theokit 0.4.0-beta.0 → 0.4.0

package/dist/{chunk-JAAHOGKI.js → chunk-M2EY7KDR.js}

@@ -13,34 +13,244 @@ import {
   resolveTransformer,
   safeAudit,
   sendError
-} from "./chunk-TPCT3MXV.js";
+} from "./chunk-ABVITXFH.js";
 import {
   loadConfig
-} from "./chunk-XP7YXRHO.js";
+} from "./chunk-U6TPSW4L.js";
+import {
+  buildServicesProxyConfig
+} from "./chunk-27LWMYNK.js";
 import {
   broadcastToDevtools
 } from "./chunk-5ODOE6EF.js";
 import {
   isRouteFile,
   scanRoutes
-} from "./chunk-O7335ZGH.js";
-import {
-  buildServicesProxyConfig
-} from "./chunk-WZ7CPVQB.js";
+} from "./chunk-CG563V5M.js";
 import {
   matchRoute,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-OXIQI2XZ.js";
+} from "./chunk-VBZCVFSA.js";
 import {
   scanServerActions
-} from "./chunk-5OFPQK6N.js";
+} from "./chunk-COXLEZCN.js";
 
 // src/vite-plugin/index.ts
-import { existsSync as existsSync5 } from "fs";
-import { resolve as resolve4, basename, dirname as dirname4 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { resolve as resolve7, dirname as dirname4 } from "path";
 import { fileURLToPath } from "url";
 
+// src/vite-plugin/config-hook.ts
+import { existsSync } from "fs";
+import { resolve } from "path";
+function runConfigHook(ctx) {
+  const ext = existsSync(resolve(ctx.theoSrcDir, "index.ts")) ? ".ts" : ".js";
+  const warmupClientFiles = [];
+  for (const candidate of ["app/layout.tsx", "app/page.tsx", "app/page.jsx"]) {
+    const full = resolve(ctx.projectRoot, candidate);
+    if (existsSync(full)) warmupClientFiles.push(`./${candidate}`);
+  }
+  const servicesProxy = ctx.services && Object.keys(ctx.services).length > 0 ? buildServicesProxyConfig(ctx.services) : void 0;
+  return {
+    envPrefix: "THEO_PUBLIC_",
+    optimizeDeps: {
+      ...ctx.optimizeDepsInclude.length > 0 ? { include: ctx.optimizeDepsInclude } : {},
+      force: true
+    },
+    server: {
+      ...warmupClientFiles.length > 0 ? { warmup: { clientFiles: warmupClientFiles } } : {},
+      ...servicesProxy !== void 0 ? { proxy: servicesProxy } : {},
+      // Skip watching gitignored heavy dirs to avoid hitting ENOSPC
+      // (inotify watcher exhaustion).
+      watch: {
+        ignored: [
+          "**/referencias/**",
+          "**/.theokit/**",
+          "**/.theo/**",
+          "**/dist/**",
+          "**/node_modules/**"
+        ]
+      }
+    },
+    resolve: {
+      alias: [
+        // Order matters: most-specific first so `theokit/X` doesn't
+        // get matched by the bare `theokit` alias.
+        { find: "theokit/server", replacement: resolve(ctx.theoSrcDir, `server/index${ext}`) },
+        { find: "theokit/client", replacement: resolve(ctx.theoSrcDir, `client/index${ext}`) },
+        {
+          // T2.1 (M5 lonely folders) moved the source from
+          // `react-query/index.ts` into `client/react-query.ts` (sibling of
+          // `client/index.ts`). The package.json export `./react-query`
+          // still points at the build artifact `./dist/react-query/index.{js,d.ts}`,
+          // but the dev-time source alias must follow the new location.
+          find: "theokit/react-query",
+          replacement: resolve(ctx.theoSrcDir, `client/react-query${ext}`)
+        },
+        {
+          find: "theokit/vite-plugin",
+          replacement: resolve(ctx.theoSrcDir, `vite-plugin/index${ext}`)
+        },
+        {
+          find: "theokit/adapters/web-shim",
+          replacement: resolve(ctx.theoSrcDir, `adapters/web-shim${ext}`)
+        },
+        {
+          find: "theokit/adapters/ws-shim",
+          replacement: resolve(ctx.theoSrcDir, `adapters/ws-shim${ext}`)
+        },
+        // T1.2 — devtools entry (DEV only; tree-shaken in build).
+        // Source layout: src/devtools/dom/entry.tsx (has /dom/ segment)
+        // Dist layout:   dist/devtools/entry.js    (tsup flattens /dom/)
+        {
+          find: "theokit/devtools/entry",
+          replacement: resolve(
+            ctx.theoSrcDir,
+            ext === ".ts" ? "devtools/dom/entry.tsx" : "devtools/entry.js"
+          )
+        },
+        { find: "theokit", replacement: resolve(ctx.theoSrcDir, `index${ext}`) }
+      ]
+    }
+  };
+}
+
+// src/vite-plugin/theoui-detect.ts
+import { existsSync as existsSync2, readFileSync } from "fs";
+import { dirname, join } from "path";
+function resolveTheoUiConfig(raw) {
+  return {
+    theme: raw?.theme ?? "violet-forge",
+    fonts: raw?.fonts ?? "bundled"
+  };
+}
+function resolveExportSubpath(pkgRoot, subpath) {
+  const pkgJsonPath = join(pkgRoot, "package.json");
+  if (!existsSync2(pkgJsonPath)) return null;
+  try {
+    const pkg = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
+    const exportKey = `./${subpath}`;
+    const exp = pkg.exports?.[exportKey];
+    if (!exp) {
+      const fallback = join(pkgRoot, "dist", subpath);
+      return existsSync2(fallback) ? fallback : null;
+    }
+    let target;
+    if (typeof exp === "string") target = exp;
+    else if (typeof exp === "object") {
+      const e = exp;
+      target = e.import ?? e.default;
+    }
+    if (!target) return null;
+    const cleaned = target.replace(/^\.\//, "");
+    const candidate = join(pkgRoot, cleaned);
+    return existsSync2(candidate) ? candidate : null;
+  } catch {
+    return null;
+  }
+}
+var defaultResolver = (specifier, projectRoot) => {
+  const parts = specifier.split("/");
+  const pkgName = parts[0]?.startsWith("@") && parts.length >= 2 ? `${parts[0]}/${parts[1]}` : parts[0];
+  if (!pkgName) return false;
+  const subpath = specifier.slice(pkgName.length + 1);
+  if (!subpath) return false;
+  let dir = projectRoot;
+  for (let depth = 0; depth < 10; depth++) {
+    const pkgRoot = join(dir, "node_modules", ...pkgName.split("/"));
+    if (existsSync2(pkgRoot)) {
+      const resolved = resolveExportSubpath(pkgRoot, subpath);
+      if (resolved) return true;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return false;
+};
+function isDeclaredInPackageJson(projectRoot) {
+  try {
+    const raw = readFileSync(join(projectRoot, "package.json"), "utf-8");
+    const pkg = JSON.parse(raw);
+    return Boolean(
+      pkg.dependencies?.["@theokit/ui"] ?? pkg.devDependencies?.["@theokit/ui"] ?? pkg.peerDependencies?.["@theokit/ui"]
+    );
+  } catch {
+    return false;
+  }
+}
+function detectTheoUi(projectRoot, rawConfig, resolver = defaultResolver) {
+  const config = resolveTheoUiConfig(typeof rawConfig === "object" ? rawConfig : void 0);
+  if (rawConfig === false) {
+    return { enabled: false, config };
+  }
+  if (!isDeclaredInPackageJson(projectRoot)) {
+    return { enabled: false, config };
+  }
+  const probes = ["@theokit/ui/styles.css", "@theokit/ui/fonts.css"];
+  for (const probe of probes) {
+    if (resolver(probe, projectRoot)) {
+      return { enabled: true, config };
+    }
+  }
+  return { enabled: false, config };
+}
+
+// src/vite-plugin/config-resolve.ts
+var DEFAULT_RESOLVED = {
+  pluginRunner: void 0,
+  transformer: void 0,
+  resolvedBatching: void 0,
+  theoUi: void 0,
+  csrfMode: "strict",
+  securityHeaders: void 0,
+  disallowed: void 0,
+  cors: void 0,
+  auditLogger: void 0,
+  devtoolsEnabled: true,
+  openapi: void 0,
+  distDir: ".theo"
+};
+async function resolvePluginConfig(projectRoot) {
+  try {
+    const userConfig = await loadConfig(projectRoot);
+    const pluginRunner = await createPluginRunnerFromConfig(userConfig.plugins);
+    const transformer = resolveTransformer(userConfig.serialization);
+    let resolvedBatching;
+    if (userConfig.batching === true) {
+      resolvedBatching = {};
+    } else if (typeof userConfig.batching === "object") {
+      resolvedBatching = userConfig.batching;
+    }
+    const theoUi = detectTheoUi(projectRoot, userConfig.ui);
+    let auditLogger;
+    const maybeLogger = userConfig.audit?.logger;
+    if (maybeLogger && typeof maybeLogger.log === "function") {
+      auditLogger = maybeLogger;
+    }
+    return {
+      pluginRunner,
+      transformer,
+      resolvedBatching,
+      theoUi,
+      csrfMode: userConfig.security?.csrf ?? "strict",
+      securityHeaders: userConfig.security?.headers,
+      disallowed: userConfig.security?.disallowed,
+      cors: userConfig.security?.cors,
+      auditLogger,
+      devtoolsEnabled: userConfig.devtools !== false,
+      openapi: userConfig.openapi,
+      distDir: userConfig.distDir
+    };
+  } catch {
+    return DEFAULT_RESOLVED;
+  }
+}
+
+// src/vite-plugin/configure-server-hook.ts
+import { resolve as resolve4, basename } from "path";
+
 // src/devtools/server-side/route-manifest.ts
 function buildPath(parents, segment) {
   const joined = [...parents, segment].filter(Boolean).join("/");
@@ -75,422 +285,27 @@ function broadcastRouteManifest(tree) {
   broadcastToDevtools("theo:devtools:manifest", manifest);
 }
 
-// src/router/entry-server.ts
-function generateEntryServer(options = {}) {
-  if (options.streaming) {
-    return generateStreamingEntry(options);
+// src/server/security/csrf-readiness-store.ts
+var CsrfReadinessStore = class _CsrfReadinessStore {
+  static MAX_ENTRIES = 1e3;
+  entries = /* @__PURE__ */ new Map();
+  keyFor(event) {
+    return `${event.method}\0${event.path}\0${event.reason}`;
   }
-  return generateSingleShotEntry(options);
-}
-function buildAppTreeJs(options) {
-  const theme = options.theoUi?.theme ?? "violet-forge";
-  if (options.theoUi) {
-    return [
-      `React.createElement(TheoUIProvider, { theme: { defaultTheme: '${theme}' } },`,
-      `      React.createElement(Suspense, { fallback: null },`,
-      `        React.createElement(StaticRouterProvider, { router, context, hydrate: false })`,
-      `      )`,
-      `    )`
-    ].join("\n");
-  }
-  return `React.createElement(Suspense, { fallback: null },
-      React.createElement(StaticRouterProvider, { router, context, hydrate: false })
-    )`;
-}
-function hydrationDataExtractSnippet() {
-  return [
-    `    const hydrationData = {`,
-    `      loaderData: context.loaderData,`,
-    `      actionData: context.actionData,`,
-    `      errors: context.errors,`,
-    `    }`
-  ].join("\n");
-}
-function generateSingleShotEntry(options) {
-  const theoUiImport = options.theoUi ? `import { TheoUIProvider } from '@theokit/ui'
-` : "";
-  const appTree = buildAppTreeJs(options);
-  return [
-    `import React, { Suspense } from 'react'`,
-    `import { renderToPipeableStream } from 'react-dom/server'`,
-    `import { createStaticHandler, createStaticRouter, StaticRouterProvider } from 'react-router'`,
-    `import { PassThrough } from 'node:stream'`,
-    `import { routes } from '/@theo/route-manifest'`,
-    theoUiImport,
-    `export async function render(url, options = {}) {`,
-    `  const handler = createStaticHandler(routes)`,
-    `  const request = new Request('http://localhost' + url)`,
-    `  const context = await handler.query(request)`,
-    ``,
-    `  if (context instanceof Response) {`,
-    `    return { redirect: context }`,
-    `  }`,
-    ``,
-    `  const router = createStaticRouter(handler.dataRoutes, context)`,
-    `  const app = ${appTree}`,
-    ``,
-    hydrationDataExtractSnippet(),
-    ``,
-    `  return new Promise((resolve, reject) => {`,
-    `    let html = ''`,
-    `    let piped = false`,
-    `    const passthrough = new PassThrough()`,
-    `    passthrough.on('data', (chunk) => { html += chunk.toString() })`,
-    `    passthrough.on('end', () => { resolve({ html, hydrationData }) })`,
-    `    passthrough.on('error', reject)`,
-    ``,
-    `    // Pipe on onShellReady (Next.js pattern). Calling pipe() twice`,
-    `    // throws "React currently only supports piping to one writable`,
-    `    // stream". The \`piped\` flag is a belt-and-suspenders guard if`,
-    `    // onShellReady fires unexpectedly more than once.`,
-    `    // Forward options.nonce to React so every <script> tag React`,
-    `    // emits (Suspense boundary scripts) carries the nonce attribute.`,
-    `    const { pipe } = renderToPipeableStream(app, {`,
-    `      nonce: options.nonce,`,
-    `      onShellReady() { if (!piped) { piped = true; pipe(passthrough) } },`,
-    `      onShellError(err) { reject(err) },`,
-    `      onError(err) { console.error('[SSR Error]', err) },`,
-    `    })`,
-    `  })`,
-    `}`
-  ].join("\n");
-}
-function streamingWebRenderer(appTree) {
-  return [
-    `// T2.3 \u2014 Web Standards streaming entry for edge runtimes (Cloudflare,`,
-    `// Bun, Deno, Vercel Edge). Uses renderToReadableStream and returns a`,
-    `// Response with the stream as body. Honors request.signal for client`,
-    `// disconnect cleanup.`,
-    `export async function renderStreamingWeb(request, options = {}) {`,
-    `  const handler = createStaticHandler(routes)`,
-    `  const url = new URL(request.url)`,
-    `  const context = await handler.query(request)`,
-    ``,
-    `  if (context instanceof Response) {`,
-    `    return context`,
-    `  }`,
-    ``,
-    `  const router = createStaticRouter(handler.dataRoutes, context)`,
-    `  const app = ${appTree}`,
-    ``,
-    `  const stream = await renderToReadableStream(app, {`,
-    `    signal: request.signal,`,
-    `    nonce: options.nonce,`,
-    `    onError(err) { console.error('[SSR Web Stream Error]', err) },`,
-    `  })`,
-    `  return new Response(stream, {`,
-    `    status: 200,`,
-    `    headers: {`,
-    `      'Content-Type': 'text/html; charset=utf-8',`,
-    `      'Transfer-Encoding': 'chunked',`,
-    `    },`,
-    `  })`,
-    `}`
-  ];
-}
-function streamingNodeRenderer(appTree) {
-  return [
-    `// T6.1 \u2014 Node streaming SSR entry (opt-in via theo.config.ts > ssrStreaming: true)`,
-    `// Flushes the shell as soon as it's ready, then streams Suspense boundaries.`,
-    `// EC-11: respects request.signal for client-disconnect cleanup.`,
-    `export async function renderStreaming(url, response, options = {}) {`,
-    `  const handler = createStaticHandler(routes)`,
-    `  const request = new Request('http://localhost' + url, { signal: options.signal })`,
-    `  const context = await handler.query(request)`,
-    ``,
-    `  if (context instanceof Response) {`,
-    `    return { redirect: context }`,
-    `  }`,
-    ``,
-    `  const router = createStaticRouter(handler.dataRoutes, context)`,
-    `  const app = ${appTree}`,
-    ``,
-    `  return new Promise((resolve, reject) => {`,
-    `    let didError = false`,
-    `    const stream = renderToPipeableStream(app, {`,
-    `      nonce: options.nonce,`,
-    `      onShellReady() {`,
-    `        response.statusCode = didError ? 500 : 200`,
-    `        response.setHeader('Content-Type', 'text/html; charset=utf-8')`,
-    `        response.setHeader('Transfer-Encoding', 'chunked')`,
-    `        stream.pipe(response)`,
-    `        resolve({ streaming: true })`,
-    `      },`,
-    `      onShellError(err) { reject(err) },`,
-    `      onError(err) {`,
-    `        didError = true`,
-    `        console.error('[SSR Stream Error]', err)`,
-    `      },`,
-    `    })`,
-    ``,
-    `    // EC-11: client disconnect cleanup`,
-    `    if (options.signal) {`,
-    `      options.signal.addEventListener('abort', () => { stream.abort() })`,
-    `    }`,
-    `  })`,
-    `}`
-  ];
-}
-function backCompatRenderer(appTree) {
-  return [
-    `// Backward compatibility: keep the single-shot render export available so`,
-    `// callers that always used 'render()' don't break when streaming is on.`,
-    `export async function render(url, options = {}) {`,
-    `  const handler = createStaticHandler(routes)`,
-    `  const request = new Request('http://localhost' + url)`,
-    `  const context = await handler.query(request)`,
-    ``,
-    `  if (context instanceof Response) {`,
-    `    return { redirect: context }`,
-    `  }`,
-    ``,
-    `  const router = createStaticRouter(handler.dataRoutes, context)`,
-    `  const app = ${appTree}`,
-    ``,
-    hydrationDataExtractSnippet(),
-    ``,
-    `  const { PassThrough } = await import('node:stream')`,
-    `  return new Promise((resolve, reject) => {`,
-    `    let html = ''`,
-    `    let piped = false`,
-    `    const passthrough = new PassThrough()`,
-    `    passthrough.on('data', (chunk) => { html += chunk.toString() })`,
-    `    passthrough.on('end', () => { resolve({ html, hydrationData }) })`,
-    `    passthrough.on('error', reject)`,
-    ``,
-    `    // Pipe on onShellReady (Next.js pattern). nonce forwarded.`,
-    `    const { pipe } = renderToPipeableStream(app, {`,
-    `      nonce: options.nonce,`,
-    `      onShellReady() { if (!piped) { piped = true; pipe(passthrough) } },`,
-    `      onShellError(err) { reject(err) },`,
-    `      onError(err) { console.error('[SSR Error]', err) },`,
-    `    })`,
-    `  })`,
-    `}`
-  ];
-}
-function generateStreamingEntry(options) {
-  const theoUiImport = options.theoUi ? `import { TheoUIProvider } from '@theokit/ui'
-` : "";
-  const appTree = buildAppTreeJs(options);
-  return [
-    `import React, { Suspense } from 'react'`,
-    `import { renderToPipeableStream, renderToReadableStream } from 'react-dom/server'`,
-    `import { createStaticHandler, createStaticRouter, StaticRouterProvider } from 'react-router'`,
-    `import { routes } from '/@theo/route-manifest'`,
-    theoUiImport,
-    ``,
-    ...streamingWebRenderer(appTree),
-    ``,
-    ...streamingNodeRenderer(appTree),
-    ``,
-    ...backCompatRenderer(appTree)
-  ].join("\n");
-}
-
-// src/router/entry.ts
-function generateEntryClient(ssr, opts = {}) {
-  const rootMethod = ssr ? "hydrateRoot" : "createRoot";
-  const theoUiImports = [];
-  if (opts.theoUi) {
-    theoUiImports.push(
-      `// T2.2 \u2014 TheoUI CSS auto-injected (config.ui)`,
-      `import '@theokit/ui/styles.css'`
-    );
-    const fontsModule = opts.theoUi.fonts === "cdn" ? "fonts-cdn.css" : "fonts.css";
-    theoUiImports.push(
-      `import '@theokit/ui/${fontsModule}'`,
-      `// T2.3 \u2014 TheoUIProvider auto-wraps RouterProvider`,
-      `import { TheoUIProvider } from '@theokit/ui'`
-    );
-  }
-  const theme = opts.theoUi?.theme ?? "violet-forge";
-  const routerTree = opts.theoUi ? `React.createElement(TheoUIProvider, { theme: { defaultTheme: '${theme}' } },
-      React.createElement(Suspense, { fallback: null },
-        React.createElement(RouterProvider, { router })
-      )
-    )` : `React.createElement(Suspense, { fallback: null },
-      React.createElement(RouterProvider, { router })
-    )`;
-  const renderCall = ssr ? `  ${rootMethod}(el,
-    ${routerTree}
-  )` : `  ${rootMethod}(el).render(
-    ${routerTree}
-  )`;
-  const hydrationLine = ssr ? `const router = createBrowserRouter(routes, { hydrationData: window.__staticRouterHydrationData })` : `const router = createBrowserRouter(routes)`;
-  const preloadBlock = ssr ? [
-    `// Phase 4 \u2014 preload matched-route modules before hydrate (EC-3 safeguard)`,
-    `const __theoMatches = matchRoutes(routes, window.location.pathname) ?? []`,
-    `const __theoPreloadPaths = __theoMatches`,
-    `  .map((m) => m.route && (m.route).path)`,
-    `  .filter((p) => typeof p === 'string' && p in __theoPreloadMap)`,
-    `const __theoPreloadPromise = Promise.all(`,
-    `  __theoPreloadPaths.map((p) => __theoPreloadMap[p]().catch((err) => { console.error('[theo] preload failed', p, err); return null }))`,
-    `)`,
-    `const __theoTimeout = new Promise((resolve) => setTimeout(() => resolve('timeout'), 1500))`,
-    `await Promise.race([__theoPreloadPromise, __theoTimeout])`,
-    ""
-  ] : [];
-  const renderBlock = ssr ? [
-    `if (el) {`,
-    `  ;(async () => {`,
-    ...preloadBlock.map((l) => "    " + l),
-    renderCall,
-    `  })()`,
-    `}`
-  ] : [`if (el) {`, renderCall, `}`];
-  const manifestImports = ssr ? `import { routes, __theoPreloadMap } from '/@theo/route-manifest'` : `import { routes } from '/@theo/route-manifest'`;
-  const reactRouterImports = ssr ? `import { createBrowserRouter, RouterProvider, matchRoutes } from 'react-router'` : `import { createBrowserRouter, RouterProvider } from 'react-router'`;
-  return [
-    `import React, { Suspense } from 'react'`,
-    `import { ${rootMethod} } from 'react-dom/client'`,
-    reactRouterImports,
-    manifestImports,
-    `// T1.3 \u2014 side-effect import sets globalThis.__THEO_TRANSFORMER__ for theoFetch`,
-    `import '/@theo/runtime-config'`,
-    ...theoUiImports,
-    ``,
-    hydrationLine,
-    `const el = document.getElementById('root')`,
-    ...renderBlock
-  ].join("\n");
-}
-
-// src/router/generate.ts
-function normalizePath(p) {
-  return p.replace(/\\/g, "/");
-}
-function safeVarName(segment, prefix) {
-  const safe = segment.replace(/[^a-zA-Z0-9]/g, "_") || "root";
-  return `${prefix}_${safe}`;
-}
-function buildRoutePath(parents, segment) {
-  const joined = [...parents, segment].filter(Boolean).join("/");
-  return "/" + joined;
-}
-function pushIf(staticImports, filePath, varName) {
-  if (filePath !== void 0) {
-    staticImports.push({ varName, importPath: normalizePath(filePath) });
-  }
-}
-function walkRouteTree(node, parents, acc) {
-  const seg = node.segment || "root";
-  const routePath = buildRoutePath(parents, node.segment);
-  if (node.page !== void 0) {
-    acc.lazyPages.push({
-      varName: safeVarName(seg, "Page"),
-      importPath: normalizePath(node.page),
-      routePath
-    });
-  }
-  if (node.layout !== void 0) acc.layoutState.found = true;
-  pushIf(acc.staticImports, node.layout, safeVarName(seg, "Layout"));
-  pushIf(acc.staticImports, node.error, safeVarName(seg, "Error"));
-  pushIf(acc.staticImports, node.loading, safeVarName(seg, "Loading"));
-  pushIf(acc.staticImports, node.notFound, safeVarName(seg, "NotFound"));
-  for (const child of node.children) {
-    const nextParents = node.segment ? [...parents, node.segment] : parents;
-    walkRouteTree(child, nextParents, acc);
-  }
-}
-function generateRouteManifest(tree) {
-  const acc = {
-    staticImports: [],
-    lazyPages: [],
-    layoutState: { found: false }
-  };
-  walkRouteTree(tree, [], acc);
-  const staticImports = acc.staticImports;
-  const lazyPages = acc.lazyPages;
-  const layoutState = acc.layoutState;
-  const lines = [`import React, { Suspense } from 'react'`];
-  if (layoutState.found) {
-    lines.push(`import { Outlet } from 'react-router'`);
-  }
-  lines.push("");
-  for (const imp of staticImports) {
-    lines.push(`import ${imp.varName} from '${imp.importPath}'`);
-  }
-  for (const lp of lazyPages) {
-    lines.push(`const ${lp.varName} = React.lazy(() => import('${lp.importPath}'))`);
-  }
-  lines.push("");
-  const preloadEntries = lazyPages.map(
-    (lp) => `  '${lp.routePath}': () => import('${lp.importPath}'),`
-  );
-  lines.push("export const __theoPreloadMap = {");
-  for (const e of preloadEntries) lines.push(e);
-  lines.push("}", "");
-  function buildChildrenArray(node, seg) {
-    const childConfigs = [];
-    if (node.page) {
-      const pageVar = safeVarName(seg, "Page");
-      const fallbackEl = node.loading ? `React.createElement(${safeVarName(seg, "Loading")})` : "null";
-      const pageElement = `React.createElement(Suspense, { fallback: ${fallbackEl} }, React.createElement(${pageVar}))`;
-      childConfigs.push(`{ index: true, element: ${pageElement} }`);
-    }
-    for (const child of node.children) {
-      childConfigs.push(genRouteConfig(child, false));
-    }
-    if (node.notFound) {
-      const nfVar = safeVarName(seg, "NotFound");
-      childConfigs.push(`{ path: '*', element: React.createElement(${nfVar}) }`);
-    }
-    let arr = `[${childConfigs.join(", ")}]`;
-    if (node.error) {
-      const errVar = safeVarName(seg, "Error");
-      arr = `[{ errorElement: React.createElement(${errVar}), children: ${arr} }]`;
-    }
-    return arr;
-  }
-  function genRouteConfig(node, isRoot) {
-    const seg = node.segment || "root";
-    const childrenArray = buildChildrenArray(node, seg);
-    if (node.layout) {
-      const layoutVar = safeVarName(seg, "Layout");
-      const pathPart = isRoot ? `path: '/'` : `path: '${node.segment}'`;
-      return `{ ${pathPart}, element: React.createElement(${layoutVar}, { children: React.createElement(Outlet) }), children: ${childrenArray} }`;
-    }
-    if (isRoot) {
-      if (node.children.length === 0 && !node.page && !node.notFound && !node.error) {
-        return `{ path: '/', children: [] }`;
-      }
-      return `{ path: '/', children: ${childrenArray} }`;
-    }
-    if (node.page && node.children.length === 0 && !node.error && !node.notFound) {
-      const pageVar = safeVarName(seg, "Page");
-      const fallbackEl = node.loading ? `React.createElement(${safeVarName(seg, "Loading")})` : "null";
-      const pageElement = `React.createElement(Suspense, { fallback: ${fallbackEl} }, React.createElement(${pageVar}))`;
-      return `{ path: '${node.segment}', element: ${pageElement} }`;
-    }
-    return `{ path: '${node.segment}', children: ${childrenArray} }`;
-  }
-  const routeConfig = genRouteConfig(tree, true);
-  lines.push(`export const routes = [${routeConfig}]`);
-  return lines.join("\n");
-}
-
-// src/server/security/csrf-readiness-store.ts
-var CsrfReadinessStore = class _CsrfReadinessStore {
-  static MAX_ENTRIES = 1e3;
-  entries = /* @__PURE__ */ new Map();
-  keyFor(event) {
-    return `${event.method}\0${event.path}\0${event.reason}`;
-  }
-  record(event) {
-    const key = this.keyFor(event);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = this.entries.get(key);
-    if (existing) {
-      existing.count++;
-      existing.lastSeen = now;
-      return;
-    }
-    if (this.entries.size >= _CsrfReadinessStore.MAX_ENTRIES) {
-      const firstKey = this.entries.keys().next().value;
-      if (firstKey !== void 0) this.entries.delete(firstKey);
-    }
-    this.entries.set(key, { count: 1, firstSeen: now, lastSeen: now });
+  record(event) {
+    const key = this.keyFor(event);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const existing = this.entries.get(key);
+    if (existing) {
+      existing.count++;
+      existing.lastSeen = now;
+      return;
+    }
+    if (this.entries.size >= _CsrfReadinessStore.MAX_ENTRIES) {
+      const firstKey = this.entries.keys().next().value;
+      if (firstKey !== void 0) this.entries.delete(firstKey);
+    }
+    this.entries.set(key, { count: 1, firstSeen: now, lastSeen: now });
   }
   summary() {
     let total = 0;
@@ -617,9 +432,9 @@ var DEFAULT_MAX_BATCH = 32;
 var batchRequestSchema = z.object({
   path: z.string().min(1),
   method: z.string().min(1),
-  query: z.record(z.unknown()).optional(),
+  query: z.record(z.string(), z.unknown()).optional(),
   body: z.unknown().optional(),
-  headers: z.record(z.string()).optional()
+  headers: z.record(z.string(), z.string()).optional()
 });
 var batchPayloadSchema = z.object({
   requests: z.array(batchRequestSchema).min(1)
@@ -746,7 +561,6 @@ function createCorsHandler(config) {
 }
 
 // src/server/http/trace-context.ts
-import { randomUUID as randomUUID2 } from "crypto";
 var TRACE_HEADER = "x-trace-id";
 var TRACE_PARENT_HEADER = "traceparent";
 var REQUEST_ID_HEADER = "x-request-id";
@@ -769,15 +583,19 @@ function pickHeader(value) {
   if (typeof value === "string" && value.length > 0) return value;
   return null;
 }
-function extractTraceId(req) {
-  const traceparent = pickHeader(req.headers[TRACE_PARENT_HEADER]);
-  if (traceparent) {
+function resolveTraceIdFromHeaders(traceparent, requestId) {
+  if (traceparent !== null) {
     const parsed = parseTraceparent(traceparent);
-    if (parsed) return parsed;
+    if (parsed !== null) return parsed;
   }
-  const requestId = pickHeader(req.headers[REQUEST_ID_HEADER]);
-  if (requestId) return requestId;
-  return randomUUID2();
+  if (requestId !== null) return requestId;
+  return globalThis.crypto.randomUUID();
+}
+function extractTraceId(req) {
+  return resolveTraceIdFromHeaders(
+    pickHeader(req.headers[TRACE_PARENT_HEADER]),
+    pickHeader(req.headers[REQUEST_ID_HEADER])
+  );
 }
 
 // src/server/security/csp-report.ts
@@ -826,7 +644,7 @@ function normalizeNew(entry) {
   };
 }
 async function readBody(req, maxBytes) {
-  return await new Promise((resolve5, reject) => {
+  return await new Promise((resolve8, reject) => {
     const chunks = [];
     let total = 0;
     req.on("data", (chunk) => {
@@ -839,7 +657,7 @@ async function readBody(req, maxBytes) {
       chunks.push(chunk);
     });
     req.on("end", () => {
-      resolve5(Buffer.concat(chunks).toString("utf8"));
+      resolve8(Buffer.concat(chunks).toString("utf8"));
     });
     req.on("error", reject);
   });
@@ -1001,10 +819,10 @@ async function handleBatchIfMatch(req, res, ctx) {
 async function handleBatchInline(req, res, batching, requestId) {
   try {
     const chunks = [];
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve8, reject) => {
       req.on("data", (c) => chunks.push(c));
       req.on("end", () => {
-        resolve5();
+        resolve8();
       });
       req.on("error", reject);
     });
@@ -1150,138 +968,483 @@ function createApiMiddleware(vite, serverDir, rateLimitConfigOrOptions) {
   };
 }
 
-// src/vite-plugin/theoui-detect.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, join } from "path";
-function resolveTheoUiConfig(raw) {
-  return {
-    theme: raw?.theme ?? "violet-forge",
-    fonts: raw?.fonts ?? "bundled"
-  };
+// src/vite-plugin/ssr-dev-middleware.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+function isSsrRenderResult(value) {
+  if (typeof value !== "object" || value === null) return false;
+  if (!("html" in value)) return false;
+  return typeof value.html === "string";
 }
-function resolveExportSubpath(pkgRoot, subpath) {
-  const pkgJsonPath = join(pkgRoot, "package.json");
-  if (!existsSync(pkgJsonPath)) return null;
+function setupSsrDevMiddleware(server, opts) {
+  server.middlewares.use((req, res, next) => {
+    void (async () => {
+      const url = req.url ?? "/";
+      if (url.startsWith("/api/") || url.startsWith("/@") || url.startsWith("/node_modules/") || url.includes(".")) {
+        next();
+        return;
+      }
+      try {
+        const indexPath = resolve2(opts.projectRoot, "index.html");
+        let template = readFileSync2(indexPath, "utf-8");
+        template = await server.transformIndexHtml(url, template);
+        const nonce = generateNonce();
+        applySecurityHeaders(
+          res,
+          opts.securityHeaders ?? {},
+          { production: process.env.NODE_ENV === "production" },
+          { nonce }
+        );
+        const mod = await server.ssrLoadModule(opts.virtualEntryServerId);
+        const result = await mod.render(url, { nonce });
+        if (result && typeof result === "object" && "redirect" in result) {
+          res.writeHead(302, {
+            Location: result.redirect.headers.get("location") ?? "/"
+          });
+          res.end();
+          return;
+        }
+        let ssrHtml;
+        let hydrationScript = "";
+        if (typeof result === "string") {
+          ssrHtml = result;
+        } else if (isSsrRenderResult(result)) {
+          ssrHtml = result.html;
+          const dataJson = JSON.stringify(result.hydrationData).replace(/</g, "\\u003c");
+          hydrationScript = `<script nonce="${nonce}">window.__staticRouterHydrationData=${dataJson}</script>`;
+        } else {
+          ssrHtml = "";
+        }
+        const rootDivMatch = /<div id=["']root["'][^>]*>/.exec(template);
+        if (!rootDivMatch) {
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(template);
+          return;
+        }
+        const splitIdx = template.indexOf(rootDivMatch[0]) + rootDivMatch[0].length;
+        const html = template.slice(0, splitIdx) + ssrHtml + hydrationScript + template.slice(splitIdx);
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(html);
+      } catch (err) {
+        server.ssrFixStacktrace(err);
+        console.error("[SSR Dev Error]", err);
+        next();
+        return;
+      }
+    })();
+  });
+}
+
+// src/vite-plugin/ws-upgrade.ts
+import { resolve as resolve3 } from "path";
+function setupWsUpgrade(server, projectRoot) {
+  const wsRoutes = scanWebSocketRoutes(resolve3(projectRoot, "server"));
+  if (wsRoutes.length === 0) return;
+  const wsHttpServer = server.httpServer;
+  if (!wsHttpServer) return;
+  void import("ws").then(({ WebSocketServer }) => {
+    const wss = new WebSocketServer({ noServer: true });
+    wsHttpServer.on("upgrade", (request, socket, head) => {
+      void (async () => {
+        const url = request.url ?? "/";
+        if (!url.startsWith("/ws/")) return;
+        const wsPath = url.split("?")[0];
+        const match = wsRoutes.find((r) => r.wsPath === wsPath);
+        if (!match) {
+          socket.destroy();
+          return;
+        }
+        try {
+          const mod = await server.ssrLoadModule(match.filePath);
+          const handler = mod.default ?? mod;
+          wss.handleUpgrade(request, socket, head, (ws) => {
+            void handler.onOpen?.(ws, request);
+            ws.on("message", (data) => {
+              void handler.onMessage?.(ws, data.toString());
+            });
+            ws.on("close", (code, reason) => {
+              void handler.onClose?.(ws, code, reason);
+            });
+            ws.on("error", (err) => {
+              void handler.onError?.(ws, err);
+            });
+          });
+        } catch {
+          socket.destroy();
+        }
+      })();
+    });
+  }).catch(() => {
+    console.warn(
+      '[Theo] WebSocket routes found but "ws" package not installed. Run: npm install ws'
+    );
+  });
+}
+
+// src/vite-plugin/configure-server-hook.ts
+async function runConfigureServer(server, ctx) {
+  ctx.isDevMode.value = true;
+  globalThis.__theoViteHotServer = server;
+  server.ws.on("theo:devtools:request-manifest", () => {
+    try {
+      const tree = scanRoutes(ctx.appDir);
+      broadcastRouteManifest(tree);
+    } catch {
+    }
+  });
+  const serverDir = resolve4(ctx.projectRoot, "server");
+  server.middlewares.use(
+    createActionMiddleware(server, serverDir, {
+      pluginRunner: ctx.pluginRunner,
+      csrfMode: ctx.csrfMode,
+      disallowed: ctx.disallowed
+    })
+  );
+  const servicesProxyPrefixes = ctx.services && Object.keys(ctx.services).length > 0 ? Object.values(ctx.services).map((s) => s.proxy) : [];
+  const csrfReadinessStore = ctx.csrfReadinessStoreOverride ?? new CsrfReadinessStore();
+  server.middlewares.use(
+    createApiMiddleware(server, serverDir, {
+      rateLimitConfig: ctx.rateLimit,
+      pluginRunner: ctx.pluginRunner,
+      batching: ctx.resolvedBatching,
+      transformer: ctx.transformer,
+      csrfMode: ctx.csrfMode,
+      securityHeaders: ctx.securityHeaders,
+      disallowed: ctx.disallowed,
+      cors: ctx.cors,
+      auditLogger: ctx.auditLogger,
+      servicesProxyPrefixes,
+      csrfReadinessStore
+    })
+  );
+  const configPath = resolve4(ctx.projectRoot, "theo.config.ts");
+  server.watcher.on("change", (file) => {
+    if (file === configPath) {
+      console.warn(
+        "\n[theokit] theo.config.ts changed; restart dev server for plugin changes to take effect\n"
+      );
+    }
+  });
+  if (ctx.ssrEnabled) {
+    setupSsrDevMiddleware(server, {
+      projectRoot: ctx.projectRoot,
+      virtualEntryServerId: ctx.virtualEntryServerId,
+      securityHeaders: ctx.securityHeaders
+    });
+  }
+  function handleRouteChange(filePath) {
+    if (!isRouteFile(basename(filePath))) return;
+    if (!filePath.startsWith(ctx.appDir)) return;
+    const mod = server.moduleGraph.getModuleById(ctx.resolvedManifestId);
+    if (mod) {
+      server.moduleGraph.invalidateModule(mod);
+      server.ws.send({ type: "full-reload" });
+    }
+  }
+  server.watcher.on("add", handleRouteChange);
+  server.watcher.on("unlink", handleRouteChange);
+  if (ctx.resolvedOpenApi !== void 0) {
+    const openApiCfg = ctx.resolvedOpenApi;
+    const { reEmitOpenApi } = await import("./dev-emit-HHP2XJXE.js");
+    const openApiServerDir = resolve4(ctx.projectRoot, "server");
+    const openApiDistDir = resolve4(ctx.projectRoot, ctx.resolvedDistDir);
+    const isRouteFileForOpenApi = (file) => file.startsWith(openApiServerDir) && /\.(ts|tsx|js|mjs)$/.test(file);
+    void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
+    server.watcher.on("change", (file) => {
+      if (isRouteFileForOpenApi(file)) {
+        void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
+      }
+    });
+    server.watcher.on("add", (file) => {
+      if (isRouteFileForOpenApi(file)) {
+        void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
+      }
+    });
+    server.watcher.on("unlink", (file) => {
+      if (isRouteFileForOpenApi(file)) {
+        void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
+      }
+    });
+  }
+  setupWsUpgrade(server, ctx.projectRoot);
+  server.httpServer?.once("close", () => {
+    ;
+    globalThis.__theoViteHotServer = void 0;
+  });
+}
+
+// src/vite-plugin/integrate-ui.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { dirname as dirname3, join as join3 } from "path";
+import { pathToFileURL } from "url";
+
+// src/vite-plugin/auto-detect.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+function isDeclared(name, projectRoot) {
   try {
-    const pkg = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
-    const exportKey = `./${subpath}`;
-    const exp = pkg.exports?.[exportKey];
-    if (!exp) {
-      const fallback = join(pkgRoot, "dist", subpath);
-      return existsSync(fallback) ? fallback : null;
+    const raw = readFileSync3(join2(projectRoot, "package.json"), "utf-8");
+    const pkg = JSON.parse(raw);
+    return Boolean(
+      pkg.dependencies?.[name] ?? pkg.devDependencies?.[name] ?? pkg.peerDependencies?.[name]
+    );
+  } catch {
+    return false;
+  }
+}
+function resolvePackageJson(name, cwd) {
+  let dir = cwd;
+  for (let depth = 0; depth < 10; depth++) {
+    const pkgJsonPath = join2(dir, "node_modules", ...name.split("/"), "package.json");
+    if (existsSync3(pkgJsonPath)) {
+      try {
+        const raw = readFileSync3(pkgJsonPath, "utf-8");
+        const pkg = JSON.parse(raw);
+        if (pkg.name === name) {
+          return { path: pkgJsonPath, version: pkg.version };
+        }
+      } catch {
+      }
+    }
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function fallbackProbe(name, cwd) {
+  const candidates = ["index.mjs", "dist/index.mjs", "dist/index.js", "index.js"];
+  let dir = cwd;
+  for (let depth = 0; depth < 10; depth++) {
+    const pkgDir = join2(dir, "node_modules", ...name.split("/"));
+    for (const candidate of candidates) {
+      const entry = join2(pkgDir, candidate);
+      if (existsSync3(entry)) return { resolvedEntry: entry };
+    }
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function findOwningPackageJson(entry, expectedName) {
+  let dir = dirname2(entry);
+  for (let i = 0; i < 10; i++) {
+    const candidate = join2(dir, "package.json");
+    if (existsSync3(candidate)) {
+      try {
+        const raw = readFileSync3(candidate, "utf-8");
+        const pkg = JSON.parse(raw);
+        if (pkg.name === expectedName) {
+          return { path: candidate, version: pkg.version };
+        }
+      } catch {
+      }
+    }
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function detectPackage(name, cwd) {
+  if (!isDeclared(name, cwd)) {
+    return { installed: false };
+  }
+  const pkgJson = resolvePackageJson(name, cwd);
+  if (pkgJson) {
+    return {
+      installed: true,
+      version: pkgJson.version,
+      resolvedPath: pkgJson.path
+    };
+  }
+  let dir = cwd;
+  for (let i = 0; i < 10; i++) {
+    const nmPath = join2(dir, "node_modules", ...name.split("/"));
+    const nmPkgJson = join2(nmPath, "package.json");
+    if (existsSync3(nmPkgJson)) {
+      try {
+        const raw = readFileSync3(nmPkgJson, "utf-8");
+        const pkg = JSON.parse(raw);
+        if (pkg.name === name) {
+          return { installed: true, version: pkg.version, resolvedPath: nmPkgJson };
+        }
+      } catch {
+      }
+      return { installed: true };
     }
-    let target;
-    if (typeof exp === "string") target = exp;
-    else if (typeof exp === "object") {
-      const e = exp;
-      target = e.import ?? e.default;
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  const probe = fallbackProbe(name, cwd);
+  if (probe) {
+    const owning = findOwningPackageJson(probe.resolvedEntry, name);
+    if (owning) {
+      return { installed: true, version: owning.version, resolvedPath: owning.path };
     }
-    if (!target) return null;
-    const cleaned = target.replace(/^\.\//, "");
-    const candidate = join(pkgRoot, cleaned);
-    return existsSync(candidate) ? candidate : null;
-  } catch {
-    return null;
+    return { installed: true };
   }
+  return { installed: false };
 }
-var defaultResolver = (specifier, projectRoot) => {
-  const parts = specifier.split("/");
-  const pkgName = parts[0]?.startsWith("@") && parts.length >= 2 ? `${parts[0]}/${parts[1]}` : parts[0];
-  if (!pkgName) return false;
-  const subpath = specifier.slice(pkgName.length + 1);
-  if (!subpath) return false;
-  let dir = projectRoot;
-  for (let depth = 0; depth < 10; depth++) {
-    const pkgRoot = join(dir, "node_modules", ...pkgName.split("/"));
-    if (existsSync(pkgRoot)) {
-      const resolved = resolveExportSubpath(pkgRoot, subpath);
-      if (resolved) return true;
+
+// src/vite-plugin/integrate-ui.ts
+function resolveConsumerImport(name, cwd) {
+  let dir = cwd;
+  for (let i = 0; i < 10; i++) {
+    const pkgDir = join3(dir, "node_modules", ...name.split("/"));
+    const pkgJsonPath = join3(pkgDir, "package.json");
+    if (existsSync4(pkgJsonPath)) {
+      try {
+        const raw = readFileSync4(pkgJsonPath, "utf-8");
+        const pkg = JSON.parse(raw);
+        let entry;
+        const dotExport = pkg.exports?.["."];
+        if (typeof dotExport === "string") entry = dotExport;
+        else if (dotExport && typeof dotExport === "object") {
+          entry = dotExport.import ?? dotExport.default;
+        }
+        entry ??= pkg.module ?? pkg.main;
+        if (!entry) return null;
+        const cleaned = entry.replace(/^\.\//, "");
+        return pathToFileURL(join3(pkgDir, cleaned)).href;
+      } catch {
+        return null;
+      }
     }
-    const parent = dirname(dir);
+    const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return false;
-};
-function isDeclaredInPackageJson(projectRoot) {
+  return null;
+}
+function isValidPlugin(value) {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return false;
+  if (!("name" in value)) return false;
+  return typeof value.name === "string";
+}
+function normalizePluginReturn(value) {
+  if (Array.isArray(value)) {
+    const result = [];
+    for (const entry of value) {
+      if (!isValidPlugin(entry)) return null;
+      result.push(entry);
+    }
+    return result.length > 0 ? result : null;
+  }
+  if (isValidPlugin(value)) return [value];
+  return null;
+}
+async function integrateUseTheoUI(cwd, opts) {
+  if (opts?.enabled === false) return [];
+  const uiDetect = detectPackage("@theokit/ui", cwd);
+  if (!uiDetect.installed) return [];
+  if (opts?.consumerTailwindConfig || opts?.consumerPostcssConfig) {
+    console.info(
+      `[theokit] Detected your tailwind.config / postcss.config \u2014 skipping auto-config. Extend with \`import preset from '@theokit/ui/preset'\` to apply UI theme.`
+    );
+    return [];
+  }
+  const tailwindDetect = detectPackage("@tailwindcss/vite", cwd);
+  if (!tailwindDetect.installed) {
+    console.warn(
+      `[theokit] @theokit/ui detected but @tailwindcss/vite is not installed. Run \`pnpm add -D @tailwindcss/vite\` to enable styling.`
+    );
+    return [];
+  }
+  const tailwindUrl = resolveConsumerImport("@tailwindcss/vite", cwd);
+  if (!tailwindUrl) {
+    console.warn(
+      `[theokit] @tailwindcss/vite installed but its package entry was not resolvable from ${cwd}. Skipping auto-config.`
+    );
+    return [];
+  }
+  let tailwindMod;
+  let uiMod;
   try {
-    const raw = readFileSync(join(projectRoot, "package.json"), "utf-8");
-    const pkg = JSON.parse(raw);
-    return Boolean(
-      pkg.dependencies?.["@theokit/ui"] ?? pkg.devDependencies?.["@theokit/ui"] ?? pkg.peerDependencies?.["@theokit/ui"]
+    tailwindMod = await import(tailwindUrl);
+  } catch (err) {
+    console.warn(
+      `[theokit] @tailwindcss/vite dynamic import failed (${err.message}). Skipping auto-config.`
     );
-  } catch {
-    return false;
+    return [];
   }
-}
-function detectTheoUi(projectRoot, rawConfig, resolver = defaultResolver) {
-  const config = resolveTheoUiConfig(typeof rawConfig === "object" ? rawConfig : void 0);
-  if (rawConfig === false) {
-    return { enabled: false, config };
+  const uiPkgInstalled = detectPackage("@theokit/ui", cwd);
+  const uiPkgDir = uiPkgInstalled.resolvedPath ? uiPkgInstalled.resolvedPath.replace(/[\\/]package\.json$/, "") : null;
+  const uiPluginPath = uiPkgDir ? join3(uiPkgDir, "dist", "vite-plugin.js") : null;
+  if (!uiPluginPath || !existsSync4(uiPluginPath)) {
+    console.warn(
+      `[theokit] @theokit/ui/vite-plugin entry not found at ${String(uiPluginPath)}. Skipping auto-config.`
+    );
+    return [];
   }
-  if (!isDeclaredInPackageJson(projectRoot)) {
-    return { enabled: false, config };
+  try {
+    uiMod = await import(pathToFileURL(uiPluginPath).href);
+  } catch (err) {
+    console.warn(
+      `[theokit] @theokit/ui/vite-plugin dynamic import failed (${err.message}). Skipping auto-config.`
+    );
+    return [];
   }
-  const probes = ["@theokit/ui/styles.css", "@theokit/ui/fonts.css"];
-  for (const probe of probes) {
-    if (resolver(probe, projectRoot)) {
-      return { enabled: true, config };
-    }
+  if (typeof tailwindMod.default !== "function") {
+    console.warn(
+      `[theokit] @tailwindcss/vite does not expose a default-export function. Skipping auto-config.`
+    );
+    return [];
   }
-  return { enabled: false, config };
+  if (typeof uiMod.default !== "function") {
+    console.warn(
+      `[theokit] @theokit/ui/vite-plugin does not expose a default-export function. Skipping auto-config.`
+    );
+    return [];
+  }
+  let tailwindPlugin;
+  let uiPlugin;
+  try {
+    tailwindPlugin = tailwindMod.default();
+  } catch (err) {
+    console.warn(`[theokit] @tailwindcss/vite() threw: ${err.message}`);
+    return [];
+  }
+  try {
+    uiPlugin = uiMod.default({
+      tailwind: false
+    });
+  } catch (err) {
+    console.warn(`[theokit] @theokit/ui/vite-plugin() threw: ${err.message}`);
+    return [];
+  }
+  const tailwindPlugins = normalizePluginReturn(tailwindPlugin);
+  if (tailwindPlugins === null) {
+    console.warn(`[theokit] @tailwindcss/vite returned unexpected shape. Skipping auto-config.`);
+    return [];
+  }
+  const uiPlugins = normalizePluginReturn(uiPlugin);
+  if (uiPlugins === null) {
+    console.warn(
+      `[theokit] @theokit/ui/vite-plugin returned unexpected shape. Skipping auto-config.`
+    );
+    return [];
+  }
+  return [...tailwindPlugins, ...uiPlugins];
 }
 
-// src/vite-plugin/config-resolve.ts
-var DEFAULT_RESOLVED = {
-  pluginRunner: void 0,
-  transformer: void 0,
-  resolvedBatching: void 0,
-  theoUi: void 0,
-  csrfMode: "strict",
-  securityHeaders: void 0,
-  disallowed: void 0,
-  cors: void 0,
-  auditLogger: void 0,
-  devtoolsEnabled: true,
-  openapi: void 0,
-  distDir: ".theo"
-};
-async function resolvePluginConfig(projectRoot) {
-  try {
-    const userConfig = await loadConfig(projectRoot);
-    const pluginRunner = await createPluginRunnerFromConfig(userConfig.plugins);
-    const transformer = resolveTransformer(userConfig.serialization);
-    let resolvedBatching;
-    if (userConfig.batching === true) {
-      resolvedBatching = {};
-    } else if (typeof userConfig.batching === "object") {
-      resolvedBatching = userConfig.batching;
-    }
-    const theoUi = detectTheoUi(projectRoot, userConfig.ui);
-    let auditLogger;
-    const maybeLogger = userConfig.audit?.logger;
-    if (maybeLogger && typeof maybeLogger.log === "function") {
-      auditLogger = maybeLogger;
-    }
-    return {
-      pluginRunner,
-      transformer,
-      resolvedBatching,
-      theoUi,
-      csrfMode: userConfig.security?.csrf ?? "strict",
-      securityHeaders: userConfig.security?.headers,
-      disallowed: userConfig.security?.disallowed,
-      cors: userConfig.security?.cors,
-      auditLogger,
-      devtoolsEnabled: userConfig.devtools !== false,
-      openapi: userConfig.openapi,
-      distDir: userConfig.distDir
-    };
-  } catch {
-    return DEFAULT_RESOLVED;
+// src/vite-plugin/resolve-theo-root.ts
+import { existsSync as existsSync5 } from "fs";
+import { resolve as resolve5 } from "path";
+function resolveTheoRootDir(currentDir) {
+  if (existsSync5(resolve5(currentDir, "client"))) {
+    return currentDir;
   }
+  return resolve5(currentDir, "..");
 }
 
+// src/vite-plugin/transform-html-hook.ts
+import { existsSync as existsSync6 } from "fs";
+import { resolve as resolve6 } from "path";
+
 // src/vite-plugin/inject-devtools.ts
 var DEVTOOLS_VIRTUAL_ID = "/@theo/devtools/entry.js";
 var DEVTOOLS_RESOLVED_ID = "\0@theo/devtools/entry.js";
@@ -1367,385 +1530,461 @@ function injectStylesheets(html, opts) {
 ${html}`, injected: tagsToInject };
 }
 
-// src/vite-plugin/integrate-ui.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname3, join as join3 } from "path";
-import { pathToFileURL } from "url";
+// src/vite-plugin/transform-html-hook.ts
+function runTransformIndexHtml(html, ctx) {
+  const entry = injectEntryClient(html);
+  if (entry.warning) console.warn(entry.warning);
+  let next = entry.html;
+  const devtools = injectDevtoolsScript(next, {
+    isDev: ctx.isDevMode.value,
+    enabled: ctx.devtoolsEnabled
+  });
+  if (devtools.warning) console.warn(devtools.warning);
+  next = devtools.html;
+  const styles = injectStylesheets(next, {
+    isDev: ctx.isDevMode.value,
+    hasPackage: (name) => existsSync6(resolve6(ctx.projectRoot, "node_modules", ...name.split("/")))
+  });
+  next = styles.html;
+  return next;
+}
 
-// src/vite-plugin/auto-detect.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
-function isDeclared(name, projectRoot) {
-  try {
-    const raw = readFileSync2(join2(projectRoot, "package.json"), "utf-8");
-    const pkg = JSON.parse(raw);
-    return Boolean(
-      pkg.dependencies?.[name] ?? pkg.devDependencies?.[name] ?? pkg.peerDependencies?.[name]
-    );
-  } catch {
-    return false;
+// src/router/entry-server.ts
+function generateEntryServer(options = {}) {
+  if (options.streaming) {
+    return generateStreamingEntry(options);
   }
+  return generateSingleShotEntry(options);
 }
-function resolvePackageJson(name, cwd) {
-  let dir = cwd;
-  for (let depth = 0; depth < 10; depth++) {
-    const pkgJsonPath = join2(dir, "node_modules", ...name.split("/"), "package.json");
-    if (existsSync2(pkgJsonPath)) {
-      try {
-        const raw = readFileSync2(pkgJsonPath, "utf-8");
-        const pkg = JSON.parse(raw);
-        if (pkg.name === name) {
-          return { path: pkgJsonPath, version: pkg.version };
-        }
-      } catch {
-      }
-    }
-    const parent = dirname2(dir);
-    if (parent === dir) break;
-    dir = parent;
+function buildAppTreeJs(options) {
+  const theme = options.theoUi?.theme ?? "violet-forge";
+  if (options.theoUi) {
+    return [
+      `React.createElement(TheoUIProvider, { theme: { defaultTheme: '${theme}' } },`,
+      `      React.createElement(Suspense, { fallback: null },`,
+      `        React.createElement(StaticRouterProvider, { router, context, hydrate: false })`,
+      `      )`,
+      `    )`
+    ].join("\n");
   }
-  return null;
+  return `React.createElement(Suspense, { fallback: null },
+      React.createElement(StaticRouterProvider, { router, context, hydrate: false })
+    )`;
 }
-function fallbackProbe(name, cwd) {
-  const candidates = ["index.mjs", "dist/index.mjs", "dist/index.js", "index.js"];
-  let dir = cwd;
-  for (let depth = 0; depth < 10; depth++) {
-    const pkgDir = join2(dir, "node_modules", ...name.split("/"));
-    for (const candidate of candidates) {
-      const entry = join2(pkgDir, candidate);
-      if (existsSync2(entry)) return { resolvedEntry: entry };
-    }
-    const parent = dirname2(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
+function hydrationDataExtractSnippet() {
+  return [
+    `    const hydrationData = {`,
+    `      loaderData: context.loaderData,`,
+    `      actionData: context.actionData,`,
+    `      errors: context.errors,`,
+    `    }`
+  ].join("\n");
 }
-function findOwningPackageJson(entry, expectedName) {
-  let dir = dirname2(entry);
-  for (let i = 0; i < 10; i++) {
-    const candidate = join2(dir, "package.json");
-    if (existsSync2(candidate)) {
-      try {
-        const raw = readFileSync2(candidate, "utf-8");
-        const pkg = JSON.parse(raw);
-        if (pkg.name === expectedName) {
-          return { path: candidate, version: pkg.version };
-        }
-      } catch {
-      }
-    }
-    const parent = dirname2(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
+function generateSingleShotEntry(options) {
+  const theoUiImport = options.theoUi ? `import { TheoUIProvider } from '@theokit/ui'
+` : "";
+  const appTree = buildAppTreeJs(options);
+  return [
+    `import React, { Suspense } from 'react'`,
+    `import { renderToPipeableStream } from 'react-dom/server'`,
+    `import { createStaticHandler, createStaticRouter, StaticRouterProvider } from 'react-router'`,
+    `import { PassThrough } from 'node:stream'`,
+    `import { routes } from '/@theo/route-manifest'`,
+    theoUiImport,
+    `export async function render(url, options = {}) {`,
+    `  const handler = createStaticHandler(routes)`,
+    `  const request = new Request('http://localhost' + url)`,
+    `  const context = await handler.query(request)`,
+    ``,
+    `  if (context instanceof Response) {`,
+    `    return { redirect: context }`,
+    `  }`,
+    ``,
+    `  const router = createStaticRouter(handler.dataRoutes, context)`,
+    `  const app = ${appTree}`,
+    ``,
+    hydrationDataExtractSnippet(),
+    ``,
+    `  return new Promise((resolve, reject) => {`,
+    `    let html = ''`,
+    `    let piped = false`,
+    `    const passthrough = new PassThrough()`,
+    `    passthrough.on('data', (chunk) => { html += chunk.toString() })`,
+    `    passthrough.on('end', () => { resolve({ html, hydrationData }) })`,
+    `    passthrough.on('error', reject)`,
+    ``,
+    `    // Pipe on onShellReady (Next.js pattern). Calling pipe() twice`,
+    `    // throws "React currently only supports piping to one writable`,
+    `    // stream". The \`piped\` flag is a belt-and-suspenders guard if`,
+    `    // onShellReady fires unexpectedly more than once.`,
+    `    // Forward options.nonce to React so every <script> tag React`,
+    `    // emits (Suspense boundary scripts) carries the nonce attribute.`,
+    `    const { pipe } = renderToPipeableStream(app, {`,
+    `      nonce: options.nonce,`,
+    `      onShellReady() { if (!piped) { piped = true; pipe(passthrough) } },`,
+    `      onShellError(err) { reject(err) },`,
+    `      onError(err) { console.error('[SSR Error]', err) },`,
+    `    })`,
+    `  })`,
+    `}`
+  ].join("\n");
+}
+function streamingWebRenderer(appTree) {
+  return [
+    `// T2.3 \u2014 Web Standards streaming entry for edge runtimes (Cloudflare,`,
+    `// Bun, Deno, Vercel Edge). Uses renderToReadableStream and returns a`,
+    `// Response with the stream as body. Honors request.signal for client`,
+    `// disconnect cleanup.`,
+    `export async function renderStreamingWeb(request, options = {}) {`,
+    `  const handler = createStaticHandler(routes)`,
+    `  const url = new URL(request.url)`,
+    `  const context = await handler.query(request)`,
+    ``,
+    `  if (context instanceof Response) {`,
+    `    return context`,
+    `  }`,
+    ``,
+    `  const router = createStaticRouter(handler.dataRoutes, context)`,
+    `  const app = ${appTree}`,
+    ``,
+    `  const stream = await renderToReadableStream(app, {`,
+    `    signal: request.signal,`,
+    `    nonce: options.nonce,`,
+    `    onError(err) { console.error('[SSR Web Stream Error]', err) },`,
+    `  })`,
+    `  return new Response(stream, {`,
+    `    status: 200,`,
+    `    headers: {`,
+    `      'Content-Type': 'text/html; charset=utf-8',`,
+    `      'Transfer-Encoding': 'chunked',`,
+    `    },`,
+    `  })`,
+    `}`
+  ];
+}
+function streamingNodeRenderer(appTree) {
+  return [
+    `// T6.1 \u2014 Node streaming SSR entry (opt-in via theo.config.ts > ssrStreaming: true)`,
+    `// Flushes the shell as soon as it's ready, then streams Suspense boundaries.`,
+    `// EC-11: respects request.signal for client-disconnect cleanup.`,
+    `export async function renderStreaming(url, response, options = {}) {`,
+    `  const handler = createStaticHandler(routes)`,
+    `  const request = new Request('http://localhost' + url, { signal: options.signal })`,
+    `  const context = await handler.query(request)`,
+    ``,
+    `  if (context instanceof Response) {`,
+    `    return { redirect: context }`,
+    `  }`,
+    ``,
+    `  const router = createStaticRouter(handler.dataRoutes, context)`,
+    `  const app = ${appTree}`,
+    ``,
+    `  return new Promise((resolve, reject) => {`,
+    `    let didError = false`,
+    `    const stream = renderToPipeableStream(app, {`,
+    `      nonce: options.nonce,`,
+    `      onShellReady() {`,
+    `        response.statusCode = didError ? 500 : 200`,
+    `        response.setHeader('Content-Type', 'text/html; charset=utf-8')`,
+    `        response.setHeader('Transfer-Encoding', 'chunked')`,
+    `        stream.pipe(response)`,
+    `        resolve({ streaming: true })`,
+    `      },`,
+    `      onShellError(err) { reject(err) },`,
+    `      onError(err) {`,
+    `        didError = true`,
+    `        console.error('[SSR Stream Error]', err)`,
+    `      },`,
+    `    })`,
+    ``,
+    `    // EC-11: client disconnect cleanup`,
+    `    if (options.signal) {`,
+    `      options.signal.addEventListener('abort', () => { stream.abort() })`,
+    `    }`,
+    `  })`,
+    `}`
+  ];
+}
+function backCompatRenderer(appTree) {
+  return [
+    `// Backward compatibility: keep the single-shot render export available so`,
+    `// callers that always used 'render()' don't break when streaming is on.`,
+    `export async function render(url, options = {}) {`,
+    `  const handler = createStaticHandler(routes)`,
+    `  const request = new Request('http://localhost' + url)`,
+    `  const context = await handler.query(request)`,
+    ``,
+    `  if (context instanceof Response) {`,
+    `    return { redirect: context }`,
+    `  }`,
+    ``,
+    `  const router = createStaticRouter(handler.dataRoutes, context)`,
+    `  const app = ${appTree}`,
+    ``,
+    hydrationDataExtractSnippet(),
+    ``,
+    `  const { PassThrough } = await import('node:stream')`,
+    `  return new Promise((resolve, reject) => {`,
+    `    let html = ''`,
+    `    let piped = false`,
+    `    const passthrough = new PassThrough()`,
+    `    passthrough.on('data', (chunk) => { html += chunk.toString() })`,
+    `    passthrough.on('end', () => { resolve({ html, hydrationData }) })`,
+    `    passthrough.on('error', reject)`,
+    ``,
+    `    // Pipe on onShellReady (Next.js pattern). nonce forwarded.`,
+    `    const { pipe } = renderToPipeableStream(app, {`,
+    `      nonce: options.nonce,`,
+    `      onShellReady() { if (!piped) { piped = true; pipe(passthrough) } },`,
+    `      onShellError(err) { reject(err) },`,
+    `      onError(err) { console.error('[SSR Error]', err) },`,
+    `    })`,
+    `  })`,
+    `}`
+  ];
+}
+function generateStreamingEntry(options) {
+  const theoUiImport = options.theoUi ? `import { TheoUIProvider } from '@theokit/ui'
+` : "";
+  const appTree = buildAppTreeJs(options);
+  return [
+    `import React, { Suspense } from 'react'`,
+    `import { renderToPipeableStream, renderToReadableStream } from 'react-dom/server'`,
+    `import { createStaticHandler, createStaticRouter, StaticRouterProvider } from 'react-router'`,
+    `import { routes } from '/@theo/route-manifest'`,
+    theoUiImport,
+    ``,
+    ...streamingWebRenderer(appTree),
+    ``,
+    ...streamingNodeRenderer(appTree),
+    ``,
+    ...backCompatRenderer(appTree)
+  ].join("\n");
 }
-function detectPackage(name, cwd) {
-  if (!isDeclared(name, cwd)) {
-    return { installed: false };
-  }
-  const pkgJson = resolvePackageJson(name, cwd);
-  if (pkgJson) {
-    return {
-      installed: true,
-      version: pkgJson.version,
-      resolvedPath: pkgJson.path
-    };
-  }
-  let dir = cwd;
-  for (let i = 0; i < 10; i++) {
-    const nmPath = join2(dir, "node_modules", ...name.split("/"));
-    const nmPkgJson = join2(nmPath, "package.json");
-    if (existsSync2(nmPkgJson)) {
-      try {
-        const raw = readFileSync2(nmPkgJson, "utf-8");
-        const pkg = JSON.parse(raw);
-        if (pkg.name === name) {
-          return { installed: true, version: pkg.version, resolvedPath: nmPkgJson };
-        }
-      } catch {
-      }
-      return { installed: true };
-    }
-    const parent = dirname2(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  const probe = fallbackProbe(name, cwd);
-  if (probe) {
-    const owning = findOwningPackageJson(probe.resolvedEntry, name);
-    if (owning) {
-      return { installed: true, version: owning.version, resolvedPath: owning.path };
-    }
-    return { installed: true };
+
+// src/router/entry.ts
+function generateEntryClient(ssr, opts = {}) {
+  const rootMethod = ssr ? "hydrateRoot" : "createRoot";
+  const theoUiImports = [];
+  if (opts.theoUi) {
+    theoUiImports.push(
+      `// T2.2 \u2014 TheoUI CSS auto-injected (config.ui)`,
+      `import '@theokit/ui/styles.css'`
+    );
+    const fontsModule = opts.theoUi.fonts === "cdn" ? "fonts-cdn.css" : "fonts.css";
+    theoUiImports.push(
+      `import '@theokit/ui/${fontsModule}'`,
+      `// T2.3 \u2014 TheoUIProvider auto-wraps RouterProvider`,
+      `import { TheoUIProvider } from '@theokit/ui'`
+    );
   }
-  return { installed: false };
+  const theme = opts.theoUi?.theme ?? "violet-forge";
+  const routerTree = opts.theoUi ? `React.createElement(TheoUIProvider, { theme: { defaultTheme: '${theme}' } },
+      React.createElement(Suspense, { fallback: null },
+        React.createElement(RouterProvider, { router })
+      )
+    )` : `React.createElement(Suspense, { fallback: null },
+      React.createElement(RouterProvider, { router })
+    )`;
+  const renderCall = ssr ? `  ${rootMethod}(el,
+    ${routerTree}
+  )` : `  ${rootMethod}(el).render(
+    ${routerTree}
+  )`;
+  const hydrationLine = ssr ? `const router = createBrowserRouter(routes, { hydrationData: window.__staticRouterHydrationData })` : `const router = createBrowserRouter(routes)`;
+  const preloadBlock = ssr ? [
+    `// Phase 4 \u2014 preload matched-route modules before hydrate (EC-3 safeguard)`,
+    `const __theoMatches = matchRoutes(routes, window.location.pathname) ?? []`,
+    `const __theoPreloadPaths = __theoMatches`,
+    `  .map((m) => m.route && (m.route).path)`,
+    `  .filter((p) => typeof p === 'string' && p in __theoPreloadMap)`,
+    `const __theoPreloadPromise = Promise.all(`,
+    `  __theoPreloadPaths.map((p) => __theoPreloadMap[p]().catch((err) => { console.error('[theo] preload failed', p, err); return null }))`,
+    `)`,
+    `const __theoTimeout = new Promise((resolve) => setTimeout(() => resolve('timeout'), 1500))`,
+    `await Promise.race([__theoPreloadPromise, __theoTimeout])`,
+    ""
+  ] : [];
+  const renderBlock = ssr ? [
+    `if (el) {`,
+    `  ;(async () => {`,
+    ...preloadBlock.map((l) => "    " + l),
+    renderCall,
+    `  })()`,
+    `}`
+  ] : [`if (el) {`, renderCall, `}`];
+  const manifestImports = ssr ? `import { routes, __theoPreloadMap } from '/@theo/route-manifest'` : `import { routes } from '/@theo/route-manifest'`;
+  const reactRouterImports = ssr ? `import { createBrowserRouter, RouterProvider, matchRoutes } from 'react-router'` : `import { createBrowserRouter, RouterProvider } from 'react-router'`;
+  return [
+    `import React, { Suspense } from 'react'`,
+    `import { ${rootMethod} } from 'react-dom/client'`,
+    reactRouterImports,
+    manifestImports,
+    `// T1.3 \u2014 side-effect import sets globalThis.__THEO_TRANSFORMER__ for theoFetch`,
+    `import '/@theo/runtime-config'`,
+    ...theoUiImports,
+    ``,
+    hydrationLine,
+    `const el = document.getElementById('root')`,
+    ...renderBlock
+  ].join("\n");
 }
 
-// src/vite-plugin/integrate-ui.ts
-function resolveConsumerImport(name, cwd) {
-  let dir = cwd;
-  for (let i = 0; i < 10; i++) {
-    const pkgDir = join3(dir, "node_modules", ...name.split("/"));
-    const pkgJsonPath = join3(pkgDir, "package.json");
-    if (existsSync3(pkgJsonPath)) {
-      try {
-        const raw = readFileSync3(pkgJsonPath, "utf-8");
-        const pkg = JSON.parse(raw);
-        let entry;
-        const dotExport = pkg.exports?.["."];
-        if (typeof dotExport === "string") entry = dotExport;
-        else if (dotExport && typeof dotExport === "object") {
-          entry = dotExport.import ?? dotExport.default;
-        }
-        entry ??= pkg.module ?? pkg.main;
-        if (!entry) return null;
-        const cleaned = entry.replace(/^\.\//, "");
-        return pathToFileURL(join3(pkgDir, cleaned)).href;
-      } catch {
-        return null;
-      }
-    }
-    const parent = dirname3(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
+// src/router/generate.ts
+function normalizePath(p) {
+  return p.replace(/\\/g, "/");
 }
-function isValidPlugin(value) {
-  if (value === null || typeof value !== "object") return false;
-  if (Array.isArray(value)) return false;
-  if (!("name" in value)) return false;
-  return typeof value.name === "string";
+function safeVarName(segment, prefix) {
+  const safe = segment.replace(/[^a-zA-Z0-9]/g, "_") || "root";
+  return `${prefix}_${safe}`;
 }
-function normalizePluginReturn(value) {
-  if (Array.isArray(value)) {
-    const result = [];
-    for (const entry of value) {
-      if (!isValidPlugin(entry)) return null;
-      result.push(entry);
-    }
-    return result.length > 0 ? result : null;
-  }
-  if (isValidPlugin(value)) return [value];
-  return null;
+function buildRoutePath(parents, segment) {
+  const joined = [...parents, segment].filter(Boolean).join("/");
+  return "/" + joined;
 }
-async function integrateUseTheoUI(cwd, opts) {
-  if (opts?.enabled === false) return [];
-  const uiDetect = detectPackage("@theokit/ui", cwd);
-  if (!uiDetect.installed) return [];
-  if (opts?.consumerTailwindConfig || opts?.consumerPostcssConfig) {
-    console.info(
-      `[theokit] Detected your tailwind.config / postcss.config \u2014 skipping auto-config. Extend with \`import preset from '@theokit/ui/preset'\` to apply UI theme.`
-    );
-    return [];
-  }
-  const tailwindDetect = detectPackage("@tailwindcss/vite", cwd);
-  if (!tailwindDetect.installed) {
-    console.warn(
-      `[theokit] @theokit/ui detected but @tailwindcss/vite is not installed. Run \`pnpm add -D @tailwindcss/vite\` to enable styling.`
-    );
-    return [];
-  }
-  const tailwindUrl = resolveConsumerImport("@tailwindcss/vite", cwd);
-  if (!tailwindUrl) {
-    console.warn(
-      `[theokit] @tailwindcss/vite installed but its package entry was not resolvable from ${cwd}. Skipping auto-config.`
-    );
-    return [];
-  }
-  let tailwindMod;
-  let uiMod;
-  try {
-    tailwindMod = await import(tailwindUrl);
-  } catch (err) {
-    console.warn(
-      `[theokit] @tailwindcss/vite dynamic import failed (${err.message}). Skipping auto-config.`
-    );
-    return [];
-  }
-  const uiPkgInstalled = detectPackage("@theokit/ui", cwd);
-  const uiPkgDir = uiPkgInstalled.resolvedPath ? uiPkgInstalled.resolvedPath.replace(/[\\/]package\.json$/, "") : null;
-  const uiPluginPath = uiPkgDir ? join3(uiPkgDir, "dist", "vite-plugin.js") : null;
-  if (!uiPluginPath || !existsSync3(uiPluginPath)) {
-    console.warn(
-      `[theokit] @theokit/ui/vite-plugin entry not found at ${String(uiPluginPath)}. Skipping auto-config.`
-    );
-    return [];
-  }
-  try {
-    uiMod = await import(pathToFileURL(uiPluginPath).href);
-  } catch (err) {
-    console.warn(
-      `[theokit] @theokit/ui/vite-plugin dynamic import failed (${err.message}). Skipping auto-config.`
-    );
-    return [];
-  }
-  if (typeof tailwindMod.default !== "function") {
-    console.warn(
-      `[theokit] @tailwindcss/vite does not expose a default-export function. Skipping auto-config.`
-    );
-    return [];
+function pushIf(staticImports, filePath, varName) {
+  if (filePath !== void 0) {
+    staticImports.push({ varName, importPath: normalizePath(filePath) });
   }
-  if (typeof uiMod.default !== "function") {
-    console.warn(
-      `[theokit] @theokit/ui/vite-plugin does not expose a default-export function. Skipping auto-config.`
-    );
-    return [];
+}
+function walkRouteTree(node, parents, acc) {
+  const seg = node.segment || "root";
+  const routePath = buildRoutePath(parents, node.segment);
+  if (node.page !== void 0) {
+    acc.lazyPages.push({
+      varName: safeVarName(seg, "Page"),
+      importPath: normalizePath(node.page),
+      routePath
+    });
   }
-  let tailwindPlugin;
-  let uiPlugin;
-  try {
-    tailwindPlugin = tailwindMod.default();
-  } catch (err) {
-    console.warn(`[theokit] @tailwindcss/vite() threw: ${err.message}`);
-    return [];
+  if (node.layout !== void 0) acc.layoutState.found = true;
+  pushIf(acc.staticImports, node.layout, safeVarName(seg, "Layout"));
+  pushIf(acc.staticImports, node.error, safeVarName(seg, "Error"));
+  pushIf(acc.staticImports, node.loading, safeVarName(seg, "Loading"));
+  pushIf(acc.staticImports, node.notFound, safeVarName(seg, "NotFound"));
+  for (const child of node.children) {
+    const nextParents = node.segment ? [...parents, node.segment] : parents;
+    walkRouteTree(child, nextParents, acc);
   }
-  try {
-    uiPlugin = uiMod.default({
-      tailwind: false
-    });
-  } catch (err) {
-    console.warn(`[theokit] @theokit/ui/vite-plugin() threw: ${err.message}`);
-    return [];
+}
+function generateRouteManifest(tree) {
+  const acc = {
+    staticImports: [],
+    lazyPages: [],
+    layoutState: { found: false }
+  };
+  walkRouteTree(tree, [], acc);
+  const staticImports = acc.staticImports;
+  const lazyPages = acc.lazyPages;
+  const layoutState = acc.layoutState;
+  const lines = [`import React, { Suspense } from 'react'`];
+  if (layoutState.found) {
+    lines.push(`import { Outlet } from 'react-router'`);
   }
-  const tailwindPlugins = normalizePluginReturn(tailwindPlugin);
-  if (tailwindPlugins === null) {
-    console.warn(`[theokit] @tailwindcss/vite returned unexpected shape. Skipping auto-config.`);
-    return [];
+  lines.push("");
+  for (const imp of staticImports) {
+    lines.push(`import ${imp.varName} from '${imp.importPath}'`);
   }
-  const uiPlugins = normalizePluginReturn(uiPlugin);
-  if (uiPlugins === null) {
-    console.warn(
-      `[theokit] @theokit/ui/vite-plugin returned unexpected shape. Skipping auto-config.`
-    );
-    return [];
+  for (const lp of lazyPages) {
+    lines.push(`const ${lp.varName} = React.lazy(() => import('${lp.importPath}'))`);
   }
-  return [...tailwindPlugins, ...uiPlugins];
-}
-
-// src/vite-plugin/resolve-theo-root.ts
-import { existsSync as existsSync4 } from "fs";
-import { resolve } from "path";
-function resolveTheoRootDir(currentDir) {
-  if (existsSync4(resolve(currentDir, "client"))) {
-    return currentDir;
+  lines.push("");
+  const preloadEntries = lazyPages.map(
+    (lp) => `  '${lp.routePath}': () => import('${lp.importPath}'),`
+  );
+  lines.push("export const __theoPreloadMap = {");
+  for (const e of preloadEntries) lines.push(e);
+  lines.push("}", "");
+  function buildChildrenArray(node, seg) {
+    const childConfigs = [];
+    if (node.page) {
+      const pageVar = safeVarName(seg, "Page");
+      const fallbackEl = node.loading ? `React.createElement(${safeVarName(seg, "Loading")})` : "null";
+      const pageElement = `React.createElement(Suspense, { fallback: ${fallbackEl} }, React.createElement(${pageVar}))`;
+      childConfigs.push(`{ index: true, element: ${pageElement} }`);
+    }
+    for (const child of node.children) {
+      childConfigs.push(genRouteConfig(child, false));
+    }
+    if (node.notFound) {
+      const nfVar = safeVarName(seg, "NotFound");
+      childConfigs.push(`{ path: '*', element: React.createElement(${nfVar}) }`);
+    }
+    let arr = `[${childConfigs.join(", ")}]`;
+    if (node.error) {
+      const errVar = safeVarName(seg, "Error");
+      arr = `[{ errorElement: React.createElement(${errVar}), children: ${arr} }]`;
+    }
+    return arr;
   }
-  return resolve(currentDir, "..");
-}
-
-// src/vite-plugin/ssr-dev-middleware.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve2 } from "path";
-function isSsrRenderResult(value) {
-  if (typeof value !== "object" || value === null) return false;
-  if (!("html" in value)) return false;
-  return typeof value.html === "string";
-}
-function setupSsrDevMiddleware(server, opts) {
-  server.middlewares.use((req, res, next) => {
-    void (async () => {
-      const url = req.url ?? "/";
-      if (url.startsWith("/api/") || url.startsWith("/@") || url.startsWith("/node_modules/") || url.includes(".")) {
-        next();
-        return;
-      }
-      try {
-        const indexPath = resolve2(opts.projectRoot, "index.html");
-        let template = readFileSync4(indexPath, "utf-8");
-        template = await server.transformIndexHtml(url, template);
-        const nonce = generateNonce();
-        applySecurityHeaders(
-          res,
-          opts.securityHeaders ?? {},
-          { production: process.env.NODE_ENV === "production" },
-          { nonce }
-        );
-        const mod = await server.ssrLoadModule(opts.virtualEntryServerId);
-        const result = await mod.render(url, { nonce });
-        if (result && typeof result === "object" && "redirect" in result) {
-          res.writeHead(302, {
-            Location: result.redirect.headers.get("location") ?? "/"
-          });
-          res.end();
-          return;
-        }
-        let ssrHtml;
-        let hydrationScript = "";
-        if (typeof result === "string") {
-          ssrHtml = result;
-        } else if (isSsrRenderResult(result)) {
-          ssrHtml = result.html;
-          const dataJson = JSON.stringify(result.hydrationData).replace(/</g, "\\u003c");
-          hydrationScript = `<script nonce="${nonce}">window.__staticRouterHydrationData=${dataJson}</script>`;
-        } else {
-          ssrHtml = "";
-        }
-        const rootDivMatch = /<div id=["']root["'][^>]*>/.exec(template);
-        if (!rootDivMatch) {
-          res.writeHead(200, { "Content-Type": "text/html" });
-          res.end(template);
-          return;
-        }
-        const splitIdx = template.indexOf(rootDivMatch[0]) + rootDivMatch[0].length;
-        const html = template.slice(0, splitIdx) + ssrHtml + hydrationScript + template.slice(splitIdx);
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(html);
-      } catch (err) {
-        server.ssrFixStacktrace(err);
-        console.error("[SSR Dev Error]", err);
-        next();
-        return;
+  function genRouteConfig(node, isRoot) {
+    const seg = node.segment || "root";
+    const childrenArray = buildChildrenArray(node, seg);
+    if (node.layout) {
+      const layoutVar = safeVarName(seg, "Layout");
+      const pathPart = isRoot ? `path: '/'` : `path: '${node.segment}'`;
+      return `{ ${pathPart}, element: React.createElement(${layoutVar}, { children: React.createElement(Outlet) }), children: ${childrenArray} }`;
+    }
+    if (isRoot) {
+      if (node.children.length === 0 && !node.page && !node.notFound && !node.error) {
+        return `{ path: '/', children: [] }`;
       }
-    })();
-  });
+      return `{ path: '/', children: ${childrenArray} }`;
+    }
+    if (node.page && node.children.length === 0 && !node.error && !node.notFound) {
+      const pageVar = safeVarName(seg, "Page");
+      const fallbackEl = node.loading ? `React.createElement(${safeVarName(seg, "Loading")})` : "null";
+      const pageElement = `React.createElement(Suspense, { fallback: ${fallbackEl} }, React.createElement(${pageVar}))`;
+      return `{ path: '${node.segment}', element: ${pageElement} }`;
+    }
+    return `{ path: '${node.segment}', children: ${childrenArray} }`;
+  }
+  const routeConfig = genRouteConfig(tree, true);
+  lines.push(`export const routes = [${routeConfig}]`);
+  return lines.join("\n");
 }
 
-// src/vite-plugin/ws-upgrade.ts
-import { resolve as resolve3 } from "path";
-function setupWsUpgrade(server, projectRoot) {
-  const wsRoutes = scanWebSocketRoutes(resolve3(projectRoot, "server"));
-  if (wsRoutes.length === 0) return;
-  const wsHttpServer = server.httpServer;
-  if (!wsHttpServer) return;
-  void import("ws").then(({ WebSocketServer }) => {
-    const wss = new WebSocketServer({ noServer: true });
-    wsHttpServer.on("upgrade", (request, socket, head) => {
-      void (async () => {
-        const url = request.url ?? "/";
-        if (!url.startsWith("/ws/")) return;
-        const wsPath = url.split("?")[0];
-        const match = wsRoutes.find((r) => r.wsPath === wsPath);
-        if (!match) {
-          socket.destroy();
-          return;
-        }
-        try {
-          const mod = await server.ssrLoadModule(match.filePath);
-          const handler = mod.default ?? mod;
-          wss.handleUpgrade(request, socket, head, (ws) => {
-            void handler.onOpen?.(ws, request);
-            ws.on("message", (data) => {
-              void handler.onMessage?.(ws, data.toString());
-            });
-            ws.on("close", (code, reason) => {
-              void handler.onClose?.(ws, code, reason);
-            });
-            ws.on("error", (err) => {
-              void handler.onError?.(ws, err);
-            });
-          });
-        } catch {
-          socket.destroy();
-        }
-      })();
+// src/vite-plugin/virtual-modules-hook.ts
+function resolveVirtualModuleId(id, ids) {
+  if (id === ids.VIRTUAL_ENTRY_ID) return ids.RESOLVED_ENTRY_ID;
+  if (id === ids.VIRTUAL_MANIFEST_ID) return ids.RESOLVED_MANIFEST_ID;
+  if (id === ids.VIRTUAL_ENTRY_SERVER_ID) return ids.RESOLVED_ENTRY_SERVER_ID;
+  if (id === ids.VIRTUAL_RUNTIME_CONFIG_ID) return ids.RESOLVED_RUNTIME_CONFIG_ID;
+  if (id === DEVTOOLS_VIRTUAL_ID) return DEVTOOLS_RESOLVED_ID;
+  return void 0;
+}
+function loadVirtualModule(id, ctx) {
+  if (id === ctx.ids.RESOLVED_ENTRY_ID) {
+    return generateEntryClient(ctx.ssrEnabled, {
+      theoUi: ctx.theoUi?.enabled ? { fonts: ctx.theoUi.config.fonts, theme: ctx.theoUi.config.theme } : void 0
     });
-  }).catch(() => {
-    console.warn(
-      '[Theo] WebSocket routes found but "ws" package not installed. Run: npm install ws'
-    );
-  });
+  }
+  if (id === ctx.ids.RESOLVED_MANIFEST_ID) {
+    const tree = scanRoutes(ctx.appDir);
+    broadcastRouteManifest(tree);
+    return generateRouteManifest(tree);
+  }
+  if (id === ctx.ids.RESOLVED_ENTRY_SERVER_ID) {
+    return generateEntryServer({
+      streaming: ctx.streamingEnabled,
+      theoUi: ctx.theoUi?.enabled ? { theme: ctx.theoUi.config.theme } : void 0
+    });
+  }
+  if (id === ctx.ids.RESOLVED_RUNTIME_CONFIG_ID) {
+    const tName = ctx.transformer?.name ?? "json";
+    return [
+      `// Generated by Theo Vite plugin`,
+      `;(globalThis).__THEO_TRANSFORMER__ = ${JSON.stringify(tName)}`,
+      `export const TRANSFORMER_NAME = ${JSON.stringify(tName)}`
+    ].join("\n");
+  }
+  if (id === DEVTOOLS_RESOLVED_ID) {
+    return [
+      `// Theo devtools \u2014 virtual entry (DEV only)`,
+      `import('theokit/devtools/entry').catch((e) => console.error('[theo devtools] mount failed', e))`
+    ].join("\n");
+  }
+  return void 0;
 }
 
 // src/vite-plugin/integrations.ts
@@ -1858,8 +2097,8 @@ function findConsumerConfig(projectRoot, basename2) {
   let dir = projectRoot;
   for (let level = 0; level < 3; level++) {
     for (const ext of extensions) {
-      const candidate = resolve4(dir, `${basename2}${ext}`);
-      if (existsSync5(candidate)) return candidate;
+      const candidate = resolve7(dir, `${basename2}${ext}`);
+      if (existsSync7(candidate)) return candidate;
     }
     const parent = dirname4(dir);
     if (parent === dir) break;
@@ -1878,7 +2117,7 @@ async function theoPluginAsync(rootOrOptions) {
   });
   const servicesPlugins = [];
   if (options.services && Object.keys(options.services).length > 0) {
-    const { servicesTypedClientPlugin } = await import("./services-typed-client-ZX5JUHH3.js");
+    const { servicesTypedClientPlugin } = await import("./services-typed-client-T7M5VPBP.js");
     servicesPlugins.push(
       servicesTypedClientPlugin({
         cwd: projectRoot,
@@ -1886,20 +2125,20 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-ITIYTBXO.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-OUJO3V5J.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
-    serverDir: resolve4(projectRoot, "server"),
-    distDir: resolve4(projectRoot, ".theo")
+    serverDir: resolve7(projectRoot, "server"),
+    distDir: resolve7(projectRoot, ".theo")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-HWNTIEPI.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-IY46EEEX.js");
   const actionsPlugin = actionsVirtualModule({
-    serverDir: resolve4(projectRoot, "server"),
-    distDir: resolve4(projectRoot, ".theo")
+    serverDir: resolve7(projectRoot, "server"),
+    distDir: resolve7(projectRoot, ".theo")
   });
   const { serverRoutesHmrPlugin } = await import("./server-routes-hmr-GZJGPWMS.js");
   const routesHmrPlugin = serverRoutesHmrPlugin({
-    serverDir: resolve4(projectRoot, "server")
+    serverDir: resolve7(projectRoot, "server")
   });
   return [
     theoPlugin(rootOrOptions),
@@ -1912,10 +2151,10 @@ async function theoPluginAsync(rootOrOptions) {
 }
 function buildOptimizeDepsInclude(projectRoot, viteOptimizeDeps) {
   const include = [];
-  if (existsSync5(resolve4(projectRoot, "node_modules", "@theokit", "ui"))) {
+  if (existsSync7(resolve7(projectRoot, "node_modules", "@theokit", "ui"))) {
     include.push("@theokit/ui");
   }
-  if (existsSync5(resolve4(projectRoot, "node_modules", "lucide-react"))) {
+  if (existsSync7(resolve7(projectRoot, "node_modules", "lucide-react"))) {
     include.push("lucide-react");
   }
   include.push("devalue");
@@ -1928,10 +2167,20 @@ function buildOptimizeDepsInclude(projectRoot, viteOptimizeDeps) {
   }
   return include;
 }
+var VIRTUAL_MODULE_IDS = {
+  VIRTUAL_ENTRY_ID,
+  RESOLVED_ENTRY_ID,
+  VIRTUAL_MANIFEST_ID,
+  RESOLVED_MANIFEST_ID,
+  VIRTUAL_ENTRY_SERVER_ID,
+  RESOLVED_ENTRY_SERVER_ID,
+  VIRTUAL_RUNTIME_CONFIG_ID,
+  RESOLVED_RUNTIME_CONFIG_ID
+};
 function theoPlugin(rootOrOptions) {
   const options = typeof rootOrOptions === "string" ? { root: rootOrOptions } : rootOrOptions ?? {};
   const projectRoot = options.root ?? process.cwd();
-  const appDir = resolve4(projectRoot, "app");
+  const appDir = resolve7(projectRoot, "app");
   const ssrEnabled = options.ssr ?? false;
   const currentDir = dirname4(fileURLToPath(import.meta.url));
   const theoSrcDir = resolveTheoRootDir(currentDir);
@@ -1947,7 +2196,7 @@ function theoPlugin(rootOrOptions) {
   let devtoolsEnabled = true;
   let resolvedOpenApi;
   let resolvedDistDir = ".theo";
-  let isDevMode = false;
+  const isDevModeRef = { value: false };
   let configLoadedOnce = false;
   return {
     name: "theo",
@@ -1968,223 +2217,73 @@ function theoPlugin(rootOrOptions) {
       resolvedOpenApi = resolved.openapi;
       resolvedDistDir = resolved.distDir;
     },
-    // Vite calls this hook (sync return is fine — no awaits left after
-    // the auto-chain moved to theoPluginAsync). The @theokit/ui +
-    // @tailwindcss/vite auto-chain lives in `theoPluginAsync` because
-    // Vite drops plugins returned from a child plugin's config() hook.
+    // T2.6 (M6) — config() body extracted to config-hook.ts. The hook
+    // owns optimizeDeps + warmup + services proxy + alias cascade.
+    // The @theokit/ui + @tailwindcss/vite auto-chain lives in
+    // `theoPluginAsync` because Vite drops plugins returned from a
+    // child plugin's config() hook.
     config() {
-      const ext = existsSync5(resolve4(theoSrcDir, "index.ts")) ? ".ts" : ".js";
-      const optimizeDepsInclude = buildOptimizeDepsInclude(projectRoot, options.viteOptimizeDeps);
-      const warmupClientFiles = [];
-      for (const candidate of ["app/layout.tsx", "app/page.tsx", "app/page.jsx"]) {
-        const full = resolve4(projectRoot, candidate);
-        if (existsSync5(full)) warmupClientFiles.push(`./${candidate}`);
-      }
-      const servicesProxy = options.services && Object.keys(options.services).length > 0 ? buildServicesProxyConfig(options.services) : void 0;
-      return {
-        envPrefix: "THEO_PUBLIC_",
-        optimizeDeps: {
-          ...optimizeDepsInclude.length > 0 ? { include: optimizeDepsInclude } : {},
-          force: true
-        },
-        server: {
-          ...warmupClientFiles.length > 0 ? { warmup: { clientFiles: warmupClientFiles } } : {},
-          ...servicesProxy !== void 0 ? { proxy: servicesProxy } : {},
-          // Skip watching gitignored heavy dirs to avoid hitting ENOSPC
-          // (inotify watcher exhaustion). `referencias/` are deep-research
-          // clones; `.theokit/` is per-conversation cache; `.theo/` is
-          // build output. None should trigger HMR.
-          watch: {
-            ignored: [
-              "**/referencias/**",
-              "**/.theokit/**",
-              "**/.theo/**",
-              "**/dist/**",
-              "**/node_modules/**"
-            ]
-          }
-        },
-        resolve: {
-          alias: [
-            // Order matters: most-specific first so `theokit/X` doesn't
-            // get matched by the bare `theokit` alias.
-            { find: "theokit/server", replacement: resolve4(theoSrcDir, `server/index${ext}`) },
-            { find: "theokit/client", replacement: resolve4(theoSrcDir, `client/index${ext}`) },
-            {
-              find: "theokit/react-query",
-              replacement: resolve4(theoSrcDir, `react-query/index${ext}`)
-            },
-            {
-              find: "theokit/vite-plugin",
-              replacement: resolve4(theoSrcDir, `vite-plugin/index${ext}`)
-            },
-            {
-              find: "theokit/adapters/web-shim",
-              replacement: resolve4(theoSrcDir, `adapters/web-shim${ext}`)
-            },
-            {
-              find: "theokit/adapters/ws-shim",
-              replacement: resolve4(theoSrcDir, `adapters/ws-shim${ext}`)
-            },
-            // T1.2 — devtools entry (DEV only; tree-shaken in build because
-            // the script tag is never injected by inject-devtools.ts in build mode)
-            {
-              find: "theokit/devtools/entry",
-              replacement: resolve4(theoSrcDir, `devtools/entry${ext === ".ts" ? ".tsx" : ".js"}`)
-            },
-            { find: "theokit", replacement: resolve4(theoSrcDir, `index${ext}`) }
-          ]
-        }
-      };
+      return runConfigHook({
+        projectRoot,
+        theoSrcDir,
+        services: options.services,
+        optimizeDepsInclude: buildOptimizeDepsInclude(projectRoot, options.viteOptimizeDeps)
+      });
     },
-    // Auto-inject the entry-client `<script>` into every served HTML
-    // (Phase 2 of nextjs-maturity plan). Runs BEFORE Vite's own
-    // transform so the injection lands inside <body>, not after
-    // Vite-injected content. Idempotent: if the user already wrote
-    // the script tag, the HTML is returned unchanged.
+    // T2.6 (M6) — transformIndexHtml hook extracted to transform-html-hook.ts.
+    // Preserves the canonical 3-step order (entry-client → devtools → styles)
+    // so EC-10 (Vite hook ordering side effects) is honored.
     transformIndexHtml: {
       order: "pre",
       handler(html) {
-        const entry = injectEntryClient(html);
-        if (entry.warning) console.warn(entry.warning);
-        let next = entry.html;
-        const devtools = injectDevtoolsScript(next, {
-          isDev: isDevMode,
-          enabled: devtoolsEnabled
+        return runTransformIndexHtml(html, {
+          isDevMode: isDevModeRef,
+          devtoolsEnabled,
+          projectRoot
         });
-        if (devtools.warning) console.warn(devtools.warning);
-        next = devtools.html;
-        const styles = injectStylesheets(next, {
-          isDev: isDevMode,
-          hasPackage: (name) => existsSync5(resolve4(projectRoot, "node_modules", ...name.split("/")))
-        });
-        next = styles.html;
-        return next;
       }
     },
+    // T2.6 (M6) — virtual-module resolveId + load dispatch extracted to
+    // virtual-modules-hook.ts. Pure structural split; identity branches
+    // preserved.
     resolveId(id) {
-      if (id === VIRTUAL_ENTRY_ID) return RESOLVED_ENTRY_ID;
-      if (id === VIRTUAL_MANIFEST_ID) return RESOLVED_MANIFEST_ID;
-      if (id === VIRTUAL_ENTRY_SERVER_ID) return RESOLVED_ENTRY_SERVER_ID;
-      if (id === VIRTUAL_RUNTIME_CONFIG_ID) return RESOLVED_RUNTIME_CONFIG_ID;
-      if (id === DEVTOOLS_VIRTUAL_ID) return DEVTOOLS_RESOLVED_ID;
+      return resolveVirtualModuleId(id, VIRTUAL_MODULE_IDS);
     },
     load(id) {
-      if (id === RESOLVED_ENTRY_ID) {
-        return generateEntryClient(ssrEnabled, {
-          theoUi: theoUi?.enabled ? { fonts: theoUi.config.fonts, theme: theoUi.config.theme } : void 0
-        });
-      }
-      if (id === RESOLVED_MANIFEST_ID) {
-        const tree = scanRoutes(appDir);
-        broadcastRouteManifest(tree);
-        return generateRouteManifest(tree);
-      }
-      if (id === RESOLVED_ENTRY_SERVER_ID) {
-        return generateEntryServer({
-          streaming: options.ssrStreaming === true,
-          theoUi: theoUi?.enabled ? { theme: theoUi.config.theme } : void 0
-        });
-      }
-      if (id === RESOLVED_RUNTIME_CONFIG_ID) {
-        const tName = transformer?.name ?? "json";
-        return [
-          `// Generated by Theo Vite plugin`,
-          `;(globalThis).__THEO_TRANSFORMER__ = ${JSON.stringify(tName)}`,
-          `export const TRANSFORMER_NAME = ${JSON.stringify(tName)}`
-        ].join("\n");
-      }
-      if (id === DEVTOOLS_RESOLVED_ID) {
-        return [
-          `// Theo devtools \u2014 virtual entry (DEV only)`,
-          `import('theokit/devtools/entry').catch((e) => console.error('[theo devtools] mount failed', e))`
-        ].join("\n");
-      }
+      return loadVirtualModule(id, {
+        ids: VIRTUAL_MODULE_IDS,
+        appDir,
+        ssrEnabled,
+        streamingEnabled: options.ssrStreaming === true,
+        theoUi,
+        transformer
+      });
     },
+    // T2.6 (M6) — configureServer body extracted to configure-server-hook.ts.
+    // The hook owns middleware order, ws subscriptions, watcher handlers,
+    // OpenAPI re-emit, and WS upgrade. EC-10 honored (every effect preserved
+    // in its original ordering).
     async configureServer(server) {
-      isDevMode = true;
-      globalThis.__theoViteHotServer = server;
-      server.ws.on("theo:devtools:request-manifest", () => {
-        try {
-          const tree = scanRoutes(appDir);
-          broadcastRouteManifest(tree);
-        } catch {
-        }
-      });
-      const serverDir = resolve4(projectRoot, "server");
-      server.middlewares.use(
-        createActionMiddleware(server, serverDir, { pluginRunner, csrfMode, disallowed })
-      );
-      const servicesProxyPrefixes = options.services && Object.keys(options.services).length > 0 ? Object.values(options.services).map((s) => s.proxy) : [];
-      const csrfReadinessStore = options.csrfReadinessStore ?? new CsrfReadinessStore();
-      server.middlewares.use(
-        createApiMiddleware(server, serverDir, {
-          rateLimitConfig: options.rateLimit,
-          pluginRunner,
-          batching: resolvedBatching,
-          transformer,
-          csrfMode,
-          securityHeaders,
-          disallowed,
-          cors,
-          auditLogger,
-          servicesProxyPrefixes,
-          csrfReadinessStore
-        })
-      );
-      const configPath = resolve4(projectRoot, "theo.config.ts");
-      server.watcher.on("change", (file) => {
-        if (file === configPath) {
-          console.warn(
-            "\n[theokit] theo.config.ts changed; restart dev server for plugin changes to take effect\n"
-          );
-        }
-      });
-      if (ssrEnabled) {
-        setupSsrDevMiddleware(server, {
-          projectRoot,
-          virtualEntryServerId: VIRTUAL_ENTRY_SERVER_ID,
-          securityHeaders
-        });
-      }
-      function handleRouteChange(filePath) {
-        if (!isRouteFile(basename(filePath))) return;
-        if (!filePath.startsWith(appDir)) return;
-        const mod = server.moduleGraph.getModuleById(RESOLVED_MANIFEST_ID);
-        if (mod) {
-          server.moduleGraph.invalidateModule(mod);
-          server.ws.send({ type: "full-reload" });
-        }
-      }
-      server.watcher.on("add", handleRouteChange);
-      server.watcher.on("unlink", handleRouteChange);
-      if (resolvedOpenApi !== void 0) {
-        const openApiCfg = resolvedOpenApi;
-        const { reEmitOpenApi } = await import("./dev-emit-NO6OZJOQ.js");
-        const openApiServerDir = resolve4(projectRoot, "server");
-        const openApiDistDir = resolve4(projectRoot, resolvedDistDir);
-        const isRouteFileForOpenApi = (file) => file.startsWith(openApiServerDir) && /\.(ts|tsx|js|mjs)$/.test(file);
-        void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
-        server.watcher.on("change", (file) => {
-          if (isRouteFileForOpenApi(file)) {
-            void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
-          }
-        });
-        server.watcher.on("add", (file) => {
-          if (isRouteFileForOpenApi(file)) {
-            void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
-          }
-        });
-        server.watcher.on("unlink", (file) => {
-          if (isRouteFileForOpenApi(file)) {
-            void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
-          }
-        });
-      }
-      setupWsUpgrade(server, projectRoot);
-      server.httpServer?.once("close", () => {
-        ;
-        globalThis.__theoViteHotServer = void 0;
+      await runConfigureServer(server, {
+        projectRoot,
+        appDir,
+        resolvedDistDir,
+        ssrEnabled,
+        isDevMode: isDevModeRef,
+        pluginRunner,
+        transformer,
+        resolvedBatching,
+        csrfMode,
+        securityHeaders,
+        disallowed,
+        cors,
+        auditLogger,
+        resolvedOpenApi,
+        services: options.services,
+        rateLimit: options.rateLimit,
+        csrfReadinessStoreOverride: options.csrfReadinessStore,
+        virtualEntryServerId: VIRTUAL_ENTRY_SERVER_ID,
+        resolvedManifestId: RESOLVED_MANIFEST_ID
       });
     }
   };
@@ -2198,4 +2297,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-JAAHOGKI.js.map
+//# sourceMappingURL=chunk-M2EY7KDR.js.map