@betterportal/framework 10.1.42 → 10.1.44

package/lib/adapters/h3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"h3.d.ts","sourceRoot":"","sources":["../../src/adapters/h3.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxG,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAwD,MAAM,0BAA0B,CAAC;AAC5I,OAAO,KAAK,EAGV,WAAW,EAIX,mBAAmB,EACnB,oBAAoB,EAIrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AA0B1B,MAAM,WAAW,4BAA4B;IAC3C,0BAA0B,CAAC,EAAE,CAC3B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,uBAAuB,KAChC,yBAAyB,CAAC;IAC/B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yGAAyG;IACzG,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,GAAG,aAAa,GAAG,SAAS,CAAC;IACnI;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,sBAAsB,EAAE,mBAAmB,CAAC,GAAG,OAAO,sBAAsB,EAAE,mBAAmB,CAAC;IAC1K,qEAAqE;IACrE,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC7I;AAOD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE;QACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AA0GD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAKvE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExG;AAuCD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,iBAAiB,EACtB,OAAO,GAAE,4BAAiC,GACzC,IAAI,CA4HN;AA+rCD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,QAAQ,GAAG,SAAS,CAAC;CAChC,GACL,IAAI,CAyCN"}
+{"version":3,"file":"h3.d.ts","sourceRoot":"","sources":["../../src/adapters/h3.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxG,OAAO,KAAK,EAAsB,oBAAoB,EAAE,eAAe,EAAwD,MAAM,0BAA0B,CAAC;AAChK,OAAO,KAAK,EAGV,WAAW,EAIX,mBAAmB,EACnB,oBAAoB,EAIrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,sBAAsB,CAAC;AAErE,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AA0B1B,MAAM,WAAW,4BAA4B;IAC3C,0BAA0B,CAAC,EAAE,CAC3B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,uBAAuB,KAChC,yBAAyB,CAAC;IAC/B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yGAAyG;IACzG,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,GAAG,aAAa,GAAG,SAAS,CAAC;IACnI;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,sBAAsB,EAAE,mBAAmB,CAAC,GAAG,OAAO,sBAAsB,EAAE,mBAAmB,CAAC;IAC1K,qEAAqE;IACrE,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC7I;AAOD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE;QACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AA0GD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAKvE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExG;AA2CD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,iBAAiB,EACtB,OAAO,GAAE,4BAAiC,GACzC,IAAI,CAmGN;AA8wCD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,QAAQ,GAAG,SAAS,CAAC;CAChC,GACL,IAAI,CAyCN"}

package/lib/adapters/h3.js

@@ -145,8 +145,11 @@ function chromeContentTypeParams(chrome) {
     }
     return params.length ? `; ${params.join("; ")}` : "";
 }
-function htmlContentType(themeId, mode, chrome) {
-    return `text/html; theme=${themeId}; mode=${mode}${chromeContentTypeParams(chrome)}`;
+function htmlContentType(mode, chrome) {
+    return `text/html; mode=${mode}${chromeContentTypeParams(chrome)}`;
+}
+function rendererFromEvent(event) {
+    return event.__bpApp?.shell?.renderer;
 }
 // -- Router registration ----------------------------------------------
 /**
@@ -162,7 +165,7 @@ export function createH3Router(registry, app, options = {}) {
         for (const method of route.methods) {
             const register = methodRegistrar(app, method);
             register(route.path, async (event) => {
-                return withRequestObservability(event, route, method, options, (obs) => handleRouteRequest(registry.routes, route, method, event, obs, options));
+                return withRequestObservability(event, route, method, options, (obs) => handleRouteRequest(registry.routes, registry.dependencies ?? {}, route, method, event, obs, options));
             });
         }
         // Streaming routes (createStreamHandler) expose their frame stream at
@@ -198,40 +201,17 @@ export function createH3Router(registry, app, options = {}) {
                     }
                     // Generator path: framework drives the stream.
                     if (typeof result === "object" && result !== null && Symbol.asyncIterator in result) {
-                        // Resolve theme renderer if `?_f=loc.frag` provided. The theme MUST be
-                        // disambiguated - with multiple themes registered, picking the first
-                        // match would silently render another theme's fragment. Prefer the
-                        // theme resolved from request context (__bpThemeId), then an explicit
-                        // `?_theme=` pin; only fall back to a cross-theme scan when exactly one
-                        // theme provides the fragment.
+                        // Renderer identity comes only from the server-resolved app shell.
                         const fragmentKey = rawQuery._f ?? undefined;
                         let sseRender;
                         if (fragmentKey) {
-                            const themeId = event.__bpThemeId
-                                ?? rawQuery._theme;
-                            if (themeId) {
-                                const resolved = resolveRenderer(route, themeId, "fragment", "GET", undefined, fragmentKey);
+                            const renderer = rendererFromEvent(event);
+                            if (renderer) {
+                                const resolved = resolveRenderer(route, renderer, "fragment", "GET", undefined, fragmentKey);
                                 if (resolved?.renderer.sseRender) {
                                     sseRender = resolved.renderer.sseRender;
                                 }
                             }
-                            else {
-                                // No theme context. Only render if the match is unambiguous across
-                                // themes; otherwise leave it to the JSON passthrough rather than guess.
-                                const matches = [];
-                                for (const candidateThemeId of Object.keys(route.themeRenderers)) {
-                                    const resolved = resolveRenderer(route, candidateThemeId, "fragment", "GET", undefined, fragmentKey);
-                                    if (resolved?.renderer.sseRender) {
-                                        matches.push(resolved.renderer.sseRender);
-                                    }
-                                }
-                                if (matches.length === 1) {
-                                    sseRender = matches[0];
-                                }
-                                else if (matches.length > 1) {
-                                    obs?.logger.warn("BP SSE: ambiguous fragment '{fragmentKey}' across {count} themes and no theme context; sending raw ticks", { fragmentKey, count: matches.length });
-                                }
-                            }
                         }
                         const stream = createEventStream(event);
                         const iterable = result;
@@ -322,7 +302,7 @@ function routePathsMatch(left, right) {
         return false;
     return a.every((segment, index) => {
         const other = b[index];
-        return segment === other || segment.startsWith(":") || other.startsWith(":");
+        return segment === other || pathParamName(segment) !== null || pathParamName(other) !== null;
     });
 }
 function routeMountServicePath(routeMount) {
@@ -431,7 +411,45 @@ function createRouteUiAttributes(url, options = {}, form = false) {
         attrs["hx-push-url"] = String(options.push);
     return attrs;
 }
-function createViewRenderContext(route, ctx, theme, mode, kind, key, status) {
+function createElementResolver(extraContext, dependencyAliases) {
+    return (reference) => {
+        if (!reference.fragment.trim())
+            return { unavailable: "fragment_required" };
+        if (reference.service === "shell") {
+            const shellServiceId = extraContext.app.shell?.serviceId;
+            const origin = shellServiceId ? serviceOrigin(extraContext, shellServiceId) : null;
+            if (!shellServiceId || !origin)
+                return { unavailable: "shell_unavailable" };
+            const path = `/.well-known/bp/shell/fragment/${encodeURIComponent(reference.fragment)}`;
+            return { serviceId: shellServiceId, url: appendQuery(path, reference.args?.query, origin) };
+        }
+        if (!reference.path?.startsWith("/"))
+            return { unavailable: "service_path_required" };
+        const pluginId = dependencyAliases[reference.service] ?? reference.service;
+        const serviceIds = new Set(extraContext.tenant.services
+            .filter((service) => service.enabled && (service.serviceId === pluginId || service.id === pluginId))
+            .map((service) => service.id));
+        const mounts = extraContext.app.routes.filter((mount) => {
+            const servicePath = routeMountServicePath(mount);
+            return mount.enabled !== false
+                && serviceIds.has(mount.serviceId)
+                && Boolean(servicePath)
+                && routePathsMatch(servicePath, reference.path);
+        });
+        if (mounts.length !== 1)
+            return { unavailable: mounts.length ? "ambiguous_provider" : "service_unavailable" };
+        const mount = mounts[0];
+        const origin = serviceOrigin(extraContext, mount.serviceId);
+        if (!origin)
+            return { unavailable: "service_unavailable" };
+        const servicePath = fillAppPath(routeMountServicePath(mount), reference.args?.params);
+        return {
+            serviceId: mount.serviceId,
+            url: renderUrl(servicePath, { absolute: true, origin, query: reference.args?.query, fragment: reference.fragment })
+        };
+    };
+}
+function createViewRenderContext(route, ctx, dependencyAliases, renderer, mode, kind, key, status) {
     const current = (options = {}) => renderUrl(ctx.path, options);
     const path = (value, options = {}) => renderUrl(value, options);
     const routeUrl = (viewId, options) => ctx.routeUrl?.(viewId, options) ?? null;
@@ -440,14 +458,15 @@ function createViewRenderContext(route, ctx, theme, mode, kind, key, status) {
     const form = (url, options) => createRouteUiAttributes(url, options, true);
     return {
         request: { method: ctx.method, path: ctx.path, params: ctx.params, query: ctx.query },
-        route: { viewId: route.viewId, path: route.path, theme, mode, kind, key, status },
+        route: { viewId: route.viewId, path: route.path, renderer, mode, kind, key, status },
         url: { current, path, route: routeUrl, uiRoute },
         routeUi: {
             link: ui,
             current: (options = {}) => ui(current(options), options),
             fragment: ui,
             form
-        }
+        },
+        element: createElementResolver(ctx, dependencyAliases)
     };
 }
 function createServiceRouteUrlBuilder(routes, extraContext, currentServiceId) {
@@ -570,7 +589,7 @@ async function withSpan(obs, name, attributes, handler) {
         throw error;
     }
 }
-async function handleRouteRequest(registryRoutes, route, method, event, obs, routerOptions = {}) {
+async function handleRouteRequest(registryRoutes, dependencyAliases, route, method, event, obs, routerOptions = {}) {
     const methodRoute = route.methodRoutes?.[method];
     const handler = methodRoute?.handler ?? route.handlers[method];
     const schemas = methodRoute?.schemas ?? route.schemas;
@@ -673,6 +692,7 @@ async function handleRouteRequest(registryRoutes, route, method, event, obs, rou
         rawEvent: event,
         user: authResult.user,
         serviceCaller: authResult.serviceCaller,
+        callerMode: authResult.callerMode,
         ...extraContext,
         bpHeaders,
         responseHeaders: event.res.headers,
@@ -726,7 +746,7 @@ async function handleRouteRequest(registryRoutes, route, method, event, obs, rou
             description: route.description,
             path: route.path,
             methods: [...route.methods],
-            auth: route.auth,
+            auth: { ...route.auth, callers: [...(route.auth.callers ?? ["user"])] },
             cacheHints: route.cacheHints
         }, 200, {
             "content-type": "application/vnd.betterportal.metadata+json; charset=utf-8"
@@ -755,33 +775,31 @@ async function handleRouteRequest(registryRoutes, route, method, event, obs, rou
     if (representation.kind === "json") {
         return jsonResponse(data, handlerStatus);
     }
-    // HTML - resolve theme from request context (hostname -> app config), Accept header as fallback
-    const themeId = event.__bpThemeId
-        ?? representation.theme;
-    if (!themeId) {
-        logNegotiationFailure(obs, route, method, "theme_not_resolved", {
+    const renderer = rendererFromEvent(event);
+    if (!renderer) {
+        logNegotiationFailure(obs, route, method, "renderer_not_resolved", {
             "http.request.accept": acceptHeader ?? "",
             "bp.representation.kind": representation.kind
         });
-        return jsonResponse({ error: "Theme could not be resolved from app config or request" }, 406);
+        return jsonResponse({ error: "Renderer could not be resolved from the app shell" }, 406);
     }
     // Determine the renderer kind requested
     const fragmentKey = url.searchParams.get("_f") ?? fragmentFromAcceptHeader(acceptHeader);
     const componentId = url.searchParams.get("_c");
     const requestedKind = fragmentKey ? "fragment" : componentId ? "component" : "page";
     const requestedKey = fragmentKey ?? componentId ?? undefined;
-    const renderContext = createViewRenderContext(route, ctx, themeId, representation.mode ?? "page", requestedKind, requestedKey, handlerStatus);
+    const renderContext = createViewRenderContext(route, ctx, dependencyAliases, renderer, representation.mode ?? "page", requestedKind, requestedKey, handlerStatus);
     // Status-specific renderer lookup (any non-undefined status code)
     if (handlerStatus !== 200) {
-        const statusRenderer = resolveStatusRenderer(route, themeId, handlerStatus, requestedKind, requestedKey, method);
+        const statusRenderer = resolveStatusRenderer(route, renderer, handlerStatus, requestedKind, requestedKey, method);
         if (statusRenderer) {
             const html = await withSpan(obs, "bp.view.render", {
                 "bp.route.view_id": route.viewId,
-                "bp.view.theme_id": themeId,
+                "bp.view.renderer": renderer,
                 "bp.view.kind": requestedKind,
                 "bp.view.status": handlerStatus
             }, () => statusRenderer.render(data, renderContext));
-            return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType(themeId, "status", route.chrome));
+            return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType("status", route.chrome));
         }
         // No specific renderer found.
         if (!shouldFallThroughToDefaultRenderer(handlerStatus)) {
@@ -792,67 +810,67 @@ async function handleRouteRequest(registryRoutes, route, method, event, obs, rou
     }
     // Fragment request via `_f` query param or Accept header
     if (fragmentKey) {
-        const resolved = resolveRenderer(route, themeId, "fragment", method, undefined, fragmentKey);
+        const resolved = resolveRenderer(route, renderer, "fragment", method, undefined, fragmentKey);
         if (!resolved) {
             logNegotiationFailure(obs, route, method, "fragment_renderer_not_found", {
                 "http.request.accept": acceptHeader ?? "",
-                "bp.view.theme_id": themeId,
+                "bp.view.renderer": renderer,
                 "bp.view.kind": "fragment",
                 "bp.view.key": fragmentKey
             });
             return jsonResponse({
-                error: `No fragment renderer found for fragment="${fragmentKey}" in theme "${themeId}"`
+                error: `No fragment renderer found for fragment="${fragmentKey}" in renderer "${renderer}"`
             }, 406);
         }
         const html = await withSpan(obs, "bp.view.render", {
             "bp.route.view_id": route.viewId,
-            "bp.view.theme_id": themeId,
+            "bp.view.renderer": renderer,
             "bp.view.kind": "fragment",
             "bp.view.key": fragmentKey
         }, () => resolved.renderer.render(data, renderContext));
-        return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType(themeId, "fragment", route.chrome));
+        return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType("fragment", route.chrome));
     }
     // Component request via `_c` query param
     if (componentId) {
-        const resolved = resolveRenderer(route, themeId, "component", method, componentId);
+        const resolved = resolveRenderer(route, renderer, "component", method, componentId);
         if (!resolved) {
             logNegotiationFailure(obs, route, method, "component_renderer_not_found", {
                 "http.request.accept": acceptHeader ?? "",
-                "bp.view.theme_id": themeId,
+                "bp.view.renderer": renderer,
                 "bp.view.kind": "component",
                 "bp.view.key": componentId
             });
             return jsonResponse({
-                error: `No component renderer found for _c="${componentId}" in theme "${themeId}"`
+                error: `No component renderer found for _c="${componentId}" in renderer "${renderer}"`
             }, 406);
         }
         const html = await withSpan(obs, "bp.view.render", {
             "bp.route.view_id": route.viewId,
-            "bp.view.theme_id": themeId,
+            "bp.view.renderer": renderer,
             "bp.view.kind": "component",
             "bp.view.key": componentId
         }, () => resolved.renderer.render(data, renderContext));
-        return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType(themeId, "fragment", route.chrome));
+        return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType("fragment", route.chrome));
     }
     // Page request - only page renderers allowed
-    const resolved = resolveRenderer(route, themeId, "page", method);
+    const resolved = resolveRenderer(route, renderer, "page", method);
     if (!resolved) {
         logNegotiationFailure(obs, route, method, "page_renderer_not_found", {
             "http.request.accept": acceptHeader ?? "",
-            "bp.view.theme_id": themeId,
+            "bp.view.renderer": renderer,
             "bp.view.kind": "page"
         });
         return jsonResponse({
-            error: `No page renderer found for theme "${themeId}"`
+            error: `No page renderer found for renderer "${renderer}"`
         }, 406);
     }
     const html = await withSpan(obs, "bp.view.render", {
         "bp.route.view_id": route.viewId,
-        "bp.view.theme_id": themeId,
+        "bp.view.renderer": renderer,
         "bp.view.kind": "page"
     }, () => resolved.renderer.render(data, renderContext));
     const mode = representation.mode ?? "page";
-    return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType(themeId, mode, route.chrome));
+    return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType(mode, route.chrome));
 }
 /**
  * Handle representations that stream, returning null for buffered ones so the
@@ -869,16 +887,15 @@ async function handleStreamRepresentation(route, handler, ctx, event, url, metho
     // Fragment/component selectors render over the buffered data set.
     if (url.searchParams.get("_f") || url.searchParams.get("_c"))
         return null;
-    const themeId = event.__bpThemeId
-        ?? representation.theme;
-    if (!themeId)
+    const renderer = rendererFromEvent(event);
+    if (!renderer)
         return null;
-    const streamSet = route.themeRenderers[themeId]?.stream;
+    const streamSet = route.renderers[renderer]?.stream;
     if (!streamSet)
         return null;
     // Full-page request with a page renderer available -> buffered render of the
     // complete data set (crawlers, no-SSE clients). Fragment swaps stream.
-    if (representation.mode === "page" && resolveRenderer(route, themeId, "page", method)) {
+    if (representation.mode === "page" && resolveRenderer(route, renderer, "page", method)) {
         return null;
     }
     const shellCtx = {
@@ -888,10 +905,10 @@ async function handleStreamRepresentation(route, handler, ctx, event, url, metho
     };
     const html = await withSpan(obs, "bp.view.render", {
         "bp.route.view_id": route.viewId,
-        "bp.view.theme_id": themeId,
+        "bp.view.renderer": renderer,
         "bp.view.kind": "stream-shell"
     }, () => streamSet.renderShell(shellCtx));
-    return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), 200, htmlContentType(themeId, "fragment", route.chrome));
+    return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), 200, htmlContentType("fragment", route.chrome));
 }
 /**
  * SSE delivery of the frame stream at `{path}/__sse`. With a theme context and
@@ -926,6 +943,7 @@ async function handleStreamSse(registryRoutes, route, handler, event, obs, route
         rawEvent: event,
         user: authResult.user,
         serviceCaller: authResult.serviceCaller,
+        callerMode: authResult.callerMode,
         ...extraContext,
         serviceId: routerOptions.serviceId,
         routeUrl: createServiceRouteUrlBuilder(registryRoutes, extraContext, routerOptions.serviceId),
@@ -934,9 +952,8 @@ async function handleStreamSse(registryRoutes, route, handler, event, obs, route
         file: fileResponseHelper,
         ...(obs ? { obs } : {})
     };
-    const themeId = event.__bpThemeId
-        ?? rawQuery._theme;
-    const streamSet = themeId ? route.themeRenderers[themeId]?.stream : undefined;
+    const renderer = rendererFromEvent(event);
+    const streamSet = renderer ? route.renderers[renderer]?.stream : undefined;
     const stream = createEventStream(event);
     (async () => {
         try {
@@ -998,45 +1015,87 @@ async function loadAuthContext(event, route, routerOptions, obs) {
  */
 async function resolveRequestAuth(apiAuth, event, authContext, route, method, obs) {
     const required = apiAuth.required;
-    const authHeader = event.req.headers.get("authorization");
-    const bearer = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-    // Step 1: no token
-    if (!bearer) {
+    const primaryHeader = event.req.headers.get("authorization");
+    const secondaryHeader = event.req.headers.get("x-bp-service-authorization");
+    const primary = primaryHeader?.startsWith("Bearer ") ? primaryHeader.slice(7) : null;
+    const secondary = secondaryHeader?.startsWith("Bearer ") ? secondaryHeader.slice(7) : null;
+    const callerMode = secondaryHeader !== null
+        ? "delegated"
+        : primary && isServiceToken(primary)
+            ? "service"
+            : primary
+                ? "user"
+                : undefined;
+    if (!primary || !callerMode) {
         if (required)
             return { status: 401, error: "Authentication required" };
         return { status: 200 };
     }
+    const allowedCallers = apiAuth.callers ?? ["user"];
+    if (!allowedCallers.includes(callerMode)) {
+        if (required)
+            return { status: 403, error: `${callerMode} callers are not allowed` };
+        return { status: 200 };
+    }
     if (!authContext) {
         if (required)
             return { status: 503, error: "Auth context unavailable" };
         return { status: 200 };
     }
-    if (isServiceToken(bearer)) {
-        if (!authContext.serviceVerifier) {
-            if (required)
-                return { status: 503, error: "Service auth context unavailable" };
-            return { status: 200 };
-        }
+    if (callerMode === "user") {
+        return resolveUserRequestAuth(primary, apiAuth, authContext, obs);
+    }
+    const sourceServiceId = event.req.headers.get("x-bp-service-id");
+    const tenantId = event.req.headers.get("x-bp-tenant-id");
+    const appId = event.req.headers.get("x-bp-app-id");
+    if (!sourceServiceId || !tenantId || !appId) {
+        return { status: 401, error: "Service, tenant, and app headers are required for S2S calls" };
+    }
+    if (tenantId !== authContext.tenantId || appId !== authContext.appId) {
+        return { status: 401, error: "S2S headers do not match the resolved tenant/app" };
+    }
+    if (!authContext.serviceVerifier) {
+        if (required)
+            return { status: 503, error: "Service auth context unavailable" };
+        return { status: 200 };
+    }
+    const verifyService = async (token, mode) => {
         try {
-            const claims = await authContext.serviceVerifier.verify(bearer, {
+            return await authContext.serviceVerifier.verify(token, {
                 tenantId: authContext.tenantId,
                 appId: authContext.appId,
                 viewId: route.viewId,
                 method,
+                mode,
+                sourceServiceId,
                 requiredPermissions: apiAuth.permissions.flatMap((requirement) => requirement.permissions)
             });
-            return { status: 200, serviceCaller: claims };
         }
         catch (err) {
             obs?.logger.warn("Service token verification failed: {msg}", { msg: err.message });
-            if (required) {
-                const status = err.status === 403 ? 403 : 401;
-                return { status, error: status === 403 ? "Service access denied" : "Invalid service token" };
-            }
-            return { status: 200 };
+            const status = err.status === 403 ? 403 : 401;
+            return { status, error: status === 403 ? "Service access denied" : "Invalid service token" };
         }
+    };
+    if (callerMode === "service") {
+        const serviceCaller = await verifyService(primary, "service");
+        if ("status" in serviceCaller)
+            return required ? serviceCaller : { status: 200 };
+        return { status: 200, serviceCaller, callerMode };
     }
-    // Step 2-4: verify JWT (signature + double-verify happens inside verifier)
+    if (!secondary || isServiceToken(primary)) {
+        return { status: 401, error: "Delegated calls require a BP user token and a service token" };
+    }
+    const userResult = await resolveUserRequestAuth(primary, apiAuth, authContext, obs);
+    if (userResult.error || !userResult.user)
+        return userResult.error ? userResult : { status: 401, error: "Valid BP user token required" };
+    const serviceCaller = await verifyService(secondary, "delegated");
+    if ("status" in serviceCaller)
+        return required ? serviceCaller : { status: 200 };
+    return { status: 200, user: userResult.user, serviceCaller, callerMode };
+}
+async function resolveUserRequestAuth(bearer, apiAuth, authContext, obs) {
+    const required = apiAuth.required;
     const verifier = authContext.verifier;
     if (!verifier) {
         if (required)
@@ -1060,7 +1119,6 @@ async function resolveRequestAuth(apiAuth, event, authContext, route, method, ob
             return { status: 401, error: "Invalid token" };
         return { status: 200 };
     }
-    // Step 5: tenant binding
     if (claims.tenantId !== authContext.tenantId) {
         obs?.logger.warn("JWT tenantId mismatch: token={t1} request={t2}", {
             t1: claims.tenantId,
@@ -1070,7 +1128,6 @@ async function resolveRequestAuth(apiAuth, event, authContext, route, method, ob
             return { status: 401, error: "Token bound to a different tenant" };
         return { status: 200 };
     }
-    // Step 6: app binding
     if (claims.appId !== authContext.appId) {
         obs?.logger.warn("JWT appId mismatch: token={a1} request={a2}", {
             a1: claims.appId,
@@ -1080,7 +1137,6 @@ async function resolveRequestAuth(apiAuth, event, authContext, route, method, ob
             return { status: 401, error: "Token bound to a different app" };
         return { status: 200 };
     }
-    // Step 7: permission check against app.auth.roles
     if (apiAuth.permissions.length > 0) {
         const hasPlatformRootRole = claims.roles.includes(PLATFORM_ROOT_PERMISSION_ROLE_ID);
         if (hasPlatformRootRole) {
@@ -1089,7 +1145,7 @@ async function resolveRequestAuth(apiAuth, event, authContext, route, method, ob
                 && claims.tenantId === authContext.platformRoot.tenantId
                 && claims.appId === authContext.platformRoot.appId;
             if (rootMatches) {
-                return { status: 200, user: claims };
+                return { status: 200, user: claims, callerMode: "user" };
             }
             obs?.logger.error("Reserved platform-root permission role used outside management app: tenant={tenantId} app={appId} rootTenant={rootTenantId} rootApp={rootAppId}", {
                 tenantId: claims.tenantId,
@@ -1099,15 +1155,13 @@ async function resolveRequestAuth(apiAuth, event, authContext, route, method, ob
             });
         }
         const granted = expandRolesToPermissions(claims.roles, authContext.appAuthConfig);
-        // Grants reference tenant service-instance ids; route requirements are
-        // authored against pluginIds. Treat them as equal via the alias map.
         const aliases = authContext.serviceIdAliases ?? {};
-        const serviceIdsMatch = (grantServiceId, requiredServiceId) => grantServiceId === requiredServiceId ||
-            aliases[grantServiceId] === requiredServiceId ||
-            aliases[requiredServiceId] === grantServiceId;
-        const ok = apiAuth.permissions.every((requirement) => requirement.permissions.every((action) => granted.some((grant) => serviceIdsMatch(grant.serviceId, requirement.serviceId) &&
-            grant.viewId === requirement.viewId &&
-            grant.permissions.includes(action))));
+        const serviceIdsMatch = (grantServiceId, requiredServiceId) => grantServiceId === requiredServiceId
+            || aliases[grantServiceId] === requiredServiceId
+            || aliases[requiredServiceId] === grantServiceId;
+        const ok = apiAuth.permissions.every((requirement) => requirement.permissions.every((action) => granted.some((grant) => serviceIdsMatch(grant.serviceId, requirement.serviceId)
+            && grant.viewId === requirement.viewId
+            && grant.permissions.includes(action))));
         if (!ok) {
             if (required) {
                 return {
@@ -1119,8 +1173,7 @@ async function resolveRequestAuth(apiAuth, event, authContext, route, method, ob
             return { status: 200 };
         }
     }
-    // Step 8: attach validated claims
-    return { status: 200, user: claims };
+    return { status: 200, user: claims, callerMode: "user" };
 }
 function expandRolesToPermissions(roleIds, appAuthConfig) {
     if (!appAuthConfig)
@@ -1171,7 +1224,7 @@ function formatRequiredPermissions(requiredPermissions = []) {
         .join("; ");
 }
 function renderAuthError(route, event, status, message, requiredPermissions = []) {
-    const themeId = event.__bpThemeId;
+    const renderer = rendererFromEvent(event);
     const acceptHeader = acceptHeaderFromEvent(event);
     const representation = resolveRequestedRepresentation(acceptHeader);
     const corsHeaders = corsHeadersFromEvent(event);
@@ -1183,14 +1236,14 @@ function renderAuthError(route, event, status, message, requiredPermissions = []
     // app.auth config and redirects on seeing this 401. Services just report status.
     // Prefer a route/theme status view so the body swaps cleanly into the htmx
     // target as a fragment rather than replacing the shell.
-    if (themeId && (representation.kind === "html")) {
-        const statusRenderer = resolveStatusRenderer(route, themeId, status, "page", undefined, "GET");
+    if (renderer && (representation.kind === "html")) {
+        const statusRenderer = resolveStatusRenderer(route, renderer, status, "page", undefined, "GET");
         if (statusRenderer) {
             try {
                 const html = statusRenderer.render({ error: message, status, requiredPermissions });
                 return new Response(toHtmlString(html), {
                     status,
-                    headers: { ...corsHeaders, "content-type": htmlContentType(themeId, "status", route.chrome) }
+                    headers: { ...corsHeaders, "content-type": htmlContentType("status", route.chrome) }
                 });
             }
             catch {
@@ -1211,7 +1264,7 @@ function renderAuthError(route, event, status, message, requiredPermissions = []
     `;
         return new Response(html, {
             status,
-            headers: { ...corsHeaders, "content-type": themeId ? htmlContentType(themeId, "status", route.chrome) : "text/html; charset=utf-8" }
+            headers: { ...corsHeaders, "content-type": renderer ? htmlContentType("status", route.chrome) : "text/html; charset=utf-8" }
         });
     }
     return jsonResponse({ error: message, status, requiredPermissions }, status, corsHeaders);
@@ -1223,7 +1276,7 @@ function readTenantAppFromEvent(event) {
     return { tenantId: ctx.__bpTenantId, appId: ctx.__bpAppId };
 }
 function renderUpgradeRequired(route, event, validation) {
-    const themeId = event.__bpThemeId;
+    const renderer = rendererFromEvent(event);
     const acceptHeader = acceptHeaderFromEvent(event);
     const representation = resolveRequestedRepresentation(acceptHeader);
     const status = 426;
@@ -1232,8 +1285,8 @@ function renderUpgradeRequired(route, event, validation) {
     if (validation.retryAfterSeconds) {
         extraHeaders["retry-after"] = String(validation.retryAfterSeconds);
     }
-    if (themeId && representation.kind === "html") {
-        const statusRenderer = resolveStatusRenderer(route, themeId, status, "page", undefined, "GET");
+    if (renderer && representation.kind === "html") {
+        const statusRenderer = resolveStatusRenderer(route, renderer, status, "page", undefined, "GET");
         if (statusRenderer) {
             try {
                 const html = statusRenderer.render({
@@ -1241,7 +1294,7 @@ function renderUpgradeRequired(route, event, validation) {
                     reason: validation.reason,
                     upgradeUrl: validation.upgradeUrl
                 });
-                return htmlResponse(toHtmlString(html), status, htmlContentType(themeId, "status", route.chrome));
+                return htmlResponse(toHtmlString(html), status, htmlContentType("status", route.chrome));
             }
             catch {
                 // fall through to JSON