theokit 0.2.0 → 0.2.1

package/dist/{generate-SIO4JSKJ.js → generate-DT4IIAHF.js}

@@ -9,6 +9,25 @@ var VALID_TYPES = ["route", "action", "page", "ws"];
 function toKebabCase(name) {
   return /^[a-z][a-z0-9/-]*$/.test(name);
 }
+var RESERVED_BASENAMES = /* @__PURE__ */ new Set([
+  "index",
+  "constructor",
+  "__proto__",
+  "prototype",
+  "hasOwnProperty"
+]);
+function hasReservedSegment(name) {
+  const basename = name.includes("/") ? name.split("/").pop() ?? name : name;
+  return RESERVED_BASENAMES.has(basename);
+}
+function isPathInside(cwd, targetSubpath) {
+  if (targetSubpath.includes("\0")) return false;
+  if (targetSubpath.startsWith("/") || targetSubpath.startsWith("\\")) return false;
+  const resolved = resolve(cwd, targetSubpath);
+  const cwdResolved = resolve(cwd);
+  const sep = process.platform === "win32" ? "\\" : "/";
+  return resolved === cwdResolved || resolved.startsWith(cwdResolved + sep);
+}
 function toPascalCase(name) {
   return name.split(/[-/]/).map((s) => s.charAt(0).toUpperCase() + s.slice(1)).join("");
 }
@@ -44,6 +63,51 @@ function generateActionTemplate(name) {
     ``
   ].join("\n");
 }
+function resolveTemplate(cwd, type, name) {
+  switch (type) {
+    case "route":
+      return {
+        filePath: resolve(cwd, "server/routes", `${name}.ts`),
+        content: generateRouteTemplate(name)
+      };
+    case "action":
+      return {
+        filePath: resolve(cwd, "server/actions", `${name}.ts`),
+        content: generateActionTemplate(name)
+      };
+    case "page":
+      return { filePath: resolve(cwd, `app/${name}/page.tsx`), content: generatePageTemplate(name) };
+    case "ws":
+      return {
+        filePath: resolve(cwd, "server/ws", `${name}.ts`),
+        content: generateWsTemplate(name)
+      };
+    default:
+      return null;
+  }
+}
+function generateActionTestTemplate(name) {
+  const camel = toCamelCase(name);
+  return [
+    `import { describe, it, expect } from 'vitest'`,
+    ``,
+    `import { ${camel} } from './${name.split("/").pop()}.js'`,
+    ``,
+    `describe('${name} action', () => {`,
+    `  it('should accept a valid input shape', () => {`,
+    `    expect(${camel}.input).toBeDefined()`,
+    `    expect(typeof ${camel}.handler).toBe('function')`,
+    `  })`,
+    ``,
+    `  it('should reject invalid input via zod schema', () => {`,
+    `    const parsed = ${camel}.input.safeParse({ __invalid: true })`,
+    `    // Empty object schema accepts {}; tighten this assertion when adding fields.`,
+    `    expect(parsed.success).toBe(true)`,
+    `  })`,
+    `})`,
+    ``
+  ].join("\n");
+}
 function generatePageTemplate(name) {
   const pascal = toPascalCase(name);
   return [`export default function ${pascal}Page() {`, `  return <h1>${pascal}</h1>`, `}`, ``].join(
@@ -82,33 +146,35 @@ async function generate(opts) {
       message: `Invalid name "${name}". Use kebab-case: lowercase letters, numbers, hyphens.`
     };
   }
-  let filePath;
-  let content;
-  switch (type) {
-    case "route":
-      filePath = resolve(cwd, "server/routes", `${name}.ts`);
-      content = generateRouteTemplate(name);
-      break;
-    case "action":
-      filePath = resolve(cwd, "server/actions", `${name}.ts`);
-      content = generateActionTemplate(name);
-      break;
-    case "page":
-      filePath = resolve(cwd, `app/${name}/page.tsx`);
-      content = generatePageTemplate(name);
-      break;
-    case "ws":
-      filePath = resolve(cwd, "server/ws", `${name}.ts`);
-      content = generateWsTemplate(name);
-      break;
-    default:
-      return { status: "invalid_kind", message: `Unknown type: ${type}` };
+  if (hasReservedSegment(name)) {
+    return {
+      status: "invalid_name",
+      message: `Reserved name "${name}" \u2014 basename collides with built-in identifier (index/constructor/__proto__/prototype/hasOwnProperty).`
+    };
+  }
+  const resolved = resolveTemplate(cwd, type, name);
+  if (resolved === null) {
+    return { status: "invalid_kind", message: `Unknown type: ${type}` };
+  }
+  const { filePath, content } = resolved;
+  const relativeFromCwd = filePath.startsWith(resolve(cwd)) ? filePath.slice(resolve(cwd).length + 1) : filePath;
+  if (!isPathInside(cwd, relativeFromCwd)) {
+    return {
+      status: "invalid_name",
+      message: `Path traversal denied: "${name}" would escape project root.`
+    };
   }
   if (existsSync(filePath)) {
     return { status: "already_exists", filePath, kind: type, name };
   }
   mkdirSync(dirname(filePath), { recursive: true });
   writeFileSync(filePath, content);
+  if (type === "action") {
+    const testPath = filePath.replace(/\.ts$/, ".test.ts");
+    if (!existsSync(testPath)) {
+      writeFileSync(testPath, generateActionTestTemplate(name));
+    }
+  }
   return { status: "created", filePath, kind: type, name };
 }
 async function generateCommand(type, name) {
@@ -139,4 +205,4 @@ export {
   generate,
   generateCommand
 };
-//# sourceMappingURL=generate-SIO4JSKJ.js.map
+//# sourceMappingURL=generate-DT4IIAHF.js.map

package/dist/generate-DT4IIAHF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/generate.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * CLI `theo generate`. Writes scaffolded files under `cwd` + a generator\n * name from CLI args. Build-time tool. No HTTP input.\n */\nimport { existsSync, mkdirSync, writeFileSync } from 'node:fs'\nimport { resolve, dirname } from 'node:path'\n\nexport const VALID_TYPES = ['route', 'action', 'page', 'ws'] as const\nexport type GeneratorType = (typeof VALID_TYPES)[number]\n\nexport interface GenerateOptions {\n  cwd: string\n  type: string\n  name: string\n}\n\nexport type GenerateStatus =\n  | 'created'\n  | 'already_exists'\n  | 'invalid_kind'\n  | 'invalid_name'\n  | 'not_a_project'\n\nexport interface GenerateResult {\n  status: GenerateStatus\n  filePath?: string\n  kind?: GeneratorType\n  name?: string\n  message?: string\n}\n\nfunction toKebabCase(name: string): boolean {\n  return /^[a-z][a-z0-9/-]*$/.test(name)\n}\n\n/**\n * Reserved JS identifier names that conflict with object prototype machinery\n * or would shadow built-in module shapes if used as action/route names.\n * Mirrors action-scan's RESERVED_NAMES (T1.4).\n */\nconst RESERVED_BASENAMES = new Set([\n  'index',\n  'constructor',\n  '__proto__',\n  'prototype',\n  'hasOwnProperty',\n])\n\n/**\n * Validate that a name segment doesn't hit the reserved-identifier list.\n * Checks the BASENAME (last `/` segment) — nested `admin/constructor` still\n * rejected because the file `constructor.ts` would be the conflict.\n */\nfunction hasReservedSegment(name: string): boolean {\n  const basename = name.includes('/') ? (name.split('/').pop() ?? name) : name\n  return RESERVED_BASENAMES.has(basename)\n}\n\n/**\n * EC-4: validate that resolving `targetSubpath` under `cwd` stays inside `cwd`.\n * Returns `true` when path is safe (stays inside), `false` when it escapes via\n * `..`, absolute path, null byte, or similar traversal vector.\n */\nfunction isPathInside(cwd: string, targetSubpath: string): boolean {\n  if (targetSubpath.includes('\\x00')) return false\n  if (targetSubpath.startsWith('/') || targetSubpath.startsWith('\\\\')) return false\n  const resolved = resolve(cwd, targetSubpath)\n  const cwdResolved = resolve(cwd)\n  const sep = process.platform === 'win32' ? '\\\\' : '/'\n  return resolved === cwdResolved || resolved.startsWith(cwdResolved + sep)\n}\n\nfunction toPascalCase(name: string): string {\n  return name\n    .split(/[-/]/)\n    .map((s) => s.charAt(0).toUpperCase() + s.slice(1))\n    .join('')\n}\n\nfunction toCamelCase(name: string): string {\n  const pascal = toPascalCase(name)\n  return pascal.charAt(0).toLowerCase() + pascal.slice(1)\n}\n\nfunction generateRouteTemplate(name: string): string {\n  return [\n    `import { defineRoute } from 'theokit/server'`,\n    `import { z } from 'zod'`,\n    ``,\n    `export const GET = defineRoute({`,\n    `  handler: ({ ctx }) => {`,\n    `    return { message: 'TODO: implement ${name} GET' }`,\n    `  },`,\n    `})`,\n    ``,\n  ].join('\\n')\n}\n\nfunction generateActionTemplate(name: string): string {\n  const camel = toCamelCase(name)\n  return [\n    `import { defineAction } from 'theokit/server'`,\n    `import { z } from 'zod'`,\n    ``,\n    `export const ${camel} = defineAction({`,\n    `  input: z.object({}),`,\n    `  handler: ({ input, ctx }) => {`,\n    `    return { message: 'TODO: implement ${name}' }`,\n    `  },`,\n    `})`,\n    ``,\n  ].join('\\n')\n}\n\n/**\n * Co-located test template for `theokit generate action <name>` (T5.2 +\n * plan Q4 cenário 1: roundtrip serialize). Skeleton uses vitest BDD shape\n * per testing.md.\n */\nfunction resolveTemplate(\n  cwd: string,\n  type: GeneratorType,\n  name: string,\n): { filePath: string; content: string } | null {\n  switch (type) {\n    case 'route':\n      return {\n        filePath: resolve(cwd, 'server/routes', `${name}.ts`),\n        content: generateRouteTemplate(name),\n      }\n    case 'action':\n      return {\n        filePath: resolve(cwd, 'server/actions', `${name}.ts`),\n        content: generateActionTemplate(name),\n      }\n    case 'page':\n      return { filePath: resolve(cwd, `app/${name}/page.tsx`), content: generatePageTemplate(name) }\n    case 'ws':\n      return {\n        filePath: resolve(cwd, 'server/ws', `${name}.ts`),\n        content: generateWsTemplate(name),\n      }\n    default:\n      return null\n  }\n}\n\nfunction generateActionTestTemplate(name: string): string {\n  const camel = toCamelCase(name)\n  return [\n    `import { describe, it, expect } from 'vitest'`,\n    ``,\n    `import { ${camel} } from './${name.split('/').pop()}.js'`,\n    ``,\n    `describe('${name} action', () => {`,\n    `  it('should accept a valid input shape', () => {`,\n    `    expect(${camel}.input).toBeDefined()`,\n    `    expect(typeof ${camel}.handler).toBe('function')`,\n    `  })`,\n    ``,\n    `  it('should reject invalid input via zod schema', () => {`,\n    `    const parsed = ${camel}.input.safeParse({ __invalid: true })`,\n    `    // Empty object schema accepts {}; tighten this assertion when adding fields.`,\n    `    expect(parsed.success).toBe(true)`,\n    `  })`,\n    `})`,\n    ``,\n  ].join('\\n')\n}\n\nfunction generatePageTemplate(name: string): string {\n  const pascal = toPascalCase(name)\n  return [`export default function ${pascal}Page() {`, `  return <h1>${pascal}</h1>`, `}`, ``].join(\n    '\\n',\n  )\n}\n\nfunction generateWsTemplate(_name: string): string {\n  return [\n    `import { defineWebSocket } from 'theokit/server'`,\n    ``,\n    `export default defineWebSocket({`,\n    `  onMessage(ws, data) {`,\n    `    ws.send(\\`echo: \\${data}\\`)`,\n    `  },`,\n    `})`,\n    ``,\n  ].join('\\n')\n}\n\n/**\n * Programmatic generate. Returns a structured result instead of throwing —\n * Studio (`theokit_generate` tool) consumes this directly. The CLI wrapper\n * below maps the structured result to console output + exit code semantics.\n */\n// eslint-disable-next-line @typescript-eslint/require-await\nexport async function generate(opts: GenerateOptions): Promise<GenerateResult> {\n  const { cwd, type, name } = opts\n\n  if (!existsSync(resolve(cwd, 'theo.config.ts')) && !existsSync(resolve(cwd, 'theo.config.js'))) {\n    return {\n      status: 'not_a_project',\n      message: 'Not a Theo project. cwd has no theo.config.ts or theo.config.js',\n    }\n  }\n\n  if (!VALID_TYPES.includes(type as GeneratorType)) {\n    return {\n      status: 'invalid_kind',\n      message: `Invalid generator type \"${type}\". Available: ${VALID_TYPES.join(', ')}`,\n    }\n  }\n\n  if (!name || !toKebabCase(name)) {\n    return {\n      status: 'invalid_name',\n      message: `Invalid name \"${name}\". Use kebab-case: lowercase letters, numbers, hyphens.`,\n    }\n  }\n\n  // EC-2-related: reject reserved JS identifier basenames (would shadow\n  // built-in prototype machinery in virtual module emit or scan).\n  if (hasReservedSegment(name)) {\n    return {\n      status: 'invalid_name',\n      message: `Reserved name \"${name}\" — basename collides with built-in identifier (index/constructor/__proto__/prototype/hasOwnProperty).`,\n    }\n  }\n\n  const resolved = resolveTemplate(cwd, type as GeneratorType, name)\n  if (resolved === null) {\n    return { status: 'invalid_kind', message: `Unknown type: ${type}` }\n  }\n  const { filePath, content } = resolved\n\n  // EC-4: confirm the resolved filePath stays inside cwd. `toKebabCase`\n  // already rejects most traversal vectors but a defense-in-depth check\n  // against `..` slipping in via valid-looking segments is cheap.\n  const relativeFromCwd = filePath.startsWith(resolve(cwd))\n    ? filePath.slice(resolve(cwd).length + 1)\n    : filePath\n  if (!isPathInside(cwd, relativeFromCwd)) {\n    return {\n      status: 'invalid_name',\n      message: `Path traversal denied: \"${name}\" would escape project root.`,\n    }\n  }\n\n  if (existsSync(filePath)) {\n    return { status: 'already_exists', filePath, kind: type as GeneratorType, name }\n  }\n\n  mkdirSync(dirname(filePath), { recursive: true })\n  writeFileSync(filePath, content)\n\n  // T5.2 + plan Q4: emit co-located test file alongside actions (only\n  // for action type; routes/pages/ws keep prior single-file behavior).\n  // Skip if existing test file present (preserve user-customized tests).\n  if (type === 'action') {\n    const testPath = filePath.replace(/\\.ts$/, '.test.ts')\n    if (!existsSync(testPath)) {\n      writeFileSync(testPath, generateActionTestTemplate(name))\n    }\n  }\n\n  return { status: 'created', filePath, kind: type as GeneratorType, name }\n}\n\n/**\n * CLI entry point — preserves the original surface (throws + console.log).\n * Wraps the programmatic `generate` function.\n */\nexport async function generateCommand(type: string, name: string): Promise<void> {\n  const result = await generate({ cwd: process.cwd(), type, name })\n  switch (result.status) {\n    case 'not_a_project':\n      throw new Error('Not a Theo project. Run this from a project root with theo.config.ts')\n    case 'invalid_kind':\n      throw new Error(result.message ?? 'Invalid kind')\n    case 'invalid_name':\n      throw new Error(\n        `Invalid name \"${name}\". Use kebab-case: lowercase letters, numbers, hyphens. Example: my-route`,\n      )\n    case 'already_exists':\n      console.log(`\\n  ⚠ ${result.filePath} already exists. Skipping.\\n`)\n      return\n    case 'created':\n      console.log(`\\n  ✓ Created ${type}: ${result.filePath}\\n`)\n      return\n  }\n}\n"],"mappings":";;;;;AAIA,SAAS,YAAY,WAAW,qBAAqB;AACrD,SAAS,SAAS,eAAe;AAE1B,IAAM,cAAc,CAAC,SAAS,UAAU,QAAQ,IAAI;AAwB3D,SAAS,YAAY,MAAuB;AAC1C,SAAO,qBAAqB,KAAK,IAAI;AACvC;AAOA,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,mBAAmB,MAAuB;AACjD,QAAM,WAAW,KAAK,SAAS,GAAG,IAAK,KAAK,MAAM,GAAG,EAAE,IAAI,KAAK,OAAQ;AACxE,SAAO,mBAAmB,IAAI,QAAQ;AACxC;AAOA,SAAS,aAAa,KAAa,eAAgC;AACjE,MAAI,cAAc,SAAS,IAAM,EAAG,QAAO;AAC3C,MAAI,cAAc,WAAW,GAAG,KAAK,cAAc,WAAW,IAAI,EAAG,QAAO;AAC5E,QAAM,WAAW,QAAQ,KAAK,aAAa;AAC3C,QAAM,cAAc,QAAQ,GAAG;AAC/B,QAAM,MAAM,QAAQ,aAAa,UAAU,OAAO;AAClD,SAAO,aAAa,eAAe,SAAS,WAAW,cAAc,GAAG;AAC1E;AAEA,SAAS,aAAa,MAAsB;AAC1C,SAAO,KACJ,MAAM,MAAM,EACZ,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,IAAI,EAAE,MAAM,CAAC,CAAC,EACjD,KAAK,EAAE;AACZ;AAEA,SAAS,YAAY,MAAsB;AACzC,QAAM,SAAS,aAAa,IAAI;AAChC,SAAO,OAAO,OAAO,CAAC,EAAE,YAAY,IAAI,OAAO,MAAM,CAAC;AACxD;AAEA,SAAS,sBAAsB,MAAsB;AACnD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,0CAA0C,IAAI;AAAA,IAC9C;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,uBAAuB,MAAsB;AACpD,QAAM,QAAQ,YAAY,IAAI;AAC9B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB;AAAA,IACA;AAAA,IACA,0CAA0C,IAAI;AAAA,IAC9C;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAOA,SAAS,gBACP,KACA,MACA,MAC8C;AAC9C,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,QACL,UAAU,QAAQ,KAAK,iBAAiB,GAAG,IAAI,KAAK;AAAA,QACpD,SAAS,sBAAsB,IAAI;AAAA,MACrC;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,UAAU,QAAQ,KAAK,kBAAkB,GAAG,IAAI,KAAK;AAAA,QACrD,SAAS,uBAAuB,IAAI;AAAA,MACtC;AAAA,IACF,KAAK;AACH,aAAO,EAAE,UAAU,QAAQ,KAAK,OAAO,IAAI,WAAW,GAAG,SAAS,qBAAqB,IAAI,EAAE;AAAA,IAC/F,KAAK;AACH,aAAO;AAAA,QACL,UAAU,QAAQ,KAAK,aAAa,GAAG,IAAI,KAAK;AAAA,QAChD,SAAS,mBAAmB,IAAI;AAAA,MAClC;AAAA,IACF;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,2BAA2B,MAAsB;AACxD,QAAM,QAAQ,YAAY,IAAI;AAC9B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YAAY,KAAK,cAAc,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC;AAAA,IACpD;AAAA,IACA,aAAa,IAAI;AAAA,IACjB;AAAA,IACA,cAAc,KAAK;AAAA,IACnB,qBAAqB,KAAK;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA,sBAAsB,KAAK;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,qBAAqB,MAAsB;AAClD,QAAM,SAAS,aAAa,IAAI;AAChC,SAAO,CAAC,2BAA2B,MAAM,YAAY,gBAAgB,MAAM,SAAS,KAAK,EAAE,EAAE;AAAA,IAC3F;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAAuB;AACjD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAQA,eAAsB,SAAS,MAAgD;AAC7E,QAAM,EAAE,KAAK,MAAM,KAAK,IAAI;AAE5B,MAAI,CAAC,WAAW,QAAQ,KAAK,gBAAgB,CAAC,KAAK,CAAC,WAAW,QAAQ,KAAK,gBAAgB,CAAC,GAAG;AAC9F,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,IACX;AAAA,EACF;AAEA,MAAI,CAAC,YAAY,SAAS,IAAqB,GAAG;AAChD,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,2BAA2B,IAAI,iBAAiB,YAAY,KAAK,IAAI,CAAC;AAAA,IACjF;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,GAAG;AAC/B,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,iBAAiB,IAAI;AAAA,IAChC;AAAA,EACF;AAIA,MAAI,mBAAmB,IAAI,GAAG;AAC5B,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,kBAAkB,IAAI;AAAA,IACjC;AAAA,EACF;AAEA,QAAM,WAAW,gBAAgB,KAAK,MAAuB,IAAI;AACjE,MAAI,aAAa,MAAM;AACrB,WAAO,EAAE,QAAQ,gBAAgB,SAAS,iBAAiB,IAAI,GAAG;AAAA,EACpE;AACA,QAAM,EAAE,UAAU,QAAQ,IAAI;AAK9B,QAAM,kBAAkB,SAAS,WAAW,QAAQ,GAAG,CAAC,IACpD,SAAS,MAAM,QAAQ,GAAG,EAAE,SAAS,CAAC,IACtC;AACJ,MAAI,CAAC,aAAa,KAAK,eAAe,GAAG;AACvC,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,2BAA2B,IAAI;AAAA,IAC1C;AAAA,EACF;AAEA,MAAI,WAAW,QAAQ,GAAG;AACxB,WAAO,EAAE,QAAQ,kBAAkB,UAAU,MAAM,MAAuB,KAAK;AAAA,EACjF;AAEA,YAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,gBAAc,UAAU,OAAO;AAK/B,MAAI,SAAS,UAAU;AACrB,UAAM,WAAW,SAAS,QAAQ,SAAS,UAAU;AACrD,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,oBAAc,UAAU,2BAA2B,IAAI,CAAC;AAAA,IAC1D;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,WAAW,UAAU,MAAM,MAAuB,KAAK;AAC1E;AAMA,eAAsB,gBAAgB,MAAc,MAA6B;AAC/E,QAAM,SAAS,MAAM,SAAS,EAAE,KAAK,QAAQ,IAAI,GAAG,MAAM,KAAK,CAAC;AAChE,UAAQ,OAAO,QAAQ;AAAA,IACrB,KAAK;AACH,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF,KAAK;AACH,YAAM,IAAI,MAAM,OAAO,WAAW,cAAc;AAAA,IAClD,KAAK;AACH,YAAM,IAAI;AAAA,QACR,iBAAiB,IAAI;AAAA,MACvB;AAAA,IACF,KAAK;AACH,cAAQ,IAAI;AAAA,WAAS,OAAO,QAAQ;AAAA,CAA8B;AAClE;AAAA,IACF,KAAK;AACH,cAAQ,IAAI;AAAA,mBAAiB,IAAI,KAAK,OAAO,QAAQ;AAAA,CAAI;AACzD;AAAA,EACJ;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 export { theoPlugin } from './vite-plugin/index.js';
 import 'vite';
-import './schema-Cxq2qqwh.js';
+import './schema-CjVly9c_.js';
 import 'node:http';
 import './rate-limit-store-BEJnhWdw.js';
 
@@ -412,6 +412,21 @@ declare const theoConfigSchema: z.ZodEffects<z.ZodObject<{
      * matching `--target`, `theokit build` emits a cross-reference note.
      */
     adapters: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Extra package names to pre-bundle via Vite's `optimizeDeps.include`.
+     *
+     * Framework auto-includes `@usetheo/ui` and `lucide-react` when present.
+     * Apps adding plugin peer-deps that rely on a runtime `import('<pkg>')`
+     * (dynamic specifier) — e.g. `@theokit/plugin-canvas` consumers
+     * installing `mermaid` for Mermaid SVG rendering — must declare those
+     * here so Vite can resolve the literal in dev mode without
+     * "Failed to resolve module specifier" errors. Production builds use
+     * tsup/esbuild bundling and are not affected.
+     *
+     * Example:
+     *   viteOptimizeDeps: ['mermaid']
+     */
+    viteOptimizeDeps: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     /**
      * Jobs backend (ADR D3 + T2.1). When configured, every request gets
      * `ctx.queue.enqueue` auto-wired via the outbox lifecycle. Pass a
@@ -771,6 +786,54 @@ declare const theoConfigSchema: z.ZodEffects<z.ZodObject<{
         dependsOn?: string[] | undefined;
         passSetCookie?: boolean | undefined;
     }> | undefined>;
+    /**
+     * G2 — OpenAPI emit (build-time only).
+     *
+     * When present, `theokit build` writes a generated `openapi.json` from
+     * every `defineRoute()` body/query/params Zod schema. `undefined` keeps
+     * the framework backward-compatible (no emit). Pass `openapi: {}` to
+     * opt in with defaults.
+     *
+     * Defaults: spec 3.1.0 · servers `http://localhost:3000` · title
+     * "TheoKit App" · version "0.0.0" · outDir ".theo" (next to dist).
+     *
+     * The env var `THEOKIT_OPENAPI_SERVERS` (CSV of URLs) overrides
+     * `servers[].url` at emit time without rebuilding the config.
+     */
+    openapi: z.ZodOptional<z.ZodObject<{
+        servers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            url: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            url: string;
+            description?: string | undefined;
+        }, {
+            url: string;
+            description?: string | undefined;
+        }>, "many">>;
+        specVersion: z.ZodDefault<z.ZodEnum<["3.1.0", "3.0.3"]>>;
+        title: z.ZodDefault<z.ZodString>;
+        version: z.ZodDefault<z.ZodString>;
+        outDir: z.ZodDefault<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        version: string;
+        servers: {
+            url: string;
+            description?: string | undefined;
+        }[];
+        specVersion: "3.1.0" | "3.0.3";
+        title: string;
+        outDir: string;
+    }, {
+        version?: string | undefined;
+        servers?: {
+            url: string;
+            description?: string | undefined;
+        }[] | undefined;
+        specVersion?: "3.1.0" | "3.0.3" | undefined;
+        title?: string | undefined;
+        outDir?: string | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     port: number;
     services: Record<string, {
@@ -793,6 +856,16 @@ declare const theoConfigSchema: z.ZodEffects<z.ZodObject<{
     ssr: boolean;
     ssrStreaming: boolean;
     serialization: "json" | "superjson";
+    openapi?: {
+        version: string;
+        servers: {
+            url: string;
+            description?: string | undefined;
+        }[];
+        specVersion: "3.1.0" | "3.0.3";
+        title: string;
+        outDir: string;
+    } | undefined;
     storage?: {
         redis?: Record<string, {
             host: string;
@@ -921,11 +994,22 @@ declare const theoConfigSchema: z.ZodEffects<z.ZodObject<{
         position?: "top-left" | "top-right" | "bottom-left" | "bottom-right" | undefined;
     } | undefined;
     adapters?: string[] | undefined;
+    viteOptimizeDeps?: string[] | undefined;
     jobs?: {
         backend?: unknown;
     } | undefined;
 }, {
     port?: number | undefined;
+    openapi?: {
+        version?: string | undefined;
+        servers?: {
+            url: string;
+            description?: string | undefined;
+        }[] | undefined;
+        specVersion?: "3.1.0" | "3.0.3" | undefined;
+        title?: string | undefined;
+        outDir?: string | undefined;
+    } | undefined;
     services?: Record<string, {
         runtime: "python" | "node";
         port: number;
@@ -1074,6 +1158,7 @@ declare const theoConfigSchema: z.ZodEffects<z.ZodObject<{
         position?: "top-left" | "top-right" | "bottom-left" | "bottom-right" | undefined;
     } | undefined;
     adapters?: string[] | undefined;
+    viteOptimizeDeps?: string[] | undefined;
     jobs?: {
         backend?: unknown;
     } | undefined;
@@ -1099,6 +1184,16 @@ declare const theoConfigSchema: z.ZodEffects<z.ZodObject<{
     ssr: boolean;
     ssrStreaming: boolean;
     serialization: "json" | "superjson";
+    openapi?: {
+        version: string;
+        servers: {
+            url: string;
+            description?: string | undefined;
+        }[];
+        specVersion: "3.1.0" | "3.0.3";
+        title: string;
+        outDir: string;
+    } | undefined;
     storage?: {
         redis?: Record<string, {
             host: string;
@@ -1227,11 +1322,22 @@ declare const theoConfigSchema: z.ZodEffects<z.ZodObject<{
         position?: "top-left" | "top-right" | "bottom-left" | "bottom-right" | undefined;
     } | undefined;
     adapters?: string[] | undefined;
+    viteOptimizeDeps?: string[] | undefined;
     jobs?: {
         backend?: unknown;
     } | undefined;
 }, {
     port?: number | undefined;
+    openapi?: {
+        version?: string | undefined;
+        servers?: {
+            url: string;
+            description?: string | undefined;
+        }[] | undefined;
+        specVersion?: "3.1.0" | "3.0.3" | undefined;
+        title?: string | undefined;
+        outDir?: string | undefined;
+    } | undefined;
     services?: Record<string, {
         runtime: "python" | "node";
         port: number;
@@ -1380,6 +1486,7 @@ declare const theoConfigSchema: z.ZodEffects<z.ZodObject<{
         position?: "top-left" | "top-right" | "bottom-left" | "bottom-right" | undefined;
     } | undefined;
     adapters?: string[] | undefined;
+    viteOptimizeDeps?: string[] | undefined;
     jobs?: {
         backend?: unknown;
     } | undefined;

package/dist/index.js

@@ -8,13 +8,16 @@ import {
   scanRoutes,
   theoConfigSchema,
   theoPlugin
-} from "./chunk-FRBYJANT.js";
+} from "./chunk-4W447H7M.js";
 import "./chunk-7BIM27LV.js";
 import "./chunk-O4BLVPML.js";
-import "./chunk-OEB3OIYP.js";
+import "./chunk-OJHO2X7C.js";
+import "./chunk-2BQYEBCK.js";
+import "./chunk-7DHGV77J.js";
 import "./chunk-PB4GR7EP.js";
 import "./chunk-GY5Q27BJ.js";
 import "./chunk-X2VVCJ4V.js";
+import "./chunk-WSJKACWB.js";
 import "./chunk-DGUM43GV.js";
 
 // src/config/define-config.ts

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config/define-config.ts","../src/core/validate-structure.ts","../src/core/errors.ts"],"sourcesContent":["import type { TheoConfig } from './schema.js'\n\n/**\n * Define Theo framework configuration.\n * Identity function — provides type inference for theo.config.ts.\n * Runtime validation happens in loadConfig(), not here.\n */\nexport function defineConfig(config: Partial<TheoConfig>): Partial<TheoConfig> {\n  return config\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Project-structure validator. Reads paths joined onto `projectRoot`,\n * with names from a fixed `ValidationRule[]` table. No HTTP input.\n */\nimport { existsSync } from 'node:fs'\nimport { join } from 'node:path'\n\nimport { TheoProjectError } from './errors.js'\n\ninterface ValidationRule {\n  path: string\n  errorMessage: string\n}\n\nconst REQUIRED_DIRS: ValidationRule[] = [\n  {\n    path: 'app',\n    errorMessage: 'Missing required directory: app/',\n  },\n]\n\nconst REQUIRED_FILES: ValidationRule[] = [\n  {\n    path: 'theo.config.ts',\n    errorMessage: 'Missing required file: theo.config.ts',\n  },\n  {\n    path: 'package.json',\n    errorMessage: 'Missing required file: package.json',\n  },\n]\n\nexport function validateProjectStructure(rootDir: string): void {\n  if (!existsSync(rootDir)) {\n    throw new TheoProjectError([`Project directory does not exist: ${rootDir}`], rootDir)\n  }\n\n  const errors: string[] = []\n\n  for (const rule of REQUIRED_DIRS) {\n    if (!existsSync(join(rootDir, rule.path))) {\n      errors.push(rule.errorMessage)\n    }\n  }\n\n  for (const rule of REQUIRED_FILES) {\n    if (!existsSync(join(rootDir, rule.path))) {\n      errors.push(rule.errorMessage)\n    }\n  }\n\n  if (errors.length > 0) {\n    throw new TheoProjectError(errors, rootDir)\n  }\n}\n","export class TheoProjectError extends Error {\n  public readonly errors: string[]\n  public readonly rootDir: string\n\n  constructor(errors: string[], rootDir: string) {\n    const errorLines = errors.map((e) => `  - ${e}`).join('\\n')\n\n    super(\n      `Invalid Theo project structure\\n\\n` +\n        `  Root: ${rootDir}\\n\\n` +\n        (errorLines ? `  Errors:\\n${errorLines}\\n` : ''),\n    )\n\n    this.name = 'TheoProjectError'\n    this.errors = errors\n    this.rootDir = rootDir\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAOO,SAAS,aAAa,QAAkD;AAC7E,SAAO;AACT;;;ACLA,SAAS,kBAAkB;AAC3B,SAAS,YAAY;;;ACLd,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1B;AAAA,EACA;AAAA,EAEhB,YAAY,QAAkB,SAAiB;AAC7C,UAAM,aAAa,OAAO,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AAE1D;AAAA,MACE;AAAA;AAAA,UACa,OAAO;AAAA;AAAA,KACjB,aAAa;AAAA,EAAc,UAAU;AAAA,IAAO;AAAA,IACjD;AAEA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AAAA,EACjB;AACF;;;ADHA,IAAM,gBAAkC;AAAA,EACtC;AAAA,IACE,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AACF;AAEA,IAAM,iBAAmC;AAAA,EACvC;AAAA,IACE,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AACF;AAEO,SAAS,yBAAyB,SAAuB;AAC9D,MAAI,CAAC,WAAW,OAAO,GAAG;AACxB,UAAM,IAAI,iBAAiB,CAAC,qCAAqC,OAAO,EAAE,GAAG,OAAO;AAAA,EACtF;AAEA,QAAM,SAAmB,CAAC;AAE1B,aAAW,QAAQ,eAAe;AAChC,QAAI,CAAC,WAAW,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG;AACzC,aAAO,KAAK,KAAK,YAAY;AAAA,IAC/B;AAAA,EACF;AAEA,aAAW,QAAQ,gBAAgB;AACjC,QAAI,CAAC,WAAW,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG;AACzC,aAAO,KAAK,KAAK,YAAY;AAAA,IAC/B;AAAA,EACF;AAEA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,iBAAiB,QAAQ,OAAO;AAAA,EAC5C;AACF;","names":[]}
+{"version":3,"sources":["../src/config/define-config.ts","../src/core/validate-structure.ts","../src/core/errors.ts"],"sourcesContent":["import type { TheoConfig } from './schema.js'\n\n/**\n * Define Theo framework configuration.\n * Identity function — provides type inference for theo.config.ts.\n * Runtime validation happens in loadConfig(), not here.\n */\nexport function defineConfig(config: Partial<TheoConfig>): Partial<TheoConfig> {\n  return config\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Project-structure validator. Reads paths joined onto `projectRoot`,\n * with names from a fixed `ValidationRule[]` table. No HTTP input.\n */\nimport { existsSync } from 'node:fs'\nimport { join } from 'node:path'\n\nimport { TheoProjectError } from './errors.js'\n\ninterface ValidationRule {\n  path: string\n  errorMessage: string\n}\n\nconst REQUIRED_DIRS: ValidationRule[] = [\n  {\n    path: 'app',\n    errorMessage: 'Missing required directory: app/',\n  },\n]\n\nconst REQUIRED_FILES: ValidationRule[] = [\n  {\n    path: 'theo.config.ts',\n    errorMessage: 'Missing required file: theo.config.ts',\n  },\n  {\n    path: 'package.json',\n    errorMessage: 'Missing required file: package.json',\n  },\n]\n\nexport function validateProjectStructure(rootDir: string): void {\n  if (!existsSync(rootDir)) {\n    throw new TheoProjectError([`Project directory does not exist: ${rootDir}`], rootDir)\n  }\n\n  const errors: string[] = []\n\n  for (const rule of REQUIRED_DIRS) {\n    if (!existsSync(join(rootDir, rule.path))) {\n      errors.push(rule.errorMessage)\n    }\n  }\n\n  for (const rule of REQUIRED_FILES) {\n    if (!existsSync(join(rootDir, rule.path))) {\n      errors.push(rule.errorMessage)\n    }\n  }\n\n  if (errors.length > 0) {\n    throw new TheoProjectError(errors, rootDir)\n  }\n}\n","export class TheoProjectError extends Error {\n  public readonly errors: string[]\n  public readonly rootDir: string\n\n  constructor(errors: string[], rootDir: string) {\n    const errorLines = errors.map((e) => `  - ${e}`).join('\\n')\n\n    super(\n      `Invalid Theo project structure\\n\\n` +\n        `  Root: ${rootDir}\\n\\n` +\n        (errorLines ? `  Errors:\\n${errorLines}\\n` : ''),\n    )\n\n    this.name = 'TheoProjectError'\n    this.errors = errors\n    this.rootDir = rootDir\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAOO,SAAS,aAAa,QAAkD;AAC7E,SAAO;AACT;;;ACLA,SAAS,kBAAkB;AAC3B,SAAS,YAAY;;;ACLd,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1B;AAAA,EACA;AAAA,EAEhB,YAAY,QAAkB,SAAiB;AAC7C,UAAM,aAAa,OAAO,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AAE1D;AAAA,MACE;AAAA;AAAA,UACa,OAAO;AAAA;AAAA,KACjB,aAAa;AAAA,EAAc,UAAU;AAAA,IAAO;AAAA,IACjD;AAEA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AAAA,EACjB;AACF;;;ADHA,IAAM,gBAAkC;AAAA,EACtC;AAAA,IACE,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AACF;AAEA,IAAM,iBAAmC;AAAA,EACvC;AAAA,IACE,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AACF;AAEO,SAAS,yBAAyB,SAAuB;AAC9D,MAAI,CAAC,WAAW,OAAO,GAAG;AACxB,UAAM,IAAI,iBAAiB,CAAC,qCAAqC,OAAO,EAAE,GAAG,OAAO;AAAA,EACtF;AAEA,QAAM,SAAmB,CAAC;AAE1B,aAAW,QAAQ,eAAe;AAChC,QAAI,CAAC,WAAW,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG;AACzC,aAAO,KAAK,KAAK,YAAY;AAAA,IAC/B;AAAA,EACF;AAEA,aAAW,QAAQ,gBAAgB;AACjC,QAAI,CAAC,WAAW,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG;AACzC,aAAO,KAAK,KAAK,YAAY;AAAA,IAC/B;AAAA,EACF;AAEA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,iBAAiB,QAAQ,OAAO;AAAA,EAC5C;AACF;","names":[]}

package/dist/{info-B3UOXFUF.js → info-VM7EK4JC.js}

@@ -2,8 +2,8 @@
 import "tsx/esm";
 import {
   loadConfig
-} from "./chunk-S3JBIFKS.js";
-import "./chunk-3Q36SEDK.js";
+} from "./chunk-MG7H3LAW.js";
+import "./chunk-ZBWROIIO.js";
 import {
   scanRoutes
 } from "./chunk-O7335ZGH.js";
@@ -101,4 +101,4 @@ export {
   buildInfo,
   infoCommand
 };
-//# sourceMappingURL=info-B3UOXFUF.js.map
+//# sourceMappingURL=info-VM7EK4JC.js.map

package/dist/openapi-CBASKC7W.js

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  emitOpenApi,
+  loadRoutesForOpenApi
+} from "./chunk-ZOXNJV2O.js";
+import {
+  loadConfig
+} from "./chunk-MG7H3LAW.js";
+import "./chunk-ZBWROIIO.js";
+import "./chunk-WZ7CPVQB.js";
+import {
+  generateManifest
+} from "./chunk-SEVYARIU.js";
+import "./chunk-QLGES2HC.js";
+import "./chunk-MOT42NAH.js";
+import "./chunk-KT3MWNZG.js";
+
+// src/cli/commands/openapi.ts
+import { mkdtempSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join, resolve } from "path";
+var MIGRATION_GUIDE_URL = "docs/concepts/openapi.md";
+async function openapiCommand(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const config = await loadConfig(cwd);
+  if (config.openapi === void 0) {
+    console.error(
+      `
+  \u2717 openapi: not configured in theo.config.ts
+
+  Add the \`openapi\` block to opt in:
+
+    export default defineConfig({
+      openapi: {
+        title: 'My App',
+        version: '1.0.0',
+      },
+    })
+
+  See ${MIGRATION_GUIDE_URL} for the full reference.
+`
+    );
+    process.exit(1);
+    return;
+  }
+  const serverDir = resolve(cwd, config.serverDir);
+  const manifest = generateManifest(serverDir);
+  const hydrated = await loadRoutesForOpenApi({ serverDir, routes: manifest.routes });
+  if (options.dryRun) {
+    const result2 = emitOpenApiInMemory(hydrated, config.openapi);
+    console.log(`
+  \u2713 openapi.json (dry-run): ${String(hydrated.length)} ops`);
+    console.log(JSON.stringify(result2.document, null, 2));
+    console.log(`
+  Docs: ${MIGRATION_GUIDE_URL}
+`);
+    return;
+  }
+  const distDir = resolve(cwd, config.distDir);
+  const result = emitOpenApi({
+    manifest: hydrated,
+    config: { ...config.openapi, outDir: distDir }
+  });
+  console.log(
+    `
+  \u2713 openapi.json: ${String(hydrated.length)} ops \u2192 ${result.path}
+  Docs: ${MIGRATION_GUIDE_URL}
+`
+  );
+}
+function emitOpenApiInMemory(manifest, config) {
+  const tmp = mkdtempSync(join(tmpdir(), "theokit-openapi-dryrun-"));
+  try {
+    const result = emitOpenApi({ manifest, config: { ...config, outDir: tmp } });
+    return { document: result.document };
+  } finally {
+    rmSync(tmp, { recursive: true, force: true });
+  }
+}
+export {
+  openapiCommand
+};
+//# sourceMappingURL=openapi-CBASKC7W.js.map

package/dist/openapi-CBASKC7W.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/openapi.ts"],"sourcesContent":["/**\n * `theokit openapi` — regenerate `<distDir>/openapi.json` standalone.\n *\n * Mirrors trpc-openapi's `pnpm codegen` script. Useful in dev workflows\n * when only schemas changed and a full `theokit build` would be\n * overkill.\n *\n * Per G2 plan v1.1 T2.3. Single output (dev location only) — for the\n * dist artifact, run `theokit build`.\n *\n * Flags:\n *   --dry-run   Validate + print the document to stdout; skip the\n *               filesystem write (EC-3 absorbed).\n */\nimport { mkdtempSync, rmSync } from 'node:fs'\nimport { tmpdir } from 'node:os'\nimport { join, resolve } from 'node:path'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { generateManifest } from '../../server/scan/manifest.js'\nimport { emitOpenApi } from '../../vite-plugin/openapi-emit/emit.js'\nimport { loadRoutesForOpenApi } from '../../vite-plugin/openapi-emit/load-routes.js'\n\nconst MIGRATION_GUIDE_URL = 'docs/concepts/openapi.md'\n\nexport interface OpenApiCommandOptions {\n  /** Project root (defaults to `process.cwd()`). */\n  cwd?: string\n  /** Skip the filesystem write; print the document to stdout (EC-3). */\n  dryRun?: boolean\n}\n\nexport async function openapiCommand(options: OpenApiCommandOptions = {}): Promise<void> {\n  const cwd = options.cwd ?? process.cwd()\n  const config = await loadConfig(cwd)\n\n  if (config.openapi === undefined) {\n    console.error(\n      `\\n  ✗ openapi: not configured in theo.config.ts\\n\\n` +\n        `  Add the \\`openapi\\` block to opt in:\\n\\n` +\n        `    export default defineConfig({\\n` +\n        `      openapi: {\\n` +\n        `        title: 'My App',\\n` +\n        `        version: '1.0.0',\\n` +\n        `      },\\n` +\n        `    })\\n\\n` +\n        `  See ${MIGRATION_GUIDE_URL} for the full reference.\\n`,\n    )\n    process.exit(1)\n    return\n  }\n\n  const serverDir = resolve(cwd, config.serverDir)\n  const manifest = generateManifest(serverDir)\n  const hydrated = await loadRoutesForOpenApi({ serverDir, routes: manifest.routes })\n\n  if (options.dryRun) {\n    // Build the document without writing — for the dry-run we still want a\n    // valid emit pass, but with an in-memory output dir we never touch disk.\n    const result = emitOpenApiInMemory(hydrated, config.openapi)\n    console.log(`\\n  ✓ openapi.json (dry-run): ${String(hydrated.length)} ops`)\n    console.log(JSON.stringify(result.document, null, 2))\n    console.log(`\\n  Docs: ${MIGRATION_GUIDE_URL}\\n`)\n    return\n  }\n\n  const distDir = resolve(cwd, config.distDir)\n  const result = emitOpenApi({\n    manifest: hydrated,\n    config: { ...config.openapi, outDir: distDir },\n  })\n  console.log(\n    `\\n  ✓ openapi.json: ${String(hydrated.length)} ops → ${result.path}\\n` +\n      `  Docs: ${MIGRATION_GUIDE_URL}\\n`,\n  )\n}\n\n/**\n * Dry-run helper: build the OpenAPI doc without writing. Routes through\n * the same `emitOpenApi` but discards the side-effecting write by\n * targeting a temp directory we immediately ignore.\n *\n * Honest tradeoff: this still calls `mkdirSync` (no-op on existing tmpdir)\n * + a synchronous write to a discardable tempfile. Cost is < 1ms and the\n * code stays the single transformation. A pure no-write helper would\n * duplicate the orchestration in `emit.ts` — KISS prefers reuse.\n */\nfunction emitOpenApiInMemory(\n  manifest: Parameters<typeof emitOpenApi>[0]['manifest'],\n  config: Omit<Parameters<typeof emitOpenApi>[0]['config'], 'outDir'>,\n): { document: unknown } {\n  const tmp = mkdtempSync(join(tmpdir(), 'theokit-openapi-dryrun-'))\n  try {\n    const result = emitOpenApi({ manifest, config: { ...config, outDir: tmp } })\n    return { document: result.document }\n  } finally {\n    rmSync(tmp, { recursive: true, force: true })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAcA,SAAS,aAAa,cAAc;AACpC,SAAS,cAAc;AACvB,SAAS,MAAM,eAAe;AAO9B,IAAM,sBAAsB;AAS5B,eAAsB,eAAe,UAAiC,CAAC,GAAkB;AACvF,QAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACvC,QAAM,SAAS,MAAM,WAAW,GAAG;AAEnC,MAAI,OAAO,YAAY,QAAW;AAChC,YAAQ;AAAA,MACN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQW,mBAAmB;AAAA;AAAA,IAChC;AACA,YAAQ,KAAK,CAAC;AACd;AAAA,EACF;AAEA,QAAM,YAAY,QAAQ,KAAK,OAAO,SAAS;AAC/C,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,WAAW,MAAM,qBAAqB,EAAE,WAAW,QAAQ,SAAS,OAAO,CAAC;AAElF,MAAI,QAAQ,QAAQ;AAGlB,UAAMA,UAAS,oBAAoB,UAAU,OAAO,OAAO;AAC3D,YAAQ,IAAI;AAAA,mCAAiC,OAAO,SAAS,MAAM,CAAC,MAAM;AAC1E,YAAQ,IAAI,KAAK,UAAUA,QAAO,UAAU,MAAM,CAAC,CAAC;AACpD,YAAQ,IAAI;AAAA,UAAa,mBAAmB;AAAA,CAAI;AAChD;AAAA,EACF;AAEA,QAAM,UAAU,QAAQ,KAAK,OAAO,OAAO;AAC3C,QAAM,SAAS,YAAY;AAAA,IACzB,UAAU;AAAA,IACV,QAAQ,EAAE,GAAG,OAAO,SAAS,QAAQ,QAAQ;AAAA,EAC/C,CAAC;AACD,UAAQ;AAAA,IACN;AAAA,yBAAuB,OAAO,SAAS,MAAM,CAAC,eAAU,OAAO,IAAI;AAAA,UACtD,mBAAmB;AAAA;AAAA,EAClC;AACF;AAYA,SAAS,oBACP,UACA,QACuB;AACvB,QAAM,MAAM,YAAY,KAAK,OAAO,GAAG,yBAAyB,CAAC;AACjE,MAAI;AACF,UAAM,SAAS,YAAY,EAAE,UAAU,QAAQ,EAAE,GAAG,QAAQ,QAAQ,IAAI,EAAE,CAAC;AAC3E,WAAO,EAAE,UAAU,OAAO,SAAS;AAAA,EACrC,UAAE;AACA,WAAO,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAC9C;AACF;","names":["result"]}

package/dist/{registry-BB3UYAOG.js → registry-QGSNLJKJ.js}

@@ -7,7 +7,7 @@ var adapterRegistry = {
   node: async () => (await import("./node-KWZI3CKV.js")).nodeAdapter,
   vercel: async () => (await import("./vercel-RHADE5IP.js")).vercelAdapter,
   cloudflare: async () => (await import("./cloudflare-RBANU3SE.js")).cloudflareAdapter,
-  static: async () => (await import("./static-BH6JQNM2.js")).staticAdapter,
+  static: async () => (await import("./static-6PZZBY7G.js")).staticAdapter,
   bun: async () => (await import("./bun-DITMZMKL.js")).bunAdapter,
   "deno-deploy": async () => (await import("./deno-deploy-J7LI6HNL.js")).denoDeployAdapter,
   netlify: async () => (await import("./netlify-IFY6ZGFV.js")).netlifyAdapter,
@@ -22,4 +22,4 @@ export {
   adapterRegistry,
   resolveAdapter
 };
-//# sourceMappingURL=registry-BB3UYAOG.js.map
+//# sourceMappingURL=registry-QGSNLJKJ.js.map

package/dist/{routes-CAGFZKUK.js → routes-7O4NUDYS.js}

@@ -4,15 +4,17 @@ import {
   validateProjectStructure
 } from "./chunk-XMS5VRIK.js";
 import {
-  scanServerActions,
+  loadConfig
+} from "./chunk-MG7H3LAW.js";
+import "./chunk-ZBWROIIO.js";
+import "./chunk-WZ7CPVQB.js";
+import {
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-GQSTRXXB.js";
+} from "./chunk-QLGES2HC.js";
 import {
-  loadConfig
-} from "./chunk-S3JBIFKS.js";
-import "./chunk-3Q36SEDK.js";
-import "./chunk-WZ7CPVQB.js";
+  scanServerActions
+} from "./chunk-MOT42NAH.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/cli/commands/routes.ts
@@ -61,4 +63,4 @@ async function routesCommand() {
 export {
   routesCommand
 };
-//# sourceMappingURL=routes-CAGFZKUK.js.map
+//# sourceMappingURL=routes-7O4NUDYS.js.map

package/dist/{routes-CAGFZKUK.js.map → routes-7O4NUDYS.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/routes.ts"],"sourcesContent":["import { resolve, relative } from 'node:path'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { validateProjectStructure } from '../../core/validate-structure.js'\nimport { scanServerActions } from '../../server/scan/action-scan.js'\nimport { scanServerRoutes } from '../../server/scan/scan.js'\nimport { scanWebSocketRoutes } from '../../server/scan/ws-scan.js'\n\nexport async function routesCommand(): Promise<void> {\n  const cwd = process.cwd()\n  const config = await loadConfig(cwd)\n  validateProjectStructure(cwd)\n\n  const serverDir = resolve(cwd, config.serverDir)\n\n  const apiRoutes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const wsRoutes = scanWebSocketRoutes(serverDir)\n\n  const totalCount = apiRoutes.length + actions.length + wsRoutes.length\n\n  if (totalCount === 0) {\n    console.log('\\n  No routes found.\\n')\n    return\n  }\n\n  // API Routes\n  if (apiRoutes.length > 0) {\n    console.log('\\n  API Routes')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of apiRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  GET/POST  ${route.routePath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  // Actions\n  if (actions.length > 0) {\n    console.log('\\n  Actions')\n    console.log('  ' + '─'.repeat(60))\n    for (const action of actions) {\n      const rel = relative(cwd, action.filePath)\n      console.log(`  POST      /api/__actions/${action.actionPath.padEnd(18)} ${rel}`)\n    }\n  }\n\n  // WebSocket\n  if (wsRoutes.length > 0) {\n    console.log('\\n  WebSocket')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of wsRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  WS        ${route.wsPath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  console.log(`\\n  Total: ${totalCount} endpoints\\n`)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,gBAAgB;AAQlC,eAAsB,gBAA+B;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,WAAW,GAAG;AACnC,2BAAyB,GAAG;AAE5B,QAAM,YAAY,QAAQ,KAAK,OAAO,SAAS;AAE/C,QAAM,YAAY,iBAAiB,SAAS;AAC5C,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,WAAW,oBAAoB,SAAS;AAE9C,QAAM,aAAa,UAAU,SAAS,QAAQ,SAAS,SAAS;AAEhE,MAAI,eAAe,GAAG;AACpB,YAAQ,IAAI,wBAAwB;AACpC;AAAA,EACF;AAGA,MAAI,UAAU,SAAS,GAAG;AACxB,YAAQ,IAAI,gBAAgB;AAC5B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,WAAW;AAC7B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,UAAU,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAChE;AAAA,EACF;AAGA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ,IAAI,aAAa;AACzB,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,UAAU,SAAS;AAC5B,YAAM,MAAM,SAAS,KAAK,OAAO,QAAQ;AACzC,cAAQ,IAAI,8BAA8B,OAAO,WAAW,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IACjF;AAAA,EACF;AAGA,MAAI,SAAS,SAAS,GAAG;AACvB,YAAQ,IAAI,eAAe;AAC3B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,UAAU;AAC5B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,OAAO,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,UAAQ,IAAI;AAAA,WAAc,UAAU;AAAA,CAAc;AACpD;","names":[]}
+{"version":3,"sources":["../src/cli/commands/routes.ts"],"sourcesContent":["import { resolve, relative } from 'node:path'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { validateProjectStructure } from '../../core/validate-structure.js'\nimport { scanServerActions } from '../../server/scan/action-scan.js'\nimport { scanServerRoutes } from '../../server/scan/scan.js'\nimport { scanWebSocketRoutes } from '../../server/scan/ws-scan.js'\n\nexport async function routesCommand(): Promise<void> {\n  const cwd = process.cwd()\n  const config = await loadConfig(cwd)\n  validateProjectStructure(cwd)\n\n  const serverDir = resolve(cwd, config.serverDir)\n\n  const apiRoutes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const wsRoutes = scanWebSocketRoutes(serverDir)\n\n  const totalCount = apiRoutes.length + actions.length + wsRoutes.length\n\n  if (totalCount === 0) {\n    console.log('\\n  No routes found.\\n')\n    return\n  }\n\n  // API Routes\n  if (apiRoutes.length > 0) {\n    console.log('\\n  API Routes')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of apiRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  GET/POST  ${route.routePath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  // Actions\n  if (actions.length > 0) {\n    console.log('\\n  Actions')\n    console.log('  ' + '─'.repeat(60))\n    for (const action of actions) {\n      const rel = relative(cwd, action.filePath)\n      console.log(`  POST      /api/__actions/${action.actionPath.padEnd(18)} ${rel}`)\n    }\n  }\n\n  // WebSocket\n  if (wsRoutes.length > 0) {\n    console.log('\\n  WebSocket')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of wsRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  WS        ${route.wsPath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  console.log(`\\n  Total: ${totalCount} endpoints\\n`)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,gBAAgB;AAQlC,eAAsB,gBAA+B;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,WAAW,GAAG;AACnC,2BAAyB,GAAG;AAE5B,QAAM,YAAY,QAAQ,KAAK,OAAO,SAAS;AAE/C,QAAM,YAAY,iBAAiB,SAAS;AAC5C,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,WAAW,oBAAoB,SAAS;AAE9C,QAAM,aAAa,UAAU,SAAS,QAAQ,SAAS,SAAS;AAEhE,MAAI,eAAe,GAAG;AACpB,YAAQ,IAAI,wBAAwB;AACpC;AAAA,EACF;AAGA,MAAI,UAAU,SAAS,GAAG;AACxB,YAAQ,IAAI,gBAAgB;AAC5B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,WAAW;AAC7B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,UAAU,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAChE;AAAA,EACF;AAGA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ,IAAI,aAAa;AACzB,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,UAAU,SAAS;AAC5B,YAAM,MAAM,SAAS,KAAK,OAAO,QAAQ;AACzC,cAAQ,IAAI,8BAA8B,OAAO,WAAW,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IACjF;AAAA,EACF;AAGA,MAAI,SAAS,SAAS,GAAG;AACvB,YAAQ,IAAI,eAAe;AAC3B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,UAAU;AAC5B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,OAAO,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,UAAQ,IAAI;AAAA,WAAc,UAAU;AAAA,CAAc;AACpD;","names":[]}

package/dist/{schema-Cxq2qqwh.d.ts → schema-CjVly9c_.d.ts}

@@ -32,6 +32,48 @@ declare function createRateLimiter(config: RateLimitConfig, opts?: {
     store?: RateLimitStore;
 }): (req: IncomingMessage) => RateLimitResult;
 
+/**
+ * T2.2 — In-memory bounded counter for CSRF warn events.
+ *
+ * Aggregates `csrf.warn` payloads by `(method, path, reason)` triple.
+ * Used by the `/__theo/csrf-readiness` endpoint to expose a summary the
+ * developer (or devtools tab) can inspect, so users do NOT need to grep
+ * stdout to know which endpoints will break under 0.3.0 strict CSRF.
+ *
+ * Bounded at 1000 distinct keys (EC-22). Eviction is LRU-by-insertion —
+ * when the cap is hit, the oldest key is dropped and a re-record of an
+ * evicted key starts fresh (count: 1).
+ *
+ * Single-threaded by virtue of the JS event loop; Map operations are
+ * atomic. NOT shared across processes — each worker has its own store.
+ */
+interface CsrfWarnRecord {
+    method: string;
+    path: string;
+    reason: string;
+}
+interface CsrfReadinessRouteSummary {
+    method: string;
+    path: string;
+    reason: string;
+    count: number;
+    firstSeen: string;
+    lastSeen: string;
+}
+interface CsrfReadinessSummary {
+    generatedAt: string;
+    totalEvents: number;
+    routes: CsrfReadinessRouteSummary[];
+}
+declare class CsrfReadinessStore {
+    static readonly MAX_ENTRIES = 1000;
+    private readonly entries;
+    private keyFor;
+    record(event: CsrfWarnRecord): void;
+    summary(): CsrfReadinessSummary;
+    reset(): void;
+}
+
 /**
  * Wave 2 — Polyglot Services Orchestration (T1.1).
  *
@@ -229,4 +271,4 @@ declare const servicesConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.Zod
 type ServicesConfigInput = z.input<typeof servicesConfigSchema>;
 type ServicesConfigOutput = z.output<typeof servicesConfigSchema>;
 
-export { type RateLimitConfig as R, type ServicesConfig as S, type RateLimitResult as a, type ServiceDefinition as b, type ServicesConfigInput as c, type ServicesConfigOutput as d, createRateLimiter as e };
+export { CsrfReadinessStore as C, type RateLimitConfig as R, type ServicesConfig as S, type RateLimitResult as a, type CsrfReadinessRouteSummary as b, type CsrfReadinessSummary as c, type CsrfWarnRecord as d, type ServiceDefinition as e, type ServicesConfigInput as f, type ServicesConfigOutput as g, createRateLimiter as h };

package/dist/{schema-MVB2FVK6.js → schema-JAKF23GR.js}

@@ -11,7 +11,7 @@ import {
   storageSchema,
   theoConfigSchema,
   uploadSchema
-} from "./chunk-3Q36SEDK.js";
+} from "./chunk-ZBWROIIO.js";
 import "./chunk-WZ7CPVQB.js";
 import "./chunk-KT3MWNZG.js";
 export {
@@ -26,4 +26,4 @@ export {
   theoConfigSchema,
   uploadSchema
 };
-//# sourceMappingURL=schema-MVB2FVK6.js.map
+//# sourceMappingURL=schema-JAKF23GR.js.map

package/dist/server/cost/index.js

@@ -2,7 +2,7 @@ import {
   InMemoryUsageStorage,
   trackAgentRun,
   trackAgentTools
-} from "../../chunk-JBC7PFV4.js";
+} from "../../chunk-M23FP2AS.js";
 import "../../chunk-DGUM43GV.js";
 export {
   InMemoryUsageStorage,