theokit 0.48.13 → 0.50.0

package/dist/chunk-3PBAN2YE.js

@@ -0,0 +1,146 @@
+// src/server/_internal/process-singleton.ts
+var NAMESPACE = "theokit.singleton.";
+function processSingleton(key, factory) {
+  const slot = /* @__PURE__ */ Symbol.for(NAMESPACE + key);
+  const host = globalThis;
+  const existing = host[slot];
+  if (existing !== void 0) return existing;
+  const created = factory();
+  host[slot] = created;
+  return created;
+}
+
+// src/server/agent/provider-resolver.ts
+var DEFAULT_REGISTRY = [
+  {
+    name: "openrouter",
+    envKey: "OPENROUTER_API_KEY",
+    baseUrl: "https://openrouter.ai/api/v1",
+    priority: 1
+  },
+  {
+    name: "openai",
+    envKey: "OPENAI_API_KEY",
+    baseUrl: "https://api.openai.com/v1",
+    priority: 2
+  },
+  {
+    name: "anthropic",
+    envKey: "ANTHROPIC_API_KEY",
+    baseUrl: "https://api.anthropic.com",
+    priority: 3
+  },
+  {
+    // Mirrors the profile `@theokit/sdk` already ships for this provider — same default host, same
+    // override variable — so the two cannot disagree about where ollama is listening. The SDK is
+    // what dials it (see `baseUrlEnv`); this entry's job is to stop the resolver from rejecting the
+    // model before the SDK is ever reached. No `envKey`: see that field's doc comment for why the
+    // absence also keeps this entry out of the priority walk.
+    name: "ollama",
+    baseUrl: "http://localhost:11434",
+    baseUrlEnv: "OLLAMA_HOST",
+    priority: 100
+  }
+];
+function registryOf() {
+  return processSingleton("provider-registry", () => [...DEFAULT_REGISTRY]);
+}
+var announced = /* @__PURE__ */ new Set();
+function registerProvider(descriptor) {
+  const registry = registryOf();
+  const idx = registry.findIndex((p) => p.name === descriptor.name);
+  if (idx >= 0) registry[idx] = descriptor;
+  else registry.push(descriptor);
+}
+function resetProviderRegistry() {
+  const registry = registryOf();
+  registry.length = 0;
+  registry.push(...DEFAULT_REGISTRY);
+}
+function listProviders() {
+  return [...registryOf()].sort((a, b) => a.priority - b.priority);
+}
+function announce(desc, how, options) {
+  if (announced.has(desc.name)) return;
+  announced.add(desc.name);
+  const source = desc.envKey ?? "none (this provider takes no credential)";
+  const line = `[theokit] provider=${desc.name} (${how}) source=${source} baseUrl=${baseUrlOf(desc)}`;
+  if (options?.announce) options.announce(line);
+  else console.warn(line);
+}
+function baseUrlOf(desc) {
+  if (desc.baseUrlEnv === void 0) return desc.baseUrl;
+  const override = process.env[desc.baseUrlEnv];
+  return override !== void 0 && override.length > 0 ? override : desc.baseUrl;
+}
+function providerOf(modelId, registered) {
+  const prefix = declaredPrefixOf(modelId);
+  if (prefix === void 0) return void 0;
+  return registered.find((p) => p.name === prefix);
+}
+function declaredPrefixOf(modelId) {
+  if (modelId === void 0) return void 0;
+  const slash = modelId.indexOf("/");
+  if (slash <= 0) return void 0;
+  return modelId.slice(0, slash);
+}
+function takesCredential(desc) {
+  return desc.envKey !== void 0;
+}
+function resolveProvider(modelId, options) {
+  const sorted = [...registryOf()].sort((a, b) => a.priority - b.priority);
+  const declared = modelId === void 0 ? void 0 : providerOf(modelId, sorted);
+  if (declared !== void 0 && modelId !== void 0) {
+    if (declared.envKey === void 0) {
+      announce(declared, "declared by the model", options);
+      return { name: declared.name, apiKey: "", baseUrl: baseUrlOf(declared) };
+    }
+    const apiKey = process.env[declared.envKey];
+    if (apiKey && apiKey.length > 0) {
+      announce(declared, "declared by the model", options);
+      return { name: declared.name, apiKey, baseUrl: baseUrlOf(declared) };
+    }
+    throw new Error(
+      `Model "${modelId}" declares provider "${declared.name}", but ${declared.envKey} is not set. Set ${declared.envKey}, or change the model's provider prefix.`
+    );
+  }
+  const credentialed = sorted.filter(takesCredential);
+  for (const desc of credentialed) {
+    const apiKey = process.env[desc.envKey];
+    if (apiKey && apiKey.length > 0) {
+      announce(desc, "by env priority", options);
+      return {
+        name: desc.name,
+        apiKey,
+        baseUrl: baseUrlOf(desc)
+      };
+    }
+  }
+  const prefix = declaredPrefixOf(modelId);
+  if (prefix !== void 0) {
+    throw new Error(
+      `Model "${modelId}" declares provider "${prefix}", which is not registered. Registered providers: ${sorted.map((p) => p.name).join(", ")}. Register it with registerProvider({ name: '${prefix}', \u2026 }), or use a registered prefix.`
+    );
+  }
+  const envKeys = credentialed.map((p) => p.envKey).join(" OR ");
+  throw new Error(
+    `No LLM provider API key found in environment. Set one of: ${envKeys}. Get a free OpenRouter key at https://openrouter.ai/keys (recommended \u2014 one key, many models).`
+  );
+}
+function tryResolveProvider(modelId) {
+  try {
+    return resolveProvider(modelId);
+  } catch {
+    return null;
+  }
+}
+
+export {
+  processSingleton,
+  registerProvider,
+  resetProviderRegistry,
+  listProviders,
+  resolveProvider,
+  tryResolveProvider
+};
+//# sourceMappingURL=chunk-3PBAN2YE.js.map

package/dist/chunk-3PBAN2YE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/_internal/process-singleton.ts","../src/server/agent/provider-resolver.ts"],"mappings":";AAgCA,IAAM,YAAY;AASX,SAAS,iBAAmC,KAAa,SAAqB;AACnF,QAAM,OAAO,uBAAO,IAAI,YAAY,GAAG;AACvC,QAAM,OAAO;AAEb,QAAM,WAAW,KAAK,IAAI;AAC1B,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,UAAU,QAAQ;AACxB,OAAK,IAAI,IAAI;AACb,SAAO;AACT;;;ACsCA,IAAM,mBAAyC;AAAA,EAC7C;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAME,MAAM;AAAA,IACN,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,UAAU;AAAA,EACZ;AACF;AAYA,SAAS,aAAmC;AAC1C,SAAO,iBAAiB,qBAAqB,MAAM,CAAC,GAAG,gBAAgB,CAAC;AAC1E;AAUA,IAAM,YAAY,oBAAI,IAAY;AA2B3B,SAAS,iBAAiB,YAAsC;AAErE,QAAM,WAAW,WAAW;AAC5B,QAAM,MAAM,SAAS,UAAU,CAAC,MAAM,EAAE,SAAS,WAAW,IAAI;AAChE,MAAI,OAAO,EAAG,UAAS,GAAG,IAAI;AAAA,MACzB,UAAS,KAAK,UAAU;AAC/B;AAOO,SAAS,wBAA8B;AAC5C,QAAM,WAAW,WAAW;AAC5B,WAAS,SAAS;AAClB,WAAS,KAAK,GAAG,gBAAgB;AACnC;AAOO,SAAS,gBAA+C;AAC7D,SAAO,CAAC,GAAG,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AACjE;AASA,SAAS,SACP,MACA,KACA,SACM;AACN,MAAI,UAAU,IAAI,KAAK,IAAI,EAAG;AAC9B,YAAU,IAAI,KAAK,IAAI;AACvB,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,OAAO,sBAAsB,KAAK,IAAI,KAAK,GAAG,YAAY,MAAM,YAAY,UAAU,IAAI,CAAC;AACjG,MAAI,SAAS,SAAU,SAAQ,SAAS,IAAI;AAAA,MAIvC,SAAQ,KAAK,IAAI;AACxB;AAQA,SAAS,UAAU,MAAkC;AACnD,MAAI,KAAK,eAAe,OAAW,QAAO,KAAK;AAC/C,QAAM,WAAW,QAAQ,IAAI,KAAK,UAAU;AAC5C,SAAO,aAAa,UAAa,SAAS,SAAS,IAAI,WAAW,KAAK;AACzE;AAaA,SAAS,WACP,SACA,YACgC;AAChC,QAAM,SAAS,iBAAiB,OAAO;AACvC,MAAI,WAAW,OAAW,QAAO;AACjC,SAAO,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM;AACjD;AASA,SAAS,iBAAiB,SAAiD;AACzE,MAAI,YAAY,OAAW,QAAO;AAClC,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,SAAS,EAAG,QAAO;AACvB,SAAO,QAAQ,MAAM,GAAG,KAAK;AAC/B;AAKA,SAAS,gBAAgB,MAAwD;AAC/E,SAAO,KAAK,WAAW;AACzB;AAaO,SAAS,gBAAgB,SAAkB,SAA4C;AAC5F,QAAM,SAAS,CAAC,GAAG,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AAEvE,QAAM,WAAW,YAAY,SAAY,SAAY,WAAW,SAAS,MAAM;AAC/E,MAAI,aAAa,UAAa,YAAY,QAAW;AACnD,QAAI,SAAS,WAAW,QAAW;AAIjC,eAAS,UAAU,yBAAyB,OAAO;AACnD,aAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,IAAI,SAAS,UAAU,QAAQ,EAAE;AAAA,IACzE;AACA,UAAM,SAAS,QAAQ,IAAI,SAAS,MAAM;AAC1C,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,UAAU,yBAAyB,OAAO;AACnD,aAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,SAAS,UAAU,QAAQ,EAAE;AAAA,IACrE;AAIA,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,wBAAwB,SAAS,IAAI,UAAU,SAAS,MAAM,oBACtE,SAAS,MAAM;AAAA,IAC1B;AAAA,EACF;AAIA,QAAM,eAAe,OAAO,OAAO,eAAe;AAElD,aAAW,QAAQ,cAAc;AAC/B,UAAM,SAAS,QAAQ,IAAI,KAAK,MAAM;AACtC,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,MAAM,mBAAmB,OAAO;AACzC,aAAO;AAAA,QACL,MAAM,KAAK;AAAA,QACX;AAAA,QACA,SAAS,UAAU,IAAI;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAKA,QAAM,SAAS,iBAAiB,OAAO;AACvC,MAAI,WAAW,QAAW;AACxB,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,wBAAwB,MAAM,qDACpB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,gDACf,MAAM;AAAA,IACxD;AAAA,EACF;AAEA,QAAM,UAAU,aAAa,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,MAAM;AAC7D,QAAM,IAAI;AAAA,IACR,6DAA6D,OAAO;AAAA,EAEtE;AACF;AAQO,SAAS,mBAAmB,SAA2C;AAC5E,MAAI;AACF,WAAO,gBAAgB,OAAO;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-HBU2GIMZ.js → chunk-3QPVEJ7D.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 
 // src/config/load-env.ts
-import { lstatSync, readFileSync, realpathSync, statSync } from "fs";
+import { closeSync, lstatSync, openSync, readFileSync, realpathSync, statSync } from "fs";
 import { resolve } from "path";
 import dotenv from "dotenv";
 import { expand } from "dotenv-expand";
@@ -29,19 +29,25 @@ function readEnvFile(path) {
     );
     return null;
   }
+  let fd;
   try {
-    const lstat = lstatSync(path);
-    if (lstat.isSymbolicLink()) {
-      const real = realpathSync(path);
-      console.info(`[theokit] .env at ${path} is a symlink \u2192 ${real}`);
-    }
+    fd = openSync(path, "r");
   } catch {
+    return null;
   }
   try {
-    const content = readFileSync(path, "utf-8");
-    return dotenv.parse(content);
+    try {
+      if (lstatSync(path).isSymbolicLink()) {
+        const real = realpathSync(path);
+        console.info(`[theokit] .env at ${path} is a symlink \u2192 ${real}`);
+      }
+    } catch {
+    }
+    return dotenv.parse(readFileSync(fd, "utf-8"));
   } catch {
     return null;
+  } finally {
+    closeSync(fd);
   }
 }
 function loadEnv(options = {}) {
@@ -98,4 +104,4 @@ function loadEnv(options = {}) {
 export {
   loadEnv
 };
-//# sourceMappingURL=chunk-HBU2GIMZ.js.map
+//# sourceMappingURL=chunk-3QPVEJ7D.js.map

package/dist/chunk-3QPVEJ7D.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/load-env.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Reads `.env` files from a CLI-controlled `cwd`. File names are a fixed\n * literal set. Build-time + CLI tool; no HTTP input.\n */\n/**\n * `loadEnv()` — auto-loads `.env` files into `process.env` for server code.\n *\n * Implements the Next.js `loadEnvConfig` algorithm\n * (`references/next.js/packages/next-env/index.ts:114-180`) with TheoKit\n * adaptations:\n *\n * - EC-1: 1MB file-size cap (anti-OOM, anti-supply-chain).\n * - EC-2: `_resetEnvCache()` test-only side-door.\n * - EC-8: `dotenv-expand` circular-ref safe (lib-provided).\n * - EC-13: log when `.env` is a symlink (transparency).\n * - D6: real `process.env` wins over `.env`-file values.\n * - NODE_ENV stash: `.env`-set NODE_ENV NEVER overrides the real\n *   `process.env.NODE_ENV`. Stashed in `__THEOKIT_USER_NODE_ENV` instead.\n */\n\nimport { closeSync, lstatSync, openSync, readFileSync, realpathSync, statSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport dotenv from 'dotenv'\nimport { expand, type DotenvPopulateInput } from 'dotenv-expand'\n\nimport type { LoadEnvOptions, LoadEnvResult } from './load-env-types.js'\n\n/** EC-1: 1MB cap. Real `.env`s are < 10KB. */\nconst MAX_ENV_FILE_BYTES = 1_048_576\n\nconst cache = new Map<string, LoadEnvResult>()\n\n/** Test-only side-door for EC-2 — clear the module-level cache between vitest test files. */\nexport function _resetEnvCache(): void {\n  cache.clear()\n}\n\nfunction envFilesInPriorityOrder(mode: string): string[] {\n  // Top of list = highest priority. Will be read in REVERSE so first-in\n  // wins via overwrite during merge.\n  const files = [`.env.${mode}.local`, `.env.local`, `.env.${mode}`, `.env`]\n  // Test mode skips `.env.local` per dotenv convention (avoid leaking dev\n  // secrets into the test suite).\n  if (mode === 'test') {\n    return files.filter((f) => f !== '.env.local')\n  }\n  return files\n}\n\nfunction readEnvFile(path: string): Record<string, string> | null {\n  let stat\n  try {\n    stat = statSync(path)\n  } catch {\n    return null // ENOENT / EACCES → skip\n  }\n\n  // Allow files + FIFOs (1Password/SOPS pipe support).\n  if (!stat.isFile() && !stat.isFIFO()) return null\n\n  // EC-1 — anti-OOM cap.\n  if (stat.size > MAX_ENV_FILE_BYTES) {\n    console.warn(\n      `[theokit] .env file at ${path} exceeds ${MAX_ENV_FILE_BYTES} bytes — skipping (likely a generated artifact, not a real env file)`,\n    )\n    return null\n  }\n\n  // Open first, then describe, then read — all through the one descriptor. Reading by name after\n  // inspecting the name resolves it twice, so the file the transparency note describes need not be\n  // the file whose values are loaded (CodeQL `js/file-system-race`).\n  let fd: number\n  try {\n    fd = openSync(path, 'r')\n  } catch {\n    return null\n  }\n\n  try {\n    // EC-13 — symlink transparency. Don't refuse; just say so.\n    try {\n      if (lstatSync(path).isSymbolicLink()) {\n        const real = realpathSync(path)\n        // eslint-disable-next-line no-console -- intentional transparency log on a build-time tool\n        console.info(`[theokit] .env at ${path} is a symlink → ${real}`)\n      }\n    } catch {\n      // The note is informational; failing to produce it must not fail the load.\n    }\n\n    return dotenv.parse(readFileSync(fd, 'utf-8'))\n  } catch {\n    return null\n  } finally {\n    closeSync(fd)\n  }\n}\n\n// eslint-disable-next-line complexity -- canonical env-load algorithm (priority → expand → guards → apply); inlining branches is clearer than extracting micro-helpers\nexport function loadEnv(options: LoadEnvOptions = {}): LoadEnvResult {\n  const cwd = options.cwd ?? process.cwd()\n  const mode = options.mode ?? process.env.NODE_ENV ?? 'development'\n  const cacheKey = `${cwd}:${mode}`\n\n  if (!options.forceReload) {\n    const cached = cache.get(cacheKey)\n    if (cached) return cached\n  }\n\n  const fileNames = envFilesInPriorityOrder(mode)\n  const filePaths = fileNames.map((f) => resolve(cwd, f))\n\n  // Read in REVERSE — lower-priority files first, so higher-priority\n  // (lower-index) overwrites during merge.\n  const merged: Record<string, string> = {}\n  const loadedFromFiles: string[] = []\n  for (const path of [...filePaths].reverse()) {\n    const parsed = readEnvFile(path)\n    if (parsed === null) continue\n    for (const [k, v] of Object.entries(parsed)) {\n      merged[k] = v\n    }\n    loadedFromFiles.unshift(path) // keep priority order in result\n  }\n\n  // NODE_ENV stash — `.env`-set NODE_ENV never overrides real process.env.NODE_ENV.\n  if (merged.NODE_ENV && process.env.__THEOKIT_USER_NODE_ENV === undefined) {\n    process.env.__THEOKIT_USER_NODE_ENV = merged.NODE_ENV\n  }\n  delete merged.NODE_ENV // never propagate\n\n  // EC-8 — dotenv-expand@11 stack-overflows on circular refs (A=${B}, B=${A}).\n  // Wrap in try/catch — on overflow, leave the parsed map untouched (literal\n  // values survive). Tested via test_loadEnv_circular_expand_no_loop_EC8.\n  // Pass a CLONE of process.env (string-only, filtered) so expand can\n  // reference real env without mutating it.\n  const processEnvClone: DotenvPopulateInput = {}\n  for (const [k, v] of Object.entries(process.env)) {\n    if (typeof v === 'string') processEnvClone[k] = v\n  }\n  try {\n    expand({ parsed: merged, processEnv: processEnvClone })\n  } catch (err) {\n    if (err instanceof RangeError) {\n      console.warn(\n        `[theokit] .env expansion overflow (likely circular reference like A=\\${B}, B=\\${A}). Leaving values as literals.`,\n      )\n    } else {\n      throw err\n    }\n  }\n\n  // Apply: D6 — real process.env wins over file values.\n  const loaded: Record<string, string> = {}\n  for (const [k, v] of Object.entries(merged)) {\n    if (process.env[k] !== undefined) continue // real env wins\n    process.env[k] = v\n    loaded[k] = v\n  }\n\n  // Sentinel\n  process.env.__THEOKIT_PROCESSED_ENV = 'true'\n\n  const result: LoadEnvResult = { loaded, loadedFromFiles }\n  cache.set(cacheKey, result)\n  return result\n}\n"],"mappings":";;;;AAoBA,SAAS,WAAW,WAAW,UAAU,cAAc,cAAc,gBAAgB;AACrF,SAAS,eAAe;AAExB,OAAO,YAAY;AACnB,SAAS,cAAwC;AAKjD,IAAM,qBAAqB;AAE3B,IAAM,QAAQ,oBAAI,IAA2B;AAO7C,SAAS,wBAAwB,MAAwB;AAGvD,QAAM,QAAQ,CAAC,QAAQ,IAAI,UAAU,cAAc,QAAQ,IAAI,IAAI,MAAM;AAGzE,MAAI,SAAS,QAAQ;AACnB,WAAO,MAAM,OAAO,CAAC,MAAM,MAAM,YAAY;AAAA,EAC/C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAA6C;AAChE,MAAI;AACJ,MAAI;AACF,WAAO,SAAS,IAAI;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AAGA,MAAI,CAAC,KAAK,OAAO,KAAK,CAAC,KAAK,OAAO,EAAG,QAAO;AAG7C,MAAI,KAAK,OAAO,oBAAoB;AAClC,YAAQ;AAAA,MACN,0BAA0B,IAAI,YAAY,kBAAkB;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAKA,MAAI;AACJ,MAAI;AACF,SAAK,SAAS,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MAAI;AAEF,QAAI;AACF,UAAI,UAAU,IAAI,EAAE,eAAe,GAAG;AACpC,cAAM,OAAO,aAAa,IAAI;AAE9B,gBAAQ,KAAK,qBAAqB,IAAI,wBAAmB,IAAI,EAAE;AAAA,MACjE;AAAA,IACF,QAAQ;AAAA,IAER;AAEA,WAAO,OAAO,MAAM,aAAa,IAAI,OAAO,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,cAAU,EAAE;AAAA,EACd;AACF;AAGO,SAAS,QAAQ,UAA0B,CAAC,GAAkB;AACnE,QAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACvC,QAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI,YAAY;AACrD,QAAM,WAAW,GAAG,GAAG,IAAI,IAAI;AAE/B,MAAI,CAAC,QAAQ,aAAa;AACxB,UAAM,SAAS,MAAM,IAAI,QAAQ;AACjC,QAAI,OAAQ,QAAO;AAAA,EACrB;AAEA,QAAM,YAAY,wBAAwB,IAAI;AAC9C,QAAM,YAAY,UAAU,IAAI,CAAC,MAAM,QAAQ,KAAK,CAAC,CAAC;AAItD,QAAM,SAAiC,CAAC;AACxC,QAAM,kBAA4B,CAAC;AACnC,aAAW,QAAQ,CAAC,GAAG,SAAS,EAAE,QAAQ,GAAG;AAC3C,UAAM,SAAS,YAAY,IAAI;AAC/B,QAAI,WAAW,KAAM;AACrB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,aAAO,CAAC,IAAI;AAAA,IACd;AACA,oBAAgB,QAAQ,IAAI;AAAA,EAC9B;AAGA,MAAI,OAAO,YAAY,QAAQ,IAAI,4BAA4B,QAAW;AACxE,YAAQ,IAAI,0BAA0B,OAAO;AAAA,EAC/C;AACA,SAAO,OAAO;AAOd,QAAM,kBAAuC,CAAC;AAC9C,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAChD,QAAI,OAAO,MAAM,SAAU,iBAAgB,CAAC,IAAI;AAAA,EAClD;AACA,MAAI;AACF,WAAO,EAAE,QAAQ,QAAQ,YAAY,gBAAgB,CAAC;AAAA,EACxD,SAAS,KAAK;AACZ,QAAI,eAAe,YAAY;AAC7B,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM;AAAA,IACR;AAAA,EACF;AAGA,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,QAAI,QAAQ,IAAI,CAAC,MAAM,OAAW;AAClC,YAAQ,IAAI,CAAC,IAAI;AACjB,WAAO,CAAC,IAAI;AAAA,EACd;AAGA,UAAQ,IAAI,0BAA0B;AAEtC,QAAM,SAAwB,EAAE,QAAQ,gBAAgB;AACxD,QAAM,IAAI,UAAU,MAAM;AAC1B,SAAO;AACT;","names":[]}

package/dist/{chunk-47CINLWF.js → chunk-44J2ANQC.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   findControllerFiles
-} from "./chunk-T5C46IIU.js";
+} from "./chunk-HWBRS4DZ.js";
 
 // src/cli/commands/build/emit-controllers.ts
 import { mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -43,4 +43,4 @@ export {
   emitControllerArtifacts,
   describeControllerArtifacts
 };
-//# sourceMappingURL=chunk-47CINLWF.js.map
+//# sourceMappingURL=chunk-44J2ANQC.js.map

package/dist/{chunk-IEES3CHD.js → chunk-47MM2JUK.js}

@@ -93,7 +93,13 @@ function scanChild(parentDir, dirName, routePath) {
 function scanDir(dir, segment, routePath) {
   const node = { segment, path: routePath, children: [] };
   attachRouteFiles(node, dir);
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+  const entries = readdirSync(dir, { withFileTypes: true });
+  entries.sort((a, b) => {
+    if (a.name < b.name) return -1;
+    if (a.name > b.name) return 1;
+    return 0;
+  });
+  for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith("_") || entry.name.startsWith(".")) continue;
     const child = scanChild(dir, entry.name, routePath);
@@ -117,4 +123,4 @@ export {
   isRouteFile,
   scanRoutes
 };
-//# sourceMappingURL=chunk-IEES3CHD.js.map
+//# sourceMappingURL=chunk-47MM2JUK.js.map

package/dist/chunk-47MM2JUK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/router/scan.ts","../src/router/types.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time file-system scanner. All paths originate from `appDir`,\n * which is itself derived from `process.cwd()`. No HTTP input flows here.\n */\nimport { readdirSync, statSync, existsSync } from 'node:fs'\nimport { join, resolve } from 'node:path'\n\nimport type { RouteNode, RouteFileName } from './types.js'\nimport { ROUTE_FILE_NAMES, ROUTE_FILE_EXTENSIONS } from './types.js'\n\nfunction toNodeKey(name: RouteFileName): 'page' | 'layout' | 'error' | 'loading' | 'notFound' {\n  if (name === 'not-found') return 'notFound'\n  return name\n}\n\nfunction setRouteFile(\n  node: RouteNode,\n  key: 'page' | 'layout' | 'error' | 'loading' | 'notFound',\n  value: string,\n): void {\n  switch (key) {\n    case 'page':\n      node.page = value\n      break\n    case 'layout':\n      node.layout = value\n      break\n    case 'error':\n      node.error = value\n      break\n    case 'loading':\n      node.loading = value\n      break\n    case 'notFound':\n      node.notFound = value\n      break\n  }\n}\n\nfunction attachRouteFiles(node: RouteNode, dir: string): void {\n  // Check route files with extension priority (.tsx > .ts > .jsx > .js)\n  for (const name of ROUTE_FILE_NAMES) {\n    const key = toNodeKey(name)\n    if (node[key] !== undefined) continue\n    for (const ext of ROUTE_FILE_EXTENSIONS) {\n      const filename = `${name}${ext}`\n      if (existsSync(join(dir, filename))) {\n        setRouteFile(node, key, resolve(dir, filename))\n        break\n      }\n    }\n  }\n}\n\ninterface ParsedSegment {\n  kind: 'static' | 'dynamic' | 'catchall'\n  paramName?: string\n}\n\n/**\n * Classify a directory name as a static, dynamic (`[param]`), or catch-all\n * (`[...slug]`) route segment. Throws at build time on:\n *  - optional catch-all `[[...slug]]` (EC-4 — not supported yet; see plan Q3)\n *  - a param name outside `[A-Za-z0-9_]` (EC-5 — react-router would silently mis-match)\n * Order matters: catch-all is checked before single dynamic so `[...slug]` is\n * not misread as a dynamic param literally named `...slug`.\n */\nfunction parseSegment(name: string): ParsedSegment {\n  if (name.startsWith('[[')) {\n    throw new Error(\n      `Optional catch-all route segment is not supported yet: '${name}'. ` +\n        `Use '[...param]' for catch-all, or split into explicit segments.`,\n    )\n  }\n  const catchAll = /^\\[\\.\\.\\.(.+)\\]$/.exec(name)\n  if (catchAll) return checkedSegment('catchall', catchAll[1], name)\n  const dynamic = /^\\[(.+)\\]$/.exec(name)\n  if (dynamic) return checkedSegment('dynamic', dynamic[1], name)\n  return { kind: 'static' }\n}\n\nfunction checkedSegment(\n  kind: 'dynamic' | 'catchall',\n  paramName: string,\n  name: string,\n): ParsedSegment {\n  if (!/^\\w+$/.test(paramName)) {\n    throw new Error(\n      `Invalid route param '${paramName}' in segment '${name}' — ` +\n        `param names must match [A-Za-z0-9_] (react-router constraint).`,\n    )\n  }\n  return { kind, paramName }\n}\n\nfunction nodeHasContent(node: RouteNode): boolean {\n  return (\n    node.page !== undefined ||\n    node.layout !== undefined ||\n    node.error !== undefined ||\n    node.loading !== undefined ||\n    node.notFound !== undefined ||\n    node.children.length > 0\n  )\n}\n\nfunction buildChildPath(routePath: string, urlSegment: string): string {\n  if (!urlSegment) return routePath\n  return routePath === '/' ? `/${urlSegment}` : `${routePath}/${urlSegment}`\n}\n\n/** Scan one subdirectory into a child RouteNode, attaching dynamic-segment metadata. */\nfunction scanChild(parentDir: string, dirName: string, routePath: string): RouteNode {\n  const isRouteGroup = dirName.startsWith('(') && dirName.endsWith(')')\n  const urlSegment = isRouteGroup ? '' : dirName\n  const childPath = buildChildPath(routePath, urlSegment)\n  const child = scanDir(join(parentDir, dirName), isRouteGroup ? '' : dirName, childPath)\n\n  // Dynamic / catch-all segment metadata (throws on [[...]] or invalid charset).\n  if (!isRouteGroup) {\n    const parsed = parseSegment(dirName)\n    if (parsed.kind !== 'static' && parsed.paramName !== undefined) {\n      child.dynamic = { paramName: parsed.paramName, catchAll: parsed.kind === 'catchall' }\n    }\n  }\n  return child\n}\n\nfunction scanDir(dir: string, segment: string, routePath: string): RouteNode {\n  const node: RouteNode = { segment, path: routePath, children: [] }\n  attachRouteFiles(node, dir)\n\n  // Sorted by name so the manifest does not inherit the filesystem's iteration order.\n  // ext4 returns entries in filename-hash order, APFS and NTFS in others — an unsorted\n  // walk emits a different module graph per machine, which is what makes the client build\n  // non-reproducible (usetheokit/theokit#346).\n  //\n  // Compared by code unit rather than with `localeCompare`: collation is locale-dependent,\n  // so the same tree could sort differently under a different `LANG` — reintroducing the\n  // very cross-machine divergence this sort exists to remove.\n  const entries = readdirSync(dir, { withFileTypes: true })\n  entries.sort((a, b) => {\n    if (a.name < b.name) return -1\n    if (a.name > b.name) return 1\n    return 0\n  })\n\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue\n    if (entry.name.startsWith('_') || entry.name.startsWith('.')) continue\n\n    const child = scanChild(dir, entry.name, routePath)\n    // Prune empty nodes — a directory with no route files AND no children is\n    // irrelevant to the manifest.\n    if (nodeHasContent(child)) {\n      node.children.push(child)\n    }\n  }\n\n  return node\n}\n\nexport function scanRoutes(appDir: string): RouteNode {\n  if (!existsSync(appDir)) {\n    throw new Error(`App directory does not exist: ${appDir}`)\n  }\n  if (!statSync(appDir).isDirectory()) {\n    throw new Error(`App path is not a directory: ${appDir}`)\n  }\n  return scanDir(appDir, '', '/')\n}\n","// T2.2 (architecture-cleanup) — RouteNode moved to core/contracts/route-node.ts\n// (canonical home per ADR-0001 v3). Re-export keeps the local path stable.\nexport type { RouteNode } from '../core/contracts/route-node.js'\n\nexport const ROUTE_FILE_NAMES = ['page', 'layout', 'error', 'loading', 'not-found'] as const\n\nexport type RouteFileName = (typeof ROUTE_FILE_NAMES)[number]\n\nexport const ROUTE_FILE_EXTENSIONS = ['.tsx', '.ts', '.jsx', '.js'] as const\n\nconst ROUTE_FILE_REGEX = /^(page|layout|error|loading|not-found)\\.(tsx|ts|jsx|js)$/\n\nexport function isRouteFile(filename: string): boolean {\n  return ROUTE_FILE_REGEX.test(filename)\n}\n"],"mappings":";;;;AAIA,SAAS,aAAa,UAAU,kBAAkB;AAClD,SAAS,MAAM,eAAe;;;ACDvB,IAAM,mBAAmB,CAAC,QAAQ,UAAU,SAAS,WAAW,WAAW;AAI3E,IAAM,wBAAwB,CAAC,QAAQ,OAAO,QAAQ,KAAK;AAElE,IAAM,mBAAmB;AAElB,SAAS,YAAY,UAA2B;AACrD,SAAO,iBAAiB,KAAK,QAAQ;AACvC;;;ADJA,SAAS,UAAU,MAA2E;AAC5F,MAAI,SAAS,YAAa,QAAO;AACjC,SAAO;AACT;AAEA,SAAS,aACP,MACA,KACA,OACM;AACN,UAAQ,KAAK;AAAA,IACX,KAAK;AACH,WAAK,OAAO;AACZ;AAAA,IACF,KAAK;AACH,WAAK,SAAS;AACd;AAAA,IACF,KAAK;AACH,WAAK,QAAQ;AACb;AAAA,IACF,KAAK;AACH,WAAK,UAAU;AACf;AAAA,IACF,KAAK;AACH,WAAK,WAAW;AAChB;AAAA,EACJ;AACF;AAEA,SAAS,iBAAiB,MAAiB,KAAmB;AAE5D,aAAW,QAAQ,kBAAkB;AACnC,UAAM,MAAM,UAAU,IAAI;AAC1B,QAAI,KAAK,GAAG,MAAM,OAAW;AAC7B,eAAW,OAAO,uBAAuB;AACvC,YAAM,WAAW,GAAG,IAAI,GAAG,GAAG;AAC9B,UAAI,WAAW,KAAK,KAAK,QAAQ,CAAC,GAAG;AACnC,qBAAa,MAAM,KAAK,QAAQ,KAAK,QAAQ,CAAC;AAC9C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAeA,SAAS,aAAa,MAA6B;AACjD,MAAI,KAAK,WAAW,IAAI,GAAG;AACzB,UAAM,IAAI;AAAA,MACR,2DAA2D,IAAI;AAAA,IAEjE;AAAA,EACF;AACA,QAAM,WAAW,mBAAmB,KAAK,IAAI;AAC7C,MAAI,SAAU,QAAO,eAAe,YAAY,SAAS,CAAC,GAAG,IAAI;AACjE,QAAM,UAAU,aAAa,KAAK,IAAI;AACtC,MAAI,QAAS,QAAO,eAAe,WAAW,QAAQ,CAAC,GAAG,IAAI;AAC9D,SAAO,EAAE,MAAM,SAAS;AAC1B;AAEA,SAAS,eACP,MACA,WACA,MACe;AACf,MAAI,CAAC,QAAQ,KAAK,SAAS,GAAG;AAC5B,UAAM,IAAI;AAAA,MACR,wBAAwB,SAAS,iBAAiB,IAAI;AAAA,IAExD;AAAA,EACF;AACA,SAAO,EAAE,MAAM,UAAU;AAC3B;AAEA,SAAS,eAAe,MAA0B;AAChD,SACE,KAAK,SAAS,UACd,KAAK,WAAW,UAChB,KAAK,UAAU,UACf,KAAK,YAAY,UACjB,KAAK,aAAa,UAClB,KAAK,SAAS,SAAS;AAE3B;AAEA,SAAS,eAAe,WAAmB,YAA4B;AACrE,MAAI,CAAC,WAAY,QAAO;AACxB,SAAO,cAAc,MAAM,IAAI,UAAU,KAAK,GAAG,SAAS,IAAI,UAAU;AAC1E;AAGA,SAAS,UAAU,WAAmB,SAAiB,WAA8B;AACnF,QAAM,eAAe,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG;AACpE,QAAM,aAAa,eAAe,KAAK;AACvC,QAAM,YAAY,eAAe,WAAW,UAAU;AACtD,QAAM,QAAQ,QAAQ,KAAK,WAAW,OAAO,GAAG,eAAe,KAAK,SAAS,SAAS;AAGtF,MAAI,CAAC,cAAc;AACjB,UAAM,SAAS,aAAa,OAAO;AACnC,QAAI,OAAO,SAAS,YAAY,OAAO,cAAc,QAAW;AAC9D,YAAM,UAAU,EAAE,WAAW,OAAO,WAAW,UAAU,OAAO,SAAS,WAAW;AAAA,IACtF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,KAAa,SAAiB,WAA8B;AAC3E,QAAM,OAAkB,EAAE,SAAS,MAAM,WAAW,UAAU,CAAC,EAAE;AACjE,mBAAiB,MAAM,GAAG;AAU1B,QAAM,UAAU,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AACxD,UAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,WAAO;AAAA,EACT,CAAC;AAED,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,QAAI,MAAM,KAAK,WAAW,GAAG,KAAK,MAAM,KAAK,WAAW,GAAG,EAAG;AAE9D,UAAM,QAAQ,UAAU,KAAK,MAAM,MAAM,SAAS;AAGlD,QAAI,eAAe,KAAK,GAAG;AACzB,WAAK,SAAS,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,WAAW,QAA2B;AACpD,MAAI,CAAC,WAAW,MAAM,GAAG;AACvB,UAAM,IAAI,MAAM,iCAAiC,MAAM,EAAE;AAAA,EAC3D;AACA,MAAI,CAAC,SAAS,MAAM,EAAE,YAAY,GAAG;AACnC,UAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AAAA,EAC1D;AACA,SAAO,QAAQ,QAAQ,IAAI,GAAG;AAChC;","names":[]}

package/dist/chunk-4X6H2BXP.js

@@ -0,0 +1,108 @@
+// src/config/load-env.ts
+import { closeSync, lstatSync, openSync, readFileSync, realpathSync, statSync } from "fs";
+import { resolve } from "path";
+import dotenv from "dotenv";
+import { expand } from "dotenv-expand";
+var MAX_ENV_FILE_BYTES = 1048576;
+var cache = /* @__PURE__ */ new Map();
+function _resetEnvCache() {
+  cache.clear();
+}
+function envFilesInPriorityOrder(mode) {
+  const files = [`.env.${mode}.local`, `.env.local`, `.env.${mode}`, `.env`];
+  if (mode === "test") {
+    return files.filter((f) => f !== ".env.local");
+  }
+  return files;
+}
+function readEnvFile(path) {
+  let stat;
+  try {
+    stat = statSync(path);
+  } catch {
+    return null;
+  }
+  if (!stat.isFile() && !stat.isFIFO()) return null;
+  if (stat.size > MAX_ENV_FILE_BYTES) {
+    console.warn(
+      `[theokit] .env file at ${path} exceeds ${MAX_ENV_FILE_BYTES} bytes \u2014 skipping (likely a generated artifact, not a real env file)`
+    );
+    return null;
+  }
+  let fd;
+  try {
+    fd = openSync(path, "r");
+  } catch {
+    return null;
+  }
+  try {
+    try {
+      if (lstatSync(path).isSymbolicLink()) {
+        const real = realpathSync(path);
+        console.info(`[theokit] .env at ${path} is a symlink \u2192 ${real}`);
+      }
+    } catch {
+    }
+    return dotenv.parse(readFileSync(fd, "utf-8"));
+  } catch {
+    return null;
+  } finally {
+    closeSync(fd);
+  }
+}
+function loadEnv(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const mode = options.mode ?? process.env.NODE_ENV ?? "development";
+  const cacheKey = `${cwd}:${mode}`;
+  if (!options.forceReload) {
+    const cached = cache.get(cacheKey);
+    if (cached) return cached;
+  }
+  const fileNames = envFilesInPriorityOrder(mode);
+  const filePaths = fileNames.map((f) => resolve(cwd, f));
+  const merged = {};
+  const loadedFromFiles = [];
+  for (const path of [...filePaths].reverse()) {
+    const parsed = readEnvFile(path);
+    if (parsed === null) continue;
+    for (const [k, v] of Object.entries(parsed)) {
+      merged[k] = v;
+    }
+    loadedFromFiles.unshift(path);
+  }
+  if (merged.NODE_ENV && process.env.__THEOKIT_USER_NODE_ENV === void 0) {
+    process.env.__THEOKIT_USER_NODE_ENV = merged.NODE_ENV;
+  }
+  delete merged.NODE_ENV;
+  const processEnvClone = {};
+  for (const [k, v] of Object.entries(process.env)) {
+    if (typeof v === "string") processEnvClone[k] = v;
+  }
+  try {
+    expand({ parsed: merged, processEnv: processEnvClone });
+  } catch (err) {
+    if (err instanceof RangeError) {
+      console.warn(
+        `[theokit] .env expansion overflow (likely circular reference like A=\${B}, B=\${A}). Leaving values as literals.`
+      );
+    } else {
+      throw err;
+    }
+  }
+  const loaded = {};
+  for (const [k, v] of Object.entries(merged)) {
+    if (process.env[k] !== void 0) continue;
+    process.env[k] = v;
+    loaded[k] = v;
+  }
+  process.env.__THEOKIT_PROCESSED_ENV = "true";
+  const result = { loaded, loadedFromFiles };
+  cache.set(cacheKey, result);
+  return result;
+}
+
+export {
+  _resetEnvCache,
+  loadEnv
+};
+//# sourceMappingURL=chunk-4X6H2BXP.js.map

package/dist/chunk-4X6H2BXP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/load-env.ts"],"mappings":";AAoBA,SAAS,WAAW,WAAW,UAAU,cAAc,cAAc,gBAAgB;AACrF,SAAS,eAAe;AAExB,OAAO,YAAY;AACnB,SAAS,cAAwC;AAKjD,IAAM,qBAAqB;AAE3B,IAAM,QAAQ,oBAAI,IAA2B;AAGtC,SAAS,iBAAuB;AACrC,QAAM,MAAM;AACd;AAEA,SAAS,wBAAwB,MAAwB;AAGvD,QAAM,QAAQ,CAAC,QAAQ,IAAI,UAAU,cAAc,QAAQ,IAAI,IAAI,MAAM;AAGzE,MAAI,SAAS,QAAQ;AACnB,WAAO,MAAM,OAAO,CAAC,MAAM,MAAM,YAAY;AAAA,EAC/C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAA6C;AAChE,MAAI;AACJ,MAAI;AACF,WAAO,SAAS,IAAI;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AAGA,MAAI,CAAC,KAAK,OAAO,KAAK,CAAC,KAAK,OAAO,EAAG,QAAO;AAG7C,MAAI,KAAK,OAAO,oBAAoB;AAClC,YAAQ;AAAA,MACN,0BAA0B,IAAI,YAAY,kBAAkB;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAKA,MAAI;AACJ,MAAI;AACF,SAAK,SAAS,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MAAI;AAEF,QAAI;AACF,UAAI,UAAU,IAAI,EAAE,eAAe,GAAG;AACpC,cAAM,OAAO,aAAa,IAAI;AAE9B,gBAAQ,KAAK,qBAAqB,IAAI,wBAAmB,IAAI,EAAE;AAAA,MACjE;AAAA,IACF,QAAQ;AAAA,IAER;AAEA,WAAO,OAAO,MAAM,aAAa,IAAI,OAAO,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,cAAU,EAAE;AAAA,EACd;AACF;AAGO,SAAS,QAAQ,UAA0B,CAAC,GAAkB;AACnE,QAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACvC,QAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI,YAAY;AACrD,QAAM,WAAW,GAAG,GAAG,IAAI,IAAI;AAE/B,MAAI,CAAC,QAAQ,aAAa;AACxB,UAAM,SAAS,MAAM,IAAI,QAAQ;AACjC,QAAI,OAAQ,QAAO;AAAA,EACrB;AAEA,QAAM,YAAY,wBAAwB,IAAI;AAC9C,QAAM,YAAY,UAAU,IAAI,CAAC,MAAM,QAAQ,KAAK,CAAC,CAAC;AAItD,QAAM,SAAiC,CAAC;AACxC,QAAM,kBAA4B,CAAC;AACnC,aAAW,QAAQ,CAAC,GAAG,SAAS,EAAE,QAAQ,GAAG;AAC3C,UAAM,SAAS,YAAY,IAAI;AAC/B,QAAI,WAAW,KAAM;AACrB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,aAAO,CAAC,IAAI;AAAA,IACd;AACA,oBAAgB,QAAQ,IAAI;AAAA,EAC9B;AAGA,MAAI,OAAO,YAAY,QAAQ,IAAI,4BAA4B,QAAW;AACxE,YAAQ,IAAI,0BAA0B,OAAO;AAAA,EAC/C;AACA,SAAO,OAAO;AAOd,QAAM,kBAAuC,CAAC;AAC9C,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAChD,QAAI,OAAO,MAAM,SAAU,iBAAgB,CAAC,IAAI;AAAA,EAClD;AACA,MAAI;AACF,WAAO,EAAE,QAAQ,QAAQ,YAAY,gBAAgB,CAAC;AAAA,EACxD,SAAS,KAAK;AACZ,QAAI,eAAe,YAAY;AAC7B,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM;AAAA,IACR;AAAA,EACF;AAGA,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,QAAI,QAAQ,IAAI,CAAC,MAAM,OAAW;AAClC,YAAQ,IAAI,CAAC,IAAI;AACjB,WAAO,CAAC,IAAI;AAAA,EACd;AAGA,UAAQ,IAAI,0BAA0B;AAEtC,QAAM,SAAwB,EAAE,QAAQ,gBAAgB;AACxD,QAAM,IAAI,UAAU,MAAM;AAC1B,SAAO;AACT;","names":[]}

package/dist/{chunk-A7JBF5FO.js → chunk-5K4TDLRG.js}

@@ -1,19 +1,22 @@
-#!/usr/bin/env node
-import "tsx/esm";
+import {
+  compareByCodeUnit
+} from "./chunk-ZWN3AODA.js";
 
 // src/server/_internal/scan-walker.ts
 import { readdirSync } from "fs";
 import { extname, join, resolve } from "path";
 function walkSourceFiles(root, opts, onFile) {
   const skipPrefixes = opts.skipPrefixes ?? ["_", "."];
+  const readDir = opts.readDir ?? ((dir) => readdirSync(dir, { withFileTypes: true }));
   const visit = (dir) => {
     let entries;
     try {
-      entries = readdirSync(dir, { withFileTypes: true });
+      entries = readDir(dir);
     } catch {
       return;
     }
-    for (const entry of entries) {
+    const ordered = [...entries].sort((a, b) => compareByCodeUnit(a.name, b.name));
+    for (const entry of ordered) {
       const fullPath = join(dir, entry.name);
       if (entry.isDirectory() && !skipPrefixes.some((p) => entry.name.startsWith(p))) {
         visit(fullPath);
@@ -28,4 +31,4 @@ function walkSourceFiles(root, opts, onFile) {
 export {
   walkSourceFiles
 };
-//# sourceMappingURL=chunk-A7JBF5FO.js.map
+//# sourceMappingURL=chunk-5K4TDLRG.js.map

package/dist/chunk-5K4TDLRG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/_internal/scan-walker.ts"],"mappings":";;;;;AAIA,SAAS,mBAAmB;AAE5B,SAAS,SAAS,MAAM,eAAe;AAoDhC,SAAS,gBACd,MACA,MACA,QACM;AACN,QAAM,eAAe,KAAK,gBAAgB,CAAC,KAAK,GAAG;AACnD,QAAM,UAAU,KAAK,YAAY,CAAC,QAAgB,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AAC1F,QAAM,QAAQ,CAAC,QAAsB;AACnC,QAAI;AACJ,QAAI;AACF,gBAAU,QAAQ,GAAG;AAAA,IACvB,QAAQ;AAEN;AAAA,IACF;AAKA,UAAM,UAAU,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC;AAC7E,eAAW,SAAS,SAAS;AAC3B,YAAM,WAAW,KAAK,KAAK,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,KAAK,CAAC,aAAa,KAAK,CAAC,MAAM,MAAM,KAAK,WAAW,CAAC,CAAC,GAAG;AAC9E,cAAM,QAAQ;AAAA,MAChB,WAAW,MAAM,OAAO,KAAK,KAAK,WAAW,IAAI,QAAQ,MAAM,IAAI,CAAC,GAAG;AACrE,eAAO,QAAQ,QAAQ,CAAC;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AACA,QAAM,IAAI;AACZ;","names":[]}

package/dist/chunk-5YPXXSYY.js

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/server/_internal/process-singleton.ts
+var NAMESPACE = "theokit.singleton.";
+function processSingleton(key, factory) {
+  const slot = /* @__PURE__ */ Symbol.for(NAMESPACE + key);
+  const host = globalThis;
+  const existing = host[slot];
+  if (existing !== void 0) return existing;
+  const created = factory();
+  host[slot] = created;
+  return created;
+}
+
+// src/server/agent/provider-resolver.ts
+var DEFAULT_REGISTRY = [
+  {
+    name: "openrouter",
+    envKey: "OPENROUTER_API_KEY",
+    baseUrl: "https://openrouter.ai/api/v1",
+    priority: 1
+  },
+  {
+    name: "openai",
+    envKey: "OPENAI_API_KEY",
+    baseUrl: "https://api.openai.com/v1",
+    priority: 2
+  },
+  {
+    name: "anthropic",
+    envKey: "ANTHROPIC_API_KEY",
+    baseUrl: "https://api.anthropic.com",
+    priority: 3
+  },
+  {
+    // Mirrors the profile `@theokit/sdk` already ships for this provider — same default host, same
+    // override variable — so the two cannot disagree about where ollama is listening. The SDK is
+    // what dials it (see `baseUrlEnv`); this entry's job is to stop the resolver from rejecting the
+    // model before the SDK is ever reached. No `envKey`: see that field's doc comment for why the
+    // absence also keeps this entry out of the priority walk.
+    name: "ollama",
+    baseUrl: "http://localhost:11434",
+    baseUrlEnv: "OLLAMA_HOST",
+    priority: 100
+  }
+];
+function registryOf() {
+  return processSingleton("provider-registry", () => [...DEFAULT_REGISTRY]);
+}
+var announced = /* @__PURE__ */ new Set();
+function announce(desc, how, options) {
+  if (announced.has(desc.name)) return;
+  announced.add(desc.name);
+  const source = desc.envKey ?? "none (this provider takes no credential)";
+  const line = `[theokit] provider=${desc.name} (${how}) source=${source} baseUrl=${baseUrlOf(desc)}`;
+  if (options?.announce) options.announce(line);
+  else console.warn(line);
+}
+function baseUrlOf(desc) {
+  if (desc.baseUrlEnv === void 0) return desc.baseUrl;
+  const override = process.env[desc.baseUrlEnv];
+  return override !== void 0 && override.length > 0 ? override : desc.baseUrl;
+}
+function providerOf(modelId, registered) {
+  const prefix = declaredPrefixOf(modelId);
+  if (prefix === void 0) return void 0;
+  return registered.find((p) => p.name === prefix);
+}
+function declaredPrefixOf(modelId) {
+  if (modelId === void 0) return void 0;
+  const slash = modelId.indexOf("/");
+  if (slash <= 0) return void 0;
+  return modelId.slice(0, slash);
+}
+function takesCredential(desc) {
+  return desc.envKey !== void 0;
+}
+function resolveProvider(modelId, options) {
+  const sorted = [...registryOf()].sort((a, b) => a.priority - b.priority);
+  const declared = modelId === void 0 ? void 0 : providerOf(modelId, sorted);
+  if (declared !== void 0 && modelId !== void 0) {
+    if (declared.envKey === void 0) {
+      announce(declared, "declared by the model", options);
+      return { name: declared.name, apiKey: "", baseUrl: baseUrlOf(declared) };
+    }
+    const apiKey = process.env[declared.envKey];
+    if (apiKey && apiKey.length > 0) {
+      announce(declared, "declared by the model", options);
+      return { name: declared.name, apiKey, baseUrl: baseUrlOf(declared) };
+    }
+    throw new Error(
+      `Model "${modelId}" declares provider "${declared.name}", but ${declared.envKey} is not set. Set ${declared.envKey}, or change the model's provider prefix.`
+    );
+  }
+  const credentialed = sorted.filter(takesCredential);
+  for (const desc of credentialed) {
+    const apiKey = process.env[desc.envKey];
+    if (apiKey && apiKey.length > 0) {
+      announce(desc, "by env priority", options);
+      return {
+        name: desc.name,
+        apiKey,
+        baseUrl: baseUrlOf(desc)
+      };
+    }
+  }
+  const prefix = declaredPrefixOf(modelId);
+  if (prefix !== void 0) {
+    throw new Error(
+      `Model "${modelId}" declares provider "${prefix}", which is not registered. Registered providers: ${sorted.map((p) => p.name).join(", ")}. Register it with registerProvider({ name: '${prefix}', \u2026 }), or use a registered prefix.`
+    );
+  }
+  const envKeys = credentialed.map((p) => p.envKey).join(" OR ");
+  throw new Error(
+    `No LLM provider API key found in environment. Set one of: ${envKeys}. Get a free OpenRouter key at https://openrouter.ai/keys (recommended \u2014 one key, many models).`
+  );
+}
+
+// src/server/agent/approval-registry.ts
+function getApprovalRegistry() {
+  return processSingleton("approval-registry", () => createInProcessApprovalRegistry());
+}
+function createInProcessApprovalRegistry() {
+  const pending = /* @__PURE__ */ new Map();
+  return {
+    register(approvalId, opts) {
+      return new Promise((resolve) => {
+        const settle = (decision) => {
+          const entry = pending.get(approvalId);
+          if (!entry) return;
+          clearTimeout(entry.timer);
+          pending.delete(approvalId);
+          resolve(decision);
+        };
+        const timer = setTimeout(() => {
+          settle({
+            approved: opts.onTimeout === "proceed",
+            settledBy: "timeout",
+            // Every value in this sentence was already here and none of it used to survive the
+            // settle. `onTimeout` is named because all three of its values reach this line and two
+            // of them deny — an operator who wrote `'retry'` and got a denial had nothing to read
+            // that mentioned retry.
+            reason: `no decision within ${String(opts.timeoutMs)} ms; onTimeout: '${opts.onTimeout}' was applied`
+          });
+        }, opts.timeoutMs);
+        const info = {
+          approvalId,
+          toolName: opts.toolName,
+          question: opts.question,
+          expiresAt: Date.now() + opts.timeoutMs,
+          ...opts.payloadSchema !== void 0 ? { payloadSchema: opts.payloadSchema } : {}
+        };
+        pending.set(approvalId, {
+          settle,
+          timer,
+          info,
+          ...opts.owner !== void 0 ? { owner: opts.owner } : {}
+        });
+      });
+    },
+    resolve(approvalId, decision) {
+      const entry = pending.get(approvalId);
+      if (!entry) return false;
+      entry.settle(typeof decision === "boolean" ? { approved: decision } : decision);
+      return true;
+    },
+    list() {
+      return [...pending.values()].map((p) => p.info);
+    },
+    ownerOf(approvalId) {
+      return pending.get(approvalId)?.owner;
+    }
+  };
+}
+
+export {
+  getApprovalRegistry,
+  resolveProvider
+};
+//# sourceMappingURL=chunk-5YPXXSYY.js.map