theokit 0.18.0 → 0.19.0

package/dist/{chunk-XWS4RZCE.js → chunk-W4YO6S4I.js}

@@ -476,6 +476,113 @@ async function runErrorHooks(err, hookCtx, onError) {
   return mergeHookHeaders(errorResponse, hookCtx.responseHeaders);
 }
 
+// src/server/agent/mcp-handler.ts
+import {
+  buildMcpToolDescriptors,
+  compileAgentModule,
+  mcpServerInfo
+} from "@theokit/agents";
+var MCP_PATH = /^\/api\/agents\/([^/]+)\/mcp$/;
+function isMcpPath(urlPath) {
+  const match = MCP_PATH.exec(urlPath);
+  return match ? decodeURIComponent(match[1]) : null;
+}
+function isJsonRpcRequest(body) {
+  return typeof body === "object" && body !== null && body.jsonrpc === "2.0" && typeof body.method === "string";
+}
+function jsonResponse(payload) {
+  return new Response(JSON.stringify(payload), {
+    status: 200,
+    headers: { "content-type": "application/json; charset=utf-8" }
+  });
+}
+function toEntry(name, mod) {
+  const compiled = compileAgentModule(mod, `mcp server for "${name}"`);
+  return {
+    name,
+    route: `/api/agents/${name}`,
+    stream: compiled.stream,
+    mainLoop: { method: "", strategy: "" },
+    guards: [],
+    interceptors: [],
+    tools: compiled.tools.map((t) => ({
+      name: t.name,
+      description: t.description,
+      approval: false,
+      trace: false,
+      audit: false
+    })),
+    subAgents: []
+  };
+}
+function handleMcpJsonRpc(mod, name, body, appResources = []) {
+  if (!isJsonRpcRequest(body)) {
+    return jsonResponse({
+      jsonrpc: "2.0",
+      id: null,
+      error: { code: -32600, message: "Invalid Request" }
+    });
+  }
+  const { id, method, params } = body;
+  try {
+    const entry = toEntry(name, mod);
+    if (method === "initialize") {
+      const info = mcpServerInfo(entry);
+      const capabilities = { tools: {} };
+      if (appResources.length > 0) capabilities.resources = {};
+      return jsonResponse({
+        jsonrpc: "2.0",
+        id,
+        result: {
+          protocolVersion: info.protocolVersion,
+          capabilities,
+          serverInfo: { name: info.name, version: info.version }
+        }
+      });
+    }
+    if (method === "tools/list") {
+      return jsonResponse({ jsonrpc: "2.0", id, result: { tools: buildMcpToolDescriptors(entry) } });
+    }
+    if (method === "resources/list") {
+      return jsonResponse({
+        jsonrpc: "2.0",
+        id,
+        result: { resources: buildResourceDescriptors(appResources) }
+      });
+    }
+    if (method === "resources/read") {
+      const uri = params?.uri;
+      if (typeof uri !== "string") {
+        return jsonResponse({
+          jsonrpc: "2.0",
+          id,
+          error: { code: -32602, message: "resources/read requires a string `uri` param." }
+        });
+      }
+      const contents = readAppResource(appResources, uri);
+      if (contents === null) {
+        return jsonResponse({
+          jsonrpc: "2.0",
+          id,
+          error: { code: -32602, message: `Resource not found: ${uri}` }
+        });
+      }
+      return jsonResponse({ jsonrpc: "2.0", id, result: contents });
+    }
+    return jsonResponse({
+      jsonrpc: "2.0",
+      id,
+      error: { code: -32601, message: `Method not found: ${method}` }
+    });
+  } catch (err) {
+    return jsonResponse({
+      jsonrpc: "2.0",
+      id,
+      error: { code: -32603, message: err instanceof Error ? err.message : "Internal error" }
+    });
+  }
+}
+
 export {
   _resetEnvCache,
   loadEnv,
@@ -486,6 +593,8 @@ export {
   buildResourceDescriptors,
   readAppResource,
   extractAppResources,
+  isMcpPath,
+  handleMcpJsonRpc,
   executeWebRequest
 };
-//# sourceMappingURL=chunk-XWS4RZCE.js.map
+//# sourceMappingURL=chunk-W4YO6S4I.js.map

package/dist/chunk-W4YO6S4I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/load-env.ts","../src/server/transformer.ts","../src/server/agent/mcp-app-resources.ts","../src/server/http/web-middleware-runner.ts","../src/server/web-handler.ts","../src/server/agent/mcp-handler.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Reads `.env` files from a CLI-controlled `cwd`. File names are a fixed\n * literal set. Build-time + CLI tool; no HTTP input.\n */\n/**\n * `loadEnv()` — auto-loads `.env` files into `process.env` for server code.\n *\n * Implements the Next.js `loadEnvConfig` algorithm\n * (`referencias/next.js/packages/next-env/index.ts:114-180`) with TheoKit\n * adaptations:\n *\n * - EC-1: 1MB file-size cap (anti-OOM, anti-supply-chain).\n * - EC-2: `_resetEnvCache()` test-only side-door.\n * - EC-8: `dotenv-expand` circular-ref safe (lib-provided).\n * - EC-13: log when `.env` is a symlink (transparency).\n * - D6: real `process.env` wins over `.env`-file values.\n * - NODE_ENV stash: `.env`-set NODE_ENV NEVER overrides the real\n *   `process.env.NODE_ENV`. Stashed in `__THEOKIT_USER_NODE_ENV` instead.\n */\n\nimport { lstatSync, readFileSync, realpathSync, statSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport dotenv from 'dotenv'\nimport { expand, type DotenvPopulateInput } from 'dotenv-expand'\n\nimport type { LoadEnvOptions, LoadEnvResult } from './load-env-types.js'\n\n/** EC-1: 1MB cap. Real `.env`s are < 10KB. */\nconst MAX_ENV_FILE_BYTES = 1_048_576\n\nconst cache = new Map<string, LoadEnvResult>()\n\n/** Test-only side-door for EC-2 — clear the module-level cache between vitest test files. */\nexport function _resetEnvCache(): void {\n  cache.clear()\n}\n\nfunction envFilesInPriorityOrder(mode: string): string[] {\n  // Top of list = highest priority. Will be read in REVERSE so first-in\n  // wins via overwrite during merge.\n  const files = [`.env.${mode}.local`, `.env.local`, `.env.${mode}`, `.env`]\n  // Test mode skips `.env.local` per dotenv convention (avoid leaking dev\n  // secrets into the test suite).\n  if (mode === 'test') {\n    return files.filter((f) => f !== '.env.local')\n  }\n  return files\n}\n\nfunction readEnvFile(path: string): Record<string, string> | null {\n  let stat\n  try {\n    stat = statSync(path)\n  } catch {\n    return null // ENOENT / EACCES → skip\n  }\n\n  // Allow files + FIFOs (1Password/SOPS pipe support).\n  if (!stat.isFile() && !stat.isFIFO()) return null\n\n  // EC-1 — anti-OOM cap.\n  if (stat.size > MAX_ENV_FILE_BYTES) {\n    console.warn(\n      `[theokit] .env file at ${path} exceeds ${MAX_ENV_FILE_BYTES} bytes — skipping (likely a generated artifact, not a real env file)`,\n    )\n    return null\n  }\n\n  // EC-13 — symlink transparency. Don't refuse; just log.\n  try {\n    const lstat = lstatSync(path)\n    if (lstat.isSymbolicLink()) {\n      const real = realpathSync(path)\n      // eslint-disable-next-line no-console -- intentional transparency log on a build-time tool\n      console.info(`[theokit] .env at ${path} is a symlink → ${real}`)\n    }\n  } catch {\n    // lstat failure is non-fatal — fall through to read.\n  }\n\n  try {\n    const content = readFileSync(path, 'utf-8')\n    return dotenv.parse(content)\n  } catch {\n    return null\n  }\n}\n\n// eslint-disable-next-line complexity -- canonical env-load algorithm (priority → expand → guards → apply); inlining branches is clearer than extracting micro-helpers\nexport function loadEnv(options: LoadEnvOptions = {}): LoadEnvResult {\n  const cwd = options.cwd ?? process.cwd()\n  const mode = options.mode ?? process.env.NODE_ENV ?? 'development'\n  const cacheKey = `${cwd}:${mode}`\n\n  if (!options.forceReload) {\n    const cached = cache.get(cacheKey)\n    if (cached) return cached\n  }\n\n  const fileNames = envFilesInPriorityOrder(mode)\n  const filePaths = fileNames.map((f) => resolve(cwd, f))\n\n  // Read in REVERSE — lower-priority files first, so higher-priority\n  // (lower-index) overwrites during merge.\n  const merged: Record<string, string> = {}\n  const loadedFromFiles: string[] = []\n  for (const path of [...filePaths].reverse()) {\n    const parsed = readEnvFile(path)\n    if (parsed === null) continue\n    for (const [k, v] of Object.entries(parsed)) {\n      merged[k] = v\n    }\n    loadedFromFiles.unshift(path) // keep priority order in result\n  }\n\n  // NODE_ENV stash — `.env`-set NODE_ENV never overrides real process.env.NODE_ENV.\n  if (merged.NODE_ENV && process.env.__THEOKIT_USER_NODE_ENV === undefined) {\n    process.env.__THEOKIT_USER_NODE_ENV = merged.NODE_ENV\n  }\n  delete merged.NODE_ENV // never propagate\n\n  // EC-8 — dotenv-expand@11 stack-overflows on circular refs (A=${B}, B=${A}).\n  // Wrap in try/catch — on overflow, leave the parsed map untouched (literal\n  // values survive). Tested via test_loadEnv_circular_expand_no_loop_EC8.\n  // Pass a CLONE of process.env (string-only, filtered) so expand can\n  // reference real env without mutating it.\n  const processEnvClone: DotenvPopulateInput = {}\n  for (const [k, v] of Object.entries(process.env)) {\n    if (typeof v === 'string') processEnvClone[k] = v\n  }\n  try {\n    expand({ parsed: merged, processEnv: processEnvClone })\n  } catch (err) {\n    if (err instanceof RangeError) {\n      console.warn(\n        `[theokit] .env expansion overflow (likely circular reference like A=\\${B}, B=\\${A}). Leaving values as literals.`,\n      )\n    } else {\n      throw err\n    }\n  }\n\n  // Apply: D6 — real process.env wins over file values.\n  const loaded: Record<string, string> = {}\n  for (const [k, v] of Object.entries(merged)) {\n    if (process.env[k] !== undefined) continue // real env wins\n    process.env[k] = v\n    loaded[k] = v\n  }\n\n  // Sentinel\n  process.env.__THEOKIT_PROCESSED_ENV = 'true'\n\n  const result: LoadEnvResult = { loaded, loadedFromFiles }\n  cache.set(cacheKey, result)\n  return result\n}\n","import superjson from 'superjson'\n\n/**\n * T5.2 — pluggable response/request transformer.\n *\n * `superjson` is the default, preserving Date/Map/Set/BigInt/etc.\n * `json` is the lightweight option (plain JSON.stringify/parse).\n * Users can supply a custom object implementing this contract.\n */\nexport interface TheoTransformer {\n  name: string\n  serialize: (value: unknown) => string\n  deserialize: (raw: string) => unknown\n}\n\nexport const superjsonTransformer: TheoTransformer = {\n  name: 'superjson',\n  serialize: (v) => JSON.stringify(superjson.serialize(v)),\n  deserialize: (raw) => {\n    const parsed = JSON.parse(raw) as Parameters<typeof superjson.deserialize>[0]\n    return superjson.deserialize(parsed)\n  },\n}\n\nexport const jsonTransformer: TheoTransformer = {\n  name: 'json',\n  serialize: (v) => JSON.stringify(v),\n  deserialize: (raw) => JSON.parse(raw) as unknown,\n}\n\nconst BUILT_INS: Record<string, TheoTransformer> = {\n  superjson: superjsonTransformer,\n  json: jsonTransformer,\n}\n\nexport function resolveTransformer(\n  selector: 'json' | 'superjson' | TheoTransformer,\n): TheoTransformer {\n  if (typeof selector === 'string') {\n    // selector is 'json' | 'superjson' literal — both keys exist in\n    // BUILT_INS by construction. Type system guarantees a hit; we keep\n    // a defensive fallback that the compiler cannot see is unreachable\n    // at runtime, just in case someone adds a new literal to the union\n    // but forgets to register the built-in.\n    const built = BUILT_INS[selector]\n    // Defensive: the public union ensures `built` is defined, but if a\n    // future contributor extends the union without registering the impl,\n    // the cast keeps the failure mode loud.\n    if ((built as TheoTransformer | undefined) === undefined) {\n      throw new Error(\n        `Unknown transformer \"${selector}\". Built-in options: ${Object.keys(BUILT_INS).join(', ')}.`,\n      )\n    }\n    return built\n  }\n  if (\n    typeof selector !== 'object' ||\n    typeof selector.serialize !== 'function' ||\n    typeof selector.deserialize !== 'function'\n  ) {\n    throw new Error(\n      `Custom transformer must have serialize and deserialize functions. Got: ${JSON.stringify(selector)}`,\n    )\n  }\n  return selector\n}\n","/**\n * M30 (ADR-0041) — MCP Apps: `ui://` HTML resources for the MCP server (M16).\n *\n * A tool can declare a `ui://` HTML resource; the MCP server advertises it via `resources/list` and\n * serves the HTML via `resources/read`. The client renders it in a SANDBOXED iframe (see\n * `mcp-app-host.ts`). Pure data transforms here — no LLM, no runtime (ADR-0040 § D2 home concern).\n *\n * Security: only the `ui://` scheme is accepted (an app UI resource), never `http(s)://` — the HTML\n * is rendered sandboxed on the client, and the scheme gate keeps a tool from smuggling a remote URL\n * into the app surface.\n */\n\n/** A declared `ui://` app resource. */\nexport interface AppResource {\n  uri: string\n  name: string\n  mimeType: 'text/html'\n  html: string\n  description?: string\n}\n\n/** Input to {@link defineAppResource}. */\nexport interface AppResourceInput {\n  /** MUST start with `ui://`. */\n  uri: string\n  name: string\n  html: string\n  description?: string\n}\n\n/** An MCP `resources/list` descriptor (no HTML body — that comes from `resources/read`). */\nexport interface McpResourceDescriptor {\n  uri: string\n  name: string\n  mimeType: 'text/html'\n  description?: string\n}\n\n/** An MCP `resources/read` result. */\nexport interface McpResourceContents {\n  contents: { uri: string; mimeType: 'text/html'; text: string }[]\n}\n\n/**\n * Declare a `ui://` HTML app resource. Fails fast if the uri is not a `ui://` scheme or the HTML is\n * empty (error-handling.md) — a misconfigured resource is caught at definition time.\n */\nexport function defineAppResource(input: AppResourceInput): AppResource {\n  if (!input.uri.startsWith('ui://')) {\n    throw new Error(\n      `defineAppResource: uri must use the ui:// scheme (an app UI resource). Got: ${JSON.stringify(input.uri)}`,\n    )\n  }\n  if (input.html.length === 0) {\n    throw new Error(`defineAppResource(${JSON.stringify(input.uri)}): html must be non-empty.`)\n  }\n  return {\n    uri: input.uri,\n    name: input.name,\n    mimeType: 'text/html',\n    html: input.html,\n    ...(input.description !== undefined ? { description: input.description } : {}),\n  }\n}\n\n/** Map app resources to MCP `resources/list` descriptors (the HTML body is omitted from the list). */\nexport function buildResourceDescriptors(\n  resources: readonly AppResource[],\n): McpResourceDescriptor[] {\n  return resources.map((r) => ({\n    uri: r.uri,\n    name: r.name,\n    mimeType: r.mimeType,\n    ...(r.description !== undefined ? { description: r.description } : {}),\n  }))\n}\n\n/** Serve the HTML for `uri` as an MCP `resources/read` result, or `null` when unknown. */\nexport function readAppResource(\n  resources: readonly AppResource[],\n  uri: string,\n): McpResourceContents | null {\n  const found = resources.find((r) => r.uri === uri)\n  if (!found) return null\n  return { contents: [{ uri: found.uri, mimeType: 'text/html', text: found.html }] }\n}\n\n/** True when `v` is a well-formed {@link AppResource} (from `defineAppResource`). */\nfunction isAppResource(v: unknown): v is AppResource {\n  if (typeof v !== 'object' || v === null) return false\n  const r = v as Record<string, unknown>\n  return (\n    typeof r.uri === 'string' &&\n    r.uri.startsWith('ui://') &&\n    r.mimeType === 'text/html' &&\n    typeof r.html === 'string'\n  )\n}\n\n/**\n * M30 wiring — extract the App resources an agent module declares via a named `appResources` export\n * (`export const appResources = [defineAppResource(...)]`). Returns only the well-formed entries; a\n * module without the export (or with a malformed one) yields `[]`. This is how per-agent `ui://`\n * resources reach the MCP server's `resources/list` + `resources/read` without a runtime dependency\n * from `@theokit/agents` on this theo-side type (the module exports them; the serving path reads them).\n */\nexport function extractAppResources(mod: unknown): AppResource[] {\n  const raw = (mod as { appResources?: unknown } | null | undefined)?.appResources\n  if (!Array.isArray(raw)) return []\n  return raw.filter(isAppResource)\n}\n","/**\n * T3.2 — Web-Standards middleware runner for the `executeWebRequest` path.\n *\n * The Node request path (`http/execute.ts`) runs middleware via\n * `runMiddlewareAndContext`, which is coupled to Node `req`/`res`. Per G8\n * (Web Standards over Node APIs) the Web path needs a `Request`-shaped runner;\n * this is it. Extracted to a sibling so `web-handler.ts` stays under its LoC\n * budget (G6).\n *\n * Ordering invariant (EC-3): the caller runs the CSRF gate BEFORE invoking this\n * runner, mirroring the Node path (CSRF stage precedes user middleware).\n *\n * NOTE (D4 / EC-12): this is its own middleware contract — `(request, context)`.\n * Full semantic parity with the Node `defineMiddleware` contract is part of the\n * deferred Node→Web pipeline convergence, not this slice.\n */\n\n/** A Web-path middleware: mutate `context`, or return a `Response` to short-circuit. */\nexport type WebMiddleware = (\n  request: Request,\n  context: Record<string, unknown>,\n  // A middleware may mutate `context` and return nothing (void) OR return a\n  // `Response` to short-circuit (Express/Koa-style). `void` in this union is\n  // intentional — `runWebMiddleware` only inspects `instanceof Response`, so a\n  // void return means \"continue to the next middleware / handler\".\n  // eslint-disable-next-line @typescript-eslint/no-invalid-void-type\n) => Promise<Response | undefined> | Response | undefined | void\n\n/**\n * Run middleware in order against a shared mutable `context`. The first\n * middleware that returns a `Response` short-circuits the chain (the handler\n * is not reached); its `Response` is returned verbatim so headers like\n * `Set-Cookie` are preserved (EC-11). Returns `undefined` when every\n * middleware passes (the handler should run next).\n */\nexport async function runWebMiddleware(\n  request: Request,\n  middleware: readonly WebMiddleware[],\n  context: Record<string, unknown>,\n): Promise<Response | undefined> {\n  for (const mw of middleware) {\n    const result = await mw(request, context)\n    if (result instanceof Response) return result\n  }\n  return undefined\n}\n","/**\n * T5a.2 Phase A — Foundation: Web-Standards request handler entry-point.\n *\n * Per `docs/plans/t5a2-incoming-message-to-request-shape-refactor-plan.md`\n * v1.0 § Phase A. Bridges the gap between Web `Request`/`Response` and the\n * existing `defineRoute` config shape (which is consumed today by the Node-\n * shaped `executeRoute`).\n *\n * This is the entry-point T1.2 RED tests expect:\n *   `executeWebRequest(request: Request, routeModule: { GET?, POST?, ... }): Promise<Response>`\n *\n * Architecture per ADR-0028 (R3a) — this function accepts a native Web\n * `Request` and returns a native Web `Response`. No `node:*` is required in\n * the implementation (Zod + native Headers/URL/Response cover the surface).\n *\n * **Scope (intentionally narrow):**\n *   - Method dispatch (GET/POST/PUT/PATCH/DELETE).\n *   - Zod validation for `query` (from URL.searchParams), `body` (from\n *     request.json() OR request.text()), `params` (consumer-supplied OR\n *     parsed from path).\n *   - Handler invocation.\n *   - Result → JSON Response (200 default, 204 for void return).\n *   - Error → envelope-shaped JSON Response (400 for validation, 500 for\n *     handler throws) per G5 boundary translation (serverErrorToEnvelope).\n *\n * **NOT included (deferred to T5a.2 Phase B-G):**\n *   - Plugin runner integration (onRequest/preHandler/onResponse hooks).\n *   - CSRF / CORS / security headers / rate limiting / cookies / auth.\n *   - Middleware chain. SSR rendering. WebSocket upgrade. File upload.\n *   - File-system routing scan; consumer provides the route module\n *     explicitly (Web Request entry doesn't yet know about scan results).\n *\n * The narrow scope makes this a viable Phase A landing zone — turns the\n * 7 T1.2 RED tests GREEN without prematurely refactoring the full\n * IncomingMessage→Request boundary across server/http/ files.\n */\nimport type { z } from 'zod'\n\nimport { envelopeCodeToStatus } from '../core/contracts/envelope-code-to-status.js'\nimport type { TheoErrorEnvelope } from '../core/contracts/error-envelope.js'\nimport { serverErrorToEnvelope } from '../core/contracts/server-error-to-envelope.js'\nimport { TheoError } from '../core/contracts/theo-error.js'\n\nimport { isZodLike } from './http/execute-stages.js'\nimport { runWebMiddleware, type WebMiddleware } from './http/web-middleware-runner.js'\nimport type {\n  WebOnErrorHook,\n  WebOnRequestHook,\n  WebOnResponseHook,\n  WebPluginContext,\n  WebPluginErrorContext,\n  WebPreHandlerHook,\n} from './plugin-types.js'\nimport { validateCsrfRequest } from './security/csrf.js'\n\nexport type { WebMiddleware }\n\n/**\n * Minimal structural type for a `defineRoute` config. Mirrors\n * `core/contracts/route-config.ts` shape but only the fields this entry\n * point needs at runtime (Zod schemas + handler). Kept structural to\n * avoid a hard dep on the full RouteConfig generic chain.\n */\ninterface WebRouteHandlerConfig {\n  query?: z.ZodType\n  body?: z.ZodType\n  params?: z.ZodType\n  /** Optional Zod schema validating a plain-object handler return (D1/D2). */\n  response?: z.ZodType\n  /** Honored for plain-object returns to match the Node runner (D3). */\n  status?: number\n  handler: (ctx: {\n    query: unknown\n    body: unknown\n    params: unknown\n    request: Request\n    /** Mutable per-request context populated by the Web middleware chain (T3.2). */\n    context: Record<string, unknown>\n  }) => unknown\n}\n\n/**\n * The route module exported by a `server/routes/*.ts` file (after T2.6 G6\n * router lockdown). Method-named exports map to `defineRoute` results.\n */\ntype WebRouteModule = Partial<Record<'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', unknown>>\n\n/**\n * Coerce URL.searchParams into a plain `{ key: value }` object so Zod\n * `z.object({...})` schemas work without per-route adapters. Repeated keys\n * become arrays (most browsers serialize multi-select that way).\n */\nfunction searchParamsToObject(params: URLSearchParams): Record<string, string | string[]> {\n  const out: Record<string, string | string[]> = {}\n  for (const [key, value] of params.entries()) {\n    if (!Object.hasOwn(out, key)) {\n      out[key] = value\n      continue\n    }\n    const existing = out[key]\n    if (Array.isArray(existing)) {\n      existing.push(value)\n    } else {\n      out[key] = [existing, value]\n    }\n  }\n  return out\n}\n\n/**\n * Parse request body based on Content-Type. JSON is the canonical path;\n * empty body returns `undefined` (the handler treats as \"no body\").\n *\n * **Inline-only mode (default):** handles `application/json` and `text/*`.\n * Other content-types return `undefined`. Multipart/form-data requires\n * the opt-in `bodyParser: 'full'` mode (T5a.2 Phase E).\n */\nasync function parseBodyInline(request: Request): Promise<unknown> {\n  // GET/HEAD have no body by spec; even if the consumer sets one, ignore it\n  // (matches Web Request semantics — `body` is null for GET/HEAD anyway).\n  if (request.method === 'GET' || request.method === 'HEAD') return undefined\n  const contentType = request.headers.get('content-type') ?? ''\n  if (contentType.includes('application/json')) {\n    const text = await request.text()\n    if (text.length === 0) return undefined\n    try {\n      return JSON.parse(text)\n    } catch {\n      // Malformed JSON — return undefined; Zod schema (if any) will fail with\n      // a more useful \"required\" message than a raw SyntaxError.\n      return undefined\n    }\n  }\n  // text/plain or no body: return raw text or undefined\n  if (contentType.startsWith('text/')) {\n    const text = await request.text()\n    return text.length === 0 ? undefined : text\n  }\n  return undefined\n}\n\n/**\n * T5a.2 Phase E — \"full\" body parser delegating to `parseWebRequestBody`.\n * Returns a `ParsedWebBody` (`{ json?, fields, files }`) for JSON OR\n * multipart, or `undefined` when the body is empty / unparseable.\n *\n * Handler downstream pattern:\n *   `body?.json` (JSON requests)\n *   `body?.fields` + `body?.files` (multipart upload requests)\n *\n * Limits enforced by parseWebRequestBody:\n *   - declared Content-Length cap (default 10MB × maxFiles + 1MB margin)\n *   - per-file size cap (default 10MB)\n *   - max files (default 10)\n */\nasync function parseBodyFull(request: Request): Promise<unknown> {\n  if (request.method === 'GET' || request.method === 'HEAD') return undefined\n  const { parseWebRequestBody } = await import('./body-parser-web.js')\n  try {\n    const parsed = await parseWebRequestBody(request)\n    // If nothing parsed (empty body OR unhandled content-type), return undefined\n    // so Zod schemas treat it as missing — same semantics as inline parser.\n    if (\n      parsed.json === undefined &&\n      Object.keys(parsed.fields).length === 0 &&\n      parsed.files.length === 0\n    ) {\n      return undefined\n    }\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Build an envelope-shaped 400 Response for a Zod validation failure. Uses\n * the canonical `TheoErrorEnvelope` shape per G5 D3 (boundary translation).\n */\nfunction validationErrorResponse(zodError: z.ZodError, field: string): Response {\n  const envelope: TheoErrorEnvelope = {\n    code: 'BAD_REQUEST',\n    message: `Validation failed: ${field}`,\n    ext: {\n      fields: zodError.issues.map((issue) => ({\n        path: issue.path.join('.'),\n        message: issue.message,\n      })),\n    },\n  }\n  return new Response(JSON.stringify(envelope), {\n    status: 400,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\n/**\n * Run a `defineRoute` config against a parsed Web Request. Returns the raw\n * handler result; serialization to Response happens in the caller.\n *\n * Throws if Zod validation fails (caller catches and emits 400).\n */\nasync function runHandler(\n  config: WebRouteHandlerConfig,\n  request: Request,\n  bodyParser: 'inline' | 'full' = 'inline',\n  paramsInput: Record<string, string> = {},\n  context: Record<string, unknown> = {},\n): Promise<{ ok: true; result: unknown } | { ok: false; response: Response }> {\n  const url = new URL(request.url)\n  const queryRaw = searchParamsToObject(url.searchParams)\n  const bodyRaw =\n    bodyParser === 'full' ? await parseBodyFull(request) : await parseBodyInline(request)\n  // T3.1 — route params resolved upstream (matchRoute) and threaded via\n  // opts.params. Defaults to `{}` so callers that don't supply params keep the\n  // prior behavior (a route declaring config.params then fails validation).\n  const paramsRaw = paramsInput\n\n  // Validate input via Zod schemas when present.\n  let query: unknown = queryRaw\n  if (config.query !== undefined) {\n    const parsed = config.query.safeParse(queryRaw)\n    if (!parsed.success)\n      return { ok: false, response: validationErrorResponse(parsed.error, 'query') }\n    query = parsed.data\n  }\n  let body: unknown = bodyRaw\n  if (config.body !== undefined) {\n    const parsed = config.body.safeParse(bodyRaw)\n    if (!parsed.success)\n      return { ok: false, response: validationErrorResponse(parsed.error, 'body') }\n    body = parsed.data\n  }\n  let params: unknown = paramsRaw\n  if (config.params !== undefined) {\n    const parsed = config.params.safeParse(paramsRaw)\n    if (!parsed.success)\n      return { ok: false, response: validationErrorResponse(parsed.error, 'params') }\n    params = parsed.data\n  }\n\n  const result = await config.handler({ query, body, params, request, context })\n  return validateResponseOutput(config.response, result) ?? { ok: true, result }\n}\n\n/**\n * Validate a plain-object handler return against `config.response` (D1/D2). A\n * mismatch is a SERVER fault → 500 envelope. `Response`-instance returns and\n * `undefined`/`null` (→ 204) skip validation — parity with the Node runner,\n * which validates only in its plain-object branch. Returns `undefined` when no\n * validation applies (caller forwards the raw result).\n */\nfunction validateResponseOutput(\n  response: unknown,\n  result: unknown,\n): { ok: true; result: unknown } | { ok: false; response: Response } | undefined {\n  const validatable = result !== undefined && result !== null && !(result instanceof Response)\n  if (!validatable || !isZodLike(response)) return undefined\n  const parsed = response.safeParse(result)\n  if (parsed.success) return { ok: true, result: parsed.data }\n  const err = new TheoError({\n    code: 'INTERNAL_SERVER_ERROR',\n    message: 'response validation failed',\n    ext: { issues: parsed.error?.issues },\n  })\n  return { ok: false, response: handlerErrorResponse(err) }\n}\n\n/**\n * Serialize a handler return value into a native Web `Response`. Conventions:\n *   - `undefined` / `void` → 204 No Content.\n *   - existing `Response` instance → pass through unchanged.\n *   - everything else → 200 JSON.\n */\nfunction toResponse(result: unknown, status?: number): Response {\n  if (result === undefined) {\n    return new Response(null, { status: 204 })\n  }\n  if (result instanceof Response) {\n    return result\n  }\n  return new Response(JSON.stringify(result), {\n    status: status ?? 200,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\n/**\n * Build an envelope-shaped 500 Response when a handler throws. Uses\n * `serverErrorToEnvelope` so existing ad-hoc Error classes (AuthRequired,\n * FileTooLarge, etc.) get mapped to canonical envelope codes.\n */\nfunction handlerErrorResponse(err: unknown): Response {\n  const envelope = serverErrorToEnvelope(err)\n  // Map envelope code → HTTP status when possible. Default to 500 for\n  // INTERNAL_SERVER_ERROR. Other codes map per HTTP semantics.\n  const status = envelopeCodeToStatus(envelope.code)\n  return new Response(JSON.stringify(envelope), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\n// envelopeCodeToStatus extracted to core/contracts/envelope-code-to-status.ts\n// (architecture-remediation T1.2, 2026-06-12)\n\n/**\n * Optional behavior knobs for `executeWebRequest`. Each knob defaults to\n * the safe \"no-op\" stance so existing Phase A consumers (T1.2 fixture\n * tests) keep working unchanged.\n *\n * **`csrfMode`** (T5a.2 Phase B slice 1/6) — when set to `'strict'`, the\n * Web-Standards request gate runs `validateCsrfRequest` BEFORE method\n * dispatch on state-changing methods (POST/PUT/PATCH/DELETE) and emits a\n * `403 FORBIDDEN` envelope when the check fails. Default: `'off'` (no\n * CSRF enforcement) to preserve Phase A backward compat. Production\n * consumers SHOULD pass `csrfMode: 'strict'`.\n *\n * Per the T5a.2 plan v1.0 § Phase B header-only leaves: csrf.ts is the\n * first leaf to be migrated (slice 1/6); 5 more sibling leaves remain\n * (csrf-multi-header, csrf-readiness-endpoint, csp-report, cors, cookies).\n */\nexport interface ExecuteWebRequestOptions {\n  csrfMode?: 'off' | 'strict'\n  /**\n   * T3.1 — route params resolved upstream by `matchRoute` (e.g. `{ id: '42' }`\n   * for `/users/:id`). Threaded to the handler's `params` input and validated\n   * against `config.params` (Zod) when declared. Defaults to `{}` — callers\n   * that don't supply params keep the prior behavior (additive, backward-compat).\n   */\n  params?: Record<string, string>\n  /**\n   * T3.2 — Web-Standards middleware chain. Runs in order AFTER the CSRF gate\n   * (EC-3) and BEFORE the handler. A middleware returning a `Response`\n   * short-circuits (handler not reached); mutating `context` passes data to\n   * the handler. Omitted → zero overhead (handler runs directly).\n   */\n  middleware?: readonly WebMiddleware[]\n  /**\n   * T5a.2 Phase E — body parser strategy.\n   *\n   * - `'inline'` (default): handle `application/json` + `text/*` only.\n   *   Returns the parsed value (object for JSON, string for text). Other\n   *   content-types (e.g., multipart) return `undefined`.\n   * - `'full'`: delegate to `parseWebRequestBody` for multipart support\n   *   + per-file size caps + max-files cap (Web Standards `request.formData()`\n   *   under the hood). Returns a `ParsedWebBody` object:\n   *   `{ json?, fields, files }`. Multipart consumers MUST opt into this\n   *   mode; JSON-only routes pay zero cost staying on `'inline'`.\n   */\n  bodyParser?: 'inline' | 'full'\n  /**\n   * T5a.2 Phase G slice 1/N — plugin lifecycle hooks.\n   *\n   * Adapters (Node, CF Workers, Bun, Deno) wire `WebPluginContext`-shaped\n   * hooks at the executeWebRequest lifecycle. Lifecycle order mirrors the\n   * Fastify / Hono convention:\n   *\n   *   1. CSRF check (when opts.csrfMode === 'strict')\n   *   2. onRequest — earliest, before body parsing. Plugins can short-circuit\n   *      by setting `ctx.response` (handler skipped; subsequent hooks see\n   *      the short-circuit response).\n   *   3. body parse (inline OR full per opts.bodyParser)\n   *   4. preHandler — after body parsed, before handler runs. Same\n   *      short-circuit semantic.\n   *   5. handler invocation\n   *   6. onResponse — after handler returns OR after a hook short-circuit.\n   *      `ctx.response` is populated.\n   *   7. onError — fires if any of (handler, onRequest, preHandler) throws.\n   *      `ctx.response` is the envelope-shaped error response built via\n   *      serverErrorToEnvelope.\n   *\n   * `responseHeaders` is shared across hooks; the final Response merges\n   * them with the handler's Response headers (handler headers win on\n   * conflict; hook headers add new ones). Decorations made via\n   * `ctx.ctx[key] = value` persist across hooks (request-scoped state).\n   *\n   * `hooks: undefined` (default) → no plugin lifecycle, Phase A behavior\n   * preserved. Production consumers wire via the WebPluginRunner facade\n   * (a future Phase G slice).\n   */\n  hooks?: {\n    onRequest?: readonly WebOnRequestHook[]\n    preHandler?: readonly WebPreHandlerHook[]\n    onResponse?: readonly WebOnResponseHook[]\n    onError?: readonly WebOnErrorHook[]\n  }\n  /**\n   * Stable request identifier propagated into hook contexts. Adapters\n   * resolve via traceparent / x-request-id / generated UUID (see\n   * `extractTraceIdFromRequest` from Phase C slice 1/2). Default:\n   * `globalThis.crypto.randomUUID()`.\n   */\n  requestId?: string\n}\n\n/**\n * Methods that require CSRF enforcement when `csrfMode: 'strict'`. GET\n * and HEAD are read-only per HTTP semantics and bypass CSRF (the threat\n * model is state-changing requests forged via cross-origin POSTs); OPTIONS\n * is the CORS preflight and also bypasses.\n */\nexport const CSRF_PROTECTED_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])\n\n/**\n * Web-Standards entry-point for executing a route module against a native\n * Web `Request`. Returns a native Web `Response`.\n *\n * Method dispatch: looks up the handler keyed by `request.method`\n * (uppercase). Returns 405 if the method isn't exported.\n *\n * @example\n * import * as users from './app/users/route.js'\n * import { executeWebRequest } from 'theokit/server'\n *\n * const response = await executeWebRequest(\n *   new Request('http://localhost/api/users', { method: 'GET' }),\n *   users,\n *   { csrfMode: 'strict' },\n * )\n */\n/**\n * T5a.2 Phase G slice 1/N — merge hook-mutated response headers into the\n * handler's Response. Handler-set headers win on conflict (the handler\n * has the most context about its own response); hook headers add new\n * entries (e.g., CORS, Set-Cookie). Returns a new Response with the\n * merged headers + same body/status as the source.\n *\n * Set-Cookie is multi-value at the Web spec layer — `getSetCookie()` is\n * the only way to retrieve multiple values. The merge appends ALL hook-\n * set Set-Cookie values to the response (multiple Set-Cookie headers is\n * spec-correct and how browsers expect cookie issuance).\n */\nfunction mergeHookHeaders(response: Response, hookHeaders: Headers): Response {\n  if ([...hookHeaders].length === 0) return response\n  const merged = new Headers(response.headers)\n  for (const [k, v] of hookHeaders.entries()) {\n    if (k.toLowerCase() === 'set-cookie') continue // handled separately\n    if (!merged.has(k)) merged.set(k, v)\n  }\n  for (const sc of hookHeaders.getSetCookie()) {\n    merged.append('Set-Cookie', sc)\n  }\n  return new Response(response.body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers: merged,\n  })\n}\n\n/** Build a 405 envelope Response. */\nfunction methodNotAllowedResponse(method: string): Response {\n  const envelope: TheoErrorEnvelope = {\n    code: 'METHOD_NOT_ALLOWED',\n    message: `Method ${method} not allowed`,\n  }\n  return new Response(JSON.stringify(envelope), {\n    status: 405,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\n/** Build a 403 CSRF envelope Response. */\nfunction csrfFailedResponse(reason: string): Response {\n  const envelope: TheoErrorEnvelope = {\n    code: 'FORBIDDEN',\n    message: `CSRF check failed: ${reason}`,\n  }\n  return new Response(JSON.stringify(envelope), {\n    status: 403,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\nexport async function executeWebRequest(\n  request: Request,\n  routeModule: WebRouteModule,\n  opts: ExecuteWebRequestOptions = {},\n): Promise<Response> {\n  const method = request.method.toUpperCase() as keyof WebRouteModule\n  const config = routeModule[method] as WebRouteHandlerConfig | undefined\n\n  // T5a.2 Phase G slice 1/N — plugin lifecycle hooks.\n  // When opts.hooks is undefined, skip the entire hook orchestration to\n  // preserve Phase A backward compat (zero overhead for consumers not\n  // wiring hooks). In the no-hooks branch, dispatch + CSRF gates run\n  // FIRST and 405 short-circuits before the handler runs.\n  if (opts.hooks === undefined) {\n    if (config === undefined || typeof config.handler !== 'function') {\n      return methodNotAllowedResponse(method)\n    }\n    if (opts.csrfMode === 'strict' && CSRF_PROTECTED_METHODS.has(method)) {\n      const csrfCheck = validateCsrfRequest(request)\n      if (!csrfCheck.valid) return csrfFailedResponse(csrfCheck.reason)\n    }\n    try {\n      // T3.2 — middleware runs AFTER the CSRF gate (EC-3), BEFORE the handler.\n      const context: Record<string, unknown> = {}\n      if (opts.middleware?.length) {\n        const shortCircuit = await runWebMiddleware(request, opts.middleware, context)\n        if (shortCircuit) return shortCircuit\n      }\n      const outcome = await runHandler(\n        config,\n        request,\n        opts.bodyParser ?? 'inline',\n        opts.params ?? {},\n        context,\n      )\n      if (!outcome.ok) return outcome.response\n      return toResponse(outcome.result, config.status)\n    } catch (err) {\n      return handlerErrorResponse(err)\n    }\n  }\n\n  // With hooks: onRequest hooks run BEFORE method dispatch (Hono /\n  // Fastify convention) so CORS preflight plugins can intercept OPTIONS\n  // requests regardless of route shape. If no hook short-circuits, then\n  // 405 fires when the method isn't exported by the route module.\n  return runWithHooks(request, config, opts, opts.hooks)\n}\n\n/**\n * Run the request through the full plugin lifecycle. Extracted to keep\n * `executeWebRequest`'s cyclomatic + cognitive complexity under the lint\n * caps (15/20). Pure side-effect surface — same return type as the\n * no-hooks branch.\n */\n/**\n * Pre-handler pipeline: onRequest hooks → CSRF gate → preHandler hooks →\n * method dispatch + handler. Mutates `hookCtx.response` on short-circuit\n * OR on handler completion. Extracted from `runWithHooks` to keep the\n * latter's cyclomatic complexity under the lint cap (15).\n */\nasync function runPreHandlerPipeline(\n  hookCtx: WebPluginContext,\n  request: Request,\n  config: WebRouteHandlerConfig | undefined,\n  opts: ExecuteWebRequestOptions,\n  hooks: NonNullable<ExecuteWebRequestOptions['hooks']>,\n): Promise<void> {\n  const method = request.method.toUpperCase()\n  const runList = async (list: readonly WebOnRequestHook[]): Promise<void> => {\n    for (const hook of list) {\n      if (hookCtx.response !== undefined) return\n      await hook(hookCtx)\n    }\n  }\n  // onRequest first (CORS preflight + auth gate intercept before dispatch).\n  if (hooks.onRequest) await runList(hooks.onRequest)\n  // CSRF gate AFTER onRequest (auth-short-circuit avoids CSRF cost) but\n  // BEFORE the handler.\n  if (\n    hookCtx.response === undefined &&\n    opts.csrfMode === 'strict' &&\n    CSRF_PROTECTED_METHODS.has(method)\n  ) {\n    const csrfCheck = validateCsrfRequest(request)\n    if (!csrfCheck.valid) hookCtx.response = csrfFailedResponse(csrfCheck.reason)\n  }\n  if (hookCtx.response === undefined && hooks.preHandler) {\n    await runList(hooks.preHandler)\n  }\n  if (hookCtx.response === undefined) {\n    await runHandlerStage(hookCtx, request, config, opts, method)\n  }\n}\n\n/**\n * T3.2 — the middleware + handler stage of the hook pipeline. Extracted from\n * `runPreHandlerPipeline` to keep its cyclomatic complexity under the lint cap.\n * Order: 405 check → user middleware (after CSRF + preHandler) → handler.\n */\nasync function runHandlerStage(\n  hookCtx: WebPluginContext,\n  request: Request,\n  config: WebRouteHandlerConfig | undefined,\n  opts: ExecuteWebRequestOptions,\n  method: string,\n): Promise<void> {\n  // 405 if route module doesn't export this method.\n  if (config === undefined || typeof config.handler !== 'function') {\n    hookCtx.response = methodNotAllowedResponse(method)\n    return\n  }\n  // hookCtx.ctx is the shared per-request context the middleware mutates.\n  if (opts.middleware?.length) {\n    const shortCircuit = await runWebMiddleware(request, opts.middleware, hookCtx.ctx)\n    if (shortCircuit) {\n      hookCtx.response = shortCircuit\n      return\n    }\n  }\n  const outcome = await runHandler(\n    config,\n    request,\n    opts.bodyParser ?? 'inline',\n    opts.params ?? {},\n    hookCtx.ctx,\n  )\n  hookCtx.response = outcome.ok ? toResponse(outcome.result, config.status) : outcome.response\n}\n\nasync function runWithHooks(\n  request: Request,\n  config: WebRouteHandlerConfig | undefined,\n  opts: ExecuteWebRequestOptions,\n  hooks: NonNullable<ExecuteWebRequestOptions['hooks']>,\n): Promise<Response> {\n  const hookCtx: WebPluginContext = {\n    request,\n    responseHeaders: new Headers(),\n    ctx: {},\n    requestId: opts.requestId ?? globalThis.crypto.randomUUID(),\n  }\n  try {\n    await runPreHandlerPipeline(hookCtx, request, config, opts, hooks)\n    if (hooks.onResponse) {\n      for (const hook of hooks.onResponse) {\n        await hook(hookCtx)\n      }\n    }\n    // runPreHandlerPipeline guarantees hookCtx.response is set (via either\n    // a hook short-circuit OR handler outcome OR 405). TS doesn't infer this\n    // post-mutation; the assertion is safe per the function's contract.\n    const finalResponse =\n      hookCtx.response ??\n      new Response(\n        JSON.stringify({ code: 'INTERNAL_SERVER_ERROR', message: 'No response built' }),\n        {\n          status: 500,\n          headers: { 'content-type': 'application/json' },\n        },\n      )\n    return mergeHookHeaders(finalResponse, hookCtx.responseHeaders)\n  } catch (err) {\n    return runErrorHooks(err, hookCtx, hooks.onError)\n  }\n}\n\n/**\n * Run onError hooks against an envelope-shaped error response. EC-9 —\n * each hook throw is swallowed to avoid error-in-error-handler recursion.\n * Returns the merged final Response.\n */\nasync function runErrorHooks(\n  err: unknown,\n  hookCtx: WebPluginContext,\n  onError: readonly WebOnErrorHook[] | undefined,\n): Promise<Response> {\n  const errorResponse = handlerErrorResponse(err)\n  if (onError !== undefined) {\n    const errorCtx: WebPluginErrorContext = {\n      ...hookCtx,\n      response: errorResponse,\n      error: err,\n    }\n    for (const hook of onError) {\n      try {\n        await hook(errorCtx)\n      } catch {\n        // EC-9: error in error handler — swallow to avoid recursion.\n      }\n    }\n  }\n  return mergeHookHeaders(errorResponse, hookCtx.responseHeaders)\n}\n","/**\n * M16 (theokit-ai-first) — serve an agent as an MCP server over HTTP at `/api/agents/<name>/mcp`.\n *\n * Answers the two core MCP methods over JSON-RPC 2.0: `initialize` (server info + capabilities) and\n * `tools/list` (the agent's tools as MCP descriptors, via `buildMcpToolDescriptors`). M30 adds\n * `resources/list` + `resources/read` for `ui://` App resources. Unknown methods return `-32601`\n * (method not found). Web Standards Response (G8). The stdio transport + full method set stay\n * SDK-side (sdk-runtime.md); this exposes the agent over the app's own HTTP route.\n */\nimport {\n  type AgentManifestEntry,\n  buildMcpToolDescriptors,\n  compileAgentModule,\n  mcpServerInfo,\n} from '@theokit/agents'\n\nimport { type AppResource, buildResourceDescriptors, readAppResource } from './mcp-app-resources.js'\n\nconst MCP_PATH = /^\\/api\\/agents\\/([^/]+)\\/mcp$/\n\n/** Return the agent name when `urlPath` is the MCP endpoint, else `null`. */\nexport function isMcpPath(urlPath: string): string | null {\n  const match = MCP_PATH.exec(urlPath)\n  return match ? decodeURIComponent(match[1]) : null\n}\n\ninterface JsonRpcRequest {\n  jsonrpc: '2.0'\n  id: number | string | null\n  method: string\n  params?: unknown\n}\n\nfunction isJsonRpcRequest(body: unknown): body is JsonRpcRequest {\n  return (\n    typeof body === 'object' &&\n    body !== null &&\n    (body as { jsonrpc?: unknown }).jsonrpc === '2.0' &&\n    typeof (body as { method?: unknown }).method === 'string'\n  )\n}\n\nfunction jsonResponse(payload: unknown): Response {\n  return new Response(JSON.stringify(payload), {\n    status: 200,\n    headers: { 'content-type': 'application/json; charset=utf-8' },\n  })\n}\n\n/** Minimal manifest entry (the subset the MCP generators read) from a compiled agent. */\nfunction toEntry(name: string, mod: unknown): AgentManifestEntry {\n  const compiled = compileAgentModule(mod, `mcp server for \"${name}\"`)\n  return {\n    name,\n    route: `/api/agents/${name}`,\n    stream: compiled.stream,\n    mainLoop: { method: '', strategy: '' },\n    guards: [],\n    interceptors: [],\n    tools: compiled.tools.map((t) => ({\n      name: t.name,\n      description: t.description,\n      approval: false,\n      trace: false,\n      audit: false,\n    })),\n    subAgents: [],\n  }\n}\n\n/**\n * Handle one MCP JSON-RPC request for an agent module. Always returns a 200 JSON-RPC envelope.\n *\n * M30 — `appResources` (optional) are the agent's declared `ui://` App resources; when present the\n * server advertises `capabilities.resources` and answers `resources/list` + `resources/read`.\n */\nexport function handleMcpJsonRpc(\n  mod: unknown,\n  name: string,\n  body: unknown,\n  appResources: readonly AppResource[] = [],\n): Response {\n  if (!isJsonRpcRequest(body)) {\n    return jsonResponse({\n      jsonrpc: '2.0',\n      id: null,\n      error: { code: -32600, message: 'Invalid Request' },\n    })\n  }\n  const { id, method, params } = body\n  try {\n    const entry = toEntry(name, mod)\n    if (method === 'initialize') {\n      const info = mcpServerInfo(entry)\n      const capabilities: Record<string, unknown> = { tools: {} }\n      if (appResources.length > 0) capabilities.resources = {}\n      return jsonResponse({\n        jsonrpc: '2.0',\n        id,\n        result: {\n          protocolVersion: info.protocolVersion,\n          capabilities,\n          serverInfo: { name: info.name, version: info.version },\n        },\n      })\n    }\n    if (method === 'tools/list') {\n      return jsonResponse({ jsonrpc: '2.0', id, result: { tools: buildMcpToolDescriptors(entry) } })\n    }\n    if (method === 'resources/list') {\n      return jsonResponse({\n        jsonrpc: '2.0',\n        id,\n        result: { resources: buildResourceDescriptors(appResources) },\n      })\n    }\n    if (method === 'resources/read') {\n      const uri = (params as { uri?: unknown } | undefined)?.uri\n      if (typeof uri !== 'string') {\n        return jsonResponse({\n          jsonrpc: '2.0',\n          id,\n          error: { code: -32602, message: 'resources/read requires a string `uri` param.' },\n        })\n      }\n      const contents = readAppResource(appResources, uri)\n      if (contents === null) {\n        return jsonResponse({\n          jsonrpc: '2.0',\n          id,\n          error: { code: -32602, message: `Resource not found: ${uri}` },\n        })\n      }\n      return jsonResponse({ jsonrpc: '2.0', id, result: contents })\n    }\n    return jsonResponse({\n      jsonrpc: '2.0',\n      id,\n      error: { code: -32601, message: `Method not found: ${method}` },\n    })\n  } catch (err) {\n    return jsonResponse({\n      jsonrpc: '2.0',\n      id,\n      error: { code: -32603, message: err instanceof Error ? err.message : 'Internal error' },\n    })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAoBA,SAAS,WAAW,cAAc,cAAc,gBAAgB;AAChE,SAAS,eAAe;AAExB,OAAO,YAAY;AACnB,SAAS,cAAwC;AAKjD,IAAM,qBAAqB;AAE3B,IAAM,QAAQ,oBAAI,IAA2B;AAGtC,SAAS,iBAAuB;AACrC,QAAM,MAAM;AACd;AAEA,SAAS,wBAAwB,MAAwB;AAGvD,QAAM,QAAQ,CAAC,QAAQ,IAAI,UAAU,cAAc,QAAQ,IAAI,IAAI,MAAM;AAGzE,MAAI,SAAS,QAAQ;AACnB,WAAO,MAAM,OAAO,CAAC,MAAM,MAAM,YAAY;AAAA,EAC/C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAA6C;AAChE,MAAI;AACJ,MAAI;AACF,WAAO,SAAS,IAAI;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AAGA,MAAI,CAAC,KAAK,OAAO,KAAK,CAAC,KAAK,OAAO,EAAG,QAAO;AAG7C,MAAI,KAAK,OAAO,oBAAoB;AAClC,YAAQ;AAAA,MACN,0BAA0B,IAAI,YAAY,kBAAkB;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAGA,MAAI;AACF,UAAM,QAAQ,UAAU,IAAI;AAC5B,QAAI,MAAM,eAAe,GAAG;AAC1B,YAAM,OAAO,aAAa,IAAI;AAE9B,cAAQ,KAAK,qBAAqB,IAAI,wBAAmB,IAAI,EAAE;AAAA,IACjE;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,UAAU,aAAa,MAAM,OAAO;AAC1C,WAAO,OAAO,MAAM,OAAO;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,QAAQ,UAA0B,CAAC,GAAkB;AACnE,QAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACvC,QAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI,YAAY;AACrD,QAAM,WAAW,GAAG,GAAG,IAAI,IAAI;AAE/B,MAAI,CAAC,QAAQ,aAAa;AACxB,UAAM,SAAS,MAAM,IAAI,QAAQ;AACjC,QAAI,OAAQ,QAAO;AAAA,EACrB;AAEA,QAAM,YAAY,wBAAwB,IAAI;AAC9C,QAAM,YAAY,UAAU,IAAI,CAAC,MAAM,QAAQ,KAAK,CAAC,CAAC;AAItD,QAAM,SAAiC,CAAC;AACxC,QAAM,kBAA4B,CAAC;AACnC,aAAW,QAAQ,CAAC,GAAG,SAAS,EAAE,QAAQ,GAAG;AAC3C,UAAM,SAAS,YAAY,IAAI;AAC/B,QAAI,WAAW,KAAM;AACrB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,aAAO,CAAC,IAAI;AAAA,IACd;AACA,oBAAgB,QAAQ,IAAI;AAAA,EAC9B;AAGA,MAAI,OAAO,YAAY,QAAQ,IAAI,4BAA4B,QAAW;AACxE,YAAQ,IAAI,0BAA0B,OAAO;AAAA,EAC/C;AACA,SAAO,OAAO;AAOd,QAAM,kBAAuC,CAAC;AAC9C,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAChD,QAAI,OAAO,MAAM,SAAU,iBAAgB,CAAC,IAAI;AAAA,EAClD;AACA,MAAI;AACF,WAAO,EAAE,QAAQ,QAAQ,YAAY,gBAAgB,CAAC;AAAA,EACxD,SAAS,KAAK;AACZ,QAAI,eAAe,YAAY;AAC7B,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM;AAAA,IACR;AAAA,EACF;AAGA,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,QAAI,QAAQ,IAAI,CAAC,MAAM,OAAW;AAClC,YAAQ,IAAI,CAAC,IAAI;AACjB,WAAO,CAAC,IAAI;AAAA,EACd;AAGA,UAAQ,IAAI,0BAA0B;AAEtC,QAAM,SAAwB,EAAE,QAAQ,gBAAgB;AACxD,QAAM,IAAI,UAAU,MAAM;AAC1B,SAAO;AACT;;;AC7JA,OAAO,eAAe;AAef,IAAM,uBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,WAAW,CAAC,MAAM,KAAK,UAAU,UAAU,UAAU,CAAC,CAAC;AAAA,EACvD,aAAa,CAAC,QAAQ;AACpB,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,WAAO,UAAU,YAAY,MAAM;AAAA,EACrC;AACF;AAEO,IAAM,kBAAmC;AAAA,EAC9C,MAAM;AAAA,EACN,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC;AAAA,EAClC,aAAa,CAAC,QAAQ,KAAK,MAAM,GAAG;AACtC;AAEA,IAAM,YAA6C;AAAA,EACjD,WAAW;AAAA,EACX,MAAM;AACR;AAEO,SAAS,mBACd,UACiB;AACjB,MAAI,OAAO,aAAa,UAAU;AAMhC,UAAM,QAAQ,UAAU,QAAQ;AAIhC,QAAK,UAA0C,QAAW;AACxD,YAAM,IAAI;AAAA,QACR,wBAAwB,QAAQ,wBAAwB,OAAO,KAAK,SAAS,EAAE,KAAK,IAAI,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MACE,OAAO,aAAa,YACpB,OAAO,SAAS,cAAc,cAC9B,OAAO,SAAS,gBAAgB,YAChC;AACA,UAAM,IAAI;AAAA,MACR,0EAA0E,KAAK,UAAU,QAAQ,CAAC;AAAA,IACpG;AAAA,EACF;AACA,SAAO;AACT;;;AClBO,SAAS,kBAAkB,OAAsC;AACtE,MAAI,CAAC,MAAM,IAAI,WAAW,OAAO,GAAG;AAClC,UAAM,IAAI;AAAA,MACR,+EAA+E,KAAK,UAAU,MAAM,GAAG,CAAC;AAAA,IAC1G;AAAA,EACF;AACA,MAAI,MAAM,KAAK,WAAW,GAAG;AAC3B,UAAM,IAAI,MAAM,qBAAqB,KAAK,UAAU,MAAM,GAAG,CAAC,4BAA4B;AAAA,EAC5F;AACA,SAAO;AAAA,IACL,KAAK,MAAM;AAAA,IACX,MAAM,MAAM;AAAA,IACZ,UAAU;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,EAC9E;AACF;AAGO,SAAS,yBACd,WACyB;AACzB,SAAO,UAAU,IAAI,CAAC,OAAO;AAAA,IAC3B,KAAK,EAAE;AAAA,IACP,MAAM,EAAE;AAAA,IACR,UAAU,EAAE;AAAA,IACZ,GAAI,EAAE,gBAAgB,SAAY,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC;AAAA,EACtE,EAAE;AACJ;AAGO,SAAS,gBACd,WACA,KAC4B;AAC5B,QAAM,QAAQ,UAAU,KAAK,CAAC,MAAM,EAAE,QAAQ,GAAG;AACjD,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,EAAE,UAAU,CAAC,EAAE,KAAK,MAAM,KAAK,UAAU,aAAa,MAAM,MAAM,KAAK,CAAC,EAAE;AACnF;AAGA,SAAS,cAAc,GAA8B;AACnD,MAAI,OAAO,MAAM,YAAY,MAAM,KAAM,QAAO;AAChD,QAAM,IAAI;AACV,SACE,OAAO,EAAE,QAAQ,YACjB,EAAE,IAAI,WAAW,OAAO,KACxB,EAAE,aAAa,eACf,OAAO,EAAE,SAAS;AAEtB;AASO,SAAS,oBAAoB,KAA6B;AAC/D,QAAM,MAAO,KAAuD;AACpE,MAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AACjC,SAAO,IAAI,OAAO,aAAa;AACjC;;;AC3EA,eAAsB,iBACpB,SACA,YACA,SAC+B;AAC/B,aAAW,MAAM,YAAY;AAC3B,UAAM,SAAS,MAAM,GAAG,SAAS,OAAO;AACxC,QAAI,kBAAkB,SAAU,QAAO;AAAA,EACzC;AACA,SAAO;AACT;;;AC+CA,SAAS,qBAAqB,QAA4D;AACxF,QAAM,MAAyC,CAAC;AAChD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG;AAC3C,QAAI,CAAC,OAAO,OAAO,KAAK,GAAG,GAAG;AAC5B,UAAI,GAAG,IAAI;AACX;AAAA,IACF;AACA,UAAM,WAAW,IAAI,GAAG;AACxB,QAAI,MAAM,QAAQ,QAAQ,GAAG;AAC3B,eAAS,KAAK,KAAK;AAAA,IACrB,OAAO;AACL,UAAI,GAAG,IAAI,CAAC,UAAU,KAAK;AAAA,IAC7B;AAAA,EACF;AACA,SAAO;AACT;AAUA,eAAe,gBAAgB,SAAoC;AAGjE,MAAI,QAAQ,WAAW,SAAS,QAAQ,WAAW,OAAQ,QAAO;AAClE,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,MAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,QAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AAGN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,YAAY,WAAW,OAAO,GAAG;AACnC,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,WAAO,KAAK,WAAW,IAAI,SAAY;AAAA,EACzC;AACA,SAAO;AACT;AAgBA,eAAe,cAAc,SAAoC;AAC/D,MAAI,QAAQ,WAAW,SAAS,QAAQ,WAAW,OAAQ,QAAO;AAClE,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,+BAAsB;AACnE,MAAI;AACF,UAAM,SAAS,MAAM,oBAAoB,OAAO;AAGhD,QACE,OAAO,SAAS,UAChB,OAAO,KAAK,OAAO,MAAM,EAAE,WAAW,KACtC,OAAO,MAAM,WAAW,GACxB;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,SAAS,wBAAwB,UAAsB,OAAyB;AAC9E,QAAM,WAA8B;AAAA,IAClC,MAAM;AAAA,IACN,SAAS,sBAAsB,KAAK;AAAA,IACpC,KAAK;AAAA,MACH,QAAQ,SAAS,OAAO,IAAI,CAAC,WAAW;AAAA,QACtC,MAAM,MAAM,KAAK,KAAK,GAAG;AAAA,QACzB,SAAS,MAAM;AAAA,MACjB,EAAE;AAAA,IACJ;AAAA,EACF;AACA,SAAO,IAAI,SAAS,KAAK,UAAU,QAAQ,GAAG;AAAA,IAC5C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAQA,eAAe,WACb,QACA,SACA,aAAgC,UAChC,cAAsC,CAAC,GACvC,UAAmC,CAAC,GACwC;AAC5E,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,WAAW,qBAAqB,IAAI,YAAY;AACtD,QAAM,UACJ,eAAe,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,gBAAgB,OAAO;AAItF,QAAM,YAAY;AAGlB,MAAI,QAAiB;AACrB,MAAI,OAAO,UAAU,QAAW;AAC9B,UAAM,SAAS,OAAO,MAAM,UAAU,QAAQ;AAC9C,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,IAAI,OAAO,UAAU,wBAAwB,OAAO,OAAO,OAAO,EAAE;AAC/E,YAAQ,OAAO;AAAA,EACjB;AACA,MAAI,OAAgB;AACpB,MAAI,OAAO,SAAS,QAAW;AAC7B,UAAM,SAAS,OAAO,KAAK,UAAU,OAAO;AAC5C,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,IAAI,OAAO,UAAU,wBAAwB,OAAO,OAAO,MAAM,EAAE;AAC9E,WAAO,OAAO;AAAA,EAChB;AACA,MAAI,SAAkB;AACtB,MAAI,OAAO,WAAW,QAAW;AAC/B,UAAM,SAAS,OAAO,OAAO,UAAU,SAAS;AAChD,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,IAAI,OAAO,UAAU,wBAAwB,OAAO,OAAO,QAAQ,EAAE;AAChF,aAAS,OAAO;AAAA,EAClB;AAEA,QAAM,SAAS,MAAM,OAAO,QAAQ,EAAE,OAAO,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAC7E,SAAO,uBAAuB,OAAO,UAAU,MAAM,KAAK,EAAE,IAAI,MAAM,OAAO;AAC/E;AASA,SAAS,uBACP,UACA,QAC+E;AAC/E,QAAM,cAAc,WAAW,UAAa,WAAW,QAAQ,EAAE,kBAAkB;AACnF,MAAI,CAAC,eAAe,CAAC,UAAU,QAAQ,EAAG,QAAO;AACjD,QAAM,SAAS,SAAS,UAAU,MAAM;AACxC,MAAI,OAAO,QAAS,QAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,KAAK;AAC3D,QAAM,MAAM,IAAI,UAAU;AAAA,IACxB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,KAAK,EAAE,QAAQ,OAAO,OAAO,OAAO;AAAA,EACtC,CAAC;AACD,SAAO,EAAE,IAAI,OAAO,UAAU,qBAAqB,GAAG,EAAE;AAC1D;AAQA,SAAS,WAAW,QAAiB,QAA2B;AAC9D,MAAI,WAAW,QAAW;AACxB,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AACA,MAAI,kBAAkB,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO,IAAI,SAAS,KAAK,UAAU,MAAM,GAAG;AAAA,IAC1C,QAAQ,UAAU;AAAA,IAClB,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAOA,SAAS,qBAAqB,KAAwB;AACpD,QAAM,WAAW,sBAAsB,GAAG;AAG1C,QAAM,SAAS,qBAAqB,SAAS,IAAI;AACjD,SAAO,IAAI,SAAS,KAAK,UAAU,QAAQ,GAAG;AAAA,IAC5C;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAqGO,IAAM,yBAAyB,oBAAI,IAAI,CAAC,QAAQ,OAAO,SAAS,QAAQ,CAAC;AA+BhF,SAAS,iBAAiB,UAAoB,aAAgC;AAC5E,MAAI,CAAC,GAAG,WAAW,EAAE,WAAW,EAAG,QAAO;AAC1C,QAAM,SAAS,IAAI,QAAQ,SAAS,OAAO;AAC3C,aAAW,CAAC,GAAG,CAAC,KAAK,YAAY,QAAQ,GAAG;AAC1C,QAAI,EAAE,YAAY,MAAM,aAAc;AACtC,QAAI,CAAC,OAAO,IAAI,CAAC,EAAG,QAAO,IAAI,GAAG,CAAC;AAAA,EACrC;AACA,aAAW,MAAM,YAAY,aAAa,GAAG;AAC3C,WAAO,OAAO,cAAc,EAAE;AAAA,EAChC;AACA,SAAO,IAAI,SAAS,SAAS,MAAM;AAAA,IACjC,QAAQ,SAAS;AAAA,IACjB,YAAY,SAAS;AAAA,IACrB,SAAS;AAAA,EACX,CAAC;AACH;AAGA,SAAS,yBAAyB,QAA0B;AAC1D,QAAM,WAA8B;AAAA,IAClC,MAAM;AAAA,IACN,SAAS,UAAU,MAAM;AAAA,EAC3B;AACA,SAAO,IAAI,SAAS,KAAK,UAAU,QAAQ,GAAG;AAAA,IAC5C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAGA,SAAS,mBAAmB,QAA0B;AACpD,QAAM,WAA8B;AAAA,IAClC,MAAM;AAAA,IACN,SAAS,sBAAsB,MAAM;AAAA,EACvC;AACA,SAAO,IAAI,SAAS,KAAK,UAAU,QAAQ,GAAG;AAAA,IAC5C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAEA,eAAsB,kBACpB,SACA,aACA,OAAiC,CAAC,GACf;AACnB,QAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,QAAM,SAAS,YAAY,MAAM;AAOjC,MAAI,KAAK,UAAU,QAAW;AAC5B,QAAI,WAAW,UAAa,OAAO,OAAO,YAAY,YAAY;AAChE,aAAO,yBAAyB,MAAM;AAAA,IACxC;AACA,QAAI,KAAK,aAAa,YAAY,uBAAuB,IAAI,MAAM,GAAG;AACpE,YAAM,YAAY,oBAAoB,OAAO;AAC7C,UAAI,CAAC,UAAU,MAAO,QAAO,mBAAmB,UAAU,MAAM;AAAA,IAClE;AACA,QAAI;AAEF,YAAM,UAAmC,CAAC;AAC1C,UAAI,KAAK,YAAY,QAAQ;AAC3B,cAAM,eAAe,MAAM,iBAAiB,SAAS,KAAK,YAAY,OAAO;AAC7E,YAAI,aAAc,QAAO;AAAA,MAC3B;AACA,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,QACA,KAAK,cAAc;AAAA,QACnB,KAAK,UAAU,CAAC;AAAA,QAChB;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,aAAO,WAAW,QAAQ,QAAQ,OAAO,MAAM;AAAA,IACjD,SAAS,KAAK;AACZ,aAAO,qBAAqB,GAAG;AAAA,IACjC;AAAA,EACF;AAMA,SAAO,aAAa,SAAS,QAAQ,MAAM,KAAK,KAAK;AACvD;AAcA,eAAe,sBACb,SACA,SACA,QACA,MACA,OACe;AACf,QAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,QAAM,UAAU,OAAO,SAAqD;AAC1E,eAAW,QAAQ,MAAM;AACvB,UAAI,QAAQ,aAAa,OAAW;AACpC,YAAM,KAAK,OAAO;AAAA,IACpB;AAAA,EACF;AAEA,MAAI,MAAM,UAAW,OAAM,QAAQ,MAAM,SAAS;AAGlD,MACE,QAAQ,aAAa,UACrB,KAAK,aAAa,YAClB,uBAAuB,IAAI,MAAM,GACjC;AACA,UAAM,YAAY,oBAAoB,OAAO;AAC7C,QAAI,CAAC,UAAU,MAAO,SAAQ,WAAW,mBAAmB,UAAU,MAAM;AAAA,EAC9E;AACA,MAAI,QAAQ,aAAa,UAAa,MAAM,YAAY;AACtD,UAAM,QAAQ,MAAM,UAAU;AAAA,EAChC;AACA,MAAI,QAAQ,aAAa,QAAW;AAClC,UAAM,gBAAgB,SAAS,SAAS,QAAQ,MAAM,MAAM;AAAA,EAC9D;AACF;AAOA,eAAe,gBACb,SACA,SACA,QACA,MACA,QACe;AAEf,MAAI,WAAW,UAAa,OAAO,OAAO,YAAY,YAAY;AAChE,YAAQ,WAAW,yBAAyB,MAAM;AAClD;AAAA,EACF;AAEA,MAAI,KAAK,YAAY,QAAQ;AAC3B,UAAM,eAAe,MAAM,iBAAiB,SAAS,KAAK,YAAY,QAAQ,GAAG;AACjF,QAAI,cAAc;AAChB,cAAQ,WAAW;AACnB;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,KAAK,cAAc;AAAA,IACnB,KAAK,UAAU,CAAC;AAAA,IAChB,QAAQ;AAAA,EACV;AACA,UAAQ,WAAW,QAAQ,KAAK,WAAW,QAAQ,QAAQ,OAAO,MAAM,IAAI,QAAQ;AACtF;AAEA,eAAe,aACb,SACA,QACA,MACA,OACmB;AACnB,QAAM,UAA4B;AAAA,IAChC;AAAA,IACA,iBAAiB,IAAI,QAAQ;AAAA,IAC7B,KAAK,CAAC;AAAA,IACN,WAAW,KAAK,aAAa,WAAW,OAAO,WAAW;AAAA,EAC5D;AACA,MAAI;AACF,UAAM,sBAAsB,SAAS,SAAS,QAAQ,MAAM,KAAK;AACjE,QAAI,MAAM,YAAY;AACpB,iBAAW,QAAQ,MAAM,YAAY;AACnC,cAAM,KAAK,OAAO;AAAA,MACpB;AAAA,IACF;AAIA,UAAM,gBACJ,QAAQ,YACR,IAAI;AAAA,MACF,KAAK,UAAU,EAAE,MAAM,yBAAyB,SAAS,oBAAoB,CAAC;AAAA,MAC9E;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAChD;AAAA,IACF;AACF,WAAO,iBAAiB,eAAe,QAAQ,eAAe;AAAA,EAChE,SAAS,KAAK;AACZ,WAAO,cAAc,KAAK,SAAS,MAAM,OAAO;AAAA,EAClD;AACF;AAOA,eAAe,cACb,KACA,SACA,SACmB;AACnB,QAAM,gBAAgB,qBAAqB,GAAG;AAC9C,MAAI,YAAY,QAAW;AACzB,UAAM,WAAkC;AAAA,MACtC,GAAG;AAAA,MACH,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AACA,eAAW,QAAQ,SAAS;AAC1B,UAAI;AACF,cAAM,KAAK,QAAQ;AAAA,MACrB,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,SAAO,iBAAiB,eAAe,QAAQ,eAAe;AAChE;;;AClpBA;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,IAAM,WAAW;AAGV,SAAS,UAAU,SAAgC;AACxD,QAAM,QAAQ,SAAS,KAAK,OAAO;AACnC,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AASA,SAAS,iBAAiB,MAAuC;AAC/D,SACE,OAAO,SAAS,YAChB,SAAS,QACR,KAA+B,YAAY,SAC5C,OAAQ,KAA8B,WAAW;AAErD;AAEA,SAAS,aAAa,SAA4B;AAChD,SAAO,IAAI,SAAS,KAAK,UAAU,OAAO,GAAG;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,kCAAkC;AAAA,EAC/D,CAAC;AACH;AAGA,SAAS,QAAQ,MAAc,KAAkC;AAC/D,QAAM,WAAW,mBAAmB,KAAK,mBAAmB,IAAI,GAAG;AACnE,SAAO;AAAA,IACL;AAAA,IACA,OAAO,eAAe,IAAI;AAAA,IAC1B,QAAQ,SAAS;AAAA,IACjB,UAAU,EAAE,QAAQ,IAAI,UAAU,GAAG;AAAA,IACrC,QAAQ,CAAC;AAAA,IACT,cAAc,CAAC;AAAA,IACf,OAAO,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,MAChC,MAAM,EAAE;AAAA,MACR,aAAa,EAAE;AAAA,MACf,UAAU;AAAA,MACV,OAAO;AAAA,MACP,OAAO;AAAA,IACT,EAAE;AAAA,IACF,WAAW,CAAC;AAAA,EACd;AACF;AAQO,SAAS,iBACd,KACA,MACA,MACA,eAAuC,CAAC,GAC9B;AACV,MAAI,CAAC,iBAAiB,IAAI,GAAG;AAC3B,WAAO,aAAa;AAAA,MAClB,SAAS;AAAA,MACT,IAAI;AAAA,MACJ,OAAO,EAAE,MAAM,QAAQ,SAAS,kBAAkB;AAAA,IACpD,CAAC;AAAA,EACH;AACA,QAAM,EAAE,IAAI,QAAQ,OAAO,IAAI;AAC/B,MAAI;AACF,UAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,QAAI,WAAW,cAAc;AAC3B,YAAM,OAAO,cAAc,KAAK;AAChC,YAAM,eAAwC,EAAE,OAAO,CAAC,EAAE;AAC1D,UAAI,aAAa,SAAS,EAAG,cAAa,YAAY,CAAC;AACvD,aAAO,aAAa;AAAA,QAClB,SAAS;AAAA,QACT;AAAA,QACA,QAAQ;AAAA,UACN,iBAAiB,KAAK;AAAA,UACtB;AAAA,UACA,YAAY,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,QAAQ;AAAA,QACvD;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,WAAW,cAAc;AAC3B,aAAO,aAAa,EAAE,SAAS,OAAO,IAAI,QAAQ,EAAE,OAAO,wBAAwB,KAAK,EAAE,EAAE,CAAC;AAAA,IAC/F;AACA,QAAI,WAAW,kBAAkB;AAC/B,aAAO,aAAa;AAAA,QAClB,SAAS;AAAA,QACT;AAAA,QACA,QAAQ,EAAE,WAAW,yBAAyB,YAAY,EAAE;AAAA,MAC9D,CAAC;AAAA,IACH;AACA,QAAI,WAAW,kBAAkB;AAC/B,YAAM,MAAO,QAA0C;AACvD,UAAI,OAAO,QAAQ,UAAU;AAC3B,eAAO,aAAa;AAAA,UAClB,SAAS;AAAA,UACT;AAAA,UACA,OAAO,EAAE,MAAM,QAAQ,SAAS,gDAAgD;AAAA,QAClF,CAAC;AAAA,MACH;AACA,YAAM,WAAW,gBAAgB,cAAc,GAAG;AAClD,UAAI,aAAa,MAAM;AACrB,eAAO,aAAa;AAAA,UAClB,SAAS;AAAA,UACT;AAAA,UACA,OAAO,EAAE,MAAM,QAAQ,SAAS,uBAAuB,GAAG,GAAG;AAAA,QAC/D,CAAC;AAAA,MACH;AACA,aAAO,aAAa,EAAE,SAAS,OAAO,IAAI,QAAQ,SAAS,CAAC;AAAA,IAC9D;AACA,WAAO,aAAa;AAAA,MAClB,SAAS;AAAA,MACT;AAAA,MACA,OAAO,EAAE,MAAM,QAAQ,SAAS,qBAAqB,MAAM,GAAG;AAAA,IAChE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,SAAS;AAAA,MACT;AAAA,MACA,OAAO,EAAE,MAAM,QAAQ,SAAS,eAAe,QAAQ,IAAI,UAAU,iBAAiB;AAAA,IACxF,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/{agent-TZ5JZUJ7.js → chunk-ZYMFKYLM.js}

@@ -10,7 +10,6 @@ import {
 import {
   scanAgents
 } from "./chunk-34YQOXGM.js";
-import "./chunk-P37RZRFV.js";
 
 // src/server/agent/run-terminal-agent.ts
 import {
@@ -178,7 +177,7 @@ async function agentCommand(name, message, deps = {}) {
 async function createAgentSsrLoader(projectRoot) {
   const { createServer } = await import("vite");
   const react = (await import("@vitejs/plugin-react")).default;
-  const { theoPluginAsync } = await import("./vite-plugin-DBS2USI4.js");
+  const { theoPluginAsync } = await import("./vite-plugin-GXRWNESN.js");
   const { loadConfig } = await import("./load-config-JKYO5RFK.js");
   const config = await loadConfig(projectRoot);
   const theoPlugins = await theoPluginAsync({
@@ -203,7 +202,9 @@ async function createAgentSsrLoader(projectRoot) {
     }
   };
 }
+
 export {
-  agentCommand
+  agentCommand,
+  createAgentSsrLoader
 };
-//# sourceMappingURL=agent-TZ5JZUJ7.js.map
+//# sourceMappingURL=chunk-ZYMFKYLM.js.map

package/dist/{agent-TZ5JZUJ7.js.map → chunk-ZYMFKYLM.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/agent/run-terminal-agent.ts","../src/server/agent/render-terminal.ts","../src/cli/commands/agent.ts"],"sourcesContent":["/**\n * M5 (theokit-ai-first) — run a compiled agent in the terminal, reusing the M4 harness.\n *\n * The web `mountAgent` renders `streamAgentUIMessages` to an HTTP `Response` and resolves HITL\n * approvals via the approve route. This is its terminal sibling: SAME `compileAgentModule` + SAME\n * `streamAgentUIMessages` + SAME in-process approval registry — only the render surface (stdout) and\n * the approval input (a readline prompt) differ (ADR 0039 D2). In a single-process CLI the stream's\n * `awaitApproval` (→ `registry.register`) and the terminal prompt (→ `registry.resolve`) share the one\n * in-process registry — the M4 singleton's exact fit. No new runtime, no LLM call, no tool dispatch.\n */\nimport {\n  compileAgentModule,\n  streamAgentUIMessages,\n  type HumanInTheLoopOptions,\n} from '@theokit/agents'\n\nimport { getApprovalRegistry, type ApprovalRegistry } from './approval-registry.js'\nimport {\n  promptTerminalApproval,\n  renderAgentStreamToTerminal,\n  type TerminalOut,\n} from './render-terminal.js'\n\nexport interface RunTerminalAgentInput {\n  message: string\n  /** Resume key; a fresh id per run when omitted. */\n  sessionId?: string\n  /** Injectable sink (defaults to `process.stdout` at the CLI entry). */\n  stdout?: TerminalOut\n  /** Injectable shared registry (defaults to the process singleton). */\n  registry?: ApprovalRegistry\n  /** Injectable approval prompt (defaults to the readline prompt over the process streams). */\n  promptApproval?: (req: { toolName: string; timeoutMs?: number }) => Promise<boolean>\n  /** Labels a fail-fast `AgentDefinitionError` (the file path). */\n  source?: string\n}\n\n/**\n * Compile the module (M4, gathers `@Mixin` toolboxes), stream it, and render to the terminal. When the\n * agent has `@HumanInTheLoop`-gated tools, the terminal prompts and resolves the shared registry —\n * approve runs the tool, deny/timeout/non-TTY denies and the run continues.\n */\nexport async function runAgentInTerminal(\n  mod: unknown,\n  apiKey: string,\n  input: RunTerminalAgentInput,\n): Promise<{ sawError: boolean }> {\n  const compiled = compileAgentModule(mod, input.source)\n  const stdout = input.stdout ?? process.stdout\n  const registry = input.registry ?? getApprovalRegistry()\n  const sessionId = input.sessionId ?? crypto.randomUUID()\n  const promptApproval =\n    input.promptApproval ??\n    ((req: { toolName: string; timeoutMs?: number }) =>\n      promptTerminalApproval(req, { input: process.stdin, output: process.stdout }, req.timeoutMs))\n\n  // Mirror mount-agent's HITL wiring; absent ⇒ the non-HITL stream path (M2), unchanged.\n  const gated = compiled.hitl\n  const hitl =\n    gated && gated.size > 0\n      ? {\n          gated,\n          awaitApproval: (approvalId: string, opts: HumanInTheLoopOptions) =>\n            registry.register(approvalId, {\n              timeoutMs: opts.timeout ?? 300_000,\n              onTimeout: opts.onTimeout ?? 'abort',\n            }),\n        }\n      : undefined\n\n  const chunks = streamAgentUIMessages(compiled, apiKey, {\n    message: input.message,\n    sessionId,\n    hitl,\n  })\n  return renderAgentStreamToTerminal(chunks, {\n    stdout,\n    onApproval: async ({ approvalId, toolName }) => {\n      // The renderer paused here (the SDK run is paused in its awaited pre_tool_call hook); prompt,\n      // then resolve the SAME registry the stream registered into — the run resumes with the decision.\n      // The prompt shares the gated tool's timeout so it can never outlive the registry-settled run.\n      const timeoutMs = gated?.get(toolName)?.timeout ?? 300_000\n      const approved = await promptApproval({ toolName, timeoutMs })\n      registry.resolve(approvalId, approved)\n    },\n  })\n}\n","/**\n * M5 (theokit-ai-first) — the terminal render surface for the M4 agent harness.\n *\n * Consumes the M4 `UIMessageChunk` stream (`streamAgentUIMessages`) and writes it to the terminal:\n * streaming text, a dim reasoning line, `▸ tool(input)` / result cards, a checkpoint notice, errors.\n * On a HITL `tool-approval-request` it delegates to the injected `onApproval` (the entry wires that to\n * a readline prompt + the approval registry). This is the ONLY new code M5 adds — no runtime, no LLM\n * call, no tool dispatch (ADR 0039 D2). I/O is INJECTED (`stdout`, prompt streams) so the whole\n * surface is deterministically testable without a TTY (ADR 0039 D4 / ADR-M5a).\n */\nimport { createInterface } from 'node:readline'\nimport type { Readable, Writable } from 'node:stream'\n\nimport type { UIMessageChunk } from 'ai'\n\n/** ANSI helpers — applied only on a TTY so a captured (non-TTY) sink stays plain-text for tests. */\nconst ANSI = {\n  dim: '\\x1b[2m',\n  red: '\\x1b[31m',\n  cyan: '\\x1b[36m',\n  green: '\\x1b[32m',\n  reset: '\\x1b[0m',\n}\nfunction paint(text: string, color: keyof typeof ANSI, tty: boolean | undefined): string {\n  return tty ? `${ANSI[color]}${text}${ANSI.reset}` : text\n}\n\n/** A stdout-like sink; `isTTY` gates color (Node's `process.stdout` carries it, a test sink does not). */\nexport type TerminalOut = Writable & { isTTY?: boolean }\n\nexport interface TerminalRenderOptions {\n  stdout: TerminalOut\n  /** Resolve a HITL approval (the entry prompts + resolves the registry). */\n  onApproval: (req: { approvalId: string; toolName: string }) => Promise<void>\n}\n\n/** Render an `unknown` tool output/input for display (string as-is; other JSON-ish values stringified). */\nfunction display(value: unknown): string {\n  return typeof value === 'string' ? value : JSON.stringify(value ?? {})\n}\n\n/**\n * Map a single (non-approval) `UIMessageChunk` to its terminal line(s), or `''` for chunks that render\n * nothing (`start`/`text-start`/`reasoning-start`/…). Pure — the async loop owns approval + I/O.\n * Narrows the `ai` discriminated union directly on `chunk.type` (no cast; G3).\n */\nfunction renderChunkLine(chunk: UIMessageChunk, tty: boolean | undefined): string {\n  switch (chunk.type) {\n    case 'text-delta':\n      return chunk.delta\n    case 'text-end':\n    case 'finish':\n      return '\\n'\n    case 'reasoning-delta':\n      return paint(chunk.delta, 'dim', tty)\n    case 'reasoning-end':\n      return '\\n'\n    case 'tool-input-available':\n      return paint(`\\n▸ ${chunk.toolName}(${display(chunk.input)})\\n`, 'cyan', tty)\n    case 'tool-output-available':\n      return paint(`  ✓ ${display(chunk.output)}\\n`, 'green', tty)\n    case 'tool-output-error':\n      return paint(`  ✗ ${chunk.errorText}\\n`, 'red', tty)\n    case 'error':\n      return paint(`\\n✗ ${chunk.errorText}\\n`, 'red', tty)\n    default:\n      // ai-sdk `data-*` transient parts (e.g. the M4 `data-checkpoint` resume handle).\n      return chunk.type === 'data-checkpoint'\n        ? paint('\\n⎇ checkpoint saved — resume with the same session id\\n', 'dim', tty)\n        : ''\n  }\n}\n\n/**\n * Render the `UIMessageChunk` stream to `stdout`. Sequential: one chunk → its line(s). The SDK run is\n * already paused inside the awaited `pre_tool_call` hook when a `tool-approval-request` arrives, so a\n * blocking `await onApproval(...)` here is correct — no frame buffer, no concurrency. Returns whether\n * an `error` chunk was seen so the caller can signal a non-zero exit (fail-loud, not silent exit 0).\n */\nexport async function renderAgentStreamToTerminal(\n  chunks: AsyncIterable<UIMessageChunk>,\n  opts: TerminalRenderOptions,\n): Promise<{ sawError: boolean }> {\n  const tty = opts.stdout.isTTY\n  const write = (s: string): void => {\n    if (s) opts.stdout.write(s)\n  }\n  // toolCallId → toolName, so the approval prompt (whose chunk carries only ids) can name the tool.\n  const toolNames = new Map<string, string>()\n  let sawError = false\n\n  for await (const chunk of chunks) {\n    if (chunk.type === 'tool-approval-request') {\n      const toolName = toolNames.get(chunk.toolCallId)\n      await opts.onApproval({ approvalId: chunk.approvalId, toolName: toolName ?? 'tool' })\n      continue\n    }\n    if (chunk.type === 'tool-input-available' && chunk.toolCallId) {\n      toolNames.set(chunk.toolCallId, chunk.toolName)\n    }\n    if (chunk.type === 'error') sawError = true\n    write(renderChunkLine(chunk, tty))\n  }\n  return { sawError }\n}\n\n/** Injectable I/O for the approval prompt (defaults to the process streams at the CLI entry). */\nexport interface PromptIO {\n  input: Readable & { isTTY?: boolean }\n  output: Writable & { isTTY?: boolean }\n}\n\n/**\n * Prompt `Approve <tool>? (y/N)` and resolve to the decision. A non-interactive environment (piped /\n * CI — either stream is not a TTY) AUTO-DENIES without prompting (ADR-M5b fail-safe: a decision that\n * cannot be obtained is a deny, never an auto-approve; mirrors HITL `onTimeout: 'abort'`).\n *\n * `timeoutMs` (the gated tool's `@HumanInTheLoop` timeout) auto-denies + closes the prompt when the\n * human walks away — WITHOUT it the readline question would outlive the SDK run (the registry settles\n * the run at its own timeout but readline has no timer), hanging the CLI on a now-irrelevant prompt.\n */\nexport function promptTerminalApproval(\n  req: { toolName: string },\n  io: PromptIO,\n  timeoutMs?: number,\n): Promise<boolean> {\n  if (!io.input.isTTY || !io.output.isTTY) {\n    io.output.write(`\\n⚠ Non-interactive terminal — auto-denying approval for '${req.toolName}'.\\n`)\n    return Promise.resolve(false)\n  }\n  return new Promise<boolean>((resolve) => {\n    const rl = createInterface({ input: io.input, output: io.output })\n    let timer: ReturnType<typeof setTimeout> | undefined\n    const settle = (approved: boolean): void => {\n      if (timer) clearTimeout(timer)\n      rl.close()\n      resolve(approved)\n    }\n    if (timeoutMs !== undefined && timeoutMs > 0) {\n      timer = setTimeout(() => {\n        io.output.write(`\\n⚠ Approval timed out — denying '${req.toolName}'.\\n`)\n        settle(false)\n      }, timeoutMs)\n    }\n    rl.question(`\\n❔ Approve ${req.toolName}? (y/N) `, (answer) => {\n      const a = answer.trim().toLowerCase()\n      settle(a === 'y' || a === 'yes')\n    })\n  })\n}\n","/**\n * M5 (theokit-ai-first) — `theokit agent <name> [message]`: run a scanned agent in the terminal.\n *\n * Scans the top-level `agents/` directory (M2), loads the matched `agents/<name>.ts` through the\n * framework's OWN Vite pipeline (the SAME transpile `theokit dev` uses — legacy `@Agent`/`@Tool`\n * decorators need it; Node's native loader can't transpile TS), resolves the provider apiKey, and\n * runs it in the terminal via the M4 harness (`runAgentInTerminal`). A dev-time surface (ADR 0039 D1),\n * not a CLI product. `deps` is injectable so the fail-fast branches are tested without Vite/an LLM.\n */\nimport { loadEnv } from '../../config/load-env.js'\nimport { resolveProvider } from '../../server/agent/provider-resolver.js'\nimport { runAgentInTerminal } from '../../server/agent/run-terminal-agent.js'\nimport { scanAgents } from '../../server/scan/agent-scan.js'\n\nexport interface AgentCommandDeps {\n  projectRoot?: string\n  /** Load a TS agent module; defaults to a fresh minimal Vite SSR server (framework transpile). */\n  loadModule?: (filePath: string) => Promise<Record<string, unknown>>\n  runAgent?: typeof runAgentInTerminal\n  resolveApiKey?: () => string\n}\n\nexport async function agentCommand(\n  name: string,\n  message: string | undefined,\n  deps: AgentCommandDeps = {},\n): Promise<{ sawError: boolean }> {\n  if (!message || message.trim().length === 0) {\n    throw new Error('theokit agent: a message is required. Usage: theokit agent <name> \"<message>\"')\n  }\n  const projectRoot = deps.projectRoot ?? process.cwd()\n  const agents = scanAgents(projectRoot)\n  const agent = agents.find((a) => a.name === name)\n  if (!agent) {\n    const names = agents.map((a) => a.name).join(', ') || '(none found in agents/)'\n    throw new Error(`theokit agent: '${name}' not found. Available agents: ${names}`)\n  }\n\n  const runAgent = deps.runAgent ?? runAgentInTerminal\n  // Load .env into process.env BEFORE resolving the provider key — parity with `theokit dev`\n  // (dev.ts loadEnv), so an app with OPENROUTER_API_KEY in .env works here too (review H1). Skipped\n  // when the key is injected (tests) — a temp project has no .env anyway.\n  const apiKey =\n    deps.resolveApiKey?.() ??\n    (() => {\n      loadEnv({ cwd: projectRoot, mode: 'development' })\n      return resolveProvider().apiKey\n    })()\n\n  let loadModule = deps.loadModule\n  let dispose: (() => Promise<void>) | undefined\n  if (!loadModule) {\n    const loader = await createAgentSsrLoader(projectRoot)\n    loadModule = loader.load\n    dispose = loader.dispose\n  }\n\n  try {\n    const mod = await loadModule(agent.filePath)\n    return await runAgent(mod, apiKey, { message, source: agent.filePath })\n  } finally {\n    if (dispose) await dispose()\n  }\n}\n\n/**\n * A minimal middleware-mode Vite server built from the SAME `theoPluginAsync` plugin set `theokit dev`\n * uses (`cli/commands/dev.ts`) — so a class-decorated `agents/<name>.ts` transpiles identically. No\n * HTTP listen, no service orchestration, silent — just `ssrLoadModule`. Caller MUST `dispose()`.\n */\nasync function createAgentSsrLoader(projectRoot: string): Promise<{\n  load: (p: string) => Promise<Record<string, unknown>>\n  dispose: () => Promise<void>\n}> {\n  const { createServer } = await import('vite')\n  const react = (await import('@vitejs/plugin-react')).default\n  const { theoPluginAsync } = await import('../../vite-plugin/index.js')\n  const { loadConfig } = await import('../../config/load-config.js')\n  // Pass the project's ssr/services/optimizeDeps config through, exactly as dev.ts does — so an app\n  // that customizes ssr.noExternal transpiles here identically to `theokit dev` (review L1).\n  const config = await loadConfig(projectRoot)\n  const theoPlugins = await theoPluginAsync({\n    root: projectRoot,\n    ssr: config.ssr,\n    services: config.services,\n    viteOptimizeDeps: config.viteOptimizeDeps,\n  })\n  const server = await createServer({\n    root: projectRoot,\n    plugins: [react(), ...theoPlugins],\n    server: { middlewareMode: true },\n    appType: 'custom',\n    logLevel: 'silent',\n  })\n  return {\n    load: (p) => server.ssrLoadModule(p) as Promise<Record<string, unknown>>,\n    dispose: async () => {\n      // Surface a cleanup failure instead of swallowing it (error-handling.md) — non-fatal, the run\n      // already finished, so warn rather than throw past the CLI boundary.\n      await server.close().catch((err: unknown) => {\n        console.warn('[theokit agent] Vite server cleanup error:', err)\n      })\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAUA;AAAA,EACE;AAAA,EACA;AAAA,OAEK;;;ACJP,SAAS,uBAAuB;AAMhC,IAAM,OAAO;AAAA,EACX,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AAAA,EACN,OAAO;AAAA,EACP,OAAO;AACT;AACA,SAAS,MAAM,MAAc,OAA0B,KAAkC;AACvF,SAAO,MAAM,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,GAAG,KAAK,KAAK,KAAK;AACtD;AAYA,SAAS,QAAQ,OAAwB;AACvC,SAAO,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,SAAS,CAAC,CAAC;AACvE;AAOA,SAAS,gBAAgB,OAAuB,KAAkC;AAChF,UAAQ,MAAM,MAAM;AAAA,IAClB,KAAK;AACH,aAAO,MAAM;AAAA,IACf,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,MAAM,MAAM,OAAO,OAAO,GAAG;AAAA,IACtC,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,MAAM;AAAA,SAAO,MAAM,QAAQ,IAAI,QAAQ,MAAM,KAAK,CAAC;AAAA,GAAO,QAAQ,GAAG;AAAA,IAC9E,KAAK;AACH,aAAO,MAAM,YAAO,QAAQ,MAAM,MAAM,CAAC;AAAA,GAAM,SAAS,GAAG;AAAA,IAC7D,KAAK;AACH,aAAO,MAAM,YAAO,MAAM,SAAS;AAAA,GAAM,OAAO,GAAG;AAAA,IACrD,KAAK;AACH,aAAO,MAAM;AAAA,SAAO,MAAM,SAAS;AAAA,GAAM,OAAO,GAAG;AAAA,IACrD;AAEE,aAAO,MAAM,SAAS,oBAClB,MAAM,sEAA4D,OAAO,GAAG,IAC5E;AAAA,EACR;AACF;AAQA,eAAsB,4BACpB,QACA,MACgC;AAChC,QAAM,MAAM,KAAK,OAAO;AACxB,QAAM,QAAQ,CAAC,MAAoB;AACjC,QAAI,EAAG,MAAK,OAAO,MAAM,CAAC;AAAA,EAC5B;AAEA,QAAM,YAAY,oBAAI,IAAoB;AAC1C,MAAI,WAAW;AAEf,mBAAiB,SAAS,QAAQ;AAChC,QAAI,MAAM,SAAS,yBAAyB;AAC1C,YAAM,WAAW,UAAU,IAAI,MAAM,UAAU;AAC/C,YAAM,KAAK,WAAW,EAAE,YAAY,MAAM,YAAY,UAAU,YAAY,OAAO,CAAC;AACpF;AAAA,IACF;AACA,QAAI,MAAM,SAAS,0BAA0B,MAAM,YAAY;AAC7D,gBAAU,IAAI,MAAM,YAAY,MAAM,QAAQ;AAAA,IAChD;AACA,QAAI,MAAM,SAAS,QAAS,YAAW;AACvC,UAAM,gBAAgB,OAAO,GAAG,CAAC;AAAA,EACnC;AACA,SAAO,EAAE,SAAS;AACpB;AAiBO,SAAS,uBACd,KACA,IACA,WACkB;AAClB,MAAI,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,OAAO;AACvC,OAAG,OAAO,MAAM;AAAA,oEAA6D,IAAI,QAAQ;AAAA,CAAM;AAC/F,WAAO,QAAQ,QAAQ,KAAK;AAAA,EAC9B;AACA,SAAO,IAAI,QAAiB,CAAC,YAAY;AACvC,UAAM,KAAK,gBAAgB,EAAE,OAAO,GAAG,OAAO,QAAQ,GAAG,OAAO,CAAC;AACjE,QAAI;AACJ,UAAM,SAAS,CAAC,aAA4B;AAC1C,UAAI,MAAO,cAAa,KAAK;AAC7B,SAAG,MAAM;AACT,cAAQ,QAAQ;AAAA,IAClB;AACA,QAAI,cAAc,UAAa,YAAY,GAAG;AAC5C,cAAQ,WAAW,MAAM;AACvB,WAAG,OAAO,MAAM;AAAA,4CAAqC,IAAI,QAAQ;AAAA,CAAM;AACvE,eAAO,KAAK;AAAA,MACd,GAAG,SAAS;AAAA,IACd;AACA,OAAG,SAAS;AAAA,iBAAe,IAAI,QAAQ,YAAY,CAAC,WAAW;AAC7D,YAAM,IAAI,OAAO,KAAK,EAAE,YAAY;AACpC,aAAO,MAAM,OAAO,MAAM,KAAK;AAAA,IACjC,CAAC;AAAA,EACH,CAAC;AACH;;;AD3GA,eAAsB,mBACpB,KACA,QACA,OACgC;AAChC,QAAM,WAAW,mBAAmB,KAAK,MAAM,MAAM;AACrD,QAAM,SAAS,MAAM,UAAU,QAAQ;AACvC,QAAM,WAAW,MAAM,YAAY,oBAAoB;AACvD,QAAM,YAAY,MAAM,aAAa,OAAO,WAAW;AACvD,QAAM,iBACJ,MAAM,mBACL,CAAC,QACA,uBAAuB,KAAK,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,GAAG,IAAI,SAAS;AAG/F,QAAM,QAAQ,SAAS;AACvB,QAAM,OACJ,SAAS,MAAM,OAAO,IAClB;AAAA,IACE;AAAA,IACA,eAAe,CAAC,YAAoB,SAClC,SAAS,SAAS,YAAY;AAAA,MAC5B,WAAW,KAAK,WAAW;AAAA,MAC3B,WAAW,KAAK,aAAa;AAAA,IAC/B,CAAC;AAAA,EACL,IACA;AAEN,QAAM,SAAS,sBAAsB,UAAU,QAAQ;AAAA,IACrD,SAAS,MAAM;AAAA,IACf;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO,4BAA4B,QAAQ;AAAA,IACzC;AAAA,IACA,YAAY,OAAO,EAAE,YAAY,SAAS,MAAM;AAI9C,YAAM,YAAY,OAAO,IAAI,QAAQ,GAAG,WAAW;AACnD,YAAM,WAAW,MAAM,eAAe,EAAE,UAAU,UAAU,CAAC;AAC7D,eAAS,QAAQ,YAAY,QAAQ;AAAA,IACvC;AAAA,EACF,CAAC;AACH;;;AEhEA,eAAsB,aACpB,MACA,SACA,OAAyB,CAAC,GACM;AAChC,MAAI,CAAC,WAAW,QAAQ,KAAK,EAAE,WAAW,GAAG;AAC3C,UAAM,IAAI,MAAM,+EAA+E;AAAA,EACjG;AACA,QAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AACpD,QAAM,SAAS,WAAW,WAAW;AACrC,QAAM,QAAQ,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAChD,MAAI,CAAC,OAAO;AACV,UAAM,QAAQ,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK;AACtD,UAAM,IAAI,MAAM,mBAAmB,IAAI,kCAAkC,KAAK,EAAE;AAAA,EAClF;AAEA,QAAM,WAAW,KAAK,YAAY;AAIlC,QAAM,SACJ,KAAK,gBAAgB,MACpB,MAAM;AACL,YAAQ,EAAE,KAAK,aAAa,MAAM,cAAc,CAAC;AACjD,WAAO,gBAAgB,EAAE;AAAA,EAC3B,GAAG;AAEL,MAAI,aAAa,KAAK;AACtB,MAAI;AACJ,MAAI,CAAC,YAAY;AACf,UAAM,SAAS,MAAM,qBAAqB,WAAW;AACrD,iBAAa,OAAO;AACpB,cAAU,OAAO;AAAA,EACnB;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,WAAW,MAAM,QAAQ;AAC3C,WAAO,MAAM,SAAS,KAAK,QAAQ,EAAE,SAAS,QAAQ,MAAM,SAAS,CAAC;AAAA,EACxE,UAAE;AACA,QAAI,QAAS,OAAM,QAAQ;AAAA,EAC7B;AACF;AAOA,eAAe,qBAAqB,aAGjC;AACD,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,MAAM;AAC5C,QAAM,SAAS,MAAM,OAAO,sBAAsB,GAAG;AACrD,QAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,2BAA4B;AACrE,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2BAA6B;AAGjE,QAAM,SAAS,MAAM,WAAW,WAAW;AAC3C,QAAM,cAAc,MAAM,gBAAgB;AAAA,IACxC,MAAM;AAAA,IACN,KAAK,OAAO;AAAA,IACZ,UAAU,OAAO;AAAA,IACjB,kBAAkB,OAAO;AAAA,EAC3B,CAAC;AACD,QAAM,SAAS,MAAM,aAAa;AAAA,IAChC,MAAM;AAAA,IACN,SAAS,CAAC,MAAM,GAAG,GAAG,WAAW;AAAA,IACjC,QAAQ,EAAE,gBAAgB,KAAK;AAAA,IAC/B,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AACD,SAAO;AAAA,IACL,MAAM,CAAC,MAAM,OAAO,cAAc,CAAC;AAAA,IACnC,SAAS,YAAY;AAGnB,YAAM,OAAO,MAAM,EAAE,MAAM,CAAC,QAAiB;AAC3C,gBAAQ,KAAK,8CAA8C,GAAG;AAAA,MAChE,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/server/agent/run-terminal-agent.ts","../src/server/agent/render-terminal.ts","../src/cli/commands/agent.ts"],"sourcesContent":["/**\n * M5 (theokit-ai-first) — run a compiled agent in the terminal, reusing the M4 harness.\n *\n * The web `mountAgent` renders `streamAgentUIMessages` to an HTTP `Response` and resolves HITL\n * approvals via the approve route. This is its terminal sibling: SAME `compileAgentModule` + SAME\n * `streamAgentUIMessages` + SAME in-process approval registry — only the render surface (stdout) and\n * the approval input (a readline prompt) differ (ADR 0039 D2). In a single-process CLI the stream's\n * `awaitApproval` (→ `registry.register`) and the terminal prompt (→ `registry.resolve`) share the one\n * in-process registry — the M4 singleton's exact fit. No new runtime, no LLM call, no tool dispatch.\n */\nimport {\n  compileAgentModule,\n  streamAgentUIMessages,\n  type HumanInTheLoopOptions,\n} from '@theokit/agents'\n\nimport { getApprovalRegistry, type ApprovalRegistry } from './approval-registry.js'\nimport {\n  promptTerminalApproval,\n  renderAgentStreamToTerminal,\n  type TerminalOut,\n} from './render-terminal.js'\n\nexport interface RunTerminalAgentInput {\n  message: string\n  /** Resume key; a fresh id per run when omitted. */\n  sessionId?: string\n  /** Injectable sink (defaults to `process.stdout` at the CLI entry). */\n  stdout?: TerminalOut\n  /** Injectable shared registry (defaults to the process singleton). */\n  registry?: ApprovalRegistry\n  /** Injectable approval prompt (defaults to the readline prompt over the process streams). */\n  promptApproval?: (req: { toolName: string; timeoutMs?: number }) => Promise<boolean>\n  /** Labels a fail-fast `AgentDefinitionError` (the file path). */\n  source?: string\n}\n\n/**\n * Compile the module (M4, gathers `@Mixin` toolboxes), stream it, and render to the terminal. When the\n * agent has `@HumanInTheLoop`-gated tools, the terminal prompts and resolves the shared registry —\n * approve runs the tool, deny/timeout/non-TTY denies and the run continues.\n */\nexport async function runAgentInTerminal(\n  mod: unknown,\n  apiKey: string,\n  input: RunTerminalAgentInput,\n): Promise<{ sawError: boolean }> {\n  const compiled = compileAgentModule(mod, input.source)\n  const stdout = input.stdout ?? process.stdout\n  const registry = input.registry ?? getApprovalRegistry()\n  const sessionId = input.sessionId ?? crypto.randomUUID()\n  const promptApproval =\n    input.promptApproval ??\n    ((req: { toolName: string; timeoutMs?: number }) =>\n      promptTerminalApproval(req, { input: process.stdin, output: process.stdout }, req.timeoutMs))\n\n  // Mirror mount-agent's HITL wiring; absent ⇒ the non-HITL stream path (M2), unchanged.\n  const gated = compiled.hitl\n  const hitl =\n    gated && gated.size > 0\n      ? {\n          gated,\n          awaitApproval: (approvalId: string, opts: HumanInTheLoopOptions) =>\n            registry.register(approvalId, {\n              timeoutMs: opts.timeout ?? 300_000,\n              onTimeout: opts.onTimeout ?? 'abort',\n            }),\n        }\n      : undefined\n\n  const chunks = streamAgentUIMessages(compiled, apiKey, {\n    message: input.message,\n    sessionId,\n    hitl,\n  })\n  return renderAgentStreamToTerminal(chunks, {\n    stdout,\n    onApproval: async ({ approvalId, toolName }) => {\n      // The renderer paused here (the SDK run is paused in its awaited pre_tool_call hook); prompt,\n      // then resolve the SAME registry the stream registered into — the run resumes with the decision.\n      // The prompt shares the gated tool's timeout so it can never outlive the registry-settled run.\n      const timeoutMs = gated?.get(toolName)?.timeout ?? 300_000\n      const approved = await promptApproval({ toolName, timeoutMs })\n      registry.resolve(approvalId, approved)\n    },\n  })\n}\n","/**\n * M5 (theokit-ai-first) — the terminal render surface for the M4 agent harness.\n *\n * Consumes the M4 `UIMessageChunk` stream (`streamAgentUIMessages`) and writes it to the terminal:\n * streaming text, a dim reasoning line, `▸ tool(input)` / result cards, a checkpoint notice, errors.\n * On a HITL `tool-approval-request` it delegates to the injected `onApproval` (the entry wires that to\n * a readline prompt + the approval registry). This is the ONLY new code M5 adds — no runtime, no LLM\n * call, no tool dispatch (ADR 0039 D2). I/O is INJECTED (`stdout`, prompt streams) so the whole\n * surface is deterministically testable without a TTY (ADR 0039 D4 / ADR-M5a).\n */\nimport { createInterface } from 'node:readline'\nimport type { Readable, Writable } from 'node:stream'\n\nimport type { UIMessageChunk } from 'ai'\n\n/** ANSI helpers — applied only on a TTY so a captured (non-TTY) sink stays plain-text for tests. */\nconst ANSI = {\n  dim: '\\x1b[2m',\n  red: '\\x1b[31m',\n  cyan: '\\x1b[36m',\n  green: '\\x1b[32m',\n  reset: '\\x1b[0m',\n}\nfunction paint(text: string, color: keyof typeof ANSI, tty: boolean | undefined): string {\n  return tty ? `${ANSI[color]}${text}${ANSI.reset}` : text\n}\n\n/** A stdout-like sink; `isTTY` gates color (Node's `process.stdout` carries it, a test sink does not). */\nexport type TerminalOut = Writable & { isTTY?: boolean }\n\nexport interface TerminalRenderOptions {\n  stdout: TerminalOut\n  /** Resolve a HITL approval (the entry prompts + resolves the registry). */\n  onApproval: (req: { approvalId: string; toolName: string }) => Promise<void>\n}\n\n/** Render an `unknown` tool output/input for display (string as-is; other JSON-ish values stringified). */\nfunction display(value: unknown): string {\n  return typeof value === 'string' ? value : JSON.stringify(value ?? {})\n}\n\n/**\n * Map a single (non-approval) `UIMessageChunk` to its terminal line(s), or `''` for chunks that render\n * nothing (`start`/`text-start`/`reasoning-start`/…). Pure — the async loop owns approval + I/O.\n * Narrows the `ai` discriminated union directly on `chunk.type` (no cast; G3).\n */\nfunction renderChunkLine(chunk: UIMessageChunk, tty: boolean | undefined): string {\n  switch (chunk.type) {\n    case 'text-delta':\n      return chunk.delta\n    case 'text-end':\n    case 'finish':\n      return '\\n'\n    case 'reasoning-delta':\n      return paint(chunk.delta, 'dim', tty)\n    case 'reasoning-end':\n      return '\\n'\n    case 'tool-input-available':\n      return paint(`\\n▸ ${chunk.toolName}(${display(chunk.input)})\\n`, 'cyan', tty)\n    case 'tool-output-available':\n      return paint(`  ✓ ${display(chunk.output)}\\n`, 'green', tty)\n    case 'tool-output-error':\n      return paint(`  ✗ ${chunk.errorText}\\n`, 'red', tty)\n    case 'error':\n      return paint(`\\n✗ ${chunk.errorText}\\n`, 'red', tty)\n    default:\n      // ai-sdk `data-*` transient parts (e.g. the M4 `data-checkpoint` resume handle).\n      return chunk.type === 'data-checkpoint'\n        ? paint('\\n⎇ checkpoint saved — resume with the same session id\\n', 'dim', tty)\n        : ''\n  }\n}\n\n/**\n * Render the `UIMessageChunk` stream to `stdout`. Sequential: one chunk → its line(s). The SDK run is\n * already paused inside the awaited `pre_tool_call` hook when a `tool-approval-request` arrives, so a\n * blocking `await onApproval(...)` here is correct — no frame buffer, no concurrency. Returns whether\n * an `error` chunk was seen so the caller can signal a non-zero exit (fail-loud, not silent exit 0).\n */\nexport async function renderAgentStreamToTerminal(\n  chunks: AsyncIterable<UIMessageChunk>,\n  opts: TerminalRenderOptions,\n): Promise<{ sawError: boolean }> {\n  const tty = opts.stdout.isTTY\n  const write = (s: string): void => {\n    if (s) opts.stdout.write(s)\n  }\n  // toolCallId → toolName, so the approval prompt (whose chunk carries only ids) can name the tool.\n  const toolNames = new Map<string, string>()\n  let sawError = false\n\n  for await (const chunk of chunks) {\n    if (chunk.type === 'tool-approval-request') {\n      const toolName = toolNames.get(chunk.toolCallId)\n      await opts.onApproval({ approvalId: chunk.approvalId, toolName: toolName ?? 'tool' })\n      continue\n    }\n    if (chunk.type === 'tool-input-available' && chunk.toolCallId) {\n      toolNames.set(chunk.toolCallId, chunk.toolName)\n    }\n    if (chunk.type === 'error') sawError = true\n    write(renderChunkLine(chunk, tty))\n  }\n  return { sawError }\n}\n\n/** Injectable I/O for the approval prompt (defaults to the process streams at the CLI entry). */\nexport interface PromptIO {\n  input: Readable & { isTTY?: boolean }\n  output: Writable & { isTTY?: boolean }\n}\n\n/**\n * Prompt `Approve <tool>? (y/N)` and resolve to the decision. A non-interactive environment (piped /\n * CI — either stream is not a TTY) AUTO-DENIES without prompting (ADR-M5b fail-safe: a decision that\n * cannot be obtained is a deny, never an auto-approve; mirrors HITL `onTimeout: 'abort'`).\n *\n * `timeoutMs` (the gated tool's `@HumanInTheLoop` timeout) auto-denies + closes the prompt when the\n * human walks away — WITHOUT it the readline question would outlive the SDK run (the registry settles\n * the run at its own timeout but readline has no timer), hanging the CLI on a now-irrelevant prompt.\n */\nexport function promptTerminalApproval(\n  req: { toolName: string },\n  io: PromptIO,\n  timeoutMs?: number,\n): Promise<boolean> {\n  if (!io.input.isTTY || !io.output.isTTY) {\n    io.output.write(`\\n⚠ Non-interactive terminal — auto-denying approval for '${req.toolName}'.\\n`)\n    return Promise.resolve(false)\n  }\n  return new Promise<boolean>((resolve) => {\n    const rl = createInterface({ input: io.input, output: io.output })\n    let timer: ReturnType<typeof setTimeout> | undefined\n    const settle = (approved: boolean): void => {\n      if (timer) clearTimeout(timer)\n      rl.close()\n      resolve(approved)\n    }\n    if (timeoutMs !== undefined && timeoutMs > 0) {\n      timer = setTimeout(() => {\n        io.output.write(`\\n⚠ Approval timed out — denying '${req.toolName}'.\\n`)\n        settle(false)\n      }, timeoutMs)\n    }\n    rl.question(`\\n❔ Approve ${req.toolName}? (y/N) `, (answer) => {\n      const a = answer.trim().toLowerCase()\n      settle(a === 'y' || a === 'yes')\n    })\n  })\n}\n","/**\n * M5 (theokit-ai-first) — `theokit agent <name> [message]`: run a scanned agent in the terminal.\n *\n * Scans the top-level `agents/` directory (M2), loads the matched `agents/<name>.ts` through the\n * framework's OWN Vite pipeline (the SAME transpile `theokit dev` uses — legacy `@Agent`/`@Tool`\n * decorators need it; Node's native loader can't transpile TS), resolves the provider apiKey, and\n * runs it in the terminal via the M4 harness (`runAgentInTerminal`). A dev-time surface (ADR 0039 D1),\n * not a CLI product. `deps` is injectable so the fail-fast branches are tested without Vite/an LLM.\n */\nimport { loadEnv } from '../../config/load-env.js'\nimport { resolveProvider } from '../../server/agent/provider-resolver.js'\nimport { runAgentInTerminal } from '../../server/agent/run-terminal-agent.js'\nimport { scanAgents } from '../../server/scan/agent-scan.js'\n\nexport interface AgentCommandDeps {\n  projectRoot?: string\n  /** Load a TS agent module; defaults to a fresh minimal Vite SSR server (framework transpile). */\n  loadModule?: (filePath: string) => Promise<Record<string, unknown>>\n  runAgent?: typeof runAgentInTerminal\n  resolveApiKey?: () => string\n}\n\nexport async function agentCommand(\n  name: string,\n  message: string | undefined,\n  deps: AgentCommandDeps = {},\n): Promise<{ sawError: boolean }> {\n  if (!message || message.trim().length === 0) {\n    throw new Error('theokit agent: a message is required. Usage: theokit agent <name> \"<message>\"')\n  }\n  const projectRoot = deps.projectRoot ?? process.cwd()\n  const agents = scanAgents(projectRoot)\n  const agent = agents.find((a) => a.name === name)\n  if (!agent) {\n    const names = agents.map((a) => a.name).join(', ') || '(none found in agents/)'\n    throw new Error(`theokit agent: '${name}' not found. Available agents: ${names}`)\n  }\n\n  const runAgent = deps.runAgent ?? runAgentInTerminal\n  // Load .env into process.env BEFORE resolving the provider key — parity with `theokit dev`\n  // (dev.ts loadEnv), so an app with OPENROUTER_API_KEY in .env works here too (review H1). Skipped\n  // when the key is injected (tests) — a temp project has no .env anyway.\n  const apiKey =\n    deps.resolveApiKey?.() ??\n    (() => {\n      loadEnv({ cwd: projectRoot, mode: 'development' })\n      return resolveProvider().apiKey\n    })()\n\n  let loadModule = deps.loadModule\n  let dispose: (() => Promise<void>) | undefined\n  if (!loadModule) {\n    const loader = await createAgentSsrLoader(projectRoot)\n    loadModule = loader.load\n    dispose = loader.dispose\n  }\n\n  try {\n    const mod = await loadModule(agent.filePath)\n    return await runAgent(mod, apiKey, { message, source: agent.filePath })\n  } finally {\n    if (dispose) await dispose()\n  }\n}\n\n/**\n * A minimal middleware-mode Vite server built from the SAME `theoPluginAsync` plugin set `theokit dev`\n * uses (`cli/commands/dev.ts`) — so a class-decorated `agents/<name>.ts` transpiles identically. No\n * HTTP listen, no service orchestration, silent — just `ssrLoadModule`. Caller MUST `dispose()`.\n */\nexport async function createAgentSsrLoader(projectRoot: string): Promise<{\n  load: (p: string) => Promise<Record<string, unknown>>\n  dispose: () => Promise<void>\n}> {\n  const { createServer } = await import('vite')\n  const react = (await import('@vitejs/plugin-react')).default\n  const { theoPluginAsync } = await import('../../vite-plugin/index.js')\n  const { loadConfig } = await import('../../config/load-config.js')\n  // Pass the project's ssr/services/optimizeDeps config through, exactly as dev.ts does — so an app\n  // that customizes ssr.noExternal transpiles here identically to `theokit dev` (review L1).\n  const config = await loadConfig(projectRoot)\n  const theoPlugins = await theoPluginAsync({\n    root: projectRoot,\n    ssr: config.ssr,\n    services: config.services,\n    viteOptimizeDeps: config.viteOptimizeDeps,\n  })\n  const server = await createServer({\n    root: projectRoot,\n    plugins: [react(), ...theoPlugins],\n    server: { middlewareMode: true },\n    appType: 'custom',\n    logLevel: 'silent',\n  })\n  return {\n    load: (p) => server.ssrLoadModule(p) as Promise<Record<string, unknown>>,\n    dispose: async () => {\n      // Surface a cleanup failure instead of swallowing it (error-handling.md) — non-fatal, the run\n      // already finished, so warn rather than throw past the CLI boundary.\n      await server.close().catch((err: unknown) => {\n        console.warn('[theokit agent] Vite server cleanup error:', err)\n      })\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAUA;AAAA,EACE;AAAA,EACA;AAAA,OAEK;;;ACJP,SAAS,uBAAuB;AAMhC,IAAM,OAAO;AAAA,EACX,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AAAA,EACN,OAAO;AAAA,EACP,OAAO;AACT;AACA,SAAS,MAAM,MAAc,OAA0B,KAAkC;AACvF,SAAO,MAAM,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,GAAG,KAAK,KAAK,KAAK;AACtD;AAYA,SAAS,QAAQ,OAAwB;AACvC,SAAO,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,SAAS,CAAC,CAAC;AACvE;AAOA,SAAS,gBAAgB,OAAuB,KAAkC;AAChF,UAAQ,MAAM,MAAM;AAAA,IAClB,KAAK;AACH,aAAO,MAAM;AAAA,IACf,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,MAAM,MAAM,OAAO,OAAO,GAAG;AAAA,IACtC,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,MAAM;AAAA,SAAO,MAAM,QAAQ,IAAI,QAAQ,MAAM,KAAK,CAAC;AAAA,GAAO,QAAQ,GAAG;AAAA,IAC9E,KAAK;AACH,aAAO,MAAM,YAAO,QAAQ,MAAM,MAAM,CAAC;AAAA,GAAM,SAAS,GAAG;AAAA,IAC7D,KAAK;AACH,aAAO,MAAM,YAAO,MAAM,SAAS;AAAA,GAAM,OAAO,GAAG;AAAA,IACrD,KAAK;AACH,aAAO,MAAM;AAAA,SAAO,MAAM,SAAS;AAAA,GAAM,OAAO,GAAG;AAAA,IACrD;AAEE,aAAO,MAAM,SAAS,oBAClB,MAAM,sEAA4D,OAAO,GAAG,IAC5E;AAAA,EACR;AACF;AAQA,eAAsB,4BACpB,QACA,MACgC;AAChC,QAAM,MAAM,KAAK,OAAO;AACxB,QAAM,QAAQ,CAAC,MAAoB;AACjC,QAAI,EAAG,MAAK,OAAO,MAAM,CAAC;AAAA,EAC5B;AAEA,QAAM,YAAY,oBAAI,IAAoB;AAC1C,MAAI,WAAW;AAEf,mBAAiB,SAAS,QAAQ;AAChC,QAAI,MAAM,SAAS,yBAAyB;AAC1C,YAAM,WAAW,UAAU,IAAI,MAAM,UAAU;AAC/C,YAAM,KAAK,WAAW,EAAE,YAAY,MAAM,YAAY,UAAU,YAAY,OAAO,CAAC;AACpF;AAAA,IACF;AACA,QAAI,MAAM,SAAS,0BAA0B,MAAM,YAAY;AAC7D,gBAAU,IAAI,MAAM,YAAY,MAAM,QAAQ;AAAA,IAChD;AACA,QAAI,MAAM,SAAS,QAAS,YAAW;AACvC,UAAM,gBAAgB,OAAO,GAAG,CAAC;AAAA,EACnC;AACA,SAAO,EAAE,SAAS;AACpB;AAiBO,SAAS,uBACd,KACA,IACA,WACkB;AAClB,MAAI,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,OAAO;AACvC,OAAG,OAAO,MAAM;AAAA,oEAA6D,IAAI,QAAQ;AAAA,CAAM;AAC/F,WAAO,QAAQ,QAAQ,KAAK;AAAA,EAC9B;AACA,SAAO,IAAI,QAAiB,CAAC,YAAY;AACvC,UAAM,KAAK,gBAAgB,EAAE,OAAO,GAAG,OAAO,QAAQ,GAAG,OAAO,CAAC;AACjE,QAAI;AACJ,UAAM,SAAS,CAAC,aAA4B;AAC1C,UAAI,MAAO,cAAa,KAAK;AAC7B,SAAG,MAAM;AACT,cAAQ,QAAQ;AAAA,IAClB;AACA,QAAI,cAAc,UAAa,YAAY,GAAG;AAC5C,cAAQ,WAAW,MAAM;AACvB,WAAG,OAAO,MAAM;AAAA,4CAAqC,IAAI,QAAQ;AAAA,CAAM;AACvE,eAAO,KAAK;AAAA,MACd,GAAG,SAAS;AAAA,IACd;AACA,OAAG,SAAS;AAAA,iBAAe,IAAI,QAAQ,YAAY,CAAC,WAAW;AAC7D,YAAM,IAAI,OAAO,KAAK,EAAE,YAAY;AACpC,aAAO,MAAM,OAAO,MAAM,KAAK;AAAA,IACjC,CAAC;AAAA,EACH,CAAC;AACH;;;AD3GA,eAAsB,mBACpB,KACA,QACA,OACgC;AAChC,QAAM,WAAW,mBAAmB,KAAK,MAAM,MAAM;AACrD,QAAM,SAAS,MAAM,UAAU,QAAQ;AACvC,QAAM,WAAW,MAAM,YAAY,oBAAoB;AACvD,QAAM,YAAY,MAAM,aAAa,OAAO,WAAW;AACvD,QAAM,iBACJ,MAAM,mBACL,CAAC,QACA,uBAAuB,KAAK,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,GAAG,IAAI,SAAS;AAG/F,QAAM,QAAQ,SAAS;AACvB,QAAM,OACJ,SAAS,MAAM,OAAO,IAClB;AAAA,IACE;AAAA,IACA,eAAe,CAAC,YAAoB,SAClC,SAAS,SAAS,YAAY;AAAA,MAC5B,WAAW,KAAK,WAAW;AAAA,MAC3B,WAAW,KAAK,aAAa;AAAA,IAC/B,CAAC;AAAA,EACL,IACA;AAEN,QAAM,SAAS,sBAAsB,UAAU,QAAQ;AAAA,IACrD,SAAS,MAAM;AAAA,IACf;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO,4BAA4B,QAAQ;AAAA,IACzC;AAAA,IACA,YAAY,OAAO,EAAE,YAAY,SAAS,MAAM;AAI9C,YAAM,YAAY,OAAO,IAAI,QAAQ,GAAG,WAAW;AACnD,YAAM,WAAW,MAAM,eAAe,EAAE,UAAU,UAAU,CAAC;AAC7D,eAAS,QAAQ,YAAY,QAAQ;AAAA,IACvC;AAAA,EACF,CAAC;AACH;;;AEhEA,eAAsB,aACpB,MACA,SACA,OAAyB,CAAC,GACM;AAChC,MAAI,CAAC,WAAW,QAAQ,KAAK,EAAE,WAAW,GAAG;AAC3C,UAAM,IAAI,MAAM,+EAA+E;AAAA,EACjG;AACA,QAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AACpD,QAAM,SAAS,WAAW,WAAW;AACrC,QAAM,QAAQ,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAChD,MAAI,CAAC,OAAO;AACV,UAAM,QAAQ,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK;AACtD,UAAM,IAAI,MAAM,mBAAmB,IAAI,kCAAkC,KAAK,EAAE;AAAA,EAClF;AAEA,QAAM,WAAW,KAAK,YAAY;AAIlC,QAAM,SACJ,KAAK,gBAAgB,MACpB,MAAM;AACL,YAAQ,EAAE,KAAK,aAAa,MAAM,cAAc,CAAC;AACjD,WAAO,gBAAgB,EAAE;AAAA,EAC3B,GAAG;AAEL,MAAI,aAAa,KAAK;AACtB,MAAI;AACJ,MAAI,CAAC,YAAY;AACf,UAAM,SAAS,MAAM,qBAAqB,WAAW;AACrD,iBAAa,OAAO;AACpB,cAAU,OAAO;AAAA,EACnB;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,WAAW,MAAM,QAAQ;AAC3C,WAAO,MAAM,SAAS,KAAK,QAAQ,EAAE,SAAS,QAAQ,MAAM,SAAS,CAAC;AAAA,EACxE,UAAE;AACA,QAAI,QAAS,OAAM,QAAQ;AAAA,EAC7B;AACF;AAOA,eAAsB,qBAAqB,aAGxC;AACD,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,MAAM;AAC5C,QAAM,SAAS,MAAM,OAAO,sBAAsB,GAAG;AACrD,QAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,2BAA4B;AACrE,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2BAA6B;AAGjE,QAAM,SAAS,MAAM,WAAW,WAAW;AAC3C,QAAM,cAAc,MAAM,gBAAgB;AAAA,IACxC,MAAM;AAAA,IACN,KAAK,OAAO;AAAA,IACZ,UAAU,OAAO;AAAA,IACjB,kBAAkB,OAAO;AAAA,EAC3B,CAAC;AACD,QAAM,SAAS,MAAM,aAAa;AAAA,IAChC,MAAM;AAAA,IACN,SAAS,CAAC,MAAM,GAAG,GAAG,WAAW;AAAA,IACjC,QAAQ,EAAE,gBAAgB,KAAK;AAAA,IAC/B,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AACD,SAAO;AAAA,IACL,MAAM,CAAC,MAAM,OAAO,cAAc,CAAC;AAAA,IACnC,SAAS,YAAY;AAGnB,YAAM,OAAO,MAAM,EAAE,MAAM,CAAC,QAAiB;AAC3C,gBAAQ,KAAK,8CAA8C,GAAG;AAAA,MAChE,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/dist/cli/index.js

@@ -5,12 +5,12 @@ import "tsx/esm";
 import cac from "cac";
 var cli = cac("theokit");
 cli.command("dev", "Start development server").option("--port <port>", "Port number").action(async (options) => {
-  const { devCommand } = await import("../dev-A7NESJ7S.js");
+  const { devCommand } = await import("../dev-D7PKQUL2.js");
   await devCommand({ port: options.port ? Number(options.port) : void 0 });
 });
 cli.command("build", "Build for production").option("--target <target>", "Deploy target (node, vercel, cloudflare)").action(async (options) => {
   try {
-    const { buildCommand } = await import("../build-5PSDDMFB.js");
+    const { buildCommand } = await import("../build-ESXLJKYY.js");
     await buildCommand({ target: options.target });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -22,7 +22,7 @@ cli.command("build", "Build for production").option("--target <target>", "Deploy
 });
 cli.command("start", "Start production server").option("--port <port>", "Port number").action(async (options) => {
   try {
-    const { startCommand } = await import("../start-WGOKQEUW.js");
+    const { startCommand } = await import("../start-5UDUXYKC.js");
     await startCommand({ port: options.port ? Number(options.port) : void 0 });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -52,7 +52,7 @@ cli.command(
   "Run an agent in the terminal (stream + tool calls + approval)"
 ).action(async (name, message) => {
   try {
-    const { agentCommand } = await import("../agent-TZ5JZUJ7.js");
+    const { agentCommand } = await import("../agent-Y4W4X46A.js");
     const { sawError } = await agentCommand(name, message);
     if (sawError) process.exit(1);
   } catch (err) {
@@ -63,6 +63,18 @@ cli.command(
     process.exit(1);
   }
 });
+cli.command("mcp <agent>", "Serve an agent as an MCP server over stdio (for desktop MCP clients)").action(async (agent) => {
+  try {
+    const { mcpCommand } = await import("../mcp-3C4CMHP4.js");
+    await mcpCommand(agent);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`
+  \u2717 ${msg}
+`);
+    process.exit(1);
+  }
+});
 cli.command("routes", "List all routes, actions, and WebSocket endpoints").action(async () => {
   try {
     const { routesCommand } = await import("../routes-NNBEZSGN.js");

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/cli/index.ts"],"sourcesContent":["import cac from 'cac'\n\ninterface CliOptions {\n  port?: string | number\n  target?: string\n  upgradeReadiness?: string | number\n  json?: boolean\n  allowWarnings?: boolean\n  force?: boolean\n  dryRun?: boolean\n}\n\nconst cli = cac('theokit')\n\ncli\n  .command('dev', 'Start development server')\n  .option('--port <port>', 'Port number')\n  .action(async (options: CliOptions) => {\n    const { devCommand } = await import('./commands/dev.js')\n    await devCommand({ port: options.port ? Number(options.port) : undefined })\n  })\n\ncli\n  .command('build', 'Build for production')\n  .option('--target <target>', 'Deploy target (node, vercel, cloudflare)')\n  .action(async (options: CliOptions) => {\n    try {\n      const { buildCommand } = await import('./commands/build.js')\n      await buildCommand({ target: options.target })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('start', 'Start production server')\n  .option('--port <port>', 'Port number')\n  .action(async (options: CliOptions) => {\n    try {\n      const { startCommand } = await import('./commands/start/index.js')\n      await startCommand({ port: options.port ? Number(options.port) : undefined })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command(\n    'generate <type> <name> [...fields]',\n    'Generate a route, action, page, ws, controller, or resource (resource accepts field:type args)',\n  )\n  .action(async (type: string, name: string, fields: string[]) => {\n    try {\n      const { generateCommand } = await import('./commands/generate.js')\n      await generateCommand(type, name, fields.length > 0 ? fields : undefined)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command(\n    'agent <name> [message]',\n    'Run an agent in the terminal (stream + tool calls + approval)',\n  )\n  .action(async (name: string, message: string | undefined) => {\n    try {\n      const { agentCommand } = await import('./commands/agent.js')\n      const { sawError } = await agentCommand(name, message)\n      // The run ended with an error chunk (already rendered) — exit non-zero so `$?` / CI reflects it.\n      if (sawError) process.exit(1)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli.command('routes', 'List all routes, actions, and WebSocket endpoints').action(async () => {\n  try {\n    const { routesCommand } = await import('./commands/routes.js')\n    await routesCommand()\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err)\n    console.error(`\\n  ✗ ${msg}\\n`)\n    process.exit(1)\n  }\n})\n\ncli\n  .command('check', 'Run typecheck + scan + (optional) eslint')\n  .option(\n    '--upgrade-readiness <version>',\n    'Scan source for anticipated breakage under a future TheoKit version (currently supports 0.3). See docs/migration/0.2-to-0.3.md',\n  )\n  .option('--json', 'Emit machine-readable JSON (only with --upgrade-readiness)')\n  .option(\n    '--allow-warnings',\n    'Do not fail the build when violations are present (only with --upgrade-readiness)',\n  )\n  .action(async (options: CliOptions) => {\n    // cac may coerce `0.3` to a JS number — normalize before comparing.\n    const targetRaw = options.upgradeReadiness\n    if (targetRaw !== undefined) {\n      const target = String(targetRaw)\n      if (target !== '0.3') {\n        console.error(`\\n  ✗ --upgrade-readiness: only '0.3' is supported (got '${target}')\\n`)\n        process.exit(1)\n      }\n      const { upgradeReadinessCommand } = await import('./commands/upgrade-readiness.js')\n      await upgradeReadinessCommand({\n        json: Boolean(options.json),\n        allowWarnings: Boolean(options.allowWarnings),\n      })\n      return\n    }\n    const { checkCommand } = await import('./commands/check.js')\n    await checkCommand()\n  })\n\ncli\n  .command('add <package>', 'Install a known TheoKit adapter or plugin (whitelist-only)')\n  .action(async (pkg: string) => {\n    const { addCommand } = await import('./commands/add.js')\n    await addCommand(pkg)\n  })\n\ncli.command('info', 'Print environment info (runtime, config, routes)').action(async () => {\n  const { infoCommand } = await import('./commands/info.js')\n  await infoCommand()\n})\n\ncli\n  .command(\n    'openapi',\n    'Generate <distDir>/openapi.json from route schemas (opt-in via config.openapi)',\n  )\n  .option('--dry-run', 'Print the document to stdout without writing to disk (EC-3)')\n  .action(async (options: CliOptions) => {\n    try {\n      const { openapiCommand } = await import('./commands/openapi.js')\n      await openapiCommand({ dryRun: Boolean(options.dryRun) })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command(\n    'migrate <kind>',\n    'Run a one-shot convention migration. Supported: router (G6 dotted→nested), services-json-v1-to-v2 (Plan v1.2 T2.3)',\n  )\n  .option('--dry-run', 'Print the migration plan but do not touch the filesystem')\n  .option('--force', 'Skip the dev-server port pre-flight check (CI / non-TTY)')\n  .option('--name <slug>', 'Explicit project name (DNS-1123). Services-json migrate only.')\n  .action(async (kind: string, options: CliOptions & { name?: string }) => {\n    try {\n      if (kind === 'router') {\n        const { routerMigrateCommand } = await import('./commands/migrate/router.js')\n        await routerMigrateCommand({\n          dryRun: Boolean(options.dryRun),\n          force: Boolean(options.force),\n        })\n        return\n      }\n      if (kind === 'services-json-v1-to-v2' || kind === 'services-json') {\n        const { servicesJsonMigrateCommand } = await import('./commands/migrate/services-json.js')\n        await servicesJsonMigrateCommand({\n          dryRun: Boolean(options.dryRun),\n          name: options.name,\n        })\n        return\n      }\n      console.error(\n        `\\n  ✗ Unknown migration kind: ${kind}. Supported: router, services-json-v1-to-v2\\n`,\n      )\n      process.exit(1)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('docker', 'Generate Dockerfile for production')\n  .option('--force', 'Overwrite existing Dockerfile')\n  .action(async (options: CliOptions) => {\n    try {\n      const { dockerCommand } = await import('./commands/docker.js')\n      await dockerCommand({ force: options.force })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('db <action>', 'Database commands: migrate (push schema), generate (SQL files), seed')\n  .action(async (action: string) => {\n    try {\n      const { dbCommandCli } = await import('./commands/db.js')\n      dbCommandCli(action)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli.help()\ncli.version('0.1.0-alpha.0')\n\nexport function main(): void {\n  cli.parse()\n}\n\n// Auto-execute when run as script\nmain()\n"],"mappings":";;;;AAAA,OAAO,SAAS;AAYhB,IAAM,MAAM,IAAI,SAAS;AAEzB,IACG,QAAQ,OAAO,0BAA0B,EACzC,OAAO,iBAAiB,aAAa,EACrC,OAAO,OAAO,YAAwB;AACrC,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAmB;AACvD,QAAM,WAAW,EAAE,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,IAAI,OAAU,CAAC;AAC5E,CAAC;AAEH,IACG,QAAQ,SAAS,sBAAsB,EACvC,OAAO,qBAAqB,0CAA0C,EACtE,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAqB;AAC3D,UAAM,aAAa,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,SAAS,yBAAyB,EAC1C,OAAO,iBAAiB,aAAa,EACrC,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAA2B;AACjE,UAAM,aAAa,EAAE,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,IAAI,OAAU,CAAC;AAAA,EAC9E,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,OAAO,MAAc,MAAc,WAAqB;AAC9D,MAAI;AACF,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,yBAAwB;AACjE,UAAM,gBAAgB,MAAM,MAAM,OAAO,SAAS,IAAI,SAAS,MAAS;AAAA,EAC1E,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,OAAO,MAAc,YAAgC;AAC3D,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAqB;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,aAAa,MAAM,OAAO;AAErD,QAAI,SAAU,SAAQ,KAAK,CAAC;AAAA,EAC9B,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IAAI,QAAQ,UAAU,mDAAmD,EAAE,OAAO,YAAY;AAC5F,MAAI;AACF,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAsB;AAC7D,UAAM,cAAc;AAAA,EACtB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAED,IACG,QAAQ,SAAS,0CAA0C,EAC3D;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,UAAU,4DAA4D,EAC7E;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,OAAO,YAAwB;AAErC,QAAM,YAAY,QAAQ;AAC1B,MAAI,cAAc,QAAW;AAC3B,UAAM,SAAS,OAAO,SAAS;AAC/B,QAAI,WAAW,OAAO;AACpB,cAAQ,MAAM;AAAA,8DAA4D,MAAM;AAAA,CAAM;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,UAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,kCAAiC;AAClF,UAAM,wBAAwB;AAAA,MAC5B,MAAM,QAAQ,QAAQ,IAAI;AAAA,MAC1B,eAAe,QAAQ,QAAQ,aAAa;AAAA,IAC9C,CAAC;AACD;AAAA,EACF;AACA,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAqB;AAC3D,QAAM,aAAa;AACrB,CAAC;AAEH,IACG,QAAQ,iBAAiB,4DAA4D,EACrF,OAAO,OAAO,QAAgB;AAC7B,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAmB;AACvD,QAAM,WAAW,GAAG;AACtB,CAAC;AAEH,IAAI,QAAQ,QAAQ,kDAAkD,EAAE,OAAO,YAAY;AACzF,QAAM,EAAE,YAAY,IAAI,MAAM,OAAO,qBAAoB;AACzD,QAAM,YAAY;AACpB,CAAC;AAED,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,aAAa,6DAA6D,EACjF,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,wBAAuB;AAC/D,UAAM,eAAe,EAAE,QAAQ,QAAQ,QAAQ,MAAM,EAAE,CAAC;AAAA,EAC1D,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,aAAa,0DAA0D,EAC9E,OAAO,WAAW,0DAA0D,EAC5E,OAAO,iBAAiB,+DAA+D,EACvF,OAAO,OAAO,MAAc,YAA4C;AACvE,MAAI;AACF,QAAI,SAAS,UAAU;AACrB,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,uBAA8B;AAC5E,YAAM,qBAAqB;AAAA,QACzB,QAAQ,QAAQ,QAAQ,MAAM;AAAA,QAC9B,OAAO,QAAQ,QAAQ,KAAK;AAAA,MAC9B,CAAC;AACD;AAAA,IACF;AACA,QAAI,SAAS,4BAA4B,SAAS,iBAAiB;AACjE,YAAM,EAAE,2BAA2B,IAAI,MAAM,OAAO,8BAAqC;AACzF,YAAM,2BAA2B;AAAA,QAC/B,QAAQ,QAAQ,QAAQ,MAAM;AAAA,QAC9B,MAAM,QAAQ;AAAA,MAChB,CAAC;AACD;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,mCAAiC,IAAI;AAAA;AAAA,IACvC;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,UAAU,oCAAoC,EACtD,OAAO,WAAW,+BAA+B,EACjD,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAsB;AAC7D,UAAM,cAAc,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,EAC9C,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,eAAe,sEAAsE,EAC7F,OAAO,OAAO,WAAmB;AAChC,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,mBAAkB;AACxD,iBAAa,MAAM;AAAA,EACrB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IAAI,KAAK;AACT,IAAI,QAAQ,eAAe;AAEpB,SAAS,OAAa;AAC3B,MAAI,MAAM;AACZ;AAGA,KAAK;","names":[]}
+{"version":3,"sources":["../../src/cli/index.ts"],"sourcesContent":["import cac from 'cac'\n\ninterface CliOptions {\n  port?: string | number\n  target?: string\n  upgradeReadiness?: string | number\n  json?: boolean\n  allowWarnings?: boolean\n  force?: boolean\n  dryRun?: boolean\n}\n\nconst cli = cac('theokit')\n\ncli\n  .command('dev', 'Start development server')\n  .option('--port <port>', 'Port number')\n  .action(async (options: CliOptions) => {\n    const { devCommand } = await import('./commands/dev.js')\n    await devCommand({ port: options.port ? Number(options.port) : undefined })\n  })\n\ncli\n  .command('build', 'Build for production')\n  .option('--target <target>', 'Deploy target (node, vercel, cloudflare)')\n  .action(async (options: CliOptions) => {\n    try {\n      const { buildCommand } = await import('./commands/build.js')\n      await buildCommand({ target: options.target })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('start', 'Start production server')\n  .option('--port <port>', 'Port number')\n  .action(async (options: CliOptions) => {\n    try {\n      const { startCommand } = await import('./commands/start/index.js')\n      await startCommand({ port: options.port ? Number(options.port) : undefined })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command(\n    'generate <type> <name> [...fields]',\n    'Generate a route, action, page, ws, controller, or resource (resource accepts field:type args)',\n  )\n  .action(async (type: string, name: string, fields: string[]) => {\n    try {\n      const { generateCommand } = await import('./commands/generate.js')\n      await generateCommand(type, name, fields.length > 0 ? fields : undefined)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command(\n    'agent <name> [message]',\n    'Run an agent in the terminal (stream + tool calls + approval)',\n  )\n  .action(async (name: string, message: string | undefined) => {\n    try {\n      const { agentCommand } = await import('./commands/agent.js')\n      const { sawError } = await agentCommand(name, message)\n      // The run ended with an error chunk (already rendered) — exit non-zero so `$?` / CI reflects it.\n      if (sawError) process.exit(1)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('mcp <agent>', 'Serve an agent as an MCP server over stdio (for desktop MCP clients)')\n  .action(async (agent: string) => {\n    try {\n      const { mcpCommand } = await import('./commands/mcp.js')\n      await mcpCommand(agent)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli.command('routes', 'List all routes, actions, and WebSocket endpoints').action(async () => {\n  try {\n    const { routesCommand } = await import('./commands/routes.js')\n    await routesCommand()\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err)\n    console.error(`\\n  ✗ ${msg}\\n`)\n    process.exit(1)\n  }\n})\n\ncli\n  .command('check', 'Run typecheck + scan + (optional) eslint')\n  .option(\n    '--upgrade-readiness <version>',\n    'Scan source for anticipated breakage under a future TheoKit version (currently supports 0.3). See docs/migration/0.2-to-0.3.md',\n  )\n  .option('--json', 'Emit machine-readable JSON (only with --upgrade-readiness)')\n  .option(\n    '--allow-warnings',\n    'Do not fail the build when violations are present (only with --upgrade-readiness)',\n  )\n  .action(async (options: CliOptions) => {\n    // cac may coerce `0.3` to a JS number — normalize before comparing.\n    const targetRaw = options.upgradeReadiness\n    if (targetRaw !== undefined) {\n      const target = String(targetRaw)\n      if (target !== '0.3') {\n        console.error(`\\n  ✗ --upgrade-readiness: only '0.3' is supported (got '${target}')\\n`)\n        process.exit(1)\n      }\n      const { upgradeReadinessCommand } = await import('./commands/upgrade-readiness.js')\n      await upgradeReadinessCommand({\n        json: Boolean(options.json),\n        allowWarnings: Boolean(options.allowWarnings),\n      })\n      return\n    }\n    const { checkCommand } = await import('./commands/check.js')\n    await checkCommand()\n  })\n\ncli\n  .command('add <package>', 'Install a known TheoKit adapter or plugin (whitelist-only)')\n  .action(async (pkg: string) => {\n    const { addCommand } = await import('./commands/add.js')\n    await addCommand(pkg)\n  })\n\ncli.command('info', 'Print environment info (runtime, config, routes)').action(async () => {\n  const { infoCommand } = await import('./commands/info.js')\n  await infoCommand()\n})\n\ncli\n  .command(\n    'openapi',\n    'Generate <distDir>/openapi.json from route schemas (opt-in via config.openapi)',\n  )\n  .option('--dry-run', 'Print the document to stdout without writing to disk (EC-3)')\n  .action(async (options: CliOptions) => {\n    try {\n      const { openapiCommand } = await import('./commands/openapi.js')\n      await openapiCommand({ dryRun: Boolean(options.dryRun) })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command(\n    'migrate <kind>',\n    'Run a one-shot convention migration. Supported: router (G6 dotted→nested), services-json-v1-to-v2 (Plan v1.2 T2.3)',\n  )\n  .option('--dry-run', 'Print the migration plan but do not touch the filesystem')\n  .option('--force', 'Skip the dev-server port pre-flight check (CI / non-TTY)')\n  .option('--name <slug>', 'Explicit project name (DNS-1123). Services-json migrate only.')\n  .action(async (kind: string, options: CliOptions & { name?: string }) => {\n    try {\n      if (kind === 'router') {\n        const { routerMigrateCommand } = await import('./commands/migrate/router.js')\n        await routerMigrateCommand({\n          dryRun: Boolean(options.dryRun),\n          force: Boolean(options.force),\n        })\n        return\n      }\n      if (kind === 'services-json-v1-to-v2' || kind === 'services-json') {\n        const { servicesJsonMigrateCommand } = await import('./commands/migrate/services-json.js')\n        await servicesJsonMigrateCommand({\n          dryRun: Boolean(options.dryRun),\n          name: options.name,\n        })\n        return\n      }\n      console.error(\n        `\\n  ✗ Unknown migration kind: ${kind}. Supported: router, services-json-v1-to-v2\\n`,\n      )\n      process.exit(1)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('docker', 'Generate Dockerfile for production')\n  .option('--force', 'Overwrite existing Dockerfile')\n  .action(async (options: CliOptions) => {\n    try {\n      const { dockerCommand } = await import('./commands/docker.js')\n      await dockerCommand({ force: options.force })\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli\n  .command('db <action>', 'Database commands: migrate (push schema), generate (SQL files), seed')\n  .action(async (action: string) => {\n    try {\n      const { dbCommandCli } = await import('./commands/db.js')\n      dbCommandCli(action)\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err)\n      console.error(`\\n  ✗ ${msg}\\n`)\n      process.exit(1)\n    }\n  })\n\ncli.help()\ncli.version('0.1.0-alpha.0')\n\nexport function main(): void {\n  cli.parse()\n}\n\n// Auto-execute when run as script\nmain()\n"],"mappings":";;;;AAAA,OAAO,SAAS;AAYhB,IAAM,MAAM,IAAI,SAAS;AAEzB,IACG,QAAQ,OAAO,0BAA0B,EACzC,OAAO,iBAAiB,aAAa,EACrC,OAAO,OAAO,YAAwB;AACrC,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAmB;AACvD,QAAM,WAAW,EAAE,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,IAAI,OAAU,CAAC;AAC5E,CAAC;AAEH,IACG,QAAQ,SAAS,sBAAsB,EACvC,OAAO,qBAAqB,0CAA0C,EACtE,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAqB;AAC3D,UAAM,aAAa,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,SAAS,yBAAyB,EAC1C,OAAO,iBAAiB,aAAa,EACrC,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAA2B;AACjE,UAAM,aAAa,EAAE,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,IAAI,OAAU,CAAC;AAAA,EAC9E,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,OAAO,MAAc,MAAc,WAAqB;AAC9D,MAAI;AACF,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,yBAAwB;AACjE,UAAM,gBAAgB,MAAM,MAAM,OAAO,SAAS,IAAI,SAAS,MAAS;AAAA,EAC1E,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,OAAO,MAAc,YAAgC;AAC3D,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAqB;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,aAAa,MAAM,OAAO;AAErD,QAAI,SAAU,SAAQ,KAAK,CAAC;AAAA,EAC9B,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,eAAe,sEAAsE,EAC7F,OAAO,OAAO,UAAkB;AAC/B,MAAI;AACF,UAAM,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAmB;AACvD,UAAM,WAAW,KAAK;AAAA,EACxB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IAAI,QAAQ,UAAU,mDAAmD,EAAE,OAAO,YAAY;AAC5F,MAAI;AACF,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAsB;AAC7D,UAAM,cAAc;AAAA,EACtB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAED,IACG,QAAQ,SAAS,0CAA0C,EAC3D;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,UAAU,4DAA4D,EAC7E;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,OAAO,YAAwB;AAErC,QAAM,YAAY,QAAQ;AAC1B,MAAI,cAAc,QAAW;AAC3B,UAAM,SAAS,OAAO,SAAS;AAC/B,QAAI,WAAW,OAAO;AACpB,cAAQ,MAAM;AAAA,8DAA4D,MAAM;AAAA,CAAM;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,UAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,kCAAiC;AAClF,UAAM,wBAAwB;AAAA,MAC5B,MAAM,QAAQ,QAAQ,IAAI;AAAA,MAC1B,eAAe,QAAQ,QAAQ,aAAa;AAAA,IAC9C,CAAC;AACD;AAAA,EACF;AACA,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAqB;AAC3D,QAAM,aAAa;AACrB,CAAC;AAEH,IACG,QAAQ,iBAAiB,4DAA4D,EACrF,OAAO,OAAO,QAAgB;AAC7B,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,oBAAmB;AACvD,QAAM,WAAW,GAAG;AACtB,CAAC;AAEH,IAAI,QAAQ,QAAQ,kDAAkD,EAAE,OAAO,YAAY;AACzF,QAAM,EAAE,YAAY,IAAI,MAAM,OAAO,qBAAoB;AACzD,QAAM,YAAY;AACpB,CAAC;AAED,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,aAAa,6DAA6D,EACjF,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,wBAAuB;AAC/D,UAAM,eAAe,EAAE,QAAQ,QAAQ,QAAQ,MAAM,EAAE,CAAC;AAAA,EAC1D,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,aAAa,0DAA0D,EAC9E,OAAO,WAAW,0DAA0D,EAC5E,OAAO,iBAAiB,+DAA+D,EACvF,OAAO,OAAO,MAAc,YAA4C;AACvE,MAAI;AACF,QAAI,SAAS,UAAU;AACrB,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,uBAA8B;AAC5E,YAAM,qBAAqB;AAAA,QACzB,QAAQ,QAAQ,QAAQ,MAAM;AAAA,QAC9B,OAAO,QAAQ,QAAQ,KAAK;AAAA,MAC9B,CAAC;AACD;AAAA,IACF;AACA,QAAI,SAAS,4BAA4B,SAAS,iBAAiB;AACjE,YAAM,EAAE,2BAA2B,IAAI,MAAM,OAAO,8BAAqC;AACzF,YAAM,2BAA2B;AAAA,QAC/B,QAAQ,QAAQ,QAAQ,MAAM;AAAA,QAC9B,MAAM,QAAQ;AAAA,MAChB,CAAC;AACD;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,mCAAiC,IAAI;AAAA;AAAA,IACvC;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,UAAU,oCAAoC,EACtD,OAAO,WAAW,+BAA+B,EACjD,OAAO,OAAO,YAAwB;AACrC,MAAI;AACF,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAsB;AAC7D,UAAM,cAAc,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,EAC9C,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IACG,QAAQ,eAAe,sEAAsE,EAC7F,OAAO,OAAO,WAAmB;AAChC,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,mBAAkB;AACxD,iBAAa,MAAM;AAAA,EACrB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,CAAC;AAEH,IAAI,KAAK;AACT,IAAI,QAAQ,eAAe;AAEpB,SAAS,OAAa;AAC3B,MAAI,MAAM;AACZ;AAGA,KAAK;","names":[]}

package/dist/{dev-A7NESJ7S.js → dev-D7PKQUL2.js}

@@ -8,8 +8,9 @@ import {
 } from "./chunk-HNBWZKIQ.js";
 import {
   theoPluginAsync
-} from "./chunk-CC5WOQUV.js";
-import "./chunk-XVFMSNDE.js";
+} from "./chunk-ULFNEG27.js";
+import "./chunk-DXF64KS5.js";
+import "./chunk-DMC6HYUR.js";
 import "./chunk-M6NMS5LR.js";
 import "./chunk-IEES3CHD.js";
 import {
@@ -104,4 +105,4 @@ export {
   devCommand,
   startDevServer
 };
-//# sourceMappingURL=dev-A7NESJ7S.js.map
+//# sourceMappingURL=dev-D7PKQUL2.js.map

package/dist/{dev-A7NESJ7S.js.map → dev-D7PKQUL2.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/dev.ts"],"sourcesContent":["import react from '@vitejs/plugin-react'\nimport { createServer, type Plugin, type ViteDevServer } from 'vite'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { loadEnv } from '../../config/load-env.js'\nimport { validateProjectStructure } from '../../config/validate-structure.js'\nimport { orchestrateDev } from '../../services/index.js'\nimport { theoPluginAsync } from '../../vite-plugin/index.js'\nimport { preflightNodeAndBindings } from '../preflight-node-version.js'\n\ninterface DevOptions {\n  port?: number\n}\n\nexport async function startDevServer(cwd: string, options?: DevOptions): Promise<ViteDevServer> {\n  // Preflight (FIRST — BEFORE anything that touches native bindings):\n  // verifies Node version + native binding ABI match. Emits actionable\n  // error referencing `nvm use` + `pnpm rebuild` when the dev server\n  // was spawned under the wrong Node (common gotcha with `nohup env ...`\n  // stripping the nvm PATH prefix).\n  preflightNodeAndBindings(cwd)\n\n  // Phase 1 (T1.2) — Load .env files into process.env BEFORE any module\n  // reads them. Must run before loadConfig() so theo.config.ts functions\n  // referencing process.env.* resolve correctly.\n  loadEnv({ cwd, mode: 'development' })\n\n  const config = await loadConfig(cwd)\n  validateProjectStructure(cwd)\n\n  // Wave 2 (T1.1) — spawn polyglot services BEFORE Vite. Healthcheck gates\n  // readiness. Empty `services: {}` → early return (Wave 1 BC preserved).\n  const orchestration = await orchestrateDev({\n    cwd,\n    services: config.services,\n  })\n  if (!orchestration.allHealthy) {\n    await orchestration.stop()\n    throw new Error(\n      `[services] services failed healthcheck: ${orchestration.unhealthy.join(', ')}. ` +\n        `Check that each declared service binds its port and responds 200 on its ` +\n        `healthcheck path within 30s.`,\n    )\n  }\n\n  // Phase 7 — legacy fs-mtime sweep removed: SDK's Agent.registry handles\n  // LRU + idle eviction natively (configurable via theo.config.ts >\n  // agents.registry; lazy-configured on first request).\n\n  const port = options?.port ?? config.port\n  // Narrow the rateLimit union: only the legacy flat shape (windowMs+max)\n  // flows into the theoPlugin's RateLimitConfig parameter. The per-route\n  // variant is consumed inside the api-middleware via the loaded user\n  // config separately.\n  const flatRateLimit =\n    config.rateLimit && 'windowMs' in config.rateLimit && 'max' in config.rateLimit\n      ? config.rateLimit\n      : undefined\n  // theoPluginAsync auto-chains @theokit/ui + @tailwindcss/vite via\n  // top-level Plugin[] return (sync `theoPlugin()` factory's config()\n  // hook returning {plugins:[...]} is silently dropped by Vite — see\n  // commit history). Spread the result so Vite flattens them.\n  let server: ViteDevServer\n  try {\n    const theoPlugins = await theoPluginAsync({\n      root: cwd,\n      rateLimit: flatRateLimit,\n      ssr: config.ssr,\n      // Wave 2 (T3.1) — wire typed-client plugin when services declared.\n      services: config.services,\n      // T4.1 (canvas-ecosystem-refactor / ADR D6) — passthrough peer-deps\n      // that plugins import dynamically (e.g., mermaid via plugin-canvas).\n      viteOptimizeDeps: config.viteOptimizeDeps,\n    })\n    server = await createServer({\n      root: cwd,\n      plugins: [react(), ...theoPlugins] as Plugin[],\n      server: {\n        port,\n        host: config.host,\n        open: config.open,\n        strictPort: config.strictPort,\n        warmup: config.warmup ?? {\n          clientFiles: ['./app/**/*.tsx', './app/**/*.ts'],\n        },\n      },\n      logLevel: options?.port === 0 ? 'silent' : undefined,\n    })\n\n    await server.listen()\n  } catch (err) {\n    // EC-1 / try-finally pattern: if Vite create/listen fails AFTER services\n    // started, stop them so we don't leak child processes.\n    await orchestration.stop()\n    throw err\n  }\n\n  // EC-1 fix: attach orchestration.stop() to the underlying HTTP server's\n  // close event via Node-native API. We do NOT mutate `server.close`\n  // (fragile across Vite upgrades). httpServer is `http.Server | null`.\n  server.httpServer?.on('close', () => {\n    void orchestration.stop()\n  })\n\n  return server\n}\n\nexport async function devCommand(options: DevOptions): Promise<void> {\n  try {\n    const cwd = process.cwd()\n    const server = await startDevServer(cwd, options)\n    server.printUrls()\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err)\n    console.error(`\\n  ✗ ${msg}\\n`)\n    process.exit(1)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,WAAW;AAClB,SAAS,oBAAqD;AAa9D,eAAsB,eAAe,KAAa,SAA8C;AAM9F,2BAAyB,GAAG;AAK5B,UAAQ,EAAE,KAAK,MAAM,cAAc,CAAC;AAEpC,QAAM,SAAS,MAAM,WAAW,GAAG;AACnC,2BAAyB,GAAG;AAI5B,QAAM,gBAAgB,MAAM,eAAe;AAAA,IACzC;AAAA,IACA,UAAU,OAAO;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,cAAc,YAAY;AAC7B,UAAM,cAAc,KAAK;AACzB,UAAM,IAAI;AAAA,MACR,2CAA2C,cAAc,UAAU,KAAK,IAAI,CAAC;AAAA,IAG/E;AAAA,EACF;AAMA,QAAM,OAAO,SAAS,QAAQ,OAAO;AAKrC,QAAM,gBACJ,OAAO,aAAa,cAAc,OAAO,aAAa,SAAS,OAAO,YAClE,OAAO,YACP;AAKN,MAAI;AACJ,MAAI;AACF,UAAM,cAAc,MAAM,gBAAgB;AAAA,MACxC,MAAM;AAAA,MACN,WAAW;AAAA,MACX,KAAK,OAAO;AAAA;AAAA,MAEZ,UAAU,OAAO;AAAA;AAAA;AAAA,MAGjB,kBAAkB,OAAO;AAAA,IAC3B,CAAC;AACD,aAAS,MAAM,aAAa;AAAA,MAC1B,MAAM;AAAA,MACN,SAAS,CAAC,MAAM,GAAG,GAAG,WAAW;AAAA,MACjC,QAAQ;AAAA,QACN;AAAA,QACA,MAAM,OAAO;AAAA,QACb,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO,UAAU;AAAA,UACvB,aAAa,CAAC,kBAAkB,eAAe;AAAA,QACjD;AAAA,MACF;AAAA,MACA,UAAU,SAAS,SAAS,IAAI,WAAW;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,OAAO;AAAA,EACtB,SAAS,KAAK;AAGZ,UAAM,cAAc,KAAK;AACzB,UAAM;AAAA,EACR;AAKA,SAAO,YAAY,GAAG,SAAS,MAAM;AACnC,SAAK,cAAc,KAAK;AAAA,EAC1B,CAAC;AAED,SAAO;AACT;AAEA,eAAsB,WAAW,SAAoC;AACnE,MAAI;AACF,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,SAAS,MAAM,eAAe,KAAK,OAAO;AAChD,WAAO,UAAU;AAAA,EACnB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":[]}
+{"version":3,"sources":["../src/cli/commands/dev.ts"],"sourcesContent":["import react from '@vitejs/plugin-react'\nimport { createServer, type Plugin, type ViteDevServer } from 'vite'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { loadEnv } from '../../config/load-env.js'\nimport { validateProjectStructure } from '../../config/validate-structure.js'\nimport { orchestrateDev } from '../../services/index.js'\nimport { theoPluginAsync } from '../../vite-plugin/index.js'\nimport { preflightNodeAndBindings } from '../preflight-node-version.js'\n\ninterface DevOptions {\n  port?: number\n}\n\nexport async function startDevServer(cwd: string, options?: DevOptions): Promise<ViteDevServer> {\n  // Preflight (FIRST — BEFORE anything that touches native bindings):\n  // verifies Node version + native binding ABI match. Emits actionable\n  // error referencing `nvm use` + `pnpm rebuild` when the dev server\n  // was spawned under the wrong Node (common gotcha with `nohup env ...`\n  // stripping the nvm PATH prefix).\n  preflightNodeAndBindings(cwd)\n\n  // Phase 1 (T1.2) — Load .env files into process.env BEFORE any module\n  // reads them. Must run before loadConfig() so theo.config.ts functions\n  // referencing process.env.* resolve correctly.\n  loadEnv({ cwd, mode: 'development' })\n\n  const config = await loadConfig(cwd)\n  validateProjectStructure(cwd)\n\n  // Wave 2 (T1.1) — spawn polyglot services BEFORE Vite. Healthcheck gates\n  // readiness. Empty `services: {}` → early return (Wave 1 BC preserved).\n  const orchestration = await orchestrateDev({\n    cwd,\n    services: config.services,\n  })\n  if (!orchestration.allHealthy) {\n    await orchestration.stop()\n    throw new Error(\n      `[services] services failed healthcheck: ${orchestration.unhealthy.join(', ')}. ` +\n        `Check that each declared service binds its port and responds 200 on its ` +\n        `healthcheck path within 30s.`,\n    )\n  }\n\n  // Phase 7 — legacy fs-mtime sweep removed: SDK's Agent.registry handles\n  // LRU + idle eviction natively (configurable via theo.config.ts >\n  // agents.registry; lazy-configured on first request).\n\n  const port = options?.port ?? config.port\n  // Narrow the rateLimit union: only the legacy flat shape (windowMs+max)\n  // flows into the theoPlugin's RateLimitConfig parameter. The per-route\n  // variant is consumed inside the api-middleware via the loaded user\n  // config separately.\n  const flatRateLimit =\n    config.rateLimit && 'windowMs' in config.rateLimit && 'max' in config.rateLimit\n      ? config.rateLimit\n      : undefined\n  // theoPluginAsync auto-chains @theokit/ui + @tailwindcss/vite via\n  // top-level Plugin[] return (sync `theoPlugin()` factory's config()\n  // hook returning {plugins:[...]} is silently dropped by Vite — see\n  // commit history). Spread the result so Vite flattens them.\n  let server: ViteDevServer\n  try {\n    const theoPlugins = await theoPluginAsync({\n      root: cwd,\n      rateLimit: flatRateLimit,\n      ssr: config.ssr,\n      // Wave 2 (T3.1) — wire typed-client plugin when services declared.\n      services: config.services,\n      // T4.1 (canvas-ecosystem-refactor / ADR D6) — passthrough peer-deps\n      // that plugins import dynamically (e.g., mermaid via plugin-canvas).\n      viteOptimizeDeps: config.viteOptimizeDeps,\n    })\n    server = await createServer({\n      root: cwd,\n      plugins: [react(), ...theoPlugins] as Plugin[],\n      server: {\n        port,\n        host: config.host,\n        open: config.open,\n        strictPort: config.strictPort,\n        warmup: config.warmup ?? {\n          clientFiles: ['./app/**/*.tsx', './app/**/*.ts'],\n        },\n      },\n      logLevel: options?.port === 0 ? 'silent' : undefined,\n    })\n\n    await server.listen()\n  } catch (err) {\n    // EC-1 / try-finally pattern: if Vite create/listen fails AFTER services\n    // started, stop them so we don't leak child processes.\n    await orchestration.stop()\n    throw err\n  }\n\n  // EC-1 fix: attach orchestration.stop() to the underlying HTTP server's\n  // close event via Node-native API. We do NOT mutate `server.close`\n  // (fragile across Vite upgrades). httpServer is `http.Server | null`.\n  server.httpServer?.on('close', () => {\n    void orchestration.stop()\n  })\n\n  return server\n}\n\nexport async function devCommand(options: DevOptions): Promise<void> {\n  try {\n    const cwd = process.cwd()\n    const server = await startDevServer(cwd, options)\n    server.printUrls()\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err)\n    console.error(`\\n  ✗ ${msg}\\n`)\n    process.exit(1)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,WAAW;AAClB,SAAS,oBAAqD;AAa9D,eAAsB,eAAe,KAAa,SAA8C;AAM9F,2BAAyB,GAAG;AAK5B,UAAQ,EAAE,KAAK,MAAM,cAAc,CAAC;AAEpC,QAAM,SAAS,MAAM,WAAW,GAAG;AACnC,2BAAyB,GAAG;AAI5B,QAAM,gBAAgB,MAAM,eAAe;AAAA,IACzC;AAAA,IACA,UAAU,OAAO;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,cAAc,YAAY;AAC7B,UAAM,cAAc,KAAK;AACzB,UAAM,IAAI;AAAA,MACR,2CAA2C,cAAc,UAAU,KAAK,IAAI,CAAC;AAAA,IAG/E;AAAA,EACF;AAMA,QAAM,OAAO,SAAS,QAAQ,OAAO;AAKrC,QAAM,gBACJ,OAAO,aAAa,cAAc,OAAO,aAAa,SAAS,OAAO,YAClE,OAAO,YACP;AAKN,MAAI;AACJ,MAAI;AACF,UAAM,cAAc,MAAM,gBAAgB;AAAA,MACxC,MAAM;AAAA,MACN,WAAW;AAAA,MACX,KAAK,OAAO;AAAA;AAAA,MAEZ,UAAU,OAAO;AAAA;AAAA;AAAA,MAGjB,kBAAkB,OAAO;AAAA,IAC3B,CAAC;AACD,aAAS,MAAM,aAAa;AAAA,MAC1B,MAAM;AAAA,MACN,SAAS,CAAC,MAAM,GAAG,GAAG,WAAW;AAAA,MACjC,QAAQ;AAAA,QACN;AAAA,QACA,MAAM,OAAO;AAAA,QACb,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO,UAAU;AAAA,UACvB,aAAa,CAAC,kBAAkB,eAAe;AAAA,QACjD;AAAA,MACF;AAAA,MACA,UAAU,SAAS,SAAS,IAAI,WAAW;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,OAAO;AAAA,EACtB,SAAS,KAAK;AAGZ,UAAM,cAAc,KAAK;AACzB,UAAM;AAAA,EACR;AAKA,SAAO,YAAY,GAAG,SAAS,MAAM;AACnC,SAAK,cAAc,KAAK;AAAA,EAC1B,CAAC;AAED,SAAO;AACT;AAEA,eAAsB,WAAW,SAAoC;AACnE,MAAI;AACF,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,SAAS,MAAM,eAAe,KAAK,OAAO;AAChD,WAAO,UAAU;AAAA,EACnB,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ,MAAM;AAAA,WAAS,GAAG;AAAA,CAAI;AAC9B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":[]}

package/dist/index.js

@@ -8,11 +8,11 @@ import {
   scanRoutes,
   theoConfigSchema,
   theoPlugin
-} from "./chunk-DEO2VAJE.js";
+} from "./chunk-7NTXG7SI.js";
 import "./chunk-D7ZH7DTG.js";
 import "./chunk-RSVN727G.js";
 import "./chunk-7BIM27LV.js";
-import "./chunk-XWS4RZCE.js";
+import "./chunk-W4YO6S4I.js";
 import "./chunk-5QW7IQQU.js";
 import "./chunk-IAJ2JVEH.js";
 import "./chunk-VMEWD57H.js";