theokit 0.4.0-beta.0 → 0.5.0

package/dist/csrf-BBrEZSBW.d.ts

@@ -0,0 +1,107 @@
+import { IncomingMessage } from 'node:http';
+import { A as AuditLogger } from './audit-log-BQWM5YLG.js';
+
+/**
+ * CSRF enforcement mode.
+ *
+ * - `off`     — skip CSRF entirely. Use only when you have another defense
+ *               (e.g. you don't ship session cookies, all auth is bearer).
+ * - `warn`    — log a structured warning when the check would fail, but
+ *               still serve the request. Default for 0.2.0. Migration mode.
+ * - `strict`  — reject failing requests with 403 + code `CSRF_INVALID`.
+ *               Will become the default in 0.3.0.
+ */
+type CsrfMode = 'off' | 'warn' | 'strict';
+/**
+ * Per-request structured logger surface. Only `warn` is used by enforceCsrf;
+ * we don't require a full Logger here so callers can pass a mock or the
+ * console directly.
+ */
+interface CsrfLogger {
+    warn: (payload: CsrfWarnPayload) => void;
+    /** Optional path the request was destined for — used for log correlation. */
+    path?: string;
+}
+/**
+ * T5.1 — Rails-inspired per-route escalation.
+ *
+ * `routes` accepts string (exact match) or RegExp entries. When a request
+ * path matches AND the request would otherwise emit a warning, the
+ * `behavior` field decides what happens:
+ *
+ *   - `'warn'`  → normal warn dispatch (no-op vs default)
+ *   - `'raise'` → escalate to 403 regardless of global `csrf` mode
+ *
+ * `'raise'` never downgrades: when global mode is `'off'`, validation is
+ * skipped entirely and disallowed dispatch never runs.
+ */
+interface DisallowedConfig {
+    routes: (string | RegExp)[];
+    behavior: 'warn' | 'raise';
+}
+/**
+ * Test whether `path` matches any of the supplied patterns. String
+ * patterns are EXACT (trailing slash matters — use RegExp for tolerance).
+ *
+ * EC-5: when a RegExp carries the `/g` flag, `.test()` mutates
+ * `lastIndex` and the next invocation may miss. We reset `lastIndex`
+ * before each test so the matcher is a pure function.
+ */
+declare function matchDisallowed(path: string, patterns: readonly (string | RegExp)[]): boolean;
+/**
+ * T2.2 — Stable cutover identifier shipped with every csrf.warn payload.
+ *
+ * Convention borrowed from Vite's `deprecations.ts:74` — a `code` plus a
+ * `docsUrl` lets users (a) grep their logs for a single stable identifier
+ * to find every csrf.warn line, and (b) click through directly to the
+ * migration guide. Strings are exported constants so the analyzer (T2.3)
+ * and migration guide can reference the same source of truth.
+ */
+declare const CSRF_WARN_CODE: "CSRF_STRICT_CUTOVER";
+declare const CSRF_WARN_DOCS_URL: "https://theokit.dev/upgrade/csrf-strict-cutover";
+interface CsrfWarnPayload {
+    event: 'csrf.warn';
+    method: string;
+    path: string | undefined;
+    reason: string;
+    /**
+     * Stable identifier for the 0.2 → 0.3 CSRF strict cutover. Always
+     * `'CSRF_STRICT_CUTOVER'`. Grep-able from prod logs.
+     */
+    code: string;
+    /**
+     * Link to the section of the migration guide explaining how to clear
+     * this specific warning class.
+     */
+    docsUrl: string;
+}
+declare function validateCsrf(req: IncomingMessage): {
+    valid: true;
+} | {
+    valid: false;
+    reason: string;
+};
+/**
+ * T5a.2 Phase B (slice 1/6) — Web-Standards-shaped CSRF validator.
+ *
+ * Mirror of `validateCsrf(req: IncomingMessage)` for the Web `Request`
+ * shape. Consumes `request.headers.get(name)` (native Web `Headers` API)
+ * instead of `req.headers[name]` (Node `IncomingMessage` indexer). Same
+ * CSRF policy + same return shape — the difference is only the input
+ * extraction.
+ *
+ * Used by `executeWebRequest` (T5a.2 Phase A) to enforce CSRF on the
+ * Web-Standards request handler entry-point.
+ */
+declare function validateCsrfRequest(request: Request): {
+    valid: true;
+} | {
+    valid: false;
+    reason: string;
+};
+declare function enforceCsrf(req: IncomingMessage, mode: CsrfMode, logger?: CsrfLogger, disallowed?: DisallowedConfig, auditLogger?: AuditLogger): {
+    allow: boolean;
+    reason?: string;
+};
+
+export { CSRF_WARN_CODE as C, type DisallowedConfig as D, CSRF_WARN_DOCS_URL as a, type CsrfLogger as b, type CsrfMode as c, type CsrfWarnPayload as d, enforceCsrf as e, validateCsrfRequest as f, matchDisallowed as m, validateCsrf as v };

package/dist/csrf-readiness-store-CjIoub3U.d.ts

@@ -0,0 +1,43 @@
+/**
+ * T2.2 — In-memory bounded counter for CSRF warn events.
+ *
+ * Aggregates `csrf.warn` payloads by `(method, path, reason)` triple.
+ * Used by the `/__theo/csrf-readiness` endpoint to expose a summary the
+ * developer (or devtools tab) can inspect, so users do NOT need to grep
+ * stdout to know which endpoints will break under 0.3.0 strict CSRF.
+ *
+ * Bounded at 1000 distinct keys (EC-22). Eviction is LRU-by-insertion —
+ * when the cap is hit, the oldest key is dropped and a re-record of an
+ * evicted key starts fresh (count: 1).
+ *
+ * Single-threaded by virtue of the JS event loop; Map operations are
+ * atomic. NOT shared across processes — each worker has its own store.
+ */
+interface CsrfWarnRecord {
+    method: string;
+    path: string;
+    reason: string;
+}
+interface CsrfReadinessRouteSummary {
+    method: string;
+    path: string;
+    reason: string;
+    count: number;
+    firstSeen: string;
+    lastSeen: string;
+}
+interface CsrfReadinessSummary {
+    generatedAt: string;
+    totalEvents: number;
+    routes: CsrfReadinessRouteSummary[];
+}
+declare class CsrfReadinessStore {
+    static readonly MAX_ENTRIES = 1000;
+    private readonly entries;
+    private keyFor;
+    record(event: CsrfWarnRecord): void;
+    summary(): CsrfReadinessSummary;
+    reset(): void;
+}
+
+export { CsrfReadinessStore as C, type CsrfReadinessRouteSummary as a, type CsrfReadinessSummary as b, type CsrfWarnRecord as c };

package/dist/define-websocket-CdK94O-D.d.ts

@@ -0,0 +1,64 @@
+import { IncomingMessage } from 'node:http';
+
+interface WebSocketLike {
+    send(data: string | Buffer): void;
+    close(code?: number, reason?: string): void;
+}
+interface WebSocketHandler {
+    onOpen?: (ws: WebSocketLike, req: IncomingMessage) => void;
+    onMessage?: (ws: WebSocketLike, data: string | Buffer) => void;
+    onClose?: (ws: WebSocketLike, code: number, reason: Buffer) => void;
+    onError?: (ws: WebSocketLike, error: Error) => void;
+}
+/**
+ * Define a WebSocket endpoint handler.
+ * Identity function — provides type inference for WebSocket handlers.
+ */
+declare function defineWebSocket(handler: WebSocketHandler): WebSocketHandler;
+/**
+ * T5a.2 Phase F slice 3/3 — Web-Standards WebSocket endpoint handler.
+ *
+ * Mirror of `WebSocketHandler` for the Web `Request` shape. `onOpen`
+ * receives `request: Request` instead of `req: IncomingMessage`. The
+ * rest of the lifecycle (onMessage, onClose, onError) is shape-agnostic
+ * (`WebSocketLike` is already Web-standards-compatible per the existing
+ * design — `send(string | Buffer)` works on both Node `ws` and Web
+ * `WebSocket` instances; CF Workers / Bun / Deno coerce as needed at
+ * the adapter boundary).
+ *
+ * Per `docs/plans/t5a2-incoming-message-to-request-shape-refactor-plan.md`
+ * v1.0 § Phase F (closes Phase F).
+ *
+ * **Architectural note — WebSocket upgrade semantics differ across runtimes:**
+ *   - Node + `ws`: `WebSocketServer.handleUpgrade(req, socket, head, cb)` —
+ *     `req` is `IncomingMessage`. Use `WebSocketHandler`.
+ *   - CF Workers: `new WebSocketPair()` + `request.headers` (the upgrade
+ *     handshake IS a Web Request). Use `WebSocketHandlerWeb`.
+ *   - Bun: `server.upgrade(request, { data })` — same Web Request shape.
+ *   - Deno: `Deno.upgradeWebSocket(request)` — same Web Request shape.
+ *
+ * Cross-runtime WebSocket endpoints ship BOTH `WebSocketHandler` +
+ * `WebSocketHandlerWeb` exports; the runtime adapter picks the matching
+ * one. This is the canonical Hono / Nitric pattern.
+ */
+interface WebSocketHandlerWeb {
+    onOpen?: (ws: WebSocketLike, request: Request) => void;
+    onMessage?: (ws: WebSocketLike, data: string | Uint8Array) => void;
+    onClose?: (ws: WebSocketLike, code: number, reason: string) => void;
+    onError?: (ws: WebSocketLike, error: Error) => void;
+}
+/**
+ * Web-Standards `defineWebSocket` sibling. Identity function — provides
+ * type inference for Web WebSocket handlers.
+ *
+ * **Type difference note vs Node path:**
+ *   - `onMessage` data is `string | Uint8Array` instead of `string | Buffer`
+ *     (Web standards have no `Buffer`; Node's Buffer is a Uint8Array
+ *     subclass so the Node path's Buffer values flow through unchanged
+ *     when adapters wrap them).
+ *   - `onClose` reason is `string` instead of `Buffer` (Web `CloseEvent`
+ *     exposes the reason as a UTF-8 string natively).
+ */
+declare function defineWebSocketWeb(handler: WebSocketHandlerWeb): WebSocketHandlerWeb;
+
+export { type WebSocketHandler as W, type WebSocketHandlerWeb as a, type WebSocketLike as b, defineWebSocketWeb as c, defineWebSocket as d };

package/dist/{deno-deploy-ZN4RE5HF.js → deno-deploy-BHWKFTOW.js}

@@ -2,11 +2,11 @@
 import "tsx/esm";
 import {
   nodeAdapter
-} from "./chunk-ZJW5FFYJ.js";
+} from "./chunk-LC5PYNJP.js";
 import {
   assertServicesUnsupported,
   readManifest
-} from "./chunk-WZ7CPVQB.js";
+} from "./chunk-27LWMYNK.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/adapters/deno-deploy.ts
@@ -105,4 +105,4 @@ export {
   denoDeployAdapter,
   renderDenoEntry
 };
-//# sourceMappingURL=deno-deploy-ZN4RE5HF.js.map
+//# sourceMappingURL=deno-deploy-BHWKFTOW.js.map

package/dist/{dev-266MVCVA.js → dev-MJVSRZGF.js}

@@ -5,23 +5,23 @@ import {
 } from "./chunk-XMS5VRIK.js";
 import {
   preflightNodeAndBindings
-} from "./chunk-F3TG5FJV.js";
+} from "./chunk-IEZCAT2I.js";
 import {
   theoPluginAsync
-} from "./chunk-JAAHOGKI.js";
-import "./chunk-TPCT3MXV.js";
+} from "./chunk-M2EY7KDR.js";
+import "./chunk-ABVITXFH.js";
 import {
   loadConfig,
   loadEnv
-} from "./chunk-XP7YXRHO.js";
-import "./chunk-X4JAX2U3.js";
-import "./chunk-5ODOE6EF.js";
-import "./chunk-O7335ZGH.js";
+} from "./chunk-U6TPSW4L.js";
+import "./chunk-4S2UCILN.js";
 import {
   orchestrateDev
-} from "./chunk-WZ7CPVQB.js";
-import "./chunk-OXIQI2XZ.js";
-import "./chunk-5OFPQK6N.js";
+} from "./chunk-27LWMYNK.js";
+import "./chunk-5ODOE6EF.js";
+import "./chunk-CG563V5M.js";
+import "./chunk-VBZCVFSA.js";
+import "./chunk-COXLEZCN.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/cli/commands/dev.ts
@@ -89,4 +89,4 @@ export {
   devCommand,
   startDevServer
 };
-//# sourceMappingURL=dev-266MVCVA.js.map
+//# sourceMappingURL=dev-MJVSRZGF.js.map

package/dist/{dev-emit-RBSFZZNO.js → dev-emit-5VPRCHOD.js}

@@ -1,10 +1,10 @@
 import {
   generateManifest
-} from "./chunk-2VQKDRVF.js";
-import "./chunk-B6RP57M3.js";
-import "./chunk-7TOMTMHT.js";
-import "./chunk-X2VVCJ4V.js";
+} from "./chunk-MR7OLIC6.js";
+import "./chunk-OLPB36O2.js";
+import "./chunk-R7OC6UDK.js";
 import "./chunk-WSJKACWB.js";
+import "./chunk-X2VVCJ4V.js";
 import "./chunk-DGUM43GV.js";
 
 // src/vite-plugin/openapi-emit/emit.ts
@@ -12,12 +12,7 @@ import { mkdirSync, writeFileSync } from "fs";
 import { join } from "path";
 
 // src/vite-plugin/openapi-emit/zod-to-openapi.ts
-var ZodToOpenApiError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ZodToOpenApiError";
-  }
-};
+import { z } from "zod";
 function zodToOpenApiSchema(schema, options = {}) {
   const ctx = options.ctx ?? { seen: /* @__PURE__ */ new Map(), components: {} };
   const name = options.name;
@@ -27,150 +22,52 @@ function zodToOpenApiSchema(schema, options = {}) {
     }
     ctx.seen.set(schema, name);
     ctx.components[name] = {};
-    const body = convert(schema, ctx);
+    const body = convertSchema(schema, ctx);
     ctx.components[name] = body;
     return { $ref: `#/components/schemas/${name}` };
   }
-  return convert(schema, ctx);
+  return convertSchema(schema, ctx);
 }
-function convert(schema, ctx) {
+function convertSchema(schema, ctx) {
   const existing = ctx.seen.get(schema);
   if (existing !== void 0) {
     return { $ref: `#/components/schemas/${existing}` };
   }
-  const def = schema._def;
-  const typeName = def.typeName ?? "";
-  switch (typeName) {
-    case "ZodString":
-      return convertString(schema);
-    case "ZodNumber":
-      return convertNumber(schema);
-    case "ZodBoolean":
-      return { type: "boolean" };
-    case "ZodLiteral":
-      return convertLiteral(schema);
-    case "ZodEnum":
-      return convertEnum(schema);
-    case "ZodArray":
-      return convertArray(schema, ctx);
-    case "ZodObject":
-      return convertObject(schema, ctx);
-    case "ZodUnion":
-      return convertUnion(schema, ctx);
-    case "ZodDiscriminatedUnion":
-      return convertDiscriminatedUnion(schema, ctx);
-    case "ZodOptional":
-      return convert(schema._def.innerType, ctx);
-    case "ZodNullable": {
-      const inner = convert(
-        schema._def.innerType,
-        ctx
-      );
-      return { ...inner, nullable: true };
-    }
-    case "ZodEffects":
-    case "ZodTransform":
-      return convert(schema._def.schema, ctx);
-    case "ZodDefault":
-      return convert(schema._def.innerType, ctx);
-    case "ZodLazy": {
-      const getter = schema._def.getter;
-      return convert(getter(), ctx);
-    }
-    case "ZodRecord": {
-      const valueType = schema._def.valueType;
-      return { type: "object", additionalProperties: convert(valueType, ctx) };
-    }
-    case "ZodAny":
-    case "ZodUnknown":
-      return {};
-    // no constraint
-    case "ZodNull":
-      return { type: "null" };
-    case "ZodFunction":
-      throw new ZodToOpenApiError(
-        "Unsupported Zod type: z.function() cannot be represented in OpenAPI Schema. Remove from the route schema."
-      );
-    case "ZodPromise":
-      throw new ZodToOpenApiError(
-        "Unsupported Zod type: z.promise() cannot be represented in OpenAPI Schema. Unwrap the value before passing to defineRoute."
-      );
-    default:
-      throw new ZodToOpenApiError(
-        `Unsupported Zod type: ${typeName || "(unknown)"}. Open an issue if this construct should be supported.`
-      );
-  }
-}
-function convertString(schema) {
-  const def = schema._def;
-  const checks = def.checks ?? [];
-  const out = { type: "string" };
-  for (const c of checks) {
-    if (c.kind === "email") out.format = "email";
-    else if (c.kind === "uuid") out.format = "uuid";
-    else if (c.kind === "url") out.format = "uri";
-    else if (c.kind === "datetime") out.format = "date-time";
-  }
-  return out;
-}
-function convertNumber(schema) {
-  const def = schema._def;
-  const checks = def.checks ?? [];
-  const isInt = checks.some((c) => c.kind === "int");
-  return { type: isInt ? "integer" : "number" };
-}
-function convertLiteral(schema) {
-  const value = schema._def.value;
-  const typed = literalTypeOf(value);
-  if (typed === null) {
-    return { type: "null", enum: [null] };
+  try {
+    const jsonSchema = z.toJSONSchema(schema);
+    return toOpenApi3(jsonSchema);
+  } catch {
+    return {};
   }
-  return { type: typed, enum: [value] };
 }
-function literalTypeOf(value) {
-  if (value === null) return null;
-  if (typeof value === "string") return "string";
-  if (typeof value === "number") return Number.isInteger(value) ? "integer" : "number";
-  if (typeof value === "boolean") return "boolean";
-  return "string";
-}
-function convertEnum(schema) {
-  const values = schema._def.values;
-  return { type: "string", enum: [...values] };
-}
-function convertArray(schema, ctx) {
-  const inner = schema._def.type;
-  return { type: "array", items: convert(inner, ctx) };
-}
-function convertObject(schema, ctx) {
-  const shape = schema.shape;
-  const properties = {};
-  const required = [];
-  for (const [key, child] of Object.entries(shape)) {
-    properties[key] = convert(child, ctx);
-    const childDef = child._def;
-    const isOptional = childDef.typeName === "ZodOptional" || childDef.typeName === "ZodDefault";
-    if (!isOptional) required.push(key);
+function toOpenApi3(js) {
+  const { $schema: _, $defs: _defs, ...rest } = js;
+  const out = {};
+  for (const [key, value] of Object.entries(rest)) {
+    if (key === "type" && Array.isArray(value)) {
+      const types = value;
+      const hasNull = types.includes("null");
+      const nonNull = types.filter((t) => t !== "null");
+      out.type = nonNull.length === 1 ? nonNull[0] : nonNull;
+      if (hasNull) out.nullable = true;
+    } else if (key === "properties" && value && typeof value === "object") {
+      const props = {};
+      for (const [pk, pv] of Object.entries(value)) {
+        props[pk] = pv && typeof pv === "object" ? toOpenApi3(pv) : pv;
+      }
+      out.properties = props;
+    } else if (key === "items" && value && typeof value === "object") {
+      out.items = toOpenApi3(value);
+    } else if ((key === "anyOf" || key === "oneOf" || key === "allOf") && Array.isArray(value)) {
+      out[key] = value.map((v) => toOpenApi3(v));
+    } else if (key === "additionalProperties" && value && typeof value === "object") {
+      out.additionalProperties = toOpenApi3(value);
+    } else {
+      out[key] = value;
+    }
   }
-  const out = {
-    type: "object",
-    properties,
-    additionalProperties: false
-  };
-  if (required.length > 0) out.required = required;
   return out;
 }
-function convertUnion(schema, ctx) {
-  const options = schema._def.options;
-  return { oneOf: options.map((o) => convert(o, ctx)) };
-}
-function convertDiscriminatedUnion(schema, ctx) {
-  const def = schema._def;
-  return {
-    oneOf: def.options.map((o) => convert(o, ctx)),
-    discriminator: { propertyName: def.discriminator }
-  };
-}
 
 // src/vite-plugin/openapi-emit/emit.ts
 var METHOD_TO_KEY = {
@@ -387,4 +284,4 @@ export {
   _resetInFlightForTests,
   reEmitOpenApi
 };
-//# sourceMappingURL=dev-emit-RBSFZZNO.js.map
+//# sourceMappingURL=dev-emit-5VPRCHOD.js.map

package/dist/dev-emit-5VPRCHOD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vite-plugin/openapi-emit/emit.ts","../src/vite-plugin/openapi-emit/zod-to-openapi.ts","../src/vite-plugin/openapi-emit/load-routes.ts","../src/vite-plugin/openapi-emit/dev-emit.ts"],"sourcesContent":["/**\n * In-house `emitOpenApi()` orchestrator (build-time only).\n *\n * Pure transformation: takes a route manifest (already hydrated with Zod\n * schemas extracted from `defineRoute()` config) + the openapi config\n * block, builds an OpenAPI 3.x document, writes `<outDir>/openapi.json`,\n * returns the document for downstream callers (CLI logs, tests).\n *\n * Per G2 plan v1.1 T2.1. Modelled on trpc-openapi's\n * `generateOpenApiDocument` + encore's `Generator.Generate()`.\n *\n * NEVER ship to runtime — devDep-shaped artifact.\n *\n * Path templating: TheoKit's `:param` syntax is converted to OpenAPI's\n * `{param}` per the spec. Env-var override: `THEOKIT_OPENAPI_SERVER_URL`\n * overrides `servers[0].url` without rebuilding the config.\n */\n/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time emit. outDir is a config-controlled relative path. The\n * caller already refused absolute paths via theoConfigSchema.distDir\n * pattern; the openapi.outDir field follows the same convention.\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { join } from 'node:path'\n\nimport type { z } from 'zod'\n\nimport { zodToOpenApiSchema, type ConvertCtx, type OpenApiSchema } from './zod-to-openapi.js'\n\nexport interface OpenApiManifestRoute {\n  /** TheoKit-style path with `:param` placeholders (`/users/:id`). */\n  routePath: string\n  /** Uppercase HTTP methods the route exports (`['GET','POST']`). */\n  methods: string[]\n  /** Optional `defineRoute({body})` schema. */\n  body?: z.ZodType\n  /** Optional `defineRoute({query})` schema. */\n  query?: z.ZodType\n  /** Optional `defineRoute({params})` schema. */\n  params?: z.ZodType\n  /** Optional `defineRoute({response})` schema. */\n  response?: z.ZodType\n}\n\nexport interface OpenApiEmitConfig {\n  servers: { url: string; description?: string }[]\n  specVersion: '3.1.0' | '3.0.3'\n  title: string\n  version: string\n  outDir: string\n}\n\nexport interface OpenApiOperation {\n  operationId?: string\n  parameters?: OpenApiParameter[]\n  requestBody?: {\n    required?: boolean\n    content: Record<string, { schema: OpenApiSchema }>\n  }\n  responses: Record<\n    string,\n    { description: string; content?: Record<string, { schema: OpenApiSchema }> }\n  >\n}\n\nexport interface OpenApiParameter {\n  name: string\n  in: 'path' | 'query' | 'header' | 'cookie'\n  required: boolean\n  schema: OpenApiSchema\n  description?: string\n}\n\nexport type OpenApiPathItem = Partial<\n  Record<'get' | 'post' | 'put' | 'patch' | 'delete' | 'head' | 'options', OpenApiOperation>\n>\n\nexport interface OpenApiDocument {\n  openapi: '3.1.0' | '3.0.3'\n  info: { title: string; version: string }\n  servers: { url: string; description?: string }[]\n  paths: Record<string, OpenApiPathItem>\n  components?: { schemas?: Record<string, OpenApiSchema> }\n}\n\nexport interface EmitOpenApiInput {\n  manifest: OpenApiManifestRoute[]\n  config: OpenApiEmitConfig\n}\n\nexport interface EmitOpenApiResult {\n  document: OpenApiDocument\n  path: string\n}\n\nconst METHOD_TO_KEY: Record<string, keyof OpenApiPathItem> = {\n  GET: 'get',\n  POST: 'post',\n  PUT: 'put',\n  PATCH: 'patch',\n  DELETE: 'delete',\n  HEAD: 'head',\n  OPTIONS: 'options',\n}\n\n/** Convert `/users/:id/posts/:postId?` → `/users/{id}/posts/{postId}`. */\nexport function templatePath(routePath: string): string {\n  // Bounded quantifier (\\w{0,64}) is OSS-safe — TheoKit route param names\n  // never exceed 64 chars in practice; cap prevents super-linear backtracking.\n  return routePath.replace(/:([A-Za-z_]\\w{0,64})\\??/g, '{$1}')\n}\n\nfunction buildParameters(\n  paramsSchema: z.ZodType | undefined,\n  querySchema: z.ZodType | undefined,\n  ctx: ConvertCtx,\n): OpenApiParameter[] {\n  const out: OpenApiParameter[] = []\n  if (paramsSchema !== undefined) {\n    appendObjectAsParameters(paramsSchema, 'path', out, ctx)\n  }\n  if (querySchema !== undefined) {\n    appendObjectAsParameters(querySchema, 'query', out, ctx)\n  }\n  return out\n}\n\nfunction appendObjectAsParameters(\n  schema: z.ZodType,\n  location: 'path' | 'query',\n  out: OpenApiParameter[],\n  ctx: ConvertCtx,\n): void {\n  // We expect an object schema; if it's not, skip silently (caller already\n  // validated upstream when scanning defineRoute()).\n  const shape = (schema as unknown as { shape?: Record<string, z.ZodType> }).shape\n  if (shape === undefined) return\n  for (const [name, child] of Object.entries(shape)) {\n    const childDef = (child as unknown as { _def: { typeName?: string } })._def\n    const optional = childDef.typeName === 'ZodOptional' || childDef.typeName === 'ZodDefault'\n    out.push({\n      name,\n      in: location,\n      required: location === 'path' ? true : !optional,\n      schema: zodToOpenApiSchema(child, { ctx }),\n    })\n  }\n}\n\nfunction buildOperation(\n  route: OpenApiManifestRoute,\n  ctx: ConvertCtx,\n  method: string,\n): OpenApiOperation {\n  // Bounded sanitizer: two single-pass replacements (no nested quantifiers).\n  const sanitized = route.routePath.replace(/[/:\\-{}]/g, '_').replace(/_+/g, '_')\n  const operationId = `${method.toLowerCase()}_${sanitized.replace(/^_|_$/g, '')}`\n  const op: OpenApiOperation = {\n    operationId,\n    responses: {\n      '200': { description: 'OK' },\n    },\n  }\n\n  const parameters = buildParameters(route.params, route.query, ctx)\n  if (parameters.length > 0) op.parameters = parameters\n\n  // Body only meaningful for write methods; we still attach if defined so\n  // the document is honest about the contract.\n  if (route.body !== undefined) {\n    op.requestBody = {\n      required: true,\n      content: {\n        'application/json': { schema: zodToOpenApiSchema(route.body, { ctx }) },\n      },\n    }\n  }\n\n  if (route.response !== undefined) {\n    op.responses['200'] = {\n      description: 'OK',\n      content: {\n        'application/json': { schema: zodToOpenApiSchema(route.response, { ctx }) },\n      },\n    }\n  }\n\n  return op\n}\n\nexport function emitOpenApi(input: EmitOpenApiInput): EmitOpenApiResult {\n  const { manifest, config } = input\n\n  const ctx: ConvertCtx = { seen: new Map(), components: {} }\n\n  const paths: Record<string, OpenApiPathItem> = {}\n  for (const route of manifest) {\n    const templatedPath = templatePath(route.routePath)\n    const item: OpenApiPathItem = paths[templatedPath] ?? {}\n    for (const method of route.methods) {\n      // Defensive: manifest emitter normalizes to uppercase, but if a\n      // future scanner produces a non-HTTP verb the key lookup yields\n      // undefined and we skip silently. TS narrows the indexed type to\n      // keyof OpenApiPathItem; the runtime undefined check is honest.\n      const key = METHOD_TO_KEY[method.toUpperCase()] as keyof OpenApiPathItem | undefined\n      if (key === undefined) continue\n      item[key] = buildOperation(route, ctx, method)\n    }\n    paths[templatedPath] = item\n  }\n\n  const servers = applyServerOverride(config.servers)\n\n  const document: OpenApiDocument = {\n    openapi: config.specVersion,\n    info: { title: config.title, version: config.version },\n    servers,\n    paths,\n  }\n\n  if (Object.keys(ctx.components).length > 0) {\n    document.components = { schemas: ctx.components }\n  }\n\n  mkdirSync(config.outDir, { recursive: true })\n  const outPath = join(config.outDir, 'openapi.json')\n  writeFileSync(outPath, `${JSON.stringify(document, null, 2)}\\n`, 'utf8')\n\n  return { document, path: outPath }\n}\n\nfunction applyServerOverride(\n  servers: { url: string; description?: string }[],\n): { url: string; description?: string }[] {\n  const override = process.env.THEOKIT_OPENAPI_SERVER_URL\n  if (override === undefined || override === '') return servers\n  if (servers.length === 0) return [{ url: override }]\n  const [first, ...rest] = servers\n  return [\n    {\n      url: override,\n      ...(first.description !== undefined ? { description: first.description } : {}),\n    },\n    ...rest,\n  ]\n}\n","/**\n * Zod → OpenAPI 3.0 Schema converter (build-time only).\n *\n * Uses Zod v4's native `z.toJSONSchema()` and post-processes\n * the JSON Schema output into OpenAPI 3.0 format:\n *   - Removes `$schema` (invalid in OpenAPI 3.0)\n *   - Converts `type: [\"string\", \"null\"]` → `{ type: \"string\", nullable: true }`\n *   - Recursively normalizes nested schemas\n *\n * NEVER ship to runtime — devDep-shaped artifact.\n */\nimport { z } from 'zod'\n\nexport interface OpenApiSchema {\n  type?: 'string' | 'number' | 'integer' | 'boolean' | 'array' | 'object' | 'null'\n  format?: string\n  items?: OpenApiSchema\n  properties?: Record<string, OpenApiSchema>\n  required?: string[]\n  additionalProperties?: boolean | OpenApiSchema\n  oneOf?: OpenApiSchema[]\n  anyOf?: OpenApiSchema[]\n  allOf?: OpenApiSchema[]\n  discriminator?: { propertyName: string; mapping?: Record<string, string> }\n  enum?: unknown[]\n  nullable?: boolean\n  description?: string\n  default?: unknown\n  $ref?: string\n}\n\nexport interface ConvertCtx {\n  seen: Map<z.ZodType, string>\n  components: Record<string, OpenApiSchema>\n}\n\nexport interface ConvertOptions {\n  ctx?: ConvertCtx\n  name?: string\n}\n\nexport class ZodToOpenApiError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'ZodToOpenApiError'\n  }\n}\n\nexport function zodToOpenApiSchema(schema: z.ZodType, options: ConvertOptions = {}): OpenApiSchema {\n  const ctx: ConvertCtx = options.ctx ?? { seen: new Map(), components: {} }\n\n  const name = options.name\n  if (name !== undefined) {\n    if (Object.prototype.hasOwnProperty.call(ctx.components, name)) {\n      return { $ref: `#/components/schemas/${name}` }\n    }\n    ctx.seen.set(schema, name)\n    ctx.components[name] = {}\n    const body = convertSchema(schema, ctx)\n    ctx.components[name] = body\n    return { $ref: `#/components/schemas/${name}` }\n  }\n\n  return convertSchema(schema, ctx)\n}\n\nfunction convertSchema(schema: z.ZodType, ctx: ConvertCtx): OpenApiSchema {\n  const existing = ctx.seen.get(schema)\n  if (existing !== undefined) {\n    return { $ref: `#/components/schemas/${existing}` }\n  }\n\n  try {\n    const jsonSchema = z.toJSONSchema(schema) as Record<string, unknown>\n    return toOpenApi3(jsonSchema)\n  } catch {\n    return {}\n  }\n}\n\n/**\n * Post-process JSON Schema (draft-2020-12) → OpenAPI 3.0.\n * Handles:\n *   - $schema removal\n *   - nullable conversion\n *   - Recursive normalization of properties/items/anyOf/oneOf/allOf\n */\nfunction toOpenApi3(js: Record<string, unknown>): OpenApiSchema {\n  const { $schema: _, $defs: _defs, ...rest } = js\n  const out: Record<string, unknown> = {}\n\n  for (const [key, value] of Object.entries(rest)) {\n    if (key === 'type' && Array.isArray(value)) {\n      const types = value as string[]\n      const hasNull = types.includes('null')\n      const nonNull = types.filter((t: string) => t !== 'null')\n      out.type = nonNull.length === 1 ? nonNull[0] : nonNull\n      if (hasNull) out.nullable = true\n    } else if (key === 'properties' && value && typeof value === 'object') {\n      const props: Record<string, OpenApiSchema> = {}\n      for (const [pk, pv] of Object.entries(value as Record<string, unknown>)) {\n        props[pk] = pv && typeof pv === 'object' ? toOpenApi3(pv as Record<string, unknown>) : (pv as OpenApiSchema)\n      }\n      out.properties = props\n    } else if (key === 'items' && value && typeof value === 'object') {\n      out.items = toOpenApi3(value as Record<string, unknown>)\n    } else if ((key === 'anyOf' || key === 'oneOf' || key === 'allOf') && Array.isArray(value)) {\n      out[key] = (value as Record<string, unknown>[]).map((v) => toOpenApi3(v))\n    } else if (key === 'additionalProperties' && value && typeof value === 'object') {\n      out.additionalProperties = toOpenApi3(value as Record<string, unknown>)\n    } else {\n      out[key] = value\n    }\n  }\n\n  return out as OpenApiSchema\n}\n","/**\n * Build-time route loader for OpenAPI emit.\n *\n * Takes the G1 manifest (filePath + routePath + methods) and hydrates each\n * route's Zod schemas by dynamically importing the module. `defineRoute`\n * is an identity function, so the imported config exposes `body/query/\n * params/response` directly without any AST gymnastics.\n *\n * Supports both export shapes:\n *   1. `export const POST = defineRoute({...})` (per-method named exports)\n *   2. `export default defineRoute({...})` (single-export legacy shape)\n *\n * Per G2 plan v1.1 T2.2. Uses Vite's `ssrLoadModule` because route files\n * are TS at build time — Node's native loader doesn't transpile.\n */\nimport { resolve } from 'node:path'\n\nimport type { z } from 'zod'\n\nimport type { ManifestRoute } from '../../server/scan/manifest.js'\n\nimport type { OpenApiManifestRoute } from './emit.js'\n\ninterface RouteConfigShape {\n  body?: z.ZodType\n  query?: z.ZodType\n  params?: z.ZodType\n  response?: z.ZodType\n}\n\ninterface ViteLikeServer {\n  ssrLoadModule: (id: string) => Promise<Record<string, unknown>>\n  close: () => Promise<void>\n}\n\ninterface DefaultLoader {\n  load: (absPath: string) => Promise<Record<string, unknown>>\n  dispose: () => Promise<void>\n}\n\n/** Method names recognized as per-route named exports (UPPERCASE). */\nconst HTTP_METHOD_KEYS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'] as const\n\nexport interface LoadRoutesOptions {\n  serverDir: string\n  routes: ManifestRoute[]\n  /** Injectable for tests; defaults to a fresh Vite SSR dev server. */\n  loadModule?: (absPath: string) => Promise<Record<string, unknown>>\n}\n\n/**\n * Hydrate manifest routes with Zod schemas extracted from their modules.\n *\n * Returns one `OpenApiManifestRoute` per (file × method) tuple. If a route\n * file declares multiple methods (`GET` + `POST`), each method gets its\n * own entry with the schemas from that method's `defineRoute()` call.\n *\n * Routes that fail to load are skipped with a console warning — the emit\n * should be best-effort, not a hard build failure.\n *\n * The default Vite loader is created once per call and disposed in the\n * `finally` block so the underlying server is released even when route\n * loading throws.\n */\nexport async function loadRoutesForOpenApi(\n  options: LoadRoutesOptions,\n): Promise<OpenApiManifestRoute[]> {\n  const { serverDir, routes } = options\n  let loadModule = options.loadModule\n  let dispose: (() => Promise<void>) | undefined\n  if (loadModule === undefined) {\n    const created = await createDefaultLoader(serverDir)\n    loadModule = created.load\n    dispose = created.dispose\n  }\n\n  const out: OpenApiManifestRoute[] = []\n  try {\n    for (const r of routes) {\n      const abs = resolve(serverDir, r.filePath)\n      let mod: Record<string, unknown>\n      try {\n        mod = await loadModule(abs)\n      } catch (err) {\n        console.warn(\n          `[openapi-emit] Skipping ${r.filePath}: load failed (${(err as Error).message})`,\n        )\n        continue\n      }\n\n      const methods = r.methods ?? HTTP_METHOD_KEYS.filter((m) => mod[m] !== undefined)\n      if (methods.length === 0) {\n        // Fall back to default export when no method-named exports detected.\n        const def = mod.default\n        if (def !== undefined && def !== null) {\n          out.push({ routePath: r.routePath, methods: ['GET'], ...extractSchemas(def) })\n        }\n        continue\n      }\n\n      for (const method of methods) {\n        const handler = mod[method] ?? mod.default\n        if (handler === undefined || handler === null) continue\n        out.push({ routePath: r.routePath, methods: [method], ...extractSchemas(handler) })\n      }\n    }\n  } finally {\n    if (dispose !== undefined) {\n      await dispose()\n    }\n  }\n  return out\n}\n\nfunction extractSchemas(handlerExport: unknown): RouteConfigShape {\n  if (typeof handlerExport !== 'object' || handlerExport === null) return {}\n  const cfg = handlerExport as RouteConfigShape\n  const out: RouteConfigShape = {}\n  if (cfg.body !== undefined) out.body = cfg.body\n  if (cfg.query !== undefined) out.query = cfg.query\n  if (cfg.params !== undefined) out.params = cfg.params\n  if (cfg.response !== undefined) out.response = cfg.response\n  return out\n}\n\n/**\n * Default loader: spin up a minimal Vite SSR dev server (no HMR, no\n * middlewares) just to use its `ssrLoadModule`. Vite handles TS, ESM, and\n * import resolution for free.\n *\n * Returns `{load, dispose}` — the caller owns the lifecycle and MUST\n * call `dispose()` (typically in a `finally`) so the server is closed.\n */\nasync function createDefaultLoader(serverDir: string): Promise<DefaultLoader> {\n  // Vite is a peerDep in build flows; import dynamically.\n  const { createServer } = await import('vite')\n  const server = (await createServer({\n    root: serverDir,\n    configFile: false,\n    server: { middlewareMode: true },\n    appType: 'custom',\n    logLevel: 'silent',\n  })) as unknown as ViteLikeServer\n\n  const swallow = (): void => {\n    /* eat close errors — best-effort cleanup */\n  }\n  return {\n    load: async (absPath) => server.ssrLoadModule(absPath),\n    dispose: async () => {\n      await server.close().catch(swallow)\n    },\n  }\n}\n","/**\n * Dev-mode OpenAPI emit helper for `theokit dev`.\n *\n * Per P#3 plan v1.3 T1.1 (ADRs D3 + D4 + EC-8). Called once on `theokit dev`\n * boot AND on every chokidar 'change'/'add'/'unlink' watcher event for\n * route files when `config.openapi !== undefined`. Re-runs G2's\n * `emitOpenApi()` orchestrator to keep `<distDir>/openapi.json` always\n * fresh in dev.\n *\n * EC-8 absorbed (single-flight guard): if a previous invocation is still\n * awaiting `loadRoutesForOpenApi` (Vite SSR loader can hang on circular\n * imports or syntax errors), skip the new call and emit a `console.warn`\n * so watcher events don't pile up + dev server doesn't deadlock.\n *\n * Best-effort: ALL errors caught + warned. Never throws out of the\n * exported function (would crash Vite dev's chokidar handler).\n *\n * NEVER ship to runtime — dev-only artifact gated on `config.openapi`.\n */\nimport { generateManifest } from '../../server/scan/manifest.js'\n\nimport { emitOpenApi } from './emit.js'\nimport { loadRoutesForOpenApi } from './load-routes.js'\n\ninterface DevEmitConfig {\n  servers: { url: string; description?: string }[]\n  specVersion: '3.1.0' | '3.0.3'\n  title: string\n  version: string\n}\n\nlet inFlight = false\n\nexport async function reEmitOpenApi(\n  serverDir: string,\n  distDir: string,\n  openApiConfig: DevEmitConfig,\n): Promise<void> {\n  if (inFlight) {\n    console.warn(\n      '[openapi-emit] previous emit still running; skipping watcher event (EC-8 single-flight guard)',\n    )\n    return\n  }\n  inFlight = true\n  try {\n    const manifest = generateManifest(serverDir)\n    const hydrated = await loadRoutesForOpenApi({ serverDir, routes: manifest.routes })\n    emitOpenApi({\n      manifest: hydrated,\n      config: { ...openApiConfig, outDir: distDir },\n    })\n  } catch (err) {\n    console.warn(`[openapi-emit] re-emit failed: ${(err as Error).message}`)\n  } finally {\n    inFlight = false\n  }\n}\n\n/** Test seam — resets the inFlight flag between tests. NOT for production use. */\nexport function _resetInFlightForTests(): void {\n  inFlight = false\n}\n"],"mappings":";;;;;;;;;;AAsBA,SAAS,WAAW,qBAAqB;AACzC,SAAS,YAAY;;;ACZrB,SAAS,SAAS;AAqCX,SAAS,mBAAmB,QAAmB,UAA0B,CAAC,GAAkB;AACjG,QAAM,MAAkB,QAAQ,OAAO,EAAE,MAAM,oBAAI,IAAI,GAAG,YAAY,CAAC,EAAE;AAEzE,QAAM,OAAO,QAAQ;AACrB,MAAI,SAAS,QAAW;AACtB,QAAI,OAAO,UAAU,eAAe,KAAK,IAAI,YAAY,IAAI,GAAG;AAC9D,aAAO,EAAE,MAAM,wBAAwB,IAAI,GAAG;AAAA,IAChD;AACA,QAAI,KAAK,IAAI,QAAQ,IAAI;AACzB,QAAI,WAAW,IAAI,IAAI,CAAC;AACxB,UAAM,OAAO,cAAc,QAAQ,GAAG;AACtC,QAAI,WAAW,IAAI,IAAI;AACvB,WAAO,EAAE,MAAM,wBAAwB,IAAI,GAAG;AAAA,EAChD;AAEA,SAAO,cAAc,QAAQ,GAAG;AAClC;AAEA,SAAS,cAAc,QAAmB,KAAgC;AACxE,QAAM,WAAW,IAAI,KAAK,IAAI,MAAM;AACpC,MAAI,aAAa,QAAW;AAC1B,WAAO,EAAE,MAAM,wBAAwB,QAAQ,GAAG;AAAA,EACpD;AAEA,MAAI;AACF,UAAM,aAAa,EAAE,aAAa,MAAM;AACxC,WAAO,WAAW,UAAU;AAAA,EAC9B,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AASA,SAAS,WAAW,IAA4C;AAC9D,QAAM,EAAE,SAAS,GAAG,OAAO,OAAO,GAAG,KAAK,IAAI;AAC9C,QAAM,MAA+B,CAAC;AAEtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC/C,QAAI,QAAQ,UAAU,MAAM,QAAQ,KAAK,GAAG;AAC1C,YAAM,QAAQ;AACd,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,YAAM,UAAU,MAAM,OAAO,CAAC,MAAc,MAAM,MAAM;AACxD,UAAI,OAAO,QAAQ,WAAW,IAAI,QAAQ,CAAC,IAAI;AAC/C,UAAI,QAAS,KAAI,WAAW;AAAA,IAC9B,WAAW,QAAQ,gBAAgB,SAAS,OAAO,UAAU,UAAU;AACrE,YAAM,QAAuC,CAAC;AAC9C,iBAAW,CAAC,IAAI,EAAE,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACvE,cAAM,EAAE,IAAI,MAAM,OAAO,OAAO,WAAW,WAAW,EAA6B,IAAK;AAAA,MAC1F;AACA,UAAI,aAAa;AAAA,IACnB,WAAW,QAAQ,WAAW,SAAS,OAAO,UAAU,UAAU;AAChE,UAAI,QAAQ,WAAW,KAAgC;AAAA,IACzD,YAAY,QAAQ,WAAW,QAAQ,WAAW,QAAQ,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC1F,UAAI,GAAG,IAAK,MAAoC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC;AAAA,IAC1E,WAAW,QAAQ,0BAA0B,SAAS,OAAO,UAAU,UAAU;AAC/E,UAAI,uBAAuB,WAAW,KAAgC;AAAA,IACxE,OAAO;AACL,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AAEA,SAAO;AACT;;;ADrBA,IAAM,gBAAuD;AAAA,EAC3D,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,SAAS;AACX;AAGO,SAAS,aAAa,WAA2B;AAGtD,SAAO,UAAU,QAAQ,4BAA4B,MAAM;AAC7D;AAEA,SAAS,gBACP,cACA,aACA,KACoB;AACpB,QAAM,MAA0B,CAAC;AACjC,MAAI,iBAAiB,QAAW;AAC9B,6BAAyB,cAAc,QAAQ,KAAK,GAAG;AAAA,EACzD;AACA,MAAI,gBAAgB,QAAW;AAC7B,6BAAyB,aAAa,SAAS,KAAK,GAAG;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,yBACP,QACA,UACA,KACA,KACM;AAGN,QAAM,QAAS,OAA4D;AAC3E,MAAI,UAAU,OAAW;AACzB,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,UAAM,WAAY,MAAqD;AACvE,UAAM,WAAW,SAAS,aAAa,iBAAiB,SAAS,aAAa;AAC9E,QAAI,KAAK;AAAA,MACP;AAAA,MACA,IAAI;AAAA,MACJ,UAAU,aAAa,SAAS,OAAO,CAAC;AAAA,MACxC,QAAQ,mBAAmB,OAAO,EAAE,IAAI,CAAC;AAAA,IAC3C,CAAC;AAAA,EACH;AACF;AAEA,SAAS,eACP,OACA,KACA,QACkB;AAElB,QAAM,YAAY,MAAM,UAAU,QAAQ,aAAa,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC9E,QAAM,cAAc,GAAG,OAAO,YAAY,CAAC,IAAI,UAAU,QAAQ,UAAU,EAAE,CAAC;AAC9E,QAAM,KAAuB;AAAA,IAC3B;AAAA,IACA,WAAW;AAAA,MACT,OAAO,EAAE,aAAa,KAAK;AAAA,IAC7B;AAAA,EACF;AAEA,QAAM,aAAa,gBAAgB,MAAM,QAAQ,MAAM,OAAO,GAAG;AACjE,MAAI,WAAW,SAAS,EAAG,IAAG,aAAa;AAI3C,MAAI,MAAM,SAAS,QAAW;AAC5B,OAAG,cAAc;AAAA,MACf,UAAU;AAAA,MACV,SAAS;AAAA,QACP,oBAAoB,EAAE,QAAQ,mBAAmB,MAAM,MAAM,EAAE,IAAI,CAAC,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,MAAM,aAAa,QAAW;AAChC,OAAG,UAAU,KAAK,IAAI;AAAA,MACpB,aAAa;AAAA,MACb,SAAS;AAAA,QACP,oBAAoB,EAAE,QAAQ,mBAAmB,MAAM,UAAU,EAAE,IAAI,CAAC,EAAE;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,YAAY,OAA4C;AACtE,QAAM,EAAE,UAAU,OAAO,IAAI;AAE7B,QAAM,MAAkB,EAAE,MAAM,oBAAI,IAAI,GAAG,YAAY,CAAC,EAAE;AAE1D,QAAM,QAAyC,CAAC;AAChD,aAAW,SAAS,UAAU;AAC5B,UAAM,gBAAgB,aAAa,MAAM,SAAS;AAClD,UAAM,OAAwB,MAAM,aAAa,KAAK,CAAC;AACvD,eAAW,UAAU,MAAM,SAAS;AAKlC,YAAM,MAAM,cAAc,OAAO,YAAY,CAAC;AAC9C,UAAI,QAAQ,OAAW;AACvB,WAAK,GAAG,IAAI,eAAe,OAAO,KAAK,MAAM;AAAA,IAC/C;AACA,UAAM,aAAa,IAAI;AAAA,EACzB;AAEA,QAAM,UAAU,oBAAoB,OAAO,OAAO;AAElD,QAAM,WAA4B;AAAA,IAChC,SAAS,OAAO;AAAA,IAChB,MAAM,EAAE,OAAO,OAAO,OAAO,SAAS,OAAO,QAAQ;AAAA,IACrD;AAAA,IACA;AAAA,EACF;AAEA,MAAI,OAAO,KAAK,IAAI,UAAU,EAAE,SAAS,GAAG;AAC1C,aAAS,aAAa,EAAE,SAAS,IAAI,WAAW;AAAA,EAClD;AAEA,YAAU,OAAO,QAAQ,EAAE,WAAW,KAAK,CAAC;AAC5C,QAAM,UAAU,KAAK,OAAO,QAAQ,cAAc;AAClD,gBAAc,SAAS,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,GAAM,MAAM;AAEvE,SAAO,EAAE,UAAU,MAAM,QAAQ;AACnC;AAEA,SAAS,oBACP,SACyC;AACzC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,aAAa,UAAa,aAAa,GAAI,QAAO;AACtD,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC,EAAE,KAAK,SAAS,CAAC;AACnD,QAAM,CAAC,OAAO,GAAG,IAAI,IAAI;AACzB,SAAO;AAAA,IACL;AAAA,MACE,KAAK;AAAA,MACL,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,IAC9E;AAAA,IACA,GAAG;AAAA,EACL;AACF;;;AEtOA,SAAS,eAAe;AA0BxB,IAAM,mBAAmB,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,QAAQ,SAAS;AAuBpF,eAAsB,qBACpB,SACiC;AACjC,QAAM,EAAE,WAAW,OAAO,IAAI;AAC9B,MAAI,aAAa,QAAQ;AACzB,MAAI;AACJ,MAAI,eAAe,QAAW;AAC5B,UAAM,UAAU,MAAM,oBAAoB,SAAS;AACnD,iBAAa,QAAQ;AACrB,cAAU,QAAQ;AAAA,EACpB;AAEA,QAAM,MAA8B,CAAC;AACrC,MAAI;AACF,eAAW,KAAK,QAAQ;AACtB,YAAM,MAAM,QAAQ,WAAW,EAAE,QAAQ;AACzC,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,WAAW,GAAG;AAAA,MAC5B,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,2BAA2B,EAAE,QAAQ,kBAAmB,IAAc,OAAO;AAAA,QAC/E;AACA;AAAA,MACF;AAEA,YAAM,UAAU,EAAE,WAAW,iBAAiB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,MAAS;AAChF,UAAI,QAAQ,WAAW,GAAG;AAExB,cAAM,MAAM,IAAI;AAChB,YAAI,QAAQ,UAAa,QAAQ,MAAM;AACrC,cAAI,KAAK,EAAE,WAAW,EAAE,WAAW,SAAS,CAAC,KAAK,GAAG,GAAG,eAAe,GAAG,EAAE,CAAC;AAAA,QAC/E;AACA;AAAA,MACF;AAEA,iBAAW,UAAU,SAAS;AAC5B,cAAM,UAAU,IAAI,MAAM,KAAK,IAAI;AACnC,YAAI,YAAY,UAAa,YAAY,KAAM;AAC/C,YAAI,KAAK,EAAE,WAAW,EAAE,WAAW,SAAS,CAAC,MAAM,GAAG,GAAG,eAAe,OAAO,EAAE,CAAC;AAAA,MACpF;AAAA,IACF;AAAA,EACF,UAAE;AACA,QAAI,YAAY,QAAW;AACzB,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eAAe,eAA0C;AAChE,MAAI,OAAO,kBAAkB,YAAY,kBAAkB,KAAM,QAAO,CAAC;AACzE,QAAM,MAAM;AACZ,QAAM,MAAwB,CAAC;AAC/B,MAAI,IAAI,SAAS,OAAW,KAAI,OAAO,IAAI;AAC3C,MAAI,IAAI,UAAU,OAAW,KAAI,QAAQ,IAAI;AAC7C,MAAI,IAAI,WAAW,OAAW,KAAI,SAAS,IAAI;AAC/C,MAAI,IAAI,aAAa,OAAW,KAAI,WAAW,IAAI;AACnD,SAAO;AACT;AAUA,eAAe,oBAAoB,WAA2C;AAE5E,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,MAAM;AAC5C,QAAM,SAAU,MAAM,aAAa;AAAA,IACjC,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,QAAQ,EAAE,gBAAgB,KAAK;AAAA,IAC/B,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,UAAU,MAAY;AAAA,EAE5B;AACA,SAAO;AAAA,IACL,MAAM,OAAO,YAAY,OAAO,cAAc,OAAO;AAAA,IACrD,SAAS,YAAY;AACnB,YAAM,OAAO,MAAM,EAAE,MAAM,OAAO;AAAA,IACpC;AAAA,EACF;AACF;;;AC1HA,IAAI,WAAW;AAEf,eAAsB,cACpB,WACA,SACA,eACe;AACf,MAAI,UAAU;AACZ,YAAQ;AAAA,MACN;AAAA,IACF;AACA;AAAA,EACF;AACA,aAAW;AACX,MAAI;AACF,UAAM,WAAW,iBAAiB,SAAS;AAC3C,UAAM,WAAW,MAAM,qBAAqB,EAAE,WAAW,QAAQ,SAAS,OAAO,CAAC;AAClF,gBAAY;AAAA,MACV,UAAU;AAAA,MACV,QAAQ,EAAE,GAAG,eAAe,QAAQ,QAAQ;AAAA,IAC9C,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,KAAK,kCAAmC,IAAc,OAAO,EAAE;AAAA,EACzE,UAAE;AACA,eAAW;AAAA,EACb;AACF;AAGO,SAAS,yBAA+B;AAC7C,aAAW;AACb;","names":[]}

package/dist/{dev-emit-NO6OZJOQ.js → dev-emit-HHP2XJXE.js}

@@ -3,12 +3,12 @@ import "tsx/esm";
 import {
   emitOpenApi,
   loadRoutesForOpenApi
-} from "./chunk-ZOXNJV2O.js";
+} from "./chunk-WGHJD6I7.js";
 import {
   generateManifest
-} from "./chunk-TRH2L3FI.js";
-import "./chunk-OXIQI2XZ.js";
-import "./chunk-5OFPQK6N.js";
+} from "./chunk-WEGALZEU.js";
+import "./chunk-VBZCVFSA.js";
+import "./chunk-COXLEZCN.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/vite-plugin/openapi-emit/dev-emit.ts
@@ -41,4 +41,4 @@ export {
   _resetInFlightForTests,
   reEmitOpenApi
 };
-//# sourceMappingURL=dev-emit-NO6OZJOQ.js.map
+//# sourceMappingURL=dev-emit-HHP2XJXE.js.map