theokit 0.4.0-beta.0 → 0.4.0

package/dist/server/storage/index.d.ts

@@ -0,0 +1,22 @@
+export { P as PostgresFactory, R as RedisFactory, S as StorageManager, g as getStorageManager } from '../../storage-manager-C4jsO0Tp.js';
+export { G as GenericFactory, a as PoolLike, P as PostgresDatabaseConfig, c as RedisLike, R as RedisServerConfig, S as ServerConfig, d as StorageAdapter, b as StorageConfig, T as TlsConfig } from '../../storage-types-DsDTCPbp.js';
+
+interface UnstorageInstance<T> {
+    getItem(key: string): Promise<T | null>;
+    setItem(key: string, value: T): Promise<void>;
+    removeItem(key: string): Promise<void>;
+    keys(prefix?: string): Promise<string[]>;
+    hasItem(key: string): Promise<boolean>;
+    clear(prefix?: string): Promise<void>;
+    dispose?(): Promise<void>;
+}
+declare function useUnstorage<T = unknown>(name: string, driver?: unknown): Promise<UnstorageInstance<T>>;
+
+interface Db0Database {
+    exec: (sql: string) => Promise<unknown>;
+    prepare: (sql: string) => unknown;
+    sql: (strings: TemplateStringsArray, ...args: unknown[]) => Promise<unknown>;
+}
+declare function useDatabase(name: string, connector: unknown): Promise<Db0Database>;
+
+export { type Db0Database, type UnstorageInstance, useDatabase, useUnstorage };

package/dist/server/storage/index.js

@@ -0,0 +1,14 @@
+import {
+  StorageManager,
+  getStorageManager,
+  useDatabase,
+  useUnstorage
+} from "../../chunk-ESC54TAK.js";
+import "../../chunk-DGUM43GV.js";
+export {
+  StorageManager,
+  getStorageManager,
+  useDatabase,
+  useUnstorage
+};
+//# sourceMappingURL=index.js.map

package/dist/server/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/server/webhook/index.d.ts

@@ -0,0 +1,148 @@
+/**
+ * Constant-time byte comparison.
+ *
+ * Wraps `node:crypto.timingSafeEqual` when available (Node 6.6+) and falls
+ * back to a constant-time XOR loop for runtimes without `node:crypto`
+ * (Cloudflare Workers, Deno, Bun edge). Required to defeat timing attacks
+ * on webhook signature verification — a naive `===` or `Buffer.equals`
+ * would short-circuit on first mismatch byte and leak signature position
+ * via wall-clock timing.
+ *
+ * Web Crypto's `crypto.subtle.verify` would also work, but requires a
+ * `CryptoKey` object and is asymmetric (verify a signature against a key).
+ * For our case — comparing two pre-computed digests — raw byte equality
+ * is the correct primitive.
+ *
+ * @see https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b
+ * @see https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/verify
+ */
+/**
+ * Returns true iff `a` and `b` have identical bytes. Takes time
+ * proportional to `a.length` regardless of where bytes differ.
+ *
+ * @throws TypeError if either argument is not a Uint8Array.
+ */
+declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
+
+/**
+ * Read a Web `Request` body as a raw string EXACTLY ONCE and expose it
+ * alongside the original request (which remains readable by downstream
+ * code). Enforces a configurable `maxBodyBytes` cap to prevent OOM via
+ * pathological POST.
+ *
+ * MUST be called FIRST in the webhook pipeline, before any other code
+ * touches the body (`request.text()`, `request.json()`, parsers). Once
+ * the body is consumed, `Request.clone()` throws and this function fails.
+ *
+ * EC-101: default `maxBodyBytes = 1_000_000` (1 MB) covers Stripe
+ * (256 KB max), Slack (4 MB but compressed), and is well below Node
+ * memory thresholds. GitHub webhooks up to 25 MB MUST opt in
+ * (`maxBodyBytes: 25_000_000`).
+ *
+ * @see https://docs.stripe.com/webhooks/signatures
+ * @see https://docs.github.com/en/webhooks/using-webhooks/best-practices-for-using-webhooks
+ */
+declare const DEFAULT_MAX_BODY_BYTES = 1000000;
+interface ReadRawBodyOptions {
+    /** Maximum bytes to read before throwing `BodyTooLargeError`. Defaults to 1 MB. */
+    maxBodyBytes?: number;
+}
+interface RawBodyResult {
+    /** UTF-8 decoded body (or empty string when no body present). */
+    rawBody: string;
+    /** The ORIGINAL request, still readable by downstream code. */
+    bodyClone: Request;
+}
+/**
+ * Thrown when the request body exceeds `maxBodyBytes`. Carries status
+ * 413 (Payload Too Large) and stable code `BODY_TOO_LARGE` so callers
+ * can map it to an HTTP response without sniffing the message.
+ */
+declare class BodyTooLargeError extends Error {
+    readonly limit: number;
+    readonly actualSeen: number;
+    readonly status = 413;
+    readonly code = "BODY_TOO_LARGE";
+    constructor(limit: number, actualSeen: number);
+}
+declare function readRawBody(request: Request, options?: ReadRawBodyOptions): Promise<RawBodyResult>;
+
+/**
+ * Webhook primitive types (R0.5.10).
+ *
+ * @see docs/adr/0005-webhook-verify-inline-function.md
+ */
+type VerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * A verify function — pure, async-or-sync. Takes the cloned request
+ * (raw body NOT yet consumed by handler), returns ok/notOk + reason.
+ *
+ * Per ADR-0005, helper factories (`stripe`, `github`, `slack`) return
+ * this shape. Users can also write inline `verify: async (req) => ...`
+ * for custom providers.
+ */
+type VerifyFn = (req: Request) => Promise<VerifyResult> | VerifyResult;
+interface WebhookContext {
+    /** The cloned Request (still readable by user code). */
+    readonly request: Request;
+    /** Raw body bytes as UTF-8 string — already-verified at this point. */
+    readonly rawBody: string;
+    /** W3C trace_id propagated from request. */
+    readonly traceId: string;
+    /** Abort signal triggered by client disconnect or server stop. */
+    readonly signal: AbortSignal;
+}
+interface DefineWebhookOptions {
+    verify: VerifyFn;
+    handler: (ctx: WebhookContext) => unknown;
+    /** Override `readRawBody` body size cap (EC-101). Default 1MB. */
+    maxBodyBytes?: number;
+}
+interface WebhookDefinition {
+    readonly verify: VerifyFn;
+    readonly handler: (ctx: WebhookContext) => unknown;
+    readonly maxBodyBytes?: number;
+    /** Discriminator for runtime dispatch. */
+    readonly __theokit_kind: 'webhook';
+}
+
+/**
+ * Declare a webhook handler with first-class signature verification
+ * (R0.5.10, ADR-0005). Pure identity helper — returns the definition
+ * unchanged for downstream dispatch.
+ *
+ * @example
+ * ```ts
+ * // server/webhooks/stripe.ts
+ * import { defineWebhook } from 'theokit/server'
+ * import { stripe } from 'theokit/server/webhook/providers'
+ *
+ * export default defineWebhook({
+ *   verify: stripe({ secret: process.env.STRIPE_WEBHOOK_SECRET! }),
+ *   async handler({ rawBody }) {
+ *     const event = JSON.parse(rawBody)
+ *     // ...
+ *     return new Response('ok')
+ *   },
+ * })
+ * ```
+ */
+declare function defineWebhook(opts: DefineWebhookOptions): WebhookDefinition;
+/**
+ * Dispatch a webhook request through the definition's verify → handler
+ * pipeline. Returns the handler's `Response` (or a wrapped one), or a
+ * 401/413 response when verification or body size guards trip.
+ *
+ * EC-101: enforces `maxBodyBytes` (default 1MB via readRawBody).
+ * EC-103: every throw from `verify` (sync or async) is treated as
+ * `{ok: false, reason: 'verify threw: <message>'}`. Handler NEVER
+ * invoked on verify failure.
+ */
+declare function dispatchWebhook(def: WebhookDefinition, request: Request): Promise<Response>;
+
+export { BodyTooLargeError, DEFAULT_MAX_BODY_BYTES, type DefineWebhookOptions, type RawBodyResult, type ReadRawBodyOptions, type VerifyFn, type VerifyResult, type WebhookContext, type WebhookDefinition, defineWebhook, dispatchWebhook, readRawBody, timingSafeEqual };

package/dist/server/webhook/index.js

@@ -0,0 +1,19 @@
+import {
+  BodyTooLargeError,
+  DEFAULT_MAX_BODY_BYTES,
+  defineWebhook,
+  dispatchWebhook,
+  readRawBody,
+  timingSafeEqual
+} from "../../chunk-UUFYP2UM.js";
+import "../../chunk-6NEXVBPY.js";
+import "../../chunk-DGUM43GV.js";
+export {
+  BodyTooLargeError,
+  DEFAULT_MAX_BODY_BYTES,
+  defineWebhook,
+  dispatchWebhook,
+  readRawBody,
+  timingSafeEqual
+};
+//# sourceMappingURL=index.js.map

package/dist/server/webhook/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/server-error-to-envelope-NO4CCAFQ.js

@@ -0,0 +1,8 @@
+import {
+  serverErrorToEnvelope
+} from "./chunk-TQYSPYKU.js";
+import "./chunk-DGUM43GV.js";
+export {
+  serverErrorToEnvelope
+};
+//# sourceMappingURL=server-error-to-envelope-NO4CCAFQ.js.map

package/dist/server-error-to-envelope-NO4CCAFQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/server-error-to-envelope-UJK6OWDJ.js

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import "./chunk-KT3MWNZG.js";
+
+// src/core/contracts/theo-error.ts
+var TheoError = class extends Error {
+  name = "TheoError";
+  code;
+  meta;
+  ext;
+  constructor(opts) {
+    super(opts.message, opts.cause !== void 0 ? { cause: opts.cause } : void 0);
+    this.code = opts.code;
+    this.meta = opts.meta;
+    this.ext = opts.ext;
+  }
+  /**
+   * The canonical envelope view of this error. Use when crossing the wire
+   * boundary or feeding telemetry — exposes the shape consumers can rely on
+   * without depending on the class identity.
+   */
+  get envelope() {
+    return {
+      code: this.code,
+      message: this.message,
+      cause: this.cause,
+      meta: this.meta,
+      ext: this.ext
+    };
+  }
+  /**
+   * JSON serialization — emits envelope shape only (no name/stack class
+   * internals). Per ADR D5, `meta.stack` is auto-stripped in non-dev to
+   * prevent accidental leak; other meta keys are preserved.
+   */
+  toJSON() {
+    const meta = this.meta ? sanitizeMeta(this.meta) : void 0;
+    return {
+      code: this.code,
+      message: this.message,
+      cause: this.cause,
+      meta,
+      ext: this.ext
+    };
+  }
+};
+function sanitizeMeta(meta) {
+  if (process.env.NODE_ENV === "development") {
+    return meta;
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(meta)) {
+    if (k === "stack") continue;
+    out[k] = v;
+  }
+  return out;
+}
+
+// src/core/contracts/server-error-to-envelope.ts
+var ERROR_NAME_TO_CODE = /* @__PURE__ */ new Map([
+  ["AuthRequiredError", "UNAUTHORIZED"],
+  ["FileTooLargeError", "PAYLOAD_TOO_LARGE"],
+  ["RequestBodyTooLargeError", "PAYLOAD_TOO_LARGE"],
+  ["BodyTooLargeError", "PAYLOAD_TOO_LARGE"],
+  // RouterConventionError reaches the wire only during dev-error overlay;
+  // INTERNAL_SERVER_ERROR is appropriate, but we add a HintExt-shaped ext
+  // with the migration guidance for the devtools display.
+  ["RouterConventionError", "INTERNAL_SERVER_ERROR"]
+]);
+var META_EXTRACTORS = /* @__PURE__ */ new Map([
+  [
+    "FileTooLargeError",
+    (err) => {
+      const e = err;
+      return {
+        truncatedFilenames: e.truncatedFilenames ?? [],
+        maxFileSize: e.maxFileSize
+      };
+    }
+  ],
+  [
+    "RouterConventionError",
+    (err) => {
+      const e = err;
+      return {
+        file: e.file,
+        suggestion: e.suggestion,
+        migrationUrl: e.migrationUrl
+      };
+    }
+  ]
+]);
+var EXT_BUILDERS = /* @__PURE__ */ new Map([
+  [
+    "RouterConventionError",
+    () => ({
+      hint: "Run `theokit migrate router` to convert dotted-basename routes to directory-nested form."
+    })
+  ]
+]);
+function serverErrorToEnvelope(value) {
+  if (value instanceof TheoError) {
+    return value.envelope;
+  }
+  if (!(value instanceof Error)) {
+    return {
+      code: "INTERNAL_SERVER_ERROR",
+      message: typeof value === "string" ? value : "Unknown error"
+    };
+  }
+  const name = value.name;
+  const code = ERROR_NAME_TO_CODE.get(name) ?? "INTERNAL_SERVER_ERROR";
+  const extractor = META_EXTRACTORS.get(name);
+  const extra = extractor ? extractor(value) : null;
+  const meta = { name };
+  if (extra) {
+    for (const [k, v] of Object.entries(extra)) {
+      if (v !== void 0) meta[k] = v;
+    }
+  }
+  const extBuilder = EXT_BUILDERS.get(name);
+  const ext = extBuilder ? extBuilder(value) : void 0;
+  return {
+    code,
+    message: value.message,
+    cause: value.cause,
+    meta,
+    ext
+  };
+}
+export {
+  serverErrorToEnvelope
+};
+//# sourceMappingURL=server-error-to-envelope-UJK6OWDJ.js.map

package/dist/server-error-to-envelope-UJK6OWDJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/contracts/theo-error.ts","../src/core/contracts/server-error-to-envelope.ts"],"sourcesContent":["/**\n * `TheoError` — envelope-emitting `Error` subclass per plan\n * g5-error-envelope-cross-layer v1.0 § Phase 1 / T1.2.\n *\n * Mirrors trpc's TRPCError ergonomic pattern (referencia:\n * trpc/packages/server/src/unstable-core-do-not-import/error/TRPCError.ts:65-87)\n * adapted for theokit's hybrid envelope model (blueprint Form 4).\n *\n * Per ADR D5: `meta.stack` is auto-stripped in non-dev builds when serialized\n * via `toJSON()` — defense against accidental stack leak to clients (encore\n * `json:\"-\"` analog).\n *\n * Lives in `core/contracts/` per architecture.md v3 invariant #3.\n */\n\nimport type { TheoErrorCode, TheoErrorEnvelope } from './error-envelope.js'\n\n/**\n * Constructor options. `code` and `message` are required; `cause` follows TC39\n * proposal-error-cause; `meta` and `ext` are opt-in per blueprint ADR D2.\n */\nexport interface TheoErrorOptions<TExt = unknown> {\n  readonly code: TheoErrorCode\n  readonly message: string\n  readonly cause?: unknown\n  readonly meta?: Record<string, unknown>\n  readonly ext?: TExt\n}\n\n/**\n * `TheoError` — envelope-emitting Error subclass. Use this anywhere in\n * `theokit/server`, route handlers, or middleware to emit a typed,\n * cross-layer-compatible error.\n *\n * Mirrors TRPCError pattern: `code` is required, `message` defaults to\n * code if omitted, `cause` chain is preserved via TC39 proposal-error-cause.\n */\nexport class TheoError<TExt = unknown> extends Error {\n  override readonly name = 'TheoError'\n  readonly code: TheoErrorCode\n  readonly meta?: Record<string, unknown>\n  readonly ext?: TExt\n\n  constructor(opts: TheoErrorOptions<TExt>) {\n    super(opts.message, opts.cause !== undefined ? { cause: opts.cause } : undefined)\n    this.code = opts.code\n    this.meta = opts.meta\n    this.ext = opts.ext\n  }\n\n  /**\n   * The canonical envelope view of this error. Use when crossing the wire\n   * boundary or feeding telemetry — exposes the shape consumers can rely on\n   * without depending on the class identity.\n   */\n  get envelope(): TheoErrorEnvelope<TExt> {\n    return {\n      code: this.code,\n      message: this.message,\n      cause: (this as Error & { cause?: unknown }).cause,\n      meta: this.meta,\n      ext: this.ext,\n    }\n  }\n\n  /**\n   * JSON serialization — emits envelope shape only (no name/stack class\n   * internals). Per ADR D5, `meta.stack` is auto-stripped in non-dev to\n   * prevent accidental leak; other meta keys are preserved.\n   */\n  toJSON(): TheoErrorEnvelope<TExt> {\n    const meta = this.meta ? sanitizeMeta(this.meta) : undefined\n    return {\n      code: this.code,\n      message: this.message,\n      cause: (this as Error & { cause?: unknown }).cause,\n      meta,\n      ext: this.ext,\n    }\n  }\n}\n\n/**\n * Strip server-only sensitive meta keys in non-dev builds. Per ADR D5,\n * `stack` is the canonical leak vector (trpc accidentally exposes it via\n * `config.isDev` even today — references/trpc getErrorShape.ts:29-31).\n * Default to safe-by-default; preserve in dev only.\n */\nfunction sanitizeMeta(meta: Record<string, unknown>): Record<string, unknown> | undefined {\n  // Treat anything other than NODE_ENV === 'development' as production-safe\n  // (CI, staging, production all strip). Matches the security posture in\n  // blueprint EC-5 (default STRICT).\n  if (process.env.NODE_ENV === 'development') {\n    return meta\n  }\n  const out: Record<string, unknown> = {}\n  for (const [k, v] of Object.entries(meta)) {\n    if (k === 'stack') continue\n    out[k] = v\n  }\n  return out\n}\n\n/**\n * Coerce any unknown value into a TheoError envelope.\n *\n * - If value is already a TheoError, returns it unchanged (no double-wrap).\n * - If value is a plain Error, wraps it as `INTERNAL_SERVER_ERROR` with\n *   `cause` chain preserving the original.\n * - Other values (string, undefined, object) are coerced safely with a\n *   meaningful message.\n *\n * Use at framework boundaries (route handler catch-all, middleware catch,\n * SDK egress) to ensure every error crossing the wire carries an envelope.\n */\nexport function fromUnknown(value: unknown): TheoError {\n  if (value instanceof TheoError) return value\n  if (value instanceof Error) {\n    return new TheoError({\n      code: 'INTERNAL_SERVER_ERROR',\n      message: value.message,\n      cause: value,\n    })\n  }\n  if (typeof value === 'string') {\n    return new TheoError({ code: 'INTERNAL_SERVER_ERROR', message: value })\n  }\n  if (value === undefined || value === null) {\n    return new TheoError({ code: 'INTERNAL_SERVER_ERROR', message: 'Unknown error' })\n  }\n  // Object / number / boolean / etc. — best-effort stringify\n  return new TheoError({\n    code: 'INTERNAL_SERVER_ERROR',\n    message: `Non-Error value thrown: ${safeStringify(value)}`,\n    cause: value,\n  })\n}\n\n/**\n * Best-effort stringify of an unknown value for error message context.\n * JSON.stringify first (preserves shape for diagnostics); on cycle/BigInt/symbol\n * failure, signal explicitly instead of falling back to `[object Object]`.\n */\nfunction safeStringify(value: unknown): string {\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  if (typeof value === 'bigint') return `${value.toString()}n`\n  if (typeof value === 'symbol') return value.toString()\n  try {\n    return JSON.stringify(value)\n  } catch {\n    return '[unstringifiable value]'\n  }\n}\n","/**\n * G5 T2.5 — server-side boundary translation per blueprint ADR D3.\n *\n * Translates ad-hoc Error class instances (FileTooLargeError,\n * AuthRequiredError, RouterConventionError, etc.) into the canonical\n * `TheoErrorEnvelope` shape at the wire boundary. This is the SINGLE\n * boundary translation point — class identities stay in place inside the\n * codebase (no invasive call-site rewrites), but the envelope is what\n * crosses to clients.\n *\n * Pure; no I/O. Lives in `core/contracts/` per architecture.md v3\n * invariant #3 (canonical home for shared client↔server types). This file\n * is the EXCEPTION-of-an-exception: it intentionally inspects Error names\n * by string instead of `instanceof` to avoid `core/contracts/` taking a\n * dependency on `server/`. The mapping table is small and grep-discoverable.\n */\n\nimport type { TheoErrorCode, TheoErrorEnvelope } from './error-envelope.js'\nimport { TheoError } from './theo-error.js'\n\n/**\n * Mapping from ad-hoc Error class name to envelope code. Add entries here\n * when a new ad-hoc Error is introduced anywhere in `theokit/server/`.\n * Build-time errors (Duplicate*, ActionScanError, InvalidPluginShapeError)\n * are NOT in this table by design — they never cross the wire boundary,\n * so their canonical shape is `INTERNAL_SERVER_ERROR` via the default branch.\n */\nconst ERROR_NAME_TO_CODE: ReadonlyMap<string, TheoErrorCode> = new Map<string, TheoErrorCode>([\n  ['AuthRequiredError', 'UNAUTHORIZED'],\n  ['FileTooLargeError', 'PAYLOAD_TOO_LARGE'],\n  ['RequestBodyTooLargeError', 'PAYLOAD_TOO_LARGE'],\n  ['BodyTooLargeError', 'PAYLOAD_TOO_LARGE'],\n  // RouterConventionError reaches the wire only during dev-error overlay;\n  // INTERNAL_SERVER_ERROR is appropriate, but we add a HintExt-shaped ext\n  // with the migration guidance for the devtools display.\n  ['RouterConventionError', 'INTERNAL_SERVER_ERROR'],\n])\n\ntype MetaExtractor = (err: Error) => Record<string, unknown> | null\n\n/**\n * Class-specific metadata extractors. Each function receives the raw Error\n * and returns an object merged into envelope.meta (excluding name/message\n * which are reserved).\n */\nconst META_EXTRACTORS: ReadonlyMap<string, MetaExtractor> = new Map<string, MetaExtractor>([\n  [\n    'FileTooLargeError',\n    (err) => {\n      const e = err as Error & { truncatedFilenames?: string[]; maxFileSize?: number }\n      return {\n        truncatedFilenames: e.truncatedFilenames ?? [],\n        maxFileSize: e.maxFileSize,\n      }\n    },\n  ],\n  [\n    'RouterConventionError',\n    (err) => {\n      const e = err as Error & { file?: string; suggestion?: string; migrationUrl?: string }\n      return {\n        file: e.file,\n        suggestion: e.suggestion,\n        migrationUrl: e.migrationUrl,\n      }\n    },\n  ],\n])\n\ntype ExtBuilder = (err: Error) => unknown\n\n/**\n * Class-specific ext (extension slot) builders. RouterConventionError ships a\n * HintExt-shaped `{ hint }` so devtools / dev overlay can render the actionable\n * migration tip directly.\n */\nconst EXT_BUILDERS: ReadonlyMap<string, ExtBuilder> = new Map<string, ExtBuilder>([\n  [\n    'RouterConventionError',\n    () => ({\n      hint: 'Run `theokit migrate router` to convert dotted-basename routes to directory-nested form.',\n    }),\n  ],\n])\n\n/**\n * Translate any server-side Error instance into a canonical envelope.\n *\n * Pass-through behavior:\n * - `TheoError` instances return their `.envelope` unchanged.\n * - Plain `Error` with unknown name → `INTERNAL_SERVER_ERROR`.\n * - Non-Error values → wrapped via `TheoError.fromUnknown` semantics.\n *\n * Meta carries the source class `name` plus class-specific fields when an\n * extractor is registered. This keeps wire-side telemetry useful without\n * leaking implementation details.\n */\nexport function serverErrorToEnvelope(value: unknown): TheoErrorEnvelope {\n  if (value instanceof TheoError) {\n    return value.envelope\n  }\n  if (!(value instanceof Error)) {\n    return {\n      code: 'INTERNAL_SERVER_ERROR',\n      message: typeof value === 'string' ? value : 'Unknown error',\n    }\n  }\n  const name = value.name\n  const code = ERROR_NAME_TO_CODE.get(name) ?? 'INTERNAL_SERVER_ERROR'\n  const extractor = META_EXTRACTORS.get(name)\n  const extra = extractor ? extractor(value) : null\n  const meta: Record<string, unknown> = { name }\n  if (extra) {\n    for (const [k, v] of Object.entries(extra)) {\n      if (v !== undefined) meta[k] = v\n    }\n  }\n  const extBuilder = EXT_BUILDERS.get(name)\n  const ext = extBuilder ? extBuilder(value) : undefined\n  return {\n    code,\n    message: value.message,\n    cause: (value as Error & { cause?: unknown }).cause,\n    meta,\n    ext,\n  }\n}\n"],"mappings":";;;;;AAqCO,IAAM,YAAN,cAAwC,MAAM;AAAA,EACjC,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAA8B;AACxC,UAAM,KAAK,SAAS,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,MAAS;AAChF,SAAK,OAAO,KAAK;AACjB,SAAK,OAAO,KAAK;AACjB,SAAK,MAAM,KAAK;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,WAAoC;AACtC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,OAAQ,KAAqC;AAAA,MAC7C,MAAM,KAAK;AAAA,MACX,KAAK,KAAK;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAkC;AAChC,UAAM,OAAO,KAAK,OAAO,aAAa,KAAK,IAAI,IAAI;AACnD,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,OAAQ,KAAqC;AAAA,MAC7C;AAAA,MACA,KAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAQA,SAAS,aAAa,MAAoE;AAIxF,MAAI,QAAQ,IAAI,aAAa,eAAe;AAC1C,WAAO;AAAA,EACT;AACA,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,QAAI,MAAM,QAAS;AACnB,QAAI,CAAC,IAAI;AAAA,EACX;AACA,SAAO;AACT;;;AC1EA,IAAM,qBAAyD,oBAAI,IAA2B;AAAA,EAC5F,CAAC,qBAAqB,cAAc;AAAA,EACpC,CAAC,qBAAqB,mBAAmB;AAAA,EACzC,CAAC,4BAA4B,mBAAmB;AAAA,EAChD,CAAC,qBAAqB,mBAAmB;AAAA;AAAA;AAAA;AAAA,EAIzC,CAAC,yBAAyB,uBAAuB;AACnD,CAAC;AASD,IAAM,kBAAsD,oBAAI,IAA2B;AAAA,EACzF;AAAA,IACE;AAAA,IACA,CAAC,QAAQ;AACP,YAAM,IAAI;AACV,aAAO;AAAA,QACL,oBAAoB,EAAE,sBAAsB,CAAC;AAAA,QAC7C,aAAa,EAAE;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA,CAAC,QAAQ;AACP,YAAM,IAAI;AACV,aAAO;AAAA,QACL,MAAM,EAAE;AAAA,QACR,YAAY,EAAE;AAAA,QACd,cAAc,EAAE;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACF,CAAC;AASD,IAAM,eAAgD,oBAAI,IAAwB;AAAA,EAChF;AAAA,IACE;AAAA,IACA,OAAO;AAAA,MACL,MAAM;AAAA,IACR;AAAA,EACF;AACF,CAAC;AAcM,SAAS,sBAAsB,OAAmC;AACvE,MAAI,iBAAiB,WAAW;AAC9B,WAAO,MAAM;AAAA,EACf;AACA,MAAI,EAAE,iBAAiB,QAAQ;AAC7B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,OAAO,UAAU,WAAW,QAAQ;AAAA,IAC/C;AAAA,EACF;AACA,QAAM,OAAO,MAAM;AACnB,QAAM,OAAO,mBAAmB,IAAI,IAAI,KAAK;AAC7C,QAAM,YAAY,gBAAgB,IAAI,IAAI;AAC1C,QAAM,QAAQ,YAAY,UAAU,KAAK,IAAI;AAC7C,QAAM,OAAgC,EAAE,KAAK;AAC7C,MAAI,OAAO;AACT,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,MAAM,OAAW,MAAK,CAAC,IAAI;AAAA,IACjC;AAAA,EACF;AACA,QAAM,aAAa,aAAa,IAAI,IAAI;AACxC,QAAM,MAAM,aAAa,WAAW,KAAK,IAAI;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM;AAAA,IACf,OAAQ,MAAsC;AAAA,IAC9C;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/services-json-Z2QNGVPW.js

@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import "./chunk-KT3MWNZG.js";
+
+// src/cli/commands/migrate/services-json.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { basename, join, resolve } from "path";
+function isDns1123(s) {
+  if (s.length === 0 || s.length > 63) return false;
+  for (let i = 0; i < s.length; i += 1) {
+    const c = s.charCodeAt(i);
+    const isLower = c >= 97 && c <= 122;
+    const isDigit = c >= 48 && c <= 57;
+    const isHyphen = c === 45;
+    if (!(isLower || isDigit || isHyphen)) return false;
+    if (i === 0 && isHyphen) return false;
+    if (i === s.length - 1 && isHyphen) return false;
+  }
+  return true;
+}
+function slugify(input) {
+  const lowered = input.toLowerCase();
+  let result = "";
+  let lastWasHyphen = false;
+  for (let i = 0; i < lowered.length; i += 1) {
+    const ch = lowered.charAt(i);
+    const code = lowered.charCodeAt(i);
+    const isLower = code >= 97 && code <= 122;
+    const isDigit = code >= 48 && code <= 57;
+    if (isLower || isDigit) {
+      result += ch;
+      lastWasHyphen = false;
+      continue;
+    }
+    if ((ch === "-" || ch === "_") && !lastWasHyphen && result.length > 0) {
+      result += "-";
+      lastWasHyphen = true;
+    }
+  }
+  while (result.endsWith("-")) result = result.slice(0, -1);
+  return result.slice(0, 63);
+}
+function configDeclaresName(source) {
+  const start = source.indexOf("defineConfig(");
+  if (start < 0) return false;
+  return /\bname\s*:\s*['"]/u.test(source.slice(start));
+}
+function injectName(source, projectName) {
+  if (configDeclaresName(source)) return source;
+  return source.replace(/(defineConfig\(\s*\{)([\s\S])/u, (_match, head, next) => {
+    const nl = next === "\n" || next === "\r" ? next : "\n";
+    return `${head}
+  name: '${projectName}',${nl === "\n" ? "" : nl}`;
+  });
+}
+function fromPackageJson(pkgPath) {
+  if (!existsSync(pkgPath)) return null;
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    if (typeof pkg.name !== "string" || pkg.name.length === 0) return null;
+    const candidate = slugify(pkg.name);
+    return isDns1123(candidate) ? { projectName: candidate, source: "package-json" } : null;
+  } catch {
+    return null;
+  }
+}
+function fromDirectoryBasename(cwd) {
+  const candidate = slugify(basename(resolve(cwd)));
+  return isDns1123(candidate) ? { projectName: candidate, source: "directory" } : null;
+}
+function resolveProjectName(opts, cwd, pkgPath) {
+  if (opts.name !== void 0 && opts.name.length > 0) {
+    return { projectName: opts.name, source: "flag" };
+  }
+  return fromPackageJson(pkgPath) ?? fromDirectoryBasename(cwd) ?? {
+    projectName: "services-bundle",
+    source: "fallback"
+  };
+}
+function planServicesJsonMigration(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const configPath = opts.configPath ?? join(cwd, "theo.config.ts");
+  const pkgPath = opts.pkgPath ?? join(cwd, "package.json");
+  const configSource = existsSync(configPath) ? readFileSync(configPath, "utf-8") : "";
+  const alreadyMigrated = configSource.length > 0 ? configDeclaresName(configSource) : false;
+  const resolution = resolveProjectName(opts, cwd, pkgPath);
+  const warning = resolution.source === "fallback" ? "Using fallback project name `services-bundle`. This preserves the Gitea repo lineage shipped by Plan B v3.1 (zero downtime). To adopt a new project name, re-run with `--name <slug>` and coordinate the ArgoCD App rewire." : "";
+  if (!isDns1123(resolution.projectName)) {
+    throw new Error(
+      `services-json migrate: resolved project name "${resolution.projectName}" is not DNS-1123 (1-63 chars, lowercase alphanumeric+hyphens, no leading/trailing hyphen). Re-run with --name <slug>.`
+    );
+  }
+  return {
+    projectName: resolution.projectName,
+    source: resolution.source,
+    alreadyMigrated,
+    warning
+  };
+}
+function servicesJsonMigrateCommand(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const configPath = opts.configPath ?? join(cwd, "theo.config.ts");
+  const log = (m) => {
+    if (opts.silent === true) return;
+    process.stdout.write(`${m}
+`);
+  };
+  if (!existsSync(configPath)) {
+    return Promise.reject(
+      new Error(`services-json migrate: ${configPath} not found. Run from a TheoKit project root.`)
+    );
+  }
+  const plan = planServicesJsonMigration(opts);
+  log(`  \u2022 Resolved project name: '${plan.projectName}' (source: ${plan.source})`);
+  if (plan.warning.length > 0) log(`  \u26A0 ${plan.warning}`);
+  if (plan.alreadyMigrated) {
+    log("  \u2713 theo.config.ts already declares `name` \u2014 nothing to do (idempotent).");
+    return Promise.resolve();
+  }
+  if (opts.dryRun === true) {
+    log("  \u2022 Dry-run: would inject `name` into theo.config.ts (no write).");
+    return Promise.resolve();
+  }
+  const before = readFileSync(configPath, "utf-8");
+  const after = injectName(before, plan.projectName);
+  if (after === before) {
+    log("  \u26A0 Could not locate `defineConfig({ ... })` block. Add `name: '<slug>',` manually.");
+    return Promise.resolve();
+  }
+  writeFileSync(configPath, after, "utf-8");
+  log(`  \u2713 Injected name='${plan.projectName}' into theo.config.ts`);
+  log("  \u2022 Next: re-run `theokit build --target theo-cloud` to emit services.json v2.");
+  return Promise.resolve();
+}
+export {
+  configDeclaresName,
+  injectName,
+  planServicesJsonMigration,
+  servicesJsonMigrateCommand,
+  slugify
+};
+//# sourceMappingURL=services-json-Z2QNGVPW.js.map

package/dist/services-json-Z2QNGVPW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/migrate/services-json.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time codemod: paths are derived from `<cwd>/theo.config.ts` (or\n * the supplied `--config` arg). No HTTP input reaches these fs calls.\n */\n/**\n * Plan v1.2 T2.3 + EC-2 — `theokit migrate services-json-v1-to-v2`.\n *\n * Idempotent codemod that injects a top-level `name` field into\n * `theo.config.ts` (and refreshes `.theo/services.json` if a build artifact\n * exists). When the resolved `name` would be `services-bundle`, the codemod\n * emits an actionable warning so the operator can decide between:\n *   a) keeping `services-bundle` (zero-downtime — preserves the Gitea repo\n *      lineage shipped by Plan B v3.1); or\n *   b) renaming to a new project — requires ArgoCD App rewire downtime.\n *\n * Inputs (in order of precedence):\n *   1) explicit `--name <slug>` CLI argument\n *   2) `package.json` `name` field (slugified to DNS-1123)\n *   3) directory basename\n *   4) `services-bundle` fallback with a warning\n */\nimport { existsSync, readFileSync, writeFileSync } from 'node:fs'\nimport { basename, join, resolve } from 'node:path'\n\nexport interface ServicesJsonMigrateOptions {\n  /** Override theo.config.ts path. Defaults to `<cwd>/theo.config.ts`. */\n  configPath?: string\n  /** Override package.json path. Defaults to `<cwd>/package.json`. */\n  pkgPath?: string\n  /** Explicit project name. When set, bypasses package.json / dir-basename. */\n  name?: string\n  /** When true, prints the plan but performs no writes. */\n  dryRun?: boolean\n  /** When true, suppresses stdout (used in tests). */\n  silent?: boolean\n  /** When set, treats this as the working directory (defaults to process.cwd). */\n  cwd?: string\n}\n\nexport interface ServicesJsonMigratePlan {\n  /** The DNS-1123 project name that will land in theo.config.ts. */\n  projectName: string\n  /** Reason describing where the name came from. */\n  source: 'flag' | 'package-json' | 'directory' | 'fallback'\n  /** Whether `theo.config.ts` already declared `name`. */\n  alreadyMigrated: boolean\n  /** Warning string when projectName=services-bundle. Empty otherwise. */\n  warning: string\n}\n\n// Canonical DNS-1123 anchor. Equivalent to ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$\n// but split into explicit single-char anchors so neither security/detect-\n// unsafe-regex nor sonarjs/slow-regex flag it (linear scan, no backtracking\n// hot paths over arbitrary input).\nfunction isDns1123(s: string): boolean {\n  if (s.length === 0 || s.length > 63) return false\n  for (let i = 0; i < s.length; i += 1) {\n    const c = s.charCodeAt(i)\n    const isLower = c >= 0x61 && c <= 0x7a\n    const isDigit = c >= 0x30 && c <= 0x39\n    const isHyphen = c === 0x2d\n    if (!(isLower || isDigit || isHyphen)) return false\n    if (i === 0 && isHyphen) return false\n    if (i === s.length - 1 && isHyphen) return false\n  }\n  return true\n}\n\n/**\n * Best-effort slugifier: lowercases, replaces underscores with hyphens,\n * drops invalid characters, collapses repeated hyphens, trims leading /\n * trailing hyphens. Returns empty string when nothing survives.\n */\nexport function slugify(input: string): string {\n  const lowered = input.toLowerCase()\n  let result = ''\n  let lastWasHyphen = false\n  for (let i = 0; i < lowered.length; i += 1) {\n    const ch = lowered.charAt(i)\n    const code = lowered.charCodeAt(i)\n    const isLower = code >= 0x61 && code <= 0x7a\n    const isDigit = code >= 0x30 && code <= 0x39\n    if (isLower || isDigit) {\n      result += ch\n      lastWasHyphen = false\n      continue\n    }\n    if ((ch === '-' || ch === '_') && !lastWasHyphen && result.length > 0) {\n      result += '-'\n      lastWasHyphen = true\n    }\n  }\n  while (result.endsWith('-')) result = result.slice(0, -1)\n  return result.slice(0, 63)\n}\n\n/** Returns `true` when `theo.config.ts` source already declares `name: …`. */\nexport function configDeclaresName(source: string): boolean {\n  // Linear scan instead of `[\\s\\S]*?` lookahead so sonarjs/slow-regex\n  // stays clean (no super-linear backtracking). We anchor on `defineConfig(`\n  // then walk forward looking for `name:` inside the literal block.\n  const start = source.indexOf('defineConfig(')\n  if (start < 0) return false\n  return /\\bname\\s*:\\s*['\"]/u.test(source.slice(start))\n}\n\n/**\n * Inject `name: <project>,` into the first `defineConfig({ ... })` call.\n * Idempotent: when the config already declares `name`, returns the source\n * untouched.\n */\nexport function injectName(source: string, projectName: string): string {\n  if (configDeclaresName(source)) return source\n  return source.replace(/(defineConfig\\(\\s*\\{)([\\s\\S])/u, (_match, head: string, next: string) => {\n    // Preserve existing whitespace style by sniffing the next character.\n    const nl = next === '\\n' || next === '\\r' ? next : '\\n'\n    return `${head}\\n  name: '${projectName}',${nl === '\\n' ? '' : nl}`\n  })\n}\n\ninterface CandidateResolution {\n  projectName: string\n  source: ServicesJsonMigratePlan['source']\n}\n\nfunction fromPackageJson(pkgPath: string): CandidateResolution | null {\n  if (!existsSync(pkgPath)) return null\n  try {\n    const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')) as { name?: string }\n    if (typeof pkg.name !== 'string' || pkg.name.length === 0) return null\n    const candidate = slugify(pkg.name)\n    return isDns1123(candidate) ? { projectName: candidate, source: 'package-json' } : null\n  } catch {\n    return null\n  }\n}\n\nfunction fromDirectoryBasename(cwd: string): CandidateResolution | null {\n  const candidate = slugify(basename(resolve(cwd)))\n  return isDns1123(candidate) ? { projectName: candidate, source: 'directory' } : null\n}\n\nfunction resolveProjectName(\n  opts: ServicesJsonMigrateOptions,\n  cwd: string,\n  pkgPath: string,\n): CandidateResolution {\n  if (opts.name !== undefined && opts.name.length > 0) {\n    return { projectName: opts.name, source: 'flag' }\n  }\n  return (\n    fromPackageJson(pkgPath) ??\n    fromDirectoryBasename(cwd) ?? {\n      projectName: 'services-bundle',\n      source: 'fallback',\n    }\n  )\n}\n\nexport function planServicesJsonMigration(\n  opts: ServicesJsonMigrateOptions,\n): ServicesJsonMigratePlan {\n  const cwd = opts.cwd ?? process.cwd()\n  const configPath = opts.configPath ?? join(cwd, 'theo.config.ts')\n  const pkgPath = opts.pkgPath ?? join(cwd, 'package.json')\n\n  const configSource = existsSync(configPath) ? readFileSync(configPath, 'utf-8') : ''\n  const alreadyMigrated = configSource.length > 0 ? configDeclaresName(configSource) : false\n\n  const resolution = resolveProjectName(opts, cwd, pkgPath)\n  const warning =\n    resolution.source === 'fallback'\n      ? 'Using fallback project name `services-bundle`. This preserves the Gitea ' +\n        'repo lineage shipped by Plan B v3.1 (zero downtime). To adopt a new project ' +\n        'name, re-run with `--name <slug>` and coordinate the ArgoCD App rewire.'\n      : ''\n\n  if (!isDns1123(resolution.projectName)) {\n    throw new Error(\n      `services-json migrate: resolved project name \"${resolution.projectName}\" is not DNS-1123 ` +\n        '(1-63 chars, lowercase alphanumeric+hyphens, no leading/trailing hyphen). Re-run with --name <slug>.',\n    )\n  }\n\n  return {\n    projectName: resolution.projectName,\n    source: resolution.source,\n    alreadyMigrated,\n    warning,\n  }\n}\n\n// Returns void; not async — kept Promise-bearing via the CLI dispatcher's\n// `await` site by wrapping into Promise.resolve(...) on the call boundary.\nexport function servicesJsonMigrateCommand(opts: ServicesJsonMigrateOptions): Promise<void> {\n  const cwd = opts.cwd ?? process.cwd()\n  const configPath = opts.configPath ?? join(cwd, 'theo.config.ts')\n  const log = (m: string): void => {\n    if (opts.silent === true) return\n    process.stdout.write(`${m}\\n`)\n  }\n\n  if (!existsSync(configPath)) {\n    return Promise.reject(\n      new Error(`services-json migrate: ${configPath} not found. Run from a TheoKit project root.`),\n    )\n  }\n\n  const plan = planServicesJsonMigration(opts)\n  log(`  • Resolved project name: '${plan.projectName}' (source: ${plan.source})`)\n  if (plan.warning.length > 0) log(`  ⚠ ${plan.warning}`)\n\n  if (plan.alreadyMigrated) {\n    log('  ✓ theo.config.ts already declares `name` — nothing to do (idempotent).')\n    return Promise.resolve()\n  }\n\n  if (opts.dryRun === true) {\n    log('  • Dry-run: would inject `name` into theo.config.ts (no write).')\n    return Promise.resolve()\n  }\n\n  const before = readFileSync(configPath, 'utf-8')\n  const after = injectName(before, plan.projectName)\n  if (after === before) {\n    log(\"  ⚠ Could not locate `defineConfig({ ... })` block. Add `name: '<slug>',` manually.\")\n    return Promise.resolve()\n  }\n  writeFileSync(configPath, after, 'utf-8')\n  log(`  ✓ Injected name='${plan.projectName}' into theo.config.ts`)\n  log('  • Next: re-run `theokit build --target theo-cloud` to emit services.json v2.')\n  return Promise.resolve()\n}\n"],"mappings":";;;;;AAqBA,SAAS,YAAY,cAAc,qBAAqB;AACxD,SAAS,UAAU,MAAM,eAAe;AAgCxC,SAAS,UAAU,GAAoB;AACrC,MAAI,EAAE,WAAW,KAAK,EAAE,SAAS,GAAI,QAAO;AAC5C,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK,GAAG;AACpC,UAAM,IAAI,EAAE,WAAW,CAAC;AACxB,UAAM,UAAU,KAAK,MAAQ,KAAK;AAClC,UAAM,UAAU,KAAK,MAAQ,KAAK;AAClC,UAAM,WAAW,MAAM;AACvB,QAAI,EAAE,WAAW,WAAW,UAAW,QAAO;AAC9C,QAAI,MAAM,KAAK,SAAU,QAAO;AAChC,QAAI,MAAM,EAAE,SAAS,KAAK,SAAU,QAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAOO,SAAS,QAAQ,OAAuB;AAC7C,QAAM,UAAU,MAAM,YAAY;AAClC,MAAI,SAAS;AACb,MAAI,gBAAgB;AACpB,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,GAAG;AAC1C,UAAM,KAAK,QAAQ,OAAO,CAAC;AAC3B,UAAM,OAAO,QAAQ,WAAW,CAAC;AACjC,UAAM,UAAU,QAAQ,MAAQ,QAAQ;AACxC,UAAM,UAAU,QAAQ,MAAQ,QAAQ;AACxC,QAAI,WAAW,SAAS;AACtB,gBAAU;AACV,sBAAgB;AAChB;AAAA,IACF;AACA,SAAK,OAAO,OAAO,OAAO,QAAQ,CAAC,iBAAiB,OAAO,SAAS,GAAG;AACrE,gBAAU;AACV,sBAAgB;AAAA,IAClB;AAAA,EACF;AACA,SAAO,OAAO,SAAS,GAAG,EAAG,UAAS,OAAO,MAAM,GAAG,EAAE;AACxD,SAAO,OAAO,MAAM,GAAG,EAAE;AAC3B;AAGO,SAAS,mBAAmB,QAAyB;AAI1D,QAAM,QAAQ,OAAO,QAAQ,eAAe;AAC5C,MAAI,QAAQ,EAAG,QAAO;AACtB,SAAO,qBAAqB,KAAK,OAAO,MAAM,KAAK,CAAC;AACtD;AAOO,SAAS,WAAW,QAAgB,aAA6B;AACtE,MAAI,mBAAmB,MAAM,EAAG,QAAO;AACvC,SAAO,OAAO,QAAQ,kCAAkC,CAAC,QAAQ,MAAc,SAAiB;AAE9F,UAAM,KAAK,SAAS,QAAQ,SAAS,OAAO,OAAO;AACnD,WAAO,GAAG,IAAI;AAAA,WAAc,WAAW,KAAK,OAAO,OAAO,KAAK,EAAE;AAAA,EACnE,CAAC;AACH;AAOA,SAAS,gBAAgB,SAA6C;AACpE,MAAI,CAAC,WAAW,OAAO,EAAG,QAAO;AACjC,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,aAAa,SAAS,OAAO,CAAC;AACrD,QAAI,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,WAAW,EAAG,QAAO;AAClE,UAAM,YAAY,QAAQ,IAAI,IAAI;AAClC,WAAO,UAAU,SAAS,IAAI,EAAE,aAAa,WAAW,QAAQ,eAAe,IAAI;AAAA,EACrF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,sBAAsB,KAAyC;AACtE,QAAM,YAAY,QAAQ,SAAS,QAAQ,GAAG,CAAC,CAAC;AAChD,SAAO,UAAU,SAAS,IAAI,EAAE,aAAa,WAAW,QAAQ,YAAY,IAAI;AAClF;AAEA,SAAS,mBACP,MACA,KACA,SACqB;AACrB,MAAI,KAAK,SAAS,UAAa,KAAK,KAAK,SAAS,GAAG;AACnD,WAAO,EAAE,aAAa,KAAK,MAAM,QAAQ,OAAO;AAAA,EAClD;AACA,SACE,gBAAgB,OAAO,KACvB,sBAAsB,GAAG,KAAK;AAAA,IAC5B,aAAa;AAAA,IACb,QAAQ;AAAA,EACV;AAEJ;AAEO,SAAS,0BACd,MACyB;AACzB,QAAM,MAAM,KAAK,OAAO,QAAQ,IAAI;AACpC,QAAM,aAAa,KAAK,cAAc,KAAK,KAAK,gBAAgB;AAChE,QAAM,UAAU,KAAK,WAAW,KAAK,KAAK,cAAc;AAExD,QAAM,eAAe,WAAW,UAAU,IAAI,aAAa,YAAY,OAAO,IAAI;AAClF,QAAM,kBAAkB,aAAa,SAAS,IAAI,mBAAmB,YAAY,IAAI;AAErF,QAAM,aAAa,mBAAmB,MAAM,KAAK,OAAO;AACxD,QAAM,UACJ,WAAW,WAAW,aAClB,gOAGA;AAEN,MAAI,CAAC,UAAU,WAAW,WAAW,GAAG;AACtC,UAAM,IAAI;AAAA,MACR,iDAAiD,WAAW,WAAW;AAAA,IAEzE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,aAAa,WAAW;AAAA,IACxB,QAAQ,WAAW;AAAA,IACnB;AAAA,IACA;AAAA,EACF;AACF;AAIO,SAAS,2BAA2B,MAAiD;AAC1F,QAAM,MAAM,KAAK,OAAO,QAAQ,IAAI;AACpC,QAAM,aAAa,KAAK,cAAc,KAAK,KAAK,gBAAgB;AAChE,QAAM,MAAM,CAAC,MAAoB;AAC/B,QAAI,KAAK,WAAW,KAAM;AAC1B,YAAQ,OAAO,MAAM,GAAG,CAAC;AAAA,CAAI;AAAA,EAC/B;AAEA,MAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAO,QAAQ;AAAA,MACb,IAAI,MAAM,0BAA0B,UAAU,8CAA8C;AAAA,IAC9F;AAAA,EACF;AAEA,QAAM,OAAO,0BAA0B,IAAI;AAC3C,MAAI,oCAA+B,KAAK,WAAW,cAAc,KAAK,MAAM,GAAG;AAC/E,MAAI,KAAK,QAAQ,SAAS,EAAG,KAAI,YAAO,KAAK,OAAO,EAAE;AAEtD,MAAI,KAAK,iBAAiB;AACxB,QAAI,oFAA0E;AAC9E,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAEA,MAAI,KAAK,WAAW,MAAM;AACxB,QAAI,uEAAkE;AACtE,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAEA,QAAM,SAAS,aAAa,YAAY,OAAO;AAC/C,QAAM,QAAQ,WAAW,QAAQ,KAAK,WAAW;AACjD,MAAI,UAAU,QAAQ;AACpB,QAAI,0FAAqF;AACzF,WAAO,QAAQ,QAAQ;AAAA,EACzB;AACA,gBAAc,YAAY,OAAO,OAAO;AACxC,MAAI,2BAAsB,KAAK,WAAW,uBAAuB;AACjE,MAAI,qFAAgF;AACpF,SAAO,QAAQ,QAAQ;AACzB;","names":[]}

package/dist/{services-typed-client-XWYYBWGW.js → services-typed-client-KK6RHRDG.js}

@@ -1,6 +1,6 @@
 import {
   generateTypedClient
-} from "./chunk-O4BLVPML.js";
+} from "./chunk-DNMSV3R3.js";
 import "./chunk-DGUM43GV.js";
 
 // src/vite-plugin/services-typed-client.ts
@@ -43,4 +43,4 @@ function servicesTypedClientPlugin(opts) {
 export {
   servicesTypedClientPlugin
 };
-//# sourceMappingURL=services-typed-client-XWYYBWGW.js.map
+//# sourceMappingURL=services-typed-client-KK6RHRDG.js.map

package/dist/{services-typed-client-ZX5JUHH3.js → services-typed-client-T7M5VPBP.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   generateTypedClient
-} from "./chunk-WZ7CPVQB.js";
+} from "./chunk-27LWMYNK.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/vite-plugin/services-typed-client.ts
@@ -45,4 +45,4 @@ function servicesTypedClientPlugin(opts) {
 export {
   servicesTypedClientPlugin
 };
-//# sourceMappingURL=services-typed-client-ZX5JUHH3.js.map
+//# sourceMappingURL=services-typed-client-T7M5VPBP.js.map

package/dist/{sqlite-vec-ARPNUBWT.js → sqlite-vec-54KB4RD3.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import "./chunk-KT3MWNZG.js";
 
-// ../../../theokit-plugins/node_modules/.pnpm/sqlite-vec@0.1.9/node_modules/sqlite-vec/index.mjs
+// ../../node_modules/.pnpm/sqlite-vec@0.1.9/node_modules/sqlite-vec/index.mjs
 import { fileURLToPath } from "url";
 import { arch, platform } from "process";
 var BASE_PACKAGE_NAME = "sqlite-vec";
@@ -38,4 +38,4 @@ export {
   getLoadablePath,
   load
 };
-//# sourceMappingURL=sqlite-vec-ARPNUBWT.js.map
+//# sourceMappingURL=sqlite-vec-54KB4RD3.js.map

package/dist/sqlite-vec-54KB4RD3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../node_modules/.pnpm/sqlite-vec@0.1.9/node_modules/sqlite-vec/index.mjs"],"sourcesContent":["\n\nimport { fileURLToPath } from \"node:url\";\nimport { arch, platform } from \"node:process\";\n\n\nconst BASE_PACKAGE_NAME = \"sqlite-vec\";\nconst ENTRYPOINT_BASE_NAME = \"vec0\";\nconst supportedPlatforms = [[\"darwin\",\"x64\"],[\"linux\",\"x64\"],[\"darwin\",\"arm64\"],[\"win32\",\"x64\"],[\"linux\",\"arm64\"]];\n\nconst invalidPlatformErrorMessage = `Unsupported platform for ${BASE_PACKAGE_NAME}, on a ${platform}-${arch} machine. Supported platforms are (${supportedPlatforms\n  .map(([p, a]) => `${p}-${a}`)\n  .join(\",\")}). Consult the ${BASE_PACKAGE_NAME} NPM package README for details.`;\n\nconst extensionNotFoundErrorMessage = packageName => `Loadble extension for ${BASE_PACKAGE_NAME} not found. Was the ${packageName} package installed?`;\n\nfunction validPlatform(platform, arch) {\n  return (\n    supportedPlatforms.find(([p, a]) => platform === p && arch === a) !== undefined\n  );\n}\nfunction extensionSuffix(platform) {\n  if (platform === \"win32\") return \"dll\";\n  if (platform === \"darwin\") return \"dylib\";\n  return \"so\";\n}\nfunction platformPackageName(platform, arch) {\n  const os = platform === \"win32\" ? \"windows\" : platform;\n  return `${BASE_PACKAGE_NAME}-${os}-${arch}`;\n}\n\nfunction getLoadablePath() {\n  if (!validPlatform(platform, arch)) {\n    throw new Error(\n      invalidPlatformErrorMessage\n    );\n  }\n  const packageName = platformPackageName(platform, arch);\n  const loadablePath = fileURLToPath(import.meta.resolve(packageName + \"/\" + ENTRYPOINT_BASE_NAME + \".\" + extensionSuffix(platform)));\n  return loadablePath;\n}\n\nfunction load(db) {\n  db.loadExtension(getLoadablePath());\n}\n\nexport {getLoadablePath, load};\n"],"mappings":";;;;;AAEA,SAAS,qBAAqB;AAC9B,SAAS,MAAM,gBAAgB;AAG/B,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB,CAAC,CAAC,UAAS,KAAK,GAAE,CAAC,SAAQ,KAAK,GAAE,CAAC,UAAS,OAAO,GAAE,CAAC,SAAQ,KAAK,GAAE,CAAC,SAAQ,OAAO,CAAC;AAEjH,IAAM,8BAA8B,4BAA4B,iBAAiB,UAAU,QAAQ,IAAI,IAAI,sCAAsC,mBAC9I,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,EAC3B,KAAK,GAAG,CAAC,kBAAkB,iBAAiB;AAI/C,SAAS,cAAcA,WAAUC,OAAM;AACrC,SACE,mBAAmB,KAAK,CAAC,CAAC,GAAG,CAAC,MAAMD,cAAa,KAAKC,UAAS,CAAC,MAAM;AAE1E;AACA,SAAS,gBAAgBD,WAAU;AACjC,MAAIA,cAAa,QAAS,QAAO;AACjC,MAAIA,cAAa,SAAU,QAAO;AAClC,SAAO;AACT;AACA,SAAS,oBAAoBA,WAAUC,OAAM;AAC3C,QAAM,KAAKD,cAAa,UAAU,YAAYA;AAC9C,SAAO,GAAG,iBAAiB,IAAI,EAAE,IAAIC,KAAI;AAC3C;AAEA,SAAS,kBAAkB;AACzB,MAAI,CAAC,cAAc,UAAU,IAAI,GAAG;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,cAAc,oBAAoB,UAAU,IAAI;AACtD,QAAM,eAAe,cAAc,YAAY,QAAQ,cAAc,MAAM,uBAAuB,MAAM,gBAAgB,QAAQ,CAAC,CAAC;AAClI,SAAO;AACT;AAEA,SAAS,KAAK,IAAI;AAChB,KAAG,cAAc,gBAAgB,CAAC;AACpC;","names":["platform","arch"]}