theokit 0.4.0-beta.0 → 0.5.0

package/dist/{chunk-X4JAX2U3.js → chunk-4S2UCILN.js}

@@ -2,152 +2,188 @@
 import "tsx/esm";
 import {
   servicesConfigSchema
-} from "./chunk-WZ7CPVQB.js";
+} from "./chunk-27LWMYNK.js";
 
 // src/config/schema.ts
+import { z as z8 } from "zod";
+
+// src/config/schemas/header-safe.ts
 import { z } from "zod";
-var baseRateLimitSchema = z.object({
-  windowMs: z.number().min(1),
-  max: z.number().int().min(1)
+var headerSafeString = z.string().refine((s) => !/[\r\n]/.test(s), { message: "Header value must not contain CR/LF" });
+
+// src/config/schemas/rate-limit.ts
+import { z as z2 } from "zod";
+var baseRateLimitSchema = z2.object({
+  windowMs: z2.number().min(1),
+  max: z2.number().int().min(1)
 });
-var rateLimitSchema = z.union([
+var rateLimitSchema = z2.union([
   baseRateLimitSchema,
-  z.object({
+  z2.object({
     default: baseRateLimitSchema.optional(),
-    routes: z.record(z.string(), baseRateLimitSchema).optional(),
-    keyBy: z.union([
-      z.enum(["ip", "session", "user"]),
-      z.function().args(z.unknown()).returns(z.string())
+    routes: z2.record(z2.string(), baseRateLimitSchema).optional(),
+    keyBy: z2.union([
+      z2.enum(["ip", "session", "user"]),
+      z2.function({ input: z2.tuple([z2.unknown()]), output: z2.string() })
     ]).optional(),
-    cookieName: z.string().min(1).optional()
+    cookieName: z2.string().min(1).optional()
   })
 ]);
-var uploadSchema = z.object({
-  maxFileSize: z.number().min(1).default(10 * 1024 * 1024),
+
+// src/config/schemas/upload.ts
+import { z as z3 } from "zod";
+var uploadSchema = z3.object({
+  maxFileSize: z3.number().min(1).default(10 * 1024 * 1024),
   // 10MB
-  maxFiles: z.number().int().min(1).default(10),
-  maxFieldSize: z.number().min(1).default(1 * 1024 * 1024)
+  maxFiles: z3.number().int().min(1).default(10),
+  maxFieldSize: z3.number().min(1).default(1 * 1024 * 1024)
   // 1MB
 });
-var loggingSchema = z.object({
-  level: z.enum(["debug", "info", "warn", "error", "silent"]).default("info")
+
+// src/config/schemas/logging.ts
+import { z as z4 } from "zod";
+var loggingSchema = z4.object({
+  level: z4.enum(["debug", "info", "warn", "error", "silent"]).default("info")
 });
-var routeRuleSchema = z.object({
-  maxAge: z.number().nonnegative().finite().optional(),
-  swr: z.number().nonnegative().finite().optional(),
-  tags: z.array(z.string()).optional()
+
+// src/config/schemas/cache.ts
+import { z as z5 } from "zod";
+var routeRuleSchema = z5.object({
+  maxAge: z5.number().nonnegative().finite().optional(),
+  swr: z5.number().nonnegative().finite().optional(),
+  tags: z5.array(z5.string()).optional()
 });
-var cacheSchema = z.object({
-  enabled: z.boolean().default(true),
+var cacheSchema = z5.object({
+  enabled: z5.boolean().default(true),
   /** 'memory' uses InMemoryCacheAdapter; otherwise pass a custom adapter instance. */
-  storage: z.union([z.literal("memory"), z.custom()]).default("memory"),
-  maxEntries: z.number().int().positive().default(1e3),
-  defaults: z.object({
-    maxAge: z.number().nonnegative().finite().default(1),
-    swr: z.number().nonnegative().finite().optional(),
-    cacheErrors: z.boolean().default(false)
-  }).default({}),
-  keyDerivation: z.object({
-    excludeQuery: z.array(z.string()).optional(),
-    sortQuery: z.boolean().default(true),
-    lowercaseHost: z.boolean().default(true)
-  }).default({}),
-  routeRules: z.record(z.string(), routeRuleSchema).optional()
+  storage: z5.union([z5.literal("memory"), z5.custom()]).default("memory"),
+  maxEntries: z5.number().int().positive().default(1e3),
+  defaults: z5.object({
+    maxAge: z5.number().nonnegative().finite().default(1),
+    swr: z5.number().nonnegative().finite().optional(),
+    cacheErrors: z5.boolean().default(false)
+  }).default({ maxAge: 1, cacheErrors: false }),
+  keyDerivation: z5.object({
+    excludeQuery: z5.array(z5.string()).optional(),
+    sortQuery: z5.boolean().default(true),
+    lowercaseHost: z5.boolean().default(true)
+  }).default({ sortQuery: true, lowercaseHost: true }),
+  routeRules: z5.record(z5.string(), routeRuleSchema).optional()
 });
-var headerSafeString = z.string().refine((s) => !/[\r\n]/.test(s), { message: "Header value must not contain CR/LF" });
-var securityHeadersSchema = z.object({
-  csp: z.union([headerSafeString, z.literal(false)]).optional(),
+
+// src/config/schemas/security.ts
+import { z as z6 } from "zod";
+var securityHeadersSchema = z6.object({
+  csp: z6.union([headerSafeString, z6.literal(false)]).optional(),
   // T6.1 — default flipped from 'report-only' to 'enforce' for 0.3.0.
   // Users who want the old behaviour set `cspMode: 'report-only'`
   // explicitly. See docs/migrating/0.2-to-0.3.md.
-  cspMode: z.enum(["enforce", "report-only", "off"]).default("enforce"),
-  hsts: z.union([headerSafeString, z.literal(false)]).optional(),
-  frameOptions: z.enum(["DENY", "SAMEORIGIN"]).default("DENY"),
-  contentTypeOptions: z.literal("nosniff").default("nosniff"),
+  cspMode: z6.enum(["enforce", "report-only", "off"]).default("enforce"),
+  hsts: z6.union([headerSafeString, z6.literal(false)]).optional(),
+  frameOptions: z6.enum(["DENY", "SAMEORIGIN"]).default("DENY"),
+  contentTypeOptions: z6.literal("nosniff").default("nosniff"),
   referrerPolicy: headerSafeString.default("strict-origin-when-cross-origin"),
   /**
    * T1.1 — Permissions-Policy directive string. EC-3-refined: rejects CR/LF.
    * Pass `false` to suppress the header.
    */
-  permissionsPolicy: z.union([headerSafeString, z.literal(false)]).optional()
+  permissionsPolicy: z6.union([headerSafeString, z6.literal(false)]).optional()
 });
-var disallowedConfigSchema = z.object({
-  routes: z.array(z.union([z.string(), z.instanceof(RegExp)])),
-  behavior: z.enum(["warn", "raise"]).default("raise")
+var disallowedConfigSchema = z6.object({
+  routes: z6.array(z6.union([z6.string(), z6.instanceof(RegExp)])),
+  behavior: z6.enum(["warn", "raise"]).default("raise")
 });
-var corsSchema = z.object({
-  origins: z.union([
-    z.literal("*"),
+var corsSchema = z6.object({
+  origins: z6.union([
+    z6.literal("*"),
     headerSafeString,
-    z.instanceof(RegExp),
-    z.array(z.union([headerSafeString, z.instanceof(RegExp)])),
-    z.function().args(z.string()).returns(z.boolean())
+    z6.instanceof(RegExp),
+    z6.array(z6.union([headerSafeString, z6.instanceof(RegExp)])),
+    z6.function({ input: z6.tuple([z6.string()]), output: z6.boolean() })
   ]),
-  methods: z.array(z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"])).optional(),
-  allowedHeaders: z.array(headerSafeString).optional(),
-  exposedHeaders: z.array(headerSafeString).optional(),
-  credentials: z.boolean().default(false),
-  maxAge: z.number().int().min(0).max(86400).default(600)
+  methods: z6.array(z6.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"])).optional(),
+  allowedHeaders: z6.array(headerSafeString).optional(),
+  exposedHeaders: z6.array(headerSafeString).optional(),
+  credentials: z6.boolean().default(false),
+  maxAge: z6.number().int().min(0).max(86400).default(600)
 }).refine((c) => !(c.origins === "*" && c.credentials), {
   message: 'CORS spec forbids origins:"*" with credentials:true \u2014 browsers ignore the wildcard'
 });
-var securitySchema = z.object({
+var securitySchema = z6.object({
   // T6.1 — default flipped from 'warn' to 'strict' for 0.3.0. Apps that
   // grep their warn-mode logs from 0.2.x already know which endpoints
   // break; opt back into 'warn' globally OR use disallowedRoutes for
   // surgical migration. See docs/migrating/0.2-to-0.3.md.
-  csrf: z.enum(["off", "warn", "strict"]).default("strict"),
+  csrf: z6.enum(["off", "warn", "strict"]).default("strict"),
   headers: securityHeadersSchema.optional(),
   /** T5.1 — per-route escalation (Rails disallowed_warnings pattern). */
   disallowed: disallowedConfigSchema.optional(),
   /** T1.2 — Cross-Origin Resource Sharing. Single global config; runs first in pipeline. */
   cors: corsSchema.optional()
 });
-var tlsConfigSchema = z.object({
-  rejectUnauthorized: z.boolean().optional(),
-  caCert: z.string().optional(),
-  clientCert: z.string().optional(),
-  clientKey: z.string().optional()
+
+// src/config/schemas/storage.ts
+import { z as z7 } from "zod";
+var tlsConfigSchema = z7.object({
+  rejectUnauthorized: z7.boolean().optional(),
+  caCert: z7.string().optional(),
+  clientCert: z7.string().optional(),
+  clientKey: z7.string().optional()
 });
-var serverConfigSchema = z.object({
-  host: z.string().min(1),
-  port: z.number().int().positive().max(65535).optional(),
-  user: z.string().min(1),
+var serverConfigSchema = z7.object({
+  host: z7.string().min(1),
+  port: z7.number().int().positive().max(65535).optional(),
+  user: z7.string().min(1),
   /** Password may be the empty string (some providers permit it). */
-  password: z.string(),
+  password: z7.string(),
   tls: tlsConfigSchema.optional()
 });
-var postgresPoolConfigSchema = z.object({
-  min: z.number().int().nonnegative().optional(),
-  max: z.number().int().positive().optional(),
-  connectionTimeoutMillis: z.number().int().positive().optional(),
-  idleTimeoutMillis: z.number().int().nonnegative().optional()
+var postgresPoolConfigSchema = z7.object({
+  min: z7.number().int().nonnegative().optional(),
+  max: z7.number().int().positive().optional(),
+  connectionTimeoutMillis: z7.number().int().positive().optional(),
+  idleTimeoutMillis: z7.number().int().nonnegative().optional()
 });
-var postgresDatabaseConfigSchema = z.object({
+var postgresDatabaseConfigSchema = z7.object({
   /** References a key in `storage.servers`. Resolved at `usePostgres()` call time. */
-  server: z.string().min(1),
-  database: z.string().min(1),
+  server: z7.string().min(1),
+  database: z7.string().min(1),
   pool: postgresPoolConfigSchema.optional()
 });
 var redisServerConfigSchema = serverConfigSchema.extend({
-  db: z.number().int().nonnegative().optional(),
-  maxRetriesPerRequest: z.number().int().nonnegative().optional()
+  db: z7.number().int().nonnegative().optional(),
+  maxRetriesPerRequest: z7.number().int().nonnegative().optional()
 });
-var storageSchema = z.object({
-  servers: z.record(z.string(), serverConfigSchema).optional(),
-  databases: z.record(z.string(), postgresDatabaseConfigSchema).optional(),
-  redis: z.record(z.string(), redisServerConfigSchema).optional()
+var storageSchema = z7.object({
+  servers: z7.record(z7.string(), serverConfigSchema).optional(),
+  databases: z7.record(z7.string(), postgresDatabaseConfigSchema).optional(),
+  redis: z7.record(z7.string(), redisServerConfigSchema).optional()
 });
-var theoConfigSchema = z.object({
-  appDir: z.string().default("app"),
-  serverDir: z.string().default("server"),
+
+// src/config/schema.ts
+var theoConfigSchema = z8.object({
+  /**
+   * Plan v1.2 T2.1 — project identifier propagated into
+   * `.theo/services.json` v2 `project` field. DNS-1123 compatible (drives
+   * Gitea repo + ArgoCD App naming on TheoCloud). When omitted, the build
+   * emits services.json v1 with the legacy `services-bundle` fallback
+   * (ADR D10) and logs a deprecation warning.
+   */
+  name: z8.string().max(63).refine(
+    // DNS-1123 equivalent expressed as explicit single-char anchors so
+    // security/detect-unsafe-regex stays clean (no backtracking).
+    (value) => value.length > 0 && /^[a-z0-9-]+$/u.test(value) && !value.startsWith("-") && !value.endsWith("-"),
+    "name must match DNS-1123 (lowercase alphanumeric+hyphens, 1-63 chars, no leading/trailing hyphen)"
+  ).optional(),
+  appDir: z8.string().default("app"),
+  serverDir: z8.string().default("server"),
   /**
    * T2.2 / EC-4 — Build output directory. Must be a relative path inside
    * the project root. Refused absolute or parent-relative paths to prevent
    * `cleanOutDir` from wiping arbitrary locations (defense-in-depth on
    * top of cleanOutDir's runtime EC-3 guard).
    */
-  distDir: z.string().default(".theo").refine(
+  distDir: z8.string().default(".theo").refine(
     (d) => !/^([A-Za-z]:)?[/\\]/.test(d) && !d.startsWith(".."),
     'distDir must be a relative path inside the project root (e.g., ".theo")'
   ),
@@ -166,46 +202,46 @@ var theoConfigSchema = z.object({
    *   * `idleTimeoutMs` — auto-evict idle agents (default 30 min). 0 disables
    *     idle eviction (LRU only).
    */
-  agents: z.object({
-    maxRegistries: z.number().int().positive().default(100),
-    registry: z.object({
+  agents: z8.object({
+    maxRegistries: z8.number().int().positive().default(100),
+    registry: z8.object({
       /** LRU cap — MUST be ≥ max-concurrent-active-conversations. */
-      maxAgents: z.number().int().positive().max(1e4).default(100),
+      maxAgents: z8.number().int().positive().max(1e4).default(100),
       /** Idle eviction window in ms. 0 disables idle eviction (LRU only). */
-      idleTimeoutMs: z.number().int().nonnegative().default(30 * 6e4)
+      idleTimeoutMs: z8.number().int().nonnegative().default(30 * 6e4)
     }).optional()
   }).optional(),
-  port: z.number().int().min(1).max(65535).default(3e3),
-  ssr: z.boolean().default(false),
+  port: z8.number().int().min(1).max(65535).default(3e3),
+  ssr: z8.boolean().default(false),
   /** When true (and ssr === true), use renderToPipeableStream with progressive
    * shell flush instead of single-shot renderToString. Opt-in for streaming
    * SSR; default false preserves the current behavior. */
-  ssrStreaming: z.boolean().default(false),
+  ssrStreaming: z8.boolean().default(false),
   rateLimit: rateLimitSchema.optional(),
   upload: uploadSchema.optional(),
   logging: loggingSchema.optional(),
   security: securitySchema.optional(),
-  serialization: z.enum(["json", "superjson"]).default("json"),
+  serialization: z8.enum(["json", "superjson"]).default("json"),
   // Plugins are validated structurally at runtime by createPluginRunnerFromConfig.
   // Zod only checks the shape minimally (must be array). Type-level safety is
   // provided through defineConfig at the user surface.
-  plugins: z.array(z.unknown()).optional(),
+  plugins: z8.array(z8.unknown()).optional(),
   /** Enable client-side batching of theoFetch calls and the
    * /api/__theo_batch__ server endpoint. */
-  batching: z.union([z.boolean(), z.object({ max: z.number().int().positive().optional() })]).optional(),
+  batching: z8.union([z8.boolean(), z8.object({ max: z8.number().int().positive().optional() })]).optional(),
   /** T4.1 — Audit log. When `logger` is provided, framework events
    * (csrf.warn, rate-limit.exceeded, session.rotated, csp.violation) are
    * emitted to it. Default: noop. */
-  audit: z.object({
-    logger: z.unknown().optional()
+  audit: z8.object({
+    logger: z8.unknown().optional()
   }).optional(),
   /** TheoUI auto-wire (T2.1). `false` = opt-out; object = explicit theme/fonts;
    * undefined = enabled when @theokit/ui is detected in node_modules. */
-  ui: z.union([
-    z.literal(false),
-    z.object({
-      theme: z.enum(["violet-forge", "noir", "paper"]).optional(),
-      fonts: z.enum(["bundled", "cdn"]).optional()
+  ui: z8.union([
+    z8.literal(false),
+    z8.object({
+      theme: z8.enum(["violet-forge", "noir", "paper"]).optional(),
+      fonts: z8.enum(["bundled", "cdn"]).optional()
     })
   ]).optional(),
   /**
@@ -224,11 +260,11 @@ var theoConfigSchema = z.object({
    * Tree-shaken to noop in prod via the dual-export pattern in
    * `packages/theo/src/devtools/index.ts` (EC-17 positive prod check).
    */
-  devtools: z.union([
-    z.literal(false),
-    z.object({
-      position: z.enum(["top-left", "top-right", "bottom-left", "bottom-right"]).optional(),
-      theme: z.enum(["light", "dark", "system"]).optional()
+  devtools: z8.union([
+    z8.literal(false),
+    z8.object({
+      position: z8.enum(["top-left", "top-right", "bottom-left", "bottom-right"]).optional(),
+      theme: z8.enum(["light", "dark", "system"]).optional()
     })
   ]).optional(),
   /**
@@ -237,7 +273,7 @@ var theoConfigSchema = z.object({
    * (EC-201 / ADR D2). If `config.adapters` includes a target NOT
    * matching `--target`, `theokit build` emits a cross-reference note.
    */
-  adapters: z.array(z.string()).optional(),
+  adapters: z8.array(z8.string()).optional(),
   /**
    * Extra package names to pre-bundle via Vite's `optimizeDeps.include`.
    *
@@ -252,14 +288,14 @@ var theoConfigSchema = z.object({
    * Example:
    *   viteOptimizeDeps: ['mermaid']
    */
-  viteOptimizeDeps: z.array(z.string()).optional(),
+  viteOptimizeDeps: z8.array(z8.string()).optional(),
   /**
    * Jobs backend (ADR D3 + T2.1). When configured, every request gets
    * `ctx.queue.enqueue` auto-wired via the outbox lifecycle. Pass a
    * `JobBackend` instance (InMemoryJobBackend, PostgresJobBackend, etc.).
    */
-  jobs: z.object({
-    backend: z.custom((v) => typeof v === "object" && v !== null)
+  jobs: z8.object({
+    backend: z8.custom((v) => typeof v === "object" && v !== null)
   }).optional(),
   /**
    * StorageManager configuration (T1.1 / ADR-0007).
@@ -294,17 +330,35 @@ var theoConfigSchema = z.object({
    * The env var `THEOKIT_OPENAPI_SERVERS` (CSV of URLs) overrides
    * `servers[].url` at emit time without rebuilding the config.
    */
-  openapi: z.object({
-    servers: z.array(
-      z.object({
-        url: z.string().url(),
-        description: z.string().optional()
+  openapi: z8.object({
+    servers: z8.array(
+      z8.object({
+        url: z8.string().url(),
+        description: z8.string().optional()
       })
     ).default([{ url: "http://localhost:3000", description: "Local development" }]),
-    specVersion: z.enum(["3.1.0", "3.0.3"]).default("3.1.0"),
-    title: z.string().default("TheoKit App"),
-    version: z.string().default("0.0.0"),
-    outDir: z.string().default(".theo")
+    specVersion: z8.enum(["3.1.0", "3.0.3"]).default("3.1.0"),
+    title: z8.string().default("TheoKit App"),
+    version: z8.string().default("0.0.0"),
+    outDir: z8.string().default(".theo")
+  }).optional(),
+  /**
+   * G5 T1.3 — error envelope transformer hook (blueprint ADR D3).
+   *
+   * When present, runs at framework error-boundary time to enrich the
+   * envelope with consumer-defined extensions (`hint`, custom telemetry
+   * tags, etc.) BEFORE the envelope is serialized to the client. The
+   * function signature is preserved via the explicit `FormatErrorHook`
+   * type — TS inference flows from `theo.config.ts` into `@theo/client`
+   * codegen and `@theokit/ui` AgentErrorCard consumers.
+   *
+   * Use `z.custom<FormatErrorHook>(...)` because Zod's built-in
+   * `z.function()` discards its TS signature after parse; `z.custom`
+   * with a function-typed runtime guard preserves the call-site type
+   * without trading off Zod runtime validation.
+   */
+  formatError: z8.custom((val) => typeof val === "function", {
+    message: "formatError must be a function"
   }).optional()
 }).refine((cfg) => !Object.values(cfg.services).some((s) => s.port === cfg.port), {
   message: "service.port collides with TheoKit web port \u2014 change one of them",
@@ -312,6 +366,7 @@ var theoConfigSchema = z.object({
 });
 
 export {
+  headerSafeString,
   rateLimitSchema,
   uploadSchema,
   loggingSchema,
@@ -323,4 +378,4 @@ export {
   storageSchema,
   theoConfigSchema
 };
-//# sourceMappingURL=chunk-X4JAX2U3.js.map
+//# sourceMappingURL=chunk-4S2UCILN.js.map

package/dist/chunk-4S2UCILN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/schema.ts","../src/config/schemas/header-safe.ts","../src/config/schemas/rate-limit.ts","../src/config/schemas/upload.ts","../src/config/schemas/logging.ts","../src/config/schemas/cache.ts","../src/config/schemas/security.ts","../src/config/schemas/storage.ts"],"sourcesContent":["import { z } from 'zod'\n\nimport { servicesConfigSchema } from '../services/index.js'\n\nimport {\n  cacheSchema,\n  loggingSchema,\n  rateLimitSchema,\n  securitySchema,\n  storageSchema,\n  uploadSchema,\n  type FormatErrorContext,\n  type FormatErrorHook,\n} from './schemas/index.js'\n\n// Re-export per-concern schemas + types so downstream consumers\n// (`adapters/*`, vite-plugin, generators, tests) keep their existing\n// imports valid. Per plan T2.3 — pure structural split; zero behavior\n// change at the call site.\nexport {\n  cacheSchema,\n  corsSchema,\n  disallowedConfigSchema,\n  headerSafeString,\n  loggingSchema,\n  rateLimitSchema,\n  securityHeadersSchema,\n  securitySchema,\n  storageSchema,\n  uploadSchema,\n} from './schemas/index.js'\n\nexport type { FormatErrorContext, FormatErrorHook, StorageConfig } from './schemas/index.js'\n\n/**\n * Root `theo.config.ts` schema — composer assembled from the per-concern\n * primitives re-exported above.\n *\n * Embedded blocks that exist ONLY as part of the root config (`agents`,\n * `ui`, `devtools`, `jobs`, `openapi`) stay inline below. They have no\n * external consumers; splitting them would create lonely files (M5\n * smell) without comprehension benefit.\n */\nexport const theoConfigSchema = z\n  .object({\n    /**\n     * Plan v1.2 T2.1 — project identifier propagated into\n     * `.theo/services.json` v2 `project` field. DNS-1123 compatible (drives\n     * Gitea repo + ArgoCD App naming on TheoCloud). When omitted, the build\n     * emits services.json v1 with the legacy `services-bundle` fallback\n     * (ADR D10) and logs a deprecation warning.\n     */\n    name: z\n      .string()\n      .max(63)\n      .refine(\n        // DNS-1123 equivalent expressed as explicit single-char anchors so\n        // security/detect-unsafe-regex stays clean (no backtracking).\n        (value) =>\n          value.length > 0 &&\n          /^[a-z0-9-]+$/u.test(value) &&\n          !value.startsWith('-') &&\n          !value.endsWith('-'),\n        'name must match DNS-1123 (lowercase alphanumeric+hyphens, 1-63 chars, no leading/trailing hyphen)',\n      )\n      .optional(),\n    appDir: z.string().default('app'),\n    serverDir: z.string().default('server'),\n    /**\n     * T2.2 / EC-4 — Build output directory. Must be a relative path inside\n     * the project root. Refused absolute or parent-relative paths to prevent\n     * `cleanOutDir` from wiping arbitrary locations (defense-in-depth on\n     * top of cleanOutDir's runtime EC-3 guard).\n     */\n    distDir: z\n      .string()\n      .default('.theo')\n      .refine(\n        (d) => !/^([A-Za-z]:)?[/\\\\]/.test(d) && !d.startsWith('..'),\n        'distDir must be a relative path inside the project root (e.g., \".theo\")',\n      ),\n    /**\n     * Agent runtime configuration.\n     *\n     * - `maxRegistries` (T2.3, legacy): dev-mode cleanup of stale\n     *   `.theokit/agents/<id>/` dirs by mtime. Now superseded by SDK's\n     *   native registry GC but kept for backward-compat.\n     * - `registry` (Phase 6, Production-Readiness #2): forwarded to\n     *   `Agent.registry.configure()` lazily on first request.\n     *   * `maxAgents` — LRU cap. MUST be ≥ max-concurrent-active-conversations\n     *     (EC-17 DOCUMENT): with maxAgents:1 and 2 concurrent chats, LRU evicts\n     *     mid-stream → SDK aborts with code:'aborted'. Default 100 covers\n     *     indie/small-team; tune up for high-traffic.\n     *   * `idleTimeoutMs` — auto-evict idle agents (default 30 min). 0 disables\n     *     idle eviction (LRU only).\n     */\n    agents: z\n      .object({\n        maxRegistries: z.number().int().positive().default(100),\n        registry: z\n          .object({\n            /** LRU cap — MUST be ≥ max-concurrent-active-conversations. */\n            maxAgents: z.number().int().positive().max(10_000).default(100),\n            /** Idle eviction window in ms. 0 disables idle eviction (LRU only). */\n            idleTimeoutMs: z\n              .number()\n              .int()\n              .nonnegative()\n              .default(30 * 60_000),\n          })\n          .optional(),\n      })\n      .optional(),\n    port: z.number().int().min(1).max(65535).default(3000),\n    ssr: z.boolean().default(false),\n    /** When true (and ssr === true), use renderToPipeableStream with progressive\n     * shell flush instead of single-shot renderToString. Opt-in for streaming\n     * SSR; default false preserves the current behavior. */\n    ssrStreaming: z.boolean().default(false),\n    rateLimit: rateLimitSchema.optional(),\n    upload: uploadSchema.optional(),\n    logging: loggingSchema.optional(),\n    security: securitySchema.optional(),\n    serialization: z.enum(['json', 'superjson']).default('json'),\n    // Plugins are validated structurally at runtime by createPluginRunnerFromConfig.\n    // Zod only checks the shape minimally (must be array). Type-level safety is\n    // provided through defineConfig at the user surface.\n    plugins: z.array(z.unknown()).optional(),\n    /** Enable client-side batching of theoFetch calls and the\n     * /api/__theo_batch__ server endpoint. */\n    batching: z\n      .union([z.boolean(), z.object({ max: z.number().int().positive().optional() })])\n      .optional(),\n    /** T4.1 — Audit log. When `logger` is provided, framework events\n     * (csrf.warn, rate-limit.exceeded, session.rotated, csp.violation) are\n     * emitted to it. Default: noop. */\n    audit: z\n      .object({\n        logger: z.unknown().optional(),\n      })\n      .optional(),\n    /** TheoUI auto-wire (T2.1). `false` = opt-out; object = explicit theme/fonts;\n     * undefined = enabled when @theokit/ui is detected in node_modules. */\n    ui: z\n      .union([\n        z.literal(false),\n        z.object({\n          theme: z.enum(['violet-forge', 'noir', 'paper']).optional(),\n          fonts: z.enum(['bundled', 'cdn']).optional(),\n        }),\n      ])\n      .optional(),\n    /**\n     * Cache subsystem (caching-and-revalidation-plan).\n     * Default `undefined` keeps caching disabled (backward compatible).\n     * Pass `cache: {}` to opt in with defaults.\n     */\n    cache: cacheSchema.optional(),\n    /**\n     * Devtools overlay (Phase 0.4.0+ — see docs/plans/devtools-plan.md).\n     *\n     * - `undefined` (default): devtools auto-injects in `pnpm dev`, NEVER in `vite build`.\n     * - `false`: devtools disabled entirely (Vite plugin skips injection even in dev).\n     * - `{ ... }`: devtools enabled with explicit defaults (position, theme).\n     *\n     * Tree-shaken to noop in prod via the dual-export pattern in\n     * `packages/theo/src/devtools/index.ts` (EC-17 positive prod check).\n     */\n    devtools: z\n      .union([\n        z.literal(false),\n        z.object({\n          position: z.enum(['top-left', 'top-right', 'bottom-left', 'bottom-right']).optional(),\n          theme: z.enum(['light', 'dark', 'system']).optional(),\n        }),\n      ])\n      .optional(),\n    /**\n     * Informative list of deploy adapters the app supports. Does NOT\n     * trigger per-build translations — only the `--target` CLI flag does\n     * (EC-201 / ADR D2). If `config.adapters` includes a target NOT\n     * matching `--target`, `theokit build` emits a cross-reference note.\n     */\n    adapters: z.array(z.string()).optional(),\n    /**\n     * Extra package names to pre-bundle via Vite's `optimizeDeps.include`.\n     *\n     * Framework auto-includes `@theokit/ui` and `lucide-react` when present.\n     * Apps adding plugin peer-deps that rely on a runtime `import('<pkg>')`\n     * (dynamic specifier) — e.g. `@theokit/plugin-canvas` consumers\n     * installing `mermaid` for Mermaid SVG rendering — must declare those\n     * here so Vite can resolve the literal in dev mode without\n     * \"Failed to resolve module specifier\" errors. Production builds use\n     * tsup/esbuild bundling and are not affected.\n     *\n     * Example:\n     *   viteOptimizeDeps: ['mermaid']\n     */\n    viteOptimizeDeps: z.array(z.string()).optional(),\n    /**\n     * Jobs backend (ADR D3 + T2.1). When configured, every request gets\n     * `ctx.queue.enqueue` auto-wired via the outbox lifecycle. Pass a\n     * `JobBackend` instance (InMemoryJobBackend, PostgresJobBackend, etc.).\n     */\n    jobs: z\n      .object({\n        backend: z.custom<unknown>((v) => typeof v === 'object' && v !== null),\n      })\n      .optional(),\n    /**\n     * StorageManager configuration (T1.1 / ADR-0007).\n     *\n     * Declares Postgres servers + databases + Redis servers. Consumed by\n     * `getStorageManager().configure()` at boot via `start.ts`.\n     *\n     * Default `undefined` means manager exists but is not configured — adapters\n     * relying on the manager (PostgresJobBackend.fromStorageManager, etc.) will\n     * throw with an actionable error on first use.\n     */\n    storage: storageSchema.optional(),\n    /**\n     * Wave 2 — Polyglot services orchestration (T1.1 / ADR-0012/0013/0014/0015).\n     *\n     * Declarative external sidecar processes (Python FastAPI / Node Hono)\n     * that boot alongside the TheoKit TS app. Empty `services: {}` is the\n     * default and preserves Wave 1 behavior.\n     */\n    services: servicesConfigSchema,\n    /**\n     * G2 — OpenAPI emit (build-time only).\n     *\n     * When present, `theokit build` writes a generated `openapi.json` from\n     * every `defineRoute()` body/query/params Zod schema. `undefined` keeps\n     * the framework backward-compatible (no emit). Pass `openapi: {}` to\n     * opt in with defaults.\n     *\n     * Defaults: spec 3.1.0 · servers `http://localhost:3000` · title\n     * \"TheoKit App\" · version \"0.0.0\" · outDir \".theo\" (next to dist).\n     *\n     * The env var `THEOKIT_OPENAPI_SERVERS` (CSV of URLs) overrides\n     * `servers[].url` at emit time without rebuilding the config.\n     */\n    openapi: z\n      .object({\n        servers: z\n          .array(\n            z.object({\n              url: z.string().url(),\n              description: z.string().optional(),\n            }),\n          )\n          .default([{ url: 'http://localhost:3000', description: 'Local development' }]),\n        specVersion: z.enum(['3.1.0', '3.0.3']).default('3.1.0'),\n        title: z.string().default('TheoKit App'),\n        version: z.string().default('0.0.0'),\n        outDir: z.string().default('.theo'),\n      })\n      .optional(),\n    /**\n     * G5 T1.3 — error envelope transformer hook (blueprint ADR D3).\n     *\n     * When present, runs at framework error-boundary time to enrich the\n     * envelope with consumer-defined extensions (`hint`, custom telemetry\n     * tags, etc.) BEFORE the envelope is serialized to the client. The\n     * function signature is preserved via the explicit `FormatErrorHook`\n     * type — TS inference flows from `theo.config.ts` into `@theo/client`\n     * codegen and `@theokit/ui` AgentErrorCard consumers.\n     *\n     * Use `z.custom<FormatErrorHook>(...)` because Zod's built-in\n     * `z.function()` discards its TS signature after parse; `z.custom`\n     * with a function-typed runtime guard preserves the call-site type\n     * without trading off Zod runtime validation.\n     */\n    formatError: z\n      .custom<FormatErrorHook>((val) => typeof val === 'function', {\n        message: 'formatError must be a function',\n      })\n      .optional(),\n  })\n  // EC-2 fix: cross-config refine — no service may share TheoKit's web port.\n  .refine((cfg) => !Object.values(cfg.services).some((s) => s.port === cfg.port), {\n    message: 'service.port collides with TheoKit web port — change one of them',\n    path: ['services'],\n  })\n\nexport type TheoConfig = z.infer<typeof theoConfigSchema>\n\nexport type OpenApiConfig = NonNullable<TheoConfig['openapi']>\n\n// Silence unused-import warnings for type-only re-exports — TS strips at compile,\n// but exports above re-introduce them for downstream consumers.\nexport type _FormatErrorContext = FormatErrorContext\n","import { z } from 'zod'\n\n/**\n * EC-3 — CWE-113 HTTP Response Splitting mitigation.\n *\n * Every string that becomes a header value must reject CR/LF. Apps that\n * derive header values from untrusted input (feature flags, tenant config,\n * URL params) would otherwise let attackers inject Set-Cookie / Location\n * headers via `\\r\\n`. Apply this refinement to every header-bound string\n * field: permissionsPolicy, csp, hsts, referrerPolicy, CORS allow/expose.\n */\nexport const headerSafeString = z\n  .string()\n  .refine((s) => !/[\\r\\n]/.test(s), { message: 'Header value must not contain CR/LF' })\n","import { z } from 'zod'\n\n/**\n * Base bucket config — legacy shape preserved for backwards compatibility.\n */\nconst baseRateLimitSchema = z.object({\n  windowMs: z.number().min(1),\n  max: z.number().int().min(1),\n})\n\n/**\n * T2.2 — Per-route + per-user rate limit. The new shape adds `routes`\n * (path map), `keyBy`, and `cookieName`. The legacy flat shape is still\n * accepted via the union — see `createRouteRateLimiter` for normalization.\n */\nexport const rateLimitSchema = z.union([\n  baseRateLimitSchema,\n  z.object({\n    default: baseRateLimitSchema.optional(),\n    routes: z.record(z.string(), baseRateLimitSchema).optional(),\n    keyBy: z\n      .union([\n        z.enum(['ip', 'session', 'user']),\n        z.function({ input: z.tuple([z.unknown()]), output: z.string() }),\n      ])\n      .optional(),\n    cookieName: z.string().min(1).optional(),\n  }),\n])\n","import { z } from 'zod'\n\nexport const uploadSchema = z.object({\n  maxFileSize: z\n    .number()\n    .min(1)\n    .default(10 * 1024 * 1024), // 10MB\n  maxFiles: z.number().int().min(1).default(10),\n  maxFieldSize: z\n    .number()\n    .min(1)\n    .default(1 * 1024 * 1024), // 1MB\n})\n","import { z } from 'zod'\n\nexport const loggingSchema = z.object({\n  level: z.enum(['debug', 'info', 'warn', 'error', 'silent']).default('info'),\n})\n","import { z } from 'zod'\n\n/**\n * Cache subsystem config (caching-and-revalidation-plan).\n * Default `cache: undefined` keeps the framework backward-compatible\n * (no engine initialized → no cache primitives available).\n *\n * Setting `cache: {}` opts in with all defaults.\n */\nconst routeRuleSchema = z.object({\n  maxAge: z.number().nonnegative().finite().optional(),\n  swr: z.number().nonnegative().finite().optional(),\n  tags: z.array(z.string()).optional(),\n})\n\nexport const cacheSchema = z.object({\n  enabled: z.boolean().default(true),\n  /** 'memory' uses InMemoryCacheAdapter; otherwise pass a custom adapter instance. */\n  storage: z.union([z.literal('memory'), z.custom<unknown>()]).default('memory'),\n  maxEntries: z.number().int().positive().default(1000),\n  defaults: z\n    .object({\n      maxAge: z.number().nonnegative().finite().default(1),\n      swr: z.number().nonnegative().finite().optional(),\n      cacheErrors: z.boolean().default(false),\n    })\n    .default({ maxAge: 1, cacheErrors: false }),\n  keyDerivation: z\n    .object({\n      excludeQuery: z.array(z.string()).optional(),\n      sortQuery: z.boolean().default(true),\n      lowercaseHost: z.boolean().default(true),\n    })\n    .default({ sortQuery: true, lowercaseHost: true }),\n  routeRules: z.record(z.string(), routeRuleSchema).optional(),\n})\n","import { z } from 'zod'\n\nimport { headerSafeString } from './header-safe.js'\n\n/**\n * Phase 5 — CSRF warn-first (EC-1).\n *\n * 0.2.0 default: `warn`. Existing apps keep working but get structured\n * warnings about every state-mutating request that does not carry the\n * `X-Theo-Action: 1` header. 0.3.0 will flip the default to `strict`.\n *\n * Set explicitly to `strict` to opt into the future default early,\n * or `off` to disable CSRF entirely (only valid when you have another\n * defense — bearer auth, no session cookies, etc).\n */\n\n/**\n * Phase 6 — Default security headers (D4 / EC-2).\n *\n * 0.2.0 defaults:\n *   - CSP in `report-only` mode (EC-2: don't break existing apps)\n *   - X-Frame-Options: DENY · X-Content-Type-Options: nosniff\n *   - Referrer-Policy: strict-origin-when-cross-origin\n *   - HSTS in production only (no TLS on localhost)\n *\n * Users override individual headers, swap CSP to `enforce`, or disable\n * CSP entirely (`csp: false` / `cspMode: 'off'`).\n */\nexport const securityHeadersSchema = z.object({\n  csp: z.union([headerSafeString, z.literal(false)]).optional(),\n  // T6.1 — default flipped from 'report-only' to 'enforce' for 0.3.0.\n  // Users who want the old behaviour set `cspMode: 'report-only'`\n  // explicitly. See docs/migrating/0.2-to-0.3.md.\n  cspMode: z.enum(['enforce', 'report-only', 'off']).default('enforce'),\n  hsts: z.union([headerSafeString, z.literal(false)]).optional(),\n  frameOptions: z.enum(['DENY', 'SAMEORIGIN']).default('DENY'),\n  contentTypeOptions: z.literal('nosniff').default('nosniff'),\n  referrerPolicy: headerSafeString.default('strict-origin-when-cross-origin'),\n  /**\n   * T1.1 — Permissions-Policy directive string. EC-3-refined: rejects CR/LF.\n   * Pass `false` to suppress the header.\n   */\n  permissionsPolicy: z.union([headerSafeString, z.literal(false)]).optional(),\n})\n\n/**\n * T5.1 — Disallowed-routes escalation pattern (Rails-inspired).\n *\n * `routes` accepts string (exact match — trailing slash matters) or\n * RegExp entries. Matched routes that would otherwise emit `csrf.warn`\n * dispatch through `disallowedBehavior` instead:\n *   - `'warn'`  : no-op vs the default warn-mode behavior\n *   - `'raise'` : escalate to 403, even when global `csrf` mode is 'warn'\n *\n * Use to roll out strict mode per-route (e.g., flip /api/auth/* first)\n * without committing the entire surface to strict at once.\n */\nexport const disallowedConfigSchema = z.object({\n  routes: z.array(z.union([z.string(), z.instanceof(RegExp)])),\n  behavior: z.enum(['warn', 'raise']).default('raise'),\n})\n\n/**\n * T1.2 — CORS configuration.\n *\n * `origins` accepts a single value (`'*'`, string, RegExp, callback) OR an\n * array of (string | RegExp). The spec-violating `origins: '*'` +\n * `credentials: true` combination is rejected at parse time (browsers\n * ignore wildcards when credentials are sent).\n *\n * EC-3 — `allowedHeaders` and `exposedHeaders` entries go through the\n * header-safe refinement (CR/LF rejected — CWE-113 mitigation).\n */\nexport const corsSchema = z\n  .object({\n    origins: z.union([\n      z.literal('*'),\n      headerSafeString,\n      z.instanceof(RegExp),\n      z.array(z.union([headerSafeString, z.instanceof(RegExp)])),\n      z.function({ input: z.tuple([z.string()]), output: z.boolean() }),\n    ]),\n    methods: z\n      .array(z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'HEAD']))\n      .optional(),\n    allowedHeaders: z.array(headerSafeString).optional(),\n    exposedHeaders: z.array(headerSafeString).optional(),\n    credentials: z.boolean().default(false),\n    maxAge: z.number().int().min(0).max(86400).default(600),\n  })\n  .refine((c) => !(c.origins === '*' && c.credentials), {\n    message: 'CORS spec forbids origins:\"*\" with credentials:true — browsers ignore the wildcard',\n  })\n\nexport const securitySchema = z.object({\n  // T6.1 — default flipped from 'warn' to 'strict' for 0.3.0. Apps that\n  // grep their warn-mode logs from 0.2.x already know which endpoints\n  // break; opt back into 'warn' globally OR use disallowedRoutes for\n  // surgical migration. See docs/migrating/0.2-to-0.3.md.\n  csrf: z.enum(['off', 'warn', 'strict']).default('strict'),\n  headers: securityHeadersSchema.optional(),\n  /** T5.1 — per-route escalation (Rails disallowed_warnings pattern). */\n  disallowed: disallowedConfigSchema.optional(),\n  /** T1.2 — Cross-Origin Resource Sharing. Single global config; runs first in pipeline. */\n  cors: corsSchema.optional(),\n})\n","import { z } from 'zod'\n\n/**\n * StorageManager schemas (T1.1 / ADR-0007 D4).\n *\n * `theo.config.ts > storage` declares Postgres servers (credentials), the\n * databases on each server (TheoCloud / managed PG / self-host), and Redis\n * servers. The runtime `StorageManager` consumes this block; adapters\n * (PostgresJobBackend, PostgresConversationStorage, etc.) request pools by\n * database name and never see raw credentials at the call site.\n *\n * EC-1 (DOCUMENT in concept doc T4.1): Zod default strip-unknown mode\n * silently drops typo keys (`databasees` instead of `databases`). The\n * concept doc warns users to use exact names; runtime errors are still\n * actionable (`Database \"X\" not configured`).\n *\n * EC-2 (DEFERRED to use-time): `databases.X.server` references a key in\n * `servers`. Cross-field validation is intentionally NOT enforced at parse\n * time — `StorageManager.usePostgres()` throws an actionable error on the\n * first call with the dangling reference, matching Rails / Nitro behavior.\n */\nconst tlsConfigSchema = z.object({\n  rejectUnauthorized: z.boolean().optional(),\n  caCert: z.string().optional(),\n  clientCert: z.string().optional(),\n  clientKey: z.string().optional(),\n})\n\nconst serverConfigSchema = z.object({\n  host: z.string().min(1),\n  port: z.number().int().positive().max(65535).optional(),\n  user: z.string().min(1),\n  /** Password may be the empty string (some providers permit it). */\n  password: z.string(),\n  tls: tlsConfigSchema.optional(),\n})\n\nconst postgresPoolConfigSchema = z.object({\n  min: z.number().int().nonnegative().optional(),\n  max: z.number().int().positive().optional(),\n  connectionTimeoutMillis: z.number().int().positive().optional(),\n  idleTimeoutMillis: z.number().int().nonnegative().optional(),\n})\n\nconst postgresDatabaseConfigSchema = z.object({\n  /** References a key in `storage.servers`. Resolved at `usePostgres()` call time. */\n  server: z.string().min(1),\n  database: z.string().min(1),\n  pool: postgresPoolConfigSchema.optional(),\n})\n\nconst redisServerConfigSchema = serverConfigSchema.extend({\n  db: z.number().int().nonnegative().optional(),\n  maxRetriesPerRequest: z.number().int().nonnegative().optional(),\n})\n\nexport const storageSchema = z.object({\n  servers: z.record(z.string(), serverConfigSchema).optional(),\n  databases: z.record(z.string(), postgresDatabaseConfigSchema).optional(),\n  redis: z.record(z.string(), redisServerConfigSchema).optional(),\n})\n\nexport type StorageConfig = z.infer<typeof storageSchema>\n"],"mappings":";;;;;;;AAAA,SAAS,KAAAA,UAAS;;;ACAlB,SAAS,SAAS;AAWX,IAAM,mBAAmB,EAC7B,OAAO,EACP,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,GAAG,EAAE,SAAS,sCAAsC,CAAC;;;ACbtF,SAAS,KAAAC,UAAS;AAKlB,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EACnC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAC7B,CAAC;AAOM,IAAM,kBAAkBA,GAAE,MAAM;AAAA,EACrC;AAAA,EACAA,GAAE,OAAO;AAAA,IACP,SAAS,oBAAoB,SAAS;AAAA,IACtC,QAAQA,GAAE,OAAOA,GAAE,OAAO,GAAG,mBAAmB,EAAE,SAAS;AAAA,IAC3D,OAAOA,GACJ,MAAM;AAAA,MACLA,GAAE,KAAK,CAAC,MAAM,WAAW,MAAM,CAAC;AAAA,MAChCA,GAAE,SAAS,EAAE,OAAOA,GAAE,MAAM,CAACA,GAAE,QAAQ,CAAC,CAAC,GAAG,QAAQA,GAAE,OAAO,EAAE,CAAC;AAAA,IAClE,CAAC,EACA,SAAS;AAAA,IACZ,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,CAAC;AACH,CAAC;;;AC5BD,SAAS,KAAAC,UAAS;AAEX,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,aAAaA,GACV,OAAO,EACP,IAAI,CAAC,EACL,QAAQ,KAAK,OAAO,IAAI;AAAA;AAAA,EAC3B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE;AAAA,EAC5C,cAAcA,GACX,OAAO,EACP,IAAI,CAAC,EACL,QAAQ,IAAI,OAAO,IAAI;AAAA;AAC5B,CAAC;;;ACZD,SAAS,KAAAC,UAAS;AAEX,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,OAAOA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,SAAS,QAAQ,CAAC,EAAE,QAAQ,MAAM;AAC5E,CAAC;;;ACJD,SAAS,KAAAC,UAAS;AASlB,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EAC/B,QAAQA,GAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EACnD,KAAKA,GAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChD,MAAMA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AACrC,CAAC;AAEM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,SAASA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEjC,SAASA,GAAE,MAAM,CAACA,GAAE,QAAQ,QAAQ,GAAGA,GAAE,OAAgB,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC7E,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACpD,UAAUA,GACP,OAAO;AAAA,IACN,QAAQA,GAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC;AAAA,IACnD,KAAKA,GAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChD,aAAaA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,CAAC,EACA,QAAQ,EAAE,QAAQ,GAAG,aAAa,MAAM,CAAC;AAAA,EAC5C,eAAeA,GACZ,OAAO;AAAA,IACN,cAAcA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IAC3C,WAAWA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,IACnC,eAAeA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EACzC,CAAC,EACA,QAAQ,EAAE,WAAW,MAAM,eAAe,KAAK,CAAC;AAAA,EACnD,YAAYA,GAAE,OAAOA,GAAE,OAAO,GAAG,eAAe,EAAE,SAAS;AAC7D,CAAC;;;ACnCD,SAAS,KAAAC,UAAS;AA4BX,IAAM,wBAAwBC,GAAE,OAAO;AAAA,EAC5C,KAAKA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5D,SAASA,GAAE,KAAK,CAAC,WAAW,eAAe,KAAK,CAAC,EAAE,QAAQ,SAAS;AAAA,EACpE,MAAMA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7D,cAAcA,GAAE,KAAK,CAAC,QAAQ,YAAY,CAAC,EAAE,QAAQ,MAAM;AAAA,EAC3D,oBAAoBA,GAAE,QAAQ,SAAS,EAAE,QAAQ,SAAS;AAAA,EAC1D,gBAAgB,iBAAiB,QAAQ,iCAAiC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1E,mBAAmBA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAC5E,CAAC;AAcM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,QAAQA,GAAE,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,EAC3D,UAAUA,GAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,QAAQ,OAAO;AACrD,CAAC;AAaM,IAAM,aAAaA,GACvB,OAAO;AAAA,EACN,SAASA,GAAE,MAAM;AAAA,IACfA,GAAE,QAAQ,GAAG;AAAA,IACb;AAAA,IACAA,GAAE,WAAW,MAAM;AAAA,IACnBA,GAAE,MAAMA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,IACzDA,GAAE,SAAS,EAAE,OAAOA,GAAE,MAAM,CAACA,GAAE,OAAO,CAAC,CAAC,GAAG,QAAQA,GAAE,QAAQ,EAAE,CAAC;AAAA,EAClE,CAAC;AAAA,EACD,SAASA,GACN,MAAMA,GAAE,KAAK,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,WAAW,MAAM,CAAC,CAAC,EAC1E,SAAS;AAAA,EACZ,gBAAgBA,GAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,EACnD,gBAAgBA,GAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,EACnD,aAAaA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAG;AACxD,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,EAAE,YAAY,OAAO,EAAE,cAAc;AAAA,EACpD,SAAS;AACX,CAAC;AAEI,IAAM,iBAAiBA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,MAAMA,GAAE,KAAK,CAAC,OAAO,QAAQ,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACxD,SAAS,sBAAsB,SAAS;AAAA;AAAA,EAExC,YAAY,uBAAuB,SAAS;AAAA;AAAA,EAE5C,MAAM,WAAW,SAAS;AAC5B,CAAC;;;ACzGD,SAAS,KAAAC,UAAS;AAqBlB,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EAC/B,oBAAoBA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACzC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EAClC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,EACtD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,UAAUA,GAAE,OAAO;AAAA,EACnB,KAAK,gBAAgB,SAAS;AAChC,CAAC;AAED,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EACxC,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC7C,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,yBAAyBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9D,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAC7D,CAAC;AAED,IAAM,+BAA+BA,GAAE,OAAO;AAAA;AAAA,EAE5C,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,yBAAyB,SAAS;AAC1C,CAAC;AAED,IAAM,0BAA0B,mBAAmB,OAAO;AAAA,EACxD,IAAIA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC5C,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAChE,CAAC;AAEM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAG,kBAAkB,EAAE,SAAS;AAAA,EAC3D,WAAWA,GAAE,OAAOA,GAAE,OAAO,GAAG,4BAA4B,EAAE,SAAS;AAAA,EACvE,OAAOA,GAAE,OAAOA,GAAE,OAAO,GAAG,uBAAuB,EAAE,SAAS;AAChE,CAAC;;;APjBM,IAAM,mBAAmBC,GAC7B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQN,MAAMA,GACH,OAAO,EACP,IAAI,EAAE,EACN;AAAA;AAAA;AAAA,IAGC,CAAC,UACC,MAAM,SAAS,KACf,gBAAgB,KAAK,KAAK,KAC1B,CAAC,MAAM,WAAW,GAAG,KACrB,CAAC,MAAM,SAAS,GAAG;AAAA,IACrB;AAAA,EACF,EACC,SAAS;AAAA,EACZ,QAAQA,GAAE,OAAO,EAAE,QAAQ,KAAK;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtC,SAASA,GACN,OAAO,EACP,QAAQ,OAAO,EACf;AAAA,IACC,CAAC,MAAM,CAAC,qBAAqB,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,IAAI;AAAA,IAC1D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBF,QAAQA,GACL,OAAO;AAAA,IACN,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,IACtD,UAAUA,GACP,OAAO;AAAA;AAAA,MAEN,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAG;AAAA;AAAA,MAE9D,eAAeA,GACZ,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,QAAQ,KAAK,GAAM;AAAA,IACxB,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AAAA,EACZ,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAI;AAAA,EACrD,KAAKA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI9B,cAAcA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACvC,WAAW,gBAAgB,SAAS;AAAA,EACpC,QAAQ,aAAa,SAAS;AAAA,EAC9B,SAAS,cAAc,SAAS;AAAA,EAChC,UAAU,eAAe,SAAS;AAAA,EAClC,eAAeA,GAAE,KAAK,CAAC,QAAQ,WAAW,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA,EAI3D,SAASA,GAAE,MAAMA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,UAAUA,GACP,MAAM,CAACA,GAAE,QAAQ,GAAGA,GAAE,OAAO,EAAE,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAC9E,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,OAAOA,GACJ,OAAO;AAAA,IACN,QAAQA,GAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,CAAC,EACA,SAAS;AAAA;AAAA;AAAA,EAGZ,IAAIA,GACD,MAAM;AAAA,IACLA,GAAE,QAAQ,KAAK;AAAA,IACfA,GAAE,OAAO;AAAA,MACP,OAAOA,GAAE,KAAK,CAAC,gBAAgB,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,MAC1D,OAAOA,GAAE,KAAK,CAAC,WAAW,KAAK,CAAC,EAAE,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMZ,OAAO,YAAY,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW5B,UAAUA,GACP,MAAM;AAAA,IACLA,GAAE,QAAQ,KAAK;AAAA,IACfA,GAAE,OAAO;AAAA,MACP,UAAUA,GAAE,KAAK,CAAC,YAAY,aAAa,eAAe,cAAc,CAAC,EAAE,SAAS;AAAA,MACpF,OAAOA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,CAAC,EAAE,SAAS;AAAA,IACtD,CAAC;AAAA,EACH,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOZ,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAevC,kBAAkBA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,MAAMA,GACH,OAAO;AAAA,IACN,SAASA,GAAE,OAAgB,CAAC,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI;AAAA,EACvE,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWZ,SAAS,cAAc,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeV,SAASA,GACN,OAAO;AAAA,IACN,SAASA,GACN;AAAA,MACCA,GAAE,OAAO;AAAA,QACP,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA,QACpB,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,MACnC,CAAC;AAAA,IACH,EACC,QAAQ,CAAC,EAAE,KAAK,yBAAyB,aAAa,oBAAoB,CAAC,CAAC;AAAA,IAC/E,aAAaA,GAAE,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,QAAQ,OAAO;AAAA,IACvD,OAAOA,GAAE,OAAO,EAAE,QAAQ,aAAa;AAAA,IACvC,SAASA,GAAE,OAAO,EAAE,QAAQ,OAAO;AAAA,IACnC,QAAQA,GAAE,OAAO,EAAE,QAAQ,OAAO;AAAA,EACpC,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBZ,aAAaA,GACV,OAAwB,CAAC,QAAQ,OAAO,QAAQ,YAAY;AAAA,IAC3D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AACd,CAAC,EAEA,OAAO,CAAC,QAAQ,CAAC,OAAO,OAAO,IAAI,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,GAAG;AAAA,EAC9E,SAAS;AAAA,EACT,MAAM,CAAC,UAAU;AACnB,CAAC;","names":["z","z","z","z","z","z","z","z","z"]}

package/dist/{chunk-C52GSJPF.js → chunk-4S6YHNG2.js}

@@ -1,8 +1,13 @@
 import {
-  extractTraceContext,
-  generateNewTraceContext,
   writeAtomic
-} from "./chunk-YLBSSEHX.js";
+} from "./chunk-Y4H3JNVK.js";
+import {
+  extractTraceContext,
+  generateNewTraceContext
+} from "./chunk-6NEXVBPY.js";
+import {
+  importUserModule
+} from "./chunk-7MQOHNHE.js";
 import {
   walkSourceFiles
 } from "./chunk-X2VVCJ4V.js";
@@ -37,7 +42,6 @@ var NonRetryableError = class extends Error {
 };
 
 // src/server/jobs/job-backend-memory.ts
-import { randomUUID } from "crypto";
 var DEFAULT_MAX_PENDING = 1e4;
 var InMemoryJobBackend = class {
   name = "memory";
@@ -72,7 +76,7 @@ var InMemoryJobBackend = class {
         return { jobId: existing.jobId };
       }
     }
-    const jobId = randomUUID();
+    const jobId = globalThis.crypto.randomUUID();
     const now = Date.now();
     const availableAt = now + (input.delaySeconds ?? 0) * 1e3;
     const entry = {
@@ -444,7 +448,6 @@ function relativize(absPath, root) {
 // src/server/jobs/job-scan.ts
 import { existsSync } from "fs";
 import { basename } from "path";
-import { pathToFileURL } from "url";
 var DuplicateJobNameError = class extends Error {
   constructor(jobName, filePaths) {
     super(
@@ -476,7 +479,7 @@ async function scanJobs(jobsDir) {
   for (const filePath of filePaths) {
     let mod;
     try {
-      mod = await import(pathToFileURL(filePath).href);
+      mod = await importUserModule(filePath);
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       throw new Error(`Failed to import job file "${filePath}": ${reason}`);
@@ -520,4 +523,4 @@ export {
   DuplicateJobNameError,
   scanJobs
 };
-//# sourceMappingURL=chunk-C52GSJPF.js.map
+//# sourceMappingURL=chunk-4S6YHNG2.js.map