theokit 0.43.7 → 0.44.3

package/dist/router-6MAACS25.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/migrate/router.ts","../src/cli/commands/migrate/router-codemod.ts"],"sourcesContent":["/**\n * G6 T2.1 — `theokit migrate router` CLI subcommand.\n *\n * Plan: .claude/knowledge-base/plans/g6-router-convention-plan.md v1.1\n *\n * Wraps the pure `planRouterMigration` with side effects:\n *   - EC-2: pre-flight `isPortInUse(3000|3100)` warning to prevent the\n *     dev-server HMR cascade described in the edge-case review.\n *   - EC-7: partial failure produces a typed `RouterMigrationPartialFailure`\n *     with `filesAlreadyMigrated` so a re-run can continue from where it\n *     stopped (idempotent by virtue of `planRouterMigration`).\n *   - Prefers `git mv $from $to` so the rename appears as a single\n *     history entry; falls back to `mkdir -p $(dirname $to) && fs.rename`\n *     when not in a git repo or git mv fails.\n */\nimport { execFileSync } from 'node:child_process'\nimport { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'\nimport { createServer } from 'node:net'\nimport { dirname, resolve } from 'node:path'\n\nimport {\n  computeDepthDelta,\n  planRouterMigration,\n  rewriteRelativeImports,\n  type RouterMigrationPlanItem,\n} from './router-codemod.js'\n\ninterface RouterMigrateOptions {\n  /** Absolute path to `<project>/server/routes`. Defaults to `<cwd>/server/routes`. */\n  routesDir?: string\n  /**\n   * Skip the EC-2 dev-server port pre-flight check (CI / non-TTY).\n   * Default: false.\n   */\n  force?: boolean\n  /** When true, prints the plan but performs no renames (dry-run). */\n  dryRun?: boolean\n  /** When true, suppresses stdout (used in tests). */\n  silent?: boolean\n}\n\n/**\n * Thrown when the codemod completes with at least one successful rename\n * AND at least one failure — caller can re-run safely (idempotent) and\n * the second pass will skip already-migrated files.\n */\nclass RouterMigrationPartialFailure extends Error {\n  override readonly name = 'RouterMigrationPartialFailure'\n  readonly filesAlreadyMigrated: string[]\n  readonly failedFile: string\n  readonly causeMessage: string\n  constructor(filesAlreadyMigrated: string[], failedFile: string, causeMessage: string) {\n    super(\n      `Router migration partial failure: ${filesAlreadyMigrated.length} files migrated successfully, then failed on ${failedFile}: ${causeMessage}. Re-run \\`theokit migrate router\\` to retry — already-migrated files will be skipped.`,\n    )\n    this.filesAlreadyMigrated = filesAlreadyMigrated\n    this.failedFile = failedFile\n    this.causeMessage = causeMessage\n  }\n}\n\n/**\n * EC-2: dev-server detection. Returns true if the port is in use (someone\n * is already listening on localhost:<port>). Uses Node's `node:net` —\n * zero new deps.\n */\nexport async function isPortInUse(port: number): Promise<boolean> {\n  return await new Promise<boolean>((resolve) => {\n    const probe = createServer()\n    probe.once('error', (err: NodeJS.ErrnoException) => {\n      probe.close(() => {\n        resolve(err.code === 'EADDRINUSE')\n      })\n    })\n    probe.once('listening', () => {\n      probe.close(() => {\n        resolve(false)\n      })\n    })\n    probe.listen(port, '127.0.0.1')\n  })\n}\n\n/**\n * EC-2 pre-flight: returns the first port in use among the typical\n * theokit dev ports (3000 + 3100) so the caller can warn the user.\n */\nexport async function findRunningDevServerPort(): Promise<number | null> {\n  for (const port of [3000, 3100]) {\n    if (await isPortInUse(port)) return port\n  }\n  return null\n}\n\nfunction tryGitMv(from: string, to: string): boolean {\n  try {\n    mkdirSync(dirname(to), { recursive: true })\n    // Arguments are absolute paths from a recursive walk of <routesDir>.\n    // Pass as argv to avoid shell parsing entirely (no `shell: true`).\n    // `git` is resolved via the operator's PATH (same security model as\n    // every other CLI tool — `theokit dev`, `pnpm install`, etc.).\n\n    execFileSync('git', ['mv', from, to], { stdio: 'pipe' })\n    return true\n  } catch {\n    return false\n  }\n}\n\nfunction fallbackRename(from: string, to: string): void {\n  mkdirSync(dirname(to), { recursive: true })\n  renameSync(from, to)\n}\n\nfunction applyRename(item: RouterMigrationPlanItem): void {\n  if (!existsSync(item.from)) {\n    // Idempotency: already migrated — skip silently\n    return\n  }\n  if (existsSync(item.to)) {\n    // The plan() phase would have thrown CollisionError if we knew about\n    // it at plan time. This branch covers a race condition where the\n    // target was created between plan and apply.\n    throw new Error(\n      `Refusing to overwrite existing file at ${item.to} during migration of ${item.from}`,\n    )\n  }\n  if (!tryGitMv(item.from, item.to)) {\n    fallbackRename(item.from, item.to)\n  }\n}\n\n/**\n * Adjust relative imports inside the renamed file to compensate for the\n * extra nesting depth. Without this, `import { foo } from './chat'` inside\n * a file moved from `routes/admin.sdk-config.ts` → `routes/admin/sdk-config.ts`\n * would fail to resolve at typecheck/runtime — the import needs `../chat`\n * now that the file lives one level deeper.\n */\nfunction applyImportRewrite(item: RouterMigrationPlanItem, routesDir: string): void {\n  const delta = computeDepthDelta(item.from, item.to, routesDir)\n  if (delta <= 0) return\n  const source = readFileSync(item.to, 'utf8')\n  const rewritten = rewriteRelativeImports(source, delta)\n  if (rewritten !== source) {\n    writeFileSync(item.to, rewritten, 'utf8')\n  }\n}\n\ninterface RouterMigrateResult {\n  /** Successfully renamed (from, to) pairs. */\n  migrated: RouterMigrationPlanItem[]\n  /** Plan was empty — nothing to do (already-nested). */\n  alreadyClean: boolean\n}\n\ntype LogFn = (msg: string) => void\n\nfunction makeLog(silent: boolean | undefined): LogFn {\n  if (silent) {\n    return (_msg: string) => {\n      // intentionally silent\n    }\n  }\n  return (msg: string) => {\n    console.log(msg)\n  }\n}\n\nasync function assertNoRunningDevServer(opts: RouterMigrateOptions): Promise<void> {\n  if (opts.force) return\n  const runningPort = await findRunningDevServerPort()\n  if (runningPort !== null) {\n    throw new Error(\n      `Detected theokit dev server running on port ${runningPort}. STOP it before running migration to avoid HMR cascade (see EC-2). Re-run with --force to override.`,\n    )\n  }\n}\n\nfunction executeRenames(\n  plan: readonly RouterMigrationPlanItem[],\n  routesDir: string,\n  log: LogFn,\n): RouterMigrationPlanItem[] {\n  const migrated: RouterMigrationPlanItem[] = []\n  for (const item of plan) {\n    try {\n      applyRename(item)\n      applyImportRewrite(item, routesDir)\n      migrated.push(item)\n      log(`     ✓ ${item.from} → ${item.to}`)\n    } catch (err) {\n      // EC-7: partial failure observability — emit structured error with\n      // the list of already-migrated files so a re-run can recover.\n      const causeMessage = err instanceof Error ? err.message : String(err)\n      throw new RouterMigrationPartialFailure(\n        migrated.map((m) => m.from),\n        item.from,\n        causeMessage,\n      )\n    }\n  }\n  return migrated\n}\n\nexport async function routerMigrateCommand(\n  opts: RouterMigrateOptions = {},\n): Promise<RouterMigrateResult> {\n  const routesDir = opts.routesDir ?? resolve(process.cwd(), 'server', 'routes')\n  const log = makeLog(opts.silent)\n\n  await assertNoRunningDevServer(opts)\n\n  const plan = planRouterMigration(routesDir)\n  if (plan.length === 0) {\n    log('  ✓ Router already uses directory-nested convention. Nothing to do.')\n    return { migrated: [], alreadyClean: true }\n  }\n\n  log(`  → Migrating ${plan.length} dotted route(s) to directory-nested form...`)\n\n  if (opts.dryRun) {\n    for (const item of plan) {\n      log(`     [dry-run] ${item.from} → ${item.to}`)\n    }\n    return { migrated: [], alreadyClean: false }\n  }\n\n  const migrated = executeRenames(plan, routesDir, log)\n  log(`  ✓ Migrated ${migrated.length} route(s).`)\n  return { migrated, alreadyClean: false }\n}\n","/**\n * G6 T2.1 — Pure codemod core for `theokit migrate router`.\n *\n * Plan: .claude/knowledge-base/plans/g6-router-convention-plan.md v1.1\n *\n * `planRouterMigration` walks `<routesDir>` recursively and returns the\n * set of (from, to) renames required to convert legacy dotted-basename\n * routes (`auth.[provider].login.ts`) into the directory-nested form\n * (`auth/[provider]/login.ts`). The function is PURE — it does NOT\n * touch the filesystem beyond `readdirSync`/`statSync`. The CLI subcommand\n * (`router.ts`) is responsible for executing the renames via `git mv`\n * or `fs.rename` with the appropriate error handling.\n *\n * Edge cases covered:\n *   - EC-4: co-located `*.test.[jt]sx?` / `*.spec.[jt]sx?` files are\n *     silently skipped (same filter as the scanner).\n *   - EC-5: target collision detection is CASE-INSENSITIVE so a\n *     macOS/Windows dev doesn't silently overwrite a sibling file that\n *     differs only in case.\n *   - Idempotent: invoked twice on the same tree, the second pass is empty.\n */\nimport { readdirSync, statSync } from 'node:fs'\nimport { extname, join, relative, sep } from 'node:path'\n\nconst ROUTE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx'])\nconst TEST_OR_SPEC_RE = /\\.(test|spec)\\.[jt]sx?$/\n\n/**\n * One pending rename emitted by `planRouterMigration`.\n */\nexport interface RouterMigrationPlanItem {\n  /** Absolute path of the offending dotted-basename file. */\n  from: string\n  /** Absolute path of the proposed directory-nested replacement. */\n  to: string\n}\n\n/**\n * `RouterMigrationCollisionError` is thrown when migrating a dotted file\n * would overwrite an existing file (case-insensitive). The caller MUST\n * resolve the conflict manually before re-running the codemod.\n */\nexport class RouterMigrationCollisionError extends Error {\n  override readonly name = 'RouterMigrationCollisionError'\n  readonly from: string\n  readonly to: string\n  constructor(from: string, to: string) {\n    super(\n      `Router migration collision: ${from} would rename to ${to}, but that file already exists (case-insensitive match). Resolve manually.`,\n    )\n    this.from = from\n    this.to = to\n  }\n}\n\n/**\n * Compute the depth delta (number of extra `..` levels needed) between\n * the original (dotted) path and the migrated (nested) path, relative\n * to a common `routesDir` ancestor.\n *\n * - `admin.sdk-config.ts` (depth 0) → `admin/sdk-config.ts` (depth 1): delta = 1\n * - `debug.stability.last.ts` (depth 0) → `debug/stability/last.ts` (depth 2): delta = 2\n * - `canvas/artifacts.[id].ts` (depth 1) → `canvas/artifacts/[id].ts` (depth 2): delta = 1\n */\nexport function computeDepthDelta(from: string, to: string, routesDir: string): number {\n  const depthOf = (p: string): number => {\n    const rel = relative(routesDir, p).replace(/\\\\/g, '/')\n    // depth = number of `/` separators in the relative path\n    return rel.split('/').length - 1\n  }\n  return depthOf(to) - depthOf(from)\n}\n\n/**\n * Rewrite all relative imports in `source` by prepending `../` × `delta`\n * to every `./X` or `../X` specifier. Absolute / package specifiers\n * (`theokit/server`, `zod`, `node:fs`) are untouched.\n *\n * Handles three import shapes:\n *   - `import ... from './foo'`\n *   - `import('./foo')` (dynamic)\n *   - `import './foo'` (side-effect only)\n *   - `export ... from './foo'` (re-exports)\n *\n * Pure: returns the new source; does NOT touch disk.\n */\nexport function rewriteRelativeImports(source: string, delta: number): string {\n  if (delta <= 0) return source\n\n  const prefix = '../'.repeat(delta)\n\n  // Rewrites a captured relative specifier: `./foo` → `<prefix>foo`,\n  // `../foo` → `<prefix>../foo`. Single source of truth for the algorithm\n  // shared by all three import-shape regexes below.\n  const transformSpecifier = (specifier: string): string => {\n    if (specifier.startsWith('./')) return `${prefix}${specifier.slice(2)}`\n    return `${prefix}${specifier}`\n  }\n\n  // Three narrow regexes keep us out of catastrophic-backtracking territory.\n  // Each is anchored on a keyword (`from`, `import`) and uses a possessive\n  // character class (`[^'\"]+`) for the specifier, so backtracking is bounded.\n  const fromRe = /\\bfrom\\s+(['\"])(\\.{1,2}\\/[^'\"]+)\\1/g\n  const dynRe = /\\bimport\\s*\\(\\s*(['\"])(\\.{1,2}\\/[^'\"]+)\\1\\s*\\)/g\n  const sideRe = /\\bimport\\s+(['\"])(\\.{1,2}\\/[^'\"]+)\\1/g\n\n  const fromSub = (_m: string, q: string, spec: string): string =>\n    `from ${q}${transformSpecifier(spec)}${q}`\n  const dynSub = (_m: string, q: string, spec: string): string =>\n    `import(${q}${transformSpecifier(spec)}${q})`\n  const sideSub = (_m: string, q: string, spec: string): string =>\n    `import ${q}${transformSpecifier(spec)}${q}`\n\n  // `from` covers both `import ... from '...'` and `export ... from '...'`\n  // (the `\\bfrom\\s+` anchor matches the keyword position in both shapes).\n  // `dynRe` handles `import('...')`. `sideRe` handles bare `import '...'`.\n  // No overlap — `sideRe` requires `import` followed by whitespace then\n  // a quote (vs. `import(` for dynRe and `import ... from` for fromRe).\n  return source.replace(fromRe, fromSub).replace(dynRe, dynSub).replace(sideRe, sideSub)\n}\n\nfunction isTestOrSpecFile(filePath: string): boolean {\n  return TEST_OR_SPEC_RE.test(filePath)\n}\n\nfunction hasDotOutsideBrackets(segment: string): boolean {\n  let depth = 0\n  for (const ch of segment) {\n    if (ch === '[') depth++\n    else if (ch === ']') depth--\n    else if (ch === '.' && depth === 0) return true\n  }\n  return false\n}\n\nfunction splitDottedSegmentOutsideBrackets(segment: string): string[] {\n  const parts: string[] = []\n  let current = ''\n  let depth = 0\n  for (const ch of segment) {\n    if (ch === '[') {\n      depth++\n      current += ch\n    } else if (ch === ']') {\n      depth--\n      current += ch\n    } else if (ch === '.' && depth === 0) {\n      if (current) parts.push(current)\n      current = ''\n    } else {\n      current += ch\n    }\n  }\n  if (current) parts.push(current)\n  return parts\n}\n\nfunction toDirectoryNestedPath(filePath: string, routesDir: string): string {\n  const rel = relative(routesDir, filePath).replace(/\\\\/g, '/')\n  const ext = extname(rel)\n  const withoutExt = rel.slice(0, -ext.length)\n  const flattened = withoutExt.split('/').flatMap(splitDottedSegmentOutsideBrackets)\n  return join(routesDir, `${flattened.join(sep)}${ext}`)\n}\n\nfunction walkRoutes(root: string, onFile: (absPath: string) => void): void {\n  let entries\n  try {\n    entries = readdirSync(root, { withFileTypes: true })\n  } catch {\n    return\n  }\n  for (const entry of entries) {\n    if (entry.name.startsWith('_') || entry.name.startsWith('.')) continue\n    const full = join(root, entry.name)\n    if (entry.isDirectory()) {\n      walkRoutes(full, onFile)\n    } else if (entry.isFile() && ROUTE_EXTENSIONS.has(extname(entry.name))) {\n      onFile(full)\n    }\n  }\n}\n\nfunction isDottedRouteFile(filePath: string, routesDir: string): boolean {\n  const rel = relative(routesDir, filePath).replace(/\\\\/g, '/')\n  const ext = extname(rel)\n  const withoutExt = rel.slice(0, -ext.length)\n  return withoutExt.split('/').some(hasDotOutsideBrackets)\n}\n\n/**\n * Compute the migration plan for a `<server>/routes` tree.\n *\n * Pure: does NOT mutate the filesystem.\n *\n * @throws RouterMigrationCollisionError when a target collides with an\n *   existing file (case-insensitive).\n */\nexport function planRouterMigration(routesDir: string): RouterMigrationPlanItem[] {\n  const plan: RouterMigrationPlanItem[] = []\n  const existingPathsLowercase = new Set<string>()\n\n  walkRoutes(routesDir, (absPath) => {\n    existingPathsLowercase.add(absPath.toLowerCase())\n  })\n\n  walkRoutes(routesDir, (absPath) => {\n    if (isTestOrSpecFile(absPath)) return\n    if (!isDottedRouteFile(absPath, routesDir)) return\n\n    const to = toDirectoryNestedPath(absPath, routesDir)\n\n    // EC-5: case-insensitive collision check — macOS HFS+/APFS default\n    // and Windows NTFS treat case-only differences as the same path. If\n    // any pre-existing file at a case-insensitive match exists, the codemod\n    // would silently overwrite on those platforms; we bail explicitly.\n    const targetLower = to.toLowerCase()\n    if (existingPathsLowercase.has(targetLower) && targetLower !== absPath.toLowerCase()) {\n      throw new RouterMigrationCollisionError(absPath, to)\n    }\n    // Also guard against statSync race using an explicit existence check.\n    try {\n      if (statSync(to).isFile()) {\n        throw new RouterMigrationCollisionError(absPath, to)\n      }\n    } catch (err) {\n      if (err instanceof RouterMigrationCollisionError) throw err\n      // ENOENT — fine, target does not exist\n    }\n\n    plan.push({ from: absPath, to })\n  })\n\n  return plan\n}\n"],"mappings":";;;;AAeA,SAAS,oBAAoB;AAC7B,SAAS,YAAY,WAAW,cAAc,YAAY,qBAAqB;AAC/E,SAAS,oBAAoB;AAC7B,SAAS,SAAS,eAAe;;;ACGjC,SAAS,aAAa,gBAAgB;AACtC,SAAS,SAAS,MAAM,UAAU,WAAW;AAE7C,IAAM,mBAAmB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAC/D,IAAM,kBAAkB;AAiBjB,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACrC,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACT,YAAY,MAAc,IAAY;AACpC;AAAA,MACE,+BAA+B,IAAI,oBAAoB,EAAE;AAAA,IAC3D;AACA,SAAK,OAAO;AACZ,SAAK,KAAK;AAAA,EACZ;AACF;AAWO,SAAS,kBAAkB,MAAc,IAAY,WAA2B;AACrF,QAAM,UAAU,CAAC,MAAsB;AACrC,UAAM,MAAM,SAAS,WAAW,CAAC,EAAE,QAAQ,OAAO,GAAG;AAErD,WAAO,IAAI,MAAM,GAAG,EAAE,SAAS;AAAA,EACjC;AACA,SAAO,QAAQ,EAAE,IAAI,QAAQ,IAAI;AACnC;AAeO,SAAS,uBAAuB,QAAgB,OAAuB;AAC5E,MAAI,SAAS,EAAG,QAAO;AAEvB,QAAM,SAAS,MAAM,OAAO,KAAK;AAKjC,QAAM,qBAAqB,CAAC,cAA8B;AACxD,QAAI,UAAU,WAAW,IAAI,EAAG,QAAO,GAAG,MAAM,GAAG,UAAU,MAAM,CAAC,CAAC;AACrE,WAAO,GAAG,MAAM,GAAG,SAAS;AAAA,EAC9B;AAKA,QAAM,SAAS;AACf,QAAM,QAAQ;AACd,QAAM,SAAS;AAEf,QAAM,UAAU,CAAC,IAAY,GAAW,SACtC,QAAQ,CAAC,GAAG,mBAAmB,IAAI,CAAC,GAAG,CAAC;AAC1C,QAAM,SAAS,CAAC,IAAY,GAAW,SACrC,UAAU,CAAC,GAAG,mBAAmB,IAAI,CAAC,GAAG,CAAC;AAC5C,QAAM,UAAU,CAAC,IAAY,GAAW,SACtC,UAAU,CAAC,GAAG,mBAAmB,IAAI,CAAC,GAAG,CAAC;AAO5C,SAAO,OAAO,QAAQ,QAAQ,OAAO,EAAE,QAAQ,OAAO,MAAM,EAAE,QAAQ,QAAQ,OAAO;AACvF;AAEA,SAAS,iBAAiB,UAA2B;AACnD,SAAO,gBAAgB,KAAK,QAAQ;AACtC;AAEA,SAAS,sBAAsB,SAA0B;AACvD,MAAI,QAAQ;AACZ,aAAW,MAAM,SAAS;AACxB,QAAI,OAAO,IAAK;AAAA,aACP,OAAO,IAAK;AAAA,aACZ,OAAO,OAAO,UAAU,EAAG,QAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,kCAAkC,SAA2B;AACpE,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI,QAAQ;AACZ,aAAW,MAAM,SAAS;AACxB,QAAI,OAAO,KAAK;AACd;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,KAAK;AACrB;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,OAAO,UAAU,GAAG;AACpC,UAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,gBAAU;AAAA,IACZ,OAAO;AACL,iBAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,SAAO;AACT;AAEA,SAAS,sBAAsB,UAAkB,WAA2B;AAC1E,QAAM,MAAM,SAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,MAAM,QAAQ,GAAG;AACvB,QAAM,aAAa,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAC3C,QAAM,YAAY,WAAW,MAAM,GAAG,EAAE,QAAQ,iCAAiC;AACjF,SAAO,KAAK,WAAW,GAAG,UAAU,KAAK,GAAG,CAAC,GAAG,GAAG,EAAE;AACvD;AAEA,SAAS,WAAW,MAAc,QAAyC;AACzE,MAAI;AACJ,MAAI;AACF,cAAU,YAAY,MAAM,EAAE,eAAe,KAAK,CAAC;AAAA,EACrD,QAAQ;AACN;AAAA,EACF;AACA,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,KAAK,WAAW,GAAG,KAAK,MAAM,KAAK,WAAW,GAAG,EAAG;AAC9D,UAAM,OAAO,KAAK,MAAM,MAAM,IAAI;AAClC,QAAI,MAAM,YAAY,GAAG;AACvB,iBAAW,MAAM,MAAM;AAAA,IACzB,WAAW,MAAM,OAAO,KAAK,iBAAiB,IAAI,QAAQ,MAAM,IAAI,CAAC,GAAG;AACtE,aAAO,IAAI;AAAA,IACb;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,UAAkB,WAA4B;AACvE,QAAM,MAAM,SAAS,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,QAAM,MAAM,QAAQ,GAAG;AACvB,QAAM,aAAa,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM;AAC3C,SAAO,WAAW,MAAM,GAAG,EAAE,KAAK,qBAAqB;AACzD;AAUO,SAAS,oBAAoB,WAA8C;AAChF,QAAM,OAAkC,CAAC;AACzC,QAAM,yBAAyB,oBAAI,IAAY;AAE/C,aAAW,WAAW,CAAC,YAAY;AACjC,2BAAuB,IAAI,QAAQ,YAAY,CAAC;AAAA,EAClD,CAAC;AAED,aAAW,WAAW,CAAC,YAAY;AACjC,QAAI,iBAAiB,OAAO,EAAG;AAC/B,QAAI,CAAC,kBAAkB,SAAS,SAAS,EAAG;AAE5C,UAAM,KAAK,sBAAsB,SAAS,SAAS;AAMnD,UAAM,cAAc,GAAG,YAAY;AACnC,QAAI,uBAAuB,IAAI,WAAW,KAAK,gBAAgB,QAAQ,YAAY,GAAG;AACpF,YAAM,IAAI,8BAA8B,SAAS,EAAE;AAAA,IACrD;AAEA,QAAI;AACF,UAAI,SAAS,EAAE,EAAE,OAAO,GAAG;AACzB,cAAM,IAAI,8BAA8B,SAAS,EAAE;AAAA,MACrD;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,8BAA+B,OAAM;AAAA,IAE1D;AAEA,SAAK,KAAK,EAAE,MAAM,SAAS,GAAG,CAAC;AAAA,EACjC,CAAC;AAED,SAAO;AACT;;;AD5LA,IAAM,gCAAN,cAA4C,MAAM;AAAA,EAC9B,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EACT,YAAY,sBAAgC,YAAoB,cAAsB;AACpF;AAAA,MACE,qCAAqC,qBAAqB,MAAM,gDAAgD,UAAU,KAAK,YAAY;AAAA,IAC7I;AACA,SAAK,uBAAuB;AAC5B,SAAK,aAAa;AAClB,SAAK,eAAe;AAAA,EACtB;AACF;AAOA,eAAsB,YAAY,MAAgC;AAChE,SAAO,MAAM,IAAI,QAAiB,CAACA,aAAY;AAC7C,UAAM,QAAQ,aAAa;AAC3B,UAAM,KAAK,SAAS,CAAC,QAA+B;AAClD,YAAM,MAAM,MAAM;AAChB,QAAAA,SAAQ,IAAI,SAAS,YAAY;AAAA,MACnC,CAAC;AAAA,IACH,CAAC;AACD,UAAM,KAAK,aAAa,MAAM;AAC5B,YAAM,MAAM,MAAM;AAChB,QAAAA,SAAQ,KAAK;AAAA,MACf,CAAC;AAAA,IACH,CAAC;AACD,UAAM,OAAO,MAAM,WAAW;AAAA,EAChC,CAAC;AACH;AAMA,eAAsB,2BAAmD;AACvE,aAAW,QAAQ,CAAC,KAAM,IAAI,GAAG;AAC/B,QAAI,MAAM,YAAY,IAAI,EAAG,QAAO;AAAA,EACtC;AACA,SAAO;AACT;AAEA,SAAS,SAAS,MAAc,IAAqB;AACnD,MAAI;AACF,cAAU,QAAQ,EAAE,GAAG,EAAE,WAAW,KAAK,CAAC;AAM1C,iBAAa,OAAO,CAAC,MAAM,MAAM,EAAE,GAAG,EAAE,OAAO,OAAO,CAAC;AACvD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,MAAc,IAAkB;AACtD,YAAU,QAAQ,EAAE,GAAG,EAAE,WAAW,KAAK,CAAC;AAC1C,aAAW,MAAM,EAAE;AACrB;AAEA,SAAS,YAAY,MAAqC;AACxD,MAAI,CAAC,WAAW,KAAK,IAAI,GAAG;AAE1B;AAAA,EACF;AACA,MAAI,WAAW,KAAK,EAAE,GAAG;AAIvB,UAAM,IAAI;AAAA,MACR,0CAA0C,KAAK,EAAE,wBAAwB,KAAK,IAAI;AAAA,IACpF;AAAA,EACF;AACA,MAAI,CAAC,SAAS,KAAK,MAAM,KAAK,EAAE,GAAG;AACjC,mBAAe,KAAK,MAAM,KAAK,EAAE;AAAA,EACnC;AACF;AASA,SAAS,mBAAmB,MAA+B,WAAyB;AAClF,QAAM,QAAQ,kBAAkB,KAAK,MAAM,KAAK,IAAI,SAAS;AAC7D,MAAI,SAAS,EAAG;AAChB,QAAM,SAAS,aAAa,KAAK,IAAI,MAAM;AAC3C,QAAM,YAAY,uBAAuB,QAAQ,KAAK;AACtD,MAAI,cAAc,QAAQ;AACxB,kBAAc,KAAK,IAAI,WAAW,MAAM;AAAA,EAC1C;AACF;AAWA,SAAS,QAAQ,QAAoC;AACnD,MAAI,QAAQ;AACV,WAAO,CAAC,SAAiB;AAAA,IAEzB;AAAA,EACF;AACA,SAAO,CAAC,QAAgB;AACtB,YAAQ,IAAI,GAAG;AAAA,EACjB;AACF;AAEA,eAAe,yBAAyB,MAA2C;AACjF,MAAI,KAAK,MAAO;AAChB,QAAM,cAAc,MAAM,yBAAyB;AACnD,MAAI,gBAAgB,MAAM;AACxB,UAAM,IAAI;AAAA,MACR,+CAA+C,WAAW;AAAA,IAC5D;AAAA,EACF;AACF;AAEA,SAAS,eACP,MACA,WACA,KAC2B;AAC3B,QAAM,WAAsC,CAAC;AAC7C,aAAW,QAAQ,MAAM;AACvB,QAAI;AACF,kBAAY,IAAI;AAChB,yBAAmB,MAAM,SAAS;AAClC,eAAS,KAAK,IAAI;AAClB,UAAI,eAAU,KAAK,IAAI,WAAM,KAAK,EAAE,EAAE;AAAA,IACxC,SAAS,KAAK;AAGZ,YAAM,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACpE,YAAM,IAAI;AAAA,QACR,SAAS,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,QAC1B,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,qBACpB,OAA6B,CAAC,GACA;AAC9B,QAAM,YAAY,KAAK,aAAa,QAAQ,QAAQ,IAAI,GAAG,UAAU,QAAQ;AAC7E,QAAM,MAAM,QAAQ,KAAK,MAAM;AAE/B,QAAM,yBAAyB,IAAI;AAEnC,QAAM,OAAO,oBAAoB,SAAS;AAC1C,MAAI,KAAK,WAAW,GAAG;AACrB,QAAI,0EAAqE;AACzE,WAAO,EAAE,UAAU,CAAC,GAAG,cAAc,KAAK;AAAA,EAC5C;AAEA,MAAI,sBAAiB,KAAK,MAAM,8CAA8C;AAE9E,MAAI,KAAK,QAAQ;AACf,eAAW,QAAQ,MAAM;AACvB,UAAI,kBAAkB,KAAK,IAAI,WAAM,KAAK,EAAE,EAAE;AAAA,IAChD;AACA,WAAO,EAAE,UAAU,CAAC,GAAG,cAAc,MAAM;AAAA,EAC7C;AAEA,QAAM,WAAW,eAAe,MAAM,WAAW,GAAG;AACpD,MAAI,qBAAgB,SAAS,MAAM,YAAY;AAC/C,SAAO,EAAE,UAAU,cAAc,MAAM;AACzC;","names":["resolve"]}

package/dist/{routes-XNS3UM3B.js → routes-2RD4S5PZ.js}

@@ -5,16 +5,16 @@ import {
 } from "./chunk-GEQJAFSV.js";
 import {
   loadConfig
-} from "./chunk-AFVTEAES.js";
+} from "./chunk-B7ONQ4QJ.js";
 import "./chunk-GDN3PXFH.js";
-import "./chunk-GSO77FSM.js";
-import "./chunk-45C3WUQ7.js";
+import "./chunk-HEK4SET7.js";
+import "./chunk-QPVXGC7O.js";
 import {
   scanServerActions,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-FRUEDJFX.js";
-import "./chunk-P37RZRFV.js";
+} from "./chunk-226KMIGZ.js";
+import "./chunk-A7JBF5FO.js";
 
 // src/cli/commands/routes.ts
 import { resolve, relative } from "path";
@@ -62,4 +62,4 @@ async function routesCommand() {
 export {
   routesCommand
 };
-//# sourceMappingURL=routes-XNS3UM3B.js.map
+//# sourceMappingURL=routes-2RD4S5PZ.js.map

package/dist/schema-S553QCAU.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  cacheSchema,
+  corsSchema,
+  rateLimitSchema,
+  securityHeadersSchema,
+  securitySchema,
+  storageSchema,
+  theoConfigSchema
+} from "./chunk-HEK4SET7.js";
+import "./chunk-QPVXGC7O.js";
+export {
+  cacheSchema,
+  corsSchema,
+  rateLimitSchema,
+  securityHeadersSchema,
+  securitySchema,
+  storageSchema,
+  theoConfigSchema
+};
+//# sourceMappingURL=schema-S553QCAU.js.map

package/dist/server/agent/index.d.ts

@@ -1,9 +1,9 @@
 import { z } from 'zod';
 import { C as CustomTool } from '../../define-agent-tool-cRuSpidb.js';
-import { AcpTransport, HumanInTheLoopOptions, HitlDecision, streamAgentUIMessages } from '@theokit/agents';
+import { AcpTransport } from '@theokit/agents';
+export { InProcessApprovalRequest, InProcessApprovalRequiredError, InProcessAwaitApproval, StreamAgentTurnDeps, StreamAgentTurnInProcessInput, streamAgentTurnInProcess } from '@theokit/agents';
 import { CustomTool as CustomTool$1 } from '@theokit/sdk';
 import { V as VerifyFn } from '../../webhook-types-CNUZY7o1.js';
-import { UIMessageChunk } from 'ai';
 
 /**
  * M26 (ADR-0041) — `createWorkflowTool`: wrap an SDK `Workflow` as a `CustomTool`.
@@ -229,75 +229,6 @@ interface ChannelWebhookConfig {
  */
 declare function handleChannelWebhook(request: Request, urlPath: string, config: ChannelWebhookConfig): Promise<Response>;
 
-/**
- * M35 (multi-surface) — the in-process agent-turn seam (Model A).
- *
- * The FRAMEWORK-owned sibling of the HTTP `mountAgent` and the stdout `runAgentInTerminal`: it runs a
- * compiled agent with the SAME `compileAgentModule` + SAME `streamAgentUIMessages` (G2 — reuses the
- * SDK runtime, reimplements nothing), but returns the raw `UIMessageChunk` generator so ANY consumer
- * drives it directly — the Ink TUI (M35), a Tauri window (M36), or a test — in a SINGLE process with
- * NO HTTP loopback, NO port, and NO CSRF (there is no network boundary to defend).
- *
- * The ONLY difference from the HTTP mount is HITL resolution: the mount pauses the run and resolves
- * the approval via a SECOND HTTP request to `/approve/:id` (the approval registry). In-process there
- * is no second request — the caller resolves the approval INLINE via `awaitApproval` (e.g. the Ink
- * TUI's y/n prompt). The gated-tool map is `compiled.hitl` verbatim, so the pause semantics are
- * byte-identical to the HTTP path; only the resolver differs. Parity with the mount is by
- * construction: both compile the module, resolve function-form skills, and call `streamAgentUIMessages`
- * with the same `{ message, sessionId, hitl }`.
- *
- * Consumers WILL still receive `tool-approval-request` chunks from the returned generator — they are
- * INFORMATIONAL (render them or ignore them). The authoritative human gate is `awaitApproval`, which
- * the SDK awaits BEFORE the gated tool runs; the chunk is not the gate.
- */
-
-/** An inline approval request handed to the caller's `awaitApproval` (the Ink/Tauri prompt). */
-interface InProcessApprovalRequest {
-    approvalId: string;
-    toolName: string;
-    opts: HumanInTheLoopOptions;
-}
-/** Resolve one gated-tool approval inline (approve/deny, or a structured {@link HitlDecision}). */
-type InProcessAwaitApproval = (req: InProcessApprovalRequest) => Promise<boolean | HitlDecision>;
-interface StreamAgentTurnInProcessInput {
-    message: string;
-    /**
-     * M35 (multimodal) — images to send alongside the text. Threaded to the SDK's structured
-     * `SDKUserMessage { text, images }` send form. Absent ⇒ the string send path is byte-unchanged.
-     */
-    images?: Parameters<typeof streamAgentUIMessages>[2]['images'];
-    /** Resume key; a fresh id per run when omitted. */
-    sessionId?: string;
-    /**
-     * Inline HITL resolver — required IFF the agent has `@HumanInTheLoop`-gated tools. Omitting it for a
-     * gated agent is a fail-fast error, never a silent bypass (Rule 8, the #99 lesson).
-     */
-    awaitApproval?: InProcessAwaitApproval;
-    /** Labels a fail-fast `AgentDefinitionError` (the file path). */
-    source?: string;
-    /** Abort signal forwarded to the SDK stream (client disconnect / window close). */
-    signal?: AbortSignal;
-}
-/** Injectable stream fn (defaults to the real SDK bridge) — lets tests drive a deterministic stream. */
-interface StreamAgentTurnDeps {
-    stream: typeof streamAgentUIMessages;
-}
-/**
- * Thrown when a gated agent is run in-process without an `awaitApproval` resolver. Refusing loudly is
- * the correct posture: silently running a `@HumanInTheLoop`-gated tool with no human gate is exactly
- * the #99 class of bug. Typed so callers can catch it distinctly.
- */
-declare class InProcessApprovalRequiredError extends Error {
-    constructor(toolNames: readonly string[]);
-}
-/**
- * Run a compiled agent in-process and return its `UIMessageChunk` stream. `apiKey` is resolved by the
- * caller (same contract as the HTTP mount). Validation + compile happen SYNCHRONOUSLY (so a gated
- * agent without a resolver throws at call time, not lazily on first iteration); the returned value is
- * the SDK's `streamAgentUIMessages` generator.
- */
-declare function streamAgentTurnInProcess(mod: unknown, apiKey: string, input: StreamAgentTurnInProcessInput, deps?: StreamAgentTurnDeps): AsyncGenerator<UIMessageChunk>;
-
 /**
  * M30 (ADR-0041) — MCP Apps: `ui://` HTML resources for the MCP server (M16).
  *
@@ -389,4 +320,4 @@ interface StdioStreams {
  */
 declare function serveMcpStdio(mod: unknown, name: string, appResources: readonly AppResource[], streams: StdioStreams): Promise<void>;
 
-export { type AcpToolConfig, type AppResource, type AppResourceInput, type ChannelMessage, type ChannelWebhookConfig, type CodeModeApi, type CodeModeConfig, type CodeModePermission, CodeModePermissionDeniedError, type InProcessApprovalRequest, InProcessApprovalRequiredError, type InProcessAwaitApproval, type McpResourceContents, type McpResourceDescriptor, NodeAcpTransport, type Sandbox, type StdioStreams, type StreamAgentTurnDeps, type StreamAgentTurnInProcessInput, type VendorAgentClient, type VendorAgentToolConfig, type WorkflowLike, type WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, parseChannelPath, readAppResource, serveMcpStdio, streamAgentTurnInProcess };
+export { type AcpToolConfig, type AppResource, type AppResourceInput, type ChannelMessage, type ChannelWebhookConfig, type CodeModeApi, type CodeModeConfig, type CodeModePermission, CodeModePermissionDeniedError, type McpResourceContents, type McpResourceDescriptor, NodeAcpTransport, type Sandbox, type StdioStreams, type VendorAgentClient, type VendorAgentToolConfig, type WorkflowLike, type WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, parseChannelPath, readAppResource, serveMcpStdio };

package/dist/server/agent/index.js

@@ -12,15 +12,15 @@ import {
   parseChannelPath,
   serveMcpStdio,
   streamAgentTurnInProcess
-} from "../../chunk-5AVPWHUE.js";
+} from "../../chunk-FZG3JYB3.js";
 import {
   buildResourceDescriptors,
   defineAppResource,
   extractAppResources,
   readAppResource
-} from "../../chunk-HZ6USUHC.js";
-import "../../chunk-E25FBYJP.js";
-import "../../chunk-DGUM43GV.js";
+} from "../../chunk-YOIVCCZT.js";
+import "../../chunk-SAFGDIPQ.js";
+import "../../chunk-XTHN6JBX.js";
 export {
   CodeModePermissionDeniedError,
   InProcessApprovalRequiredError,

package/dist/server/agent/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"sources":[],"mappings":"","names":[]}

package/dist/server/auth/index.js

@@ -23,12 +23,12 @@ import {
   verifyBackupCode,
   verifyOAuthState,
   verifyTotp
-} from "../../chunk-SJIRP73B.js";
-import "../../chunk-ZJQ4O76G.js";
+} from "../../chunk-646CA6RV.js";
+import "../../chunk-4FWBKX6G.js";
 import {
   generateNonce
-} from "../../chunk-C3ZZ56YZ.js";
-import "../../chunk-DGUM43GV.js";
+} from "../../chunk-JA2ZAT5Q.js";
+import "../../chunk-XTHN6JBX.js";
 export {
   AuthRequiredError,
   _resetKeyCacheForTests,

package/dist/server/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"sources":[],"mappings":"","names":[]}

package/dist/server/cost/index.js

@@ -2,8 +2,8 @@ import {
   InMemoryUsageStorage,
   trackAgentRun,
   trackAgentTools
-} from "../../chunk-RMU7EBRO.js";
-import "../../chunk-DGUM43GV.js";
+} from "../../chunk-SEELKQUM.js";
+import "../../chunk-XTHN6JBX.js";
 export {
   InMemoryUsageStorage,
   trackAgentRun,

package/dist/server/cost/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"sources":[],"mappings":"","names":[]}

package/dist/server/cron/index.js

@@ -14,12 +14,12 @@ import {
   translateCronToVercel,
   validateCronSchedule,
   writeCronManifest
-} from "../../chunk-U3NTEK46.js";
-import "../../chunk-YB5DJJ4U.js";
-import "../../chunk-6NEXVBPY.js";
-import "../../chunk-7MQOHNHE.js";
-import "../../chunk-X2VVCJ4V.js";
-import "../../chunk-DGUM43GV.js";
+} from "../../chunk-2ADKT37V.js";
+import "../../chunk-VZTYCAO6.js";
+import "../../chunk-RWNSW4FM.js";
+import "../../chunk-52PDWL5S.js";
+import "../../chunk-U267AOWS.js";
+import "../../chunk-XTHN6JBX.js";
 export {
   CRON_MANIFEST_SCHEMA_VERSION,
   DuplicateCronNameError,

package/dist/server/cron/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"sources":[],"mappings":"","names":[]}

package/dist/server/define/index.js

@@ -8,18 +8,18 @@ import {
   tool,
   uiMessageStreamResponse,
   websocket
-} from "../../chunk-JQJN6LFK.js";
+} from "../../chunk-62EU2BVZ.js";
 import {
   HEALTH_PATH,
   READY_PATH,
   defineHealthRoute,
   defineReadyRoute,
   serveReservedRoute
-} from "../../chunk-V3LJN2GS.js";
+} from "../../chunk-GAPBPRPP.js";
 import {
   applyTransform
-} from "../../chunk-E25FBYJP.js";
-import "../../chunk-DGUM43GV.js";
+} from "../../chunk-SAFGDIPQ.js";
+import "../../chunk-XTHN6JBX.js";
 export {
   HEALTH_PATH,
   READY_PATH,

package/dist/server/define/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"sources":[],"mappings":"","names":[]}

package/dist/server/http/index.js

@@ -2,7 +2,7 @@ import {
   MAX_ERROR_HTML_BYTES,
   loadCustomErrorPages,
   serveStaticFile
-} from "../../chunk-OPLICDUB.js";
+} from "../../chunk-UW2TEAGR.js";
 import {
   BATCH_PATH,
   BatchPathConflictError,
@@ -24,21 +24,21 @@ import {
   runMiddlewareAndContext,
   sendError,
   sendJson
-} from "../../chunk-QWBXUZAX.js";
-import "../../chunk-GY5Q27BJ.js";
-import "../../chunk-WFNLNIJX.js";
-import "../../chunk-ZEGYW52B.js";
-import "../../chunk-TSLSIRBR.js";
-import "../../chunk-UD3LFGDL.js";
+} from "../../chunk-37ZO643S.js";
+import "../../chunk-47FFT43U.js";
+import "../../chunk-KD5G3YXI.js";
+import "../../chunk-FB2HBNIC.js";
+import "../../chunk-OLGPYOLO.js";
+import "../../chunk-AVQU5CQF.js";
 import {
   envelopeCodeToStatus
-} from "../../chunk-X32XEJXR.js";
+} from "../../chunk-ACKBVBUI.js";
 import {
   NotFoundError,
   TheoError,
   fromUnknown,
   serverErrorToEnvelope
-} from "../../chunk-UVXB2ER7.js";
+} from "../../chunk-7SABX4DJ.js";
 import {
   appendCookieToHeaders,
   appendDeleteCookieToHeaders,
@@ -48,8 +48,8 @@ import {
   parseCookieHeader,
   serializeCookie,
   setCookie
-} from "../../chunk-ZJQ4O76G.js";
-import "../../chunk-DGUM43GV.js";
+} from "../../chunk-4FWBKX6G.js";
+import "../../chunk-XTHN6JBX.js";
 export {
   BATCH_PATH,
   BatchPathConflictError,

package/dist/server/http/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"sources":[],"mappings":"","names":[]}

package/dist/server/index.d.ts

@@ -29,14 +29,14 @@ export { G as GenericFactory, a as PoolLike, P as PostgresDatabaseConfig, c as R
 export { BodyTooLargeError, DEFAULT_MAX_BODY_BYTES, RawBodyResult, ReadRawBodyOptions, defineWebhook, dispatchWebhook, readRawBody, timingSafeEqual } from './webhook/index.js';
 export { D as DefineWebhookOptions, V as VerifyFn, a as VerifyResult, W as WebhookContext, b as WebhookDefinition } from '../webhook-types-CNUZY7o1.js';
 import { z } from 'zod';
-export { AcpToolConfig, AppResource, AppResourceInput, ChannelMessage, ChannelWebhookConfig, CodeModeApi, CodeModeConfig, CodeModePermission, CodeModePermissionDeniedError, InProcessApprovalRequest, InProcessApprovalRequiredError, InProcessAwaitApproval, McpResourceContents, McpResourceDescriptor, NodeAcpTransport, Sandbox, StdioStreams, StreamAgentTurnDeps, StreamAgentTurnInProcessInput, VendorAgentClient, VendorAgentToolConfig, WorkflowLike, WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, parseChannelPath, readAppResource, serveMcpStdio, streamAgentTurnInProcess } from './agent/index.js';
+export { AcpToolConfig, AppResource, AppResourceInput, ChannelMessage, ChannelWebhookConfig, CodeModeApi, CodeModeConfig, CodeModePermission, CodeModePermissionDeniedError, McpResourceContents, McpResourceDescriptor, NodeAcpTransport, Sandbox, StdioStreams, VendorAgentClient, VendorAgentToolConfig, WorkflowLike, WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, parseChannelPath, readAppResource, serveMcpStdio } from './agent/index.js';
+export { InProcessApprovalRequest, InProcessApprovalRequiredError, InProcessAwaitApproval, StreamAgentTurnDeps, StreamAgentTurnInProcessInput, streamAgentTurnInProcess } from '@theokit/agents';
 import { IncomingMessage } from 'node:http';
 import { W as WebOnRequestHook, b as WebPreHandlerHook, c as WebOnResponseHook, d as WebOnErrorHook } from '../plugin-types-D69-lJZ9.js';
 export { e as HookName, H as HookResult, O as OnErrorHook, f as OnRequestHook, g as OnResponseHook, P as PluginContext, h as PluginErrorContext, i as PreHandlerHook, R as RunHookOptions, a as TheoApp, T as TheoPlugin } from '../plugin-types-D69-lJZ9.js';
 export { a as ServiceDefinition, S as ServicesConfig, b as ServicesConfigInput, c as ServicesConfigOutput } from '../schema-BpH6ivDY.js';
 import 'ai';
 import 'vite';
-import '@theokit/agents';
 import '@theokit/sdk';
 
 /**

package/dist/server/index.js

@@ -3,7 +3,7 @@ import {
   getStorageManager,
   useDatabase,
   useUnstorage
-} from "../chunk-ESC54TAK.js";
+} from "../chunk-3DGIANAN.js";
 import {
   BodyTooLargeError,
   DEFAULT_MAX_BODY_BYTES,
@@ -11,12 +11,12 @@ import {
   dispatchWebhook,
   readRawBody,
   timingSafeEqual
-} from "../chunk-UUFYP2UM.js";
+} from "../chunk-AM3QABW5.js";
 import {
   MAX_ERROR_HTML_BYTES,
   loadCustomErrorPages,
   serveStaticFile
-} from "../chunk-OPLICDUB.js";
+} from "../chunk-UW2TEAGR.js";
 import {
   DuplicateJobNameError,
   InMemoryJobBackend,
@@ -28,7 +28,7 @@ import {
   defineJob,
   scanJobs,
   writeJobManifest
-} from "../chunk-GUUWDMR2.js";
+} from "../chunk-L5Z6IY5U.js";
 import {
   ConsoleObservabilityAdapter,
   NoopObservabilityAdapter,
@@ -39,20 +39,20 @@ import {
   defineObservabilityAdapter,
   resolveAdapter,
   serializeSpansToOtlp
-} from "../chunk-KI7OWQUX.js";
-import "../chunk-NPMCKOX4.js";
+} from "../chunk-KBGGQK4I.js";
+import "../chunk-GUBN5UTT.js";
 import {
   createRouteRateLimiter,
   createRouteRateLimiterWeb,
   deriveKey,
   deriveKeyFromRequest,
   matchRoutePattern
-} from "../chunk-ASDXVRJD.js";
+} from "../chunk-6KDXP472.js";
 import {
   ChannelManager
-} from "../chunk-NM4WF3XD.js";
-import "../chunk-E3JH6YUM.js";
-import "../chunk-JHEAWR3L.js";
+} from "../chunk-4PBJ266F.js";
+import "../chunk-7IHWXDJJ.js";
+import "../chunk-WPJOTQA5.js";
 import {
   _resetEnvCache,
   executeWebRequest,
@@ -61,7 +61,7 @@ import {
   resolveTransformer,
   superjsonTransformer,
   validateRouteInput
-} from "../chunk-GW5H4KB4.js";
+} from "../chunk-U3H53IIN.js";
 import {
   ActionError,
   ActionInputError,
@@ -88,17 +88,17 @@ import {
   runMiddlewareAndContext,
   sendError,
   sendJson
-} from "../chunk-QWBXUZAX.js";
+} from "../chunk-37ZO643S.js";
 import {
   DuplicateContextKeyError,
   createOutbox,
   createOutboxDispatcher,
   createQueueClient
-} from "../chunk-GY5Q27BJ.js";
+} from "../chunk-47FFT43U.js";
 import {
   findSuggestion,
   levenshtein
-} from "../chunk-5QW7IQQU.js";
+} from "../chunk-NTDN54XO.js";
 import {
   FileTooLargeError,
   _resetWarnOnceForTests,
@@ -106,23 +106,23 @@ import {
   logRequest,
   parseRequestBody,
   warnOnce
-} from "../chunk-WFNLNIJX.js";
+} from "../chunk-KD5G3YXI.js";
 import {
   DuplicateDecorationError,
   DuplicatePluginError,
   InvalidPluginShapeError,
   PluginRunner,
   createPluginRunnerFromConfig
-} from "../chunk-IAJ2JVEH.js";
+} from "../chunk-VSLTKX5L.js";
 import {
   InMemoryStore,
   createRateLimiter,
   createRateLimiterWeb
-} from "../chunk-VMEWD57H.js";
+} from "../chunk-KPKLIUUL.js";
 import {
   createProductionLoader,
   createViteLoader
-} from "../chunk-JQSKBMXP.js";
+} from "../chunk-7LVM22VG.js";
 import {
   ActionScanError,
   compilePattern,
@@ -134,11 +134,11 @@ import {
   scanServerRoutes,
   scanWebSocketRoutes,
   writeManifest
-} from "../chunk-IHJZPQEF.js";
-import "../chunk-WSJKACWB.js";
+} from "../chunk-L4Y6RJ4E.js";
+import "../chunk-C34PMLSN.js";
 import {
   scanMiddlewares
-} from "../chunk-ZEGYW52B.js";
+} from "../chunk-FB2HBNIC.js";
 import {
   CSP_REPORT_PATH,
   CSRF_READINESS_PATH,
@@ -154,7 +154,7 @@ import {
   handleCsrfReadinessRequest,
   normalizeLegacy,
   normalizeNew
-} from "../chunk-JBCHWRKF.js";
+} from "../chunk-MTEWLGVY.js";
 import {
   CSRF_WARN_CODE,
   CSRF_WARN_DOCS_URL,
@@ -162,21 +162,21 @@ import {
   matchDisallowed,
   validateCsrf,
   validateCsrfRequest
-} from "../chunk-TSLSIRBR.js";
+} from "../chunk-OLGPYOLO.js";
 import {
   JsonStdoutSink,
   createNoOpLogger,
   safeAudit
-} from "../chunk-UD3LFGDL.js";
+} from "../chunk-AVQU5CQF.js";
 import {
   envelopeCodeToStatus
-} from "../chunk-X32XEJXR.js";
+} from "../chunk-ACKBVBUI.js";
 import {
   NotFoundError,
   TheoError,
   fromUnknown,
   serverErrorToEnvelope
-} from "../chunk-UVXB2ER7.js";
+} from "../chunk-7SABX4DJ.js";
 import {
   CodeModePermissionDeniedError,
   InProcessApprovalRequiredError,
@@ -191,13 +191,13 @@ import {
   parseChannelPath,
   serveMcpStdio,
   streamAgentTurnInProcess
-} from "../chunk-5AVPWHUE.js";
+} from "../chunk-FZG3JYB3.js";
 import {
   buildResourceDescriptors,
   defineAppResource,
   extractAppResources,
   readAppResource
-} from "../chunk-HZ6USUHC.js";
+} from "../chunk-YOIVCCZT.js";
 import {
   AuthRequiredError,
   _resetKeyCacheForTests,
@@ -223,7 +223,7 @@ import {
   verifyBackupCode,
   verifyOAuthState,
   verifyTotp
-} from "../chunk-SJIRP73B.js";
+} from "../chunk-646CA6RV.js";
 import {
   appendCookieToHeaders,
   appendDeleteCookieToHeaders,
@@ -233,15 +233,15 @@ import {
   parseCookieHeader,
   serializeCookie,
   setCookie
-} from "../chunk-ZJQ4O76G.js";
+} from "../chunk-4FWBKX6G.js";
 import {
   generateNonce
-} from "../chunk-C3ZZ56YZ.js";
+} from "../chunk-JA2ZAT5Q.js";
 import {
   InMemoryUsageStorage,
   trackAgentRun,
   trackAgentTools
-} from "../chunk-RMU7EBRO.js";
+} from "../chunk-SEELKQUM.js";
 import {
   CRON_MANIFEST_SCHEMA_VERSION,
   DuplicateCronNameError,
@@ -258,11 +258,11 @@ import {
   translateCronToVercel,
   validateCronSchedule,
   writeCronManifest
-} from "../chunk-U3NTEK46.js";
-import "../chunk-YB5DJJ4U.js";
-import "../chunk-6NEXVBPY.js";
-import "../chunk-7MQOHNHE.js";
-import "../chunk-X2VVCJ4V.js";
+} from "../chunk-2ADKT37V.js";
+import "../chunk-VZTYCAO6.js";
+import "../chunk-RWNSW4FM.js";
+import "../chunk-52PDWL5S.js";
+import "../chunk-U267AOWS.js";
 import {
   action,
   defineChannel,
@@ -273,18 +273,18 @@ import {
   tool,
   uiMessageStreamResponse,
   websocket
-} from "../chunk-JQJN6LFK.js";
+} from "../chunk-62EU2BVZ.js";
 import {
   HEALTH_PATH,
   READY_PATH,
   defineHealthRoute,
   defineReadyRoute,
   serveReservedRoute
-} from "../chunk-V3LJN2GS.js";
+} from "../chunk-GAPBPRPP.js";
 import {
   applyTransform
-} from "../chunk-E25FBYJP.js";
-import "../chunk-DGUM43GV.js";
+} from "../chunk-SAFGDIPQ.js";
+import "../chunk-XTHN6JBX.js";
 
 // src/server/openapi/serve-docs.ts
 import { existsSync, readFileSync, statSync } from "fs";