theokit 0.54.1 → 0.56.0

package/dist/{chunk-S6RWUH3J.js → chunk-ZTIB4QSV.js}

@@ -1,16 +1,13 @@
 import {
   resolveTheoRootDir
-} from "./chunk-VQPHPQ5L.js";
+} from "./chunk-7NRFZBAL.js";
 import {
   buildServicesProxyConfig,
   servicesConfigSchema
 } from "./chunk-SSYDEKWF.js";
 import {
   dispatchControllerRequest
-} from "./chunk-DAE7BJ7H.js";
-import {
-  broadcastToDevtools
-} from "./chunk-OIGJOYX6.js";
+} from "./chunk-XYVZJCZU.js";
 import {
   RUN_ID_HEADER,
   SSE_BASE_HEADERS,
@@ -35,10 +32,20 @@ import {
   securitySchema,
   storageSchema,
   uploadSchema
-} from "./chunk-WX6NHGKS.js";
+} from "./chunk-M357ILK5.js";
+import {
+  broadcastToDevtools
+} from "./chunk-OIGJOYX6.js";
 import {
   loadEnv
-} from "./chunk-4X6H2BXP.js";
+} from "./chunk-U3SPBLJF.js";
+import {
+  CSP_REPORT_PATH,
+  CsrfReadinessStore,
+  applySecurityHeaders,
+  handleCspReport,
+  handleCsrfReadiness
+} from "./chunk-BPYMC7SU.js";
 import {
   resolveTransformer
 } from "./chunk-OGLS76RN.js";
@@ -53,7 +60,13 @@ import {
   incomingMessageToHandlerRequest,
   sendError,
   writeWebResponseToServerResponse
-} from "./chunk-FVFYACYK.js";
+} from "./chunk-JW5UFKQ3.js";
+import {
+  validateCsrfRequest
+} from "./chunk-P6OS7652.js";
+import {
+  subjectFromContext
+} from "./chunk-YN4W7LCX.js";
 import {
   findSuggestion
 } from "./chunk-NTDN54XO.js";
@@ -61,7 +74,7 @@ import {
   TRACE_HEADER,
   extractTraceId,
   logRequest
-} from "./chunk-BND4YZTQ.js";
+} from "./chunk-ZDCCILMP.js";
 import {
   createPluginRunnerFromConfig
 } from "./chunk-VSLTKX5L.js";
@@ -70,26 +83,16 @@ import {
 } from "./chunk-TNI4MARH.js";
 import {
   createViteLoader
-} from "./chunk-OQCRCXCP.js";
+} from "./chunk-4ERYQBL6.js";
 import {
   matchRoute,
   scanServerActions,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-I2UN46ZX.js";
+} from "./chunk-XJOU425Y.js";
 import {
   scanAgents
-} from "./chunk-IRASEXOG.js";
-import {
-  CSP_REPORT_PATH,
-  CsrfReadinessStore,
-  applySecurityHeaders,
-  handleCspReport,
-  handleCsrfReadiness
-} from "./chunk-BPYMC7SU.js";
-import {
-  validateCsrfRequest
-} from "./chunk-P6OS7652.js";
+} from "./chunk-KDP2HURW.js";
 import {
   extractAppResources,
   handleMcpJsonRpc,
@@ -97,25 +100,22 @@ import {
 } from "./chunk-YOIVCCZT.js";
 import {
   resolveProvider
-} from "./chunk-3PBAN2YE.js";
+} from "./chunk-CF2DNN5R.js";
 import {
   generateNonce
 } from "./chunk-Z4PJMZLM.js";
 import {
   importUserModule
-} from "./chunk-52PDWL5S.js";
-import {
-  subjectFromContext
-} from "./chunk-YN4W7LCX.js";
+} from "./chunk-5KRMDP46.js";
 
 // src/vite-plugin/index.ts
-import { existsSync as existsSync8 } from "fs";
-import { resolve as resolve10, dirname as dirname4 } from "path";
-import { fileURLToPath } from "url";
+import { existsSync as existsSync8 } from "node:fs";
+import { resolve as resolve10, dirname as dirname4 } from "node:path";
+import { fileURLToPath } from "node:url";
 
 // src/vite-plugin/config-hook.ts
-import { existsSync } from "fs";
-import { resolve } from "path";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
 function runConfigHook(ctx) {
   const ext = existsSync(resolve(ctx.theoSrcDir, "index.ts")) ? ".ts" : ".js";
   const warmupClientFiles = [];
@@ -211,8 +211,8 @@ function runConfigHook(ctx) {
 }
 
 // src/config/load-config.ts
-import { existsSync as existsSync2 } from "fs";
-import { resolve as resolve2 } from "path";
+import { existsSync as existsSync2 } from "node:fs";
+import { resolve as resolve2 } from "node:path";
 
 // src/config/errors.ts
 var TheoConfigError = class extends Error {
@@ -571,8 +571,8 @@ async function loadConfig(dir) {
 }
 
 // src/config/resolve-plugin-specifiers.ts
-import { isAbsolute, resolve as resolve3 } from "path";
-import { pathToFileURL } from "url";
+import { isAbsolute, resolve as resolve3 } from "node:path";
+import { pathToFileURL } from "node:url";
 var UnresolvablePluginSpecifierError = class extends Error {
   constructor(index, specifier, reason) {
     super(`plugins[${index}] (${specifier}) could not be loaded: ${reason}`);
@@ -611,8 +611,8 @@ function messageOf(err) {
 }
 
 // src/vite-plugin/theoui-detect.ts
-import { existsSync as existsSync3, readFileSync } from "fs";
-import { dirname, join } from "path";
+import { existsSync as existsSync3, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 function resolveTheoUiConfig(raw) {
   return {
     theme: raw?.theme ?? "violet-forge",
@@ -750,7 +750,7 @@ async function resolvePluginConfig(projectRoot) {
 }
 
 // src/vite-plugin/configure-server-hook.ts
-import { resolve as resolve8, basename } from "path";
+import { resolve as resolve8, basename } from "node:path";
 
 // src/devtools/server-side/route-manifest.ts
 function buildPath(parents, segment) {
@@ -787,8 +787,8 @@ function broadcastRouteManifest(tree) {
 }
 
 // src/router/scan.ts
-import { readdirSync, statSync, existsSync as existsSync4 } from "fs";
-import { join as join2, resolve as resolve4 } from "path";
+import { readdirSync, statSync, existsSync as existsSync4 } from "node:fs";
+import { join as join2, resolve as resolve4 } from "node:path";
 
 // src/router/types.ts
 var ROUTE_FILE_NAMES = ["page", "layout", "error", "loading", "not-found"];
@@ -905,7 +905,7 @@ function scanRoutes(appDir) {
 }
 
 // src/vite-plugin/action-middleware.ts
-import { randomUUID } from "crypto";
+import { randomUUID } from "node:crypto";
 var PREFIX = "/api/__actions/";
 function createActionMiddleware(vite, serverDir, options) {
   const loadModule = createViteLoader(vite);
@@ -988,7 +988,7 @@ function createActionMiddleware(vite, serverDir, options) {
 }
 
 // src/vite-plugin/agent-middleware.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 
 // src/server/agent/agent-card-handler.ts
 import { buildAgentCard, compileAgentModule } from "@theokit/agents";
@@ -1820,7 +1820,7 @@ async function serveAgentTurn(t) {
 }
 
 // src/vite-plugin/api-middleware.ts
-import { resolve as resolve6 } from "path";
+import { resolve as resolve6 } from "node:path";
 function shouldBypassApiMiddleware(url, prefixes) {
   if (!url.startsWith("/api/")) return true;
   if (prefixes.length === 0) return false;
@@ -2070,8 +2070,8 @@ function createApiMiddleware(vite, serverDir, rateLimitConfigOrOptions) {
 }
 
 // src/vite-plugin/ssr-dev-middleware.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { resolve as resolve7 } from "path";
+import { readFileSync as readFileSync2 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
 
 // src/core/contracts/find-root-div.ts
 function maskHtmlComments(html) {
@@ -2333,7 +2333,7 @@ async function runConfigureServer(server, ctx) {
   server.watcher.on("unlink", handleRouteChange);
   if (ctx.resolvedOpenApi !== void 0) {
     const openApiCfg = ctx.resolvedOpenApi;
-    const { reEmitOpenApi } = await import("./dev-emit-W27J3DLU.js");
+    const { reEmitOpenApi } = await import("./dev-emit-FIQASO3D.js");
     const openApiServerDir = ctx.serverDir;
     const openApiDistDir = resolve8(ctx.projectRoot, ctx.resolvedDistDir);
     const isRouteFileForOpenApi = (file) => file.startsWith(openApiServerDir) && /\.(ts|tsx|js|mjs)$/.test(file);
@@ -2383,13 +2383,13 @@ async function integrateStudio(importStudio = () => import(
 }
 
 // src/vite-plugin/integrate-ui.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
-import { pathToFileURL as pathToFileURL2 } from "url";
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "node:fs";
+import { dirname as dirname3, join as join4 } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
 
 // src/vite-plugin/auto-detect.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "node:fs";
+import { dirname as dirname2, join as join3 } from "node:path";
 function isDeclared(name, projectRoot) {
   try {
     const raw = readFileSync3(join3(projectRoot, "package.json"), "utf-8");
@@ -2641,8 +2641,8 @@ async function integrateUseTheoUI(cwd, opts) {
 }
 
 // src/vite-plugin/transform-html-hook.ts
-import { existsSync as existsSync7 } from "fs";
-import { resolve as resolve9 } from "path";
+import { existsSync as existsSync7 } from "node:fs";
+import { resolve as resolve9 } from "node:path";
 
 // src/vite-plugin/inject-devtools.ts
 var DEVTOOLS_VIRTUAL_ID = "/@theo/devtools/entry.js";
@@ -3476,7 +3476,7 @@ async function theoPluginAsync(rootOrOptions) {
   const studioPlugins = await integrateStudio();
   const servicesPlugins = [];
   if (options.services && Object.keys(options.services).length > 0) {
-    const { servicesTypedClientPlugin } = await import("./services-typed-client-IXNOPVZA.js");
+    const { servicesTypedClientPlugin } = await import("./services-typed-client-ACTJHAEP.js");
     servicesPlugins.push(
       servicesTypedClientPlugin({
         cwd: projectRoot,
@@ -3484,19 +3484,19 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-6MNNVMJU.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-XSXAORG6.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve10(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-FGJR3I7V.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-KJBCM7PP.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve10(projectRoot, ".theokit")
   });
-  const { agentsTypedClientPlugin } = await import("./agents-typed-client-INR2E7B3.js");
-  const { generateManifest } = await import("./internal-api-VUDJUWYE.js");
+  const { agentsTypedClientPlugin } = await import("./agents-typed-client-PVUZU65B.js");
+  const { generateManifest } = await import("./internal-api-JNX3MTIM.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -3505,15 +3505,15 @@ async function theoPluginAsync(rootOrOptions) {
     // parent (projectRoot for the canonical layout) + the agents dir name (#95 follow-up).
     scanManifest: () => generateManifest(serverDirAbs, projectRoot, agentsDirName)
   });
-  const { serverRoutesHmrPlugin } = await import("./server-routes-hmr-BWN3WIGR.js");
+  const { serverRoutesHmrPlugin } = await import("./server-routes-hmr-TNI3FNGM.js");
   const routesHmrPlugin = serverRoutesHmrPlugin({
     serverDir: serverDirAbs
   });
-  const { controllerSwcTransformPlugin } = await import("./controller-swc-transform-T7ZTD55V.js");
+  const { controllerSwcTransformPlugin } = await import("./controller-swc-transform-7EZKG2IS.js");
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-4UIGB3G5.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-654WC5SA.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -3696,4 +3696,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-S6RWUH3J.js.map
+//# sourceMappingURL=chunk-ZTIB4QSV.js.map

package/dist/cli/index.js

@@ -15,12 +15,12 @@ function cliVersion() {
 // src/cli/index.ts
 var cli = cac("theokit");
 cli.command("dev", "Start development server").option("--port <port>", "Port number").action(async (options) => {
-  const { devCommand } = await import("../dev-6KDYNF5E.js");
+  const { devCommand } = await import("../dev-ZNTHPBBN.js");
   await devCommand({ port: options.port ? Number(options.port) : void 0 });
 });
 cli.command("build", "Build for production").option("--target <target>", "Deploy target (node, vercel, cloudflare)").action(async (options) => {
   try {
-    const { buildCommand } = await import("../build-JH53TZJI.js");
+    const { buildCommand } = await import("../build-4GQLIFTD.js");
     await buildCommand({ target: options.target });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -32,7 +32,7 @@ cli.command("build", "Build for production").option("--target <target>", "Deploy
 });
 cli.command("start", "Start production server").option("--port <port>", "Port number").action(async (options) => {
   try {
-    const { startCommand } = await import("../start-3F4LVHWS.js");
+    const { startCommand } = await import("../start-ONZXIWEG.js");
     await startCommand({ port: options.port ? Number(options.port) : void 0 });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -44,7 +44,7 @@ cli.command("start", "Start production server").option("--port <port>", "Port nu
 });
 cli.command("preview", "Build for production, then serve it \u2014 one step (B-030)").option("--port <port>", "Port number").option("--target <target>", "Deploy target (node, vercel, cloudflare)").action(async (options) => {
   try {
-    const { previewCommand } = await import("../preview-J57QZNTO.js");
+    const { previewCommand } = await import("../preview-K4NIQLAK.js");
     await previewCommand({
       port: options.port ? Number(options.port) : void 0,
       target: options.target
@@ -77,7 +77,7 @@ cli.command(
   "Run an agent in the terminal (stream + tool calls + approval)"
 ).action(async (name, message) => {
   try {
-    const { agentCommand } = await import("../agent-TKCC4WZ6.js");
+    const { agentCommand } = await import("../agent-NLG77PFN.js");
     const { sawError } = await agentCommand(name, message);
     if (sawError) process.exit(1);
   } catch (err) {
@@ -108,7 +108,7 @@ cli.command("agent sessions gc", "Collect old transcripts for this project (dry
 });
 cli.command("mcp <agent>", "Serve an agent as an MCP server over stdio (for desktop MCP clients)").action(async (agent) => {
   try {
-    const { mcpCommand } = await import("../mcp-2RQCKWQR.js");
+    const { mcpCommand } = await import("../mcp-IMY3NUCL.js");
     await mcpCommand(agent);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);

package/dist/{config-support-WQHQIJTA.js → config-support-O4REYSK5.js}

@@ -95,10 +95,41 @@ function warnUnappliedConfig(config, adapter, target, log) {
 ${describeUnappliedConfig(target, dropped)}
 `);
 }
+var UnenforceableRateLimitError = class extends Error {
+  constructor(target) {
+    super(
+      [
+        `Refusing to build for \`${target}\`: theo.config.ts declares a rate limit and this target does not enforce one.`,
+        ``,
+        `  The config reads as protection the deploy will not have. Nothing at runtime reports the`,
+        `  absence, so the first sign is abuse \u2014 which is why this refuses rather than warns.`,
+        ``,
+        `  Two honest ways forward:`,
+        `    \u2022 build for \`node\` and run \`theokit start\`, which applies the limit; or`,
+        `    \u2022 remove \`rateLimit\` from theo.config.ts, so the file states what actually runs.`,
+        ``,
+        `  There is deliberately no flag to keep the key and skip the check: a config that stays`,
+        `  while doing nothing is the state this refusal exists to end (usetheokit/theokit#461).`
+      ].join("\n")
+    );
+    this.target = target;
+  }
+  target;
+  name = "UnenforceableRateLimitError";
+};
+function assertRateLimitEnforceable(config, adapter, target) {
+  const applied = adapter.appliesConfig ?? [];
+  if (applied === "runtime-not-emitted-here") return;
+  if (!isDeclared(config, "rateLimit")) return;
+  if (applied.includes("rateLimit")) return;
+  throw new UnenforceableRateLimitError(target);
+}
 export {
   CONFIG_CONCERNS,
+  UnenforceableRateLimitError,
+  assertRateLimitEnforceable,
   describeUnappliedConfig,
   findUnappliedConfig,
   warnUnappliedConfig
 };
-//# sourceMappingURL=config-support-WQHQIJTA.js.map
+//# sourceMappingURL=config-support-O4REYSK5.js.map

package/dist/{config-support-WQHQIJTA.js.map → config-support-O4REYSK5.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/adapters/config-support.ts"],"sourcesContent":["/**\n * Which configuration a deploy target's emitted handler actually applies.\n *\n * `theo.config.ts` validates `rateLimit`, `security.cors`, `security.csrf`,\n * `security.disallowed` and `serialization` for every target. Applying them is\n * the handler's job, and the six Web-standards adapters build `executeRoute`'s\n * context from a subset of its fields, so the rest fall back to hard-coded\n * defaults on a deployed app (usetheokit/theokit#410). `security.cors` was read\n * only by the dev server until #409 wired it into `theokit start`; the six Web\n * targets still drop it.\n *\n * This module does not fix that. It makes it **audible at build time**: a\n * config key that is parsed and then dropped is named, with the target that\n * drops it and the next action. Silence was the defect — an operator who\n * declares a rate limit and gets none has no reason to look.\n *\n * It warns rather than refuses, deliberately. Refusing would break every\n * deployment that declares `rateLimit` today, and the real fix — wiring a\n * limiter that needs a per-runtime client address — is not a build away\n * (`docs/program/journeys/j07-rate-limit.md` § Correction measured what it\n * costs). Forcing an operator to delete valid configuration in order to ship\n * would trade a silent gap for a loud one that also loses information.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\nimport { nodeAdapter } from './node.js'\nimport type { ConfigConcern, DeployAdapter } from './types.js'\n\n/**\n * The closed set. A concern belongs here when it is (a) declarable in\n * `theo.config.ts` and (b) applied by a request handler rather than at build\n * time — a build-time key cannot be silently dropped by a runtime.\n */\nexport const CONFIG_CONCERNS = [\n  'rateLimit',\n  'cors',\n  'csrf',\n  'disallowed',\n  'serialization',\n  'plugins',\n  'securityHeaders',\n] as const satisfies readonly ConfigConcern[]\n\n/**\n * Does any production target apply this concern?\n *\n * DERIVED from what the `node` adapter declares, rather than listed. This was a hand-maintained\n * `APPLIED_BY_NO_TARGET` set holding `cors`, kept in step with `nodeAdapter.appliesConfig` by a\n * test — and #409, which taught `theokit start` to apply `cors`, emptied it. An empty hardcoded\n * set is not merely redundant: it makes the branch below provably unreachable, which the linter\n * says out loud (`sonarjs/no-empty-collection`).\n *\n * Deriving keeps the branch honest AND reachable: the moment a concern is added that `node` does\n * not apply, the advice stops claiming a target exists for it, with nothing to remember.\n */\nfunction appliedByNoTarget(concern: ConfigConcern): boolean {\n  const applied = nodeAdapter.appliesConfig\n  if (applied === undefined || applied === 'runtime-not-emitted-here') return true\n  return !applied.includes(concern)\n}\n\n/** Where each concern lives in the config, for a message the operator can grep. */\nconst CONFIG_KEY: Record<ConfigConcern, string> = {\n  rateLimit: 'rateLimit',\n  cors: 'security.cors',\n  csrf: 'security.csrf',\n  disallowed: 'security.disallowed',\n  serialization: 'serialization',\n  plugins: 'plugins',\n  securityHeaders: 'security.headers',\n}\n\nfunction isDeclared(config: TheoConfig, concern: ConfigConcern): boolean {\n  const security = config.security\n  switch (concern) {\n    case 'rateLimit':\n      return config.rateLimit !== undefined\n    case 'cors':\n      return security?.cors !== undefined\n    case 'csrf':\n      // `csrf` carries `.default('strict')` (config/schemas/security.ts:100) and\n      // the deployed fallback is also `'strict'` (server/http/execute.ts:144).\n      // A config that says `'strict'` therefore gets what it asked for, by\n      // coincidence rather than by wiring -- reporting it dropped would be noise\n      // over an identical outcome. Only a weaker setting is silently ignored.\n      return security?.csrf !== undefined && security.csrf !== 'strict'\n    case 'disallowed':\n      return security?.disallowed !== undefined && security.disallowed.routes.length > 0\n    case 'securityHeaders':\n      return security?.headers !== undefined\n    case 'serialization':\n      // Same shape: `.default('json')` (config/schema.ts:147), and a target with\n      // no transformer serializes as JSON. `'json'` is honoured by coincidence;\n      // `'superjson'` is the case where the deployed app quietly disagrees with\n      // the file.\n      return config.serialization !== 'json'\n    case 'plugins':\n      return config.plugins !== undefined && config.plugins.length > 0\n  }\n}\n\n/**\n * The concerns this config declares and this adapter does not apply.\n *\n * An adapter that emits no request handler of its own answers\n * `'runtime-not-emitted-here'` and is never reported against: it is not that\n * the configuration is dropped, it is that this build cannot know. Saying\n * nothing is the honest output, and it is a different fact from saying no.\n */\nexport function findUnappliedConfig(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n): ConfigConcern[] {\n  const applied = adapter.appliesConfig ?? []\n  if (applied === 'runtime-not-emitted-here') return []\n  return CONFIG_CONCERNS.filter(\n    (concern) => isDeclared(config, concern) && !applied.includes(concern),\n  )\n}\n\n/**\n * The build-time message. Empty string when nothing was dropped, so the caller\n * neither branches nor prints a header over an empty list.\n */\nexport function describeUnappliedConfig(target: string, dropped: readonly ConfigConcern[]): string {\n  if (dropped.length === 0) return ''\n  const one = dropped.length === 1\n  const list = dropped.map((concern) => `      - ${CONFIG_KEY[concern]}`).join('\\n')\n  const elsewhere = dropped.filter((concern) => !appliedByNoTarget(concern))\n  const nowhere = dropped.filter(appliedByNoTarget)\n\n  // The advice has to change with the target, or it degenerates. Building for\n  // `node` with only `security.cors` dropped once produced \"deploy to `node`,\n  // which applies all of the above except security.cors\" -- an instruction to\n  // do what you are already doing, about the one key it then excepts.\n  const actions: string[] = []\n  if (elsewhere.length > 0 && target !== 'node') {\n    actions.push(\n      `    - ${elsewhere.map((c) => CONFIG_KEY[c]).join(', ')}: build for \\`node\\` and run \\`theokit start\\`,`,\n      `      which applies ${elsewhere.length === 1 ? 'it' : 'them'}; or remove ${elsewhere.length === 1 ? 'it' : 'them'} so the file states what runs.`,\n    )\n  } else if (elsewhere.length > 0) {\n    actions.push(\n      `    - ${elsewhere.map((c) => CONFIG_KEY[c]).join(', ')}: remove ${elsewhere.length === 1 ? 'it' : 'them'} so the file states what runs.`,\n    )\n  }\n  if (nowhere.length > 0) {\n    actions.push(\n      `    - ${nowhere.map((c) => CONFIG_KEY[c]).join(', ')}: no production target applies ${nowhere.length === 1 ? 'this' : 'these'} today`,\n      `      (usetheokit/theokit#409) -- terminate it in front of the app, or remove it.`,\n    )\n  }\n\n  return [\n    `  ! ${String(dropped.length)} configuration ${one ? 'key is' : 'keys are'} validated and NOT applied on \\`${target}\\`:`,\n    list,\n    `    The handler this target emits never reads ${one ? 'it' : 'them'}, so the deployed app`,\n    `    behaves as if ${one ? 'the key were' : 'the keys were'} absent.`,\n    `    What to do:`,\n    ...actions,\n    `    Tracked: usetheokit/theokit#410 (deploy targets), usetheokit/theokit#409 (cors).`,\n  ].join('\\n')\n}\n\n/**\n * Emit the warning, if there is one. The sink is injected so the behaviour is\n * exercisable without driving a whole build: the alternative was a caller that\n * only a full `theokit build` could reach, which in practice means a caller\n * nothing tests.\n */\nexport function warnUnappliedConfig(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n  target: string,\n  log: (message: string) => void,\n): void {\n  const dropped = findUnappliedConfig(config, adapter)\n  if (dropped.length === 0) return\n  log(`\\n${describeUnappliedConfig(target, dropped)}\\n`)\n}\n"],"mappings":";;;;;;;;AAiCO,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAcA,SAAS,kBAAkB,SAAiC;AAC1D,QAAM,UAAU,YAAY;AAC5B,MAAI,YAAY,UAAa,YAAY,2BAA4B,QAAO;AAC5E,SAAO,CAAC,QAAQ,SAAS,OAAO;AAClC;AAGA,IAAM,aAA4C;AAAA,EAChD,WAAW;AAAA,EACX,MAAM;AAAA,EACN,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,SAAS;AAAA,EACT,iBAAiB;AACnB;AAEA,SAAS,WAAW,QAAoB,SAAiC;AACvE,QAAM,WAAW,OAAO;AACxB,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO,OAAO,cAAc;AAAA,IAC9B,KAAK;AACH,aAAO,UAAU,SAAS;AAAA,IAC5B,KAAK;AAMH,aAAO,UAAU,SAAS,UAAa,SAAS,SAAS;AAAA,IAC3D,KAAK;AACH,aAAO,UAAU,eAAe,UAAa,SAAS,WAAW,OAAO,SAAS;AAAA,IACnF,KAAK;AACH,aAAO,UAAU,YAAY;AAAA,IAC/B,KAAK;AAKH,aAAO,OAAO,kBAAkB;AAAA,IAClC,KAAK;AACH,aAAO,OAAO,YAAY,UAAa,OAAO,QAAQ,SAAS;AAAA,EACnE;AACF;AAUO,SAAS,oBACd,QACA,SACiB;AACjB,QAAM,UAAU,QAAQ,iBAAiB,CAAC;AAC1C,MAAI,YAAY,2BAA4B,QAAO,CAAC;AACpD,SAAO,gBAAgB;AAAA,IACrB,CAAC,YAAY,WAAW,QAAQ,OAAO,KAAK,CAAC,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;AAMO,SAAS,wBAAwB,QAAgB,SAA2C;AACjG,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,MAAM,QAAQ,WAAW;AAC/B,QAAM,OAAO,QAAQ,IAAI,CAAC,YAAY,WAAW,WAAW,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AACjF,QAAM,YAAY,QAAQ,OAAO,CAAC,YAAY,CAAC,kBAAkB,OAAO,CAAC;AACzE,QAAM,UAAU,QAAQ,OAAO,iBAAiB;AAMhD,QAAM,UAAoB,CAAC;AAC3B,MAAI,UAAU,SAAS,KAAK,WAAW,QAAQ;AAC7C,YAAQ;AAAA,MACN,SAAS,UAAU,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MACvD,uBAAuB,UAAU,WAAW,IAAI,OAAO,MAAM,eAAe,UAAU,WAAW,IAAI,OAAO,MAAM;AAAA,IACpH;AAAA,EACF,WAAW,UAAU,SAAS,GAAG;AAC/B,YAAQ;AAAA,MACN,SAAS,UAAU,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,YAAY,UAAU,WAAW,IAAI,OAAO,MAAM;AAAA,IAC3G;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ;AAAA,MACN,SAAS,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,kCAAkC,QAAQ,WAAW,IAAI,SAAS,OAAO;AAAA,MAC9H;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,QAAQ,MAAM,CAAC,kBAAkB,MAAM,WAAW,UAAU,mCAAmC,MAAM;AAAA,IACnH;AAAA,IACA,iDAAiD,MAAM,OAAO,MAAM;AAAA,IACpE,qBAAqB,MAAM,iBAAiB,eAAe;AAAA,IAC3D;AAAA,IACA,GAAG;AAAA,IACH;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAQO,SAAS,oBACd,QACA,SACA,QACA,KACM;AACN,QAAM,UAAU,oBAAoB,QAAQ,OAAO;AACnD,MAAI,QAAQ,WAAW,EAAG;AAC1B,MAAI;AAAA,EAAK,wBAAwB,QAAQ,OAAO,CAAC;AAAA,CAAI;AACvD;","names":[]}
+{"version":3,"sources":["../src/adapters/config-support.ts"],"sourcesContent":["/**\n * Which configuration a deploy target's emitted handler actually applies.\n *\n * `theo.config.ts` validates `rateLimit`, `security.cors`, `security.csrf`,\n * `security.disallowed` and `serialization` for every target. Applying them is\n * the handler's job, and the six Web-standards adapters build `executeRoute`'s\n * context from a subset of its fields, so the rest fall back to hard-coded\n * defaults on a deployed app (usetheokit/theokit#410). `security.cors` was read\n * only by the dev server until #409 wired it into `theokit start`; the six Web\n * targets still drop it.\n *\n * This module does not fix that. It makes it **audible at build time**: a\n * config key that is parsed and then dropped is named, with the target that\n * drops it and the next action. Silence was the defect — an operator who\n * declares a rate limit and gets none has no reason to look.\n *\n * It warns rather than refuses, deliberately. Refusing would break every\n * deployment that declares `rateLimit` today, and the real fix — wiring a\n * limiter that needs a per-runtime client address — is not a build away\n * (`docs/program/journeys/j07-rate-limit.md` § Correction measured what it\n * costs). Forcing an operator to delete valid configuration in order to ship\n * would trade a silent gap for a loud one that also loses information.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\nimport { nodeAdapter } from './node.js'\nimport type { ConfigConcern, DeployAdapter } from './types.js'\n\n/**\n * The closed set. A concern belongs here when it is (a) declarable in\n * `theo.config.ts` and (b) applied by a request handler rather than at build\n * time — a build-time key cannot be silently dropped by a runtime.\n */\nexport const CONFIG_CONCERNS = [\n  'rateLimit',\n  'cors',\n  'csrf',\n  'disallowed',\n  'serialization',\n  'plugins',\n  'securityHeaders',\n] as const satisfies readonly ConfigConcern[]\n\n/**\n * Does any production target apply this concern?\n *\n * DERIVED from what the `node` adapter declares, rather than listed. This was a hand-maintained\n * `APPLIED_BY_NO_TARGET` set holding `cors`, kept in step with `nodeAdapter.appliesConfig` by a\n * test — and #409, which taught `theokit start` to apply `cors`, emptied it. An empty hardcoded\n * set is not merely redundant: it makes the branch below provably unreachable, which the linter\n * says out loud (`sonarjs/no-empty-collection`).\n *\n * Deriving keeps the branch honest AND reachable: the moment a concern is added that `node` does\n * not apply, the advice stops claiming a target exists for it, with nothing to remember.\n */\nfunction appliedByNoTarget(concern: ConfigConcern): boolean {\n  const applied = nodeAdapter.appliesConfig\n  if (applied === undefined || applied === 'runtime-not-emitted-here') return true\n  return !applied.includes(concern)\n}\n\n/** Where each concern lives in the config, for a message the operator can grep. */\nconst CONFIG_KEY: Record<ConfigConcern, string> = {\n  rateLimit: 'rateLimit',\n  cors: 'security.cors',\n  csrf: 'security.csrf',\n  disallowed: 'security.disallowed',\n  serialization: 'serialization',\n  plugins: 'plugins',\n  securityHeaders: 'security.headers',\n}\n\nfunction isDeclared(config: TheoConfig, concern: ConfigConcern): boolean {\n  const security = config.security\n  switch (concern) {\n    case 'rateLimit':\n      return config.rateLimit !== undefined\n    case 'cors':\n      return security?.cors !== undefined\n    case 'csrf':\n      // `csrf` carries `.default('strict')` (config/schemas/security.ts:100) and\n      // the deployed fallback is also `'strict'` (server/http/execute.ts:144).\n      // A config that says `'strict'` therefore gets what it asked for, by\n      // coincidence rather than by wiring -- reporting it dropped would be noise\n      // over an identical outcome. Only a weaker setting is silently ignored.\n      return security?.csrf !== undefined && security.csrf !== 'strict'\n    case 'disallowed':\n      return security?.disallowed !== undefined && security.disallowed.routes.length > 0\n    case 'securityHeaders':\n      return security?.headers !== undefined\n    case 'serialization':\n      // Same shape: `.default('json')` (config/schema.ts:147), and a target with\n      // no transformer serializes as JSON. `'json'` is honoured by coincidence;\n      // `'superjson'` is the case where the deployed app quietly disagrees with\n      // the file.\n      return config.serialization !== 'json'\n    case 'plugins':\n      return config.plugins !== undefined && config.plugins.length > 0\n  }\n}\n\n/**\n * The concerns this config declares and this adapter does not apply.\n *\n * An adapter that emits no request handler of its own answers\n * `'runtime-not-emitted-here'` and is never reported against: it is not that\n * the configuration is dropped, it is that this build cannot know. Saying\n * nothing is the honest output, and it is a different fact from saying no.\n */\nexport function findUnappliedConfig(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n): ConfigConcern[] {\n  const applied = adapter.appliesConfig ?? []\n  if (applied === 'runtime-not-emitted-here') return []\n  return CONFIG_CONCERNS.filter(\n    (concern) => isDeclared(config, concern) && !applied.includes(concern),\n  )\n}\n\n/**\n * The build-time message. Empty string when nothing was dropped, so the caller\n * neither branches nor prints a header over an empty list.\n */\nexport function describeUnappliedConfig(target: string, dropped: readonly ConfigConcern[]): string {\n  if (dropped.length === 0) return ''\n  const one = dropped.length === 1\n  const list = dropped.map((concern) => `      - ${CONFIG_KEY[concern]}`).join('\\n')\n  const elsewhere = dropped.filter((concern) => !appliedByNoTarget(concern))\n  const nowhere = dropped.filter(appliedByNoTarget)\n\n  // The advice has to change with the target, or it degenerates. Building for\n  // `node` with only `security.cors` dropped once produced \"deploy to `node`,\n  // which applies all of the above except security.cors\" -- an instruction to\n  // do what you are already doing, about the one key it then excepts.\n  const actions: string[] = []\n  if (elsewhere.length > 0 && target !== 'node') {\n    actions.push(\n      `    - ${elsewhere.map((c) => CONFIG_KEY[c]).join(', ')}: build for \\`node\\` and run \\`theokit start\\`,`,\n      `      which applies ${elsewhere.length === 1 ? 'it' : 'them'}; or remove ${elsewhere.length === 1 ? 'it' : 'them'} so the file states what runs.`,\n    )\n  } else if (elsewhere.length > 0) {\n    actions.push(\n      `    - ${elsewhere.map((c) => CONFIG_KEY[c]).join(', ')}: remove ${elsewhere.length === 1 ? 'it' : 'them'} so the file states what runs.`,\n    )\n  }\n  if (nowhere.length > 0) {\n    actions.push(\n      `    - ${nowhere.map((c) => CONFIG_KEY[c]).join(', ')}: no production target applies ${nowhere.length === 1 ? 'this' : 'these'} today`,\n      `      (usetheokit/theokit#409) -- terminate it in front of the app, or remove it.`,\n    )\n  }\n\n  return [\n    `  ! ${String(dropped.length)} configuration ${one ? 'key is' : 'keys are'} validated and NOT applied on \\`${target}\\`:`,\n    list,\n    `    The handler this target emits never reads ${one ? 'it' : 'them'}, so the deployed app`,\n    `    behaves as if ${one ? 'the key were' : 'the keys were'} absent.`,\n    `    What to do:`,\n    ...actions,\n    `    Tracked: usetheokit/theokit#410 (deploy targets), usetheokit/theokit#409 (cors).`,\n  ].join('\\n')\n}\n\n/**\n * Emit the warning, if there is one. The sink is injected so the behaviour is\n * exercisable without driving a whole build: the alternative was a caller that\n * only a full `theokit build` could reach, which in practice means a caller\n * nothing tests.\n */\nexport function warnUnappliedConfig(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n  target: string,\n  log: (message: string) => void,\n): void {\n  const dropped = findUnappliedConfig(config, adapter)\n  if (dropped.length === 0) return\n  log(`\\n${describeUnappliedConfig(target, dropped)}\\n`)\n}\n\n/**\n * A declared rate limit the chosen target cannot enforce.\n *\n * Its own class so a caller can distinguish it from a configuration typo — this is not the build\n * failing to understand the file, it is the build understanding it and refusing the combination.\n */\nexport class UnenforceableRateLimitError extends Error {\n  override readonly name = 'UnenforceableRateLimitError'\n  constructor(readonly target: string) {\n    super(\n      [\n        `Refusing to build for \\`${target}\\`: theo.config.ts declares a rate limit and this target does not enforce one.`,\n        ``,\n        `  The config reads as protection the deploy will not have. Nothing at runtime reports the`,\n        `  absence, so the first sign is abuse — which is why this refuses rather than warns.`,\n        ``,\n        `  Two honest ways forward:`,\n        `    • build for \\`node\\` and run \\`theokit start\\`, which applies the limit; or`,\n        `    • remove \\`rateLimit\\` from theo.config.ts, so the file states what actually runs.`,\n        ``,\n        `  There is deliberately no flag to keep the key and skip the check: a config that stays`,\n        `  while doing nothing is the state this refusal exists to end (usetheokit/theokit#461).`,\n      ].join('\\n'),\n    )\n  }\n}\n\n/**\n * Refuse a build whose target drops a DECLARED rate limit.\n *\n * Only `rateLimit`, and the narrowness is the design. A dropped `cors` or `serialization` degrades\n * where someone can see it, and `describeUnappliedConfig`'s warning is proportionate for those.\n * `rateLimit` is the one whose absence looks exactly like success, which is the same reasoning\n * `MissingRoutePolicyError` applies to an undeclared route policy: refuse where silence would be\n * read as safety.\n *\n * `'runtime-not-emitted-here'` is not judged. That adapter's runtime is someone else's and this\n * build cannot answer for it; refusing there would be asserting something unmeasured.\n */\nexport function assertRateLimitEnforceable(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n  target: string,\n): void {\n  const applied = adapter.appliesConfig ?? []\n  if (applied === 'runtime-not-emitted-here') return\n  if (!isDeclared(config, 'rateLimit')) return\n  if (applied.includes('rateLimit')) return\n  throw new UnenforceableRateLimitError(target)\n}\n"],"mappings":";;;;;;;;AAiCO,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAcA,SAAS,kBAAkB,SAAiC;AAC1D,QAAM,UAAU,YAAY;AAC5B,MAAI,YAAY,UAAa,YAAY,2BAA4B,QAAO;AAC5E,SAAO,CAAC,QAAQ,SAAS,OAAO;AAClC;AAGA,IAAM,aAA4C;AAAA,EAChD,WAAW;AAAA,EACX,MAAM;AAAA,EACN,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,SAAS;AAAA,EACT,iBAAiB;AACnB;AAEA,SAAS,WAAW,QAAoB,SAAiC;AACvE,QAAM,WAAW,OAAO;AACxB,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO,OAAO,cAAc;AAAA,IAC9B,KAAK;AACH,aAAO,UAAU,SAAS;AAAA,IAC5B,KAAK;AAMH,aAAO,UAAU,SAAS,UAAa,SAAS,SAAS;AAAA,IAC3D,KAAK;AACH,aAAO,UAAU,eAAe,UAAa,SAAS,WAAW,OAAO,SAAS;AAAA,IACnF,KAAK;AACH,aAAO,UAAU,YAAY;AAAA,IAC/B,KAAK;AAKH,aAAO,OAAO,kBAAkB;AAAA,IAClC,KAAK;AACH,aAAO,OAAO,YAAY,UAAa,OAAO,QAAQ,SAAS;AAAA,EACnE;AACF;AAUO,SAAS,oBACd,QACA,SACiB;AACjB,QAAM,UAAU,QAAQ,iBAAiB,CAAC;AAC1C,MAAI,YAAY,2BAA4B,QAAO,CAAC;AACpD,SAAO,gBAAgB;AAAA,IACrB,CAAC,YAAY,WAAW,QAAQ,OAAO,KAAK,CAAC,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;AAMO,SAAS,wBAAwB,QAAgB,SAA2C;AACjG,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,MAAM,QAAQ,WAAW;AAC/B,QAAM,OAAO,QAAQ,IAAI,CAAC,YAAY,WAAW,WAAW,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AACjF,QAAM,YAAY,QAAQ,OAAO,CAAC,YAAY,CAAC,kBAAkB,OAAO,CAAC;AACzE,QAAM,UAAU,QAAQ,OAAO,iBAAiB;AAMhD,QAAM,UAAoB,CAAC;AAC3B,MAAI,UAAU,SAAS,KAAK,WAAW,QAAQ;AAC7C,YAAQ;AAAA,MACN,SAAS,UAAU,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MACvD,uBAAuB,UAAU,WAAW,IAAI,OAAO,MAAM,eAAe,UAAU,WAAW,IAAI,OAAO,MAAM;AAAA,IACpH;AAAA,EACF,WAAW,UAAU,SAAS,GAAG;AAC/B,YAAQ;AAAA,MACN,SAAS,UAAU,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,YAAY,UAAU,WAAW,IAAI,OAAO,MAAM;AAAA,IAC3G;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ;AAAA,MACN,SAAS,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,kCAAkC,QAAQ,WAAW,IAAI,SAAS,OAAO;AAAA,MAC9H;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,QAAQ,MAAM,CAAC,kBAAkB,MAAM,WAAW,UAAU,mCAAmC,MAAM;AAAA,IACnH;AAAA,IACA,iDAAiD,MAAM,OAAO,MAAM;AAAA,IACpE,qBAAqB,MAAM,iBAAiB,eAAe;AAAA,IAC3D;AAAA,IACA,GAAG;AAAA,IACH;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAQO,SAAS,oBACd,QACA,SACA,QACA,KACM;AACN,QAAM,UAAU,oBAAoB,QAAQ,OAAO;AACnD,MAAI,QAAQ,WAAW,EAAG;AAC1B,MAAI;AAAA,EAAK,wBAAwB,QAAQ,OAAO,CAAC;AAAA,CAAI;AACvD;AAQO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAErD,YAAqB,QAAgB;AACnC;AAAA,MACE;AAAA,QACE,2BAA2B,MAAM;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAfmB;AAAA,EAgBrB;AAAA,EAhBqB;AAAA,EADH,OAAO;AAkB3B;AAcO,SAAS,2BACd,QACA,SACA,QACM;AACN,QAAM,UAAU,QAAQ,iBAAiB,CAAC;AAC1C,MAAI,YAAY,2BAA4B;AAC5C,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG;AACtC,MAAI,QAAQ,SAAS,WAAW,EAAG;AACnC,QAAM,IAAI,4BAA4B,MAAM;AAC9C;","names":[]}

package/dist/{controller-swc-transform-T7ZTD55V.js → controller-swc-transform-7EZKG2IS.js}

@@ -1,7 +1,7 @@
 import "./chunk-XTHN6JBX.js";
 
 // src/vite-plugin/controller-swc-transform.ts
-import { resolve } from "path";
+import { resolve } from "node:path";
 import { transformControllerSource } from "@theokit/http";
 function toPosix(p) {
   return p.replace(/\\/g, "/");
@@ -24,4 +24,4 @@ function controllerSwcTransformPlugin(options) {
 export {
   controllerSwcTransformPlugin
 };
-//# sourceMappingURL=controller-swc-transform-T7ZTD55V.js.map
+//# sourceMappingURL=controller-swc-transform-7EZKG2IS.js.map

package/dist/cost-types-BALTuBpG.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Cost tracking types (R0.5.11).
+ *
+ * Phase 5 — Production-Readiness #4: adds `ToolUsageRecord` for per-tool
+ * latency / error tracking via SDK's onToolStart/onToolEnd/onToolError hooks.
+ * Same UsageStorageAdapter handles both via discriminated union.
+ *
+ * EC-9 (SHOULD TEST): backward compat — record() input without `kind` is
+ * normalized to 'llm' by the framework so external adapters from older
+ * versions keep working.
+ */
+/**
+ * Per-LLM-call cost record (existing — gains optional `kind` discriminator).
+ */
+interface UsageRecord {
+    /** Discriminator. Optional for backward-compat; defaults to 'llm'. */
+    kind?: 'llm';
+    /** User identifier (e.g., session userId, tenantId, apiKey hash). */
+    userId: string;
+    /** Model id (e.g., 'claude-sonnet-4-5-20250929'). */
+    model: string;
+    /** Token counts per direction. */
+    tokens: {
+        input: number;
+        output: number;
+    };
+    /** USD cost in fractional dollars. */
+    costUsd: number;
+    /** When the run happened. */
+    timestamp: Date;
+}
+/**
+ * Per-tool-invocation record (Phase 5 — Production-Readiness #4).
+ *
+ * Emitted by `trackAgentTools` on every `onToolEnd` / `onToolError`. The same
+ * `UsageStorageAdapter.record` accepts both record kinds via union.
+ */
+interface ToolUsageRecord {
+    kind: 'tool';
+    userId: string;
+    conversationId: string;
+    toolName: string;
+    /**
+     * Unique per invocation; correlates onToolStart with onToolEnd / onToolError.
+     * EC-16 (DOCUMENT): callId uniqueness is SDK contract — if SDK ever reuses
+     * a callId, `trackAgentTools`'s Map uses last-write-wins (defensive).
+     */
+    callId: string;
+    /** True when the tool handler returned; false when it threw. */
+    success: boolean;
+    /** Milliseconds from onToolStart to onToolEnd / onToolError. */
+    durationMs: number;
+    /** Populated only when success === false. */
+    errorMessage?: string;
+    timestamp: Date;
+}
+interface UsageQuery {
+    userId: string;
+    period: {
+        from: Date;
+        to: Date;
+    };
+}
+interface UsageResult {
+    totalTokens: number;
+    totalCostUsd: number;
+    runs: number;
+}
+interface UsageStorageAdapter {
+    readonly name: string;
+    /**
+     * Record a usage event. Accepts both kinds; framework normalizes input
+     * without `kind` to 'llm' before calling adapter (EC-9 backward compat).
+     */
+    record(input: UsageRecord | ToolUsageRecord): Promise<void>;
+    getUsage(query: UsageQuery): Promise<UsageResult>;
+}
+
+export type { ToolUsageRecord as T, UsageStorageAdapter as U, UsageRecord as a, UsageQuery as b, UsageResult as c };

package/dist/{dev-6KDYNF5E.js → dev-ZNTHPBBN.js}

@@ -11,14 +11,14 @@ import {
 } from "./chunk-KTMQUYED.js";
 import {
   theoPluginAsync
-} from "./chunk-HLDXHDCB.js";
-import "./chunk-6VYF5PMG.js";
+} from "./chunk-5TPBOAAH.js";
+import "./chunk-6PFF5HMY.js";
 import "./chunk-2CVV6CNN.js";
 import "./chunk-3PWQQWT6.js";
 import "./chunk-FDOOBTXJ.js";
 import "./chunk-47MM2JUK.js";
-import "./chunk-IHAQUUT2.js";
-import "./chunk-5YPXXSYY.js";
+import "./chunk-22ZZSUKD.js";
+import "./chunk-35QIWOHT.js";
 import "./chunk-MWWFXYW3.js";
 import "./chunk-RPET332G.js";
 import "./chunk-5VLP3GQ2.js";
@@ -123,4 +123,4 @@ export {
   devCommand,
   startDevServer
 };
-//# sourceMappingURL=dev-6KDYNF5E.js.map
+//# sourceMappingURL=dev-ZNTHPBBN.js.map

package/dist/{dev-emit-W27J3DLU.js → dev-emit-FIQASO3D.js}

@@ -1,15 +1,15 @@
 import {
   generateManifest
-} from "./chunk-I2UN46ZX.js";
+} from "./chunk-XJOU425Y.js";
+import "./chunk-KDP2HURW.js";
 import "./chunk-DV34VG3N.js";
-import "./chunk-IRASEXOG.js";
-import "./chunk-5K4TDLRG.js";
+import "./chunk-SOYOYGWY.js";
 import "./chunk-ZWN3AODA.js";
 import "./chunk-XTHN6JBX.js";
 
 // src/vite-plugin/openapi-emit/emit.ts
-import { mkdirSync, writeFileSync } from "fs";
-import { join } from "path";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 
 // src/vite-plugin/openapi-emit/zod-to-openapi.ts
 import { z } from "zod";
@@ -235,7 +235,7 @@ function applyServerOverride(servers) {
 }
 
 // src/vite-plugin/openapi-emit/load-routes.ts
-import { resolve } from "path";
+import { resolve } from "node:path";
 var HTTP_METHOD_KEYS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
 async function loadRoutesForOpenApi(options) {
   const { serverDir, routes } = options;
@@ -339,4 +339,4 @@ export {
   _resetInFlightForTests,
   reEmitOpenApi
 };
-//# sourceMappingURL=dev-emit-W27J3DLU.js.map
+//# sourceMappingURL=dev-emit-FIQASO3D.js.map