theokit 0.48.13 → 0.50.0

package/README.md

@@ -47,6 +47,7 @@ missing:
 import { route, action, websocket, middleware, tool, plugin } from 'theokit/server'
 
 export const GET = route()
+  .policy('public')
   .query(z.object({ search: z.string().optional() }))
   .handler(({ query }) => ({ results: search(query.search) }))
   .build()

package/dist/{actions-virtual-module-YQXRSSMW.js → actions-virtual-module-5WBVSDOM.js}

@@ -1,24 +1,34 @@
-import "./chunk-OJLL4YD6.js";
-import "./chunk-XALU5LCU.js";
+import "./chunk-SL7YUHPV.js";
+import "./chunk-WOBSEO75.js";
+import "./chunk-RWNYIU6A.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
-import "./chunk-KD5G3YXI.js";
+import "./chunk-MCTC6HSE.js";
+import "./chunk-72DMJBXI.js";
 import "./chunk-VSLTKX5L.js";
 import "./chunk-TNI4MARH.js";
-import "./chunk-7LVM22VG.js";
+import "./chunk-OQCRCXCP.js";
 import {
   scanServerActionsEnriched
-} from "./chunk-YGAXV5HR.js";
+} from "./chunk-6J4JWHDJ.js";
 import "./chunk-DV34VG3N.js";
-import "./chunk-FB2HBNIC.js";
-import "./chunk-MTEWLGVY.js";
-import "./chunk-OLGPYOLO.js";
+import "./chunk-L4VFNFDL.js";
+import "./chunk-BX6EUYHU.js";
+import "./chunk-BPYMC7SU.js";
+import "./chunk-IRQGAC4L.js";
+import "./chunk-P6OS7652.js";
 import "./chunk-AVQU5CQF.js";
 import "./chunk-ACKBVBUI.js";
 import "./chunk-IZ3TIL6K.js";
-import "./chunk-6E5WKMDS.js";
-import "./chunk-JA2ZAT5Q.js";
-import "./chunk-U267AOWS.js";
+import "./chunk-3PBAN2YE.js";
+import "./chunk-YSJOZEI6.js";
+import "./chunk-Z4PJMZLM.js";
+import "./chunk-UMNXCU3K.js";
+import "./chunk-52PDWL5S.js";
+import "./chunk-5K4TDLRG.js";
+import "./chunk-ZWN3AODA.js";
+import "./chunk-D4VP2QPR.js";
+import "./chunk-YN4W7LCX.js";
 import "./chunk-XTHN6JBX.js";
 
 // src/vite-plugin/actions-virtual-module.ts
@@ -222,4 +232,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-YQXRSSMW.js.map
+//# sourceMappingURL=actions-virtual-module-5WBVSDOM.js.map

package/dist/actions-virtual-module-5WBVSDOM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vite-plugin/actions-virtual-module.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,SAAS,YAAY,WAAW,YAAY,SAAS,SAAS,qBAAqB;AACnF,SAAS,SAAS,MAAM,OAAO,eAAe;AAM9C,IAAM,aAAa;AACnB,IAAM,cAAc,KAAK,UAAU;AAc5B,SAAS,qBAAqB,MAA2C;AAC9E,QAAM,EAAE,WAAW,QAAQ,IAAI;AAE/B,WAAS,iBAAuB;AAC9B,QAAI,YAAY,OAAW;AAC3B,UAAM,UAAU,SAAS,SAAS;AAClC,UAAM,UAAU,MAAM,KAAK,QAAQ,OAAO,EAAE,QAAQ,OAAO,GAAG,GAAG,cAAc;AAC/E,UAAM,UAAU,mBAAmB,OAAO;AAC1C,QAAI;AAEF,gBAAU,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AAC/C,YAAM,MAAM,GAAG,OAAO,IAAI,QAAQ,GAAG;AAErC,oBAAc,KAAK,OAAO;AAE1B,iBAAW,KAAK,OAAO;AAAA,IACzB,SAAS,KAAK;AACZ,cAAQ,MAAM,oDAAoD,GAAG;AAAA,IACvE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,iBAAiB;AACf,qBAAe;AAAA,IACjB;AAAA,IACA,WAAW;AACT,qBAAe;AAAA,IACjB;AAAA,IACA,UAAU,IAAY;AACpB,UAAI,OAAO,WAAY,QAAO;AAC9B,aAAO;AAAA,IACT;AAAA,IACA,KAAK,IAAY;AACf,UAAI,OAAO,YAAa,QAAO;AAC/B,YAAM,UAAU,SAAS,SAAS;AAClC,YAAM,MAAM;AACZ,YAAM,UAAU,KAAK,aAAa;AAClC,YAAM,WAAW,YAAY,YAAY,YAAY;AACrD,aAAO,WAAW,qBAAqB,OAAO,IAAI,uBAAuB,OAAO;AAAA,IAClF;AAAA,IACA,gBAAgB,QAAuB;AACrC,YAAM,aAAa,KAAK,WAAW,SAAS;AAE5C,UAAI,CAAC,WAAW,UAAU,EAAG;AAI7B,YAAM,UAAU,QAAQ,YAAY,EAAE,WAAW,KAAK,GAAG,MAAM;AAC7D,uBAAe;AACf,cAAM,MAAM,OAAO,YAAY,cAAc,WAAW;AACxD,YAAI,KAAK;AACP,iBAAO,YAAY,iBAAiB,GAAG;AAAA,QACzC;AACA,eAAO,GAAG,KAAK,EAAE,MAAM,cAAc,CAAC;AAAA,MACxC,CAAC;AACD,aAAO,YAAY,KAAK,SAAS,MAAM;AACrC,gBAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAUA,SAAS,mBAAmB,SAAiD;AAC3E,QAAM,QAAQ,QACX,IAAI,CAAC,UAAU;AACd,UAAM,cAAc;AAIpB,QAAI,MAAM,mBAAmB,QAAW;AACtC,YAAM,mBAAmB,MAAM,eAC5B,QAAQ,OAAO,GAAG,EAClB,QAAQ,sBAAsB,KAAK;AACtC,aAAO,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC,MAAM,WAAW,6CAA6C,KAAK,UAAU,gBAAgB,CAAC;AAAA,IACxI;AACA,WAAO,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,WAAW;AAAA,EAC1D,CAAC,EACA,KAAK,IAAI;AACZ,SAAO;AAAA;AAAA;AAAA,EAGP,KAAK;AAAA;AAAA;AAAA;AAIP;AAEA,SAAS,SAAS,WAA0C;AAC1D,MAAI;AACF,WAAO,0BAA0B,SAAS;AAAA,EAC5C,QAAQ;AAGN,WAAO,CAAC;AAAA,EACV;AACF;AAQA,SAAS,qBAAqB,SAAwC;AACpE,QAAM,aAAa,QAChB,IAAI,CAAC,UAAU,KAAK,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,KAAK,UAAU,MAAM,OAAO,CAAC,GAAG,EACnF,KAAK,IAAI;AAMZ,QAAM,gBAAgB,QAAQ,OAAO,CAAC,MAAM,EAAE,mBAAmB,MAAS;AAC1E,QAAM,gBAAgB,cACnB,IAAI,CAAC,OAAO,QAAQ;AAInB,UAAM,aAAa,MAAM,eAAgB,QAAQ,OAAO,GAAG;AAC3D,WAAO,kCAAkC,GAAG,WAAW,KAAK,UAAU,UAAU,CAAC;AAAA,EACnF,CAAC,EACA,KAAK,IAAI;AACZ,QAAM,iBAAiB,cACpB,IAAI,CAAC,OAAO,QAAQ,KAAK,KAAK,UAAU,MAAM,IAAI,CAAC,iBAAiB,GAAG,GAAG,EAC1E,KAAK,IAAI;AAEZ,SAAO;AAAA;AAAA,EAEP,aAAa;AAAA;AAAA;AAAA,EAGb,UAAU;AAAA;AAAA;AAAA;AAAA,EAIV,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0FhB;AAOA,SAAS,uBAAuB,SAAwC;AACtE,SAAO;AAAA;AAAA,0BAEiB,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAAA;AAAA;AAG1D;","names":[]}

package/dist/{actions-virtual-module-LB4NGONI.js → actions-virtual-module-ZYLMNW6K.js}

@@ -1,14 +1,19 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-BIVCP6X5.js";
-import "./chunk-6GGWS7J3.js";
-import "./chunk-T5C46IIU.js";
-import "./chunk-ZB7D62OA.js";
-import "./chunk-LNVMHQ2Z.js";
+import "./chunk-C62IZEJI.js";
+import "./chunk-5YPXXSYY.js";
+import "./chunk-HWBRS4DZ.js";
+import "./chunk-RPET332G.js";
+import "./chunk-7PM6K5EV.js";
+import "./chunk-2AMLGJJA.js";
+import "./chunk-KUZVRJ7M.js";
+import "./chunk-EVZKNA2W.js";
 import {
   scanServerActionsEnriched
-} from "./chunk-BMHS4WAN.js";
-import "./chunk-A7JBF5FO.js";
+} from "./chunk-XS7EX55U.js";
+import "./chunk-FD4ZDTQ6.js";
+import "./chunk-U5PWXS3J.js";
+import "./chunk-VI7ZANB3.js";
 import "./chunk-VQIUTCK2.js";
 
 // src/vite-plugin/actions-virtual-module.ts
@@ -212,4 +217,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-LB4NGONI.js.map
+//# sourceMappingURL=actions-virtual-module-ZYLMNW6K.js.map

package/dist/{actions-virtual-module-LB4NGONI.js.map → actions-virtual-module-ZYLMNW6K.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/vite-plugin/actions-virtual-module.ts"],"sourcesContent":["/**\n * Vite plugin: resolves `@theo/actions` virtual module and emits a typed\n * Proxy facade that calls `theoFetch('/_actions/<name>', body)` against the\n * server-side action handlers.\n *\n * Per plan g3-server-actions-and-useaction v1.2 § Phase 3 / T3.1 + ADR D4.\n * Astro `vite-plugin-actions.ts` modular pattern. Single focused plugin\n * (not monolithic), virtual module + `configureServer` watcher.\n *\n * Module shape emitted on client environment: thin proxy that forwards\n * `actions.<name>(input)` to `POST /_actions/<name>` with JSON or\n * FormData body. On server environment: re-export of the manifest for\n * SSR / module-loader access (T1.3 sub-C consumer).\n *\n * EC-15 (DOCUMENT): HMR uses Vite default invalidation — coarse but\n * correct. Optimization (fine-grained invalidation of only consumers of\n * `@theo/actions`) deferred to G3.1 if dev-server p95 reload > 500ms.\n */\nimport { existsSync, mkdirSync, renameSync, watch as fsWatch, writeFileSync } from 'node:fs'\nimport { dirname, join, posix, resolve } from 'node:path'\n\nimport type { Plugin, ViteDevServer } from 'vite'\n\nimport { scanServerActionsEnriched, type ActionManifestEntry } from '../server/internal-api.js'\n\nconst VIRTUAL_ID = '@theo/actions'\nconst RESOLVED_ID = `\\0${VIRTUAL_ID}`\n\ninterface ActionsVirtualModuleOptions {\n  /** Path to server directory (where `actions/` lives). */\n  serverDir: string\n  /**\n   * Optional `.theokit/` output dir for emitting `actions.d.ts`. When provided,\n   * the plugin writes an ambient `declare module '@theo/actions'` so TS in\n   * consumer apps can resolve the virtual module import. Mirrors the G1\n   * `app-typed-client` emit pattern.\n   */\n  distDir?: string\n}\n\nexport function actionsVirtualModule(opts: ActionsVirtualModuleOptions): Plugin {\n  const { serverDir, distDir } = opts\n\n  function emitActionsDts(): void {\n    if (distDir === undefined) return\n    const entries = safeScan(serverDir)\n    const dtsPath = posix.join(resolve(distDir).replace(/\\\\/g, '/'), 'actions.d.ts')\n    const content = generateActionsDts(entries)\n    try {\n      // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time derived path\n      mkdirSync(dirname(dtsPath), { recursive: true })\n      const tmp = `${dtsPath}.${process.pid}.tmp`\n      // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time derived path\n      writeFileSync(tmp, content)\n      // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time derived path\n      renameSync(tmp, dtsPath)\n    } catch (err) {\n      console.error('[theokit:actions-virtual-module] dts emit error:', err)\n    }\n  }\n\n  return {\n    name: 'theo:actions-virtual-module',\n    enforce: 'pre',\n    configResolved() {\n      emitActionsDts()\n    },\n    buildEnd() {\n      emitActionsDts()\n    },\n    resolveId(id: string) {\n      if (id === VIRTUAL_ID) return RESOLVED_ID\n      return undefined\n    },\n    load(id: string) {\n      if (id !== RESOLVED_ID) return undefined\n      const entries = safeScan(serverDir)\n      const ctx = this as unknown as { environment?: { name?: string } } | undefined\n      const envName = ctx?.environment?.name\n      const isClient = envName === 'client' || envName === undefined\n      return isClient ? generateClientFacade(entries) : generateServerManifest(entries)\n    },\n    configureServer(server: ViteDevServer) {\n      const actionsDir = join(serverDir, 'actions')\n      // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time derived path\n      if (!existsSync(actionsDir)) return\n      // EC-15: coarse invalidation — invalidate ALL modules on actions file change.\n      // Optimization deferred per plan ADR D4 note.\n      // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time path\n      const watcher = fsWatch(actionsDir, { recursive: true }, () => {\n        emitActionsDts()\n        const mod = server.moduleGraph.getModuleById(RESOLVED_ID)\n        if (mod) {\n          server.moduleGraph.invalidateModule(mod)\n        }\n        server.ws.send({ type: 'full-reload' })\n      })\n      server.httpServer?.once('close', () => {\n        watcher.close()\n      })\n    },\n  }\n}\n\n/**\n * Emit `.theokit/actions.d.ts` — ambient declaration of `@theo/actions` so\n * consumer TS apps can `import { actions } from '@theo/actions'` and get\n * typed completions for each scanned action name. Each entry maps name to\n * a generic `(input: unknown) => Promise<{data, error}>` invoker — the full\n * input/output inference from defineAction would require either monomorphic\n * dts-bundle or virtual type emit (deferred to a future plan).\n */\nfunction generateActionsDts(entries: readonly ActionManifestEntry[]): string {\n  const lines = entries\n    .map((entry) => {\n      const invokerType = `(input: unknown) => Promise<{ data: unknown; error: undefined } | { data: undefined; error: { code: string; message: string; fields?: Record<string, string[]>; type?: string } }>`\n      // P#4 plugin-forms typed __zodSchema (per plan p4-plugin-forms v1.1 EC-3).\n      // When schemaFilePath present, emit intersection type so consumers see both\n      // the callable invoker AND the __zodSchema field with the exact schema type.\n      if (entry.schemaFilePath !== undefined) {\n        const schemaImportPath = entry.schemaFilePath\n          .replace(/\\\\/g, '/')\n          .replace(/\\.(ts|tsx|js|jsx)$/, '.js')\n        return `    ${JSON.stringify(entry.name)}: (${invokerType}) & { readonly __zodSchema: typeof import(${JSON.stringify(schemaImportPath)}).schema }`\n      }\n      return `    ${JSON.stringify(entry.name)}: ${invokerType}`\n    })\n    .join('\\n')\n  return `// AUTO-GENERATED by @theo/actions virtual module. DO NOT EDIT MANUALLY.\ndeclare module '@theo/actions' {\n  export const actions: {\n${lines}\n  }\n}\n`\n}\n\nfunction safeScan(serverDir: string): ActionManifestEntry[] {\n  try {\n    return scanServerActionsEnriched(serverDir)\n  } catch {\n    // ActionScanError surfaces at build time; for HMR keep an empty manifest\n    // so the dev server doesn't crash mid-edit.\n    return []\n  }\n}\n\n/**\n * Client-side module: emits a Proxy facade. For each action `name` in\n * manifest, `actions.<name>(input)` POSTs to `/_actions/<name>` with JSON\n * body (or FormData when input is a FormData instance) and parses the\n * `application/json+devalue` response via the runtime helper.\n */\nfunction generateClientFacade(entries: ActionManifestEntry[]): string {\n  const entryLines = entries\n    .map((entry) => `  ${JSON.stringify(entry.name)}: ${JSON.stringify(entry.urlPath)},`)\n    .join('\\n')\n\n  // P#4 plugin-forms shared-schema convention (per plan p4-plugin-forms v1.1 T1.1).\n  // Emit ESM imports + ACTION_SCHEMA_MAP so the Proxy can attach __zodSchema.\n  // Vite resolves absolute filesystem paths via its module graph; schema files\n  // are isomorphic (zod-only, no server APIs) so they bundle into the client.\n  const schemaEntries = entries.filter((e) => e.schemaFilePath !== undefined)\n  const schemaImports = schemaEntries\n    .map((entry, idx) => {\n      // schemaEntries was filtered by `e.schemaFilePath !== undefined` above,\n      // so the assertion is provably safe in this scope.\n      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n      const importPath = entry.schemaFilePath!.replace(/\\\\/g, '/')\n      return `import { schema as __theoSchema${idx} } from ${JSON.stringify(importPath)}`\n    })\n    .join('\\n')\n  const schemaMapLines = schemaEntries\n    .map((entry, idx) => `  ${JSON.stringify(entry.name)}: __theoSchema${idx},`)\n    .join('\\n')\n\n  return `// AUTO-GENERATED by @theo/actions virtual module\n/* eslint-disable */\n${schemaImports}\n\nconst ACTION_URL_MAP = {\n${entryLines}\n}\n\nconst ACTION_SCHEMA_MAP = {\n${schemaMapLines}\n}\n\n// Devtools telemetry — fires in the SAME realm as the Overlay React tree\n// (browser), so the Actions tab updates immediately on each call.\n// The Overlay component installs \\`window.__theoDevtoolsDispatcher\\` on\n// mount (dev only; prod tree-shakes the Overlay entirely). Reading the\n// global avoids a cross-package dynamic import that Vite's virtual-module\n// resolver cannot trace. Same pattern as React DevTools'\n// \\`__REACT_DEVTOOLS_GLOBAL_HOOK__\\`.\nfunction emitTelemetry(name, startedAt, input, outcome) {\n  if (typeof window === 'undefined') return\n  const dispatcher = window.__theoDevtoolsDispatcher\n  if (!dispatcher || typeof dispatcher.onActionCall !== 'function') return\n  try {\n    dispatcher.onActionCall({\n      id: 'act-' + String(Date.now()) + '-' + Math.random().toString(36).slice(2, 8),\n      timestamp: startedAt,\n      name,\n      input,\n      output: outcome.status === 'success' ? outcome.data : undefined,\n      error: outcome.status === 'error' ? outcome.error : undefined,\n      durationMs: Date.now() - startedAt,\n      status: outcome.status,\n    })\n  } catch (_) {\n    // dispatcher threw — devtools UI bug; never bubble to consumer code\n  }\n}\n\nasync function callAction(name, url, input) {\n  const startedAt = Date.now()\n  const isForm = typeof FormData !== 'undefined' && input instanceof FormData\n  const headers = { 'x-theo-action': '1' }\n  const body = isForm ? input : JSON.stringify(input ?? {})\n  if (!isForm) headers['content-type'] = 'application/json'\n  let response\n  try {\n    response = await fetch(url, { method: 'POST', headers, body, credentials: 'same-origin' })\n  } catch (e) {\n    const err = { code: 'NETWORK_ERROR', message: e && e.message ? e.message : 'fetch failed' }\n    emitTelemetry(name, startedAt, input, { status: 'error', error: err })\n    return { data: undefined, error: err }\n  }\n  const contentType = response.headers.get('content-type') ?? ''\n  let result\n  if (response.status === 204) {\n    result = { data: undefined, error: undefined }\n  } else if (contentType.startsWith('application/json+devalue')) {\n    const text = await response.text()\n    const { parse } = await import('devalue')\n    result = { data: parse(text, { URL: (h) => new URL(h) }), error: undefined }\n  } else if (contentType.startsWith('application/json')) {\n    const json = await response.json()\n    result = response.ok ? { data: json, error: undefined } : { data: undefined, error: json }\n  } else {\n    result = { data: undefined, error: { code: 'INTERNAL_SERVER_ERROR', message: await response.text() } }\n  }\n  emitTelemetry(name, startedAt, input, result.error\n    ? { status: 'error', error: result.error }\n    : { status: 'success', data: result.data })\n  return result\n}\n\n// P#4 plugin-forms cache: callable proxies must be stable per action so that\n// repeated property access does not allocate + reset the __zodSchema attach.\nconst ACTION_CALLABLE_CACHE = {}\n\nexport const actions = new Proxy({}, {\n  get(target, prop) {\n    if (typeof prop !== 'string') return undefined\n    const url = ACTION_URL_MAP[prop]\n    if (!url) return undefined\n    if (!ACTION_CALLABLE_CACHE[prop]) {\n      const callable = (input) => callAction(prop, url, input)\n      const schema = ACTION_SCHEMA_MAP[prop]\n      if (schema !== undefined) {\n        Object.defineProperty(callable, '__zodSchema', {\n          value: schema,\n          enumerable: false,\n          writable: false,\n          configurable: false,\n        })\n      }\n      ACTION_CALLABLE_CACHE[prop] = callable\n    }\n    return ACTION_CALLABLE_CACHE[prop]\n  },\n})\n`\n}\n\n/**\n * Server-side module: re-exports the manifest entries for SSR / module-\n * loader consumption (T1.3 sub-C in action-execute.ts will route requests\n * via this manifest).\n */\nfunction generateServerManifest(entries: ActionManifestEntry[]): string {\n  return `// AUTO-GENERATED by @theo/actions virtual module (server env)\n/* eslint-disable */\nexport const manifest = ${JSON.stringify(entries, null, 2)}\nexport const actions = manifest\n`\n}\n"],"mappings":";;;;;;;;;;;;;;AAkBA,SAAS,YAAY,WAAW,YAAY,SAAS,SAAS,qBAAqB;AACnF,SAAS,SAAS,MAAM,OAAO,eAAe;AAM9C,IAAM,aAAa;AACnB,IAAM,cAAc,KAAK,UAAU;AAc5B,SAAS,qBAAqB,MAA2C;AAC9E,QAAM,EAAE,WAAW,QAAQ,IAAI;AAE/B,WAAS,iBAAuB;AAC9B,QAAI,YAAY,OAAW;AAC3B,UAAM,UAAU,SAAS,SAAS;AAClC,UAAM,UAAU,MAAM,KAAK,QAAQ,OAAO,EAAE,QAAQ,OAAO,GAAG,GAAG,cAAc;AAC/E,UAAM,UAAU,mBAAmB,OAAO;AAC1C,QAAI;AAEF,gBAAU,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AAC/C,YAAM,MAAM,GAAG,OAAO,IAAI,QAAQ,GAAG;AAErC,oBAAc,KAAK,OAAO;AAE1B,iBAAW,KAAK,OAAO;AAAA,IACzB,SAAS,KAAK;AACZ,cAAQ,MAAM,oDAAoD,GAAG;AAAA,IACvE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,iBAAiB;AACf,qBAAe;AAAA,IACjB;AAAA,IACA,WAAW;AACT,qBAAe;AAAA,IACjB;AAAA,IACA,UAAU,IAAY;AACpB,UAAI,OAAO,WAAY,QAAO;AAC9B,aAAO;AAAA,IACT;AAAA,IACA,KAAK,IAAY;AACf,UAAI,OAAO,YAAa,QAAO;AAC/B,YAAM,UAAU,SAAS,SAAS;AAClC,YAAM,MAAM;AACZ,YAAM,UAAU,KAAK,aAAa;AAClC,YAAM,WAAW,YAAY,YAAY,YAAY;AACrD,aAAO,WAAW,qBAAqB,OAAO,IAAI,uBAAuB,OAAO;AAAA,IAClF;AAAA,IACA,gBAAgB,QAAuB;AACrC,YAAM,aAAa,KAAK,WAAW,SAAS;AAE5C,UAAI,CAAC,WAAW,UAAU,EAAG;AAI7B,YAAM,UAAU,QAAQ,YAAY,EAAE,WAAW,KAAK,GAAG,MAAM;AAC7D,uBAAe;AACf,cAAM,MAAM,OAAO,YAAY,cAAc,WAAW;AACxD,YAAI,KAAK;AACP,iBAAO,YAAY,iBAAiB,GAAG;AAAA,QACzC;AACA,eAAO,GAAG,KAAK,EAAE,MAAM,cAAc,CAAC;AAAA,MACxC,CAAC;AACD,aAAO,YAAY,KAAK,SAAS,MAAM;AACrC,gBAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAUA,SAAS,mBAAmB,SAAiD;AAC3E,QAAM,QAAQ,QACX,IAAI,CAAC,UAAU;AACd,UAAM,cAAc;AAIpB,QAAI,MAAM,mBAAmB,QAAW;AACtC,YAAM,mBAAmB,MAAM,eAC5B,QAAQ,OAAO,GAAG,EAClB,QAAQ,sBAAsB,KAAK;AACtC,aAAO,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC,MAAM,WAAW,6CAA6C,KAAK,UAAU,gBAAgB,CAAC;AAAA,IACxI;AACA,WAAO,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,WAAW;AAAA,EAC1D,CAAC,EACA,KAAK,IAAI;AACZ,SAAO;AAAA;AAAA;AAAA,EAGP,KAAK;AAAA;AAAA;AAAA;AAIP;AAEA,SAAS,SAAS,WAA0C;AAC1D,MAAI;AACF,WAAO,0BAA0B,SAAS;AAAA,EAC5C,QAAQ;AAGN,WAAO,CAAC;AAAA,EACV;AACF;AAQA,SAAS,qBAAqB,SAAwC;AACpE,QAAM,aAAa,QAChB,IAAI,CAAC,UAAU,KAAK,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,KAAK,UAAU,MAAM,OAAO,CAAC,GAAG,EACnF,KAAK,IAAI;AAMZ,QAAM,gBAAgB,QAAQ,OAAO,CAAC,MAAM,EAAE,mBAAmB,MAAS;AAC1E,QAAM,gBAAgB,cACnB,IAAI,CAAC,OAAO,QAAQ;AAInB,UAAM,aAAa,MAAM,eAAgB,QAAQ,OAAO,GAAG;AAC3D,WAAO,kCAAkC,GAAG,WAAW,KAAK,UAAU,UAAU,CAAC;AAAA,EACnF,CAAC,EACA,KAAK,IAAI;AACZ,QAAM,iBAAiB,cACpB,IAAI,CAAC,OAAO,QAAQ,KAAK,KAAK,UAAU,MAAM,IAAI,CAAC,iBAAiB,GAAG,GAAG,EAC1E,KAAK,IAAI;AAEZ,SAAO;AAAA;AAAA,EAEP,aAAa;AAAA;AAAA;AAAA,EAGb,UAAU;AAAA;AAAA;AAAA;AAAA,EAIV,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0FhB;AAOA,SAAS,uBAAuB,SAAwC;AACtE,SAAO;AAAA;AAAA,0BAEiB,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAAA;AAAA;AAG1D;","names":[]}
+{"version":3,"sources":["../src/vite-plugin/actions-virtual-module.ts"],"sourcesContent":["/**\n * Vite plugin: resolves `@theo/actions` virtual module and emits a typed\n * Proxy facade that calls `theoFetch('/_actions/<name>', body)` against the\n * server-side action handlers.\n *\n * Per plan g3-server-actions-and-useaction v1.2 § Phase 3 / T3.1 + ADR D4.\n * Astro `vite-plugin-actions.ts` modular pattern. Single focused plugin\n * (not monolithic), virtual module + `configureServer` watcher.\n *\n * Module shape emitted on client environment: thin proxy that forwards\n * `actions.<name>(input)` to `POST /_actions/<name>` with JSON or\n * FormData body. On server environment: re-export of the manifest for\n * SSR / module-loader access (T1.3 sub-C consumer).\n *\n * EC-15 (DOCUMENT): HMR uses Vite default invalidation — coarse but\n * correct. Optimization (fine-grained invalidation of only consumers of\n * `@theo/actions`) deferred to G3.1 if dev-server p95 reload > 500ms.\n */\nimport { existsSync, mkdirSync, renameSync, watch as fsWatch, writeFileSync } from 'node:fs'\nimport { dirname, join, posix, resolve } from 'node:path'\n\nimport type { Plugin, ViteDevServer } from 'vite'\n\nimport { scanServerActionsEnriched, type ActionManifestEntry } from '../server/internal-api.js'\n\nconst VIRTUAL_ID = '@theo/actions'\nconst RESOLVED_ID = `\\0${VIRTUAL_ID}`\n\ninterface ActionsVirtualModuleOptions {\n  /** Path to server directory (where `actions/` lives). */\n  serverDir: string\n  /**\n   * Optional `.theokit/` output dir for emitting `actions.d.ts`. When provided,\n   * the plugin writes an ambient `declare module '@theo/actions'` so TS in\n   * consumer apps can resolve the virtual module import. Mirrors the G1\n   * `app-typed-client` emit pattern.\n   */\n  distDir?: string\n}\n\nexport function actionsVirtualModule(opts: ActionsVirtualModuleOptions): Plugin {\n  const { serverDir, distDir } = opts\n\n  function emitActionsDts(): void {\n    if (distDir === undefined) return\n    const entries = safeScan(serverDir)\n    const dtsPath = posix.join(resolve(distDir).replace(/\\\\/g, '/'), 'actions.d.ts')\n    const content = generateActionsDts(entries)\n    try {\n      // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time derived path\n      mkdirSync(dirname(dtsPath), { recursive: true })\n      const tmp = `${dtsPath}.${process.pid}.tmp`\n      // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time derived path\n      writeFileSync(tmp, content)\n      // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time derived path\n      renameSync(tmp, dtsPath)\n    } catch (err) {\n      console.error('[theokit:actions-virtual-module] dts emit error:', err)\n    }\n  }\n\n  return {\n    name: 'theo:actions-virtual-module',\n    enforce: 'pre',\n    configResolved() {\n      emitActionsDts()\n    },\n    buildEnd() {\n      emitActionsDts()\n    },\n    resolveId(id: string) {\n      if (id === VIRTUAL_ID) return RESOLVED_ID\n      return undefined\n    },\n    load(id: string) {\n      if (id !== RESOLVED_ID) return undefined\n      const entries = safeScan(serverDir)\n      const ctx = this as unknown as { environment?: { name?: string } } | undefined\n      const envName = ctx?.environment?.name\n      const isClient = envName === 'client' || envName === undefined\n      return isClient ? generateClientFacade(entries) : generateServerManifest(entries)\n    },\n    configureServer(server: ViteDevServer) {\n      const actionsDir = join(serverDir, 'actions')\n      // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time derived path\n      if (!existsSync(actionsDir)) return\n      // EC-15: coarse invalidation — invalidate ALL modules on actions file change.\n      // Optimization deferred per plan ADR D4 note.\n      // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time path\n      const watcher = fsWatch(actionsDir, { recursive: true }, () => {\n        emitActionsDts()\n        const mod = server.moduleGraph.getModuleById(RESOLVED_ID)\n        if (mod) {\n          server.moduleGraph.invalidateModule(mod)\n        }\n        server.ws.send({ type: 'full-reload' })\n      })\n      server.httpServer?.once('close', () => {\n        watcher.close()\n      })\n    },\n  }\n}\n\n/**\n * Emit `.theokit/actions.d.ts` — ambient declaration of `@theo/actions` so\n * consumer TS apps can `import { actions } from '@theo/actions'` and get\n * typed completions for each scanned action name. Each entry maps name to\n * a generic `(input: unknown) => Promise<{data, error}>` invoker — the full\n * input/output inference from defineAction would require either monomorphic\n * dts-bundle or virtual type emit (deferred to a future plan).\n */\nfunction generateActionsDts(entries: readonly ActionManifestEntry[]): string {\n  const lines = entries\n    .map((entry) => {\n      const invokerType = `(input: unknown) => Promise<{ data: unknown; error: undefined } | { data: undefined; error: { code: string; message: string; fields?: Record<string, string[]>; type?: string } }>`\n      // P#4 plugin-forms typed __zodSchema (per plan p4-plugin-forms v1.1 EC-3).\n      // When schemaFilePath present, emit intersection type so consumers see both\n      // the callable invoker AND the __zodSchema field with the exact schema type.\n      if (entry.schemaFilePath !== undefined) {\n        const schemaImportPath = entry.schemaFilePath\n          .replace(/\\\\/g, '/')\n          .replace(/\\.(ts|tsx|js|jsx)$/, '.js')\n        return `    ${JSON.stringify(entry.name)}: (${invokerType}) & { readonly __zodSchema: typeof import(${JSON.stringify(schemaImportPath)}).schema }`\n      }\n      return `    ${JSON.stringify(entry.name)}: ${invokerType}`\n    })\n    .join('\\n')\n  return `// AUTO-GENERATED by @theo/actions virtual module. DO NOT EDIT MANUALLY.\ndeclare module '@theo/actions' {\n  export const actions: {\n${lines}\n  }\n}\n`\n}\n\nfunction safeScan(serverDir: string): ActionManifestEntry[] {\n  try {\n    return scanServerActionsEnriched(serverDir)\n  } catch {\n    // ActionScanError surfaces at build time; for HMR keep an empty manifest\n    // so the dev server doesn't crash mid-edit.\n    return []\n  }\n}\n\n/**\n * Client-side module: emits a Proxy facade. For each action `name` in\n * manifest, `actions.<name>(input)` POSTs to `/_actions/<name>` with JSON\n * body (or FormData when input is a FormData instance) and parses the\n * `application/json+devalue` response via the runtime helper.\n */\nfunction generateClientFacade(entries: ActionManifestEntry[]): string {\n  const entryLines = entries\n    .map((entry) => `  ${JSON.stringify(entry.name)}: ${JSON.stringify(entry.urlPath)},`)\n    .join('\\n')\n\n  // P#4 plugin-forms shared-schema convention (per plan p4-plugin-forms v1.1 T1.1).\n  // Emit ESM imports + ACTION_SCHEMA_MAP so the Proxy can attach __zodSchema.\n  // Vite resolves absolute filesystem paths via its module graph; schema files\n  // are isomorphic (zod-only, no server APIs) so they bundle into the client.\n  const schemaEntries = entries.filter((e) => e.schemaFilePath !== undefined)\n  const schemaImports = schemaEntries\n    .map((entry, idx) => {\n      // schemaEntries was filtered by `e.schemaFilePath !== undefined` above,\n      // so the assertion is provably safe in this scope.\n      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n      const importPath = entry.schemaFilePath!.replace(/\\\\/g, '/')\n      return `import { schema as __theoSchema${idx} } from ${JSON.stringify(importPath)}`\n    })\n    .join('\\n')\n  const schemaMapLines = schemaEntries\n    .map((entry, idx) => `  ${JSON.stringify(entry.name)}: __theoSchema${idx},`)\n    .join('\\n')\n\n  return `// AUTO-GENERATED by @theo/actions virtual module\n/* eslint-disable */\n${schemaImports}\n\nconst ACTION_URL_MAP = {\n${entryLines}\n}\n\nconst ACTION_SCHEMA_MAP = {\n${schemaMapLines}\n}\n\n// Devtools telemetry — fires in the SAME realm as the Overlay React tree\n// (browser), so the Actions tab updates immediately on each call.\n// The Overlay component installs \\`window.__theoDevtoolsDispatcher\\` on\n// mount (dev only; prod tree-shakes the Overlay entirely). Reading the\n// global avoids a cross-package dynamic import that Vite's virtual-module\n// resolver cannot trace. Same pattern as React DevTools'\n// \\`__REACT_DEVTOOLS_GLOBAL_HOOK__\\`.\nfunction emitTelemetry(name, startedAt, input, outcome) {\n  if (typeof window === 'undefined') return\n  const dispatcher = window.__theoDevtoolsDispatcher\n  if (!dispatcher || typeof dispatcher.onActionCall !== 'function') return\n  try {\n    dispatcher.onActionCall({\n      id: 'act-' + String(Date.now()) + '-' + Math.random().toString(36).slice(2, 8),\n      timestamp: startedAt,\n      name,\n      input,\n      output: outcome.status === 'success' ? outcome.data : undefined,\n      error: outcome.status === 'error' ? outcome.error : undefined,\n      durationMs: Date.now() - startedAt,\n      status: outcome.status,\n    })\n  } catch (_) {\n    // dispatcher threw — devtools UI bug; never bubble to consumer code\n  }\n}\n\nasync function callAction(name, url, input) {\n  const startedAt = Date.now()\n  const isForm = typeof FormData !== 'undefined' && input instanceof FormData\n  const headers = { 'x-theo-action': '1' }\n  const body = isForm ? input : JSON.stringify(input ?? {})\n  if (!isForm) headers['content-type'] = 'application/json'\n  let response\n  try {\n    response = await fetch(url, { method: 'POST', headers, body, credentials: 'same-origin' })\n  } catch (e) {\n    const err = { code: 'NETWORK_ERROR', message: e && e.message ? e.message : 'fetch failed' }\n    emitTelemetry(name, startedAt, input, { status: 'error', error: err })\n    return { data: undefined, error: err }\n  }\n  const contentType = response.headers.get('content-type') ?? ''\n  let result\n  if (response.status === 204) {\n    result = { data: undefined, error: undefined }\n  } else if (contentType.startsWith('application/json+devalue')) {\n    const text = await response.text()\n    const { parse } = await import('devalue')\n    result = { data: parse(text, { URL: (h) => new URL(h) }), error: undefined }\n  } else if (contentType.startsWith('application/json')) {\n    const json = await response.json()\n    result = response.ok ? { data: json, error: undefined } : { data: undefined, error: json }\n  } else {\n    result = { data: undefined, error: { code: 'INTERNAL_SERVER_ERROR', message: await response.text() } }\n  }\n  emitTelemetry(name, startedAt, input, result.error\n    ? { status: 'error', error: result.error }\n    : { status: 'success', data: result.data })\n  return result\n}\n\n// P#4 plugin-forms cache: callable proxies must be stable per action so that\n// repeated property access does not allocate + reset the __zodSchema attach.\nconst ACTION_CALLABLE_CACHE = {}\n\nexport const actions = new Proxy({}, {\n  get(target, prop) {\n    if (typeof prop !== 'string') return undefined\n    const url = ACTION_URL_MAP[prop]\n    if (!url) return undefined\n    if (!ACTION_CALLABLE_CACHE[prop]) {\n      const callable = (input) => callAction(prop, url, input)\n      const schema = ACTION_SCHEMA_MAP[prop]\n      if (schema !== undefined) {\n        Object.defineProperty(callable, '__zodSchema', {\n          value: schema,\n          enumerable: false,\n          writable: false,\n          configurable: false,\n        })\n      }\n      ACTION_CALLABLE_CACHE[prop] = callable\n    }\n    return ACTION_CALLABLE_CACHE[prop]\n  },\n})\n`\n}\n\n/**\n * Server-side module: re-exports the manifest entries for SSR / module-\n * loader consumption (T1.3 sub-C in action-execute.ts will route requests\n * via this manifest).\n */\nfunction generateServerManifest(entries: ActionManifestEntry[]): string {\n  return `// AUTO-GENERATED by @theo/actions virtual module (server env)\n/* eslint-disable */\nexport const manifest = ${JSON.stringify(entries, null, 2)}\nexport const actions = manifest\n`\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkBA,SAAS,YAAY,WAAW,YAAY,SAAS,SAAS,qBAAqB;AACnF,SAAS,SAAS,MAAM,OAAO,eAAe;AAM9C,IAAM,aAAa;AACnB,IAAM,cAAc,KAAK,UAAU;AAc5B,SAAS,qBAAqB,MAA2C;AAC9E,QAAM,EAAE,WAAW,QAAQ,IAAI;AAE/B,WAAS,iBAAuB;AAC9B,QAAI,YAAY,OAAW;AAC3B,UAAM,UAAU,SAAS,SAAS;AAClC,UAAM,UAAU,MAAM,KAAK,QAAQ,OAAO,EAAE,QAAQ,OAAO,GAAG,GAAG,cAAc;AAC/E,UAAM,UAAU,mBAAmB,OAAO;AAC1C,QAAI;AAEF,gBAAU,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AAC/C,YAAM,MAAM,GAAG,OAAO,IAAI,QAAQ,GAAG;AAErC,oBAAc,KAAK,OAAO;AAE1B,iBAAW,KAAK,OAAO;AAAA,IACzB,SAAS,KAAK;AACZ,cAAQ,MAAM,oDAAoD,GAAG;AAAA,IACvE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,iBAAiB;AACf,qBAAe;AAAA,IACjB;AAAA,IACA,WAAW;AACT,qBAAe;AAAA,IACjB;AAAA,IACA,UAAU,IAAY;AACpB,UAAI,OAAO,WAAY,QAAO;AAC9B,aAAO;AAAA,IACT;AAAA,IACA,KAAK,IAAY;AACf,UAAI,OAAO,YAAa,QAAO;AAC/B,YAAM,UAAU,SAAS,SAAS;AAClC,YAAM,MAAM;AACZ,YAAM,UAAU,KAAK,aAAa;AAClC,YAAM,WAAW,YAAY,YAAY,YAAY;AACrD,aAAO,WAAW,qBAAqB,OAAO,IAAI,uBAAuB,OAAO;AAAA,IAClF;AAAA,IACA,gBAAgB,QAAuB;AACrC,YAAM,aAAa,KAAK,WAAW,SAAS;AAE5C,UAAI,CAAC,WAAW,UAAU,EAAG;AAI7B,YAAM,UAAU,QAAQ,YAAY,EAAE,WAAW,KAAK,GAAG,MAAM;AAC7D,uBAAe;AACf,cAAM,MAAM,OAAO,YAAY,cAAc,WAAW;AACxD,YAAI,KAAK;AACP,iBAAO,YAAY,iBAAiB,GAAG;AAAA,QACzC;AACA,eAAO,GAAG,KAAK,EAAE,MAAM,cAAc,CAAC;AAAA,MACxC,CAAC;AACD,aAAO,YAAY,KAAK,SAAS,MAAM;AACrC,gBAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAUA,SAAS,mBAAmB,SAAiD;AAC3E,QAAM,QAAQ,QACX,IAAI,CAAC,UAAU;AACd,UAAM,cAAc;AAIpB,QAAI,MAAM,mBAAmB,QAAW;AACtC,YAAM,mBAAmB,MAAM,eAC5B,QAAQ,OAAO,GAAG,EAClB,QAAQ,sBAAsB,KAAK;AACtC,aAAO,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC,MAAM,WAAW,6CAA6C,KAAK,UAAU,gBAAgB,CAAC;AAAA,IACxI;AACA,WAAO,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,WAAW;AAAA,EAC1D,CAAC,EACA,KAAK,IAAI;AACZ,SAAO;AAAA;AAAA;AAAA,EAGP,KAAK;AAAA;AAAA;AAAA;AAIP;AAEA,SAAS,SAAS,WAA0C;AAC1D,MAAI;AACF,WAAO,0BAA0B,SAAS;AAAA,EAC5C,QAAQ;AAGN,WAAO,CAAC;AAAA,EACV;AACF;AAQA,SAAS,qBAAqB,SAAwC;AACpE,QAAM,aAAa,QAChB,IAAI,CAAC,UAAU,KAAK,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,KAAK,UAAU,MAAM,OAAO,CAAC,GAAG,EACnF,KAAK,IAAI;AAMZ,QAAM,gBAAgB,QAAQ,OAAO,CAAC,MAAM,EAAE,mBAAmB,MAAS;AAC1E,QAAM,gBAAgB,cACnB,IAAI,CAAC,OAAO,QAAQ;AAInB,UAAM,aAAa,MAAM,eAAgB,QAAQ,OAAO,GAAG;AAC3D,WAAO,kCAAkC,GAAG,WAAW,KAAK,UAAU,UAAU,CAAC;AAAA,EACnF,CAAC,EACA,KAAK,IAAI;AACZ,QAAM,iBAAiB,cACpB,IAAI,CAAC,OAAO,QAAQ,KAAK,KAAK,UAAU,MAAM,IAAI,CAAC,iBAAiB,GAAG,GAAG,EAC1E,KAAK,IAAI;AAEZ,SAAO;AAAA;AAAA,EAEP,aAAa;AAAA;AAAA;AAAA,EAGb,UAAU;AAAA;AAAA;AAAA;AAAA,EAIV,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0FhB;AAOA,SAAS,uBAAuB,SAAwC;AACtE,SAAO;AAAA;AAAA,0BAEiB,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAAA;AAAA;AAG1D;","names":[]}

package/dist/adapters/agent-mount.d.ts

@@ -0,0 +1,127 @@
+import { a as RouteSubject, R as RoutePolicy } from '../route-policy-BxOycCDq.js';
+import { C as CsrfMode } from '../csrf-Dgot9qSM.js';
+export { r as resolveProvider } from '../provider-resolver-Dx6QuWrw.js';
+export { s as scanAgents } from '../agent-scan-BZa-pagG.js';
+import 'node:http';
+import '../audit-log-BQWM5YLG.js';
+
+/**
+ * ADR 0001, applied to the agent surface (usetheokit/theokit#365).
+ *
+ * `RouteConfig.policy` gave routes one access decision evaluated by both HTTP executors and
+ * `callProcedure`. The agent endpoints are dispatched BEFORE route matching
+ * (`request-handler.ts` runs `tryServeAgentAux` and `tryServeAgent` ahead of `tryServeApiRoute`),
+ * so no `route()`, no `server/middleware/` and no `server/context.ts` ever observed those URLs.
+ * The policy existed and did not reach them.
+ *
+ * ## Why the policy is declared on the agent module and not passed by the caller
+ *
+ * `mountAgent` already accepted `policy` and `subject` as options. Every production caller invoked
+ * it without either, so the evaluator saw `undefined` and admitted everyone — a gate that works
+ * perfectly and is never reached. An option nobody passes is not a seam; it is a comment with a
+ * type. So the declaration travels WITH the agent:
+ *
+ * ```ts
+ * // agents/support.ts
+ * import { requireOwner } from 'theokit/server/define'
+ *
+ * export const policy = ({ subject, params }) => requireOwner(subject, ownerOf(params.sessionId))
+ * export default defineAgent({ ... })
+ * ```
+ *
+ * One declaration covers every endpoint the agent exposes — the run, the thread routes, the
+ * approval surface and MCP — because they all reach the same conversation and the same paused
+ * tools. `params.endpoint` says which one is being asked for, so a policy that wants to answer
+ * them differently can.
+ *
+ * `'public'` is the other legal value, and it is a decision rather than the absence of one. It is
+ * greppable; silence was not.
+ *
+ * ## Why the refusal does not repeat the policy's reason
+ *
+ * `requireOwner` distinguishes `'resource has no recorded owner'` from `'subject does not own this
+ * resource'`. Echoed to the wire, that pair tells an unauthenticated caller whether a conversation
+ * id exists — the enumeration oracle `docs/program/journeys/j08-tenant.md` grades under criterion 2,
+ * rebuilt out of the very check added to close the leak. So the reason goes to the server log,
+ * where an operator can read it, and the wire gets one fixed sentence that names what the caller
+ * must do. The status stays `403`: the decision is taken before any lookup, so `403` is returned
+ * identically for an id that exists and one that never did, and a truthful `403` beats a `404`
+ * whose truthfulness a reader cannot check (`docs/adr/0002-*`).
+ */
+
+/** Resolve the caller's identity, lazily — see `resolveAgentSubject` for why it must be lazy. */
+type AgentSubjectResolver = () => RouteSubject | null | Promise<RouteSubject | null>;
+
+/**
+ * How a caller picks the credential for a model.
+ *
+ * It lives in its own module rather than beside either consumer because both need it and they
+ * already point at each other: `mount-agent.ts` imports `buildAgentHitl` from
+ * `build-agent-streamer.ts`, so declaring the type in `mount-agent.ts` and importing it back
+ * created a cycle the architecture guard rejected — correctly. A shared contract that two modules
+ * depend on belongs to neither of them.
+ */
+/**
+ * Chooses the API key for a model. Receives the model id the compiled agent declares, or
+ * `undefined` when it declares none.
+ *
+ * The resolver form exists because the credential depends on the model, and the model is only
+ * known once the agent module is compiled. Callers that resolved eagerly were choosing a provider
+ * before anyone could read which one the agent asked for — usetheokit/theokit#326 on the agent
+ * endpoint, #328 on the thread follow-up route.
+ *
+ * @public
+ */
+type ApiKeyResolver = (modelId: string | undefined) => string;
+
+/** Non-runtime options for {@link mountAgent} (grouped so the call stays ≤ 5 params). */
+interface MountAgentOptions {
+    /** Labels a fail-fast `AgentDefinitionError` (the agent file path). Default `'agent module'`. */
+    source?: string;
+    /** CSRF posture at this boundary. Default `'strict'`; `'off'` when a controller already gated (G5). */
+    csrfMode?: CsrfMode;
+    /**
+     * theokit-file-based-config (EC-1) — the framework-resolved app root. When the agent opted into
+     * `.theokit/` file-based config (`.settingSources([...])`), discovery points here, NOT `process.cwd()`.
+     */
+    projectRoot?: string;
+    /**
+     * The agent's name, as the scanner discovered it. Reported to the policy under
+     * `params.agent` and named in a refusal. Defaults to {@link MountAgentOptions.source}.
+     */
+    agentName?: string;
+    /**
+     * Who may run this agent, and against which conversation (ADR 0001,
+     * usetheokit/theokit#365).
+     *
+     * NORMALLY ABSENT, and that is the fix rather than an omission: the policy is read from the
+     * agent module's own `export const policy`, so it travels with the agent instead of depending
+     * on every caller remembering to pass it. This option exists for a host that resolved the
+     * decision itself (an `@Expose`-bound controller, an embedder), and it OVERRIDES the module's
+     * declaration when given.
+     *
+     * Evaluated against the parsed request body, so a policy can ask who owns the
+     * conversation being resumed. Absent on both ends ⇒ not evaluated, matching the route
+     * executors: absence means "not declared" and is not reinterpreted as denial. Absence is
+     * refused at scan time instead, where the file that omitted it can be named.
+     */
+    policy?: RoutePolicy;
+    /**
+     * Resolve the authenticated caller. Invoked at most once, and only when a policy exists — an
+     * agent declaring `'public'` never pays for the application's `createContext`.
+     */
+    resolveSubject?: AgentSubjectResolver;
+}
+/**
+ * Mount a loaded agent module as a `Response`.
+ *
+ * `apiKey` accepts either a resolved string or an {@link ApiKeyResolver}. The resolver form exists
+ * because the credential depends on the model, and the model is only known once the module is
+ * compiled — inside here. Callers that resolved eagerly were choosing a provider before anyone
+ * could read which one the agent asked for, which is theokit#326.
+ *
+ * See {@link MountAgentOptions} for the labeling / CSRF / app-root knobs.
+ */
+declare function mountAgent(mod: unknown, request: Request, apiKey: string | ApiKeyResolver, { source, csrfMode, projectRoot, agentName, policy, resolveSubject, }?: MountAgentOptions): Promise<Response>;
+
+export { mountAgent };

package/dist/adapters/agent-mount.js

@@ -0,0 +1,24 @@
+import {
+  mountAgent
+} from "../chunk-WOBSEO75.js";
+import "../chunk-MCTC6HSE.js";
+import "../chunk-72DMJBXI.js";
+import {
+  scanAgents
+} from "../chunk-L4VFNFDL.js";
+import "../chunk-P6OS7652.js";
+import "../chunk-AVQU5CQF.js";
+import {
+  resolveProvider
+} from "../chunk-3PBAN2YE.js";
+import "../chunk-UMNXCU3K.js";
+import "../chunk-5K4TDLRG.js";
+import "../chunk-ZWN3AODA.js";
+import "../chunk-YN4W7LCX.js";
+import "../chunk-XTHN6JBX.js";
+export {
+  mountAgent,
+  resolveProvider,
+  scanAgents
+};
+//# sourceMappingURL=agent-mount.js.map

package/dist/adapters/security-headers.d.ts

@@ -0,0 +1,132 @@
+export { g as generateNonce } from '../nonce-BXt7Qu_C.js';
+import { S as SecurityHeadersConfig } from '../security-headers-Ccj7ncNx.js';
+export { b as buildSecurityHeaders } from '../security-headers-Ccj7ncNx.js';
+
+/**
+ * The security headers a deployed target puts on its responses.
+ *
+ * `theokit start` applies the configured baseline to every response it writes
+ * (`cli/commands/start/request-handler.ts`). None of the six Web-standards
+ * deploy adapters applied any, so the same page carried a CSP,
+ * `X-Frame-Options`, HSTS and `nosniff` under `theokit start` and none of them
+ * once deployed (usetheokit/theokit#410, GHSA-87qq-fgcr-384x).
+ *
+ * This module is the seam that closes that half of the gap. It has two halves
+ * and they live together on purpose: the code that writes the literal into a
+ * generated entry and the code that reads it at request time have to agree on
+ * one shape, and a shape stated in two files drifts.
+ *
+ * - **Build time** — {@link renderSecurityHeadersConfigLiteral} turns
+ *   `security.headers` into a JSON literal the adapter inlines. A deployed
+ *   runtime has no `theo.config.ts` to read, so the configuration travels as
+ *   data.
+ * - **Request time** — the generated entry calls {@link buildSecurityHeaders}
+ *   on that literal and hands every response to {@link withSecurityHeaders}.
+ *   The same function `theokit start` calls, on the same input, so the two
+ *   cannot disagree about what the configuration means.
+ *
+ * ## The per-request nonce, and where it stops
+ *
+ * `buildSecurityHeaders` accepts a per-request `nonce` and substitutes it into
+ * `script-src`. A nonce cannot survive a build-time literal — it is minted per
+ * response — so a target reaches one only if it renders the HTML at request
+ * time and can put the same value on the script tags it emits.
+ *
+ * Exactly one deploy path does: **Cloudflare with `ssrStreaming: true`**, whose
+ * worker calls `renderStreamingWeb(request, { nonce })`, and that renderer
+ * threads the value into `renderToReadableStream` and into the hydration script
+ * (`router/entry-server.ts`). That branch mints a nonce per request and builds
+ * its CSP from it. Everything else serves HTML written at build time, or no
+ * HTML at all, and carries a **nonce-less CSP** — the same answer
+ * `buildSecurityHeaders` already gives a prerendered route (EC-4), for the same
+ * reason: a nonce in the header with no nonce on the tag blocks every inline
+ * script.
+ *
+ * That asymmetry is real and is not smoothed over. It is stated in the emitted
+ * entry, printed by the build through
+ * {@link describeDeployedSecurityHeaders}, and written down in
+ * `docs/surfaces/build-adapters.md`.
+ */
+
+/**
+ * The `security.headers` block, as a literal a generated entry can carry.
+ *
+ * `{}` when the app declares none — which is not the same as "no headers".
+ * `buildSecurityHeaders({})` returns the full default baseline, and `{}` is
+ * exactly what `theokit start` passes when `security.headers` is absent
+ * (`cli/commands/start/index.ts`). An app with no security block gets the same
+ * baseline deployed as it gets locally.
+ */
+declare function renderSecurityHeadersConfigLiteral(headers: SecurityHeadersConfig | undefined): string;
+/**
+ * Put the headers on a response, without overruling the handler.
+ *
+ * `theokit start` sets the baseline BEFORE the route handler runs, so a handler
+ * can override it with `res.setHeader` (last write wins, Node convention). On a
+ * Web target the response arrives already built, so the equivalent of "the
+ * handler wins" is to skip a header the response already carries: a route that
+ * set its own `Content-Security-Policy` keeps it.
+ *
+ * Mutates and returns the same `Response` rather than constructing a
+ * replacement, because these responses are handed to the runtime while their
+ * body is still being written (#382) and re-wrapping the stream is exactly the
+ * second buffering point that change removed.
+ *
+ * Mutation is safe for every response these entries produce: the Fetch spec
+ * gives a locally constructed `Response` the `response` header guard, which
+ * permits `set` for every name used here. The `immutable` guard belongs to
+ * responses that came back from `fetch()`, and none of the six emitted handlers
+ * returns one — each builds its response from `createWebShim`, from a `new
+ * Response(...)`, or from the SSR renderer. The WebSocket upgrade, which is the
+ * one response an adapter gets from its runtime rather than building, is
+ * deliberately not routed through here.
+ */
+declare function withSecurityHeaders(response: Response, headers: Record<string, string>): Response;
+interface DeployedSecurityHeaderLimits {
+    target: string;
+    /** The app's `security.headers` block, or undefined when it declares none. */
+    securityHeaders: SecurityHeadersConfig | undefined;
+    /**
+     * Does the emitted handler render HTML at request time and mint a CSP nonce
+     * for it? True only for Cloudflare with `ssrStreaming: true`.
+     */
+    mintsNonce: boolean;
+    /**
+     * Is the HTML document served by a platform static host rather than by the
+     * handler this build emits? True wherever the emitted handler answers
+     * `/api/*` and returns 404 for everything else.
+     */
+    /**
+     * Who puts the security headers on the HTML DOCUMENT — a different question from who serves it,
+     * and the two used to be collapsed into one boolean (usetheokit/theokit#412).
+     *
+     * - `handler` — this target's own handler returns the document, so it carries the same baseline
+     *   every API response carries. No caveat.
+     * - `platform-configured` — the platform's static host serves the document, AND this build emits
+     *   the configuration that puts the headers on it (`.vercel/output/config.json`, `netlify.toml`).
+     *   Still worth stating, because nothing here has seen a deployed response.
+     * - `platform-unmanaged` — the platform serves it and this build owns no artifact that could
+     *   configure it. This is the real remaining gap, and it stays named.
+     *
+     * The two-value version reported `platform-configured` targets with the same message as
+     * `platform-unmanaged` ones, telling an operator to go and do work the build had already done —
+     * and a stale limitation reads exactly like a current one.
+     */
+    documentHeaders: 'handler' | 'platform-configured' | 'platform-unmanaged';
+}
+/**
+ * What the build tells the operator, once, per target.
+ *
+ * Silent degradation is the failure mode `rules/three-target-parity.md` exists
+ * to prevent. Two things degrade quietly here and both are named rather than
+ * discovered in production: a CSP that refuses inline scripts on a deploy while
+ * allowing them locally, and an HTML document that never passes through the
+ * handler these headers are attached to.
+ *
+ * The header names are read from the map the entry will actually carry, not
+ * from a list written next to it. A configuration that switches HSTS or the CSP
+ * off would otherwise be announced as sending them.
+ */
+declare function describeDeployedSecurityHeaders(limits: DeployedSecurityHeaderLimits): string;
+
+export { type DeployedSecurityHeaderLimits, describeDeployedSecurityHeaders, renderSecurityHeadersConfigLiteral, withSecurityHeaders };

package/dist/adapters/security-headers.js

@@ -0,0 +1,64 @@
+import {
+  buildSecurityHeaders
+} from "../chunk-IRQGAC4L.js";
+import {
+  generateNonce
+} from "../chunk-Z4PJMZLM.js";
+import "../chunk-XTHN6JBX.js";
+
+// src/adapters/security-headers.ts
+function renderSecurityHeadersConfigLiteral(headers) {
+  return JSON.stringify(headers ?? {});
+}
+function withSecurityHeaders(response, headers) {
+  for (const [key, value] of Object.entries(headers)) {
+    if (!response.headers.has(key)) response.headers.set(key, value);
+  }
+  return response;
+}
+function describeDeployedSecurityHeaders(limits) {
+  const headers = buildSecurityHeaders(limits.securityHeaders ?? {}, { production: true });
+  const names = Object.keys(headers);
+  if (names.length === 0) {
+    return `  ! \`${limits.target}\` sends no security headers: the configuration switched every one of them off.`;
+  }
+  const lines = [
+    `  \u2713 security headers on every response \`${limits.target}\` returns: ${names.join(", ")}.`
+  ];
+  const sendsCsp = names.some((name) => name.startsWith("Content-Security-Policy"));
+  if (sendsCsp && !limits.mintsNonce) {
+    lines.push(
+      `    - The CSP carries no nonce: this target serves HTML written at build time,`,
+      `      so there is no per-request value to put on a script tag. An inline`,
+      `      <script> is refused by \`script-src 'self'\` here, while the same page`,
+      `      under \`theokit start\` gets a nonce and runs it. Move inline scripts to`,
+      `      \`<script src="...">\`, or set \`security.headers.cspMode: 'report-only'\``,
+      `      while you migrate.`
+    );
+  }
+  if (limits.documentHeaders === "platform-configured") {
+    lines.push(
+      `    - The HTML document is served by the platform's static host, and reaches`,
+      `      the browser with these headers through config this build emits. That`,
+      `      path is not verified by a deploy from here \u2014 the values come from the`,
+      `      same function the handler uses, but no response has been read back.`
+    );
+  }
+  if (limits.documentHeaders === "platform-unmanaged") {
+    lines.push(
+      `    - The HTML document does NOT pass through this handler \u2014 the platform's`,
+      `      static host serves it \u2014 so these headers reach \`/api/*\` responses and`,
+      `      not the page. This build emits no artifact that could configure it, so`,
+      `      set the document's headers on the platform (usetheokit/theokit#412).`
+    );
+  }
+  return lines.join("\n");
+}
+export {
+  buildSecurityHeaders,
+  describeDeployedSecurityHeaders,
+  generateNonce,
+  renderSecurityHeadersConfigLiteral,
+  withSecurityHeaders
+};
+//# sourceMappingURL=security-headers.js.map

package/dist/adapters/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/security-headers.ts"],"mappings":";;;;;;;;;AA8EO,SAAS,mCACd,SACQ;AACR,SAAO,KAAK,UAAU,WAAW,CAAC,CAAC;AACrC;AAyBO,SAAS,oBAAoB,UAAoB,SAA2C;AACjG,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,CAAC,SAAS,QAAQ,IAAI,GAAG,EAAG,UAAS,QAAQ,IAAI,KAAK,KAAK;AAAA,EACjE;AACA,SAAO;AACT;AAgDO,SAAS,gCAAgC,QAA8C;AAC5F,QAAM,UAAU,qBAAqB,OAAO,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AACvF,QAAM,QAAQ,OAAO,KAAK,OAAO;AACjC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,SAAS,OAAO,MAAM;AAAA,EAC/B;AAEA,QAAM,QAAQ;AAAA,IACZ,iDAA4C,OAAO,MAAM,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1F;AACA,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,yBAAyB,CAAC;AAChF,MAAI,YAAY,CAAC,OAAO,YAAY;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,uBAAuB;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,sBAAsB;AACnD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}