theokit 0.48.13 → 0.50.0

package/dist/router/element-scroll-restoration.js

@@ -0,0 +1,96 @@
+import "../chunk-XTHN6JBX.js";
+
+// src/router/element-scroll-restoration.tsx
+import { useLayoutEffect, useRef } from "react";
+import { useLocation } from "react-router";
+
+// src/router/scroll-restoration.ts
+var SCROLL_CONTAINER_ATTRIBUTE = "data-theo-scroll";
+function storageKey(locationKey) {
+  return `theokit:scroll:${locationKey}`;
+}
+function createScrollRestorer(store) {
+  return {
+    save(locationKey, targets) {
+      const offsets = {};
+      for (const target of targets) offsets[target.id] = target.scrollTop;
+      try {
+        store.set(storageKey(locationKey), JSON.stringify(offsets));
+      } catch {
+      }
+    },
+    restore(locationKey, targets) {
+      const offsets = readOffsets(store, locationKey);
+      if (offsets === void 0) return;
+      for (const target of targets) {
+        const offset = offsets[target.id];
+        if (typeof offset === "number") target.scrollTop = offset;
+      }
+    }
+  };
+}
+function readOffsets(store, locationKey) {
+  const raw = store.get(storageKey(locationKey));
+  if (raw === null) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed !== null && typeof parsed === "object" ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/router/element-scroll-restoration.tsx
+function ElementScrollRestoration() {
+  const location = useLocation();
+  const previousKey = useRef(void 0);
+  useLayoutEffect(() => {
+    const restorer = createScrollRestorer(sessionScrollStore());
+    const leaving = previousKey.current;
+    if (leaving !== void 0) restorer.save(leaving, scrollTargets());
+    previousKey.current = location.key;
+    restorer.restore(location.key, scrollTargets());
+    const onHide = () => {
+      createScrollRestorer(sessionScrollStore()).save(location.key, scrollTargets());
+    };
+    window.addEventListener("pagehide", onHide);
+    return () => {
+      window.removeEventListener("pagehide", onHide);
+    };
+  }, [location.key]);
+  return null;
+}
+function scrollTargets() {
+  return [...document.querySelectorAll(`[${SCROLL_CONTAINER_ATTRIBUTE}]`)].flatMap((element) => {
+    const id = element.getAttribute(SCROLL_CONTAINER_ATTRIBUTE);
+    if (id === null || id === "") return [];
+    return [
+      {
+        id,
+        get scrollTop() {
+          return element.scrollTop;
+        },
+        set scrollTop(value) {
+          element.scrollTop = value;
+        }
+      }
+    ];
+  });
+}
+function sessionScrollStore() {
+  try {
+    const storage = window.sessionStorage;
+    return {
+      get: (key) => storage.getItem(key),
+      set: (key, value) => {
+        storage.setItem(key, value);
+      }
+    };
+  } catch {
+    return { get: () => null, set: () => void 0 };
+  }
+}
+export {
+  ElementScrollRestoration
+};
+//# sourceMappingURL=element-scroll-restoration.js.map

package/dist/router/element-scroll-restoration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/router/element-scroll-restoration.tsx","../../src/router/scroll-restoration.ts"],"mappings":";;;AAAA,SAAS,iBAAiB,cAAc;AACxC,SAAS,mBAAmB;;;ACiDrB,IAAM,6BAA6B;AAG1C,SAAS,WAAW,aAA6B;AAC/C,SAAO,kBAAkB,WAAW;AACtC;AASO,SAAS,qBAAqB,OAAoC;AACvE,SAAO;AAAA,IACL,KAAK,aAAa,SAAS;AACzB,YAAM,UAAkC,CAAC;AACzC,iBAAW,UAAU,QAAS,SAAQ,OAAO,EAAE,IAAI,OAAO;AAC1D,UAAI;AACF,cAAM,IAAI,WAAW,WAAW,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,MAC5D,QAAQ;AAAA,MAGR;AAAA,IACF;AAAA,IAEA,QAAQ,aAAa,SAAS;AAC5B,YAAM,UAAU,YAAY,OAAO,WAAW;AAC9C,UAAI,YAAY,OAAW;AAC3B,iBAAW,UAAU,SAAS;AAC5B,cAAM,SAAS,QAAQ,OAAO,EAAE;AAGhC,YAAI,OAAO,WAAW,SAAU,QAAO,YAAY;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,YAAY,OAAoB,aAA0D;AACjG,QAAM,MAAM,MAAM,IAAI,WAAW,WAAW,CAAC;AAC7C,MAAI,QAAQ,KAAM,QAAO;AACzB,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,GAAG;AAGtC,WAAO,WAAW,QAAQ,OAAO,WAAW,WACvC,SACD;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADpEO,SAAS,2BAAiC;AAC/C,QAAM,WAAW,YAAY;AAC7B,QAAM,cAAc,OAA2B,MAAS;AAExD,kBAAgB,MAAM;AACpB,UAAM,WAAW,qBAAqB,mBAAmB,CAAC;AAC1D,UAAM,UAAU,YAAY;AAC5B,QAAI,YAAY,OAAW,UAAS,KAAK,SAAS,cAAc,CAAC;AACjE,gBAAY,UAAU,SAAS;AAC/B,aAAS,QAAQ,SAAS,KAAK,cAAc,CAAC;AAI9C,UAAM,SAAS,MAAY;AACzB,2BAAqB,mBAAmB,CAAC,EAAE,KAAK,SAAS,KAAK,cAAc,CAAC;AAAA,IAC/E;AACA,WAAO,iBAAiB,YAAY,MAAM;AAC1C,WAAO,MAAM;AACX,aAAO,oBAAoB,YAAY,MAAM;AAAA,IAC/C;AAAA,EACF,GAAG,CAAC,SAAS,GAAG,CAAC;AAEjB,SAAO;AACT;AAWA,SAAS,gBAAgC;AACvC,SAAO,CAAC,GAAG,SAAS,iBAAiB,IAAI,0BAA0B,GAAG,CAAC,EAAE,QAAQ,CAAC,YAAY;AAC5F,UAAM,KAAK,QAAQ,aAAa,0BAA0B;AAC1D,QAAI,OAAO,QAAQ,OAAO,GAAI,QAAO,CAAC;AACtC,WAAO;AAAA,MACL;AAAA,QACE;AAAA,QACA,IAAI,YAAoB;AACtB,iBAAO,QAAQ;AAAA,QACjB;AAAA,QACA,IAAI,UAAU,OAAe;AAC3B,kBAAQ,YAAY;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAQA,SAAS,qBAAkC;AACzC,MAAI;AACF,UAAM,UAAU,OAAO;AACvB,WAAO;AAAA,MACL,KAAK,CAAC,QAAQ,QAAQ,QAAQ,GAAG;AAAA,MACjC,KAAK,CAAC,KAAK,UAAU;AACnB,gBAAQ,QAAQ,KAAK,KAAK;AAAA,MAC5B;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,KAAK,MAAM,MAAM,KAAK,MAAM,OAAU;AAAA,EACjD;AACF;","names":[]}

package/dist/{routes-OLNQX7CT.js → routes-BPLU3ISV.js}

@@ -3,18 +3,20 @@ import "tsx/esm";
 import {
   validateProjectStructure
 } from "./chunk-GEQJAFSV.js";
-import {
-  loadConfig
-} from "./chunk-S433N3CT.js";
-import "./chunk-HBU2GIMZ.js";
-import "./chunk-GVW5EKEU.js";
-import "./chunk-7VPQHEAJ.js";
 import {
   scanServerActions,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-BMHS4WAN.js";
-import "./chunk-A7JBF5FO.js";
+} from "./chunk-XS7EX55U.js";
+import "./chunk-FD4ZDTQ6.js";
+import {
+  loadConfig
+} from "./chunk-QTHVHNJJ.js";
+import "./chunk-3QPVEJ7D.js";
+import "./chunk-U5PWXS3J.js";
+import "./chunk-FH3SQR6P.js";
+import "./chunk-ZNZISJDZ.js";
+import "./chunk-VI7ZANB3.js";
 
 // src/cli/commands/routes.ts
 import { resolve, relative } from "path";
@@ -62,4 +64,4 @@ async function routesCommand() {
 export {
   routesCommand
 };
-//# sourceMappingURL=routes-OLNQX7CT.js.map
+//# sourceMappingURL=routes-BPLU3ISV.js.map

package/dist/{routes-OLNQX7CT.js.map → routes-BPLU3ISV.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/routes.ts"],"sourcesContent":["import { resolve, relative } from 'node:path'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { validateProjectStructure } from '../../config/validate-structure.js'\nimport { scanServerActions } from '../../server/scan/action-scan.js'\nimport { scanServerRoutes } from '../../server/scan/scan.js'\nimport { scanWebSocketRoutes } from '../../server/scan/ws-scan.js'\n\nexport async function routesCommand(): Promise<void> {\n  const cwd = process.cwd()\n  const config = await loadConfig(cwd)\n  // #95 — honor config.appDir so a custom frontend dir (e.g. apps/web) passes the structure gate.\n  validateProjectStructure(cwd, config.appDir)\n\n  const serverDir = resolve(cwd, config.serverDir)\n\n  const apiRoutes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const wsRoutes = scanWebSocketRoutes(serverDir)\n\n  const totalCount = apiRoutes.length + actions.length + wsRoutes.length\n\n  if (totalCount === 0) {\n    console.log('\\n  No routes found.\\n')\n    return\n  }\n\n  // API Routes\n  if (apiRoutes.length > 0) {\n    console.log('\\n  API Routes')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of apiRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  GET/POST  ${route.routePath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  // Actions\n  if (actions.length > 0) {\n    console.log('\\n  Actions')\n    console.log('  ' + '─'.repeat(60))\n    for (const action of actions) {\n      const rel = relative(cwd, action.filePath)\n      console.log(`  POST      /api/__actions/${action.actionPath.padEnd(18)} ${rel}`)\n    }\n  }\n\n  // WebSocket\n  if (wsRoutes.length > 0) {\n    console.log('\\n  WebSocket')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of wsRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  WS        ${route.wsPath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  console.log(`\\n  Total: ${totalCount} endpoints\\n`)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,gBAAgB;AAQlC,eAAsB,gBAA+B;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,WAAW,GAAG;AAEnC,2BAAyB,KAAK,OAAO,MAAM;AAE3C,QAAM,YAAY,QAAQ,KAAK,OAAO,SAAS;AAE/C,QAAM,YAAY,iBAAiB,SAAS;AAC5C,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,WAAW,oBAAoB,SAAS;AAE9C,QAAM,aAAa,UAAU,SAAS,QAAQ,SAAS,SAAS;AAEhE,MAAI,eAAe,GAAG;AACpB,YAAQ,IAAI,wBAAwB;AACpC;AAAA,EACF;AAGA,MAAI,UAAU,SAAS,GAAG;AACxB,YAAQ,IAAI,gBAAgB;AAC5B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,WAAW;AAC7B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,UAAU,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAChE;AAAA,EACF;AAGA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ,IAAI,aAAa;AACzB,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,UAAU,SAAS;AAC5B,YAAM,MAAM,SAAS,KAAK,OAAO,QAAQ;AACzC,cAAQ,IAAI,8BAA8B,OAAO,WAAW,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IACjF;AAAA,EACF;AAGA,MAAI,SAAS,SAAS,GAAG;AACvB,YAAQ,IAAI,eAAe;AAC3B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,UAAU;AAC5B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,OAAO,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,UAAQ,IAAI;AAAA,WAAc,UAAU;AAAA,CAAc;AACpD;","names":[]}
+{"version":3,"sources":["../src/cli/commands/routes.ts"],"sourcesContent":["import { resolve, relative } from 'node:path'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { validateProjectStructure } from '../../config/validate-structure.js'\nimport { scanServerActions } from '../../server/scan/action-scan.js'\nimport { scanServerRoutes } from '../../server/scan/scan.js'\nimport { scanWebSocketRoutes } from '../../server/scan/ws-scan.js'\n\nexport async function routesCommand(): Promise<void> {\n  const cwd = process.cwd()\n  const config = await loadConfig(cwd)\n  // #95 — honor config.appDir so a custom frontend dir (e.g. apps/web) passes the structure gate.\n  validateProjectStructure(cwd, config.appDir)\n\n  const serverDir = resolve(cwd, config.serverDir)\n\n  const apiRoutes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const wsRoutes = scanWebSocketRoutes(serverDir)\n\n  const totalCount = apiRoutes.length + actions.length + wsRoutes.length\n\n  if (totalCount === 0) {\n    console.log('\\n  No routes found.\\n')\n    return\n  }\n\n  // API Routes\n  if (apiRoutes.length > 0) {\n    console.log('\\n  API Routes')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of apiRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  GET/POST  ${route.routePath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  // Actions\n  if (actions.length > 0) {\n    console.log('\\n  Actions')\n    console.log('  ' + '─'.repeat(60))\n    for (const action of actions) {\n      const rel = relative(cwd, action.filePath)\n      console.log(`  POST      /api/__actions/${action.actionPath.padEnd(18)} ${rel}`)\n    }\n  }\n\n  // WebSocket\n  if (wsRoutes.length > 0) {\n    console.log('\\n  WebSocket')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of wsRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  WS        ${route.wsPath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  console.log(`\\n  Total: ${totalCount} endpoints\\n`)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,gBAAgB;AAQlC,eAAsB,gBAA+B;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,WAAW,GAAG;AAEnC,2BAAyB,KAAK,OAAO,MAAM;AAE3C,QAAM,YAAY,QAAQ,KAAK,OAAO,SAAS;AAE/C,QAAM,YAAY,iBAAiB,SAAS;AAC5C,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,WAAW,oBAAoB,SAAS;AAE9C,QAAM,aAAa,UAAU,SAAS,QAAQ,SAAS,SAAS;AAEhE,MAAI,eAAe,GAAG;AACpB,YAAQ,IAAI,wBAAwB;AACpC;AAAA,EACF;AAGA,MAAI,UAAU,SAAS,GAAG;AACxB,YAAQ,IAAI,gBAAgB;AAC5B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,WAAW;AAC7B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,UAAU,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAChE;AAAA,EACF;AAGA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ,IAAI,aAAa;AACzB,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,UAAU,SAAS;AAC5B,YAAM,MAAM,SAAS,KAAK,OAAO,QAAQ;AACzC,cAAQ,IAAI,8BAA8B,OAAO,WAAW,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IACjF;AAAA,EACF;AAGA,MAAI,SAAS,SAAS,GAAG;AACvB,YAAQ,IAAI,eAAe;AAC3B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,UAAU;AAC5B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,OAAO,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,UAAQ,IAAI;AAAA,WAAc,UAAU;AAAA,CAAc;AACpD;","names":[]}

package/dist/{scan-7MJC6PYU.js → scan-YJEE4KQK.js}

@@ -2,8 +2,8 @@
 import "tsx/esm";
 import {
   scanRoutes
-} from "./chunk-IEES3CHD.js";
+} from "./chunk-47MM2JUK.js";
 export {
   scanRoutes
 };
-//# sourceMappingURL=scan-7MJC6PYU.js.map
+//# sourceMappingURL=scan-YJEE4KQK.js.map

package/dist/{schema-ZO3OSWVG.js → schema-SOAD43RQ.js}

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 import "tsx/esm";
+import {
+  theoConfigSchema
+} from "./chunk-FH3SQR6P.js";
+import "./chunk-ZNZISJDZ.js";
 import {
   cacheSchema,
   corsSchema,
   securityHeadersSchema,
-  storageSchema,
-  theoConfigSchema
-} from "./chunk-GVW5EKEU.js";
-import "./chunk-7VPQHEAJ.js";
+  storageSchema
+} from "./chunk-VI7ZANB3.js";
 export {
   cacheSchema,
   corsSchema,
@@ -15,4 +17,4 @@ export {
   storageSchema,
   theoConfigSchema
 };
-//# sourceMappingURL=schema-ZO3OSWVG.js.map
+//# sourceMappingURL=schema-SOAD43RQ.js.map

package/dist/schemas-4AXHQMV3.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  cacheSchema,
+  corsSchema,
+  loggingSchema,
+  observabilitySchema,
+  rateLimitSchema,
+  securityHeadersSchema,
+  securitySchema,
+  storageSchema,
+  uploadSchema
+} from "./chunk-VI7ZANB3.js";
+export {
+  cacheSchema,
+  corsSchema,
+  loggingSchema,
+  observabilitySchema,
+  rateLimitSchema,
+  securityHeadersSchema,
+  securitySchema,
+  storageSchema,
+  uploadSchema
+};
+//# sourceMappingURL=schemas-4AXHQMV3.js.map

package/dist/schemas-4AXHQMV3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/security-headers-Ccj7ncNx.d.ts

@@ -0,0 +1,129 @@
+/**
+ * The security-header baseline, as a pure function of configuration.
+ *
+ * It lives in `core/contracts/` because **every** target needs it and none of it
+ * is transport-specific: `buildSecurityHeaders` takes a config object and
+ * returns `Record<string, string>`. `theokit start` writes that map onto a Node
+ * `ServerResponse` (`server/security/security-headers.ts`); the six Web deploy
+ * adapters write it onto a `Response` (`adapters/security-headers.ts`). Putting
+ * it under `server/` made the second group import across a boundary the
+ * dependency graph forbids — `adapters → server` is not a declared edge in
+ * ADR-0001 v3 — and the fix is not to widen the rule but to notice that this
+ * code was never server code.
+ *
+ * `core/contracts/<file>.ts` is the declared exception to the deep-import rule,
+ * so both callers reach it directly and there is still exactly ONE definition of
+ * what a configured header set means.
+ *
+ * Phase 6 — Default Security Headers (D4 / EC-2).
+ *
+ * Per-response security baseline. The framework applies these BEFORE the
+ * route handler runs so a handler can still override via `res.setHeader`.
+ *
+ * EC-2 backward-compatibility: CSP ships in `report-only` mode by default
+ * for 0.2.0. Existing apps with inline scripts or third-party CDN scripts
+ * keep working but consumers see violation reports via their CSP report
+ * collector (or browser DevTools). 0.3.0 will flip the default to
+ * `enforce` after a release of visibility.
+ */
+/**
+ * Default Content-Security-Policy. Conservative-but-not-paralyzing:
+ *
+ *   - default-src 'self'              — every fetch falls back to same-origin
+ *   - script-src 'self'               — T6.1 (0.3.0): `'unsafe-inline'`
+ *                                         dropped. The SSR pipeline issues a
+ *                                         per-request nonce that REPLACES
+ *                                         this directive at runtime
+ *                                         (`'nonce-<token>'`). For static /
+ *                                         non-SSR contexts where no nonce is
+ *                                         available, the policy is strict-
+ *                                         no-inline — user inline scripts
+ *                                         must be migrated to external
+ *                                         `<script src="...">` or threaded
+ *                                         through `ctx.nonce`.
+ *   - style-src 'self' 'unsafe-inline' — Tailwind + TheoUI use style attrs
+ *                                         in animation directives
+ *   - img-src 'self' data: blob:      — supports inline data URIs, blobs
+ *                                         from canvas exports
+ *   - font-src 'self' data:           — Geist fonts inline-base64
+ *   - connect-src 'self' ws: wss:     — WebSocket dev HMR + agent streams
+ *   - frame-ancestors 'none'          — clickjacking defense
+ */
+/**
+ * T5.1 — default CSP includes the built-in report endpoint so violations
+ * are visible without extra config. Apps that ship a custom `csp` string
+ * override the report-uri.
+ */
+declare const DEFAULT_CSP: string;
+/**
+ * T1.1 — Default Permissions-Policy header (default-deny stance).
+ *
+ * Disables sensitive Web APIs that the vast majority of apps don't use.
+ * Apps that DO need any of these opt in by overriding `permissionsPolicy`
+ * in `config.security.headers`.
+ *
+ * The seven features listed are the most-abused for: tracking
+ * (geolocation, accelerometer, gyroscope), spyware (camera, microphone),
+ * fraud (payment), and hardware exfiltration (usb).
+ *
+ * Aligns with Mozilla baseline + OWASP Secure Headers + Lighthouse PWA.
+ */
+declare const DEFAULT_PERMISSIONS_POLICY = "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()";
+type CspMode = 'enforce' | 'report-only' | 'off';
+interface SecurityHeadersConfig {
+    /**
+     * Custom CSP policy string. When set, replaces the default verbatim.
+     * Pass `false` to disable CSP entirely (alias for `cspMode: 'off'`).
+     */
+    csp?: string | false;
+    /**
+     * Enforcement mode for CSP. Default `report-only` for 0.2.0 (EC-2).
+     * 0.3.0 will default to `enforce`.
+     */
+    cspMode?: CspMode;
+    /**
+     * Strict-Transport-Security value. Defaults to
+     * `max-age=31536000; includeSubDomains` in production. Pass `false` to
+     * suppress (e.g. internal LANs without TLS).
+     */
+    hsts?: string | false;
+    /** X-Frame-Options. Default DENY. */
+    frameOptions?: 'DENY' | 'SAMEORIGIN';
+    /** X-Content-Type-Options. Default `nosniff`. */
+    contentTypeOptions?: 'nosniff';
+    /** Referrer-Policy. Default `strict-origin-when-cross-origin`. */
+    referrerPolicy?: string;
+    /**
+     * T1.1 — Permissions-Policy directive string. When set, replaces the
+     * default verbatim (no merge — see ADR-EC-12). Pass `false` to disable
+     * the header entirely. Schema-level refinement rejects any string
+     * containing CR/LF (EC-3 — CWE-113 HTTP Response Splitting mitigation).
+     */
+    permissionsPolicy?: string | false;
+}
+interface SecurityEnv {
+    production: boolean;
+}
+/**
+ * T4.1 — Per-request options passed by the SSR pipeline.
+ *
+ * - `nonce`: when set, the framework substitutes the `'unsafe-inline'`
+ *   token in `script-src` with `'nonce-<nonce>'`. EC-3 forces
+ *   `Cache-Control: private, no-store` so a CDN cannot cache the HTML
+ *   (carrying one nonce) and re-serve it with a freshly-generated CSP
+ *   header (carrying a different nonce).
+ * - `prerender`: when true, the nonce is IGNORED. Prerendered HTML is
+ *   generated at build time with no nonce in the script tags; mixing a
+ *   runtime nonce in the header would block every script. EC-4.
+ */
+interface SecurityHeadersOptions {
+    nonce?: string;
+    prerender?: boolean;
+}
+/**
+ * Build the security headers map for a given config + env. Pure function —
+ * returned object can be inspected, logged, or applied to a response.
+ */
+declare function buildSecurityHeaders(config: SecurityHeadersConfig, env: SecurityEnv, options?: SecurityHeadersOptions): Record<string, string>;
+
+export { type CspMode as C, DEFAULT_CSP as D, type SecurityHeadersConfig as S, DEFAULT_PERMISSIONS_POLICY as a, buildSecurityHeaders as b, type SecurityEnv as c, type SecurityHeadersOptions as d };

package/dist/server/agent/index.d.ts

@@ -4,95 +4,7 @@ import { AcpTransport } from '@theokit/agents';
 export { InProcessApprovalRequest, InProcessApprovalRequiredError, InProcessAwaitApproval, StreamAgentTurnDeps, StreamAgentTurnInProcessInput, streamAgentTurnInProcess } from '@theokit/agents';
 import { CustomTool as CustomTool$1 } from '@theokit/sdk';
 import { V as VerifyFn } from '../../webhook-types-DGIjjcaI.js';
-
-/**
- * Provider Resolver — Strategy + Registry pattern (FAANG-grade).
- *
- * Inspiration: Dapr Conversation Registry (`dapr/pkg/components/conversation/registry.go`)
- * + Encore Manager provider array (`encore/runtimes/go/pubsub/manager_internal.go`).
- *
- * Principle: provider routing is the FRAMEWORK's responsibility, not the consumer's.
- * The consumer template uses a plain `model: { id: 'gpt-4o-mini' }` — no conditionals.
- *
- * Wire protocol: OpenAI Chat Completions (universal — implemented by every
- * os providers: OpenRouter, Groq, Mistral, Together, Anthropic via proxy, etc).
- *
- * Resolution by priority (FIRST match wins):
- *   1. OPENROUTER_API_KEY → baseUrl=openrouter.ai (multi-model gateway)
- *   2. OPENAI_API_KEY     → baseUrl=api.openai.com
- *   3. ANTHROPIC_API_KEY  → direct Anthropic (Messages API, not OpenAI-compat)
- *
- * Escape hatch: an explicit `options.apiKey` OVERRIDES auto-resolution
- * (the consumer can force a specific provider if it wants to).
- */
-/**
- * Provider configuration descriptor — Registry entry shape.
- *
- * @public
- */
-interface ProviderDescriptor {
-    /** Stable name used internally — not exposed on the wire. */
-    name: string;
-    /** Environment variable that holds the API key for this provider. */
-    envKey: string;
-    /** Base URL for the provider's OpenAI-compatible (or native) API. */
-    baseUrl: string;
-    /** Resolution priority (lower = higher priority). FIRST match wins. */
-    priority: number;
-}
-/**
- * Resolved provider configuration — output of `resolveProvider()`.
- *
- * @public
- */
-interface ResolvedProvider {
-    name: string;
-    apiKey: string;
-    baseUrl: string;
-}
-/**
- * Register a new provider (Registry pattern — runtime extension point).
- * Useful for self-hosted endpoints or custom providers without touching theokit src.
- *
- * @example
- * registerProvider({
- *   name: 'self-hosted',
- *   envKey: 'SELF_HOSTED_API_KEY',
- *   baseUrl: 'https://llm.internal.acme.com/v1',
- *   priority: 0, // highest priority
- * })
- *
- * @public
- */
-declare function registerProvider(descriptor: ProviderDescriptor): void;
-/**
- * Reset registry to DEFAULT_REGISTRY (test-only / dev escape hatch).
- *
- * @public
- */
-declare function resetProviderRegistry(): void;
-/**
- * Get current registry snapshot (read-only — inspection).
- *
- * @public
- */
-declare function listProviders(): readonly ProviderDescriptor[];
-/**
- * Resolve provider from env vars by priority. FIRST env var found wins.
- *
- * @returns ResolvedProvider with apiKey + baseUrl + name
- * @throws Error if NO provider env var is set (actionable message)
- *
- * @public
- */
-declare function resolveProvider(): ResolvedProvider;
-/**
- * Try to resolve — does NOT throw. Returns null if no provider available.
- * Useful for graceful degradation (e.g., mock mode).
- *
- * @public
- */
-declare function tryResolveProvider(): ResolvedProvider | null;
+export { P as ProviderDescriptor, R as ResolvedProvider, l as listProviders, a as registerProvider, b as resetProviderRegistry, r as resolveProvider, t as tryResolveProvider } from '../../provider-resolver-Dx6QuWrw.js';
 
 /**
  * M26 (ADR-0041) — `createWorkflowTool`: wrap an SDK `Workflow` as a `CustomTool`.
@@ -409,4 +321,4 @@ interface StdioStreams {
  */
 declare function serveMcpStdio(mod: unknown, name: string, appResources: readonly AppResource[], streams: StdioStreams): Promise<void>;
 
-export { type AcpToolConfig, type AppResource, type AppResourceInput, type ChannelMessage, type ChannelWebhookConfig, type CodeModeApi, type CodeModeConfig, type CodeModePermission, CodeModePermissionDeniedError, type McpResourceContents, type McpResourceDescriptor, NodeAcpTransport, type ProviderDescriptor, type ResolvedProvider, type Sandbox, type StdioStreams, type VendorAgentClient, type VendorAgentToolConfig, type WorkflowLike, type WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, listProviders, parseChannelPath, readAppResource, registerProvider, resetProviderRegistry, resolveProvider, serveMcpStdio, tryResolveProvider };
+export { type AcpToolConfig, type AppResource, type AppResourceInput, type ChannelMessage, type ChannelWebhookConfig, type CodeModeApi, type CodeModeConfig, type CodeModePermission, CodeModePermissionDeniedError, type McpResourceContents, type McpResourceDescriptor, NodeAcpTransport, type Sandbox, type StdioStreams, type VendorAgentClient, type VendorAgentToolConfig, type WorkflowLike, type WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, parseChannelPath, readAppResource, serveMcpStdio };

package/dist/server/agent/index.js

@@ -25,7 +25,7 @@ import {
   resetProviderRegistry,
   resolveProvider,
   tryResolveProvider
-} from "../../chunk-6E5WKMDS.js";
+} from "../../chunk-3PBAN2YE.js";
 import "../../chunk-SAFGDIPQ.js";
 import "../../chunk-XTHN6JBX.js";
 export {

package/dist/server/auth/index.d.ts

@@ -1,26 +1,7 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
+export { g as generateNonce } from '../../nonce-BXt7Qu_C.js';
 import { R as RateLimitStore } from '../../rate-limit-store-BEJnhWdw.js';
 
-/**
- * T4.1 — Per-request CSP nonce generation.
- *
- * Returns a 22–24 character base64-encoded string carrying 16 bytes of
- * cryptographic entropy. Used by the SSR pipeline to nonce the inline
- * hydration data script so the default CSP can drop `'unsafe-inline'`
- * from `script-src` in 0.3.0.
- *
- * Runtime portability: prefers Web Crypto (`globalThis.crypto`) because
- * it is available on every target runtime (Node 19+, Bun, Deno, Vercel
- * Edge, Cloudflare Workers). Falls back to `node:crypto` for older Node
- * builds where `globalThis.crypto` is absent.
- *
- * NOT a security primitive in the cryptographic sense — the nonce is a
- * one-shot, single-request value that defeats trivial XSS injection by
- * making the attacker guess a 128-bit string per request. It is NOT
- * suitable for signing or session tokens.
- */
-declare function generateNonce(): string;
-
 declare class AuthRequiredError extends Error {
     code: "AUTH_REQUIRED";
     status: number;
@@ -416,4 +397,4 @@ declare function clearOidcCache(): void;
  */
 declare function discoverOidcProvider(issuer: string | URL): Promise<OidcMetadata>;
 
-export { AuthRequiredError, type BackupCode, type BackupCodeOptions, type OidcMetadata, type PkceChallenge, type SessionConfig, type SessionManager, type SessionManagerWeb, type SessionMeta, type ThrottleOptions, type ThrottleState, type TotpAlgorithm, type TotpOptions, type TotpUriOptions, type VerifyTotpOptions, _resetKeyCacheForTests, assertProductionSecret, checkThrottle, clearOidcCache, createSessionManager, createSessionManagerWeb, decrypt, discoverOidcProvider, encrypt, generateBackupCodes, generateNonce, generateOAuthState, generatePkceChallenge, generateTotp, generateTotpSecret, pkceChallengeFromVerifier, recordAttempt, requireAuth, rotateIfNeeded, rotateIfNeededWeb, totpUri, verifyBackupCode, verifyOAuthState, verifyTotp };
+export { AuthRequiredError, type BackupCode, type BackupCodeOptions, type OidcMetadata, type PkceChallenge, type SessionConfig, type SessionManager, type SessionManagerWeb, type SessionMeta, type ThrottleOptions, type ThrottleState, type TotpAlgorithm, type TotpOptions, type TotpUriOptions, type VerifyTotpOptions, _resetKeyCacheForTests, assertProductionSecret, checkThrottle, clearOidcCache, createSessionManager, createSessionManagerWeb, decrypt, discoverOidcProvider, encrypt, generateBackupCodes, generateOAuthState, generatePkceChallenge, generateTotp, generateTotpSecret, pkceChallengeFromVerifier, recordAttempt, requireAuth, rotateIfNeeded, rotateIfNeededWeb, totpUri, verifyBackupCode, verifyOAuthState, verifyTotp };

package/dist/server/auth/index.js

@@ -23,11 +23,12 @@ import {
   verifyBackupCode,
   verifyOAuthState,
   verifyTotp
-} from "../../chunk-646CA6RV.js";
+} from "../../chunk-RQW5YMH7.js";
 import "../../chunk-4FWBKX6G.js";
+import "../../chunk-YSJOZEI6.js";
 import {
   generateNonce
-} from "../../chunk-JA2ZAT5Q.js";
+} from "../../chunk-Z4PJMZLM.js";
 import "../../chunk-XTHN6JBX.js";
 export {
   AuthRequiredError,

package/dist/server/cron/index.js

@@ -14,11 +14,12 @@ import {
   translateCronToVercel,
   validateCronSchedule,
   writeCronManifest
-} from "../../chunk-LXAESF4Y.js";
+} from "../../chunk-HK4AZBKX.js";
 import "../../chunk-VZTYCAO6.js";
-import "../../chunk-RWNSW4FM.js";
+import "../../chunk-UMNXCU3K.js";
 import "../../chunk-52PDWL5S.js";
-import "../../chunk-U267AOWS.js";
+import "../../chunk-5K4TDLRG.js";
+import "../../chunk-ZWN3AODA.js";
 import "../../chunk-XTHN6JBX.js";
 export {
   CRON_MANIFEST_SCHEMA_VERSION,