create-theokit 1.23.7 → 1.23.10

package/templates/default/dot-claude/skills/theokit-routes/SKILL.md

@@ -17,6 +17,7 @@ import { z } from 'zod'
 
 // GET handler — no body, optional params/query
 export const GET = defineRoute({
+  policy: 'public',                              // who may call it — required
   params: z.object({ id: z.coerce.number() }),   // URL params
   query: z.object({ page: z.coerce.number().optional() }), // Query string
   handler: ({ params, query }) => {
@@ -26,6 +27,7 @@ export const GET = defineRoute({
 
 // POST handler — with body validation + custom status
 export const POST = defineRoute({
+  policy: ({ subject }) => subject !== null,     // any authenticated caller
   body: z.object({
     title: z.string().min(3),
     done: z.boolean().default(false),
@@ -38,10 +40,26 @@ export const POST = defineRoute({
 })
 
 // PUT, DELETE follow the same pattern
-export const PUT = defineRoute({ body: z.object({...}), handler: ({body, params}) => {...} })
-export const DELETE = defineRoute({ params: z.object({id: z.coerce.number()}), handler: ({params}) => {...} })
+export const PUT = defineRoute({ policy: 'public', body: z.object({...}), handler: ({body, params}) => {...} })
+export const DELETE = defineRoute({ policy: 'public', params: z.object({id: z.coerce.number()}), handler: ({params}) => {...} })
 ```
 
+## policy — who may call this route
+
+Required on every exported method. The scanner refuses a route file that omits it and names the
+file, so absence is a build error rather than a route silently open to everyone.
+
+```typescript
+policy: 'public'                                          // open, and said out loud
+policy: ({ subject }) => subject !== null                 // any authenticated caller
+policy: ({ subject, params }) =>
+  requireOwner(subject, ownerOf(params.id))               // this subject owns this record
+```
+
+`requireOwner` comes from `theokit/server`. The policy is evaluated identically over HTTP and
+in-process, so a desktop or terminal surface gets the same answer a browser does. It receives no
+headers and no cookies: identity arrives as `subject`, established by the transport.
+
 ## File-to-URL Mapping
 
 | File path | URL | Notes |
@@ -71,6 +89,7 @@ export const createTask = defineAction({
 import { TheoError } from 'theokit'
 
 export const GET = defineRoute({
+  policy: 'public',
   handler: ({ params }) => {
     const task = db.select().from(tasks).where(eq(tasks.id, params.id)).get()
     if (!task) throw new TheoError({ code: 'NOT_FOUND', message: 'Task not found' })

package/templates/default/dot-claude/skills/theokit-ui/SKILL.md

@@ -25,8 +25,8 @@ paths:
 npm install @theokit/ui
 
 # Or from local tarball (when using source repo)
-cd ../theo-ui && npm pack    # produces theokit-ui-X.Y.Z.tgz
-cd ../my-app && npm install ../theo-ui/theokit-ui-X.Y.Z.tgz
+cd ../theokit-ui && npm pack    # produces theokit-ui-X.Y.Z.tgz
+cd ../my-app && npm install ../theokit-ui/theokit-ui-X.Y.Z.tgz
 ```
 
 **WARNING: NEVER use `npm link ../theo-ui` or `file:../theo-ui`.** The symlink exposes the sibling's nested `node_modules/react` (typically a different version), causing dual-React: "React Element from an older version" errors, broken hooks (`useState` null), and silent render failures. `resolve.dedupe` in Vite does NOT fix this — the pnpm structure physically has two React copies. Use tarball (`npm pack` → `npm install .tgz`) instead.
@@ -160,6 +160,6 @@ const myTheme = defineTheme({
 - NEVER build a custom markdown renderer — `ChatMessageContent` handles it (including streaming partial fences)
 - NEVER build a custom code highlighter — `CodeBlock` (from `@usetheo/ui`) uses shiki (lazy-loaded)
 - Import AI-agent-surface components (ChatThread, ChatMessage, ToolCallCard, etc.) from `@theokit/ui`; import generic primitives (Button, Input, CodeBlock, PageShell, Sidebar, Avatar, Alert) from `@usetheo/ui` — both are live packages since the 2026-07-03 pivot (`@theokit/ui` depends on `@usetheo/ui`)
-- NEVER use `npm link` or `file:../theo-ui` to install — causes dual-React (use tarball or npm registry)
+- NEVER use `npm link` or `file:../theokit-ui` to install — causes dual-React (use tarball or npm registry)
 - NEVER install ALL peer deps — only install the peers for components you actually use
 - NEVER use components without wrapping in `TheoUIProvider` + `ThemeProvider` first

package/templates/default/eslint.config.mjs

@@ -12,14 +12,14 @@ export default tseslint.config(
     },
   },
   {
-    // Arquivos de declaração carregam as augmentações de módulo do TheoKit — `JobRegistry` em
-    // `types/jobs.d.ts` nasce VAZIA de propósito, para o app preencher conforme cria jobs. Sem esta
-    // exceção, um app recém-scaffoldado reprova no próprio `npm run lint` no minuto zero (#93), e a
-    // primeira lição que o TheoKit dá é que o gate dele mente.
+    // Declaration files carry TheoKit's module augmentations — `JobRegistry` in `types/jobs.d.ts`
+    // is born EMPTY on purpose, for the app to fill in as it creates jobs. Without this exception, a
+    // freshly scaffolded app fails its own `npm run lint` at minute zero (#93), and the first lesson
+    // TheoKit teaches is that its gate lies.
     //
-    // `allowInterfaces: 'always'` em vez de desligar a regra: interface vazia é a forma canônica de
-    // declaration merging, mas `type X = {}` continua sendo acusado — e esse ainda é um erro de
-    // verdade, porque `{}` aceita qualquer valor não-nulo, inclusive `0` e `""`.
+    // `allowInterfaces: 'always'` rather than disabling the rule: an empty interface is the canonical
+    // form of declaration merging, but `type X = {}` is still flagged — and that one is a real error,
+    // because `{}` accepts any non-null value, including `0` and `""`.
     files: ['**/*.d.ts'],
     rules: {
       '@typescript-eslint/no-empty-object-type': ['error', { allowInterfaces: 'always' }],

package/templates/default/index.html

@@ -1,13 +1,13 @@
-<!DOCTYPE html>
+<!doctype html>
 <html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>TheoKit App</title>
-  <meta name="description" content="Built with TheoKit — the app your agent lives in" />
-  <link rel="icon" href="/favicon.svg" />
-</head>
-<body>
-  <div id="root"></div>
-</body>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>TheoKit App</title>
+    <meta name="description" content="Built with TheoKit — the app your agent lives in" />
+    <link rel="icon" href="/favicon.svg" />
+  </head>
+  <body>
+    <div id="root"></div>
+  </body>
 </html>

package/templates/default/package.json.tmpl

@@ -7,6 +7,7 @@
     "dev": "theokit dev",
     "build": "theokit build",
     "start": "theokit start",
+    "preview": "theokit preview",
     "test": "vitest run",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
@@ -15,10 +16,10 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "theokit": "^0.46.1",
-    "@theokit/agents": "^7.3.1",
-    "@theokit/sdk": "^4.0.1",
-    "@theokit/ui": "^1.0.0",
+    "theokit": "^0.50.0",
+    "@theokit/agents": "^10.1.0",
+    "@theokit/sdk": "^4.52.1",
+    "@theokit/ui": "^1.1.0",
     "@usetheo/ui": "^0.26.0",
     "lucide-react": "^0.469.0",
     "react": "^19.0.0",
@@ -40,12 +41,5 @@
     "typescript": "^5.5.0",
     "typescript-eslint": "^8.0.0",
     "vitest": "^3.0.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild",
-      "better-sqlite3",
-      "workerd"
-    ]
   }
 }

package/templates/default/pnpm-workspace.yaml

@@ -0,0 +1,21 @@
+# Build scripts this project allows its dependencies to run.
+#
+# pnpm 10 refuses to run a dependency's install script unless it is approved here,
+# and it stopped reading the `pnpm` field in package.json — where this list used to
+# live, silently doing nothing while every install printed a warning about it
+# (usetheokit/theokit#397). Without these entries, `pnpm install` ends in
+# ERR_PNPM_IGNORED_BUILDS with esbuild and node-pty unbuilt.
+#
+# Each entry is a decision, not boilerplate: an install script runs arbitrary code
+# on your machine. These are the ones this scaffold needs.
+allowBuilds:
+  # The bundler behind `theokit dev` and `theokit build`; ships a platform binary.
+  esbuild: true
+  # A native terminal, reached through @theokit/agents. Compiles or downloads a
+  # prebuild on install. A web-only app never opens one — see usetheokit/theokit#25
+  # if you would rather not pay for it.
+  node-pty: true
+  # Present only if you add them; harmless entries otherwise, and here so the
+  # decision is already made the day you do.
+  better-sqlite3: true
+  workerd: true