theokit 0.2.4 → 0.4.0

package/dist/index.d.ts

@@ -1,502 +1,205 @@
 import { z } from 'zod';
+import { T as TheoErrorEnvelope } from './error-envelope-BsNzzAV5.js';
 export { theoPlugin } from './vite-plugin/index.js';
 import 'vite';
-import './schema-CjVly9c_.js';
+import './rate-limit-BdNDZ3vt.js';
 import 'node:http';
 import './rate-limit-store-BEJnhWdw.js';
+import './csrf-readiness-store-CjIoub3U.js';
+import './schema-D3v8VB7o.js';
 
-declare const theoConfigSchema: z.ZodEffects<z.ZodObject<{
+/**
+ * G5 T1.3 — formatError hook signature (blueprint ADR D3).
+ *
+ * Type-inferred functional transformer that runs at framework error-boundary
+ * time. Producer-side analog of trpc's `errorFormatter`. The return type is
+ * `TheoErrorEnvelope<TExt>` for arbitrary `TExt` so the inference flows into
+ * `@theo/client` codegen + UI consumers.
+ */
+interface FormatErrorContext {
+    readonly route?: string;
+    readonly action?: string;
+    readonly agentRunId?: string;
+}
+type FormatErrorHook = (envelope: TheoErrorEnvelope, ctx: FormatErrorContext) => TheoErrorEnvelope;
+
+/**
+ * Root `theo.config.ts` schema — composer assembled from the per-concern
+ * primitives re-exported above.
+ *
+ * Embedded blocks that exist ONLY as part of the root config (`agents`,
+ * `ui`, `devtools`, `jobs`, `openapi`) stay inline below. They have no
+ * external consumers; splitting them would create lonely files (M5
+ * smell) without comprehension benefit.
+ */
+declare const theoConfigSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
     appDir: z.ZodDefault<z.ZodString>;
     serverDir: z.ZodDefault<z.ZodString>;
-    /**
-     * T2.2 / EC-4 — Build output directory. Must be a relative path inside
-     * the project root. Refused absolute or parent-relative paths to prevent
-     * `cleanOutDir` from wiping arbitrary locations (defense-in-depth on
-     * top of cleanOutDir's runtime EC-3 guard).
-     */
-    distDir: z.ZodEffects<z.ZodDefault<z.ZodString>, string, string | undefined>;
-    /**
-     * Agent runtime configuration.
-     *
-     * - `maxRegistries` (T2.3, legacy): dev-mode cleanup of stale
-     *   `.theokit/agents/<id>/` dirs by mtime. Now superseded by SDK's
-     *   native registry GC but kept for backward-compat.
-     * - `registry` (Phase 6, Production-Readiness #2): forwarded to
-     *   `Agent.registry.configure()` lazily on first request.
-     *   * `maxAgents` — LRU cap. MUST be ≥ max-concurrent-active-conversations
-     *     (EC-17 DOCUMENT): with maxAgents:1 and 2 concurrent chats, LRU evicts
-     *     mid-stream → SDK aborts with code:'aborted'. Default 100 covers
-     *     indie/small-team; tune up for high-traffic.
-     *   * `idleTimeoutMs` — auto-evict idle agents (default 30 min). 0 disables
-     *     idle eviction (LRU only).
-     */
+    distDir: z.ZodDefault<z.ZodString>;
     agents: z.ZodOptional<z.ZodObject<{
         maxRegistries: z.ZodDefault<z.ZodNumber>;
         registry: z.ZodOptional<z.ZodObject<{
-            /** LRU cap — MUST be ≥ max-concurrent-active-conversations. */
             maxAgents: z.ZodDefault<z.ZodNumber>;
-            /** Idle eviction window in ms. 0 disables idle eviction (LRU only). */
             idleTimeoutMs: z.ZodDefault<z.ZodNumber>;
-        }, "strip", z.ZodTypeAny, {
-            maxAgents: number;
-            idleTimeoutMs: number;
-        }, {
-            maxAgents?: number | undefined;
-            idleTimeoutMs?: number | undefined;
-        }>>;
-    }, "strip", z.ZodTypeAny, {
-        maxRegistries: number;
-        registry?: {
-            maxAgents: number;
-            idleTimeoutMs: number;
-        } | undefined;
-    }, {
-        maxRegistries?: number | undefined;
-        registry?: {
-            maxAgents?: number | undefined;
-            idleTimeoutMs?: number | undefined;
-        } | undefined;
-    }>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     port: z.ZodDefault<z.ZodNumber>;
     ssr: z.ZodDefault<z.ZodBoolean>;
-    /** When true (and ssr === true), use renderToPipeableStream with progressive
-     * shell flush instead of single-shot renderToString. Opt-in for streaming
-     * SSR; default false preserves the current behavior. */
     ssrStreaming: z.ZodDefault<z.ZodBoolean>;
-    rateLimit: z.ZodOptional<z.ZodUnion<[z.ZodObject<{
+    rateLimit: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         windowMs: z.ZodNumber;
         max: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        windowMs: number;
-        max: number;
-    }, {
-        windowMs: number;
-        max: number;
-    }>, z.ZodObject<{
+    }, z.core.$strip>, z.ZodObject<{
         default: z.ZodOptional<z.ZodObject<{
             windowMs: z.ZodNumber;
             max: z.ZodNumber;
-        }, "strip", z.ZodTypeAny, {
-            windowMs: number;
-            max: number;
-        }, {
-            windowMs: number;
-            max: number;
-        }>>;
+        }, z.core.$strip>>;
         routes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             windowMs: z.ZodNumber;
             max: z.ZodNumber;
-        }, "strip", z.ZodTypeAny, {
-            windowMs: number;
-            max: number;
-        }, {
-            windowMs: number;
-            max: number;
-        }>>>;
-        keyBy: z.ZodOptional<z.ZodUnion<[z.ZodEnum<["ip", "session", "user"]>, z.ZodFunction<z.ZodTuple<[z.ZodUnknown], z.ZodUnknown>, z.ZodString>]>>;
+        }, z.core.$strip>>>;
+        keyBy: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            ip: "ip";
+            session: "session";
+            user: "user";
+        }>, z.ZodFunction<z.ZodTuple<[z.ZodUnknown], null>, z.ZodString>]>>;
         cookieName: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        default?: {
-            windowMs: number;
-            max: number;
-        } | undefined;
-        routes?: Record<string, {
-            windowMs: number;
-            max: number;
-        }> | undefined;
-        keyBy?: "ip" | "session" | "user" | ((args_0: unknown, ...args: unknown[]) => string) | undefined;
-        cookieName?: string | undefined;
-    }, {
-        default?: {
-            windowMs: number;
-            max: number;
-        } | undefined;
-        routes?: Record<string, {
-            windowMs: number;
-            max: number;
-        }> | undefined;
-        keyBy?: "ip" | "session" | "user" | ((args_0: unknown, ...args: unknown[]) => string) | undefined;
-        cookieName?: string | undefined;
-    }>]>>;
+    }, z.core.$strip>]>>;
     upload: z.ZodOptional<z.ZodObject<{
         maxFileSize: z.ZodDefault<z.ZodNumber>;
         maxFiles: z.ZodDefault<z.ZodNumber>;
         maxFieldSize: z.ZodDefault<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        maxFileSize: number;
-        maxFiles: number;
-        maxFieldSize: number;
-    }, {
-        maxFileSize?: number | undefined;
-        maxFiles?: number | undefined;
-        maxFieldSize?: number | undefined;
-    }>>;
+    }, z.core.$strip>>;
     logging: z.ZodOptional<z.ZodObject<{
-        level: z.ZodDefault<z.ZodEnum<["debug", "info", "warn", "error", "silent"]>>;
-    }, "strip", z.ZodTypeAny, {
-        level: "info" | "warn" | "error" | "debug" | "silent";
-    }, {
-        level?: "info" | "warn" | "error" | "debug" | "silent" | undefined;
-    }>>;
+        level: z.ZodDefault<z.ZodEnum<{
+            error: "error";
+            info: "info";
+            warn: "warn";
+            debug: "debug";
+            silent: "silent";
+        }>>;
+    }, z.core.$strip>>;
     security: z.ZodOptional<z.ZodObject<{
-        csrf: z.ZodDefault<z.ZodEnum<["off", "warn", "strict"]>>;
+        csrf: z.ZodDefault<z.ZodEnum<{
+            warn: "warn";
+            off: "off";
+            strict: "strict";
+        }>>;
         headers: z.ZodOptional<z.ZodObject<{
-            csp: z.ZodOptional<z.ZodUnion<[z.ZodEffects<z.ZodString, string, string>, z.ZodLiteral<false>]>>;
-            cspMode: z.ZodDefault<z.ZodEnum<["enforce", "report-only", "off"]>>;
-            hsts: z.ZodOptional<z.ZodUnion<[z.ZodEffects<z.ZodString, string, string>, z.ZodLiteral<false>]>>;
-            frameOptions: z.ZodDefault<z.ZodEnum<["DENY", "SAMEORIGIN"]>>;
+            csp: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<false>]>>;
+            cspMode: z.ZodDefault<z.ZodEnum<{
+                enforce: "enforce";
+                "report-only": "report-only";
+                off: "off";
+            }>>;
+            hsts: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<false>]>>;
+            frameOptions: z.ZodDefault<z.ZodEnum<{
+                DENY: "DENY";
+                SAMEORIGIN: "SAMEORIGIN";
+            }>>;
             contentTypeOptions: z.ZodDefault<z.ZodLiteral<"nosniff">>;
-            referrerPolicy: z.ZodDefault<z.ZodEffects<z.ZodString, string, string>>;
-            /**
-             * T1.1 — Permissions-Policy directive string. EC-3-refined: rejects CR/LF.
-             * Pass `false` to suppress the header.
-             */
-            permissionsPolicy: z.ZodOptional<z.ZodUnion<[z.ZodEffects<z.ZodString, string, string>, z.ZodLiteral<false>]>>;
-        }, "strip", z.ZodTypeAny, {
-            cspMode: "enforce" | "report-only" | "off";
-            frameOptions: "DENY" | "SAMEORIGIN";
-            contentTypeOptions: "nosniff";
-            referrerPolicy: string;
-            csp?: string | false | undefined;
-            hsts?: string | false | undefined;
-            permissionsPolicy?: string | false | undefined;
-        }, {
-            csp?: string | false | undefined;
-            cspMode?: "enforce" | "report-only" | "off" | undefined;
-            hsts?: string | false | undefined;
-            frameOptions?: "DENY" | "SAMEORIGIN" | undefined;
-            contentTypeOptions?: "nosniff" | undefined;
-            referrerPolicy?: string | undefined;
-            permissionsPolicy?: string | false | undefined;
-        }>>;
-        /** T5.1 — per-route escalation (Rails disallowed_warnings pattern). */
+            referrerPolicy: z.ZodDefault<z.ZodString>;
+            permissionsPolicy: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<false>]>>;
+        }, z.core.$strip>>;
         disallowed: z.ZodOptional<z.ZodObject<{
-            routes: z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodType<RegExp, z.ZodTypeDef, RegExp>]>, "many">;
-            behavior: z.ZodDefault<z.ZodEnum<["warn", "raise"]>>;
-        }, "strip", z.ZodTypeAny, {
-            routes: (string | RegExp)[];
-            behavior: "warn" | "raise";
-        }, {
-            routes: (string | RegExp)[];
-            behavior?: "warn" | "raise" | undefined;
-        }>>;
-        /** T1.2 — Cross-Origin Resource Sharing. Single global config; runs first in pipeline. */
-        cors: z.ZodOptional<z.ZodEffects<z.ZodObject<{
-            origins: z.ZodUnion<[z.ZodLiteral<"*">, z.ZodEffects<z.ZodString, string, string>, z.ZodType<RegExp, z.ZodTypeDef, RegExp>, z.ZodArray<z.ZodUnion<[z.ZodEffects<z.ZodString, string, string>, z.ZodType<RegExp, z.ZodTypeDef, RegExp>]>, "many">, z.ZodFunction<z.ZodTuple<[z.ZodString], z.ZodUnknown>, z.ZodBoolean>]>;
-            methods: z.ZodOptional<z.ZodArray<z.ZodEnum<["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"]>, "many">>;
-            allowedHeaders: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
-            exposedHeaders: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+            routes: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodCustom<RegExp, RegExp>]>>;
+            behavior: z.ZodDefault<z.ZodEnum<{
+                warn: "warn";
+                raise: "raise";
+            }>>;
+        }, z.core.$strip>>;
+        cors: z.ZodOptional<z.ZodObject<{
+            origins: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString, z.ZodCustom<RegExp, RegExp>, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodCustom<RegExp, RegExp>]>>, z.ZodFunction<z.ZodTuple<[z.ZodString], null>, z.ZodBoolean>]>;
+            methods: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                GET: "GET";
+                HEAD: "HEAD";
+                OPTIONS: "OPTIONS";
+                POST: "POST";
+                PUT: "PUT";
+                PATCH: "PATCH";
+                DELETE: "DELETE";
+            }>>>;
+            allowedHeaders: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            exposedHeaders: z.ZodOptional<z.ZodArray<z.ZodString>>;
             credentials: z.ZodDefault<z.ZodBoolean>;
             maxAge: z.ZodDefault<z.ZodNumber>;
-        }, "strip", z.ZodTypeAny, {
-            maxAge: number;
-            origins: string | RegExp | (string | RegExp)[] | ((args_0: string, ...args: unknown[]) => boolean);
-            credentials: boolean;
-            methods?: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE")[] | undefined;
-            allowedHeaders?: string[] | undefined;
-            exposedHeaders?: string[] | undefined;
-        }, {
-            origins: string | RegExp | (string | RegExp)[] | ((args_0: string, ...args: unknown[]) => boolean);
-            maxAge?: number | undefined;
-            methods?: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE")[] | undefined;
-            allowedHeaders?: string[] | undefined;
-            exposedHeaders?: string[] | undefined;
-            credentials?: boolean | undefined;
-        }>, {
-            maxAge: number;
-            origins: string | RegExp | (string | RegExp)[] | ((args_0: string, ...args: unknown[]) => boolean);
-            credentials: boolean;
-            methods?: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE")[] | undefined;
-            allowedHeaders?: string[] | undefined;
-            exposedHeaders?: string[] | undefined;
-        }, {
-            origins: string | RegExp | (string | RegExp)[] | ((args_0: string, ...args: unknown[]) => boolean);
-            maxAge?: number | undefined;
-            methods?: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE")[] | undefined;
-            allowedHeaders?: string[] | undefined;
-            exposedHeaders?: string[] | undefined;
-            credentials?: boolean | undefined;
-        }>>;
-    }, "strip", z.ZodTypeAny, {
-        csrf: "strict" | "warn" | "off";
-        cors?: {
-            maxAge: number;
-            origins: string | RegExp | (string | RegExp)[] | ((args_0: string, ...args: unknown[]) => boolean);
-            credentials: boolean;
-            methods?: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE")[] | undefined;
-            allowedHeaders?: string[] | undefined;
-            exposedHeaders?: string[] | undefined;
-        } | undefined;
-        headers?: {
-            cspMode: "enforce" | "report-only" | "off";
-            frameOptions: "DENY" | "SAMEORIGIN";
-            contentTypeOptions: "nosniff";
-            referrerPolicy: string;
-            csp?: string | false | undefined;
-            hsts?: string | false | undefined;
-            permissionsPolicy?: string | false | undefined;
-        } | undefined;
-        disallowed?: {
-            routes: (string | RegExp)[];
-            behavior: "warn" | "raise";
-        } | undefined;
-    }, {
-        cors?: {
-            origins: string | RegExp | (string | RegExp)[] | ((args_0: string, ...args: unknown[]) => boolean);
-            maxAge?: number | undefined;
-            methods?: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE")[] | undefined;
-            allowedHeaders?: string[] | undefined;
-            exposedHeaders?: string[] | undefined;
-            credentials?: boolean | undefined;
-        } | undefined;
-        headers?: {
-            csp?: string | false | undefined;
-            cspMode?: "enforce" | "report-only" | "off" | undefined;
-            hsts?: string | false | undefined;
-            frameOptions?: "DENY" | "SAMEORIGIN" | undefined;
-            contentTypeOptions?: "nosniff" | undefined;
-            referrerPolicy?: string | undefined;
-            permissionsPolicy?: string | false | undefined;
-        } | undefined;
-        csrf?: "strict" | "warn" | "off" | undefined;
-        disallowed?: {
-            routes: (string | RegExp)[];
-            behavior?: "warn" | "raise" | undefined;
-        } | undefined;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    serialization: z.ZodDefault<z.ZodEnum<{
+        json: "json";
+        superjson: "superjson";
     }>>;
-    serialization: z.ZodDefault<z.ZodEnum<["json", "superjson"]>>;
-    plugins: z.ZodOptional<z.ZodArray<z.ZodUnknown, "many">>;
-    /** Enable client-side batching of theoFetch calls and the
-     * /api/__theo_batch__ server endpoint. */
-    batching: z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodObject<{
+    plugins: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    batching: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
         max: z.ZodOptional<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        max?: number | undefined;
-    }, {
-        max?: number | undefined;
-    }>]>>;
-    /** T4.1 — Audit log. When `logger` is provided, framework events
-     * (csrf.warn, rate-limit.exceeded, session.rotated, csp.violation) are
-     * emitted to it. Default: noop. */
+    }, z.core.$strip>]>>;
     audit: z.ZodOptional<z.ZodObject<{
         logger: z.ZodOptional<z.ZodUnknown>;
-    }, "strip", z.ZodTypeAny, {
-        logger?: unknown;
-    }, {
-        logger?: unknown;
-    }>>;
-    /** TheoUI auto-wire (T2.1). `false` = opt-out; object = explicit theme/fonts;
-     * undefined = enabled when @theokit/ui is detected in node_modules. */
-    ui: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<false>, z.ZodObject<{
-        theme: z.ZodOptional<z.ZodEnum<["violet-forge", "noir", "paper"]>>;
-        fonts: z.ZodOptional<z.ZodEnum<["bundled", "cdn"]>>;
-    }, "strip", z.ZodTypeAny, {
-        theme?: "violet-forge" | "noir" | "paper" | undefined;
-        fonts?: "bundled" | "cdn" | undefined;
-    }, {
-        theme?: "violet-forge" | "noir" | "paper" | undefined;
-        fonts?: "bundled" | "cdn" | undefined;
-    }>]>>;
-    /**
-     * Cache subsystem (caching-and-revalidation-plan).
-     * Default `undefined` keeps caching disabled (backward compatible).
-     * Pass `cache: {}` to opt in with defaults.
-     */
+    }, z.core.$strip>>;
+    ui: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+        theme: z.ZodOptional<z.ZodEnum<{
+            "violet-forge": "violet-forge";
+            noir: "noir";
+            paper: "paper";
+        }>>;
+        fonts: z.ZodOptional<z.ZodEnum<{
+            bundled: "bundled";
+            cdn: "cdn";
+        }>>;
+    }, z.core.$strip>]>>;
     cache: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
-        /** 'memory' uses InMemoryCacheAdapter; otherwise pass a custom adapter instance. */
-        storage: z.ZodDefault<z.ZodUnion<[z.ZodLiteral<"memory">, z.ZodType<unknown, z.ZodTypeDef, unknown>]>>;
+        storage: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"memory">, z.ZodCustom<unknown, unknown>]>>;
         maxEntries: z.ZodDefault<z.ZodNumber>;
         defaults: z.ZodDefault<z.ZodObject<{
             maxAge: z.ZodDefault<z.ZodNumber>;
             swr: z.ZodOptional<z.ZodNumber>;
             cacheErrors: z.ZodDefault<z.ZodBoolean>;
-        }, "strip", z.ZodTypeAny, {
-            maxAge: number;
-            cacheErrors: boolean;
-            swr?: number | undefined;
-        }, {
-            maxAge?: number | undefined;
-            swr?: number | undefined;
-            cacheErrors?: boolean | undefined;
-        }>>;
+        }, z.core.$strip>>;
         keyDerivation: z.ZodDefault<z.ZodObject<{
-            excludeQuery: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            excludeQuery: z.ZodOptional<z.ZodArray<z.ZodString>>;
             sortQuery: z.ZodDefault<z.ZodBoolean>;
             lowercaseHost: z.ZodDefault<z.ZodBoolean>;
-        }, "strip", z.ZodTypeAny, {
-            sortQuery: boolean;
-            lowercaseHost: boolean;
-            excludeQuery?: string[] | undefined;
-        }, {
-            excludeQuery?: string[] | undefined;
-            sortQuery?: boolean | undefined;
-            lowercaseHost?: boolean | undefined;
-        }>>;
+        }, z.core.$strip>>;
         routeRules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             maxAge: z.ZodOptional<z.ZodNumber>;
             swr: z.ZodOptional<z.ZodNumber>;
-            tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        }, "strip", z.ZodTypeAny, {
-            maxAge?: number | undefined;
-            swr?: number | undefined;
-            tags?: string[] | undefined;
-        }, {
-            maxAge?: number | undefined;
-            swr?: number | undefined;
-            tags?: string[] | undefined;
-        }>>>;
-    }, "strip", z.ZodTypeAny, {
-        enabled: boolean;
-        maxEntries: number;
-        defaults: {
-            maxAge: number;
-            cacheErrors: boolean;
-            swr?: number | undefined;
-        };
-        keyDerivation: {
-            sortQuery: boolean;
-            lowercaseHost: boolean;
-            excludeQuery?: string[] | undefined;
-        };
-        storage?: unknown;
-        routeRules?: Record<string, {
-            maxAge?: number | undefined;
-            swr?: number | undefined;
-            tags?: string[] | undefined;
-        }> | undefined;
-    }, {
-        enabled?: boolean | undefined;
-        storage?: unknown;
-        maxEntries?: number | undefined;
-        defaults?: {
-            maxAge?: number | undefined;
-            swr?: number | undefined;
-            cacheErrors?: boolean | undefined;
-        } | undefined;
-        keyDerivation?: {
-            excludeQuery?: string[] | undefined;
-            sortQuery?: boolean | undefined;
-            lowercaseHost?: boolean | undefined;
-        } | undefined;
-        routeRules?: Record<string, {
-            maxAge?: number | undefined;
-            swr?: number | undefined;
-            tags?: string[] | undefined;
-        }> | undefined;
-    }>>;
-    /**
-     * Devtools overlay (Phase 0.4.0+ — see docs/plans/devtools-plan.md).
-     *
-     * - `undefined` (default): devtools auto-injects in `pnpm dev`, NEVER in `vite build`.
-     * - `false`: devtools disabled entirely (Vite plugin skips injection even in dev).
-     * - `{ ... }`: devtools enabled with explicit defaults (position, theme).
-     *
-     * Tree-shaken to noop in prod via the dual-export pattern in
-     * `packages/theo/src/devtools/index.ts` (EC-17 positive prod check).
-     */
-    devtools: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<false>, z.ZodObject<{
-        position: z.ZodOptional<z.ZodEnum<["top-left", "top-right", "bottom-left", "bottom-right"]>>;
-        theme: z.ZodOptional<z.ZodEnum<["light", "dark", "system"]>>;
-    }, "strip", z.ZodTypeAny, {
-        theme?: "light" | "dark" | "system" | undefined;
-        position?: "top-left" | "top-right" | "bottom-left" | "bottom-right" | undefined;
-    }, {
-        theme?: "light" | "dark" | "system" | undefined;
-        position?: "top-left" | "top-right" | "bottom-left" | "bottom-right" | undefined;
-    }>]>>;
-    /**
-     * Informative list of deploy adapters the app supports. Does NOT
-     * trigger per-build translations — only the `--target` CLI flag does
-     * (EC-201 / ADR D2). If `config.adapters` includes a target NOT
-     * matching `--target`, `theokit build` emits a cross-reference note.
-     */
-    adapters: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    /**
-     * Extra package names to pre-bundle via Vite's `optimizeDeps.include`.
-     *
-     * Framework auto-includes `@theokit/ui` and `lucide-react` when present.
-     * Apps adding plugin peer-deps that rely on a runtime `import('<pkg>')`
-     * (dynamic specifier) — e.g. `@theokit/plugin-canvas` consumers
-     * installing `mermaid` for Mermaid SVG rendering — must declare those
-     * here so Vite can resolve the literal in dev mode without
-     * "Failed to resolve module specifier" errors. Production builds use
-     * tsup/esbuild bundling and are not affected.
-     *
-     * Example:
-     *   viteOptimizeDeps: ['mermaid']
-     */
-    viteOptimizeDeps: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    /**
-     * Jobs backend (ADR D3 + T2.1). When configured, every request gets
-     * `ctx.queue.enqueue` auto-wired via the outbox lifecycle. Pass a
-     * `JobBackend` instance (InMemoryJobBackend, PostgresJobBackend, etc.).
-     */
+            tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    devtools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+        position: z.ZodOptional<z.ZodEnum<{
+            "top-left": "top-left";
+            "top-right": "top-right";
+            "bottom-left": "bottom-left";
+            "bottom-right": "bottom-right";
+        }>>;
+        theme: z.ZodOptional<z.ZodEnum<{
+            light: "light";
+            dark: "dark";
+            system: "system";
+        }>>;
+    }, z.core.$strip>]>>;
+    adapters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    viteOptimizeDeps: z.ZodOptional<z.ZodArray<z.ZodString>>;
     jobs: z.ZodOptional<z.ZodObject<{
-        backend: z.ZodType<unknown, z.ZodTypeDef, unknown>;
-    }, "strip", z.ZodTypeAny, {
-        backend?: unknown;
-    }, {
-        backend?: unknown;
-    }>>;
-    /**
-     * StorageManager configuration (T1.1 / ADR-0007).
-     *
-     * Declares Postgres servers + databases + Redis servers. Consumed by
-     * `getStorageManager().configure()` at boot via `start.ts`.
-     *
-     * Default `undefined` means manager exists but is not configured — adapters
-     * relying on the manager (PostgresJobBackend.fromStorageManager, etc.) will
-     * throw with an actionable error on first use.
-     */
+        backend: z.ZodCustom<unknown, unknown>;
+    }, z.core.$strip>>;
     storage: z.ZodOptional<z.ZodObject<{
         servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             host: z.ZodString;
             port: z.ZodOptional<z.ZodNumber>;
             user: z.ZodString;
-            /** Password may be the empty string (some providers permit it). */
             password: z.ZodString;
             tls: z.ZodOptional<z.ZodObject<{
                 rejectUnauthorized: z.ZodOptional<z.ZodBoolean>;
                 caCert: z.ZodOptional<z.ZodString>;
                 clientCert: z.ZodOptional<z.ZodString>;
                 clientKey: z.ZodOptional<z.ZodString>;
-            }, "strip", z.ZodTypeAny, {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            }, {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-        }, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-        }>>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>>;
         databases: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-            /** References a key in `storage.servers`. Resolved at `usePostgres()` call time. */
             server: z.ZodString;
             database: z.ZodString;
             pool: z.ZodOptional<z.ZodObject<{
@@ -504,172 +207,33 @@ declare const theoConfigSchema: z.ZodEffects<z.ZodObject<{
                 max: z.ZodOptional<z.ZodNumber>;
                 connectionTimeoutMillis: z.ZodOptional<z.ZodNumber>;
                 idleTimeoutMillis: z.ZodOptional<z.ZodNumber>;
-            }, "strip", z.ZodTypeAny, {
-                max?: number | undefined;
-                min?: number | undefined;
-                connectionTimeoutMillis?: number | undefined;
-                idleTimeoutMillis?: number | undefined;
-            }, {
-                max?: number | undefined;
-                min?: number | undefined;
-                connectionTimeoutMillis?: number | undefined;
-                idleTimeoutMillis?: number | undefined;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            server: string;
-            database: string;
-            pool?: {
-                max?: number | undefined;
-                min?: number | undefined;
-                connectionTimeoutMillis?: number | undefined;
-                idleTimeoutMillis?: number | undefined;
-            } | undefined;
-        }, {
-            server: string;
-            database: string;
-            pool?: {
-                max?: number | undefined;
-                min?: number | undefined;
-                connectionTimeoutMillis?: number | undefined;
-                idleTimeoutMillis?: number | undefined;
-            } | undefined;
-        }>>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>>;
         redis: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             host: z.ZodString;
             port: z.ZodOptional<z.ZodNumber>;
             user: z.ZodString;
-            /** Password may be the empty string (some providers permit it). */
             password: z.ZodString;
             tls: z.ZodOptional<z.ZodObject<{
                 rejectUnauthorized: z.ZodOptional<z.ZodBoolean>;
                 caCert: z.ZodOptional<z.ZodString>;
                 clientCert: z.ZodOptional<z.ZodString>;
                 clientKey: z.ZodOptional<z.ZodString>;
-            }, "strip", z.ZodTypeAny, {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            }, {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            }>>;
-        } & {
+            }, z.core.$strip>>;
             db: z.ZodOptional<z.ZodNumber>;
             maxRetriesPerRequest: z.ZodOptional<z.ZodNumber>;
-        }, "strip", z.ZodTypeAny, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-            db?: number | undefined;
-            maxRetriesPerRequest?: number | undefined;
-        }, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-            db?: number | undefined;
-            maxRetriesPerRequest?: number | undefined;
-        }>>>;
-    }, "strip", z.ZodTypeAny, {
-        redis?: Record<string, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-            db?: number | undefined;
-            maxRetriesPerRequest?: number | undefined;
-        }> | undefined;
-        servers?: Record<string, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-        }> | undefined;
-        databases?: Record<string, {
-            server: string;
-            database: string;
-            pool?: {
-                max?: number | undefined;
-                min?: number | undefined;
-                connectionTimeoutMillis?: number | undefined;
-                idleTimeoutMillis?: number | undefined;
-            } | undefined;
-        }> | undefined;
-    }, {
-        redis?: Record<string, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-            db?: number | undefined;
-            maxRetriesPerRequest?: number | undefined;
-        }> | undefined;
-        servers?: Record<string, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-        }> | undefined;
-        databases?: Record<string, {
-            server: string;
-            database: string;
-            pool?: {
-                max?: number | undefined;
-                min?: number | undefined;
-                connectionTimeoutMillis?: number | undefined;
-                idleTimeoutMillis?: number | undefined;
-            } | undefined;
-        }> | undefined;
-    }>>;
-    /**
-     * Wave 2 — Polyglot services orchestration (T1.1 / ADR-0012/0013/0014/0015).
-     *
-     * Declarative external sidecar processes (Python FastAPI / Node Hono)
-     * that boot alongside the TheoKit TS app. Empty `services: {}` is the
-     * default and preserves Wave 1 behavior.
-     */
-    services: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodDefault<z.ZodRecord<z.ZodEffects<z.ZodString, string, string>, z.ZodObject<{
-        runtime: z.ZodEnum<["python", "node"]>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    services: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        runtime: z.ZodEnum<{
+            python: "python";
+            node: "node";
+        }>;
+        type: z.ZodOptional<z.ZodEnum<{
+            server: "server";
+            worker: "worker";
+            frontend: "frontend";
+        }>>;
         port: z.ZodNumber;
         proxy: z.ZodString;
         dev: z.ZodString;
@@ -679,818 +243,24 @@ declare const theoConfigSchema: z.ZodEffects<z.ZodObject<{
         healthcheck: z.ZodDefault<z.ZodString>;
         cors: z.ZodDefault<z.ZodBoolean>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        dependsOn: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        dependsOn: z.ZodOptional<z.ZodArray<z.ZodString>>;
         passSetCookie: z.ZodDefault<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        runtime: "python" | "node";
-        port: number;
-        proxy: string;
-        dev: string;
-        start: string;
-        healthcheck: string;
-        cors: boolean;
-        passSetCookie: boolean;
-        build?: string | undefined;
-        openapi?: string | undefined;
-        env?: Record<string, string> | undefined;
-        dependsOn?: string[] | undefined;
-    }, {
-        runtime: "python" | "node";
-        port: number;
-        proxy: string;
-        dev: string;
-        start: string;
-        build?: string | undefined;
-        openapi?: string | undefined;
-        healthcheck?: string | undefined;
-        cors?: boolean | undefined;
-        env?: Record<string, string> | undefined;
-        dependsOn?: string[] | undefined;
-        passSetCookie?: boolean | undefined;
-    }>>>, Record<string, {
-        runtime: "python" | "node";
-        port: number;
-        proxy: string;
-        dev: string;
-        start: string;
-        healthcheck: string;
-        cors: boolean;
-        passSetCookie: boolean;
-        build?: string | undefined;
-        openapi?: string | undefined;
-        env?: Record<string, string> | undefined;
-        dependsOn?: string[] | undefined;
-    }>, Record<string, {
-        runtime: "python" | "node";
-        port: number;
-        proxy: string;
-        dev: string;
-        start: string;
-        build?: string | undefined;
-        openapi?: string | undefined;
-        healthcheck?: string | undefined;
-        cors?: boolean | undefined;
-        env?: Record<string, string> | undefined;
-        dependsOn?: string[] | undefined;
-        passSetCookie?: boolean | undefined;
-    }> | undefined>, Record<string, {
-        runtime: "python" | "node";
-        port: number;
-        proxy: string;
-        dev: string;
-        start: string;
-        healthcheck: string;
-        cors: boolean;
-        passSetCookie: boolean;
-        build?: string | undefined;
-        openapi?: string | undefined;
-        env?: Record<string, string> | undefined;
-        dependsOn?: string[] | undefined;
-    }>, Record<string, {
-        runtime: "python" | "node";
-        port: number;
-        proxy: string;
-        dev: string;
-        start: string;
-        build?: string | undefined;
-        openapi?: string | undefined;
-        healthcheck?: string | undefined;
-        cors?: boolean | undefined;
-        env?: Record<string, string> | undefined;
-        dependsOn?: string[] | undefined;
-        passSetCookie?: boolean | undefined;
-    }> | undefined>, Record<string, {
-        runtime: "python" | "node";
-        port: number;
-        proxy: string;
-        dev: string;
-        start: string;
-        healthcheck: string;
-        cors: boolean;
-        passSetCookie: boolean;
-        build?: string | undefined;
-        openapi?: string | undefined;
-        env?: Record<string, string> | undefined;
-        dependsOn?: string[] | undefined;
-    }>, Record<string, {
-        runtime: "python" | "node";
-        port: number;
-        proxy: string;
-        dev: string;
-        start: string;
-        build?: string | undefined;
-        openapi?: string | undefined;
-        healthcheck?: string | undefined;
-        cors?: boolean | undefined;
-        env?: Record<string, string> | undefined;
-        dependsOn?: string[] | undefined;
-        passSetCookie?: boolean | undefined;
-    }> | undefined>;
-    /**
-     * G2 — OpenAPI emit (build-time only).
-     *
-     * When present, `theokit build` writes a generated `openapi.json` from
-     * every `defineRoute()` body/query/params Zod schema. `undefined` keeps
-     * the framework backward-compatible (no emit). Pass `openapi: {}` to
-     * opt in with defaults.
-     *
-     * Defaults: spec 3.1.0 · servers `http://localhost:3000` · title
-     * "TheoKit App" · version "0.0.0" · outDir ".theo" (next to dist).
-     *
-     * The env var `THEOKIT_OPENAPI_SERVERS` (CSV of URLs) overrides
-     * `servers[].url` at emit time without rebuilding the config.
-     */
+    }, z.core.$strip>>>;
     openapi: z.ZodOptional<z.ZodObject<{
         servers: z.ZodDefault<z.ZodArray<z.ZodObject<{
             url: z.ZodString;
             description: z.ZodOptional<z.ZodString>;
-        }, "strip", z.ZodTypeAny, {
-            url: string;
-            description?: string | undefined;
-        }, {
-            url: string;
-            description?: string | undefined;
-        }>, "many">>;
-        specVersion: z.ZodDefault<z.ZodEnum<["3.1.0", "3.0.3"]>>;
+        }, z.core.$strip>>>;
+        specVersion: z.ZodDefault<z.ZodEnum<{
+            "3.1.0": "3.1.0";
+            "3.0.3": "3.0.3";
+        }>>;
         title: z.ZodDefault<z.ZodString>;
         version: z.ZodDefault<z.ZodString>;
         outDir: z.ZodDefault<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        version: string;
-        servers: {
-            url: string;
-            description?: string | undefined;
-        }[];
-        specVersion: "3.1.0" | "3.0.3";
-        title: string;
-        outDir: string;
-    }, {
-        version?: string | undefined;
-        servers?: {
-            url: string;
-            description?: string | undefined;
-        }[] | undefined;
-        specVersion?: "3.1.0" | "3.0.3" | undefined;
-        title?: string | undefined;
-        outDir?: string | undefined;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    port: number;
-    services: Record<string, {
-        runtime: "python" | "node";
-        port: number;
-        proxy: string;
-        dev: string;
-        start: string;
-        healthcheck: string;
-        cors: boolean;
-        passSetCookie: boolean;
-        build?: string | undefined;
-        openapi?: string | undefined;
-        env?: Record<string, string> | undefined;
-        dependsOn?: string[] | undefined;
-    }>;
-    appDir: string;
-    serverDir: string;
-    distDir: string;
-    ssr: boolean;
-    ssrStreaming: boolean;
-    serialization: "json" | "superjson";
-    openapi?: {
-        version: string;
-        servers: {
-            url: string;
-            description?: string | undefined;
-        }[];
-        specVersion: "3.1.0" | "3.0.3";
-        title: string;
-        outDir: string;
-    } | undefined;
-    storage?: {
-        redis?: Record<string, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-            db?: number | undefined;
-            maxRetriesPerRequest?: number | undefined;
-        }> | undefined;
-        servers?: Record<string, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-        }> | undefined;
-        databases?: Record<string, {
-            server: string;
-            database: string;
-            pool?: {
-                max?: number | undefined;
-                min?: number | undefined;
-                connectionTimeoutMillis?: number | undefined;
-                idleTimeoutMillis?: number | undefined;
-            } | undefined;
-        }> | undefined;
-    } | undefined;
-    agents?: {
-        maxRegistries: number;
-        registry?: {
-            maxAgents: number;
-            idleTimeoutMs: number;
-        } | undefined;
-    } | undefined;
-    rateLimit?: {
-        windowMs: number;
-        max: number;
-    } | {
-        default?: {
-            windowMs: number;
-            max: number;
-        } | undefined;
-        routes?: Record<string, {
-            windowMs: number;
-            max: number;
-        }> | undefined;
-        keyBy?: "ip" | "session" | "user" | ((args_0: unknown, ...args: unknown[]) => string) | undefined;
-        cookieName?: string | undefined;
-    } | undefined;
-    upload?: {
-        maxFileSize: number;
-        maxFiles: number;
-        maxFieldSize: number;
-    } | undefined;
-    logging?: {
-        level: "info" | "warn" | "error" | "debug" | "silent";
-    } | undefined;
-    security?: {
-        csrf: "strict" | "warn" | "off";
-        cors?: {
-            maxAge: number;
-            origins: string | RegExp | (string | RegExp)[] | ((args_0: string, ...args: unknown[]) => boolean);
-            credentials: boolean;
-            methods?: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE")[] | undefined;
-            allowedHeaders?: string[] | undefined;
-            exposedHeaders?: string[] | undefined;
-        } | undefined;
-        headers?: {
-            cspMode: "enforce" | "report-only" | "off";
-            frameOptions: "DENY" | "SAMEORIGIN";
-            contentTypeOptions: "nosniff";
-            referrerPolicy: string;
-            csp?: string | false | undefined;
-            hsts?: string | false | undefined;
-            permissionsPolicy?: string | false | undefined;
-        } | undefined;
-        disallowed?: {
-            routes: (string | RegExp)[];
-            behavior: "warn" | "raise";
-        } | undefined;
-    } | undefined;
-    plugins?: unknown[] | undefined;
-    batching?: boolean | {
-        max?: number | undefined;
-    } | undefined;
-    audit?: {
-        logger?: unknown;
-    } | undefined;
-    ui?: false | {
-        theme?: "violet-forge" | "noir" | "paper" | undefined;
-        fonts?: "bundled" | "cdn" | undefined;
-    } | undefined;
-    cache?: {
-        enabled: boolean;
-        maxEntries: number;
-        defaults: {
-            maxAge: number;
-            cacheErrors: boolean;
-            swr?: number | undefined;
-        };
-        keyDerivation: {
-            sortQuery: boolean;
-            lowercaseHost: boolean;
-            excludeQuery?: string[] | undefined;
-        };
-        storage?: unknown;
-        routeRules?: Record<string, {
-            maxAge?: number | undefined;
-            swr?: number | undefined;
-            tags?: string[] | undefined;
-        }> | undefined;
-    } | undefined;
-    devtools?: false | {
-        theme?: "light" | "dark" | "system" | undefined;
-        position?: "top-left" | "top-right" | "bottom-left" | "bottom-right" | undefined;
-    } | undefined;
-    adapters?: string[] | undefined;
-    viteOptimizeDeps?: string[] | undefined;
-    jobs?: {
-        backend?: unknown;
-    } | undefined;
-}, {
-    port?: number | undefined;
-    openapi?: {
-        version?: string | undefined;
-        servers?: {
-            url: string;
-            description?: string | undefined;
-        }[] | undefined;
-        specVersion?: "3.1.0" | "3.0.3" | undefined;
-        title?: string | undefined;
-        outDir?: string | undefined;
-    } | undefined;
-    services?: Record<string, {
-        runtime: "python" | "node";
-        port: number;
-        proxy: string;
-        dev: string;
-        start: string;
-        build?: string | undefined;
-        openapi?: string | undefined;
-        healthcheck?: string | undefined;
-        cors?: boolean | undefined;
-        env?: Record<string, string> | undefined;
-        dependsOn?: string[] | undefined;
-        passSetCookie?: boolean | undefined;
-    }> | undefined;
-    storage?: {
-        redis?: Record<string, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-            db?: number | undefined;
-            maxRetriesPerRequest?: number | undefined;
-        }> | undefined;
-        servers?: Record<string, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-        }> | undefined;
-        databases?: Record<string, {
-            server: string;
-            database: string;
-            pool?: {
-                max?: number | undefined;
-                min?: number | undefined;
-                connectionTimeoutMillis?: number | undefined;
-                idleTimeoutMillis?: number | undefined;
-            } | undefined;
-        }> | undefined;
-    } | undefined;
-    appDir?: string | undefined;
-    serverDir?: string | undefined;
-    distDir?: string | undefined;
-    agents?: {
-        maxRegistries?: number | undefined;
-        registry?: {
-            maxAgents?: number | undefined;
-            idleTimeoutMs?: number | undefined;
-        } | undefined;
-    } | undefined;
-    ssr?: boolean | undefined;
-    ssrStreaming?: boolean | undefined;
-    rateLimit?: {
-        windowMs: number;
-        max: number;
-    } | {
-        default?: {
-            windowMs: number;
-            max: number;
-        } | undefined;
-        routes?: Record<string, {
-            windowMs: number;
-            max: number;
-        }> | undefined;
-        keyBy?: "ip" | "session" | "user" | ((args_0: unknown, ...args: unknown[]) => string) | undefined;
-        cookieName?: string | undefined;
-    } | undefined;
-    upload?: {
-        maxFileSize?: number | undefined;
-        maxFiles?: number | undefined;
-        maxFieldSize?: number | undefined;
-    } | undefined;
-    logging?: {
-        level?: "info" | "warn" | "error" | "debug" | "silent" | undefined;
-    } | undefined;
-    security?: {
-        cors?: {
-            origins: string | RegExp | (string | RegExp)[] | ((args_0: string, ...args: unknown[]) => boolean);
-            maxAge?: number | undefined;
-            methods?: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE")[] | undefined;
-            allowedHeaders?: string[] | undefined;
-            exposedHeaders?: string[] | undefined;
-            credentials?: boolean | undefined;
-        } | undefined;
-        headers?: {
-            csp?: string | false | undefined;
-            cspMode?: "enforce" | "report-only" | "off" | undefined;
-            hsts?: string | false | undefined;
-            frameOptions?: "DENY" | "SAMEORIGIN" | undefined;
-            contentTypeOptions?: "nosniff" | undefined;
-            referrerPolicy?: string | undefined;
-            permissionsPolicy?: string | false | undefined;
-        } | undefined;
-        csrf?: "strict" | "warn" | "off" | undefined;
-        disallowed?: {
-            routes: (string | RegExp)[];
-            behavior?: "warn" | "raise" | undefined;
-        } | undefined;
-    } | undefined;
-    serialization?: "json" | "superjson" | undefined;
-    plugins?: unknown[] | undefined;
-    batching?: boolean | {
-        max?: number | undefined;
-    } | undefined;
-    audit?: {
-        logger?: unknown;
-    } | undefined;
-    ui?: false | {
-        theme?: "violet-forge" | "noir" | "paper" | undefined;
-        fonts?: "bundled" | "cdn" | undefined;
-    } | undefined;
-    cache?: {
-        enabled?: boolean | undefined;
-        storage?: unknown;
-        maxEntries?: number | undefined;
-        defaults?: {
-            maxAge?: number | undefined;
-            swr?: number | undefined;
-            cacheErrors?: boolean | undefined;
-        } | undefined;
-        keyDerivation?: {
-            excludeQuery?: string[] | undefined;
-            sortQuery?: boolean | undefined;
-            lowercaseHost?: boolean | undefined;
-        } | undefined;
-        routeRules?: Record<string, {
-            maxAge?: number | undefined;
-            swr?: number | undefined;
-            tags?: string[] | undefined;
-        }> | undefined;
-    } | undefined;
-    devtools?: false | {
-        theme?: "light" | "dark" | "system" | undefined;
-        position?: "top-left" | "top-right" | "bottom-left" | "bottom-right" | undefined;
-    } | undefined;
-    adapters?: string[] | undefined;
-    viteOptimizeDeps?: string[] | undefined;
-    jobs?: {
-        backend?: unknown;
-    } | undefined;
-}>, {
-    port: number;
-    services: Record<string, {
-        runtime: "python" | "node";
-        port: number;
-        proxy: string;
-        dev: string;
-        start: string;
-        healthcheck: string;
-        cors: boolean;
-        passSetCookie: boolean;
-        build?: string | undefined;
-        openapi?: string | undefined;
-        env?: Record<string, string> | undefined;
-        dependsOn?: string[] | undefined;
-    }>;
-    appDir: string;
-    serverDir: string;
-    distDir: string;
-    ssr: boolean;
-    ssrStreaming: boolean;
-    serialization: "json" | "superjson";
-    openapi?: {
-        version: string;
-        servers: {
-            url: string;
-            description?: string | undefined;
-        }[];
-        specVersion: "3.1.0" | "3.0.3";
-        title: string;
-        outDir: string;
-    } | undefined;
-    storage?: {
-        redis?: Record<string, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-            db?: number | undefined;
-            maxRetriesPerRequest?: number | undefined;
-        }> | undefined;
-        servers?: Record<string, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-        }> | undefined;
-        databases?: Record<string, {
-            server: string;
-            database: string;
-            pool?: {
-                max?: number | undefined;
-                min?: number | undefined;
-                connectionTimeoutMillis?: number | undefined;
-                idleTimeoutMillis?: number | undefined;
-            } | undefined;
-        }> | undefined;
-    } | undefined;
-    agents?: {
-        maxRegistries: number;
-        registry?: {
-            maxAgents: number;
-            idleTimeoutMs: number;
-        } | undefined;
-    } | undefined;
-    rateLimit?: {
-        windowMs: number;
-        max: number;
-    } | {
-        default?: {
-            windowMs: number;
-            max: number;
-        } | undefined;
-        routes?: Record<string, {
-            windowMs: number;
-            max: number;
-        }> | undefined;
-        keyBy?: "ip" | "session" | "user" | ((args_0: unknown, ...args: unknown[]) => string) | undefined;
-        cookieName?: string | undefined;
-    } | undefined;
-    upload?: {
-        maxFileSize: number;
-        maxFiles: number;
-        maxFieldSize: number;
-    } | undefined;
-    logging?: {
-        level: "info" | "warn" | "error" | "debug" | "silent";
-    } | undefined;
-    security?: {
-        csrf: "strict" | "warn" | "off";
-        cors?: {
-            maxAge: number;
-            origins: string | RegExp | (string | RegExp)[] | ((args_0: string, ...args: unknown[]) => boolean);
-            credentials: boolean;
-            methods?: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE")[] | undefined;
-            allowedHeaders?: string[] | undefined;
-            exposedHeaders?: string[] | undefined;
-        } | undefined;
-        headers?: {
-            cspMode: "enforce" | "report-only" | "off";
-            frameOptions: "DENY" | "SAMEORIGIN";
-            contentTypeOptions: "nosniff";
-            referrerPolicy: string;
-            csp?: string | false | undefined;
-            hsts?: string | false | undefined;
-            permissionsPolicy?: string | false | undefined;
-        } | undefined;
-        disallowed?: {
-            routes: (string | RegExp)[];
-            behavior: "warn" | "raise";
-        } | undefined;
-    } | undefined;
-    plugins?: unknown[] | undefined;
-    batching?: boolean | {
-        max?: number | undefined;
-    } | undefined;
-    audit?: {
-        logger?: unknown;
-    } | undefined;
-    ui?: false | {
-        theme?: "violet-forge" | "noir" | "paper" | undefined;
-        fonts?: "bundled" | "cdn" | undefined;
-    } | undefined;
-    cache?: {
-        enabled: boolean;
-        maxEntries: number;
-        defaults: {
-            maxAge: number;
-            cacheErrors: boolean;
-            swr?: number | undefined;
-        };
-        keyDerivation: {
-            sortQuery: boolean;
-            lowercaseHost: boolean;
-            excludeQuery?: string[] | undefined;
-        };
-        storage?: unknown;
-        routeRules?: Record<string, {
-            maxAge?: number | undefined;
-            swr?: number | undefined;
-            tags?: string[] | undefined;
-        }> | undefined;
-    } | undefined;
-    devtools?: false | {
-        theme?: "light" | "dark" | "system" | undefined;
-        position?: "top-left" | "top-right" | "bottom-left" | "bottom-right" | undefined;
-    } | undefined;
-    adapters?: string[] | undefined;
-    viteOptimizeDeps?: string[] | undefined;
-    jobs?: {
-        backend?: unknown;
-    } | undefined;
-}, {
-    port?: number | undefined;
-    openapi?: {
-        version?: string | undefined;
-        servers?: {
-            url: string;
-            description?: string | undefined;
-        }[] | undefined;
-        specVersion?: "3.1.0" | "3.0.3" | undefined;
-        title?: string | undefined;
-        outDir?: string | undefined;
-    } | undefined;
-    services?: Record<string, {
-        runtime: "python" | "node";
-        port: number;
-        proxy: string;
-        dev: string;
-        start: string;
-        build?: string | undefined;
-        openapi?: string | undefined;
-        healthcheck?: string | undefined;
-        cors?: boolean | undefined;
-        env?: Record<string, string> | undefined;
-        dependsOn?: string[] | undefined;
-        passSetCookie?: boolean | undefined;
-    }> | undefined;
-    storage?: {
-        redis?: Record<string, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-            db?: number | undefined;
-            maxRetriesPerRequest?: number | undefined;
-        }> | undefined;
-        servers?: Record<string, {
-            host: string;
-            user: string;
-            password: string;
-            port?: number | undefined;
-            tls?: {
-                rejectUnauthorized?: boolean | undefined;
-                caCert?: string | undefined;
-                clientCert?: string | undefined;
-                clientKey?: string | undefined;
-            } | undefined;
-        }> | undefined;
-        databases?: Record<string, {
-            server: string;
-            database: string;
-            pool?: {
-                max?: number | undefined;
-                min?: number | undefined;
-                connectionTimeoutMillis?: number | undefined;
-                idleTimeoutMillis?: number | undefined;
-            } | undefined;
-        }> | undefined;
-    } | undefined;
-    appDir?: string | undefined;
-    serverDir?: string | undefined;
-    distDir?: string | undefined;
-    agents?: {
-        maxRegistries?: number | undefined;
-        registry?: {
-            maxAgents?: number | undefined;
-            idleTimeoutMs?: number | undefined;
-        } | undefined;
-    } | undefined;
-    ssr?: boolean | undefined;
-    ssrStreaming?: boolean | undefined;
-    rateLimit?: {
-        windowMs: number;
-        max: number;
-    } | {
-        default?: {
-            windowMs: number;
-            max: number;
-        } | undefined;
-        routes?: Record<string, {
-            windowMs: number;
-            max: number;
-        }> | undefined;
-        keyBy?: "ip" | "session" | "user" | ((args_0: unknown, ...args: unknown[]) => string) | undefined;
-        cookieName?: string | undefined;
-    } | undefined;
-    upload?: {
-        maxFileSize?: number | undefined;
-        maxFiles?: number | undefined;
-        maxFieldSize?: number | undefined;
-    } | undefined;
-    logging?: {
-        level?: "info" | "warn" | "error" | "debug" | "silent" | undefined;
-    } | undefined;
-    security?: {
-        cors?: {
-            origins: string | RegExp | (string | RegExp)[] | ((args_0: string, ...args: unknown[]) => boolean);
-            maxAge?: number | undefined;
-            methods?: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE")[] | undefined;
-            allowedHeaders?: string[] | undefined;
-            exposedHeaders?: string[] | undefined;
-            credentials?: boolean | undefined;
-        } | undefined;
-        headers?: {
-            csp?: string | false | undefined;
-            cspMode?: "enforce" | "report-only" | "off" | undefined;
-            hsts?: string | false | undefined;
-            frameOptions?: "DENY" | "SAMEORIGIN" | undefined;
-            contentTypeOptions?: "nosniff" | undefined;
-            referrerPolicy?: string | undefined;
-            permissionsPolicy?: string | false | undefined;
-        } | undefined;
-        csrf?: "strict" | "warn" | "off" | undefined;
-        disallowed?: {
-            routes: (string | RegExp)[];
-            behavior?: "warn" | "raise" | undefined;
-        } | undefined;
-    } | undefined;
-    serialization?: "json" | "superjson" | undefined;
-    plugins?: unknown[] | undefined;
-    batching?: boolean | {
-        max?: number | undefined;
-    } | undefined;
-    audit?: {
-        logger?: unknown;
-    } | undefined;
-    ui?: false | {
-        theme?: "violet-forge" | "noir" | "paper" | undefined;
-        fonts?: "bundled" | "cdn" | undefined;
-    } | undefined;
-    cache?: {
-        enabled?: boolean | undefined;
-        storage?: unknown;
-        maxEntries?: number | undefined;
-        defaults?: {
-            maxAge?: number | undefined;
-            swr?: number | undefined;
-            cacheErrors?: boolean | undefined;
-        } | undefined;
-        keyDerivation?: {
-            excludeQuery?: string[] | undefined;
-            sortQuery?: boolean | undefined;
-            lowercaseHost?: boolean | undefined;
-        } | undefined;
-        routeRules?: Record<string, {
-            maxAge?: number | undefined;
-            swr?: number | undefined;
-            tags?: string[] | undefined;
-        }> | undefined;
-    } | undefined;
-    devtools?: false | {
-        theme?: "light" | "dark" | "system" | undefined;
-        position?: "top-left" | "top-right" | "bottom-left" | "bottom-right" | undefined;
-    } | undefined;
-    adapters?: string[] | undefined;
-    viteOptimizeDeps?: string[] | undefined;
-    jobs?: {
-        backend?: unknown;
-    } | undefined;
-}>;
+    }, z.core.$strip>>;
+    formatError: z.ZodOptional<z.ZodCustom<FormatErrorHook, FormatErrorHook>>;
+}, z.core.$strip>;
 type TheoConfig = z.infer<typeof theoConfigSchema>;
 
 /**