theokit 0.4.0-beta.0 → 0.5.0

package/dist/registry-QHEZ3BWB.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import "./chunk-KT3MWNZG.js";
+
+// src/adapters/registry.ts
+var adapterRegistry = {
+  node: async () => (await import("./node-6I5B6RL3.js")).nodeAdapter,
+  vercel: async () => (await import("./vercel-TKPZK62A.js")).vercelAdapter,
+  cloudflare: async () => (await import("./cloudflare-OJGJ7R2D.js")).cloudflareAdapter,
+  static: async () => (await import("./static-QI5NQT2X.js")).staticAdapter,
+  bun: async () => (await import("./bun-ISHSNFIO.js")).bunAdapter,
+  "deno-deploy": async () => (await import("./deno-deploy-BHWKFTOW.js")).denoDeployAdapter,
+  netlify: async () => (await import("./netlify-GSNSJGMN.js")).netlifyAdapter,
+  "aws-lambda": async () => (await import("./aws-lambda-GKSTX6HD.js")).awsLambdaAdapter,
+  "theo-cloud": async () => (await import("./theo-cloud-RSQCBNXL.js")).theoCloudAdapter
+};
+async function resolveAdapter(target) {
+  const factory = adapterRegistry[target];
+  return factory();
+}
+export {
+  adapterRegistry,
+  resolveAdapter
+};
+//# sourceMappingURL=registry-QHEZ3BWB.js.map

package/dist/{routes-H4SPLFHJ.js → routes-3A4XGIEJ.js}

@@ -5,16 +5,16 @@ import {
 } from "./chunk-XMS5VRIK.js";
 import {
   loadConfig
-} from "./chunk-XP7YXRHO.js";
-import "./chunk-X4JAX2U3.js";
-import "./chunk-WZ7CPVQB.js";
+} from "./chunk-U6TPSW4L.js";
+import "./chunk-4S2UCILN.js";
+import "./chunk-27LWMYNK.js";
 import {
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-OXIQI2XZ.js";
+} from "./chunk-VBZCVFSA.js";
 import {
   scanServerActions
-} from "./chunk-5OFPQK6N.js";
+} from "./chunk-COXLEZCN.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/cli/commands/routes.ts
@@ -63,4 +63,4 @@ async function routesCommand() {
 export {
   routesCommand
 };
-//# sourceMappingURL=routes-H4SPLFHJ.js.map
+//# sourceMappingURL=routes-3A4XGIEJ.js.map

package/dist/{scan-C2BOKLSY.js → scan-NQFI5S7P.js}

@@ -2,9 +2,9 @@
 import "tsx/esm";
 import {
   scanRoutes
-} from "./chunk-O7335ZGH.js";
+} from "./chunk-CG563V5M.js";
 import "./chunk-KT3MWNZG.js";
 export {
   scanRoutes
 };
-//# sourceMappingURL=scan-C2BOKLSY.js.map
+//# sourceMappingURL=scan-NQFI5S7P.js.map

package/dist/scan-NQFI5S7P.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/schema-D3v8VB7o.d.ts

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+
+/**
+ * Wave 2 — Polyglot Services Orchestration (T1.1).
+ *
+ * Declarative `services: {}` primitive for `theo.config.ts`. Each entry
+ * declares an external sidecar process (Python FastAPI / Node Hono) that
+ * boots alongside the TheoKit TS app. Empty `services: {}` is the default
+ * and preserves Wave 1 behavior (no impact on TS-only apps).
+ *
+ * See ADRs 0012-0015 + plan: docs/plans/wave-2-polyglot-services-plan.md
+ */
+
+/**
+ * Single service definition. All commands run from `services/<name>/` cwd.
+ *
+ * EC-4 fix: `proxy` regex requires NON-EMPTY path after `/` (the `+` quantifier)
+ * to reject `/` which would catch-all and conflict with TheoKit's own routing.
+ */
+declare const ServiceDefinitionSchema: z.ZodObject<{
+    runtime: z.ZodEnum<{
+        python: "python";
+        node: "node";
+    }>;
+    type: z.ZodOptional<z.ZodEnum<{
+        server: "server";
+        worker: "worker";
+        frontend: "frontend";
+    }>>;
+    port: z.ZodNumber;
+    proxy: z.ZodString;
+    dev: z.ZodString;
+    build: z.ZodOptional<z.ZodString>;
+    start: z.ZodString;
+    openapi: z.ZodOptional<z.ZodString>;
+    healthcheck: z.ZodDefault<z.ZodString>;
+    cors: z.ZodDefault<z.ZodBoolean>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    dependsOn: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    passSetCookie: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type ServiceDefinition = z.infer<typeof ServiceDefinitionSchema>;
+type ServicesConfig = Record<string, ServiceDefinition>;
+/**
+ * Full services config schema with cross-service refines.
+ *
+ * EC-1 fix: detect duplicate ports across services.
+ * EC-13: empty `dependsOn: []` accepted as no-deps.
+ * Self-dep, missing-ref, and cycles rejected via topological check.
+ */
+declare const servicesConfigSchema: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+    runtime: z.ZodEnum<{
+        python: "python";
+        node: "node";
+    }>;
+    type: z.ZodOptional<z.ZodEnum<{
+        server: "server";
+        worker: "worker";
+        frontend: "frontend";
+    }>>;
+    port: z.ZodNumber;
+    proxy: z.ZodString;
+    dev: z.ZodString;
+    build: z.ZodOptional<z.ZodString>;
+    start: z.ZodString;
+    openapi: z.ZodOptional<z.ZodString>;
+    healthcheck: z.ZodDefault<z.ZodString>;
+    cors: z.ZodDefault<z.ZodBoolean>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    dependsOn: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    passSetCookie: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>>>;
+type ServicesConfigInput = z.input<typeof servicesConfigSchema>;
+type ServicesConfigOutput = z.output<typeof servicesConfigSchema>;
+
+export type { ServicesConfig as S, ServiceDefinition as a, ServicesConfigInput as b, ServicesConfigOutput as c };

package/dist/{schema-VR6YNVLQ.js → schema-KZVOV333.js}

@@ -4,6 +4,7 @@ import {
   cacheSchema,
   corsSchema,
   disallowedConfigSchema,
+  headerSafeString,
   loggingSchema,
   rateLimitSchema,
   securityHeadersSchema,
@@ -11,13 +12,14 @@ import {
   storageSchema,
   theoConfigSchema,
   uploadSchema
-} from "./chunk-X4JAX2U3.js";
-import "./chunk-WZ7CPVQB.js";
+} from "./chunk-4S2UCILN.js";
+import "./chunk-27LWMYNK.js";
 import "./chunk-KT3MWNZG.js";
 export {
   cacheSchema,
   corsSchema,
   disallowedConfigSchema,
+  headerSafeString,
   loggingSchema,
   rateLimitSchema,
   securityHeadersSchema,
@@ -26,4 +28,4 @@ export {
   theoConfigSchema,
   uploadSchema
 };
-//# sourceMappingURL=schema-VR6YNVLQ.js.map
+//# sourceMappingURL=schema-KZVOV333.js.map

package/dist/schema-KZVOV333.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/server/agent/index.d.ts

@@ -0,0 +1,229 @@
+import { a as AgentErrorEvent, A as AgentEvent } from '../../agent-events-B3KNV9ER.js';
+export { b as AgentMessageEvent, e as AgentRunErrorCode, c as AgentToolCallEvent, d as AgentToolResultEvent } from '../../agent-events-B3KNV9ER.js';
+
+/**
+ * Item #4 — `streamAgentRun`
+ *
+ * Adapter that consumes the `@theokit/sdk` `Run.stream()` async generator
+ * (SDKMessage variants) and yields TheoKit `AgentEvent`s suitable for SSE
+ * via `defineAgentEndpoint`. One line at the consumer side:
+ *
+ *   ```ts
+ *   const run = await agent.send(message)
+ *   yield* streamAgentRun(run)
+ *   ```
+ *
+ * Mapping table (SDK → AgentEvent):
+ *
+ * | SDK message                          | AgentEvent yielded                     |
+ * |---|---|
+ * | assistant.content[].type==='text'    | { type: 'message', content }           |
+ * | assistant.content[].type==='tool_use'| (none — covered by tool_call below)    |
+ * | tool_call(status='running')          | { type: 'tool_call', name, args, id }  |
+ * | tool_call(status='completed')        | { type: 'tool_result', name, data, id }|
+ * | tool_call(status='error')            | { type: 'error', message, id }         |
+ * | run.wait() status==='error'          | { type: 'error', message }             |
+ * | run.wait() status==='cancelled'      | (none — cancel ≠ error)                |
+ * | system / user / thinking / status /  | (none — internal SDK telemetry)        |
+ * |   task / request / object_delta      |                                        |
+ *
+ * Abort semantics: when the consumer calls `generator.return()` on the
+ * outer `defineAgentEndpoint` generator, `streamAgentRun` exits the
+ * `for await` loop and does NOT call `run.wait()`. Cleanup of in-flight
+ * SDK resources is the SDK consumer's responsibility (`run.cancel()`).
+ */
+/**
+ * Local mirror of the SDK's `Run` interface — only the surfaces we consume.
+ * The message contract is minimal (just `{ type: string }`) so the SDK's
+ * `SDKMessage` discriminated union IS structurally assignable without any
+ * cast at the consumer site (covariant — TS accepts the SDK's typed message
+ * as the wider `{ type: string }`). Property access inside `streamAgentRun`
+ * narrows via runtime type guards.
+ *
+ * `import type` from `@theokit/sdk` would couple TheoKit to the SDK at type-
+ * resolution time even for consumers who never use the agent surface.
+ */
+interface AgentRunLike {
+    stream: () => AsyncIterable<{
+        type: string;
+    }>;
+    wait: () => Promise<AgentRunResult>;
+}
+/**
+ * Re-exported as a convenience for test fixtures. Production code typically
+ * passes an SDK `Run` directly (structural match via `{ type: string }`).
+ */
+type AgentRunStreamMessage = {
+    type: 'assistant';
+    message: {
+        role: 'assistant';
+        content: {
+            type: string;
+            text?: string;
+        }[];
+    };
+} | {
+    type: 'tool_call';
+    name: string;
+    status: 'running' | 'completed' | 'error';
+    args?: unknown;
+    result?: unknown;
+    call_id: string;
+} | {
+    type: string;
+    [k: string]: unknown;
+};
+/** Subset of the SDK `RunResult` we consume. */
+interface AgentRunResult {
+    status: 'finished' | 'error' | 'cancelled';
+    error?: {
+        message: string;
+        code?: string;
+        cause?: unknown;
+    };
+}
+/**
+ * Map an SDK error to the AgentErrorEvent shape. Pure function — easy to test.
+ *
+ * Backward compat (D4): non-AgentRunError throws yield only `message` field
+ * (legacy shape); discriminated fields stay `undefined`.
+ *
+ * Return type is the specific `AgentErrorEvent` (not the union) for ergonomic
+ * call-site access — `errorToEvent(err).code` works without narrowing.
+ */
+declare function errorToEvent(err: unknown, id?: string): AgentErrorEvent;
+declare function streamAgentRun(run: AgentRunLike): AsyncGenerator<AgentEvent, void, unknown>;
+
+/**
+ * Item #5 — `createConversationHistory`
+ *
+ * Orchestrator that resolves a stable `agentId` from (explicit → session →
+ * cookie → fresh UUID), then returns an `@theokit/sdk` `Agent` via
+ * `Agent.getOrCreate(agentId, options)`. Conversation turns auto-persist in
+ * `<cwd>/.theokit/agents/<agentId>/messages.jsonl` — SDK owns the storage
+ * (ADR D1). `MemorySettings` (facts recall layer) is opt-in passthrough via
+ * `options.memory` (ADR D2).
+ *
+ * Security: agentId from cookie/explicit is attacker-controlled. The SDK
+ * uses it as a filesystem path component AND we serialize it into Set-Cookie.
+ * EC-1 enforces a strict regex `^[a-zA-Z0-9_-]{1,128}$` at every entry point;
+ * invalid values fall through (treated as "missing") rather than throw.
+ */
+/**
+ * Minimum surface of an SDK Agent that consumers care about post-creation.
+ * Structural match — any object with `send` + `dispose` of compatible
+ * shape works. `send` returns a `SdkRunLike` (a Run-shaped object) that
+ * `streamAgentRun` can consume. Permissive `unknown` for now; consumers
+ * who want stricter types can cast to the SDK's own types.
+ *
+ * **T5.2 (architecture-cleanup) — DP-7 decision: KEEP (Opt B).** The 5 duck-typed
+ * mirrors below were flagged as "over-engineered" by the 2026-05-27 architecture
+ * review. Decision: KEEP them because `@theokit/sdk` is `devDependency` (not
+ * required at runtime for consumers that don't use agent features). Removing
+ * the mirrors would force a hard runtime dep on the SDK, breaking consumers
+ * who build TheoKit apps without the agent layer.
+ *
+ * @kept Defensive duck-type. Do NOT replace with direct SDK type imports unless
+ *   `@theokit/sdk` is promoted from devDependency to dependency. If promoting,
+ *   ALSO drop the mirrors (Opt A from the architecture-cleanup plan T5.2).
+ */
+interface SdkRunLike {
+    stream: () => AsyncIterable<{
+        type: string;
+    }>;
+    wait: () => Promise<{
+        status: 'finished' | 'error' | 'cancelled';
+        error?: {
+            message: string;
+        };
+    }>;
+}
+interface SdkAgent {
+    send: (message: string, options?: unknown) => Promise<SdkRunLike>;
+    dispose: () => Promise<void>;
+}
+/**
+ * Phase 2 — structural duck-type of `@theokit/sdk`'s `ConversationStorageAdapter`.
+ *
+ * D2 (decoupling): we mirror the SDK's shape locally rather than hard-import
+ * the SDK type. This lets consumers pass any object matching the structural
+ * contract (own implementation, SDK's `FileSystemConversationStorage`,
+ * `InMemoryConversationStorage`, or a Postgres/Redis recipe).
+ *
+ * EC-5 (SHOULD TEST — sync drift detection): the SDK type MUST be assignable
+ * to this interface AND vice-versa. A contract test asserts both directions.
+ *
+ * `unknown` for the message payload avoids coupling to the SDK's `SDKMessage`
+ * shape. Real consumers cast at the call site if they need stricter types.
+ */
+interface ConversationStorageLike {
+    getMessages(conversationId: string): Promise<readonly unknown[]>;
+    appendMessage(conversationId: string, message: unknown): Promise<void>;
+    deleteConversation(conversationId: string): Promise<void>;
+    listConversationIds?(opts?: {
+        limit?: number;
+    }): Promise<readonly string[] | undefined>;
+    dispose?(): Promise<void>;
+}
+/**
+ * Minimum surface of `AgentOptions` accepted by `Agent.getOrCreate`. Forward-
+ * compatible: callers pass whatever the SDK supports (memory, tools, etc.).
+ *
+ * Phase 2 adds typed `conversationStorage` slot. The index signature still
+ * passes everything else opaquely.
+ */
+interface SdkAgentOptions {
+    apiKey?: string;
+    model?: {
+        id: string;
+    };
+    tools?: readonly unknown[];
+    memory?: Record<string, unknown>;
+    /**
+     * Phase 2 (Production-Readiness #1) — pluggable conversation persistence.
+     * Default (when omitted): SDK falls back to `FileSystemConversationStorage`.
+     * Required for serverless / multi-host deploys.
+     */
+    conversationStorage?: ConversationStorageLike;
+    [key: string]: unknown;
+}
+interface ConversationHistoryArgs {
+    /** Request — for reading the conversation cookie. */
+    request: Request | {
+        headers?: {
+            cookie?: string;
+        } | Headers;
+    };
+    /**
+     * Response-like surface that accepts a `Set-Cookie` header. The primitive
+     * appends a Set-Cookie line when issuing a new conversation id. If absent,
+     * the primitive still reads the existing cookie but cannot issue a new
+     * one — useful for read-only contexts.
+     */
+    response?: {
+        headers: Headers;
+    };
+    /** Explicit override — wins over session/cookie/uuid (ADR D3 step 1). */
+    agentId?: string;
+    /** Auth session containing a `conversationId` field — ADR D3 step 2. */
+    session?: {
+        conversationId?: string;
+    } | null;
+    /** SDK AgentOptions forwarded to Agent.getOrCreate. apiKey + model required. */
+    options: SdkAgentOptions;
+    /** Cookie name override. Default: 'theo_conversation'. */
+    cookieName?: string;
+    /** Cookie max-age in seconds. Default + min: 30 days. Non-positive coerced to default (EC-4). */
+    cookieMaxAge?: number;
+}
+interface ConversationHistoryResult {
+    /** The SDK Agent, ready to receive `agent.send(message)`. */
+    agent: SdkAgent;
+    /** The resolved conversation id (useful for logging / debugging). */
+    conversationId: string;
+    /** True when the id was newly generated (no prior cookie / session). */
+    isNew: boolean;
+}
+declare function createConversationHistory(args: ConversationHistoryArgs): Promise<ConversationHistoryResult>;
+
+export { AgentErrorEvent, AgentEvent, type AgentRunLike, type AgentRunResult, type AgentRunStreamMessage, type ConversationHistoryArgs, type ConversationHistoryResult, type ConversationStorageLike, type SdkAgent, type SdkAgentOptions, type SdkRunLike, createConversationHistory, errorToEvent, streamAgentRun };

package/dist/server/agent/index.js

@@ -0,0 +1,16 @@
+import {
+  __resetSdkForTests,
+  __setSdkForTests,
+  createConversationHistory,
+  errorToEvent,
+  streamAgentRun
+} from "../../chunk-RESN62GB.js";
+import "../../chunk-DGUM43GV.js";
+export {
+  __resetSdkForTests,
+  __setSdkForTests,
+  createConversationHistory,
+  errorToEvent,
+  streamAgentRun
+};
+//# sourceMappingURL=index.js.map

package/dist/server/agent/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/server/auth/index.d.ts

@@ -49,6 +49,51 @@ interface SessionManager<TSession> {
     rotateSession(req: IncomingMessage, res: ServerResponse): Promise<TSession | null>;
 }
 declare function createSessionManager<TSession>(config: SessionConfig): SessionManager<TSession>;
+/**
+ * T5a.2 Phase D slice 3/3 — Web-Standards session manager.
+ *
+ * Mirror of `SessionManager<TSession>` for the Web `Request` + `Headers`
+ * shape. Same `SessionConfig`, same encryption (`encrypt`/`decrypt` from
+ * `./crypto.js`), same dual-key rotation logic (CR-002 constant-time
+ * decrypt fallback walk + transparent re-encrypt), same OWASP A07
+ * `rotateSession` invariant.
+ *
+ * **Signature differences vs `SessionManager`:**
+ *   - Read methods take `Request` (instead of `IncomingMessage`).
+ *   - Write methods take a `Headers` instance to mutate (instead of
+ *     `ServerResponse`) — caller passes the headers they're building
+ *     for their `Response` constructor.
+ *
+ * Uses `getCookieFromRequest` / `appendCookieToHeaders` /
+ * `appendDeleteCookieToHeaders` from Phase B slice 6/6.
+ */
+interface SessionManagerWeb<TSession> {
+    getSession(request: Request): Promise<TSession | null>;
+    getSessionWithMeta(request: Request): Promise<{
+        data: TSession | null;
+        meta: SessionMeta;
+    }>;
+    createSession(target: Headers, data: TSession): Promise<void>;
+    destroySession(target: Headers): void;
+    rotateSession(request: Request, target: Headers): Promise<TSession | null>;
+}
+declare function createSessionManagerWeb<TSession>(config: SessionConfig): SessionManagerWeb<TSession>;
+/**
+ * T5a.2 Phase D slice 3/3 — Web-Standards transparent re-encrypt helper.
+ *
+ * Mirror of `rotateIfNeeded(sm, req, res)` for the Web Request + Headers
+ * shape. Reads session via `getSessionWithMeta`; if the cookie was
+ * decrypted with a legacy secret (index > 0), re-issues the cookie with
+ * the newest secret via `createSession(target, data)`.
+ *
+ * **EC-4 honest framing:** unlike the IncomingMessage path where the
+ * timing constraint is "before `res.writeHead` fires", the Web Request
+ * path's constraint is "before the `Response` object is constructed and
+ * returned to the runtime". Caller MUST invoke `rotateIfNeededWeb`
+ * BEFORE building the final `Response(body, { headers: target })` so the
+ * re-encrypted Set-Cookie lands on the wire.
+ */
+declare function rotateIfNeededWeb<TSession>(sm: SessionManagerWeb<TSession>, request: Request, target: Headers): Promise<TSession | null>;
 /**
  * T3.2 — Transparent re-encrypt helper (EC-4 timing-safe wrapper).
  *
@@ -371,4 +416,4 @@ declare function clearOidcCache(): void;
  */
 declare function discoverOidcProvider(issuer: string | URL): Promise<OidcMetadata>;
 
-export { AuthRequiredError, type BackupCode, type BackupCodeOptions, type OidcMetadata, type PkceChallenge, type SessionConfig, type SessionManager, type SessionMeta, type ThrottleOptions, type ThrottleState, type TotpAlgorithm, type TotpOptions, type TotpUriOptions, type VerifyTotpOptions, _resetKeyCacheForTests, assertProductionSecret, checkThrottle, clearOidcCache, createSessionManager, decrypt, discoverOidcProvider, encrypt, generateBackupCodes, generateNonce, generateOAuthState, generatePkceChallenge, generateTotp, generateTotpSecret, pkceChallengeFromVerifier, recordAttempt, requireAuth, rotateIfNeeded, totpUri, verifyBackupCode, verifyOAuthState, verifyTotp };
+export { AuthRequiredError, type BackupCode, type BackupCodeOptions, type OidcMetadata, type PkceChallenge, type SessionConfig, type SessionManager, type SessionManagerWeb, type SessionMeta, type ThrottleOptions, type ThrottleState, type TotpAlgorithm, type TotpOptions, type TotpUriOptions, type VerifyTotpOptions, _resetKeyCacheForTests, assertProductionSecret, checkThrottle, clearOidcCache, createSessionManager, createSessionManagerWeb, decrypt, discoverOidcProvider, encrypt, generateBackupCodes, generateNonce, generateOAuthState, generatePkceChallenge, generateTotp, generateTotpSecret, pkceChallengeFromVerifier, recordAttempt, requireAuth, rotateIfNeeded, rotateIfNeededWeb, totpUri, verifyBackupCode, verifyOAuthState, verifyTotp };

package/dist/server/auth/index.js

@@ -4,6 +4,7 @@ import {
   checkThrottle,
   clearOidcCache,
   createSessionManager,
+  createSessionManagerWeb,
   decrypt,
   discoverOidcProvider,
   encrypt,
@@ -15,16 +16,20 @@ import {
   pkceChallengeFromVerifier,
   recordAttempt,
   rotateIfNeeded,
+  rotateIfNeededWeb,
   totpUri,
   verifyBackupCode,
   verifyOAuthState,
   verifyTotp
-} from "../../chunk-VRHXOKRP.js";
+} from "../../chunk-NZXH2LQQ.js";
+import {
+  generateNonce
+} from "../../chunk-C3ZZ56YZ.js";
+import "../../chunk-ZJQ4O76G.js";
 import {
   AuthRequiredError,
-  generateNonce,
   requireAuth
-} from "../../chunk-PB4GR7EP.js";
+} from "../../chunk-4HBI7DHP.js";
 import "../../chunk-DGUM43GV.js";
 export {
   AuthRequiredError,
@@ -33,6 +38,7 @@ export {
   checkThrottle,
   clearOidcCache,
   createSessionManager,
+  createSessionManagerWeb,
   decrypt,
   discoverOidcProvider,
   encrypt,
@@ -46,6 +52,7 @@ export {
   recordAttempt,
   requireAuth,
   rotateIfNeeded,
+  rotateIfNeededWeb,
   totpUri,
   verifyBackupCode,
   verifyOAuthState,

package/dist/server/cost/index.d.ts

@@ -1,4 +1,4 @@
-import { c as StorageAdapter } from '../../storage-types-DtIVejC1.js';
+import { d as StorageAdapter } from '../../storage-types-DsDTCPbp.js';
 
 /**
  * Cost tracking types (R0.5.11).
@@ -147,8 +147,6 @@ declare class InMemoryUsageStorage implements UsageStorageAdapter, StorageAdapte
     dispose(): Promise<void>;
     record(input: UsageRecord | ToolUsageRecord): Promise<void>;
     getUsage(query: UsageQuery): Promise<UsageResult>;
-    /** @internal — test helper to inspect raw record stream */
-    __getRecords(): readonly (UsageRecord | ToolUsageRecord)[];
 }
 
 interface TrackAgentToolsOptions {

package/dist/server/cost/index.js

@@ -2,7 +2,7 @@ import {
   InMemoryUsageStorage,
   trackAgentRun,
   trackAgentTools
-} from "../../chunk-64JI5LTO.js";
+} from "../../chunk-RMU7EBRO.js";
 import "../../chunk-DGUM43GV.js";
 export {
   InMemoryUsageStorage,

package/dist/server/cron/index.js

@@ -13,8 +13,10 @@ import {
   translateCronToVercel,
   validateCronSchedule,
   writeCronManifest
-} from "../../chunk-4QTKSLTO.js";
-import "../../chunk-YLBSSEHX.js";
+} from "../../chunk-K4M64WD6.js";
+import "../../chunk-Y4H3JNVK.js";
+import "../../chunk-6NEXVBPY.js";
+import "../../chunk-7MQOHNHE.js";
 import "../../chunk-X2VVCJ4V.js";
 import "../../chunk-DGUM43GV.js";
 export {