theokit 0.48.13 → 0.48.14

package/dist/{actions-virtual-module-YQXRSSMW.js → actions-virtual-module-E4PISKMB.js}

@@ -1,4 +1,4 @@
-import "./chunk-OJLL4YD6.js";
+import "./chunk-KTKTHIUF.js";
 import "./chunk-XALU5LCU.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
@@ -16,7 +16,7 @@ import "./chunk-OLGPYOLO.js";
 import "./chunk-AVQU5CQF.js";
 import "./chunk-ACKBVBUI.js";
 import "./chunk-IZ3TIL6K.js";
-import "./chunk-6E5WKMDS.js";
+import "./chunk-AXKUA57G.js";
 import "./chunk-JA2ZAT5Q.js";
 import "./chunk-U267AOWS.js";
 import "./chunk-XTHN6JBX.js";
@@ -222,4 +222,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-YQXRSSMW.js.map
+//# sourceMappingURL=actions-virtual-module-E4PISKMB.js.map

package/dist/{actions-virtual-module-LB4NGONI.js → actions-virtual-module-YZRZMHAX.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-BIVCP6X5.js";
-import "./chunk-6GGWS7J3.js";
+import "./chunk-WYHYOYRH.js";
+import "./chunk-DQIPV7L5.js";
 import "./chunk-T5C46IIU.js";
 import "./chunk-ZB7D62OA.js";
 import "./chunk-LNVMHQ2Z.js";
@@ -212,4 +212,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-LB4NGONI.js.map
+//# sourceMappingURL=actions-virtual-module-YZRZMHAX.js.map

package/dist/{agent-7JJW3TPB.js → agent-XAQCUQNB.js}

@@ -3,13 +3,13 @@ import "tsx/esm";
 import {
   agentCommand,
   createAgentSsrLoader
-} from "./chunk-PXFXSFJL.js";
+} from "./chunk-DS5MCU2X.js";
 import "./chunk-HBU2GIMZ.js";
-import "./chunk-6GGWS7J3.js";
+import "./chunk-DQIPV7L5.js";
 import "./chunk-LNVMHQ2Z.js";
 import "./chunk-A7JBF5FO.js";
 export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=agent-7JJW3TPB.js.map
+//# sourceMappingURL=agent-XAQCUQNB.js.map

package/dist/{app-typed-client-GHO3EWZK.js → app-typed-client-HLP26EYM.js}

@@ -1,6 +1,6 @@
 import {
   scanControllerModules
-} from "./chunk-OJLL4YD6.js";
+} from "./chunk-KTKTHIUF.js";
 import "./chunk-XALU5LCU.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
@@ -20,7 +20,7 @@ import "./chunk-OLGPYOLO.js";
 import "./chunk-AVQU5CQF.js";
 import "./chunk-ACKBVBUI.js";
 import "./chunk-IZ3TIL6K.js";
-import "./chunk-6E5WKMDS.js";
+import "./chunk-AXKUA57G.js";
 import "./chunk-JA2ZAT5Q.js";
 import "./chunk-U267AOWS.js";
 import "./chunk-XTHN6JBX.js";
@@ -424,4 +424,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-GHO3EWZK.js.map
+//# sourceMappingURL=app-typed-client-HLP26EYM.js.map

package/dist/{app-typed-client-G3J5G7E5.js → app-typed-client-I4X2UJWW.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-BIVCP6X5.js";
-import "./chunk-6GGWS7J3.js";
+import "./chunk-WYHYOYRH.js";
+import "./chunk-DQIPV7L5.js";
 import {
   scanControllerModules
 } from "./chunk-T5C46IIU.js";
@@ -414,4 +414,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-G3J5G7E5.js.map
+//# sourceMappingURL=app-typed-client-I4X2UJWW.js.map

package/dist/{aws-lambda-CYNDGU5O.js → aws-lambda-KES4MFJV.js}

@@ -2,11 +2,11 @@
 import "tsx/esm";
 import {
   nodeAdapter
-} from "./chunk-E576KYYT.js";
+} from "./chunk-BHOTGS7N.js";
 import {
   assertServicesUnsupported,
   readManifest
-} from "./chunk-7VPQHEAJ.js";
+} from "./chunk-WSXNGF7X.js";
 
 // src/adapters/aws-lambda.ts
 import { mkdirSync, writeFileSync } from "fs";
@@ -169,4 +169,4 @@ export {
   renderAwsLambdaEntry,
   responseToLambdaResultV2
 };
-//# sourceMappingURL=aws-lambda-CYNDGU5O.js.map
+//# sourceMappingURL=aws-lambda-KES4MFJV.js.map

package/dist/{build-WU6AKKIB.js → build-F2Q5QTSC.js}

@@ -17,15 +17,15 @@ import {
 import {
   importUserModule,
   loadConfig
-} from "./chunk-S433N3CT.js";
+} from "./chunk-AATSV4UV.js";
 import {
   loadEnv
 } from "./chunk-HBU2GIMZ.js";
-import "./chunk-GVW5EKEU.js";
+import "./chunk-CMYSHZFT.js";
 import {
   buildManifest,
   writeManifest
-} from "./chunk-7VPQHEAJ.js";
+} from "./chunk-WSXNGF7X.js";
 import "./chunk-T5C46IIU.js";
 import {
   generateManifest,
@@ -543,7 +543,7 @@ async function buildCommand(options) {
 `);
 }
 async function runAdapterBuild(target, config, cwd) {
-  const { theoPluginAsync } = await import("./vite-plugin-VPJFD4HK.js");
+  const { theoPluginAsync } = await import("./vite-plugin-RJFKLF2U.js");
   const { default: react } = await import("@vitejs/plugin-react");
   const ctx = {
     // `react()` may return Plugin or Plugin[] depending on version; spread the
@@ -561,7 +561,7 @@ async function runAdapterBuild(target, config, cwd) {
       })
     ].flat()
   };
-  const { resolveAdapter } = await import("./registry-GKR3EWRW.js");
+  const { resolveAdapter } = await import("./registry-S7OMF3OS.js");
   const adapter = await resolveAdapter(target);
   await adapter.build(config, cwd, ctx);
 }
@@ -629,4 +629,4 @@ function relativize3(absPath, root) {
 export {
   buildCommand
 };
-//# sourceMappingURL=build-WU6AKKIB.js.map
+//# sourceMappingURL=build-F2Q5QTSC.js.map

package/dist/{bun-33RD6K7O.js → bun-A5B2MJMO.js}

@@ -2,11 +2,11 @@
 import "tsx/esm";
 import {
   nodeAdapter
-} from "./chunk-E576KYYT.js";
+} from "./chunk-BHOTGS7N.js";
 import {
   assertServicesUnsupported,
   readManifest
-} from "./chunk-7VPQHEAJ.js";
+} from "./chunk-WSXNGF7X.js";
 
 // src/adapters/bun.ts
 import { mkdirSync, writeFileSync } from "fs";
@@ -136,4 +136,4 @@ export {
   bunAdapter,
   renderBunEntry
 };
-//# sourceMappingURL=bun-33RD6K7O.js.map
+//# sourceMappingURL=bun-A5B2MJMO.js.map

package/dist/{chunk-S433N3CT.js → chunk-AATSV4UV.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-HBU2GIMZ.js";
 import {
   theoConfigSchema
-} from "./chunk-GVW5EKEU.js";
+} from "./chunk-CMYSHZFT.js";
 
 // src/config/load-config.ts
 import { existsSync } from "fs";
@@ -140,4 +140,4 @@ export {
   deepMerge,
   loadConfig
 };
-//# sourceMappingURL=chunk-S433N3CT.js.map
+//# sourceMappingURL=chunk-AATSV4UV.js.map

package/dist/{chunk-6E5WKMDS.js → chunk-AXKUA57G.js}

@@ -20,6 +20,7 @@ var DEFAULT_REGISTRY = [
   }
 ];
 var registry = [...DEFAULT_REGISTRY];
+var announced = /* @__PURE__ */ new Set();
 function registerProvider(descriptor) {
   const idx = registry.findIndex((p) => p.name === descriptor.name);
   if (idx >= 0) registry[idx] = descriptor;
@@ -32,11 +33,37 @@ function resetProviderRegistry() {
 function listProviders() {
   return [...registry].sort((a, b) => a.priority - b.priority);
 }
-function resolveProvider() {
+function announce(desc, how, options) {
+  if (announced.has(desc.name)) return;
+  announced.add(desc.name);
+  const line = `[theokit] provider=${desc.name} (${how}) source=${desc.envKey} baseUrl=${desc.baseUrl}`;
+  if (options?.announce) options.announce(line);
+  else console.warn(line);
+}
+function providerOf(modelId, registered) {
+  if (modelId === void 0) return void 0;
+  const slash = modelId.indexOf("/");
+  if (slash <= 0) return void 0;
+  const prefix = modelId.slice(0, slash);
+  return registered.find((p) => p.name === prefix);
+}
+function resolveProvider(modelId, options) {
   const sorted = [...registry].sort((a, b) => a.priority - b.priority);
+  const declared = modelId === void 0 ? void 0 : providerOf(modelId, sorted);
+  if (declared !== void 0 && modelId !== void 0) {
+    const apiKey = process.env[declared.envKey];
+    if (apiKey && apiKey.length > 0) {
+      announce(declared, "declared by the model", options);
+      return { name: declared.name, apiKey, baseUrl: declared.baseUrl };
+    }
+    throw new Error(
+      `Model "${modelId}" declares provider "${declared.name}", but ${declared.envKey} is not set. Set ${declared.envKey}, or change the model's provider prefix.`
+    );
+  }
   for (const desc of sorted) {
     const apiKey = process.env[desc.envKey];
     if (apiKey && apiKey.length > 0) {
+      announce(desc, "by env priority", options);
       return {
         name: desc.name,
         apiKey,
@@ -49,9 +76,9 @@ function resolveProvider() {
     `No LLM provider API key found in environment. Set one of: ${envKeys}. Get a free OpenRouter key at https://openrouter.ai/keys (recommended \u2014 one key, many models).`
   );
 }
-function tryResolveProvider() {
+function tryResolveProvider(modelId) {
   try {
-    return resolveProvider();
+    return resolveProvider(modelId);
   } catch {
     return null;
   }
@@ -64,4 +91,4 @@ export {
   resolveProvider,
   tryResolveProvider
 };
-//# sourceMappingURL=chunk-6E5WKMDS.js.map
+//# sourceMappingURL=chunk-AXKUA57G.js.map

package/dist/chunk-AXKUA57G.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/agent/provider-resolver.ts"],"mappings":";AAgEA,IAAM,mBAAyC;AAAA,EAC7C;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AACF;AAMA,IAAM,WAAiC,CAAC,GAAG,gBAAgB;AAU3D,IAAM,YAAY,oBAAI,IAAY;AA2B3B,SAAS,iBAAiB,YAAsC;AAErE,QAAM,MAAM,SAAS,UAAU,CAAC,MAAM,EAAE,SAAS,WAAW,IAAI;AAChE,MAAI,OAAO,EAAG,UAAS,GAAG,IAAI;AAAA,MACzB,UAAS,KAAK,UAAU;AAC/B;AAOO,SAAS,wBAA8B;AAC5C,WAAS,SAAS;AAClB,WAAS,KAAK,GAAG,gBAAgB;AACnC;AAOO,SAAS,gBAA+C;AAC7D,SAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AAC7D;AASA,SAAS,SACP,MACA,KACA,SACM;AACN,MAAI,UAAU,IAAI,KAAK,IAAI,EAAG;AAC9B,YAAU,IAAI,KAAK,IAAI;AACvB,QAAM,OAAO,sBAAsB,KAAK,IAAI,KAAK,GAAG,YAAY,KAAK,MAAM,YAAY,KAAK,OAAO;AACnG,MAAI,SAAS,SAAU,SAAQ,SAAS,IAAI;AAAA,MAIvC,SAAQ,KAAK,IAAI;AACxB;AAaA,SAAS,WACP,SACA,YACgC;AAChC,MAAI,YAAY,OAAW,QAAO;AAClC,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,SAAS,EAAG,QAAO;AACvB,QAAM,SAAS,QAAQ,MAAM,GAAG,KAAK;AACrC,SAAO,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM;AACjD;AAaO,SAAS,gBAAgB,SAAkB,SAA4C;AAC5F,QAAM,SAAS,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AAEnE,QAAM,WAAW,YAAY,SAAY,SAAY,WAAW,SAAS,MAAM;AAC/E,MAAI,aAAa,UAAa,YAAY,QAAW;AACnD,UAAM,SAAS,QAAQ,IAAI,SAAS,MAAM;AAC1C,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,UAAU,yBAAyB,OAAO;AACnD,aAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,SAAS,SAAS,QAAQ;AAAA,IAClE;AAIA,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,wBAAwB,SAAS,IAAI,UAAU,SAAS,MAAM,oBACtE,SAAS,MAAM;AAAA,IAC1B;AAAA,EACF;AAEA,aAAW,QAAQ,QAAQ;AACzB,UAAM,SAAS,QAAQ,IAAI,KAAK,MAAM;AACtC,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,MAAM,mBAAmB,OAAO;AACzC,aAAO;AAAA,QACL,MAAM,KAAK;AAAA,QACX;AAAA,QACA,SAAS,KAAK;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,MAAM;AACvD,QAAM,IAAI;AAAA,IACR,6DAA6D,OAAO;AAAA,EAEtE;AACF;AAQO,SAAS,mBAAmB,SAA2C;AAC5E,MAAI;AACF,WAAO,gBAAgB,OAAO;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-E576KYYT.js → chunk-BHOTGS7N.js}

@@ -4,7 +4,7 @@ import {
   generateCaddyfile,
   generateComposeYaml,
   readManifest
-} from "./chunk-7VPQHEAJ.js";
+} from "./chunk-WSXNGF7X.js";
 
 // src/adapters/node.ts
 import { writeFileSync } from "fs";
@@ -62,4 +62,4 @@ var nodeAdapter = {
 export {
   nodeAdapter
 };
-//# sourceMappingURL=chunk-E576KYYT.js.map
+//# sourceMappingURL=chunk-BHOTGS7N.js.map

package/dist/{chunk-GVW5EKEU.js → chunk-CMYSHZFT.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   servicesConfigSchema
-} from "./chunk-7VPQHEAJ.js";
+} from "./chunk-WSXNGF7X.js";
 
 // src/config/schema.ts
 import { z as z8 } from "zod";
@@ -419,4 +419,4 @@ export {
   storageSchema,
   theoConfigSchema
 };
-//# sourceMappingURL=chunk-GVW5EKEU.js.map
+//# sourceMappingURL=chunk-CMYSHZFT.js.map

package/dist/{chunk-6GGWS7J3.js → chunk-DQIPV7L5.js}

@@ -23,11 +23,38 @@ var DEFAULT_REGISTRY = [
   }
 ];
 var registry = [...DEFAULT_REGISTRY];
-function resolveProvider() {
+var announced = /* @__PURE__ */ new Set();
+function announce(desc, how, options) {
+  if (announced.has(desc.name)) return;
+  announced.add(desc.name);
+  const line = `[theokit] provider=${desc.name} (${how}) source=${desc.envKey} baseUrl=${desc.baseUrl}`;
+  if (options?.announce) options.announce(line);
+  else console.warn(line);
+}
+function providerOf(modelId, registered) {
+  if (modelId === void 0) return void 0;
+  const slash = modelId.indexOf("/");
+  if (slash <= 0) return void 0;
+  const prefix = modelId.slice(0, slash);
+  return registered.find((p) => p.name === prefix);
+}
+function resolveProvider(modelId, options) {
   const sorted = [...registry].sort((a, b) => a.priority - b.priority);
+  const declared = modelId === void 0 ? void 0 : providerOf(modelId, sorted);
+  if (declared !== void 0 && modelId !== void 0) {
+    const apiKey = process.env[declared.envKey];
+    if (apiKey && apiKey.length > 0) {
+      announce(declared, "declared by the model", options);
+      return { name: declared.name, apiKey, baseUrl: declared.baseUrl };
+    }
+    throw new Error(
+      `Model "${modelId}" declares provider "${declared.name}", but ${declared.envKey} is not set. Set ${declared.envKey}, or change the model's provider prefix.`
+    );
+  }
   for (const desc of sorted) {
     const apiKey = process.env[desc.envKey];
     if (apiKey && apiKey.length > 0) {
+      announce(desc, "by env priority", options);
       return {
         name: desc.name,
         apiKey,
@@ -88,4 +115,4 @@ export {
   getApprovalRegistry,
   resolveProvider
 };
-//# sourceMappingURL=chunk-6GGWS7J3.js.map
+//# sourceMappingURL=chunk-DQIPV7L5.js.map

package/dist/chunk-DQIPV7L5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/agent/provider-resolver.ts","../src/server/agent/approval-registry.ts"],"sourcesContent":["/**\n * Provider Resolver — Strategy + Registry pattern (FAANG-grade).\n *\n * Inspiration: Dapr Conversation Registry (`dapr/pkg/components/conversation/registry.go`)\n * + Encore Manager provider array (`encore/runtimes/go/pubsub/manager_internal.go`).\n *\n * Principle: provider routing is the FRAMEWORK's responsibility, not the consumer's — but the\n * consumer still gets to SAY which provider it wants, and it says so in the model id.\n *\n * `provider/model` is the convention every agent in this ecosystem already writes\n * (`anthropic/claude-sonnet-4-6`, `openrouter/anthropic/claude-haiku-4.5`), and it is the one the\n * SDK routes on. Until theokit#326 this resolver ignored it entirely and picked by env-var\n * priority, so an agent that declared `anthropic/...` was handed an OpenRouter key whenever one\n * happened to be present — and every turn failed with `auth_failed (HTTP 401)` against a provider\n * nobody asked for. The declared provider now wins; priority is the fallback for a bare model id.\n *\n * Wire protocol: OpenAI Chat Completions (universal — implemented by every\n * os providers: OpenRouter, Groq, Mistral, Together, Anthropic via proxy, etc).\n *\n * Resolution by priority (FIRST match wins):\n *   1. OPENROUTER_API_KEY → baseUrl=openrouter.ai (multi-model gateway)\n *   2. OPENAI_API_KEY     → baseUrl=api.openai.com\n *   3. ANTHROPIC_API_KEY  → direct Anthropic (Messages API, not OpenAI-compat)\n *\n * Escape hatch: an explicit `options.apiKey` OVERRIDES auto-resolution\n * (the consumer can force a specific provider if it wants to).\n */\n\n/**\n * Provider configuration descriptor — Registry entry shape.\n *\n * @public\n */\nexport interface ProviderDescriptor {\n  /** Stable name used internally — not exposed on the wire. */\n  name: string\n  /** Environment variable that holds the API key for this provider. */\n  envKey: string\n  /** Base URL for the provider's OpenAI-compatible (or native) API. */\n  baseUrl: string\n  /** Resolution priority (lower = higher priority). FIRST match wins. */\n  priority: number\n}\n\n/**\n * Resolved provider configuration — output of `resolveProvider()`.\n *\n * @public\n */\nexport interface ResolvedProvider {\n  name: string\n  apiKey: string\n  baseUrl: string\n}\n\n/**\n * Default provider registry. Order = priority (first = highest).\n *\n * Adding a new provider:\n *   1. Append entry below (or register via `registerProvider()`).\n *   2. Set `envKey` matching the user's env var convention.\n *   3. Set `baseUrl` to the OpenAI-compat endpoint (or native if not compat).\n *   4. Provider name used in telemetry/logs only — never wire-exposed.\n */\nconst DEFAULT_REGISTRY: ProviderDescriptor[] = [\n  {\n    name: 'openrouter',\n    envKey: 'OPENROUTER_API_KEY',\n    baseUrl: 'https://openrouter.ai/api/v1',\n    priority: 1,\n  },\n  {\n    name: 'openai',\n    envKey: 'OPENAI_API_KEY',\n    baseUrl: 'https://api.openai.com/v1',\n    priority: 2,\n  },\n  {\n    name: 'anthropic',\n    envKey: 'ANTHROPIC_API_KEY',\n    baseUrl: 'https://api.anthropic.com',\n    priority: 3,\n  },\n]\n\n/**\n * Runtime registry — copy of DEFAULT_REGISTRY mutable via registerProvider().\n * Sorted by priority on every resolve (stable, O(n log n) — n <= ~10 providers).\n */\nconst registry: ProviderDescriptor[] = [...DEFAULT_REGISTRY]\n\n/**\n * Providers already announced, so a boot line does not become a per-request line.\n *\n * theokit#326 — resolution was silent on success. `resolveProvider` returns `{ name, apiKey,\n * baseUrl }` and every call site consumes only the key, so an operator could only learn which\n * provider was selected from an error message: exactly when it has already failed, and never in\n * the case that hurts most — a stale key that resolves cleanly and 401s at the provider.\n */\nconst announced = new Set<string>()\n\n/** Test-only reset, so announcement state does not leak between cases. @public */\nexport function resetProviderAnnouncements(): void {\n  announced.clear()\n}\n\n/** Where the announcement goes, and what it may contain. @public */\nexport interface ResolveOptions {\n  /** Receives one line per provider, at most once. NEVER receives the key. */\n  announce?: (line: string) => void\n}\n\n/**\n * Register a new provider (Registry pattern — runtime extension point).\n * Useful for self-hosted endpoints or custom providers without touching theokit src.\n *\n * @example\n * registerProvider({\n *   name: 'self-hosted',\n *   envKey: 'SELF_HOSTED_API_KEY',\n *   baseUrl: 'https://llm.internal.acme.com/v1',\n *   priority: 0, // highest priority\n * })\n *\n * @public\n */\nexport function registerProvider(descriptor: ProviderDescriptor): void {\n  // Idempotent — replace existing by name.\n  const idx = registry.findIndex((p) => p.name === descriptor.name)\n  if (idx >= 0) registry[idx] = descriptor\n  else registry.push(descriptor)\n}\n\n/**\n * Reset registry to DEFAULT_REGISTRY (test-only / dev escape hatch).\n *\n * @public\n */\nexport function resetProviderRegistry(): void {\n  registry.length = 0\n  registry.push(...DEFAULT_REGISTRY)\n}\n\n/**\n * Get current registry snapshot (read-only — inspection).\n *\n * @public\n */\nexport function listProviders(): readonly ProviderDescriptor[] {\n  return [...registry].sort((a, b) => a.priority - b.priority)\n}\n\n/**\n * Says which provider was selected, once.\n *\n * Carries the provider, HOW it was chosen, and the variable the credential came from — never the\n * credential. Which env var holds it is what an operator needs to fix a mis-selection; the value\n * is what a log must never hold.\n */\nfunction announce(\n  desc: ProviderDescriptor,\n  how: 'declared by the model' | 'by env priority',\n  options: ResolveOptions | undefined,\n): void {\n  if (announced.has(desc.name)) return\n  announced.add(desc.name)\n  const line = `[theokit] provider=${desc.name} (${how}) source=${desc.envKey} baseUrl=${desc.baseUrl}`\n  if (options?.announce) options.announce(line)\n  // `warn` rather than `info` because the repo's lint rule allows only `warn`/`error` — and this\n  // line is closer to a warning in spirit anyway: it is the one chance an operator gets to notice\n  // that the provider serving their agents is not the one they expected.\n  else console.warn(line)\n}\n\n/**\n * The provider a model id declares, or `undefined` when it declares none.\n *\n * `provider/model` and `gateway/provider/model` both resolve on the FIRST segment: a gateway is a\n * provider from the framework's point of view (it holds the credential), and everything after it\n * is the upstream namespace the gateway itself routes on.\n *\n * A bare id (`gpt-4o-mini`, `qwen2.5:3b`) declares nothing, and an unregistered prefix is treated\n * the same way rather than as an error — a project may legitimately point a custom id at a\n * registered provider's endpoint, and refusing it here would break that before it reached the SDK.\n */\nfunction providerOf(\n  modelId: string | undefined,\n  registered: readonly ProviderDescriptor[],\n): ProviderDescriptor | undefined {\n  if (modelId === undefined) return undefined\n  const slash = modelId.indexOf('/')\n  if (slash <= 0) return undefined\n  const prefix = modelId.slice(0, slash)\n  return registered.find((p) => p.name === prefix)\n}\n\n/**\n * Resolve the provider for a model.\n *\n * When `modelId` declares a registered provider (`anthropic/…`), THAT provider's key is\n * required — no substitution. Otherwise the registry is walked by priority, first match wins.\n *\n * @returns ResolvedProvider with apiKey + baseUrl + name\n * @throws Error if NO provider env var is set (actionable message)\n *\n * @public\n */\nexport function resolveProvider(modelId?: string, options?: ResolveOptions): ResolvedProvider {\n  const sorted = [...registry].sort((a, b) => a.priority - b.priority)\n\n  const declared = modelId === undefined ? undefined : providerOf(modelId, sorted)\n  if (declared !== undefined && modelId !== undefined) {\n    const apiKey = process.env[declared.envKey]\n    if (apiKey && apiKey.length > 0) {\n      announce(declared, 'declared by the model', options)\n      return { name: declared.name, apiKey, baseUrl: declared.baseUrl }\n    }\n    // Deliberately NOT falling back to another provider's key. Silently substituting one is how\n    // theokit#326 produced a 401 nobody could attribute: the request went somewhere the agent\n    // never named. Say which variable is missing and stop.\n    throw new Error(\n      `Model \"${modelId}\" declares provider \"${declared.name}\", but ${declared.envKey} is not set. ` +\n        `Set ${declared.envKey}, or change the model's provider prefix.`,\n    )\n  }\n\n  for (const desc of sorted) {\n    const apiKey = process.env[desc.envKey]\n    if (apiKey && apiKey.length > 0) {\n      announce(desc, 'by env priority', options)\n      return {\n        name: desc.name,\n        apiKey,\n        baseUrl: desc.baseUrl,\n      }\n    }\n  }\n  // No env var found — emit actionable error.\n  const envKeys = sorted.map((p) => p.envKey).join(' OR ')\n  throw new Error(\n    `No LLM provider API key found in environment. Set one of: ${envKeys}. ` +\n      `Get a free OpenRouter key at https://openrouter.ai/keys (recommended — one key, many models).`,\n  )\n}\n\n/**\n * Try to resolve — does NOT throw. Returns null if no provider available.\n * Useful for graceful degradation (e.g., mock mode).\n *\n * @public\n */\nexport function tryResolveProvider(modelId?: string): ResolvedProvider | null {\n  try {\n    return resolveProvider(modelId)\n  } catch {\n    return null\n  }\n}\n","/**\n * M4 (theokit-ai-first) — the in-process HITL approval registry.\n *\n * The HITL plugin's `awaitApproval` calls `register(approvalId)` and awaits the returned Promise\n * (this is what genuinely PAUSES the SDK run — the SDK `pre_tool_call` hook is awaited). The\n * approve route calls `resolve(approvalId, approved)` to settle it. A per-approval timeout settles\n * the Promise deterministically per the `@HumanInTheLoop` `onTimeout` policy so a hung approval\n * never leaks the paused stream.\n *\n * Single-process contract (ADR 0038 / plan Drawback 2): a multi-instance deploy needs a shared\n * registry — the interface is injectable so a durable impl (Redis, etc.) slots in without touching\n * the harness. We do NOT build a durable store now (YAGNI).\n */\n// The timeout policy vocabulary is owned by the `@HumanInTheLoop` decorator (DRY / G12) — reuse it\n// rather than re-declaring the union, so the two can never drift.\nimport type { TimeoutAction } from '@theokit/agents'\n\nexport interface RegisterOptions {\n  /** Milliseconds before the approval auto-settles per `onTimeout`. */\n  timeoutMs: number\n  /**\n   * What a timeout means. Only `'proceed'` auto-approves; `'abort'` and `'retry'` both deny — the\n   * registry does NOT implement retry semantics (a timed-out `'retry'` is a deny, not a re-prompt).\n   */\n  onTimeout: TimeoutAction\n  /** M14 — the gated tool name, surfaced by `list()` (optional; absent for legacy callers). */\n  toolName?: string\n  /** M14 — the approval question, surfaced by `list()` (optional). */\n  question?: string\n  /**\n   * M20 — an optional JSON-schema descriptor of the custom payload the approver may attach. Carried\n   * verbatim into `list()` + the `approval_required` event so the UI knows what to collect. Kept as\n   * a plain JSON object (not a live Zod schema) so the registry stays serializable and SDK-free.\n   */\n  payloadSchema?: Record<string, unknown>\n}\n\n/**\n * M20 — a settled HITL decision. `approved` is the allow/deny bit (backward-compatible with the\n * legacy boolean); `reason` + `payload` are the optional approver-attached extras that surface to\n * the model (on denial, via the veto message) and to the app/UI.\n */\nexport interface ApprovalDecision {\n  approved: boolean\n  reason?: string\n  payload?: unknown\n}\n\n/** M14 — a pending approval as surfaced by {@link ApprovalRegistry.list}. */\nexport interface PendingApproval {\n  approvalId: string\n  toolName?: string\n  question?: string\n  /** Epoch millis when the pending approval auto-settles (registeredAt + timeoutMs). */\n  expiresAt: number\n  /** M20 — the declared custom-payload schema, if the gated tool declares one. */\n  payloadSchema?: Record<string, unknown>\n}\n\nexport interface ApprovalRegistry {\n  /**\n   * Register a pending approval; the returned Promise settles with the full {@link ApprovalDecision}\n   * on `resolve` or timeout (M20 — was a bare boolean pre-M20).\n   */\n  register(approvalId: string, opts: RegisterOptions): Promise<ApprovalDecision>\n  /**\n   * Settle a pending approval. Accepts a full {@link ApprovalDecision} OR a bare boolean (coerced to\n   * `{ approved }` — backward-compatible). Returns false if the id is unknown or already settled.\n   */\n  resolve(approvalId: string, decision: boolean | ApprovalDecision): boolean\n  /** M14 — list the currently-pending approvals (process-wide; single-process contract). */\n  list(): PendingApproval[]\n}\n\ninterface Pending {\n  settle: (decision: ApprovalDecision) => void\n  timer: ReturnType<typeof setTimeout>\n  info: PendingApproval\n}\n\n/**\n * The one process-wide registry the stream mount (`mountAgent`) and the approve route share.\n *\n * The in-process impl holds LIVE Promise resolvers in memory — the approval a request awaits and\n * the approval the route resolves MUST be the same object, so a single instance per process is not\n * a convenience but a correctness requirement. Lazily created; a durable/multi-instance deploy\n * swaps this accessor for a shared-store impl (ADR 0038 / plan Drawback 2) without touching callers.\n * Tests use {@link createInProcessApprovalRegistry} directly — never this singleton.\n */\nlet serverRegistry: ApprovalRegistry | undefined\nexport function getApprovalRegistry(): ApprovalRegistry {\n  serverRegistry ??= createInProcessApprovalRegistry()\n  return serverRegistry\n}\n\nexport function createInProcessApprovalRegistry(): ApprovalRegistry {\n  const pending = new Map<string, Pending>()\n\n  return {\n    register(approvalId, opts) {\n      return new Promise<ApprovalDecision>((resolve) => {\n        const settle = (decision: ApprovalDecision): void => {\n          const entry = pending.get(approvalId)\n          if (!entry) return\n          clearTimeout(entry.timer)\n          pending.delete(approvalId)\n          resolve(decision)\n        }\n        // 'proceed' → allow on timeout; 'abort'/'retry' → deny on timeout.\n        const timer = setTimeout(() => {\n          settle({ approved: opts.onTimeout === 'proceed' })\n        }, opts.timeoutMs)\n        const info: PendingApproval = {\n          approvalId,\n          toolName: opts.toolName,\n          question: opts.question,\n          expiresAt: Date.now() + opts.timeoutMs,\n          ...(opts.payloadSchema !== undefined ? { payloadSchema: opts.payloadSchema } : {}),\n        }\n        pending.set(approvalId, { settle, timer, info })\n      })\n    },\n    resolve(approvalId, decision) {\n      const entry = pending.get(approvalId)\n      if (!entry) return false\n      // M20 — coerce the legacy bare-boolean form to a decision object.\n      entry.settle(typeof decision === 'boolean' ? { approved: decision } : decision)\n      return true\n    },\n    list() {\n      return [...pending.values()].map((p) => p.info)\n    },\n  }\n}\n"],"mappings":";;;;AAgEA,IAAM,mBAAyC;AAAA,EAC7C;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AACF;AAMA,IAAM,WAAiC,CAAC,GAAG,gBAAgB;AAU3D,IAAM,YAAY,oBAAI,IAAY;AA4DlC,SAAS,SACP,MACA,KACA,SACM;AACN,MAAI,UAAU,IAAI,KAAK,IAAI,EAAG;AAC9B,YAAU,IAAI,KAAK,IAAI;AACvB,QAAM,OAAO,sBAAsB,KAAK,IAAI,KAAK,GAAG,YAAY,KAAK,MAAM,YAAY,KAAK,OAAO;AACnG,MAAI,SAAS,SAAU,SAAQ,SAAS,IAAI;AAAA,MAIvC,SAAQ,KAAK,IAAI;AACxB;AAaA,SAAS,WACP,SACA,YACgC;AAChC,MAAI,YAAY,OAAW,QAAO;AAClC,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,SAAS,EAAG,QAAO;AACvB,QAAM,SAAS,QAAQ,MAAM,GAAG,KAAK;AACrC,SAAO,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM;AACjD;AAaO,SAAS,gBAAgB,SAAkB,SAA4C;AAC5F,QAAM,SAAS,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AAEnE,QAAM,WAAW,YAAY,SAAY,SAAY,WAAW,SAAS,MAAM;AAC/E,MAAI,aAAa,UAAa,YAAY,QAAW;AACnD,UAAM,SAAS,QAAQ,IAAI,SAAS,MAAM;AAC1C,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,UAAU,yBAAyB,OAAO;AACnD,aAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,SAAS,SAAS,QAAQ;AAAA,IAClE;AAIA,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,wBAAwB,SAAS,IAAI,UAAU,SAAS,MAAM,oBACtE,SAAS,MAAM;AAAA,IAC1B;AAAA,EACF;AAEA,aAAW,QAAQ,QAAQ;AACzB,UAAM,SAAS,QAAQ,IAAI,KAAK,MAAM;AACtC,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,MAAM,mBAAmB,OAAO;AACzC,aAAO;AAAA,QACL,MAAM,KAAK;AAAA,QACX;AAAA,QACA,SAAS,KAAK;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,MAAM;AACvD,QAAM,IAAI;AAAA,IACR,6DAA6D,OAAO;AAAA,EAEtE;AACF;;;AC1JA,IAAI;AACG,SAAS,sBAAwC;AACtD,qBAAmB,gCAAgC;AACnD,SAAO;AACT;AAEO,SAAS,kCAAoD;AAClE,QAAM,UAAU,oBAAI,IAAqB;AAEzC,SAAO;AAAA,IACL,SAAS,YAAY,MAAM;AACzB,aAAO,IAAI,QAA0B,CAAC,YAAY;AAChD,cAAM,SAAS,CAAC,aAAqC;AACnD,gBAAM,QAAQ,QAAQ,IAAI,UAAU;AACpC,cAAI,CAAC,MAAO;AACZ,uBAAa,MAAM,KAAK;AACxB,kBAAQ,OAAO,UAAU;AACzB,kBAAQ,QAAQ;AAAA,QAClB;AAEA,cAAM,QAAQ,WAAW,MAAM;AAC7B,iBAAO,EAAE,UAAU,KAAK,cAAc,UAAU,CAAC;AAAA,QACnD,GAAG,KAAK,SAAS;AACjB,cAAM,OAAwB;AAAA,UAC5B;AAAA,UACA,UAAU,KAAK;AAAA,UACf,UAAU,KAAK;AAAA,UACf,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,UAC7B,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,QAClF;AACA,gBAAQ,IAAI,YAAY,EAAE,QAAQ,OAAO,KAAK,CAAC;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,IACA,QAAQ,YAAY,UAAU;AAC5B,YAAM,QAAQ,QAAQ,IAAI,UAAU;AACpC,UAAI,CAAC,MAAO,QAAO;AAEnB,YAAM,OAAO,OAAO,aAAa,YAAY,EAAE,UAAU,SAAS,IAAI,QAAQ;AAC9E,aAAO;AAAA,IACT;AAAA,IACA,OAAO;AACL,aAAO,CAAC,GAAG,QAAQ,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAChD;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-PXFXSFJL.js → chunk-DS5MCU2X.js}

@@ -6,7 +6,7 @@ import {
 import {
   getApprovalRegistry,
   resolveProvider
-} from "./chunk-6GGWS7J3.js";
+} from "./chunk-DQIPV7L5.js";
 import {
   scanAgents
 } from "./chunk-LNVMHQ2Z.js";
@@ -145,7 +145,7 @@ async function agentCommand(name, message, deps = {}) {
     );
   }
   const projectRoot = deps.projectRoot ?? process.cwd();
-  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-VKD6LKWU.js")).loadConfig(projectRoot)).agentsDir;
+  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-FIWNKOJO.js")).loadConfig(projectRoot)).agentsDir;
   const agents = scanAgents(projectRoot, agentsDir);
   const agent = agents.find((a) => a.name === name);
   if (!agent) {
@@ -178,8 +178,8 @@ async function agentCommand(name, message, deps = {}) {
 async function createAgentSsrLoader(projectRoot) {
   const { createServer } = await import("vite");
   const react = (await import("@vitejs/plugin-react")).default;
-  const { theoPluginAsync } = await import("./vite-plugin-VPJFD4HK.js");
-  const { loadConfig } = await import("./load-config-VKD6LKWU.js");
+  const { theoPluginAsync } = await import("./vite-plugin-RJFKLF2U.js");
+  const { loadConfig } = await import("./load-config-FIWNKOJO.js");
   const config = await loadConfig(projectRoot);
   const theoPlugins = await theoPluginAsync({
     root: projectRoot,
@@ -212,4 +212,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=chunk-PXFXSFJL.js.map
+//# sourceMappingURL=chunk-DS5MCU2X.js.map

package/dist/{chunk-GXEX4CBH.js → chunk-FTFN4MYN.js}

@@ -18,7 +18,7 @@ import {
   mintRunId,
   mountAgent,
   parseAgentRequestBody
-} from "./chunk-OJLL4YD6.js";
+} from "./chunk-KTKTHIUF.js";
 import {
   loadEnv,
   resolveTransformer
@@ -74,7 +74,7 @@ import {
 } from "./chunk-YOIVCCZT.js";
 import {
   resolveProvider
-} from "./chunk-6E5WKMDS.js";
+} from "./chunk-AXKUA57G.js";
 import {
   generateNonce
 } from "./chunk-JA2ZAT5Q.js";
@@ -1481,7 +1481,9 @@ async function serveThreadRoute(request, method, urlPath, deps) {
     const mod = await deps.loadModule(agent.filePath);
     return handleThreadMessage({
       mod,
-      apiKey: deps.resolveApiKey(),
+      // Passed unresolved: `makeThreadStartRun` calls it once the module is compiled and the
+      // model is known (theokit#328).
+      apiKey: deps.resolveApiKey,
       sessionId: msg.sessionId,
       request,
       source: `agent "${msg.name}"`,
@@ -1600,7 +1602,8 @@ async function serveAux(req, res, next, urlPath, deps) {
       baseUrl: `http://${req.headers.host ?? "localhost"}`,
       csrfMode: deps.csrfMode,
       // M39 — the thread follow-up route drives the agent; resolve the key on demand.
-      resolveApiKey: () => resolveProvider().apiKey
+      // theokit#328 — the thread route drives an agent, so its key follows the model too.
+      resolveApiKey: (model) => resolveProvider(model).apiKey
     });
     if (response === null) {
       next();
@@ -1627,7 +1630,7 @@ async function serveAux(req, res, next, urlPath, deps) {
     requestId
   });
 }
-function createAgentMiddleware(vite, projectRoot, csrfMode = "strict", agentsDir = "agents") {
+function createAgentMiddleware(vite, projectRoot, csrfMode = "strict", agentsDir = "agents", pluginRunner) {
   const loadModule = createViteLoader(vite);
   return (req, res, next) => {
     void (async () => {
@@ -1675,30 +1678,90 @@ function createAgentMiddleware(vite, projectRoot, csrfMode = "strict", agentsDir
         logRequest({ method, url, status: 405, duration: Date.now() - start, requestId });
         return;
       }
-      try {
-        const mod = await loadModule(agent.filePath);
-        const apiKey = resolveProvider().apiKey;
-        const request = incomingMessageToWebRequest(req);
-        const response = await mountAgent(mod, request, apiKey, {
-          source: agent.filePath,
-          csrfMode,
-          projectRoot
-        });
-        await writeWebResponseToServerResponse(response, res);
-      } catch (err) {
-        sendError(
-          res,
-          "INTERNAL",
-          err instanceof Error ? err.message : "Agent handler failed",
-          500,
-          void 0,
-          requestId
-        );
-      }
-      logRequest({ method, url, status: res.statusCode, duration: Date.now() - start, requestId });
+      await serveAgentTurn({
+        req,
+        res,
+        agent,
+        method,
+        url,
+        requestId,
+        start,
+        loadModule,
+        csrfMode,
+        projectRoot,
+        pluginRunner
+      });
     })();
   };
 }
+async function serveAgentTurn(t) {
+  const {
+    req,
+    res,
+    agent,
+    method,
+    url,
+    requestId,
+    start,
+    loadModule,
+    csrfMode,
+    projectRoot,
+    pluginRunner
+  } = t;
+  let pluginCtx;
+  let request;
+  try {
+    request = incomingMessageToWebRequest(req);
+    pluginCtx = { request, response: res, ctx: {}, requestId };
+  } catch (err) {
+    sendError(
+      res,
+      "INTERNAL",
+      err instanceof Error ? err.message : "Agent handler failed",
+      500,
+      void 0,
+      requestId
+    );
+    logRequest({ method, url, status: res.statusCode, duration: Date.now() - start, requestId });
+    return;
+  }
+  if (pluginRunner) {
+    pluginRunner.applyDecorations(pluginCtx.ctx);
+    const onRequest = await pluginRunner.runOnRequest(pluginCtx);
+    if (onRequest.shortCircuited) {
+      logRequest({
+        method,
+        url,
+        status: res.statusCode,
+        duration: Date.now() - start,
+        requestId
+      });
+      return;
+    }
+  }
+  try {
+    const mod = await loadModule(agent.filePath);
+    const apiKey = (model) => resolveProvider(model).apiKey;
+    const response = await mountAgent(mod, request, apiKey, {
+      source: agent.filePath,
+      csrfMode,
+      projectRoot
+    });
+    await writeWebResponseToServerResponse(response, res);
+  } catch (err) {
+    if (pluginRunner) await pluginRunner.runOnError(pluginCtx, err);
+    sendError(
+      res,
+      "INTERNAL",
+      err instanceof Error ? err.message : "Agent handler failed",
+      500,
+      void 0,
+      requestId
+    );
+  }
+  if (pluginRunner) await pluginRunner.runOnResponse(pluginCtx);
+  logRequest({ method, url, status: res.statusCode, duration: Date.now() - start, requestId });
+}
 
 // src/vite-plugin/api-middleware.ts
 import { resolve as resolve4 } from "path";
@@ -1817,7 +1880,10 @@ async function tryControllerFallthrough(ctx) {
     requestId: ctx.requestId,
     // M47 — serve @Expose-bound agent routes via the ONE runtime (mountAgent). CSRF is already enforced
     // once at the controller-dispatch boundary (G5), so mountAgent runs with csrfMode 'off' (no double gate).
-    serveAgent: (agent, request) => mountAgent(agent, request, resolveProvider().apiKey, { source: "expose", csrfMode: "off" })
+    serveAgent: (agent, request) => mountAgent(agent, request, (model) => resolveProvider(model).apiKey, {
+      source: "expose",
+      csrfMode: "off"
+    })
   });
   if (!handled) return false;
   logRequest(
@@ -2151,7 +2217,7 @@ async function runConfigureServer(server, ctx) {
     })
   );
   server.middlewares.use(
-    createAgentMiddleware(server, ctx.projectRoot, ctx.csrfMode, ctx.agentsDir)
+    createAgentMiddleware(server, ctx.projectRoot, ctx.csrfMode, ctx.agentsDir, ctx.pluginRunner)
   );
   const servicesProxyPrefixes = ctx.services && Object.keys(ctx.services).length > 0 ? Object.values(ctx.services).map((s) => s.proxy) : [];
   const csrfReadinessStore = ctx.csrfReadinessStoreOverride ?? new CsrfReadinessStore();
@@ -3293,19 +3359,19 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-GHO3EWZK.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-HLP26EYM.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve9(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-YQXRSSMW.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-E4PISKMB.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve9(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-INR2E7B3.js");
-  const { generateManifest } = await import("./internal-api-WEOSTMSN.js");
+  const { generateManifest } = await import("./internal-api-ZCJWJ5EC.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -3499,4 +3565,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-GXEX4CBH.js.map
+//# sourceMappingURL=chunk-FTFN4MYN.js.map