theokit 0.2.0 → 0.2.1

package/dist/chunk-QLGES2HC.js

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  walkSourceFiles
+} from "./chunk-MOT42NAH.js";
+
+// src/core/contracts/http-methods.ts
+var HTTP_METHODS = [
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS"
+];
+var HTTP_METHOD_LOWERCASE = HTTP_METHODS.map((m) => m.toLowerCase());
+
+// src/server/scan/scan.ts
+import { existsSync, statSync } from "fs";
+import { extname, join, relative } from "path";
+
+// src/server/scan/detect-http-methods.ts
+import { readFileSync } from "fs";
+import { createRequire } from "module";
+var require_ = createRequire(import.meta.url);
+var ts = require_("typescript");
+var HTTP_METHOD_NAMES = new Set(HTTP_METHODS);
+function hasExportModifier(modifiers) {
+  if (!modifiers) return false;
+  for (const m of modifiers) {
+    if (m.kind === ts.SyntaxKind.ExportKeyword) return true;
+  }
+  return false;
+}
+function collectFromStatement(stmt, found) {
+  if (ts.isVariableStatement(stmt) && hasExportModifier(ts.getModifiers(stmt))) {
+    for (const decl of stmt.declarationList.declarations) {
+      if (ts.isIdentifier(decl.name) && HTTP_METHOD_NAMES.has(decl.name.text)) {
+        found.add(decl.name.text);
+      }
+    }
+    return;
+  }
+  if ((ts.isFunctionDeclaration(stmt) || ts.isClassDeclaration(stmt)) && hasExportModifier(ts.getModifiers(stmt))) {
+    if (stmt.name && HTTP_METHOD_NAMES.has(stmt.name.text)) {
+      found.add(stmt.name.text);
+    }
+    return;
+  }
+  if (ts.isExportDeclaration(stmt) && stmt.exportClause && ts.isNamedExports(stmt.exportClause)) {
+    for (const spec of stmt.exportClause.elements) {
+      if (HTTP_METHOD_NAMES.has(spec.name.text)) {
+        found.add(spec.name.text);
+      }
+    }
+  }
+}
+function detectExportedHttpMethods(filePath, content) {
+  const src = content ?? readFileSync(filePath, "utf-8");
+  const sourceFile = ts.createSourceFile(
+    filePath,
+    src,
+    ts.ScriptTarget.Latest,
+    /* setParentNodes */
+    false,
+    ts.ScriptKind.TS
+  );
+  const found = /* @__PURE__ */ new Set();
+  for (const stmt of sourceFile.statements) {
+    collectFromStatement(stmt, found);
+  }
+  return [...found].sort();
+}
+
+// src/server/scan/match.ts
+function compilePattern(routePath) {
+  const paramNames = [];
+  const regexStr = routePath.replace(/:(?:\.\.\.)?([^/]+)/g, (match, name) => {
+    paramNames.push(name);
+    return match.startsWith(":...") ? "(.+)" : "([^/]+)";
+  });
+  return { pattern: new RegExp(`^${regexStr}$`), paramNames };
+}
+function matchRoute(url, routes) {
+  let path = url.split("?")[0];
+  if (path.length > 1 && path.endsWith("/")) {
+    path = path.slice(0, -1);
+  }
+  for (const route of routes) {
+    const match = route.pattern.exec(path);
+    if (match) {
+      const params = {};
+      route.paramNames.forEach((name, i) => {
+        params[name] = match[i + 1];
+      });
+      return { route, params };
+    }
+  }
+  return null;
+}
+
+// src/server/scan/scan.ts
+var ROUTE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
+function fileToRoutePath(filePath, routesDir) {
+  let rel = relative(routesDir, filePath);
+  const ext = extname(rel);
+  rel = rel.slice(0, -ext.length);
+  rel = rel.replace(/\\/g, "/");
+  if (rel.endsWith("/index")) {
+    rel = rel.slice(0, -6);
+  } else if (rel === "index") {
+    rel = "";
+  }
+  rel = rel.replace(/\[\.\.\.([^\]]+)\]/g, ":...$1");
+  rel = rel.replace(/\[([^\]]+)\]/g, ":$1");
+  return `/api/${rel}`;
+}
+function scanServerRoutes(serverDir) {
+  const routesDir = join(serverDir, "routes");
+  if (!existsSync(routesDir) || !statSync(routesDir).isDirectory()) {
+    return [];
+  }
+  const results = [];
+  walkSourceFiles(routesDir, { extensions: ROUTE_EXTENSIONS }, (absPath) => {
+    const routePath = fileToRoutePath(absPath, routesDir);
+    const { pattern, paramNames } = compilePattern(routePath);
+    const methods = detectExportedHttpMethods(absPath);
+    results.push({
+      filePath: absPath,
+      routePath,
+      paramNames,
+      pattern,
+      methods
+    });
+  });
+  const conflicting = results.find((r) => r.routePath === "/api/__theo_batch__");
+  if (conflicting) {
+    throw new Error(
+      `Server route ${conflicting.filePath} resolves to '/api/__theo_batch__' which is reserved for the batch endpoint. Rename the route or disable batching in theo.config.ts.`
+    );
+  }
+  const isCatchAll = (route) => route.routePath.includes(":...");
+  results.sort((a, b) => {
+    const aStatic = a.paramNames.length === 0;
+    const bStatic = b.paramNames.length === 0;
+    const aCatchAll = isCatchAll(a);
+    const bCatchAll = isCatchAll(b);
+    if (aStatic && !bStatic) return -1;
+    if (!aStatic && bStatic) return 1;
+    if (aCatchAll && !bCatchAll) return 1;
+    if (!aCatchAll && bCatchAll) return -1;
+    return a.routePath.localeCompare(b.routePath);
+  });
+  return results;
+}
+
+// src/server/scan/ws-scan.ts
+import { existsSync as existsSync2, statSync as statSync2 } from "fs";
+import { extname as extname2, join as join2, relative as relative2 } from "path";
+var WS_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
+function scanWebSocketRoutes(serverDir) {
+  const wsDir = join2(serverDir, "ws");
+  if (!existsSync2(wsDir) || !statSync2(wsDir).isDirectory()) {
+    return [];
+  }
+  const results = [];
+  walkSourceFiles(wsDir, { extensions: WS_EXTENSIONS }, (absPath) => {
+    let rel = relative2(wsDir, absPath);
+    rel = rel.replace(/\\/g, "/");
+    rel = rel.slice(0, -extname2(rel).length);
+    if (rel.endsWith("/index")) rel = rel.slice(0, -6);
+    else if (rel === "index") rel = "";
+    results.push({
+      filePath: absPath,
+      wsPath: `/ws/${rel}`
+    });
+  });
+  return results;
+}
+
+export {
+  compilePattern,
+  matchRoute,
+  HTTP_METHODS,
+  scanServerRoutes,
+  scanWebSocketRoutes
+};
+//# sourceMappingURL=chunk-QLGES2HC.js.map

package/dist/chunk-QLGES2HC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/contracts/http-methods.ts","../src/server/scan/scan.ts","../src/server/scan/detect-http-methods.ts","../src/server/scan/match.ts","../src/server/scan/ws-scan.ts"],"sourcesContent":["/**\n * Canonical HTTP method set used by the typed client codegen + Proxy runtime.\n * Kept here (under `server/scan/`) because the SCAN is the first consumer —\n * `vite-plugin/app-typed-client.ts` (Phase 2) and `client/app-client.ts` (Phase 3)\n * import from here to ensure a single source of truth.\n *\n * Lowercase variants are derived via `.toLowerCase()` at call sites; we do not\n * export them separately to avoid drift between the two lists.\n */\n\nexport const HTTP_METHODS = [\n  'GET',\n  'POST',\n  'PUT',\n  'PATCH',\n  'DELETE',\n  'HEAD',\n  'OPTIONS',\n] as const\n\nexport type HttpMethod = (typeof HTTP_METHODS)[number]\n\nexport const HTTP_METHOD_LOWERCASE = HTTP_METHODS.map((m) => m.toLowerCase()) as readonly string[]\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks `serverDir/routes/` derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { existsSync, statSync } from 'node:fs'\nimport { extname, join, relative } from 'node:path'\n\nimport { walkSourceFiles } from '../_internal/scan-walker.js'\n\nimport { detectExportedHttpMethods } from './detect-http-methods.js'\nimport { compilePattern, type ServerRouteNode } from './match.js'\n\nconst ROUTE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\n\nfunction fileToRoutePath(filePath: string, routesDir: string): string {\n  let rel = relative(routesDir, filePath)\n  // Strip extension\n  const ext = extname(rel)\n  rel = rel.slice(0, -ext.length)\n  // Normalize separators\n  rel = rel.replace(/\\\\/g, '/')\n  // Strip index suffix\n  if (rel.endsWith('/index')) {\n    rel = rel.slice(0, -6)\n  } else if (rel === 'index') {\n    rel = ''\n  }\n  // Replace [...param] with :...param (catch-all, before regular params).\n  // Replace [param] with :param. Inputs are file paths bounded by the\n  // OS filename limit; the bracket capture is bounded by `]`.\n  rel = rel.replace(/\\[\\.\\.\\.([^\\]]+)\\]/g, ':...$1')\n  // eslint-disable-next-line sonarjs/slow-regex -- bounded by `]`; input is a single filename\n  rel = rel.replace(/\\[([^\\]]+)\\]/g, ':$1')\n  return `/api/${rel}`\n}\n\nexport function scanServerRoutes(serverDir: string): ServerRouteNode[] {\n  const routesDir = join(serverDir, 'routes')\n  if (!existsSync(routesDir) || !statSync(routesDir).isDirectory()) {\n    return []\n  }\n\n  const results: ServerRouteNode[] = []\n  walkSourceFiles(routesDir, { extensions: ROUTE_EXTENSIONS }, (absPath) => {\n    const routePath = fileToRoutePath(absPath, routesDir)\n    const { pattern, paramNames } = compilePattern(routePath)\n    const methods = detectExportedHttpMethods(absPath)\n    results.push({\n      filePath: absPath,\n      routePath,\n      paramNames,\n      pattern,\n      methods,\n    })\n  })\n\n  // T1.4 / EC-2 — refuse to scan if a user route collides with the reserved\n  // batch endpoint path. User must rename or disable batching.\n  const conflicting = results.find((r) => r.routePath === '/api/__theo_batch__')\n  if (conflicting) {\n    throw new Error(\n      `Server route ${conflicting.filePath} resolves to '/api/__theo_batch__' which is reserved for the batch endpoint. Rename the route or disable batching in theo.config.ts.`,\n    )\n  }\n\n  // Sort: static first, then dynamic, then catch-all last\n  const isCatchAll = (route: ServerRouteNode) => route.routePath.includes(':...')\n  results.sort((a, b) => {\n    const aStatic = a.paramNames.length === 0\n    const bStatic = b.paramNames.length === 0\n    const aCatchAll = isCatchAll(a)\n    const bCatchAll = isCatchAll(b)\n\n    // Static routes first\n    if (aStatic && !bStatic) return -1\n    if (!aStatic && bStatic) return 1\n    // Catch-all routes last\n    if (aCatchAll && !bCatchAll) return 1\n    if (!aCatchAll && bCatchAll) return -1\n    return a.routePath.localeCompare(b.routePath)\n  })\n\n  return results\n}\n","/**\n * Detect which HTTP-method named exports a route file declares.\n *\n * Uses the TypeScript compiler API (not regex) per G1 edge-case review EC-4:\n * regex over file content emits false positives for `// export const GET = ...`\n * in comments and `` `export const GET = ...` `` in template literals. AST\n * walking avoids both classes of bug.\n *\n * `typescript` ships as CommonJS with internal dynamic `require('fs')`.\n * When loaded via ESM `import`, the dynamic requires fail at module-bootstrap.\n * We use `createRequire(import.meta.url)` to keep the package on its native\n * CJS path. The type-only namespace import gives us the AST helpers shape.\n *\n * Returns the set of HTTP methods (uppercase) the file exports. Empty array\n * means the file has no HTTP exports (the route file is util-only).\n */\n\nimport { readFileSync } from 'node:fs'\nimport { createRequire } from 'node:module'\n\nimport type * as TS from 'typescript'\n\nimport { HTTP_METHODS, type HttpMethod } from '../../core/contracts/http-methods.js'\n\nconst require_ = createRequire(import.meta.url)\n// eslint-disable-next-line @typescript-eslint/no-require-imports\nconst ts = require_('typescript') as typeof TS\n\nconst HTTP_METHOD_NAMES = new Set<string>(HTTP_METHODS)\n\nfunction hasExportModifier(modifiers: readonly TS.Modifier[] | undefined): boolean {\n  if (!modifiers) return false\n  for (const m of modifiers) {\n    if (m.kind === ts.SyntaxKind.ExportKeyword) return true\n  }\n  return false\n}\n\nfunction collectFromStatement(stmt: TS.Statement, found: Set<HttpMethod>): void {\n  // `export const GET = ...` / `export function GET ...` / `export async function GET ...`\n  if (ts.isVariableStatement(stmt) && hasExportModifier(ts.getModifiers(stmt))) {\n    for (const decl of stmt.declarationList.declarations) {\n      if (ts.isIdentifier(decl.name) && HTTP_METHOD_NAMES.has(decl.name.text)) {\n        found.add(decl.name.text as HttpMethod)\n      }\n    }\n    return\n  }\n\n  if (\n    (ts.isFunctionDeclaration(stmt) || ts.isClassDeclaration(stmt)) &&\n    hasExportModifier(ts.getModifiers(stmt))\n  ) {\n    if (stmt.name && HTTP_METHOD_NAMES.has(stmt.name.text)) {\n      found.add(stmt.name.text as HttpMethod)\n    }\n    return\n  }\n\n  // `export { GET }` / `export { handler as GET } from './shared'` (EC-5)\n  if (ts.isExportDeclaration(stmt) && stmt.exportClause && ts.isNamedExports(stmt.exportClause)) {\n    for (const spec of stmt.exportClause.elements) {\n      // spec.name is the exported (re-)name; spec.propertyName is the original (when renamed)\n      if (HTTP_METHOD_NAMES.has(spec.name.text)) {\n        found.add(spec.name.text as HttpMethod)\n      }\n    }\n  }\n}\n\nexport function detectExportedHttpMethods(filePath: string, content?: string): HttpMethod[] {\n  const src = content ?? readFileSync(filePath, 'utf-8')\n  const sourceFile = ts.createSourceFile(\n    filePath,\n    src,\n    ts.ScriptTarget.Latest,\n    /* setParentNodes */ false,\n    ts.ScriptKind.TS,\n  )\n  const found = new Set<HttpMethod>()\n  for (const stmt of sourceFile.statements) {\n    collectFromStatement(stmt, found)\n  }\n  return [...found].sort()\n}\n","export interface ServerRouteNode {\n  filePath: string\n  routePath: string\n  paramNames: string[]\n  pattern: RegExp\n  /** HTTP methods (uppercase) the route file exports. Optional for backward\n   * compatibility with manifests generated before G1. Empty array means the\n   * file has no HTTP exports (util-only); undefined means \"not detected\". */\n  methods?: string[]\n}\n\nexport function compilePattern(routePath: string): {\n  pattern: RegExp\n  paramNames: string[]\n} {\n  const paramNames: string[] = []\n  // Single pass: handle both catch-all (:...name) and regular (:name) params\n  const regexStr = routePath.replace(/:(?:\\.\\.\\.)?([^/]+)/g, (match: string, name: string) => {\n    paramNames.push(name)\n    // Catch-all matches across slashes, regular matches single segment\n    return match.startsWith(':...') ? '(.+)' : '([^/]+)'\n  })\n  // `regexStr` is derived from a developer-authored route path (build-time\n  // input, not HTTP-controlled). The `security/detect-non-literal-regexp`\n  // rule cannot see this constraint — disable narrowly.\n  // eslint-disable-next-line security/detect-non-literal-regexp -- route pattern from build-time scan, never HTTP input\n  return { pattern: new RegExp(`^${regexStr}$`), paramNames }\n}\n\nexport function matchRoute(\n  url: string,\n  routes: ServerRouteNode[],\n): { route: ServerRouteNode; params: Record<string, string> } | null {\n  // Strip query string and trailing slash\n  let path = url.split('?')[0]\n  if (path.length > 1 && path.endsWith('/')) {\n    path = path.slice(0, -1)\n  }\n\n  for (const route of routes) {\n    const match = route.pattern.exec(path)\n    if (match) {\n      const params: Record<string, string> = {}\n      route.paramNames.forEach((name, i) => {\n        params[name] = match[i + 1]\n      })\n      return { route, params }\n    }\n  }\n  return null\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks `serverDir/ws/` derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { existsSync, statSync } from 'node:fs'\nimport { extname, join, relative } from 'node:path'\n\nimport { walkSourceFiles } from '../_internal/scan-walker.js'\n\nconst WS_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\n\nexport interface WebSocketRouteNode {\n  filePath: string\n  wsPath: string\n}\n\nexport function scanWebSocketRoutes(serverDir: string): WebSocketRouteNode[] {\n  const wsDir = join(serverDir, 'ws')\n  if (!existsSync(wsDir) || !statSync(wsDir).isDirectory()) {\n    return []\n  }\n\n  const results: WebSocketRouteNode[] = []\n  walkSourceFiles(wsDir, { extensions: WS_EXTENSIONS }, (absPath) => {\n    let rel = relative(wsDir, absPath)\n    rel = rel.replace(/\\\\/g, '/')\n    rel = rel.slice(0, -extname(rel).length)\n    if (rel.endsWith('/index')) rel = rel.slice(0, -6)\n    else if (rel === 'index') rel = ''\n    results.push({\n      filePath: absPath,\n      wsPath: `/ws/${rel}`,\n    })\n  })\n  return results\n}\n"],"mappings":";;;;;;;AAUO,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,IAAM,wBAAwB,aAAa,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;;;AClB5E,SAAS,YAAY,gBAAgB;AACrC,SAAS,SAAS,MAAM,gBAAgB;;;ACYxC,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAM9B,IAAM,WAAW,cAAc,YAAY,GAAG;AAE9C,IAAM,KAAK,SAAS,YAAY;AAEhC,IAAM,oBAAoB,IAAI,IAAY,YAAY;AAEtD,SAAS,kBAAkB,WAAwD;AACjF,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,KAAK,WAAW;AACzB,QAAI,EAAE,SAAS,GAAG,WAAW,cAAe,QAAO;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,MAAoB,OAA8B;AAE9E,MAAI,GAAG,oBAAoB,IAAI,KAAK,kBAAkB,GAAG,aAAa,IAAI,CAAC,GAAG;AAC5E,eAAW,QAAQ,KAAK,gBAAgB,cAAc;AACpD,UAAI,GAAG,aAAa,KAAK,IAAI,KAAK,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACvE,cAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,MACxC;AAAA,IACF;AACA;AAAA,EACF;AAEA,OACG,GAAG,sBAAsB,IAAI,KAAK,GAAG,mBAAmB,IAAI,MAC7D,kBAAkB,GAAG,aAAa,IAAI,CAAC,GACvC;AACA,QAAI,KAAK,QAAQ,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACtD,YAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,IACxC;AACA;AAAA,EACF;AAGA,MAAI,GAAG,oBAAoB,IAAI,KAAK,KAAK,gBAAgB,GAAG,eAAe,KAAK,YAAY,GAAG;AAC7F,eAAW,QAAQ,KAAK,aAAa,UAAU;AAE7C,UAAI,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACzC,cAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,0BAA0B,UAAkB,SAAgC;AAC1F,QAAM,MAAM,WAAW,aAAa,UAAU,OAAO;AACrD,QAAM,aAAa,GAAG;AAAA,IACpB;AAAA,IACA;AAAA,IACA,GAAG,aAAa;AAAA;AAAA,IACK;AAAA,IACrB,GAAG,WAAW;AAAA,EAChB;AACA,QAAM,QAAQ,oBAAI,IAAgB;AAClC,aAAW,QAAQ,WAAW,YAAY;AACxC,yBAAqB,MAAM,KAAK;AAAA,EAClC;AACA,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK;AACzB;;;ACzEO,SAAS,eAAe,WAG7B;AACA,QAAM,aAAuB,CAAC;AAE9B,QAAM,WAAW,UAAU,QAAQ,wBAAwB,CAAC,OAAe,SAAiB;AAC1F,eAAW,KAAK,IAAI;AAEpB,WAAO,MAAM,WAAW,MAAM,IAAI,SAAS;AAAA,EAC7C,CAAC;AAKD,SAAO,EAAE,SAAS,IAAI,OAAO,IAAI,QAAQ,GAAG,GAAG,WAAW;AAC5D;AAEO,SAAS,WACd,KACA,QACmE;AAEnE,MAAI,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC;AAC3B,MAAI,KAAK,SAAS,KAAK,KAAK,SAAS,GAAG,GAAG;AACzC,WAAO,KAAK,MAAM,GAAG,EAAE;AAAA,EACzB;AAEA,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI;AACrC,QAAI,OAAO;AACT,YAAM,SAAiC,CAAC;AACxC,YAAM,WAAW,QAAQ,CAAC,MAAM,MAAM;AACpC,eAAO,IAAI,IAAI,MAAM,IAAI,CAAC;AAAA,MAC5B,CAAC;AACD,aAAO,EAAE,OAAO,OAAO;AAAA,IACzB;AAAA,EACF;AACA,SAAO;AACT;;;AFtCA,IAAM,mBAAmB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAE/D,SAAS,gBAAgB,UAAkB,WAA2B;AACpE,MAAI,MAAM,SAAS,WAAW,QAAQ;AAEtC,QAAM,MAAM,QAAQ,GAAG;AACvB,QAAM,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAE9B,QAAM,IAAI,QAAQ,OAAO,GAAG;AAE5B,MAAI,IAAI,SAAS,QAAQ,GAAG;AAC1B,UAAM,IAAI,MAAM,GAAG,EAAE;AAAA,EACvB,WAAW,QAAQ,SAAS;AAC1B,UAAM;AAAA,EACR;AAIA,QAAM,IAAI,QAAQ,uBAAuB,QAAQ;AAEjD,QAAM,IAAI,QAAQ,iBAAiB,KAAK;AACxC,SAAO,QAAQ,GAAG;AACpB;AAEO,SAAS,iBAAiB,WAAsC;AACrE,QAAM,YAAY,KAAK,WAAW,QAAQ;AAC1C,MAAI,CAAC,WAAW,SAAS,KAAK,CAAC,SAAS,SAAS,EAAE,YAAY,GAAG;AAChE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAA6B,CAAC;AACpC,kBAAgB,WAAW,EAAE,YAAY,iBAAiB,GAAG,CAAC,YAAY;AACxE,UAAM,YAAY,gBAAgB,SAAS,SAAS;AACpD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,SAAS;AACxD,UAAM,UAAU,0BAA0B,OAAO;AACjD,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAID,QAAM,cAAc,QAAQ,KAAK,CAAC,MAAM,EAAE,cAAc,qBAAqB;AAC7E,MAAI,aAAa;AACf,UAAM,IAAI;AAAA,MACR,gBAAgB,YAAY,QAAQ;AAAA,IACtC;AAAA,EACF;AAGA,QAAM,aAAa,CAAC,UAA2B,MAAM,UAAU,SAAS,MAAM;AAC9E,UAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,UAAM,UAAU,EAAE,WAAW,WAAW;AACxC,UAAM,UAAU,EAAE,WAAW,WAAW;AACxC,UAAM,YAAY,WAAW,CAAC;AAC9B,UAAM,YAAY,WAAW,CAAC;AAG9B,QAAI,WAAW,CAAC,QAAS,QAAO;AAChC,QAAI,CAAC,WAAW,QAAS,QAAO;AAEhC,QAAI,aAAa,CAAC,UAAW,QAAO;AACpC,QAAI,CAAC,aAAa,UAAW,QAAO;AACpC,WAAO,EAAE,UAAU,cAAc,EAAE,SAAS;AAAA,EAC9C,CAAC;AAED,SAAO;AACT;;;AG/EA,SAAS,cAAAA,aAAY,YAAAC,iBAAgB;AACrC,SAAS,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;AAIxC,IAAM,gBAAgB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAOrD,SAAS,oBAAoB,WAAyC;AAC3E,QAAM,QAAQC,MAAK,WAAW,IAAI;AAClC,MAAI,CAACC,YAAW,KAAK,KAAK,CAACC,UAAS,KAAK,EAAE,YAAY,GAAG;AACxD,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAgC,CAAC;AACvC,kBAAgB,OAAO,EAAE,YAAY,cAAc,GAAG,CAAC,YAAY;AACjE,QAAI,MAAMC,UAAS,OAAO,OAAO;AACjC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAACC,SAAQ,GAAG,EAAE,MAAM;AACvC,QAAI,IAAI,SAAS,QAAQ,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AAAA,aACxC,QAAQ,QAAS,OAAM;AAChC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,QAAQ,OAAO,GAAG;AAAA,IACpB,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;","names":["existsSync","statSync","extname","join","relative","join","existsSync","statSync","relative","extname"]}

package/dist/{chunk-JZ5WEG3S.js → chunk-SEVYARIU.js}

@@ -2,10 +2,12 @@
 import "tsx/esm";
 import {
   compilePattern,
-  scanServerActions,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-GQSTRXXB.js";
+} from "./chunk-QLGES2HC.js";
+import {
+  scanServerActions
+} from "./chunk-MOT42NAH.js";
 
 // src/server/scan/manifest.ts
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
@@ -20,7 +22,8 @@ function generateManifest(serverDir) {
     routes: routes.map((r) => ({
       filePath: relative(serverDir, r.filePath),
       routePath: r.routePath,
-      paramNames: r.paramNames
+      paramNames: r.paramNames,
+      ...r.methods !== void 0 ? { methods: r.methods } : {}
     })),
     actions: actions.map((a) => ({
       filePath: relative(serverDir, a.filePath),
@@ -49,7 +52,8 @@ function loadManifest(distDir, serverDir) {
       filePath: resolve(serverDir, r.filePath),
       routePath: r.routePath,
       paramNames,
-      pattern
+      pattern,
+      ...r.methods !== void 0 ? { methods: r.methods } : {}
     };
   });
   const actions = raw.actions.map((a) => ({
@@ -68,4 +72,4 @@ export {
   writeManifest,
   loadManifest
 };
-//# sourceMappingURL=chunk-JZ5WEG3S.js.map
+//# sourceMappingURL=chunk-SEVYARIU.js.map

package/dist/chunk-SEVYARIU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/scan/manifest.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time manifest emitter / loader. All paths derived from `distDir`\n * + `serverDir`, themselves resolved from `process.cwd()`. No HTTP input.\n */\nimport { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs'\nimport { join, resolve, relative } from 'node:path'\n\nimport { scanServerActions } from './action-scan.js'\nimport type { ActionNode } from './action-scan.js'\nimport { compilePattern } from './match.js'\nimport type { ServerRouteNode } from './match.js'\nimport { scanServerRoutes } from './scan.js'\nimport { scanWebSocketRoutes } from './ws-scan.js'\nimport type { WebSocketRouteNode } from './ws-scan.js'\n\n// --- Manifest Types ---\n\nexport interface ManifestRoute {\n  filePath: string\n  routePath: string\n  paramNames: string[]\n  /** HTTP methods (uppercase) the route file exports. Optional — manifests\n   * generated before G1 omit this; loaders treat absence as \"unknown\". */\n  methods?: string[]\n}\n\nexport interface ManifestAction {\n  filePath: string\n  actionPath: string\n}\n\nexport interface ManifestWebSocket {\n  filePath: string\n  wsPath: string\n}\n\nexport interface TheoManifest {\n  version: 1\n  generatedAt: string\n  routes: ManifestRoute[]\n  actions: ManifestAction[]\n  websockets: ManifestWebSocket[]\n}\n\nexport interface LoadedManifest {\n  routes: ServerRouteNode[]\n  actions: ActionNode[]\n  websockets: WebSocketRouteNode[]\n}\n\n// --- Generate ---\n\nexport function generateManifest(serverDir: string): TheoManifest {\n  const routes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const websockets = scanWebSocketRoutes(serverDir)\n\n  return {\n    version: 1,\n    generatedAt: new Date().toISOString(),\n    routes: routes.map((r) => ({\n      filePath: relative(serverDir, r.filePath),\n      routePath: r.routePath,\n      paramNames: r.paramNames,\n      ...(r.methods !== undefined ? { methods: r.methods } : {}),\n    })),\n    actions: actions.map((a) => ({\n      filePath: relative(serverDir, a.filePath),\n      actionPath: a.actionPath,\n    })),\n    websockets: websockets.map((w) => ({\n      filePath: relative(serverDir, w.filePath),\n      wsPath: w.wsPath,\n    })),\n  }\n}\n\n// --- Write ---\n\nexport function writeManifest(manifest: TheoManifest, outputDir: string): void {\n  mkdirSync(outputDir, { recursive: true })\n  const manifestPath = join(outputDir, 'manifest.json')\n  writeFileSync(manifestPath, JSON.stringify(manifest, null, 2))\n}\n\n// --- Load ---\n\nexport function loadManifest(distDir: string, serverDir: string): LoadedManifest {\n  const manifestPath = join(distDir, 'manifest.json')\n\n  if (!existsSync(manifestPath)) {\n    throw new Error(`No manifest found at ${manifestPath}. Run \"theo build\" first.`)\n  }\n\n  const raw = JSON.parse(readFileSync(manifestPath, 'utf-8')) as TheoManifest\n\n  const routes: ServerRouteNode[] = raw.routes.map((r) => {\n    const { pattern, paramNames } = compilePattern(r.routePath)\n    return {\n      filePath: resolve(serverDir, r.filePath),\n      routePath: r.routePath,\n      paramNames,\n      pattern,\n      ...(r.methods !== undefined ? { methods: r.methods } : {}),\n    }\n  })\n\n  const actions: ActionNode[] = raw.actions.map((a) => ({\n    filePath: resolve(serverDir, a.filePath),\n    actionPath: a.actionPath,\n  }))\n\n  const websockets: WebSocketRouteNode[] = raw.websockets.map((w) => ({\n    filePath: resolve(serverDir, w.filePath),\n    wsPath: w.wsPath,\n  }))\n\n  return { routes, actions, websockets }\n}\n"],"mappings":";;;;;;;;;;;;AAIA,SAAS,YAAY,cAAc,eAAe,iBAAiB;AACnE,SAAS,MAAM,SAAS,gBAAgB;AA+CjC,SAAS,iBAAiB,WAAiC;AAChE,QAAM,SAAS,iBAAiB,SAAS;AACzC,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,aAAa,oBAAoB,SAAS;AAEhD,SAAO;AAAA,IACL,SAAS;AAAA,IACT,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,QAAQ,OAAO,IAAI,CAAC,OAAO;AAAA,MACzB,UAAU,SAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,WAAW,EAAE;AAAA,MACb,YAAY,EAAE;AAAA,MACd,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1D,EAAE;AAAA,IACF,SAAS,QAAQ,IAAI,CAAC,OAAO;AAAA,MAC3B,UAAU,SAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,YAAY,EAAE;AAAA,IAChB,EAAE;AAAA,IACF,YAAY,WAAW,IAAI,CAAC,OAAO;AAAA,MACjC,UAAU,SAAS,WAAW,EAAE,QAAQ;AAAA,MACxC,QAAQ,EAAE;AAAA,IACZ,EAAE;AAAA,EACJ;AACF;AAIO,SAAS,cAAc,UAAwB,WAAyB;AAC7E,YAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AACxC,QAAM,eAAe,KAAK,WAAW,eAAe;AACpD,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC/D;AAIO,SAAS,aAAa,SAAiB,WAAmC;AAC/E,QAAM,eAAe,KAAK,SAAS,eAAe;AAElD,MAAI,CAAC,WAAW,YAAY,GAAG;AAC7B,UAAM,IAAI,MAAM,wBAAwB,YAAY,2BAA2B;AAAA,EACjF;AAEA,QAAM,MAAM,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAE1D,QAAM,SAA4B,IAAI,OAAO,IAAI,CAAC,MAAM;AACtD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,EAAE,SAAS;AAC1D,WAAO;AAAA,MACL,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,MACvC,WAAW,EAAE;AAAA,MACb;AAAA,MACA;AAAA,MACA,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1D;AAAA,EACF,CAAC;AAED,QAAM,UAAwB,IAAI,QAAQ,IAAI,CAAC,OAAO;AAAA,IACpD,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,YAAY,EAAE;AAAA,EAChB,EAAE;AAEF,QAAM,aAAmC,IAAI,WAAW,IAAI,CAAC,OAAO;AAAA,IAClE,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,IACvC,QAAQ,EAAE;AAAA,EACZ,EAAE;AAEF,SAAO,EAAE,QAAQ,SAAS,WAAW;AACvC;","names":[]}

package/dist/{chunk-ZK5JCE5J.js → chunk-TFECHXR5.js}

@@ -13,16 +13,10 @@ import {
   resolveTransformer,
   safeAudit,
   sendError
-} from "./chunk-WQCPKA2L.js";
-import {
-  matchRoute,
-  scanServerActions,
-  scanServerRoutes,
-  scanWebSocketRoutes
-} from "./chunk-GQSTRXXB.js";
+} from "./chunk-C27AZN46.js";
 import {
   loadConfig
-} from "./chunk-S3JBIFKS.js";
+} from "./chunk-MG7H3LAW.js";
 import {
   broadcastToDevtools
 } from "./chunk-5ODOE6EF.js";
@@ -33,6 +27,14 @@ import {
 import {
   buildServicesProxyConfig
 } from "./chunk-WZ7CPVQB.js";
+import {
+  matchRoute,
+  scanServerRoutes,
+  scanWebSocketRoutes
+} from "./chunk-QLGES2HC.js";
+import {
+  scanServerActions
+} from "./chunk-MOT42NAH.js";
 
 // src/vite-plugin/index.ts
 import { existsSync as existsSync5 } from "fs";
@@ -468,6 +470,54 @@ function generateRouteManifest(tree) {
   return lines.join("\n");
 }
 
+// src/server/security/csrf-readiness-store.ts
+var CsrfReadinessStore = class _CsrfReadinessStore {
+  static MAX_ENTRIES = 1e3;
+  entries = /* @__PURE__ */ new Map();
+  keyFor(event) {
+    return `${event.method}\0${event.path}\0${event.reason}`;
+  }
+  record(event) {
+    const key = this.keyFor(event);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const existing = this.entries.get(key);
+    if (existing) {
+      existing.count++;
+      existing.lastSeen = now;
+      return;
+    }
+    if (this.entries.size >= _CsrfReadinessStore.MAX_ENTRIES) {
+      const firstKey = this.entries.keys().next().value;
+      if (firstKey !== void 0) this.entries.delete(firstKey);
+    }
+    this.entries.set(key, { count: 1, firstSeen: now, lastSeen: now });
+  }
+  summary() {
+    let total = 0;
+    const routes = [];
+    for (const [key, entry] of this.entries) {
+      const [method, path, reason] = key.split("\0");
+      routes.push({
+        method,
+        path,
+        reason,
+        count: entry.count,
+        firstSeen: entry.firstSeen,
+        lastSeen: entry.lastSeen
+      });
+      total += entry.count;
+    }
+    return {
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      totalEvents: total,
+      routes
+    };
+  }
+  reset() {
+    this.entries.clear();
+  }
+};
+
 // src/vite-plugin/action-middleware.ts
 import { randomUUID } from "crypto";
 var PREFIX = "/api/__actions/";
@@ -536,13 +586,17 @@ function createActionMiddleware(vite, serverDir, options) {
         csrfMode,
         disallowed
       );
-      logRequest({
-        method: req.method ?? "POST",
-        url,
-        status: res.statusCode,
-        duration: Date.now() - start,
-        requestId
-      });
+      logRequest(
+        {
+          method: req.method ?? "POST",
+          url,
+          status: res.statusCode,
+          duration: Date.now() - start,
+          requestId
+        },
+        void 0,
+        req
+      );
     })();
   };
 }
@@ -974,6 +1028,35 @@ async function handleBatchInline(req, res, batching, requestId) {
     sendError(res, "BATCH_ERROR", message, 400, void 0, requestId);
   }
 }
+async function runPluginsBeforeRouteMatch(pluginRunner, reqCtx) {
+  const { req, res, requestId, start, url } = reqCtx;
+  try {
+    const hookResult = await pluginRunner.runOnRequest({
+      request: req,
+      response: res,
+      ctx: {},
+      requestId
+    });
+    if (hookResult.shortCircuited) {
+      logRequest(
+        {
+          method: req.method ?? "GET",
+          url,
+          status: res.statusCode,
+          duration: Date.now() - start,
+          requestId
+        },
+        void 0,
+        req
+      );
+      return true;
+    }
+  } catch (err) {
+    sendError(res, "PLUGIN_ERROR", err.message, 500, void 0, requestId);
+    return true;
+  }
+  return false;
+}
 function createApiMiddleware(vite, serverDir, rateLimitConfigOrOptions) {
   const opts = rateLimitConfigOrOptions && "windowMs" in rateLimitConfigOrOptions ? { rateLimitConfig: rateLimitConfigOrOptions } : rateLimitConfigOrOptions ?? {};
   const loadModule = createViteLoader(vite);
@@ -991,7 +1074,7 @@ function createApiMiddleware(vite, serverDir, rateLimitConfigOrOptions) {
   const csrfReadinessStore = opts.csrfReadinessStore;
   const servicesProxyPrefixes = opts.servicesProxyPrefixes ?? [];
   return (req, res, next) => {
-    void (async () => {
+    const handle = async () => {
       const url = req.url ?? "";
       if (await handleCspReportIfMatch(req, res, url, { auditLogger, onCspViolation })) {
         return;
@@ -1015,6 +1098,9 @@ function createApiMiddleware(vite, serverDir, rateLimitConfigOrOptions) {
       if (applyRateLimitOr429(req, res, { rateLimiter, requestId, url, start })) {
         return;
       }
+      if (pluginRunner && await runPluginsBeforeRouteMatch(pluginRunner, { req, res, requestId, start, url })) {
+        return;
+      }
       if (await handleBatchIfMatch(req, res, { url, batching, requestId, start })) {
         return;
       }
@@ -1026,13 +1112,17 @@ function createApiMiddleware(vite, serverDir, rateLimitConfigOrOptions) {
         const suggestion = findSuggestion(urlPath, routePaths);
         const msg = suggestion ? `API route not found: ${urlPath}. Did you mean: ${suggestion}?` : "API route not found";
         sendError(res, "NOT_FOUND", msg, 404, void 0, requestId);
-        logRequest({
-          method: req.method ?? "GET",
-          url,
-          status: 404,
-          duration: Date.now() - start,
-          requestId
-        });
+        logRequest(
+          {
+            method: req.method ?? "GET",
+            url,
+            status: 404,
+            duration: Date.now() - start,
+            requestId
+          },
+          void 0,
+          req
+        );
         return;
       }
       const method = (req.method ?? "GET").toUpperCase();
@@ -1050,8 +1140,13 @@ function createApiMiddleware(vite, serverDir, rateLimitConfigOrOptions) {
         csrfMode,
         disallowed
       });
-      logRequest({ method, url, status: res.statusCode, duration: Date.now() - start, requestId });
-    })();
+      logRequest(
+        { method, url, status: res.statusCode, duration: Date.now() - start, requestId },
+        void 0,
+        req
+      );
+    };
+    void handle();
   };
 }
 
@@ -1077,7 +1172,7 @@ function resolveExportSubpath(pkgRoot, subpath) {
     }
     let target;
     if (typeof exp === "string") target = exp;
-    else if (exp && typeof exp === "object") {
+    else if (typeof exp === "object") {
       const e = exp;
       target = e.import ?? e.default;
     }
@@ -1147,7 +1242,9 @@ var DEFAULT_RESOLVED = {
   disallowed: void 0,
   cors: void 0,
   auditLogger: void 0,
-  devtoolsEnabled: true
+  devtoolsEnabled: true,
+  openapi: void 0,
+  distDir: ".theo"
 };
 async function resolvePluginConfig(projectRoot) {
   try {
@@ -1176,7 +1273,9 @@ async function resolvePluginConfig(projectRoot) {
       disallowed: userConfig.security?.disallowed,
       cors: userConfig.security?.cors,
       auditLogger,
-      devtoolsEnabled: userConfig.devtools !== false
+      devtoolsEnabled: userConfig.devtools !== false,
+      openapi: userConfig.openapi,
+      distDir: userConfig.distDir
     };
   } catch {
     return DEFAULT_RESOLVED;
@@ -1513,9 +1612,7 @@ async function integrateUseTheoUI(cwd, opts) {
   }
   const tailwindPlugins = normalizePluginReturn(tailwindPlugin);
   if (tailwindPlugins === null) {
-    console.warn(
-      `[theokit] @tailwindcss/vite returned unexpected shape. Skipping auto-config.`
-    );
+    console.warn(`[theokit] @tailwindcss/vite returned unexpected shape. Skipping auto-config.`);
     return [];
   }
   const uiPlugins = normalizePluginReturn(uiPlugin);
@@ -1789,7 +1886,42 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  return [theoPlugin(rootOrOptions), ...uiPlugins, ...servicesPlugins];
+  const { appTypedClientPlugin } = await import("./app-typed-client-4L4L4BWD.js");
+  const appClientPlugin = appTypedClientPlugin({
+    cwd: projectRoot,
+    serverDir: resolve4(projectRoot, "server"),
+    distDir: resolve4(projectRoot, ".theo")
+  });
+  const { actionsVirtualModule } = await import("./actions-virtual-module-E6PU47GV.js");
+  const actionsPlugin = actionsVirtualModule({
+    serverDir: resolve4(projectRoot, "server"),
+    distDir: resolve4(projectRoot, ".theo")
+  });
+  return [
+    theoPlugin(rootOrOptions),
+    ...uiPlugins,
+    ...servicesPlugins,
+    appClientPlugin,
+    actionsPlugin
+  ];
+}
+function buildOptimizeDepsInclude(projectRoot, viteOptimizeDeps) {
+  const include = [];
+  if (existsSync5(resolve4(projectRoot, "node_modules", "@usetheo", "ui"))) {
+    include.push("@usetheo/ui");
+  }
+  if (existsSync5(resolve4(projectRoot, "node_modules", "lucide-react"))) {
+    include.push("lucide-react");
+  }
+  include.push("devalue");
+  if (Array.isArray(viteOptimizeDeps)) {
+    for (const pkg of viteOptimizeDeps) {
+      if (typeof pkg === "string" && pkg.length > 0 && !include.includes(pkg)) {
+        include.push(pkg);
+      }
+    }
+  }
+  return include;
 }
 function theoPlugin(rootOrOptions) {
   const options = typeof rootOrOptions === "string" ? { root: rootOrOptions } : rootOrOptions ?? {};
@@ -1808,6 +1940,8 @@ function theoPlugin(rootOrOptions) {
   let cors;
   let auditLogger;
   let devtoolsEnabled = true;
+  let resolvedOpenApi;
+  let resolvedDistDir = ".theo";
   let isDevMode = false;
   let configLoadedOnce = false;
   return {
@@ -1826,6 +1960,8 @@ function theoPlugin(rootOrOptions) {
       cors = resolved.cors;
       auditLogger = resolved.auditLogger;
       devtoolsEnabled = resolved.devtoolsEnabled;
+      resolvedOpenApi = resolved.openapi;
+      resolvedDistDir = resolved.distDir;
     },
     // Vite calls this hook (sync return is fine — no awaits left after
     // the auto-chain moved to theoPluginAsync). The @usetheo/ui +
@@ -1833,13 +1969,7 @@ function theoPlugin(rootOrOptions) {
     // Vite drops plugins returned from a child plugin's config() hook.
     config() {
       const ext = existsSync5(resolve4(theoSrcDir, "index.ts")) ? ".ts" : ".js";
-      const optimizeDepsInclude = [];
-      if (existsSync5(resolve4(projectRoot, "node_modules", "@usetheo", "ui"))) {
-        optimizeDepsInclude.push("@usetheo/ui");
-      }
-      if (existsSync5(resolve4(projectRoot, "node_modules", "lucide-react"))) {
-        optimizeDepsInclude.push("lucide-react");
-      }
+      const optimizeDepsInclude = buildOptimizeDepsInclude(projectRoot, options.viteOptimizeDeps);
       const warmupClientFiles = [];
       for (const candidate of ["app/layout.tsx", "app/page.tsx", "app/page.jsx"]) {
         const full = resolve4(projectRoot, candidate);
@@ -1848,7 +1978,10 @@ function theoPlugin(rootOrOptions) {
       const servicesProxy = options.services && Object.keys(options.services).length > 0 ? buildServicesProxyConfig(options.services) : void 0;
       return {
         envPrefix: "THEO_PUBLIC_",
-        optimizeDeps: optimizeDepsInclude.length > 0 ? { include: optimizeDepsInclude } : void 0,
+        optimizeDeps: {
+          ...optimizeDepsInclude.length > 0 ? { include: optimizeDepsInclude } : {},
+          force: true
+        },
         server: {
           ...warmupClientFiles.length > 0 ? { warmup: { clientFiles: warmupClientFiles } } : {},
           ...servicesProxy !== void 0 ? { proxy: servicesProxy } : {},
@@ -1963,7 +2096,7 @@ function theoPlugin(rootOrOptions) {
         ].join("\n");
       }
     },
-    configureServer(server) {
+    async configureServer(server) {
       isDevMode = true;
       globalThis.__theoViteHotServer = server;
       server.ws.on("theo:devtools:request-manifest", () => {
@@ -1978,6 +2111,7 @@ function theoPlugin(rootOrOptions) {
         createActionMiddleware(server, serverDir, { pluginRunner, csrfMode, disallowed })
       );
       const servicesProxyPrefixes = options.services && Object.keys(options.services).length > 0 ? Object.values(options.services).map((s) => s.proxy) : [];
+      const csrfReadinessStore = options.csrfReadinessStore ?? new CsrfReadinessStore();
       server.middlewares.use(
         createApiMiddleware(server, serverDir, {
           rateLimitConfig: options.rateLimit,
@@ -1989,7 +2123,8 @@ function theoPlugin(rootOrOptions) {
           disallowed,
           cors,
           auditLogger,
-          servicesProxyPrefixes
+          servicesProxyPrefixes,
+          csrfReadinessStore
         })
       );
       const configPath = resolve4(projectRoot, "theo.config.ts");
@@ -2018,6 +2153,29 @@ function theoPlugin(rootOrOptions) {
       }
       server.watcher.on("add", handleRouteChange);
       server.watcher.on("unlink", handleRouteChange);
+      if (resolvedOpenApi !== void 0) {
+        const openApiCfg = resolvedOpenApi;
+        const { reEmitOpenApi } = await import("./dev-emit-I3CKOHML.js");
+        const openApiServerDir = resolve4(projectRoot, "server");
+        const openApiDistDir = resolve4(projectRoot, resolvedDistDir);
+        const isRouteFileForOpenApi = (file) => file.startsWith(openApiServerDir) && /\.(ts|tsx|js|mjs)$/.test(file);
+        void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
+        server.watcher.on("change", (file) => {
+          if (isRouteFileForOpenApi(file)) {
+            void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
+          }
+        });
+        server.watcher.on("add", (file) => {
+          if (isRouteFileForOpenApi(file)) {
+            void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
+          }
+        });
+        server.watcher.on("unlink", (file) => {
+          if (isRouteFileForOpenApi(file)) {
+            void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
+          }
+        });
+      }
       setupWsUpgrade(server, projectRoot);
       server.httpServer?.once("close", () => {
         ;
@@ -2035,4 +2193,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-ZK5JCE5J.js.map
+//# sourceMappingURL=chunk-TFECHXR5.js.map