theokit 0.48.13 → 0.50.0

package/dist/chunk-FD4ZDTQ6.js

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/server/_internal/compare-by-code-unit.ts
+function compareByCodeUnit(a, b) {
+  if (a < b) return -1;
+  if (a > b) return 1;
+  return 0;
+}
+
+// src/server/_internal/scan-walker.ts
+import { readdirSync } from "fs";
+import { extname, join, resolve } from "path";
+function walkSourceFiles(root, opts, onFile) {
+  const skipPrefixes = opts.skipPrefixes ?? ["_", "."];
+  const readDir = opts.readDir ?? ((dir) => readdirSync(dir, { withFileTypes: true }));
+  const visit = (dir) => {
+    let entries;
+    try {
+      entries = readDir(dir);
+    } catch {
+      return;
+    }
+    const ordered = [...entries].sort((a, b) => compareByCodeUnit(a.name, b.name));
+    for (const entry of ordered) {
+      const fullPath = join(dir, entry.name);
+      if (entry.isDirectory() && !skipPrefixes.some((p) => entry.name.startsWith(p))) {
+        visit(fullPath);
+      } else if (entry.isFile() && opts.extensions.has(extname(entry.name))) {
+        onFile(resolve(fullPath));
+      }
+    }
+  };
+  visit(root);
+}
+
+// src/server/scan/errors.ts
+var ROUTER_MIGRATION_GUIDE_URL = "https://theokit.dev/migration/0.3-to-0.4-router";
+var RouterConventionError = class extends Error {
+  name = "RouterConventionError";
+  file;
+  suggestion;
+  migrationUrl;
+  constructor(opts) {
+    const migrationUrl = opts.migrationUrl ?? ROUTER_MIGRATION_GUIDE_URL;
+    const message = [
+      `Router convention violation: dotted route basename is not supported in theokit 0.4+.`,
+      ``,
+      `  File: ${opts.file}`,
+      `  Use directory-nested form: ${opts.suggestion}`,
+      ``,
+      `Migration guide: ${migrationUrl}`,
+      `Run \`theokit migrate router\` to convert all dotted basenames automatically.`
+    ].join("\n");
+    super(message);
+    this.file = opts.file;
+    this.suggestion = opts.suggestion;
+    this.migrationUrl = migrationUrl;
+  }
+};
+var ROUTE_POLICY_MIGRATION_GUIDE_URL = "https://theokit.dev/migration/route-policy";
+var MissingRoutePolicyError = class extends Error {
+  name = "MissingRoutePolicyError";
+  file;
+  routePath;
+  methods;
+  migrationUrl;
+  constructor(opts) {
+    const migrationUrl = opts.migrationUrl ?? ROUTE_POLICY_MIGRATION_GUIDE_URL;
+    const methods = [...opts.methods].sort(compareByCodeUnit);
+    const message = [
+      `Route policy not declared: every route says who may call it (ADR 0001).`,
+      ``,
+      `  File:    ${opts.file}`,
+      `  Route:   ${opts.routePath}`,
+      `  Missing: ${methods.join(", ")}`,
+      ``,
+      `Add a policy to each method listed above:`,
+      ``,
+      // The import is part of the remedy, not decoration. This message shipped
+      // naming `requireOwner` while no entry point exported it, so it read as
+      // actionable and was not. `tests/unit/policy-gate-remedy-is-importable.test.ts`
+      // asserts that every symbol named here is reachable from the path named here.
+      `  import { route, requireOwner } from 'theokit/server/define'`,
+      ``,
+      `  export const ${methods[0] ?? "GET"} = route()`,
+      `    .policy('public')                                  // anyone may call this`,
+      `    .handler(...)`,
+      `    .build()`,
+      ``,
+      `  export const ${methods[0] ?? "GET"} = route()`,
+      `    .policy(({ subject, params }) => requireOwner(subject, ownerOf(params.id)))`,
+      `    .handler(...)`,
+      `    .build()`,
+      ``,
+      `Writing 'public' is a decision and not a default. It states that this route`,
+      `is open to anyone who can reach it, and it is greppable, so how much of the`,
+      `app is open becomes a number somebody can read.`,
+      ``,
+      `Migration guide: ${migrationUrl}`
+    ].join("\n");
+    super(message);
+    this.file = opts.file;
+    this.routePath = opts.routePath;
+    this.methods = methods;
+    this.migrationUrl = migrationUrl;
+  }
+};
+var AGENT_POLICY_MIGRATION_GUIDE_URL = "https://theokit.dev/migration/agent-policy";
+var MissingAgentPolicyError = class extends Error {
+  name = "MissingAgentPolicyError";
+  file;
+  agentPath;
+  migrationUrl;
+  constructor(opts) {
+    const migrationUrl = opts.migrationUrl ?? AGENT_POLICY_MIGRATION_GUIDE_URL;
+    const message = [
+      `Agent policy not declared: every agent says who may run it (ADR 0001).`,
+      ``,
+      `  File:  ${opts.file}`,
+      `  Agent: ${opts.agentPath}`,
+      ``,
+      `This one declaration covers every endpoint the agent exposes - the run, the`,
+      `thread routes, the pending-approval listing, the approve route and MCP - because`,
+      `they all reach the same conversation and the same paused tools.`,
+      ``,
+      `Add ONE of these to the file above:`,
+      ``,
+      `  export const policy = 'public'   // anyone who can reach it may run it`,
+      ``,
+      `  import { requireOwner } from 'theokit/server/define'`,
+      ``,
+      `  //  subject  <- what server/context.ts put on ctx.subject`,
+      `  //  params   <- { agent, endpoint, sessionId?, approvalId? }`,
+      `  //  body     <- the parsed chat body, on the endpoints that have one`,
+      `  export const policy = ({ subject, params }) =>`,
+      `    requireOwner(subject, ownerOf(params.sessionId))`,
+      ``,
+      `Writing 'public' is a decision and not a default. The endpoint resumes whatever`,
+      `conversation the CALLER names, so 'public' means any caller holding an id may read`,
+      `and continue that conversation - a capability model, which is legitimate when it is`,
+      `the choice somebody made and greppable once it is written down.`,
+      ``,
+      `Migration guide: ${migrationUrl}`
+    ].join("\n");
+    super(message);
+    this.file = opts.file;
+    this.agentPath = opts.agentPath;
+    this.migrationUrl = migrationUrl;
+  }
+};
+
+// src/server/scan/file-stamp-cache.ts
+import { statSync } from "fs";
+function createFileStampCache() {
+  const entries = /* @__PURE__ */ new Map();
+  return {
+    get(filePath, compute) {
+      const stat = statSync(filePath);
+      const key = `${filePath}:${String(stat.mtimeMs)}:${String(stat.size)}`;
+      const hit = entries.get(key);
+      if (hit !== void 0 || entries.has(key)) return hit;
+      const value = compute();
+      entries.set(key, value);
+      return value;
+    },
+    clear() {
+      entries.clear();
+    }
+  };
+}
+
+export {
+  compareByCodeUnit,
+  walkSourceFiles,
+  RouterConventionError,
+  MissingRoutePolicyError,
+  MissingAgentPolicyError,
+  createFileStampCache
+};
+//# sourceMappingURL=chunk-FD4ZDTQ6.js.map

package/dist/chunk-FD4ZDTQ6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/_internal/compare-by-code-unit.ts","../src/server/_internal/scan-walker.ts","../src/server/scan/errors.ts","../src/server/scan/file-stamp-cache.ts"],"sourcesContent":["/**\n * Total order over strings by UTF-16 code unit — the ordering build-time output\n * must use.\n *\n * `localeCompare` is the wrong instrument here, and reads like the right one,\n * which is why it kept being chosen. With no locale argument it uses the default\n * collator, and Node derives that from `LC_ALL`/`LANG`: under `sv-SE` an `ä`\n * sorts after `z`, under `en-US` before `a`. A scanner ordering that way emits a\n * different manifest per machine — and where the order being emitted is an\n * execution order, it decides which middleware runs first\n * (usetheokit/theokit#346, usetheokit/theokit#351).\n *\n * What build output needs from a comparator is that it be total and stable.\n * Being alphabetical for a reader of one particular language is not a property\n * it needs, and is the one that costs reproducibility.\n *\n * Presentation code is the opposite case and should keep `localeCompare`: a list\n * a human reads should collate the way that human's language collates.\n *\n * @internal\n */\nexport function compareByCodeUnit(a: string, b: string): number {\n  if (a < b) return -1\n  if (a > b) return 1\n  return 0\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks directories derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { readdirSync } from 'node:fs'\nimport type { Dirent } from 'node:fs'\nimport { extname, join, resolve } from 'node:path'\n\nimport { compareByCodeUnit } from './compare-by-code-unit.js'\n\n/**\n * Options for walkSourceFiles.\n *\n * Sequential by design — callers (route precedence) depend on insertion\n * order (EC-19 documented decision). Async-callback support is implicit\n * via JavaScript's serial await loop.\n *\n * Tested on macOS + Linux. Windows long-path support not validated (EC-20).\n */\ninterface WalkOptions {\n  /** File extensions to include (e.g., new Set(['.ts', '.tsx'])). */\n  extensions: ReadonlySet<string>\n  /** Skip directories whose name starts with any of these (default: ['_', '.']). */\n  skipPrefixes?: readonly string[]\n  /**\n   * Read one directory. Defaults to `readdirSync`.\n   *\n   * Injected for one reason: the ordering below cannot be tested against a real\n   * filesystem. `readdirSync` returns whatever the filesystem returns — creation\n   * order on tmpfs, hash order on ext4 with `dir_index` — and on the machine\n   * this was written on those four names came back already sorted, so a\n   * name-based test passed before the sort existed and proved nothing. A test\n   * that agrees with the code because both read the same accidental order is\n   * `B-022`, and writing one here would have been that item committed inside its\n   * own fix.\n   */\n  readDir?: (dir: string) => Dirent[]\n}\n\n/**\n * Recursively walk `root`, invoking `onFile(absPath)` for every file matching\n * `opts.extensions`. Directories whose name starts with any `skipPrefixes`\n * char are skipped (defaults to `_` and `.`).\n *\n * Entries are emitted in UTF-16 code-unit order, files and directories in one\n * total order. Without it the walker passed the filesystem's order through to\n * six scanners — routes, actions, websockets, cron, agents, jobs — and only one\n * re-orders afterwards, so five emitted a different manifest per machine. Where\n * that order is an execution order it decides what runs first (#346, B-004).\n *\n * Replaces 3 near-identical recursive walkers in scan.ts, action-scan.ts,\n * ws-scan.ts (PV-3 — DRY consolidation). Resolves T3.1 of\n * architecture-review-remediation-plan. Six call sites consume it today, not\n * three; the count in this paragraph was true when it was written.\n *\n * Symlink loops are NOT tracked — callers must avoid them or pre-resolve\n * via `fs.realpath`. EC-11 documented but not implemented (rare in dev).\n */\nexport function walkSourceFiles(\n  root: string,\n  opts: WalkOptions,\n  onFile: (absPath: string) => void,\n): void {\n  const skipPrefixes = opts.skipPrefixes ?? ['_', '.']\n  const readDir = opts.readDir ?? ((dir: string) => readdirSync(dir, { withFileTypes: true }))\n  const visit = (dir: string): void => {\n    let entries\n    try {\n      entries = readDir(dir)\n    } catch {\n      // Silently skip unreadable directories — caller controls discoverability\n      return\n    }\n    // One total order over files and directories together, so a name sorts the\n    // same way whichever it is. Sorting the two groups separately would emit a\n    // different interleaving than a single pass, which is an ordering decision\n    // nobody made (#346).\n    const ordered = [...entries].sort((a, b) => compareByCodeUnit(a.name, b.name))\n    for (const entry of ordered) {\n      const fullPath = join(dir, entry.name)\n      if (entry.isDirectory() && !skipPrefixes.some((p) => entry.name.startsWith(p))) {\n        visit(fullPath)\n      } else if (entry.isFile() && opts.extensions.has(extname(entry.name))) {\n        onFile(resolve(fullPath))\n      }\n    }\n  }\n  visit(root)\n}\n","import { compareByCodeUnit } from '../_internal/compare-by-code-unit.js'\n\n/**\n * Router-convention errors thrown by the server-route scanner.\n *\n *\n * theokit 0.4.0+ enforces directory-nested file-system routing\n * (`auth/[provider]/login.ts`) and REJECTS dotted-basename routes\n * (`auth.[provider].login.ts`) because the legacy regex extracted the\n * dotted basename incorrectly — `params.provider` was undefined at request\n * time. Decision recorded in the plan above (`g6-router-convention-plan.md`) and CHANGELOG 0.4.0\n * (no standalone ADR was cut for this router-convention change).\n */\n\n/**\n * Canonical migration guide URL. T4.2 establishes this as the authoritative\n * landing page. EC-3: error message uses this constant so the URL never\n * drifts from the doc location.\n */\nexport const ROUTER_MIGRATION_GUIDE_URL = 'https://theokit.dev/migration/0.3-to-0.4-router'\n\ninterface RouterConventionErrorOptions {\n  /** Absolute path of the offending route file. */\n  file: string\n  /** Suggested directory-nested replacement path (relative, e.g. `routes/auth/[provider]/login.ts`). */\n  suggestion: string\n  /** Migration guide URL (defaults to `ROUTER_MIGRATION_GUIDE_URL`). */\n  migrationUrl?: string\n}\n\n/**\n * Thrown by `scanServerRoutes` when a route file uses the legacy\n * dotted-basename convention (`auth.[provider].login.ts`).\n *\n * The error is FAIL-FAST by design — running with a route that has wrong\n * `paramNames` produces silent 404s at request time, which is strictly\n * worse than a build-time error.\n */\nexport class RouterConventionError extends Error {\n  override readonly name = 'RouterConventionError'\n  readonly file: string\n  readonly suggestion: string\n  readonly migrationUrl: string\n\n  constructor(opts: RouterConventionErrorOptions) {\n    const migrationUrl = opts.migrationUrl ?? ROUTER_MIGRATION_GUIDE_URL\n    const message = [\n      `Router convention violation: dotted route basename is not supported in theokit 0.4+.`,\n      ``,\n      `  File: ${opts.file}`,\n      `  Use directory-nested form: ${opts.suggestion}`,\n      ``,\n      `Migration guide: ${migrationUrl}`,\n      `Run \\`theokit migrate router\\` to convert all dotted basenames automatically.`,\n    ].join('\\n')\n    super(message)\n    this.file = opts.file\n    this.suggestion = opts.suggestion\n    this.migrationUrl = migrationUrl\n  }\n}\n\n/**\n * Canonical landing page for the policy-declaration migration. Held as a\n * constant for the same reason as {@link ROUTER_MIGRATION_GUIDE_URL}: the error\n * message and the doc cannot drift apart if only one of them names the URL.\n *\n * Module-local, unlike its sibling: nothing outside this file needs to name it,\n * and an export with no consumer is what `knip` exists to refuse.\n */\nconst ROUTE_POLICY_MIGRATION_GUIDE_URL = 'https://theokit.dev/migration/route-policy'\n\ninterface MissingRoutePolicyErrorOptions {\n  /** Absolute path of the route file. */\n  file: string\n  /** The URL path the file resolves to, so the message reads like the app, not like the disk. */\n  routePath: string\n  /** The exported HTTP methods that declare no policy. */\n  methods: string[]\n  /** Migration guide URL (defaults to {@link ROUTE_POLICY_MIGRATION_GUIDE_URL}). */\n  migrationUrl?: string\n}\n\n/**\n * Thrown by `scanServerRoutes` when a route file exports an HTTP method that\n * declares no access policy (ADR 0001, Decision point 5).\n *\n * Absence used to mean \"not declared\", which every reader and every transport\n * had to interpret as open. The interpretation was the bug: a route nobody\n * thought about looked exactly like a route deliberately left open. This error\n * is where the two stop looking alike.\n *\n * It fires at scan time — `theo build`, `theo start`, `theo dev`, `theo routes`\n * and every deployment adapter go through the same scanner — so the answer\n * arrives before a request does, in the same place the scanner already refuses\n * a dotted basename and a collision with the reserved batch path.\n */\nexport class MissingRoutePolicyError extends Error {\n  override readonly name = 'MissingRoutePolicyError'\n  readonly file: string\n  readonly routePath: string\n  readonly methods: string[]\n  readonly migrationUrl: string\n\n  constructor(opts: MissingRoutePolicyErrorOptions) {\n    const migrationUrl = opts.migrationUrl ?? ROUTE_POLICY_MIGRATION_GUIDE_URL\n    const methods = [...opts.methods].sort(compareByCodeUnit)\n    const message = [\n      `Route policy not declared: every route says who may call it (ADR 0001).`,\n      ``,\n      `  File:    ${opts.file}`,\n      `  Route:   ${opts.routePath}`,\n      `  Missing: ${methods.join(', ')}`,\n      ``,\n      `Add a policy to each method listed above:`,\n      ``,\n      // The import is part of the remedy, not decoration. This message shipped\n      // naming `requireOwner` while no entry point exported it, so it read as\n      // actionable and was not. `tests/unit/policy-gate-remedy-is-importable.test.ts`\n      // asserts that every symbol named here is reachable from the path named here.\n      `  import { route, requireOwner } from 'theokit/server/define'`,\n      ``,\n      `  export const ${methods[0] ?? 'GET'} = route()`,\n      `    .policy('public')                                  // anyone may call this`,\n      `    .handler(...)`,\n      `    .build()`,\n      ``,\n      `  export const ${methods[0] ?? 'GET'} = route()`,\n      `    .policy(({ subject, params }) => requireOwner(subject, ownerOf(params.id)))`,\n      `    .handler(...)`,\n      `    .build()`,\n      ``,\n      `Writing 'public' is a decision and not a default. It states that this route`,\n      `is open to anyone who can reach it, and it is greppable, so how much of the`,\n      `app is open becomes a number somebody can read.`,\n      ``,\n      `Migration guide: ${migrationUrl}`,\n    ].join('\\n')\n    super(message)\n    this.file = opts.file\n    this.routePath = opts.routePath\n    this.methods = methods\n    this.migrationUrl = migrationUrl\n  }\n}\n\n/**\n * Canonical landing page for the agent-policy migration. Module-local for the same reason as its\n * route sibling: nothing outside this file names it, and an export with no consumer is what `knip`\n * exists to refuse.\n */\nconst AGENT_POLICY_MIGRATION_GUIDE_URL = 'https://theokit.dev/migration/agent-policy'\n\ninterface MissingAgentPolicyErrorOptions {\n  /** Absolute path of the agent file. */\n  file: string\n  /** The URL the agent is served at, so the message reads like the app rather than like the disk. */\n  agentPath: string\n  /** Migration guide URL (defaults to {@link AGENT_POLICY_MIGRATION_GUIDE_URL}). */\n  migrationUrl?: string\n}\n\n/**\n * Thrown by `scanAgents` when an agent file declares no access policy\n * (ADR 0001 Decision point 5, extended to the agent surface by usetheokit/theokit#365).\n *\n * ## Why absence had to stop meaning open HERE and not at runtime\n *\n * The agent endpoints resume a conversation the CALLER names, and they are dispatched before route\n * matching, so no route, no middleware and no `server/context.ts` ever saw those URLs. A caller\n * holding a conversation id and no credential read that conversation back.\n *\n * There is no safe runtime default for that. Refusing every caller-named session id would break\n * multi-turn chat, which is the base case; admitting them is the defect. So the decision moves to\n * where a person can answer it once, in the file that owns the agent — the same place and the same\n * reasoning as the route gate, which is why this error reads like its sibling.\n *\n * ## What it costs\n *\n * Every existing application with an agent fails its next build until it adds one line. That is the\n * half of ADR 0001 the ADR itself called breaking, and the trade it names: a build error that\n * points at a file beats a silent 200 that hands over somebody else's conversation.\n */\nexport class MissingAgentPolicyError extends Error {\n  override readonly name = 'MissingAgentPolicyError'\n  readonly file: string\n  readonly agentPath: string\n  readonly migrationUrl: string\n\n  constructor(opts: MissingAgentPolicyErrorOptions) {\n    const migrationUrl = opts.migrationUrl ?? AGENT_POLICY_MIGRATION_GUIDE_URL\n    const message = [\n      `Agent policy not declared: every agent says who may run it (ADR 0001).`,\n      ``,\n      `  File:  ${opts.file}`,\n      `  Agent: ${opts.agentPath}`,\n      ``,\n      `This one declaration covers every endpoint the agent exposes - the run, the`,\n      `thread routes, the pending-approval listing, the approve route and MCP - because`,\n      `they all reach the same conversation and the same paused tools.`,\n      ``,\n      `Add ONE of these to the file above:`,\n      ``,\n      `  export const policy = 'public'   // anyone who can reach it may run it`,\n      ``,\n      `  import { requireOwner } from 'theokit/server/define'`,\n      ``,\n      `  //  subject  <- what server/context.ts put on ctx.subject`,\n      `  //  params   <- { agent, endpoint, sessionId?, approvalId? }`,\n      `  //  body     <- the parsed chat body, on the endpoints that have one`,\n      `  export const policy = ({ subject, params }) =>`,\n      `    requireOwner(subject, ownerOf(params.sessionId))`,\n      ``,\n      `Writing 'public' is a decision and not a default. The endpoint resumes whatever`,\n      `conversation the CALLER names, so 'public' means any caller holding an id may read`,\n      `and continue that conversation - a capability model, which is legitimate when it is`,\n      `the choice somebody made and greppable once it is written down.`,\n      ``,\n      `Migration guide: ${migrationUrl}`,\n    ].join('\\n')\n    super(message)\n    this.file = opts.file\n    this.agentPath = opts.agentPath\n    this.migrationUrl = migrationUrl\n  }\n}\n","/**\n * Memoise per source file, invalidated by the file's own stamp.\n *\n * ## Why this exists\n *\n * `theokit dev` re-scans the routes and agents directories on EVERY request, so any work that\n * parses a file with the TypeScript AST turns a build-time check into per-request latency.\n * `agent-scan.ts` recognised this and carried its own `Map` keyed on `path:mtimeMs:size`;\n * `scan.ts` — with far more files — carried neither the cache nor the reasoning, and the\n * route-policy gate then added a SECOND full parse of every route file on top of the one\n * `detectExportedHttpMethods` had been paying since before it (usetheokit/theokit#417).\n *\n * Lifting the mechanism here rather than copying it is the point: two hand-rolled caches keyed\n * \"the same way\" are two chances for the keys to stop being the same.\n *\n * ## Why the stamp and not a watcher\n *\n * `mtimeMs` and `size` together come from the `statSync` the scanner is doing anyway, so an edit\n * invalidates the entry without anyone remembering to, and a `theokit build` — one process, one\n * scan — never notices the cache exists.\n *\n * The known limit, stated rather than discovered: a rewrite that preserves BOTH mtime and size is\n * invisible. That is a deliberate trade every mtime cache makes, and the alternative (hashing the\n * contents) reads the file to avoid reading the file.\n */\nimport { statSync } from 'node:fs'\n\nexport interface FileStampCache<T> {\n  /** The memoised value for `filePath`, computing it when the file's stamp has changed. */\n  get: (filePath: string, compute: () => T) => T\n  /** Test seam — a module-level cache would otherwise outlive a fixture directory. */\n  clear: () => void\n}\n\nexport function createFileStampCache<T>(): FileStampCache<T> {\n  const entries = new Map<string, T>()\n\n  return {\n    get(filePath, compute) {\n      // A path the scanner itself discovered by globbing the project, never caller input at runtime.\n      // eslint-disable-next-line security/detect-non-literal-fs-filename -- see above\n      const stat = statSync(filePath)\n      const key = `${filePath}:${String(stat.mtimeMs)}:${String(stat.size)}`\n\n      const hit = entries.get(key)\n      // `has` rather than a truthiness check on the value: `false`, `0` and `''` are all legitimate\n      // results to cache, and a truthiness test would recompute them on every call — which is the\n      // defect this file exists to remove, wearing a subtler hat.\n      if (hit !== undefined || entries.has(key)) return hit as T\n\n      const value = compute()\n      entries.set(key, value)\n      return value\n    },\n    clear() {\n      entries.clear()\n    },\n  }\n}\n"],"mappings":";;;;AAqBO,SAAS,kBAAkB,GAAW,GAAmB;AAC9D,MAAI,IAAI,EAAG,QAAO;AAClB,MAAI,IAAI,EAAG,QAAO;AAClB,SAAO;AACT;;;ACrBA,SAAS,mBAAmB;AAE5B,SAAS,SAAS,MAAM,eAAe;AAoDhC,SAAS,gBACd,MACA,MACA,QACM;AACN,QAAM,eAAe,KAAK,gBAAgB,CAAC,KAAK,GAAG;AACnD,QAAM,UAAU,KAAK,YAAY,CAAC,QAAgB,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AAC1F,QAAM,QAAQ,CAAC,QAAsB;AACnC,QAAI;AACJ,QAAI;AACF,gBAAU,QAAQ,GAAG;AAAA,IACvB,QAAQ;AAEN;AAAA,IACF;AAKA,UAAM,UAAU,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC;AAC7E,eAAW,SAAS,SAAS;AAC3B,YAAM,WAAW,KAAK,KAAK,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,KAAK,CAAC,aAAa,KAAK,CAAC,MAAM,MAAM,KAAK,WAAW,CAAC,CAAC,GAAG;AAC9E,cAAM,QAAQ;AAAA,MAChB,WAAW,MAAM,OAAO,KAAK,KAAK,WAAW,IAAI,QAAQ,MAAM,IAAI,CAAC,GAAG;AACrE,eAAO,QAAQ,QAAQ,CAAC;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AACA,QAAM,IAAI;AACZ;;;ACrEO,IAAM,6BAA6B;AAmBnC,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC7B,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAoC;AAC9C,UAAM,eAAe,KAAK,gBAAgB;AAC1C,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,gCAAgC,KAAK,UAAU;AAAA,MAC/C;AAAA,MACA,oBAAoB,YAAY;AAAA,MAChC;AAAA,IACF,EAAE,KAAK,IAAI;AACX,UAAM,OAAO;AACb,SAAK,OAAO,KAAK;AACjB,SAAK,aAAa,KAAK;AACvB,SAAK,eAAe;AAAA,EACtB;AACF;AAUA,IAAM,mCAAmC;AA2BlC,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC/B,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAsC;AAChD,UAAM,eAAe,KAAK,gBAAgB;AAC1C,UAAM,UAAU,CAAC,GAAG,KAAK,OAAO,EAAE,KAAK,iBAAiB;AACxD,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,cAAc,KAAK,IAAI;AAAA,MACvB,cAAc,KAAK,SAAS;AAAA,MAC5B,cAAc,QAAQ,KAAK,IAAI,CAAC;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA;AAAA,MACA;AAAA,MACA,kBAAkB,QAAQ,CAAC,KAAK,KAAK;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,kBAAkB,QAAQ,CAAC,KAAK,KAAK;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,YAAY;AAAA,IAClC,EAAE,KAAK,IAAI;AACX,UAAM,OAAO;AACb,SAAK,OAAO,KAAK;AACjB,SAAK,YAAY,KAAK;AACtB,SAAK,UAAU;AACf,SAAK,eAAe;AAAA,EACtB;AACF;AAOA,IAAM,mCAAmC;AAgClC,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC/B,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAsC;AAChD,UAAM,eAAe,KAAK,gBAAgB;AAC1C,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,YAAY,KAAK,IAAI;AAAA,MACrB,YAAY,KAAK,SAAS;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,YAAY;AAAA,IAClC,EAAE,KAAK,IAAI;AACX,UAAM,OAAO;AACb,SAAK,OAAO,KAAK;AACjB,SAAK,YAAY,KAAK;AACtB,SAAK,eAAe;AAAA,EACtB;AACF;;;ACxMA,SAAS,gBAAgB;AASlB,SAAS,uBAA6C;AAC3D,QAAM,UAAU,oBAAI,IAAe;AAEnC,SAAO;AAAA,IACL,IAAI,UAAU,SAAS;AAGrB,YAAM,OAAO,SAAS,QAAQ;AAC9B,YAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,KAAK,OAAO,CAAC,IAAI,OAAO,KAAK,IAAI,CAAC;AAEpE,YAAM,MAAM,QAAQ,IAAI,GAAG;AAI3B,UAAI,QAAQ,UAAa,QAAQ,IAAI,GAAG,EAAG,QAAO;AAElD,YAAM,QAAQ,QAAQ;AACtB,cAAQ,IAAI,KAAK,KAAK;AACtB,aAAO;AAAA,IACT;AAAA,IACA,QAAQ;AACN,cAAQ,MAAM;AAAA,IAChB;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-FDOOBTXJ.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/vite-plugin/resolve-theo-root.ts
+import { existsSync } from "fs";
+import { resolve } from "path";
+function resolveTheoRootDir(currentDir) {
+  if (existsSync(resolve(currentDir, "client"))) {
+    return currentDir;
+  }
+  return resolve(currentDir, "..");
+}
+
+export {
+  resolveTheoRootDir
+};
+//# sourceMappingURL=chunk-FDOOBTXJ.js.map

package/dist/chunk-FDOOBTXJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vite-plugin/resolve-theo-root.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Resolves theokit's own install directory (the `node_modules/theokit/`).\n * Build-time tool. Read-only check. No HTTP input.\n */\nimport { existsSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\n/**\n * Resolve the directory that holds the framework's compiled (or source)\n * subpaths — `client/`, `server/`, `react-query/`, etc.\n *\n * Cases (regression T1.3):\n *   - Source mode (`src/vite-plugin/index.ts`) — `currentDir` is\n *     `…/src/vite-plugin`. Parent (`…/src`) contains `client/`. Return parent.\n *   - Dist mode (`dist/chunk-XYZ.js`) — `currentDir` is `…/dist`. That dir\n *     itself contains `client/`. Return currentDir.\n *   - Unknown shape — fall back to parent (legacy behavior). The dogfood\n *     validator will catch the misconfiguration before runtime.\n *\n * Pure function — no side effects, only filesystem reads via `existsSync`.\n * Exported so the regression test can exercise the branch logic directly.\n */\nexport function resolveTheoRootDir(currentDir: string): string {\n  if (existsSync(resolve(currentDir, 'client'))) {\n    return currentDir\n  }\n  return resolve(currentDir, '..')\n}\n"],"mappings":";;;;AAIA,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AAiBjB,SAAS,mBAAmB,YAA4B;AAC7D,MAAI,WAAW,QAAQ,YAAY,QAAQ,CAAC,GAAG;AAC7C,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,YAAY,IAAI;AACjC;","names":[]}

package/dist/chunk-FH3SQR6P.js

@@ -0,0 +1,275 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  servicesConfigSchema
+} from "./chunk-ZNZISJDZ.js";
+import {
+  cacheSchema,
+  loggingSchema,
+  observabilitySchema,
+  rateLimitSchema,
+  securitySchema,
+  storageSchema,
+  uploadSchema
+} from "./chunk-VI7ZANB3.js";
+
+// src/config/schema.ts
+import { z } from "zod";
+
+// src/core/contracts/theo-ui-theme.ts
+var THEME_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+
+// src/config/schema.ts
+var theoConfigSchema = z.object({
+  /**
+   * Plan v1.2 T2.1 — project identifier propagated into
+   * `.theokit/services.json` v2 `project` field. DNS-1123 compatible (drives
+   * Gitea repo + ArgoCD App naming on TheoCloud). When omitted, the build
+   * emits services.json v1 with the legacy `services-bundle` fallback
+   * (ADR D10) and logs a deprecation warning.
+   */
+  name: z.string().max(63).refine(
+    // DNS-1123 equivalent expressed as explicit single-char anchors so
+    // security/detect-unsafe-regex stays clean (no backtracking).
+    (value) => value.length > 0 && /^[a-z0-9-]+$/u.test(value) && !value.startsWith("-") && !value.endsWith("-"),
+    "name must match DNS-1123 (lowercase alphanumeric+hyphens, 1-63 chars, no leading/trailing hyphen)"
+  ).optional(),
+  appDir: z.string().default("app"),
+  serverDir: z.string().default("server"),
+  /**
+   * Directory (relative to the project root) holding `agents/<name>.ts` definitions, scanned by
+   * dev/build/terminal/mcp. Defaults to `"agents"` — apps that keep the canonical layout are
+   * unaffected. Set to e.g. `"core/agents"` to organize agents under a domain root (#95 follow-up).
+   */
+  agentsDir: z.string().default("agents"),
+  /**
+   * T2.2 / EC-4 — Build output directory. Must be a relative path inside
+   * the project root. Refused absolute or parent-relative paths to prevent
+   * `cleanOutDir` from wiping arbitrary locations (defense-in-depth on
+   * top of cleanOutDir's runtime EC-3 guard).
+   */
+  distDir: z.string().default(".theokit").refine(
+    (d) => !/^([A-Za-z]:)?[/\\]/.test(d) && !d.startsWith(".."),
+    'distDir must be a relative path inside the project root (e.g., ".theokit")'
+  ),
+  /**
+   * Agent runtime configuration.
+   *
+   * - `maxRegistries` (T2.3, legacy): dev-mode cleanup of stale
+   *   `.theokit/agents/<id>/` dirs by mtime. Now superseded by SDK's
+   *   native registry GC but kept for backward-compat.
+   * - `registry` (Phase 6, Production-Readiness #2): forwarded to
+   *   `Agent.registry.configure()` lazily on first request.
+   *   * `maxAgents` — LRU cap. MUST be ≥ max-concurrent-active-conversations
+   *     (EC-17 DOCUMENT): with maxAgents:1 and 2 concurrent chats, LRU evicts
+   *     mid-stream → SDK aborts with code:'aborted'. Default 100 covers
+   *     indie/small-team; tune up for high-traffic.
+   *   * `idleTimeoutMs` — auto-evict idle agents (default 30 min). 0 disables
+   *     idle eviction (LRU only).
+   */
+  agents: z.object({
+    maxRegistries: z.number().int().positive().default(100),
+    registry: z.object({
+      /** LRU cap — MUST be ≥ max-concurrent-active-conversations. */
+      maxAgents: z.number().int().positive().max(1e4).default(100),
+      /** Idle eviction window in ms. 0 disables idle eviction (LRU only). */
+      idleTimeoutMs: z.number().int().nonnegative().default(30 * 6e4)
+    }).optional()
+  }).optional(),
+  port: z.number().int().min(1).max(65535).default(3e3),
+  /** Listen on all addresses (0.0.0.0) for LAN/mobile testing. */
+  host: z.union([z.string(), z.boolean()]).default("localhost"),
+  /** Automatically open browser on `theokit dev`. */
+  open: z.union([z.boolean(), z.string()]).default(false),
+  /** Exit if port is already in use instead of trying next available. */
+  strictPort: z.boolean().default(false),
+  /** Forward browser console/errors to terminal — useful for AI agent dev. */
+  forwardConsole: z.union([
+    z.boolean(),
+    z.object({
+      unhandledErrors: z.boolean().optional(),
+      logLevels: z.array(z.enum(["error", "warn", "info", "log", "debug"])).optional()
+    })
+  ]).default(false),
+  /** Pre-transform files on startup for faster first page load. */
+  warmup: z.object({
+    clientFiles: z.array(z.string()).optional(),
+    ssrFiles: z.array(z.string()).optional()
+  }).optional(),
+  ssr: z.boolean().default(false),
+  /** When true (and ssr === true), use renderToPipeableStream with progressive
+   * shell flush instead of single-shot renderToString. Opt-in for streaming
+   * SSR; default false preserves the current behavior. */
+  ssrStreaming: z.boolean().default(false),
+  rateLimit: rateLimitSchema.optional(),
+  upload: uploadSchema.optional(),
+  logging: loggingSchema.optional(),
+  security: securitySchema.optional(),
+  serialization: z.enum(["json", "superjson"]).default("json"),
+  // Plugins are validated structurally at runtime by createPluginRunnerFromConfig.
+  // Zod only checks the shape minimally (must be array). Type-level safety is
+  // provided through defineConfig at the user surface.
+  //
+  // #425 — an entry MAY also be a module SPECIFIER (a string), resolved to that module's default
+  // export by `config/resolve-plugin-specifiers.ts`. A constructed plugin closes over state and
+  // therefore has no literal, so it is the string form — and only the string form — that a
+  // generated deploy entry can carry. Both shapes are accepted here for the same reason they are
+  // accepted at runtime: one declaration has to serve the local server and the deployed one.
+  plugins: z.array(z.unknown()).optional(),
+  /** Enable client-side batching of theoFetch calls and the
+   * /api/__theo_batch__ server endpoint. */
+  batching: z.union([z.boolean(), z.object({ max: z.number().int().positive().optional() })]).optional(),
+  /** T4.1 — Audit log. When `logger` is provided, framework events
+   * (csrf.warn, rate-limit.exceeded, session.rotated, csp.violation) are
+   * emitted to it. Default: noop. */
+  audit: z.object({
+    logger: z.unknown().optional()
+  }).optional(),
+  /** TheoUI auto-wire (T2.1). `false` = opt-out; object = explicit theme/fonts;
+   * undefined = enabled when @theokit/ui is detected in node_modules. */
+  ui: z.union([
+    z.literal(false),
+    z.object({
+      // Any theme @theokit/ui knows — built-in or from `defineTheme()`. This was a closed
+      // enum of `violet-forge | noir | paper`, two of which never existed in @theokit/ui, so
+      // the only accepted value was the default and every real theme was rejected. The pattern
+      // mirrors what @theokit/ui's ThemeProvider enforces, and it is load-bearing: the value is
+      // interpolated into the generated entry and into a CSS selector.
+      theme: z.string().regex(
+        THEME_NAME_PATTERN,
+        "must start with a letter and contain only lowercase letters, digits and hyphens"
+      ).optional(),
+      fonts: z.enum(["bundled", "cdn"]).optional()
+    })
+  ]).optional(),
+  /**
+   * Cache subsystem (caching-and-revalidation-plan).
+   * Default `undefined` keeps caching disabled (backward compatible).
+   * Pass `cache: {}` to opt in with defaults.
+   */
+  cache: cacheSchema.optional(),
+  /**
+   * Observability (#353). Default `undefined` keeps telemetry off. Present and
+   * not `enabled: false` opts in; `provider` overrides the environment-derived
+   * adapter, which is the priority `adapter-registry.ts` has always documented.
+   */
+  observability: observabilitySchema.optional(),
+  /**
+   * Devtools overlay (Phase 0.4.0+ —
+   *
+   * - `undefined` (default): devtools auto-injects in `pnpm dev`, NEVER in `vite build`.
+   * - `false`: devtools disabled entirely (Vite plugin skips injection even in dev).
+   * - `{ ... }`: devtools enabled with explicit defaults (position, theme).
+   *
+   * Tree-shaken to noop in prod via the dual-export pattern in
+   * `packages/theo/src/devtools/index.ts` (EC-17 positive prod check).
+   */
+  devtools: z.union([
+    z.literal(false),
+    z.object({
+      position: z.enum(["top-left", "top-right", "bottom-left", "bottom-right"]).optional(),
+      theme: z.enum(["light", "dark", "system"]).optional()
+    })
+  ]).optional(),
+  /**
+   * Informative list of deploy adapters the app supports. Does NOT
+   * trigger per-build translations — only the `--target` CLI flag does
+   * (EC-201 / ADR D2). If `config.adapters` includes a target NOT
+   * matching `--target`, `theokit build` emits a cross-reference note.
+   */
+  adapters: z.array(z.string()).optional(),
+  /**
+   * Extra package names to pre-bundle via Vite's `optimizeDeps.include`.
+   *
+   * Framework auto-includes `@theokit/ui` and `lucide-react` when present.
+   * Apps adding plugin peer-deps that rely on a runtime `import('<pkg>')`
+   * (dynamic specifier) — e.g. `@theokit/plugin-canvas` consumers
+   * installing `mermaid` for Mermaid SVG rendering — must declare those
+   * here so Vite can resolve the literal in dev mode without
+   * "Failed to resolve module specifier" errors. Production builds use
+   * tsup/esbuild bundling and are not affected.
+   *
+   * Example:
+   *   viteOptimizeDeps: ['mermaid']
+   */
+  viteOptimizeDeps: z.array(z.string()).optional(),
+  /**
+   * Jobs backend (ADR D3 + T2.1). When configured, every request gets
+   * `ctx.queue.enqueue` auto-wired via the outbox lifecycle. Pass a
+   * `JobBackend` instance (InMemoryJobBackend, PostgresJobBackend, etc.).
+   */
+  jobs: z.object({
+    backend: z.custom((v) => typeof v === "object" && v !== null)
+  }).optional(),
+  /**
+   * StorageManager configuration (T1.1 / ADR-0007).
+   *
+   * Declares Postgres servers + databases + Redis servers. Consumed by
+   * `getStorageManager().configure()` at boot via `start.ts`.
+   *
+   * Default `undefined` means manager exists but is not configured — adapters
+   * relying on the manager (PostgresJobBackend.fromStorageManager, etc.) will
+   * throw with an actionable error on first use.
+   */
+  storage: storageSchema.optional(),
+  /**
+   * Wave 2 — Polyglot services orchestration (T1.1 / ADR-0012/0013/0014/0015).
+   *
+   * Declarative external sidecar processes (Python FastAPI / Node Hono)
+   * that boot alongside the TheoKit TS app. Empty `services: {}` is the
+   * default and preserves Wave 1 behavior.
+   */
+  services: servicesConfigSchema,
+  /**
+   * G2 — OpenAPI emit (build-time only).
+   *
+   * When present, `theokit build` writes a generated `openapi.json` from
+   * every `defineRoute()` body/query/params Zod schema. `undefined` keeps
+   * the framework backward-compatible (no emit). Pass `openapi: {}` to
+   * opt in with defaults.
+   *
+   * Defaults: spec 3.1.0 · servers `http://localhost:3000` · title
+   * "TheoKit App" · version "0.0.0" · outDir ".theokit" (next to dist).
+   *
+   * The env var `THEOKIT_OPENAPI_SERVERS` (CSV of URLs) overrides
+   * `servers[].url` at emit time without rebuilding the config.
+   */
+  openapi: z.object({
+    servers: z.array(
+      z.object({
+        url: z.url(),
+        description: z.string().optional()
+      })
+    ).default([{ url: "http://localhost:3000", description: "Local development" }]),
+    specVersion: z.enum(["3.1.0", "3.0.3"]).default("3.1.0"),
+    title: z.string().default("TheoKit App"),
+    version: z.string().default("0.0.0"),
+    outDir: z.string().default(".theokit")
+  }).optional(),
+  /**
+   * G5 T1.3 — error envelope transformer hook (blueprint ADR D3).
+   *
+   * When present, runs at framework error-boundary time to enrich the
+   * envelope with consumer-defined extensions (`hint`, custom telemetry
+   * tags, etc.) BEFORE the envelope is serialized to the client. The
+   * function signature is preserved via the explicit `FormatErrorHook`
+   * type — TS inference flows from `theo.config.ts` into `@theo/client`
+   * codegen and `@theokit/ui` AgentErrorCard consumers.
+   *
+   * Use `z.custom<FormatErrorHook>(...)` because Zod's built-in
+   * `z.function()` discards its TS signature after parse; `z.custom`
+   * with a function-typed runtime guard preserves the call-site type
+   * without trading off Zod runtime validation.
+   */
+  formatError: z.custom((val) => typeof val === "function", {
+    message: "formatError must be a function"
+  }).optional()
+}).refine((cfg) => !Object.values(cfg.services).some((s) => s.port === cfg.port), {
+  message: "service.port collides with TheoKit web port \u2014 change one of them",
+  path: ["services"]
+});
+
+export {
+  theoConfigSchema
+};
+//# sourceMappingURL=chunk-FH3SQR6P.js.map

package/dist/chunk-FH3SQR6P.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/schema.ts","../src/core/contracts/theo-ui-theme.ts"],"sourcesContent":["import { z } from 'zod'\n\nimport { THEME_NAME_PATTERN } from '../core/contracts/theo-ui-theme.js'\nimport { servicesConfigSchema } from '../services/index.js'\n\nimport {\n  cacheSchema,\n  loggingSchema,\n  observabilitySchema,\n  rateLimitSchema,\n  securitySchema,\n  storageSchema,\n  uploadSchema,\n  type FormatErrorContext,\n  type FormatErrorHook,\n} from './schemas/index.js'\n\n// Re-export per-concern schemas + types so downstream consumers\n// (`adapters/*`, vite-plugin, generators) keep their existing imports valid.\n// Per plan T2.3 — pure structural split; zero behavior change at the call site.\n//\n// `rateLimitSchema` and `securitySchema` are NOT re-exported: they are composed into\n// `theoConfigSchema` below and nothing imports them from here. They remain available at their\n// source of truth, `./schemas/index.js`.\nexport { cacheSchema, corsSchema, securityHeadersSchema, storageSchema } from './schemas/index.js'\n\nexport type { StorageConfig } from './schemas/index.js'\n\n/**\n * Root `theo.config.ts` schema — composer assembled from the per-concern\n * primitives re-exported above.\n *\n * Embedded blocks that exist ONLY as part of the root config (`agents`,\n * `ui`, `devtools`, `jobs`, `openapi`) stay inline below. They have no\n * external consumers; splitting them would create lonely files (M5\n * smell) without comprehension benefit.\n */\nexport const theoConfigSchema = z\n  .object({\n    /**\n     * Plan v1.2 T2.1 — project identifier propagated into\n     * `.theokit/services.json` v2 `project` field. DNS-1123 compatible (drives\n     * Gitea repo + ArgoCD App naming on TheoCloud). When omitted, the build\n     * emits services.json v1 with the legacy `services-bundle` fallback\n     * (ADR D10) and logs a deprecation warning.\n     */\n    name: z\n      .string()\n      .max(63)\n      .refine(\n        // DNS-1123 equivalent expressed as explicit single-char anchors so\n        // security/detect-unsafe-regex stays clean (no backtracking).\n        (value) =>\n          value.length > 0 &&\n          /^[a-z0-9-]+$/u.test(value) &&\n          !value.startsWith('-') &&\n          !value.endsWith('-'),\n        'name must match DNS-1123 (lowercase alphanumeric+hyphens, 1-63 chars, no leading/trailing hyphen)',\n      )\n      .optional(),\n    appDir: z.string().default('app'),\n    serverDir: z.string().default('server'),\n    /**\n     * Directory (relative to the project root) holding `agents/<name>.ts` definitions, scanned by\n     * dev/build/terminal/mcp. Defaults to `\"agents\"` — apps that keep the canonical layout are\n     * unaffected. Set to e.g. `\"core/agents\"` to organize agents under a domain root (#95 follow-up).\n     */\n    agentsDir: z.string().default('agents'),\n    /**\n     * T2.2 / EC-4 — Build output directory. Must be a relative path inside\n     * the project root. Refused absolute or parent-relative paths to prevent\n     * `cleanOutDir` from wiping arbitrary locations (defense-in-depth on\n     * top of cleanOutDir's runtime EC-3 guard).\n     */\n    distDir: z\n      .string()\n      .default('.theokit')\n      .refine(\n        (d) => !/^([A-Za-z]:)?[/\\\\]/.test(d) && !d.startsWith('..'),\n        'distDir must be a relative path inside the project root (e.g., \".theokit\")',\n      ),\n    /**\n     * Agent runtime configuration.\n     *\n     * - `maxRegistries` (T2.3, legacy): dev-mode cleanup of stale\n     *   `.theokit/agents/<id>/` dirs by mtime. Now superseded by SDK's\n     *   native registry GC but kept for backward-compat.\n     * - `registry` (Phase 6, Production-Readiness #2): forwarded to\n     *   `Agent.registry.configure()` lazily on first request.\n     *   * `maxAgents` — LRU cap. MUST be ≥ max-concurrent-active-conversations\n     *     (EC-17 DOCUMENT): with maxAgents:1 and 2 concurrent chats, LRU evicts\n     *     mid-stream → SDK aborts with code:'aborted'. Default 100 covers\n     *     indie/small-team; tune up for high-traffic.\n     *   * `idleTimeoutMs` — auto-evict idle agents (default 30 min). 0 disables\n     *     idle eviction (LRU only).\n     */\n    agents: z\n      .object({\n        maxRegistries: z.number().int().positive().default(100),\n        registry: z\n          .object({\n            /** LRU cap — MUST be ≥ max-concurrent-active-conversations. */\n            maxAgents: z.number().int().positive().max(10_000).default(100),\n            /** Idle eviction window in ms. 0 disables idle eviction (LRU only). */\n            idleTimeoutMs: z\n              .number()\n              .int()\n              .nonnegative()\n              .default(30 * 60_000),\n          })\n          .optional(),\n      })\n      .optional(),\n    port: z.number().int().min(1).max(65535).default(3000),\n    /** Listen on all addresses (0.0.0.0) for LAN/mobile testing. */\n    host: z.union([z.string(), z.boolean()]).default('localhost'),\n    /** Automatically open browser on `theokit dev`. */\n    open: z.union([z.boolean(), z.string()]).default(false),\n    /** Exit if port is already in use instead of trying next available. */\n    strictPort: z.boolean().default(false),\n    /** Forward browser console/errors to terminal — useful for AI agent dev. */\n    forwardConsole: z\n      .union([\n        z.boolean(),\n        z.object({\n          unhandledErrors: z.boolean().optional(),\n          logLevels: z.array(z.enum(['error', 'warn', 'info', 'log', 'debug'])).optional(),\n        }),\n      ])\n      .default(false),\n    /** Pre-transform files on startup for faster first page load. */\n    warmup: z\n      .object({\n        clientFiles: z.array(z.string()).optional(),\n        ssrFiles: z.array(z.string()).optional(),\n      })\n      .optional(),\n    ssr: z.boolean().default(false),\n    /** When true (and ssr === true), use renderToPipeableStream with progressive\n     * shell flush instead of single-shot renderToString. Opt-in for streaming\n     * SSR; default false preserves the current behavior. */\n    ssrStreaming: z.boolean().default(false),\n    rateLimit: rateLimitSchema.optional(),\n    upload: uploadSchema.optional(),\n    logging: loggingSchema.optional(),\n    security: securitySchema.optional(),\n    serialization: z.enum(['json', 'superjson']).default('json'),\n    // Plugins are validated structurally at runtime by createPluginRunnerFromConfig.\n    // Zod only checks the shape minimally (must be array). Type-level safety is\n    // provided through defineConfig at the user surface.\n    //\n    // #425 — an entry MAY also be a module SPECIFIER (a string), resolved to that module's default\n    // export by `config/resolve-plugin-specifiers.ts`. A constructed plugin closes over state and\n    // therefore has no literal, so it is the string form — and only the string form — that a\n    // generated deploy entry can carry. Both shapes are accepted here for the same reason they are\n    // accepted at runtime: one declaration has to serve the local server and the deployed one.\n    plugins: z.array(z.unknown()).optional(),\n    /** Enable client-side batching of theoFetch calls and the\n     * /api/__theo_batch__ server endpoint. */\n    batching: z\n      .union([z.boolean(), z.object({ max: z.number().int().positive().optional() })])\n      .optional(),\n    /** T4.1 — Audit log. When `logger` is provided, framework events\n     * (csrf.warn, rate-limit.exceeded, session.rotated, csp.violation) are\n     * emitted to it. Default: noop. */\n    audit: z\n      .object({\n        logger: z.unknown().optional(),\n      })\n      .optional(),\n    /** TheoUI auto-wire (T2.1). `false` = opt-out; object = explicit theme/fonts;\n     * undefined = enabled when @theokit/ui is detected in node_modules. */\n    ui: z\n      .union([\n        z.literal(false),\n        z.object({\n          // Any theme @theokit/ui knows — built-in or from `defineTheme()`. This was a closed\n          // enum of `violet-forge | noir | paper`, two of which never existed in @theokit/ui, so\n          // the only accepted value was the default and every real theme was rejected. The pattern\n          // mirrors what @theokit/ui's ThemeProvider enforces, and it is load-bearing: the value is\n          // interpolated into the generated entry and into a CSS selector.\n          theme: z\n            .string()\n            .regex(\n              THEME_NAME_PATTERN,\n              'must start with a letter and contain only lowercase letters, digits and hyphens',\n            )\n            .optional(),\n          fonts: z.enum(['bundled', 'cdn']).optional(),\n        }),\n      ])\n      .optional(),\n    /**\n     * Cache subsystem (caching-and-revalidation-plan).\n     * Default `undefined` keeps caching disabled (backward compatible).\n     * Pass `cache: {}` to opt in with defaults.\n     */\n    cache: cacheSchema.optional(),\n    /**\n     * Observability (#353). Default `undefined` keeps telemetry off. Present and\n     * not `enabled: false` opts in; `provider` overrides the environment-derived\n     * adapter, which is the priority `adapter-registry.ts` has always documented.\n     */\n    observability: observabilitySchema.optional(),\n    /**\n     * Devtools overlay (Phase 0.4.0+ —\n     *\n     * - `undefined` (default): devtools auto-injects in `pnpm dev`, NEVER in `vite build`.\n     * - `false`: devtools disabled entirely (Vite plugin skips injection even in dev).\n     * - `{ ... }`: devtools enabled with explicit defaults (position, theme).\n     *\n     * Tree-shaken to noop in prod via the dual-export pattern in\n     * `packages/theo/src/devtools/index.ts` (EC-17 positive prod check).\n     */\n    devtools: z\n      .union([\n        z.literal(false),\n        z.object({\n          position: z.enum(['top-left', 'top-right', 'bottom-left', 'bottom-right']).optional(),\n          theme: z.enum(['light', 'dark', 'system']).optional(),\n        }),\n      ])\n      .optional(),\n    /**\n     * Informative list of deploy adapters the app supports. Does NOT\n     * trigger per-build translations — only the `--target` CLI flag does\n     * (EC-201 / ADR D2). If `config.adapters` includes a target NOT\n     * matching `--target`, `theokit build` emits a cross-reference note.\n     */\n    adapters: z.array(z.string()).optional(),\n    /**\n     * Extra package names to pre-bundle via Vite's `optimizeDeps.include`.\n     *\n     * Framework auto-includes `@theokit/ui` and `lucide-react` when present.\n     * Apps adding plugin peer-deps that rely on a runtime `import('<pkg>')`\n     * (dynamic specifier) — e.g. `@theokit/plugin-canvas` consumers\n     * installing `mermaid` for Mermaid SVG rendering — must declare those\n     * here so Vite can resolve the literal in dev mode without\n     * \"Failed to resolve module specifier\" errors. Production builds use\n     * tsup/esbuild bundling and are not affected.\n     *\n     * Example:\n     *   viteOptimizeDeps: ['mermaid']\n     */\n    viteOptimizeDeps: z.array(z.string()).optional(),\n    /**\n     * Jobs backend (ADR D3 + T2.1). When configured, every request gets\n     * `ctx.queue.enqueue` auto-wired via the outbox lifecycle. Pass a\n     * `JobBackend` instance (InMemoryJobBackend, PostgresJobBackend, etc.).\n     */\n    jobs: z\n      .object({\n        backend: z.custom<unknown>((v) => typeof v === 'object' && v !== null),\n      })\n      .optional(),\n    /**\n     * StorageManager configuration (T1.1 / ADR-0007).\n     *\n     * Declares Postgres servers + databases + Redis servers. Consumed by\n     * `getStorageManager().configure()` at boot via `start.ts`.\n     *\n     * Default `undefined` means manager exists but is not configured — adapters\n     * relying on the manager (PostgresJobBackend.fromStorageManager, etc.) will\n     * throw with an actionable error on first use.\n     */\n    storage: storageSchema.optional(),\n    /**\n     * Wave 2 — Polyglot services orchestration (T1.1 / ADR-0012/0013/0014/0015).\n     *\n     * Declarative external sidecar processes (Python FastAPI / Node Hono)\n     * that boot alongside the TheoKit TS app. Empty `services: {}` is the\n     * default and preserves Wave 1 behavior.\n     */\n    services: servicesConfigSchema,\n    /**\n     * G2 — OpenAPI emit (build-time only).\n     *\n     * When present, `theokit build` writes a generated `openapi.json` from\n     * every `defineRoute()` body/query/params Zod schema. `undefined` keeps\n     * the framework backward-compatible (no emit). Pass `openapi: {}` to\n     * opt in with defaults.\n     *\n     * Defaults: spec 3.1.0 · servers `http://localhost:3000` · title\n     * \"TheoKit App\" · version \"0.0.0\" · outDir \".theokit\" (next to dist).\n     *\n     * The env var `THEOKIT_OPENAPI_SERVERS` (CSV of URLs) overrides\n     * `servers[].url` at emit time without rebuilding the config.\n     */\n    openapi: z\n      .object({\n        servers: z\n          .array(\n            z.object({\n              url: z.url(),\n              description: z.string().optional(),\n            }),\n          )\n          .default([{ url: 'http://localhost:3000', description: 'Local development' }]),\n        specVersion: z.enum(['3.1.0', '3.0.3']).default('3.1.0'),\n        title: z.string().default('TheoKit App'),\n        version: z.string().default('0.0.0'),\n        outDir: z.string().default('.theokit'),\n      })\n      .optional(),\n    /**\n     * G5 T1.3 — error envelope transformer hook (blueprint ADR D3).\n     *\n     * When present, runs at framework error-boundary time to enrich the\n     * envelope with consumer-defined extensions (`hint`, custom telemetry\n     * tags, etc.) BEFORE the envelope is serialized to the client. The\n     * function signature is preserved via the explicit `FormatErrorHook`\n     * type — TS inference flows from `theo.config.ts` into `@theo/client`\n     * codegen and `@theokit/ui` AgentErrorCard consumers.\n     *\n     * Use `z.custom<FormatErrorHook>(...)` because Zod's built-in\n     * `z.function()` discards its TS signature after parse; `z.custom`\n     * with a function-typed runtime guard preserves the call-site type\n     * without trading off Zod runtime validation.\n     */\n    formatError: z\n      .custom<FormatErrorHook>((val) => typeof val === 'function', {\n        message: 'formatError must be a function',\n      })\n      .optional(),\n  })\n  // EC-2 fix: cross-config refine — no service may share TheoKit's web port.\n  .refine((cfg) => !Object.values(cfg.services).some((s) => s.port === cfg.port), {\n    message: 'service.port collides with TheoKit web port — change one of them',\n    path: ['services'],\n  })\n\nexport type TheoConfig = z.infer<typeof theoConfigSchema>\n\n// Silence unused-import warnings for type-only re-exports — TS strips at compile,\n// but exports above re-introduce them for downstream consumers.\ntype _FormatErrorContext = FormatErrorContext\n","/**\n * The `@theokit/ui` theme name — a contract shared by the config schema, the entry generators and\n * the Vite plugin's detector.\n *\n * It lives in `core/contracts/` because those three sit in different modules that may not depend on\n * one another: `config/` and `router/` are allowed to reach into `core/` only. Before this file the\n * union was written out separately in all three places, and all three drifted from what the design\n * system actually ships.\n */\n\n/**\n * Theme names `@theokit/ui` ships today — an autocomplete hint, NOT the accepted set.\n *\n * The accepted set used to be exactly `'violet-forge' | 'noir' | 'paper'`, and two of those three\n * were never real: the design system has no `noir` and no `paper`. So the only value config\n * validation accepted was the default, and every genuine theme — plus anything from\n * `defineTheme()` — was rejected.\n *\n * A closed union here is a copy of another package's catalogue; it rots the moment that package\n * ships a theme. This list is therefore advisory, and {@link TheoUiTheme} stays open. The\n * authoritative list is `builtinThemes`, exported by `@theokit/ui`.\n */\nexport type BuiltinThemeName =\n  | 'violet-forge'\n  | 'falcon-red'\n  | 'classic-paper'\n  | 'aurora-terminal'\n  | 'vercel-mono'\n  | 'github-dark'\n  | 'dracula'\n  | 'one-dark'\n  | 'anthropic-style'\n  | 'openai-style'\n  | 'linear-glass'\n\n/**\n * A theme name. Built-ins autocomplete; a custom theme from `defineTheme()` is equally valid.\n *\n * `(string & {})` is the idiomatic way to keep literal suggestions on an open union — without it\n * TypeScript widens the whole type to `string` and the hints disappear.\n */\nexport type TheoUiTheme = BuiltinThemeName | (string & {})\n\n/** How fonts are delivered — bundled with the app, or fetched from a CDN. */\nexport type TheoUiFonts = 'bundled' | 'cdn'\n\n/**\n * The shape a theme name must have — mirrors the pattern `@theokit/ui`'s `ThemeProvider` enforces\n * before it writes `[data-theme=\"<name>\"]`.\n *\n * Validating here is not cosmetic. The value is interpolated into the generated entry\n * (`defaultTheme: '<name>'`) and into a CSS selector, so an unchecked name is a code-injection\n * vector — and anything this rejects would be rejected by the provider anyway, so the developer\n * gets the error at config time instead of at render time.\n */\nexport const THEME_NAME_PATTERN = /^[a-z][a-z0-9-]*$/\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;;;ACuDX,IAAM,qBAAqB;;;ADlB3B,IAAM,mBAAmB,EAC7B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQN,MAAM,EACH,OAAO,EACP,IAAI,EAAE,EACN;AAAA;AAAA;AAAA,IAGC,CAAC,UACC,MAAM,SAAS,KACf,gBAAgB,KAAK,KAAK,KAC1B,CAAC,MAAM,WAAW,GAAG,KACrB,CAAC,MAAM,SAAS,GAAG;AAAA,IACrB;AAAA,EACF,EACC,SAAS;AAAA,EACZ,QAAQ,EAAE,OAAO,EAAE,QAAQ,KAAK;AAAA,EAChC,WAAW,EAAE,OAAO,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,WAAW,EAAE,OAAO,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtC,SAAS,EACN,OAAO,EACP,QAAQ,UAAU,EAClB;AAAA,IACC,CAAC,MAAM,CAAC,qBAAqB,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,IAAI;AAAA,IAC1D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBF,QAAQ,EACL,OAAO;AAAA,IACN,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,IACtD,UAAU,EACP,OAAO;AAAA;AAAA,MAEN,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAG;AAAA;AAAA,MAE9D,eAAe,EACZ,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,QAAQ,KAAK,GAAM;AAAA,IACxB,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AAAA,EACZ,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAI;AAAA;AAAA,EAErD,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,WAAW;AAAA;AAAA,EAE5D,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEtD,YAAY,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAErC,gBAAgB,EACb,MAAM;AAAA,IACL,EAAE,QAAQ;AAAA,IACV,EAAE,OAAO;AAAA,MACP,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,MACtC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,OAAO,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,IACjF,CAAC;AAAA,EACH,CAAC,EACA,QAAQ,KAAK;AAAA;AAAA,EAEhB,QAAQ,EACL,OAAO;AAAA,IACN,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IAC1C,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACzC,CAAC,EACA,SAAS;AAAA,EACZ,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI9B,cAAc,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACvC,WAAW,gBAAgB,SAAS;AAAA,EACpC,QAAQ,aAAa,SAAS;AAAA,EAC9B,SAAS,cAAc,SAAS;AAAA,EAChC,UAAU,eAAe,SAAS;AAAA,EAClC,eAAe,EAAE,KAAK,CAAC,QAAQ,WAAW,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU3D,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,UAAU,EACP,MAAM,CAAC,EAAE,QAAQ,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAC9E,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,OAAO,EACJ,OAAO;AAAA,IACN,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,CAAC,EACA,SAAS;AAAA;AAAA;AAAA,EAGZ,IAAI,EACD,MAAM;AAAA,IACL,EAAE,QAAQ,KAAK;AAAA,IACf,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMP,OAAO,EACJ,OAAO,EACP;AAAA,QACC;AAAA,QACA;AAAA,MACF,EACC,SAAS;AAAA,MACZ,OAAO,EAAE,KAAK,CAAC,WAAW,KAAK,CAAC,EAAE,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMZ,OAAO,YAAY,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5B,eAAe,oBAAoB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW5C,UAAU,EACP,MAAM;AAAA,IACL,EAAE,QAAQ,KAAK;AAAA,IACf,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,KAAK,CAAC,YAAY,aAAa,eAAe,cAAc,CAAC,EAAE,SAAS;AAAA,MACpF,OAAO,EAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,CAAC,EAAE,SAAS;AAAA,IACtD,CAAC;AAAA,EACH,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOZ,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAevC,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,MAAM,EACH,OAAO;AAAA,IACN,SAAS,EAAE,OAAgB,CAAC,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI;AAAA,EACvE,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWZ,SAAS,cAAc,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeV,SAAS,EACN,OAAO;AAAA,IACN,SAAS,EACN;AAAA,MACC,EAAE,OAAO;AAAA,QACP,KAAK,EAAE,IAAI;AAAA,QACX,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACnC,CAAC;AAAA,IACH,EACC,QAAQ,CAAC,EAAE,KAAK,yBAAyB,aAAa,oBAAoB,CAAC,CAAC;AAAA,IAC/E,aAAa,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,QAAQ,OAAO;AAAA,IACvD,OAAO,EAAE,OAAO,EAAE,QAAQ,aAAa;AAAA,IACvC,SAAS,EAAE,OAAO,EAAE,QAAQ,OAAO;AAAA,IACnC,QAAQ,EAAE,OAAO,EAAE,QAAQ,UAAU;AAAA,EACvC,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBZ,aAAa,EACV,OAAwB,CAAC,QAAQ,OAAO,QAAQ,YAAY;AAAA,IAC3D,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AACd,CAAC,EAEA,OAAO,CAAC,QAAQ,CAAC,OAAO,OAAO,IAAI,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,GAAG;AAAA,EAC9E,SAAS;AAAA,EACT,MAAM,CAAC,UAAU;AACnB,CAAC;","names":[]}

package/dist/chunk-HJHGTFEJ.js

@@ -0,0 +1,23 @@
+// src/server/observability/define-adapter.ts
+function defineObservabilityAdapter(config) {
+  return {
+    name: config.name,
+    startSpan: (name, attrs, context) => config.startSpan(name, attrs, context),
+    counter: (name, value, attrs) => {
+      config.counter(name, value, attrs);
+    },
+    histogram: (name, value, attrs) => {
+      config.histogram(name, value, attrs);
+    },
+    log: (level, message, attrs) => {
+      config.log(level, message, attrs);
+    },
+    flush: () => config.flush(),
+    shutdown: () => config.shutdown()
+  };
+}
+
+export {
+  defineObservabilityAdapter
+};
+//# sourceMappingURL=chunk-HJHGTFEJ.js.map

package/dist/chunk-HJHGTFEJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/observability/define-adapter.ts"],"mappings":";AAsDO,SAAS,2BAA2B,QAAmD;AAC5F,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,WAAW,CAAC,MAAM,OAAO,YAAY,OAAO,UAAU,MAAM,OAAO,OAAO;AAAA,IAC1E,SAAS,CAAC,MAAM,OAAO,UAAU;AAC/B,aAAO,QAAQ,MAAM,OAAO,KAAK;AAAA,IACnC;AAAA,IACA,WAAW,CAAC,MAAM,OAAO,UAAU;AACjC,aAAO,UAAU,MAAM,OAAO,KAAK;AAAA,IACrC;AAAA,IACA,KAAK,CAAC,OAAO,SAAS,UAAU;AAC9B,aAAO,IAAI,OAAO,SAAS,KAAK;AAAA,IAClC;AAAA,IACA,OAAO,MAAM,OAAO,MAAM;AAAA,IAC1B,UAAU,MAAM,OAAO,SAAS;AAAA,EAClC;AACF;","names":[]}

package/dist/{chunk-LXAESF4Y.js → chunk-HK4AZBKX.js}

@@ -3,13 +3,16 @@ import {
 } from "./chunk-VZTYCAO6.js";
 import {
   generateNewTraceContext
-} from "./chunk-RWNSW4FM.js";
+} from "./chunk-UMNXCU3K.js";
 import {
   importUserModule
 } from "./chunk-52PDWL5S.js";
 import {
   walkSourceFiles
-} from "./chunk-U267AOWS.js";
+} from "./chunk-5K4TDLRG.js";
+import {
+  compareByCodeUnit
+} from "./chunk-ZWN3AODA.js";
 
 // src/server/cron/cron-validate.ts
 import { CronExpressionParser } from "cron-parser";
@@ -372,7 +375,7 @@ async function scanCronDirs(dirs) {
       throw new DuplicateCronNameError(name, paths);
     }
   }
-  return nodes.sort((a, b) => a.name.localeCompare(b.name));
+  return nodes.sort((a, b) => compareByCodeUnit(a.name, b.name));
 }
 
 export {
@@ -392,4 +395,4 @@ export {
   scanCrons,
   scanCronDirs
 };
-//# sourceMappingURL=chunk-LXAESF4Y.js.map
+//# sourceMappingURL=chunk-HK4AZBKX.js.map