDir = join2(serverDir, "actions");
+  if (!existsSync(actionsDir) || !statSync(actionsDir).isDirectory()) {
+    return [];
+  }
+  const results = [];
+  walkSourceFiles(actionsDir, { extensions: ACTION_EXTENSIONS }, (absPath) => {
+    if (TEST_FILE_RE.test(absPath)) return;
+    let rel = relative(actionsDir, absPath);
+    rel = rel.replace(/\\/g, "/");
+    rel = rel.slice(0, -extname2(rel).length);
+    results.push({
+      filePath: absPath,
+      actionPath: rel
+    });
+  });
+  return results;
+}
+function scanServerActionsEnriched(serverDir) {
+  const actionsDir = join2(serverDir, "actions");
+  if (!existsSync(actionsDir) || !statSync(actionsDir).isDirectory()) {
+    return [];
+  }
+  const seenNames = /* @__PURE__ */ new Set();
+  const entries = [];
+  walkSourceFiles(actionsDir, { extensions: ACTION_EXTENSIONS }, (absPath) => {
+    if (TEST_FILE_RE.test(absPath)) return;
+    const rel = relative(actionsDir, absPath).replace(/\\/g, "/");
+    const name = rel.slice(0, -extname2(rel).length);
+    const basename = name.includes("/") ? name.split("/").pop() ?? name : name;
+    if (RESERVED_NAMES.has(basename)) {
+      throw new ActionScanError(
+        "RESERVED_NAME",
+        `Reserved JS identifier "${basename}" cannot be an action name (${absPath})`,
+        [absPath]
+      );
+    }
+    const source = readFileSync(absPath, "utf8");
+    const stripped = stripComments(source);
+    const accept = /\baccept\s*:\s*['"]form['"]/.test(stripped) ? "form" : "json";
+    const hasInput = /\binput\s*:\s*z\./.test(stripped) || /\binput\s*:\s*\w+\(/.test(stripped);
+    const exportNames = extractActionExportNames(stripped);
+    for (const exportName of exportNames) {
+      const proxyKey = exportName === "default" ? name : exportName;
+      if (seenNames.has(proxyKey)) {
+        throw new ActionScanError(
+          "NAME_COLLISION",
+          `Duplicate action proxy key "${proxyKey}" (two files export the same name)`,
+          [absPath]
+        );
+      }
+      seenNames.add(proxyKey);
+      entries.push({
+        name: proxyKey,
+        filePath: absPath,
+        urlPath: `/api/__actions/${name}/${exportName}`,
+        accept,
+        hasInput
+      });
+    }
+  });
+  for (const entry of entries) {
+    const childPrefix = `${entry.name}/`;
+    const conflictingChild = entries.find((other) => other.name.startsWith(childPrefix));
+    if (conflictingChild) {
+      throw new ActionScanError(
+        "NAME_COLLISION",
+        `Action "${entry.name}" conflicts with directory of same name containing "${conflictingChild.name}"`,
+        [entry.filePath, conflictingChild.filePath]
+      );
+    }
+  }
+  entries.sort((a, b) => {
+    if (a.name < b.name) return -1;
+    if (a.name > b.name) return 1;
+    return 0;
+  });
+  return entries;
+}
+function extractActionExportNames(stripped) {
+  const names = /* @__PURE__ */ new Set();
+  const namedRe = /\bexport\s+(?:const|let|var|function\*?)\s+([a-zA-Z_$][\w$]*)\s*[=(]/g;
+  let m;
+  while ((m = namedRe.exec(stripped)) !== null) {
+    const name = m[1];
+    if (typeof name === "string" && name.length > 0) names.add(name);
+  }
+  if (/\bexport\s+default\s+defineAction\b/.test(stripped)) {
+    names.add("default");
+  }
+  if (names.size === 0) names.add("default");
+  return [...names];
+}
+function stripComments(source) {
+  let out = "";
+  let i = 0;
+  while (i < source.length) {
+    const ch = source[i];
+    const next = source[i + 1];
+    if (ch === "/" && next === "/") {
+      while (i < source.length && source[i] !== "\n") i++;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < source.length - 1 && !(source[i] === "*" && source[i + 1] === "/")) i++;
+      i += 2;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+
+export {
+  walkSourceFiles,
+  scanServerActions,
+  scanServerActionsEnriched
+};
+//# sourceMappingURL=chunk-MOT42NAH.js.map

package/dist/chunk-MOT42NAH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/scan/action-scan.ts","../src/server/_internal/scan-walker.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks `serverDir/actions/` derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { existsSync, readFileSync, statSync } from 'node:fs'\nimport { extname, join, relative } from 'node:path'\n\nimport { walkSourceFiles } from '../_internal/scan-walker.js'\n\nexport interface ActionNode {\n  filePath: string\n  actionPath: string\n}\n\n/**\n * Enriched manifest entry per plan g3-server-actions-and-useaction v1.2\n * § Phase 1 / T1.4 + ADR D4. Consumed by virtual module `@theo/actions`\n * (T3.1) and G4 devtools \"Actions\" tab (T5.1).\n */\nexport interface ActionManifestEntry {\n  name: string\n  filePath: string\n  urlPath: string\n  accept: 'form' | 'json'\n  hasInput: boolean\n}\n\n/**\n * EC-2: structured error for scan-time defects (name collision, reserved\n * identifier, etc.). Throw at scan time to fail loud — silent shadowing is\n * a security/correctness footgun.\n */\nexport class ActionScanError extends Error {\n  readonly code: 'NAME_COLLISION' | 'RESERVED_NAME'\n  readonly conflictingPaths: readonly string[]\n\n  constructor(\n    code: 'NAME_COLLISION' | 'RESERVED_NAME',\n    message: string,\n    conflictingPaths: readonly string[],\n  ) {\n    super(message)\n    this.code = code\n    this.conflictingPaths = conflictingPaths\n  }\n}\n\nconst ACTION_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\nconst TEST_FILE_RE = /\\.(test|spec)\\.(ts|tsx|js|jsx)$/\nconst RESERVED_NAMES = new Set(['index', 'constructor', '__proto__', 'prototype', 'hasOwnProperty'])\n\n/**\n * Backward-compatible: original simple-shape scanner used by existing\n * consumers. Preserved verbatim; new consumers should call\n * `scanServerActionsEnriched`.\n */\nexport function scanServerActions(serverDir: string): ActionNode[] {\n  const actionsDir = join(serverDir, 'actions')\n  if (!existsSync(actionsDir) || !statSync(actionsDir).isDirectory()) {\n    return []\n  }\n\n  const results: ActionNode[] = []\n  walkSourceFiles(actionsDir, { extensions: ACTION_EXTENSIONS }, (absPath) => {\n    if (TEST_FILE_RE.test(absPath)) return\n    let rel = relative(actionsDir, absPath)\n    rel = rel.replace(/\\\\/g, '/')\n    rel = rel.slice(0, -extname(rel).length)\n    results.push({\n      filePath: absPath,\n      actionPath: rel,\n    })\n  })\n  return results\n}\n\n/**\n * Enriched scan: light AST detection of `accept: 'form'|'json'` + `input:`\n * presence via regex-after-comment-stripping (EC-9). Throws ActionScanError\n * on file/dir name collision (EC-2) or reserved JS identifier names.\n *\n * Output `ActionManifestEntry[]` is sorted by `name` for deterministic\n * `.theo/actions-manifest.json` emission.\n */\nexport function scanServerActionsEnriched(serverDir: string): ActionManifestEntry[] {\n  const actionsDir = join(serverDir, 'actions')\n  if (!existsSync(actionsDir) || !statSync(actionsDir).isDirectory()) {\n    return []\n  }\n\n  const seenNames = new Set<string>()\n  const entries: ActionManifestEntry[] = []\n\n  // Collect first; collision-check after the full walk.\n  walkSourceFiles(actionsDir, { extensions: ACTION_EXTENSIONS }, (absPath) => {\n    if (TEST_FILE_RE.test(absPath)) return\n    const rel = relative(actionsDir, absPath).replace(/\\\\/g, '/')\n    const name = rel.slice(0, -extname(rel).length)\n\n    const basename = name.includes('/') ? (name.split('/').pop() ?? name) : name\n    if (RESERVED_NAMES.has(basename)) {\n      throw new ActionScanError(\n        'RESERVED_NAME',\n        `Reserved JS identifier \"${basename}\" cannot be an action name (${absPath})`,\n        [absPath],\n      )\n    }\n    // File-level collision (one file appearing twice) is impossible via the\n    // walker; per-export collision check happens inside the export loop below.\n    const source = readFileSync(absPath, 'utf8')\n    const stripped = stripComments(source)\n    const accept = /\\baccept\\s*:\\s*['\"]form['\"]/.test(stripped) ? 'form' : 'json'\n    const hasInput = /\\binput\\s*:\\s*z\\./.test(stripped) || /\\binput\\s*:\\s*\\w+\\(/.test(stripped)\n\n    // T7.1 wire fix — extract exports so the urlPath includes the second\n    // segment required by action-middleware (`/api/__actions/<file>/<export>`).\n    // Each named action export becomes its own manifest entry.\n    // Proxy key on the EXPORT name (so consumers write `actions.saveMemory(input)`).\n    // URL keeps the runtime 2-segment shape `/api/__actions/<file>/<export>`\n    // expected by action-middleware. Cross-file export collisions become a\n    // scan error to surface the ambiguity early.\n    const exportNames = extractActionExportNames(stripped)\n    for (const exportName of exportNames) {\n      const proxyKey = exportName === 'default' ? name : exportName\n      if (seenNames.has(proxyKey)) {\n        throw new ActionScanError(\n          'NAME_COLLISION',\n          `Duplicate action proxy key \"${proxyKey}\" (two files export the same name)`,\n          [absPath],\n        )\n      }\n      seenNames.add(proxyKey)\n      entries.push({\n        name: proxyKey,\n        filePath: absPath,\n        urlPath: `/api/__actions/${name}/${exportName}`,\n        accept,\n        hasInput,\n      })\n    }\n  })\n\n  // EC-2: detect file vs dir collisions (e.g., foo.ts AND foo/bar.ts).\n  // After walk completes, any name that has children prefixed `name/` triggers collision.\n  for (const entry of entries) {\n    const childPrefix = `${entry.name}/`\n    const conflictingChild = entries.find((other) => other.name.startsWith(childPrefix))\n    if (conflictingChild) {\n      throw new ActionScanError(\n        'NAME_COLLISION',\n        `Action \"${entry.name}\" conflicts with directory of same name containing \"${conflictingChild.name}\"`,\n        [entry.filePath, conflictingChild.filePath],\n      )\n    }\n  }\n\n  entries.sort((a, b) => {\n    if (a.name < b.name) return -1\n    if (a.name > b.name) return 1\n    return 0\n  })\n  return entries\n}\n\n/**\n * Strip JavaScript line + block comments from source. Simple state machine\n * (does not parse strings — false positives if a comment marker appears\n * inside a string literal, but that's an acceptable trade-off for v1 vs\n * full AST parse).\n */\n/**\n * Extract action export names via regex over comment-stripped source.\n * Matches `export const <name> = defineAction(...)`, `export default\n * defineAction(...)`, and `export function <name>(...)` forms. Returns\n * `['default']` when no named action exports are found (best-effort fallback\n * for default-export shapes the regex misses).\n */\nfunction extractActionExportNames(stripped: string): string[] {\n  const names = new Set<string>()\n  const namedRe = /\\bexport\\s+(?:const|let|var|function\\*?)\\s+([a-zA-Z_$][\\w$]*)\\s*[=(]/g\n  let m: RegExpExecArray | null\n  while ((m = namedRe.exec(stripped)) !== null) {\n    const name = m[1]\n    if (typeof name === 'string' && name.length > 0) names.add(name)\n  }\n  if (/\\bexport\\s+default\\s+defineAction\\b/.test(stripped)) {\n    names.add('default')\n  }\n  if (names.size === 0) names.add('default')\n  return [...names]\n}\n\nfunction stripComments(source: string): string {\n  let out = ''\n  let i = 0\n  while (i < source.length) {\n    const ch = source[i]\n    const next = source[i + 1]\n    if (ch === '/' && next === '/') {\n      // Line comment: skip until newline\n      while (i < source.length && source[i] !== '\\n') i++\n      continue\n    }\n    if (ch === '/' && next === '*') {\n      // Block comment: skip until */\n      i += 2\n      while (i < source.length - 1 && !(source[i] === '*' && source[i + 1] === '/')) i++\n      i += 2\n      continue\n    }\n    out += ch\n    i++\n  }\n  return out\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks directories derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { readdirSync } from 'node:fs'\nimport { extname, join, resolve } from 'node:path'\n\n/**\n * Options for walkSourceFiles.\n *\n * Sequential by design — callers (route precedence) depend on insertion\n * order (EC-19 documented decision). Async-callback support is implicit\n * via JavaScript's serial await loop.\n *\n * Tested on macOS + Linux. Windows long-path support not validated (EC-20).\n */\nexport interface WalkOptions {\n  /** File extensions to include (e.g., new Set(['.ts', '.tsx'])). */\n  extensions: ReadonlySet<string>\n  /** Skip directories whose name starts with any of these (default: ['_', '.']). */\n  skipPrefixes?: readonly string[]\n}\n\n/**\n * Recursively walk `root`, invoking `onFile(absPath)` for every file matching\n * `opts.extensions`. Directories whose name starts with any `skipPrefixes`\n * char are skipped (defaults to `_` and `.`).\n *\n * Replaces 3 near-identical recursive walkers in scan.ts, action-scan.ts,\n * ws-scan.ts (PV-3 — DRY consolidation). Resolves T3.1 of\n * architecture-review-remediation-plan.\n *\n * Symlink loops are NOT tracked — callers must avoid them or pre-resolve\n * via `fs.realpath`. EC-11 documented but not implemented (rare in dev).\n */\nexport function walkSourceFiles(\n  root: string,\n  opts: WalkOptions,\n  onFile: (absPath: string) => void,\n): void {\n  const skipPrefixes = opts.skipPrefixes ?? ['_', '.']\n  const visit = (dir: string): void => {\n    let entries\n    try {\n      entries = readdirSync(dir, { withFileTypes: true })\n    } catch {\n      // Silently skip unreadable directories — caller controls discoverability\n      return\n    }\n    for (const entry of entries) {\n      const fullPath = join(dir, entry.name)\n      if (entry.isDirectory() && !skipPrefixes.some((p) => entry.name.startsWith(p))) {\n        visit(fullPath)\n      } else if (entry.isFile() && opts.extensions.has(extname(entry.name))) {\n        onFile(resolve(fullPath))\n      }\n    }\n  }\n  visit(root)\n}\n"],"mappings":";;;;AAIA,SAAS,YAAY,cAAc,gBAAgB;AACnD,SAAS,WAAAA,UAAS,QAAAC,OAAM,gBAAgB;;;ACDxC,SAAS,mBAAmB;AAC5B,SAAS,SAAS,MAAM,eAAe;AA8BhC,SAAS,gBACd,MACA,MACA,QACM;AACN,QAAM,eAAe,KAAK,gBAAgB,CAAC,KAAK,GAAG;AACnD,QAAM,QAAQ,CAAC,QAAsB;AACnC,QAAI;AACJ,QAAI;AACF,gBAAU,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,IACpD,QAAQ;AAEN;AAAA,IACF;AACA,eAAW,SAAS,SAAS;AAC3B,YAAM,WAAW,KAAK,KAAK,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,KAAK,CAAC,aAAa,KAAK,CAAC,MAAM,MAAM,KAAK,WAAW,CAAC,CAAC,GAAG;AAC9E,cAAM,QAAQ;AAAA,MAChB,WAAW,MAAM,OAAO,KAAK,KAAK,WAAW,IAAI,QAAQ,MAAM,IAAI,CAAC,GAAG;AACrE,eAAO,QAAQ,QAAQ,CAAC;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AACA,QAAM,IAAI;AACZ;;;AD3BO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAChC;AAAA,EACA;AAAA,EAET,YACE,MACA,SACA,kBACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,mBAAmB;AAAA,EAC1B;AACF;AAEA,IAAM,oBAAoB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAChE,IAAM,eAAe;AACrB,IAAM,iBAAiB,oBAAI,IAAI,CAAC,SAAS,eAAe,aAAa,aAAa,gBAAgB,CAAC;AAO5F,SAAS,kBAAkB,WAAiC;AACjE,QAAM,aAAaC,MAAK,WAAW,SAAS;AAC5C,MAAI,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,UAAU,EAAE,YAAY,GAAG;AAClE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAwB,CAAC;AAC/B,kBAAgB,YAAY,EAAE,YAAY,kBAAkB,GAAG,CAAC,YAAY;AAC1E,QAAI,aAAa,KAAK,OAAO,EAAG;AAChC,QAAI,MAAM,SAAS,YAAY,OAAO;AACtC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAACC,SAAQ,GAAG,EAAE,MAAM;AACvC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,YAAY;AAAA,IACd,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;AAUO,SAAS,0BAA0B,WAA0C;AAClF,QAAM,aAAaD,MAAK,WAAW,SAAS;AAC5C,MAAI,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,UAAU,EAAE,YAAY,GAAG;AAClE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,YAAY,oBAAI,IAAY;AAClC,QAAM,UAAiC,CAAC;AAGxC,kBAAgB,YAAY,EAAE,YAAY,kBAAkB,GAAG,CAAC,YAAY;AAC1E,QAAI,aAAa,KAAK,OAAO,EAAG;AAChC,UAAM,MAAM,SAAS,YAAY,OAAO,EAAE,QAAQ,OAAO,GAAG;AAC5D,UAAM,OAAO,IAAI,MAAM,GAAG,CAACC,SAAQ,GAAG,EAAE,MAAM;AAE9C,UAAM,WAAW,KAAK,SAAS,GAAG,IAAK,KAAK,MAAM,GAAG,EAAE,IAAI,KAAK,OAAQ;AACxE,QAAI,eAAe,IAAI,QAAQ,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,2BAA2B,QAAQ,+BAA+B,OAAO;AAAA,QACzE,CAAC,OAAO;AAAA,MACV;AAAA,IACF;AAGA,UAAM,SAAS,aAAa,SAAS,MAAM;AAC3C,UAAM,WAAW,cAAc,MAAM;AACrC,UAAM,SAAS,8BAA8B,KAAK,QAAQ,IAAI,SAAS;AACvE,UAAM,WAAW,oBAAoB,KAAK,QAAQ,KAAK,sBAAsB,KAAK,QAAQ;AAS1F,UAAM,cAAc,yBAAyB,QAAQ;AACrD,eAAW,cAAc,aAAa;AACpC,YAAM,WAAW,eAAe,YAAY,OAAO;AACnD,UAAI,UAAU,IAAI,QAAQ,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,+BAA+B,QAAQ;AAAA,UACvC,CAAC,OAAO;AAAA,QACV;AAAA,MACF;AACA,gBAAU,IAAI,QAAQ;AACtB,cAAQ,KAAK;AAAA,QACX,MAAM;AAAA,QACN,UAAU;AAAA,QACV,SAAS,kBAAkB,IAAI,IAAI,UAAU;AAAA,QAC7C;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAID,aAAW,SAAS,SAAS;AAC3B,UAAM,cAAc,GAAG,MAAM,IAAI;AACjC,UAAM,mBAAmB,QAAQ,KAAK,CAAC,UAAU,MAAM,KAAK,WAAW,WAAW,CAAC;AACnF,QAAI,kBAAkB;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,WAAW,MAAM,IAAI,uDAAuD,iBAAiB,IAAI;AAAA,QACjG,CAAC,MAAM,UAAU,iBAAiB,QAAQ;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AACT;AAeA,SAAS,yBAAyB,UAA4B;AAC5D,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,UAAU;AAChB,MAAI;AACJ,UAAQ,IAAI,QAAQ,KAAK,QAAQ,OAAO,MAAM;AAC5C,UAAM,OAAO,EAAE,CAAC;AAChB,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,EAAG,OAAM,IAAI,IAAI;AAAA,EACjE;AACA,MAAI,sCAAsC,KAAK,QAAQ,GAAG;AACxD,UAAM,IAAI,SAAS;AAAA,EACrB;AACA,MAAI,MAAM,SAAS,EAAG,OAAM,IAAI,SAAS;AACzC,SAAO,CAAC,GAAG,KAAK;AAClB;AAEA,SAAS,cAAc,QAAwB;AAC7C,MAAI,MAAM;AACV,MAAI,IAAI;AACR,SAAO,IAAI,OAAO,QAAQ;AACxB,UAAM,KAAK,OAAO,CAAC;AACnB,UAAM,OAAO,OAAO,IAAI,CAAC;AACzB,QAAI,OAAO,OAAO,SAAS,KAAK;AAE9B,aAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,KAAM;AAChD;AAAA,IACF;AACA,QAAI,OAAO,OAAO,SAAS,KAAK;AAE9B,WAAK;AACL,aAAO,IAAI,OAAO,SAAS,KAAK,EAAE,OAAO,CAAC,MAAM,OAAO,OAAO,IAAI,CAAC,MAAM,KAAM;AAC/E,WAAK;AACL;AAAA,IACF;AACA,WAAO;AACP;AAAA,EACF;AACA,SAAO;AACT;","names":["extname","join","join","extname"]}