theokit 0.48.14 → 0.50.0

package/dist/chunk-AXKUA57G.js

@@ -1,94 +0,0 @@
-// src/server/agent/provider-resolver.ts
-var DEFAULT_REGISTRY = [
-  {
-    name: "openrouter",
-    envKey: "OPENROUTER_API_KEY",
-    baseUrl: "https://openrouter.ai/api/v1",
-    priority: 1
-  },
-  {
-    name: "openai",
-    envKey: "OPENAI_API_KEY",
-    baseUrl: "https://api.openai.com/v1",
-    priority: 2
-  },
-  {
-    name: "anthropic",
-    envKey: "ANTHROPIC_API_KEY",
-    baseUrl: "https://api.anthropic.com",
-    priority: 3
-  }
-];
-var registry = [...DEFAULT_REGISTRY];
-var announced = /* @__PURE__ */ new Set();
-function registerProvider(descriptor) {
-  const idx = registry.findIndex((p) => p.name === descriptor.name);
-  if (idx >= 0) registry[idx] = descriptor;
-  else registry.push(descriptor);
-}
-function resetProviderRegistry() {
-  registry.length = 0;
-  registry.push(...DEFAULT_REGISTRY);
-}
-function listProviders() {
-  return [...registry].sort((a, b) => a.priority - b.priority);
-}
-function announce(desc, how, options) {
-  if (announced.has(desc.name)) return;
-  announced.add(desc.name);
-  const line = `[theokit] provider=${desc.name} (${how}) source=${desc.envKey} baseUrl=${desc.baseUrl}`;
-  if (options?.announce) options.announce(line);
-  else console.warn(line);
-}
-function providerOf(modelId, registered) {
-  if (modelId === void 0) return void 0;
-  const slash = modelId.indexOf("/");
-  if (slash <= 0) return void 0;
-  const prefix = modelId.slice(0, slash);
-  return registered.find((p) => p.name === prefix);
-}
-function resolveProvider(modelId, options) {
-  const sorted = [...registry].sort((a, b) => a.priority - b.priority);
-  const declared = modelId === void 0 ? void 0 : providerOf(modelId, sorted);
-  if (declared !== void 0 && modelId !== void 0) {
-    const apiKey = process.env[declared.envKey];
-    if (apiKey && apiKey.length > 0) {
-      announce(declared, "declared by the model", options);
-      return { name: declared.name, apiKey, baseUrl: declared.baseUrl };
-    }
-    throw new Error(
-      `Model "${modelId}" declares provider "${declared.name}", but ${declared.envKey} is not set. Set ${declared.envKey}, or change the model's provider prefix.`
-    );
-  }
-  for (const desc of sorted) {
-    const apiKey = process.env[desc.envKey];
-    if (apiKey && apiKey.length > 0) {
-      announce(desc, "by env priority", options);
-      return {
-        name: desc.name,
-        apiKey,
-        baseUrl: desc.baseUrl
-      };
-    }
-  }
-  const envKeys = sorted.map((p) => p.envKey).join(" OR ");
-  throw new Error(
-    `No LLM provider API key found in environment. Set one of: ${envKeys}. Get a free OpenRouter key at https://openrouter.ai/keys (recommended \u2014 one key, many models).`
-  );
-}
-function tryResolveProvider(modelId) {
-  try {
-    return resolveProvider(modelId);
-  } catch {
-    return null;
-  }
-}
-
-export {
-  registerProvider,
-  resetProviderRegistry,
-  listProviders,
-  resolveProvider,
-  tryResolveProvider
-};
-//# sourceMappingURL=chunk-AXKUA57G.js.map

package/dist/chunk-AXKUA57G.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/agent/provider-resolver.ts"],"mappings":";AAgEA,IAAM,mBAAyC;AAAA,EAC7C;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AACF;AAMA,IAAM,WAAiC,CAAC,GAAG,gBAAgB;AAU3D,IAAM,YAAY,oBAAI,IAAY;AA2B3B,SAAS,iBAAiB,YAAsC;AAErE,QAAM,MAAM,SAAS,UAAU,CAAC,MAAM,EAAE,SAAS,WAAW,IAAI;AAChE,MAAI,OAAO,EAAG,UAAS,GAAG,IAAI;AAAA,MACzB,UAAS,KAAK,UAAU;AAC/B;AAOO,SAAS,wBAA8B;AAC5C,WAAS,SAAS;AAClB,WAAS,KAAK,GAAG,gBAAgB;AACnC;AAOO,SAAS,gBAA+C;AAC7D,SAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AAC7D;AASA,SAAS,SACP,MACA,KACA,SACM;AACN,MAAI,UAAU,IAAI,KAAK,IAAI,EAAG;AAC9B,YAAU,IAAI,KAAK,IAAI;AACvB,QAAM,OAAO,sBAAsB,KAAK,IAAI,KAAK,GAAG,YAAY,KAAK,MAAM,YAAY,KAAK,OAAO;AACnG,MAAI,SAAS,SAAU,SAAQ,SAAS,IAAI;AAAA,MAIvC,SAAQ,KAAK,IAAI;AACxB;AAaA,SAAS,WACP,SACA,YACgC;AAChC,MAAI,YAAY,OAAW,QAAO;AAClC,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,SAAS,EAAG,QAAO;AACvB,QAAM,SAAS,QAAQ,MAAM,GAAG,KAAK;AACrC,SAAO,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM;AACjD;AAaO,SAAS,gBAAgB,SAAkB,SAA4C;AAC5F,QAAM,SAAS,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AAEnE,QAAM,WAAW,YAAY,SAAY,SAAY,WAAW,SAAS,MAAM;AAC/E,MAAI,aAAa,UAAa,YAAY,QAAW;AACnD,UAAM,SAAS,QAAQ,IAAI,SAAS,MAAM;AAC1C,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,UAAU,yBAAyB,OAAO;AACnD,aAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,SAAS,SAAS,QAAQ;AAAA,IAClE;AAIA,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,wBAAwB,SAAS,IAAI,UAAU,SAAS,MAAM,oBACtE,SAAS,MAAM;AAAA,IAC1B;AAAA,EACF;AAEA,aAAW,QAAQ,QAAQ;AACzB,UAAM,SAAS,QAAQ,IAAI,KAAK,MAAM;AACtC,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,MAAM,mBAAmB,OAAO;AACzC,aAAO;AAAA,QACL,MAAM,KAAK;AAAA,QACX;AAAA,QACA,SAAS,KAAK;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,MAAM;AACvD,QAAM,IAAI;AAAA,IACR,6DAA6D,OAAO;AAAA,EAEtE;AACF;AAQO,SAAS,mBAAmB,SAA2C;AAC5E,MAAI;AACF,WAAO,gBAAgB,OAAO;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/chunk-BHOTGS7N.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/adapters/node.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Node deploy adapter — derives all write paths from the trusted `cwd`\n * (CLI argument). The `.theokit/docker-compose.yml` + `.theokit/Caddyfile`\n * outputs use a fixed sub-path. Build-time tool — no HTTP input.\n */\nimport { writeFileSync } from 'node:fs'\nimport { join } from 'node:path'\n\nimport { build as viteBuild } from 'vite'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport { generateCaddyfile, generateComposeYaml, readManifest } from '../services/index.js'\n\nimport type { AdapterBuildContext, DeployAdapter } from './types.js'\n\nexport const nodeAdapter: DeployAdapter = {\n  name: 'node',\n\n  async build(config: TheoConfig, cwd: string, ctx?: AdapterBuildContext): Promise<void> {\n    // T1.1 (architecture-cleanup) — Vite plugin composition is INJECTED via `ctx.makeVitePlugins`.\n    // The CLI (which already imports both `adapters/*` and `vite-plugin/*`) composes the\n    // Plugin[] and passes it in, eliminating the previous `adapters → vite-plugin` edge\n    // (CRITICAL layering inversion per ADR-0001 v2; fixed by ADR-0001 v3).\n    if (!ctx?.makeVitePlugins) {\n      throw new Error(\n        '[adapter-node] build requires ctx.makeVitePlugins (CLI must inject the Vite plugin factory). ' +\n          'This is a framework-internal invariant — see ADR-0001 v3.',\n      )\n    }\n\n    // Client build — `await` per ADR-0001 v3.1: makeVitePlugins may return\n    // a Promise (theokit build uses theoPluginAsync to wire the full chain\n    // including @theo/actions virtual module).\n    await viteBuild({\n      root: cwd,\n      plugins: await ctx.makeVitePlugins({ root: cwd, ssr: config.ssr }),\n      build: {\n        outDir: '.theokit/client',\n        emptyOutDir: true,\n      },\n      logLevel: 'info',\n    })\n\n    // SSR build (only when ssr: true)\n    if (config.ssr) {\n      // eslint-disable-next-line no-console -- CLI build progress\n      console.log('\\n  Building SSR...\\n')\n      await viteBuild({\n        root: cwd,\n        plugins: await ctx.makeVitePlugins({ root: cwd, ssr: true }),\n        build: {\n          ssr: true,\n          outDir: '.theokit/server',\n          emptyOutDir: true,\n          rollupOptions: {\n            input: '/@theo/entry-server',\n          },\n        },\n        logLevel: 'info',\n      })\n    }\n\n    // Wave 2 (T2.1) — when polyglot services are declared, emit a\n    // TheoCloud-shaped docker-compose harness + Caddyfile (with W3C\n    // traceparent propagation via Caddy 2.11+ `tracing` directive).\n    // Empty manifest → no emission (Wave 1 BC preserved).\n    const manifest = readManifest(cwd)\n    if (manifest && manifest.services.length > 0) {\n      const yaml = generateComposeYaml(manifest, { webPort: config.port })\n      const caddyfile = generateCaddyfile(manifest, {\n        port: config.port,\n        webHost: 'web',\n      })\n      writeFileSync(join(cwd, '.theokit', 'docker-compose.yml'), yaml)\n      writeFileSync(join(cwd, '.theokit', 'Caddyfile'), caddyfile)\n      // eslint-disable-next-line no-console -- CLI build progress\n      console.log(\n        `  ✓ TheoCloud-shaped harness: .theokit/docker-compose.yml + .theokit/Caddyfile ` +\n          `(${String(manifest.services.length)} service(s))`,\n      )\n    }\n  },\n}\n"],"mappings":";;;;;;;;;AAKA,SAAS,qBAAqB;AAC9B,SAAS,YAAY;AAErB,SAAS,SAAS,iBAAiB;AAO5B,IAAM,cAA6B;AAAA,EACxC,MAAM;AAAA,EAEN,MAAM,MAAM,QAAoB,KAAa,KAA0C;AAKrF,QAAI,CAAC,KAAK,iBAAiB;AACzB,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAKA,UAAM,UAAU;AAAA,MACd,MAAM;AAAA,MACN,SAAS,MAAM,IAAI,gBAAgB,EAAE,MAAM,KAAK,KAAK,OAAO,IAAI,CAAC;AAAA,MACjE,OAAO;AAAA,QACL,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,UAAU;AAAA,IACZ,CAAC;AAGD,QAAI,OAAO,KAAK;AAEd,cAAQ,IAAI,uBAAuB;AACnC,YAAM,UAAU;AAAA,QACd,MAAM;AAAA,QACN,SAAS,MAAM,IAAI,gBAAgB,EAAE,MAAM,KAAK,KAAK,KAAK,CAAC;AAAA,QAC3D,OAAO;AAAA,UACL,KAAK;AAAA,UACL,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,eAAe;AAAA,YACb,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAMA,UAAM,WAAW,aAAa,GAAG;AACjC,QAAI,YAAY,SAAS,SAAS,SAAS,GAAG;AAC5C,YAAM,OAAO,oBAAoB,UAAU,EAAE,SAAS,OAAO,KAAK,CAAC;AACnE,YAAM,YAAY,kBAAkB,UAAU;AAAA,QAC5C,MAAM,OAAO;AAAA,QACb,SAAS;AAAA,MACX,CAAC;AACD,oBAAc,KAAK,KAAK,YAAY,oBAAoB,GAAG,IAAI;AAC/D,oBAAc,KAAK,KAAK,YAAY,WAAW,GAAG,SAAS;AAE3D,cAAQ;AAAA,QACN,wFACM,OAAO,SAAS,SAAS,MAAM,CAAC;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-BMHS4WAN.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/scan/action-scan.ts","../src/server/scan/match.ts","../src/core/contracts/http-methods.ts","../src/server/scan/scan.ts","../src/server/scan/detect-http-methods.ts","../src/server/scan/errors.ts","../src/server/scan/ws-scan.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks `serverDir/actions/` derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { existsSync, readFileSync, statSync } from 'node:fs'\nimport { extname, join, relative } from 'node:path'\n\nimport { walkSourceFiles } from '../_internal/scan-walker.js'\n\nexport interface ActionNode {\n  filePath: string\n  actionPath: string\n}\n\n/**\n * Enriched manifest entry per plan g3-server-actions-and-useaction v1.2\n * § Phase 1 / T1.4 + ADR D4. Consumed by virtual module `@theo/actions`\n * (T3.1) and G4 devtools \"Actions\" tab (T5.1).\n */\nexport interface ActionManifestEntry {\n  name: string\n  filePath: string\n  urlPath: string\n  accept: 'form' | 'json'\n  hasInput: boolean\n  /**\n   * P#4 plugin-forms shared-schema convention (per plan p4-plugin-forms v1.1 T1.1).\n   * When present, points to an isomorphic schema file at\n   * `<serverDir>/actions/schemas/<basename>.ts` exporting `export const schema = z.object(...)`.\n   * Virtual module emits `import {schema} from '<schemaFilePath>'` + attaches as\n   * `actions.X.__zodSchema` so client-side <TheoForm> can drive zodResolver.\n   * Undefined when convention not followed (graceful degrade — TheoForm still\n   * works via explicit `schema={...}` prop escape hatch).\n   */\n  schemaFilePath?: string\n}\n\n/**\n * EC-2: structured error for scan-time defects (name collision, reserved\n * identifier, etc.). Throw at scan time to fail loud — silent shadowing is\n * a security/correctness footgun.\n */\nexport class ActionScanError extends Error {\n  readonly code: 'NAME_COLLISION' | 'RESERVED_NAME'\n  readonly conflictingPaths: readonly string[]\n\n  constructor(\n    code: 'NAME_COLLISION' | 'RESERVED_NAME',\n    message: string,\n    conflictingPaths: readonly string[],\n  ) {\n    super(message)\n    // T4.1 fix: identify class by name so serverErrorToEnvelope boundary\n    // translator can route via class-name lookup (without this, runtime\n    // `err.name` defaults to 'Error' and the meta.name diagnostic is wrong).\n    this.name = 'ActionScanError'\n    this.code = code\n    this.conflictingPaths = conflictingPaths\n  }\n}\n\nconst ACTION_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\nconst TEST_FILE_RE = /\\.(test|spec)\\.(ts|tsx|js|jsx)$/\nconst RESERVED_NAMES = new Set(['index', 'constructor', '__proto__', 'prototype', 'hasOwnProperty'])\n\n/**\n * Backward-compatible: original simple-shape scanner used by existing\n * consumers. Preserved verbatim; new consumers should call\n * `scanServerActionsEnriched`.\n */\nexport function scanServerActions(serverDir: string): ActionNode[] {\n  const actionsDir = join(serverDir, 'actions')\n  if (!existsSync(actionsDir) || !statSync(actionsDir).isDirectory()) {\n    return []\n  }\n\n  const results: ActionNode[] = []\n  walkSourceFiles(actionsDir, { extensions: ACTION_EXTENSIONS }, (absPath) => {\n    if (TEST_FILE_RE.test(absPath)) return\n    let rel = relative(actionsDir, absPath)\n    rel = rel.replace(/\\\\/g, '/')\n    rel = rel.slice(0, -extname(rel).length)\n    results.push({\n      filePath: absPath,\n      actionPath: rel,\n    })\n  })\n  return results\n}\n\n/**\n * Enriched scan: light AST detection of `accept: 'form'|'json'` + `input:`\n * presence via regex-after-comment-stripping (EC-9). Throws ActionScanError\n * on file/dir name collision (EC-2) or reserved JS identifier names.\n *\n * Output `ActionManifestEntry[]` is sorted by `name` for deterministic\n * `.theokit/actions-manifest.json` emission.\n */\nexport function scanServerActionsEnriched(serverDir: string): ActionManifestEntry[] {\n  const actionsDir = join(serverDir, 'actions')\n  if (!existsSync(actionsDir) || !statSync(actionsDir).isDirectory()) {\n    return []\n  }\n\n  const seenNames = new Set<string>()\n  const entries: ActionManifestEntry[] = []\n\n  // Collect first; collision-check after the full walk.\n  walkSourceFiles(actionsDir, { extensions: ACTION_EXTENSIONS }, (absPath) => {\n    if (TEST_FILE_RE.test(absPath)) return\n    const rel = relative(actionsDir, absPath).replace(/\\\\/g, '/')\n    // P#4 plugin-forms — `schemas/` subdir holds isomorphic zod schemas\n    // for the shared-schema convention (T1.1). NOT executable actions; skip.\n    if (rel.startsWith('schemas/')) return\n    const name = rel.slice(0, -extname(rel).length)\n\n    const basename = name.includes('/') ? (name.split('/').pop() ?? name) : name\n    if (RESERVED_NAMES.has(basename)) {\n      throw new ActionScanError(\n        'RESERVED_NAME',\n        `Reserved JS identifier \"${basename}\" cannot be an action name (${absPath})`,\n        [absPath],\n      )\n    }\n    // File-level collision (one file appearing twice) is impossible via the\n    // walker; per-export collision check happens inside the export loop below.\n    const source = readFileSync(absPath, 'utf8')\n    const stripped = stripComments(source)\n    const accept = /\\baccept\\s*:\\s*['\"]form['\"]/.test(stripped) ? 'form' : 'json'\n    const hasInput = /\\binput\\s*:\\s*z\\./.test(stripped) || /\\binput\\s*:\\s*\\w+\\(/.test(stripped)\n\n    // T7.1 wire fix — extract exports so the urlPath includes the second\n    // segment required by action-middleware (`/api/__actions/<file>/<export>`).\n    // Each named action export becomes its own manifest entry.\n    // Proxy key on the EXPORT name (so consumers write `actions.saveMemory(input)`).\n    // URL keeps the runtime 2-segment shape `/api/__actions/<file>/<export>`\n    // expected by action-middleware. Cross-file export collisions become a\n    // scan error to surface the ambiguity early.\n    const exportNames = extractActionExportNames(stripped)\n    // P#4 plugin-forms shared-schema convention: check for\n    // `<actionsDir>/schemas/<basename>.ts` (or .tsx/.js/.jsx).\n    // Skip when actions live in subdirs (`schemas/` is flat by convention).\n    const schemaFilePath = name.includes('/') ? undefined : detectSchemaFile(actionsDir, basename)\n    for (const exportName of exportNames) {\n      const proxyKey = exportName === 'default' ? name : exportName\n      if (seenNames.has(proxyKey)) {\n        throw new ActionScanError(\n          'NAME_COLLISION',\n          `Duplicate action proxy key \"${proxyKey}\" (two files export the same name)`,\n          [absPath],\n        )\n      }\n      seenNames.add(proxyKey)\n      const entry: ActionManifestEntry = {\n        name: proxyKey,\n        filePath: absPath,\n        urlPath: `/api/__actions/${name}/${exportName}`,\n        accept,\n        hasInput,\n      }\n      if (schemaFilePath !== undefined) {\n        entry.schemaFilePath = schemaFilePath\n      }\n      entries.push(entry)\n    }\n  })\n\n  // EC-2: detect file vs dir collisions (e.g., foo.ts AND foo/bar.ts).\n  // After walk completes, any name that has children prefixed `name/` triggers collision.\n  for (const entry of entries) {\n    const childPrefix = `${entry.name}/`\n    const conflictingChild = entries.find((other) => other.name.startsWith(childPrefix))\n    if (conflictingChild) {\n      throw new ActionScanError(\n        'NAME_COLLISION',\n        `Action \"${entry.name}\" conflicts with directory of same name containing \"${conflictingChild.name}\"`,\n        [entry.filePath, conflictingChild.filePath],\n      )\n    }\n  }\n\n  entries.sort((a, b) => {\n    if (a.name < b.name) return -1\n    if (a.name > b.name) return 1\n    return 0\n  })\n  return entries\n}\n\n/**\n * Strip JavaScript line + block comments from source. Simple state machine\n * (does not parse strings — false positives if a comment marker appears\n * inside a string literal, but that's an acceptable trade-off for v1 vs\n * full AST parse).\n */\n/**\n * Extract action export names via regex over comment-stripped source.\n * Matches `export const <name> = defineAction(...)`, `export default\n * defineAction(...)`, and `export function <name>(...)` forms. Returns\n * `['default']` when no named action exports are found (best-effort fallback\n * for default-export shapes the regex misses).\n */\nfunction extractActionExportNames(stripped: string): string[] {\n  const names = new Set<string>()\n  const namedRe = /\\bexport\\s+(?:const|let|var|function\\*?)\\s+([a-zA-Z_$][\\w$]*)\\s*[=(]/g\n  let m: RegExpExecArray | null\n  while ((m = namedRe.exec(stripped)) !== null) {\n    const name = m[1]\n    if (typeof name === 'string' && name.length > 0) names.add(name)\n  }\n  if (/\\bexport\\s+default\\s+defineAction\\b/.test(stripped)) {\n    names.add('default')\n  }\n  if (names.size === 0) names.add('default')\n  return [...names]\n}\n\n/**\n * P#4 plugin-forms shared-schema convention helper (per plan p4-plugin-forms v1.1 T1.1).\n * Returns the resolved path to `<actionsDir>/schemas/<basename>.<ext>` if it exists.\n * Tries `.ts`, `.tsx`, `.js`, `.jsx` in that order. Returns undefined when no match.\n */\nfunction detectSchemaFile(actionsDir: string, basename: string): string | undefined {\n  const schemasDir = join(actionsDir, 'schemas')\n  if (!existsSync(schemasDir)) return undefined\n  for (const ext of ['.ts', '.tsx', '.js', '.jsx']) {\n    const candidate = join(schemasDir, `${basename}${ext}`)\n    if (existsSync(candidate)) return candidate\n  }\n  return undefined\n}\n\nfunction stripComments(source: string): string {\n  let out = ''\n  let i = 0\n  while (i < source.length) {\n    const ch = source[i]\n    const next = source[i + 1]\n    if (ch === '/' && next === '/') {\n      // Line comment: skip until newline\n      while (i < source.length && source[i] !== '\\n') i++\n      continue\n    }\n    if (ch === '/' && next === '*') {\n      // Block comment: skip until */\n      i += 2\n      while (i < source.length - 1 && !(source[i] === '*' && source[i + 1] === '/')) i++\n      i += 2\n      continue\n    }\n    out += ch\n    i++\n  }\n  return out\n}\n","export interface ServerRouteNode {\n  filePath: string\n  routePath: string\n  paramNames: string[]\n  pattern: RegExp\n  /** HTTP methods (uppercase) the route file exports. Optional for backward\n   * compatibility with manifests generated before G1. Empty array means the\n   * file has no HTTP exports (util-only); undefined means \"not detected\". */\n  methods?: string[]\n}\n\nexport function compilePattern(routePath: string): {\n  pattern: RegExp\n  paramNames: string[]\n} {\n  const paramNames: string[] = []\n  // Single pass: handle both catch-all (:...name) and regular (:name) params\n  const regexStr = routePath.replace(/:(?:\\.\\.\\.)?([^/]+)/g, (match: string, name: string) => {\n    paramNames.push(name)\n    // Catch-all matches across slashes, regular matches single segment\n    return match.startsWith(':...') ? '(.+)' : '([^/]+)'\n  })\n  // `regexStr` is derived from a developer-authored route path (build-time\n  // input, not HTTP-controlled). The `security/detect-non-literal-regexp`\n  // rule cannot see this constraint — disable narrowly.\n  // eslint-disable-next-line security/detect-non-literal-regexp -- route pattern from build-time scan, never HTTP input\n  return { pattern: new RegExp(`^${regexStr}$`), paramNames }\n}\n\nexport function matchRoute(\n  url: string,\n  routes: ServerRouteNode[],\n): { route: ServerRouteNode; params: Record<string, string> } | null {\n  // Strip query string and trailing slash\n  let path = url.split('?')[0]\n  if (path.length > 1 && path.endsWith('/')) {\n    path = path.slice(0, -1)\n  }\n\n  for (const route of routes) {\n    const match = route.pattern.exec(path)\n    if (match) {\n      const params: Record<string, string> = {}\n      route.paramNames.forEach((name, i) => {\n        params[name] = match[i + 1]\n      })\n      return { route, params }\n    }\n  }\n  return null\n}\n","/**\n * Canonical HTTP method set used by the typed client codegen + Proxy runtime.\n * Kept here (under `server/scan/`) because the SCAN is the first consumer —\n * `vite-plugin/app-typed-client.ts` (Phase 2) and `client/app-client.ts` (Phase 3)\n * import from here to ensure a single source of truth.\n *\n * Lowercase variants are derived via `.toLowerCase()` at call sites; we do not\n * export them separately to avoid drift between the two lists.\n */\n\nexport const HTTP_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'] as const\n\nexport type HttpMethod = (typeof HTTP_METHODS)[number]\n\nexport const HTTP_METHOD_LOWERCASE = HTTP_METHODS.map((m) => m.toLowerCase()) as readonly string[]\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks `serverDir/routes/` derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { existsSync, statSync } from 'node:fs'\nimport { basename, extname, join, relative } from 'node:path'\n\nimport { walkSourceFiles } from '../_internal/scan-walker.js'\n\nimport { detectExportedHttpMethods } from './detect-http-methods.js'\nimport { RouterConventionError } from './errors.js'\nimport { compilePattern, type ServerRouteNode } from './match.js'\n\nconst ROUTE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\n\n// EC-4: Co-located unit/spec tests must be silently skipped by the scanner,\n// BEFORE the dotted-basename check fires. Matches `*.test.ts|tsx|js|jsx`\n// and `*.spec.ts|tsx|js|jsx`.\nconst TEST_OR_SPEC_RE = /\\.(test|spec)\\.[jt]sx?$/\n\nfunction isTestOrSpecFile(filePath: string): boolean {\n  return TEST_OR_SPEC_RE.test(basename(filePath))\n}\n\nfunction hasDotOutsideBrackets(segment: string): boolean {\n  let depth = 0\n  for (const ch of segment) {\n    if (ch === '[') depth++\n    else if (ch === ']') depth--\n    else if (ch === '.' && depth === 0) return true\n  }\n  return false\n}\n\nfunction splitDottedSegmentOutsideBrackets(segment: string): string[] {\n  const parts: string[] = []\n  let current = ''\n  let depth = 0\n  for (const ch of segment) {\n    if (ch === '[') {\n      depth++\n      current += ch\n    } else if (ch === ']') {\n      depth--\n      current += ch\n    } else if (ch === '.' && depth === 0) {\n      if (current) parts.push(current)\n      current = ''\n    } else {\n      current += ch\n    }\n  }\n  if (current) parts.push(current)\n  return parts\n}\n\nfunction buildDirectoryNestedSuggestion(filePath: string, routesDir: string): string {\n  const rel = relative(routesDir, filePath).replace(/\\\\/g, '/')\n  const ext = extname(rel)\n  const withoutExt = rel.slice(0, -ext.length)\n  const segments = withoutExt.split('/').flatMap(splitDottedSegmentOutsideBrackets)\n  return `routes/${segments.join('/')}${ext}`\n}\n\nfunction assertNoDottedSegment(filePath: string, routesDir: string): void {\n  const rel = relative(routesDir, filePath).replace(/\\\\/g, '/')\n  const ext = extname(rel)\n  const withoutExt = rel.slice(0, -ext.length)\n  const segments = withoutExt.split('/')\n  for (const seg of segments) {\n    if (hasDotOutsideBrackets(seg)) {\n      throw new RouterConventionError({\n        file: filePath,\n        suggestion: buildDirectoryNestedSuggestion(filePath, routesDir),\n      })\n    }\n  }\n}\n\nfunction fileToRoutePath(filePath: string, routesDir: string): string {\n  let rel = relative(routesDir, filePath)\n  // Strip extension\n  const ext = extname(rel)\n  rel = rel.slice(0, -ext.length)\n  // Normalize separators\n  rel = rel.replace(/\\\\/g, '/')\n  // Strip index suffix\n  if (rel.endsWith('/index')) {\n    rel = rel.slice(0, -6)\n  } else if (rel === 'index') {\n    rel = ''\n  }\n  // Replace [...param] with :...param (catch-all, before regular params).\n  // Replace [param] with :param. Inputs are file paths bounded by the\n  // OS filename limit; the bracket capture is bounded by `]`.\n  rel = rel.replace(/\\[\\.\\.\\.([^\\]]+)\\]/g, ':...$1')\n  // eslint-disable-next-line sonarjs/slow-regex -- bounded by `]`; input is a single filename\n  rel = rel.replace(/\\[([^\\]]+)\\]/g, ':$1')\n  return `/api/${rel}`\n}\n\nexport function scanServerRoutes(serverDir: string): ServerRouteNode[] {\n  const routesDir = join(serverDir, 'routes')\n  if (!existsSync(routesDir) || !statSync(routesDir).isDirectory()) {\n    return []\n  }\n\n  const results: ServerRouteNode[] = []\n  walkSourceFiles(routesDir, { extensions: ROUTE_EXTENSIONS }, (absPath) => {\n    // EC-4: skip co-located test/spec files BEFORE the dotted-basename check\n    if (isTestOrSpecFile(absPath)) return\n\n    // G6 T1.1: reject dotted basenames (legacy convention that produced wrong\n    // paramNames due to greedy `:(?:\\.\\.\\.)?([^/]+)` regex in compilePattern).\n    assertNoDottedSegment(absPath, routesDir)\n\n    const routePath = fileToRoutePath(absPath, routesDir)\n    const { pattern, paramNames } = compilePattern(routePath)\n    const methods = detectExportedHttpMethods(absPath)\n    results.push({\n      filePath: absPath,\n      routePath,\n      paramNames,\n      pattern,\n      methods,\n    })\n  })\n\n  // T1.4 / EC-2 — refuse to scan if a user route collides with the reserved\n  // batch endpoint path. User must rename or disable batching.\n  const conflicting = results.find((r) => r.routePath === '/api/__theo_batch__')\n  if (conflicting) {\n    throw new Error(\n      `Server route ${conflicting.filePath} resolves to '/api/__theo_batch__' which is reserved for the batch endpoint. Rename the route or disable batching in theo.config.ts.`,\n    )\n  }\n\n  // Sort: static first, then dynamic, then catch-all last\n  const isCatchAll = (route: ServerRouteNode) => route.routePath.includes(':...')\n  results.sort((a, b) => {\n    const aStatic = a.paramNames.length === 0\n    const bStatic = b.paramNames.length === 0\n    const aCatchAll = isCatchAll(a)\n    const bCatchAll = isCatchAll(b)\n\n    // Static routes first\n    if (aStatic && !bStatic) return -1\n    if (!aStatic && bStatic) return 1\n    // Catch-all routes last\n    if (aCatchAll && !bCatchAll) return 1\n    if (!aCatchAll && bCatchAll) return -1\n    return a.routePath.localeCompare(b.routePath)\n  })\n\n  return results\n}\n","/**\n * Detect which HTTP-method named exports a route file declares.\n *\n * Uses the TypeScript compiler API (not regex) per G1 edge-case review EC-4:\n * regex over file content emits false positives for `// export const GET = ...`\n * in comments and `` `export const GET = ...` `` in template literals. AST\n * walking avoids both classes of bug.\n *\n * `typescript` ships as CommonJS with internal dynamic `require('fs')`.\n * When loaded via ESM `import`, the dynamic requires fail at module-bootstrap.\n * We use `createRequire(import.meta.url)` to keep the package on its native\n * CJS path. The type-only namespace import gives us the AST helpers shape.\n *\n * Returns the set of HTTP methods (uppercase) the file exports. Empty array\n * means the file has no HTTP exports (the route file is util-only).\n */\n\nimport { readFileSync } from 'node:fs'\nimport { createRequire } from 'node:module'\n\nimport type * as TS from 'typescript'\n\nimport { HTTP_METHODS, type HttpMethod } from '../../core/contracts/http-methods.js'\n\nconst require_ = createRequire(import.meta.url)\n\nconst ts = require_('typescript') as typeof TS\n\nconst HTTP_METHOD_NAMES = new Set<string>(HTTP_METHODS)\n\nfunction hasExportModifier(modifiers: readonly TS.Modifier[] | undefined): boolean {\n  if (!modifiers) return false\n  for (const m of modifiers) {\n    if (m.kind === ts.SyntaxKind.ExportKeyword) return true\n  }\n  return false\n}\n\n// An AST visitor over the export forms (const / function / named export) is inherently branchy;\n// the complexity is in the grammar it walks, not in tangled logic. Splitting it would scatter one\n// cohesive dispatch across helpers for no readability gain.\n// eslint-disable-next-line complexity -- AST visitor, see above\nfunction collectFromStatement(stmt: TS.Statement, found: Set<HttpMethod>): void {\n  // `export const GET = ...` / `export function GET ...` / `export async function GET ...`\n  if (ts.isVariableStatement(stmt) && hasExportModifier(ts.getModifiers(stmt))) {\n    for (const decl of stmt.declarationList.declarations) {\n      if (ts.isIdentifier(decl.name) && HTTP_METHOD_NAMES.has(decl.name.text)) {\n        found.add(decl.name.text as HttpMethod)\n      }\n    }\n    return\n  }\n\n  if (\n    (ts.isFunctionDeclaration(stmt) || ts.isClassDeclaration(stmt)) &&\n    hasExportModifier(ts.getModifiers(stmt))\n  ) {\n    if (stmt.name && HTTP_METHOD_NAMES.has(stmt.name.text)) {\n      found.add(stmt.name.text as HttpMethod)\n    }\n    return\n  }\n\n  // `export { GET }` / `export { handler as GET } from './shared'` (EC-5)\n  if (ts.isExportDeclaration(stmt) && stmt.exportClause && ts.isNamedExports(stmt.exportClause)) {\n    for (const spec of stmt.exportClause.elements) {\n      // spec.name is the exported (re-)name; spec.propertyName is the original (when renamed)\n      if (HTTP_METHOD_NAMES.has(spec.name.text)) {\n        found.add(spec.name.text as HttpMethod)\n      }\n    }\n  }\n}\n\nexport function detectExportedHttpMethods(filePath: string, content?: string): HttpMethod[] {\n  // `filePath` is a route module the framework itself discovered by globbing the project — never\n  // user input at runtime. Reading it by a computed path is the whole job of a source scanner.\n  // eslint-disable-next-line security/detect-non-literal-fs-filename -- framework-controlled path\n  const src = content ?? readFileSync(filePath, 'utf-8')\n  const sourceFile = ts.createSourceFile(\n    filePath,\n    src,\n    ts.ScriptTarget.Latest,\n    /* setParentNodes */ false,\n    ts.ScriptKind.TS,\n  )\n  const found = new Set<HttpMethod>()\n  for (const stmt of sourceFile.statements) {\n    collectFromStatement(stmt, found)\n  }\n  return [...found].sort((a, b) => a.localeCompare(b))\n}\n","/**\n * Router-convention errors thrown by the server-route scanner.\n *\n *\n * theokit 0.4.0+ enforces directory-nested file-system routing\n * (`auth/[provider]/login.ts`) and REJECTS dotted-basename routes\n * (`auth.[provider].login.ts`) because the legacy regex extracted the\n * dotted basename incorrectly — `params.provider` was undefined at request\n * time. Decision recorded in the plan above (`g6-router-convention-plan.md`) and CHANGELOG 0.4.0\n * (no standalone ADR was cut for this router-convention change).\n */\n\n/**\n * Canonical migration guide URL. T4.2 establishes this as the authoritative\n * landing page. EC-3: error message uses this constant so the URL never\n * drifts from the doc location.\n */\nexport const ROUTER_MIGRATION_GUIDE_URL = 'https://theokit.dev/migration/0.3-to-0.4-router'\n\ninterface RouterConventionErrorOptions {\n  /** Absolute path of the offending route file. */\n  file: string\n  /** Suggested directory-nested replacement path (relative, e.g. `routes/auth/[provider]/login.ts`). */\n  suggestion: string\n  /** Migration guide URL (defaults to `ROUTER_MIGRATION_GUIDE_URL`). */\n  migrationUrl?: string\n}\n\n/**\n * Thrown by `scanServerRoutes` when a route file uses the legacy\n * dotted-basename convention (`auth.[provider].login.ts`).\n *\n * The error is FAIL-FAST by design — running with a route that has wrong\n * `paramNames` produces silent 404s at request time, which is strictly\n * worse than a build-time error.\n */\nexport class RouterConventionError extends Error {\n  override readonly name = 'RouterConventionError'\n  readonly file: string\n  readonly suggestion: string\n  readonly migrationUrl: string\n\n  constructor(opts: RouterConventionErrorOptions) {\n    const migrationUrl = opts.migrationUrl ?? ROUTER_MIGRATION_GUIDE_URL\n    const message = [\n      `Router convention violation: dotted route basename is not supported in theokit 0.4+.`,\n      ``,\n      `  File: ${opts.file}`,\n      `  Use directory-nested form: ${opts.suggestion}`,\n      ``,\n      `Migration guide: ${migrationUrl}`,\n      `Run \\`theokit migrate router\\` to convert all dotted basenames automatically.`,\n    ].join('\\n')\n    super(message)\n    this.file = opts.file\n    this.suggestion = opts.suggestion\n    this.migrationUrl = migrationUrl\n  }\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Build-time scanner: walks `serverDir/ws/` derived from cwd.\n * No HTTP input ever reaches these fs calls.\n */\nimport { existsSync, statSync } from 'node:fs'\nimport { extname, join, relative } from 'node:path'\n\nimport { walkSourceFiles } from '../_internal/scan-walker.js'\n\nconst WS_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\n\nexport interface WebSocketRouteNode {\n  filePath: string\n  wsPath: string\n}\n\nexport function scanWebSocketRoutes(serverDir: string): WebSocketRouteNode[] {\n  const wsDir = join(serverDir, 'ws')\n  if (!existsSync(wsDir) || !statSync(wsDir).isDirectory()) {\n    return []\n  }\n\n  const results: WebSocketRouteNode[] = []\n  walkSourceFiles(wsDir, { extensions: WS_EXTENSIONS }, (absPath) => {\n    let rel = relative(wsDir, absPath)\n    rel = rel.replace(/\\\\/g, '/')\n    rel = rel.slice(0, -extname(rel).length)\n    if (rel.endsWith('/index')) rel = rel.slice(0, -6)\n    else if (rel === 'index') rel = ''\n    results.push({\n      filePath: absPath,\n      wsPath: `/ws/${rel}`,\n    })\n  })\n  return results\n}\n"],"mappings":";;;;;;;AAIA,SAAS,YAAY,cAAc,gBAAgB;AACnD,SAAS,SAAS,MAAM,gBAAgB;AAqCjC,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAChC;AAAA,EACA;AAAA,EAET,YACE,MACA,SACA,kBACA;AACA,UAAM,OAAO;AAIb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,mBAAmB;AAAA,EAC1B;AACF;AAEA,IAAM,oBAAoB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAChE,IAAM,eAAe;AACrB,IAAM,iBAAiB,oBAAI,IAAI,CAAC,SAAS,eAAe,aAAa,aAAa,gBAAgB,CAAC;AAO5F,SAAS,kBAAkB,WAAiC;AACjE,QAAM,aAAa,KAAK,WAAW,SAAS;AAC5C,MAAI,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,UAAU,EAAE,YAAY,GAAG;AAClE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAwB,CAAC;AAC/B,kBAAgB,YAAY,EAAE,YAAY,kBAAkB,GAAG,CAAC,YAAY;AAC1E,QAAI,aAAa,KAAK,OAAO,EAAG;AAChC,QAAI,MAAM,SAAS,YAAY,OAAO;AACtC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM;AACvC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,YAAY;AAAA,IACd,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;AAUO,SAAS,0BAA0B,WAA0C;AAClF,QAAM,aAAa,KAAK,WAAW,SAAS;AAC5C,MAAI,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,UAAU,EAAE,YAAY,GAAG;AAClE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,YAAY,oBAAI,IAAY;AAClC,QAAM,UAAiC,CAAC;AAGxC,kBAAgB,YAAY,EAAE,YAAY,kBAAkB,GAAG,CAAC,YAAY;AAC1E,QAAI,aAAa,KAAK,OAAO,EAAG;AAChC,UAAM,MAAM,SAAS,YAAY,OAAO,EAAE,QAAQ,OAAO,GAAG;AAG5D,QAAI,IAAI,WAAW,UAAU,EAAG;AAChC,UAAM,OAAO,IAAI,MAAM,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM;AAE9C,UAAMA,YAAW,KAAK,SAAS,GAAG,IAAK,KAAK,MAAM,GAAG,EAAE,IAAI,KAAK,OAAQ;AACxE,QAAI,eAAe,IAAIA,SAAQ,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,2BAA2BA,SAAQ,+BAA+B,OAAO;AAAA,QACzE,CAAC,OAAO;AAAA,MACV;AAAA,IACF;AAGA,UAAM,SAAS,aAAa,SAAS,MAAM;AAC3C,UAAM,WAAW,cAAc,MAAM;AACrC,UAAM,SAAS,8BAA8B,KAAK,QAAQ,IAAI,SAAS;AACvE,UAAM,WAAW,oBAAoB,KAAK,QAAQ,KAAK,sBAAsB,KAAK,QAAQ;AAS1F,UAAM,cAAc,yBAAyB,QAAQ;AAIrD,UAAM,iBAAiB,KAAK,SAAS,GAAG,IAAI,SAAY,iBAAiB,YAAYA,SAAQ;AAC7F,eAAW,cAAc,aAAa;AACpC,YAAM,WAAW,eAAe,YAAY,OAAO;AACnD,UAAI,UAAU,IAAI,QAAQ,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,+BAA+B,QAAQ;AAAA,UACvC,CAAC,OAAO;AAAA,QACV;AAAA,MACF;AACA,gBAAU,IAAI,QAAQ;AACtB,YAAM,QAA6B;AAAA,QACjC,MAAM;AAAA,QACN,UAAU;AAAA,QACV,SAAS,kBAAkB,IAAI,IAAI,UAAU;AAAA,QAC7C;AAAA,QACA;AAAA,MACF;AACA,UAAI,mBAAmB,QAAW;AAChC,cAAM,iBAAiB;AAAA,MACzB;AACA,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF,CAAC;AAID,aAAW,SAAS,SAAS;AAC3B,UAAM,cAAc,GAAG,MAAM,IAAI;AACjC,UAAM,mBAAmB,QAAQ,KAAK,CAAC,UAAU,MAAM,KAAK,WAAW,WAAW,CAAC;AACnF,QAAI,kBAAkB;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,WAAW,MAAM,IAAI,uDAAuD,iBAAiB,IAAI;AAAA,QACjG,CAAC,MAAM,UAAU,iBAAiB,QAAQ;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,QAAI,EAAE,OAAO,EAAE,KAAM,QAAO;AAC5B,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AACT;AAeA,SAAS,yBAAyB,UAA4B;AAC5D,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,UAAU;AAChB,MAAI;AACJ,UAAQ,IAAI,QAAQ,KAAK,QAAQ,OAAO,MAAM;AAC5C,UAAM,OAAO,EAAE,CAAC;AAChB,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,EAAG,OAAM,IAAI,IAAI;AAAA,EACjE;AACA,MAAI,sCAAsC,KAAK,QAAQ,GAAG;AACxD,UAAM,IAAI,SAAS;AAAA,EACrB;AACA,MAAI,MAAM,SAAS,EAAG,OAAM,IAAI,SAAS;AACzC,SAAO,CAAC,GAAG,KAAK;AAClB;AAOA,SAAS,iBAAiB,YAAoBA,WAAsC;AAClF,QAAM,aAAa,KAAK,YAAY,SAAS;AAC7C,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,aAAW,OAAO,CAAC,OAAO,QAAQ,OAAO,MAAM,GAAG;AAChD,UAAM,YAAY,KAAK,YAAY,GAAGA,SAAQ,GAAG,GAAG,EAAE;AACtD,QAAI,WAAW,SAAS,EAAG,QAAO;AAAA,EACpC;AACA,SAAO;AACT;AAEA,SAAS,cAAc,QAAwB;AAC7C,MAAI,MAAM;AACV,MAAI,IAAI;AACR,SAAO,IAAI,OAAO,QAAQ;AACxB,UAAM,KAAK,OAAO,CAAC;AACnB,UAAM,OAAO,OAAO,IAAI,CAAC;AACzB,QAAI,OAAO,OAAO,SAAS,KAAK;AAE9B,aAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,KAAM;AAChD;AAAA,IACF;AACA,QAAI,OAAO,OAAO,SAAS,KAAK;AAE9B,WAAK;AACL,aAAO,IAAI,OAAO,SAAS,KAAK,EAAE,OAAO,CAAC,MAAM,OAAO,OAAO,IAAI,CAAC,MAAM,KAAM;AAC/E,WAAK;AACL;AAAA,IACF;AACA,WAAO;AACP;AAAA,EACF;AACA,SAAO;AACT;;;ACnPO,SAAS,eAAe,WAG7B;AACA,QAAM,aAAuB,CAAC;AAE9B,QAAM,WAAW,UAAU,QAAQ,wBAAwB,CAAC,OAAe,SAAiB;AAC1F,eAAW,KAAK,IAAI;AAEpB,WAAO,MAAM,WAAW,MAAM,IAAI,SAAS;AAAA,EAC7C,CAAC;AAKD,SAAO,EAAE,SAAS,IAAI,OAAO,IAAI,QAAQ,GAAG,GAAG,WAAW;AAC5D;AAEO,SAAS,WACd,KACA,QACmE;AAEnE,MAAI,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC;AAC3B,MAAI,KAAK,SAAS,KAAK,KAAK,SAAS,GAAG,GAAG;AACzC,WAAO,KAAK,MAAM,GAAG,EAAE;AAAA,EACzB;AAEA,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI;AACrC,QAAI,OAAO;AACT,YAAM,SAAiC,CAAC;AACxC,YAAM,WAAW,QAAQ,CAAC,MAAM,MAAM;AACpC,eAAO,IAAI,IAAI,MAAM,IAAI,CAAC;AAAA,MAC5B,CAAC;AACD,aAAO,EAAE,OAAO,OAAO;AAAA,IACzB;AAAA,EACF;AACA,SAAO;AACT;;;ACxCO,IAAM,eAAe,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,QAAQ,SAAS;AAIhF,IAAM,wBAAwB,aAAa,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;;;ACV5E,SAAS,cAAAC,aAAY,YAAAC,iBAAgB;AACrC,SAAS,UAAU,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;;;ACYlD,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,qBAAqB;AAM9B,IAAM,WAAW,cAAc,YAAY,GAAG;AAE9C,IAAM,KAAK,SAAS,YAAY;AAEhC,IAAM,oBAAoB,IAAI,IAAY,YAAY;AAEtD,SAAS,kBAAkB,WAAwD;AACjF,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,KAAK,WAAW;AACzB,QAAI,EAAE,SAAS,GAAG,WAAW,cAAe,QAAO;AAAA,EACrD;AACA,SAAO;AACT;AAMA,SAAS,qBAAqB,MAAoB,OAA8B;AAE9E,MAAI,GAAG,oBAAoB,IAAI,KAAK,kBAAkB,GAAG,aAAa,IAAI,CAAC,GAAG;AAC5E,eAAW,QAAQ,KAAK,gBAAgB,cAAc;AACpD,UAAI,GAAG,aAAa,KAAK,IAAI,KAAK,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACvE,cAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,MACxC;AAAA,IACF;AACA;AAAA,EACF;AAEA,OACG,GAAG,sBAAsB,IAAI,KAAK,GAAG,mBAAmB,IAAI,MAC7D,kBAAkB,GAAG,aAAa,IAAI,CAAC,GACvC;AACA,QAAI,KAAK,QAAQ,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACtD,YAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,IACxC;AACA;AAAA,EACF;AAGA,MAAI,GAAG,oBAAoB,IAAI,KAAK,KAAK,gBAAgB,GAAG,eAAe,KAAK,YAAY,GAAG;AAC7F,eAAW,QAAQ,KAAK,aAAa,UAAU;AAE7C,UAAI,kBAAkB,IAAI,KAAK,KAAK,IAAI,GAAG;AACzC,cAAM,IAAI,KAAK,KAAK,IAAkB;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,0BAA0B,UAAkB,SAAgC;AAI1F,QAAM,MAAM,WAAWC,cAAa,UAAU,OAAO;AACrD,QAAM,aAAa,GAAG;AAAA,IACpB;AAAA,IACA;AAAA,IACA,GAAG,aAAa;AAAA;AAAA,IACK;AAAA,IACrB,GAAG,WAAW;AAAA,EAChB;AACA,QAAM,QAAQ,oBAAI,IAAgB;AAClC,aAAW,QAAQ,WAAW,YAAY;AACxC,yBAAqB,MAAM,KAAK;AAAA,EAClC;AACA,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACrD;;;AC1EO,IAAM,6BAA6B;AAmBnC,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC7B,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAoC;AAC9C,UAAM,eAAe,KAAK,gBAAgB;AAC1C,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,gCAAgC,KAAK,UAAU;AAAA,MAC/C;AAAA,MACA,oBAAoB,YAAY;AAAA,MAChC;AAAA,IACF,EAAE,KAAK,IAAI;AACX,UAAM,OAAO;AACb,SAAK,OAAO,KAAK;AACjB,SAAK,aAAa,KAAK;AACvB,SAAK,eAAe;AAAA,EACtB;AACF;;;AF7CA,IAAM,mBAAmB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAK/D,IAAM,kBAAkB;AAExB,SAAS,iBAAiB,UAA2B;AACnD,SAAO,gBAAgB,KAAK,SAAS,QAAQ,CAAC;AAChD;AAEA,SAAS,sBAAsB,SAA0B;AACvD,MAAI,QAAQ;AACZ,aAAW,MAAM,SAAS;AACxB,QAAI,OAAO,IAAK;AAAA,aACP,OAAO,IAAK;AAAA,aACZ,OAAO,OAAO,UAAU,EAAG,QAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,kCAAkC,SAA2B;AACpE,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI,QAAQ;AACZ,aAAW,MAAM,SAAS;AACxB,QAAI,OAAO,KAAK;AACd;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,KAAK;AACrB;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,OAAO,UAAU,GAAG;AACpC,UAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,gBAAU;AAAA,IACZ,OAAO;AACL,iBAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,SAAO;AACT;AAEA,SAAS,+BAA+B,UAAkB,WAA2B;AACnF,QAAM,MAAMC,UAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,aAAa,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAC3C,QAAM,WAAW,WAAW,MAAM,GAAG,EAAE,QAAQ,iCAAiC;AAChF,SAAO,UAAU,SAAS,KAAK,GAAG,CAAC,GAAG,GAAG;AAC3C;AAEA,SAAS,sBAAsB,UAAkB,WAAyB;AACxE,QAAM,MAAMD,UAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,aAAa,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAC3C,QAAM,WAAW,WAAW,MAAM,GAAG;AACrC,aAAW,OAAO,UAAU;AAC1B,QAAI,sBAAsB,GAAG,GAAG;AAC9B,YAAM,IAAI,sBAAsB;AAAA,QAC9B,MAAM;AAAA,QACN,YAAY,+BAA+B,UAAU,SAAS;AAAA,MAChE,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,UAAkB,WAA2B;AACpE,MAAI,MAAMD,UAAS,WAAW,QAAQ;AAEtC,QAAM,MAAMC,SAAQ,GAAG;AACvB,QAAM,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAE9B,QAAM,IAAI,QAAQ,OAAO,GAAG;AAE5B,MAAI,IAAI,SAAS,QAAQ,GAAG;AAC1B,UAAM,IAAI,MAAM,GAAG,EAAE;AAAA,EACvB,WAAW,QAAQ,SAAS;AAC1B,UAAM;AAAA,EACR;AAIA,QAAM,IAAI,QAAQ,uBAAuB,QAAQ;AAEjD,QAAM,IAAI,QAAQ,iBAAiB,KAAK;AACxC,SAAO,QAAQ,GAAG;AACpB;AAEO,SAAS,iBAAiB,WAAsC;AACrE,QAAM,YAAYC,MAAK,WAAW,QAAQ;AAC1C,MAAI,CAACC,YAAW,SAAS,KAAK,CAACC,UAAS,SAAS,EAAE,YAAY,GAAG;AAChE,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAA6B,CAAC;AACpC,kBAAgB,WAAW,EAAE,YAAY,iBAAiB,GAAG,CAAC,YAAY;AAExE,QAAI,iBAAiB,OAAO,EAAG;AAI/B,0BAAsB,SAAS,SAAS;AAExC,UAAM,YAAY,gBAAgB,SAAS,SAAS;AACpD,UAAM,EAAE,SAAS,WAAW,IAAI,eAAe,SAAS;AACxD,UAAM,UAAU,0BAA0B,OAAO;AACjD,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAID,QAAM,cAAc,QAAQ,KAAK,CAAC,MAAM,EAAE,cAAc,qBAAqB;AAC7E,MAAI,aAAa;AACf,UAAM,IAAI;AAAA,MACR,gBAAgB,YAAY,QAAQ;AAAA,IACtC;AAAA,EACF;AAGA,QAAM,aAAa,CAAC,UAA2B,MAAM,UAAU,SAAS,MAAM;AAC9E,UAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,UAAM,UAAU,EAAE,WAAW,WAAW;AACxC,UAAM,UAAU,EAAE,WAAW,WAAW;AACxC,UAAM,YAAY,WAAW,CAAC;AAC9B,UAAM,YAAY,WAAW,CAAC;AAG9B,QAAI,WAAW,CAAC,QAAS,QAAO;AAChC,QAAI,CAAC,WAAW,QAAS,QAAO;AAEhC,QAAI,aAAa,CAAC,UAAW,QAAO;AACpC,QAAI,CAAC,aAAa,UAAW,QAAO;AACpC,WAAO,EAAE,UAAU,cAAc,EAAE,SAAS;AAAA,EAC9C,CAAC;AAED,SAAO;AACT;;;AGvJA,SAAS,cAAAC,aAAY,YAAAC,iBAAgB;AACrC,SAAS,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;AAIxC,IAAM,gBAAgB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAOrD,SAAS,oBAAoB,WAAyC;AAC3E,QAAM,QAAQC,MAAK,WAAW,IAAI;AAClC,MAAI,CAACC,YAAW,KAAK,KAAK,CAACC,UAAS,KAAK,EAAE,YAAY,GAAG;AACxD,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAgC,CAAC;AACvC,kBAAgB,OAAO,EAAE,YAAY,cAAc,GAAG,CAAC,YAAY;AACjE,QAAI,MAAMC,UAAS,OAAO,OAAO;AACjC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAACC,SAAQ,GAAG,EAAE,MAAM;AACvC,QAAI,IAAI,SAAS,QAAQ,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AAAA,aACxC,QAAQ,QAAS,OAAM;AAChC,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV,QAAQ,OAAO,GAAG;AAAA,IACpB,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;","names":["basename","existsSync","statSync","extname","join","relative","readFileSync","readFileSync","relative","extname","join","existsSync","statSync","existsSync","statSync","extname","join","relative","join","existsSync","statSync","relative","extname"]}

package/dist/chunk-CMYSHZFT.js

@@ -1,422 +0,0 @@
-#!/usr/bin/env node
-import "tsx/esm";
-import {
-  servicesConfigSchema
-} from "./chunk-WSXNGF7X.js";
-
-// src/config/schema.ts
-import { z as z8 } from "zod";
-
-// src/core/contracts/theo-ui-theme.ts
-var THEME_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
-
-// src/config/schemas/rate-limit.ts
-import { z } from "zod";
-var baseRateLimitSchema = z.object({
-  windowMs: z.number().min(1),
-  max: z.number().int().min(1)
-});
-var rateLimitSchema = z.union([
-  baseRateLimitSchema,
-  z.object({
-    default: baseRateLimitSchema.optional(),
-    routes: z.record(z.string(), baseRateLimitSchema).optional(),
-    keyBy: z.union([
-      z.enum(["ip", "session", "user"]),
-      z.function({ input: z.tuple([z.unknown()]), output: z.string() })
-    ]).optional(),
-    cookieName: z.string().min(1).optional(),
-    /**
-     * How many reverse proxies sit in front of the app, for `keyBy: 'ip'`. `false` (default)
-     * trusts none; `true` means one; a number names a longer chain.
-     *
-     * Required for correct limiting behind Caddy/nginx/a load balancer — without it every visitor
-     * keys on the proxy address and shares a single bucket. Off by default because
-     * `x-forwarded-for` is client-writable.
-     */
-    trustProxy: z.union([z.boolean(), z.number().int().min(0)]).optional()
-  })
-]);
-
-// src/config/schemas/upload.ts
-import { z as z2 } from "zod";
-var uploadSchema = z2.object({
-  maxFileSize: z2.number().min(1).default(10 * 1024 * 1024),
-  // 10MB
-  maxFiles: z2.number().int().min(1).default(10),
-  maxFieldSize: z2.number().min(1).default(1 * 1024 * 1024)
-  // 1MB
-});
-
-// src/config/schemas/logging.ts
-import { z as z3 } from "zod";
-var loggingSchema = z3.object({
-  level: z3.enum(["debug", "info", "warn", "error", "silent"]).default("info")
-});
-
-// src/config/schemas/cache.ts
-import { z as z4 } from "zod";
-var routeRuleSchema = z4.object({
-  maxAge: z4.number().nonnegative().optional(),
-  swr: z4.number().nonnegative().optional(),
-  tags: z4.array(z4.string()).optional()
-});
-var cacheSchema = z4.object({
-  enabled: z4.boolean().default(true),
-  /** 'memory' uses InMemoryCacheAdapter; otherwise pass a custom adapter instance. */
-  storage: z4.union([z4.literal("memory"), z4.custom()]).default("memory"),
-  maxEntries: z4.number().int().positive().default(1e3),
-  defaults: z4.object({
-    maxAge: z4.number().nonnegative().default(1),
-    swr: z4.number().nonnegative().optional(),
-    cacheErrors: z4.boolean().default(false)
-  }).default({ maxAge: 1, cacheErrors: false }),
-  keyDerivation: z4.object({
-    excludeQuery: z4.array(z4.string()).optional(),
-    sortQuery: z4.boolean().default(true),
-    lowercaseHost: z4.boolean().default(true)
-  }).default({ sortQuery: true, lowercaseHost: true }),
-  routeRules: z4.record(z4.string(), routeRuleSchema).optional()
-});
-
-// src/config/schemas/security.ts
-import { z as z6 } from "zod";
-
-// src/config/schemas/header-safe.ts
-import { z as z5 } from "zod";
-var headerSafeString = z5.string().refine((s) => !/[\r\n]/.test(s), { message: "Header value must not contain CR/LF" });
-
-// src/config/schemas/security.ts
-var securityHeadersSchema = z6.object({
-  csp: z6.union([headerSafeString, z6.literal(false)]).optional(),
-  // T6.1 — default flipped from 'report-only' to 'enforce' for 0.3.0.
-  // Users who want the old behaviour set `cspMode: 'report-only'`
-  // explicitly.
-  cspMode: z6.enum(["enforce", "report-only", "off"]).default("enforce"),
-  hsts: z6.union([headerSafeString, z6.literal(false)]).optional(),
-  frameOptions: z6.enum(["DENY", "SAMEORIGIN"]).default("DENY"),
-  contentTypeOptions: z6.literal("nosniff").default("nosniff"),
-  referrerPolicy: headerSafeString.default("strict-origin-when-cross-origin"),
-  /**
-   * T1.1 — Permissions-Policy directive string. EC-3-refined: rejects CR/LF.
-   * Pass `false` to suppress the header.
-   */
-  permissionsPolicy: z6.union([headerSafeString, z6.literal(false)]).optional()
-});
-var disallowedConfigSchema = z6.object({
-  routes: z6.array(z6.union([z6.string(), z6.instanceof(RegExp)])),
-  behavior: z6.enum(["warn", "raise"]).default("raise")
-});
-var corsSchema = z6.object({
-  origins: z6.union([
-    z6.literal("*"),
-    headerSafeString,
-    z6.instanceof(RegExp),
-    z6.array(z6.union([headerSafeString, z6.instanceof(RegExp)])),
-    z6.function({ input: z6.tuple([z6.string()]), output: z6.boolean() })
-  ]),
-  methods: z6.array(z6.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"])).optional(),
-  allowedHeaders: z6.array(headerSafeString).optional(),
-  exposedHeaders: z6.array(headerSafeString).optional(),
-  credentials: z6.boolean().default(false),
-  maxAge: z6.number().int().min(0).max(86400).default(600)
-}).refine((c) => !(c.origins === "*" && c.credentials), {
-  message: 'CORS spec forbids origins:"*" with credentials:true \u2014 browsers ignore the wildcard'
-});
-var securitySchema = z6.object({
-  // T6.1 — default flipped from 'warn' to 'strict' for 0.3.0. Apps that
-  // grep their warn-mode logs from 0.2.x already know which endpoints
-  // break; opt back into 'warn' globally OR use disallowedRoutes for
-  // surgical migration.
-  csrf: z6.enum(["off", "warn", "strict"]).default("strict"),
-  headers: securityHeadersSchema.optional(),
-  /** T5.1 — per-route escalation (Rails disallowed_warnings pattern). */
-  disallowed: disallowedConfigSchema.optional(),
-  /** T1.2 — Cross-Origin Resource Sharing. Single global config; runs first in pipeline. */
-  cors: corsSchema.optional()
-});
-
-// src/config/schemas/storage.ts
-import { z as z7 } from "zod";
-var tlsConfigSchema = z7.object({
-  rejectUnauthorized: z7.boolean().optional(),
-  caCert: z7.string().optional(),
-  clientCert: z7.string().optional(),
-  clientKey: z7.string().optional()
-});
-var serverConfigSchema = z7.object({
-  host: z7.string().min(1),
-  port: z7.number().int().positive().max(65535).optional(),
-  user: z7.string().min(1),
-  /** Password may be the empty string (some providers permit it). */
-  password: z7.string(),
-  tls: tlsConfigSchema.optional()
-});
-var postgresPoolConfigSchema = z7.object({
-  min: z7.number().int().nonnegative().optional(),
-  max: z7.number().int().positive().optional(),
-  connectionTimeoutMillis: z7.number().int().positive().optional(),
-  idleTimeoutMillis: z7.number().int().nonnegative().optional()
-});
-var postgresDatabaseConfigSchema = z7.object({
-  /** References a key in `storage.servers`. Resolved at `usePostgres()` call time. */
-  server: z7.string().min(1),
-  database: z7.string().min(1),
-  pool: postgresPoolConfigSchema.optional()
-});
-var redisServerConfigSchema = serverConfigSchema.extend({
-  db: z7.number().int().nonnegative().optional(),
-  maxRetriesPerRequest: z7.number().int().nonnegative().optional()
-});
-var storageSchema = z7.object({
-  servers: z7.record(z7.string(), serverConfigSchema).optional(),
-  databases: z7.record(z7.string(), postgresDatabaseConfigSchema).optional(),
-  redis: z7.record(z7.string(), redisServerConfigSchema).optional()
-});
-
-// src/config/schema.ts
-var theoConfigSchema = z8.object({
-  /**
-   * Plan v1.2 T2.1 — project identifier propagated into
-   * `.theokit/services.json` v2 `project` field. DNS-1123 compatible (drives
-   * Gitea repo + ArgoCD App naming on TheoCloud). When omitted, the build
-   * emits services.json v1 with the legacy `services-bundle` fallback
-   * (ADR D10) and logs a deprecation warning.
-   */
-  name: z8.string().max(63).refine(
-    // DNS-1123 equivalent expressed as explicit single-char anchors so
-    // security/detect-unsafe-regex stays clean (no backtracking).
-    (value) => value.length > 0 && /^[a-z0-9-]+$/u.test(value) && !value.startsWith("-") && !value.endsWith("-"),
-    "name must match DNS-1123 (lowercase alphanumeric+hyphens, 1-63 chars, no leading/trailing hyphen)"
-  ).optional(),
-  appDir: z8.string().default("app"),
-  serverDir: z8.string().default("server"),
-  /**
-   * Directory (relative to the project root) holding `agents/<name>.ts` definitions, scanned by
-   * dev/build/terminal/mcp. Defaults to `"agents"` — apps that keep the canonical layout are
-   * unaffected. Set to e.g. `"core/agents"` to organize agents under a domain root (#95 follow-up).
-   */
-  agentsDir: z8.string().default("agents"),
-  /**
-   * T2.2 / EC-4 — Build output directory. Must be a relative path inside
-   * the project root. Refused absolute or parent-relative paths to prevent
-   * `cleanOutDir` from wiping arbitrary locations (defense-in-depth on
-   * top of cleanOutDir's runtime EC-3 guard).
-   */
-  distDir: z8.string().default(".theokit").refine(
-    (d) => !/^([A-Za-z]:)?[/\\]/.test(d) && !d.startsWith(".."),
-    'distDir must be a relative path inside the project root (e.g., ".theokit")'
-  ),
-  /**
-   * Agent runtime configuration.
-   *
-   * - `maxRegistries` (T2.3, legacy): dev-mode cleanup of stale
-   *   `.theokit/agents/<id>/` dirs by mtime. Now superseded by SDK's
-   *   native registry GC but kept for backward-compat.
-   * - `registry` (Phase 6, Production-Readiness #2): forwarded to
-   *   `Agent.registry.configure()` lazily on first request.
-   *   * `maxAgents` — LRU cap. MUST be ≥ max-concurrent-active-conversations
-   *     (EC-17 DOCUMENT): with maxAgents:1 and 2 concurrent chats, LRU evicts
-   *     mid-stream → SDK aborts with code:'aborted'. Default 100 covers
-   *     indie/small-team; tune up for high-traffic.
-   *   * `idleTimeoutMs` — auto-evict idle agents (default 30 min). 0 disables
-   *     idle eviction (LRU only).
-   */
-  agents: z8.object({
-    maxRegistries: z8.number().int().positive().default(100),
-    registry: z8.object({
-      /** LRU cap — MUST be ≥ max-concurrent-active-conversations. */
-      maxAgents: z8.number().int().positive().max(1e4).default(100),
-      /** Idle eviction window in ms. 0 disables idle eviction (LRU only). */
-      idleTimeoutMs: z8.number().int().nonnegative().default(30 * 6e4)
-    }).optional()
-  }).optional(),
-  port: z8.number().int().min(1).max(65535).default(3e3),
-  /** Listen on all addresses (0.0.0.0) for LAN/mobile testing. */
-  host: z8.union([z8.string(), z8.boolean()]).default("localhost"),
-  /** Automatically open browser on `theokit dev`. */
-  open: z8.union([z8.boolean(), z8.string()]).default(false),
-  /** Exit if port is already in use instead of trying next available. */
-  strictPort: z8.boolean().default(false),
-  /** Forward browser console/errors to terminal — useful for AI agent dev. */
-  forwardConsole: z8.union([
-    z8.boolean(),
-    z8.object({
-      unhandledErrors: z8.boolean().optional(),
-      logLevels: z8.array(z8.enum(["error", "warn", "info", "log", "debug"])).optional()
-    })
-  ]).default(false),
-  /** Pre-transform files on startup for faster first page load. */
-  warmup: z8.object({
-    clientFiles: z8.array(z8.string()).optional(),
-    ssrFiles: z8.array(z8.string()).optional()
-  }).optional(),
-  ssr: z8.boolean().default(false),
-  /** When true (and ssr === true), use renderToPipeableStream with progressive
-   * shell flush instead of single-shot renderToString. Opt-in for streaming
-   * SSR; default false preserves the current behavior. */
-  ssrStreaming: z8.boolean().default(false),
-  rateLimit: rateLimitSchema.optional(),
-  upload: uploadSchema.optional(),
-  logging: loggingSchema.optional(),
-  security: securitySchema.optional(),
-  serialization: z8.enum(["json", "superjson"]).default("json"),
-  // Plugins are validated structurally at runtime by createPluginRunnerFromConfig.
-  // Zod only checks the shape minimally (must be array). Type-level safety is
-  // provided through defineConfig at the user surface.
-  plugins: z8.array(z8.unknown()).optional(),
-  /** Enable client-side batching of theoFetch calls and the
-   * /api/__theo_batch__ server endpoint. */
-  batching: z8.union([z8.boolean(), z8.object({ max: z8.number().int().positive().optional() })]).optional(),
-  /** T4.1 — Audit log. When `logger` is provided, framework events
-   * (csrf.warn, rate-limit.exceeded, session.rotated, csp.violation) are
-   * emitted to it. Default: noop. */
-  audit: z8.object({
-    logger: z8.unknown().optional()
-  }).optional(),
-  /** TheoUI auto-wire (T2.1). `false` = opt-out; object = explicit theme/fonts;
-   * undefined = enabled when @theokit/ui is detected in node_modules. */
-  ui: z8.union([
-    z8.literal(false),
-    z8.object({
-      // Any theme @theokit/ui knows — built-in or from `defineTheme()`. This was a closed
-      // enum of `violet-forge | noir | paper`, two of which never existed in @theokit/ui, so
-      // the only accepted value was the default and every real theme was rejected. The pattern
-      // mirrors what @theokit/ui's ThemeProvider enforces, and it is load-bearing: the value is
-      // interpolated into the generated entry and into a CSS selector.
-      theme: z8.string().regex(
-        THEME_NAME_PATTERN,
-        "must start with a letter and contain only lowercase letters, digits and hyphens"
-      ).optional(),
-      fonts: z8.enum(["bundled", "cdn"]).optional()
-    })
-  ]).optional(),
-  /**
-   * Cache subsystem (caching-and-revalidation-plan).
-   * Default `undefined` keeps caching disabled (backward compatible).
-   * Pass `cache: {}` to opt in with defaults.
-   */
-  cache: cacheSchema.optional(),
-  /**
-   * Devtools overlay (Phase 0.4.0+ —
-   *
-   * - `undefined` (default): devtools auto-injects in `pnpm dev`, NEVER in `vite build`.
-   * - `false`: devtools disabled entirely (Vite plugin skips injection even in dev).
-   * - `{ ... }`: devtools enabled with explicit defaults (position, theme).
-   *
-   * Tree-shaken to noop in prod via the dual-export pattern in
-   * `packages/theo/src/devtools/index.ts` (EC-17 positive prod check).
-   */
-  devtools: z8.union([
-    z8.literal(false),
-    z8.object({
-      position: z8.enum(["top-left", "top-right", "bottom-left", "bottom-right"]).optional(),
-      theme: z8.enum(["light", "dark", "system"]).optional()
-    })
-  ]).optional(),
-  /**
-   * Informative list of deploy adapters the app supports. Does NOT
-   * trigger per-build translations — only the `--target` CLI flag does
-   * (EC-201 / ADR D2). If `config.adapters` includes a target NOT
-   * matching `--target`, `theokit build` emits a cross-reference note.
-   */
-  adapters: z8.array(z8.string()).optional(),
-  /**
-   * Extra package names to pre-bundle via Vite's `optimizeDeps.include`.
-   *
-   * Framework auto-includes `@theokit/ui` and `lucide-react` when present.
-   * Apps adding plugin peer-deps that rely on a runtime `import('<pkg>')`
-   * (dynamic specifier) — e.g. `@theokit/plugin-canvas` consumers
-   * installing `mermaid` for Mermaid SVG rendering — must declare those
-   * here so Vite can resolve the literal in dev mode without
-   * "Failed to resolve module specifier" errors. Production builds use
-   * tsup/esbuild bundling and are not affected.
-   *
-   * Example:
-   *   viteOptimizeDeps: ['mermaid']
-   */
-  viteOptimizeDeps: z8.array(z8.string()).optional(),
-  /**
-   * Jobs backend (ADR D3 + T2.1). When configured, every request gets
-   * `ctx.queue.enqueue` auto-wired via the outbox lifecycle. Pass a
-   * `JobBackend` instance (InMemoryJobBackend, PostgresJobBackend, etc.).
-   */
-  jobs: z8.object({
-    backend: z8.custom((v) => typeof v === "object" && v !== null)
-  }).optional(),
-  /**
-   * StorageManager configuration (T1.1 / ADR-0007).
-   *
-   * Declares Postgres servers + databases + Redis servers. Consumed by
-   * `getStorageManager().configure()` at boot via `start.ts`.
-   *
-   * Default `undefined` means manager exists but is not configured — adapters
-   * relying on the manager (PostgresJobBackend.fromStorageManager, etc.) will
-   * throw with an actionable error on first use.
-   */
-  storage: storageSchema.optional(),
-  /**
-   * Wave 2 — Polyglot services orchestration (T1.1 / ADR-0012/0013/0014/0015).
-   *
-   * Declarative external sidecar processes (Python FastAPI / Node Hono)
-   * that boot alongside the TheoKit TS app. Empty `services: {}` is the
-   * default and preserves Wave 1 behavior.
-   */
-  services: servicesConfigSchema,
-  /**
-   * G2 — OpenAPI emit (build-time only).
-   *
-   * When present, `theokit build` writes a generated `openapi.json` from
-   * every `defineRoute()` body/query/params Zod schema. `undefined` keeps
-   * the framework backward-compatible (no emit). Pass `openapi: {}` to
-   * opt in with defaults.
-   *
-   * Defaults: spec 3.1.0 · servers `http://localhost:3000` · title
-   * "TheoKit App" · version "0.0.0" · outDir ".theokit" (next to dist).
-   *
-   * The env var `THEOKIT_OPENAPI_SERVERS` (CSV of URLs) overrides
-   * `servers[].url` at emit time without rebuilding the config.
-   */
-  openapi: z8.object({
-    servers: z8.array(
-      z8.object({
-        url: z8.url(),
-        description: z8.string().optional()
-      })
-    ).default([{ url: "http://localhost:3000", description: "Local development" }]),
-    specVersion: z8.enum(["3.1.0", "3.0.3"]).default("3.1.0"),
-    title: z8.string().default("TheoKit App"),
-    version: z8.string().default("0.0.0"),
-    outDir: z8.string().default(".theokit")
-  }).optional(),
-  /**
-   * G5 T1.3 — error envelope transformer hook (blueprint ADR D3).
-   *
-   * When present, runs at framework error-boundary time to enrich the
-   * envelope with consumer-defined extensions (`hint`, custom telemetry
-   * tags, etc.) BEFORE the envelope is serialized to the client. The
-   * function signature is preserved via the explicit `FormatErrorHook`
-   * type — TS inference flows from `theo.config.ts` into `@theo/client`
-   * codegen and `@theokit/ui` AgentErrorCard consumers.
-   *
-   * Use `z.custom<FormatErrorHook>(...)` because Zod's built-in
-   * `z.function()` discards its TS signature after parse; `z.custom`
-   * with a function-typed runtime guard preserves the call-site type
-   * without trading off Zod runtime validation.
-   */
-  formatError: z8.custom((val) => typeof val === "function", {
-    message: "formatError must be a function"
-  }).optional()
-}).refine((cfg) => !Object.values(cfg.services).some((s) => s.port === cfg.port), {
-  message: "service.port collides with TheoKit web port \u2014 change one of them",
-  path: ["services"]
-});
-
-export {
-  cacheSchema,
-  securityHeadersSchema,
-  corsSchema,
-  storageSchema,
-  theoConfigSchema
-};
-//# sourceMappingURL=chunk-CMYSHZFT.js.map