theokit 0.48.13 → 0.50.0

package/dist/netlify-C2IRCZKI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/netlify.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Netlify deploy adapter. All paths derived from `cwd` and a fixed\n * `.theokit/netlify/` output layout. Build-time tool — no HTTP input.\n */\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport { deployedCorsFragment, type DeployedCorsOptions } from './deployed-cors.js'\nimport { deployedCsrfFragment, type DeployedCsrfOptions } from './deployed-csrf.js'\nimport {\n  deployedRuntimeConfigFragment,\n  type DeployedRuntimeConfigOptions,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport {\n  buildSecurityHeaders,\n  describeDeployedSecurityHeaders,\n  renderSecurityHeadersConfigLiteral,\n} from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter } from './types.js'\n\nexport class NetlifyConflictError extends Error {\n  constructor(path: string, currentTo: string) {\n    super(\n      `netlify.toml has a conflicting redirect: \"${path}\" → \"${currentTo}\". ` +\n        `Remove it manually or edit it to point to \"/.netlify/functions/theo\" ` +\n        `before running the Netlify adapter again.`,\n    )\n    this.name = 'NetlifyConflictError'\n  }\n}\n\nexport interface NetlifyBuildDeps {\n  runNodeBuild?: (config: TheoConfig, cwd: string, ctx?: AdapterBuildContext) => Promise<void>\n  writeFile?: (path: string, content: string) => void\n  ensureDir?: (path: string) => void\n  readTomlIfExists?: () => string | null\n}\n\nexport function renderNetlifyFunction(\n  opts: { securityHeaders?: SecurityHeadersConfig } & DeployedCsrfOptions &\n    DeployedRuntimeConfigOptions &\n    DeployedCorsOptions = {},\n): string {\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  return [\n    `// Generated by Theo — Netlify Functions adapter`,\n    `import { resolve } from 'node:path'`,\n    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`,\n    `import { createWebShim } from 'theokit/adapters/web-shim'`,\n    `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,\n    ``,\n    `const cwd = process.cwd()`,\n    `const serverDir = resolve(cwd, 'server')`,\n    `let routesCache = null`,\n    `let loaderCache = null`,\n    ``,\n    `// #410 — the security baseline \\`theokit start\\` puts on every response,`,\n    `// carried here as a literal because the deployed function has no`,\n    `// theo.config.ts to read. The netlify.toml redirect routes only /api/* here,`,\n    `// so this covers the API and not the document Netlify's static host serves`,\n    `// (usetheokit/theokit#412).`,\n    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(opts.securityHeaders)}`,\n    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,\n    ``,\n    ...runtimeConfig.imports,\n    ...runtimeConfig.declarations,\n    ...deployedCsrfFragment(opts),\n    ``,\n    ...deployedCorsFragment(opts.cors, 'netlify'),\n    ``,\n    `export default async (request, context) => {`,\n    `  // #409 — the preflight is answered BEFORE anything routes: an OPTIONS the router`,\n    `  // handles is an OPTIONS the browser never gets a CORS answer to.`,\n    `  const preflight = corsPreflight(request)`,\n    `  if (preflight !== null) return withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    `  return withCors(request, withSecurityHeaders(await handleRequest(request), SECURITY_HEADERS))`,\n    `}`,\n    ``,\n    `async function handleRequest(request) {`,\n    `  const url = new URL(request.url)`,\n    `  if (!url.pathname.startsWith('/api/')) {`,\n    `    return new Response('Not Found', { status: 404 })`,\n    `  }`,\n    ``,\n    `  if (!routesCache) routesCache = scanServerRoutes(serverDir)`,\n    `  if (!loaderCache) loaderCache = createProductionLoader()`,\n    ``,\n    `  const match = matchRoute(url.pathname, routesCache)`,\n    `  if (!match) {`,\n    `    return new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), {`,\n    `      status: 404,`,\n    `      headers: { 'content-type': 'application/json' },`,\n    `    })`,\n    `  }`,\n    ``,\n    `  const { req, res, toResponse } = createWebShim(request)`,\n    ...deployedTraceFragment('request', '  '),\n    `  const method = request.method.toUpperCase()`,\n    `  // #382 — the run is not awaited: toResponse() settles at the headers and`,\n    `  // carries a live body, so Netlify streams while the handler writes.`,\n    `  return toResponse(executeRoute({ route: match.route, method, params: match.params, req, res, loadModule: loaderCache, serverDir, requestId, ...CSRF_CONFIG, ${runtimeConfig.executeRouteSpread} }))`,\n    `}`,\n  ].join('\\n')\n}\n\nconst THEO_REDIRECT_FROM = '/api/*'\nconst THEO_REDIRECT_TO = '/.netlify/functions/theo'\n\n/**\n * TOML merge (EC-2) — non-destructive.\n *\n * We avoid adding a TOML parser dependency by working at the line level. The\n * supported subset is sufficient for the Netlify use case:\n *   - detect existing `[[redirects]]` blocks\n *   - find a block whose `from = \"...\"` matches our target\n *   - error if such a block points elsewhere\n *   - otherwise append our block\n *\n * Unknown sections (e.g. `[build]`, `[[headers]]`, `[context.production.environment]`)\n * are preserved as-is.\n */\ninterface NetlifyRedirectBlock {\n  startLine: number\n  endLine: number\n  from?: string\n  to?: string\n}\n\nfunction parseRedirectBlocks(lines: readonly string[]): NetlifyRedirectBlock[] {\n  const blocks: NetlifyRedirectBlock[] = []\n  let current: NetlifyRedirectBlock | null = null\n\n  for (let i = 0; i < lines.length; i++) {\n    const trimmed = lines[i].trim()\n    if (trimmed === '[[redirects]]') {\n      if (current) {\n        current.endLine = i - 1\n        blocks.push(current)\n      }\n      current = { startLine: i, endLine: i }\n      continue\n    }\n    if (current && /^\\[(\\[|[^[])/.test(trimmed)) {\n      // Entering another section — close current.\n      current.endLine = i - 1\n      blocks.push(current)\n      current = null\n    }\n    if (current) {\n      const fromMatch = /^from\\s*=\\s*\"([^\"]+)\"/.exec(trimmed)\n      if (fromMatch) current.from = fromMatch[1]\n      const toMatch = /^to\\s*=\\s*\"([^\"]+)\"/.exec(trimmed)\n      if (toMatch) current.to = toMatch[1]\n      current.endLine = i\n    }\n  }\n  if (current) blocks.push(current)\n  return blocks\n}\n\nconst THEO_REDIRECT_TARGET = [\n  '[[redirects]]',\n  '  from = \"/api/*\"',\n  '  to = \"/.netlify/functions/theo\"',\n  '  status = 200',\n  '  force = true',\n].join('\\n')\n\n/**\n * Marks the block this build owns, so it can be REGENERATED rather than merely not duplicated.\n *\n * Idempotence alone would be the wrong contract here: the block carries configuration, so a\n * `security.headers` change has to reach the file. Leaving an existing block in place — which is\n * what the redirect above correctly does, because its content is fixed — would silently pin the\n * baseline to whatever the first build emitted.\n */\nconst THEO_HEADERS_MARKER = '# Generated by Theo — security baseline (usetheokit/theokit#412)'\n\n/**\n * The `[[headers]]` block telling Netlify's static host the baseline.\n *\n * The emitted function applies these to every response IT returns, and it never returns the HTML\n * document: the `[[redirects]]` block routes only `/api/*`, so the page comes from Netlify's static\n * host and carried none of them. The values come from `buildSecurityHeaders` — the same function\n * the handler calls — rather than being written out here, because two lists of headers that must\n * agree are two lists that eventually do not.\n */\nfunction renderHeadersBlock(securityHeaders: SecurityHeadersConfig | undefined): string {\n  const values = buildSecurityHeaders(securityHeaders ?? {}, { production: true })\n  return [\n    THEO_HEADERS_MARKER,\n    '[[headers]]',\n    '  for = \"/*\"',\n    '  [headers.values]',\n    ...Object.entries(values).map(([k, v]) => `    ${k} = ${JSON.stringify(v)}`),\n  ].join('\\n')\n}\n\n/**\n * Drop a previously generated block, so the next one replaces it.\n *\n * Bounded by the marker and the next top-level section at column 0 (or EOF) — the shape TOML gives\n * a block. A user's own `[[headers]]` is untouched because it does not carry the marker: their\n * file, their rules, and Netlify applies both.\n */\nfunction withoutGeneratedHeaders(source: string): string {\n  const lines = source.split(/\\r?\\n/)\n  const start = lines.indexOf(THEO_HEADERS_MARKER)\n  if (start < 0) return source\n\n  const opensSection = (line: string | undefined): boolean => (line ?? '').startsWith('[')\n\n  let end = start + 1\n  while (end < lines.length && !opensSection(lines[end])) end += 1\n  // The marker line itself opens the block, so `end` now sits on the NEXT section — but the block's\n  // own `[[headers]]` is the first `[` after the marker, so step past it before scanning again.\n  end += 1\n  while (end < lines.length && !opensSection(lines[end])) end += 1\n\n  return [...lines.slice(0, start), ...lines.slice(end)].join('\\n').replace(/\\n{3,}/gu, '\\n\\n')\n}\n\nexport function mergeNetlifyToml(\n  existing: string | null,\n  securityHeaders?: SecurityHeadersConfig,\n): string {\n  const headersBlock = renderHeadersBlock(securityHeaders)\n\n  if (existing === null || existing.trim().length === 0) {\n    return `${THEO_REDIRECT_TARGET}\\n\\n${headersBlock}\\n`\n  }\n\n  existing = withoutGeneratedHeaders(existing)\n\n  const blocks = parseRedirectBlocks(existing.split(/\\r?\\n/))\n\n  // Detect conflict: every `/api/*` block must point at our function.\n  for (const b of blocks) {\n    if (b.from !== THEO_REDIRECT_FROM) continue\n    if (b.to === THEO_REDIRECT_TO) {\n      // The redirect is already there. The headers block is regenerated regardless, because it\n      // carries configuration and the redirect does not.\n      const sep = existing.endsWith('\\n') ? '' : '\\n'\n      return `${existing}${sep}\\n${headersBlock}\\n`\n    }\n    throw new NetlifyConflictError(b.from, b.to ?? '(unknown)')\n  }\n\n  // No conflict — append target block.\n  const sep = existing.endsWith('\\n') ? '' : '\\n'\n  return `${existing}${sep}\\n${THEO_REDIRECT_TARGET}\\n\\n${headersBlock}\\n`\n}\n\nexport async function buildNetlify(\n  config: TheoConfig,\n  cwd: string,\n  deps: NetlifyBuildDeps = {},\n  ctx?: AdapterBuildContext,\n): Promise<void> {\n  // Wave 2 (T2.2) — reject polyglot services on this adapter.\n  assertServicesUnsupported('netlify', readManifest(cwd))\n\n  const runNodeBuild = deps.runNodeBuild ?? nodeAdapter.build.bind(nodeAdapter)\n  await runNodeBuild(config, cwd, ctx)\n\n  const ensureDir = deps.ensureDir ?? ((p: string) => mkdirSync(p, { recursive: true }))\n  const writeFile =\n    deps.writeFile ??\n    ((p, c) => {\n      writeFileSync(p, c)\n    })\n  const readTomlIfExists =\n    deps.readTomlIfExists ??\n    (() => {\n      const p = resolve(cwd, 'netlify.toml')\n      return existsSync(p) ? readFileSync(p, 'utf-8') : null\n    })\n\n  const fnDir = resolve(cwd, '.netlify/functions')\n  ensureDir(fnDir)\n  writeFile(\n    resolve(fnDir, 'theo.mjs'),\n    renderNetlifyFunction({\n      securityHeaders: config.security?.headers,\n      csrf: config.security?.csrf,\n      disallowed: config.security?.disallowed,\n      cors: config.security?.cors,\n      // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n      serialization: config.serialization,\n    }),\n  )\n\n  const existingToml = readTomlIfExists()\n  const merged = mergeNetlifyToml(existingToml, config.security?.headers)\n  writeFile(resolve(cwd, 'netlify.toml'), merged)\n\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log('\\n  ✓ Netlify output → .netlify/functions/theo.mjs + netlify.toml')\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log(\n    `${describeDeployedSecurityHeaders({\n      target: 'netlify',\n      securityHeaders: config.security?.headers,\n      mintsNonce: false,\n      documentHeaders: 'platform-configured',\n    })}\\n`,\n  )\n}\n\nexport const netlifyAdapter: DeployAdapter = {\n  name: 'netlify',\n  streamsResponses: true,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied -- to every response this function returns.\n  // The document is served by Netlify's static host and does not pass through\n  // it (usetheokit/theokit#412).\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization'],\n  build(config, cwd, ctx) {\n    return buildNetlify(config, cwd, {}, ctx)\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIA,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AAqBjB,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC9C,YAAY,MAAc,WAAmB;AAC3C;AAAA,MACE,6CAA6C,IAAI,aAAQ,SAAS;AAAA,IAGpE;AACA,SAAK,OAAO;AAAA,EACd;AACF;AASO,SAAS,sBACd,OAEwB,CAAC,GACjB;AACR,QAAM,gBAAgB,8BAA8B,IAAI;AACxD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,mCAAmC,mCAAmC,KAAK,eAAe,CAAC;AAAA,IAC3F;AAAA,IACA;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,cAAc;AAAA,IACjB,GAAG,qBAAqB,IAAI;AAAA,IAC5B;AAAA,IACA,GAAG,qBAAqB,KAAK,MAAM,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA,iKAAiK,cAAc,kBAAkB;AAAA,IACjM;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,IAAM,qBAAqB;AAC3B,IAAM,mBAAmB;AAsBzB,SAAS,oBAAoB,OAAkD;AAC7E,QAAM,SAAiC,CAAC;AACxC,MAAI,UAAuC;AAE3C,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,UAAU,MAAM,CAAC,EAAE,KAAK;AAC9B,QAAI,YAAY,iBAAiB;AAC/B,UAAI,SAAS;AACX,gBAAQ,UAAU,IAAI;AACtB,eAAO,KAAK,OAAO;AAAA,MACrB;AACA,gBAAU,EAAE,WAAW,GAAG,SAAS,EAAE;AACrC;AAAA,IACF;AACA,QAAI,WAAW,eAAe,KAAK,OAAO,GAAG;AAE3C,cAAQ,UAAU,IAAI;AACtB,aAAO,KAAK,OAAO;AACnB,gBAAU;AAAA,IACZ;AACA,QAAI,SAAS;AACX,YAAM,YAAY,wBAAwB,KAAK,OAAO;AACtD,UAAI,UAAW,SAAQ,OAAO,UAAU,CAAC;AACzC,YAAM,UAAU,sBAAsB,KAAK,OAAO;AAClD,UAAI,QAAS,SAAQ,KAAK,QAAQ,CAAC;AACnC,cAAQ,UAAU;AAAA,IACpB;AAAA,EACF;AACA,MAAI,QAAS,QAAO,KAAK,OAAO;AAChC,SAAO;AACT;AAEA,IAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAUX,IAAM,sBAAsB;AAW5B,SAAS,mBAAmB,iBAA4D;AACtF,QAAM,SAAS,qBAAqB,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AAC/E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,EAC7E,EAAE,KAAK,IAAI;AACb;AASA,SAAS,wBAAwB,QAAwB;AACvD,QAAM,QAAQ,OAAO,MAAM,OAAO;AAClC,QAAM,QAAQ,MAAM,QAAQ,mBAAmB;AAC/C,MAAI,QAAQ,EAAG,QAAO;AAEtB,QAAM,eAAe,CAAC,UAAuC,QAAQ,IAAI,WAAW,GAAG;AAEvF,MAAI,MAAM,QAAQ;AAClB,SAAO,MAAM,MAAM,UAAU,CAAC,aAAa,MAAM,GAAG,CAAC,EAAG,QAAO;AAG/D,SAAO;AACP,SAAO,MAAM,MAAM,UAAU,CAAC,aAAa,MAAM,GAAG,CAAC,EAAG,QAAO;AAE/D,SAAO,CAAC,GAAG,MAAM,MAAM,GAAG,KAAK,GAAG,GAAG,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,QAAQ,YAAY,MAAM;AAC9F;AAEO,SAAS,iBACd,UACA,iBACQ;AACR,QAAM,eAAe,mBAAmB,eAAe;AAEvD,MAAI,aAAa,QAAQ,SAAS,KAAK,EAAE,WAAW,GAAG;AACrD,WAAO,GAAG,oBAAoB;AAAA;AAAA,EAAO,YAAY;AAAA;AAAA,EACnD;AAEA,aAAW,wBAAwB,QAAQ;AAE3C,QAAM,SAAS,oBAAoB,SAAS,MAAM,OAAO,CAAC;AAG1D,aAAW,KAAK,QAAQ;AACtB,QAAI,EAAE,SAAS,mBAAoB;AACnC,QAAI,EAAE,OAAO,kBAAkB;AAG7B,YAAMA,OAAM,SAAS,SAAS,IAAI,IAAI,KAAK;AAC3C,aAAO,GAAG,QAAQ,GAAGA,IAAG;AAAA,EAAK,YAAY;AAAA;AAAA,IAC3C;AACA,UAAM,IAAI,qBAAqB,EAAE,MAAM,EAAE,MAAM,WAAW;AAAA,EAC5D;AAGA,QAAM,MAAM,SAAS,SAAS,IAAI,IAAI,KAAK;AAC3C,SAAO,GAAG,QAAQ,GAAG,GAAG;AAAA,EAAK,oBAAoB;AAAA;AAAA,EAAO,YAAY;AAAA;AACtE;AAEA,eAAsB,aACpB,QACA,KACA,OAAyB,CAAC,GAC1B,KACe;AAEf,4BAA0B,WAAW,aAAa,GAAG,CAAC;AAEtD,QAAM,eAAe,KAAK,gBAAgB,YAAY,MAAM,KAAK,WAAW;AAC5E,QAAM,aAAa,QAAQ,KAAK,GAAG;AAEnC,QAAM,YAAY,KAAK,cAAc,CAAC,MAAc,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACpF,QAAM,YACJ,KAAK,cACJ,CAAC,GAAG,MAAM;AACT,kBAAc,GAAG,CAAC;AAAA,EACpB;AACF,QAAM,mBACJ,KAAK,qBACJ,MAAM;AACL,UAAM,IAAI,QAAQ,KAAK,cAAc;AACrC,WAAO,WAAW,CAAC,IAAI,aAAa,GAAG,OAAO,IAAI;AAAA,EACpD;AAEF,QAAM,QAAQ,QAAQ,KAAK,oBAAoB;AAC/C,YAAU,KAAK;AACf;AAAA,IACE,QAAQ,OAAO,UAAU;AAAA,IACzB,sBAAsB;AAAA,MACpB,iBAAiB,OAAO,UAAU;AAAA,MAClC,MAAM,OAAO,UAAU;AAAA,MACvB,YAAY,OAAO,UAAU;AAAA,MAC7B,MAAM,OAAO,UAAU;AAAA;AAAA,MAEvB,eAAe,OAAO;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,QAAM,eAAe,iBAAiB;AACtC,QAAM,SAAS,iBAAiB,cAAc,OAAO,UAAU,OAAO;AACtE,YAAU,QAAQ,KAAK,cAAc,GAAG,MAAM;AAG9C,UAAQ,IAAI,6EAAmE;AAE/E,UAAQ;AAAA,IACN,GAAG,gCAAgC;AAAA,MACjC,QAAQ;AAAA,MACR,iBAAiB,OAAO,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB,CAAC,CAAC;AAAA;AAAA,EACJ;AACF;AAEO,IAAM,iBAAgC;AAAA,EAC3C,MAAM;AAAA,EACN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,eAAe;AAAA,EAChF,MAAM,QAAQ,KAAK,KAAK;AACtB,WAAO,aAAa,QAAQ,KAAK,CAAC,GAAG,GAAG;AAAA,EAC1C;AACF;","names":["sep"]}

package/dist/node-OSVPYQ3D.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  nodeAdapter
+} from "./chunk-KI4DOTN4.js";
+import "./chunk-ZNZISJDZ.js";
+export {
+  nodeAdapter
+};
+//# sourceMappingURL=node-OSVPYQ3D.js.map

package/dist/nonce-BXt7Qu_C.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The per-request CSP nonce, minted the same way on every target.
+ *
+ * It lives in `core/contracts/` for the same reason
+ * `core/contracts/security-headers.ts` does: `theokit start` needs it
+ * (`cli/commands/start/request-handler.ts`) and so does the streamed Cloudflare
+ * worker, which is the one deploy path that renders HTML at request time and can
+ * put the same value on the script tags it emits. `adapters → server` is not an
+ * edge in the module DAG (ADR-0001 v3), and a Web-Crypto call that returns a
+ * base64 string was never server code.
+ *
+ * T4.1 — Per-request CSP nonce generation.
+ *
+ * Returns a 22–24 character base64-encoded string carrying 16 bytes of
+ * cryptographic entropy. Used by the SSR pipeline to nonce the inline
+ * hydration data script so the default CSP can drop `'unsafe-inline'`
+ * from `script-src` in 0.3.0.
+ *
+ * Runtime portability: prefers Web Crypto (`globalThis.crypto`) because
+ * it is available on every target runtime (Node 19+, Bun, Deno, Vercel
+ * Edge, Cloudflare Workers). Falls back to `node:crypto` for older Node
+ * builds where `globalThis.crypto` is absent.
+ *
+ * NOT a security primitive in the cryptographic sense — the nonce is a
+ * one-shot, single-request value that defeats trivial XSS injection by
+ * making the attacker guess a 128-bit string per request. It is NOT
+ * suitable for signing or session tokens.
+ */
+declare function generateNonce(): string;
+
+export { generateNonce as g };

package/dist/observability-bootstrap-MZMSOE66.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  _resetObservabilityAdapter,
+  createObservabilityPluginFromConfig,
+  getObservabilityAdapter
+} from "./chunk-7PM6K5EV.js";
+import "./chunk-2AMLGJJA.js";
+import "./chunk-VI7ZANB3.js";
+export {
+  _resetObservabilityAdapter,
+  createObservabilityPluginFromConfig,
+  getObservabilityAdapter
+};
+//# sourceMappingURL=observability-bootstrap-MZMSOE66.js.map

package/dist/{openapi-HZXR335W.js → openapi-VFPEZSRI.js}

@@ -4,18 +4,20 @@ import {
   emitOpenApi,
   loadRoutesForOpenApi
 } from "./chunk-47VNWTL4.js";
-import {
-  loadConfig
-} from "./chunk-S433N3CT.js";
-import "./chunk-HBU2GIMZ.js";
-import "./chunk-GVW5EKEU.js";
-import "./chunk-7VPQHEAJ.js";
 import {
   generateManifest
-} from "./chunk-ZB7D62OA.js";
-import "./chunk-LNVMHQ2Z.js";
-import "./chunk-BMHS4WAN.js";
-import "./chunk-A7JBF5FO.js";
+} from "./chunk-KUZVRJ7M.js";
+import "./chunk-EVZKNA2W.js";
+import "./chunk-XS7EX55U.js";
+import "./chunk-FD4ZDTQ6.js";
+import {
+  loadConfig
+} from "./chunk-QTHVHNJJ.js";
+import "./chunk-3QPVEJ7D.js";
+import "./chunk-U5PWXS3J.js";
+import "./chunk-FH3SQR6P.js";
+import "./chunk-ZNZISJDZ.js";
+import "./chunk-VI7ZANB3.js";
 
 // src/cli/commands/openapi.ts
 import { mkdtempSync, rmSync } from "fs";
@@ -82,4 +84,4 @@ function emitOpenApiInMemory(manifest, config) {
 export {
   openapiCommand
 };
-//# sourceMappingURL=openapi-HZXR335W.js.map
+//# sourceMappingURL=openapi-VFPEZSRI.js.map

package/dist/{openapi-HZXR335W.js.map → openapi-VFPEZSRI.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/openapi.ts"],"sourcesContent":["/**\n * `theokit openapi` — regenerate `<distDir>/openapi.json` standalone.\n *\n * Mirrors trpc-openapi's `pnpm codegen` script. Useful in dev workflows\n * when only schemas changed and a full `theokit build` would be\n * overkill.\n *\n * Per G2 plan v1.1 T2.3. Single output (dev location only) — for the\n * dist artifact, run `theokit build`.\n *\n * Flags:\n *   --dry-run   Validate + print the document to stdout; skip the\n *               filesystem write (EC-3 absorbed).\n */\nimport { mkdtempSync, rmSync } from 'node:fs'\nimport { tmpdir } from 'node:os'\nimport { join, resolve } from 'node:path'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { generateManifest } from '../../server/scan/manifest.js'\nimport { emitOpenApi } from '../../vite-plugin/openapi-emit/emit.js'\nimport { loadRoutesForOpenApi } from '../../vite-plugin/openapi-emit/load-routes.js'\n\nconst OPENAPI_DOCS_URL = 'https://theokit.dev/concepts/openapi'\n\ninterface OpenApiCommandOptions {\n  /** Project root (defaults to `process.cwd()`). */\n  cwd?: string\n  /** Skip the filesystem write; print the document to stdout (EC-3). */\n  dryRun?: boolean\n}\n\nexport async function openapiCommand(options: OpenApiCommandOptions = {}): Promise<void> {\n  const cwd = options.cwd ?? process.cwd()\n  const config = await loadConfig(cwd)\n\n  if (config.openapi === undefined) {\n    console.error(\n      `\\n  ✗ openapi: not configured in theo.config.ts\\n\\n` +\n        `  Add the \\`openapi\\` block to opt in:\\n\\n` +\n        `    export default defineConfig({\\n` +\n        `      openapi: {\\n` +\n        `        title: 'My App',\\n` +\n        `        version: '1.0.0',\\n` +\n        `      },\\n` +\n        `    })\\n\\n` +\n        `  See ${OPENAPI_DOCS_URL} for the full reference.\\n`,\n    )\n    process.exit(1)\n    return\n  }\n\n  const serverDir = resolve(cwd, config.serverDir)\n  const manifest = generateManifest(serverDir)\n  const hydrated = await loadRoutesForOpenApi({ serverDir, routes: manifest.routes })\n\n  if (options.dryRun) {\n    // Build the document without writing — for the dry-run we still want a\n    // valid emit pass, but with an in-memory output dir we never touch disk.\n    const result = emitOpenApiInMemory(hydrated, config.openapi)\n    console.log(`\\n  ✓ openapi.json (dry-run): ${String(hydrated.length)} ops`)\n    console.log(JSON.stringify(result.document, null, 2))\n    console.log(`\\n  Docs: ${OPENAPI_DOCS_URL}\\n`)\n    return\n  }\n\n  const distDir = resolve(cwd, config.distDir)\n  const result = emitOpenApi({\n    manifest: hydrated,\n    config: { ...config.openapi, outDir: distDir },\n  })\n  console.log(\n    `\\n  ✓ openapi.json: ${String(hydrated.length)} ops → ${result.path}\\n` +\n      `  Docs: ${OPENAPI_DOCS_URL}\\n`,\n  )\n}\n\n/**\n * Dry-run helper: build the OpenAPI doc without writing. Routes through\n * the same `emitOpenApi` but discards the side-effecting write by\n * targeting a temp directory we immediately ignore.\n *\n * Honest tradeoff: this still calls `mkdirSync` (no-op on existing tmpdir)\n * + a synchronous write to a discardable tempfile. Cost is < 1ms and the\n * code stays the single transformation. A pure no-write helper would\n * duplicate the orchestration in `emit.ts` — KISS prefers reuse.\n */\nfunction emitOpenApiInMemory(\n  manifest: Parameters<typeof emitOpenApi>[0]['manifest'],\n  config: Omit<Parameters<typeof emitOpenApi>[0]['config'], 'outDir'>,\n): { document: unknown } {\n  const tmp = mkdtempSync(join(tmpdir(), 'theokit-openapi-dryrun-'))\n  try {\n    const result = emitOpenApi({ manifest, config: { ...config, outDir: tmp } })\n    return { document: result.document }\n  } finally {\n    rmSync(tmp, { recursive: true, force: true })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAcA,SAAS,aAAa,cAAc;AACpC,SAAS,cAAc;AACvB,SAAS,MAAM,eAAe;AAO9B,IAAM,mBAAmB;AASzB,eAAsB,eAAe,UAAiC,CAAC,GAAkB;AACvF,QAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACvC,QAAM,SAAS,MAAM,WAAW,GAAG;AAEnC,MAAI,OAAO,YAAY,QAAW;AAChC,YAAQ;AAAA,MACN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQW,gBAAgB;AAAA;AAAA,IAC7B;AACA,YAAQ,KAAK,CAAC;AACd;AAAA,EACF;AAEA,QAAM,YAAY,QAAQ,KAAK,OAAO,SAAS;AAC/C,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,WAAW,MAAM,qBAAqB,EAAE,WAAW,QAAQ,SAAS,OAAO,CAAC;AAElF,MAAI,QAAQ,QAAQ;AAGlB,UAAMA,UAAS,oBAAoB,UAAU,OAAO,OAAO;AAC3D,YAAQ,IAAI;AAAA,mCAAiC,OAAO,SAAS,MAAM,CAAC,MAAM;AAC1E,YAAQ,IAAI,KAAK,UAAUA,QAAO,UAAU,MAAM,CAAC,CAAC;AACpD,YAAQ,IAAI;AAAA,UAAa,gBAAgB;AAAA,CAAI;AAC7C;AAAA,EACF;AAEA,QAAM,UAAU,QAAQ,KAAK,OAAO,OAAO;AAC3C,QAAM,SAAS,YAAY;AAAA,IACzB,UAAU;AAAA,IACV,QAAQ,EAAE,GAAG,OAAO,SAAS,QAAQ,QAAQ;AAAA,EAC/C,CAAC;AACD,UAAQ;AAAA,IACN;AAAA,yBAAuB,OAAO,SAAS,MAAM,CAAC,eAAU,OAAO,IAAI;AAAA,UACtD,gBAAgB;AAAA;AAAA,EAC/B;AACF;AAYA,SAAS,oBACP,UACA,QACuB;AACvB,QAAM,MAAM,YAAY,KAAK,OAAO,GAAG,yBAAyB,CAAC;AACjE,MAAI;AACF,UAAM,SAAS,YAAY,EAAE,UAAU,QAAQ,EAAE,GAAG,QAAQ,QAAQ,IAAI,EAAE,CAAC;AAC3E,WAAO,EAAE,UAAU,OAAO,SAAS;AAAA,EACrC,UAAE;AACA,WAAO,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAC9C;AACF;","names":["result"]}
+{"version":3,"sources":["../src/cli/commands/openapi.ts"],"sourcesContent":["/**\n * `theokit openapi` — regenerate `<distDir>/openapi.json` standalone.\n *\n * Mirrors trpc-openapi's `pnpm codegen` script. Useful in dev workflows\n * when only schemas changed and a full `theokit build` would be\n * overkill.\n *\n * Per G2 plan v1.1 T2.3. Single output (dev location only) — for the\n * dist artifact, run `theokit build`.\n *\n * Flags:\n *   --dry-run   Validate + print the document to stdout; skip the\n *               filesystem write (EC-3 absorbed).\n */\nimport { mkdtempSync, rmSync } from 'node:fs'\nimport { tmpdir } from 'node:os'\nimport { join, resolve } from 'node:path'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { generateManifest } from '../../server/scan/manifest.js'\nimport { emitOpenApi } from '../../vite-plugin/openapi-emit/emit.js'\nimport { loadRoutesForOpenApi } from '../../vite-plugin/openapi-emit/load-routes.js'\n\nconst OPENAPI_DOCS_URL = 'https://theokit.dev/concepts/openapi'\n\ninterface OpenApiCommandOptions {\n  /** Project root (defaults to `process.cwd()`). */\n  cwd?: string\n  /** Skip the filesystem write; print the document to stdout (EC-3). */\n  dryRun?: boolean\n}\n\nexport async function openapiCommand(options: OpenApiCommandOptions = {}): Promise<void> {\n  const cwd = options.cwd ?? process.cwd()\n  const config = await loadConfig(cwd)\n\n  if (config.openapi === undefined) {\n    console.error(\n      `\\n  ✗ openapi: not configured in theo.config.ts\\n\\n` +\n        `  Add the \\`openapi\\` block to opt in:\\n\\n` +\n        `    export default defineConfig({\\n` +\n        `      openapi: {\\n` +\n        `        title: 'My App',\\n` +\n        `        version: '1.0.0',\\n` +\n        `      },\\n` +\n        `    })\\n\\n` +\n        `  See ${OPENAPI_DOCS_URL} for the full reference.\\n`,\n    )\n    process.exit(1)\n    return\n  }\n\n  const serverDir = resolve(cwd, config.serverDir)\n  const manifest = generateManifest(serverDir)\n  const hydrated = await loadRoutesForOpenApi({ serverDir, routes: manifest.routes })\n\n  if (options.dryRun) {\n    // Build the document without writing — for the dry-run we still want a\n    // valid emit pass, but with an in-memory output dir we never touch disk.\n    const result = emitOpenApiInMemory(hydrated, config.openapi)\n    console.log(`\\n  ✓ openapi.json (dry-run): ${String(hydrated.length)} ops`)\n    console.log(JSON.stringify(result.document, null, 2))\n    console.log(`\\n  Docs: ${OPENAPI_DOCS_URL}\\n`)\n    return\n  }\n\n  const distDir = resolve(cwd, config.distDir)\n  const result = emitOpenApi({\n    manifest: hydrated,\n    config: { ...config.openapi, outDir: distDir },\n  })\n  console.log(\n    `\\n  ✓ openapi.json: ${String(hydrated.length)} ops → ${result.path}\\n` +\n      `  Docs: ${OPENAPI_DOCS_URL}\\n`,\n  )\n}\n\n/**\n * Dry-run helper: build the OpenAPI doc without writing. Routes through\n * the same `emitOpenApi` but discards the side-effecting write by\n * targeting a temp directory we immediately ignore.\n *\n * Honest tradeoff: this still calls `mkdirSync` (no-op on existing tmpdir)\n * + a synchronous write to a discardable tempfile. Cost is < 1ms and the\n * code stays the single transformation. A pure no-write helper would\n * duplicate the orchestration in `emit.ts` — KISS prefers reuse.\n */\nfunction emitOpenApiInMemory(\n  manifest: Parameters<typeof emitOpenApi>[0]['manifest'],\n  config: Omit<Parameters<typeof emitOpenApi>[0]['config'], 'outDir'>,\n): { document: unknown } {\n  const tmp = mkdtempSync(join(tmpdir(), 'theokit-openapi-dryrun-'))\n  try {\n    const result = emitOpenApi({ manifest, config: { ...config, outDir: tmp } })\n    return { document: result.document }\n  } finally {\n    rmSync(tmp, { recursive: true, force: true })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAcA,SAAS,aAAa,cAAc;AACpC,SAAS,cAAc;AACvB,SAAS,MAAM,eAAe;AAO9B,IAAM,mBAAmB;AASzB,eAAsB,eAAe,UAAiC,CAAC,GAAkB;AACvF,QAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACvC,QAAM,SAAS,MAAM,WAAW,GAAG;AAEnC,MAAI,OAAO,YAAY,QAAW;AAChC,YAAQ;AAAA,MACN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQW,gBAAgB;AAAA;AAAA,IAC7B;AACA,YAAQ,KAAK,CAAC;AACd;AAAA,EACF;AAEA,QAAM,YAAY,QAAQ,KAAK,OAAO,SAAS;AAC/C,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,WAAW,MAAM,qBAAqB,EAAE,WAAW,QAAQ,SAAS,OAAO,CAAC;AAElF,MAAI,QAAQ,QAAQ;AAGlB,UAAMA,UAAS,oBAAoB,UAAU,OAAO,OAAO;AAC3D,YAAQ,IAAI;AAAA,mCAAiC,OAAO,SAAS,MAAM,CAAC,MAAM;AAC1E,YAAQ,IAAI,KAAK,UAAUA,QAAO,UAAU,MAAM,CAAC,CAAC;AACpD,YAAQ,IAAI;AAAA,UAAa,gBAAgB;AAAA,CAAI;AAC7C;AAAA,EACF;AAEA,QAAM,UAAU,QAAQ,KAAK,OAAO,OAAO;AAC3C,QAAM,SAAS,YAAY;AAAA,IACzB,UAAU;AAAA,IACV,QAAQ,EAAE,GAAG,OAAO,SAAS,QAAQ,QAAQ;AAAA,EAC/C,CAAC;AACD,UAAQ;AAAA,IACN;AAAA,yBAAuB,OAAO,SAAS,MAAM,CAAC,eAAU,OAAO,IAAI;AAAA,UACtD,gBAAgB;AAAA;AAAA,EAC/B;AACF;AAYA,SAAS,oBACP,UACA,QACuB;AACvB,QAAM,MAAM,YAAY,KAAK,OAAO,GAAG,yBAAyB,CAAC;AACjE,MAAI;AACF,UAAM,SAAS,YAAY,EAAE,UAAU,QAAQ,EAAE,GAAG,QAAQ,QAAQ,IAAI,EAAE,CAAC;AAC3E,WAAO,EAAE,UAAU,OAAO,SAAS;AAAA,EACrC,UAAE;AACA,WAAO,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAC9C;AACF;","names":["result"]}

package/dist/{plugin-runner-BFEcgtmJ.d.ts → plugin-runner-BVMOSxvb.d.ts}

@@ -1,4 +1,4 @@
-import { T as TheoPlugin, a as TheoApp, P as PluginContext, H as HookResult, R as RunHookOptions } from './plugin-types-D69-lJZ9.js';
+import { T as TheoPlugin, a as TheoApp, P as PluginContext, H as HookResult, R as RunHookOptions } from './plugin-types-BUVfUQ0V.js';
 
 declare class DuplicatePluginError extends Error {
     constructor(name: string);

package/dist/{plugin-types-D69-lJZ9.d.ts → plugin-types-BUVfUQ0V.d.ts}

@@ -7,6 +7,15 @@ interface PluginContext {
      * `request.method` is portable across `theokit dev` / `theokit start` (Node) and Web runtimes (#119,
      * ADR-0028 R3a). Method + absolute URL + headers; the request body is not exposed here (onRequest /
      * preHandler fire before the body is parsed — the handler reads it via `ctx.body`).
+     *
+     * `request.url` is ABSOLUTE (`http://host/api/thing`), because that is what a Web `Request`
+     * carries. A guard written as `request.url.startsWith('/api/')` is therefore false for every real
+     * request and fails silently — the hook simply never matches. To match on a path:
+     *
+     * ```ts
+     * const { pathname } = new URL(ctx.request.url)
+     * if (pathname.startsWith('/api/')) { … }
+     * ```
      */
     request: Request;
     response: ServerResponse;
@@ -49,6 +58,9 @@ interface TheoPlugin {
  *   Available during `onResponse` / `onError`. `undefined` during
  *   `onRequest` / `preHandler` (which fire before the handler runs).
  * - `ctx` / `requestId` — same semantics as the IncomingMessage path.
+ *
+ * `request.url` is ABSOLUTE here too — see the note on `PluginContext.request`; match paths with
+ * `new URL(ctx.request.url).pathname`, never `request.url.startsWith('/…')`.
  */
 interface WebPluginContext {
     request: Request;
@@ -65,4 +77,4 @@ type WebPreHandlerHook = (ctx: WebPluginContext) => void | Promise<void>;
 type WebOnResponseHook = (ctx: WebPluginContext) => void | Promise<void>;
 type WebOnErrorHook = (ctx: WebPluginErrorContext) => void | Promise<void>;
 
-export type { HookResult as H, OnErrorHook as O, PluginContext as P, RunHookOptions as R, TheoPlugin as T, WebOnRequestHook as W, TheoApp as a, WebPreHandlerHook as b, WebOnResponseHook as c, WebOnErrorHook as d, HookName as e, OnRequestHook as f, OnResponseHook as g, PluginErrorContext as h, PreHandlerHook as i };
+export type { HookResult as H, OnErrorHook as O, PluginContext as P, RunHookOptions as R, TheoPlugin as T, WebOnRequestHook as W, TheoApp as a, HookName as b, OnRequestHook as c, OnResponseHook as d, PluginErrorContext as e, PreHandlerHook as f, WebPreHandlerHook as g, WebOnResponseHook as h, WebOnErrorHook as i };

package/dist/preview-GHPT2EQ5.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/cli/commands/preview.ts
+async function defaultSteps() {
+  const [{ buildCommand }, { startCommand }] = await Promise.all([
+    import("./build-FLX6VF7Q.js"),
+    import("./start-UZDMOT7I.js")
+  ]);
+  return {
+    build: (opts) => buildCommand(opts),
+    start: (opts) => startCommand(opts)
+  };
+}
+async function previewCommand(options = {}, steps) {
+  const { build, start } = steps ?? await defaultSteps();
+  await build({ target: options.target });
+  await start({ port: options.port });
+}
+export {
+  previewCommand
+};
+//# sourceMappingURL=preview-GHPT2EQ5.js.map

package/dist/preview-GHPT2EQ5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/preview.ts"],"sourcesContent":["/**\n * `theokit preview` — build for production, then serve the result.\n *\n * Reproducing production locally was two commands, `theokit build` then\n * `theokit start`, and the two-step version fails silently: `start` serves\n * whatever `.theokit/` already holds, so a skipped build serves the previous one\n * and nothing says so. The gap is widest exactly when it matters — after a\n * change, checking whether the change works (B-030).\n *\n * This is not a third implementation of either step. It calls both, in order,\n * and never reaches the second when the first throws. `build` and `start` stay\n * separately invocable because CI builds and serves in different jobs.\n */\n\nexport interface PreviewOptions {\n  /** Port for the production server. Forwarded to `start`. */\n  port?: number\n  /** Deploy target to build for. Forwarded to `build`. */\n  target?: string\n}\n\n/**\n * The two steps, injected so the composition can be tested without running a\n * real build — the composition IS the behaviour here, and a test that shells out\n * to a full build would be testing the build.\n */\nexport interface PreviewSteps {\n  build: (opts: { target?: string }) => Promise<void>\n  start: (opts: { port?: number }) => Promise<void>\n}\n\nasync function defaultSteps(): Promise<PreviewSteps> {\n  const [{ buildCommand }, { startCommand }] = await Promise.all([\n    import('./build.js'),\n    import('./start/index.js'),\n  ])\n  return {\n    build: (opts) => buildCommand(opts),\n    start: (opts) => startCommand(opts),\n  }\n}\n\nexport async function previewCommand(\n  options: PreviewOptions = {},\n  steps?: PreviewSteps,\n): Promise<void> {\n  const { build, start } = steps ?? (await defaultSteps())\n\n  // No catch: a build failure must reach the caller unchanged. Swallowing it\n  // here and starting anyway would serve the previous build — the exact defect\n  // this command exists to remove, reproduced inside its own fix.\n  await build({ target: options.target })\n  await start({ port: options.port })\n}\n"],"mappings":";;;;AA+BA,eAAe,eAAsC;AACnD,QAAM,CAAC,EAAE,aAAa,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC7D,OAAO,qBAAY;AAAA,IACnB,OAAO,qBAAkB;AAAA,EAC3B,CAAC;AACD,SAAO;AAAA,IACL,OAAO,CAAC,SAAS,aAAa,IAAI;AAAA,IAClC,OAAO,CAAC,SAAS,aAAa,IAAI;AAAA,EACpC;AACF;AAEA,eAAsB,eACpB,UAA0B,CAAC,GAC3B,OACe;AACf,QAAM,EAAE,OAAO,MAAM,IAAI,SAAU,MAAM,aAAa;AAKtD,QAAM,MAAM,EAAE,QAAQ,QAAQ,OAAO,CAAC;AACtC,QAAM,MAAM,EAAE,MAAM,QAAQ,KAAK,CAAC;AACpC;","names":[]}

package/dist/provider-resolver-Dx6QuWrw.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Provider Resolver — Strategy + Registry pattern (FAANG-grade).
+ *
+ * Inspiration: Dapr Conversation Registry (`dapr/pkg/components/conversation/registry.go`)
+ * + Encore Manager provider array (`encore/runtimes/go/pubsub/manager_internal.go`).
+ *
+ * Principle: provider routing is the FRAMEWORK's responsibility, not the consumer's — but the
+ * consumer still gets to SAY which provider it wants, and it says so in the model id.
+ *
+ * `provider/model` is the convention every agent in this ecosystem already writes
+ * (`anthropic/claude-sonnet-4-6`, `openrouter/anthropic/claude-haiku-4.5`), and it is the one the
+ * SDK routes on. Until theokit#326 this resolver ignored it entirely and picked by env-var
+ * priority, so an agent that declared `anthropic/...` was handed an OpenRouter key whenever one
+ * happened to be present — and every turn failed with `auth_failed (HTTP 401)` against a provider
+ * nobody asked for. The declared provider now wins; priority is the fallback for a bare model id.
+ *
+ * Wire protocol: OpenAI Chat Completions (universal — implemented by every
+ * os providers: OpenRouter, Groq, Mistral, Together, Anthropic via proxy, etc).
+ *
+ * Resolution by priority (FIRST match wins):
+ *   1. OPENROUTER_API_KEY → baseUrl=openrouter.ai (multi-model gateway)
+ *   2. OPENAI_API_KEY     → baseUrl=api.openai.com
+ *   3. ANTHROPIC_API_KEY  → direct Anthropic (Messages API, not OpenAI-compat)
+ *
+ * Escape hatch: an explicit `options.apiKey` OVERRIDES auto-resolution
+ * (the consumer can force a specific provider if it wants to).
+ */
+/**
+ * Provider configuration descriptor — Registry entry shape.
+ *
+ * @public
+ */
+interface ProviderDescriptor {
+    /** Stable name used internally — not exposed on the wire. */
+    name: string;
+    /**
+     * Environment variable that holds the API key for this provider.
+     *
+     * **Absent means the provider needs no credential** — a model running on the developer's own
+     * machine has nothing to authenticate against. Such a provider is reachable ONLY when a model id
+     * names it (`ollama/llama3.2`); it never participates in the priority walk, because the walk
+     * reads "this variable is set" as "a human configured this provider", and a keyless entry offers
+     * no equivalent signal. Including it would route every bare model id to localhost the moment no
+     * cloud key was set (usetheokit/theokit#407).
+     */
+    envKey?: string;
+    /** Base URL for the provider's OpenAI-compatible (or native) API. */
+    baseUrl: string;
+    /**
+     * Environment variable that OVERRIDES {@link baseUrl} when set.
+     *
+     * Scoped honestly: every caller inside this framework takes `.apiKey` from the resolved provider
+     * and discards `.baseUrl` (`cli/commands/start/handlers.ts`, `vite-plugin/api-middleware.ts`,
+     * `cli/commands/agent.ts`), so the endpoint a request actually reaches is chosen by the SDK, from
+     * its own profile — which reads `OLLAMA_HOST` itself. This field therefore does not redirect
+     * traffic today.
+     *
+     * It exists so that the `baseUrl` this function REPORTS agrees with where the request goes, for
+     * the consumers that read it — `resolveProvider` is public API, and a reported endpoint that
+     * contradicts the real one is a debugging trap rather than a harmless inaccuracy.
+     */
+    baseUrlEnv?: string;
+    /** Resolution priority (lower = higher priority). FIRST match wins. */
+    priority: number;
+}
+/**
+ * Resolved provider configuration — output of `resolveProvider()`.
+ *
+ * @public
+ */
+interface ResolvedProvider {
+    name: string;
+    apiKey: string;
+    baseUrl: string;
+}
+/** Where the announcement goes, and what it may contain. @public */
+interface ResolveOptions {
+    /** Receives one line per provider, at most once. NEVER receives the key. */
+    announce?: (line: string) => void;
+}
+/**
+ * Register a new provider (Registry pattern — runtime extension point).
+ * Useful for self-hosted endpoints or custom providers without touching theokit src.
+ *
+ * @example
+ * registerProvider({
+ *   name: 'self-hosted',
+ *   envKey: 'SELF_HOSTED_API_KEY',
+ *   baseUrl: 'https://llm.internal.acme.com/v1',
+ *   priority: 0, // highest priority
+ * })
+ *
+ * @public
+ */
+declare function registerProvider(descriptor: ProviderDescriptor): void;
+/**
+ * Reset registry to DEFAULT_REGISTRY (test-only / dev escape hatch).
+ *
+ * @public
+ */
+declare function resetProviderRegistry(): void;
+/**
+ * Get current registry snapshot (read-only — inspection).
+ *
+ * @public
+ */
+declare function listProviders(): readonly ProviderDescriptor[];
+/**
+ * Resolve the provider for a model.
+ *
+ * When `modelId` declares a registered provider (`anthropic/…`), THAT provider's key is
+ * required — no substitution. Otherwise the registry is walked by priority, first match wins.
+ *
+ * @returns ResolvedProvider with apiKey + baseUrl + name
+ * @throws Error if NO provider env var is set (actionable message)
+ *
+ * @public
+ */
+declare function resolveProvider(modelId?: string, options?: ResolveOptions): ResolvedProvider;
+/**
+ * Try to resolve — does NOT throw. Returns null if no provider available.
+ * Useful for graceful degradation (e.g., mock mode).
+ *
+ * @public
+ */
+declare function tryResolveProvider(modelId?: string): ResolvedProvider | null;
+
+export { type ProviderDescriptor as P, type ResolvedProvider as R, registerProvider as a, resetProviderRegistry as b, listProviders as l, resolveProvider as r, tryResolveProvider as t };

package/dist/registry-KBZDCFVQ.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/adapters/registry.ts
+var adapterRegistry = {
+  node: async () => (await import("./node-OSVPYQ3D.js")).nodeAdapter,
+  vercel: async () => (await import("./vercel-BMCQKCWE.js")).vercelAdapter,
+  cloudflare: async () => (await import("./cloudflare-SIG42OIW.js")).cloudflareAdapter,
+  static: async () => (await import("./static-SVDWIOXJ.js")).staticAdapter,
+  bun: async () => (await import("./bun-L7PP6ID5.js")).bunAdapter,
+  "deno-deploy": async () => (await import("./deno-deploy-LQAYOOPW.js")).denoDeployAdapter,
+  netlify: async () => (await import("./netlify-C2IRCZKI.js")).netlifyAdapter,
+  "aws-lambda": async () => (await import("./aws-lambda-VKMYUMP2.js")).awsLambdaAdapter,
+  "theo-cloud": async () => (await import("./theo-cloud-3ET4G5T6.js")).theoCloudAdapter
+};
+async function resolveAdapter(target) {
+  const factory = adapterRegistry[target];
+  return factory();
+}
+export {
+  resolveAdapter
+};
+//# sourceMappingURL=registry-KBZDCFVQ.js.map

package/dist/route-config-Cm_ZMA1C.d.ts

@@ -0,0 +1,72 @@
+import { z } from 'zod';
+import { R as RoutePolicy } from './route-policy-BxOycCDq.js';
+
+/**
+ * core/contracts/route-config.ts
+ *
+ * Canonical home for `RouteConfig<TQuery, TBody, TParams, TCtx, TResponse>` —
+ * the contract shape consumed by `defineRoute()` (server) and
+ * `defineCachedRoute()` (cache).
+ *
+ * Moved here in T2.2 of architecture-cleanup so `cache → core/contracts`
+ * is the legal edge (replacing the prior `cache → server` violation).
+ *
+ * GAP-4 (plan v1.1): the 5-arity generic shape `<TQuery, TBody, TParams, TCtx, TResponse>`
+ * MUST be preserved byte-by-byte. Type tests assert this in
+ * `tests/unit/route-config-generic-arity.test.ts`.
+ */
+
+interface RouteConfig<TQuery extends z.ZodType = z.ZodUndefined, TBody extends z.ZodType = z.ZodUndefined, TParams extends z.ZodType = z.ZodUndefined, TCtx = unknown, TResponse = unknown> {
+    query?: TQuery;
+    body?: TBody;
+    params?: TParams;
+    status?: number;
+    /**
+     * Optional Zod schema for the handler's plain-object return value. When
+     * present, BOTH runtimes (Node `executeRoute` + Web `executeWebRequest`)
+     * validate the handler's plain-object return against it BEFORE serializing.
+     *
+     * A mismatch is a SERVER fault (the handler violated its own declared
+     * contract) → 500 `INTERNAL_SERVER_ERROR`, distinct from the 400 used for
+     * input (`query`/`body`/`params`) validation failures.
+     *
+     * `Response`-instance returns (and `undefined`/`null` → 204) are NOT
+     * validated. This is a plain optional field — runtime validation only; the
+     * handler return type is NOT statically inferred from `response` (YAGNI).
+     */
+    response?: z.ZodType;
+    /**
+     * Opt out of CSRF enforcement for this route. Use for endpoints that
+     * legitimately receive third-party POSTs (Stripe webhooks, GitHub
+     * webhooks, OAuth callbacks). Defaults to enforced per `config.security.csrf`.
+     *
+     * Setting `csrf: false` only disables the per-route check — it does NOT
+     * disable the global mode setting for other routes.
+     */
+    csrf?: false;
+    /**
+     * Who may perform this operation (ADR 0001).
+     *
+     * Evaluated by the Node executor, the Web executor AND `callProcedure`, from
+     * one implementation — which is what makes "the same route gives the same
+     * access decision on every transport" a property of the code. Before this
+     * existed, a route's access rules applied over HTTP and applied nowhere
+     * in-process, and in-process is the path the desktop and terminal targets are
+     * built on.
+     *
+     * `'public'` is a declaration and not a default. Absence currently means "not
+     * declared" and is NOT reinterpreted as denial at runtime: flipping that would
+     * break every existing route in every consumer at once. The ADR routes it
+     * through a build-time gate and a migration instead.
+     */
+    policy?: RoutePolicy<z.infer<TQuery>, z.infer<TBody>, z.infer<TParams>>;
+    handler: (ctx: {
+        query: z.infer<TQuery>;
+        body: z.infer<TBody>;
+        params: z.infer<TParams>;
+        request: Request;
+        ctx: TCtx;
+    }) => TResponse | Promise<TResponse>;
+}
+
+export type { RouteConfig as R };

package/dist/route-policy-BxOycCDq.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Who is asking. Supplied by the caller through the run-context, never read from
+ * a transport.
+ *
+ * A cookie is one way to establish this and a terminal has no cookies, so the
+ * contract takes the resolved subject rather than the mechanism that resolved it
+ * (ADR 0001 section Decision, point 4).
+ */
+interface RouteSubject {
+    id: string;
+    [claim: string]: unknown;
+}
+/** The answer a policy gives. A denial carries its reason so the caller can say it. */
+type AccessDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: string;
+};
+/** What a policy is handed. Deliberately transport-free: no headers, no cookies, no response. */
+interface RoutePolicyInput<TQuery = unknown, TBody = unknown, TParams = unknown> {
+    subject: RouteSubject | null;
+    query: TQuery;
+    body: TBody;
+    params: TParams;
+}
+/**
+ * A route's access policy.
+ *
+ * `'public'` is a declaration, not a default. The point of writing it is that
+ * openness becomes greppable — today a route that enforces nothing looks exactly
+ * like a route nobody thought about (ADR 0001 section Consequences, Risks).
+ */
+type RoutePolicy<TQuery = unknown, TBody = unknown, TParams = unknown> = 'public' | ((input: RoutePolicyInput<TQuery, TBody, TParams>) => boolean | AccessDecision | Promise<boolean | AccessDecision>);
+/** Narrow a run-context to the subject it carries, if it carries one. */
+declare function subjectFromContext(context: unknown): RouteSubject | null;
+/**
+ * Evaluate a route policy. THE single implementation - the HTTP executors and
+ * the in-process caller all reach this function, which is what makes "the same
+ * route gives the same access decision on every transport" a property of the code
+ * rather than a claim in a document.
+ *
+ * The shape mirrors `validateRouteInput`, which is already described in-source as
+ * "the SINGLE shared pipeline ... One pipeline, no drift". Access control had no
+ * such pipeline; that absence is what ADR 0001 exists to close.
+ *
+ * An undeclared policy returns `allowed` and is NOT the same thing as `'public'`.
+ * Absence is refused where an application DECLARES its routes — the file-system
+ * scanner fails the build naming the file (`MissingRoutePolicyError`) — and not
+ * here, where the argument may be a `RouteConfig` a caller built in memory and
+ * never scanned. Reinterpreting absence as denial at this point would break
+ * every direct caller of the executors at once, which the ADR routes through the
+ * build gate and a migration instead.
+ */
+declare function evaluateRoutePolicy(policy: RoutePolicy | undefined, input: RoutePolicyInput): Promise<AccessDecision>;
+/**
+ * The authorization primitive the framework did not have.
+ *
+ * `requireAuth` answers "is anyone there". Every action then answered "may THIS
+ * subject touch THIS record" on its own, which is one implementation per action
+ * and one place per action to get it wrong. This is that answer, once.
+ */
+declare function requireOwner(subject: RouteSubject | null, ownerId: string | null | undefined): AccessDecision;
+
+export { type AccessDecision as A, type RoutePolicy as R, type RouteSubject as a, type RoutePolicyInput as b, evaluateRoutePolicy as e, requireOwner as r, subjectFromContext as s };

package/dist/router/element-scroll-restoration.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Restore the scroll offset of elements the application marked as scrollers (#421).
+ *
+ * Mounted beside react-router's `<ScrollRestoration>`, not instead of it: that one owns the
+ * DOCUMENT, correctly and with its own timing, and this one owns the elements it cannot see. An app
+ * whose document scrolls keeps exactly the behaviour it had.
+ *
+ * ## What an application does
+ *
+ * ```tsx
+ * <main data-theo-scroll="main" className="overflow-y-auto">…</main>
+ * ```
+ *
+ * The attribute's VALUE is the id, so two scrollers on one page stay distinguishable.
+ *
+ * ## Why every decision is elsewhere
+ *
+ * This component queries, sequences, and nothing else — `scroll-restoration.ts` decides which key
+ * an offset lands under, when it is read back, and what happens to an element that is gone on
+ * return. That split is because this repository sets up no DOM test environment, so the part that
+ * cannot be covered by a test is deliberately the part with no branches in it.
+ *
+ * `useLayoutEffect` and not `useEffect`: the offset must be applied before the browser paints, or
+ * the user sees the top of the list and then a jump.
+ */
+declare function ElementScrollRestoration(): null;
+
+export { ElementScrollRestoration };